[SCM] Samba Shared Repository - branch v4-0-test updated
Karolin Seeger
kseeger at samba.org
Thu Nov 14 03:40:04 MST 2013
The branch, v4-0-test has been updated
via e76556d Fix bug 10196 - RW Deny for a specific user is not overriding RW Allow for a group.
via 2c2d292 Fix bug 10196 - RW Deny for a specific user is not overriding RW Allow for a group.
from c87f8ed xattr: fix listing EAs on *BSD for non-root users
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v4-0-test
- Log -----------------------------------------------------------------
commit e76556d1c81590839fed5dde4035331a38b36db2
Author: Jeremy Allison <jra at samba.org>
Date: Wed Oct 23 15:06:40 2013 -0700
Fix bug 10196 - RW Deny for a specific user is not overriding RW Allow for a group.
Fix posix_acl tests to match the change in writing ACLs
with ID_TYPE_BOTH.
Signed-off-by: Jeremy Allison <jra at samba.org>
Reviewed-by: David Disseldorp <ddiss at samba.org>
(cherry picked from commit a1bc1c32e33508c45e614646d69a5f5d67ba22be)
Autobuild-User(v4-0-test): Karolin Seeger <kseeger at samba.org>
Autobuild-Date(v4-0-test): Thu Nov 14 11:39:10 CET 2013 on sn-devel-104
commit 2c2d292f8b3cd3457815af6db54542ba227eb746
Author: Jeremy Allison <jra at samba.org>
Date: Mon Oct 21 16:59:11 2013 -0700
Fix bug 10196 - RW Deny for a specific user is not overriding RW Allow for a group.
When the ID returned is ID_TYPE_BOTH we must *always* add it as both
a user and a group, not just in the owning case. Otherwise DENY
entries are not correctly processed.
Confirmed by the reporter as fixing the problem.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10196
Signed-off-by: Jeremy Allison <jra at samba.org>
Reviewed-by: David Disseldorp <ddiss at samba.org>
(cherry picked from commit 14813e74431816cd894fb242ff5633c2cd14ddca)
-----------------------------------------------------------------------
Summary of changes:
python/samba/tests/posixacl.py | 160 +++++++++++++++++++++++++++++-----------
source3/smbd/posix_acls.c | 79 ++++++++++----------
2 files changed, 157 insertions(+), 82 deletions(-)
Changeset truncated at 500 lines:
diff --git a/python/samba/tests/posixacl.py b/python/samba/tests/posixacl.py
index 6a234e4..1948e8b 100644
--- a/python/samba/tests/posixacl.py
+++ b/python/samba/tests/posixacl.py
@@ -319,7 +319,7 @@ class PosixAclMappingTests(TestCaseInTempDir):
(AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
- self.assertEquals(posix_acl.count, 9)
+ self.assertEquals(posix_acl.count, 13)
self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
self.assertEquals(posix_acl.acl[0].a_perm, 7)
@@ -335,23 +335,39 @@ class PosixAclMappingTests(TestCaseInTempDir):
self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
self.assertEquals(posix_acl.acl[3].a_perm, 6)
- self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
+ self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
self.assertEquals(posix_acl.acl[4].a_perm, 7)
+ self.assertEquals(posix_acl.acl[4].info.uid, BA_gid)
- self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
- self.assertEquals(posix_acl.acl[5].a_perm, 5)
- self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
+ self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
+ self.assertEquals(posix_acl.acl[5].a_perm, 7)
- self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
- self.assertEquals(posix_acl.acl[6].a_perm, 7)
- self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
+ self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
+ self.assertEquals(posix_acl.acl[6].a_perm, 5)
+ self.assertEquals(posix_acl.acl[6].info.uid, SO_gid)
self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
self.assertEquals(posix_acl.acl[7].a_perm, 5)
- self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
+ self.assertEquals(posix_acl.acl[7].info.gid, SO_gid)
- self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_MASK)
