Make the vfs_acl_xattr and other modules work with NULL SD's. Fix the "protected...

Jeremy

diff --git a/source3/modules/vfs_acl_common.c b/source3/modules/vfs_acl_common.c
index abc4a62696ccff065bfa35af793d33dd2dc57a6a..ae81cff01adc55d864f9dcf71232331f1c90ce3f 100644 (file)
--- a/source3/modules/vfs_acl_common.c
+++ b/source3/modules/vfs_acl_common.c
@@ -327,6 +327,9 @@ static NTSTATUS get_nt_acl_internal(vfs_handle_struct *handle,
 
        if (memcmp(&hash[0], &hash_tmp[0], XATTR_SD_HASH_SIZE) == 0) {
                /* Hash matches, return blob sd. */
+               DEBUG(10, ("get_nt_acl_internal: blob hash "
+                       "matches for file %s\n",
+                       name ));
                goto out;
        }
 
@@ -367,6 +370,11 @@ static NTSTATUS get_nt_acl_internal(vfs_handle_struct *handle,
                                                        psbuf,
                                                        psd);
                }
+               /* The underlying POSIX module always sets
+                  the ~SEC_DESC_DACL_PROTECTED bit, as ACLs
+                  can't be inherited in this way under POSIX.
+                  Remove it for Windows-style ACLs. */
+               psd->type &= ~SEC_DESC_DACL_PROTECTED;
        }
 
        if (!(security_info & OWNER_SECURITY_INFORMATION)) {
@@ -660,61 +668,41 @@ static NTSTATUS get_nt_acl_common(vfs_handle_struct *handle,
 *********************************************************************/
 
 static NTSTATUS fset_nt_acl_common(vfs_handle_struct *handle, files_struct *fsp,
-        uint32_t security_info_sent, const struct security_descriptor *psd)
+        uint32_t security_info_sent, const struct security_descriptor *orig_psd)
 {
        NTSTATUS status;
        DATA_BLOB blob;
        struct security_descriptor *pdesc_next = NULL;
+       struct security_descriptor *psd = NULL;
        uint8_t hash[XATTR_SD_HASH_SIZE];
 
        if (DEBUGLEVEL >= 10) {
                DEBUG(10,("fset_nt_acl_xattr: incoming sd for file %s\n",
                          fsp_str_dbg(fsp)));
                NDR_PRINT_DEBUG(security_descriptor,
-                       CONST_DISCARD(struct security_descriptor *,psd));
+                       CONST_DISCARD(struct security_descriptor *,orig_psd));
        }
 
-        /* Ensure we have OWNER/GROUP/DACL set. */
-
-       if ((security_info_sent & (OWNER_SECURITY_INFORMATION|
-                               GROUP_SECURITY_INFORMATION|
-                               DACL_SECURITY_INFORMATION)) !=
-                               (OWNER_SECURITY_INFORMATION|
-                                GROUP_SECURITY_INFORMATION|
-                                DACL_SECURITY_INFORMATION)) {
-               /* No we don't - read from the existing SD. */
-               struct security_descriptor *nc_psd = NULL;
-
-               status = get_nt_acl_internal(handle, fsp,
-                               NULL,
-                               (OWNER_SECURITY_INFORMATION|
-                                GROUP_SECURITY_INFORMATION|
-                                DACL_SECURITY_INFORMATION),
-                               &nc_psd);
-
-               if (!NT_STATUS_IS_OK(status)) {
-                       return status;
-               }
-
-               /* This is safe as nc_psd is discarded at fn exit. */
-               if (security_info_sent & OWNER_SECURITY_INFORMATION) {
-                       nc_psd->owner_sid = psd->owner_sid;
-               }
-               security_info_sent |= OWNER_SECURITY_INFORMATION;
+       status = get_nt_acl_internal(handle, fsp,
+                       NULL,
+                       SECINFO_OWNER|SECINFO_GROUP|SECINFO_DACL|SECINFO_SACL,
+                       &psd);
 
-               if (security_info_sent & GROUP_SECURITY_INFORMATION) {
-                       nc_psd->group_sid = psd->group_sid;
-               }
-               security_info_sent |= GROUP_SECURITY_INFORMATION;
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
+       }
 
-               if (security_info_sent & DACL_SECURITY_INFORMATION) {
-                       nc_psd->dacl = dup_sec_acl(talloc_tos(), psd->dacl);
-                       if (nc_psd->dacl == NULL) {
-                               return NT_STATUS_NO_MEMORY;
-                       }
-               }
-               security_info_sent |= DACL_SECURITY_INFORMATION;
-               psd = nc_psd;
+       if ((security_info_sent & SECINFO_OWNER) && (orig_psd->owner_sid != NULL)) {
+               psd->owner_sid = orig_psd->owner_sid;
+       }
+       if ((security_info_sent & SECINFO_GROUP) && (orig_psd->group_sid != NULL)) {
+               psd->group_sid = orig_psd->group_sid;
+       }
+       if (security_info_sent & SECINFO_DACL) {
+               psd->dacl = orig_psd->dacl;
+       }
+       if (security_info_sent & SECINFO_SACL) {
+               psd->sacl = orig_psd->sacl;
        }
 
        status = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);