Changeset 597 for vendor/current/source3/smbd

Timestamp:

Jul 2, 2011, 4:01:14 PM (14 years ago)

Author:

Herwig Bauernfeind

Message:

Samba 3.5: Update vendor to version 3.5.9

Location:

vendor/current/source3/smbd

Files:

• dosmode.c (modified) (1 diff)
• fake_file.c (modified) (1 diff)
• filename.c (modified) (1 diff)
• nttrans.c (modified) (2 diffs)
• open.c (modified) (11 diffs)
• posix_acls.c (modified) (1 diff)
• process.c (modified) (2 diffs)
• server.c (modified) (6 diffs)
• sesssetup.c (modified) (2 diffs)
• trans2.c (modified) (3 diffs)

vendor/current/source3/smbd/dosmode.c

@@ -794 +794 @@
         }
 
+        /*
+         * From the chmod 2 man page:
+         *
+         * "If the calling process is not privileged, and the group of the file
+         * does not match the effective group ID of the process or one of its
+         * supplementary group IDs, the S_ISGID bit will be turned off, but
+         * this will not cause an error to be returned."
+         *
+         * Simply refuse to do the chmod in this case.
+         */
+
+        if (S_ISDIR(smb_fname->st.st_ex_mode) && (unixmode & S_ISGID) &&
+                        geteuid() != sec_initial_uid() &&
+                        !current_user_in_group(smb_fname->st.st_ex_gid)) {
+                DEBUG(3,("file_set_dosmode: setgid bit cannot be "
+                        "set for directory %s\n",
+                        smb_fname_str_dbg(smb_fname)));
+                errno = EPERM;
+                return -1;
+        }
+
+
         ret = SMB_VFS_CHMOD(conn, smb_fname->base_name, unixmode);
         if (ret == 0) {

vendor/current/source3/smbd/fake_file.c

@@ -127 +127 @@
 
         /* access check */
-        if (conn->server_info->utok.uid != 0) {
+        if (conn->server_info->utok.uid != 0 && !conn->admin_user) {
                 DEBUG(3, ("open_fake_file_shared: access_denied to "
                           "service[%s] file[%s] user[%s]\n",

vendor/current/source3/smbd/filename.c

@@ -352 +352 @@
                         goto done;
                 }
+
+                /* Stat failed - ensure we don't use it. */
+                SET_STAT_INVALID(smb_fname->st);
 
                 /*

vendor/current/source3/smbd/nttrans.c

@@ -2311 +2311 @@
 
         /* access check */
-        if (conn->server_info->utok.uid != 0) {
+        if (conn->server_info->utok.uid != 0 && !conn->admin_user) {
                 DEBUG(1,("get_user_quota: access_denied service [%s] user "
                          "[%s]\n", lp_servicename(SNUM(conn)),
@@ -2581 +2581 @@
 
         /* access check */
-        if (conn->server_info->utok.uid != 0) {
+        if (conn->server_info->utok.uid != 0 && !conn->admin_user) {
                 DEBUG(1,("set_user_quota: access_denied service [%s] user "
                          "[%s]\n", lp_servicename(SNUM(conn)),

vendor/current/source3/smbd/open.c

@@ -233 +233 @@
                          (unsigned int)smb_fname_parent->st.st_ex_uid,
                          strerror(errno) ));
-        }
-
-        DEBUG(10,("change_file_owner_to_parent: changed new file %s to "
+        } else {
+                DEBUG(10,("change_file_owner_to_parent: changed new file %s to "
                   "parent directory uid %u.\n", fsp_str_dbg(fsp),
                   (unsigned int)smb_fname_parent->st.st_ex_uid));
+
+                /* Ensure the uid entry is updated. */
+                fsp->fsp_name->st.st_ex_uid = smb_fname_parent->st.st_ex_uid;
+        }
 
