s3: smbd: Use separate flag to track become_root()/unbecome_root() state.
authorJeremy Allison <jra@samba.org>
Wed, 17 Jun 2015 17:23:30 +0000 (10:23 -0700)
committerJeremy Allison <jra@samba.org>
Thu, 25 Jun 2015 20:14:58 +0000 (22:14 +0200)
Early function exit can mean backup_priv is set but we haven't called
become_root(). *Lots* of work by the reviewers went in to checking this
isn't a security issue.

Found by Codenomicon at the Redmond plugfest.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11339

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jun 25 22:14:58 CEST 2015 on sn-devel-104

source3/smbd/trans2.c

index e518c7b48efb465b102f8d334874b2512bc3910d..88c69a9b757a83f53192ec8168410fce529d0c3d 100644 (file)
@@ -2474,6 +2474,7 @@ static void call_trans2findfirst(connection_struct *conn,
        struct smbd_server_connection *sconn = req->sconn;
        uint32_t ucf_flags = (UCF_SAVE_LCOMP | UCF_ALWAYS_ALLOW_WCARD_LCOMP);
        bool backup_priv = false;
+       bool as_root = false;
 
        if (total_params < 13) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
@@ -2539,6 +2540,7 @@ close_if_end = %d requires_resume_key = %d backup_priv = %d level = 0x%x, max_da
 
        if (backup_priv) {
                become_root();
+               as_root = true;
                ntstatus = filename_convert_with_privilege(ctx,
                                conn,
                                req,
@@ -2809,7 +2811,7 @@ total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pd
        }
  out:
 
-       if (backup_priv) {
+       if (as_root) {
                unbecome_root();
        }
 
@@ -2863,6 +2865,7 @@ static void call_trans2findnext(connection_struct *conn,
        struct dptr_struct *dirptr;
        struct smbd_server_connection *sconn = req->sconn;
        bool backup_priv = false; 
+       bool as_root = false;
 
        if (total_params < 13) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
@@ -3036,6 +3039,7 @@ total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pd
 
        if (backup_priv) {
                become_root();
+               as_root = true;
        }
 
        /*
@@ -3137,7 +3141,7 @@ total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pd
                dptr_close(sconn, &dptr_num); /* This frees up the saved mask */
        }
 
-       if (backup_priv) {
+       if (as_root) {
                unbecome_root();
        }