s3: Fix bug 8102

We can't allow open with access that has been denied via the share
security descriptor

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Tue Jul  5 16:21:54 CEST 2011 on sn-devel-104
(cherry picked from commit 4deca5d72804a40e68158a1183f5633dabf24761)

diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index 44b18357691fa56e3ce68881903bc26a7b4a88bf..d58744f05f8468fe3944be589614965d57e96e24 100644 (file)
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -76,6 +76,14 @@ NTSTATUS smbd_check_open_rights(struct connection_struct *conn,
        /* Check if we have rights to open. */
        NTSTATUS status;
        struct security_descriptor *sd = NULL;
+       uint32_t rejected_share_access;
+
+       rejected_share_access = access_mask & ~(conn->share_access);
+
+       if (rejected_share_access) {
+               *access_granted = rejected_share_access;
+               return NT_STATUS_ACCESS_DENIED;
+       }
 
        if ((access_mask & DELETE_ACCESS) && !lp_acl_check_permissions(SNUM(conn))) {
                *access_granted = access_mask;