r4391: bring the default ACL inline with what w2k3 uses
authorAndrew Tridgell <tridge@samba.org>
Wed, 29 Dec 2004 12:41:27 +0000 (12:41 +0000)
committerGerald (Jerry) Carter <jerry@samba.org>
Wed, 10 Oct 2007 18:07:42 +0000 (13:07 -0500)
(This used to be commit 16967f7502ea6d2efa0fc08decc955a1516c3a02)

source4/ntvfs/posix/pvfs_acl.c
source4/ntvfs/posix/pvfs_fileinfo.c

index 5302cc95244444d3ed396e840dec6daaefbbcbdc..970cddf6f7ddb9ff0edb4f986557eeb359a2893e 100644 (file)
@@ -69,10 +69,8 @@ static NTSTATUS pvfs_default_acl(struct pvfs_state *pvfs,
 {
        struct security_descriptor *sd;
        NTSTATUS status;
 {
        struct security_descriptor *sd;
        NTSTATUS status;
-       struct security_ace aces[4];
+       struct security_ace ace;
        mode_t mode;
        mode_t mode;
-       struct dom_sid *sid;
-       int i;
 
        sd = security_descriptor_initialise(req);
        if (sd == NULL) {
 
        sd = security_descriptor_initialise(req);
        if (sd == NULL) {
@@ -90,97 +88,64 @@ static NTSTATUS pvfs_default_acl(struct pvfs_state *pvfs,
 
        sd->type |= SEC_DESC_DACL_PRESENT;
 
 
        sd->type |= SEC_DESC_DACL_PRESENT;
 
+       mode = name->st.st_mode;
+
        /*
        /*
-         we provide 4 ACEs
-           - Administrator
+         we provide up to 4 ACEs
            - Owner
            - Group
            - Everyone
            - Owner
            - Group
            - Everyone
+           - Administrator
         */
         */
-       aces[0].access_mask = SEC_RIGHTS_FILE_ALL;
-       aces[1].access_mask = 0;
-       aces[2].access_mask = 0;
-       aces[3].access_mask = 0;
 
 
-       mode = name->st.st_mode;
+
+       /* setup owner ACE */
+       ace.type = SEC_ACE_TYPE_ACCESS_ALLOWED;
+       ace.flags = 0;
+       ace.trustee = *sd->owner_sid;
+       ace.access_mask = 0;
 
        if (mode & S_IRUSR) {
 
        if (mode & S_IRUSR) {
-               aces[1].access_mask |= 
-                       SEC_FILE_READ_DATA | 
-                       SEC_FILE_READ_EA |
-                       SEC_FILE_READ_ATTRIBUTE |
-                       SEC_FILE_EXECUTE |
-                       SEC_STD_SYNCHRONIZE |
-                       SEC_STD_READ_CONTROL;
+               ace.access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
        }
        if (mode & S_IWUSR) {
        }
        if (mode & S_IWUSR) {
-               aces[1].access_mask |= 
-                       SEC_FILE_WRITE_DATA | 
-                       SEC_FILE_APPEND_DATA |
-                       SEC_FILE_WRITE_EA |
-                       SEC_FILE_WRITE_ATTRIBUTE |
-                       SEC_STD_DELETE;
+               ace.access_mask |= SEC_RIGHTS_FILE_WRITE | SEC_STD_DELETE;
+       }
+       if (ace.access_mask) {
+               security_descriptor_dacl_add(sd, &ace);
        }
 
        }
 
+
+       /* setup group ACE */
+       ace.trustee = *sd->group_sid;
+       ace.access_mask = 0;
        if (mode & S_IRGRP) {
        if (mode & S_IRGRP) {
-               aces[2].access_mask |= 
-                       SEC_FILE_READ_DATA | 
-                       SEC_FILE_READ_EA |
-                       SEC_FILE_READ_ATTRIBUTE |
-                       SEC_FILE_EXECUTE |
-                       SEC_STD_SYNCHRONIZE |
-                       SEC_STD_READ_CONTROL;
+               ace.access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
        }
        if (mode & S_IWGRP) {
        }
        if (mode & S_IWGRP) {
-               aces[2].access_mask |= 
-                       SEC_FILE_WRITE_DATA | 
-                       SEC_FILE_APPEND_DATA |
-                       SEC_FILE_WRITE_EA |
-                       SEC_FILE_WRITE_ATTRIBUTE;
+               ace.access_mask |= SEC_RIGHTS_FILE_WRITE;
+       }
+       if (ace.access_mask) {
+               security_descriptor_dacl_add(sd, &ace);
        }
 
