make the UID_WRAPPER skip checks at runtime

[sfrench/samba-autobuild/.git] / source4 / ntvfs / posix / pvfs_acl.c

diff --git a/source4/ntvfs/posix/pvfs_acl.c b/source4/ntvfs/posix/pvfs_acl.c
index 06a4e690041a190bcdaaf5fd2122019f7a79aac7..232883911e13ff136d28355a8533200ea941fecf 100644 (file)
--- a/source4/ntvfs/posix/pvfs_acl.c
+++ b/source4/ntvfs/posix/pvfs_acl.c
@@ -51,7 +51,7 @@ NTSTATUS pvfs_acl_register(const struct pvfs_acl_ops *ops)
        backends = talloc_realloc(talloc_autofree_context(), backends, struct pvfs_acl_backend, num_backends+1);
        NT_STATUS_HAVE_NO_MEMORY(backends);
 
-       new_ops = talloc_memdup(backends, ops, sizeof(*ops));
+       new_ops = (struct pvfs_acl_ops *)talloc_memdup(backends, ops, sizeof(*ops));
        new_ops->name = talloc_strdup(new_ops, ops->name);
 
        backends[num_backends].ops = new_ops;
@@ -473,6 +473,14 @@ NTSTATUS pvfs_access_check_unix(struct pvfs_state *pvfs,
                max_bits |= SEC_STD_ALL;
        }
 
+       if (!uwrap_enabled()) {
+               /* when running with the uid wrapper, files will be created
+                  owned by the ruid, but we may have a different simulated 
+                  euid. We need to force the permission bits as though the 
+                  files owner matches the euid */
+               max_bits |= SEC_STD_ALL;
+       }
+
        if (*access_mask == SEC_FLAG_MAXIMUM_ALLOWED) {
                *access_mask = max_bits;
                return NT_STATUS_OK;
@@ -511,7 +519,9 @@ NTSTATUS pvfs_access_check(struct pvfs_state *pvfs,
        NTSTATUS status;
        struct security_descriptor *sd;
 
-       if (*access_mask == 0) {
+       /* on SMB2 a blank access mask is always denied */
+       if (pvfs->ntvfs->ctx->protocol == PROTOCOL_SMB2 &&
+           *access_mask == 0) {
                return NT_STATUS_ACCESS_DENIED;
        }