From 2e556c0f23ae439c804352cf51fcf30878b03c7a Mon Sep 17 00:00:00 2001 From: Andrew Deason Date: Sat, 3 Nov 2018 01:04:43 -0500 Subject: [PATCH] ptserver: Check for -restricted in SPR_Delete Currently, all prdb write operations, except for SPR_Delete, will fail with PRPERM if called by a non-system:administrators caller while restricted mode is active. SPR_Delete is missing this check, and so is not affected by the -restricted option. Fix this by inserting the same check for -restricted as all other code paths that check for -restricted. Change-Id: I35f19d0b715423cd91769e6de845efa330368e50 Reviewed-on: https://gerrit.openafs.org/13374 Reviewed-by: Benjamin Kaduk Tested-by: BuildBot --- src/ptserver/ptprocs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/ptserver/ptprocs.c b/src/ptserver/ptprocs.c index 4ce1cbf..a3ad9c5 100644 --- a/src/ptserver/ptprocs.c +++ b/src/ptserver/ptprocs.c @@ -739,6 +739,10 @@ Delete(struct rx_call *call, afs_int32 aid, afs_int32 *cid) && !IsAMemberOf(tt, *cid, tentry.owner) && !pr_noAuth) ABORT_WITH(tt, PRPERM); + if (restricted && !IsAMemberOf(tt, *cid, SYSADMINID)) { + ABORT_WITH(tt, PRPERM); + } + /* Delete each continuation block as a separate transaction so that no one * transaction become to large to complete. */ nptr = tentry.next; -- 1.9.4