2 * Unix SMB/Netbios implementation.
3 * VFS module to get and set HP-UX ACLs
4 * Copyright (C) Michael Adam 2006,2008
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 * This module supports JFS (POSIX) ACLs on VxFS (Veritas * Filesystem).
22 * These are available on HP-UX 11.00 if JFS 3.3 is installed.
23 * On HP-UX 11i (11.11 and above) these ACLs are supported out of
26 * There is another form of ACLs on HFS. These ACLs have a
27 * completely different API and their own set of userland tools.
28 * Since HFS seems to be considered deprecated, HFS acls
29 * are not supported. (They could be supported through a separate
30 * vfs-module if there is demand.)
33 /* =================================================================
36 * The original hpux-acl code in lib/sysacls.c was based upon the
37 * solaris acl code in the same file. Now for the new modularized
38 * acl implementation, I have taken the code from vfs_solarisacls.c
39 * and did similar adaptations as were done before, essentially
40 * reusing the original internal aclsort functions.
41 * The check for the presence of the acl() call has been adopted, and
42 * a check for the presence of the aclsort() call has been added.
44 * Michael Adam <obnox@samba.org>
46 * ================================================================= */
52 * including standard header <sys/aclv.h>
54 * included here as a quick hack for the special HP-UX-situation:
56 * The problem is that, on HP-UX, jfs/posix acls are
57 * defined in <sys/aclv.h>, while the deprecated hfs acls
58 * are defined inside <sys/acl.h>.
61 /* GROUP is defined somewhere else so undef it here... */
64 /* dl.h: needed to check for acl call via shl_findsym */
67 typedef struct acl HPUX_ACE_T
;
68 typedef struct acl
*HPUX_ACL_T
;
69 typedef int HPUX_ACL_TAG_T
; /* the type of an ACL entry */
70 typedef ushort HPUX_PERM_T
;
72 /* Structure to capture the count for each type of ACE.
73 * (for hpux_internal_aclsort */
74 struct hpux_acl_types
{
95 /* for convenience: check if hpux acl entry is a default entry? */
96 #define _IS_DEFAULT(ace) ((ace).a_type & ACL_DEFAULT)
97 #define _IS_OF_TYPE(ace, type) ( \
98 (((type) == SMB_ACL_TYPE_ACCESS) && !_IS_DEFAULT(ace)) \
100 (((type) == SMB_ACL_TYPE_DEFAULT) && _IS_DEFAULT(ace)) \
104 /* prototypes for private functions */
106 static HPUX_ACL_T
hpux_acl_init(int count
);
107 static bool smb_acl_to_hpux_acl(SMB_ACL_T smb_acl
,
108 HPUX_ACL_T
*solariacl
, int *count
,
109 SMB_ACL_TYPE_T type
);
110 static SMB_ACL_T
hpux_acl_to_smb_acl(HPUX_ACL_T hpuxacl
, int count
,
111 SMB_ACL_TYPE_T type
);
112 static HPUX_ACL_TAG_T
smb_tag_to_hpux_tag(SMB_ACL_TAG_T smb_tag
);
113 static SMB_ACL_TAG_T
hpux_tag_to_smb_tag(HPUX_ACL_TAG_T hpux_tag
);
114 static bool hpux_add_to_acl(HPUX_ACL_T
*hpux_acl
, int *count
,
115 HPUX_ACL_T add_acl
, int add_count
, SMB_ACL_TYPE_T type
);
116 static bool hpux_acl_get_file(const char *name
, HPUX_ACL_T
*hpuxacl
,
118 static SMB_ACL_PERM_T
hpux_perm_to_smb_perm(const HPUX_PERM_T perm
);
119 static HPUX_PERM_T
smb_perm_to_hpux_perm(const SMB_ACL_PERM_T perm
);
121 static bool hpux_acl_check(HPUX_ACL_T hpux_acl
, int count
);
123 /* aclsort (internal) and helpers: */
124 static bool hpux_acl_sort(HPUX_ACL_T acl
, int count
);
125 static int hpux_internal_aclsort(int acl_count
, int calclass
, HPUX_ACL_T aclp
);
126 static void hpux_count_obj(int acl_count
, HPUX_ACL_T aclp
,
127 struct hpux_acl_types
*acl_type_count
);
128 static void hpux_swap_acl_entries(HPUX_ACE_T
*aclp0
, HPUX_ACE_T
*aclp1
);
129 static bool hpux_prohibited_duplicate_type(int acl_type
);
131 static bool hpux_acl_call_present(void);
132 static bool hpux_aclsort_call_present(void);
135 /* public functions - the api */
137 SMB_ACL_T
hpuxacl_sys_acl_get_file(vfs_handle_struct
*handle
,
141 SMB_ACL_T result
= NULL
;
143 HPUX_ACL_T hpux_acl
= NULL
;
145 DEBUG(10, ("hpuxacl_sys_acl_get_file called for file '%s'.\n",
148 if(hpux_acl_call_present() == False
) {
149 /* Looks like we don't have the acl() system call on HPUX.
