From bc053abdd1df343eb4bf0eeff52bebc2dcbd7a30 Mon Sep 17 00:00:00 2001 From: Ralph Boehme Date: Mon, 11 Mar 2019 18:11:04 +0100 Subject: [PATCH] s3-mdssvc: call [un]become_authenticated_pipe_user() This ensures we're running as the authenticated user int the tevent callback which might be running in an arbitrary impersonation context. Signed-off-by: Ralph Boehme Reviewed-by: Noel Power --- source3/rpc_server/mdssvc/mdssvc.c | 23 ++++++++++++++++++++++- source3/rpc_server/mdssvc/mdssvc.h | 3 ++- 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/source3/rpc_server/mdssvc/mdssvc.c b/source3/rpc_server/mdssvc/mdssvc.c index ea676f48681..f03cb9d7ebd 100644 --- a/source3/rpc_server/mdssvc/mdssvc.c +++ b/source3/rpc_server/mdssvc/mdssvc.c @@ -810,20 +810,39 @@ static void tracker_cursor_cb(GObject *object, return; } + /* + * We're in a tevent callback which means in the case of + * running as external RPC service we're running as root and + * not as the user. + */ + if (!become_authenticated_pipe_user(slq->mds_ctx->pipe_session_info)) { + DBG_ERR("can't become authenticated user: %d\n", slq->mds_ctx->uid); + smb_panic("can't become authenticated user"); + } + if (geteuid() != slq->mds_ctx->uid) { DEBUG(0, ("uid mismatch: %d/%d\n", geteuid(), slq->mds_ctx->uid)); smb_panic("uid mismatch"); } + /* + * We've changed identity to the authenticated pipe user, so + * any function exit below must ensure we switch back + */ + result = sys_stat(path, &sb, false); if (result != 0) { + unbecome_authenticated_pipe_user(); goto done; } result = access(path, R_OK); if (result != 0) { + unbecome_authenticated_pipe_user(); goto done; } + unbecome_authenticated_pipe_user(); + ino64 = sb.st_ex_ino; if (slq->cnids) { /* @@ -1823,7 +1842,7 @@ static gboolean gmainloop_timer(gpointer user_data) **/ struct mds_ctx *mds_init_ctx(TALLOC_CTX *mem_ctx, struct tevent_context *ev, - const struct auth_session_info *session_info, + struct auth_session_info *session_info, const char *path) { struct mds_ctx *mds_ctx; @@ -1839,6 +1858,8 @@ struct mds_ctx *mds_init_ctx(TALLOC_CTX *mem_ctx, goto error; } + mds_ctx->pipe_session_info = session_info; + if (session_info->security_token->num_sids < 1) { goto error; } diff --git a/source3/rpc_server/mdssvc/mdssvc.h b/source3/rpc_server/mdssvc/mdssvc.h index 310e59582ed..e1b1ccfc34d 100644 --- a/source3/rpc_server/mdssvc/mdssvc.h +++ b/source3/rpc_server/mdssvc/mdssvc.h @@ -97,6 +97,7 @@ struct sl_inode_path_map { }; struct mds_ctx { + struct auth_session_info *pipe_session_info; struct dom_sid sid; uid_t uid; const char *spath; @@ -119,7 +120,7 @@ extern bool mds_init(struct messaging_context *msg_ctx); extern bool mds_shutdown(void); extern struct mds_ctx *mds_init_ctx(TALLOC_CTX *mem_ctx, struct tevent_context *ev, - const struct auth_session_info *session_info, + struct auth_session_info *session_info, const char *path); extern int mds_ctx_destructor_cb(struct mds_ctx *mds_ctx); extern bool mds_dispatch(struct mds_ctx *query_ctx, -- 2.47.3