From 438284e1025a96dfa2eb0928de99226f580f356f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 1 Apr 2022 15:56:30 +0200 Subject: [PATCH 1/5] selftest: Create users "jackthemapper" and "jacknomapper" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit BUG: https://bugzilla.samba.org/show_bug.cgi?id=15041 Signed-off-by: Pavel Filipenský Reviewed-by: Noel Power Reviewed-by: Jeremy Allison (cherry picked from commit 1b0146182224fe01ed70815364656a626038685a) --- selftest/target/Samba3.pm | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm index 62fb3d1e39e..b0ea9804c50 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm @@ -1466,8 +1466,10 @@ sub setup_ad_member_idmap_nss my $extra_member_options = " # bob:x:65521:65531:localbob gecos:/:/bin/false # jane:x:65520:65531:localjane gecos:/:/bin/false + # jackthemapper:x:65519:65531:localjackthemaper gecos:/:/bin/false + # jacknomapper:x:65518:65531:localjacknomaper gecos:/:/bin/false idmap config $dcvars->{DOMAIN} : backend = nss - idmap config $dcvars->{DOMAIN} : range = 65520-65521 + idmap config $dcvars->{DOMAIN} : range = 65518-65521 # Support SMB1 so that we can use posix_whoami(). client min protocol = CORE @@ -2532,6 +2534,8 @@ sub provision($$) my ($uid_slashuser); my ($uid_localbob); my ($uid_localjane); + my ($uid_localjackthemapper); + my ($uid_localjacknomapper); if ($unix_uid < 0xffff - 13) { $max_uid = 0xffff; @@ -2554,6 +2558,8 @@ sub provision($$) $uid_slashuser = $max_uid - 13; $uid_localbob = $max_uid - 14; $uid_localjane = $max_uid - 15; + $uid_localjackthemapper = $max_uid - 16; + $uid_localjacknomapper = $max_uid - 17; if ($unix_gids[0] < 0xffff - 8) { $max_gid = 0xffff; @@ -3298,6 +3304,8 @@ eviluser:x:$uid_eviluser:$gid_domusers:eviluser gecos::/bin/false slashuser:x:$uid_slashuser:$gid_domusers:slashuser gecos:/:/bin/false bob:x:$uid_localbob:$gid_domusers:localbob gecos:/:/bin/false jane:x:$uid_localjane:$gid_domusers:localjane gecos:/:/bin/false +jackthemapper:x:$uid_localjackthemapper:$gid_domusers:localjackthemaper gecos:/:/bin/false +jacknomapper:x:$uid_localjacknomapper:$gid_domusers:localjacknomaper gecos:/:/bin/false "; if ($unix_uid != 0) { print PASSWD "root:x:$uid_root:$gid_root:root gecos:$prefix_abs:/bin/false @@ -3362,6 +3370,8 @@ force_user:x:$gid_force_user: createuser($self, "gooduser", $password, $conffile, \%createuser_env) || die("Unable to create gooduser"); createuser($self, "eviluser", $password, $conffile, \%createuser_env) || die("Unable to create eviluser"); createuser($self, "slashuser", $password, $conffile, \%createuser_env) || die("Unable to create slashuser"); + createuser($self, "jackthemapper", "mApsEcrEt", $conffile, \%createuser_env) || die("Unable to create jackthemapper"); + createuser($self, "jacknomapper", "nOmApsEcrEt", $conffile, \%createuser_env) || die("Unable to create jacknomapper"); open(DNS_UPDATE_LIST, ">$prefix/dns_update_list") or die("Unable to open $$prefix/dns_update_list"); print DNS_UPDATE_LIST "A $server. $server_ip\n"; -- 2.34.1 From 28bf2f4c52105fc11515c58e13b935ae046399b4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 5 Apr 2022 08:30:23 +0200 Subject: [PATCH 2/5] selftest: Create groups "jackthemappergroup" and "jacknomappergroup" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit BUG: https://bugzilla.samba.org/show_bug.cgi?id=15041 Signed-off-by: Pavel Filipenský Reviewed-by: Jeremy Allison Reviewed-by: Noel Power (cherry picked from commit 26e4268d6e3bde74520e36f3ca3cc9d979292d1d) --- selftest/target/Samba3.pm | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm index b0ea9804c50..131034a0e07 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm @@ -2527,6 +2527,8 @@ sub provision($$) my ($gid_nobody, $gid_nogroup, $gid_root, $gid_domusers, $gid_domadmins); my ($gid_userdup, $gid_everyone); my ($gid_force_user); + my ($gid_jackthemapper); + my ($gid_jacknomapper); my ($uid_user1); my ($uid_user2); my ($uid_gooduser); @@ -2575,6 +2577,8 @@ sub provision($$) $gid_userdup = $max_gid - 6; $gid_everyone = $max_gid - 7; $gid_force_user = $max_gid - 8; + $gid_jackthemapper = $max_gid - 9; + $gid_jacknomapper = $max_gid - 10; ## ## create conffile @@ -3325,6 +3329,8 @@ domadmins:X:$gid_domadmins: userdup:x:$gid_userdup:$unix_name everyone:x:$gid_everyone: force_user:x:$gid_force_user: +jackthemappergroup:x:$gid_jackthemapper:jackthemapper +jacknomappergroup:x:$gid_jacknomapper:jacknomapper "; if ($unix_gids[0] != 