2 Unix SMB/CIFS implementation.
3 Set NT and POSIX ACLs and other VFS operations from Python
5 Copyrigyt (C) Andrew Bartlett 2012
6 Copyright (C) Jeremy Allison 1994-2009.
7 Copyright (C) Andreas Gruenbacher 2002.
8 Copyright (C) Simo Sorce <idra@samba.org> 2009.
9 Copyright (C) Simo Sorce 2002
10 Copyright (C) Eric Lorimer 2002
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #include "smbd/smbd.h"
29 #include "libcli/util/pyerrors.h"
30 #include "librpc/rpc/pyrpc_util.h"
32 #include "system/filesys.h"
34 extern const struct generic_mapping file_generic_mapping
;
37 #define DBGC_CLASS DBGC_ACLS
39 static NTSTATUS
set_sys_acl_no_snum(const char *fname
,
40 SMB_ACL_TYPE_T acltype
,
43 connection_struct
*conn
;
44 NTSTATUS status
= NT_STATUS_OK
;
48 conn
= talloc_zero(NULL
, connection_struct
);
50 DEBUG(0, ("talloc failed\n"));
51 return NT_STATUS_NO_MEMORY
;
54 if (!(conn
->params
= talloc(conn
, struct share_params
))) {
55 DEBUG(0,("set_sys_acl_no_snum: talloc() failed!\n"));
57 return NT_STATUS_NO_MEMORY
;
60 /* we want total control over the permissions on created files,
61 so set our umask to 0 */
62 saved_umask
= umask(0);
64 conn
->params
->service
= -1;
66 set_conn_connectpath(conn
, "/");
70 ret
= SMB_VFS_SYS_ACL_SET_FILE( conn
, fname
, acltype
, theacl
);
72 status
= map_nt_error_from_unix_common(ret
);
73 DEBUG(0,("set_sys_acl_no_snum: SMB_VFS_SYS_ACL_SET_FILE "
84 static NTSTATUS
set_nt_acl_no_snum(const char *fname
,
85 uint32 security_info_sent
, const struct security_descriptor
*sd
)
87 TALLOC_CTX
*frame
= talloc_stackframe();
88 connection_struct
*conn
;
89 NTSTATUS status
= NT_STATUS_OK
;
91 struct smb_filename
*smb_fname
= NULL
;
95 if (!posix_locking_init(false)) {
97 return NT_STATUS_NO_MEMORY
;
100 conn
= talloc_zero(frame
, connection_struct
);
103 DEBUG(0, ("talloc failed\n"));
104 return NT_STATUS_NO_MEMORY
;
107 if (!(conn
->params
= talloc(conn
, struct share_params
))) {
108 DEBUG(0,("set_nt_acl_no_snum: talloc() failed!\n"));
110 return NT_STATUS_NO_MEMORY
;
113 fsp
= talloc_zero(frame
, struct files_struct
);
116 return NT_STATUS_NO_MEMORY
;
118 fsp
->fh
= talloc(fsp
, struct fd_handle
);
119 if (fsp
->fh
== NULL
) {
121 return NT_STATUS_NO_MEMORY
;
125 /* we want total control over the permissions on created files,
126 so set our umask to 0 */
127 saved_umask
= umask(0);
129 conn
->params
->service
= -1;
131 set_conn_connectpath(conn
, "/");
135 status
= create_synthetic_smb_fname_split(fsp
, fname
, NULL
,
137 if (!NT_STATUS_IS_OK(status
)) {
143 fsp
->fsp_name
= smb_fname
;
146 flags
= O_RDONLY
|O_DIRECTORY
;
148 /* POSIX allows us to open a directory with O_RDONLY. */
152 fsp
->fh
->fd
= SMB_VFS_OPEN(conn
, smb_fname
, fsp
, O_RDWR
, 00400);
153 if (fsp
->fh
->fd
== -1 && errno
== EISDIR
) {
154 fsp
->fh
->fd
= SMB_VFS_OPEN(conn
, smb_fname
, fsp
, flags
, 00400);
156 if (fsp
->fh
->fd
== -1) {
157 printf("open: error=%d (%s)\n", errno
, strerror(errno
));
160 return NT_STATUS_UNSUCCESSFUL
;
163 ret
= SMB_VFS_FSTAT(fsp
, &smb_fname
->st
);
165 /* If we have an fd, this stat should succeed. */
166 DEBUG(0,("Error doing fstat on open file %s "
168 smb_fname_str_dbg(smb_fname
),
172 return map_nt_error_from_unix(errno
);
175 fsp
->file_id
= vfs_file_id_from_sbuf(conn
, &smb_fname
->st
);
176 fsp
->vuid
= UID_FIELD_INVALID
;
178 fsp
->can_lock
= True
;
179 fsp
->can_read
= True
;
180 fsp
->can_write
= True
;
181 fsp
->print_file
= NULL
;
182 fsp
->modified
= False
;
183 fsp
->sent_oplock_break
