source3/smbd/service.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    service (connection) opening and closing
   4    Copyright (C) Andrew Tridgell 1992-1998
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21
  22 extern userdom_struct current_user_info;
  23
  24 static bool canonicalize_connect_path(connection_struct *conn)
  25 {
  26 #ifdef REALPATH_TAKES_NULL
  27         bool ret;
  28         char *resolved_name = SMB_VFS_REALPATH(conn,conn->connectpath,NULL);
  29         if (!resolved_name) {
  30                 return false;
  31         }
  32         ret = set_conn_connectpath(conn,resolved_name);
  33         SAFE_FREE(resolved_name);
  34         return ret;
  35 #else
  36         char resolved_name_buf[PATH_MAX+1];
  37         char *resolved_name = SMB_VFS_REALPATH(conn,conn->connectpath,resolved_name_buf);
  38         if (!resolved_name) {
  39                 return false;
  40         }
  41         return set_conn_connectpath(conn,resolved_name);
  42 #endif /* REALPATH_TAKES_NULL */
  43 }
  44
  45 /****************************************************************************
  46  Ensure when setting connectpath it is a canonicalized (no ./ // or ../)
  47  absolute path stating in / and not ending in /.
  48  Observent people will notice a similarity between this and check_path_syntax :-).
  49 ****************************************************************************/
  50
  51 bool set_conn_connectpath(connection_struct *conn, const char *connectpath)
  52 {
  53         char *destname;
  54         char *d;
  55         const char *s = connectpath;
  56         bool start_of_name_component = true;
  57
  58         destname = SMB_STRDUP(connectpath);
  59         if (!destname) {
  60                 return false;
  61         }
  62         d = destname;
  63
  64         *d++ = '/'; /* Always start with root. */
  65
  66         while (*s) {
  67                 if (*s == '/') {
  68                         /* Eat multiple '/' */
  69                         while (*s == '/') {
  70                                 s++;
  71                         }
  72                         if ((d > destname + 1) && (*s != '\0')) {
  73                                 *d++ = '/';
  74                         }
  75                         start_of_name_component = True;
  76                         continue;
  77                 }
  78
  79                 if (start_of_name_component) {
  80                         if ((s[0] == '.') && (s[1] == '.') && (s[2] == '/' || s[2] == '\0')) {
  81                                 /* Uh oh - "/../" or "/..\0" ! */
  82
  83                                 /* Go past the ../ or .. */
  84                                 if (s[2] == '/') {
  85                                         s += 3;
  86                                 } else {
  87                                         s += 2; /* Go past the .. */
  88                                 }
  89
  90                                 /* If  we just added a '/' - delete it */
  91                                 if ((d > destname) && (*(d-1) == '/')) {
  92                                         *(d-1) = '\0';
  93                                         d--;
  94                                 }
  95
  96                                 /* Are we at the start ? Can't go back further if so. */
  97                                 if (d <= destname) {
  98                                         *d++ = '/'; /* Can't delete root */
  99                                         continue;
 100                                 }
 101                                 /* Go back one level... */
 102                                 /* Decrement d first as d points to the *next* char to write into. */
 103                                 for (d--; d > destname; d--) {
 104                                         if (*d == '/') {
 105                                                 break;
 106                                         }
 107                                 }
 108                                 /* We're still at the start of a name component, just the previous one. */
 109                                 continue;
 110                         } else if ((s[0] == '.') && ((s[1] == '\0') || s[1] == '/')) {
 111                                 /* Component of pathname can't be "." only - skip the '.' . */
 112                                 if (s[1] == '/') {
 113                                         s += 2;
 114                                 } else {
 115                                         s++;
 116                                 }
 117                                 continue;
 118                         }
 119                 }
 120
 121                 if (!(*s & 0x80)) {
 122                         *d++ = *s++;
 123                 } else {
 124                         size_t siz;
 125                         /* Get the size of the next MB character. */
 126                         next_codepoint(s,&siz);
 127                         switch(siz) {
 128                                 case 5:
 129                                         *d++ = *s++;
 130                                         /*fall through*/
 131                                 case 4:
 132                                         *d++ = *s++;
 133                                         /*fall through*/
 134                                 case 3:
 135                                         *d++ = *s++;
 136                                         /*fall through*/
 137                                 case 2:
 138                                         *d++ = *s++;
 139                                         /*fall through*/
 140                                 case 1:
 141                                         *d++ = *s++;
 142                                         break;
 143                                 default:
 144                                         break;
 145                         }
 146                 }
 147                 start_of_name_component = false;
 148         }
 149         *d = '\0';
 150
 151         /* And must not end in '/' */
 152         if (d > destname + 1 && (*(d-1) == '/')) {
 153                 *(d-1) = '\0';
 154         }
 155
 156         DEBUG(10,("set_conn_connectpath: service %s, connectpath = %s\n",
 157                 lp_servicename(SNUM(conn)), destname ));
 158
 159         string_set(&conn->connectpath, destname);
 160         SAFE_FREE(destname);
 161         return true;
 162 }
 163
 164 /****************************************************************************
