r15057: fix access masks for getting and setting security_descriptors

I'll add some torture tests later...

metze
(This used to be commit ce045f4df37b6740f2bf849fd06ab51c682ea0b7)

diff --git a/source4/ntvfs/posix/pvfs_qfileinfo.c b/source4/ntvfs/posix/pvfs_qfileinfo.c
index fb1b0aa3f93374081e81e36f16f71268c548f83e..e4e69a82891e85d328846fa406efb22994ded17d 100644 (file)
--- a/source4/ntvfs/posix/pvfs_qfileinfo.c
+++ b/source4/ntvfs/posix/pvfs_qfileinfo.c
@@ -28,11 +28,11 @@
 /*
   determine what access bits are needed for a call
 */
-static uint32_t pvfs_fileinfo_access(enum smb_fileinfo_level level)
+static uint32_t pvfs_fileinfo_access(union smb_fileinfo *info)
 {
        uint32_t needed;
 
-       switch (level) {
+       switch (info->generic.level) {
        case RAW_FILEINFO_EA_LIST:
        case RAW_FILEINFO_ALL_EAS:
                needed = SEC_FILE_READ_EA;
@@ -43,14 +43,24 @@ static uint32_t pvfs_fileinfo_access(enum smb_fileinfo_level level)
                break;
 
        case RAW_FILEINFO_SEC_DESC:
-               needed = SEC_STD_READ_CONTROL;
+               needed = 0;
+               if (info->query_secdesc.in.secinfo_flags & (SECINFO_OWNER|SECINFO_GROUP)) {
+                       needed |= SEC_STD_READ_CONTROL;
+               }
+               if (info->query_secdesc.in.secinfo_flags & SECINFO_DACL) {
+                       needed |= SEC_STD_READ_CONTROL;
+               }
+               if (info->query_secdesc.in.secinfo_flags & SECINFO_SACL) {
+                       needed |= SEC_FLAG_SYSTEM_SECURITY;
+               }
                break;
 
        default:
                needed = SEC_FILE_READ_ATTRIBUTE;
                break;
        }
-       return needed;  
+
+       return needed;
 }
 
 /*
@@ -304,7 +314,7 @@ NTSTATUS pvfs_qpathinfo(struct ntvfs_module_context *ntvfs,
        }
 
        status = pvfs_access_check_simple(pvfs, req, name, 
-                                         pvfs_fileinfo_access(info->generic.level));
+                                         pvfs_fileinfo_access(info));
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
@@ -332,7 +342,7 @@ NTSTATUS pvfs_qfileinfo(struct ntvfs_module_context *ntvfs,
        }
        h = f->handle;
 
-       access_needed = pvfs_fileinfo_access(info->generic.level);
+       access_needed = pvfs_fileinfo_access(info);
        if ((f->access_mask & access_needed) != access_needed) {
                return NT_STATUS_ACCESS_DENIED;
        }

diff --git a/source4/ntvfs/posix/pvfs_setfileinfo.c b/source4/ntvfs/posix/pvfs_setfileinfo.c
index 7661d1eb454587722fdb91074cfbef950e885624..e85f52fc2c217764682fe54a937888e75915cc04 100644 (file)
--- a/source4/ntvfs/posix/pvfs_setfileinfo.c
+++ b/source4/ntvfs/posix/pvfs_setfileinfo.c
@@ -53,16 +53,23 @@ static uint32_t pvfs_setfileinfo_access(union smb_setfileinfo *info)
 
        case RAW_SFILEINFO_SEC_DESC:
                needed = 0;
-               if (info->set_secdesc.in.secinfo_flags & (SECINFO_DACL|SECINFO_SACL)) {
+               if (info->set_secdesc.in.secinfo_flags & (SECINFO_OWNER|SECINFO_GROUP)) {
+                       needed |= SEC_STD_WRITE_OWNER;
+               }
+               if (info->set_secdesc.in.secinfo_flags & SECINFO_DACL) {
                        needed |= SEC_STD_WRITE_DAC;
                }
+               if (info->set_secdesc.in.secinfo_flags & SECINFO_SACL) {
+                       needed |= SEC_FLAG_SYSTEM_SECURITY;
+               }
                break;
 
        default:
                needed = SEC_FILE_WRITE_ATTRIBUTE;
                break;
        }
-       return needed;  
+
+       return needed;
 }
 
 /*