4 * Copyright (C) Jim McDonough, 2006
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 #include "nfs4_acls.h"
22 #include "librpc/gen_ndr/ndr_security.h"
23 #include "../libcli/security/dom_sid.h"
24 #include "../libcli/security/security.h"
25 #include "include/dbwrap.h"
28 #define DBGC_CLASS DBGC_ACLS
30 #define SMBACL4_PARAM_TYPE_NAME "nfs4"
32 extern const struct generic_mapping file_generic_mapping
;
34 #define SMB_ACE4_INT_MAGIC 0x76F8A967
35 typedef struct _SMB_ACE4_INT_T
42 #define SMB_ACL4_INT_MAGIC 0x29A3E792
43 typedef struct _SMB_ACL4_INT_T
47 SMB_ACE4_INT_T
*first
;
51 static SMB_ACL4_INT_T
*get_validated_aclint(SMB4ACL_T
*theacl
)
53 SMB_ACL4_INT_T
*aclint
= (SMB_ACL4_INT_T
*)theacl
;
56 DEBUG(2, ("acl is NULL\n"));
60 if (aclint
->magic
!=SMB_ACL4_INT_MAGIC
)
62 DEBUG(2, ("aclint bad magic 0x%x\n", aclint
->magic
));
69 static SMB_ACE4_INT_T
*get_validated_aceint(SMB4ACE_T
*ace
)
71 SMB_ACE4_INT_T
*aceint
= (SMB_ACE4_INT_T
*)ace
;
74 DEBUG(2, ("ace is NULL\n"));
78 if (aceint
->magic
!=SMB_ACE4_INT_MAGIC
)
80 DEBUG(2, ("aceint bad magic 0x%x\n", aceint
->magic
));
87 SMB4ACL_T
*smb_create_smb4acl(void)
89 TALLOC_CTX
*mem_ctx
= talloc_tos();
90 SMB_ACL4_INT_T
*theacl
= (SMB_ACL4_INT_T
*)TALLOC_ZERO_SIZE(mem_ctx
, sizeof(SMB_ACL4_INT_T
));
93 DEBUG(0, ("TALLOC_SIZE failed\n"));
97 theacl
->magic
= SMB_ACL4_INT_MAGIC
;
98 /* theacl->first, last = NULL not needed */
99 return (SMB4ACL_T
*)theacl
;
102 SMB4ACE_T
*smb_add_ace4(SMB4ACL_T
*theacl
, SMB_ACE4PROP_T
*prop
)
104 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(theacl
);
105 TALLOC_CTX
*mem_ctx
= talloc_tos();
108 ace
= (SMB_ACE4_INT_T
*)TALLOC_ZERO_SIZE(mem_ctx
, sizeof(SMB_ACE4_INT_T
));
111 DEBUG(0, ("TALLOC_SIZE failed\n"));
115 ace
->magic
= SMB_ACE4_INT_MAGIC
;
116 /* ace->next = NULL not needed */
117 memcpy(&ace
->prop
, prop
, sizeof(SMB_ACE4PROP_T
));
119 if (aclint
->first
==NULL
)
124 aclint
->last
->next
= (void *)ace
;
129 return (SMB4ACE_T
*)ace
;
132 SMB_ACE4PROP_T
*smb_get_ace4(SMB4ACE_T
*ace
)
134 SMB_ACE4_INT_T
*aceint
= get_validated_aceint(ace
);
138 return &aceint
->prop
;
141 SMB4ACE_T
*smb_next_ace4(SMB4ACE_T
*ace
)
143 SMB_ACE4_INT_T
*aceint
= get_validated_aceint(ace
);
147 return (SMB4ACE_T
*)aceint
->next
;
150 SMB4ACE_T
*smb_first_ace4(SMB4ACL_T
*theacl
)
152 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(theacl
);
156 return (SMB4ACE_T
*)aclint
->first
;
159 uint32
smb_get_naces(SMB4ACL_T
*theacl
)
161 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(theacl
);
165 return aclint
->naces
;
168 static int smbacl4_GetFileOwner(struct connection_struct
*conn
,
169 const char *filename
,
170 SMB_STRUCT_STAT
*psbuf
)
172 memset(psbuf
, 0, sizeof(SMB_STRUCT_STAT
));
174 /* Get the stat struct for the owner info. */