150 * May be the system doesn't have the latest version of JFS.
155 if (type
!= SMB_ACL_TYPE_ACCESS
&& type
!= SMB_ACL_TYPE_DEFAULT
) {
156 DEBUG(10, ("invalid SMB_ACL_TYPE given (%d)\n", type
));
161 DEBUGADD(10, ("getting %s acl\n",
162 ((type
== SMB_ACL_TYPE_ACCESS
) ? "access" : "default")));
164 if (!hpux_acl_get_file(path_p
, &hpux_acl
, &count
)) {
167 result
= hpux_acl_to_smb_acl(hpux_acl
, count
, type
);
168 if (result
== NULL
) {
169 DEBUG(10, ("conversion hpux_acl -> smb_acl failed (%s).\n",
174 DEBUG(10, ("hpuxacl_sys_acl_get_file %s.\n",
175 ((result
== NULL
) ? "failed" : "succeeded" )));
182 * get the access ACL of a file referred to by a fd
184 SMB_ACL_T
hpuxacl_sys_acl_get_fd(vfs_handle_struct
*handle
,
188 * HPUX doesn't have the facl call. Fake it using the path.... JRA.
190 /* For all I see, the info should already be in the fsp
191 * parameter, but get it again to be safe --- necessary? */
192 files_struct
*file_struct_p
= file_find_fd(fsp
->conn
->sconn
,
194 if (file_struct_p
== NULL
) {
199 * We know we're in the same conn context. So we
200 * can use the relative path.
202 DEBUG(10, ("redirecting call of hpuxacl_sys_acl_get_fd to "
203 "hpuxacl_sys_acl_get_file (no facl syscall on HPUX).\n"));
205 return hpuxacl_sys_acl_get_file(handle
,
206 file_struct_p
->fsp_name
->base_name
,
207 SMB_ACL_TYPE_ACCESS
);
211 int hpuxacl_sys_acl_set_file(vfs_handle_struct
*handle
,
217 HPUX_ACL_T hpux_acl
= NULL
;
219 struct smb_filename
*smb_fname
= NULL
;
222 DEBUG(10, ("hpuxacl_sys_acl_set_file called for file '%s'\n",
225 status
= create_synthetic_smb_fname(talloc_tos(), name
, NULL
, NULL
,
227 if (!NT_STATUS_IS_OK(status
)) {
231 if(hpux_acl_call_present() == False
) {
232 /* Looks like we don't have the acl() system call on HPUX.
233 * May be the system doesn't have the latest version of JFS.
238 if ((type
!= SMB_ACL_TYPE_ACCESS
) && (type
!= SMB_ACL_TYPE_DEFAULT
)) {
240 DEBUG(10, ("invalid smb acl type given (%d).\n", type
));
243 DEBUGADD(10, ("setting %s acl\n",
244 ((type
== SMB_ACL_TYPE_ACCESS
) ? "access" : "default")));
246 if(!smb_acl_to_hpux_acl(theacl
, &hpux_acl
, &count
, type
)) {
247 DEBUG(10, ("conversion smb_acl -> hpux_acl failed (%s).\n",
253 * if the file is a directory, there is extra work to do:
254 * since the hpux acl call stores both the access acl and
255 * the default acl as provided, we have to get the acl part
256 * that has _not_ been specified in "type" from the file first
257 * and concatenate it with the acl provided.
