libs/newlib-cygwin
libs
/
newlib-cygwin
mirror of git://sourceware.org/git/newlib-cygwin.git
4
0
Fork 0
Code Issues Projects Releases Wiki Activity

Cygwin: ACLs: ignore *_INHERIT flags in file ACLs 

get_posix_access() creates DEF_*_OBJ aclent_t entries from Windows ACEs
with INHERIT flags set, independent of the file type.  These flags only
make sense on directory objects, but certain Windows functions don't
check the file type and allow INHERIT ACE flags even on non-directories.

As a fix, make sure to ignore the INHERIT flags on non-directory ACLs
and don't propagate the matching DEF_*_OBJ aclent_t entries to callers.

Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
This commit is contained in:
Corinna Vinschen 2022-01-11 22:20:47 +01:00
parent 987689a3ba
commit 2537b3134b
2 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
winsup/cygwin/release/3.3.4
View File

@ -17,3 +17,6 @@ Bug Fixes
- Avoid a crash when NtQueryInformationProcess returns invalid handle data. - Avoid a crash when NtQueryInformationProcess returns invalid handle data.
Addresses: https://cygwin.com/pipermail/cygwin-patches/2021q4/011611.html Addresses: https://cygwin.com/pipermail/cygwin-patches/2021q4/011611.html
- Ignore INHERIT ACEs when reading the DACL of non-directory files.
Addresses: https://cygwin.com/pipermail/cygwin/2022-January/250363.html

9
winsup/cygwin/sec_acl.cc
View File

@ -811,7 +811,8 @@ get_posix_access (PSECURITY_DESCRIPTOR psd,
class_perm = lacl[pos].a_perm; class_perm = lacl[pos].a_perm;
} }
} }
if (ace->Header.AceFlags & SUB_CONTAINERS_AND_OBJECTS_INHERIT) if (S_ISDIR (attr)
&& (ace->Header.AceFlags & SUB_CONTAINERS_AND_OBJECTS_INHERIT) != 0)
{ {
if ((pos = searchace (lacl, MAX_ACL_ENTRIES, if ((pos = searchace (lacl, MAX_ACL_ENTRIES,
DEF_CLASS_OBJ)) >= 0) DEF_CLASS_OBJ)) >= 0)
@ -952,7 +953,8 @@ get_posix_access (PSECURITY_DESCRIPTOR psd,
standard_ACEs_only = false; standard_ACEs_only = false;
} }
} }
if ((ace->Header.AceFlags & SUB_CONTAINERS_AND_OBJECTS_INHERIT)) if (S_ISDIR (attr)
&& (ace->Header.AceFlags & SUB_CONTAINERS_AND_OBJECTS_INHERIT) != 0)
{ {
if (type == USER_OBJ) if (type == USER_OBJ)
{ {
@ -1197,10 +1199,11 @@ int
getacl (HANDLE handle, path_conv &pc, int nentries, aclent_t *aclbufp) getacl (HANDLE handle, path_conv &pc, int nentries, aclent_t *aclbufp)
{ {
security_descriptor sd; security_descriptor sd;
mode_t attr = pc.isdir () ? S_IFDIR : 0;
if (get_file_sd (handle, pc, sd, false)) if (get_file_sd (handle, pc, sd, false))
return -1; return -1;
int pos = get_posix_access (sd, NULL, NULL, NULL, aclbufp, nentries); int pos = get_posix_access (sd, &attr, NULL, NULL, aclbufp, nentries);
syscall_printf ("%R = getacl(%S)", pos, pc.get_nt_native_path ()); syscall_printf ("%R = getacl(%S)", pos, pc.get_nt_native_path ());
return pos; return pos;
} }