sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-10 01:18:15 +03:00
Code

s3/smbd: fix access checks in set_ea_dos_attribute()

Browse Source 
We wanted to set the DOS attributes and failed with permission denied
from the VFS/kernel/filesystem. Next thing we wanna do here is override
this if either

- "dos filemode = true" is set and the security descriptor gives the
  user write access or if

- the stored security descriptor has FILE_WRITE_ATTRIBUTES

The former was working, but the latter was not implemented at all.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12995

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 143d26283d)
This commit is contained in:
Ralph Boehme 2017-08-29 15:55:19 +02:00 committed by Karolin Seeger
parent 88dfaf1e4b
commit 096a3f8fdd
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
source3/smbd/dosmode.c
View File

@ -464,6 +464,7 @@ NTSTATUS set_ea_dos_attribute(connection_struct *conn,
NTSTATUS status = NT_STATUS_OK;
bool need_close = false;
files_struct *fsp = NULL;
bool set_dosmode_ok = false;
if ((errno != EPERM) && (errno != EACCES)) {
DBG_INFO("Cannot set "
@ -477,10 +478,21 @@ NTSTATUS set_ea_dos_attribute(connection_struct *conn,
*/
/* Check if we have write access. */
if (!CAN_WRITE(conn) || !lp_dos_filemode(SNUM(conn)))
if (!CAN_WRITE(conn)) {
return NT_STATUS_ACCESS_DENIED;
}
if (!can_write_to_file(conn, smb_fname)) {
status = smbd_check_access_rights(conn, smb_fname, false,
FILE_WRITE_ATTRIBUTES);
if (NT_STATUS_IS_OK(status)) {
set_dosmode_ok = true;
}
if (!set_dosmode_ok && lp_dos_filemode(SNUM(conn))) {
set_dosmode_ok = can_write_to_file(conn, smb_fname);
}
if (!set_dosmode_ok) {
return NT_STATUS_ACCESS_DENIED;
}