259 if (lp_posix_pathnames()) {
260 ret
= SMB_VFS_LSTAT(handle
->conn
, smb_fname
);
262 ret
= SMB_VFS_STAT(handle
->conn
, smb_fname
);
265 DEBUG(10, ("Error in stat call: %s\n", strerror(errno
)));
268 if (S_ISDIR(smb_fname
->st
.st_ex_mode
)) {
269 HPUX_ACL_T other_acl
;
271 SMB_ACL_TYPE_T other_type
;
273 other_type
= (type
== SMB_ACL_TYPE_ACCESS
)
274 ? SMB_ACL_TYPE_DEFAULT
275 : SMB_ACL_TYPE_ACCESS
;
276 DEBUGADD(10, ("getting acl from filesystem\n"));
277 if (!hpux_acl_get_file(smb_fname
->base_name
, &other_acl
,
279 DEBUG(10, ("error getting acl from directory\n"));
282 DEBUG(10, ("adding %s part of fs acl to given acl\n",
283 ((other_type
== SMB_ACL_TYPE_ACCESS
)
286 if (!hpux_add_to_acl(&hpux_acl
, &count
, other_acl
,
287 other_count
, other_type
))
289 DEBUG(10, ("error adding other acl.\n"));
290 SAFE_FREE(other_acl
);
293 SAFE_FREE(other_acl
);
295 else if (type
!= SMB_ACL_TYPE_ACCESS
) {
300 if (!hpux_acl_sort(hpux_acl
, count
)) {
301 DEBUG(10, ("resulting acl is not valid!\n"));
304 DEBUG(10, ("resulting acl is valid.\n"));
306 ret
= acl(CONST_DISCARD(char *, smb_fname
->base_name
), ACL_SET
, count
,
309 DEBUG(0, ("ERROR calling acl: %s\n", strerror(errno
)));
313 DEBUG(10, ("hpuxacl_sys_acl_set_file %s.\n",
314 ((ret
!= 0) ? "failed" : "succeeded")));
315 TALLOC_FREE(smb_fname
);
321 * set the access ACL on the file referred to by a fd
323 int hpuxacl_sys_acl_set_fd(vfs_handle_struct
*handle
,
328 * HPUX doesn't have the facl call. Fake it using the path.... JRA.
330 /* For all I see, the info should already be in the fsp
331 * parameter, but get it again to be safe --- necessary? */
332 files_struct
*file_struct_p
= file_find_fd(fsp
->conn
->sconn
,
334 if (file_struct_p
== NULL
) {
339 * We know we're in the same conn context. So we
340 * can use the relative path.
342 DEBUG(10, ("redirecting call of hpuxacl_sys_acl_set_fd to "
343 "hpuxacl_sys_acl_set_file (no facl syscall on HPUX)\n"));
345 return hpuxacl_sys_acl_set_file(handle
,
346 file_struct_p
->fsp_name
->base_name
,
347 SMB_ACL_TYPE_ACCESS
, theacl
);
352 * delete the default ACL of a directory
354 * This is achieved by fetching the access ACL and rewriting it
355 * directly, via the hpux system call: the ACL_SET call on
356 * directories writes both the access and the default ACL as provided.
358 * XXX: posix acl_delete_def_file returns an error if
359 * the file referred to by path is not a directory.
360 * this function does not complain but the actions
361 * have no effect on a file other than a directory.
362 * But sys_acl_delete_default_file is only called in
363 * smbd/posixacls.c after having checked that the file
364 * is a directory, anyways. So implementing the extra
365 * check is considered unnecessary. --- Agreed? XXX
367 int hpuxacl_sys_acl_delete_def_file(vfs_handle_struct
*handle
,
375 DEBUG(10, ("entering hpuxacl_sys_acl_delete_def_file.\n"));
377 smb_acl
= hpuxacl_sys_acl_get_file(handle
, path
,
378 SMB_ACL_TYPE_ACCESS
);
379 if (smb_acl
== NULL
) {
380 DEBUG(10, ("getting file acl failed!\n"));
383 if (!smb_acl_to_hpux_acl(smb_acl
, &hpux_acl
, &count
,
384 SMB_ACL_TYPE_ACCESS
))
386 DEBUG(10, ("conversion smb_acl -> hpux_acl failed.\n"));
389 if (!hpux_acl_sort(hpux_acl
, count
)) {
390 DEBUG(10, ("resulting acl is not valid!\n"));
393 ret
= acl(CONST_DISCARD(char *, path
), ACL_SET
, count
, hpux_acl
);
395 DEBUG(10, ("settinge file acl failed!\n"));
399 DEBUG(10, ("hpuxacl_sys_acl_delete_def_file %s.\n",
400 ((ret
!= 0) ? "failed" : "succeeded" )));
410 static HPUX_ACL_T
hpux_acl_init(int count
)
412 HPUX_ACL_T hpux_acl
=
413 (HPUX_ACL_T
)SMB_MALLOC(sizeof(HPUX_ACE_T
) * count
);
414 if (hpux_acl
== NULL
) {
421 * Convert the SMB acl to the ACCESS or DEFAULT part of a
422 * hpux ACL, as desired.
