s3: smbd: smbd_check_access_rights_fsp(), for a symlink handle just check the handle...

For the pathname verison of this function smbd_check_access_rights()
we return the st_mode bits turned into an NT ACL for a symlink.

For a symlink the mode bits are always 'lrwxrwxrwx' which means
smbd_check_access_rights() version always returned NT_STATUS_OK
for any access rights requested on a symlink.

For smbd_check_access_rights_fsp() to a symlink use the handle
access bits as this is a better representation of the access
allowed.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index fc15e66ea0acfae767e3685d4a1db7fed0e2485d..a8d9269acb254c4f154d239d5416c2cb334e003f 100644 (file)
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -295,6 +295,21 @@ NTSTATUS smbd_check_access_rights_fsp(struct files_struct *fsp,
                return NT_STATUS_OK;
        }
 
+       if (fsp_get_pathref_fd(fsp) == -1) {
+               /*
+                * This is a POSIX open on a symlink. For the pathname
+                * verison of this function we used to return the st_mode
+                * bits turned into an NT ACL. For a symlink the mode bits
+                * are always rwxrwxrwx which means the pathname version always
+                * returned NT_STATUS_OK for a symlink. For the handle reference
+                * to a symlink use the handle access bits.
+                */
+               if ((fsp->access_mask & access_mask) != access_mask) {
+                       return NT_STATUS_ACCESS_DENIED;
+               }
+               return NT_STATUS_OK;
+       }
+
        status = SMB_VFS_FGET_NT_ACL(fsp,
                                     (SECINFO_OWNER |
                                      SECINFO_GROUP |