Changeset 751 for trunk/server/source3/modules/vfs_acl_common.c

Timestamp:

Nov 29, 2012, 1:59:04 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.9

File:

• trunk/server/source3/modules/vfs_acl_common.c (modified) (20 diffs)

trunk/server/source3/modules/vfs_acl_common.c

@@ -167 +167 @@
 *******************************************************************/
 
-static void add_directory_inheritable_components(vfs_handle_struct *handle,
+static  add_directory_inheritable_components(vfs_handle_struct *handle,
                                 const char *name,
                                 SMB_STRUCT_STAT *psbuf,
@@ -185 +185 @@
 
         if (new_ace_list == NULL) {
-                return;
+                return;
         }
 
@@ -237 +237 @@
                                 SEC_ACE_FLAG_OBJECT_INHERIT|
                                 SEC_ACE_FLAG_INHERIT_ONLY);
-        psd->dacl->aces = new_ace_list;
-        psd->dacl->num_aces += 3;
+        if (psd->dacl) {
+                psd->dacl->aces = new_ace_list;
+                psd->dacl->num_aces += 3;
+        } else {
+                psd->dacl = make_sec_acl(talloc_tos(),
+                                NT4_ACL_REVISION,
+                                3,
+                                new_ace_list);
+                if (psd->dacl == NULL) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+        }
+        return NT_STATUS_OK;
 }
 
@@ -253 +264 @@
                                 struct security_descriptor **ppdesc)
 {
-        DATA_BLOB blob;
+        DATA_BLOB blob;
         NTSTATUS status;
         uint16_t hash_type = XATTR_SD_HASH_TYPE_NONE;
@@ -379 +390 @@
                         }
                 }
-                is_directory = S_ISDIR(sbuf.st_ex_mode);
+                is_directory = S_ISDIR(st_ex_mode);
 
                 if (ignore_file_system_acl) {
@@ -394 +405 @@
                                 !sd_has_inheritable_components(psd,
                                                         true)) {
-                                add_directory_inheritable_components(handle,
+                                status = add_directory_inheritable_components(
+                                                        handle,
                                                         name,
                                                         psbuf,
                                                         psd);
+
+
+
                         }
                         /* The underlying POSIX module always sets
@@ -414 +429 @@
         }
         if (!(security_info & SECINFO_DACL)) {
+
                 psd->dacl = NULL;
         }
         if (!(security_info & SECINFO_SACL)) {
+
                 psd->sacl = NULL;
         }
@@ -538 +555 @@
                                         (SECINFO_OWNER |
                                          SECINFO_GROUP |
-                                         SECINFO_DACL),
+                                         SECINFO_DACL  |
+                                         SECINFO_SACL),
                                         pp_parent_desc);
 
@@ -557 +575 @@
                                 struct security_descriptor **pp_parent_desc)
 {
-        char *parent_name = NULL;
         struct security_descriptor *parent_desc = NULL;
         uint32_t access_granted = 0;
@@ -576 +593 @@
         if(!NT_STATUS_IS_OK(status)) {
                 DEBUG(10,("check_parent_acl_common: access check "
-                        "on directory %s for "
+                        "on  "
                         "path %s for mask 0x%x returned %s\n",
-                        parent_name,
                         path,
                         access_mask,
@@ -621 +637 @@
                                 (SECINFO_OWNER |
                                  SECINFO_GROUP |
-                                 SECINFO_DACL),
+                                 SECINFO_DACL  |
+                                 SECINFO_SACL),
                                 &pdesc);
         if (NT_STATUS_IS_OK(status)) {
@@ -632 +649 @@
                 if (!NT_STATUS_IS_OK(status)) {
                         DEBUG(10,("open_acl_xattr: %s open "
+
                                 "refused with error %s\n",
                                 fsp_str_dbg(fsp),
+
+
                                 nt_errstr(status) ));
                         goto err;
@@ -800 +820 @@
                         CONST_DISCARD(struct security_descriptor *,psd));
         }
-        create_acl_blob(psd, &blob, XATTR_SD_HASH_TYPE_SHA256, hash);
-        store_acl_blob_fsp(handle, fsp, &blob);
-
-        return NT_STATUS_OK;
+        status = create_acl_blob(psd, &blob, XATTR_SD_HASH_TYPE_SHA256, hash);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(10, ("fset_nt_acl_xattr: create_acl_blob failed\n"));
+                return status;
+        }
+
+        status = store_acl_blob_fsp(handle, fsp, &blob);
+
+        return status;
 }
 
