# HG changeset patch # User Olaf Wintermann # Date 1549873113 -3600 # Node ID c374d11d672020e271aa6cc7115e25d1790ab91a # Parent 196a3caebdc7580a793a8b8c579e2c6a189cd8e8 remove libnsl from linux makefile diff -r 196a3caebdc7 -r c374d11d6720 make/linux.mk --- a/make/linux.mk Sun Jan 06 14:38:57 2019 +0100 +++ b/make/linux.mk Mon Feb 11 09:18:33 2019 +0100 @@ -29,7 +29,7 @@ # compiler and linker flags CFLAGS += -DLINUX -LDFLAGS += -lpthread -ldl -lnsl -lm -lldap +LDFLAGS += -lpthread -ldl -lm -lldap # platform dependend source files diff -r 196a3caebdc7 -r c374d11d6720 src/server/daemon/acl.c --- a/src/server/daemon/acl.c Sun Jan 06 14:38:57 2019 +0100 +++ b/src/server/daemon/acl.c Mon Feb 11 09:18:33 2019 +0100 @@ -55,11 +55,11 @@ acllist_createhandle(sn, rq); } ACLListHandle *list = rq->acllist; - + if(!list->defaultauthdb && acl->authdb) { list->defaultauthdb = acl->authdb; } - + ACLListElm *elm = pool_malloc(sn->pool, sizeof(ACLListElm)); elm->acl = acl; elm->next = NULL; @@ -103,7 +103,7 @@ if(!sn || !rq || !list) { return NULL; } - + // get user User *user = NULL; if(list->defaultauthdb) { @@ -129,7 +129,7 @@ rq->vars); } } - + return user; } @@ -137,7 +137,7 @@ if(sn == NULL || rq == NULL) { return; } - + if(!user) { char *value = NULL; if(acl->authprompt) { @@ -167,13 +167,13 @@ if(!list) { return REQ_PROCEED; } - + // we combine access_mask with the required access rights access_mask |= rq->aclreqaccess; - + // get user User *user = acllist_getuser(sn, rq, list); - + // evalutate all ACLs ACLList *acl = acl_evallist(list, user, access_mask, NULL); if(acl) { @@ -184,12 +184,12 @@ } return REQ_ABORTED; } - + // access allowed, we can free the user if(user) { user->free(user); } - + return REQ_PROCEED; } @@ -205,7 +205,7 @@ if(externacl) { *externacl = NULL; } - + // evaluate each acl until one denies access ACLListElm *elm = list->listhead; while(elm) { @@ -218,30 +218,30 @@ } else if(!acl->check(acl, user, access_mask)) { // the acl denies access return acl; - } + } elm = elm->next; } - + // ok - all acls allowed access - + return NULL; } int wsacl_affects_user(WSAce *ace, User *user) { int check_access = 0; - + /* * an ace can affect * a named user or group (ace->who is set) * the owner of the resource (ACL_OWNER is set) * the owning group of the resource (ACL_GROUP is set) * everyone (ACL_EVERYONE is set) - * + * * Only one of this conditions should be true. The behavior on * illegal flag combination is undefined. We assume that the acls * are created correctly by the configuration loader. */ - + if(ace->who && user) { // this ace is defined for a named user or group if((ace->flags & ACL_IDENTIFIER_GROUP) == ACL_IDENTIFIER_GROUP) { @@ -261,19 +261,19 @@ } else if((ace->flags & ACL_EVERYONE) == ACL_EVERYONE) { check_access = 1; } - + return check_access; } -int wsacl_check(WSAcl *acl, User *user, int access_mask) { +int wsacl_check(WSAcl *acl, User *user, int access_mask) { int allow = 0; uint32_t allowed_access = 0; // check each access control entry for(int i=0;iacenum;i++) { - WSAce *ace = acl->ace[i]; + WSAce *ace = acl->ace[i]; if(wsacl_affects_user(ace, user)) { if(ace->type == ACL_TYPE_ALLOWED) { - // add all new access rights + // add all new access rights allowed_access |= (access_mask & ace->access_mask); // check if we have all requested rights if((allowed_access & access_mask) == access_mask) { @@ -282,7 +282,7 @@ } } else { // ACL_TYPE_DENIED - + if((ace->access_mask & access_mask) != 0) { // access denied break; @@ -290,9 +290,9 @@ } } } - + // TODO: events - + return allow; // allow is 0, if no ace set it to 1 } @@ -332,7 +332,7 @@ } sstr_t wd = sstr(cwd); sstr_t pp = sstr(path); - + p = sstrcat(3, wd, sstrn("/", 1), pp); } else { p = sstrdup(sstr(path)); @@ -341,7 +341,7 @@ p.ptr[p.length-1] = 0; p.length--; } - + // get uid/gid struct passwd pw; if(user) { @@ -362,7 +362,7 @@ acl->user_uid = -1; acl->user_gid = -1; } - + // translate access_mask uint32_t mask = 0; if((access_mask & ACL_READ_DATA) == ACL_READ_DATA) { @@ -407,7 +407,7 @@ if((access_mask & ACL_SYNCHRONIZE) == ACL_SYNCHRONIZE) { mask |= ACE_SYNCHRONIZE; } - + /* * If the vfs wants to create new files, path does not name an existing * file. In this case, we check if the user has the ACE_ADD_FILE @@ -428,11 +428,11 @@ } } } - + /* * perform a acl check for the path and each parent directory * we don't check the file system root - * + * * after the first check, we check only search permission for the * directories */ @@ -440,7 +440,7 @@ free(p.ptr); return 0; } - + p = util_path_remove_last(p); mask = ACE_LIST_DIRECTORY; while(p.length > 1) { @@ -452,12 +452,12 @@ free(p.ptr); return 0; } - + // cut the last file name from the path p = util_path_remove_last(p); } - - + + return 1; } @@ -469,7 +469,7 @@ gid_t gid) { //printf("solaris_acl_check %s\n", path); - + int nace = acl(path, ACE_GETACLCNT, 0, NULL); if(nace == -1) { perror("acl: ACE_GETACLCNT"); @@ -483,14 +483,14 @@ free(aces); return 0; } - + int allow = 0; uint32_t allowed_access = 0; for(int i=0;ist_uid, s->st_gid)) { if(ace.a_type == ACE_ACCESS_ALLOWED_ACE_TYPE) { - // add all new access rights + // add all new access rights allowed_access |= (mask & ace.a_access_mask); // check if we have all requested rights if((allowed_access & mask) == mask) { @@ -499,7 +499,7 @@ } } else if(ace.a_type == ACE_ACCESS_DENIED_ACE_TYPE) { // ACL_TYPE_DENIED - + if((ace.a_access_mask & mask) != 0) { // access denied break; @@ -507,9 +507,9 @@ } } } - + free(aces); - + //printf("return %d\n", allow); return allow; } @@ -524,9 +524,9 @@ /* * mostly the same as wsacl_affects_user */ - + int check_access = 0; - + if((ace->a_flags & ACE_OWNER) == ACE_OWNER) { if(uid == owner) { check_access = 1; @@ -551,12 +551,12 @@ } } } - + return check_access; } void fs_acl_finish() { - + } #endif @@ -572,7 +572,7 @@ } void fs_acl_finish() { - + } #endif @@ -584,7 +584,7 @@ } void fs_acl_finish() { - + } #endif @@ -600,7 +600,7 @@ log_ereport(LOG_FAILURE, "fs_acl_check: unknown webserver uid/gid"); return 1; } - + // get uid/gid struct passwd pw; if(user) { @@ -619,7 +619,7 @@ acl->user_uid = 0; acl->user_gid = 0; } - + // set fs uid/gid if(acl->user_uid != 0) { if(setfsuid(pw.pw_uid)) { @@ -633,8 +633,8 @@ "Cannot set fsgid to gid: %u", pw.pw_gid); } } - - + + return 1; }