175 if (vfs_stat_smb_fname(conn
, filename
, psbuf
) != 0)
177 DEBUG(8, ("vfs_stat_smb_fname failed with error %s\n",
185 static int smbacl4_fGetFileOwner(files_struct
*fsp
, SMB_STRUCT_STAT
*psbuf
)
187 memset(psbuf
, 0, sizeof(SMB_STRUCT_STAT
));
189 if (fsp
->is_directory
|| fsp
->fh
->fd
== -1) {
190 return smbacl4_GetFileOwner(fsp
->conn
,
191 fsp
->fsp_name
->base_name
, psbuf
);
193 if (SMB_VFS_FSTAT(fsp
, psbuf
) != 0)
195 DEBUG(8, ("SMB_VFS_FSTAT failed with error %s\n",
203 static bool smbacl4_nfs42win(TALLOC_CTX
*mem_ctx
, SMB4ACL_T
*theacl
, /* in */
204 struct dom_sid
*psid_owner
, /* in */
205 struct dom_sid
*psid_group
, /* in */
206 bool is_directory
, /* in */
207 struct security_ace
**ppnt_ace_list
, /* out */
208 int *pgood_aces
/* out */
211 SMB_ACL4_INT_T
*aclint
= (SMB_ACL4_INT_T
*)theacl
;
212 SMB_ACE4_INT_T
*aceint
;
213 struct security_ace
*nt_ace_list
= NULL
;
216 DEBUG(10, ("smbacl_nfs42win entered\n"));
218 aclint
= get_validated_aclint(theacl
);
219 /* We do not check for naces being 0 or theacl being NULL here because it is done upstream */
220 /* in smb_get_nt_acl_nfs4(). */
221 nt_ace_list
= (struct security_ace
*)TALLOC_ZERO_SIZE(mem_ctx
, aclint
->naces
* sizeof(struct security_ace
));
222 if (nt_ace_list
==NULL
)
224 DEBUG(10, ("talloc error"));
229 for (aceint
=aclint
->first
; aceint
!=NULL
; aceint
=(SMB_ACE4_INT_T
*)aceint
->next
) {
232 SMB_ACE4PROP_T
*ace
= &aceint
->prop
;
233 uint32_t mapped_ace_flags
;
235 DEBUG(10, ("magic: 0x%x, type: %d, iflags: %x, flags: %x, mask: %x, "
236 "who: %d\n", aceint
->magic
, ace
->aceType
, ace
->flags
,
237 ace
->aceFlags
, ace
->aceMask
, ace
->who
.id
));
239 SMB_ASSERT(aceint
->magic
==SMB_ACE4_INT_MAGIC
);
241 if (ace
->flags
& SMB_ACE4_ID_SPECIAL
) {
242 switch (ace
->who
.special_id
) {
243 case SMB_ACE4_WHO_OWNER
:
244 sid_copy(&sid
, psid_owner
);
246 case SMB_ACE4_WHO_GROUP
:
247 sid_copy(&sid
, psid_group
);
249 case SMB_ACE4_WHO_EVERYONE
:
250 sid_copy(&sid
, &global_sid_World
);
253 DEBUG(8, ("invalid special who id %d "
254 "ignored\n", ace
->who
.special_id
));
257 if (ace
->aceFlags
& SMB_ACE4_IDENTIFIER_GROUP
) {
258 gid_to_sid(&sid
, ace
->who
.gid
);
260 uid_to_sid(&sid
, ace
->who
.uid
);
263 DEBUG(10, ("mapped %d to %s\n", ace
->who
.id
,
264 sid_string_dbg(&sid
)));
266 if (is_directory
&& (ace
->aceMask
& SMB_ACE4_ADD_FILE
)) {
267 ace
->aceMask
|= SMB_ACE4_DELETE_CHILD
;
270 mapped_ace_flags
= ace
->aceFlags
& 0xf;
271 if (!is_directory
&& (mapped_ace_flags
& (SMB_ACE4_FILE_INHERIT_ACE
|SMB_ACE4_DIRECTORY_INHERIT_ACE
))) {
273 * GPFS sets inherits dir_inhert and file_inherit flags
274 * to files, too, which confuses windows, and seems to
275 * be wrong anyways. ==> Map these bits away for files.
