From: Björn Baumbach <bb@sernet.de>
Date: Tue, 4 Sep 2018 13:29:58 +0000 (+0200)
Subject: pysmbd: add option to pass a session info to set_nt_acl() function
X-Git-Tag: tdb-1.3.17~1334
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ab558fa14c296b90f182ea4f53b2fb410d851837;p=thirdparty%2Fsamba.git

pysmbd: add option to pass a session info to set_nt_acl() function

A filled session info is needed by some vfs modules, e.g. full_audit.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Volker Lendecke <vl@samba.org>
---

diff --git a/python/samba/ntacls.py b/python/samba/ntacls.py
index 3ce27f32600..838152ad6e0 100644
--- a/python/samba/ntacls.py
+++ b/python/samba/ntacls.py
@@ -93,7 +93,13 @@ def getdosinfo(lp, file):
     return ndr_unpack(xattr.DOSATTRIB, attribute)
 
 
-def getntacl(lp, file, backend=None, eadbfile=None, direct_db_access=True, service=None):
+def getntacl(lp,
+             file,
+             backend=None,
+             eadbfile=None,
+             direct_db_access=True,
+             service=None,
+             session_info=None):
     if direct_db_access:
         (backend_obj, dbname) = checkset_backend(lp, backend, eadbfile)
         if dbname is not None:
@@ -119,7 +125,10 @@ def getntacl(lp, file, backend=None, eadbfile=None, direct_db_access=True, servi
         elif ntacl.version == 4:
             return ntacl.info.sd
     else:
-        return smbd.get_nt_acl(file, SECURITY_SECINFO_FLAGS, service=service)
+        return smbd.get_nt_acl(file,
+                               SECURITY_SECINFO_FLAGS,
+                               service=service,
+                               session_info=session_info)
 
 
 def setntacl(lp, file, sddl, domsid,
diff --git a/source3/smbd/pysmbd.c b/source3/smbd/pysmbd.c
index 1431925efd0..25667198840 100644
--- a/source3/smbd/pysmbd.c
+++ b/source3/smbd/pysmbd.c
@@ -31,6 +31,9 @@
 #include "librpc/rpc/pyrpc_util.h"
 #include <pytalloc.h>
 #include "system/filesys.h"
+#include "passdb.h"
+#include "secrets.h"
+#include "auth.h"
 
 extern const struct generic_mapping file_generic_mapping;
 
@@ -622,22 +625,55 @@ static PyObject *py_smbd_set_nt_acl(PyObject *self, PyObject *args, PyObject *kw
  */
 static PyObject *py_smbd_get_nt_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 {
-	const char * const kwnames[] = { "fname", "security_info_wanted", "service", NULL };
+	const char * const kwnames[] = { "fname",
+					 "security_info_wanted",
+					 "service",
+					 "session_info",
+					 NULL };
 	char *fname, *service = NULL;
 	int security_info_wanted;
 	PyObject *py_sd;
 	struct security_descriptor *sd;
 	TALLOC_CTX *frame = talloc_stackframe();
+	PyObject *py_session = Py_None;
+	struct auth_session_info *session_info = NULL;
 	connection_struct *conn;
 	NTSTATUS status;
+	int ret = 1;
 
-	if (!PyArg_ParseTupleAndKeywords(args, kwargs, "si|z", discard_const_p(char *, kwnames),
-					 &fname, &security_info_wanted, &service)) {
+	ret = PyArg_ParseTupleAndKeywords(args,
+					  kwargs,
+					  "si|zO",
+					  discard_const_p(char *, kwnames),
+					  &fname,
+					  &security_info_wanted,
+					  &service,
+					  &py_session);
+	if (!ret) {
 		TALLOC_FREE(frame);
 		return NULL;
 	}
 
-	conn = get_conn_tos(service, NULL);
+	if (py_session != Py_None) {
+		if (!py_check_dcerpc_type(py_session,
+					  "samba.dcerpc.auth",
+					  "session_info")) {
+			TALLOC_FREE(frame);
+			return NULL;
+		}
+		session_info = pytalloc_get_type(py_session,
+						 struct auth_session_info);
+		if (!session_info) {
+			PyErr_Format(
+				PyExc_TypeError,
+				"Expected auth_session_info for "
+				"session_info argument got %s",
+				talloc_get_name(pytalloc_get_ptr(py_session)));
+			return NULL;
+		}
+	}
+
+	conn = get_conn_tos(service, session_info);
 	if (!conn) {
 		TALLOC_FREE(frame);
 		return NULL;