= NO_BREAK_SENT
;
184 fsp
->is_directory
= S_ISDIR(smb_fname
->st
.st_ex_mode
);
186 status
= SMB_VFS_FSET_NT_ACL( fsp
, security_info_sent
, sd
);
187 if (!NT_STATUS_IS_OK(status
)) {
188 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned %s.\n", nt_errstr(status
)));
201 static SMB_ACL_T
make_simple_acl(gid_t gid
, mode_t chmod_mode
)
203 TALLOC_CTX
*frame
= talloc_stackframe();
205 mode_t mode
= SMB_ACL_READ
|SMB_ACL_WRITE
|SMB_ACL_EXECUTE
;
207 mode_t mode_user
= (chmod_mode
& 0700) >> 6;
208 mode_t mode_group
= (chmod_mode
& 070) >> 3;
209 mode_t mode_other
= chmod_mode
& 07;
210 SMB_ACL_ENTRY_T entry
;
211 SMB_ACL_T acl
= sys_acl_init(frame
);
217 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
222 if (sys_acl_set_tag_type(entry
, SMB_ACL_USER_OBJ
) != 0) {
227 if (sys_acl_set_permset(entry
, &mode_user
) != 0) {
232 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
237 if (sys_acl_set_tag_type(entry
, SMB_ACL_GROUP_OBJ
) != 0) {
242 if (sys_acl_set_permset(entry
, &mode_group
) != 0) {
247 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
252 if (sys_acl_set_tag_type(entry
, SMB_ACL_OTHER
) != 0) {
257 if (sys_acl_set_permset(entry
, &mode_other
) != 0) {
263 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
268 if (sys_acl_set_tag_type(entry
, SMB_ACL_GROUP
) != 0) {
273 if (sys_acl_set_qualifier(entry
, &gid
) != 0) {
278 if (sys_acl_set_permset(entry
, &mode_group
) != 0) {
284 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
289 if (sys_acl_set_tag_type(entry
, SMB_ACL_MASK
) != 0) {
294 if (sys_acl_set_permset(entry
, &mode
) != 0) {
302 set a simple ACL on a file, as a test
304 static PyObject
*py_smbd_set_simple_acl(PyObject
*self
, PyObject
*args
)
312 if (!PyArg_ParseTuple(args
, "si|i", &fname
, &mode
, &gid
))
315 acl
= make_simple_acl(gid
, mode
);
317 frame
= talloc_stackframe();
319 status
= set_sys_acl_no_snum(fname
, SMB_ACL_TYPE_ACCESS
, acl
);
324 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
332 static PyObject
*py_smbd_chown(PyObject
*self
, PyObject
*args
)
334 connection_struct
*conn
;
335 NTSTATUS status
= NT_STATUS_OK
;
343 if (!PyArg_ParseTuple(args
, "sii", &fname
, &uid
, &gid
))
346 frame
= talloc_stackframe();
348 conn
= talloc_zero(frame
, connection_struct
);
354 if (!(conn
->params
= talloc(conn
, struct share_params
))) {
359 /* we want total control over the permissions on created files,
360 so set our umask to 0 */
361 saved_umask
= umask(0);
363 conn
->params
->service
= -1;
365 set_conn_connectpath(conn
, "/");
369 ret
= SMB_VFS_CHOWN( conn
, fname
, uid
, gid
);
371 status
= map_nt_error_from_unix_common(errno
);
372 DEBUG(0,("chown returned failure: %s\n", strerror(errno
)));
381 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
389 static PyObject
*py_smbd_unlink(PyObject
*self
, PyObject
*args
)
391 connection_struct
*conn
;
392 NTSTATUS status
= NT_STATUS_OK
;
394 struct smb_filename
*smb_fname
= NULL
;
399 if (!PyArg_ParseTuple(args
, "s", &fname
))
402 frame
= talloc_stackframe();
404 conn
= talloc_zero(frame
, connection_struct
);
410 if (!(conn
->params
= talloc(conn
, struct share_params
))) {
415 /* we want total control over the permissions on created files,
416 so set our umask to 0 */
417 saved_umask
= umask(0);
419 conn
->params
->service
= -1;
421 set_conn_connectpath(conn
, "/");
425 status
= create_synthetic_smb_fname_split(frame
, fname
, NULL
,
427 if (!NT_STATUS_IS_OK(status
)) {
430 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