 165  Load parameters specific to a connection/service.
 166 ****************************************************************************/
 167
 168 bool set_current_service(connection_struct *conn, uint16 flags, bool do_chdir)
 169 {
 170         static connection_struct *last_conn;
 171         static uint16 last_flags;
 172         int snum;
 173
 174         if (!conn)  {
 175                 last_conn = NULL;
 176                 return(False);
 177         }
 178
 179         conn->lastused_count++;
 180
 181         snum = SNUM(conn);
 182
 183         if (do_chdir &&
 184             vfs_ChDir(conn,conn->connectpath) != 0 &&
 185             vfs_ChDir(conn,conn->origpath) != 0) {
 186                 DEBUG(0,("chdir (%s) failed\n",
 187                          conn->connectpath));
 188                 return(False);
 189         }
 190
 191         if ((conn == last_conn) && (last_flags == flags)) {
 192                 return(True);
 193         }
 194
 195         last_conn = conn;
 196         last_flags = flags;
 197
 198         /* Obey the client case sensitivity requests - only for clients that support it. */
 199         switch (lp_casesensitive(snum)) {
 200                 case Auto:
 201                         {
 202                                 /* We need this uglyness due to DOS/Win9x clients that lie about case insensitivity. */
 203                                 enum remote_arch_types ra_type = get_remote_arch();
 204                                 if ((ra_type != RA_SAMBA) && (ra_type != RA_CIFSFS)) {
 205                                         /* Client can't support per-packet case sensitive pathnames. */
 206                                         conn->case_sensitive = False;
 207                                 } else {
 208                                         conn->case_sensitive = !(flags & FLAG_CASELESS_PATHNAMES);
 209                                 }
 210                         }
 211                         break;
 212                 case True:
 213                         conn->case_sensitive = True;
 214                         break;
 215                 default:
 216                         conn->case_sensitive = False;
 217                         break;
 218         }
 219         return(True);
 220 }
 221
 222 static int load_registry_service(const char *servicename)
 223 {
 224         struct registry_key *key;
 225         char *path;
 226         WERROR err;
 227
 228         uint32 i;
 229         char *value_name;
 230         struct registry_value *value;
 231
 232         int res = -1;
 233
 234         if (!lp_registry_shares()) {
 235                 return -1;
 236         }
 237
 238         if (asprintf(&path, "%s\\%s", KEY_SMBCONF, servicename) == -1) {
 239                 return -1;
 240         }
 241
 242         err = reg_open_path(NULL, path, REG_KEY_READ, get_root_nt_token(),
 243                             &key);
 244         SAFE_FREE(path);
 245
 246         if (!W_ERROR_IS_OK(err)) {
 247                 return -1;
 248         }
 249
 250         res = lp_add_service(servicename, -1);
 251         if (res == -1) {
 252                 goto error;
 253         }
 254
 255         for (i=0;
 256              W_ERROR_IS_OK(reg_enumvalue(key, key, i, &value_name, &value));
 257              i++) {
 258                 switch (value->type) {
 259                 case REG_DWORD: {
 260                         char *tmp;
 261                         if (asprintf(&tmp, "%d", value->v.dword) == -1) {
 262                                 continue;
 263                         }
 264                         lp_do_parameter(res, value_name, tmp);
 265                         SAFE_FREE(tmp);
 266                         break;
 267                 }
 268                 case REG_SZ: {
 269                         lp_do_parameter(res, value_name, value->v.sz.str);
 270                         break;
 271                 }
 272                 default:
 273                         /* Ignore all the rest */
 274                         break;
 275                 }
 276
 277                 TALLOC_FREE(value_name);
 278                 TALLOC_FREE(value);
 279         }
 280
 281  error:
 282
 283         TALLOC_FREE(key);
 284         return res;
 285 }
 286
 287 void load_registry_shares(void)
 288 {
 289         struct registry_key *key;
 290         char *name;
 291         WERROR err;
 292         int i;
 293
 294         if (!lp_registry_shares()) {
 295                 return;
 296         }
 297
 298         err = reg_open_path(NULL, KEY_SMBCONF, REG_KEY_READ,
 299                             get_root_nt_token(), &key);
 300         if (!(W_ERROR_IS_OK(err))) {
 301                 return;
 302         }
 303
 304         for (i=0; W_ERROR_IS_OK(reg_enumkey(key, key, i, &name, NULL)); i++) {
 305                 load_registry_service(name);
 306                 TALLOC_FREE(name);
 307         }
 308
 309         TALLOC_FREE(key);
 310         return;
 311 }
 312
 313 /****************************************************************************
 314  Add a home service. Returns the new service number or -1 if fail.
 315 ****************************************************************************/
 316
 317 int add_home_service(const char *service, const char *username, const char *homedir)
 318 {
 319         int iHomeService;
 320
 321         if (!service || !homedir)
 322                 return -1;
 323
 324         if ((iHomeService = lp_servicenumber(HOMES_NAME)) < 0) {
 325                 if ((iHomeService = load_registry_service(HOMES_NAME)) < 0) {
 326                         return -1;
 327                 }
 328         }
 329
 330         /*
 331          * If this is a winbindd provided username, remove
 332          * the domain component before adding the service.
 333          * Log a warning if the "path=" parameter does not
 334          * include any macros.
 335          */
 336
 337         {
 338                 const char *p = strchr(service,*lp_winbind_separator());
 339
 340                 /* We only want the 'user' part of the string */
 341                 if (p) {
 342                         service = p + 1;
 343                 }
 344         }
 345
 346         if (!lp_add_home(service, iHomeService, username, homedir)) {
 347                 return -1;
 348         }
 349
 350         return lp_servicenumber(service);
 351
 352 }
 353
 354 /**
 355  * Find a service entry.
 356  *
 357  * @param service is modified (to canonical form??)
 358  **/
 359
 360 int find_service(fstring service)
 361 {
 362         int iService;
 363
 364         all_string_sub(service,"\\","/",0);
 365
 366         iService = lp_servicenumber(service);
 367
 368         /* now handle the special case of a home directory */
 369         if (iService < 0) {
 370                 char *phome_dir = get_user_home_dir(talloc_tos(), service);
 371
 372                 if(!phome_dir) {
 373                         /*
 374                          * Try mapping the servicename, it may
 375                          * be a Windows to unix mapped user name.
 376                          */
 377                         if(map_username(service))
 378                                 phome_dir = get_user_home_dir(
 379                                         talloc_tos(), service);
 380                 }
 381
 382                 DEBUG(3,("checking for home directory %s gave %s\n",service,
 383                         phome_dir?phome_dir:"(NULL)"));
 384
 385                 iService = add_home_service(service,service /* 'username' */, phome_dir);
 386         }
 387
 388         /* If we still don't have a service, attempt to add it as a printer. */
 389         if (iService < 0) {
 390                 int iPrinterService;
 391
 392                 if ((iPrinterService = lp_servicenumber(PRINTERS_NAME)) < 0) {
 393                         iPrinterService = load_registry_service(PRINTERS_NAME);
 394                 }
 395                 if (iPrinterService) {
 396                         DEBUG(3,("checking whether %s is a valid printer name...\n", service));
 397                         if (pcap_printername_ok(service)) {
 398                                 DEBUG(3,("%s is a valid printer name\n", service));
 399                                 DEBUG(3,("adding %s as a printer service\n", service));
 400                                 lp_add_printer(service, iPrinterService);
 401                                 iService = lp_servicenumber(service);
 402                                 if (iService < 0) {
 403                                         DEBUG(0,("failed to add %s as a printer service!\n", service));
 404                                 }
 405                         } else {
 406                                 DEBUG(3,("%s is not a valid printer name\n", service));
 407                         }
 408                 }
 409         }
 410
 411         /* Check for default vfs service?  Unsure whether to implement this */
 412         if (iService < 0) {
 413         }
 414
 415         if (iService < 0) {
 416                 iService = load_registry_service(service);
 417         }
 418
 419         /* Is it a usershare service ? */
 420         if (iService < 0 && *lp_usershare_path()) {
 421                 /* Ensure the name is canonicalized. */
 422                 strlower_m(service);
 423                 iService = load_usershare_service(service);
 424         }
 425
 426         /* just possibly it's a default service? */
 427         if (iService < 0) {
 428                 char *pdefservice = lp_defaultservice();
 429                 if (pdefservice && *pdefservice && !strequal(pdefservice,service) && !strstr_m(service,"..")) {
 430                         /*
 431                          * We need to do a local copy here as lp_defaultservice()
 432                          * returns one of the rotating lp_string buffers that
 433                          * could get overwritten by the recursive find_service() call
 434                          * below. Fix from Josef Hinteregger <joehtg@joehtg.co.at>.
