mirror of
https://github.com/samba-team/samba.git
synced 2025-01-05 09:18:06 +03:00
9f166c0222
The acl_read.c code contains a special case to allow dirsync to work-around having insufficient access rights. We had a concern that the dirsync module could leak sensitive information for deleted objects. This patch adds a test-case to prove whether or not this is happening. The new test case is similar to the existing dirsync test except: - We make the confidential attribute also preserve-on-delete, so it hangs around for deleted objcts. Because the attributes now persist across test case runs, I've used a different attribute to normal. (Technically, the dirsync search expressions are now specific enough that the regular attribute could be used, but it would make things quite fragile if someone tried to add a new test case). - To handle searching for deleted objects, the search expressions are now more complicated. Currently dirsync adds an extra-filter to the '!' searches to exclude deleted objects, i.e. samaccountname matches the test-objects AND the object is not deleted. We now extend this to include deleted objects with lastKnownParent equal to the test OU. The search expression matches either case so that we can use the same expression throughout the test (regardless of whether the object is deleted yet or not). This test proves that the dirsync corner-case does not actually leak sensitive information on Samba. This is due to a bug in the dirsync code - when the buggy line is removed, this new test promptly fails. Test also passes against Windows. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> |
||
|---|---|---|
| .. | ||
| auth | ||
| build/pasn1 | ||
| cldap_server | ||
| client | ||
| cluster | ||
| dns_server | ||
| dsdb | ||
| echo_server | ||
| heimdal | ||
| heimdal_build | ||
| include | ||
| kdc | ||
| ldap_server | ||
| lib | ||
| libcli | ||
| libnet | ||
| librpc | ||
| nbt_server | ||
| ntp_signd | ||
| ntvfs | ||
| param | ||
| rpc_server | ||
| script | ||
| scripting | ||
| selftest | ||
| setup | ||
| smb_server | ||
| smbd | ||
| torture | ||
| utils | ||
| web_server | ||
| winbind | ||
| wrepl_server | ||
| .clang_complete | ||
| .valgrind_suppressions | ||
| wscript_build | ||