?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-auth Rename cryptic 'ptok' to security_token
[Samba.git] / source3 / modules / vfs_acl_common.c
blob003be02b9c19b5ace5f691ef62edb3845a2c639c
1 /*
2 * Store Windows ACLs in data store - common functions.
3 * #included into modules/vfs_acl_xattr.c and modules/vfs_acl_tdb.c
4 *
5 * Copyright (C) Volker Lendecke, 2008
6 * Copyright (C) Jeremy Allison, 2009
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "../libcli/security/security.h"
23 #include "../librpc/gen_ndr/ndr_security.h"
24
25 static NTSTATUS create_acl_blob(const struct security_descriptor *psd,
26 DATA_BLOB *pblob,
27 uint16_t hash_type,
28 uint8_t hash[XATTR_SD_HASH_SIZE]);
29
30 static NTSTATUS get_acl_blob(TALLOC_CTX *ctx,
31 vfs_handle_struct *handle,
32 files_struct *fsp,
33 const char *name,
34 DATA_BLOB *pblob);
35
36 static NTSTATUS store_acl_blob_fsp(vfs_handle_struct *handle,
37 files_struct *fsp,
38 DATA_BLOB *pblob);
39
40 #define HASH_SECURITY_INFO (SECINFO_OWNER | \
41 SECINFO_GROUP | \
42 SECINFO_DACL | \
43 SECINFO_SACL)
44
45 /*******************************************************************
46 Hash a security descriptor.
47 *******************************************************************/
48
49 static NTSTATUS hash_sd_sha256(struct security_descriptor *psd,
50 uint8_t *hash)
51 {
52 DATA_BLOB blob;
53 SHA256_CTX tctx;
54 NTSTATUS status;
55
56 memset(hash, '\0', XATTR_SD_HASH_SIZE);
57 status = create_acl_blob(psd, &blob, XATTR_SD_HASH_TYPE_SHA256, hash);
58 if (!NT_STATUS_IS_OK(status)) {
59 return status;
60 }
61
62 SHA256_Init(&tctx);
63 SHA256_Update(&tctx, blob.data, blob.length);
64 SHA256_Final(hash, &tctx);
65
66 return NT_STATUS_OK;
67 }
68
69 /*******************************************************************
70 Parse out a struct security_descriptor from a DATA_BLOB.
71 *******************************************************************/
72
73 static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
74 struct security_descriptor **ppdesc,
75 uint16_t *p_hash_type,
76 uint8_t hash[XATTR_SD_HASH_SIZE])
77 {
78 TALLOC_CTX *ctx = talloc_tos();
79 struct xattr_NTACL xacl;
80 enum ndr_err_code ndr_err;
81 size_t sd_size;
82
83 ndr_err = ndr_pull_struct_blob(pblob, ctx, &xacl,
84 (ndr_pull_flags_fn_t)ndr_pull_xattr_NTACL);
85
86 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
87 DEBUG(5, ("parse_acl_blob: ndr_pull_xattr_NTACL failed: %s\n",
88 ndr_errstr(ndr_err)));
89 return ndr_map_error2ntstatus(ndr_err);
90 }
91
92 switch (xacl.version) {
93 case 2:
94 *ppdesc = make_sec_desc(ctx, SD_REVISION,
95 xacl.info.sd_hs2->sd->type | SEC_DESC_SELF_RELATIVE,
96 xacl.info.sd_hs2->sd->owner_sid,
97 xacl.info.sd_hs2->sd->group_sid,
98 xacl.info.sd_hs2->sd->sacl,
99 xacl.info.sd_hs2->sd->dacl,
100 &sd_size);
101 /* No hash - null out. */
102 *p_hash_type = XATTR_SD_HASH_TYPE_NONE;
103 memset(hash, '\0', XATTR_SD_HASH_SIZE);
104 break;
105 case 3:
106 *ppdesc = make_sec_desc(ctx, SD_REVISION,
107 xacl.info.sd_hs3->sd->type | SEC_DESC_SELF_RELATIVE,
108 xacl.info.sd_hs3->sd->owner_sid,
109 xacl.info.sd_hs3->sd->group_sid,
110 xacl.info.sd_hs3->sd->sacl,
111 xacl.info.sd_hs3->sd->dacl,
112 &sd_size);
113 *p_hash_type = xacl.info.sd_hs3->hash_type;
114 /* Current version 3. */
115 memcpy(hash, xacl.info.sd_hs3->hash, XATTR_SD_HASH_SIZE);
116 break;
117 default:
118 return NT_STATUS_REVISION_MISMATCH;
