Simo Sorce [Wed, 22 Apr 2009 13:12:58 +0000 (09:12 -0400)]
Fix profile acls in some corner cases
Always add back the real original owner of the directory in the ACE List after
we steal its ACE for the Administrators group.
(cherry picked from commit 8e438431a1447fd482c107fbe0aee3af49afe068)
Simo Sorce [Wed, 22 Apr 2009 10:15:21 +0000 (06:15 -0400)]
Avoid duplicate aces
When adding arbitrary aces to an nt_ace_list we need to make sure we
are not actually adding a duplicate.
add_or_replace_ace() takes care of doing the right thing.
(cherry picked from commit 958207e321f330426536bf7e936b30fa2efffddc)
Jeremy Allison [Wed, 22 Apr 2009 09:24:27 +0000 (02:24 -0700)]
Fix bug #6279 - winbindd crash. Cope with LDAP libraries returning LDAP_SUCCESS but not returning a result.
Jeremy
(cherry picked from commit e7687dd9ca244a53fdf2312a78cdb028dd8971d5)
Michael Adam [Fri, 17 Apr 2009 09:40:17 +0000 (11:40 +0200)]
s3:registry: Prevent creation of keys containing the '/' character.
Even though "net conf setparm abc/def comment xyz" does not
create a broken registry we do not want such keys to be created.
Since we get problems accessing these with "net registry" since
the registry code treats the '/' sign as a separator as a lower
level.
This makes e.g. "net conf setparm abc/def comment xyz" fail with
WERR_INVALID_PARAM, which is much more desirable than a broken
registry.tdb.
Jeremy Allison [Wed, 15 Apr 2009 21:09:32 +0000 (14:09 -0700)]
Fix bug #6089 - Winbind samr_OpenDomain not possible with Samba 3.2.6+
What a difference a name makes... :-). Just because something is missnamed
SA_RIGHT_SAM_OPEN_DOMAIN, when it should actually be SA_RIGHT_SAM_LOOKUP_DOMAIN,
don't automatically use it for a security check in _samr_OpenDomain().
Jeremy.
(cherry picked from commit 3591c95beaed3abfa10b1579e377b0103647a177)
Jeremy Allison [Fri, 10 Apr 2009 05:46:31 +0000 (22:46 -0700)]
Fix bug #6254 - PUT/GET produces an error in IPv6 to a smb-server(3.3)
has parameter "msdfs root = yes"
This was broken by the refactoring around create_file().
MSDFS pathname processing must be done FIRST.
MSDFS pathnames containing IPv6 addresses can
be confused with NTFS stream names (they contain
":" characters.
Jeremy.
(cherry picked from commit eb29aa406f14397e3c55e559e2c02da6eb6c4cbd)
Volker Lendecke [Sat, 28 Mar 2009 18:58:45 +0000 (19:58 +0100)]
Fix smbd crash for close_on_completion
handle_trans() can talloc_free "conn" if the client requests
close_on_completion. "state" is a talloc_child of conn, so it will be gone when
we later free state->data et al.
(cherry picked from commit 51ecc77eeabe5fc89e4d1b1fb8a15c71614d4049)
Jeremy Allison [Thu, 2 Apr 2009 03:14:35 +0000 (20:14 -0700)]
Allow pdbedit to change a user rid/sid. Based on a fix from Alexander
Zagrebin <alexz@visp.ru>.
Jeremy.
(cherry picked from commit 5b43fff78081541f642b07a70b03c6d5902e42dd)
Michael Adam [Wed, 1 Apr 2009 10:23:07 +0000 (12:23 +0200)]
s3: fix the fix for bug #6195 - dont let smbd child processes panic
This patch makes sure the original and temporary TDBs are closed
_before_ the rename. Originally, the open TDB was renamed, and so
the name passdb.tdb.tmp stayed around in the db context. Hence
upon client connect, the smbd children died because reinit_after_fork()
calling tdb_reopen_all() would try to reopen passdb.tdb.tmp which
existed no longer...
Jeremy Allison [Mon, 30 Mar 2009 22:09:10 +0000 (15:09 -0700)]
Ensure files starting with multiple dots are hidden
if "hide dot files" is set. Thanks to Barry Kelly <bkelly.ie@gmail.com>
for pointing this one out.
Jeremy.
(cherry picked from commit 5bdc16a867b9c14682b327c79f79834edcd6842d)
Jeremy Allison [Sat, 28 Mar 2009 04:26:56 +0000 (21:26 -0700)]
Fix the problem of 3.0.x passdb databases being version
3 but using a different hash calculation than 3.2.x passwd
databases (also version 3). Introduces a minor version
number.
Jeremy.
(cherry picked from commit 10b518592e616ecfaadd829ecd0674a04510b422)
Derrell Lipman [Fri, 27 Mar 2009 21:10:04 +0000 (17:10 -0400)]
[Bug 6228] SMBC_open_ctx failure due to path resolve failure doesn't set errno
Fixed.