424 static bool smb_acl_to_hpux_acl(SMB_ACL_T smb_acl
,
425 HPUX_ACL_T
*hpux_acl
, int *count
,
430 int check_which
, check_rc
;
432 DEBUG(10, ("entering smb_acl_to_hpux_acl\n"));
437 for (i
= 0; i
< smb_acl
->count
; i
++) {
438 const struct smb_acl_entry
*smb_entry
= &(smb_acl
->acl
[i
]);
439 HPUX_ACE_T hpux_entry
;
441 ZERO_STRUCT(hpux_entry
);
443 hpux_entry
.a_type
= smb_tag_to_hpux_tag(smb_entry
->a_type
);
444 if (hpux_entry
.a_type
== 0) {
445 DEBUG(10, ("smb_tag to hpux_tag failed\n"));
448 switch(hpux_entry
.a_type
) {
450 DEBUG(10, ("got tag type USER with uid %d\n",
452 hpux_entry
.a_id
= (uid_t
)smb_entry
->uid
;
455 DEBUG(10, ("got tag type GROUP with gid %d\n",
457 hpux_entry
.a_id
= (uid_t
)smb_entry
->gid
;
462 if (type
== SMB_ACL_TYPE_DEFAULT
) {
463 DEBUG(10, ("adding default bit to hpux ace\n"));
464 hpux_entry
.a_type
|= ACL_DEFAULT
;
468 smb_perm_to_hpux_perm(smb_entry
->a_perm
);
469 DEBUG(10, ("assembled the following hpux ace:\n"));
470 DEBUGADD(10, (" - type: 0x%04x\n", hpux_entry
.a_type
));
471 DEBUGADD(10, (" - id: %d\n", hpux_entry
.a_id
));
472 DEBUGADD(10, (" - perm: o%o\n", hpux_entry
.a_perm
));
473 if (!hpux_add_to_acl(hpux_acl
, count
, &hpux_entry
,
476 DEBUG(10, ("error adding acl entry\n"));
479 DEBUG(10, ("count after adding: %d (i: %d)\n", *count
, i
));
480 DEBUG(10, ("test, if entry has been copied into acl:\n"));
481 DEBUGADD(10, (" - type: 0x%04x\n",
482 (*hpux_acl
)[(*count
)-1].a_type
));
483 DEBUGADD(10, (" - id: %d\n",
484 (*hpux_acl
)[(*count
)-1].a_id
));
485 DEBUGADD(10, (" - perm: o%o\n",
486 (*hpux_acl
)[(*count
)-1].a_perm
));
493 SAFE_FREE(*hpux_acl
);
495 DEBUG(10, ("smb_acl_to_hpux_acl %s\n",
496 ((ret
== True
) ? "succeeded" : "failed")));
501 * convert either the access or the default part of a
502 * soaris acl to the SMB_ACL format.
504 static SMB_ACL_T
hpux_acl_to_smb_acl(HPUX_ACL_T hpux_acl
, int count
,
510 if ((result
= sys_acl_init(0)) == NULL
) {
511 DEBUG(10, ("error allocating memory for SMB_ACL\n"));
514 for (i
= 0; i
< count
; i
++) {
515 SMB_ACL_ENTRY_T smb_entry
;
516 SMB_ACL_PERM_T smb_perm
;
518 if (!_IS_OF_TYPE(hpux_acl
[i
], type
)) {
521 result
= SMB_REALLOC(result
,
522 sizeof(struct smb_acl_t
) +
523 (sizeof(struct smb_acl_entry
) *
524 (result
->count
+ 1)));
525 if (result
== NULL
) {
526 DEBUG(10, ("error reallocating memory for SMB_ACL\n"));
529 smb_entry
= &result
->acl
[result
->count
];
530 if (sys_acl_set_tag_type(smb_entry
,
531 hpux_tag_to_smb_tag(hpux_acl
[i
].a_type
)) != 0)
533 DEBUG(10, ("invalid tag type given: 0x%04x\n",
534 hpux_acl
[i
].a_type
));
537 /* intentionally not checking return code here: */
538 sys_acl_set_qualifier(smb_entry
, (void *)&hpux_acl
[i
].a_id
);
539 smb_perm
= hpux_perm_to_smb_perm(hpux_acl
[i
].a_perm
);
540 if (sys_acl_set_permset(smb_entry
, &smb_perm
) != 0) {
541 DEBUG(10, ("invalid permset given: %d\n",
542 hpux_acl
[i
].a_perm
));
552 DEBUG(10, ("hpux_acl_to_smb_acl %s\n",
553 ((result
== NULL
) ? "failed" : "succeeded")));
559 static HPUX_ACL_TAG_T
smb_tag_to_hpux_tag(SMB_ACL_TAG_T smb_tag
)
