From: samba-bugs@samba.org
To: cifs-qa@samba.org
Subject: [Bug 14507] New: cifs ACL exec permission granted where it should be denied
Date: Mon, 21 Sep 2020 10:42:34 +0000 [thread overview]
Message-ID: <bug-14507-10630@https.bugzilla.samba.org/> (raw)
https://bugzilla.samba.org/show_bug.cgi?id=14507
Bug ID: 14507
Summary: cifs ACL exec permission granted where it should be
denied
Product: CifsVFS
Version: 5.x
Hardware: All
OS: All
Status: NEW
Severity: major
Priority: P5
Component: kernel fs
Assignee: sfrench@samba.org
Reporter: bjacke@samba.org
QA Contact: cifs-qa@samba.org
Target Milestone: ---
if the owner of a file has exec permission, then cifs vfs seems to generally
grants exec permission on files where ACL does not actually grant exec
permission.
Example:
bjacke@cifstest1:/mnt3/a$ getcifsacl test.txt
REVISION:0x1
CONTROL:0x8c04
OWNER:S-1-5-21-4207148185-4040488370-1588356217-500
GROUP:S-1-5-21-4207148185-4040488370-1588356217-513
ACL:S-1-5-21-4207148185-4040488370-1588356217-500:ALLOWED/I/FULL
ACL:S-1-5-21-4207148185-4040488370-1588356217-513:ALLOWED/I/R
ACL:BUILTIN\Users:ALLOWED/I/R
I'm connected with a user who is just in the Users group and I *can* execute
the test.txt file. This should not be allowed. Only Administrator
(S-1-5-21-4207148185-4040488370-1588356217-500) has execute permission
according to the ACL.
--
You are receiving this mail because:
You are the QA Contact for the bug.
reply other threads:[~2020-09-21 10:42 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-14507-10630@https.bugzilla.samba.org/ \
--to=samba-bugs@samba.org \
--cc=cifs-qa@samba.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.