Changeset 2820

Timestamp:

Feb 6, 2017, 10:22:52 PM (8 years ago)

Author:

andersk

Message:

OpenAFS: Interpret daemon.scripts C bit to allow cross-locker access

File:

• trunk/server/common/patches/openafs-scripts.patch (modified) (4 diffs)

trunk/server/common/patches/openafs-scripts.patch

@@ -82 +82 @@
 --- a/src/afs/VNOPS/afs_vnop_access.c
 +++ b/src/afs/VNOPS/afs_vnop_access.c
-@@ -130,6 +130,15 @@ afs_AccessOK(struct vcache *avc, afs_int32 arights, struct vrequest *areq,
+@@ -130,6 +130,16 @@ afs_AccessOK(struct vcache *avc, afs_int32 arights, struct vrequest *areq,
             dirBits = PRSFS_LOOKUP | PRSFS_READ;
             return (arights == (dirBits & arights));
@@ -91 +91 @@
 +           !(((arights & ~(PRSFS_LOOKUP|PRSFS_READ)) == 0) && areq->realuid == HTTPD_UID) &&
 +           !(((arights & ~(PRSFS_LOOKUP|PRSFS_READ)) == 0) && areq->realuid == POSTFIX_UID) &&
++           !(PRSFS_USR2 == afs_GetAccessBits(avc, PRSFS_USR2, areq)) &&
 +           !(areq->realuid == 0 && PRSFS_USR3 == afs_GetAccessBits(avc, PRSFS_USR3, areq)) &&
 +           !((areq->realuid == 0 || areq->realuid == SIGNUP_UID) && PRSFS_USR4 == afs_GetAccessBits(avc, PRSFS_USR4, areq)) ) {
@@ -98 +99 @@
      } else {
         /* some rights come from dir and some from file.  Specifically, you 
-@@ -183,6 +192,19 @@ afs_AccessOK(struct vcache *avc, afs_int32 arights, struct vrequest *areq,
+@@ -183,6 +192,20 @@ afs_AccessOK(struct vcache *avc, afs_int32 arights, struct vrequest *areq,
                     fileBits |= PRSFS_READ;
             }
@@ -110 +111 @@
 +           !(arights == PRSFS_READ && areq->realuid == HTTPD_UID &&
 +               (avc->f.m.Mode == 0100777 || avc->apache_access)) &&
++           !(PRSFS_USR2 == afs_GetAccessBits(avc, PRSFS_USR2, areq)) &&
 +           !(areq->realuid == 0 && PRSFS_USR3 == afs_GetAccessBits(avc, PRSFS_USR3, areq)) &&
 +           !((areq->realuid == 0 || areq->realuid == SIGNUP_UID) && PRSFS_USR4 == afs_GetAccessBits(avc, PRSFS_USR4, areq)) ) {