 435                          */
 436                         char *defservice = SMB_STRDUP(pdefservice);
 437
 438                         if (!defservice) {
 439                                 goto fail;
 440                         }
 441
 442                         /* Disallow anything except explicit share names. */
 443                         if (strequal(defservice,HOMES_NAME) ||
 444                                         strequal(defservice, PRINTERS_NAME) ||
 445                                         strequal(defservice, "IPC$")) {
 446                                 SAFE_FREE(defservice);
 447                                 goto fail;
 448                         }
 449
 450                         iService = find_service(defservice);
 451                         if (iService >= 0) {
 452                                 all_string_sub(service, "_","/",0);
 453                                 iService = lp_add_service(service, iService);
 454                         }
 455                         SAFE_FREE(defservice);
 456                 }
 457         }
 458
 459         if (iService >= 0) {
 460                 if (!VALID_SNUM(iService)) {
 461                         DEBUG(0,("Invalid snum %d for %s\n",iService, service));
 462                         iService = -1;
 463                 }
 464         }
 465
 466   fail:
 467
 468         if (iService < 0)
 469                 DEBUG(3,("find_service() failed to find service %s\n", service));
 470
 471         return (iService);
 472 }
 473
 474
 475 /****************************************************************************
 476  do some basic sainity checks on the share.
 477  This function modifies dev, ecode.
 478 ****************************************************************************/
 479
 480 static NTSTATUS share_sanity_checks(int snum, fstring dev)
 481 {
 482
 483         if (!lp_snum_ok(snum) ||
 484             !check_access(smbd_server_fd(),
 485                           lp_hostsallow(snum), lp_hostsdeny(snum))) {
 486                 return NT_STATUS_ACCESS_DENIED;
 487         }
 488
 489         if (dev[0] == '?' || !dev[0]) {
 490                 if (lp_print_ok(snum)) {
 491                         fstrcpy(dev,"LPT1:");
 492                 } else if (strequal(lp_fstype(snum), "IPC")) {
 493                         fstrcpy(dev, "IPC");
 494                 } else {
 495                         fstrcpy(dev,"A:");
 496                 }
 497         }
 498
 499         strupper_m(dev);
 500
 501         if (lp_print_ok(snum)) {
 502                 if (!strequal(dev, "LPT1:")) {
 503                         return NT_STATUS_BAD_DEVICE_TYPE;
 504                 }
 505         } else if (strequal(lp_fstype(snum), "IPC")) {
 506                 if (!strequal(dev, "IPC")) {
 507                         return NT_STATUS_BAD_DEVICE_TYPE;
 508                 }
 509         } else if (!strequal(dev, "A:")) {
 510                 return NT_STATUS_BAD_DEVICE_TYPE;
 511         }
 512
 513         /* Behave as a printer if we are supposed to */
 514         if (lp_print_ok(snum) && (strcmp(dev, "A:") == 0)) {
 515                 fstrcpy(dev, "LPT1:");
 516         }
 517
 518         return NT_STATUS_OK;
 519 }
 520
 521 static NTSTATUS find_forced_user(connection_struct *conn, bool vuser_is_guest, fstring username)
 522 {
 523         int snum = conn->params->service;
 524         char *fuser, *found_username;
 525         NTSTATUS result;
 526
 527         if (!(fuser = talloc_string_sub(conn->mem_ctx, lp_force_user(snum), "%S",
 528                                         lp_servicename(snum)))) {
 529                 return NT_STATUS_NO_MEMORY;
 530         }
 531
 532         result = create_token_from_username(conn->mem_ctx, fuser, vuser_is_guest,
 533                                             &conn->uid, &conn->gid, &found_username,
 534                                             &conn->nt_user_token);
 535         if (!NT_STATUS_IS_OK(result)) {
 536                 return result;
 537         }
 538
 539         fstrcpy(username, found_username);
 540
 541         TALLOC_FREE(fuser);
 542         TALLOC_FREE(found_username);
 543         return NT_STATUS_OK;
 544 }
 545
 546 /*
 547  * Go through lookup_name etc to find the force'd group.
 548  *
 549  * Create a new token from src_token, replacing the primary group sid with the
 550  * one found.
 551  */
 552
 553 static NTSTATUS find_forced_group(bool force_user,
 554                                   int snum, const char *username,
 555                                   DOM_SID *pgroup_sid,
 556                                   gid_t *pgid)
 557 {
 558         NTSTATUS result = NT_STATUS_NO_SUCH_GROUP;
 559         TALLOC_CTX *mem_ctx;
 560         DOM_SID group_sid;
 561         enum lsa_SidType type;
 562         char *groupname;
 563         bool user_must_be_member = False;
 564         gid_t gid;
 565
 566         ZERO_STRUCTP(pgroup_sid);
 567         *pgid = (gid_t)-1;
 568
 569         mem_ctx = talloc_new(NULL);
 570         if (mem_ctx == NULL) {
 571                 DEBUG(0, ("talloc_new failed\n"));
 572                 return NT_STATUS_NO_MEMORY;
 573         }
 574
 575         groupname = talloc_strdup(mem_ctx, lp_force_group(snum));
 576         if (groupname == NULL) {
 577                 DEBUG(1, ("talloc_strdup failed\n"));
 578                 result = NT_STATUS_NO_MEMORY;
 579                 goto done;
 580         }
 581
 582         if (groupname[0] == '+') {
 583                 user_must_be_member = True;
 584                 groupname += 1;
 585         }
 586
 587         groupname = talloc_string_sub(mem_ctx, groupname,
 588                                       "%S", lp_servicename(snum));
 589
 590         if (!lookup_name_smbconf(mem_ctx, groupname,
 591                          LOOKUP_NAME_ALL|LOOKUP_NAME_GROUP,
 592                          NULL, NULL, &group_sid, &type)) {
 593                 DEBUG(10, ("lookup_name_smbconf(%s) failed\n",
 594                            groupname));
 595                 goto done;
 596         }
 597
 598         if ((type != SID_NAME_DOM_GRP) && (type != SID_NAME_ALIAS) &&
 599             (type != SID_NAME_WKN_GRP)) {
 600                 DEBUG(10, ("%s is a %s, not a group\n", groupname,
 601                            sid_type_lookup(type)));
 602                 goto done;
 603         }
 604
 605         if (!sid_to_gid(&group_sid, &gid)) {
 606                 DEBUG(10, ("sid_to_gid(%s) for %s failed\n",
 607                            sid_string_dbg(&group_sid), groupname));
 608                 goto done;
 609         }
 610
 611         /*
 612          * If the user has been forced and the forced group starts with a '+',
 613          * then we only set the group to be the forced group if the forced
 614          * user is a member of that group.  Otherwise, the meaning of the '+'
 615          * would be ignored.