+ self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
self.assertEquals(posix_acl.acl[8].a_perm, 7)
+ self.assertEquals(posix_acl.acl[8].info.uid, SY_gid)
+
+ self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
+ self.assertEquals(posix_acl.acl[9].a_perm, 7)
+ self.assertEquals(posix_acl.acl[9].info.gid, SY_gid)
+
+ self.assertEquals(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
+ self.assertEquals(posix_acl.acl[10].a_perm, 5)
+ self.assertEquals(posix_acl.acl[10].info.uid, AU_gid)
+
+ self.assertEquals(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
+ self.assertEquals(posix_acl.acl[11].a_perm, 5)
+ self.assertEquals(posix_acl.acl[11].info.gid, AU_gid)
+
+ self.assertEquals(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_MASK)
+ self.assertEquals(posix_acl.acl[12].a_perm, 7)
# check that it matches:
@@ -437,7 +453,7 @@ class PosixAclMappingTests(TestCaseInTempDir):
(AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
- self.assertEquals(posix_acl.count, 9)
+ self.assertEquals(posix_acl.count, 13)
self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
self.assertEquals(posix_acl.acl[0].a_perm, 7)
@@ -453,23 +469,39 @@ class PosixAclMappingTests(TestCaseInTempDir):
self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
self.assertEquals(posix_acl.acl[3].a_perm, 7)
- self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
+ self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
self.assertEquals(posix_acl.acl[4].a_perm, 7)
+ self.assertEquals(posix_acl.acl[4].info.uid, BA_gid)
- self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
- self.assertEquals(posix_acl.acl[5].a_perm, 5)
- self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
+ self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
+ self.assertEquals(posix_acl.acl[5].a_perm, 7)
- self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
- self.assertEquals(posix_acl.acl[6].a_perm, 7)
- self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
+ self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
+ self.assertEquals(posix_acl.acl[6].a_perm, 5)
+ self.assertEquals(posix_acl.acl[6].info.uid, SO_gid)
self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
self.assertEquals(posix_acl.acl[7].a_perm, 5)
- self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
+ self.assertEquals(posix_acl.acl[7].info.gid, SO_gid)
- self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_MASK)
+ self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
self.assertEquals(posix_acl.acl[8].a_perm, 7)
+ self.assertEquals(posix_acl.acl[8].info.uid, SY_gid)
+
+ self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
+ self.assertEquals(posix_acl.acl[9].a_perm, 7)
+ self.assertEquals(posix_acl.acl[9].info.gid, SY_gid)
+
+ self.assertEquals(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
+ self.assertEquals(posix_acl.acl[10].a_perm, 5)
+ self.assertEquals(posix_acl.acl[10].info.uid, AU_gid)
+
+ self.assertEquals(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
+ self.assertEquals(posix_acl.acl[11].a_perm, 5)
+ self.assertEquals(posix_acl.acl[11].info.gid, AU_gid)
+
+ self.assertEquals(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_MASK)
+ self.assertEquals(posix_acl.acl[12].a_perm, 7)
# check that it matches:
@@ -517,7 +549,7 @@ class PosixAclMappingTests(TestCaseInTempDir):
(PA_gid,PA_type) = s4_passdb.sid_to_id(PA_sid)
self.assertEquals(PA_type, idmap.ID_TYPE_BOTH)
- self.assertEquals(posix_acl.count, 10)
+ self.assertEquals(posix_acl.count, 15)
self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
self.assertEquals(posix_acl.acl[0].a_perm, 7)
@@ -533,27 +565,47 @@ class PosixAclMappingTests(TestCaseInTempDir):
self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
self.assertEquals(posix_acl.acl[3].a_perm, 7)
- self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
