sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-28 01:58:17 +03:00
Code

r4464: added pvfs backend support for the special CREATOR_OWNER and CREATOR_GROUP inheritance rules

Browse Source 
(This used to be commit 0a29fb45c310b4b8c348d187b8ff1833deaac6c3)
This commit is contained in:
Andrew Tridgell 2005-01-01 04:25:46 +00:00 committed by Gerald (Jerry) Carter
parent 3b21422ae8
commit d4b1657396
3 changed files with 47 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
source4/ntvfs/posix/pvfs_acl.c
View File

@ -470,11 +470,15 @@ static NTSTATUS pvfs_acl_inherit_aces(struct pvfs_state *pvfs,
for (i=0;i<parent_sd->dacl->num_aces;i++) {
struct security_ace ace = parent_sd->dacl->aces[i];
NTSTATUS status;
const struct dom_sid *creator = NULL, *new_id = NULL;
uint32_t orig_flags;
if (!pvfs_inheritable_ace(pvfs, &ace, container)) {
continue;
}
orig_flags = ace.flags;
/* see the RAW-ACLS inheritance test for details on these rules */
if (!container) {
ace.flags = 0;
@ -489,7 +493,39 @@ static NTSTATUS pvfs_acl_inherit_aces(struct pvfs_state *pvfs,
}
}
status = security_descriptor_dacl_add(sd, &ace);
/* the CREATOR sids are special when inherited */
if (dom_sid_equal(&ace.trustee, pvfs->sid_cache.creator_owner)) {
creator = pvfs->sid_cache.creator_owner;
new_id = sd->owner_sid;
} else if (dom_sid_equal(&ace.trustee, pvfs->sid_cache.creator_group)) {
creator = pvfs->sid_cache.creator_group;
new_id = sd->group_sid;
} else {
new_id = &ace.trustee;
}
if (creator && container &&
(ace.flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
uint32_t flags = ace.flags;
ace.trustee = *new_id;
ace.flags = 0;
status = security_descriptor_dacl_add(sd, &ace);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
ace.trustee = *creator;
ace.flags = flags | SEC_ACE_FLAG_INHERIT_ONLY;
status = security_descriptor_dacl_add(sd, &ace);
} else if (container &&
!(orig_flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT)) {
status = security_descriptor_dacl_add(sd, &ace);
} else {
ace.trustee = *new_id;
status = security_descriptor_dacl_add(sd, &ace);
}
if (!NT_STATUS_IS_OK(status)) {
return status;
}

4
source4/ntvfs/posix/vfs_posix.c
View File

@ -26,6 +26,7 @@
#include "includes.h"
#include "vfs_posix.h"
#include "librpc/gen_ndr/ndr_security.h"
/*
@ -82,6 +83,9 @@ static void pvfs_setup_options(struct pvfs_state *pvfs)
if (pvfs->flags & PVFS_FLAG_XATTR_ENABLE) {
pvfs->fs_attribs |= FS_ATTR_PERSISTANT_ACLS;
}
pvfs->sid_cache.creator_owner = dom_sid_parse_talloc(pvfs, SID_CREATOR_OWNER);
pvfs->sid_cache.creator_group = dom_sid_parse_talloc(pvfs, SID_CREATOR_GROUP);
}

6
source4/ntvfs/posix/vfs_posix.h
View File

@ -60,6 +60,12 @@ struct pvfs_state {
/* if posix:eadb is set, then this gets setup */
struct tdb_wrap *ea_db;
/* used to accelerate acl mapping */
struct {
const struct dom_sid *creator_owner;
const struct dom_sid *creator_group;
} sid_cache;
};
/* this is the basic information needed about a file from the filesystem */