 616          */
 617
 618         if (force_user && user_must_be_member) {
 619                 if (user_in_group_sid(username, &group_sid)) {
 620                         sid_copy(pgroup_sid, &group_sid);
 621                         *pgid = gid;
 622                         DEBUG(3,("Forced group %s for member %s\n",
 623                                  groupname, username));
 624                 } else {
 625                         DEBUG(0,("find_forced_group: forced user %s is not a member "
 626                                 "of forced group %s. Disallowing access.\n",
 627                                 username, groupname ));
 628                         result = NT_STATUS_MEMBER_NOT_IN_GROUP;
 629                         goto done;
 630                 }
 631         } else {
 632                 sid_copy(pgroup_sid, &group_sid);
 633                 *pgid = gid;
 634                 DEBUG(3,("Forced group %s\n", groupname));
 635         }
 636
 637         result = NT_STATUS_OK;
 638  done:
 639         TALLOC_FREE(mem_ctx);
 640         return result;
 641 }
 642
 643 /****************************************************************************
 644   Make a connection, given the snum to connect to, and the vuser of the
 645   connecting user if appropriate.
 646 ****************************************************************************/
 647
 648 static connection_struct *make_connection_snum(int snum, user_struct *vuser,
 649                                                DATA_BLOB password,
 650                                                const char *pdev,
 651                                                NTSTATUS *status)
 652 {
 653         struct passwd *pass = NULL;
 654         bool guest = False;
 655         connection_struct *conn;
 656         SMB_STRUCT_STAT st;
 657         fstring user;
 658         fstring dev;
 659         int ret;
 660         char addr[INET6_ADDRSTRLEN];
 661         bool on_err_call_dis_hook = false;
 662
 663         *user = 0;
 664         fstrcpy(dev, pdev);
 665         SET_STAT_INVALID(st);
 666
 667         if (NT_STATUS_IS_ERR(*status = share_sanity_checks(snum, dev))) {
 668                 return NULL;
 669         }
 670
 671         conn = conn_new();
 672         if (!conn) {
 673                 DEBUG(0,("Couldn't find free connection.\n"));
 674                 *status = NT_STATUS_INSUFFICIENT_RESOURCES;
 675                 return NULL;
 676         }
 677
 678         conn->params->service = snum;
 679         conn->nt_user_token = NULL;
 680
 681         if (lp_guest_only(snum)) {
 682                 const char *guestname = lp_guestaccount();
 683                 NTSTATUS status2;
 684                 char *found_username = NULL;
 685
 686                 guest = True;
 687                 pass = getpwnam_alloc(NULL, guestname);
 688                 if (!pass) {
 689                         DEBUG(0,("make_connection_snum: Invalid guest "
 690                                  "account %s??\n",guestname));
 691                         conn_free(conn);
 692                         *status = NT_STATUS_NO_SUCH_USER;
 693                         return NULL;
 694                 }
 695                 status2 = create_token_from_username(conn->mem_ctx, pass->pw_name, True,
 696                                                      &conn->uid, &conn->gid,
 697                                                      &found_username,
 698                                                      &conn->nt_user_token);
 699                 if (!NT_STATUS_IS_OK(status2)) {
 700                         TALLOC_FREE(pass);
 701                         conn_free(conn);
 702                         *status = status2;
 703                         return NULL;
 704                 }
 705                 fstrcpy(user, found_username);
 706                 string_set(&conn->user,user);
 707                 conn->force_user = True;
 708                 TALLOC_FREE(found_username);
 709                 TALLOC_FREE(pass);
 710                 DEBUG(3,("Guest only user %s\n",user));
 711         } else if (vuser) {
 712                 if (vuser->guest) {
 713                         if (!lp_guest_ok(snum)) {
 714                                 DEBUG(2, ("guest user (from session setup) "
 715                                           "not permitted to access this share "
 716                                           "(%s)\n", lp_servicename(snum)));
 717                                       conn_free(conn);
 718                                       *status = NT_STATUS_ACCESS_DENIED;
 719                                       return NULL;
 720                         }
 721                 } else {
 722                         if (!user_ok_token(vuser->user.unix_name,
 723                                            vuser->nt_user_token, snum)) {
 724                                 DEBUG(2, ("user '%s' (from session setup) not "
 725                                           "permitted to access this share "
 726                                           "(%s)\n", vuser->user.unix_name,
 727                                           lp_servicename(snum)));
 728                                 conn_free(conn);
 729                                 *status = NT_STATUS_ACCESS_DENIED;
 730                                 return NULL;
 731                         }
 732                 }
 733                 conn->vuid = vuser->vuid;
 734                 conn->uid = vuser->uid;
 735                 conn->gid = vuser->gid;
 736                 string_set(&conn->user,vuser->user.unix_name);
 737                 fstrcpy(user,vuser->user.unix_name);
 738                 guest = vuser->guest;
 739         } else if (lp_security() == SEC_SHARE) {
 740                 NTSTATUS status2;
 741                 char *found_username = NULL;
 742
 743                 /* add it as a possible user name if we
 744                    are in share mode security */
 745                 add_session_user(lp_servicename(snum));
 746                 /* shall we let them in? */
 747                 if (!authorise_login(snum,user,password,&guest)) {
 748                         DEBUG( 2, ( "Invalid username/password for [%s]\n",
 749                                     lp_servicename(snum)) );
 750                         conn_free(conn);
 751                         *status = NT_STATUS_WRONG_PASSWORD;
 752                         return NULL;
 753                 }
 754                 pass = Get_Pwnam_alloc(talloc_tos(), user);
 755                 status2 = create_token_from_username(conn->mem_ctx, pass->pw_name, True,
 756                                                      &conn->uid, &conn->gid,
 757                                                      &found_username,
 758                                                      &conn->nt_user_token);
 759                 TALLOC_FREE(pass);
 760                 if (!NT_STATUS_IS_OK(status2)) {
 761                         conn_free(conn);
 762                         *status = status2;
 763                         return NULL;
 764                 }
 765                 fstrcpy(user, found_username);
 766                 string_set(&conn->user,user);
 767                 TALLOC_FREE(found_username);
 768                 conn->force_user = True;
 769         } else {
