Changeset 228 for branches/samba-3.2.x/source/smbd/uid.c

Timestamp:

May 26, 2009, 9:44:50 AM (16 years ago)

Author:

Herwig Bauernfeind

Message:

Update 3.2 branch to 3.2.6

File:

• branches/samba-3.2.x/source/smbd/uid.c (modified) (4 diffs)

branches/samba-3.2.x/source/smbd/uid.c

@@ -103 +103 @@
         readonly_share = is_share_read_only_for_token(vuser->user.unix_name,
                                                       vuser->nt_user_token,
-                                                      SNUM(conn));
+                                                      conn);
 
         token = conn->nt_user_token ?
@@ -141 +141 @@
         return(True);
 }
+
+/*******************************************************************
+ Check if a username is OK in share level security.
+********************************************************************/
+
+static bool check_user_ok_sharelevel_security(connection_struct *conn,
+                                        const char *unix_name,
+                                        int snum)
+{
+        NT_USER_TOKEN *token = conn->nt_user_token;
+
+        if (!user_ok_token(unix_name, token, snum)) {
+                return false;
+        }
+
+        conn->read_only = is_share_read_only_for_token(unix_name,
+                                                      token,
+                                                      conn);
+
+        if (!conn->read_only &&
+            !share_access_check(token, lp_servicename(snum),
+                                FILE_WRITE_DATA)) {
+                /* smb.conf allows r/w, but the security descriptor denies
+                 * write. Fall back to looking at readonly. */
+                conn->read_only = true;
+                DEBUG(5,("falling back to read-only access-evaluation due to "
+                         "security descriptor\n"));
+        }
+
+        if (!share_access_check(token, lp_servicename(snum),
+                                conn->read_only ?
+                                FILE_READ_DATA : FILE_WRITE_DATA)) {
+                return false;
+        }
+
+        conn->admin_user = token_contains_name_in_list(
+                                unix_name, NULL, token,
+                                lp_admin_users(SNUM(conn)));
+
+        return true;
+}
+
 
 /****************************************************************************
@@ -173 +215 @@
          */
 
-        if((lp_security() == SEC_SHARE) && (current_user.conn == conn) &&
+        if((sec == SEC_SHARE) && (current_user.conn == conn) &&
            (current_user.ut.uid == conn->uid)) {
                 DEBUG(4,("change_to_user: Skipping user change - already "
@@ -194 +236 @@
                          lp_servicename(snum)));
                 return False;
+        } else if ((sec == SEC_SHARE) && !check_user_ok_sharelevel_security(conn,
+                        conn->user, snum)) {
+                DEBUG(2,("change_to_user: unix user %s "
+                         "not permitted access to share %s.\n",
+                         conn->user,
+                         lp_servicename(snum)));
+                return false;
         }