svn commit: samba r6365 - in branches/SAMBA_3_0/source/smbd: .
jra at samba.org
jra at samba.org
Sun Apr 17 07:57:49 GMT 2005
Author: jra
Date: 2005-04-17 07:57:45 +0000 (Sun, 17 Apr 2005)
New Revision: 6365
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=6365
Log:
Wow, how much worse does this get. From info provided by
Eric Stewart <eric at lib.usf.edu> I realised we weren't checking
against the current effective groupid (set by force group) as
well as the group list. Fix this.
Jeremy.
Modified:
branches/SAMBA_3_0/source/smbd/posix_acls.c
Changeset:
Modified: branches/SAMBA_3_0/source/smbd/posix_acls.c
===================================================================
--- branches/SAMBA_3_0/source/smbd/posix_acls.c 2005-04-17 07:57:39 UTC (rev 6364)
+++ branches/SAMBA_3_0/source/smbd/posix_acls.c 2005-04-17 07:57:45 UTC (rev 6365)
@@ -3852,6 +3852,23 @@
if (pgid == NULL) {
goto check_stat;
}
+
+ /* Does it match the current effective group ? */
+ if (current_user.gid == *pgid) {
+ ret = have_write;
+ DEBUG(10,("check_posix_acl_group_write: file %s \
+match on group %u -> can write.\n", fname, (unsigned int)*pgid ));
+
+ /* If we don't have write permission this entry doesn't
+ * prevent the subsequent enumeration of the supplementary
+ * groups.
+ */
+ if (have_write) {
+ goto done;
+ }
+ }
+
+ /* Continue with the supplementary groups. */
for (i = 0; i < current_user.ngroups; i++) {
if (current_user.groups[i] == *pgid) {
ret = have_write;
@@ -3883,6 +3900,15 @@
/* Do we match on the owning group entry ? */
+ /* First, does it match the current effective group ? */
+ if (current_user.gid == psbuf->st_gid) {
+ ret = (psbuf->st_mode & S_IWGRP) ? 1 : 0;
+ DEBUG(10,("check_posix_acl_group_write: file %s \
+match on owning group %u -> %s.\n", fname, (unsigned int)psbuf->st_gid, ret ? "can write" : "cannot write"));
+ goto done;
+ }
+
+ /* If not look at the supplementary groups. */
for (i = 0; i < current_user.ngroups; i++) {
if (current_user.groups[i] == psbuf->st_gid) {
ret = (psbuf->st_mode & S_IWGRP) ? 1 : 0;
More information about the samba-cvs
mailing list