From: Andrew Deason <adeason@sinenomine.net>
Date: Sat, 3 Nov 2018 05:58:58 +0000 (-0500)
Subject: ptserver: Fix AccessOK -restricted for SYSADMINID
X-Git-Tag: debian/1.8.4_pre1-1~9^2^2~7
X-Git-Url: https://git.michaelhowe.org/gitweb/?a=commitdiff_plain;h=d47904684afb8402b692c9f7a4bb5f32cc3da5d7;p=packages%2Fo%2Fopenafs.git

ptserver: Fix AccessOK -restricted for SYSADMINID

According to the documentation, as well as other code paths that check
for -restricted, the -restricted option does not affect members of
system:administrators. Currently, though, AccessOK only bypasses the
-restricted check if the caller is SYSADMINID itself (i.e. localauth).

Fix AccessOK to only do the -restricted checks if the caller is not in
system:administrators, to match the documentation as well as other
ptserver operations.

Reviewed-on: https://gerrit.openafs.org/13373
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
(cherry picked from commit 3a8fa4ecd65d5d743fdc573c9f0f261aee2063b6)

Change-Id: I786830efab229a50a521daf3efc624e949475030
Reviewed-on: https://gerrit.openafs.org/13687
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Andrew Deason <adeason@sinenomine.net>
Tested-by: Andrew Deason <adeason@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Reviewed-by: Stephan Wiesand <stephan.wiesand@desy.de>
---

diff --git a/src/ptserver/ptutils.c b/src/ptserver/ptutils.c
index 7ea7202dc..c551c62b9 100644
--- a/src/ptserver/ptutils.c
+++ b/src/ptserver/ptutils.c
@@ -286,7 +286,7 @@ AccessOK(struct ubik_trans *ut, afs_int32 cid,		/* caller id */
 	return 1;
     if (cid == SYSADMINID)
 	return 1;		/* special case fileserver */
-    if (restricted) {
+    if (restricted && !IsAMemberOf(ut, cid, SYSADMINID)) {
         if (mem == PRP_ADD_MEM || mem == PRP_REMOVE_MEM) {
             /* operation is for adding/removing members from a group */
             return 0;