fss: permit FSRVP ops where the caller started smbd

FSRVP operations should be permitted If the requestors security token
matches the initial process uid. This adds the ability for the selftest
user to issue FSRVP requests.

diff --git a/source3/rpc_server/fss/srv_fss_agent.c b/source3/rpc_server/fss/srv_fss_agent.c
index 8cdf74b25365d6886077d17be63cd8f591b5918b..c2f9486b9923e417c2457d8f722c8fd6af86f432 100644 (file)
--- a/source3/rpc_server/fss/srv_fss_agent.c
+++ b/source3/rpc_server/fss/srv_fss_agent.c
@@ -280,6 +280,11 @@ NTSTATUS srv_fssa_start(void)
  */
 static bool fss_permitted(struct pipes_struct *p)
 {
+       if (p->session_info->unix_token->uid == sec_initial_uid()) {
+               DEBUG(6, ("Granting FSRVP op, user started smbd\n"));
+               return true;
+       }
+
        if (nt_token_check_sid(&global_sid_Builtin_Administrators,
                               p->session_info->security_token)) {
                DEBUG(6, ("Granting FSRVP op, administrators group member\n"));