More paranoia to ensure SD's can't be set on read-only shares.

Jeremy.

diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index 1e4e06cf26025a743144f9157bdb764c5d81c77a..b602a5161119ea4e5f0571bfc2727009822562d0 100644 (file)
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -836,6 +836,10 @@ NTSTATUS set_sd(files_struct *fsp, uint8_t *data, uint32_t sd_len,
        struct security_descriptor *psd = NULL;
        NTSTATUS status;
 
+       if (!CAN_WRITE(fsp->conn)) {
+               return NT_STATUS_ACCESS_DENIED;
+       }
+
        if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
                return NT_STATUS_OK;
        }