summaryrefslogtreecommitdiff
path: root/source3/smbd
diff options
context:
space:
mode:
authorStefan Metzmacher <metze@samba.org>2009-05-08 14:33:49 +0200
committerStefan Metzmacher <metze@samba.org>2009-05-08 16:56:46 +0200
commitb79eff843be392f3065e912edca1434081d93c44 (patch)
treec67c77e97e078f07a3cc375379947bd3c3c37976 /source3/smbd
parent7d6e4c7e950592112d09f7d98393c41e8097bba8 (diff)
downloadsamba-b79eff843be392f3065e912edca1434081d93c44.tar.gz
samba-b79eff843be392f3065e912edca1434081d93c44.tar.bz2
samba-b79eff843be392f3065e912edca1434081d93c44.zip
s3:smbd: fix posix acls when setting an ACL without explicit ACE for the owner (bug#2346)
The problem of bug #2346 remains for users exported by winbindd, because create_token_from_username() just fakes the token when the user is not in the local sam domain. This causes user_in_group_sid() to give totally wrong results. In uid_entry_in_group() we need to check if we already have the full unix token in the current_user struct. If so we should use the current_user unix token, instead of doing a very complex user_in_group_sid() which doesn't give reliable results anyway. metze
Diffstat (limited to 'source3/smbd')
-rw-r--r--source3/smbd/posix_acls.c21
1 files changed, 18 insertions, 3 deletions
diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index bc96838a09..abfb00c44c 100644
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -1273,16 +1273,31 @@ static bool uid_entry_in_group( canon_ace *uid_ace, canon_ace *group_ace )
if (sid_equal(&group_ace->trustee, &global_sid_World))
return True;
- /* Assume that the current user is in the current group (force group) */
+ /*
+ * if it's the current user, we already have the unix token
+ * and don't need to do the complex user_in_group_sid() call
+ */
+ if (uid_ace->unix_ug.uid == current_user.ut.uid) {
+ size_t i;
- if (uid_ace->unix_ug.uid == current_user.ut.uid && group_ace->unix_ug.gid == current_user.ut.gid)
- return True;
+ if (group_ace->unix_ug.gid == current_user.ut.gid) {
+ return True;
+ }
+
+ for (i=0; i < current_user.ut.ngroups; i++) {
+ if (group_ace->unix_ug.gid == current_user.ut.groups[i]) {
+ return True;
+ }
+ }
+ }
/* u_name talloc'ed off tos. */
u_name = uidtoname(uid_ace->unix_ug.uid);
if (!u_name) {
return False;
}
+
+ /* notice that this is not reliable for users exported by winbindd! */
return user_in_group_sid(u_name, &group_ace->trustee);
}