The Samba-Bugzilla – Attachment 7981 Details for
Bug 9236
ACL masks incorrectly applied when setting ACLs.
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
git-am fix for 3.5.next
look (text/plain), 7.96 KB, created by
Jeremy Allison
on 2012-10-02 20:28:29 UTC
(
hide
)
Description:
git-am fix for 3.5.next
Filename:
MIME Type:
Creator:
Jeremy Allison
Created:
2012-10-02 20:28:29 UTC
Size:
7.96 KB
patch
obsolete
>From 94c026214bbc5428469bfcbad65c42e6d33ceae4 Mon Sep 17 00:00:00 2001 >From: Jeremy Allison <jra@samba.org> >Date: Tue, 2 Oct 2012 12:38:16 -0700 >Subject: [PATCH 1/4] Reformat spacing to be even. > >--- > source3/smbd/posix_acls.c | 12 ++++++------ > 1 files changed, 6 insertions(+), 6 deletions(-) > >diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c >index 78b373a..e59f54c 100644 >--- a/source3/smbd/posix_acls.c >+++ b/source3/smbd/posix_acls.c >@@ -1342,12 +1342,12 @@ static bool uid_entry_in_group( canon_ace *uid_ace, canon_ace *group_ace ) > ****************************************************************************/ > > static bool ensure_canon_entry_valid(canon_ace **pp_ace, >- const struct share_params *params, >- const bool is_directory, >- const DOM_SID *pfile_owner_sid, >- const DOM_SID *pfile_grp_sid, >- const SMB_STRUCT_STAT *pst, >- bool setting_acl) >+ const struct share_params *params, >+ const bool is_directory, >+ const DOM_SID *pfile_owner_sid, >+ const DOM_SID *pfile_grp_sid, >+ const SMB_STRUCT_STAT *pst, >+ bool setting_acl) > { > canon_ace *pace; > bool got_user = False; >-- >1.7.7.3 > > >From 6f408125f0758ffe22053f9b536e720cb89acef9 Mon Sep 17 00:00:00 2001 >From: Jeremy Allison <jra@samba.org> >Date: Tue, 2 Oct 2012 09:55:09 -0700 >Subject: [PATCH 2/4] Use is_default_acl variable in canonicalise_acl(). > >--- > source3/smbd/posix_acls.c | 5 +++-- > 1 files changed, 3 insertions(+), 2 deletions(-) > >diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c >index e59f54c..338ee6c 100644 >--- a/source3/smbd/posix_acls.c >+++ b/source3/smbd/posix_acls.c >@@ -2416,6 +2416,7 @@ static canon_ace *canonicalise_acl(struct connection_struct *conn, > canon_ace *ace = NULL; > canon_ace *next_ace = NULL; > int entry_id = SMB_ACL_FIRST_ENTRY; >+ bool is_default_acl = (the_acl_type == SMB_ACL_TYPE_DEFAULT); > SMB_ACL_ENTRY_T entry; > size_t ace_count; > >@@ -2503,7 +2504,7 @@ static canon_ace *canonicalise_acl(struct connection_struct *conn, > ace->trustee = sid; > ace->unix_ug = unix_ug; > ace->owner_type = owner_type; >- ace->ace_flags = get_pai_flags(pal, ace, (the_acl_type == SMB_ACL_TYPE_DEFAULT)); >+ ace->ace_flags = get_pai_flags(pal, ace, is_default_acl); > > DLIST_ADD(l_head, ace); > } >@@ -2522,7 +2523,7 @@ static canon_ace *canonicalise_acl(struct connection_struct *conn, > * acl_mask. Ensure all DENY Entries are at the start of the list. > */ > >- DEBUG(10,("canonicalise_acl: %s ace entries before arrange :\n", the_acl_type == SMB_ACL_TYPE_ACCESS ? "Access" : "Default" )); >+ DEBUG(10,("canonicalise_acl: %s ace entries before arrange :\n", is_default_acl ? "Default" : "Access")); > > for ( ace_count = 0, ace = l_head; ace; ace = next_ace, ace_count++) { > next_ace = ace->next; >-- >1.7.7.3 > > >From 3ef31c88f14f5e4fadfc0e4798dbb54e229ed0ca Mon Sep 17 00:00:00 2001 >From: Jeremy Allison <jra@samba.org> >Date: Tue, 2 Oct 2012 13:01:59 -0700 >Subject: [PATCH 3/4] Only apply masks on non-default ACL entries when setting > the ACL. > >--- > source3/smbd/posix_acls.c | 28 +++++++++++++++++++--------- > 1 files changed, 19 insertions(+), 9 deletions(-) > >diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c >index 338ee6c..f7258bd 100644 >--- a/source3/smbd/posix_acls.c >+++ b/source3/smbd/posix_acls.c >@@ -1342,6 +1342,7 @@ static bool uid_entry_in_group( canon_ace *uid_ace, canon_ace *group_ace ) > ****************************************************************************/ > > static bool ensure_canon_entry_valid(canon_ace **pp_ace, >+ bool is_default_acl, > const struct share_params *params, > const bool is_directory, > const DOM_SID *pfile_owner_sid, >@@ -1358,8 +1359,9 @@ static bool ensure_canon_entry_valid(canon_ace **pp_ace, > for (pace = *pp_ace; pace; pace = pace->next) { > if (pace->type == SMB_ACL_USER_OBJ) { > >- if (setting_acl) >+ if (setting_acl && !is_default_acl) { > apply_default_perms(params, is_directory, pace, S_IRUSR); >+ } > got_user = True; > > } else if (pace->type == SMB_ACL_GROUP_OBJ) { >@@ -1368,8 +1370,9 @@ static bool ensure_canon_entry_valid(canon_ace **pp_ace, > * Ensure create mask/force create mode is respected on set. > */ > >- if (setting_acl) >+ if (setting_acl && !is_default_acl) { > apply_default_perms(params, is_directory, pace, S_IRGRP); >+ } > got_grp = True; > > } else if (pace->type == SMB_ACL_OTHER) { >@@ -1378,8 +1381,9 @@ static bool ensure_canon_entry_valid(canon_ace **pp_ace, > * Ensure create mask/force create mode is respected on set. > */ > >- if (setting_acl) >+ if (setting_acl && !is_default_acl) { > apply_default_perms(params, is_directory, pace, S_IROTH); >+ } > got_other = True; > pace_other = pace; > } >@@ -1425,7 +1429,9 @@ static bool ensure_canon_entry_valid(canon_ace **pp_ace, > pace->perms = pace_other->perms; > } > >- apply_default_perms(params, is_directory, pace, S_IRUSR); >+ if (!is_default_acl) { >+ apply_default_perms(params, is_directory, pace, S_IRUSR); >+ } > } else { > pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRUSR, S_IWUSR, S_IXUSR); > } >@@ -1451,7 +1457,9 @@ static bool ensure_canon_entry_valid(canon_ace **pp_ace, > pace->perms = pace_other->perms; > else > pace->perms = 0; >- apply_default_perms(params, is_directory, pace, S_IRGRP); >+ if (!is_default_acl) { >+ apply_default_perms(params, is_directory, pace, S_IRGRP); >+ } > } else { > pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRGRP, S_IWGRP, S_IXGRP); > } >@@ -1473,7 +1481,9 @@ static bool ensure_canon_entry_valid(canon_ace **pp_ace, > pace->attr = ALLOW_ACE; > if (setting_acl) { > pace->perms = 0; >- apply_default_perms(params, is_directory, pace, S_IROTH); >+ if (!is_default_acl) { >+ apply_default_perms(params, is_directory, pace, S_IROTH); >+ } > } else > pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IROTH, S_IWOTH, S_IXOTH); > >@@ -2318,7 +2328,7 @@ static bool unpack_canon_ace(files_struct *fsp, > > print_canon_ace_list( "file ace - before valid", file_ace); > >- if (!ensure_canon_entry_valid(&file_ace, fsp->conn->params, >+ if (!ensure_canon_entry_valid(&file_ace, false, fsp->conn->params, > fsp->is_directory, pfile_owner_sid, pfile_grp_sid, pst, True)) { > free_canon_ace_list(file_ace); > free_canon_ace_list(dir_ace); >@@ -2327,7 +2337,7 @@ static bool unpack_canon_ace(files_struct *fsp, > > print_canon_ace_list( "dir ace - before valid", dir_ace); > >- if (dir_ace && !ensure_canon_entry_valid(&dir_ace, fsp->conn->params, >+ if (dir_ace && !ensure_canon_entry_valid(&dir_ace, true, fsp->conn->params, > fsp->is_directory, pfile_owner_sid, pfile_grp_sid, pst, True)) { > free_canon_ace_list(file_ace); > free_canon_ace_list(dir_ace); >@@ -2513,7 +2523,7 @@ static canon_ace *canonicalise_acl(struct connection_struct *conn, > * This next call will ensure we have at least a user/group/world set. > */ > >- if (!ensure_canon_entry_valid(&l_head, conn->params, >+ if (!ensure_canon_entry_valid(&l_head, is_default_acl, conn->params, > S_ISDIR(psbuf->st_ex_mode), powner, pgroup, > psbuf, False)) > goto fail; >-- >1.7.7.3 > > >From 0ddad8d62ab2ef7b4ba3c06affd58a023ece4e71 Mon Sep 17 00:00:00 2001 >From: Jeremy Allison <jra@samba.org> >Date: Tue, 2 Oct 2012 10:15:54 -0700 >Subject: [PATCH 4/4] When setting a non-default ACL, don't forget to apply > masks to SMB_ACL_USER and SMB_ACL_GROUP entries. > >--- > source3/smbd/posix_acls.c | 10 ++++++++++ > 1 files changed, 10 insertions(+), 0 deletions(-) > >diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c >index f7258bd..646efa4 100644 >--- a/source3/smbd/posix_acls.c >+++ b/source3/smbd/posix_acls.c >@@ -1386,6 +1386,16 @@ static bool ensure_canon_entry_valid(canon_ace **pp_ace, > } > got_other = True; > pace_other = pace; >+ >+ } else if (pace->type == SMB_ACL_USER || pace->type == SMB_ACL_GROUP) { >+ >+ /* >+ * Ensure create mask/force create mode is respected on set. >+ */ >+ >+ if (setting_acl && !is_default_acl) { >+ apply_default_perms(params, is_directory, pace, S_IRGRP); >+ } > } > } > >-- >1.7.7.3 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Actions:
View
Attachments on
bug 9236
:
7980
| 7981 |
8169
|
8170
|
8171