windows-unix-mode-bit-enforcement-20070105

modify the write-lock permission test so that the UnixMode bits do not
subtract PRSFS_WRITE from the rights when testing PRSFS_WRITE | PRSFS_LOCK.

PRSFS_WRITE implies PRSFS_LOCK so add it

Add new registry value "DeleteReadOnly" to permit deletion of read-only
files.  The default is 0.  Set to non-zero value to activate.

diff --git a/src/WINNT/afsd/afsd_init.c b/src/WINNT/afsd/afsd_init.c
index 1dc22c6d42812223bc9e6df75fe45f37d51c5f27..629915f1cadf747b706080ae831978894447a47d 100644 (file)
--- a/src/WINNT/afsd/afsd_init.c
+++ b/src/WINNT/afsd/afsd_init.c
@@ -39,6 +39,7 @@ extern int RXSTATS_ExecuteRequest(struct rx_call *z_call);
 
 extern afs_int32 cryptall;
 extern int cm_enableServerLocks;
+extern int cm_deleteReadOnly;
 
 osi_log_t *afsd_logp;
 
@@ -1067,6 +1068,15 @@ int afsd_InitCM(char **reasonP)
        afsi_log("EnableServerLocks: server requested");
        break;
     }
+
+    dummyLen = sizeof(DWORD);
+    code = RegQueryValueEx(parmKey, "DeleteReadOnly", NULL, NULL,
+                           (BYTE *) &dwValue, &dummyLen);
+    if (code == ERROR_SUCCESS) {
+        cm_deleteReadOnly = (unsigned short) dwValue;
+    } 
+    afsi_log("CM DeleteReadOnly is %u", cm_deleteReadOnly);
+    
     RegCloseKey (parmKey);
 
     /* Call lanahelper to get Netbios name, lan adapter number and gateway flag */

diff --git a/src/WINNT/afsd/cm_access.c b/src/WINNT/afsd/cm_access.c
index e1aeeba3659aaeb0d432765ac267d7fd0d8b6642..5b9d6bd88fdbd99ef5869e090e6426d1a591aaa0 100644 (file)
--- a/src/WINNT/afsd/cm_access.c
+++ b/src/WINNT/afsd/cm_access.c
@@ -20,6 +20,8 @@
 
 #include "afsd.h"
 
+int cm_deleteReadOnly = 0;
+
 /* called with scp write-locked, check to see if we have the ACL info we need
  * and can get it w/o blocking for any locks.
  *
@@ -89,8 +91,14 @@ int cm_HaveAccessRights(struct cm_scache *scp, struct cm_user *userp, afs_uint32
     /* check mode bits */
     if (!(scp->unixModeBits & 0400))
         *outRightsp &= ~PRSFS_READ;
-    if (!(scp->unixModeBits & 0200))
-        *outRightsp &= ~(PRSFS_WRITE|PRSFS_DELETE);
+    if (!(scp->unixModeBits & 0200) && !(rights == (PRSFS_WRITE | PRSFS_LOCK)))
+        *outRightsp &= ~PRSFS_WRITE;
+    if (!(scp->unixModeBits & 0200) && !cm_deleteReadOnly)
+        *outRightsp &= ~PRSFS_DELETE;
+
+    /* if the user can obtain a write-lock, read-locks are implied */
+    if (*outRightsp & PRSFS_WRITE)
+       *outRightsp |= PRSFS_LOCK;
 
     code = 1;
     /* fall through */

diff --git a/src/WINNT/afsd/cm_vnodeops.c b/src/WINNT/afsd/cm_vnodeops.c
index 97a4e0d18b2ac5d7ceb5c7f077cdcb406aac3496..d302fe593d21da93442e0fe06472478b2b215701 100644 (file)
--- a/src/WINNT/afsd/cm_vnodeops.c
+++ b/src/WINNT/afsd/cm_vnodeops.c
@@ -185,7 +185,8 @@ void cm_Gen8Dot3NameInt(const char * longname, cm_dirFid_t * pfid,
     int vnode = ntohl(pfid->vnode);
     char *lastDot;
     int validExtension = 0;
-    char tc, *temp, *name;
+    char tc, *temp;
+    const char *name;
 
     /* Unparse the file's vnode number to get a "uniquifier" */
     do {
@@ -256,8 +257,10 @@ long cm_CheckOpen(cm_scache_t *scp, int openMode, int trunc, cm_user_t *userp,
     long code;
 
     rights = 0;
-    if (openMode != 1) rights |= PRSFS_READ;
-    if (openMode == 1 || openMode == 2 || trunc) rights |= PRSFS_WRITE;
+    if (openMode != 1) 
+       rights |= PRSFS_READ;
+    if (openMode == 1 || openMode == 2 || trunc) 
+       rights |= PRSFS_WRITE;
         
     lock_ObtainMutex(&scp->mx);
 
@@ -3570,7 +3573,7 @@ long cm_LockCheckPerms(cm_scache_t * scp,
     if (lock_type == LockRead)
         rights |= PRSFS_LOCK;
     else if (lock_type == LockWrite)
-        rights |= PRSFS_WRITE;
+        rights |= PRSFS_WRITE | PRSFS_LOCK;
     else {
         /* hmmkay */
         osi_assert(FALSE);