The branch, master has been updated
via 4deca5d s3: Fix bug 8102
via 720fa46 s3: Calculate&store the maximum share access mask
via 1c022d2 s3: Return "granted" from share_access_check
from fe8fe38 ldb: set -Wl,-no-undefined only on standalone build
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 4deca5d72804a40e68158a1183f5633dabf24761
Author: Volker Lendecke <[email protected]>
Date: Tue Jul 5 11:13:07 2011 +0200
s3: Fix bug 8102
We can't allow open with access that has been denied via the share
security descriptor
Signed-off-by: Stefan Metzmacher <[email protected]>
Autobuild-User: Stefan Metzmacher <[email protected]>
Autobuild-Date: Tue Jul 5 16:21:54 CEST 2011 on sn-devel-104
commit 720fa46f9443ccbe471b265f1c2b9cb9782a3c26
Author: Volker Lendecke <[email protected]>
Date: Mon Jul 4 18:35:21 2011 +0200
s3: Calculate&store the maximum share access mask
Signed-off-by: Stefan Metzmacher <[email protected]>
commit 1c022d2e414607633323e65abbc63bb3aeaaa6a4
Author: Volker Lendecke <[email protected]>
Date: Mon Jul 4 17:02:34 2011 +0200
s3: Return "granted" from share_access_check
Signed-off-by: Stefan Metzmacher <[email protected]>
-----------------------------------------------------------------------
Summary of changes:
source3/include/proto.h | 6 +++-
source3/include/smb.h | 1 +
source3/lib/sharesec.c | 10 ++++++-
source3/rpc_server/srvsvc/srv_srvsvc_nt.c | 4 +-
source3/smbd/open.c | 8 ++++++
source3/smbd/service.c | 36 ++++++++++++-----------------
source3/smbd/uid.c | 11 +++++---
7 files changed, 45 insertions(+), 31 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 91905d3..c6fd474 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -244,8 +244,10 @@ struct security_descriptor *get_share_security( TALLOC_CTX
*ctx, const char *ser
size_t *psize);
bool set_share_security(const char *share_name, struct security_descriptor
*psd);
bool delete_share_security(const char *servicename);
-bool share_access_check(const struct security_token *token, const char
*sharename,
- uint32 desired_access);
+bool share_access_check(const struct security_token *token,
+ const char *sharename,
+ uint32 desired_access,
+ uint32_t *pgranted);
bool parse_usershare_acl(TALLOC_CTX *ctx, const char *acl_str, struct
security_descriptor **ppsd);
/* The following definitions come from lib/smbrun.c */
diff --git a/source3/include/smb.h b/source3/include/smb.h
index a72e9ad..4319a10 100644
--- a/source3/include/smb.h
+++ b/source3/include/smb.h
@@ -402,6 +402,7 @@ typedef struct connection_struct {
bool printer;
bool ipc;
bool read_only; /* Attributes for the current user of the share. */
+ uint32_t share_access;
/* Does this filesystem honor
sub second timestamps on files
and directories when setting time ? */
diff --git a/source3/lib/sharesec.c b/source3/lib/sharesec.c
index ed971a9..0c06d7b 100644
--- a/source3/lib/sharesec.c
+++ b/source3/lib/sharesec.c
@@ -410,8 +410,10 @@ bool delete_share_security(const char *servicename)
Can this user access with share with the required permissions ?
