Re: Permission denied when chainbuilding packages with mock

[Jeremy Allison <jra@samba.org>]

On Sun, Nov 07, 2021 at 01:49:47PM -0800, Jeremy Allison wrote:
>>behavior. From 'man 2 fsync':
>>
>>NOTES
>>      On some UNIX systems (but not Linux), fd must be a writable file descriptor.
>
>If this is actually what is happening, Samba is implementing the
>Windows semantics, and not the Linux ones (as we should). From
>the Microsoft MS-SMB2 spec:
>
>https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/026984f6-38af-4408-8200-50557eb0a286
>
>--------------------------------------------------------------------------
>3.3.5.11 Receiving an SMB2 FLUSH Request
>10/04/2021
>
>When the server receives a request with an SMB2 header with a Command value
>equal to SMB2 FLUSH, message handling proceeds as follows:
>
>The server MUST locate the session, as specified in section 3.3.5.2.9.
>
>The server MUST locate the tree connection, as specified in section 3.3.5.2.11.
>
>Next the server MUST locate the open being flushed by performing
>a lookup in the Session.OpenTable, using the FileId.Volatile of the
>request as the lookup key. If no open is found, or if Open.DurableFileId
>is not equal to FileId.Persistent, the server MUST fail the request
>with STATUS_FILE_CLOSED. Otherwise, the server MUST locate the Request
>in Connection.RequestList for which Request.MessageId matches
>the MessageId value in the SMB2 header, and set Request.Open to the Open.
>
>If the Open is on a file and Open.GrantedAccess includes neither
>FILE_WRITE_DATA nor FILE_APPEND_DATA, the server MUST fail the
>request with STATUS_ACCESS_DENIED.
>
>If the Open is on a directory and Open.GrantedAccess includes
>neither FILE_ADD_FILE nor FILE_ADD_SUBDIRECTORY, the server MUST
>fail the request with STATUS_ACCESS_DENIED.
>--------------------------------------------------------------------------

Steve,

I just took a look inside cifsfs and it looks like the smb2_flush()
function is being called on a file descriptor without a check that
the fd is open for writing as far as I can tell. Am I missing such
a check ? Can you investigate to see if this is the case ? This would
also fail against a Windows server too I think.

Jeremy.