Changeset 746 for vendor/current/libcli/security

Timestamp:

Nov 27, 2012, 4:56:06 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated vendor to 3.6.9

File:

• vendor/current/libcli/security/access_check.c (modified) (4 diffs)

vendor/current/libcli/security/access_check.c

@@ -159 +159 @@
         uint32_t i;
         uint32_t bits_remaining;
+        uint32_t explicitly_denied_bits = 0;
 
         *access_granted = access_desired;
@@ -178 +179 @@
         }
 
-        /* s3 had this with #if 0 previously. To be sure the merge
-           doesn't change any behaviour, we have the above #if check
-           on _SAMBA_BUILD_. */
-        if (access_desired & SEC_FLAG_SYSTEM_SECURITY) {
+        /* the owner always gets SEC_STD_WRITE_DAC and SEC_STD_READ_CONTROL */
+        if ((bits_remaining & (SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL)) &&
+            security_token_has_sid(token, sd->owner_sid)) {
+                bits_remaining &= ~(SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL);
+        }
+
+        /* a NULL dacl allows access */
+        if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl == NULL) {
+                *access_granted = access_desired;
+                return NT_STATUS_OK;
+        }
+
+        if (sd->dacl == NULL) {
+                goto done;
+        }
+
+        /* check each ace in turn. */
+        for (i=0; bits_remaining && i < sd->dacl->num_aces; i++) {
+                struct security_ace *ace = &sd->dacl->aces[i];
+
+                if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
+                        continue;
+                }
+
+                if (!security_token_has_sid(token, &ace->trustee)) {
+                        continue;
+                }
+
+                switch (ace->type) {
+                case SEC_ACE_TYPE_ACCESS_ALLOWED:
+                        bits_remaining &= ~ace->access_mask;
+                        break;
+                case SEC_ACE_TYPE_ACCESS_DENIED:
+                case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
+                        explicitly_denied_bits |= (bits_remaining & ace->access_mask);
+                        break;
+                default:        /* Other ACE types not handled/supported */
+                        break;
+                }
+        }
+
+        bits_remaining |= explicitly_denied_bits;
+
+        /*
+         * We check privileges here because they override even DENY entries.
+         */
+
+        /* Does the user have the privilege to gain SEC_PRIV_SECURITY? */
+        if (bits_remaining & SEC_FLAG_SYSTEM_SECURITY) {
                 if (security_token_has_privilege(token, SEC_PRIV_SECURITY)) {
                         bits_remaining &= ~SEC_FLAG_SYSTEM_SECURITY;
@@ -189 +235 @@
         }
 
-        /* the owner always gets SEC_STD_WRITE_DAC and SEC_STD_READ_CONTROL */
-        if ((bits_remaining & (SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL)) &&
-            security_token_has_sid(token, sd->owner_sid)) {
-                bits_remaining &= ~(SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL);
-        }
-
         /* TODO: remove this, as it is file server specific */
         if ((bits_remaining & SEC_RIGHTS_PRIV_RESTORE) &&
@@ -205 +245 @@
         }
 
-        /* a NULL dacl allows access */
-        if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl == NULL) {
-                *access_granted = access_desired;
-                return NT_STATUS_OK;
-        }
-
-        if (sd->dacl == NULL) {
-                goto done;
-        }
-
-        /* check each ace in turn. */
-        for (i=0; bits_remaining && i < sd->dacl->num_aces; i++) {
-                struct security_ace *ace = &sd->dacl->aces[i];
-
-                if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
-                        continue;
-                }
-
-                if (!security_token_has_sid(token, &ace->trustee)) {
-                        continue;
-                }
-
-                switch (ace->type) {
-                case SEC_ACE_TYPE_ACCESS_ALLOWED:
-                        bits_remaining &= ~ace->access_mask;
-                        break;
-                case SEC_ACE_TYPE_ACCESS_DENIED:
-                case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
-                        if (bits_remaining & ace->access_mask) {
-                                return NT_STATUS_ACCESS_DENIED;
-                        }
-                        break;
-                default:        /* Other ACE types not handled/supported */
-                        break;
-                }
+        if ((bits_remaining & SEC_STD_WRITE_OWNER) &&
+             security_token_has_privilege(token, SEC_PRIV_TAKE_OWNERSHIP)) {
+                bits_remaining &= ~(SEC_STD_WRITE_OWNER);
         }