Changeset 222 for branches/samba-3.3.x/source/smbd/open.c

Timestamp:

May 24, 2009, 7:45:16 AM (16 years ago)

Author:

Herwig Bauernfeind

Message:

Update Samba 3.3 branch to 3.3.2

File:

• branches/samba-3.3.x/source/smbd/open.c (modified) (4 diffs)

branches/samba-3.3.x/source/smbd/open.c

@@ -59 +59 @@
 
         *access_granted = 0;
+
+        if (conn->server_info->utok.uid == 0 || conn->admin_user) {
+                /* I'm sorry sir, I didn't know you were root... */
+                *access_granted = access_mask;
+                if (access_mask & SEC_FLAG_MAXIMUM_ALLOWED) {
+                        *access_granted |= FILE_GENERIC_ALL;
+                }
+                return NT_STATUS_OK;
+        }
 
         status = SMB_VFS_GET_NT_ACL(conn, fname,
@@ -2383 +2392 @@
         }
 
+        /* We need to support SeSecurityPrivilege for this. */
+        if (access_mask & SEC_RIGHT_SYSTEM_SECURITY) {
+                DEBUG(10, ("open_directory: open on %s "
+                        "failed - SEC_RIGHT_SYSTEM_SECURITY denied.\n",
+                        fname));
+                return NT_STATUS_PRIVILEGE_NOT_HELD;
+        }
+
         switch( create_disposition ) {
                 case FILE_OPEN:
@@ -2463 +2480 @@
                                         access_mask,
                                         &access_granted);
+
+                /* Were we trying to do a directory open
+                 * for delete and didn't get DELETE
+                 * access (only) ? Check if the
+                 * directory allows DELETE_CHILD.
+                 * See here:
+                 * http://blogs.msdn.com/oldnewthing/archive/2004/06/04/148426.aspx
+                 * for details. */
+
+                if ((NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) &&
+                                (access_mask & DELETE_ACCESS) &&
+                                (access_granted == DELETE_ACCESS) &&
+                                can_delete_file_in_directory(conn, fname))) {
+                        DEBUG(10,("open_directory: overrode ACCESS_DENIED "
+                                "on directory %s\n",
+                                fname ));
+                        status = NT_STATUS_OK;
+                }
+
                 if (!NT_STATUS_IS_OK(status)) {
                         DEBUG(10, ("open_directory: check_open_rights on "
@@ -2897 +2933 @@
                 goto fail;
         }
+#else
+        /* We need to support SeSecurityPrivilege for this. */
+        if (access_mask & SEC_RIGHT_SYSTEM_SECURITY) {
+                status = NT_STATUS_PRIVILEGE_NOT_HELD;
+                goto fail;
+        }
+        /* Don't allow a SACL set from an NTtrans create until we
+         * support SeSecurityPrivilege. */
+        if (!VALID_STAT(sbuf) &&
+                        lp_nt_acl_support(SNUM(conn)) &&
+                        sd && (sd->sacl != NULL)) {
+                status = NT_STATUS_PRIVILEGE_NOT_HELD;
+                goto fail;
+        }
 #endif