The Samba-Bugzilla – Attachment 11770 Details for
Bug 11648
[SECURITY] CVE-2015-7560: Getting and setting Windows ACLs on symlinks can change permissions on link target.
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
git-am fix for 4.0.x
bug-11648.4.0.x (text/plain), 8.94 KB, created by
Jeremy Allison
on 2016-01-12 19:28:02 UTC
(
hide
)
Description:
git-am fix for 4.0.x
Filename:
MIME Type:
Creator:
Jeremy Allison
Created:
2016-01-12 19:28:02 UTC
Size:
8.94 KB
patch
obsolete
>From dfbb2c0434ebb9ad03951c4c637c3829ed68fd1d Mon Sep 17 00:00:00 2001 >From: Jeremy Allison <jra@samba.org> >Date: Tue, 5 Jan 2016 11:18:12 -0800 >Subject: [PATCH 1/8] s3: smbd: Add refuse_symlink() function that can be used > to prevent operations on a symlink. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648 > >Signed-off-by: Jeremy Allison <jra@samba.org> >--- > source3/smbd/trans2.c | 28 ++++++++++++++++++++++++++++ > 1 file changed, 28 insertions(+) > >diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c >index f23192e..e4075da 100644 >--- a/source3/smbd/trans2.c >+++ b/source3/smbd/trans2.c >@@ -52,6 +52,34 @@ static char *store_file_unix_basic_info2(connection_struct *conn, > files_struct *fsp, > const SMB_STRUCT_STAT *psbuf); > >+/**************************************************************************** >+ Check if an open file handle or pathname is a symlink. >+****************************************************************************/ >+ >+static NTSTATUS refuse_symlink(connection_struct *conn, >+ const files_struct *fsp, >+ const char *name) >+{ >+ SMB_STRUCT_STAT sbuf; >+ const SMB_STRUCT_STAT *pst = NULL; >+ >+ if (fsp) { >+ pst = &fsp->fsp_name->st; >+ } else { >+ int ret = vfs_stat_smb_fname(conn, >+ name, >+ &sbuf); >+ if (ret == -1) { >+ return map_nt_error_from_unix(errno); >+ } >+ pst = &sbuf; >+ } >+ if (S_ISLNK(pst->st_ex_mode)) { >+ return NT_STATUS_ACCESS_DENIED; >+ } >+ return NT_STATUS_OK; >+} >+ > /******************************************************************** > The canonical "check access" based on object handle or path function. > ********************************************************************/ >-- >2.6.0.rc2.230.g3dd15c0 > > >From 7c5edad9493aad5e0647d0889172646227fa1b67 Mon Sep 17 00:00:00 2001 >From: Jeremy Allison <jra@samba.org> >Date: Tue, 5 Jan 2016 10:38:28 -0800 >Subject: [PATCH 2/8] s3: smbd: Refuse to get an ACL from a POSIX file handle > on a symlink. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648 > >Signed-off-by: Jeremy Allison <jra@samba.org> >--- > source3/smbd/nttrans.c | 7 +++++++ > 1 file changed, 7 insertions(+) > >diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c >index dd90b6b..1fc0b62 100644 >--- a/source3/smbd/nttrans.c >+++ b/source3/smbd/nttrans.c >@@ -1952,6 +1952,13 @@ NTSTATUS smbd_do_query_security_desc(connection_struct *conn, > return NT_STATUS_ACCESS_DENIED; > } > >+ if (S_ISLNK(fsp->fsp_name->st.st_ex_mode)) { >+ DEBUG(10, ("ACL get on symlink %s denied.\n", >+ fsp_str_dbg(fsp))); >+ TALLOC_FREE(frame); >+ return NT_STATUS_ACCESS_DENIED; >+ } >+ > if (security_info_wanted & (SECINFO_DACL|SECINFO_OWNER| > SECINFO_GROUP|SECINFO_SACL)) { > /* Don't return SECINFO_LABEL if anything else was >-- >2.6.0.rc2.230.g3dd15c0 > > >From 3fac6cef8f119e0aad3fb3bae37912403b47f3bf Mon Sep 17 00:00:00 2001 >From: Jeremy Allison <jra@samba.org> >Date: Tue, 5 Jan 2016 10:52:50 -0800 >Subject: [PATCH 3/8] s3: smbd: Refuse to set an ACL from a POSIX file handle > on a symlink. