From: Jeremy Allison <jra@samba.org>
Date: Thu, 13 Jun 2019 16:44:27 +0000 (-0700)
Subject: s3: smbd: Ensure open for security descriptor access actually opens an fd.
X-Git-Tag: ldb-2.0.5~254
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=56c9ad12ee3e40569fd10c60526086ab2fbb3c10;p=thirdparty%2Fsamba.git

s3: smbd: Ensure open for security descriptor access actually opens an fd.

Change test to check two things:
1) Open a symlink for SD read or write access should fail.
2) Request attribute open. Getsd/Setsd on this handle should
fail.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
---

diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index 0d9b2f17d9c..ba13255245c 100644
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -1206,7 +1206,10 @@ static NTSTATUS open_file(files_struct *fsp,
 		local_flags = (flags & ~O_ACCMODE)|O_RDWR;
 	}
 
-	if ((open_access_mask & (FILE_READ_DATA|FILE_WRITE_DATA|FILE_APPEND_DATA|FILE_EXECUTE)) ||
+	if ((open_access_mask & (FILE_READ_DATA|FILE_WRITE_DATA|
+				 FILE_APPEND_DATA|FILE_EXECUTE|
+				 WRITE_DAC_ACCESS|WRITE_OWNER_ACCESS|
+				 READ_CONTROL_ACCESS))||
 	    (!file_existed && (local_flags & O_CREAT)) ||
 	    ((local_flags & O_TRUNC) == O_TRUNC) ) {
 		const char *wild;
diff --git a/source3/torture/torture.c b/source3/torture/torture.c
index 9a3e10fb32d..dbdc703d2cd 100644
--- a/source3/torture/torture.c
+++ b/source3/torture/torture.c
@@ -7527,7 +7527,7 @@ static bool run_acl_symlink_test(int dummy)
 		goto out;
 	}
 
-	/* Open a handle on the symlink. */
+	/* Open a handle on the symlink for SD set/get should fail. */
 	status = cli_ntcreate(cli,
 			sname,
 			0,
@@ -7540,6 +7540,26 @@ static bool run_acl_symlink_test(int dummy)
 			&fnum,
 			NULL);
 
+	if (NT_STATUS_IS_OK(status)) {
+		printf("Symlink open for getsd/setsd of %s "
+			"succeeded (should fail)\n",
+			sname);
+		goto out;
+	}
+
+	/* Open a handle on the symlink. */
+	status = cli_ntcreate(cli,
+			sname,
+			0,
+			FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES,
+			0,
+			FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
+			FILE_OPEN,
+			0x0,
+			0x0,
+			&fnum,
+			NULL);
+
 	if (!NT_STATUS_IS_OK(status)) {
 		printf("cli_posix_open of %s failed (%s)\n",
 			sname,