It turns out there were a number of places where cli_resolve_path() was called
and the error path upon that function failing did not set errno. There were a
couple of places the failure handling code did set errno to ENOENT, so I made
them all consistent, although I think better errno choices for this condition
exist, e.g. EHOSTUNREACH.
Jeremy Allison [Fri, 27 Mar 2009 19:09:51 +0000 (12:09 -0700)]
Fix bug #6195 - Migrating from 3.0.x to 3.3.x can fail to update passdb.tdb correctly. For the clustering case.
Clustered setups should have only ever used
the unsigned version of TDB_DATA in the
first place so they can't be in this mess :-).
Just do the normal upgrade in the clustered case.
Jeremy.
(cherry picked from commit 52fe104996439db24a7e6b17baa7fec47ba230bb)
Jeremy Allison [Thu, 26 Mar 2009 22:33:39 +0000 (15:33 -0700)]
Try and fix the build farm RAW-STREAMS errors. Ordering of
modules shouldn't matter, so as vfs_streams_depot doesn't
implement get/setxattrs then call into the full VFS stack
at the top.
Jeremy
(cherry picked from commit a1d9b31a0c8a38dbfa94f578830d5d35695aff3b)
Jeremy Allison [Thu, 26 Mar 2009 19:13:28 +0000 (12:13 -0700)]
Fix bug #6224 - nmbd waits 5 minutes at startup before checking if it needs to run elections
Fix logic bug that causes nmbd to wait 5 minutes before
looking for a master browser. This one is *old* :-). Thanks
for Simo for bugging me on this.
Jeremy.
(cherry picked from commit 857c2e4407a0f4fcee721372ffed5366bc3051f9)
Günther Deschner [Wed, 25 Mar 2009 16:06:57 +0000 (17:06 +0100)]
s3-net: Fix Bug #6193: avoid messing with sync_context in fetch_database_to_ldif().
We absolutely need to avoid messing with the sync_context as that breaks the
stream of replication data coming from the DC (only replicates ~350 instead of
~4000 groups).
s3:libsmb: fix smb signing for fragmented trans/trans2/nttrans requests
Before we send the secondary requests we need to remove the
old mid=>seqnum mapping and reset cli->mid and make the new
mid=>seqnum mapping "persistent".
The bug we had in cli_send_trans was this:
The first cli_send_smb() incremented cli->mid
and the secondary requests used the incremented mid,
but as cli->outbuf still had the correct mid,
we send the correct mid to the server. The real problem
was that the cli_send_smb() function stored the seqnum
under the wrong mid.
cli_send_nttrans() was totally broken and now follows the
same logic as cli_send_trans().
The good thing is that in practice the problem is unlikely to happen,
because max_xmit is large enough to avoid secondary requests.
Jeremy Allison [Thu, 19 Mar 2009 03:54:13 +0000 (20:54 -0700)]
Allow DFS client paths to work when POSIX pathnames have been
selected (we need to path in pathname /that/look/like/this).
Jeremy.
(cherry picked from commit 0c11c2deee7ab9d281df6df91b793b7f1c1764a4)
Jeremy Allison [Thu, 19 Mar 2009 02:58:01 +0000 (19:58 -0700)]
Fix bug #6196 - Unable to serve files with colons to Linux CIFS/VFS client
Looks like the pathname parsing for POSIX paths got
broken when the code for doing Windows streams parsing got added.
Jeremy.
(cherry picked from commit 985ba585207e840caa17c3d87d93ef1ba5f15cbb)
Jeremy Allison [Wed, 18 Mar 2009 21:31:01 +0000 (14:31 -0700)]
Fix bug 6195 - Migrating from 3.0.x to 3.3.x can fail to update passdb.tdb correctly.
This is a really nasty one to fix as in order to successfully update the
passdb.tdb we must do the equivalent of a tdbbackup to move to the new hash
values before we do the upgrade.
Jeremy.
(cherry picked from commit b5d794d5de872bcf757c8021c103b6b3d320b8db)
Andrew Tridgell [Tue, 10 Mar 2009 05:45:45 +0000 (16:45 +1100)]
fixed a bug in message handling for code the change notify code
The change notify code registered a separate message handler for each
tree connect. This registration uses the global messaging context.
The messaging code would consider a 2nd registration for the same
messaging type as being an 'update' of the handler, rather than a new
handler. It also would only call the first handler in the linked list
for a given message type when dispatching messages.
This patch changes the messaging code to allow for multiple
registrations of the same message type, and allow for multiple calls
to different messaging handler for one incoming message.
Jeremy Allison [Fri, 6 Mar 2009 05:02:22 +0000 (21:02 -0800)]
Now we're allowing a lower bound for auth_len, ensure we
also check for an upper one (integer wrap).