 770                 DEBUG(0, ("invalid VUID (vuser) but not in security=share\n"));
 771                 conn_free(conn);
 772                 *status = NT_STATUS_ACCESS_DENIED;
 773                 return NULL;
 774         }
 775
 776         add_session_user(user);
 777
 778         safe_strcpy(conn->client_address,
 779                         client_addr(get_client_fd(),addr,sizeof(addr)),
 780                         sizeof(conn->client_address)-1);
 781         conn->num_files_open = 0;
 782         conn->lastused = conn->lastused_count = time(NULL);
 783         conn->used = True;
 784         conn->printer = (strncmp(dev,"LPT",3) == 0);
 785         conn->ipc = ( (strncmp(dev,"IPC",3) == 0) ||
 786                       ( lp_enable_asu_support() && strequal(dev,"ADMIN$")) );
 787         conn->dirptr = NULL;
 788
 789         /* Case options for the share. */
 790         if (lp_casesensitive(snum) == Auto) {
 791                 /* We will be setting this per packet. Set to be case
 792                  * insensitive for now. */
 793                 conn->case_sensitive = False;
 794         } else {
 795                 conn->case_sensitive = (bool)lp_casesensitive(snum);
 796         }
 797
 798         conn->case_preserve = lp_preservecase(snum);
 799         conn->short_case_preserve = lp_shortpreservecase(snum);
 800
 801         conn->encrypt_level = lp_smb_encrypt(snum);
 802
 803         conn->veto_list = NULL;
 804         conn->hide_list = NULL;
 805         conn->veto_oplock_list = NULL;
 806         conn->aio_write_behind_list = NULL;
 807         string_set(&conn->dirpath,"");
 808         string_set(&conn->user,user);
 809
 810         conn->read_only = lp_readonly(SNUM(conn));
 811         conn->admin_user = False;
 812
 813         /*
 814          * If force user is true, then store the given userid and the gid of
 815          * the user we're forcing.
 816          * For auxiliary groups see below.
 817          */
 818
 819         if (*lp_force_user(snum)) {
 820                 NTSTATUS status2;
 821
 822                 status2 = find_forced_user(conn,
 823                                 (vuser != NULL) && vuser->guest,
 824                                 user);
 825                 if (!NT_STATUS_IS_OK(status2)) {
 826                         conn_free(conn);
 827                         *status = status2;
 828                         return NULL;
 829                 }
 830                 string_set(&conn->user,user);
 831                 conn->force_user = True;
 832                 DEBUG(3,("Forced user %s\n",user));
 833         }
 834
 835         /*
 836          * If force group is true, then override
 837          * any groupid stored for the connecting user.
 838          */
 839
 840         if (*lp_force_group(snum)) {
 841                 NTSTATUS status2;
 842                 DOM_SID group_sid;
 843
 844                 status2 = find_forced_group(conn->force_user,
 845                                             snum, user,
 846                                             &group_sid, &conn->gid);
 847                 if (!NT_STATUS_IS_OK(status2)) {
 848                         conn_free(conn);
 849                         *status = status2;
 850                         return NULL;
 851                 }
 852
 853                 if ((conn->nt_user_token == NULL) && (vuser != NULL)) {
 854
 855                         /* Not force user and not security=share, but force
 856                          * group. vuser has a token to copy */
 857
 858                         conn->nt_user_token = dup_nt_token(
 859                                 NULL, vuser->nt_user_token);
 860                         if (conn->nt_user_token == NULL) {
 861                                 DEBUG(0, ("dup_nt_token failed\n"));
 862                                 conn_free(conn);
 863                                 *status = NT_STATUS_NO_MEMORY;
 864                                 return NULL;
 865                         }
 866                 }
 867
 868                 /* If conn->nt_user_token is still NULL, we have
 869                  * security=share. This means ignore the SID, as we had no
 870                  * vuser to copy from */
 871
 872                 if (conn->nt_user_token != NULL) {
 873                         /* Overwrite the primary group sid */
 874                         sid_copy(&conn->nt_user_token->user_sids[1],
 875                                  &group_sid);
 876
 877                 }
 878                 conn->force_group = True;
 879         }
 880
 881         if (conn->nt_user_token != NULL) {
 882                 size_t i;
 883
 884                 /* We have a share-specific token from force [user|group].
 885                  * This means we have to create the list of unix groups from
 886                  * the list of sids. */
 887
 888                 conn->ngroups = 0;
 889                 conn->groups = NULL;
 890
 891                 for (i=0; i<conn->nt_user_token->num_sids; i++) {
 892                         gid_t gid;
 893                         DOM_SID *sid = &conn->nt_user_token->user_sids[i];
 894
 895                         if (!sid_to_gid(sid, &gid)) {
 896                                 DEBUG(10, ("Could not convert SID %s to gid, "
 897                                            "ignoring it\n",
 898                                            sid_string_dbg(sid)));
 899                                 continue;
 900                         }
 901                         if (!add_gid_to_array_unique(conn->mem_ctx, gid, &conn->groups,
 902                                                 &conn->ngroups)) {
 903                                 DEBUG(0, ("add_gid_to_array_unique failed\n"));
 904                                 conn_free(conn);
 905                                 *status = NT_STATUS_NO_MEMORY;
 906                                 return NULL;
 907                         }
 908                 }
 909         }
 910
 911         {
 912                 char *s = talloc_sub_advanced(talloc_tos(),
 913                                         lp_servicename(SNUM(conn)), conn->user,
 914                                         conn->connectpath, conn->gid,
 915                                         get_current_username(),
 916                                         current_user_info.domain,
 917                                         lp_pathname(snum));
 918                 if (!s) {
 919                         conn_free(conn);
 920                         *status = NT_STATUS_NO_MEMORY;
 921                         return NULL;
 922                 }
 923
 924                 if (!set_conn_connectpath(conn,s)) {
 925                         TALLOC_FREE(s);
 926                         conn_free(conn);
 927                         *status = NT_STATUS_NO_MEMORY;
 928                         return NULL;
 929                 }
 930                 DEBUG(3,("Connect path is '%s' for service [%s]\n",s,
 931                          lp_servicename(snum)));
 932                 TALLOC_FREE(s);
 933         }
 934
 935         /*
 936          * New code to check if there's a share security descripter
 937          * added from NT server manager. This is done after the
 938          * smb.conf checks are done as we need a uid and token. JRA.
