Refactor to create check_parent_access() which can be called for file creation too.

[rusty/samba.git] / source3 / smbd / open.c

diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index f3fccd01d233dbd42617f6a7534ae3b0a950d249..1e21799868e5a61f9d0d53225d68329ee78694f1 100644 (file)
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -134,6 +134,63 @@ NTSTATUS smbd_check_open_rights(struct connection_struct *conn,
        return status;
 }
 
+static NTSTATUS check_parent_access(struct connection_struct *conn,
+                               struct smb_filename *smb_fname,
+                               uint32_t access_mask,
+                               char **pp_parent_dir,
+                               struct security_descriptor **pp_parent_sd)
+{
+       NTSTATUS status;
+       char *parent_dir = NULL;
+       struct security_descriptor *parent_sd = NULL;
+       uint32_t access_granted = 0;
+
+       if (!parent_dirname(talloc_tos(),
+                               smb_fname->base_name,
+                               &parent_dir,
+                               NULL)) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       status = SMB_VFS_GET_NT_ACL(conn,
+                               parent_dir,
+                               SECINFO_DACL,
+                               &parent_sd);
+
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(5,("check_parent_access: SMB_VFS_GET_NT_ACL failed for "
+                       "%s with error %s\n",
+                       parent_dir,
+                       nt_errstr(status)));
+               return status;
+       }
+
+       status = smb1_file_se_access_check(conn,
+                                       parent_sd,
+                                       get_current_nttok(conn),
+                                       access_mask,
+                                       &access_granted);
+       if(!NT_STATUS_IS_OK(status)) {
+               DEBUG(5,("check_parent_access: access check "
+                       "on directory %s for "
+                       "path %s for mask 0x%x returned (0x%x) %s\n",
+                       parent_dir,
+                       smb_fname->base_name,
+                       access_mask,
+                       access_granted,
+                       nt_errstr(status) ));
+               return status;
+       }
+
+       if (pp_parent_dir) {
+               *pp_parent_dir = parent_dir;
+       }
+       if (pp_parent_sd) {
+               *pp_parent_sd = parent_sd;
+       }
+       return NT_STATUS_OK;
+}
+
 /****************************************************************************
  fd support routines - attempt to do a dos_open.
 ****************************************************************************/
@@ -2437,13 +2494,14 @@ static NTSTATUS mkdir_internal(connection_struct *conn,
                               uint32 file_attributes)
 {
        mode_t mode;
-       char *parent_dir;
+       char *parent_dir = NULL;
        NTSTATUS status;
        bool posix_open = false;
        bool need_re_stat = false;
+       uint32_t access_mask = SEC_DIR_ADD_SUBDIR;
 
-       if(!CAN_WRITE(conn)) {
-               DEBUG(5,("mkdir_internal: failing create on read-only share "
+       if(access_mask & ~(conn->share_access)) {
+               DEBUG(5,("mkdir_internal: failing share access "
                         "%s\n", lp_servicename(SNUM(conn))));
                return NT_STATUS_ACCESS_DENIED;
        }
@@ -2465,6 +2523,20 @@ static NTSTATUS mkdir_internal(connection_struct *conn,
                mode = unix_mode(conn, FILE_ATTRIBUTE_DIRECTORY, smb_dname, parent_dir);
        }
 
+       status = check_parent_access(conn,
+                                       smb_dname,
+                                       access_mask,
+                                       &parent_dir,
+                                       NULL);
+       if(!NT_STATUS_IS_OK(status)) {
+               DEBUG(5,("mkdir_internal: check_parent_access "
+                       "on directory %s for path %s returned %s\n",
+                       parent_dir,
+                       smb_dname->base_name,
+                       nt_errstr(status) ));
+               return status;
+       }
+
        if (SMB_VFS_MKDIR(conn, smb_dname->base_name, mode) != 0) {
                return map_nt_error_from_unix(errno);
        }
@@ -2479,9 +2551,9 @@ static NTSTATUS mkdir_internal(connection_struct *conn,
        }
 
        if (!S_ISDIR(smb_dname->st.st_ex_mode)) {
-               DEBUG(0, ("Directory just '%s' created is not a directory\n",
+               DEBUG(0, ("Directory '%s' just created is not a directory !\n",
                          smb_fname_str_dbg(smb_dname)));
-               return NT_STATUS_ACCESS_DENIED;
+               return NT_STATUS_NOT_A_DIRECTORY;
        }
 
        if (lp_store_dos_attributes(SNUM(conn))) {
@@ -2631,6 +2703,15 @@ static NTSTATUS open_directory(connection_struct *conn,
                        /* If directory exists error. If directory doesn't
                         * exist create. */
 
+                       if (dir_existed) {
+                               status = NT_STATUS_OBJECT_NAME_COLLISION;
+                               DEBUG(2, ("open_directory: unable to create "
+                                         "%s. Error was %s\n",
+                                         smb_fname_str_dbg(smb_dname),
+                                         nt_errstr(status)));
+                               return status;
+                       }
+
                        status = mkdir_internal(conn, smb_dname,
                                                file_attributes);
 
@@ -2651,18 +2732,29 @@ static NTSTATUS open_directory(connection_struct *conn,
                         * exist create.
                         */
 
-                       status = mkdir_internal(conn, smb_dname,
+                       if (dir_existed) {
+                               status = NT_STATUS_OK;
+                               info = FILE_WAS_OPENED;
+                       } else {
+                               status = mkdir_internal(conn, smb_dname,
                                                file_attributes);
 
-                       if (NT_STATUS_IS_OK(status)) {
-                               info = FILE_WAS_CREATED;
+                               if (NT_STATUS_IS_OK(status)) {
+                                       info = FILE_WAS_CREATED;
+                               } else {
+                                       /* Cope with create race. */
+                                       if (!NT_STATUS_EQUAL(status,
+                                                       NT_STATUS_OBJECT_NAME_COLLISION)) {
+                                               DEBUG(2, ("open_directory: unable to create "
+                                                       "%s. Error was %s\n",
+                                                       smb_fname_str_dbg(smb_dname),
+                                                       nt_errstr(status)));
+                                               return status;
+                                       }
+                                       info = FILE_WAS_OPENED;
+                               }
                        }
 
-                       if (NT_STATUS_EQUAL(status,
-                                           NT_STATUS_OBJECT_NAME_COLLISION)) {
-                               info = FILE_WAS_OPENED;
-                               status = NT_STATUS_OK;
-                       }
                        break;
 
                case FILE_SUPERSEDE: