From 271ce52dbe2d28935e8203700d18b4933576fd01 Mon Sep 17 00:00:00 2001
From: Jeremy Allison <jra@samba.org>
Date: Sat, 17 May 2003 00:46:26 +0000
Subject: Cope with cumulative permissions sets. This code is #ifdef'ed out at
 the moment as I don't think cumulative permission sets make sense in POSIX
 even though that's the way Windows works.... Jeremy. (This used to be commit
 34b170a82c02b462f9d0de85922bf8f26a260c67)

---
 source3/smbd/posix_acls.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 49 insertions(+), 1 deletion(-)

(limited to 'source3')

diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index 6925b35246..86efd8fb96 100644
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -1171,7 +1171,7 @@ Deny entry after Allow entry. Failing to set on file %s.\n", fsp->fsp_name ));
 /****************************************************************************
  ASCII art time again... JRA :-).
 
- We have 3 cases to process when moving from an NT ACL to a POSIX ACL. Firstly,
+ We have 4 cases to process when moving from an NT ACL to a POSIX ACL. Firstly,
  we insist the ACL is in canonical form (ie. all DENY entries preceede ALLOW
  entries). Secondly, the merge code has ensured that all duplicate SID entries for
  allow or deny have been merged, so the same SID can only appear once in the deny
@@ -1244,6 +1244,15 @@ Deny entry after Allow entry. Failing to set on file %s.\n", fsp->fsp_name ));
  best we can do and has the advantage of failing closed rather
  than open.
  ---------------------------------------------------------------------------
+ Fourth pass - cope with cumulative permissions.
+
+ for all allow user entries, if there exists an allow group entry with
+ more permissive permissions, and the user is in that group, rewrite the
+ allow user permissions to contain both sets of permissions.
+
+ Currently the code for this is #ifdef'ed out as these semantics make
+ no sense to me. JRA.
+ ---------------------------------------------------------------------------
 
  Note we *MUST* do the deny user pass first as this will convert deny user
  entries into allow user entries which can then be processed by the deny
@@ -1433,6 +1442,45 @@ static void process_deny_list( canon_ace **pp_ace_list )
 
 	}
 
+	/* Doing this fourth pass allows Windows semantics to be layered
+	 * on top of POSIX semantics. I'm not sure if this is desirable.
+	 * For example, in W2K ACLs there is no way to say, "Group X no
+	 * access, user Y full access" if user Y is a member of group X.
+	 * This seems completely broken semantics to me.... JRA.
+	 */
+
+#if 0
+	/* Pass 4 above - deal with allow entries. */
+
+	for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
+		canon_ace *allow_ace_p;
+
+		curr_ace_next = curr_ace->next; /* So we can't lose the link. */
+
+		if (curr_ace->attr != ALLOW_ACE)
+			continue;
+
+		if (curr_ace->owner_type != UID_ACE)
+			continue;
+
+		for (allow_ace_p = ace_list; allow_ace_p; allow_ace_p = allow_ace_p->next) {
+
+			if (allow_ace_p->attr != ALLOW_ACE)
+				continue;
+
+			/* We process GID_ACE entries only. */
+
+			if (allow_ace_p->owner_type != GID_ACE)
+				continue;
+
+			/* OR in the group perms. */
+
+			if (uid_entry_in_group( curr_ace, allow_ace_p))
+				curr_ace->perms |= allow_ace_p->perms;
+		}
+	}
+#endif
+
 	*pp_ace_list = ace_list;
 }
 
-- 
cgit