433 ret
= SMB_VFS_UNLINK(conn
, smb_fname
);
435 status
= map_nt_error_from_unix_common(errno
);
436 DEBUG(0,("unlink returned failure: %s\n", strerror(errno
)));
445 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
451 check if we have ACL support
453 static PyObject
*py_smbd_have_posix_acls(PyObject
*self
, PyObject
*args
)
455 #ifdef HAVE_POSIX_ACLS
456 return PyBool_FromLong(true);
458 return PyBool_FromLong(false);
463 set the NT ACL on a file
465 static PyObject
*py_smbd_set_nt_acl(PyObject
*self
, PyObject
*args
)
469 int security_info_sent
;
471 struct security_descriptor
*sd
;
473 if (!PyArg_ParseTuple(args
, "siO", &fname
, &security_info_sent
, &py_sd
))
476 if (!py_check_dcerpc_type(py_sd
, "samba.dcerpc.security", "descriptor")) {
480 sd
= pytalloc_get_type(py_sd
, struct security_descriptor
);
482 status
= set_nt_acl_no_snum(fname
, security_info_sent
, sd
);
483 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
489 Return the NT ACL on a file
491 static PyObject
*py_smbd_get_nt_acl(PyObject
*self
, PyObject
*args
)
494 int security_info_wanted
;
496 struct security_descriptor
*sd
;
497 TALLOC_CTX
*tmp_ctx
= talloc_new(NULL
);
500 if (!PyArg_ParseTuple(args
, "si", &fname
, &security_info_wanted
))
503 status
= get_nt_acl_no_snum(tmp_ctx
, fname
, security_info_wanted
, &sd
);
504 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
506 py_sd
= py_return_ndr_struct("samba.dcerpc.security", "descriptor", sd
, sd
);
508 talloc_free(tmp_ctx
);
514 set the posix (or similar) ACL on a file
516 static PyObject
*py_smbd_set_sys_acl(PyObject
*self
, PyObject
*args
)
521 struct smb_acl_t
*acl
;
524 if (!PyArg_ParseTuple(args
, "siO", &fname
, &acl_type
, &py_acl
))
527 if (!py_check_dcerpc_type(py_acl
, "samba.dcerpc.smb_acl", "t")) {
531 acl
= pytalloc_get_type(py_acl
, struct smb_acl_t
);
533 status
= set_sys_acl_no_snum(fname
, acl_type
, acl
);
534 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
540 Return the posix (or similar) ACL on a file
542 static PyObject
*py_smbd_get_sys_acl(PyObject
*self
, PyObject
*args
)
546 struct smb_acl_t
*acl
;
548 TALLOC_CTX
*frame
= talloc_stackframe();
549 connection_struct
*conn
;
550 NTSTATUS status
= NT_STATUS_OK
;
552 if (!PyArg_ParseTuple(args
, "si", &fname
, &acl_type
)) {
557 conn
= talloc_zero(frame
, connection_struct
);
559 DEBUG(0, ("talloc failed\n"));
565 if (!(conn
->params
= talloc(conn
, struct share_params
))) {
566 DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
572 conn
->params
->service
= -1;
574 set_conn_connectpath(conn
, "/");
578 acl
= SMB_VFS_SYS_ACL_GET_FILE( conn
, fname
, acl_type
, frame
);
581 status
= map_nt_error_from_unix_common(errno
);
582 DEBUG(0,("sys_acl_get_file returned NULL: %s\n", strerror(errno
)));
583 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
588 py_acl
= py_return_ndr_struct("samba.dcerpc.smb_acl", "t", acl
, acl
);
595 static PyMethodDef py_smbd_methods
[] = {
597 (PyCFunction
)py_smbd_have_posix_acls
, METH_VARARGS
,
600 (PyCFunction
)py_smbd_set_simple_acl
, METH_VARARGS
,
603 (PyCFunction
)py_smbd_set_nt_acl
, METH_VARARGS
,
606 (PyCFunction
)py_smbd_get_nt_acl
, METH_VARARGS
,
609 (PyCFunction
)py_smbd_get_sys_acl
, METH_VARARGS
,
612 (PyCFunction
)py_smbd_set_sys_acl
, METH_VARARGS
,
615 (PyCFunction
)py_smbd_chown
, METH_VARARGS
,
618 (PyCFunction
)py_smbd_unlink
, METH_VARARGS
,
628 m
= Py_InitModule3("smbd", py_smbd_methods
,
629 "Python bindings for the smbd file server.");