diff options
| author | Ralph Boehme <slow@samba.org> | 2019-03-01 18:57:23 +0100 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2019-03-11 12:25:05 +0000 |
| commit | 43957ab96e7f62c83fe3e46e7467b974ea44f99b (patch) | |
| tree | 3a67ff8c758655379e93641bef14a8f036f76157 | |
| parent | 4fe9eff4dd63cd7aca4caa63057e27399cc3b929 (diff) | |
| download | samba-43957ab96e7f62c83fe3e46e7467b974ea44f99b.tar.gz | |
libcli/security: fix handling of deny type ACEs in access_check_max_allowed()
Deny ACEs must always be evaluated against explicitly granted rights
from previous ACEs.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13812
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 8d355dd9769e8990ce998b4c9f28977669b43616)
Autobuild-User(v4-9-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-9-test): Mon Mar 11 12:25:05 UTC 2019 on sn-devel-144
| -rw-r--r-- | libcli/security/access_check.c | 2 | ||||
| -rw-r--r-- | selftest/knownfail.d/smb2.acls | 4 |
2 files changed, 1 insertions, 5 deletions
diff --git a/libcli/security/access_check.c b/libcli/security/access_check.c index d1d57eecef2..322f4fdb0c6 100644 --- a/libcli/security/access_check.c +++ b/libcli/security/access_check.c @@ -173,7 +173,7 @@ static uint32_t access_check_max_allowed(const struct security_descriptor *sd, break; case SEC_ACE_TYPE_ACCESS_DENIED: case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT: - denied |= ace->access_mask; + denied |= ~granted & ace->access_mask; break; default: /* Other ACE types not handled/supported */ break; diff --git a/selftest/knownfail.d/smb2.acls b/selftest/knownfail.d/smb2.acls deleted file mode 100644 index b76a3c719ce..00000000000 --- a/selftest/knownfail.d/smb2.acls +++ /dev/null @@ -1,4 +0,0 @@ -^samba3.smb2.acls.OWNER-RIGHTS-DENY1\(ad_dc\) -^samba3.smb2.acls.OWNER-RIGHTS-DENY1\(nt4_dc\) -^samba3.smb2.acls.DENY1\(ad_dc\) -^samba3.smb2.acls.DENY1\(nt4_dc\) |