+ self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
self.assertEquals(posix_acl.acl[4].a_perm, 7)
+ self.assertEquals(posix_acl.acl[4].info.uid, BA_gid)
- self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
- self.assertEquals(posix_acl.acl[5].a_perm, 5)
- self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
+ self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
+ self.assertEquals(posix_acl.acl[5].a_perm, 7)
- self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
- self.assertEquals(posix_acl.acl[6].a_perm, 7)
- self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
+ self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
+ self.assertEquals(posix_acl.acl[6].a_perm, 5)
+ self.assertEquals(posix_acl.acl[6].info.uid, SO_gid)
self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
self.assertEquals(posix_acl.acl[7].a_perm, 5)
- self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
+ self.assertEquals(posix_acl.acl[7].info.gid, SO_gid)
- self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_GROUP)
+ self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
self.assertEquals(posix_acl.acl[8].a_perm, 7)
- self.assertEquals(posix_acl.acl[8].info.gid, PA_gid)
+ self.assertEquals(posix_acl.acl[8].info.uid, SY_gid)
- self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_MASK)
+ self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
self.assertEquals(posix_acl.acl[9].a_perm, 7)
+ self.assertEquals(posix_acl.acl[9].info.gid, SY_gid)
+
+ self.assertEquals(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
+ self.assertEquals(posix_acl.acl[10].a_perm, 5)
+ self.assertEquals(posix_acl.acl[10].info.uid, AU_gid)
+
+ self.assertEquals(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
+ self.assertEquals(posix_acl.acl[11].a_perm, 5)
+ self.assertEquals(posix_acl.acl[11].info.gid, AU_gid)
+
+ self.assertEquals(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_USER)
+ self.assertEquals(posix_acl.acl[12].a_perm, 7)
+ self.assertEquals(posix_acl.acl[12].info.uid, PA_gid)
+
+ self.assertEquals(posix_acl.acl[13].a_type, smb_acl.SMB_ACL_GROUP)
+ self.assertEquals(posix_acl.acl[13].a_perm, 7)
+ self.assertEquals(posix_acl.acl[13].info.gid, PA_gid)
+
+ self.assertEquals(posix_acl.acl[14].a_type, smb_acl.SMB_ACL_MASK)
+ self.assertEquals(posix_acl.acl[14].a_perm, 7)
# check that it matches:
@@ -604,7 +656,7 @@ class PosixAclMappingTests(TestCaseInTempDir):
(PA_gid,PA_type) = s4_passdb.sid_to_id(PA_sid)
self.assertEquals(PA_type, idmap.ID_TYPE_BOTH)
- self.assertEquals(posix_acl.count, 10)
+ self.assertEquals(posix_acl.count, 15)
self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
self.assertEquals(posix_acl.acl[0].a_perm, 7)
@@ -620,27 +672,47 @@ class PosixAclMappingTests(TestCaseInTempDir):
self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
self.assertEquals(posix_acl.acl[3].a_perm, 6)
- self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
+ self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
self.assertEquals(posix_acl.acl[4].a_perm, 7)
+ self.assertEquals(posix_acl.acl[4].info.uid, BA_gid)
- self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
- self.assertEquals(posix_acl.acl[5].a_perm, 5)
- self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
+ self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
+ self.assertEquals(posix_acl.acl[5].a_perm, 7)
- self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
- self.assertEquals(posix_acl.acl[6].a_perm, 7)
- self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
+ self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
+ self.assertEquals(posix_acl.acl[6].a_perm, 5)
+ self.assertEquals(posix_acl.acl[6].info.uid, SO_gid)
self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
self.assertEquals(posix_acl.acl[7].a_perm, 5)
- self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
