Re: [PATCH 2/2] server: Include user groups in file mode calculation when user is file owner
"Ben Peddell" <klightspeed(a)netspace.net.au> writes:
@@ -474,7 +475,9 @@ mode_t sd_to_mode( const struct security_descriptor *sd, const SID *owner ) if (access & FILE_EXECUTE) denied_mode |= S_IXUSR|S_IXGRP|S_IXOTH; } - else if (security_equal_sid( sid, owner )) + else if (security_equal_sid( sid, owner ) || + (security_equal_sid( user, owner ) && + token_sid_present( current->process->token, sid, TRUE ))) { unsigned int access = generic_file_map_access( ad_ace->Mask ); if (access & FILE_READ_DATA) @@ -498,7 +501,9 @@ mode_t sd_to_mode( const struct security_descriptor *sd, const SID *owner ) if (access & FILE_EXECUTE) new_mode |= S_IXUSR|S_IXGRP|S_IXOTH; } - else if (security_equal_sid( sid, owner )) + else if (security_equal_sid( sid, owner ) || + (security_equal_sid( user, owner ) && + token_sid_present( current->process->token, sid, FALSE )))
You should most likely set the group permissions too in that case. -- Alexandre Julliard julliard(a)winehq.org
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Alexandre Julliard wrote:
"Ben Peddell" <klightspeed(a)netspace.net.au> writes:
@@ -474,7 +475,9 @@ mode_t sd_to_mode( const struct security_descriptor *sd, const SID *owner ) if (access & FILE_EXECUTE) denied_mode |= S_IXUSR|S_IXGRP|S_IXOTH; } - else if (security_equal_sid( sid, owner )) + else if (security_equal_sid( sid, owner ) || + (security_equal_sid( user, owner ) && + token_sid_present( current->process->token, sid, TRUE ))) { unsigned int access = generic_file_map_access( ad_ace->Mask ); if (access & FILE_READ_DATA) @@ -498,7 +501,9 @@ mode_t sd_to_mode( const struct security_descriptor *sd, const SID *owner ) if (access & FILE_EXECUTE) new_mode |= S_IXUSR|S_IXGRP|S_IXOTH; } - else if (security_equal_sid( sid, owner )) + else if (security_equal_sid( sid, owner ) || + (security_equal_sid( user, owner ) && + token_sid_present( current->process->token, sid, FALSE )))
You should most likely set the group permissions too in that case.
I think we'd need to implement a security_sid_to_unix_uid function (and re-implement the security_unix_uid_to_sid function to complement it) to be able to do that properly. Also, we'd need a map of groups and their direct members, and possibly a map of members and their direct groups to complement it, to be able to determine the full permission set of the primary group. To store additional permissions, we could use POSIX ACLs, Extended Attributes or special files. With POSIX ACLs, proper ordering would be needed - e.g. most restrictive (full deny) through most permissive (full grant, no deny) to least permissive (no grant, no deny), to ensure users and groups get the access the security descriptor specifies. - -- Ben Peddell -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkshm0cACgkQTHDAI68NsunHGwCfTOe0jDyv+spER3tTeyHToUTl +gcAnRxwedfoxtc5MYeJXpDsLGJK4gKO =YCdA -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Ben Peddell wrote:
I think we'd need to implement a security_sid_to_unix_uid function (and re-implement the security_unix_uid_to_sid function to complement it) to be able to do that properly.
Sorry - that should be security_sid_to_unix_gid and security_unix_gid_to_sid. - -- Ben Peddell -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkshqOcACgkQTHDAI68NsunV2gCfWdTNILUbCwPcz4e9+j5pY5P0 wHAAniQ0+RYUPQ1Ba/oa7yPKCnjqdK04 =piHz -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Ben Peddell wrote:
Alexandre Julliard wrote:
You should most likely set the group permissions too in that case.
I have re-submitted, this time setting group mode according to the permission set of the user's groups. I forgot to unmask the group bits in try 2, so I have unmasked them in try 3. - -- Ben Peddell -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkshwYIACgkQTHDAI68NsumaYQCcC3K/Es3BKXxQcp6ZyI3B2wyu foIAnA14LqzUhU4pfH5mRPZsTkzF9tYv =SJ4+ -----END PGP SIGNATURE-----
participants (2)
-
Alexandre Julliard -
Ben Peddell