119 }
120
121 TALLOC_FREE(xacl.info.sd);
122
123 return (*ppdesc != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
124 }
125
126 /*******************************************************************
127 Create a DATA_BLOB from a security descriptor.
128 *******************************************************************/
129
130 static NTSTATUS create_acl_blob(const struct security_descriptor *psd,
131 DATA_BLOB *pblob,
132 uint16_t hash_type,
133 uint8_t hash[XATTR_SD_HASH_SIZE])
134 {
135 struct xattr_NTACL xacl;
136 struct security_descriptor_hash_v3 sd_hs3;
137 enum ndr_err_code ndr_err;
138 TALLOC_CTX *ctx = talloc_tos();
139
140 ZERO_STRUCT(xacl);
141 ZERO_STRUCT(sd_hs3);
142
143 xacl.version = 3;
144 xacl.info.sd_hs3 = &sd_hs3;
145 xacl.info.sd_hs3->sd = CONST_DISCARD(struct security_descriptor *, psd);
146 xacl.info.sd_hs3->hash_type = hash_type;
147 memcpy(&xacl.info.sd_hs3->hash[0], hash, XATTR_SD_HASH_SIZE);
148
149 ndr_err = ndr_push_struct_blob(
150 pblob, ctx, &xacl,
151 (ndr_push_flags_fn_t)ndr_push_xattr_NTACL);
152
153 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
154 DEBUG(5, ("create_acl_blob: ndr_push_xattr_NTACL failed: %s\n",
155 ndr_errstr(ndr_err)));
156 return ndr_map_error2ntstatus(ndr_err);
157 }
158
159 return NT_STATUS_OK;
160 }
161
162 /*******************************************************************
163 Add in 3 inheritable components for a non-inheritable directory ACL.
164 CREATOR_OWNER/CREATOR_GROUP/WORLD.
165 *******************************************************************/
166
167 static void add_directory_inheritable_components(vfs_handle_struct *handle,
168 const char *name,
169 SMB_STRUCT_STAT *psbuf,
170 struct security_descriptor *psd)
171 {
172 struct connection_struct *conn = handle->conn;
173 int num_aces = (psd->dacl ? psd->dacl->num_aces : 0);
174 struct smb_filename smb_fname;
175 enum security_ace_type acltype;
176 uint32_t access_mask;
177 mode_t dir_mode;
178 mode_t file_mode;
179 mode_t mode;
180 struct security_ace *new_ace_list = TALLOC_ZERO_ARRAY(talloc_tos(),
181 struct security_ace,
182 num_aces + 3);
183
184 if (new_ace_list == NULL) {
185 return;
186 }
187
188 /* Fake a quick smb_filename. */
189 ZERO_STRUCT(smb_fname);
190 smb_fname.st = *psbuf;
191 smb_fname.base_name = CONST_DISCARD(char *, name);
192
193 dir_mode = unix_mode(conn,
194 FILE_ATTRIBUTE_DIRECTORY, &smb_fname, NULL);
195 file_mode = unix_mode(conn,
196 FILE_ATTRIBUTE_ARCHIVE, &smb_fname, NULL);
197
198 mode = dir_mode | file_mode;
199
200 DEBUG(10, ("add_directory_inheritable_components: directory %s, "
201 "mode = 0%o\n",
202 name,
203 (unsigned int)mode ));
