Changeset 919 for vendor/current/source3/modules

Timestamp:

Jun 9, 2016, 2:17:22 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: apply latest security patches to vendor

Location:

vendor/current/source3/modules

Files:

• vfs_acl_common.c (modified) (1 diff)
• vfs_full_audit.c (modified) (1 diff)
• vfs_shadow_copy2.c (modified) (4 diffs)

vendor/current/source3/modules/vfs_acl_common.c

@@ -24 +24 @@
 #include "../libcli/security/security.h"
 #include "../librpc/gen_ndr/ndr_security.h"
+#include "../lib/util/bitmap.h"
 
 static NTSTATUS create_acl_blob(const struct security_descriptor *psd,

vendor/current/source3/modules/vfs_full_audit.c

@@ -65 +65 @@
 #include "auth.h"
 #include "ntioctl.h"
+#include "lib/util/bitmap.h"
 
 static int vfs_full_audit_debug_level = DBGC_VFS;

vendor/current/source3/modules/vfs_shadow_copy2.c

@@ -22 +22 @@
 #include "includes.h"
 #include "smbd/smbd.h"
+#include "smbd/globals.h"
+#include "../libcli/security/security.h"
 #include "system/filesys.h"
 #include "ntioctl.h"
@@ -765 +767 @@
 }
 
+static bool check_access_snapdir(struct vfs_handle_struct *handle,
+                                const char *path)
+{
+        struct smb_filename smb_fname;
+        int ret;
+        NTSTATUS status;
+        uint32_t access_granted = 0;
+
+        ZERO_STRUCT(smb_fname);
+        smb_fname.base_name = talloc_asprintf(talloc_tos(),
+                                                "%s",
+                                                path);
+        if (smb_fname.base_name == NULL) {
+                return false;
+        }
+
+        ret = SMB_VFS_NEXT_STAT(handle, &smb_fname);
+        if (ret != 0 || !S_ISDIR(smb_fname.st.st_ex_mode)) {
+                TALLOC_FREE(smb_fname.base_name);
+                return false;
+        }
+
+        status = smbd_check_open_rights(handle->conn,
+                                        &smb_fname,
+                                        SEC_DIR_LIST,
+                                        &access_granted);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("user does not have list permission "
+                        "on snapdir %s\n",
+                        smb_fname.base_name));
+                TALLOC_FREE(smb_fname.base_name);
+                return false;
+        }
+        TALLOC_FREE(smb_fname.base_name);
+        return true;
+}
+
 static int shadow_copy2_rmdir(vfs_handle_struct *handle,  const char *fname)
 {
@@ -878 +917 @@
         TALLOC_CTX *tmp_ctx = talloc_new(handle->data);
         char *snapshot;
+        bool ret;
 
         snapdir = shadow_copy2_find_snapdir(tmp_ctx, handle);
@@ -884 +924 @@
                          handle->conn->connectpath));
                 errno = EINVAL;
+                talloc_free(tmp_ctx);
+                return -1;
+        }
+        ret = check_access_snapdir(handle, snapdir);
+        if (!ret) {
+                DEBUG(0,("access denied on listing snapdir %s\n", snapdir));
+                errno = EACCES;
                 talloc_free(tmp_ctx);
                 return -1;