Bug 7717 - vfs_acl_xattr: able to remove files in directory which denies removing
Summary: vfs_acl_xattr: able to remove files in directory which denies removing
Status: NEW
Alias: None
Product: Samba 3.5
Classification: Unclassified
Component: File services (show other bugs)
Version: 3.5.5
Hardware: Other Linux
: P3 normal
Target Milestone: ---
Assignee: Jeremy Allison
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-10-08 07:06 UTC by Björn Baumbach
Modified: 2010-10-09 02:40 UTC (History)
0 users

See Also:

Attachments
Wireshark tcp dump - WinXP (267.48 KB, application/octet-stream)
2010-10-08 08:03 UTC, Björn Baumbach 		no flags Details
Wireshark tcp dump - Samba 3.5 (286.73 KB, application/octet-stream)
2010-10-08 08:11 UTC, Björn Baumbach 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Björn Baumbach 2010-10-08 07:06:56 UTC 
I created dir and denied removing an removing of subdirs and files for a user and allowed reading, writing, creating, ...

On the local disk (and on a Windows XP share, too) I'm not allowed to remove and rename sub dirs and files, but I can create and write.

Sambas acl_xattr allows removing files and dirs.
Comment 1 Björn Baumbach 2010-10-08 08:03:41 UTC 
Created attachment 6001 [details]
Wireshark tcp dump - WinXP

I get access to (169.254.134.81) \\XPTEST2\b\neu\, create and try to remove "Neuer Ordner (3)" and get a STATUS_ACCESS_DENIED
Comment 2 Björn Baumbach 2010-10-08 08:11:53 UTC 
Created attachment 6003 [details]
Wireshark tcp dump - Samba 3.5

I get access to (169.254.134.76) \\BBTESTSRV\TESTSHARE\new\, create and try to remove "Neuer Ordner" and get a STATUS_SUCCESS
Comment 3 Björn Baumbach 2010-10-08 08:42:51 UTC 
Additional test:

If I additionally allow "write" I'm not allowed to remove the file, which is correct because "modify" is not enabled.
The additional "modify" allows to remove the file again.

The Windows XP share shows the same. So the additional "modify" is stronger than deny delete child objects in the extended attributes.
Comment 4 Volker Lendecke 2010-10-09 02:40:56 UTC 
Jeremy, I think this is yours.

Volker