204
205 if (num_aces) {
206 memcpy(new_ace_list, psd->dacl->aces,
207 num_aces * sizeof(struct security_ace));
208 }
209 access_mask = map_canon_ace_perms(SNUM(conn), &acltype,
210 mode & 0700, false);
211
212 init_sec_ace(&new_ace_list[num_aces],
213 &global_sid_Creator_Owner,
214 acltype,
215 access_mask,
216 SEC_ACE_FLAG_CONTAINER_INHERIT|
217 SEC_ACE_FLAG_OBJECT_INHERIT|
218 SEC_ACE_FLAG_INHERIT_ONLY);
219 access_mask = map_canon_ace_perms(SNUM(conn), &acltype,
220 (mode << 3) & 0700, false);
221 init_sec_ace(&new_ace_list[num_aces+1],
222 &global_sid_Creator_Group,
223 acltype,
224 access_mask,
225 SEC_ACE_FLAG_CONTAINER_INHERIT|
226 SEC_ACE_FLAG_OBJECT_INHERIT|
227 SEC_ACE_FLAG_INHERIT_ONLY);
228 access_mask = map_canon_ace_perms(SNUM(conn), &acltype,
229 (mode << 6) & 0700, false);
230 init_sec_ace(&new_ace_list[num_aces+2],
231 &global_sid_World,
232 acltype,
233 access_mask,
234 SEC_ACE_FLAG_CONTAINER_INHERIT|
235 SEC_ACE_FLAG_OBJECT_INHERIT|
236 SEC_ACE_FLAG_INHERIT_ONLY);
237 psd->dacl->aces = new_ace_list;
238 psd->dacl->num_aces += 3;
239 }
240
241 /*******************************************************************
242 Pull a DATA_BLOB from an xattr given a pathname.
243 If the hash doesn't match, or doesn't exist - return the underlying
244 filesystem sd.
245 *******************************************************************/
246
247 static NTSTATUS get_nt_acl_internal(vfs_handle_struct *handle,
248 files_struct *fsp,
249 const char *name,
250 uint32_t security_info,
251 struct security_descriptor **ppdesc)
252 {
253 DATA_BLOB blob;
254 NTSTATUS status;
255 uint16_t hash_type = XATTR_SD_HASH_TYPE_NONE;
256 uint8_t hash[XATTR_SD_HASH_SIZE];
257 uint8_t hash_tmp[XATTR_SD_HASH_SIZE];
258 struct security_descriptor *psd = NULL;
259 struct security_descriptor *pdesc_next = NULL;
260 bool ignore_file_system_acl = lp_parm_bool(SNUM(handle->conn),
261 ACL_MODULE_NAME,
262 "ignore system acls",
263 false);
264
265 if (fsp && name == NULL) {
266 name = fsp->fsp_name->base_name;
267 }
268
269 DEBUG(10, ("get_nt_acl_internal: name=%s\n", name));
270
271 /* Get the full underlying sd for the hash
272 or to return as backup. */
273 if (fsp) {
274 status = SMB_VFS_NEXT_FGET_NT_ACL(handle,
275 fsp,
276 HASH_SECURITY_INFO,
277 &pdesc_next);
278 } else {
279 status = SMB_VFS_NEXT_GET_NT_ACL(handle,
280 name,
281 HASH_SECURITY_INFO,
282 &pdesc_next);
283 }
284
285 if (!NT_STATUS_IS_OK(status)) {
286 DEBUG(10, ("get_nt_acl_internal: get_next_acl for file %s "
287 "returned %s\n",
288 name,
289 nt_errstr(status)));
290 return status;
291 }
292
293 status = get_acl_blob(talloc_tos(), handle, fsp, name, &blob);