561 HPUX_ACL_TAG_T hpux_tag
= 0;
563 DEBUG(10, ("smb_tag_to_hpux_tag\n"));
564 DEBUGADD(10, (" --> got smb tag 0x%04x\n", smb_tag
));
570 case SMB_ACL_USER_OBJ
:
576 case SMB_ACL_GROUP_OBJ
:
577 hpux_tag
= GROUP_OBJ
;
580 hpux_tag
= OTHER_OBJ
;
583 hpux_tag
= CLASS_OBJ
;
586 DEBUGADD(10, (" !!! unknown smb tag type 0x%04x\n", smb_tag
));
590 DEBUGADD(10, (" --> determined hpux tag 0x%04x\n", hpux_tag
));
595 static SMB_ACL_TAG_T
hpux_tag_to_smb_tag(HPUX_ACL_TAG_T hpux_tag
)
597 SMB_ACL_TAG_T smb_tag
= 0;
599 DEBUG(10, ("hpux_tag_to_smb_tag:\n"));
600 DEBUGADD(10, (" --> got hpux tag 0x%04x\n", hpux_tag
));
602 hpux_tag
&= ~ACL_DEFAULT
;
606 smb_tag
= SMB_ACL_USER
;
609 smb_tag
= SMB_ACL_USER_OBJ
;
612 smb_tag
= SMB_ACL_GROUP
;
615 smb_tag
= SMB_ACL_GROUP_OBJ
;
618 smb_tag
= SMB_ACL_OTHER
;
621 smb_tag
= SMB_ACL_MASK
;
624 DEBUGADD(10, (" !!! unknown hpux tag type: 0x%04x\n",
629 DEBUGADD(10, (" --> determined smb tag 0x%04x\n", smb_tag
));
636 * The permission bits used in the following two permission conversion
637 * functions are same, but the functions make us independent of the concrete
638 * permission data types.
640 static SMB_ACL_PERM_T
hpux_perm_to_smb_perm(const HPUX_PERM_T perm
)
642 SMB_ACL_PERM_T smb_perm
= 0;
643 smb_perm
|= ((perm
& SMB_ACL_READ
) ? SMB_ACL_READ
: 0);
644 smb_perm
|= ((perm
& SMB_ACL_WRITE
) ? SMB_ACL_WRITE
: 0);
645 smb_perm
|= ((perm
& SMB_ACL_EXECUTE
) ? SMB_ACL_EXECUTE
: 0);
650 static HPUX_PERM_T
smb_perm_to_hpux_perm(const SMB_ACL_PERM_T perm
)
652 HPUX_PERM_T hpux_perm
= 0;
653 hpux_perm
|= ((perm
& SMB_ACL_READ
) ? SMB_ACL_READ
: 0);
654 hpux_perm
|= ((perm
& SMB_ACL_WRITE
) ? SMB_ACL_WRITE
: 0);
655 hpux_perm
|= ((perm
& SMB_ACL_EXECUTE
) ? SMB_ACL_EXECUTE
: 0);
660 static bool hpux_acl_get_file(const char *name
, HPUX_ACL_T
*hpux_acl
,
664 static HPUX_ACE_T dummy_ace
;
666 DEBUG(10, ("hpux_acl_get_file called for file '%s'\n", name
));
669 * The original code tries some INITIAL_ACL_SIZE
670 * and only did the ACL_CNT call upon failure
671 * (for performance reasons).
672 * For the sake of simplicity, I skip this for now.
674 * NOTE: There is a catch here on HP-UX: acl with cmd parameter
675 * ACL_CNT fails with errno EINVAL when called with a NULL
676 * pointer as last argument. So we need to use a dummy acl
677 * struct here (we make it static so it does not need to be
678 * instantiated or malloced each time this function is
679 * called). Btw: the count parameter does not seem to matter...
681 *count
= acl(CONST_DISCARD(char *, name
), ACL_CNT
, 0, &dummy_ace
);
683 DEBUG(10, ("acl ACL_CNT failed: %s\n", strerror(errno
)));
686 *hpux_acl
= hpux_acl_init(*count
);
687 if (*hpux_acl
== NULL
) {
688 DEBUG(10, ("error allocating memory for hpux acl...\n"));
691 *count
= acl(CONST_DISCARD(char *, name
), ACL_GET
, *count
, *hpux_acl
);
693 DEBUG(10, ("acl ACL_GET failed: %s\n", strerror(errno
)));
699 DEBUG(10, ("hpux_acl_get_file %s.\n",
700 ((result
== True
) ? "succeeded" : "failed" )));
708 * Add entries to a hpux ACL.
710 * Entries are directly added to the hpuxacl parameter.
