The Samba-Bugzilla – Attachment 8287 Details for
Bug 9462
Users can not be given write permissions any more by default
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
my version of a patch for master
0001-s3-smbd-don-t-apply-create-directory-mask-and-modes-.patch (text/plain), 4.79 KB, created by
Michael Adam
on 2012-12-05 20:42:33 UTC
(
hide
)
Description:
my version of a patch for master
Filename:
MIME Type:
Creator:
Michael Adam
Created:
2012-12-05 20:42:33 UTC
Size:
4.79 KB
patch
obsolete
>From af6e1d29cbb29447734636478d4a183967983a5f Mon Sep 17 00:00:00 2001 >From: Michael Adam <obnox@samba.org> >Date: Wed, 5 Dec 2012 15:04:01 +0100 >Subject: [PATCH] s3:smbd: don't apply create/directory mask and modes in > apply_default_perms() > >The mask/mode parameters should only apply to a situation with only >pure posix permissions. >Once we are dealing with ACLs and inheritance, we need to do it correctly. > >Signed-off-by: Michael Adam <obnox@samba.org> >--- > source3/smbd/posix_acls.c | 88 ++++++--------------------------------------- > 1 file changed, 11 insertions(+), 77 deletions(-) > >diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c >index ef0a084..a6a8c3d 100644 >--- a/source3/smbd/posix_acls.c >+++ b/source3/smbd/posix_acls.c >@@ -1236,48 +1236,19 @@ NTSTATUS unpack_nt_owners(struct connection_struct *conn, > return NT_STATUS_OK; > } > >-/**************************************************************************** >- Ensure the enforced permissions for this share apply. >-****************************************************************************/ > >-static void apply_default_perms(const struct share_params *params, >- const bool is_directory, canon_ace *pace, >- mode_t type) >+static void trim_ace_perms(canon_ace *pace) > { >- mode_t and_bits = (mode_t)0; >- mode_t or_bits = (mode_t)0; >- >- /* Get the initial bits to apply. */ >+ pace->perms = pace->perms & (S_IXUSR|S_IWUSR|S_IRUSR); >+} > >+static void ensure_minimal_owner_ace_perms(const bool is_directory, >+ canon_ace *pace) >+{ >+ pace->perms |= S_IRUSR; > if (is_directory) { >- and_bits = lp_dir_mask(params->service); >- or_bits = lp_force_dir_mode(params->service); >- } else { >- and_bits = lp_create_mask(params->service); >- or_bits = lp_force_create_mode(params->service); >- } >- >- /* Now bounce them into the S_USR space. */ >- switch(type) { >- case S_IRUSR: >- /* Ensure owner has read access. */ >- pace->perms |= S_IRUSR; >- if (is_directory) >- pace->perms |= (S_IWUSR|S_IXUSR); >- and_bits = unix_perms_to_acl_perms(and_bits, S_IRUSR, S_IWUSR, S_IXUSR); >- or_bits = unix_perms_to_acl_perms(or_bits, S_IRUSR, S_IWUSR, S_IXUSR); >- break; >- case S_IRGRP: >- and_bits = unix_perms_to_acl_perms(and_bits, S_IRGRP, S_IWGRP, S_IXGRP); >- or_bits = unix_perms_to_acl_perms(or_bits, S_IRGRP, S_IWGRP, S_IXGRP); >- break; >- case S_IROTH: >- and_bits = unix_perms_to_acl_perms(and_bits, S_IROTH, S_IWOTH, S_IXOTH); >- or_bits = unix_perms_to_acl_perms(or_bits, S_IROTH, S_IWOTH, S_IXOTH); >- break; >+ pace->perms |= (S_IWUSR|S_IXUSR); > } >- >- pace->perms = ((pace->perms & and_bits)|or_bits); > } > > /**************************************************************************** >@@ -1430,45 +1401,14 @@ static bool ensure_canon_entry_valid_on_set(connection_struct *conn, > bool got_duplicate_group = false; > > for (pace = *pp_ace; pace; pace = pace->next) { >+ trim_ace_perms(pace); > if (pace->type == SMB_ACL_USER_OBJ) { >- /* >- * Ensure we have default parameters for the >- * user (owner) even on default ACLs. >- */ >- apply_default_perms(params, is_directory, pace, S_IRUSR); >+ ensure_minimal_owner_ace_perms(is_directory, pace); > pace_user = pace; >- > } else if (pace->type == SMB_ACL_GROUP_OBJ) { >- >- /* >- * Ensure create mask/force create mode is respected on set. >- */ >- >- if (!is_default_acl) { >- apply_default_perms(params, is_directory, pace, S_IRGRP); >- } > pace_group = pace; >- > } else if (pace->type == SMB_ACL_OTHER) { >- >- /* >- * Ensure create mask/force create mode is respected on set. >- */ >- >- if (!is_default_acl) { >- apply_default_perms(params, is_directory, pace, S_IROTH); >- } > pace_other = pace; >- >- } else if (pace->type == SMB_ACL_USER || pace->type == SMB_ACL_GROUP) { >- >- /* >- * Ensure create mask/force create mode is respected on set. >- */ >- >- if (!is_default_acl) { >- apply_default_perms(params, is_directory, pace, S_IRGRP); >- } > } > } > >@@ -1520,7 +1460,7 @@ static bool ensure_canon_entry_valid_on_set(connection_struct *conn, > * Ensure we have default parameters for the > * user (owner) even on default ACLs. > */ >- apply_default_perms(params, is_directory, pace, S_IRUSR); >+ ensure_minimal_owner_ace_perms(is_directory, pace); > > DLIST_ADD(*pp_ace, pace); > pace_user = pace; >@@ -1546,9 +1486,6 @@ static bool ensure_canon_entry_valid_on_set(connection_struct *conn, > } else { > pace->perms = 0; > } >- if (!is_default_acl) { >- apply_default_perms(params, is_directory, pace, S_IRGRP); >- } > > DLIST_ADD(*pp_ace, pace); > pace_group = pace; >@@ -1568,9 +1505,6 @@ static bool ensure_canon_entry_valid_on_set(connection_struct *conn, > pace->trustee = global_sid_World; > pace->attr = ALLOW_ACE; > pace->perms = 0; >- if (!is_default_acl) { >- apply_default_perms(params, is_directory, pace, S_IROTH); >- } > > DLIST_ADD(*pp_ace, pace); > pace_other = pace; >-- >1.7.9.5 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Actions:
View
Attachments on
bug 9462
:
8280
|
8286
|
8287
|
8288
|
8289
|
8290
|
8292