294 if (!NT_STATUS_IS_OK(status)) {
295 DEBUG(10, ("get_nt_acl_internal: get_acl_blob returned %s\n",
296 nt_errstr(status)));
297 psd = pdesc_next;
298 goto out;
299 }
300
301 status = parse_acl_blob(&blob, &psd,
302 &hash_type, &hash[0]);
303 if (!NT_STATUS_IS_OK(status)) {
304 DEBUG(10, ("parse_acl_blob returned %s\n",
305 nt_errstr(status)));
306 psd = pdesc_next;
307 goto out;
308 }
309
310 /* Ensure the hash type is one we know. */
311 switch (hash_type) {
312 case XATTR_SD_HASH_TYPE_NONE:
313 /* No hash, just return blob sd. */
314 goto out;
315 case XATTR_SD_HASH_TYPE_SHA256:
316 break;
317 default:
318 DEBUG(10, ("get_nt_acl_internal: ACL blob revision "
319 "mismatch (%u) for file %s\n",
320 (unsigned int)hash_type,
321 name));
322 TALLOC_FREE(psd);
323 psd = pdesc_next;
324 goto out;
325 }
326
327 if (ignore_file_system_acl) {
328 goto out;
329 }
330
331 status = hash_sd_sha256(pdesc_next, hash_tmp);
332 if (!NT_STATUS_IS_OK(status)) {
333 TALLOC_FREE(psd);
334 psd = pdesc_next;
335 goto out;
336 }
337
338 if (memcmp(&hash[0], &hash_tmp[0], XATTR_SD_HASH_SIZE) == 0) {
339 /* Hash matches, return blob sd. */
340 DEBUG(10, ("get_nt_acl_internal: blob hash "
341 "matches for file %s\n",
342 name ));
343 goto out;
344 }
345
346 /* Hash doesn't match, return underlying sd. */
347 TALLOC_FREE(psd);
348 psd = pdesc_next;
349
350 out:
351
352 if (psd != pdesc_next) {
353 /* We're returning the blob, throw
354 * away the filesystem SD. */
355 TALLOC_FREE(pdesc_next);
356 } else {
357 SMB_STRUCT_STAT sbuf;
358 SMB_STRUCT_STAT *psbuf = &sbuf;
359 bool is_directory = false;
360 /*
361 * We're returning the underlying ACL from the
362 * filesystem. If it's a directory, and has no
363 * inheritable ACE entries we have to fake them.
364 */
365 if (fsp) {
366 status = vfs_stat_fsp(fsp);
367 if (!NT_STATUS_IS_OK(status)) {
368 return status;
369 }
370 psbuf = &fsp->fsp_name->st;
371 } else {
372 int ret = vfs_stat_smb_fname(handle->conn,
373 name,
374 &sbuf);
375 if (ret == -1) {
376 return map_nt_error_from_unix(errno);
377 }
378 }
379 is_directory = S_ISDIR(sbuf.st_ex_mode);
380
381 if (ignore_file_system_acl) {
382 TALLOC_FREE(pdesc_next);
383 status = make_default_filesystem_acl(talloc_tos(),
384 name,
385 psbuf,
386 &psd);
387 if (!NT_STATUS_IS_OK(status)) {
388 return status;
389 }
390 } else {
391 if (is_directory &&
392 !sd_has_inheritable_components(psd,
393 true)) {
394 add_directory_inheritable_components(handle,
395 name,
396 psbuf,
397 psd);
398 }
399 /* The underlying POSIX module always sets
400 the ~SEC_DESC_DACL_PROTECTED bit, as ACLs
401 can't be inherited in this way under POSIX.
