Add SeSecurityPrivilige.

Jeremy.
(cherry picked from commit f11da60f3189bc70eb82259435e108f40b2bb333)

diff --git a/source3/include/privileges.h b/source3/include/privileges.h
index 57d3fc068628ec4948f5665e6932adabafb52fd0..926731001e64d86ff9aefb2872507b7a59e331bd 100644 (file)
--- a/source3/include/privileges.h
+++ b/source3/include/privileges.h
@@ -59,6 +59,7 @@ typedef struct {
 #define SE_BACKUP                      { { 0x00000200, 0x00000000, 0x00000000, 0x00000000 } }
 #define SE_RESTORE                     { { 0x00000400, 0x00000000, 0x00000000, 0x00000000 } }
 #define SE_TAKE_OWNERSHIP              { { 0x00000800, 0x00000000, 0x00000000, 0x00000000 } }
+#define SE_SECURITY                    { { 0x00001000, 0x00000000, 0x00000000, 0x00000000 } }
 
 /* defined in lib/privilegs_basic.c */
 
@@ -72,6 +73,7 @@ extern const SE_PRIV se_disk_operators;
 extern const SE_PRIV se_remote_shutdown;
 extern const SE_PRIV se_restore;
 extern const SE_PRIV se_take_ownership;
+extern const SE_PRIV se_security;
 
 
 /*

diff --git a/source3/lib/privileges_basic.c b/source3/lib/privileges_basic.c
index 323983b1683b90a72b5f4c8168350a9eb5b09ad4..8d031f21a223536f1c151c44d4cb8498f9ec6536 100644 (file)
--- a/source3/lib/privileges_basic.c
+++ b/source3/lib/privileges_basic.c
@@ -46,6 +46,7 @@ const SE_PRIV se_disk_operators  = SE_DISK_OPERATOR;
 const SE_PRIV se_remote_shutdown = SE_REMOTE_SHUTDOWN;
 const SE_PRIV se_restore         = SE_RESTORE;
 const SE_PRIV se_take_ownership  = SE_TAKE_OWNERSHIP;
+const SE_PRIV se_security       = SE_SECURITY;
 
 /********************************************************************
  This is a list of privileges reported by a WIndows 2000 SP4 AD DC
@@ -98,6 +99,7 @@ PRIVS privs[] = {
        {SE_SERVICE_LOGON,      "SeServiceLogonRight",          "Log on as a service",                     { 0x0, 0x0 }},
 #endif
        {SE_MACHINE_ACCOUNT,    "SeMachineAccountPrivilege",    "Add machines to domain",                  { 0x0, 0x0006 }},
+       {SE_SECURITY,           "SeSecurityPrivilege",          "Manage auditing and security log",        { 0x0, 0x0008 }},
        {SE_TAKE_OWNERSHIP,     "SeTakeOwnershipPrivilege",     "Take ownership of files or other objects",{ 0x0, 0x0009 }},
         {SE_BACKUP,             "SeBackupPrivilege",            "Back up files and directories",          { 0x0, 0x0011 }},
         {SE_RESTORE,            "SeRestorePrivilege",           "Restore files and directories",          { 0x0, 0x0012 }},
@@ -107,6 +109,7 @@ PRIVS privs[] = {
        {SE_ADD_USERS,          "SeAddUsersPrivilege",          "Add users and groups to the domain",      { 0x0, 0x1002 }},
        {SE_DISK_OPERATOR,      "SeDiskOperatorPrivilege",      "Manage disk shares",                      { 0x0, 0x1003 }},
 
+
        {SE_END, "", "", { 0x0, 0x0 }}
 };
 

diff --git a/source3/lib/util_seaccess.c b/source3/lib/util_seaccess.c
index 0da7442d1953748c3e594999748c5c2ce4aea198..369f6848a0832de7117cd962b784cfbc99c09e17 100644 (file)
--- a/source3/lib/util_seaccess.c
+++ b/source3/lib/util_seaccess.c
@@ -179,17 +179,13 @@ NTSTATUS se_access_check(const struct security_descriptor *sd,
                        bits_remaining));
        }
 