+ self.assertEquals(posix_acl.acl[7].info.gid, SO_gid)
- self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_GROUP)
+ self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
self.assertEquals(posix_acl.acl[8].a_perm, 7)
- self.assertEquals(posix_acl.acl[8].info.gid, PA_gid)
+ self.assertEquals(posix_acl.acl[8].info.uid, SY_gid)
- self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_MASK)
+ self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
self.assertEquals(posix_acl.acl[9].a_perm, 7)
+ self.assertEquals(posix_acl.acl[9].info.gid, SY_gid)
+
+ self.assertEquals(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
+ self.assertEquals(posix_acl.acl[10].a_perm, 5)
+ self.assertEquals(posix_acl.acl[10].info.uid, AU_gid)
+
+ self.assertEquals(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
+ self.assertEquals(posix_acl.acl[11].a_perm, 5)
+ self.assertEquals(posix_acl.acl[11].info.gid, AU_gid)
+
+ self.assertEquals(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_USER)
+ self.assertEquals(posix_acl.acl[12].a_perm, 7)
+ self.assertEquals(posix_acl.acl[12].info.uid, PA_gid)
+
+ self.assertEquals(posix_acl.acl[13].a_type, smb_acl.SMB_ACL_GROUP)
+ self.assertEquals(posix_acl.acl[13].a_perm, 7)
+ self.assertEquals(posix_acl.acl[13].info.gid, PA_gid)
+
+ self.assertEquals(posix_acl.acl[14].a_type, smb_acl.SMB_ACL_MASK)
+ self.assertEquals(posix_acl.acl[14].a_perm, 7)
# check that it matches:
diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index 713ad50..2685f6a 100644
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -1980,47 +1980,50 @@ static bool create_canon_ace_lists(files_struct *fsp,
}
if (unixid.type == ID_TYPE_BOTH) {
- /* If it's the owning user, this is a
- * user_obj, not a user. This way, we
- * get a valid ACL for groups that own
- * files, without putting user ACL
- * entries in for groups otherwise */
- if (unixid.id == pst->st_ex_uid) {
- current_ace->owner_type = UID_ACE;
- current_ace->unix_ug.type = ID_TYPE_UID;
- current_ace->unix_ug.id = unixid.id;
- current_ace->type = SMB_ACL_USER_OBJ;
-
- /* Add the user object to the posix ACL,
- and proceed to the group mapping
- below. This handles the talloc_free
- of current_ace if not added for some
- reason */
- if (!add_current_ace_to_acl(fsp,
- psa,
- &file_ace,
- &dir_ace,
- &got_file_allow,
- &got_dir_allow,
- &all_aces_are_inherit_only,
- current_ace)) {
- free_canon_ace_list(file_ace);
- free_canon_ace_list(dir_ace);
- return false;
- }
-
- if ((current_ace = talloc(talloc_tos(),
- canon_ace)) == NULL) {
- free_canon_ace_list(file_ace);
- free_canon_ace_list(dir_ace);
- DEBUG(0,("create_canon_ace_lists: "
- "malloc fail.\n"));
- return False;
- }
+ /*
+ * We must add both a user and group
+ * entry POSIX_ACL.
+ * This is due to the fact that in POSIX
+ * user entries are more specific than
+ * groups.
+ */
+ current_ace->owner_type = UID_ACE;
+ current_ace->unix_ug.type = ID_TYPE_UID;
+ current_ace->unix_ug.id = unixid.id;
+ current_ace->type =
+ (unixid.id == pst->st_ex_uid) ?
+ SMB_ACL_USER_OBJ :
+ SMB_ACL_USER;
+
+ /* Add the user object to the posix ACL,
+ and proceed to the group mapping
+ below. This handles the talloc_free
+ of current_ace if not added for some
+ reason */
+ if (!add_current_ace_to_acl(fsp,
+ psa,
+ &file_ace,
+ &dir_ace,
+ &got_file_allow,
+ &got_dir_allow,
+ &all_aces_are_inherit_only,
+ current_ace)) {
+ free_canon_ace_list(file_ace);
+ free_canon_ace_list(dir_ace);
+ return false;
+ }
- ZERO_STRUCTP(current_ace);
+ if ((current_ace = talloc(talloc_tos(),
+ canon_ace)) == NULL) {
+ free_canon_ace_list(file_ace);
+ free_canon_ace_list(dir_ace);
+ DEBUG(0,("create_canon_ace_lists: "
+ "malloc fail.\n"));
+ return False;
}
+ ZERO_STRUCTP(current_ace);
+
sid_copy(¤t_ace->trustee, &psa->trustee);
current_ace->unix_ug.type = ID_TYPE_GID;
--
Samba Shared Repository
More information about the samba-cvs
mailing list