NEX-13644 File access audit logging
Reviewed by: Gordon Ross <gordon.ross@nexenta.com>
Reviewed by: Roman Strashkin <roman.strashkin@nexenta.com>
Reviewed by: Saso Kiselkov <saso.kiselkov@nexenta.com>
Reviewed by: Rick McNeal <rick.mcneal@nexenta.com>
Reviewed by: Yuri Pankov <yuri.pankov@nexenta.com>
NEX-9808 SMB3 persistent handles
Reviewed by: Matt Barden <matt.barden@nexenta.com>
Reviewed by: Evan Layton <evan.layton@nexenta.com>
NEX-9808 SMB3 persistent handles
Reviewed by: Matt Barden <matt.barden@nexenta.com>
Reviewed by: Evan Layton <evan.layton@nexenta.com>
NEX-9497 SMB should bypass ACL traverse checking
Reviewed by: Evan Layton <evan.layton@nexenta.com>
Reviewed by: Roman Strashkin <roman.strashkin@nexenta.com>
NEX-3787 Sync. up SMB server with: Merge with illumos-gate 12380e1e
NEX-1440 Unable to take ownership, view permissions, or delete files...
Reviewed by: Alek Pinchuk <alek@nexenta.com>
SMB-56 extended security NTLMSSP, inbound

@@ -18,11 +18,11 @@
  *
  * CDDL HEADER END
  */
 /*
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
  */
 
 /*
  * Authentication helpers for building credentials
  */

@@ -47,19 +47,25 @@
  * to the Solaris user's primary group.
  *
  * If the mapped UID is ephemeral, or the primary group could not be
  * obtained, the cred gid is set to whatever Solaris group is mapped
  * to the token's primary group.
+ *
+ * Also add any privileges that should always be in effect for this user.
+ * Note that an SMB user object also gets a u_privcred which is used
+ * when the client opens an object with "backup/restore intent".
+ * That cred is setup later, in smb_user_setcred().
  */
 cred_t *
-smb_cred_create(smb_token_t *token)
+smb_cred_create(smb_token_t *token, smb_session_t *s)
 {
         ksid_t                  ksid;
         ksidlist_t              *ksidlist = NULL;
         smb_posix_grps_t        *posix_grps;
         cred_t                  *cr;
         gid_t                   gid;
+        auditinfo_addr_t        *au;
 
         ASSERT(token);
         ASSERT(token->tkn_posix_grps);
         posix_grps = token->tkn_posix_grps;
 

@@ -107,10 +113,37 @@
                     PRIV_FILE_DAC_WRITE,
                     PRIV_FILE_OWNER,
                     NULL);
         }
 
+        /*
+         * See smb.4 bypass_traverse_checking
+         *
+         * For historical reasons, the Windows privilege is named
+         * SeChangeNotifyPrivilege, though the description is
+         * "Bypass traverse checking".
+         */
+        if (smb_token_query_privilege(token, SE_CHANGE_NOTIFY_LUID)) {
+                (void) crsetpriv(cr, PRIV_FILE_DAC_SEARCH, NULL);
+        }
+
+        au = crgetauinfo_modifiable(cr);
+        if (au != NULL) {
+                au->ai_auid = token->tkn_auid;
+                au->ai_mask = token->tkn_amask;
+                au->ai_asid = token->tkn_asid;
+                au->ai_termid.at_port = s->s_local_port;
+
+                if (s->ipaddr.a_family == AF_INET) {
+                        au->ai_termid.at_addr[0] = s->ipaddr.a_ipv4;
+                        au->ai_termid.at_type = AU_IPv4;
+                } else {
+                        bcopy(&s->ipaddr.a_ip, au->ai_termid.at_addr,
+                            sizeof (in6_addr_t));
+                        au->ai_termid.at_type = AU_IPv6;
+                }
+        }
         return (cr);
 }
 
 /*
  * Initialize the ksid based on the given smb_id_t.

@@ -152,6 +185,22 @@
                 if (lp->ksl_sids[i].ks_id > IDMAP_WK__MAX_GID)
                         lp->ksl_neid++;
         }
 
         return (lp);
+}
+
+/*
+ * Special variant of smb_cred_create() used when we need an
+ * SMB kcred (i.e. DH import).  The returned cred must be
+ * from crget() so it can be passed to smb_user_setcred().
+ */
+cred_t *
+smb_kcred_create(void)
+{
+        cred_t  *cr;
+
+        cr = crget();
+        ASSERT(cr != NULL);
+
+        return (cr);
 }