|
 |
6c52e2 |
From 9588c4950c9b3dd6c16b899156e6d985c7b43187 Mon Sep 17 00:00:00 2001
|
|
|
6c52e2 |
From: Jeremy Allison <jra@samba.org>
|
|
|
6c52e2 |
Date: Fri, 23 Oct 2015 14:54:31 -0700
|
|
|
6c52e2 |
Subject: [PATCH] CVE-2015-5299: s3-shadow-copy2: fix missing access check on
|
|
|
6c52e2 |
snapdir
|
|
|
6c52e2 |
|
|
|
6c52e2 |
Fix originally from <partha@exablox.com>
|
|
|
6c52e2 |
|
|
|
6c52e2 |
https://bugzilla.samba.org/show_bug.cgi?id=11529
|
|
|
6c52e2 |
|
|
|
6c52e2 |
Signed-off-by: Jeremy Allison <jra@samba.org>
|
|
|
6c52e2 |
Reviewed-by: David Disseldorp <ddiss@samba.org>
|
|
|
6c52e2 |
---
|
|
|
6c52e2 |
source3/modules/vfs_shadow_copy2.c | 45 ++++++++++++++++++++++++++++++++++++++
|
|
|
6c52e2 |
1 file changed, 45 insertions(+)
|
|
|
6c52e2 |
|
|
|
6c52e2 |
diff --git a/source3/modules/vfs_shadow_copy2.c b/source3/modules/vfs_shadow_copy2.c
|
|
|
6c52e2 |
index 439df5d..c5c2015 100644
|
|
|
6c52e2 |
--- a/source3/modules/vfs_shadow_copy2.c
|
|
|
6c52e2 |
+++ b/source3/modules/vfs_shadow_copy2.c
|
|
|
6c52e2 |
@@ -30,6 +30,7 @@
|
|
|
6c52e2 |
*/
|
|
|
6c52e2 |
|
|
|
6c52e2 |
#include "includes.h"
|
|
|
6c52e2 |
+#include "smbd/smbd.h"
|
|
|
6c52e2 |
#include "system/filesys.h"
|
|
|
6c52e2 |
#include "include/ntioctl.h"
|
|
|
6c52e2 |
#include <ccan/hash/hash.h>
|
|
|
6c52e2 |
@@ -1179,6 +1180,42 @@ static char *have_snapdir(struct vfs_handle_struct *handle,
|
|
|
6c52e2 |
return NULL;
|
|
|
6c52e2 |
}
|
|
|
6c52e2 |
|
|
|
6c52e2 |
+static bool check_access_snapdir(struct vfs_handle_struct *handle,
|
|
|
6c52e2 |
+ const char *path)
|
|
|
6c52e2 |
+{
|
|
|
6c52e2 |
+ struct smb_filename smb_fname;
|
|
|
6c52e2 |
+ int ret;
|
|
|
6c52e2 |
+ NTSTATUS status;
|
|
|
6c52e2 |
+
|
|
|
6c52e2 |
+ ZERO_STRUCT(smb_fname);
|
|
|
6c52e2 |
+ smb_fname.base_name = talloc_asprintf(talloc_tos(),
|
|
|
6c52e2 |
+ "%s",
|
|
|
6c52e2 |
+ path);
|
|
|
6c52e2 |
+ if (smb_fname.base_name == NULL) {
|
|
|
6c52e2 |
+ return false;
|
|
|
6c52e2 |
+ }
|
|
|
6c52e2 |
+
|
|
|
6c52e2 |
+ ret = SMB_VFS_NEXT_STAT(handle, &smb_fname);
|
|
|
6c52e2 |
+ if (ret != 0 || !S_ISDIR(smb_fname.st.st_ex_mode)) {
|
|
|
6c52e2 |
+ TALLOC_FREE(smb_fname.base_name);
|
|
|
6c52e2 |
+ return false;
|
|
|
6c52e2 |
+ }
|
|
|
6c52e2 |
+
|
|
|
6c52e2 |
+ status = smbd_check_access_rights(handle->conn,
|
|
|
6c52e2 |
+ &smb_fname,
|
|
|
6c52e2 |
+ false,
|
|
|
6c52e2 |
+ SEC_DIR_LIST);
|
|
|
6c52e2 |
+ if (!NT_STATUS_IS_OK(status)) {
|
|
|
6c52e2 |
+ DEBUG(0,("user does not have list permission "
|
|
|
6c52e2 |
+ "on snapdir %s\n",
|
|
|
6c52e2 |
+ smb_fname.base_name));
|
|
|
6c52e2 |
+ TALLOC_FREE(smb_fname.base_name);
|
|
|
6c52e2 |
+ return false;
|
|
|
6c52e2 |
+ }
|
|
|
6c52e2 |
+ TALLOC_FREE(smb_fname.base_name);
|
|
|
6c52e2 |
+ return true;
|
|
|
6c52e2 |
+}
|
|
|
6c52e2 |
+
|
|
|
6c52e2 |
/**
|
|
|
6c52e2 |
* Find the snapshot directory (if any) for the given
|
|
|
6c52e2 |
* filename (which is relative to the share).
|
|
|
6c52e2 |
@@ -1328,6 +1365,7 @@ static int shadow_copy2_get_shadow_copy_data(
|
|
|
6c52e2 |
const char *snapdir;
|
|
|
6c52e2 |
struct dirent *d;
|
|
|
6c52e2 |
TALLOC_CTX *tmp_ctx = talloc_stackframe();
|
|
|
6c52e2 |
+ bool ret;
|
|
|
6c52e2 |
|
|
|
6c52e2 |
snapdir = shadow_copy2_find_snapdir(tmp_ctx, handle, fsp->fsp_name);
|
|
|
6c52e2 |
if (snapdir == NULL) {
|
|
|
6c52e2 |
@@ -1337,6 +1375,13 @@ static int shadow_copy2_get_shadow_copy_data(
|
|
|
6c52e2 |
talloc_free(tmp_ctx);
|
|
|
6c52e2 |
return -1;
|
|
|
6c52e2 |
}
|
|
|
6c52e2 |
+ ret = check_access_snapdir(handle, snapdir);
|
|
|
6c52e2 |
+ if (!ret) {
|
|
|
6c52e2 |
+ DEBUG(0,("access denied on listing snapdir %s\n", snapdir));
|
|
|
6c52e2 |
+ errno = EACCES;
|
|
|
6c52e2 |
+ talloc_free(tmp_ctx);
|
|
|
6c52e2 |
+ return -1;
|
|
|
6c52e2 |
+ }
|
|
|
6c52e2 |
|
|
|
6c52e2 |
p = SMB_VFS_NEXT_OPENDIR(handle, snapdir, NULL, 0);
|
|
|
6c52e2 |
|
|
|
6c52e2 |
--
|
|
|
6c52e2 |
2.5.0
|
|
|
6c52e2 |
|