The Samba-Bugzilla – Attachment 11775 Details for
Bug 11648
[SECURITY] CVE-2015-7560: Getting and setting Windows ACLs on symlinks can change permissions on link target.
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
diff of patch 12 for master and 4.1 to show whitespace differences
diff-of-diffs (text/plain), 4.13 KB, created by
Michael Adam
on 2016-01-14 00:16:04 UTC
(
hide
)
Description:
diff of patch 12 for master and 4.1 to show whitespace differences
Filename:
MIME Type:
Creator:
Michael Adam
Created:
2016-01-14 00:16:04 UTC
Size:
4.13 KB
patch
obsolete
> +/* > + Test setting EA's are rejected on symlinks. > + */ > +static bool run_ea_symlink_test(int dummy) > +{ > + static struct cli_state *cli; > + const char *fname = "posix_file_ea"; > + const char *sname = "posix_symlink_ea"; > + const char *ea_name = "testea_name"; > + const char *ea_value = "testea_value"; > + uint16_t fnum = (uint16_t)-1; > + bool correct = false; > + NTSTATUS status; > + size_t i, num_eas; > + struct ea_struct *eas = NULL; > + TALLOC_CTX *frame = NULL; > + > + frame = talloc_stackframe(); > + > + printf("Starting EA symlink test\n"); > + > + if (!torture_open_connection(&cli, 0)) { > + TALLOC_FREE(frame); > + return false; > + } > + > + smbXcli_conn_set_sockopt(cli->conn, sockops); > + > + status = torture_setup_unix_extensions(cli); > + if (!NT_STATUS_IS_OK(status)) { > + TALLOC_FREE(frame); > + return false; > + } > + > + cli_setatr(cli, fname, 0, 0); > + cli_posix_unlink(cli, fname); > + cli_setatr(cli, sname, 0, 0); > + cli_posix_unlink(cli, sname); > + > + status = cli_ntcreate(cli, > + fname, > + 0, >-+ READ_CONTROL_ACCESS, >++ READ_CONTROL_ACCESS, > + 0, >-+ FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE, >-+ FILE_CREATE, >-+ 0x0, >++ FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE, >++ FILE_CREATE, >++ 0x0, > + 0x0, > + &fnum, > + NULL); > + > + if (!NT_STATUS_IS_OK(status)) { > + printf("cli_ntcreate of %s failed (%s)\n", > + fname, > + nt_errstr(status)); > + goto out; > + } > + > + status = cli_close(cli, fnum); > + if (!NT_STATUS_IS_OK(status)) { > + printf("close failed (%s)\n", > + nt_errstr(status)); > + goto out; > + } > + fnum = (uint16_t)-1; > + > + /* Set an EA on the path. */ > + status = cli_set_ea_path(cli, > + fname, > + ea_name, > + ea_value, > + strlen(ea_value)+1); > + > + if (!NT_STATUS_IS_OK(status)) { > + printf("cli_set_ea_path failed (%s)\n", > + nt_errstr(status)); > + goto out; > + } > + > + /* Now create a symlink. */ > + status = cli_posix_symlink(cli, fname, sname); > + if (!NT_STATUS_IS_OK(status)) { > + printf("cli_posix_symlink of %s -> %s failed (%s)\n", > + sname, > + fname, > + nt_errstr(status)); > + goto out; > + } > + > + /* Get the EA list on the path. Should return value set. */ > + status = cli_get_ea_list_path(cli, > + fname, > + frame, > + &num_eas, > + &eas); > + >-+ if (!NT_STATUS_IS_OK(status)) { >++ if (!NT_STATUS_IS_OK(status)) { > + printf("cli_get_ea_list_path failed (%s)\n", > + nt_errstr(status)); > + goto out; >-+ } >++ } > + > + /* Ensure the EA we set is there. */ > + for (i=0; i<num_eas; i++) { > + if (strcmp(eas[i].name, ea_name) == 0 && > + eas[i].value.length == strlen(ea_value)+1 && > + memcmp(eas[i].value.data, > + ea_value, > + eas[i].value.length) == 0) { > + break; > + } >-+ } >++ } > + > + if (i == num_eas) { > + printf("Didn't find EA on pathname %s\n", > + fname); > + goto out; >-+ } >++ } > + > + num_eas = 0; > + TALLOC_FREE(eas); > + > + /* Get the EA list on the symlink. Should return empty list. */ > + status = cli_get_ea_list_path(cli, > + sname, > + frame, > + &num_eas, > + &eas); > + >-+ if (!NT_STATUS_IS_OK(status)) { >++ if (!NT_STATUS_IS_OK(status)) { > + printf("cli_get_ea_list_path failed (%s)\n", > + nt_errstr(status)); > + goto out; >-+ } >++ } > + > + if (num_eas != 0) { > + printf("cli_get_ea_list_path failed (%s)\n", > + nt_errstr(status)); > + goto out; >-+ } >++ } > + > + /* Set an EA on the symlink. Should fail. */ > + status = cli_set_ea_path(cli, > + sname, > + ea_name, > + ea_value, > + strlen(ea_value)+1); > + > + if (!NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) { > + printf("cli_set_ea_path on a symlink gave %s. " > + "Should be NT_STATUS_ACCESS_DENIED.\n", > + nt_errstr(status)); > + goto out; > + } > + > + printf("EA symlink test passed\n"); > + correct = true; > + > + out: > + > + if (fnum != (uint16_t)-1) { > + cli_close(cli, fnum); > + fnum = (uint16_t)-1; > + } > + > + cli_setatr(cli, sname, 0, 0); > + cli_posix_unlink(cli, sname); > + cli_setatr(cli, fname, 0, 0); > + cli_posix_unlink(cli, fname); > + > + if (!torture_close_connection(cli)) { > + correct = false; > + } > + > + TALLOC_FREE(frame); > + return correct; > +}
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Actions:
View
Attachments on
bug 11648
:
11740
|
11757
|
11760
|
11763
|
11764
|
11768
|
11769
|
11770
|
11773
|
11774
|
11775
|
11776
|
11777
|
11778
|
11779
|
11856
|
11857
|
11858
|
11859
|
11860
|
11861
|
11862
|
11901