Second part of bugfix for bug #8837 - smbd crashes when deleting directory and veto files are enabled.

Store the 'struct security_token' as well as the 'struct security_unix_token'
inside the locking db when setting a delete on close.

1 files changed, 15 insertions, 8 deletions

diff --git a/source3/smbd/close.c b/source3/smbd/close.c
index 34ce7858be..8b91da81d5 100644
--- a/source3/smbd/close.c
+++ b/source3/smbd/close.c
@@ -332,6 +332,8 @@ static NTSTATUS close_remove_share_mode(files_struct *fsp,
 	NTSTATUS tmp_status;
 	struct file_id id;
 	const struct security_unix_token *del_token = NULL;
+	const struct security_token *del_nt_token = NULL;
+	bool got_tokens = false;
 
 	/* Ensure any pending write time updates are done. */
 	if (fsp->update_write_time_event) {
@@ -395,7 +397,9 @@ static NTSTATUS close_remove_share_mode(files_struct *fsp,
 			became_user = True;
 		}
 		fsp->delete_on_close = true;
-		set_delete_on_close_lck(fsp, lck, True, get_current_utok(conn));
+		set_delete_on_close_lck(fsp, lck, True,
+				get_current_nttok(conn),
+				get_current_utok(conn));
 		if (became_user) {
 			unbecome_user();
 		}
@@ -448,8 +452,9 @@ static NTSTATUS close_remove_share_mode(files_struct *fsp,
 	 */
 	fsp->update_write_time_on_close = false;
 
-	del_token = get_delete_on_close_token(lck, fsp->name_hash);
-	SMB_ASSERT(del_token != NULL);
+	got_tokens = get_delete_on_close_token(lck, fsp->name_hash,
+					&del_nt_token, &del_token);
+	SMB_ASSERT(got_tokens);
 
 	if (!unix_token_equal(del_token, get_current_utok(conn))) {
 		/* Become the user who requested the delete. */
@@ -468,7 +473,7 @@ static NTSTATUS close_remove_share_mode(files_struct *fsp,
 			    del_token->gid,
 			    del_token->ngroups,
 			    del_token->groups,
-			    NULL);
+			    del_nt_token);
 
 		changed_user = true;
 	}
@@ -541,7 +546,7 @@ static NTSTATUS close_remove_share_mode(files_struct *fsp,
  	 */
 
 	fsp->delete_on_close = false;
-	set_delete_on_close_lck(fsp, lck, false, NULL);
+	set_delete_on_close_lck(fsp, lck, false, NULL, NULL);
 
  done:
 
@@ -1010,6 +1015,7 @@ static NTSTATUS close_directory(struct smb_request *req, files_struct *fsp,
 	bool delete_dir = False;
 	NTSTATUS status = NT_STATUS_OK;
 	NTSTATUS status1 = NT_STATUS_OK;
+	const struct security_token *del_nt_token = NULL;
 	const struct security_unix_token *del_token = NULL;
 
 	/*
@@ -1044,6 +1050,7 @@ static NTSTATUS close_directory(struct smb_request *req, files_struct *fsp,
 		send_stat_cache_delete_message(fsp->conn->sconn->msg_ctx,
 					       fsp->fsp_name->base_name);
 		set_delete_on_close_lck(fsp, lck, true,
+				get_current_nttok(fsp->conn),
 				get_current_utok(fsp->conn));
 		fsp->delete_on_close = true;
 		if (became_user) {
@@ -1051,8 +1058,8 @@ static NTSTATUS close_directory(struct smb_request *req, files_struct *fsp,
 		}
 	}
 
-	del_token = get_delete_on_close_token(lck, fsp->name_hash);
-	delete_dir = (del_token != NULL);
+	delete_dir = get_delete_on_close_token(lck, fsp->name_hash,
+					&del_nt_token, &del_token);
 
 	if (delete_dir) {
 		int i;
@@ -1084,7 +1091,7 @@ static NTSTATUS close_directory(struct smb_request *req, files_struct *fsp,
 				del_token->gid,
 				del_token->ngroups,
 				del_token->groups,
-				NULL);
+				del_nt_token);
 
 		TALLOC_FREE(lck);