From: Jeremy Allison <jra@samba.org>
Date: Mon, 7 Jun 2021 21:45:24 +0000 (-0700)
Subject: s3: smbd: smbd_check_access_rights_fsp(), for a symlink handle just check the handle... 
X-Git-Tag: tevent-0.11.0~635
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=153da186a1c85c5b33ddde43f6b81233f60f90d2;p=thirdparty%2Fsamba.git

s3: smbd: smbd_check_access_rights_fsp(), for a symlink handle just check the handle bits.

For the pathname verison of this function smbd_check_access_rights()
we return the st_mode bits turned into an NT ACL for a symlink.

For a symlink the mode bits are always 'lrwxrwxrwx' which means
smbd_check_access_rights() version always returned NT_STATUS_OK
for any access rights requested on a symlink.

For smbd_check_access_rights_fsp() to a symlink use the handle
access bits as this is a better representation of the access
allowed.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
---

diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index fc15e66ea0a..a8d9269acb2 100644
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -295,6 +295,21 @@ NTSTATUS smbd_check_access_rights_fsp(struct files_struct *fsp,
 		return NT_STATUS_OK;
 	}
 
+	if (fsp_get_pathref_fd(fsp) == -1) {
+		/*
+		 * This is a POSIX open on a symlink. For the pathname
+		 * verison of this function we used to return the st_mode
+		 * bits turned into an NT ACL. For a symlink the mode bits
+		 * are always rwxrwxrwx which means the pathname version always
+		 * returned NT_STATUS_OK for a symlink. For the handle reference
+		 * to a symlink use the handle access bits.
+		 */
+		if ((fsp->access_mask & access_mask) != access_mask) {
+			return NT_STATUS_ACCESS_DENIED;
+		}
+		return NT_STATUS_OK;
+	}
+
 	status = SMB_VFS_FGET_NT_ACL(fsp,
 				     (SECINFO_OWNER |
 				      SECINFO_GROUP |