When setting a non-default ACL, don't forget to apply masks to SMB_ACL_USER and SMB_A...

The last 4 patches address bug #9236 - ACL masks incorrectly applied when
setting ACLs.
(cherry picked from commit ac7d9768c718f6225f2182d763ec1dbc6dc48ea8)

diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index 09d6becf638b4aac599f53e1646183773beee28d..22ad40faec0d5af7d7ff24cd7a2160e905d7e73e 100644 (file)
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -1399,6 +1399,16 @@ static bool ensure_canon_entry_valid(connection_struct *conn,
                        }
                        got_other = True;
                        pace_other = pace;
+
+               } else if (pace->type == SMB_ACL_USER || pace->type == SMB_ACL_GROUP) {
+
+                       /*
+                        * Ensure create mask/force create mode is respected on set.
+                        */
+
+                       if (setting_acl && !is_default_acl) {
+                               apply_default_perms(params, is_directory, pace, S_IRGRP);
+                       }
                }
        }