r4391: bring the default ACL inline with what w2k3 uses

diff --git a/source/ntvfs/posix/pvfs_acl.c b/source/ntvfs/posix/pvfs_acl.c
index 5302cc95244444d3ed396e840dec6daaefbbcbdc..970cddf6f7ddb9ff0edb4f986557eeb359a2893e 100644 (file)
--- a/source/ntvfs/posix/pvfs_acl.c
+++ b/source/ntvfs/posix/pvfs_acl.c
@@ -69,10 +69,8 @@ static NTSTATUS pvfs_default_acl(struct pvfs_state *pvfs,
 {
        struct security_descriptor *sd;
        NTSTATUS status;
-       struct security_ace aces[4];
+       struct security_ace ace;
        mode_t mode;
-       struct dom_sid *sid;
-       int i;
 
        sd = security_descriptor_initialise(req);
        if (sd == NULL) {
@@ -90,97 +88,64 @@ static NTSTATUS pvfs_default_acl(struct pvfs_state *pvfs,
 
        sd->type |= SEC_DESC_DACL_PRESENT;
 
+       mode = name->st.st_mode;
+
        /*
-         we provide 4 ACEs
-           - Administrator
+         we provide up to 4 ACEs
            - Owner
            - Group
            - Everyone
+           - Administrator
         */
-       aces[0].access_mask = SEC_RIGHTS_FILE_ALL;
-       aces[1].access_mask = 0;
-       aces[2].access_mask = 0;
-       aces[3].access_mask = 0;
 
-       mode = name->st.st_mode;
+
+       /* setup owner ACE */
+       ace.type = SEC_ACE_TYPE_ACCESS_ALLOWED;
+       ace.flags = 0;
+       ace.trustee = *sd->owner_sid;
+       ace.access_mask = 0;
 
        if (mode & S_IRUSR) {
-               aces[1].access_mask |= 
-                       SEC_FILE_READ_DATA | 
-                       SEC_FILE_READ_EA |
-                       SEC_FILE_READ_ATTRIBUTE |
-                       SEC_FILE_EXECUTE |
-                       SEC_STD_SYNCHRONIZE |
-                       SEC_STD_READ_CONTROL;
+               ace.access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
        }
        if (mode & S_IWUSR) {
-               aces[1].access_mask |= 
-                       SEC_FILE_WRITE_DATA | 
-                       SEC_FILE_APPEND_DATA |
-                       SEC_FILE_WRITE_EA |
-                       SEC_FILE_WRITE_ATTRIBUTE |
-                       SEC_STD_DELETE;
+               ace.access_mask |= SEC_RIGHTS_FILE_WRITE | SEC_STD_DELETE;
+       }
+       if (ace.access_mask) {
+               security_descriptor_dacl_add(sd, &ace);
        }
 
+
+       /* setup group ACE */
+       ace.trustee = *sd->group_sid;
+       ace.access_mask = 0;
        if (mode & S_IRGRP) {
-               aces[2].access_mask |= 
-                       SEC_FILE_READ_DATA | 
-                       SEC_FILE_READ_EA |
-                       SEC_FILE_READ_ATTRIBUTE |
-                       SEC_FILE_EXECUTE |
-                       SEC_STD_SYNCHRONIZE |
-                       SEC_STD_READ_CONTROL;
+               ace.access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
        }
        if (mode & S_IWGRP) {
-               aces[2].access_mask |= 
-                       SEC_FILE_WRITE_DATA | 
-                       SEC_FILE_APPEND_DATA |
-                       SEC_FILE_WRITE_EA |
-                       SEC_FILE_WRITE_ATTRIBUTE;
+               ace.access_mask |= SEC_RIGHTS_FILE_WRITE;
+       }
+       if (ace.access_mask) {
+               security_descriptor_dacl_add(sd, &ace);
        }
 
+       /* setup other ACE */
+       ace.trustee = *dom_sid_parse_talloc(req, SID_WORLD);
+       ace.access_mask = 0;
        if (mode & S_IROTH) {
-               aces[3].access_mask |= 
-                       SEC_FILE_READ_DATA | 
-                       SEC_FILE_READ_EA |
-                       SEC_FILE_READ_ATTRIBUTE |
-                       SEC_FILE_EXECUTE |
-                       SEC_STD_SYNCHRONIZE |
-                       SEC_STD_READ_CONTROL;
+               ace.access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
        }
        if (mode & S_IWOTH) {
-               aces[3].access_mask |= 
-                       SEC_FILE_WRITE_DATA | 
-                       SEC_FILE_APPEND_DATA |
-                       SEC_FILE_WRITE_EA |
-                       SEC_FILE_WRITE_ATTRIBUTE;
+               ace.access_mask |= SEC_RIGHTS_FILE_WRITE;
        }
-
-       sid = dom_sid_parse_talloc(sd, SID_BUILTIN_ADMINISTRATORS);
-       if (sid == NULL) return NT_STATUS_NO_MEMORY;
-
-       aces[0].type = SEC_ACE_TYPE_ACCESS_ALLOWED;
-       aces[0].flags = 0;
-       aces[0].trustee = *sid;
-
-       aces[1].type = SEC_ACE_TYPE_ACCESS_ALLOWED;
-       aces[1].flags = 0;
-       aces[1].trustee = *sd->owner_sid;
-
-       aces[2].type = SEC_ACE_TYPE_ACCESS_ALLOWED;
-       aces[2].flags = 0;
-       aces[2].trustee = *sd->group_sid;
-
-       sid = dom_sid_parse_talloc(sd, SID_WORLD);
-       if (sid == NULL) return NT_STATUS_NO_MEMORY;
-
-       aces[3].type = SEC_ACE_TYPE_ACCESS_ALLOWED;
-       aces[3].flags = 0;
-       aces[3].trustee = *sid;
-
-       for (i=0;i<4;i++) {
-               security_descriptor_dacl_add(sd, &aces[i]);
+       if (ace.access_mask) {
+               security_descriptor_dacl_add(sd, &ace);
        }
+
+       /* setup system ACE */
+       ace.trustee = *dom_sid_parse_talloc(req, SID_NT_SYSTEM);
+       ace.access_mask = SEC_RIGHTS_FILE_ALL;
+       security_descriptor_dacl_add(sd, &ace);
        
        acl->version = 1;
        acl->info.sd = sd;

diff --git a/source/ntvfs/posix/pvfs_fileinfo.c b/source/ntvfs/posix/pvfs_fileinfo.c
index 888d5f78c01040fa4da052d700c6807357adc132..fc60aa6e89c5c4758657816665c2546dd2cb3082 100644 (file)
--- a/source/ntvfs/posix/pvfs_fileinfo.c
+++ b/source/ntvfs/posix/pvfs_fileinfo.c
@@ -99,10 +99,10 @@ NTSTATUS pvfs_fill_dos_info(struct pvfs_state *pvfs, struct pvfs_filename *name,
 */
 mode_t pvfs_fileperms(struct pvfs_state *pvfs, uint32 attrib)
 {
-       mode_t mode = S_IRUSR | S_IRGRP | S_IROTH;
+       mode_t mode = S_IRUSR;
 
        if (attrib & FILE_ATTRIBUTE_DIRECTORY) {
-               mode |= S_IXUSR | S_IXGRP | S_IXOTH;
+               mode |= S_IXUSR;
        }
 
        if (!(attrib & FILE_ATTRIBUTE_READONLY) ||