 939          *
 940          */
 941
 942         {
 943                 bool can_write = False;
 944                 NT_USER_TOKEN *token = conn->nt_user_token ?
 945                         conn->nt_user_token :
 946                         (vuser ? vuser->nt_user_token : NULL);
 947
 948                 /*
 949                  * I don't believe this can happen. But the
 950                  * logic above is convoluted enough to confuse
 951                  * automated checkers, so be sure. JRA.
 952                  */
 953
 954                 if (token == NULL) {
 955                         DEBUG(0,("make_connection: connection to %s "
 956                                  "denied due to missing "
 957                                  "NT token.\n",
 958                                   lp_servicename(snum)));
 959                         conn_free(conn);
 960                         *status = NT_STATUS_ACCESS_DENIED;
 961                         return NULL;
 962                 }
 963
 964                 can_write = share_access_check(token,
 965                                                     lp_servicename(snum),
 966                                                     FILE_WRITE_DATA);
 967
 968                 if (!can_write) {
 969                         if (!share_access_check(token,
 970                                                 lp_servicename(snum),
 971                                                 FILE_READ_DATA)) {
 972                                 /* No access, read or write. */
 973                                 DEBUG(0,("make_connection: connection to %s "
 974                                          "denied due to security "
 975                                          "descriptor.\n",
 976                                           lp_servicename(snum)));
 977                                 conn_free(conn);
 978                                 *status = NT_STATUS_ACCESS_DENIED;
 979                                 return NULL;
 980                         } else {
 981                                 conn->read_only = True;
 982                         }
 983                 }
 984         }
 985         /* Initialise VFS function pointers */
 986
 987         if (!smbd_vfs_init(conn)) {
 988                 DEBUG(0, ("vfs_init failed for service %s\n",
 989                           lp_servicename(snum)));
 990                 conn_free(conn);
 991                 *status = NT_STATUS_BAD_NETWORK_NAME;
 992                 return NULL;
 993         }
 994
 995         /*
 996          * If widelinks are disallowed we need to canonicalise the connect
 997          * path here to ensure we don't have any symlinks in the
 998          * connectpath. We will be checking all paths on this connection are
 999          * below this directory. We must do this after the VFS init as we
1000          * depend on the realpath() pointer in the vfs table. JRA.
1001          */
1002         if (!lp_widelinks(snum)) {
1003                 if (!canonicalize_connect_path(conn)) {
1004                         DEBUG(0, ("canonicalize_connect_path failed "
1005                         "for service %s, path %s\n",
1006                                 lp_servicename(snum),
1007                                 conn->connectpath));
1008                         conn_free(conn);
1009                         *status = NT_STATUS_BAD_NETWORK_NAME;
1010                         return NULL;
1011                 }
1012         }
1013
1014         if ((!conn->printer) && (!conn->ipc)) {
1015                 conn->notify_ctx = notify_init(conn->mem_ctx, server_id_self(),
1016                                                smbd_messaging_context(),
1017                                                smbd_event_context(),
1018                                                conn);
1019         }
1020
1021 /* ROOT Activities: */
1022         /*
1023          * Enforce the max connections parameter.
1024          */
1025
1026         if ((lp_max_connections(snum) > 0)
1027             && (count_current_connections(lp_servicename(SNUM(conn)), True) >=
1028                 lp_max_connections(snum))) {
1029
1030                 DEBUG(1, ("Max connections (%d) exceeded for %s\n",
1031                           lp_max_connections(snum), lp_servicename(snum)));
1032                 conn_free(conn);
1033                 *status = NT_STATUS_INSUFFICIENT_RESOURCES;
1034                 return NULL;
1035         }
1036
1037         /*
1038          * Get us an entry in the connections db
1039          */
1040         if (!claim_connection(conn, lp_servicename(snum), 0)) {
1041                 DEBUG(1, ("Could not store connections entry\n"));
1042                 conn_free(conn);
1043                 *status = NT_STATUS_INTERNAL_DB_ERROR;
1044                 return NULL;
1045         }
1046
1047         /* Preexecs are done here as they might make the dir we are to ChDir
1048          * to below */
1049         /* execute any "root preexec = " line */
1050         if (*lp_rootpreexec(snum)) {
1051                 char *cmd = talloc_sub_advanced(talloc_tos(),
1052                                         lp_servicename(SNUM(conn)), conn->user,
1053                                         conn->connectpath, conn->gid,
1054                                         get_current_username(),
1055                                         current_user_info.domain,
1056                                         lp_rootpreexec(snum));
1057                 DEBUG(5,("cmd=%s\n",cmd));
1058                 ret = smbrun(cmd,NULL);
1059                 TALLOC_FREE(cmd);
1060                 if (ret != 0 && lp_rootpreexec_close(snum)) {
1061                         DEBUG(1,("root preexec gave %d - failing "
1062                                  "connection\n", ret));
1063                         yield_connection(conn, lp_servicename(snum));
1064                         conn_free(conn);
1065                         *status = NT_STATUS_ACCESS_DENIED;
1066                         return NULL;
1067                 }
1068         }
1069
1070 /* USER Activites: */
1071         if (!change_to_user(conn, conn->vuid)) {
1072                 /* No point continuing if they fail the basic checks */
1073                 DEBUG(0,("Can't become connected user!\n"));
1074                 yield_connection(conn, lp_servicename(snum));
1075                 conn_free(conn);
1076                 *status = NT_STATUS_LOGON_FAILURE;
1077                 return NULL;
1078         }
1079
1080         /* Remember that a different vuid can connect later without these
1081          * checks... */
1082
1083         /* Preexecs are done here as they might make the dir we are to ChDir
1084          * to below */
1085
1086         /* execute any "preexec = " line */
1087         if (*lp_preexec(snum)) {
1088                 char *cmd = talloc_sub_advanced(talloc_tos(),
1089                                         lp_servicename(SNUM(conn)), conn->user,
1090                                         conn->connectpath, conn->gid,
1091                                         get_current_username(),
1092                                         current_user_info.domain,
1093                                         lp_preexec(snum));
1094                 ret = smbrun(cmd,NULL);
1095                 TALLOC_FREE(cmd);
1096                 if (ret != 0 && lp_preexec_close(snum)) {
1097                         DEBUG(1,("preexec gave %d - failing connection\n",
1098                                  ret));
1099                         *status = NT_STATUS_ACCESS_DENIED;
1100                         goto err_root_exit;
1101                 }
1102         }
1103
1104 #ifdef WITH_FAKE_KASERVER
1105         if (lp_afs_share(snum)) {
1106                 afs_login(conn);
1107         }
1108 #endif
1109
1110         /* Add veto/hide lists */
