diff options
| author | Jeremy Allison <jra@samba.org> | 2009-08-20 11:08:21 -0700 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2009-08-20 11:08:21 -0700 |
| commit | 9b261a1211de2bfef22af64d4717b44c5ed2bfb8 (patch) | |
| tree | dc5433d6c4622b1e8a3caffc08d23746e5e8670d | |
| parent | 77a0a6e9a1a30b0ea3e36aaf751b433c546b5c5c (diff) | |
| download | samba-9b261a1211de2bfef22af64d4717b44c5ed2bfb8.tar.gz samba-9b261a1211de2bfef22af64d4717b44c5ed2bfb8.tar.bz2 samba-9b261a1211de2bfef22af64d4717b44c5ed2bfb8.zip | |
Fix bug 6638 - ADS Domain Member: Computer Mgr can not set share ACLs
Add good error message for share modification denial.
Jeremy.
| -rw-r--r-- | source3/rpc_server/srv_srvsvc_nt.c | 22 |
1 files changed, 19 insertions, 3 deletions
diff --git a/source3/rpc_server/srv_srvsvc_nt.c b/source3/rpc_server/srv_srvsvc_nt.c index 01ffcd837a..f7f51d1e9a 100644 --- a/source3/rpc_server/srv_srvsvc_nt.c +++ b/source3/rpc_server/srv_srvsvc_nt.c @@ -1514,6 +1514,9 @@ WERROR _srvsvc_NetShareSetInfo(pipes_struct *p, || ( lp_enable_asu_support() && strequal(share_name,"ADMIN$") ) || strequal(share_name,"global") ) { + DEBUG(5,("_srvsvc_NetShareSetInfo: share %s cannot be " + "modified by a remote user.\n", + share_name )); return WERR_ACCESS_DENIED; } @@ -1531,8 +1534,14 @@ WERROR _srvsvc_NetShareSetInfo(pipes_struct *p, /* fail out now if you are not root and not a disk op */ - if ( p->server_info->utok.uid != sec_initial_uid() && !is_disk_op ) + if ( p->server_info->utok.uid != sec_initial_uid() && !is_disk_op ) { + DEBUG(2,("_srvsvc_NetShareSetInfo: uid %u doesn't have the " + "SeDiskOperatorPrivilege privilege needed to modify " + "share %s\n", + (unsigned int)p->server_info->utok.uid, + share_name )); return WERR_ACCESS_DENIED; + } switch (r->in.level) { case 1: @@ -1599,16 +1608,23 @@ WERROR _srvsvc_NetShareSetInfo(pipes_struct *p, } /* We can only modify disk shares. */ - if (type != STYPE_DISKTREE) + if (type != STYPE_DISKTREE) { + DEBUG(5,("_srvsvc_NetShareSetInfo: share %s is not a " + "disk share\n", + share_name )); return WERR_ACCESS_DENIED; + } if (comment == NULL) { return WERR_NOMEM; } /* Check if the pathname is valid. */ - if (!(path = valid_share_pathname(p->mem_ctx, pathname ))) + if (!(path = valid_share_pathname(p->mem_ctx, pathname ))) { + DEBUG(5,("_srvsvc_NetShareSetInfo: invalid pathname %s\n", + pathname )); return WERR_OBJECT_PATH_INVALID; + } /* Ensure share name, pathname and comment don't contain '"' characters. */ string_replace(share_name, '"', ' '); |