-#if 0
-       /* We need to support SeSecurityPrivilege for this. */
-
        if (access_desired & SEC_FLAG_SYSTEM_SECURITY) {
-               if (user_has_privileges(token, &sec_security)) {
+               if (user_has_privileges(token, &se_security)) {
                        bits_remaining &= ~SEC_FLAG_SYSTEM_SECURITY;
                } else {
                        return NT_STATUS_PRIVILEGE_NOT_HELD;
                }
        }
-#endif
 
        /* a NULL dacl allows access */
        if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl == NULL) {

diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index d311cc32684b20149f0e90c45dc6bf7994dd9de3..3ff192bae336a8c08f0b6dc51fb68e9a2d41324d 100644 (file)
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -1837,6 +1837,18 @@ static void call_nt_transact_query_security_desc(connection_struct *conn,
         * Get the permissions to return.
         */
 
+       if ((security_info_wanted & SECINFO_SACL) &&
+                       !(fsp->access_mask & SEC_FLAG_SYSTEM_SECURITY)) {
+               reply_nterror(req,  NT_STATUS_ACCESS_DENIED);
+               return;
+       }
+
+       if ((security_info_wanted & (SECINFO_DACL|SECINFO_OWNER|SECINFO_GROUP)) &&
+                       !(fsp->access_mask & SEC_STD_READ_CONTROL)) {
+               reply_nterror(req, NT_STATUS_ACCESS_DENIED);
+               return;
+       }
+
        if (!lp_nt_acl_support(SNUM(conn))) {
                status = get_null_nt_acl(talloc_tos(), &psd);
        } else {

diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index 4b36f542917484ed2bbfc76179c3ca15c0bc9591..b85b0f732a0c811b1f8b2be70de92a272537ed34 100644 (file)
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -22,6 +22,7 @@
 #include "includes.h"
 #include "smbd/globals.h"
 
+extern struct current_user current_user;
 extern const struct generic_mapping file_generic_mapping;
 
 struct deferred_open_record {
@@ -2476,8 +2477,8 @@ static NTSTATUS open_directory(connection_struct *conn,
                return status;
        }
 
-       /* We need to support SeSecurityPrivilege for this. */
-       if (access_mask & SEC_FLAG_SYSTEM_SECURITY) {
+       if ((access_mask & SEC_FLAG_SYSTEM_SECURITY) &&
+                       !user_has_privileges(current_user.nt_user_token, &se_security)) {
                DEBUG(10, ("open_directory: open on %s "
                        "failed - SEC_FLAG_SYSTEM_SECURITY denied.\n",
                        smb_fname_str_dbg(smb_dname)));
@@ -2986,29 +2987,14 @@ static NTSTATUS create_file_unixpath(connection_struct *conn,
                goto fail;
        }
 
-#if 0
-       /* We need to support SeSecurityPrivilege for this. */
        if ((access_mask & SEC_FLAG_SYSTEM_SECURITY) &&
-           !user_has_privileges(current_user.nt_user_token,
-                                &se_security)) {
-               status = NT_STATUS_PRIVILEGE_NOT_HELD;
-               goto fail;
-       }
-#else
-       /* We need to support SeSecurityPrivilege for this. */
-       if (access_mask & SEC_FLAG_SYSTEM_SECURITY) {
-               status = NT_STATUS_PRIVILEGE_NOT_HELD;
-               goto fail;
-       }
-       /* Don't allow a SACL set from an NTtrans create until we
-        * support SeSecurityPrivilege. */
-       if (!VALID_STAT(smb_fname->st) &&
-                       lp_nt_acl_support(SNUM(conn)) &&
-                       sd && (sd->sacl != NULL)) {
+                       !user_has_privileges(current_user.nt_user_token, &se_security)) {
+               DEBUG(10, ("create_file_unixpath:: open on %s "
+                       "failed - SEC_FLAG_SYSTEM_SECURITY denied.\n",
+                       smb_fname_str_dbg(smb_fname)));
                status = NT_STATUS_PRIVILEGE_NOT_HELD;
                goto fail;
        }
-#endif
 
        if ((conn->fs_capabilities & FILE_NAMED_STREAMS)
            && is_ntfs_stream_smb_fname(smb_fname)