From: Jeremy Allison <jra@samba.org>
Date: Fri, 17 Apr 2020 21:14:38 +0000 (-0700)
Subject: s3: smbd: When writing a security descriptor SACL, ensure both SEC_FLAG_SYSTEM_SECURI... 
X-Git-Tag: ldb-2.2.0~902
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=81b26559cdc4aac974c2f98571f9a6d24a0d795d;p=thirdparty%2Fsamba.git

s3: smbd: When writing a security descriptor SACL, ensure both SEC_FLAG_SYSTEM_SECURITY|SEC_STD_WRITE_DAC are set.

smbtorture3 SMB2-SACL tests this against Windows10 (and Samba).

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
---

diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index f7e313d6edf..66bcebf1313 100644
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -950,6 +950,13 @@ NTSTATUS set_sd(files_struct *fsp, struct security_descriptor *psd,
 		if (!(fsp->access_mask & SEC_FLAG_SYSTEM_SECURITY)) {
 			return NT_STATUS_ACCESS_DENIED;
 		}
+		/*
+		 * Setting a SACL also requires WRITE_DAC.
+		 * See the smbtorture3 SMB2-SACL test.
+		 */
+		if (!(fsp->access_mask & SEC_STD_WRITE_DAC)) {
+			return NT_STATUS_ACCESS_DENIED;
+		}
 		/* Convert all the generic bits. */
 		if (psd->sacl) {
 			security_acl_map_generic(psd->sacl, &file_generic_mapping);