package/samba/samba-security-disable-fancy-operations.patch

From 0ef44d4c3d3ef6483c0dcebfa427ee8ff476ca43 Mon Sep 17 00:00:00 2001
From: Avery Pennarun <apenwarr@gmail.com>
Date: Sat, 29 Sep 2012 15:37:39 -0400
Subject: [PATCH] vfs_default: disable "fancy" file operations.

In particular, symlink().  Windows smb client software should never need
these, but they can potentially lead to security holes.
---
 source3/modules/vfs_default.c |   38 ++++++++++++++++++++++++++------------
 1 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c
index 27e9b9b..4bdd935 100644
--- a/source3/modules/vfs_default.c
+++ b/source3/modules/vfs_default.c
@@ -28,6 +28,20 @@
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_VFS
 
+int vfswrap_not_implemented(void)
+{
+    errno = EPERM;
+    return -1;
+}
+
+
+#if SUPPORT_FANCY_STUFF
+# define FANCY(x) x
+#else
+# define FANCY(x) vfswrap_not_implemented()
+#endif
+
+
 /* Check for NULL pointer parameters in vfswrap_* functions */
 
 /* We don't want to have NULL function pointers lying around.  Someone
@@ -75,7 +89,7 @@ static int vfswrap_set_quota(struct vfs_handle_struct *handle,  enum SMB_QUOTA_T
 	int result;
 
 	START_PROFILE(syscall_set_quota);
-	result = sys_set_quota(handle->conn->connectpath, qtype, id, qt);
+	result = FANCY(sys_set_quota(handle->conn->connectpath, qtype, id, qt));
 	END_PROFILE(syscall_set_quota);
 	return result;
 #else
@@ -1012,7 +1026,7 @@ static bool vfswrap_lock(vfs_handle_struct *handle, files_struct *fsp, int op, S
 	bool result;
 
 	START_PROFILE(syscall_fcntl_lock);
-	result =  fcntl_lock(fsp->fh->fd, op, offset, count, type);
+	result = FANCY(fcntl_lock(fsp->fh->fd, op, offset, count, type));
 	END_PROFILE(syscall_fcntl_lock);
 	return result;
 }
@@ -1021,7 +1035,7 @@ static int vfswrap_kernel_flock(vfs_handle_struct *handle, files_struct *fsp,
 				uint32 share_mode, uint32 access_mask)
 {
 	START_PROFILE(syscall_kernel_flock);
-	kernel_flock(fsp->fh->fd, share_mode, access_mask);
+	FANCY(kernel_flock(fsp->fh->fd, share_mode, access_mask));
 	END_PROFILE(syscall_kernel_flock);
 	return 0;
 }
@@ -1062,7 +1076,7 @@ static int vfswrap_symlink(vfs_handle_struct *handle,  const char *oldpath, cons
 	int result;
 
 	START_PROFILE(syscall_symlink);
-	result = symlink(oldpath, newpath);
+	result = FANCY(symlink(oldpath, newpath));
 	END_PROFILE(syscall_symlink);
 	return result;
 }
@@ -1082,7 +1096,7 @@ static int vfswrap_link(vfs_handle_struct *handle,  const char *oldpath, const c
 	int result;
 
 	START_PROFILE(syscall_link);
-	result = link(oldpath, newpath);
+	result = FANCY(link(oldpath, newpath));
 	END_PROFILE(syscall_link);
 	return result;
 }
@@ -1092,7 +1106,7 @@ static int vfswrap_mknod(vfs_handle_struct *handle,  const char *pathname, mode_
 	int result;
 
 	START_PROFILE(syscall_mknod);
-	result = sys_mknod(pathname, mode, dev);
+	result = FANCY(sys_mknod(pathname, mode, dev));
 	END_PROFILE(syscall_mknod);
 	return result;
 }
@@ -1522,32 +1536,32 @@ static ssize_t vfswrap_flistxattr(struct vfs_handle_struct *handle, struct files
 
 static int vfswrap_removexattr(struct vfs_handle_struct *handle, const char *path, const char *name)
 {
-	return sys_removexattr(path, name);
+	return FANCY(sys_removexattr(path, name));
 }
 
 static int vfswrap_lremovexattr(struct vfs_handle_struct *handle, const char *path, const char *name)
 {
-	return sys_lremovexattr(path, name);
+	return FANCY(sys_lremovexattr(path, name));
 }
 
 static int vfswrap_fremovexattr(struct vfs_handle_struct *handle, struct files_struct *fsp, const char *name)
 {
-	return sys_fremovexattr(fsp->fh->fd, name);
+	return FANCY(sys_fremovexattr(fsp->fh->fd, name));
 }
 
 static int vfswrap_setxattr(struct vfs_handle_struct *handle, const char *path, const char *name, const void *value, size_t size, int flags)
 {
-	return sys_setxattr(path, name, value, size, flags);
+	return FANCY(sys_setxattr(path, name, value, size, flags));
 }
 
 static int vfswrap_lsetxattr(struct vfs_handle_struct *handle, const char *path, const char *name, const void *value, size_t size, int flags)
 {
-	return sys_lsetxattr(path, name, value, size, flags);
+	return FANCY(sys_lsetxattr(path, name, value, size, flags));
 }
 
 static int vfswrap_fsetxattr(struct vfs_handle_struct *handle, struct files_struct *fsp, const char *name, const void *value, size_t size, int flags)
 {
-	return sys_fsetxattr(fsp->fh->fd, name, value, size, flags);
+	return FANCY(sys_fsetxattr(fsp->fh->fd, name, value, size, flags));
 }
 
 static int vfswrap_aio_read(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
-- 
1.7.9.dirty