402 Remove it for Windows-style ACLs. */
403 psd->type &= ~SEC_DESC_DACL_PROTECTED;
404 }
405 }
406
407 if (!(security_info & SECINFO_OWNER)) {
408 psd->owner_sid = NULL;
409 }
410 if (!(security_info & SECINFO_GROUP)) {
411 psd->group_sid = NULL;
412 }
413 if (!(security_info & SECINFO_DACL)) {
414 psd->dacl = NULL;
415 }
416 if (!(security_info & SECINFO_SACL)) {
417 psd->sacl = NULL;
418 }
419
420 TALLOC_FREE(blob.data);
421 *ppdesc = psd;
422
423 if (DEBUGLEVEL >= 10) {
424 DEBUG(10,("get_nt_acl_internal: returning acl for %s is:\n",
425 name ));
426 NDR_PRINT_DEBUG(security_descriptor, psd);
427 }
428
429 return NT_STATUS_OK;
430 }
431
432 /*********************************************************************
433 Create a default ACL by inheriting from the parent. If no inheritance
434 from the parent available, don't set anything. This will leave the actual
435 permissions the new file or directory already got from the filesystem
436 as the NT ACL when read.
437 *********************************************************************/
438
439 static NTSTATUS inherit_new_acl(vfs_handle_struct *handle,
440 files_struct *fsp,
441 struct security_descriptor *parent_desc,
442 bool is_directory)
443 {
444 TALLOC_CTX *ctx = talloc_tos();
445 NTSTATUS status = NT_STATUS_OK;
446 struct security_descriptor *psd = NULL;
447 size_t size;
448
449 if (!sd_has_inheritable_components(parent_desc, is_directory)) {
450 return NT_STATUS_OK;
451 }
452
453 /* Create an inherited descriptor from the parent. */
454
455 if (DEBUGLEVEL >= 10) {
456 DEBUG(10,("inherit_new_acl: parent acl for %s is:\n",
457 fsp_str_dbg(fsp) ));
458 NDR_PRINT_DEBUG(security_descriptor, parent_desc);
459 }
460
461 status = se_create_child_secdesc(ctx,
462 &psd,
463 &size,
464 parent_desc,
465 &handle->conn->server_info->security_token->sids[PRIMARY_USER_SID_INDEX],
466 &handle->conn->server_info->security_token->sids[PRIMARY_GROUP_SID_INDEX],
467 is_directory);
468 if (!NT_STATUS_IS_OK(status)) {
469 return status;
470 }
471
472 if (DEBUGLEVEL >= 10) {
473 DEBUG(10,("inherit_new_acl: child acl for %s is:\n",
474 fsp_str_dbg(fsp) ));
475 NDR_PRINT_DEBUG(security_descriptor, parent_desc);
476 }
477
478 return SMB_VFS_FSET_NT_ACL(fsp,
479 (SECINFO_OWNER |
480 SECINFO_GROUP |
481 SECINFO_DACL),
482 psd);
483 }
484
485 static NTSTATUS check_parent_acl_common(vfs_handle_struct *handle,
486 const char *path,
487 uint32_t access_mask,
488 struct security_descriptor **pp_parent_desc)
489 {
490 char *parent_name = NULL;
491 struct security_descriptor *parent_desc = NULL;
492 uint32_t access_granted = 0;
493 NTSTATUS status;
494
495 if (!parent_dirname(talloc_tos(), path, &parent_name, NULL)) {
496 return NT_STATUS_NO_MEMORY;
497 }
498
499 status = get_nt_acl_internal(handle,
500 NULL,
501 parent_name,
502 (SECINFO_OWNER |
503 SECINFO_GROUP |
504 SECINFO_DACL),
505 &parent_desc);
506
507 if (!NT_STATUS_IS_OK(status)) {
508 DEBUG(10,("check_parent_acl_common: get_nt_acl_internal "
509 "on directory %s for "
510 "path %s returned %s\n",
511 parent_name,
512 path,
513 nt_errstr(status) ));
514 return status;
515 }
516 if (pp_parent_desc) {
517 *pp_parent_desc = parent_desc;
518 }
519 status = smb1_file_se_access_check(handle->conn,
520 parent_desc,
521 get_current_nttok(handle->conn),
522 access_mask,
523 &access_granted);
524 if(!NT_STATUS_IS_OK(status)) {
525 DEBUG(10,("check_parent_acl_common: access check "
526 "on directory %s for "
527 "path %s for mask 0x%x returned %s\n",
528 parent_name,
529 path,
530 access_mask,
531 nt_errstr(status) ));
532 return status;
533 }
534 return NT_STATUS_OK;
535 }
536
537 static void free_sd_common(void **ptr)