Jeremy.
(cherry picked from commit f58a6c9e08b2b44399e0333b1358522aec70bbee)
Jeremy Allison [Fri, 6 Mar 2009 01:16:54 +0000 (17:16 -0800)]
Fix bug #6161 - smbclient corrupts source path in tar mode
This was my fault. I broke the smbclient tar argument processing
in creating the string for chdir when removing pstrings.
Jeremy.
(cherry picked from commit 750f9d94b0a1208d45cc117df68042e1d83044bf)
Volker Lendecke [Thu, 5 Mar 2009 23:12:55 +0000 (15:12 -0800)]
Complete the fix for bug 6100
According to [MS-RPCE].pdf, section 2.2.2.11:
----
A client or a server that (during composing of a PDU) has allocated more space
for the authentication token than the security provider fills in SHOULD fill in
the rest of the allocated space with zero octets. These zero octets are still
considered to belong to the authentication token part of the PDU.<36>
----
RPC implementations are allowed to send padding bytes at the end of an auth
footer. Windows 7 makes use of this.
Steven Danneman [Fri, 27 Feb 2009 16:35:18 +0000 (08:35 -0800)]
s3: fix guest auth when winbindd is running
This fix is very subtle. If a server is configured with "security = share"
and "guest ok = yes" and winbindd is running authorization will fail during
tree connect.
This is due to our inability to map the guest sid S-1-5-21-X-501 to a uid
through sid_to_uid(). Winbindd is unaware of the hard coded mapping
between this sid and whatever uid the name in lp_guestaccount() is assigned.
So sid_to_uid() fails and we exit create_token_from_username() without
ever calling pdb_getsampwsid() which IS aware of the hard coded mapping.
This patch just reorganizes the code, moving sid_to_uid() down to the
block of code in which it is needed, avoiding this early failure.
(cherry picked from commit 671812696217fe1337562b661d5131be79797f1c)
Jeremy Allison [Wed, 25 Feb 2009 22:55:19 +0000 (14:55 -0800)]
Fix more POSIX path lstat calls. Fix bug where close can return
failure if we have a pending modtime and the containing directory
of the file has been renamed (there is no POSIX "update time by
fd" call). This can't happen on Windows as the rename will fail
if there are open files beneath it. Will add a torture test
for this.
Jeremy.
(cherry picked from commit 5fb3b5e903c08013074ba473399ddee30f6c328f)
Jeremy Allison [Wed, 25 Feb 2009 01:59:19 +0000 (17:59 -0800)]
Allow set attributes on a stream fnum to be redirected to the base filename.
Fixes the new RAW-STREAMS torture test.
Jeremy.
(cherry picked from commit 73d0c3143eedb5a9fd4d154aaf42d20ba6a19a1f)
Steve French [Tue, 24 Feb 2009 23:10:19 +0000 (17:10 -0600)]
Fix guest mounts
guest session setup, login (user id) as anonymous.
This patch is for samba bugzilla bug 4640.
Signed-off-by: Shirish Pargaonkar <shirishp@us.ibm.com> Acked-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve French <sfrench@samba.org>
(cherry picked from commit 5e6b019d70fef2ad082fc414053c131294bdeb49)
Jeremy Allison [Fri, 20 Feb 2009 16:25:29 +0000 (08:25 -0800)]
Fix bug #6133 - Cannot delete non-ACL files on Solaris/ZFS/NFSv4 ACL filesystem.
As the NFSv4 ACL mapping code doesn't map write directory into the DELETE_CHILD
permission bit (which we require before allowing a delete) no one can delete
files without an explicit DELETE_CHILD bit set on the directory. Add this mapping.
Jeremy.
(cherry picked from commit 44e0e830c4c413054bdb30a62629993c4391c492)
Jeremy Allison [Thu, 19 Feb 2009 19:55:56 +0000 (11:55 -0800)]
Backport the semantics of when to delete alternate data streams on a file truncate.
Needed to fully support stream semantics.
Jeremy.
(cherry picked from commit cdcb9bbf47396a7213edafeabb009920bb4e16b7)
Volker Lendecke [Thu, 19 Feb 2009 13:16:44 +0000 (14:16 +0100)]
Fix a buffer handling bug when adding lots of registry keys
This is *ancient*... From 2002, and nobody noticed until someone added lots of
shares using net conf... :-)
(cherry picked from commit 36ae846d15027df5e3a02ffabb08183dad9f6517)
Jeremy Allison [Tue, 17 Feb 2009 23:55:23 +0000 (15:55 -0800)]
Don't miss an absolute pathname as a kerberos keytab path. From Glenn Machin <gmachin@sandia.gov>.
Jeremy.
(cherry picked from commit 9974c09608d61244133eea8615c37184b0cac57b)