Fix logic error in try_chown - we shouldn't arbitrarily chown

to ourselves unless that was passed in.
Jeremy.
(cherry picked from commit db2d56484e21daeb91df4b5e2286d242910336e8)

2 files changed, 9 insertions, 8 deletions

diff --git a/source/modules/vfs_aixacl2.c b/source/modules/vfs_aixacl2.c
index a078b9f9f62..5ebc3a12f89 100644
--- a/source/modules/vfs_aixacl2.c
+++ b/source/modules/vfs_aixacl2.c
@@ -25,8 +25,6 @@
 
 #define AIXACL2_MODULE_NAME "aixacl2"
 
-extern int try_chown(connection_struct *conn, const char *fname, uid_t uid, gid_t gid);
-
 extern SMB_ACL_T aixacl_to_smbacl( struct acl *file_acl);
 extern struct acl *aixacl_smb_to_aixacl(SMB_ACL_TYPE_T acltype, SMB_ACL_T theacl);
 
diff --git a/source/smbd/posix_acls.c b/source/smbd/posix_acls.c
index 0882cb504e9..b862699f42f 100644
--- a/source/smbd/posix_acls.c
+++ b/source/smbd/posix_acls.c
@@ -3187,6 +3187,15 @@ int try_chown(connection_struct *conn, const char *fname, uid_t uid, gid_t gid)
 		return -1;
 	}
 
+	/* only allow chown to the current user. This is more secure,
+	   and also copes with the case where the SID in a take ownership ACL is
+	   a local SID on the users workstation
+	*/
+	if (uid != current_user.ut.uid) {
+		errno = EPERM;
+		return -1;
+	}
+
 	if (SMB_VFS_STAT(conn,fname,&st)) {
 		return -1;
 	}
@@ -3195,12 +3204,6 @@ int try_chown(connection_struct *conn, const char *fname, uid_t uid, gid_t gid)
 		return -1;
 	}
 
-	/* only allow chown to the current user. This is more secure,
-	   and also copes with the case where the SID in a take ownership ACL is
-	   a local SID on the users workstation 
-	*/
-	uid = current_user.ut.uid;
-
 	become_root();
 	/* Keep the current file gid the same. */
 	ret = SMB_VFS_FCHOWN(fsp, uid, (gid_t)-1);