277 DEBUG(10, ("removing inherit flags from nfs4 ace\n"));
278 mapped_ace_flags
&= ~(SMB_ACE4_FILE_INHERIT_ACE
|SMB_ACE4_DIRECTORY_INHERIT_ACE
);
280 DEBUG(10, ("mapped ace flags: 0x%x => 0x%x\n",
281 ace
->aceFlags
, mapped_ace_flags
));
284 init_sec_ace(&nt_ace_list
[good_aces
++], &sid
,
289 *ppnt_ace_list
= nt_ace_list
;
290 *pgood_aces
= good_aces
;
295 static NTSTATUS
smb_get_nt_acl_nfs4_common(const SMB_STRUCT_STAT
*sbuf
,
296 uint32 security_info
,
297 struct security_descriptor
**ppdesc
, SMB4ACL_T
*theacl
)
300 struct dom_sid sid_owner
, sid_group
;
302 struct security_ace
*nt_ace_list
= NULL
;
303 struct security_acl
*psa
= NULL
;
304 TALLOC_CTX
*mem_ctx
= talloc_tos();
306 if (theacl
==NULL
|| smb_get_naces(theacl
)==0)
307 return NT_STATUS_ACCESS_DENIED
; /* special because we
308 * shouldn't alloc 0 for
311 uid_to_sid(&sid_owner
, sbuf
->st_ex_uid
);
312 gid_to_sid(&sid_group
, sbuf
->st_ex_gid
);
314 if (smbacl4_nfs42win(mem_ctx
, theacl
, &sid_owner
, &sid_group
,
315 S_ISDIR(sbuf
->st_ex_mode
),
316 &nt_ace_list
, &good_aces
)==False
) {
317 DEBUG(8,("smbacl4_nfs42win failed\n"));
318 return map_nt_error_from_unix(errno
);
321 psa
= make_sec_acl(mem_ctx
, NT4_ACL_REVISION
, good_aces
, nt_ace_list
);
323 DEBUG(2,("make_sec_acl failed\n"));
324 return NT_STATUS_NO_MEMORY
;
327 DEBUG(10,("after make sec_acl\n"));
328 *ppdesc
= make_sec_desc(mem_ctx
, SD_REVISION
, SEC_DESC_SELF_RELATIVE
,
329 (security_info
& SECINFO_OWNER
) ? &sid_owner
: NULL
,
330 (security_info
& SECINFO_GROUP
) ? &sid_group
: NULL
,
331 NULL
, psa
, &sd_size
);
333 DEBUG(2,("make_sec_desc failed\n"));
334 return NT_STATUS_NO_MEMORY
;
337 DEBUG(10, ("smb_get_nt_acl_nfs4_common successfully exited with sd_size %d\n",
338 (int)ndr_size_security_descriptor(*ppdesc
, 0)));
343 NTSTATUS
smb_fget_nt_acl_nfs4(files_struct
*fsp
,
344 uint32 security_info
,
345 struct security_descriptor
**ppdesc
, SMB4ACL_T
*theacl
)
347 SMB_STRUCT_STAT sbuf
;
349 DEBUG(10, ("smb_fget_nt_acl_nfs4 invoked for %s\n", fsp_str_dbg(fsp
)));
351 if (smbacl4_fGetFileOwner(fsp
, &sbuf
)) {
352 return map_nt_error_from_unix(errno
);
355 return smb_get_nt_acl_nfs4_common(&sbuf
, security_info
, ppdesc
, theacl
);
358 NTSTATUS
smb_get_nt_acl_nfs4(struct connection_struct
*conn
,
