[SCM] Samba Shared Repository - branch master updated

Stefan Metzmacher metze at samba.org
Tue Jul 5 08:22:02 MDT 2011


The branch, master has been updated
       via  4deca5d s3: Fix bug 8102
       via  720fa46 s3: Calculate&store the maximum share access mask
       via  1c022d2 s3: Return "granted" from share_access_check
      from  fe8fe38 ldb: set -Wl,-no-undefined only on standalone build

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 4deca5d72804a40e68158a1183f5633dabf24761
Author: Volker Lendecke <vl at samba.org>
Date:   Tue Jul 5 11:13:07 2011 +0200

    s3: Fix bug 8102
    
    We can't allow open with access that has been denied via the share
    security descriptor
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    
    Autobuild-User: Stefan Metzmacher <metze at samba.org>
    Autobuild-Date: Tue Jul  5 16:21:54 CEST 2011 on sn-devel-104

commit 720fa46f9443ccbe471b265f1c2b9cb9782a3c26
Author: Volker Lendecke <vl at samba.org>
Date:   Mon Jul 4 18:35:21 2011 +0200

    s3: Calculate&store the maximum share access mask
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit 1c022d2e414607633323e65abbc63bb3aeaaa6a4
Author: Volker Lendecke <vl at samba.org>
Date:   Mon Jul 4 17:02:34 2011 +0200

    s3: Return "granted" from share_access_check
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 source3/include/proto.h                   |    6 +++-
 source3/include/smb.h                     |    1 +
 source3/lib/sharesec.c                    |   10 ++++++-
 source3/rpc_server/srvsvc/srv_srvsvc_nt.c |    4 +-
 source3/smbd/open.c                       |    8 ++++++
 source3/smbd/service.c                    |   36 ++++++++++++-----------------
 source3/smbd/uid.c                        |   11 +++++---
 7 files changed, 45 insertions(+), 31 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/include/proto.h b/source3/include/proto.h
index 91905d3..c6fd474 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -244,8 +244,10 @@ struct security_descriptor *get_share_security( TALLOC_CTX *ctx, const char *ser
 			      size_t *psize);
 bool set_share_security(const char *share_name, struct security_descriptor *psd);
 bool delete_share_security(const char *servicename);
-bool share_access_check(const struct security_token *token, const char *sharename,
-			uint32 desired_access);
+bool share_access_check(const struct security_token *token,
+			const char *sharename,
+			uint32 desired_access,
+			uint32_t *pgranted);
 bool parse_usershare_acl(TALLOC_CTX *ctx, const char *acl_str, struct security_descriptor **ppsd);
 
 /* The following definitions come from lib/smbrun.c  */
diff --git a/source3/include/smb.h b/source3/include/smb.h
index a72e9ad..4319a10 100644
--- a/source3/include/smb.h
+++ b/source3/include/smb.h
@@ -402,6 +402,7 @@ typedef struct connection_struct {
 	bool printer;
 	bool ipc;
 	bool read_only; /* Attributes for the current user of the share. */
+	uint32_t share_access;
 	/* Does this filesystem honor
 	   sub second timestamps on files
 	   and directories when setting time ? */
diff --git a/source3/lib/sharesec.c b/source3/lib/sharesec.c
index ed971a9..0c06d7b 100644
--- a/source3/lib/sharesec.c
+++ b/source3/lib/sharesec.c
@@ -410,8 +410,10 @@ bool delete_share_security(const char *servicename)
  Can this user access with share with the required permissions ?
 ********************************************************************/
 
-bool share_access_check(const struct security_token *token, const char *sharename,
-			uint32 desired_access)
+bool share_access_check(const struct security_token *token,
+			const char *sharename,
+			uint32 desired_access,
+			uint32_t *pgranted)
 {
 	uint32 granted;
 	NTSTATUS status;
@@ -428,6 +430,10 @@ bool share_access_check(const struct security_token *token, const char *sharenam
 
 	TALLOC_FREE(psd);
 
+	if (pgranted != NULL) {
+		*pgranted = granted;
+	}
+
 	return NT_STATUS_IS_OK(status);
 }
 
diff --git a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
index 7299d4c..7d52a76 100644
--- a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
+++ b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
@@ -541,8 +541,8 @@ static bool is_enumeration_allowed(struct pipes_struct *p,
     if (!lp_access_based_share_enum(snum))
         return true;
 
