From 4fddab4813fed0361a2e082be27ae5d1dbd0bdee Mon Sep 17 00:00:00 2001 From: Damjan Jovanovic Date: Sun, 6 Jun 2021 03:59:38 +0200 Subject: [PATCH] server: The owner of a securable object should have all the standard access rights. Cygwin fork() fails in NtCreateSymbolicLinkObject(). We successfully create the link but then fail to alloc_handle() with STATUS_ACCESS_DENIED, because the requested access rights exceed what the owner is allowed. Allow it more. Thank you to Dmitry Timoshkov for debugging the security details from alloc_handle() onwards. Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=48891 Signed-off-by: Damjan Jovanovic Signed-off-by: Alexandre Julliard (cherry picked from commit 31e984a09d6bb9ce774da9bee7e24eea2a379f75) Signed-off-by: Michael Stefaniuc --- dlls/advapi32/tests/security.c | 19 +++++++++++++++++-- server/token.c | 2 +- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/dlls/advapi32/tests/security.c b/dlls/advapi32/tests/security.c index 020e69277e0..828601ca782 100644 --- a/dlls/advapi32/tests/security.c +++ b/dlls/advapi32/tests/security.c @@ -1083,10 +1083,25 @@ todo_wine { SetLastError(0xdeadbeef); rc = AccessCheck(sd, token, DELETE, &mapping, &priv_set, &priv_set_len, &granted, &status); ok(rc, "AccessCheck error %d\n", GetLastError()); -todo_wine { ok(status == 1, "expected 1, got %d\n", status); ok(granted == DELETE, "expected DELETE, got %#x\n", granted); -} + + granted = 0xdeadbeef; + status = 0xdeadbeef; + SetLastError(0xdeadbeef); + rc = AccessCheck(sd, token, WRITE_OWNER, &mapping, &priv_set, &priv_set_len, &granted, &status); + ok(rc, "AccessCheck error %d\n", GetLastError()); + ok(status == 1, "expected 1, got %d\n", status); + ok(granted == WRITE_OWNER, "expected WRITE_OWNER, got %#x\n", granted); + + granted = 0xdeadbeef; + status = 0xdeadbeef; + SetLastError(0xdeadbeef); + rc = AccessCheck(sd, token, SYNCHRONIZE, &mapping, &priv_set, &priv_set_len, &granted, &status); + ok(rc, "AccessCheck error %d\n", GetLastError()); + ok(status == 1, "expected 1, got %d\n", status); + ok(granted == SYNCHRONIZE, "expected SYNCHRONIZE, got %#x\n", granted); + granted = 0xdeadbeef; status = 0xdeadbeef; SetLastError(0xdeadbeef); diff --git a/server/token.c b/server/token.c index 30320851436..d18c454aba9 100644 --- a/server/token.c +++ b/server/token.c @@ -1124,7 +1124,7 @@ static unsigned int token_access_check( struct token *token, * determined here. */ if (token_sid_present( token, owner, FALSE )) { - current_access |= (READ_CONTROL | WRITE_DAC); + current_access |= (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE); if (desired_access == current_access) { *granted_access = current_access;