1111         if (!IS_IPC(conn) && !IS_PRINT(conn)) {
1112                 set_namearray( &conn->veto_list, lp_veto_files(snum));
1113                 set_namearray( &conn->hide_list, lp_hide_files(snum));
1114                 set_namearray( &conn->veto_oplock_list, lp_veto_oplocks(snum));
1115         }
1116
1117         /* Invoke VFS make connection hook - do this before the VFS_STAT call
1118            to allow any filesystems needing user credentials to initialize
1119            themselves. */
1120
1121         if (SMB_VFS_CONNECT(conn, lp_servicename(snum), user) < 0) {
1122                 DEBUG(0,("make_connection: VFS make connection failed!\n"));
1123                 *status = NT_STATUS_UNSUCCESSFUL;
1124                 goto err_root_exit;
1125         }
1126
1127         /* Any error exit after here needs to call the disconnect hook. */
1128         on_err_call_dis_hook = true;
1129
1130         /* win2000 does not check the permissions on the directory
1131            during the tree connect, instead relying on permission
1132            check during individual operations. To match this behaviour
1133            I have disabled this chdir check (tridge) */
1134         /* the alternative is just to check the directory exists */
1135         if ((ret = SMB_VFS_STAT(conn, conn->connectpath, &st)) != 0 ||
1136             !S_ISDIR(st.st_mode)) {
1137                 if (ret == 0 && !S_ISDIR(st.st_mode)) {
1138                         DEBUG(0,("'%s' is not a directory, when connecting to "
1139                                  "[%s]\n", conn->connectpath,
1140                                  lp_servicename(snum)));
1141                 } else {
1142                         DEBUG(0,("'%s' does not exist or permission denied "
1143                                  "when connecting to [%s] Error was %s\n",
1144                                  conn->connectpath, lp_servicename(snum),
1145                                  strerror(errno) ));
1146                 }
1147                 *status = NT_STATUS_BAD_NETWORK_NAME;
1148                 goto err_root_exit;
1149         }
1150
1151         string_set(&conn->origpath,conn->connectpath);
1152
1153 #if SOFTLINK_OPTIMISATION
1154         /* resolve any soft links early if possible */
1155         if (vfs_ChDir(conn,conn->connectpath) == 0) {
1156                 TALLOC_CTX *ctx = talloc_tos();
1157                 char *s = vfs_GetWd(ctx,s);
1158                 if (!s) {
1159                         *status = map_nt_error_from_unix(errno);
1160                         goto err_root_exit;
1161                 }
1162                 if (!set_conn_connectpath(conn,s)) {
1163                         *status = NT_STATUS_NO_MEMORY;
1164                         goto err_root_exit;
1165                 }
1166                 vfs_ChDir(conn,conn->connectpath);
1167         }
1168 #endif
1169
1170         /* Figure out the characteristics of the underlying filesystem. This
1171          * assumes that all the filesystem mounted withing a share path have
1172          * the same characteristics, which is likely but not guaranteed.
1173          */
1174
1175         conn->fs_capabilities = SMB_VFS_FS_CAPABILITIES(conn);
1176
1177         /*
1178          * Print out the 'connected as' stuff here as we need
1179          * to know the effective uid and gid we will be using
1180          * (at least initially).
1181          */
1182
1183         if( DEBUGLVL( IS_IPC(conn) ? 3 : 1 ) ) {
1184                 dbgtext( "%s (%s) ", get_remote_machine_name(),
1185                          conn->client_address );
1186                 dbgtext( "%s", srv_is_signing_active() ? "signed " : "");
1187                 dbgtext( "connect to service %s ", lp_servicename(snum) );
1188                 dbgtext( "initially as user %s ", user );
1189                 dbgtext( "(uid=%d, gid=%d) ", (int)geteuid(), (int)getegid() );
1190                 dbgtext( "(pid %d)\n", (int)sys_getpid() );
1191         }
1192
1193         /* we've finished with the user stuff - go back to root */
1194         change_to_root_user();
1195         return(conn);
1196
1197   err_root_exit:
1198
1199         change_to_root_user();
1200         if (on_err_call_dis_hook) {
1201                 /* Call VFS disconnect hook */
1202                 SMB_VFS_DISCONNECT(conn);
1203         }
1204         yield_connection(conn, lp_servicename(snum));
1205         conn_free(conn);
1206         return NULL;
1207 }
1208
1209 /***************************************************************************************
1210  Simple wrapper function for make_connection() to include a call to
1211  vfs_chdir()
1212  **************************************************************************************/
1213
1214 connection_struct *make_connection_with_chdir(const char *service_in,
1215                                               DATA_BLOB password,
1216                                               const char *dev, uint16 vuid,
1217                                               NTSTATUS *status)
1218 {
1219         connection_struct *conn = NULL;
1220
1221         conn = make_connection(service_in, password, dev, vuid, status);
1222
1223         /*
1224          * make_connection() does not change the directory for us any more
1225          * so we have to do it as a separate step  --jerry
1226          */
1227
1228         if ( conn && vfs_ChDir(conn,conn->connectpath) != 0 ) {
1229                 DEBUG(0,("move_driver_to_download_area: Can't change "
1230                          "directory to %s for [print$] (%s)\n",
1231                          conn->connectpath,strerror(errno)));
1232                 yield_connection(conn, lp_servicename(SNUM(conn)));
1233                 conn_free(conn);
1234                 *status = NT_STATUS_UNSUCCESSFUL;
1235                 return NULL;
1236         }
1237
1238         return conn;
1239 }
1240
1241 /****************************************************************************
1242  Make a connection to a service.
1243  *
1244  * @param service
1245 ****************************************************************************/
1246
1247 connection_struct *make_connection(const char *service_in, DATA_BLOB password,
1248                                    const char *pdev, uint16 vuid,
1249                                    NTSTATUS *status)
1250 {
1251         uid_t euid;
1252         user_struct *vuser = NULL;
1253         fstring service;
1254         fstring dev;
1255         int snum = -1;
1256         char addr[INET6_ADDRSTRLEN];
1257
1258         fstrcpy(dev, pdev);
1259
1260         /* This must ONLY BE CALLED AS ROOT. As it exits this function as
1261          * root. */
1262         if (!non_root_mode() && (euid = geteuid()) != 0) {
1263                 DEBUG(0,("make_connection: PANIC ERROR. Called as nonroot "
1264                          "(%u)\n", (unsigned int)euid ));
1265                 smb_panic("make_connection: PANIC ERROR. Called as nonroot\n");
1266         }
1267
1268         if (conn_num_open() > 2047) {
1269                 *status = NT_STATUS_INSUFF_SERVER_RESOURCES;
1270                 return NULL;
1271         }
1272
1273         if(lp_security() != SEC_SHARE) {
1274                 vuser = get_valid_user_struct(vuid);
1275                 if (!vuser) {
1276                         DEBUG(1,("make_connection: refusing to connect with "
1277                                  "no session setup\n"));
1278                         *status = NT_STATUS_ACCESS_DENIED;
1279                         return NULL;
1280                 }
1281         }
1282
1283         /* Logic to try and connect to the correct [homes] share, preferably
1284            without too many getpwnam() lookups.  This is particulary nasty for
1285            winbind usernames, where the share name isn't the same as unix
1286            username.
