spoolss issues (Re: [PATCH] Change system handling in smbd)

[David Disseldorp]

Hi Andrew,

On Fri, 15 Jun 2012 22:10:50 +1000
Andrew Bartlett <abartlet at samba.org> wrote:

> There is a problem.  While I can fix up the build issue, removing the
> getpwuid() and passdb dependency is harder, as it breaks spoolss tests.
> 
> Annoyingly, this doesn't seem happen in an individual test, so far I've
> only reproduced it during a full make test:
> 
> [485/671 in 13m52s] samba3.rpc.spoolss.driver(s3dc)

In handling the DeletePrinterDriverEx request spoolss needs to issue IO
to the print$ share, to do so it creates a fake connection struct.

This change-set fails in share_access_check() when checking the print$
share DACL (grant full access to global_sid_World) against the system
token, as the system token does not include global_sid_World.

Adding global_sid_World to the system security token allows the test to
pass, however this should not be necessary.
DeletePrinterDriverEx should be handled by the RPC server as the user
connected to the spoolss pipe (unless force user/group is set), the
system security token should be irrelevant through this code path IIUC.

Cheers, David