From: Jeremy Allison <jra@samba.org>
Date: Fri, 25 Jan 2013 18:21:48 +0000 (-0800)
Subject: Fix bug #9588 - ACLs are not inherited to directories for DFS shares.
X-Git-Url: http://git.samba.org/?p=metze%2Fsamba%2Fwip.git;a=commitdiff_plain;h=34854ae58fb0fdeec7f27d1d6264b2035778ea6b

Fix bug #9588 - ACLs are not inherited to directories for DFS shares.

We can return with NT_STATUS_OK in an error code path. This
has a really strange effect in that it prevents the ACL editor
in Windows XP from recursively changing ACE entries on sub-directories
after a change in a DFS-root share (we end up returning a path
that looks like: \\IPV4\share1\xptest/testdir with a mixture
of Windows and POSIX pathname separators).

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Mon Jan 28 13:48:13 CET 2013 on sn-devel-104
---

diff --git a/source3/smbd/msdfs.c b/source3/smbd/msdfs.c
index 4bf7aba34ae5..5388db9147f3 100644
--- a/source3/smbd/msdfs.c
+++ b/source3/smbd/msdfs.c
@@ -1031,6 +1031,19 @@ NTSTATUS get_referred_path(TALLOC_CTX *ctx,
 	if (!NT_STATUS_EQUAL(status, NT_STATUS_PATH_NOT_COVERED)) {
 		DEBUG(3,("get_referred_path: No valid referrals for path %s\n",
 			dfs_path));
+		if (NT_STATUS_IS_OK(status)) {
+			/*
+			 * We are in an error path here (we
+			 * know it's not a DFS path), but
+			 * dfs_path_lookup() can return
+			 * NT_STATUS_OK. Ensure we always
+			 * return a valid error code.
+			 *
+			 * #9588 - ACLs are not inherited to directories
+			 *         for DFS shares.
+			 */
+			status = NT_STATUS_NOT_FOUND;
+		}
 		goto err_exit;
 	}