0) { print GROUP "root:x:$gid_root: -- 2.34.1 From deadcd6a919188a75157e54b2fd772e4bf18d4fc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 5 Apr 2022 08:31:41 +0200 Subject: [PATCH 3/5] selftest: Add to "username.map" mapping for jackthemappergroup MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit BUG: https://bugzilla.samba.org/show_bug.cgi?id=15041 Only for environment ad_member_idmap_nss. * !jacknompapper = \@jackthemappergroup jackthemaper from group jackthemappergroup is mapped to jacknompapper * !root = jacknomappergroup since there is no '@' or '+' prefix, it is not an UNIX group mapping Signed-off-by: Pavel Filipenský Reviewed-by: Jeremy Allison Reviewed-by: Noel Power (cherry picked from commit 0feeb6d58a6d6b1949faa842473053af4562c979) --- selftest/target/Samba3.pm | 2 ++ 1 file changed, 2 insertions(+) diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm index 131034a0e07..8d309f9c99a 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm @@ -1490,6 +1490,8 @@ sub setup_ad_member_idmap_nss open(USERMAP, ">$prefix/lib/username.map") or die("Unable to open $prefix/lib/username.map"); print USERMAP " +!jacknomapper = \@jackthemappergroup +!root = jacknomappergroup root = $dcvars->{DOMAIN}/root bob = $dcvars->{DOMAIN}/bob "; -- 2.34.1 From edf5d5641de92665c30804be6825040d7b0862af Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 5 Apr 2022 14:04:52 +0200 Subject: [PATCH 4/5] s3:tests Test "username map" for UNIX groups MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit BUG: https://bugzilla.samba.org/show_bug.cgi?id=15041 Signed-off-by: Pavel Filipenský Reviewed-by: Jeremy Allison Reviewed-by: Noel Power (cherry picked from commit af8747a28bd62937a01fa4648f404bd0b09a44c0) --- selftest/knownfail.d/usernamemap | 1 + source3/script/tests/test_usernamemap.sh | 28 ++++++++++++++++++++++++ source3/selftest/tests.py | 2 ++ 3 files changed, 31 insertions(+) create mode 100644 selftest/knownfail.d/usernamemap create mode 100755 source3/script/tests/test_usernamemap.sh diff --git a/selftest/knownfail.d/usernamemap b/selftest/knownfail.d/usernamemap new file mode 100644 index 00000000000..1c720fe892d --- /dev/null +++ b/selftest/knownfail.d/usernamemap @@ -0,0 +1 @@ +samba3.blackbox.smbclient_usernamemap.jacknomapper diff --git a/source3/script/tests/test_usernamemap.sh b/source3/script/tests/test_usernamemap.sh new file mode 100755 index 00000000000..3a3344a8781 --- /dev/null +++ b/source3/script/tests/test_usernamemap.sh @@ -0,0 +1,28 @@ +#!/bin/sh +# +# Copyright (c) 2022 Pavel Filipenský +# +# Tests for "username map" smb.conf parameter for UNIX groups + +if [ $# -lt 2 ]; then +cat < Date: Fri, 25 Mar 2022 11:11:50 +0100 Subject: [PATCH 5/5] s3:auth: Fix user_in_list() for UNIX groups MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit BUG: https://bugzilla.samba.org/show_bug.cgi?id=15041 Signed-off-by: Pavel Filipenský Reviewed-by: Jeremy Allison Reviewed-by: Noel Power Autobuild-User(master): Noel Power Autobuild-Date(master): Thu Apr 7 09:49:44 UTC 2022 on sn-devel-184 (cherry picked from commit 6dc463d3e2eb229df1c4f620cfcaf22ac71738d4) --- selftest/knownfail.d/usernamemap | 1 - source3/auth/user_util.c | 12 +++++++----- 2 files changed, 7 insertions(+), 6 deletions(-) delete mode 100644 selftest/knownfail.d/usernamemap diff --git a/selftest/knownfail.d/usernamemap b/selftest/knownfail.d/usernamemap deleted file mode 100644 index 1c720fe892d..00000000000 --- a/selftest/knownfail.d/usernamemap +++ /dev/null @@ -1 +0,0 @@ -samba3.blackbox.smbclient_usernamemap.jacknomapper diff --git a/source3/auth/user_util.c b/source3/auth/user_util.c index 70b4f320c5e..aa765c2a692 100644 --- a/source3/auth/user_util.c +++ b/source3/auth/user_util.c @@ -143,11 +143,11 @@ bool user_in_list(TALLOC_CTX *ctx, const char *user, const char * const *list) return false; } - DBG_DEBUG("Checking user %s in list\n", user); - while (*list) { const char *p = *list; - bool ok; + bool check_unix_group = false; + + DBG_DEBUG("Checking user '%s' in list '%s'.\n", user, *list); /* Check raw username */ if (strequal(user, p)) { @@ -155,11 +155,13 @@ bool user_in_list(TALLOC_CTX *ctx, const char *user, const char * const *list) } while (*p == '@' || *p == '&' || *p == '+') { + if (*p == '@' || *p == '+') { + check_unix_group = true; + } p++; } - ok = user_in_group(user, p); - if (ok) { + if (check_unix_group && user_in_group(user, p)) { return true; } -- 2.34.1