diff options
| -rw-r--r-- | docs-xml/smbdotconf/misc/dosfilemode.xml | 17 | ||||
| -rw-r--r-- | docs-xml/smbdotconf/security/aclgroupcontrol.xml | 6 | ||||
| -rw-r--r-- | source3/param/loadparm.c | 2 | ||||
| -rw-r--r-- | source3/smbd/posix_acls.c | 40 |
4 files changed, 40 insertions, 25 deletions
diff --git a/docs-xml/smbdotconf/misc/dosfilemode.xml b/docs-xml/smbdotconf/misc/dosfilemode.xml index ae3b475107..e67ccd935a 100644 --- a/docs-xml/smbdotconf/misc/dosfilemode.xml +++ b/docs-xml/smbdotconf/misc/dosfilemode.xml @@ -3,15 +3,16 @@ type="boolean" xmlns:samba="http://www.samba.org/samba/DTD/samba-doc"> <description> - <para> The default behavior in Samba is to provide - UNIX-like behavior where only the owner of a file/directory is + <para> The default behavior in Samba is to provide + UNIX-like behavior where only the owner of a file/directory is able to change the permissions on it. However, this behavior - is often confusing to DOS/Windows users. Enabling this parameter - allows a user who has write access to the file (by whatever - means) to modify the permissions (including ACL) on it. Note that a user - belonging to the group owning the file will not be allowed to - change permissions if the group is only granted read access. - Ownership of the file/directory may also be changed.</para> + is often confusing to DOS/Windows users. Enabling this parameter + allows a user who has write access to the file (by whatever + means, including an ACL permission) to modify the permissions + (including ACL) on it. Note that a user belonging to the group + owning the file will not be allowed to change permissions if + the group is only granted read access. Ownership of the + file/directory may also be changed.</para> </description> <value type="default">no</value> </samba:parameter> diff --git a/docs-xml/smbdotconf/security/aclgroupcontrol.xml b/docs-xml/smbdotconf/security/aclgroupcontrol.xml index e2600ca9da..6efd46dd8d 100644 --- a/docs-xml/smbdotconf/security/aclgroupcontrol.xml +++ b/docs-xml/smbdotconf/security/aclgroupcontrol.xml @@ -30,8 +30,10 @@ </para> <para> - This is parameter has been marked deprecated in Samba 3.0.23. The same behavior is now - implemented by the <parameter moreinfo="none">dos filemode</parameter> option. + This is parameter has been was deprecated in Samba 3.0.23, but re-activated in + Samba 3.0.31 and above, as it now only controls permission changes if the user + is in the owning primary group. It is now no longer equivalent to the + <parameter moreinfo="none">dos filemode</parameter> option. </para> </description> diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index b679b79fea..b2cbbf1671 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -1507,7 +1507,7 @@ static struct parm_struct parm_table[] = { .ptr = &sDefault.bAclGroupControl, .special = NULL, .enum_list = NULL, - .flags = FLAG_ADVANCED | FLAG_GLOBAL | FLAG_SHARE | FLAG_DEPRECATED, + .flags = FLAG_ADVANCED | FLAG_GLOBAL | FLAG_SHARE, }, { .label = "acl map full control", diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c index e92a263ca0..427cfc9a0d 100644 --- a/source3/smbd/posix_acls.c +++ b/source3/smbd/posix_acls.c @@ -2362,20 +2362,32 @@ static bool current_user_in_group(gid_t gid) } /**************************************************************************** - Should we override a deny ? Check deprecated 'acl group control' - and 'dos filemode' + Should we override a deny ? Check 'acl group control' and 'dos filemode'. ****************************************************************************/ -static bool acl_group_override(connection_struct *conn, gid_t prim_gid) +static bool acl_group_override(connection_struct *conn, + gid_t prim_gid, + const char *fname) { - if ( (errno == EACCES || errno == EPERM) - && (lp_acl_group_control(SNUM(conn)) || lp_dos_filemode(SNUM(conn))) - && current_user_in_group(prim_gid)) - { - return True; - } + SMB_STRUCT_STAT sbuf; - return False; + if ((errno != EPERM) && (errno != EACCES)) { + return false; + } + + /* file primary group == user primary or supplementary group */ + if (lp_acl_group_control(SNUM(conn)) && + current_user_in_group(prim_gid)) { + return true; + } + + /* user has writeable permission */ + if (lp_dos_filemode(SNUM(conn)) && + can_write_to_file(conn, fname, &sbuf)) { + return true; + } + + return false; } /**************************************************************************** @@ -2561,7 +2573,7 @@ static bool set_canon_ace_list(files_struct *fsp, canon_ace *the_ace, bool defau *pacl_set_support = False; } - if (acl_group_override(conn, prim_gid)) { + if (acl_group_override(conn, prim_gid, fsp->fsp_name)) { int sret; DEBUG(5,("set_canon_ace_list: acl group control on and current user in file %s primary group.\n", @@ -2592,7 +2604,7 @@ static bool set_canon_ace_list(files_struct *fsp, canon_ace *the_ace, bool defau *pacl_set_support = False; } - if (acl_group_override(conn, prim_gid)) { + if (acl_group_override(conn, prim_gid, fsp->fsp_name)) { int sret; DEBUG(5,("set_canon_ace_list: acl group control on and current user in file %s primary group.\n", @@ -3570,7 +3582,7 @@ NTSTATUS set_nt_acl(files_struct *fsp, uint32 security_info_sent, SEC_DESC *psd) if (SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn, fsp->fsp_name) == -1) { int sret = -1; - if (acl_group_override(conn, sbuf.st_gid)) { + if (acl_group_override(conn, sbuf.st_gid, fsp->fsp_name)) { DEBUG(5,("set_nt_acl: acl group control on and " "current user in file %s primary group. Override delete_def_acl\n", fsp->fsp_name )); @@ -3617,7 +3629,7 @@ NTSTATUS set_nt_acl(files_struct *fsp, uint32 security_info_sent, SEC_DESC *psd) if(SMB_VFS_CHMOD(conn,fsp->fsp_name, posix_perms) == -1) { int sret = -1; - if (acl_group_override(conn, sbuf.st_gid)) { + if (acl_group_override(conn, sbuf.st_gid, fsp->fsp_name)) { DEBUG(5,("set_nt_acl: acl group control on and " "current user in file %s primary group. Override chmod\n", fsp->fsp_name )); |