360 uint32 security_info
,
361 struct security_descriptor
**ppdesc
, SMB4ACL_T
*theacl
)
363 SMB_STRUCT_STAT sbuf
;
365 DEBUG(10, ("smb_get_nt_acl_nfs4 invoked for %s\n", name
));
367 if (smbacl4_GetFileOwner(conn
, name
, &sbuf
)) {
368 return map_nt_error_from_unix(errno
);
371 return smb_get_nt_acl_nfs4_common(&sbuf
, security_info
, ppdesc
, theacl
);
374 enum smbacl4_mode_enum
{e_simple
=0, e_special
=1};
375 enum smbacl4_acedup_enum
{e_dontcare
=0, e_reject
=1, e_ignore
=2, e_merge
=3};
377 typedef struct _smbacl4_vfs_params
{
378 enum smbacl4_mode_enum mode
;
380 enum smbacl4_acedup_enum acedup
;
381 struct db_context
*sid_mapping_table
;
382 } smbacl4_vfs_params
;
385 * Gather special parameters for NFS4 ACL handling
387 static int smbacl4_get_vfs_params(
388 const char *type_name
,
390 smbacl4_vfs_params
*params
393 static const struct enum_list enum_smbacl4_modes
[] = {
394 { e_simple
, "simple" },
395 { e_special
, "special" }
397 static const struct enum_list enum_smbacl4_acedups
[] = {
398 { e_dontcare
, "dontcare" },
399 { e_reject
, "reject" },
400 { e_ignore
, "ignore" },
401 { e_merge
, "merge" },
404 memset(params
, 0, sizeof(smbacl4_vfs_params
));
405 params
->mode
= (enum smbacl4_mode_enum
)lp_parm_enum(
406 SNUM(fsp
->conn
), type_name
,
407 "mode", enum_smbacl4_modes
, e_simple
);
408 params
->do_chown
= lp_parm_bool(SNUM(fsp
->conn
), type_name
,
410 params
->acedup
= (enum smbacl4_acedup_enum
)lp_parm_enum(
411 SNUM(fsp
->conn
), type_name
,
412 "acedup", enum_smbacl4_acedups
, e_dontcare
);
414 DEBUG(10, ("mode:%s, do_chown:%s, acedup: %s\n",
415 enum_smbacl4_modes
[params
->mode
].name
,
416 params
->do_chown
? "true" : "false",
417 enum_smbacl4_acedups
[params
->acedup
].name
));
422 static void smbacl4_dump_nfs4acl(int level
, SMB4ACL_T
*theacl
)
424 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(theacl
);
425 SMB_ACE4_INT_T
*aceint
;
427 DEBUG(level
, ("NFS4ACL: size=%d\n", aclint
->naces
));
429 for(aceint
= aclint
->first
; aceint
!=NULL
; aceint
=(SMB_ACE4_INT_T
*)aceint
->next
) {
430 SMB_ACE4PROP_T
*ace
= &aceint
->prop
;
432 DEBUG(level
, ("\tACE: type=%d, flags=0x%x, fflags=0x%x, mask=0x%x, id=%d\n",
434 ace
->aceFlags
, ace
->flags
,
441 * Find 2 NFS4 who-special ACE property (non-copy!!!)
