Fix bug #10063 - source3/lib/util.c:1493 leaking memory w/ pam_winbind.so / winbind

Don't use talloc_tos() in something that can be linked to in pam_winbindd.so

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>

Autobuild-User(master): Simo Sorce <idra@samba.org>
Autobuild-Date(master): Sat Aug 24 02:28:28 CEST 2013 on sn-devel-104
(cherry picked from commit 9423d5afb71e272298f4858d82f436e19ee2b07f)

Autobuild-User(v4-1-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-1-test): Tue Aug 27 11:36:39 CEST 2013 on sn-devel-104
docs: Add man samba-regedit.8.

Fix bug #10001 - Man page for samba-regedit tool missing.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
Signed-off-by: Björn Jacke <bj@sernet.de>

Autobuild-User(master): Björn Jacke <bj@sernet.de>
Autobuild-Date(master): Thu Aug 29 03:15:51 CEST 2013 on sn-devel-104
(cherry picked from commit 4dd1523b95b214723dc9c0dfc5b5a6778bf4fc4d)
smbd: Fix a profile problem

When trying to read a profile, under certain circumstances Windows tries
to read with its machine account first. The profile previously written
was stored with an ACL that only allows access for the user and not
the machine. Windows should get an NT_STATUS_ACCESS_DENIED when using
the machine account, making it retry with the user account (which would
then succeed).

Samba under these circumstances erroneously gives
NT_STATUS_OBJECT_PATH_NOT_FOUND, which makes Windows give up and not
retry. The reasons is the "dropbox" patch in unix_convert, turning EACCESS
on the last path component to OBJECT_PATH_NOT_FOUND. This patch makes
the dropbox behaviour only kick in when we are creating a file. I think
this is an abstraction violation. unix_convert() should not have to know
about the create_disposition, but given that we have pathname resolution
separated from the core open code right now this is the best we can do.

Signed-off-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
Reviewed-by: Jeremy Allison <jra@samba.org>
smbd: Simplify dropbox special case in unix_convert

EACCESS needs special treatment: If we want to create a fresh file,
return OBJECT_PATH_NOT_FOUND, so that the client will continue creating
the file. If the client wants us to open a potentially existing file,
we need to correctly return ACCESS_DENIED.

This patch makes this behaviour hopefully a bit clearer than the code
before did.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Aug 26 12:14:26 CEST 2013 on sn-devel-104

The last 2 patches address bug #10114 - Dropbox (write-only-directory) case isn't
handled correctly in pathname lookup.
s3-winbindd: remove pointless variable assigment, see the strdup below.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
s3-winbindd: Fix memory leak in ads_cached_connection().

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
s3-winbindd: Fix winbind on DC crash with trusted AD domains.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
s3-winbindd: use find_domain_from_name() instead of find_domain_from_name_no_init().

Otherwise there is a good chance the domain has not been connected and we don't
know the realm name yet.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
s3-winbindd: make sure also the idmap code can deal with trusted domains.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
s3-winbindd: use get_trust_pw_clear() wrapper for AD connection code.

This avoids calling secrets functions directly.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
s3-winbindd: remove unneded include of secrets.h from idmap_ad.c

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
s3:winbind: fail ads_cached_connection_connect() if realm == NULL

This prevents segfaults when e.g. a previous SMB_STRDUP failed..

Signed-off-by: Michael Adam <obnox@samba.org>

The last 8 patches address bug #10107 - winbind on DC with trusted AD domains
crashes.
Fix the erroneous masking of chmod requests via the UNIX extensions.

Changed from switch statement to if, as "create mask", "force create mode"
are only applied to new files, not existing ones. "directory mask",
"force directory mode" are only applied to new directories, not existing
ones.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>
(cherry picked from commit bd0156988b34feaf91c3046f7ec78f0833222395)
Allow UNIX extensions client to act on open fsp instead of pathname if available.

Eliminates possible race condition on pathname op.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>
(cherry picked from commit f1ff97fc022adaacaa23b7da250be6f7d51c6ac7)
Fix the UNIX extensions CHOWN calls to use FCHOWN if available, else LCHOWN.

UNIX extensions calls must never deref links.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Aug 26 20:19:46 CEST 2013 on sn-devel-104

(cherry picked from commit d1593a20f3a5ebf287477dfa8f5ab31dca3dd0c3)

The last 3 patches address bug #10121 - masks incorrectly applied to UNIX
extension permission changes.
s3:param: Correctly set up cli_maxprotocol, cli_minprotocol in our parameter block.

Set to PROTOCOL_NT1, PROTOCOL_CORE by default.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=9829

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit f2fb829cee81996c62ff91cb8d1e9997008ffb42)
s3:client: avoid interpret_protocol()

lp_set_cmdline("client max protocol",...) and
lp_cli_maxprotocol() are the more generic solution.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 861ee9319f3cce8f104fd30c7139323ac3d3319d)
s3:torture: avoid interpret_protocol()

lp_set_cmdline("client max protocol",...) and
lp_cli_maxprotocol() are the more generic solution.

https://bugzilla.samba.org/show_bug.cgi?id=9514

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 2c3c8caa0cc7b085231b2edc100ce2332e1e0085)
s3:lib: remove unused interpret_protocol()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 9188ee4ab195a18b1bd697bced8613f98a6a91d9)
s3:libsmb: Modify cli_start_connection_connected() to use lp_cli_minprotocol()/lp_cli_maxprotocol() instead of hard coding PROTOCOL_CORE, PROTOCOL_NT1.

https://bugzilla.samba.org/show_bug.cgi?id=9514

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 42f510c155b98f3df5106aebd1de54d1749b9b1c)