summaryrefslogtreecommitdiff
path: root/source4
diff options
context:
space:
mode:
authorAndrew Tridgell <tridge@samba.org>2009-10-16 23:03:42 +1100
committerAndrew Tridgell <tridge@samba.org>2009-10-17 13:01:03 +1100
commit5d5d95131100c595d642f5dc4e4eb247736d81db (patch)
treeec53c86399125ecfd938090f1f85372247bc0942 /source4
parent9da4af062b333750d9cbdf5ef9a47c5ac3723a81 (diff)
downloadsamba-5d5d95131100c595d642f5dc4e4eb247736d81db.tar.gz
samba-5d5d95131100c595d642f5dc4e4eb247736d81db.tar.bz2
samba-5d5d95131100c595d642f5dc4e4eb247736d81db.zip
s4-pvfs: use privileges rather than "uid == 0" in unix access check
This makes the unix access check much closer to the full ACL check
Diffstat (limited to 'source4')
-rw-r--r--source4/ntvfs/posix/pvfs_acl.c18
1 files changed, 12 insertions, 6 deletions
diff --git a/source4/ntvfs/posix/pvfs_acl.c b/source4/ntvfs/posix/pvfs_acl.c
index 4680b17b79..375e38effc 100644
--- a/source4/ntvfs/posix/pvfs_acl.c
+++ b/source4/ntvfs/posix/pvfs_acl.c
@@ -490,15 +490,20 @@ NTSTATUS pvfs_access_check_unix(struct pvfs_state *pvfs,
{
uid_t uid = geteuid();
uint32_t max_bits = SEC_RIGHTS_FILE_READ | SEC_FILE_ALL;
+ struct security_token *token = req->session_info->security_token;
if (pvfs_read_only(pvfs, *access_mask)) {
return NT_STATUS_ACCESS_DENIED;
}
- /* owner and root get extra permissions */
- if (uid == 0) {
- max_bits |= SEC_STD_ALL | SEC_FLAG_SYSTEM_SECURITY;
- } else if (uid == name->st.st_uid) {
+ if (security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
+ max_bits |= SEC_RIGHTS_PRIV_RESTORE;
+ }
+ if (security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
+ max_bits |= SEC_RIGHTS_PRIV_BACKUP;
+ }
+
+ if (uid == name->st.st_uid) {
max_bits |= SEC_STD_ALL;
}
@@ -521,8 +526,9 @@ NTSTATUS pvfs_access_check_unix(struct pvfs_state *pvfs,
*access_mask &= ~SEC_FLAG_MAXIMUM_ALLOWED;
}
- if (uid != 0 && (*access_mask & SEC_FLAG_SYSTEM_SECURITY)) {
- return NT_STATUS_ACCESS_DENIED;
+ if ((*access_mask & SEC_FLAG_SYSTEM_SECURITY) &&
+ security_token_has_privilege(token, SEC_PRIV_SECURITY)) {
+ max_bits |= SEC_FLAG_SYSTEM_SECURITY;
}
if (*access_mask & ~max_bits) {