summaryrefslogtreecommitdiff
path: root/source3/smbd
diff options
context:
space:
mode:
authorJeremy Allison <jra@samba.org>2008-10-08 18:06:58 -0700
committerJeremy Allison <jra@samba.org>2008-10-08 18:06:58 -0700
commit543c6a02ae1dcb903de800c88af1f9e221827d61 (patch)
tree32ae5ccf825b1f67f7d22e1ec4e4d9efc00e48ee /source3/smbd
parent88a58ae0eeb553969c903a94e578375e109ad05a (diff)
downloadsamba-543c6a02ae1dcb903de800c88af1f9e221827d61.tar.gz
samba-543c6a02ae1dcb903de800c88af1f9e221827d61.tar.bz2
samba-543c6a02ae1dcb903de800c88af1f9e221827d61.zip
For the vfs_acl_xattr.c module, make sure we map GENERIC file and directory bits
to specific bits every time a security descriptor is set. The S4 torture suite proves that generic bits are not returned when querying an ACL set using them (ie. only the specific bits are stored on disk). Jeremy.
Diffstat (limited to 'source3/smbd')
-rw-r--r--source3/smbd/nttrans.c5
-rw-r--r--source3/smbd/open.c4
2 files changed, 9 insertions, 0 deletions
diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index 584399c86c..061855876c 100644
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -713,6 +713,7 @@ static void do_nt_transact_create_pipe(connection_struct *conn,
static NTSTATUS set_sd(files_struct *fsp, uint8 *data, uint32 sd_len,
uint32 security_info_sent)
{
+ extern const struct generic_mapping file_generic_mapping;
SEC_DESC *psd = NULL;
NTSTATUS status;
@@ -739,6 +740,10 @@ static NTSTATUS set_sd(files_struct *fsp, uint8 *data, uint32 sd_len,
security_info_sent &= ~DACL_SECURITY_INFORMATION;
}
+ /* Convert all the generic bits. */
+ security_acl_map_generic(psd->dacl, &file_generic_mapping);
+ security_acl_map_generic(psd->sacl, &file_generic_mapping);
+
status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
TALLOC_FREE(psd);
diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index ad024a58ef..8727e80d5f 100644
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -2764,6 +2764,10 @@ NTSTATUS create_file_unixpath(connection_struct *conn,
fsp->access_mask = FILE_GENERIC_ALL;
+ /* Convert all the generic bits. */
+ security_acl_map_generic(sd->dacl, &file_generic_mapping);
+ security_acl_map_generic(sd->sacl, &file_generic_mapping);
+
status = SMB_VFS_FSET_NT_ACL(fsp, sec_info_sent, sd);
fsp->access_mask = saved_access_mask;