← Back to branch summary

~ubuntu-branches/ubuntu/vivid/samba/vivid

« back to all changes in this revision

Viewing changes to source3/smbd/file_access.c

  • Committer: Package Import Robot
  • Author(s): Chuck Short
  • Date: 2011-12-21 13:18:04 UTC
  • mfrom: (0.39.21 sid)
  • Revision ID: package-import@ubuntu.com-20111221131804-xtlr39wx6njehxxr
Tags: 2:3.6.1-3ubuntu1
* Merge from Debian testing.  Remaining changes:
  + debian/patches/VERSION.patch:
    - set SAMBA_VERSION_SUFFIX to Ubuntu.
  + debian/patches/error-trans.fix-276472:
    - Add the translation of Unix Error code -ENOTSUP to NT Error Code
    - NT_STATUS_NOT_SUPPORTED to prevent the Permission denied error.
  + debian/smb.conf:
    - add "(Samba, Ubuntu)" to server string.
    - comment out the default [homes] share, and add a comment about
      "valid users = %S" to show users how to restrict access to
      \\server\username to only username.
    - Set 'usershare allow guests', so that usershare admins are 
      allowed to create public shares in addition to authenticated
      ones.
    - add map to guest = Bad user, maps bad username to guest access.
  + debian/samba-common.config:
    - Do not change priority to high if dhclient3 is installed.
    - Use priority medium instead of high for the workgroup question.
  + debian/control:
    - Don't build against or suggest ctdb.
    - Add dependency on samba-common-bin to samba.
  + Add ufw integration:
    - Created debian/samba.ufw.profile
    - debian/rules, debian/samba.dirs, debian/samba.files: install
      profile
    - debian/control: have samba suggest ufw
  + Add apport hook:
    - Created debian/source_samba.py.
    - debian/rules, debian/samba.dirs, debian/samba-common-bin.files: install
  + Switch to upstart:
    - Add debian/samba.{nmbd,smbd}.upstart.
  + debian/samba.logrotate, debian/samba-common.dhcp, debian/samba.if-up:
    - Make them upstart compatible
  + debian/samba.postinst: 
    - Avoid scary pdbedit warnings on first import.
  + debian/samba-common.postinst: Add more informative error message for
    the case where smb.conf was manually deleted
  + debian/patches/fix-debuglevel-name-conflict.patch: don't use 'debug_level'
    as a global variable name in an NSS module 
  + Dropped:
    - debian/patches/error-trans.fix-276472
    - debian/patches/fix-debuglevel-name-conflict.patch

Show diffs side-by-side

added added

removed removed

Lines of Context:
source3/smbd/file_access.c
19
19
*/
20
20
 
21
21
#include "includes.h"
 
22
#include "system/filesys.h"
 
23
#include "../libcli/security/security.h"
 
24
#include "../librpc/gen_ndr/ndr_security.h"
 
25
#include "smbd/smbd.h"
22
26
 
23
27
#undef  DBGC_CLASS
24
28
#define DBGC_CLASS DBGC_ACLS
35
39
        struct security_descriptor *secdesc = NULL;
36
40
        bool ret;
37
41
 
38
 
        if (conn->server_info->utok.uid == 0 || conn->admin_user) {
 
42
        if (get_current_uid(conn) == (uid_t)0) {
39
43
                /* I'm sorry sir, I didn't know you were root... */
40
44
                return true;
41
45
        }
42
46
 
43
47
        status = SMB_VFS_GET_NT_ACL(conn, smb_fname->base_name,
44
 
                                    (OWNER_SECURITY_INFORMATION |
45
 
                                     GROUP_SECURITY_INFORMATION |
46
 
                                     DACL_SECURITY_INFORMATION),
 
48
                                    (SECINFO_OWNER |
 
49
                                     SECINFO_GROUP |
 
50
                                     SECINFO_DACL),
47
51
                                    &secdesc);
48
52
        if (!NT_STATUS_IS_OK(status)) {
49
53
                DEBUG(5, ("Could not get acl: %s\n", nt_errstr(status)));
51
55
                goto out;
52
56
        }
53
57
 
54
 
        status = se_access_check(secdesc, conn->server_info->ptok,
 
58
        status = se_access_check(secdesc, get_current_nttok(conn),
55
59
                                 access_mask, &access_granted);
56
60
        ret = NT_STATUS_IS_OK(status);
 
61
 
 
62
        if (DEBUGLEVEL >= 10) {
 
63
                DEBUG(10,("can_access_file_acl for file %s "
 
64
                        "access_mask 0x%x, access_granted 0x%x "
 
65
                        "access %s\n",
 
66
                        smb_fname_str_dbg(smb_fname),
 
67
                        (unsigned int)access_mask,
 
68
                        (unsigned int)access_granted,
 
69
                        ret ? "ALLOWED" : "DENIED" ));
 
70
                NDR_PRINT_DEBUG(security_descriptor, secdesc);
 
71
        }
57
72
 out:
58
73
        TALLOC_FREE(secdesc);
59
74
        return ret;
105
120
                ret = false;
106
121
                goto out;
107
122
        }
108
 
        if (conn->server_info->utok.uid == 0 || conn->admin_user) {
 
123
        if (get_current_uid(conn) == (uid_t)0) {
109
124
                /* I'm sorry sir, I didn't know you were root... */
110
125
                ret = true;
111
126
                goto out;
138
153
                 * or the owner of the directory as we have no possible
139
154
                 * chance of deleting. Otherwise, go on and check the ACL.
140
155
                 */
141
 
                if ((conn->server_info->utok.uid !=
 
156
                if ((get_current_uid(conn) !=
142
157
                        smb_fname_parent->st.st_ex_uid) &&
143
 
                    (conn->server_info->utok.uid != smb_fname->st.st_ex_uid)) {
 
158
                    (get_current_uid(conn) != smb_fname->st.st_ex_uid)) {
144
159
                        DEBUG(10,("can_delete_file_in_directory: not "
145
160
                                  "owner of file %s or directory %s",
146
161
                                  smb_fname_str_dbg(smb_fname),
189
204
        DEBUG(10,("can_access_file_data: requesting 0x%x on file %s\n",
190
205
                  (unsigned int)access_mask, smb_fname_str_dbg(smb_fname)));
191
206
 
192
 
        if (conn->server_info->utok.uid == 0 || conn->admin_user) {
 
207
        if (get_current_uid(conn) == (uid_t)0) {
193
208
                /* I'm sorry sir, I didn't know you were root... */
194
209
                return True;
195
210
        }
197
212
        SMB_ASSERT(VALID_STAT(smb_fname->st));
198
213
 
199
214
        /* Check primary owner access. */
200
 
        if (conn->server_info->utok.uid == smb_fname->st.st_ex_uid) {
 
215
        if (get_current_uid(conn) == smb_fname->st.st_ex_uid) {
201
216
                switch (access_mask) {
202
217
                        case FILE_READ_DATA:
203
218
                                return (smb_fname->st.st_ex_mode & S_IRUSR) ?
245
260
        struct security_descriptor *secdesc = NULL;
246
261
        unsigned int i;
247
262
        NTSTATUS status = SMB_VFS_GET_NT_ACL(conn, fname,
248
 
                                DACL_SECURITY_INFORMATION, &secdesc);
 
263
                                SECINFO_DACL, &secdesc);
249
264
 
250
265
        if (!NT_STATUS_IS_OK(status) || secdesc == NULL) {
251
266
                return false;