-
Notifications
You must be signed in to change notification settings - Fork 73
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
d944067
commit 7c4810f
Showing
2 changed files
with
116 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,108 @@ | ||
From 9090229e6789f8ba3c24047134c47c7964b1d73b Mon Sep 17 00:00:00 2001 | ||
From: Jinoh Kang <[email protected]> | ||
Date: Tue, 19 Jul 2022 23:58:21 +0900 | ||
Subject: [PATCH 5/5] server: Use the token owner instead of the token user for | ||
default object owner. | ||
|
||
Also, replace the token user with the token owner for the default DACL | ||
as well. Wine currently selects domain_users_sid as the token owner, so | ||
use that. This is required to pass the advapi32:security test which | ||
expects the security descriptor owner SID to be referenced in the DACL | ||
as well. | ||
--- | ||
server/change.c | 2 +- | ||
server/file.c | 4 ++-- | ||
server/object.c | 2 +- | ||
server/security.h | 2 +- | ||
server/token.c | 6 +++--- | ||
5 files changed, 8 insertions(+), 8 deletions(-) | ||
|
||
diff --git a/server/change.c b/server/change.c | ||
index 6477b457f74..7a806abc017 100644 | ||
--- a/server/change.c | ||
+++ b/server/change.c | ||
@@ -391,7 +391,7 @@ static int dir_set_sd( struct object *obj, const struct security_descriptor *sd, | ||
else if (obj->sd) | ||
owner = sd_get_owner( obj->sd ); | ||
else | ||
- owner = token_get_user( current->process->token ); | ||
+ owner = token_get_owner( current->process->token ); | ||
|
||
if (set_info & DACL_SECURITY_INFORMATION) | ||
{ | ||
diff --git a/server/file.c b/server/file.c | ||
index eb2dc5696ed..76c687833c9 100644 | ||
--- a/server/file.c | ||
+++ b/server/file.c | ||
@@ -245,7 +245,7 @@ static struct object *create_file( struct fd *root, const char *nameptr, data_si | ||
{ | ||
const struct sid *owner = sd_get_owner( sd ); | ||
if (!owner) | ||
- owner = token_get_user( current->process->token ); | ||
+ owner = token_get_owner( current->process->token ); | ||
mode = sd_to_mode( sd, owner ); | ||
} | ||
else if (options & FILE_DIRECTORY_FILE) | ||
@@ -528,7 +528,7 @@ static int file_set_sd( struct object *obj, const struct security_descriptor *sd | ||
else if (obj->sd) | ||
owner = sd_get_owner( obj->sd ); | ||
else | ||
- owner = token_get_user( current->process->token ); | ||
+ owner = token_get_owner( current->process->token ); | ||
|
||
/* group and sacl not supported */ | ||
|
||
diff --git a/server/object.c b/server/object.c | ||
index 333f9e7b5d6..89e541ffb6b 100644 | ||
--- a/server/object.c | ||
+++ b/server/object.c | ||
@@ -574,7 +574,7 @@ int set_sd_defaults_from_token( struct object *obj, const struct security_descri | ||
} | ||
else if (token) | ||
{ | ||
- owner = token_get_user( token ); | ||
+ owner = token_get_owner( token ); | ||
new_sd.owner_len = sid_len( owner ); | ||
} | ||
else new_sd.owner_len = 0; | ||
diff --git a/server/security.h b/server/security.h | ||
index fa91b81b77c..58ab1594eae 100644 | ||
--- a/server/security.h | ||
+++ b/server/security.h | ||
@@ -73,7 +73,7 @@ extern int token_check_privileges( struct token *token, int all_required, | ||
const struct luid_attr *reqprivs, | ||
unsigned int count, struct luid_attr *usedprivs ); | ||
extern const struct acl *token_get_default_dacl( struct token *token ); | ||
-extern const struct sid *token_get_user( struct token *token ); | ||
+extern const struct sid *token_get_owner( struct token *token ); | ||
extern const struct sid *token_get_primary_group( struct token *token ); | ||
extern unsigned int token_get_session_id( struct token *token ); | ||
extern int token_sid_present( struct token *token, const struct sid *sid, int deny ); | ||
diff --git a/server/token.c b/server/token.c | ||
index f817c1114f8..99f5e36e279 100644 | ||
--- a/server/token.c | ||
+++ b/server/token.c | ||
@@ -732,7 +732,7 @@ struct token *token_create_admin( unsigned primary, int impersonation_level, int | ||
/* on Windows, this value changes every time the user logs on */ | ||
struct sid logon_sid = { SID_REVISION, 3, SECURITY_NT_AUTHORITY, { SECURITY_LOGON_IDS_RID, 0, 0 /* FIXME: should be randomly generated when tokens are inherited by new processes */ }}; | ||
const struct sid *user_sid = security_unix_uid_to_sid( getuid() ); | ||
- struct acl *default_dacl = create_default_dacl( user_sid ); | ||
+ struct acl *default_dacl = create_default_dacl( &domain_users_sid ); | ||
const struct luid_attr admin_privs[] = | ||
{ | ||
{ SeChangeNotifyPrivilege, SE_PRIVILEGE_ENABLED }, | ||
@@ -1044,9 +1044,9 @@ const struct acl *token_get_default_dacl( struct token *token ) | ||
return token->default_dacl; | ||
} | ||
|
||
-const struct sid *token_get_user( struct token *token ) | ||
+const struct sid *token_get_owner( struct token *token ) | ||
{ | ||
- return token->user; | ||
+ return token->owner; | ||
} | ||
|
||
const struct sid *token_get_primary_group( struct token *token ) | ||
-- | ||
GitLab | ||
|