442 * match nonzero if "special" and who is equal
443 * return ace if found matching; otherwise NULL
445 static SMB_ACE4PROP_T
*smbacl4_find_equal_special(
447 SMB_ACE4PROP_T
*aceNew
)
449 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(theacl
);
450 SMB_ACE4_INT_T
*aceint
;
452 for(aceint
= aclint
->first
; aceint
!=NULL
; aceint
=(SMB_ACE4_INT_T
*)aceint
->next
) {
453 SMB_ACE4PROP_T
*ace
= &aceint
->prop
;
455 DEBUG(10,("ace type:0x%x flags:0x%x aceFlags:0x%x "
456 "new type:0x%x flags:0x%x aceFlags:0x%x\n",
457 ace
->aceType
, ace
->flags
, ace
->aceFlags
,
458 aceNew
->aceType
, aceNew
->flags
,aceNew
->aceFlags
));
460 if (ace
->flags
== aceNew
->flags
&&
461 ace
->aceType
==aceNew
->aceType
&&
462 ((ace
->aceFlags
&SMB_ACE4_INHERIT_ONLY_ACE
)==
463 (aceNew
->aceFlags
&SMB_ACE4_INHERIT_ONLY_ACE
)) &&
464 (ace
->aceFlags
&SMB_ACE4_IDENTIFIER_GROUP
)==
465 (aceNew
->aceFlags
&SMB_ACE4_IDENTIFIER_GROUP
)
467 /* keep type safety; e.g. gid is an u.short */
468 if (ace
->flags
& SMB_ACE4_ID_SPECIAL
)
470 if (ace
->who
.special_id
==aceNew
->who
.special_id
)
473 if (ace
->aceFlags
& SMB_ACE4_IDENTIFIER_GROUP
)
475 if (ace
->who
.gid
==aceNew
->who
.gid
)
478 if (ace
->who
.uid
==aceNew
->who
.uid
)
488 static bool nfs4_map_sid(smbacl4_vfs_params
*params
, const struct dom_sid
*src
,
491 static struct db_context
*mapping_db
= NULL
;
494 if (mapping_db
== NULL
) {
495 const char *dbname
= lp_parm_const_string(
496 -1, SMBACL4_PARAM_TYPE_NAME
, "sidmap", NULL
);
498 if (dbname
== NULL
) {
499 DEBUG(10, ("%s:sidmap not defined\n",
500 SMBACL4_PARAM_TYPE_NAME
));
505 mapping_db
= db_open(NULL
, dbname
, 0, TDB_DEFAULT
,
509 if (mapping_db
== NULL
) {
510 DEBUG(1, ("could not open sidmap: %s\n",
516 if (mapping_db
->fetch(mapping_db
, NULL
,
517 string_term_tdb_data(sid_string_tos(src
)),
519 DEBUG(10, ("could not find mapping for SID %s\n",
520 sid_string_dbg(src
)));
524 if ((data
.dptr
== NULL
) || (data
.dsize
<= 0)
525 || (data
.dptr
[data
.dsize
-1] != '\0')) {
526 DEBUG(5, ("invalid mapping for SID %s\n",
527 sid_string_dbg(src
)));
528 TALLOC_FREE(data
.dptr
);
532 if (!string_to_sid(dst
, (char *)data
.dptr
)) {
533 DEBUG(1, ("invalid mapping %s for SID %s\n",
534 (char *)data
.dptr
, sid_string_dbg(src
)));
535 TALLOC_FREE(data
.dptr
);
539 TALLOC_FREE(data
.dptr
);
544 static bool smbacl4_fill_ace4(
546 const char *filename
,
547 smbacl4_vfs_params
*params
,
550 const struct security_ace
*ace_nt
, /* input */
551 SMB_ACE4PROP_T
*ace_v4
/* output */
554 DEBUG(10, ("got ace for %s\n", sid_string_dbg(&ace_nt
->trustee
)));
556 memset(ace_v4
, 0, sizeof(SMB_ACE4PROP_T
));
557 ace_v4
->aceType
= ace_nt
->type
; /* only ACCESS|DENY supported right now */
558 ace_v4
->aceFlags
= ace_nt
->flags
& SEC_ACE_FLAG_VALID_INHERIT
;
559 ace_v4
->aceMask
= ace_nt
->access_mask
&
560 (SEC_STD_ALL
| SEC_FILE_ALL
);
562 se_map_generic(&ace_v4
->aceMask
, &file_generic_mapping
);
