91 lines
3.4 KiB
Diff
91 lines
3.4 KiB
Diff
From 570e892a0e811b1c90b7fe6b065b16591d38f7ee Mon Sep 17 00:00:00 2001
|
|
From: Stefan Metzmacher <metze@samba.org>
|
|
Date: Thu, 16 Mar 2023 10:03:44 +0100
|
|
Subject: [PATCH 16/28] CVE-2023-4154 libcli/security: add
|
|
security_descriptor_[s|d]acl_insert() helpers
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15424
|
|
|
|
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
|
|
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
|
|
|
|
(cherry picked from commit 2c02378029fff6636b8f19e45af78b265f2210ed)
|
|
|
|
Conflict: NA
|
|
Reference: https://download.samba.org/pub/samba/patches/security/samba-4.18.8-security-2023-10-10.patch
|
|
[PATCH 16/28] CVE-2023-4154 libcli/security: add
|
|
security_descriptor_[s|d]acl_insert() helpers
|
|
---
|
|
libcli/security/security_descriptor.c | 28 +++++++++++++++++++++++++++
|
|
libcli/security/security_descriptor.h | 6 ++++++
|
|
2 files changed, 34 insertions(+)
|
|
|
|
diff --git a/libcli/security/security_descriptor.c b/libcli/security/security_descriptor.c
|
|
index bc38a405e1e..db998bbf816 100644
|
|
--- a/libcli/security/security_descriptor.c
|
|
+++ b/libcli/security/security_descriptor.c
|
|
@@ -344,6 +344,20 @@ NTSTATUS security_descriptor_sacl_add(struct security_descriptor *sd,
|
|
return security_descriptor_acl_add(sd, true, ace, -1);
|
|
}
|
|
|
|
+/*
|
|
+ insert an ACE at a given index to the SACL of a security_descriptor
|
|
+
|
|
+ idx can be negative, which means it's related to the new size from the
|
|
+ end, so -1 means the ace is appended at the end.
|
|
+*/
|
|
+
|
|
+NTSTATUS security_descriptor_sacl_insert(struct security_descriptor *sd,
|
|
+ const struct security_ace *ace,
|
|
+ ssize_t idx)
|
|
+{
|
|
+ return security_descriptor_acl_add(sd, true, ace, idx);
|
|
+}
|
|
+
|
|
/*
|
|
add an ACE to the DACL of a security_descriptor
|
|
*/
|
|
@@ -354,6 +368,20 @@ NTSTATUS security_descriptor_dacl_add(struct security_descriptor *sd,
|
|
return security_descriptor_acl_add(sd, false, ace, -1);
|
|
}
|
|
|
|
+/*
|
|
+ insert an ACE at a given index to the DACL of a security_descriptor
|
|
+
|
|
+ idx can be negative, which means it's related to the new size from the
|
|
+ end, so -1 means the ace is appended at the end.
|
|
+*/
|
|
+
|
|
+NTSTATUS security_descriptor_dacl_insert(struct security_descriptor *sd,
|
|
+ const struct security_ace *ace,
|
|
+ ssize_t idx)
|
|
+{
|
|
+ return security_descriptor_acl_add(sd, false, ace, idx);
|
|
+}
|
|
+
|
|
/*
|
|
delete the ACE corresponding to the given trustee in an ACL of a
|
|
security_descriptor
|
|
diff --git a/libcli/security/security_descriptor.h b/libcli/security/security_descriptor.h
|
|
index 46545321d15..354bc17e925 100644
|
|
--- a/libcli/security/security_descriptor.h
|
|
+++ b/libcli/security/security_descriptor.h
|
|
@@ -33,8 +33,14 @@ NTSTATUS security_descriptor_for_client(TALLOC_CTX *mem_ctx,
|
|
struct security_descriptor **_csd);
|
|
NTSTATUS security_descriptor_sacl_add(struct security_descriptor *sd,
|
|
const struct security_ace *ace);
|
|
+NTSTATUS security_descriptor_sacl_insert(struct security_descriptor *sd,
|
|
+ const struct security_ace *ace,
|
|
+ ssize_t idx);
|
|
NTSTATUS security_descriptor_dacl_add(struct security_descriptor *sd,
|
|
const struct security_ace *ace);
|
|
+NTSTATUS security_descriptor_dacl_insert(struct security_descriptor *sd,
|
|
+ const struct security_ace *ace,
|
|
+ ssize_t idx);
|
|
NTSTATUS security_descriptor_dacl_del(struct security_descriptor *sd,
|
|
const struct dom_sid *trustee);
|
|
NTSTATUS security_descriptor_sacl_del(struct security_descriptor *sd,
|
|
--
|
|
2.34.1
|