ndr/security: Fix up SACLs broken by Samba before 4.18

The information of the claims is lost, make smbd at least read the
full acl properly, synthesize an empty claims struct

Bug: https://bugzilla.samba.org/show_bug.cgi?id=16096
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

diff --git a/librpc/ndr/ndr_sec_helper.c b/librpc/ndr/ndr_sec_helper.c
index 55e373cfdaca061b5a895baafedb221ee696734a..0ab83773a41e272a0f10cba30fd3a950a55b9f72 100644 (file)
--- a/librpc/ndr/ndr_sec_helper.c
+++ b/librpc/ndr/ndr_sec_helper.c
@@ -113,7 +113,36 @@ _PUBLIC_ enum ndr_err_code ndr_pull_security_ace(struct ndr_pull *ndr, ndr_flags
                NDR_CHECK(ndr_maybe_pull_security_ace_object_ctr(ndr, NDR_SCALARS, r));
                NDR_CHECK(ndr_pull_dom_sid(ndr, NDR_SCALARS, &r->trustee));
                sub_size = ndr_subcontext_size_of_ace_coda(r, r->size, ndr->flags);
-               if (sub_size == 0 && !sec_ace_has_extra_blob(r->type)) {
+               if ((sub_size == 0) &&
+                   (r->type == SEC_ACE_TYPE_SYSTEM_RESOURCE_ATTRIBUTE)) {
+                       /*
+                        * Samba < 4.19 dropped the
+                        * CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1
+                        * from SYSTEM_RESOURCE_ATTRIBUTE_ACEs
+                        * when storing on disk. We need to
+                        * fake a meaningless but valid struct
+                        * so that file servers with that
+                        * broken xattr will continue to
+                        * function.
+                        */
+
+                       r->coda.claim = (struct
+                                        CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1){
+                               .name = talloc_strdup(ndr->current_mem_ctx,
+                                                     ""),
+                               .value_type =
+                                       CLAIM_SECURITY_ATTRIBUTE_TYPE_UINT64,
+                       };
+                       if (r->coda.claim.name == NULL) {
+                               return ndr_pull_error(
+                                       ndr,
+                                       NDR_ERR_ALLOC,
+                                       "out of memory synthesising "
+                                       "empty claim for zero-coda "
+                                       "SYSTEM_RESOURCE_ATTRIBUTE_"
+                                       "ACE");
+                       }
+               } else if ((sub_size == 0) && !sec_ace_has_extra_blob(r->type)) {
                        r->coda.ignored.data = NULL;
                        r->coda.ignored.length = 0;
                } else {

diff --git a/selftest/knownfail.d/ntacl_broken_418 b/selftest/knownfail.d/ntacl_broken_418
deleted file mode 100644 (file)
index a1d4ae5..0000000
--- a/selftest/knownfail.d/ntacl_broken_418
+++ /dev/null
@@ -1 +0,0 @@
-^samba.tests.ntacl_resource_attr_ace.samba.tests.ntacl_resource_attr_ace.NtaclCheckBrokenXattr.test_broken_4_18_sd*