564 if (ace_v4
->aceFlags
!=ace_nt
->flags
)
565 DEBUG(9, ("ace_v4->aceFlags(0x%x)!=ace_nt->flags(0x%x)\n",
566 ace_v4
->aceFlags
, ace_nt
->flags
));
568 if (ace_v4
->aceMask
!=ace_nt
->access_mask
)
569 DEBUG(9, ("ace_v4->aceMask(0x%x)!=ace_nt->access_mask(0x%x)\n",
570 ace_v4
->aceMask
, ace_nt
->access_mask
));
572 if (dom_sid_equal(&ace_nt
->trustee
, &global_sid_World
)) {
573 ace_v4
->who
.special_id
= SMB_ACE4_WHO_EVERYONE
;
574 ace_v4
->flags
|= SMB_ACE4_ID_SPECIAL
;
576 const char *dom
, *name
;
577 enum lsa_SidType type
;
582 sid_copy(&sid
, &ace_nt
->trustee
);
584 if (!lookup_sid(mem_ctx
, &sid
, &dom
, &name
, &type
)) {
586 struct dom_sid mapped
;
588 if (!nfs4_map_sid(params
, &sid
, &mapped
)) {
589 DEBUG(1, ("nfs4_acls.c: file [%s]: SID %s "
590 "unknown\n", filename
, sid_string_dbg(&sid
)));
595 DEBUG(2, ("nfs4_acls.c: file [%s]: mapped SID %s "
596 "to %s\n", filename
, sid_string_dbg(&sid
), sid_string_dbg(&mapped
)));
598 if (!lookup_sid(mem_ctx
, &mapped
, &dom
,
600 DEBUG(1, ("nfs4_acls.c: file [%s]: SID %s "
601 "mapped from %s is unknown\n",
602 filename
, sid_string_dbg(&mapped
), sid_string_dbg(&sid
)));
607 sid_copy(&sid
, &mapped
);
610 if (type
== SID_NAME_USER
) {
611 if (!sid_to_uid(&sid
, &uid
)) {
612 DEBUG(1, ("nfs4_acls.c: file [%s]: could not "
613 "convert %s to uid\n", filename
,
614 sid_string_dbg(&sid
)));
618 if (params
->mode
==e_special
&& uid
==ownerUID
) {
619 ace_v4
->flags
|= SMB_ACE4_ID_SPECIAL
;
620 ace_v4
->who
.special_id
= SMB_ACE4_WHO_OWNER
;
622 ace_v4
->who
.uid
= uid
;
624 } else { /* else group? - TODO check it... */
625 if (!sid_to_gid(&sid
, &gid
)) {
626 DEBUG(1, ("nfs4_acls.c: file [%s]: could not "
627 "convert %s to gid\n", filename
,
628 sid_string_dbg(&sid
)));
632 ace_v4
->aceFlags
|= SMB_ACE4_IDENTIFIER_GROUP
;
634 if (params
->mode
==e_special
&& gid
==ownerGID
) {
635 ace_v4
->flags
|= SMB_ACE4_ID_SPECIAL
;
636 ace_v4
->who
.special_id
= SMB_ACE4_WHO_GROUP
;
638 ace_v4
->who
.gid
= gid
;
643 return True
; /* OK */
646 static int smbacl4_MergeIgnoreReject(
647 enum smbacl4_acedup_enum acedup
,
648 SMB4ACL_T
*theacl
, /* may modify it */
649 SMB_ACE4PROP_T
*ace
, /* the "new" ACE */
655 SMB_ACE4PROP_T
*ace4found
= smbacl4_find_equal_special(theacl
, ace
);
660 case e_merge
: /* "merge" flags */
662 ace4found
->aceFlags
|= ace
->aceFlags
;
663 ace4found
->aceMask
|= ace
->aceMask
;
665 case e_ignore
: /* leave out this record */
668 case e_reject
: /* do an error */
669 DEBUG(8, ("ACL rejected by duplicate nt ace#%d\n", i
));
670 errno
= EINVAL
; /* SHOULD be set on any _real_ error */
680 static SMB4ACL_T
*smbacl4_win2nfs4(
681 const char *filename
,
682 const struct security_acl
*dacl
,
683 smbacl4_vfs_params
*pparams
,
690 TALLOC_CTX
*mem_ctx
= talloc_tos();
692 DEBUG(10, ("smbacl4_win2nfs4 invoked\n"));
694 theacl
= smb_create_smb4acl();
698 for(i
=0; i
<dacl
->num_aces
; i
++) {
699 SMB_ACE4PROP_T ace_v4
;