         TALLOC_FREE(smb_fname_parent);
@@ -312 +315 @@
         /* Ensure we're pointing at the same place. */
         if (smb_fname_cwd->st.st_ex_dev != psbuf->st_ex_dev ||
-            smb_fname_cwd->st.st_ex_ino != psbuf->st_ex_ino ||
-            smb_fname_cwd->st.st_ex_mode != psbuf->st_ex_mode ) {
+            smb_fname_cwd->st.st_ex_ino != psbuf->st_ex_ino) {
                 DEBUG(0,("change_dir_owner_to_parent: "
-                         "device/inode/mode on directory %s changed. "
+                         "device/inode on directory %s changed. "
                          "Refusing to chown !\n", fname ));
                 status = NT_STATUS_ACCESS_DENIED;
@@ -338 +340 @@
                   "directory %s to parent directory uid %u.\n",
                   fname, (unsigned int)smb_fname_parent->st.st_ex_uid ));
+
+        /* Ensure the uid entry is updated. */
+        psbuf->st_ex_uid = smb_fname_parent->st.st_ex_uid;
 
  chdir:
@@ -365 +370 @@
         int local_flags = flags;
         bool file_existed = VALID_STAT(fsp->fsp_name->st);
+        bool file_created = false;
 
         fsp->fh->fd = -1;
@@ -464 +470 @@
 
                 if ((local_flags & O_CREAT) && !file_existed) {
-
-                        /* Inherit the ACL if required */
-                        if (lp_inherit_perms(SNUM(conn))) {
-                                inherit_access_posix_acl(conn, parent_dir,
-                                                         smb_fname->base_name,
-                                                         unx_mode);
-                        }
-
-                        /* Change the owner if required. */
-                        if (lp_inherit_owner(SNUM(conn))) {
-                                change_file_owner_to_parent(conn, parent_dir,
-                                                            fsp);
-                        }
-
-                        notify_fname(conn, NOTIFY_ACTION_ADDED,
-                                     FILE_NOTIFY_CHANGE_FILE_NAME,
-                                     smb_fname->base_name);
+                        file_created = true;
                 }
 
@@ -589 +579 @@
                         fd_close(fsp);
                         return status;
+                }
+
+                if (file_created) {
+                        /* Do all inheritance work after we've
+                           done a successful stat call and filled
+                           in the stat struct in fsp->fsp_name. */
+
+                        /* Inherit the ACL if required */
+                        if (lp_inherit_perms(SNUM(conn))) {
+                                inherit_access_posix_acl(conn, parent_dir,
+                                                         smb_fname->base_name,
+                                                         unx_mode);
+                        }
+
+                        /* Change the owner if required. */
+                        if (lp_inherit_owner(SNUM(conn))) {
+                                change_file_owner_to_parent(conn, parent_dir,
+                                                            fsp);
+                        }
+
+                        notify_fname(conn, NOTIFY_ACTION_ADDED,
+                                     FILE_NOTIFY_CHANGE_FILE_NAME,
+                                     smb_fname->base_name);
                 }
         }
@@ -2307 +2320 @@
         NTSTATUS status;
         bool posix_open = false;
+        bool need_re_stat = false;
 
         if(!CAN_WRITE(conn)) {
@@ -2361 +2375 @@
                 inherit_access_posix_acl(conn, parent_dir,
                                          smb_dname->base_name, mode);
+                need_re_stat = true;
         }
 
@@ -2375 +2390 @@
                                       (smb_dname->st.st_ex_mode |
                                           (mode & ~smb_dname->st.st_ex_mode)));
+                        need_re_stat = true;
                 }
         }
@@ -2383 +2399 @@
                                            smb_dname->base_name,
                                            &smb_dname->st);
+                need_re_stat = true;
+        }
+
+        if (need_re_stat) {
+                if (SMB_VFS_LSTAT(conn, smb_dname) == -1) {
+                        DEBUG(2, ("Could not stat directory '%s' just created: %s\n",
+                          smb_fname_str_dbg(smb_dname), strerror(errno)));
+                        return map_nt_error_from_unix(errno);
+                }
         }
 
@@ -2945 +2970 @@
         if (lp_acl_check_permissions(SNUM(conn))
             && (create_disposition != FILE_CREATE)
-            && (share_access & FILE_SHARE_DELETE)
             && (access_mask & DELETE_ACCESS)
             && (!(can_delete_file_in_directory(conn, smb_fname) ||

vendor/current/source3/smbd/posix_acls.c

@@ -2645 +2645 @@
 ****************************************************************************/
 