711 * if memory allocation fails, this may result in hpuxacl
712 * being NULL. if the resulting acl is to be checked and is
713 * not valid, it is kept in hpuxacl but False is returned.
715 * The type of ACEs (access/default) to be added to the ACL can
716 * be selected via the type parameter.
717 * I use the SMB_ACL_TYPE_T type here. Since SMB_ACL_TYPE_ACCESS
718 * is defined as "0", this means that one can only add either
719 * access or default ACEs from the given ACL, not both at the same
720 * time. If it should become necessary to add all of an ACL, one
721 * would have to replace this parameter by another type.
723 static bool hpux_add_to_acl(HPUX_ACL_T
*hpux_acl
, int *count
,
724 HPUX_ACL_T add_acl
, int add_count
,
729 if ((type
!= SMB_ACL_TYPE_ACCESS
) && (type
!= SMB_ACL_TYPE_DEFAULT
))
731 DEBUG(10, ("invalid acl type given: %d\n", type
));
735 for (i
= 0; i
< add_count
; i
++) {
736 if (!_IS_OF_TYPE(add_acl
[i
], type
)) {
739 ADD_TO_ARRAY(NULL
, HPUX_ACE_T
, add_acl
[i
],
741 if (hpux_acl
== NULL
) {
742 DEBUG(10, ("error enlarging acl.\n"));
752 * sort the ACL and check it for validity
754 * [original comment from lib/sysacls.c:]
756 * if it's a minimal ACL with only 4 entries then we
757 * need to recalculate the mask permissions to make
758 * sure that they are the same as the GROUP_OBJ
759 * permissions as required by the UnixWare acl() system call.
761 * (note: since POSIX allows minimal ACLs which only contain
762 * 3 entries - ie there is no mask entry - we should, in theory,
763 * check for this and add a mask entry if necessary - however
764 * we "know" that the caller of this interface always specifies
765 * a mask, so in practice "this never happens" (tm) - if it *does*
766 * happen aclsort() will fail and return an error and someone will
769 static bool hpux_acl_sort(HPUX_ACL_T hpux_acl
, int count
)
771 int fixmask
= (count
<= 4);
773 if (hpux_internal_aclsort(count
, fixmask
, hpux_acl
) != 0) {
782 * Helpers for hpux_internal_aclsort:
784 * - hpux_swap_acl_entries
785 * - hpux_prohibited_duplicate_type
786 * - hpux_get_needed_class_perm
790 * Counts the different number of objects in a given array of ACL
794 * acl_count - Count of ACLs in the array of ACL strucutres.
795 * aclp - Array of ACL structures.
796 * acl_type_count - Pointer to acl_types structure. Should already be
800 * acl_type_count - This structure is filled up with counts of various
804 static void hpux_count_obj(int acl_count
, HPUX_ACL_T aclp
, struct hpux_acl_types
*acl_type_count
)
808 memset(acl_type_count
, 0, sizeof(struct hpux_acl_types
));
810 for(i
=0;i
<acl_count
;i
++) {
811 switch(aclp
[i
].a_type
) {
813 acl_type_count
->n_user
++;
816 acl_type_count
->n_user_obj
++;
819 acl_type_count
->n_def_user_obj
++;
822 acl_type_count
->n_group
++;
825 acl_type_count
->n_group_obj
++;
828 acl_type_count
->n_def_group_obj
++;
831 acl_type_count
->n_other_obj
++;
834 acl_type_count
->n_def_other_obj
++;
837 acl_type_count
->n_class_obj
++;
840 acl_type_count
->n_def_class_obj
++;
843 acl_type_count
->n_def_user
++;
846 acl_type_count
->n_def_group
++;
849 acl_type_count
->n_illegal_obj
++;
855 /* hpux_swap_acl_entries: Swaps two ACL entries.
857 * Inputs: aclp0, aclp1 - ACL entries to be swapped.
860 static void hpux_swap_acl_entries(HPUX_ACE_T
*aclp0
, HPUX_ACE_T
*aclp1
)
864 temp_acl
.a_type
= aclp0
->a_type
;
865 temp_acl
.a_id
= aclp0
->a_id
;
866 temp_acl
.a_perm
= aclp0
->a_perm
;
868 aclp0
->a_type
= aclp1
->a_type
;
869 aclp0
->a_id
= aclp1
->a_id
;
870 aclp0
->a_perm
= aclp1
->a_perm
;
872 aclp1
->a_type
= temp_acl
.a_type
;
873 aclp1
->a_id
= temp_acl
.a_id
;
874 aclp1
->a_perm
= temp_acl
.a_perm
;
877 /* hpux_prohibited_duplicate_type
878 * Identifies if given ACL type can have duplicate entries or
881 * Inputs: acl_type - ACL Type.
