1From 8e49de7754f7171a58a1f94dee0f1138dbee3c60 Mon Sep 17 00:00:00 2001
2From: Jeremy Allison <jra@samba.org>
3Date: Fri, 23 Oct 2015 14:54:31 -0700
4Subject: [PATCH] CVE-2015-5299: s3-shadow-copy2: fix missing access check on
5 snapdir
6
7Fix originally from <partha@exablox.com>
8
9https://bugzilla.samba.org/show_bug.cgi?id=11529
10
11Signed-off-by: Jeremy Allison <jra@samba.org>
12Reviewed-by: David Disseldorp <ddiss@samba.org>
13---
14 source3/modules/vfs_shadow_copy2.c | 47 ++++++++++++++++++++++++++++++++++++++
15 1 file changed, 47 insertions(+)
16
17--- a/source3/modules/vfs_shadow_copy2.c
18+++ b/source3/modules/vfs_shadow_copy2.c
19@@ -21,6 +21,8 @@
20 
21 #include "includes.h"
22 #include "smbd/smbd.h"
23+#include "smbd/globals.h"
24+#include "../libcli/security/security.h"
25 #include "system/filesys.h"
26 #include "ntioctl.h"
27 
28@@ -764,6 +766,43 @@ static int shadow_copy2_mkdir(vfs_handle
29         SHADOW2_NEXT(MKDIR, (handle, name, mode), int, -1);
30 }
31 
32+static bool check_access_snapdir(struct vfs_handle_struct *handle,
33+				const char *path)
34+{
35+	struct smb_filename smb_fname;
36+	int ret;
37+	NTSTATUS status;
38+	uint32_t access_granted = 0;
39+
40+	ZERO_STRUCT(smb_fname);
41+	smb_fname.base_name = talloc_asprintf(talloc_tos(),
42+						"%s",
43+						path);
44+	if (smb_fname.base_name == NULL) {
45+		return false;
46+	}
47+
48+	ret = SMB_VFS_NEXT_STAT(handle, &smb_fname);
49+	if (ret != 0 || !S_ISDIR(smb_fname.st.st_ex_mode)) {
50+		TALLOC_FREE(smb_fname.base_name);
51+		return false;
52+	}
53+
54+	status = smbd_check_open_rights(handle->conn,
55+					&smb_fname,
56+					SEC_DIR_LIST,
57+					&access_granted);
58+	if (!NT_STATUS_IS_OK(status)) {
59+		DEBUG(0,("user does not have list permission "
60+			"on snapdir %s\n",
61+			smb_fname.base_name));
62+		TALLOC_FREE(smb_fname.base_name);
63+		return false;
64+	}
65+	TALLOC_FREE(smb_fname.base_name);
66+	return true;
67+}
68+
69 static int shadow_copy2_rmdir(vfs_handle_struct *handle,  const char *fname)
70 {
71         SHADOW2_NEXT(RMDIR, (handle, name), int, -1);
72@@ -877,6 +916,7 @@ static int shadow_copy2_get_shadow_copy2
73 	SMB_STRUCT_DIRENT *d;
74 	TALLOC_CTX *tmp_ctx = talloc_new(handle->data);
75 	char *snapshot;
76+	bool ret;
77 
78 	snapdir = shadow_copy2_find_snapdir(tmp_ctx, handle);
79 	if (snapdir == NULL) {
80@@ -886,6 +926,13 @@ static int shadow_copy2_get_shadow_copy2
81 		talloc_free(tmp_ctx);
82 		return -1;
83 	}
84+	ret = check_access_snapdir(handle, snapdir);
85+	if (!ret) {
86+		DEBUG(0,("access denied on listing snapdir %s\n", snapdir));
87+		errno = EACCES;
88+		talloc_free(tmp_ctx);
89+		return -1;
90+	}
91 
92 	p = SMB_VFS_NEXT_OPENDIR(handle, snapdir, NULL, 0);
93 
94