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648 > >Signed-off-by: Jeremy Allison <jra@samba.org> >--- > source3/smbd/nttrans.c | 6 ++++++ > 1 file changed, 6 insertions(+) > >diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c >index 1fc0b62..b90f473 100644 >--- a/source3/smbd/nttrans.c >+++ b/source3/smbd/nttrans.c >@@ -880,6 +880,12 @@ NTSTATUS set_sd(files_struct *fsp, struct security_descriptor *psd, > return NT_STATUS_OK; > } > >+ if (S_ISLNK(fsp->fsp_name->st.st_ex_mode)) { >+ DEBUG(10, ("ACL set on symlink %s denied.\n", >+ fsp_str_dbg(fsp))); >+ return NT_STATUS_ACCESS_DENIED; >+ } >+ > if (psd->owner_sid == NULL) { > security_info_sent &= ~SECINFO_OWNER; > } >-- >2.6.0.rc2.230.g3dd15c0 > > >From 1d590c6927bd94cbf117d140a56653fcb90f1f8e Mon Sep 17 00:00:00 2001 >From: Jeremy Allison <jra@samba.org> >Date: Tue, 5 Jan 2016 11:22:12 -0800 >Subject: [PATCH 4/8] s3: smbd: Refuse to set a POSIX ACL on a symlink. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648 > >Signed-off-by: Jeremy Allison <jra@samba.org> >--- > source3/smbd/trans2.c | 6 ++++++ > 1 file changed, 6 insertions(+) > >diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c >index e4075da..0d59bff 100644 >--- a/source3/smbd/trans2.c >+++ b/source3/smbd/trans2.c >@@ -6624,6 +6624,7 @@ static NTSTATUS smb_set_posix_acl(connection_struct *conn, > uint16 num_def_acls; > bool valid_file_acls = True; > bool valid_def_acls = True; >+ NTSTATUS status; > > if (total_data < SMB_POSIX_ACL_HEADER_SIZE) { > return NT_STATUS_INVALID_PARAMETER; >@@ -6651,6 +6652,11 @@ static NTSTATUS smb_set_posix_acl(connection_struct *conn, > return NT_STATUS_INVALID_PARAMETER; > } > >+ status = refuse_symlink(conn, fsp, smb_fname->base_name); >+ if (!NT_STATUS_IS_OK(status)) { >+ return status; >+ } >+ > DEBUG(10,("smb_set_posix_acl: file %s num_file_acls = %u, num_def_acls = %u\n", > smb_fname ? smb_fname_str_dbg(smb_fname) : fsp_str_dbg(fsp), > (unsigned int)num_file_acls, >-- >2.6.0.rc2.230.g3dd15c0 > > >From a9b487bf015ffe6c7389490c1ec3bff5f1b36e00 Mon Sep 17 00:00:00 2001 >From: Jeremy Allison <jra@samba.org> >Date: Tue, 5 Jan 2016 11:24:36 -0800 >Subject: [PATCH 5/8] s3: smbd: Refuse to get a POSIX ACL on a symlink. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648 > >Signed-off-by: Jeremy Allison <jra@samba.org> >--- > source3/smbd/trans2.c | 7 +++++++ > 1 file changed, 7 insertions(+) > >diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c >index 0d59bff..c7fd3df 100644 >--- a/source3/smbd/trans2.c >+++ b/source3/smbd/trans2.c >@@ -5112,6 +5112,13 @@ NTSTATUS smbd_do_qfilepathinfo(connection_struct *conn, > uint16 num_file_acls = 0; > uint16 num_def_acls = 0; > >+ status = refuse_symlink(conn, >+ fsp, >+ smb_fname->base_name); >+ if (!NT_STATUS_IS_OK(status)) { >+ return status; >+ } >+ > if (fsp && fsp->fh->fd != -1) { > file_acl = SMB_VFS_SYS_ACL_GET_FD(fsp, > talloc_tos()); >-- >2.6.0.rc2.230.g3dd15c0 > > >From f7900627c349b99307e3983f1a7d336912386705 Mon Sep 17 00:00:00 2001 >From: Jeremy Allison <jra@samba.org> >Date: Tue, 5 Jan 2016 11:05:48 -0800 >Subject: [PATCH 6/8] s3: smbd: Set return values early, allows removal of code > duplication. