From 5b0ca2e4ebdd7f86c52926700099e3654f826ccc Mon Sep 17 00:00:00 2001 From: Andrew Deason Date: Sat, 3 Nov 2018 01:04:43 -0500 Subject: [PATCH] ptserver: Check for -restricted in SPR_Delete Currently, all prdb write operations, except for SPR_Delete, will fail with PRPERM if called by a non-system:administrators caller while restricted mode is active. SPR_Delete is missing this check, and so is not affected by the -restricted option. Fix this by inserting the same check for -restricted as all other code paths that check for -restricted. Reviewed-on: https://gerrit.openafs.org/13374 Reviewed-by: Benjamin Kaduk Tested-by: BuildBot (cherry picked from commit 2e556c0f23ae439c804352cf51fcf30878b03c7a) Change-Id: I9a31cf4e6490aa13dc0c239d2660fc146553ee75 Reviewed-on: https://gerrit.openafs.org/13688 Reviewed-by: Michael Meffie Reviewed-by: Andrew Deason Tested-by: Andrew Deason Reviewed-by: Benjamin Kaduk Reviewed-by: Stephan Wiesand --- src/ptserver/ptprocs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/ptserver/ptprocs.c b/src/ptserver/ptprocs.c index 4ce1cbf92..a3ad9c582 100644 --- a/src/ptserver/ptprocs.c +++ b/src/ptserver/ptprocs.c @@ -739,6 +739,10 @@ Delete(struct rx_call *call, afs_int32 aid, afs_int32 *cid) && !IsAMemberOf(tt, *cid, tentry.owner) && !pr_noAuth) ABORT_WITH(tt, PRPERM); + if (restricted && !IsAMemberOf(tt, *cid, SYSADMINID)) { + ABORT_WITH(tt, PRPERM); + } + /* Delete each continuation block as a separate transaction so that no one * transaction become to large to complete. */ nptr = tentry.next; -- 2.39.5