sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-10 01:18:15 +03:00
Code

smbd/posix_acls: reuse secutiry token from session info if exist

Browse Source 
If session info was passed down from upstream, then try to use it to get
security token, other then creating token every time.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13521

Signed-off-by: Joe Guo <joeg@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
This commit is contained in:
Joe Guo 2018-07-04 11:09:50 +12:00 committed by Andrew Bartlett
parent a9c6ec66bc
commit c9876defe6
1 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
source3/smbd/posix_acls.c
View File

@ -1251,11 +1251,37 @@ static void ensure_minimal_owner_ace_perms(const bool is_directory,
static bool uid_entry_in_group(connection_struct *conn, canon_ace *uid_ace, canon_ace *group_ace )
{
bool is_sid = false;
bool has_sid = false;
struct security_token *security_token = NULL;
/* "Everyone" always matches every uid. */
if (dom_sid_equal(&group_ace->trustee, &global_sid_World))
return True;
/*
* if we have session info in conn, we already have the (SID
* based) NT token and don't need to do the complex
* user_in_group_sid() call
*/
if (conn->session_info) {
security_token = conn->session_info->security_token;
/* security_token should not be NULL */
SMB_ASSERT(security_token);
is_sid = security_token_is_sid(security_token,
&uid_ace->trustee);
if (is_sid) {
has_sid = security_token_has_sid(security_token,
&group_ace->trustee);
if (has_sid) {
return true;
}
}
}
/*
* if it's the current user, we already have the unix token
* and don't need to do the complex user_in_group_sid() call