From: Andrew Deason <adeason@sinenomine.net>
Date: Sat, 3 Nov 2018 06:04:43 +0000 (-0500)
Subject: ptserver: Check for -restricted in SPR_Delete
X-Git-Tag: openafs-devel-1_9_0~363
X-Git-Url: http://git.openafs.org/?p=openafs.git;a=commitdiff_plain;h=2e556c0f23ae439c804352cf51fcf30878b03c7a

ptserver: Check for -restricted in SPR_Delete

Currently, all prdb write operations, except for SPR_Delete, will fail
with PRPERM if called by a non-system:administrators caller while
restricted mode is active.  SPR_Delete is missing this check, and so
is not affected by the -restricted option.

Fix this by inserting the same check for -restricted as all other code
paths that check for -restricted.

Change-Id: I35f19d0b715423cd91769e6de845efa330368e50
Reviewed-on: https://gerrit.openafs.org/13374
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
---

diff --git a/src/ptserver/ptprocs.c b/src/ptserver/ptprocs.c
index 4ce1cbf..a3ad9c5 100644
--- a/src/ptserver/ptprocs.c
+++ b/src/ptserver/ptprocs.c
@@ -739,6 +739,10 @@ Delete(struct rx_call *call, afs_int32 aid, afs_int32 *cid)
 	&& !IsAMemberOf(tt, *cid, tentry.owner) && !pr_noAuth)
 	ABORT_WITH(tt, PRPERM);
 
+    if (restricted && !IsAMemberOf(tt, *cid, SYSADMINID)) {
+        ABORT_WITH(tt, PRPERM);
+    }
+
     /* Delete each continuation block as a separate transaction so that no one
      * transaction become to large to complete. */
     nptr = tentry.next;