-static bool current_user_in_group(gid_t gid)
+bool current_user_in_group(gid_t gid)
 {
         int i;

vendor/current/source3/smbd/process.c

@@ -2084 +2084 @@
                 {
                         DEBUG( 3,( "Printcap cache time expired.\n"));
-                        reload_printers();
+                        pcap_cache_reload(&reload_printers);
                         last_printer_reload_time = t;
                 }
@@ -2370 +2370 @@
 
         if (!(event_add_idle(smbd_event_context(), NULL,
-                             timeval_set(SMBD_SELECT_TIMEOUT, 0),
+                             timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
                              "housekeeping", housekeeping_fn, NULL))) {
                 DEBUG(0, ("Could not add housekeeping event\n"));

vendor/current/source3/smbd/server.c

@@ -542 +542 @@
 }
 
+static bool parent_housekeeping_fn(const struct timeval *now, void *private_data)
+{
+        DEBUG(5, ("houskeeping\n"));
+        /* check if we need to reload services */
+        check_reload(time(NULL));
+        return true;
+}
+
 /****************************************************************************
  Open the socket communication.
@@ -601 +609 @@
                                 }
 
+                                /* Keep the first port for mDNS service
+                                 * registration.
+                                 */
+                                if (dns_port == 0) {
+                                        dns_port = port;
+                                }
+
                                 if (!smbd_open_one_socket(parent, ifss, port)) {
                                         return false;
@@ -668 +683 @@
         claim_connection(NULL,"",
                          FLAG_MSG_GENERAL|FLAG_MSG_SMBD|FLAG_MSG_DBWRAP);
+
+        if (!(event_add_idle(smbd_event_context(), NULL,
+                             timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
+                             "parent_housekeeping", parent_housekeeping_fn,
+                             parent))) {
+                DEBUG(0, ("Could not add housekeeping event\n"));
+                exit(1);
+        }
 
         /* Listen to messages */
@@ -735 +758 @@
 }
 
-/****************************************************************************
- Reload printers
-**************************************************************************/
+/***************************************************************************
+ purge stale printers and reload from pre-populated pcap cache
+***************************************************************************/
 void reload_printers(void)
 {
@@ -745 +768 @@
         const char *pname;
 
-        pcap_cache_reload();
-
-        /* remove stale printers */
+        DEBUG(10, ("reloading printer services from pcap cache\n"));
         for (snum = 0; snum < n_services; snum++) {
                 /* avoid removing PRINTERS_NAME or non-autoloaded printers */
@@ -794 +815 @@
         ret = lp_load(get_dyn_CONFIGFILE(), False, False, True, True);
 
-        reload_printers();
+        pcap_cache_reload(&reload_printers);
 
         /* perhaps the config filename is now set */

vendor/current/source3/smbd/sesssetup.c

@@ -1102 +1102 @@
 
         asn1_load(data, *pblob);
-        asn1_start_tag(data, pblob->data[0]);
-        if (data->has_error || data->nesting == NULL) {
+        if (asn1_start_tag(data, pblob->data[0])) {
+                /* asn1_start_tag checks if the given
+                   length of the blob is enough to complete
+                   the tag. If it returns true we know
+                   there is nothing to do - the blob is
+                   complete. */
                 asn1_free(data);
-                /* Let caller catch. */
                 return NT_STATUS_OK;
         }
+
+        if (data->nesting == NULL) {
+                /* Incorrect tag, allocation failed,
+                   or reading the tag length failed.
+                   Let the caller catch. */
+                asn1_free(data);
+                return NT_STATUS_OK;
+        }
+
+        /* Here we know asn1_start_tag() has set data->has_error to true.
+           asn1_tag_remaining() will have failed due to the given blob
+           being too short. We need to work out how short. */
 
