summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJeremy Allison <jra@samba.org>2009-08-20 11:08:21 -0700
committerJeremy Allison <jra@samba.org>2009-08-20 11:08:21 -0700
commit9b261a1211de2bfef22af64d4717b44c5ed2bfb8 (patch)
treedc5433d6c4622b1e8a3caffc08d23746e5e8670d
parent77a0a6e9a1a30b0ea3e36aaf751b433c546b5c5c (diff)
downloadsamba-9b261a1211de2bfef22af64d4717b44c5ed2bfb8.tar.gz
samba-9b261a1211de2bfef22af64d4717b44c5ed2bfb8.tar.bz2
samba-9b261a1211de2bfef22af64d4717b44c5ed2bfb8.zip
Fix bug 6638 - ADS Domain Member: Computer Mgr can not set share ACLs
Add good error message for share modification denial. Jeremy.
-rw-r--r--source3/rpc_server/srv_srvsvc_nt.c22
1 files changed, 19 insertions, 3 deletions
diff --git a/source3/rpc_server/srv_srvsvc_nt.c b/source3/rpc_server/srv_srvsvc_nt.c
index 01ffcd837a..f7f51d1e9a 100644
--- a/source3/rpc_server/srv_srvsvc_nt.c
+++ b/source3/rpc_server/srv_srvsvc_nt.c
@@ -1514,6 +1514,9 @@ WERROR _srvsvc_NetShareSetInfo(pipes_struct *p,
|| ( lp_enable_asu_support() && strequal(share_name,"ADMIN$") )
|| strequal(share_name,"global") )
{
+ DEBUG(5,("_srvsvc_NetShareSetInfo: share %s cannot be "
+ "modified by a remote user.\n",
+ share_name ));
return WERR_ACCESS_DENIED;
}
@@ -1531,8 +1534,14 @@ WERROR _srvsvc_NetShareSetInfo(pipes_struct *p,
/* fail out now if you are not root and not a disk op */
- if ( p->server_info->utok.uid != sec_initial_uid() && !is_disk_op )
+ if ( p->server_info->utok.uid != sec_initial_uid() && !is_disk_op ) {
+ DEBUG(2,("_srvsvc_NetShareSetInfo: uid %u doesn't have the "
+ "SeDiskOperatorPrivilege privilege needed to modify "
+ "share %s\n",
+ (unsigned int)p->server_info->utok.uid,
+ share_name ));
return WERR_ACCESS_DENIED;
+ }
switch (r->in.level) {
case 1:
@@ -1599,16 +1608,23 @@ WERROR _srvsvc_NetShareSetInfo(pipes_struct *p,
}
/* We can only modify disk shares. */
- if (type != STYPE_DISKTREE)
+ if (type != STYPE_DISKTREE) {
+ DEBUG(5,("_srvsvc_NetShareSetInfo: share %s is not a "
+ "disk share\n",
+ share_name ));
return WERR_ACCESS_DENIED;
+ }
if (comment == NULL) {
return WERR_NOMEM;
}
/* Check if the pathname is valid. */
- if (!(path = valid_share_pathname(p->mem_ctx, pathname )))
+ if (!(path = valid_share_pathname(p->mem_ctx, pathname ))) {
+ DEBUG(5,("_srvsvc_NetShareSetInfo: invalid pathname %s\n",
+ pathname ));
return WERR_OBJECT_PATH_INVALID;
+ }
/* Ensure share name, pathname and comment don't contain '"' characters. */
string_replace(share_name, '"', ' ');