-    return share_access_check(p->session_info->security_token, lp_servicename(snum),
-                              FILE_READ_DATA);
+    return share_access_check(p->session_info->security_token,
+			      lp_servicename(snum), FILE_READ_DATA, NULL);
 }
 
 /*******************************************************************
diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index 86a5924..bbab9f1 100644
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -76,6 +76,14 @@ NTSTATUS smbd_check_open_rights(struct connection_struct *conn,
 	/* Check if we have rights to open. */
 	NTSTATUS status;
 	struct security_descriptor *sd = NULL;
+	uint32_t rejected_share_access;
+
+	rejected_share_access = access_mask & ~(conn->share_access);
+
+	if (rejected_share_access) {
+		*access_granted = rejected_share_access;
+		return NT_STATUS_ACCESS_DENIED;
+	}
 
 	if ((access_mask & DELETE_ACCESS) && !lp_acl_check_permissions(SNUM(conn))) {
 		*access_granted = access_mask;
diff --git a/source3/smbd/service.c b/source3/smbd/service.c
index 73c3c4f..5c410be 100644
--- a/source3/smbd/service.c
+++ b/source3/smbd/service.c
@@ -641,27 +641,21 @@ connection_struct *make_connection_snum(struct smbd_server_connection *sconn,
 	 *
 	 */
 
-	{
-		bool can_write = False;
-
-		can_write = share_access_check(conn->session_info->security_token,
-					       lp_servicename(snum),
-					       FILE_WRITE_DATA);
-
-		if (!can_write) {
-			if (!share_access_check(conn->session_info->security_token,
-						lp_servicename(snum),
-						FILE_READ_DATA)) {
-				/* No access, read or write. */
-				DEBUG(0,("make_connection: connection to %s "
-					 "denied due to security "
-					 "descriptor.\n",
-					  lp_servicename(snum)));
-				*pstatus = NT_STATUS_ACCESS_DENIED;
-				goto err_root_exit;
-			} else {
-				conn->read_only = True;
-			}
+	share_access_check(conn->session_info->security_token,
+			   lp_servicename(snum), MAXIMUM_ALLOWED_ACCESS,
+			   &conn->share_access);
+
+	if ((conn->share_access & FILE_WRITE_DATA) == 0) {
+		if ((conn->share_access & FILE_READ_DATA) == 0) {
+			/* No access, read or write. */
+			DEBUG(0,("make_connection: connection to %s "
+				 "denied due to security "
+				 "descriptor.\n",
+				 lp_servicename(snum)));
+			*pstatus = NT_STATUS_ACCESS_DENIED;
+			goto err_root_exit;
+		} else {
+			conn->read_only = True;
 		}
 	}
 	/* Initialise VFS function pointers */
diff --git a/source3/smbd/uid.c b/source3/smbd/uid.c
index 285b158..8114144 100644
--- a/source3/smbd/uid.c
+++ b/source3/smbd/uid.c
@@ -121,8 +121,9 @@ static bool check_user_ok(connection_struct *conn,
 		conn);
 
 	if (!readonly_share &&
-	    !share_access_check(session_info->security_token, lp_servicename(snum),
-				FILE_WRITE_DATA)) {
+	    !share_access_check(session_info->security_token,
+				lp_servicename(snum), FILE_WRITE_DATA,
+				NULL)) {
 		/* smb.conf allows r/w, but the security descriptor denies
 		 * write. Fall back to looking at readonly. */
 		readonly_share = True;
@@ -130,9 +131,11 @@ static bool check_user_ok(connection_struct *conn,
 			 "security descriptor\n"));
 	}
 
-	if (!share_access_check(session_info->security_token, lp_servicename(snum),
+	if (!share_access_check(session_info->security_token,
+				lp_servicename(snum),
 				readonly_share ?
-				FILE_READ_DATA : FILE_WRITE_DATA)) {
+				FILE_READ_DATA : FILE_WRITE_DATA,
+				NULL)) {
 		return False;
 	}
 


-- 
Samba Shared Repository


More information about the samba-cvs mailing list