@@ -809 +834 @@
                         const char *fname, const char *mask, uint32 attr)
 {
-        NTSTATUS status = check_parent_acl_common(handle, fname,
-                                        SEC_DIR_LIST, NULL);
-
-        if (!NT_STATUS_IS_OK(status)) {
+        NTSTATUS status;
+        uint32_t access_granted = 0;
+        struct security_descriptor *sd = NULL;
+
+        status = get_nt_acl_internal(handle,
+                                NULL,
+                                fname,
+                                (SECINFO_OWNER |
+                                 SECINFO_GROUP |
+                                 SECINFO_DACL  |
+                                 SECINFO_SACL),
+                                &sd);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(10,("opendir_acl_common: "
+                        "get_nt_acl_internal for dir %s "
+                        "failed with error %s\n",
+                        fname,
+                        nt_errstr(status) ));
                 errno = map_errno_from_nt_status(status);
                 return NULL;
         }
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
         return SMB_VFS_NEXT_OPENDIR(handle, fname, mask, attr);
 }
@@ -831 +887 @@
         struct smb_filename local_fname;
         int saved_errno = 0;
+
+
+
+
+
+
+
 
         if (!parent_dirname(talloc_tos(), path,
@@ -843 +906 @@
 
         /* cd into the parent dir to pin it. */
-        ret = SMB_VFS_CHDIR(conn, parent_dir);
+        ret = (conn, parent_dir);
         if (ret == -1) {
                 saved_errno = errno;
@@ -862 +925 @@
         id = vfs_file_id_from_sbuf(conn, &local_fname.st);
         for (fsp = file_find_di_first(conn->sconn, id); fsp;
-             file_find_di_next(fsp)) {
+         file_find_di_next(fsp)) {
                 if (fsp->access_mask & DELETE_ACCESS &&
                                 fsp->delete_on_close) {
@@ -897 +960 @@
         TALLOC_FREE(parent_dir);
 
-        vfs_ChDir(conn, conn->connectpath);
+        if (saved_dir) {
+                vfs_ChDir(conn, saved_dir);
+        }
         if (saved_errno) {
                 errno = saved_errno;
@@ -909 +974 @@
         int ret;
 
+
         ret = SMB_VFS_NEXT_RMDIR(handle, path);
-        if (!(ret == -1 && (errno == EACCES || errno == EPERM))) {
-                DEBUG(10,("rmdir_acl_common: unlink of %s failed %s\n",
-                        path,
-                        strerror(errno) ));
-                return ret;
-        }
-
-        return acl_common_remove_object(handle,
-                                        path,
-                                        true);
+        if (ret == 0) {
+                return 0;
+        }
+        if (errno == EACCES || errno == EPERM) {
+                /* Failed due to access denied,
+                   see if we need to root override. */
+                return acl_common_remove_object(handle,
+                                                path,
+                                                true);
+        }
+
+        DEBUG(10,("rmdir_acl_common: unlink of %s failed %s\n",
+                path,
+                strerror(errno) ));
+        return -1;
 }
 
@@ -1039 +1110 @@
         int ret;
 
+
         ret = SMB_VFS_NEXT_UNLINK(handle, smb_fname);
-        if (!(ret == -1 && (errno == EACCES || errno == EPERM))) {
-                DEBUG(10,("unlink_acl_common: unlink of %s failed %s\n",
-                        smb_fname->base_name,
-                        strerror(errno) ));
-                return ret;
-        }
-        /* Don't do anything fancy for streams. */
-        if (smb_fname->stream_name) {
-                return ret;
-        }
-
-        return acl_common_remove_object(handle,
+        if () {
+                
+        
+        
+                
+        
+
+        
+                
+        
+                }
+        return acl_common_remove_object(handle,
                                         smb_fname->base_name,
                                         false);
+
+
+
+
+
+
 }