Bug 8102 - domuser can change ACL from his files over the network
Summary: domuser can change ACL from his files over the network
Alias: None
Product: Samba 3.5
Classification: Unclassified
Component: File services (show other bugs)
Version: 3.5.8
Hardware: x64 Linux
: P5 major
Target Milestone: ---
Assignee: Stefan Metzmacher
QA Contact: Samba QA Contact
Depends on:
Blocks: 7803
  Show dependency treegraph
Reported: 2011-04-21 12:22 UTC by Christian Strott
Modified: 2012-10-25 07:10 UTC (History)
4 users (show)

See Also:

Patch for master (8.04 KB, patch)
2011-07-05 10:06 UTC, Volker Lendecke
metze: review+
Patch for v3-6-test (19.98 KB, patch)
2011-07-12 16:18 UTC, Stefan Metzmacher
vl: review+

Note You need to log in before you can comment on or make changes to this bug.
Description Christian Strott 2011-04-21 12:22:41 UTC
On a Windows 2003 system it is not allowed to change the ACLs from a normal domuser. The corresponding checkbox is grayed out on the ACL editor(only on client side). Therefore it impossible for the client to make changes on the ACL.
Connection the client to a SAMBA server shows a different behavior. The checkbox is active and the domuser can change the ACL.
Comment 1 Volker Lendecke 2011-04-21 12:25:49 UTC
In the meantime, Stefan Metzmacher has found the solution for this. It is the share acls that make the difference. Full control granted via the share acls enables acl setting remotely even on W2k3. Probably one of my test systems was not properly configured.

We're working on this.

Thanks for the bug report!
Comment 2 Volker Lendecke 2011-05-12 15:14:08 UTC
Update: I've talked to people from Microsoft at SambaXP, and it was not immediately clear how this is exactly supposed to work. MS will soon respond.

Comment 3 Karolin Seeger 2011-06-08 07:23:32 UTC
Lowering severity.
Comment 4 Volker Lendecke 2011-07-05 10:06:27 UTC
Created attachment 6666 [details]
Patch for master

This is a patch for master.

Stefan, can you take a look? This survives my initial testing.

Comment 5 Stefan Metzmacher 2011-07-05 13:09:48 UTC
Comment on attachment 6666 [details]
Patch for master

I've pushed this to autobuild
Comment 6 Stefan Metzmacher 2011-07-12 16:18:51 UTC
Created attachment 6682 [details]
Patch for v3-6-test
Comment 7 Karolin Seeger 2011-07-13 19:40:04 UTC
(In reply to comment #6)
> Created attachment 6682 [details]
> Patch for v3-6-test

Pushed to v3-6-test.

The patches do not apply to v3-5-test, the bug report is against 3.5.
Volker/Metze, is there a chance to get a backport for 3.5?
Comment 8 Karolin Seeger 2011-07-19 18:56:29 UTC
Metze, is there a chance to get a backport for 3.5?
Comment 9 Stefan Metzmacher 2011-07-30 09:17:21 UTC
Maybe for 3.5.12, I'm not sure if I have the time to do it for 3.5.11,
as the patches doesn't apply in 3.5.
Comment 10 Stefan Metzmacher 2012-10-25 07:10:47 UTC
I don't think this will make it into any 3.5 release anymore