887 * True - If the ACL type matches any of the prohibited types.
888 * False - If the ACL type doesn't match any of the prohibited types.
891 static bool hpux_prohibited_duplicate_type(int acl_type
)
904 /* hpux_get_needed_class_perm
905 * Returns the permissions of a ACL structure only if the ACL
906 * type matches one of the pre-determined types for computing
907 * CLASS_OBJ permissions.
909 * Inputs: aclp - Pointer to ACL structure.
912 static int hpux_get_needed_class_perm(struct acl
*aclp
)
914 switch(aclp
->a_type
) {
930 /* hpux_internal_aclsort: aclsort for HPUX.
932 * -> The aclsort() system call is availabe on the latest HPUX General
933 * -> Patch Bundles. So for HPUX, we developed our version of aclsort
934 * -> function. Because, we don't want to update to a new
935 * -> HPUX GR bundle just for aclsort() call.
937 * aclsort sorts the array of ACL structures as per the description in
938 * aclsort man page. Refer to aclsort man page for more details
942 * acl_count - Count of ACLs in the array of ACL structures.
943 * calclass - If this is not zero, then we compute the CLASS_OBJ
945 * aclp - Array of ACL structures.
949 * aclp - Sorted array of ACL structures.
953 * Returns 0 for success -1 for failure. Prints a message to the Samba
954 * debug log in case of failure.
957 static int hpux_internal_aclsort(int acl_count
, int calclass
, HPUX_ACL_T aclp
)
959 struct hpux_acl_types acl_obj_count
;
960 int n_class_obj_perm
= 0;
963 DEBUG(10,("Entering hpux_internal_aclsort. (calclass = %d)\n", calclass
));
965 if (hpux_aclsort_call_present()) {
966 DEBUG(10, ("calling hpux aclsort\n"));
967 return aclsort(acl_count
, calclass
, aclp
);
970 DEBUG(10, ("using internal aclsort\n"));
973 DEBUG(10,("Zero acl count passed. Returning Success\n"));
978 DEBUG(0,("Null ACL pointer in hpux_acl_sort. Returning Failure. \n"));
982 /* Count different types of ACLs in the ACLs array */
984 hpux_count_obj(acl_count
, aclp
, &acl_obj_count
);
986 /* There should be only one entry each of type USER_OBJ, GROUP_OBJ,
987 * CLASS_OBJ and OTHER_OBJ
990 if ( (acl_obj_count
.n_user_obj
!= 1) ||
991 (acl_obj_count
.n_group_obj
!= 1) ||
992 (acl_obj_count
.n_class_obj
!= 1) ||
993 (acl_obj_count
.n_other_obj
!= 1) )
995 DEBUG(0,("hpux_internal_aclsort: More than one entry or no entries for \
996 USER OBJ or GROUP_OBJ or OTHER_OBJ or CLASS_OBJ\n"));
1000 /* If any of the default objects are present, there should be only
1004 if ( (acl_obj_count
.n_def_user_obj
> 1) ||
1005 (acl_obj_count
.n_def_group_obj
> 1) ||
1006 (acl_obj_count
.n_def_other_obj
> 1) ||
1007 (acl_obj_count
.n_def_class_obj
> 1) )
1009 DEBUG(0,("hpux_internal_aclsort: More than one entry for DEF_CLASS_OBJ \
1010 or DEF_USER_OBJ or DEF_GROUP_OBJ or DEF_OTHER_OBJ\n"));
1014 /* We now have proper number of OBJ and DEF_OBJ entries. Now sort the acl
1017 * Sorting crieteria - First sort by ACL type. If there are multiple entries of
1018 * same ACL type, sort by ACL id.
1020 * I am using the trival kind of sorting method here because, performance isn't
1021 * really effected by the ACLs feature. More over there aren't going to be more
1022 * than 17 entries on HPUX.