1287
1288            The snum of the homes share is stored on the vuser at session setup
1289            time.
1290         */
1291
1292         if (strequal(service_in,HOMES_NAME)) {
1293                 if(lp_security() != SEC_SHARE) {
1294                         DATA_BLOB no_pw = data_blob_null;
1295                         if (vuser->homes_snum == -1) {
1296                                 DEBUG(2, ("[homes] share not available for "
1297                                           "this user because it was not found "
1298                                           "or created at session setup "
1299                                           "time\n"));
1300                                 *status = NT_STATUS_BAD_NETWORK_NAME;
1301                                 return NULL;
1302                         }
1303                         DEBUG(5, ("making a connection to [homes] service "
1304                                   "created at session setup time\n"));
1305                         return make_connection_snum(vuser->homes_snum,
1306                                                     vuser, no_pw,
1307                                                     dev, status);
1308                 } else {
1309                         /* Security = share. Try with
1310                          * current_user_info.smb_name as the username.  */
1311                         if (*current_user_info.smb_name) {
1312                                 fstring unix_username;
1313                                 fstrcpy(unix_username,
1314                                         current_user_info.smb_name);
1315                                 map_username(unix_username);
1316                                 snum = find_service(unix_username);
1317                         }
1318                         if (snum != -1) {
1319                                 DEBUG(5, ("making a connection to 'homes' "
1320                                           "service %s based on "
1321                                           "security=share\n", service_in));
1322                                 return make_connection_snum(snum, NULL,
1323                                                             password,
1324                                                             dev, status);
1325                         }
1326                 }
1327         } else if ((lp_security() != SEC_SHARE) && (vuser->homes_snum != -1)
1328                    && strequal(service_in,
1329                                lp_servicename(vuser->homes_snum))) {
1330                 DATA_BLOB no_pw = data_blob_null;
1331                 DEBUG(5, ("making a connection to 'homes' service [%s] "
1332                           "created at session setup time\n", service_in));
1333                 return make_connection_snum(vuser->homes_snum,
1334                                             vuser, no_pw,
1335                                             dev, status);
1336         }
1337
1338         fstrcpy(service, service_in);
1339
1340         strlower_m(service);
1341
1342         snum = find_service(service);
1343
1344         if (snum < 0) {
1345                 if (strequal(service,"IPC$") ||
1346                     (lp_enable_asu_support() && strequal(service,"ADMIN$"))) {
1347                         DEBUG(3,("refusing IPC connection to %s\n", service));
1348                         *status = NT_STATUS_ACCESS_DENIED;
1349                         return NULL;
1350                 }
1351
1352                 DEBUG(0,("%s (%s) couldn't find service %s\n",
1353                         get_remote_machine_name(),
1354                         client_addr(get_client_fd(),addr,sizeof(addr)),
1355                         service));
1356                 *status = NT_STATUS_BAD_NETWORK_NAME;
1357                 return NULL;
1358         }
1359
1360         /* Handle non-Dfs clients attempting connections to msdfs proxy */
1361         if (lp_host_msdfs() && (*lp_msdfs_proxy(snum) != '\0'))  {
1362                 DEBUG(3, ("refusing connection to dfs proxy share '%s' "
1363                           "(pointing to %s)\n",
1364                         service, lp_msdfs_proxy(snum)));
1365                 *status = NT_STATUS_BAD_NETWORK_NAME;
1366                 return NULL;
1367         }
1368
1369         DEBUG(5, ("making a connection to 'normal' service %s\n", service));
1370
1371         return make_connection_snum(snum, vuser,
1372                                     password,
1373                                     dev, status);
1374 }
1375
1376 /****************************************************************************
1377  Close a cnum.
1378 ****************************************************************************/
1379
1380 void close_cnum(connection_struct *conn, uint16 vuid)
1381 {
1382         if (IS_IPC(conn)) {
1383                 pipe_close_conn(conn);
1384         } else {
1385                 file_close_conn(conn);
1386                 dptr_closecnum(conn);
1387         }
1388
1389         change_to_root_user();
1390
1391         DEBUG(IS_IPC(conn)?3:1, ("%s (%s) closed connection to service %s\n",
1392                                  get_remote_machine_name(),
1393                                  conn->client_address,
1394                                  lp_servicename(SNUM(conn))));
1395
1396         /* Call VFS disconnect hook */
1397         SMB_VFS_DISCONNECT(conn);
1398
1399         yield_connection(conn, lp_servicename(SNUM(conn)));
1400
1401         /* make sure we leave the directory available for unmount */
1402         vfs_ChDir(conn, "/");
1403
1404         /* execute any "postexec = " line */
1405         if (*lp_postexec(SNUM(conn)) &&
1406             change_to_user(conn, vuid))  {
1407                 char *cmd = talloc_sub_advanced(talloc_tos(),
1408                                         lp_servicename(SNUM(conn)), conn->user,
1409                                         conn->connectpath, conn->gid,
1410                                         get_current_username(),
1411                                         current_user_info.domain,
1412                                         lp_postexec(SNUM(conn)));
1413                 smbrun(cmd,NULL);
1414                 TALLOC_FREE(cmd);
1415                 change_to_root_user();
1416         }
1417
1418         change_to_root_user();
1419         /* execute any "root postexec = " line */
1420         if (*lp_rootpostexec(SNUM(conn)))  {
1421                 char *cmd = talloc_sub_advanced(talloc_tos(),
1422                                         lp_servicename(SNUM(conn)), conn->user,
1423                                         conn->connectpath, conn->gid,
1424                                         get_current_username(),
1425                                         current_user_info.domain,
1426                                         lp_rootpostexec(SNUM(conn)));
1427                 smbrun(cmd,NULL);
1428                 TALLOC_FREE(cmd);
1429         }
1430
1431         conn_free(conn);
1432 }