        }
 
+       /* setup other ACE */
+       ace.trustee = *dom_sid_parse_talloc(req, SID_WORLD);
+       ace.access_mask = 0;
        if (mode & S_IROTH) {
        if (mode & S_IROTH) {
-               aces[3].access_mask |= 
-                       SEC_FILE_READ_DATA | 
-                       SEC_FILE_READ_EA |
-                       SEC_FILE_READ_ATTRIBUTE |
-                       SEC_FILE_EXECUTE |
-                       SEC_STD_SYNCHRONIZE |
-                       SEC_STD_READ_CONTROL;
+               ace.access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
        }
        if (mode & S_IWOTH) {
        }
        if (mode & S_IWOTH) {
-               aces[3].access_mask |= 
-                       SEC_FILE_WRITE_DATA | 
-                       SEC_FILE_APPEND_DATA |
-                       SEC_FILE_WRITE_EA |
-                       SEC_FILE_WRITE_ATTRIBUTE;
+               ace.access_mask |= SEC_RIGHTS_FILE_WRITE;
        }
        }
-
-       sid = dom_sid_parse_talloc(sd, SID_BUILTIN_ADMINISTRATORS);
-       if (sid == NULL) return NT_STATUS_NO_MEMORY;
-
-       aces[0].type = SEC_ACE_TYPE_ACCESS_ALLOWED;
-       aces[0].flags = 0;
-       aces[0].trustee = *sid;
-
-       aces[1].type = SEC_ACE_TYPE_ACCESS_ALLOWED;
-       aces[1].flags = 0;
-       aces[1].trustee = *sd->owner_sid;
-
-       aces[2].type = SEC_ACE_TYPE_ACCESS_ALLOWED;
-       aces[2].flags = 0;
-       aces[2].trustee = *sd->group_sid;
-
-       sid = dom_sid_parse_talloc(sd, SID_WORLD);
-       if (sid == NULL) return NT_STATUS_NO_MEMORY;
-
-       aces[3].type = SEC_ACE_TYPE_ACCESS_ALLOWED;
-       aces[3].flags = 0;
-       aces[3].trustee = *sid;
-
-       for (i=0;i<4;i++) {
-               security_descriptor_dacl_add(sd, &aces[i]);
+       if (ace.access_mask) {
+               security_descriptor_dacl_add(sd, &ace);
        }
        }
+
+       /* setup system ACE */
+       ace.trustee = *dom_sid_parse_talloc(req, SID_NT_SYSTEM);
+       ace.access_mask = SEC_RIGHTS_FILE_ALL;
+       security_descriptor_dacl_add(sd, &ace);
        
        acl->version = 1;
        acl->info.sd = sd;
        
        acl->version = 1;
        acl->info.sd = sd;
index 888d5f78c01040fa4da052d700c6807357adc132..fc60aa6e89c5c4758657816665c2546dd2cb3082 100644 (file)
@@ -99,10 +99,10 @@ NTSTATUS pvfs_fill_dos_info(struct pvfs_state *pvfs, struct pvfs_filename *name,
 */
 mode_t pvfs_fileperms(struct pvfs_state *pvfs, uint32 attrib)
 {
 */
 mode_t pvfs_fileperms(struct pvfs_state *pvfs, uint32 attrib)
 {
-       mode_t mode = S_IRUSR | S_IRGRP | S_IROTH;
+       mode_t mode = S_IRUSR;
 
        if (attrib & FILE_ATTRIBUTE_DIRECTORY) {
 
        if (attrib & FILE_ATTRIBUTE_DIRECTORY) {
-               mode |= S_IXUSR | S_IXGRP | S_IXOTH;
+               mode |= S_IXUSR;
        }
 
        if (!(attrib & FILE_ATTRIBUTE_READONLY) ||
        }
 
        if (!(attrib & FILE_ATTRIBUTE_READONLY) ||