mirror of
https://github.com/samba-team/samba.git
synced 2025-01-11 05:18:09 +03:00
ba46578f97
An 'Object Access Allowed' ACE that assigned 'Control Access' (CR) rights to a specific attribute would not actually grant access. What was happening was the remaining_access mask for the object_tree nodes would be Read Property (RP) + Control Access (CR). The ACE mapped to the schemaIDGUID for a given attribute, which would end up being a child node in the tree. So the CR bit was cleared for a child node, but not the rest of the tree. We would then check the user had the RP access right, which it did. However, the RP right was cleared for another node in the tree, which still had the CR bit set in its remaining_access bitmap, so Samba would not grant access. Generally, the remaining_access only ever has one bit set, which means this isn't a problem normally. However, in the Control Access case there are 2 separate bits being checked, i.e. RP + CR. One option to fix this problem would be to clear the remaining_access for the tree instead of just the node. However, the Windows spec is actually pretty clear on this: if the ACE has a CR right present, then you can stop any further access checks. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> |
||
|---|---|---|
| .. | ||
| access_check.c | ||
| access_check.h | ||
| create_descriptor.c | ||
| display_sec.c | ||
| display_sec.h | ||
| dom_sid.c | ||
| dom_sid.h | ||
| object_tree.c | ||
| privileges_private.h | ||
| privileges.c | ||
| privileges.h | ||
| pysecurity.c | ||
| sddl.c | ||
| sddl.h | ||
| secace.c | ||
| secace.h | ||
| secacl.c | ||
| secacl.h | ||
| secdesc.c | ||
| secdesc.h | ||
| security_descriptor.c | ||
| security_descriptor.h | ||
| security_token.c | ||
| security_token.h | ||
| security.h | ||
| session.c | ||
| session.h | ||
| util_sid.c | ||
| wscript_build | ||