Fix bug 10196 - RW Deny for a specific user is not overriding RW Allow for a group.

When the ID returned is ID_TYPE_BOTH we must *always* add it as both
a user and a group, not just in the owning case. Otherwise DENY
entries are not correctly processed.

Confirmed by the reporter as fixing the problem.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10196

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
Fix bug 10196 - RW Deny for a specific user is not overriding RW Allow for a group.

Fix posix_acl tests to match the change in writing ACLs
with ID_TYPE_BOTH.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
Fix comment showing how to print an ACL to allow debug.

Signed-off-by: Jeremy Allison <jra@samba.org>

Reviewed-by: David Disseldorp <ddiss@samba.org>
smbd: Use remove_oplock() in close_normal_file

remove_oplock is a wrapper around release_file_oplock. This streamlines
the exports of oplock.c a bit.

Reason for this patch: In a later patch I will add functionality to
remove_oplock that is required in close_normal_file as well.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
smbd: Make release_file_oplock static

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
smbd: Unify parameters to set_oplock_type

Some lines above we set fsp->oplock_type = e->op_type. I don't see
how this might have changed. This change will unify both callers of
set_file_oplock. In the next step the second parameter to set_file_oplock
will be removed.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
smbd: Remove separate oplock_type parameter from set_file_oplock

This avoids the question where it could happen that something else but
fsp->oplock_type might be useful as an argument here.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
smbd: Move oplock/sharemode ops into one place

This makes the is_stat_open special case in grant_fsp_oplock_type
redundant because in open_file_ntcreate further up we have already set
oplock_request to NO_OPLOCK for stat opens.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
smbd: Move oplock handling together

Later on we will have all the oplock/sharemode operations in one routine.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
torture: Add smb2.oplock.levelII501 test

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Thu Oct 24 16:15:50 CEST 2013 on sn-devel-104
s4-dsacl: Fixed incorrect handling of privileges in sec_access_check_ds

Restore and backup privileges are not relevant to ldap
access checks, and the TakeOwnership privilege should
grant write_owner right

Signed-off-by: Nadezhda Ivanova <nivanova@symas.com>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
s4-openldap: Fixed a problem with provisioning with OpenLdap

Credentials are no longer used and there were too many arguments to the
constructor

Signed-off-by: Nadezhda Ivanova <nivanova@symas.com>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
s4-dns: dlz_bind9: Create dns-HOSTNAME account disabled

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Oct 25 00:39:21 CEST 2013 on sn-devel-104
build: fix ordering problems with lib-provided and internal RPATHs

When a library or system (like cups) provides an RPATH,
e.g. with -Wl,-R or -Wl,-rpath, this was added by waf
to the LINKFLAGS, wich was later prepended to our RPATH.
But if the path by chance contains an older version of
one of our internal libraries like talloc, this would lead
to linking the too old talloc into our binaries.

This has been observed on, e.g., FreeBSD, but it is a general
problem.

This patch fixes the problem by specially parsing the RPATH
linker options from the pkg-config(, cups-config, ....) output
and putting the paths into the RPATH_<lib> container, which
is then later correctly appended to our internal RPATH.

Signed-off-by: Michael Adam <obnox@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
waf: parse LDFLAGS from python

The LDFLAGS returned by get_python_variables may contain additional library
search paths. These need to be parsed out and placed in LIBPATH to maintain
correct ordering of search paths in the final link flags.

Specifically, appending LDFLAGS directly to LINKFLAGS on my system was causing
/usr/lib to be the first search path specified. This lead to linking against
installed libraries rather than the versions from the current build.

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Oct 25 02:48:35 CEST 2013 on sn-devel-104
Revert "smbd: Move oplock handling together"

This reverts commit e689b7d51e6ffd848ab10e160dca2c3a03fc750b.

This is a change in behaviour which needs much further investigation
and testing.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
Revert "smbd: Move oplock/sharemode ops into one place"

This reverts commit 7b70fa18734d9ceb020fe3e5d4cc0c26cd27a484.

This is a change in behaviour which needs much further investigation
and testing.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Fri Oct 25 14:22:20 CEST 2013 on sn-devel-104
smb2_ioctl: add support for FSCTL_SRV_COPYCHUNK_WRITE

FSCTL_SRV_COPYCHUNK can only be used when the client has the copy-chunk
target file open with FILE_WRITE_DATA and FILE_READ_DATA.
FSCTL_SRV_COPYCHUNK_WRITE requires only FILE_WRITE_DATA access on the
target, and is therefore suitable for cp --reflink, which opens the
target file O_WRONLY.

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
torture: add FSCTL_SRV_COPYCHUNK_WRITE access test

Check that FSCTL_SRV_COPYCHUNK_WRITE succeeds when the copy-chunk target
is opened with SEC_RIGHTS_FILE_WRITE only.

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Oct 25 22:48:59 CEST 2013 on sn-devel-104