diff options
| author | Ralph Boehme <slow@samba.org> | 2019-03-01 18:20:35 +0100 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2019-03-11 07:52:24 +0000 |
| commit | ebee56db540dbc7504bebc96d1b77e1252a536a1 (patch) | |
| tree | c63b30eaeced47053473e83ac8b41a67d65627c0 /selftest | |
| parent | b079f59768dadbca25c74c73dce442dd66171ea1 (diff) | |
| download | samba-ebee56db540dbc7504bebc96d1b77e1252a536a1.tar.gz | |
libcli/security: correct access check and maximum access calculation for Owner Rights ACEs
We basically must process the Owner Rights ACEs as any other ACE wrt to the
order of adding granted permissions and checking denied permissions. According
to MS-DTYP 2.5.3.2 Owner Rights ACEs must be evaluated in the main loop over
the ACEs in an ACL and the corresponding access_mask must be directly applied
to bits_remaining. We currently defer this to after the loop over the ACEs in
ACL, this is wrong.
We just have to do some initial magic to determine if an ACL contains and
Owner Rights ACEs, and in case it doesn't we grant SEC_STD_WRITE_DAC |
SEC_STD_READ_CONTROL at the *beginning*. MS-DTYP:
-- the owner of an object is always granted READ_CONTROL and WRITE_DAC.
CALL SidInToken(Token, SecurityDescriptor.Owner, PrincipalSelfSubst)
IF SidInToken returns True THEN
IF DACL does not contain ACEs from object owner THEN
Remove READ_CONTROL and WRITE_DAC from RemainingAccess
Set GrantedAccess to GrantedAccess or READ_CONTROL or WRITE_OWNER
END IF
END IF
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13812
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 9722f75757c0e38c7f42c7cc310d56aa6eaf6392)
Diffstat (limited to 'selftest')
| -rw-r--r-- | selftest/knownfail.d/smb2.acls | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/selftest/knownfail.d/smb2.acls b/selftest/knownfail.d/smb2.acls deleted file mode 100644 index e1b98cec606..00000000000 --- a/selftest/knownfail.d/smb2.acls +++ /dev/null @@ -1,2 +0,0 @@ -^samba3.smb2.acls.OWNER-RIGHTS-DENY\(ad_dc\) -^samba3.smb2.acls.OWNER-RIGHTS-DENY\(nt4_dc\) |