Attachment 11281 Details for Bug 11320 – Proposed fix

[patch] Proposed fix

0001-s3-passdb-Respect-LOOKUP_NAME_GROUP-flag-in-sid-look.patch (text/plain), 2.25 KB, created by Justin Maggard on 2015-07-21 22:30:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Justin Maggard

Created: 2015-07-21 22:30:34 UTC

Size: 2.25 KB

patch

obsolete

>From cfcbc512ad88ee2904302f4d259125d77c7c5ad9 Mon Sep 17 00:00:00 2001
>From: Justin Maggard <jmaggard@netgear.com>
>Date: Tue, 21 Jul 2015 15:17:30 -0700
>Subject: [PATCH] s3-passdb: Respect LOOKUP_NAME_GROUP flag in sid lookup.
>
>Somewhere along the line, a config line like "valid users = @foo"
>broke when "foo" also exists as a user.
>
>user_ok_token() already does the right thing by adding the LOOKUP_NAME_GROUP
>flag; but lookup_name() was not respecting that flag, and went ahead and looked
>for users anyway.
>
>Signed-off-by: Justin Maggard <jmaggard@netgear.com>
>---
> source3/passdb/lookup_sid.c | 4 ++--
> source3/passdb/lookup_sid.h | 2 +-
> 2 files changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c
>index 3cc64de..3f99ee1 100644
>--- a/source3/passdb/lookup_sid.c
>+++ b/source3/passdb/lookup_sid.c
>@@ -120,7 +120,7 @@ bool lookup_name(TALLOC_CTX *mem_ctx,
> 			goto ok;
> 	}
> 
>-	if (((flags & LOOKUP_NAME_NO_NSS) == 0)
>+	if (((flags & (LOOKUP_NAME_NO_NSS|LOOKUP_NAME_GROUP)) == 0)
> 	    && strequal(domain, unix_users_domain_name())) {
> 		if (lookup_unix_user_name(name, &sid)) {
> 			type = SID_NAME_USER;
>@@ -293,7 +293,7 @@ bool lookup_name(TALLOC_CTX *mem_ctx,
> 	/* 11. Ok, windows would end here. Samba has two more options:
>                Unmapped users and unmapped groups */
> 
>-	if (((flags & LOOKUP_NAME_NO_NSS) == 0)
>+	if (((flags & (LOOKUP_NAME_NO_NSS|LOOKUP_NAME_GROUP)) == 0)
> 	    && lookup_unix_user_name(name, &sid)) {
> 		domain = talloc_strdup(tmp_ctx, unix_users_domain_name());
> 		type = SID_NAME_USER;
>diff --git a/source3/passdb/lookup_sid.h b/source3/passdb/lookup_sid.h
>index 872f4ef..8b5edf6 100644
>--- a/source3/passdb/lookup_sid.h
>+++ b/source3/passdb/lookup_sid.h
>@@ -31,7 +31,7 @@ struct unixid;
> #define LOOKUP_NAME_NONE		0x00000000
> #define LOOKUP_NAME_ISOLATED             0x00000001  /* Look up unqualified names */
> #define LOOKUP_NAME_REMOTE               0x00000002  /* Ask others */
>-#define LOOKUP_NAME_GROUP                0x00000004  /* (unused) This is a NASTY hack for
>+#define LOOKUP_NAME_GROUP                0x00000004  /* This is a NASTY hack for
> 							valid users = @foo where foo also
> 							exists in as user. */
> #define LOOKUP_NAME_NO_NSS		 0x00000008  /* no NSS calls to avoid
>-- 
>2.4.6
>

Flags:

jra: review+

Actions: View

Attachments on bug 11320: 11131 | 11132 | 11281 | 11291 | 11296