Bug 8102 - domuser can change ACL from his files over the network
Summary: domuser can change ACL from his files over the network
Status: RESOLVED WONTFIX
Alias: None
Product: Samba 3.5
Classification: Unclassified
Component: File services (show other bugs)
Version: 3.5.8
Hardware: x64 Linux
: P5 major
Target Milestone: ---
Assignee: Stefan Metzmacher
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks: 7803
  Show dependency tree / graph
 
Reported: 2011-04-21 12:22 UTC by Christian Strott
Modified: 2012-10-25 07:10 UTC (History)
4 users (show)

See Also:

Attachments
Patch for master (8.04 KB, patch)
2011-07-05 10:06 UTC, Volker Lendecke 		metze: review+
Details
Patch for v3-6-test (19.98 KB, patch)
2011-07-12 16:18 UTC, Stefan Metzmacher 		vl: review+
Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Christian Strott 2011-04-21 12:22:41 UTC 
On a Windows 2003 system it is not allowed to change the ACLs from a normal domuser. The corresponding checkbox is grayed out on the ACL editor(only on client side). Therefore it impossible for the client to make changes on the ACL.
Connection the client to a SAMBA server shows a different behavior. The checkbox is active and the domuser can change the ACL.
Comment 1 Volker Lendecke 2011-04-21 12:25:49 UTC 
In the meantime, Stefan Metzmacher has found the solution for this. It is the share acls that make the difference. Full control granted via the share acls enables acl setting remotely even on W2k3. Probably one of my test systems was not properly configured.

We're working on this.

Thanks for the bug report!
Comment 2 Volker Lendecke 2011-05-12 15:14:08 UTC 
Update: I've talked to people from Microsoft at SambaXP, and it was not immediately clear how this is exactly supposed to work. MS will soon respond.

Volker
Comment 3 Karolin Seeger 2011-06-08 07:23:32 UTC 
Lowering severity.
Comment 4 Volker Lendecke 2011-07-05 10:06:27 UTC 
Created attachment 6666 [details]
Patch for master

This is a patch for master.

Stefan, can you take a look? This survives my initial testing.

Volker
Comment 5 Stefan Metzmacher 2011-07-05 13:09:48 UTC 
Comment on attachment 6666 [details]
Patch for master

I've pushed this to autobuild
Comment 6 Stefan Metzmacher 2011-07-12 16:18:51 UTC 
Created attachment 6682 [details]
Patch for v3-6-test
Comment 7 Karolin Seeger 2011-07-13 19:40:04 UTC 
(In reply to comment #6)
> Created attachment 6682 [details]
> Patch for v3-6-test

Pushed to v3-6-test.

The patches do not apply to v3-5-test, the bug report is against 3.5.
Volker/Metze, is there a chance to get a backport for 3.5?
Comment 8 Karolin Seeger 2011-07-19 18:56:29 UTC 
Metze, is there a chance to get a backport for 3.5?
Comment 9 Stefan Metzmacher 2011-07-30 09:17:21 UTC 
Maybe for 3.5.12, I'm not sure if I have the time to do it for 3.5.11,
as the patches doesn't apply in 3.5.
Comment 10 Stefan Metzmacher 2012-10-25 07:10:47 UTC 
I don't think this will make it into any 3.5 release anymore