         /* Integer wrap paranoia.... */
@@ -1137 +1152 @@
         if (needed_len <= pblob->length) {
                 /* Nothing to do - blob is complete. */
+                /* THIS SHOULD NOT HAPPEN - asn1_start_tag()
+                   above should have caught this !!! */
+                DEBUG(0,("check_spnego_blob_complete: logic "
+                        "error (needed_len = %u, "
+                        "pblob->length = %u).\n",
+                        (unsigned int)needed_len,
+                        (unsigned int)pblob->length ));
                 return NT_STATUS_OK;
         }

vendor/current/source3/smbd/trans2.c

@@ -3157 +3157 @@
 
                         /* access check */
-                        if (conn->server_info->utok.uid != sec_initial_uid()) {
+                        if (conn->server_info->utok.uid != sec_initial_uid() &&
+                                        !conn->admin_user) {
                                 DEBUG(0,("set_user_quota: access_denied "
                                          "service [%s] user [%s]\n",
@@ -3644 +3645 @@
 
                                 /* access check */
-                                if ((conn->server_info->utok.uid != sec_initial_uid())
+                                if (((conn->server_info->utok.uid != sec_initial_uid()) && !conn->admin_user)
                                     ||!CAN_WRITE(conn)) {
                                         DEBUG(0,("set_user_quota: access_denied service [%s] user [%s]\n",
@@ -7045 +7046 @@
         wire_open_mode &= ~SMB_ACCMODE;
 
-        if((wire_open_mode & (SMB_O_CREAT | SMB_O_EXCL)) == (SMB_O_CREAT | SMB_O_EXCL)) {
-                create_disp = FILE_CREATE;
-        } else if((wire_open_mode & (SMB_O_CREAT | SMB_O_TRUNC)) == (SMB_O_CREAT | SMB_O_TRUNC)) {
-                create_disp = FILE_OVERWRITE_IF;
-        } else if((wire_open_mode & SMB_O_CREAT) == SMB_O_CREAT) {
-                create_disp = FILE_OPEN_IF;
-        } else if ((wire_open_mode & (SMB_O_CREAT | SMB_O_EXCL | SMB_O_TRUNC)) == 0) {
-                create_disp = FILE_OPEN;
-        } else {
-                DEBUG(5,("smb_posix_open: invalid create mode 0x%x\n",
-                        (unsigned int)wire_open_mode ));
-                return NT_STATUS_INVALID_PARAMETER;
+        /* First take care of O_CREAT|O_EXCL interactions. */
+        switch (wire_open_mode & (SMB_O_CREAT | SMB_O_EXCL)) {
+                case (SMB_O_CREAT | SMB_O_EXCL):
+                        /* File exists fail. File not exist create. */
+                        create_disp = FILE_CREATE;
+                        break;
+                case SMB_O_CREAT:
+                        /* File exists open. File not exist create. */
+                        create_disp = FILE_OPEN_IF;
+                        break;
+                case 0:
+                        /* File exists open. File not exist fail. */
+                        create_disp = FILE_OPEN;
+                        break;
+                case SMB_O_EXCL:
+                        /* O_EXCL on its own without O_CREAT is undefined. */
+                default:
+                        DEBUG(5,("smb_posix_open: invalid create mode 0x%x\n",
+                                (unsigned int)wire_open_mode ));
+                        return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        /* Next factor in the effects of O_TRUNC. */
+        wire_open_mode &= ~(SMB_O_CREAT | SMB_O_EXCL);
+
+        if (wire_open_mode & SMB_O_TRUNC) {
+                switch (create_disp) {
+                        case FILE_CREATE:
+                                /* (SMB_O_CREAT | SMB_O_EXCL | O_TRUNC) */
+                                /* Leave create_disp alone as
+                                   (O_CREAT|O_EXCL|O_TRUNC) == (O_CREAT|O_EXCL)
+                                */
+                                /* File exists fail. File not exist create. */
+                                break;
+                        case FILE_OPEN_IF:
+                                /* SMB_O_CREAT | SMB_O_TRUNC */
+                                /* File exists overwrite. File not exist create. */
+                                create_disp = FILE_OVERWRITE_IF;
+                                break;
+                        case FILE_OPEN:
+                                /* SMB_O_TRUNC */
+                                /* File exists overwrite. File not exist fail. */
+                                create_disp = FILE_OVERWRITE;
+                                break;
+                        default:
+                                /* Cannot get here. */
+                                smb_panic("smb_posix_open: logic error");
+                                return NT_STATUS_INVALID_PARAMETER;
+                }
         }