Pass all of RAW-ACLS except for inheritence. Working on that next.

Jeremy.

diff --git a/source3/include/proto.h b/source3/include/proto.h
index 254c33d0756b91c74c8cd0cb75da2c0c351f38f7..0d4404b339ce8394842b83d3738e483de2813f13 100644 (file)
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -8040,6 +8040,10 @@ void reply_nttranss(struct smb_request *req);
 
 /* The following definitions come from smbd/open.c  */
 
+NTSTATUS smb1_file_se_access_check(const struct security_descriptor *sd,
+                          const NT_USER_TOKEN *token,
+                          uint32_t access_desired,
+                          uint32_t *access_granted);
 NTSTATUS fd_close(files_struct *fsp);
 bool map_open_params_to_ntcreate(const char *fname, int deny_mode, int open_func,
                                 uint32 *paccess_mask,

diff --git a/source3/modules/vfs_acl_xattr.c b/source3/modules/vfs_acl_xattr.c
index c3b27f81a5a30e1da65cf5ab0d372c901ded0185..5dfe43e55bf563dd924cd55720b958129a6afd0c 100644 (file)
--- a/source3/modules/vfs_acl_xattr.c
+++ b/source3/modules/vfs_acl_xattr.c
@@ -437,7 +437,7 @@ static int open_acl_xattr(vfs_handle_struct *handle,
                                        &pdesc);
         if (NT_STATUS_IS_OK(status)) {
                /* See if we can access it. */
-               status = se_access_check(pdesc,
+               status = smb1_file_se_access_check(pdesc,
                                        handle->conn->server_info->ptok,
                                        fsp->access_mask,
                                        &access_granted);

diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index b134e8f0fd9fd57a5abc860cba62cba627c8d5fc..480352bedaaa256150b7df293f729ad179e4c591 100644 (file)
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -29,6 +29,56 @@ struct deferred_open_record {
        struct file_id id;
 };
 
+/****************************************************************************
+ SMB1 file varient of se_access_check. Never test FILE_READ_ATTRIBUTES.
+****************************************************************************/
+
+NTSTATUS smb1_file_se_access_check(const struct security_descriptor *sd,
+                          const NT_USER_TOKEN *token,
+                          uint32_t access_desired,
+                          uint32_t *access_granted)
+{
+       return se_access_check(sd,
+                               token,
+                               (access_desired & ~FILE_READ_ATTRIBUTES),
+                               access_granted);
+}
+
+/****************************************************************************
+ Check if we have open rights.
+****************************************************************************/
+
+static NTSTATUS check_open_rights(struct connection_struct *conn,
+                               const char *fname,
+                               uint32_t access_mask)
+{
+       /* Check if we have rights to open. */
+       NTSTATUS status;
+       uint32_t access_granted = 0;
+       struct security_descriptor *sd;
+
+       status = SMB_VFS_GET_NT_ACL(conn, fname,
+                       (OWNER_SECURITY_INFORMATION |
+                       GROUP_SECURITY_INFORMATION |
+                       DACL_SECURITY_INFORMATION),&sd);
+
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(10, ("check_open_rights: Could not get acl "
+                       "on %s: %s\n",
+                       fname,
+                       nt_errstr(status)));
+               return status;
+       }
+
+       status = smb1_file_se_access_check(sd,
+                               conn->server_info->ptok,
+                               access_mask,
+                               &access_granted);
+
+       TALLOC_FREE(sd);
+       return status;
+}
+
 /****************************************************************************
  fd support routines - attempt to do a dos_open.
 ****************************************************************************/
@@ -337,6 +387,17 @@ static NTSTATUS open_file(files_struct *fsp,
 
        } else {
                fsp->fh->fd = -1; /* What we used to call a stat open. */
+               if (file_existed) {
+                       status = check_open_rights(conn,
+                                       path,
+                                       access_mask);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               DEBUG(10, ("open_file: Access denied on "
+                                       "file %s\n",
+                                       path));
+                               return status;
+                       }
+               }
        }
 
        if (!file_existed) {
@@ -1146,6 +1207,7 @@ static NTSTATUS calculate_access_mask(connection_struct *conn,
        /* Calculate MAXIMUM_ALLOWED_ACCESS if requested. */
        if (access_mask & MAXIMUM_ALLOWED_ACCESS) {
                if (file_existed) {
+
                        struct security_descriptor *sd;
                        uint32_t access_granted = 0;
 
@@ -1162,8 +1224,10 @@ static NTSTATUS calculate_access_mask(connection_struct *conn,
                                return NT_STATUS_ACCESS_DENIED;
                        }
 
-                       status = se_access_check(sd, conn->server_info->ptok,
-                                       access_mask, &access_granted);
+                       status = smb1_file_se_access_check(sd,
+                                       conn->server_info->ptok,
+                                       access_mask,
+                                       &access_granted);
 
                        TALLOC_FREE(sd);
 
@@ -2274,6 +2338,19 @@ NTSTATUS open_directory(connection_struct *conn,
                return NT_STATUS_NOT_A_DIRECTORY;
        }
 
+       if (info == FILE_WAS_OPENED) {
+               status = check_open_rights(conn,
+                                       fname,
+                                       access_mask);
+               if (!NT_STATUS_IS_OK(status)) {
+                       DEBUG(10, ("open_directory: check_open_rights on "
+                               "file %s failed with %s\n",
+                               fname,
+                               nt_errstr(status)));
+                       return status;
+               }
+       }
+
        status = file_new(req, conn, &fsp);
        if(!NT_STATUS_IS_OK(status)) {
                return status;

diff --git a/source4/torture/raw/acls.c b/source4/torture/raw/acls.c
index 2a67bd98c5c1b93fb2432b3afe44ee819a2ac124..862b96ac1730218fd6fd980f21408e5e8a6fc520 100644 (file)
--- a/source4/torture/raw/acls.c
+++ b/source4/torture/raw/acls.c
@@ -1088,7 +1088,7 @@ static bool test_owner_bits(struct torture_context *tctx,
 {
        NTSTATUS status;
        union smb_open io;
-       const char *fname = BASEDIR "\\generic.txt";
+       const char *fname = BASEDIR "\\test_owner_bits.txt";
        bool ret = true;
        int fnum = -1, i;
        union smb_fileinfo q;