[SCM] Samba Shared Repository - branch v3-3-test updated - release-3-2-0pre2-4333-gde16b89

[Jeremy Allison]

The branch, v3-3-test has been updated
       via  de16b8982f76e82ffd00d3ad66b24d239c5e8c9f (commit)
       via  cc8207790ef2fc38635415501a83a0161d48015a (commit)
      from  e20631897d5bade7827845c18ebf13ba468747fc (commit)

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-3-test


- Log -----------------------------------------------------------------
commit de16b8982f76e82ffd00d3ad66b24d239c5e8c9f
Merge: cc8207790ef2fc38635415501a83a0161d48015a e20631897d5bade7827845c18ebf13ba468747fc
Author: Jeremy Allison <jra at samba.org>
Date:   Tue Nov 4 01:35:13 2008 -0800

    Merge branch 'v3-3-test' of ssh://jra@git.samba.org/data/git/samba into v3-3-test

commit cc8207790ef2fc38635415501a83a0161d48015a
Author: Jeremy Allison <jra at samba.org>
Date:   Tue Nov 4 01:34:35 2008 -0800

    Pass all of RAW-ACLS except for inheritence. Working on that next.
    Jeremy.

-----------------------------------------------------------------------

Summary of changes:
 source/include/proto.h         |    4 ++
 source/modules/vfs_acl_xattr.c |    2 +-
 source/smbd/open.c             |   81 +++++++++++++++++++++++++++++++++++++++-
 3 files changed, 84 insertions(+), 3 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source/include/proto.h b/source/include/proto.h
index ea7481c..b432e6b 100644
--- a/source/include/proto.h
+++ b/source/include/proto.h
@@ -9899,6 +9899,10 @@ void reply_nttranss(struct smb_request *req);
 
 /* The following definitions come from smbd/open.c  */
 
+NTSTATUS smb1_file_se_access_check(const struct security_descriptor *sd,
+                          const NT_USER_TOKEN *token,
+                          uint32_t access_desired,
+                          uint32_t *access_granted);
 NTSTATUS fd_close(files_struct *fsp);
 bool map_open_params_to_ntcreate(const char *fname, int deny_mode, int open_func,
 				 uint32 *paccess_mask,
diff --git a/source/modules/vfs_acl_xattr.c b/source/modules/vfs_acl_xattr.c
index d62d4a6..e323f8e 100644
--- a/source/modules/vfs_acl_xattr.c
+++ b/source/modules/vfs_acl_xattr.c
@@ -437,7 +437,7 @@ static int open_acl_xattr(vfs_handle_struct *handle,
 					&pdesc);
         if (NT_STATUS_IS_OK(status)) {
 		/* See if we can access it. */
-		status = se_access_check(pdesc,
+		status = smb1_file_se_access_check(pdesc,
 					handle->conn->server_info->ptok,
 					fsp->access_mask,
 					&access_granted);
diff --git a/source/smbd/open.c b/source/smbd/open.c
index 967e0c5..adbe980 100644
--- a/source/smbd/open.c
+++ b/source/smbd/open.c
@@ -30,6 +30,56 @@ struct deferred_open_record {
 };
 
 /****************************************************************************
+ SMB1 file varient of se_access_check. Never test FILE_READ_ATTRIBUTES.
+****************************************************************************/
+
+NTSTATUS smb1_file_se_access_check(const struct security_descriptor *sd,
+                          const NT_USER_TOKEN *token,
+                          uint32_t access_desired,
+                          uint32_t *access_granted)
+{
+	return se_access_check(sd,
+				token,
+				(access_desired & ~FILE_READ_ATTRIBUTES),
+				access_granted);
+}
+
+/****************************************************************************
+ Check if we have open rights.
+****************************************************************************/
+
+static NTSTATUS check_open_rights(struct connection_struct *conn,
+				const char *fname,
+				uint32_t access_mask)
+{
+	/* Check if we have rights to open. */
+	NTSTATUS status;
+	uint32_t access_granted = 0;
+	struct security_descriptor *sd;
+
+	status = SMB_VFS_GET_NT_ACL(conn, fname,
+			(OWNER_SECURITY_INFORMATION |
+			GROUP_SECURITY_INFORMATION |
+			DACL_SECURITY_INFORMATION),&sd);
+
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(10, ("check_open_rights: Could not get acl "
+			"on %s: %s\n",
+			fname,
+			nt_errstr(status)));
+		return status;
+	}
+
+	status = smb1_file_se_access_check(sd,
+				conn->server_info->ptok,
+				access_mask,
+				&access_granted);
+
+	TALLOC_FREE(sd);
+	return status;
+}
+
+/****************************************************************************
  fd support routines - attempt to do a dos_open.
 ****************************************************************************/
 
@@ -337,6 +387,17 @@ static NTSTATUS open_file(files_struct *fsp,
 
 	} else {
 		fsp->fh->fd = -1; /* What we used to call a stat open. */
+		if (file_existed) {
+			status = check_open_rights(conn,
+					path,
+					access_mask);
+			if (!NT_STATUS_IS_OK(status)) {
+				DEBUG(10, ("open_file: Access denied on "
+					"file %s\n",
+					path));
+				return status;
+			}
+		}
 	}
 
 	if (!file_existed) {
@@ -1145,6 +1206,7 @@ static NTSTATUS calculate_access_mask(connection_struct *conn,
 	/* Calculate MAXIMUM_ALLOWED_ACCESS if requested. */
 	if (access_mask & MAXIMUM_ALLOWED_ACCESS) {
 		if (file_existed) {
+
 			struct security_descriptor *sd;
 			uint32_t access_granted = 0;
 
@@ -1161,8 +1223,10 @@ static NTSTATUS calculate_access_mask(connection_struct *conn,
 				return NT_STATUS_ACCESS_DENIED;
 			}
 
-			status = se_access_check(sd, conn->server_info->ptok,
-					access_mask, &access_granted);
+			status = smb1_file_se_access_check(sd,
+					conn->server_info->ptok,
+					access_mask,
+					&access_granted);
 
 			TALLOC_FREE(sd);
 
@@ -2272,6 +2336,19 @@ NTSTATUS open_directory(connection_struct *conn,
 		return NT_STATUS_NOT_A_DIRECTORY;
 	}
 
+	if (info == FILE_WAS_OPENED) {
+		status = check_open_rights(conn,
+					fname,
+					access_mask);
+		if (!NT_STATUS_IS_OK(status)) {
+			DEBUG(10, ("open_directory: check_open_rights on "
+				"file  %s failed with %s\n",
+				fname,
+				nt_errstr(status)));
+			return status;
+		}
+	}
+
 	status = file_new(conn, &fsp);
 	if(!NT_STATUS_IS_OK(status)) {
 		return status;


-- 
Samba Shared Repository