700 bool addNewACE
= True
;
702 if (!smbacl4_fill_ace4(mem_ctx
, filename
, pparams
,
704 dacl
->aces
+ i
, &ace_v4
)) {
705 DEBUG(3, ("Could not fill ace for file %s, SID %s\n",
707 sid_string_dbg(&((dacl
->aces
+i
)->trustee
))));
711 if (pparams
->acedup
!=e_dontcare
) {
712 if (smbacl4_MergeIgnoreReject(pparams
->acedup
, theacl
,
713 &ace_v4
, &addNewACE
, i
))
718 smb_add_ace4(theacl
, &ace_v4
);
724 NTSTATUS
smb_set_nt_acl_nfs4(files_struct
*fsp
,
725 uint32 security_info_sent
,
726 const struct security_descriptor
*psd
,
727 set_nfs4acl_native_fn_t set_nfs4_native
)
729 smbacl4_vfs_params params
;
730 SMB4ACL_T
*theacl
= NULL
;
733 SMB_STRUCT_STAT sbuf
;
734 bool set_acl_as_root
= false;
735 uid_t newUID
= (uid_t
)-1;
736 gid_t newGID
= (gid_t
)-1;
739 DEBUG(10, ("smb_set_nt_acl_nfs4 invoked for %s\n", fsp_str_dbg(fsp
)));
741 if ((security_info_sent
& (SECINFO_DACL
|
742 SECINFO_GROUP
| SECINFO_OWNER
)) == 0)
744 DEBUG(9, ("security_info_sent (0x%x) ignored\n",
745 security_info_sent
));
746 return NT_STATUS_OK
; /* won't show error - later to be refined... */
749 /* Special behaviours */
750 if (smbacl4_get_vfs_params(SMBACL4_PARAM_TYPE_NAME
, fsp
, ¶ms
))
751 return NT_STATUS_NO_MEMORY
;
753 if (smbacl4_fGetFileOwner(fsp
, &sbuf
))
754 return map_nt_error_from_unix(errno
);
756 if (params
.do_chown
) {
757 /* chown logic is a copy/paste from posix_acl.c:set_nt_acl */
758 NTSTATUS status
= unpack_nt_owners(fsp
->conn
, &newUID
, &newGID
, security_info_sent
, psd
);
759 if (!NT_STATUS_IS_OK(status
)) {
760 DEBUG(8, ("unpack_nt_owners failed"));
763 if (((newUID
!= (uid_t
)-1) && (sbuf
.st_ex_uid
!= newUID
)) ||
764 ((newGID
!= (gid_t
)-1) && (sbuf
.st_ex_gid
!= newGID
))) {
766 if(try_chown(fsp
->conn
, fsp
->fsp_name
, newUID
,
768 DEBUG(3,("chown %s, %u, %u failed. Error = "
769 "%s.\n", fsp_str_dbg(fsp
),
770 (unsigned int)newUID
,
771 (unsigned int)newGID
,
773 return map_nt_error_from_unix(errno
);
776 DEBUG(10,("chown %s, %u, %u succeeded.\n",
777 fsp_str_dbg(fsp
), (unsigned int)newUID
,
778 (unsigned int)newGID
));
779 if (smbacl4_GetFileOwner(fsp
->conn
,
780 fsp
->fsp_name
->base_name
,
782 return map_nt_error_from_unix(errno
);
784 /* If we successfully chowned, we know we must
785 * be able to set the acl, so do it as root.
787 set_acl_as_root
= true;
791 if (!(security_info_sent
& SECINFO_DACL
) || psd
->dacl
==NULL
) {
792 DEBUG(10, ("no dacl found; security_info_sent = 0x%x\n", security_info_sent
));
796 theacl
= smbacl4_win2nfs4(fsp
->fsp_name
->base_name
, psd
->dacl
, ¶ms
,
797 sbuf
.st_ex_uid
, sbuf
.st_ex_gid
);
799 return map_nt_error_from_unix(errno
);
801 smbacl4_dump_nfs4acl(10, theacl
);
803 if (set_acl_as_root
) {
806 result
= set_nfs4_native(fsp
, theacl
);
808 if (set_acl_as_root
) {
813 DEBUG(10, ("set_nfs4_native failed with %s\n", strerror(errno
)));
814 return map_nt_error_from_unix(errno
);
817 DEBUG(10, ("smb_set_nt_acl_nfs4 succeeded\n"));