Changeset 224 for branches/samba-3.3.x/source/smbd/posix_acls.c

Timestamp:

May 24, 2009, 7:55:48 AM (16 years ago)

Author:

Herwig Bauernfeind

Message:

Update Samba 3.3 branch to 3.3.4

File:

• branches/samba-3.3.x/source/smbd/posix_acls.c (modified) (7 diffs)

branches/samba-3.3.x/source/smbd/posix_acls.c

@@ -4 +4 @@
    Copyright (C) Jeremy Allison 1994-2000.
    Copyright (C) Andreas Gruenbacher 2002.
+   Copyright (C) Simo Sorce <idra@samba.org> 2009.
 
    This program is free software; you can redistribute it and/or modify
@@ -2815 +2816 @@
 }
 
+/*
+ * Add or Replace ACE entry.
+ * In some cases we need to add a specific ACE for compatibility reasons.
+ * When doing that we must make sure we are not actually creating a duplicate
+ * entry. So we need to search whether an ACE entry already exist and eventually
+ * replacce the access mask, or add a completely new entry if none was found.
+ *
+ * This function assumes the array has enough space to add a new entry without
+ * any reallocation of memory.
+ */
+
+static void add_or_replace_ace(SEC_ACE *nt_ace_list, size_t *num_aces,
+                                const DOM_SID *sid, enum security_ace_type type,
+                                uint32_t mask, uint8_t flags)
+{
+        int i;
+
+        /* first search for a duplicate */
+        for (i = 0; i < *num_aces; i++) {
+                if (sid_equal(&nt_ace_list[i].trustee, sid) &&
+                    (nt_ace_list[i].flags == flags)) break;
+        }
+
+        if (i < *num_aces) { /* found */
+                nt_ace_list[i].type = type;
+                nt_ace_list[i].access_mask = mask;
+                DEBUG(10, ("Replacing ACE %d with SID %s and flags %02x\n",
+                           i, sid_string_dbg(sid), flags));
+                return;
+        }
+
+        /* not found, append it */
+        init_sec_ace(&nt_ace_list[(*num_aces)++], sid, type, mask, flags);
+}
+
+
 /****************************************************************************
  Reply to query a security descriptor from an fsp. If it succeeds it allocates
@@ -2842 +2879 @@
         SEC_ACE *nt_ace_list = NULL;
         size_t num_profile_acls = 0;
+        DOM_SID orig_owner_sid;
         SEC_DESC *psd = NULL;
+        int i;
 
         /*
@@ -2848 +2887 @@
          */
 
+        create_file_sids(sbuf, &owner_sid, &group_sid);
+
         if (lp_profile_acls(SNUM(conn))) {
                 /* For WXP SP1 the owner must be administrators. */
+                sid_copy(&orig_owner_sid, &owner_sid);
                 sid_copy(&owner_sid, &global_sid_Builtin_Administrators);
                 sid_copy(&group_sid, &global_sid_Builtin_Users);
-                num_profile_acls = 2;
-        } else {
-                create_file_sids(sbuf, &owner_sid, &group_sid);
+                num_profile_acls = 3;
         }
 
@@ -2976 +3016 @@
                          * if we can't map the SID. */
                         if (lp_profile_acls(SNUM(conn))) {
-                                init_sec_ace(&nt_ace_list[num_aces++],
-                                                &global_sid_Builtin_Users,
-                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
-                                                FILE_GENERIC_ALL, 0);
+                                add_or_replace_ace(nt_ace_list, &num_aces,
+                                                   &global_sid_Builtin_Users,
+                                                   SEC_ACE_TYPE_ACCESS_ALLOWED,
+                                                   FILE_GENERIC_ALL, 0);
                         }
 
@@ -3001 +3041 @@
                          * if we can't map the SID. */
                         if (lp_profile_acls(SNUM(conn))) {
-                                init_sec_ace(&nt_ace_list[num_aces++], &global_sid_Builtin_Users, SEC_ACE_TYPE_ACCESS_ALLOWED, FILE_GENERIC_ALL,
-                                                SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
-                                                SEC_ACE_FLAG_INHERIT_ONLY|0);
+                                add_or_replace_ace(nt_ace_list, &num_aces,
+                                                &global_sid_Builtin_Users,
+                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
+                                                FILE_GENERIC_ALL,
+                                                SEC_ACE_FLAG_OBJECT_INHERIT |
+                                                SEC_ACE_FLAG_CONTAINER_INHERIT |
+                                                SEC_ACE_FLAG_INHERIT_ONLY);
                         }
 
@@ -3014 +3058 @@
                         num_aces = merge_default_aces(nt_ace_list, num_aces);
 
+                        if (lp_profile_acls(SNUM(conn))) {
+                                for (i = 0; i < num_aces; i++) {
+                                        if (sid_equal(&nt_ace_list[i].trustee, &owner_sid)) {
+                                                add_or_replace_ace(nt_ace_list, &num_aces,
+                                                                   &orig_owner_sid,
+                                                                   nt_ace_list[i].type,
+                                                                   nt_ace_list[i].access_mask,
+                                                                   nt_ace_list[i].flags);
+                                                break;
+                                        }
+                                }
+                        }
                 }