sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-24 02:04:21 +03:00
Code

smbd: allow reading files based on FILE_EXECUTE access right

Browse Source 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12149

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Thu Aug 18 18:58:22 CEST 2016 on sn-devel-144

(backported from commit a6073e6130d39dac58f1e6ea9f41ec4ab34c3e29)
This commit is contained in:
Uri Simchoni 2016-08-04 14:59:23 +03:00 committed by Karolin Seeger
parent 59eb36dedc
commit c6ac876464
2 changed files with 18 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
selftest/knownfail
View File

@ -325,10 +325,7 @@
# we don't allow auth_level_connect anymore...
#
^samba3.blackbox.rpcclient.*ncacn_np.*with.*connect.*rpcclient # we don't allow auth_level_connect anymore
#new read tests fail
#nt-vfs server blocks read with execute access
^samba4.smb2.read.access
^samba3.smb2.read.access
#new copychunk tests fail
#ntvfs server blocks copychunk with execute access on read handle
^samba4.smb2.ioctl.copy_chunk_bad_access
^samba3.smb2.ioctl.copy_chunk_bad_access
^samba3.smb2.ioctl fs_specific.copy_chunk_bad_access

16
source3/smbd/smb2_glue.c
View File

@ -48,6 +48,22 @@ struct smb_request *smbd_smb2_fake_smb_request(struct smbd_smb2_request *req)
FLAGS2_32_BIT_ERROR_CODES |
FLAGS2_LONG_PATH_COMPONENTS |
FLAGS2_IS_LONG_NAME;
/* This is not documented in revision 49 of [MS-SMB2] but should be
* added in a later revision (and torture test smb2.read.access
* as well as smb2.ioctl_copy_chunk_bad_access against
* Server 2012R2 confirms this)
*
* If FILE_EXECUTE is granted to a handle then the SMB2 server
* acts as if FILE_READ_DATA has also been granted. We must still
* keep the original granted mask, because with ioctl requests,
* access checks are made on the file handle, "below" the SMB2
* server, and the object store below the SMB layer is not aware
* of this arrangement (see smb2.ioctl.copy_chunk_bad_access
* torture test).
*/
smbreq->flags2 |= FLAGS2_READ_PERMIT_EXECUTE;
if (IVAL(inhdr, SMB2_HDR_FLAGS) & SMB2_HDR_FLAG_DFS) {
smbreq->flags2 |= FLAGS2_DFS_PATHNAMES;
}