[PATCH 2/2] server: Include user groups in file mode calculation when user is file owner (try 2)

[klightspeed]

---
 server/file.c |   23 +++++++++++++++++++++++
 1 files changed, 23 insertions(+), 0 deletions(-)

diff --git a/server/file.c b/server/file.c
index 5db64cd..2f2d2ef 100644
--- a/server/file.c
+++ b/server/file.c
@@ -447,6 +447,7 @@ mode_t sd_to_mode( const struct security_descriptor *sd, const SID *owner )
     mode_t denied_mode = 0;
     int present;
     const ACL *dacl = sd_get_dacl( sd, &present );
+    const SID *user = token_get_user( current->process->token );
     if (present && dacl)
     {
         const ACE_HEADER *ace = (const ACE_HEADER *)(dacl + 1);
@@ -484,6 +485,17 @@ mode_t sd_to_mode( const struct security_descriptor *sd, const SID *owner )
                         if (access & FILE_EXECUTE)
                             denied_mode |= S_IXUSR;
                     }
+                    else if ((security_equal_sid( user, owner ) &&
+                              token_sid_present( current->process->token, sid, TRUE )))
+                    {
+                        unsigned int access = generic_file_map_access( ad_ace->Mask );
+                        if (access & FILE_READ_DATA)
+                            denied_mode |= S_IRUSR|S_IRGRP;
+                        if (access & FILE_WRITE_DATA)
+                            denied_mode |= S_IWUSR|S_IRGRP;
+                        if (access & FILE_EXECUTE)
+                            denied_mode |= S_IXUSR|S_IRGRP;
+                    }
                     break;
                 case ACCESS_ALLOWED_ACE_TYPE:
                     aa_ace = (const ACCESS_ALLOWED_ACE *)ace;
@@ -508,6 +520,17 @@ mode_t sd_to_mode( const struct security_descriptor *sd, const SID *owner )
                         if (access & FILE_EXECUTE)
                             new_mode |= S_IXUSR;
                     }
+                    else if ((security_equal_sid( user, owner ) &&
+                              token_sid_present( current->process->token, sid, FALSE )))
+                    {
+                        unsigned int access = generic_file_map_access( ad_ace->Mask );
+                        if (access & FILE_READ_DATA)
+                            new_mode |= S_IRUSR|S_IRGRP;
+                        if (access & FILE_WRITE_DATA)
+                            new_mode |= S_IWUSR|S_IRGRP;
+                        if (access & FILE_EXECUTE)
+                            new_mode |= S_IXUSR|S_IRGRP;
+                    }
                     break;
             }
         }
-- 
1.6.4.4