From d47904684afb8402b692c9f7a4bb5f32cc3da5d7 Mon Sep 17 00:00:00 2001 From: Andrew Deason Date: Sat, 3 Nov 2018 00:58:58 -0500 Subject: [PATCH] ptserver: Fix AccessOK -restricted for SYSADMINID According to the documentation, as well as other code paths that check for -restricted, the -restricted option does not affect members of system:administrators. Currently, though, AccessOK only bypasses the -restricted check if the caller is SYSADMINID itself (i.e. localauth). Fix AccessOK to only do the -restricted checks if the caller is not in system:administrators, to match the documentation as well as other ptserver operations. Reviewed-on: https://gerrit.openafs.org/13373 Tested-by: BuildBot Reviewed-by: Mark Vitale Reviewed-by: Benjamin Kaduk (cherry picked from commit 3a8fa4ecd65d5d743fdc573c9f0f261aee2063b6) Change-Id: I786830efab229a50a521daf3efc624e949475030 Reviewed-on: https://gerrit.openafs.org/13687 Reviewed-by: Michael Meffie Reviewed-by: Andrew Deason Tested-by: Andrew Deason Reviewed-by: Benjamin Kaduk Reviewed-by: Stephan Wiesand --- src/ptserver/ptutils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ptserver/ptutils.c b/src/ptserver/ptutils.c index 7ea7202dc..c551c62b9 100644 --- a/src/ptserver/ptutils.c +++ b/src/ptserver/ptutils.c @@ -286,7 +286,7 @@ AccessOK(struct ubik_trans *ut, afs_int32 cid, /* caller id */ return 1; if (cid == SYSADMINID) return 1; /* special case fileserver */ - if (restricted) { + if (restricted && !IsAMemberOf(ut, cid, SYSADMINID)) { if (mem == PRP_ADD_MEM || mem == PRP_REMOVE_MEM) { /* operation is for adding/removing members from a group */ return 0; -- 2.39.5