sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-02 09:47:23 +03:00
Code

s3: Return "granted" from share_access_check

Browse Source 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
This commit is contained in:
Volker Lendecke 2011-07-04 17:02:34 +02:00 committed by Stefan Metzmacher
parent fe8fe384f3
commit 1c022d2e41
5 changed files with 28 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
source3/include/proto.h
View File

@ -244,8 +244,10 @@ struct security_descriptor *get_share_security( TALLOC_CTX *ctx, const char *ser
size_t *psize);
bool set_share_security(const char *share_name, struct security_descriptor *psd);
bool delete_share_security(const char *servicename);
bool share_access_check(const struct security_token *token, const char *sharename,
uint32 desired_access);
bool share_access_check(const struct security_token *token,
const char *sharename,
uint32 desired_access,
uint32_t *pgranted);
bool parse_usershare_acl(TALLOC_CTX *ctx, const char *acl_str, struct security_descriptor **ppsd);
/* The following definitions come from lib/smbrun.c */

10
source3/lib/sharesec.c
View File

@ -410,8 +410,10 @@ bool delete_share_security(const char *servicename)
Can this user access with share with the required permissions ?
********************************************************************/
bool share_access_check(const struct security_token *token, const char *sharename,
uint32 desired_access)
bool share_access_check(const struct security_token *token,
const char *sharename,
uint32 desired_access,
uint32_t *pgranted)
{
uint32 granted;
NTSTATUS status;
@ -428,6 +430,10 @@ bool share_access_check(const struct security_token *token, const char *sharenam
TALLOC_FREE(psd);
if (pgranted != NULL) {
*pgranted = granted;
}
return NT_STATUS_IS_OK(status);
}

4
source3/rpc_server/srvsvc/srv_srvsvc_nt.c
View File

@ -541,8 +541,8 @@ static bool is_enumeration_allowed(struct pipes_struct *p,
if (!lp_access_based_share_enum(snum))
return true;
return share_access_check(p->session_info->security_token, lp_servicename(snum),
FILE_READ_DATA);
return share_access_check(p->session_info->security_token,
lp_servicename(snum), FILE_READ_DATA, NULL);
}
/*******************************************************************

13
source3/smbd/service.c
View File

@ -644,14 +644,15 @@ connection_struct *make_connection_snum(struct smbd_server_connection *sconn,
{
bool can_write = False;
can_write = share_access_check(conn->session_info->security_token,
lp_servicename(snum),
FILE_WRITE_DATA);
can_write = share_access_check(
conn->session_info->security_token,
lp_servicename(snum), FILE_WRITE_DATA, NULL);
if (!can_write) {
if (!share_access_check(conn->session_info->security_token,
lp_servicename(snum),
FILE_READ_DATA)) {
if (!share_access_check(
conn->session_info->security_token,
lp_servicename(snum), FILE_READ_DATA,
NULL)) {
/* No access, read or write. */
DEBUG(0,("make_connection: connection to %s "
"denied due to security "

11
source3/smbd/uid.c
View File

@ -121,8 +121,9 @@ static bool check_user_ok(connection_struct *conn,
conn);
if (!readonly_share &&
!share_access_check(session_info->security_token, lp_servicename(snum),
FILE_WRITE_DATA)) {
!share_access_check(session_info->security_token,
lp_servicename(snum), FILE_WRITE_DATA,
NULL)) {
/* smb.conf allows r/w, but the security descriptor denies
* write. Fall back to looking at readonly. */
readonly_share = True;
@ -130,9 +131,11 @@ static bool check_user_ok(connection_struct *conn,
"security descriptor\n"));
}
if (!share_access_check(session_info->security_token, lp_servicename(snum),
if (!share_access_check(session_info->security_token,
lp_servicename(snum),
readonly_share ?
FILE_READ_DATA : FILE_WRITE_DATA)) {
FILE_READ_DATA : FILE_WRITE_DATA,
NULL)) {
return False;
}