From: Volker Lendecke <vl@samba.org>
Date: Wed, 6 Feb 2019 16:02:53 +0000 (+0100)
Subject: smbd: Avoid sending S-1-22- to winbind
X-Git-Tag: ldb-1.6.1~205
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c516394ed90a52bc8712de845a16c7293ef7fbda;p=thirdparty%2Fsamba.git

smbd: Avoid sending S-1-22- to winbind

Sending S-1-22-x to a typeless sids2xids call will make winbind prime
the reverse xids2sids cache, which is very likely the wrong mapping. Add
a check that avoids bothering the winbind pipe when it's clear this
can't work anyway.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Mulder <dmulder@suse.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
---

diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c
index 6bda783fa03..bf3ded6683e 100644
--- a/source3/passdb/lookup_sid.c
+++ b/source3/passdb/lookup_sid.c
@@ -1489,6 +1489,12 @@ bool sid_to_uid(const struct dom_sid *psid, uid_t *puid)
 		return true;
 	}
 
+	if (sid_check_is_in_unix_groups(psid)) {
+		DBG_DEBUG("SID %s is a group, failing\n",
+			  dom_sid_str_buf(psid, &buf));
+		return false;
+	}
+
 	/* Check the winbindd cache directly. */
 	ret = idmap_cache_find_sid2uid(psid, puid, &expired);
 
@@ -1545,6 +1551,12 @@ bool sid_to_gid(const struct dom_sid *psid, gid_t *pgid)
 		return true;
 	}
 
+	if (sid_check_is_in_unix_users(psid)) {
+		DBG_DEBUG("SID %s is a user, failing\n",
+			  dom_sid_str_buf(psid, &buf));
+		return false;
+	}
+
 	/* Check the winbindd cache directly. */
 	ret = idmap_cache_find_sid2gid(psid, pgid, &expired);