********************************************************************/
-bool share_access_check(const struct security_token *token, const char
*sharename,
- uint32 desired_access)
+bool share_access_check(const struct security_token *token,
+ const char *sharename,
+ uint32 desired_access,
+ uint32_t *pgranted)
{
uint32 granted;
NTSTATUS status;
@@ -428,6 +430,10 @@ bool share_access_check(const struct security_token
*token, const char *sharenam
TALLOC_FREE(psd);
+ if (pgranted != NULL) {
+ *pgranted = granted;
+ }
+
return NT_STATUS_IS_OK(status);
}
diff --git a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
index 7299d4c..7d52a76 100644
--- a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
+++ b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
@@ -541,8 +541,8 @@ static bool is_enumeration_allowed(struct pipes_struct *p,
if (!lp_access_based_share_enum(snum))
return true;
- return share_access_check(p->session_info->security_token,
lp_servicename(snum),
- FILE_READ_DATA);
+ return share_access_check(p->session_info->security_token,
+ lp_servicename(snum), FILE_READ_DATA, NULL);
}
/*******************************************************************
diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index 86a5924..bbab9f1 100644
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -76,6 +76,14 @@ NTSTATUS smbd_check_open_rights(struct connection_struct
*conn,
/* Check if we have rights to open. */
NTSTATUS status;
struct security_descriptor *sd = NULL;
+ uint32_t rejected_share_access;
+
+ rejected_share_access = access_mask & ~(conn->share_access);
+
+ if (rejected_share_access) {
+ *access_granted = rejected_share_access;
+ return NT_STATUS_ACCESS_DENIED;
+ }
if ((access_mask & DELETE_ACCESS) &&
!lp_acl_check_permissions(SNUM(conn))) {
*access_granted = access_mask;
diff --git a/source3/smbd/service.c b/source3/smbd/service.c
index 73c3c4f..5c410be 100644
--- a/source3/smbd/service.c
+++ b/source3/smbd/service.c
@@ -641,27 +641,21 @@ connection_struct *make_connection_snum(struct
smbd_server_connection *sconn,
*
*/
- {
- bool can_write = False;
-
- can_write =
share_access_check(conn->session_info->security_token,
- lp_servicename(snum),
- FILE_WRITE_DATA);
-
- if (!can_write) {
- if
(!share_access_check(conn->session_info->security_token,
- lp_servicename(snum),
- FILE_READ_DATA)) {
- /* No access, read or write. */
- DEBUG(0,("make_connection: connection to %s "
- "denied due to security "
- "descriptor.\n",
- lp_servicename(snum)));
- *pstatus = NT_STATUS_ACCESS_DENIED;
- goto err_root_exit;
- } else {
- conn->read_only = True;
- }
+ share_access_check(conn->session_info->security_token,
+ lp_servicename(snum), MAXIMUM_ALLOWED_ACCESS,
+ &conn->share_access);
+
+ if ((conn->share_access & FILE_WRITE_DATA) == 0) {
+ if ((conn->share_access & FILE_READ_DATA) == 0) {
+ /* No access, read or write. */
+ DEBUG(0,("make_connection: connection to %s "
+ "denied due to security "
+ "descriptor.\n",
+ lp_servicename(snum)));
+ *pstatus = NT_STATUS_ACCESS_DENIED;
+ goto err_root_exit;
+ } else {
+ conn->read_only = True;
}
}
/* Initialise VFS function pointers */
diff --git a/source3/smbd/uid.c b/source3/smbd/uid.c
index 285b158..8114144 100644
--- a/source3/smbd/uid.c
+++ b/source3/smbd/uid.c
@@ -121,8 +121,9 @@ static bool check_user_ok(connection_struct *conn,
conn);
if (!readonly_share &&
- !share_access_check(session_info->security_token,
lp_servicename(snum),
- FILE_WRITE_DATA)) {
+ !share_access_check(session_info->security_token,
+ lp_servicename(snum), FILE_WRITE_DATA,
+ NULL)) {
/* smb.conf allows r/w, but the security descriptor denies
* write. Fall back to looking at readonly. */
readonly_share = True;
@@ -130,9 +131,11 @@ static bool check_user_ok(connection_struct *conn,
"security descriptor\n"));
}
- if (!share_access_check(session_info->security_token,
lp_servicename(snum),
+ if (!share_access_check(session_info->security_token,
+ lp_servicename(snum),
readonly_share ?
- FILE_READ_DATA : FILE_WRITE_DATA)) {
+ FILE_READ_DATA : FILE_WRITE_DATA,
+ NULL)) {
return False;
}
--
Samba Shared Repository
