diff options
| -rw-r--r-- | source3/include/rpc_secdes.h | 11 | ||||
| -rw-r--r-- | source3/smbd/nttrans.c | 35 |
2 files changed, 38 insertions, 8 deletions
diff --git a/source3/include/rpc_secdes.h b/source3/include/rpc_secdes.h index f497c25db6..791441173c 100644 --- a/source3/include/rpc_secdes.h +++ b/source3/include/rpc_secdes.h @@ -48,6 +48,7 @@ #define SEC_ACE_FLAG_CONTAINER_INHERIT 0x2 #define SEC_ACE_FLAG_NO_PROPAGATE_INHERIT 0x4 #define SEC_ACE_FLAG_INHERIT_ONLY 0x8 +#define SEC_ACE_FLAG_INHERITED_ACE 0x10 /* New for Windows 2000 */ #define SEC_ACE_FLAG_VALID_INHERIT 0xf #define SEC_ACE_FLAG_SUCCESSFUL_ACCESS 0x40 #define SEC_ACE_FLAG_FAILED_ACCESS 0x80 @@ -58,6 +59,16 @@ #define SEC_DESC_DACL_DEFAULTED 0x0008 #define SEC_DESC_SACL_PRESENT 0x0010 #define SEC_DESC_SACL_DEFAULTED 0x0020 +/* + * New Windows 2000 bits. + */ +#define SE_DESC_DACL_AUTO_INHERIT_REQ 0x0100 +#define SE_DESC_SACL_AUTO_INHERIT_REQ 0x0200 +#define SE_DESC_DACL_AUTO_INHERITED 0x0400 +#define SE_DESC_SACL_AUTO_INHERITED 0x0800 +#define SE_DESC_DACL_PROTECTED 0x1000 +#define SE_DESC_SACL_PROTECTED 0x2000 + #define SEC_DESC_SELF_RELATIVE 0x8000 /* security information */ diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c index e94e603661..b65deefaef 100644 --- a/source3/smbd/nttrans.c +++ b/source3/smbd/nttrans.c @@ -2062,6 +2062,7 @@ static BOOL unpack_nt_permissions(uid_t *puser, gid_t *pgrp, mode_t *pmode, uint uint32 owner_rid; uint32 grp_rid; SEC_ACL *dacl = psd->dacl; + BOOL all_aces_are_inherit_only = (is_directory ? True : False); int i; *pmode = 0; @@ -2069,7 +2070,7 @@ static BOOL unpack_nt_permissions(uid_t *puser, gid_t *pgrp, mode_t *pmode, uint *pgrp = (gid_t)-1; if(security_info_sent == 0) { - DEBUG(0,("unpack_unix_permissions: no security info sent !\n")); + DEBUG(0,("unpack_nt_permissions: no security info sent !\n")); return False; } @@ -2080,7 +2081,7 @@ static BOOL unpack_nt_permissions(uid_t *puser, gid_t *pgrp, mode_t *pmode, uint memset(&owner_sid, '\0', sizeof(owner_sid)); memset(&grp_sid, '\0', sizeof(grp_sid)); - DEBUG(5,("unpack_unix_permissions: validating owner_sid.\n")); + DEBUG(5,("unpack_nt_permissions: validating owner_sid.\n")); /* * Don't immediately fail if the owner sid cannot be validated. @@ -2088,7 +2089,7 @@ static BOOL unpack_nt_permissions(uid_t *puser, gid_t *pgrp, mode_t *pmode, uint */ if(!validate_unix_sid( &owner_sid, &owner_rid, psd->owner_sid)) - DEBUG(3,("unpack_unix_permissions: unable to validate owner sid.\n")); + DEBUG(3,("unpack_nt_permissions: unable to validate owner sid.\n")); else if(security_info_sent & OWNER_SECURITY_INFORMATION) *puser = pdb_user_rid_to_uid(owner_rid); @@ -2098,7 +2099,7 @@ static BOOL unpack_nt_permissions(uid_t *puser, gid_t *pgrp, mode_t *pmode, uint */ if(!validate_unix_sid( &grp_sid, &grp_rid, psd->grp_sid)) - DEBUG(3,("unpack_unix_permissions: unable to validate group sid.\n")); + DEBUG(3,("unpack_nt_permissions: unable to validate group sid.\n")); else if(security_info_sent & GROUP_SECURITY_INFORMATION) *pgrp = pdb_user_rid_to_gid(grp_rid); @@ -2122,7 +2123,7 @@ static BOOL unpack_nt_permissions(uid_t *puser, gid_t *pgrp, mode_t *pmode, uint if((psa->type != SEC_ACE_TYPE_ACCESS_ALLOWED) && (psa->type != SEC_ACE_TYPE_ACCESS_DENIED)) { - DEBUG(3,("unpack_unix_permissions: unable to set anything but an ALLOW or DENY ACE.\n")); + DEBUG(3,("unpack_nt_permissions: unable to set anything but an ALLOW or DENY ACE.\n")); return False; } @@ -2132,15 +2133,22 @@ static BOOL unpack_nt_permissions(uid_t *puser, gid_t *pgrp, mode_t *pmode, uint if(is_directory) { if(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY) { - DEBUG(3,("unpack_unix_permissions: ignoring inherit only ACE.\n")); + DEBUG(3,("unpack_nt_permissions: ignoring inherit only ACE.\n")); continue; } + /* + * At least one of the ACE entries wasn't inherit only. + * Flag this so we know the returned mode is valid. + */ + + all_aces_are_inherit_only = False; + psa->flags &= ~(SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT); } if(psa->flags != 0) { - DEBUG(1,("unpack_unix_permissions: unable to set ACE flags (%x).\n", + DEBUG(1,("unpack_nt_permissions: unable to set ACE flags (%x).\n", (unsigned int)psa->flags)); return False; } @@ -2191,11 +2199,22 @@ static BOOL unpack_nt_permissions(uid_t *puser, gid_t *pgrp, mode_t *pmode, uint *pmode &= ~(map_nt_perms( psa->info, S_IROTH)); } else { - DEBUG(0,("unpack_unix_permissions: unknown SID used in ACL.\n")); + DEBUG(0,("unpack_nt_permissions: unknown SID used in ACL.\n")); return False; } } + if (is_directory && all_aces_are_inherit_only) { + /* + * Windows 2000 is doing one of these weird 'inherit acl' + * traverses to conserve NTFS ACL resources. Just pretend + * there was no DACL sent. JRA. + */ + + DEBUG(10,("unpack_nt_permissions: Win2k inherit acl traverse. Ignoring DACL.\n")); + free_sec_acl(&psd->dacl); + } + return True; } |