Changeset 272 for branches/samba-3.2.x/source/smbd/posix_acls.c

Timestamp:

Jun 16, 2009, 5:52:30 PM (16 years ago)

Author:

Herwig Bauernfeind

Message:

Update 3.2 to 3.2.12

File:

• branches/samba-3.2.x/source/smbd/posix_acls.c (modified) (9 diffs)

branches/samba-3.2.x/source/smbd/posix_acls.c

@@ -4 +4 @@
    Copyright (C) Jeremy Allison 1994-2000.
    Copyright (C) Andreas Gruenbacher 2002.
+   Copyright (C) Simo Sorce <idra@samba.org> 2009.
 
    This program is free software; you can redistribute it and/or modify
@@ -1119 +1120 @@
                 return True;
 
-        /* Assume that the current user is in the current group (force group) */
-
-        if (uid_ace->unix_ug.uid == current_user.ut.uid && group_ace->unix_ug.gid == current_user.ut.gid)
-                return True;
+        /*
+         * if it's the current user, we already have the unix token
+         * and don't need to do the complex user_in_group_sid() call
+         */
+        if (uid_ace->unix_ug.uid == current_user.ut.uid) {
+                size_t i;
+
+                if (group_ace->unix_ug.gid == current_user.ut.gid) {
+                        return True;
+                }
+
+                for (i=0; i < current_user.ut.ngroups; i++) {
+                        if (group_ace->unix_ug.gid == current_user.ut.groups[i]) {
+                                return True;
+                        }
+                }
+        }
 
         /* u_name talloc'ed off tos. */
@@ -1129 +1143 @@
                 return False;
         }
+
+        /* notice that this is not reliable for users exported by winbindd! */
         return user_in_group_sid(u_name, &group_ace->trustee);
 }
@@ -2815 +2831 @@
 }
 
+/*
+ * Add or Replace ACE entry.
+ * In some cases we need to add a specific ACE for compatibility reasons.
+ * When doing that we must make sure we are not actually creating a duplicate
+ * entry. So we need to search whether an ACE entry already exist and eventually
+ * replacce the access mask, or add a completely new entry if none was found.
+ *
+ * This function assumes the array has enough space to add a new entry without
+ * any reallocation of memory.
+ */
+
+static void add_or_replace_ace(SEC_ACE *nt_ace_list, size_t *num_aces,
+                                const DOM_SID *sid, enum security_ace_type type,
+                                uint32_t mask, uint8_t flags)
+{
+        int i;
+
+        /* first search for a duplicate */
+        for (i = 0; i < *num_aces; i++) {
+                if (sid_equal(&nt_ace_list[i].trustee, sid) &&
+                    (nt_ace_list[i].flags == flags)) break;
+        }
+
+        if (i < *num_aces) { /* found */
+                nt_ace_list[i].type = type;
+                nt_ace_list[i].access_mask = mask;
+                DEBUG(10, ("Replacing ACE %d with SID %s and flags %02x\n",
+                           i, sid_string_dbg(sid), flags));
+                return;
+        }
+
+        /* not found, append it */
+        init_sec_ace(&nt_ace_list[(*num_aces)++], sid, type, mask, flags);
+}
+
+
 /****************************************************************************
  Reply to query a security descriptor from an fsp. If it succeeds it allocates
@@ -2842 +2894 @@
         SEC_ACE *nt_ace_list = NULL;
         size_t num_profile_acls = 0;
+        DOM_SID orig_owner_sid;
         SEC_DESC *psd = NULL;
+        int i;
 
         /*
@@ -2848 +2902 @@
          */
 
+        create_file_sids(sbuf, &owner_sid, &group_sid);
+
         if (lp_profile_acls(SNUM(conn))) {
                 /* For WXP SP1 the owner must be administrators. */
+                sid_copy(&orig_owner_sid, &owner_sid);
                 sid_copy(&owner_sid, &global_sid_Builtin_Administrators);
                 sid_copy(&group_sid, &global_sid_Builtin_Users);
-                num_profile_acls = 2;
-        } else {
-                create_file_sids(sbuf, &owner_sid, &group_sid);
+                num_profile_acls = 3;
         }
 
@@ -2978 +3033 @@
                          * if we can't map the SID. */
                         if (lp_profile_acls(SNUM(conn))) {
-                                SEC_ACCESS acc;
-
-                                init_sec_access(&acc,FILE_GENERIC_ALL);
-                                init_sec_ace(&nt_ace_list[num_aces++],
-                                                &global_sid_Builtin_Users,
-                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
-                                                acc, 0);
+                                add_or_replace_ace(nt_ace_list, &num_aces,
+                                                   &global_sid_Builtin_Users,
+                                                   SEC_ACE_TYPE_ACCESS_ALLOWED,
+                                                   FILE_GENERIC_ALL, 0);
                         }
 
@@ -3008 +3060 @@
                          * if we can't map the SID. */
                         if (lp_profile_acls(SNUM(conn))) {
-                                SEC_ACCESS acc;
-
-                                init_sec_access(&acc,FILE_GENERIC_ALL);
-                                init_sec_ace(&nt_ace_list[num_aces++], &global_sid_Builtin_Users, SEC_ACE_TYPE_ACCESS_ALLOWED, acc,
-                                                SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
-                                                SEC_ACE_FLAG_INHERIT_ONLY|0);
+                                add_or_replace_ace(nt_ace_list, &num_aces,
+                                                &global_sid_Builtin_Users,
+                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
+                                                FILE_GENERIC_ALL,
+                                                SEC_ACE_FLAG_OBJECT_INHERIT |
+                                                SEC_ACE_FLAG_CONTAINER_INHERIT |
+                                                SEC_ACE_FLAG_INHERIT_ONLY);
                         }
 
@@ -3024 +3077 @@
                         num_aces = merge_default_aces(nt_ace_list, num_aces);
 
+                        if (lp_profile_acls(SNUM(conn))) {
+                                for (i = 0; i < num_aces; i++) {
+                                        if (sid_equal(&nt_ace_list[i].trustee, &owner_sid)) {
+                                                add_or_replace_ace(nt_ace_list, &num_aces,
+                                                                   &orig_owner_sid,
+                                                                   nt_ace_list[i].type,
+                                                                   nt_ace_list[i].access_mask,
+                                                                   nt_ace_list[i].flags);
+                                                break;
+                                        }
+                                }
+                        }
                 }