Ensure when calculating the access mask for MAXIMUM_ALLOWED_ACCESS that we add in...

If we can access the path to this file, by
default we have FILE_READ_ATTRIBUTES from the
containing directory. See the section.
"Algorithm to Check Access to an Existing File"
in MS-FSA.pdf.

diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index f97a3ec5e581550a48b71bccb3c06f2212becd70..d10b6978be6058be9474c88d90d4a4314e160825 100644 (file)
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -1423,7 +1423,14 @@ NTSTATUS smbd_calculate_access_mask(connection_struct *conn,
                                }
                        }
 
-                       access_mask = access_granted;
+                       /*
+                        * If we can access the path to this file, by
+                        * default we have FILE_READ_ATTRIBUTES from the
+                        * containing directory. See the section.
+                        * "Algorithm to Check Access to an Existing File"
+                        * in MS-FSA.pdf.
+                        */
+                       access_mask = access_granted | FILE_READ_ATTRIBUTES;
                } else {
                        access_mask = FILE_GENERIC_ALL;
                }