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648 > >Signed-off-by: Jeremy Allison <jra@samba.org> >--- > source3/smbd/trans2.c | 13 +++++-------- > 1 file changed, 5 insertions(+), 8 deletions(-) > >diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c >index c7fd3df..aa0b1b6 100644 >--- a/source3/smbd/trans2.c >+++ b/source3/smbd/trans2.c >@@ -235,11 +235,12 @@ NTSTATUS get_ea_names_from_file(TALLOC_CTX *mem_ctx, connection_struct *conn, > size_t num_names; > ssize_t sizeret = -1; > >+ if (pnames) { >+ *pnames = NULL; >+ } >+ *pnum_names = 0; >+ > if (!lp_ea_support(SNUM(conn))) { >- if (pnames) { >- *pnames = NULL; >- } >- *pnum_names = 0; > return NT_STATUS_OK; > } > >@@ -289,10 +290,6 @@ NTSTATUS get_ea_names_from_file(TALLOC_CTX *mem_ctx, connection_struct *conn, > > if (sizeret == 0) { > TALLOC_FREE(names); >- if (pnames) { >- *pnames = NULL; >- } >- *pnum_names = 0; > return NT_STATUS_OK; > } > >-- >2.6.0.rc2.230.g3dd15c0 > > >From 943adb5164f532089cf6770b1067e78d399c5a02 Mon Sep 17 00:00:00 2001 >From: Jeremy Allison <jra@samba.org> >Date: Tue, 5 Jan 2016 11:29:38 -0800 >Subject: [PATCH 7/8] s3: smbd: Silently return no EA's available on a symlink. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648 > >Signed-off-by: Jeremy Allison <jra@samba.org> >--- > source3/smbd/trans2.c | 9 +++++++++ > 1 file changed, 9 insertions(+) > >diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c >index aa0b1b6..8ab19a2 100644 >--- a/source3/smbd/trans2.c >+++ b/source3/smbd/trans2.c >@@ -234,6 +234,7 @@ NTSTATUS get_ea_names_from_file(TALLOC_CTX *mem_ctx, connection_struct *conn, > char **names, **tmp; > size_t num_names; > ssize_t sizeret = -1; >+ NTSTATUS status; > > if (pnames) { > *pnames = NULL; >@@ -244,6 +245,14 @@ NTSTATUS get_ea_names_from_file(TALLOC_CTX *mem_ctx, connection_struct *conn, > return NT_STATUS_OK; > } > >+ status = refuse_symlink(conn, fsp, fname); >+ if (!NT_STATUS_IS_OK(status)) { >+ /* >+ * Just return no EA's on a symlink. >+ */ >+ return NT_STATUS_OK; >+ } >+ > /* > * TALLOC the result early to get the talloc hierarchy right. > */ >-- >2.6.0.rc2.230.g3dd15c0 > > >From 5deb2dc28f07045fe238bc41665c554ac8f5d20f Mon Sep 17 00:00:00 2001 >From: Jeremy Allison <jra@samba.org> >Date: Tue, 5 Jan 2016 11:33:48 -0800 >Subject: [PATCH 8/8] s3: smbd: Refuse to set EA's on a symlink. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648 > >Signed-off-by: Jeremy Allison <jra@samba.org> >--- > source3/smbd/trans2.c | 5 +++++ > 1 file changed, 5 insertions(+) > >diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c >index 8ab19a2..bf933cb 100644 >--- a/source3/smbd/trans2.c >+++ b/source3/smbd/trans2.c >@@ -656,6 +656,11 @@ NTSTATUS set_ea(connection_struct *conn, files_struct *fsp, > return NT_STATUS_EAS_NOT_SUPPORTED; > } > >+ status = refuse_symlink(conn, fsp, smb_fname->base_name); >+ if (!NT_STATUS_IS_OK(status)) { >+ return status; >+ } >+ > status = check_access(conn, fsp, smb_fname, FILE_WRITE_EA); > if (!NT_STATUS_IS_OK(status)) { > return status; >-- >2.6.0.rc2.230.g3dd15c0 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Flags:
obnox
:
review+
Actions:
View
Attachments on
bug 11648
:
11740
|
11757
|
11760
|
11763
|
11764
|
11768
|
11769
|
11770
|
11773
|
11774
|
11775
|
11776
|
11777
|
11778
|
11779
|
11856
|
11857
|
11858
|
11859
|
11860
|
11861
|
11862
|
11901