1025 for(i
=0; i
<acl_count
;i
++) {
1026 for (j
=i
+1; j
<acl_count
; j
++) {
1027 if( aclp
[i
].a_type
> aclp
[j
].a_type
) {
1028 /* ACL entries out of order, swap them */
1029 hpux_swap_acl_entries((aclp
+i
), (aclp
+j
));
1030 } else if ( aclp
[i
].a_type
== aclp
[j
].a_type
) {
1031 /* ACL entries of same type, sort by id */
1032 if(aclp
[i
].a_id
> aclp
[j
].a_id
) {
1033 hpux_swap_acl_entries((aclp
+i
), (aclp
+j
));
1034 } else if (aclp
[i
].a_id
== aclp
[j
].a_id
) {
1035 /* We have a duplicate entry. */
1036 if(hpux_prohibited_duplicate_type(aclp
[i
].a_type
)) {
1037 DEBUG(0, ("hpux_internal_aclsort: Duplicate entry: Type(hex): %x Id: %d\n",
1038 aclp
[i
].a_type
, aclp
[i
].a_id
));
1046 /* set the class obj permissions to the computed one. */
1048 int n_class_obj_index
= -1;
1050 for(i
=0;i
<acl_count
;i
++) {
1051 n_class_obj_perm
|= hpux_get_needed_class_perm((aclp
+i
));
1053 if(aclp
[i
].a_type
== CLASS_OBJ
)
1054 n_class_obj_index
= i
;
1056 aclp
[n_class_obj_index
].a_perm
= n_class_obj_perm
;
1064 * hpux_acl_call_present:
1066 * This checks if the POSIX ACL system call is defined
1067 * which basically corresponds to whether JFS 3.3 or
1068 * higher is installed. If acl() was called when it
1069 * isn't defined, it causes the process to core dump
1070 * so it is important to check this and avoid acl()
1071 * calls if it isn't there.
1074 static bool hpux_acl_call_present(void)
1077 shl_t handle
= NULL
;
1080 static bool already_checked
= False
;
1087 ret_val
= shl_findsym(&handle
, "acl", TYPE_PROCEDURE
, &value
);
1090 DEBUG(5, ("hpux_acl_call_present: shl_findsym() returned %d, errno = %d, error %s\n",
1091 ret_val
, errno
, strerror(errno
)));
1092 DEBUG(5,("hpux_acl_call_present: acl() system call is not present. Check if you have JFS 3.3 and above?\n"));
1097 DEBUG(10,("hpux_acl_call_present: acl() system call is present. We have JFS 3.3 or above \n"));
1099 already_checked
= True
;
1104 * runtime check for presence of aclsort library call.
1105 * same code as for acl call. if there are more of these,
1106 * a dispatcher function could be handy...
1109 static bool hpux_aclsort_call_present(void)
1111 shl_t handle
= NULL
;
1114 static bool already_checked
= False
;
1116 if (already_checked
) {
1121 ret_val
= shl_findsym(&handle
, "aclsort", TYPE_PROCEDURE
, &value
);
1123 DEBUG(5, ("hpux_aclsort_call_present: shl_findsym "
1124 "returned %d, errno = %d, error %s",
1125 ret_val
, errno
, strerror(errno
)));
1126 DEBUG(5, ("hpux_aclsort_call_present: "
1127 "aclsort() function not available.\n"));
1130 DEBUG(10,("hpux_aclsort_call_present: aclsort() function present.\n"));
1131 already_checked
= True
;
1137 * acl check function:
1138 * unused at the moment but could be used to get more
1139 * concrete error messages for debugging...
1140 * (acl sort just says that the acl is invalid...)
1142 static bool hpux_acl_check(HPUX_ACL_T hpux_acl
, int count
)
1147 check_rc
= aclcheck(hpux_acl
, count
, &check_which
);
1148 if (check_rc
!= 0) {
1149 DEBUG(10, ("acl is not valid:\n"));
1150 DEBUGADD(10, (" - return code: %d\n", check_rc
));
1151 DEBUGADD(10, (" - which: %d\n", check_which
));
1152 if (check_which
!= -1) {
1153 DEBUGADD(10, (" - invalid entry:\n"));
1154 DEBUGADD(10, (" * type: %d:\n",
1155 hpux_acl
[check_which
].a_type
));
1156 DEBUGADD(10, (" * id: %d\n",
1157 hpux_acl
[check_which
].a_id
));
1158 DEBUGADD(10, (" * perm: 0o%o\n",
1159 hpux_acl
[check_which
].a_perm
));
1167 /* VFS operations structure */
1169 static struct vfs_fn_pointers hpuxacl_fns
= {
1170 .sys_acl_get_file
= hpuxacl_sys_acl_get_file
,
1171 .sys_acl_get_fd
= hpuxacl_sys_acl_get_fd
,
1172 .sys_acl_set_file
= hpuxacl_sys_acl_set_file
,
1173 .sys_acl_set_fd
= hpuxacl_sys_acl_set_fd
,
1174 .sys_acl_delete_def_file
= hpuxacl_sys_acl_delete_def_file
,
1177 NTSTATUS
vfs_hpuxacl_init(void)
1179 return smb_register_vfs(SMB_VFS_INTERFACE_VERSION
, "hpuxacl",