From 130532e758d0cb1d3c5d87d834021edae64fd222 Mon Sep 17 00:00:00 2001
From: Sebastian Lackner <sebastian@fds-team.de>
Date: Fri, 13 Jan 2017 00:58:17 +0100
Subject: server: Improve mapping of DACL to file permissions.

---
 server/file.c | 34 +++++++++++++++-------------------
 1 file changed, 15 insertions(+), 19 deletions(-)

diff --git a/server/file.c b/server/file.c
index 5648543e739..0164e6b75d2 100644
--- a/server/file.c
+++ b/server/file.c
@@ -722,7 +722,6 @@ mode_t sd_to_mode( const struct security_descriptor *sd, const SID *owner )
     mode_t mode;
     int present;
     const ACL *dacl = sd_get_dacl( sd, &present );
-    const SID *user = token_get_user( current->process->token );
     if (present && dacl)
     {
         const ACE_HEADER *ace = (const ACE_HEADER *)(dacl + 1);
@@ -743,16 +742,15 @@ mode_t sd_to_mode( const struct security_descriptor *sd, const SID *owner )
                     mode = file_access_to_mode( ad_ace->Mask );
                     if (security_equal_sid( sid, security_world_sid ))
                     {
-                        bits_to_set &= ~((mode << 6) | (mode << 3) | mode); /* all */
+                        bits_to_set &= ~(mode << 0); /* all */
                     }
-                    else if ((security_equal_sid( user, owner ) &&
-                              token_sid_present( current->process->token, sid, TRUE )))
+                    if (token_sid_present( current->process->token, sid, TRUE ))
                     {
-                        bits_to_set &= ~((mode << 6) | (mode << 3));  /* user + group */
+                        bits_to_set &= ~(mode << 3);  /* group */
                     }
-                    else if (security_equal_sid( sid, owner ))
+                    if (security_equal_sid( sid, owner ))
                     {
-                        bits_to_set &= ~(mode << 6);  /* user only */
+                        bits_to_set &= ~(mode << 6);  /* user */
                     }
                     break;
                 case ACCESS_ALLOWED_ACE_TYPE:
@@ -761,26 +759,24 @@ mode_t sd_to_mode( const struct security_descriptor *sd, const SID *owner )
                     mode = file_access_to_mode( aa_ace->Mask );
                     if (security_equal_sid( sid, security_world_sid ))
                     {
-                        mode = (mode << 6) | (mode << 3) | mode;  /* all */
-                        new_mode |= mode & bits_to_set;
-                        bits_to_set &= ~mode;
+                        new_mode |= (mode << 0) & bits_to_set; /* all */
+                        bits_to_set &= ~(mode << 0);
                     }
-                    else if ((security_equal_sid( user, owner ) &&
-                              token_sid_present( current->process->token, sid, FALSE )))
+                    if (token_sid_present( current->process->token, sid, FALSE ))
                     {
-                        mode = (mode << 6) | (mode << 3);  /* user + group */
-                        new_mode |= mode & bits_to_set;
-                        bits_to_set &= ~mode;
+                        new_mode |= (mode << 3) & bits_to_set; /* group */
+                        bits_to_set &= ~(mode << 3);
                     }
-                    else if (security_equal_sid( sid, owner ))
+                    if (security_equal_sid( sid, owner ))
                     {
-                        mode = (mode << 6);  /* user only */
-                        new_mode |= mode & bits_to_set;
-                        bits_to_set &= ~mode;
+                        new_mode |= (mode << 6) & bits_to_set; /* user */
+                        bits_to_set &= ~(mode << 6);
                     }
                     break;
             }
         }
+        new_mode |= (new_mode & S_IRWXO) << 3;
+        new_mode |= (new_mode & S_IRWXG) << 3;
     }
     else
         /* no ACL means full access rights to anyone */
-- 
2.11.0

