2 Unix SMB/CIFS implementation.
3 Check access to files based on security descriptors.
4 Copyright (C) Jeremy Allison 2005-2006.
5 Copyright (C) Michael Adam 2007.
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "system/filesys.h"
23 #include "../libcli/security/security.h"
24 #include "../librpc/gen_ndr/ndr_security.h"
25 #include "smbd/smbd.h"
28 #define DBGC_CLASS DBGC_ACLS
30 /****************************************************************************
31 Actually emulate the in-kernel access checking for delete access. We need
32 this to successfully return ACCESS_DENIED on a file open for delete access.
33 ****************************************************************************/
35 bool can_delete_file_in_directory(connection_struct
*conn
,
36 struct files_struct
*dirfsp
,
37 const struct smb_filename
*smb_fname
)
39 TALLOC_CTX
*ctx
= talloc_tos();
40 struct smb_filename
*smb_fname_parent
= NULL
;
43 SMB_ASSERT(dirfsp
== conn
->cwd_fsp
);
45 if (!CAN_WRITE(conn
)) {
49 if (!lp_acl_check_permissions(SNUM(conn
))) {
50 /* This option means don't check. */
54 /* Get the parent directory permission mask and owners. */
55 ret
= parent_smb_fname(ctx
, smb_fname
, &smb_fname_parent
, NULL
);
60 if(SMB_VFS_STAT(conn
, smb_fname_parent
) != 0) {
65 /* fast paths first */
67 if (!S_ISDIR(smb_fname_parent
->st
.st_ex_mode
)) {
71 if (get_current_uid(conn
) == (uid_t
)0) {
72 /* I'm sorry sir, I didn't know you were root... */
78 /* sticky bit means delete only by owner of file or by root or
79 * by owner of directory. */
80 if (smb_fname_parent
->st
.st_ex_mode
& S_ISVTX
) {
81 if (!VALID_STAT(smb_fname
->st
)) {
82 /* If the file doesn't already exist then
83 * yes we'll be able to delete it. */
89 * Patch from SATOH Fumiyasu <fumiyas@miraclelinux.com>
90 * for bug #3348. Don't assume owning sticky bit
91 * directory means write access allowed.
92 * Fail to delete if we're not the owner of the file,
93 * or the owner of the directory as we have no possible
94 * chance of deleting. Otherwise, go on and check the ACL.
96 if ((get_current_uid(conn
) !=
97 smb_fname_parent
->st
.st_ex_uid
) &&
98 (get_current_uid(conn
) != smb_fname
->st
.st_ex_uid
)) {
99 DEBUG(10,("can_delete_file_in_directory: not "
100 "owner of file %s or directory %s",
101 smb_fname_str_dbg(smb_fname
),
102 smb_fname_str_dbg(smb_fname_parent
)));
109 /* now for ACL checks */
112 * There's two ways to get the permission to delete a file: First by
113 * having the DELETE bit on the file itself and second if that does
114 * not help, by the DELETE_CHILD bit on the containing directory.
116 * Here we only check the directory permissions, we will
117 * check the file DELETE permission separately.
121 * NB. When dirfsp != conn->cwd_fsp, we must
122 * change smb_fname_parent to be "." for the name here.
124 ret
= NT_STATUS_IS_OK(smbd_check_access_rights(conn
,
130 TALLOC_FREE(smb_fname_parent
);
134 /****************************************************************************
135 Userspace check for write access.
136 ****************************************************************************/
138 bool can_write_to_file(connection_struct
*conn
,
139 struct files_struct
*dirfsp
,
140 const struct smb_filename
*smb_fname
)
142 SMB_ASSERT(dirfsp
== conn
->cwd_fsp
);
143 return NT_STATUS_IS_OK(smbd_check_access_rights(conn
,
150 /****************************************************************************
151 Check for an existing default Windows ACL on a directory.
152 ****************************************************************************/
154 bool directory_has_default_acl(connection_struct
*conn
,
155 struct files_struct
*dirfsp
,
156 struct smb_filename
*smb_fname
)
158 struct security_descriptor
*secdesc
= NULL
;
162 status
= SMB_VFS_GET_NT_ACL_AT(conn
,
169 if (!NT_STATUS_IS_OK(status
) ||
171 secdesc
->dacl
== NULL
) {
172 TALLOC_FREE(secdesc
);
176 for (i
= 0; i
< secdesc
->dacl
->num_aces
; i
++) {
177 struct security_ace
*psa
= &secdesc
->dacl
->aces
[i
];
178 if (psa
->flags
& (SEC_ACE_FLAG_OBJECT_INHERIT
|
179 SEC_ACE_FLAG_CONTAINER_INHERIT
)) {
180 TALLOC_FREE(secdesc
);
184 TALLOC_FREE(secdesc
);
188 /****************************************************************************
189 Check if setting delete on close is allowed on this fsp.
190 ****************************************************************************/
192 NTSTATUS
can_set_delete_on_close(files_struct
*fsp
, uint32_t dosmode
)
195 * Only allow delete on close for writable files.
198 if ((dosmode
& FILE_ATTRIBUTE_READONLY
) &&
199 !lp_delete_readonly(SNUM(fsp
->conn
))) {
200 DEBUG(10,("can_set_delete_on_close: file %s delete on close "
201 "flag set but file attribute is readonly.\n",
203 return NT_STATUS_CANNOT_DELETE
;
207 * Only allow delete on close for writable shares.
210 if (!CAN_WRITE(fsp
->conn
)) {
211 DEBUG(10,("can_set_delete_on_close: file %s delete on "
212 "close flag set but write access denied on share.\n",
214 return NT_STATUS_ACCESS_DENIED
;
218 * Only allow delete on close for files/directories opened with delete
222 if (!(fsp
->access_mask
& DELETE_ACCESS
)) {
223 DEBUG(10,("can_set_delete_on_close: file %s delete on "
224 "close flag set but delete access denied.\n",
226 return NT_STATUS_ACCESS_DENIED
;
229 /* Don't allow delete on close for non-empty directories. */
230 if (fsp
->fsp_flags
.is_directory
) {
231 SMB_ASSERT(!is_ntfs_stream_smb_fname(fsp
->fsp_name
));
233 /* Or the root of a share. */
234 if (ISDOT(fsp
->fsp_name
->base_name
)) {
235 DEBUG(10,("can_set_delete_on_close: can't set delete on "
236 "close for the root of a share.\n"));
237 return NT_STATUS_ACCESS_DENIED
;
240 return can_delete_directory_fsp(fsp
);