s3: smbd: Remove ugly SMB1-specific hack to filename_convert_dirfsp()
commit5075df4575d9250fa53dcef024589084ad56062d
authorJeremy Allison <jra@samba.org>
Thu, 4 Aug 2022 18:32:05 +0000 (4 11:32 -0700)
committerVolker Lendecke <vl@samba.org>
Fri, 5 Aug 2022 10:24:22 +0000 (5 10:24 +0000)
tree9ddc71147481ddb4799af26c03e19b4d8308c3e1
parent5c9404f753173465900c004e444174d247f692f6
s3: smbd: Remove ugly SMB1-specific hack to filename_convert_dirfsp()

This was added due to the error code check in test_symlink_traversal_smb1_posix.sh.
After careful consideration I've realized the error code expected here
is incorrect, and not providing any security benefit.

We already check that trying to fetch a file/traverse through a
symlink that points outside of a share returns NT_STATUS_OBJECT_PATH_NOT_FOUND,
and this is enforced in the symlink checks already inside filename_convert_dirfsp().

If a symlink points to a directory within the share for which
the user has no permissions (as is tested here), then there's no
benefit in mapping the error code from NT_STATUS_ACCESS_DENIED
to NT_STATUS_OBJECT_PATH_NOT_FOUND, as we are not providing any
extra information about the filesystem state the user cannot already
obtain by normal SMB1+POSIX calls.

Change the error code expected in this single test from NT_STATUS_OBJECT_PATH_NOT_FOUND
to NT_STATUS_ACCESS_DENIED.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri Aug  5 10:24:23 UTC 2022 on sn-devel-184
source3/script/tests/test_symlink_traversal_smb1_posix.sh
source3/smbd/filename.c