538 {
539 TALLOC_FREE(*ptr);
540 }
541
542 /*********************************************************************
543 Check ACL on open. For new files inherit from parent directory.
544 *********************************************************************/
545
546 static int open_acl_common(vfs_handle_struct *handle,
547 struct smb_filename *smb_fname,
548 files_struct *fsp,
549 int flags,
550 mode_t mode)
551 {
552 uint32_t access_granted = 0;
553 struct security_descriptor *pdesc = NULL;
554 struct security_descriptor *parent_desc = NULL;
555 bool file_existed = true;
556 char *fname = NULL;
557 NTSTATUS status;
558
559 if (fsp->base_fsp) {
560 /* Stream open. Base filename open already did the ACL check. */
561 DEBUG(10,("open_acl_common: stream open on %s\n",
562 fsp_str_dbg(fsp) ));
563 return SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
564 }
565
566 status = get_full_smb_filename(talloc_tos(), smb_fname,
567 &fname);
568 if (!NT_STATUS_IS_OK(status)) {
569 goto err;
570 }
571
572 status = get_nt_acl_internal(handle,
573 NULL,
574 fname,
575 (SECINFO_OWNER |
576 SECINFO_GROUP |
577 SECINFO_DACL),
578 &pdesc);
579 if (NT_STATUS_IS_OK(status)) {
580 /* See if we can access it. */
581 status = smb1_file_se_access_check(handle->conn,
582 pdesc,
583 get_current_nttok(handle->conn),
584 fsp->access_mask,
585 &access_granted);
586 if (!NT_STATUS_IS_OK(status)) {
587 DEBUG(10,("open_acl_xattr: %s open "
588 "refused with error %s\n",
589 fsp_str_dbg(fsp),
590 nt_errstr(status) ));
591 goto err;
592 }
593 } else if (NT_STATUS_EQUAL(status,NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
594 file_existed = false;
595 /*
596 * If O_CREAT is true then we're trying to create a file.
597 * Check the parent directory ACL will allow this.
598 */
599 if (flags & O_CREAT) {
600 struct security_descriptor *psd = NULL;
601
602 status = check_parent_acl_common(handle, fname,
603 SEC_DIR_ADD_FILE, &parent_desc);
604 if (!NT_STATUS_IS_OK(status)) {
605 goto err;
606 }
607 /* Cache the parent security descriptor for
608 * later use. We do have an fsp here, but to
609 * keep the code consistent with the directory
610 * case which doesn't, use the handle. */
611
612 /* Attach this to the conn, move from talloc_tos(). */
613 psd = (struct security_descriptor *)talloc_move(handle->conn,
614 &parent_desc);
615
616 if (!psd) {
617 status = NT_STATUS_NO_MEMORY;
618 goto err;
619 }
620 status = NT_STATUS_NO_MEMORY;
621 SMB_VFS_HANDLE_SET_DATA(handle, psd, free_sd_common,
622 struct security_descriptor *, goto err);
623 status = NT_STATUS_OK;
624 }
625 }
626
627 DEBUG(10,("open_acl_xattr: get_nt_acl_attr_internal for "
628 "%s returned %s\n",
629 fsp_str_dbg(fsp),
630 nt_errstr(status) ));
631
632 fsp->fh->fd = SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
633 return fsp->fh->fd;
634
635 err:
636
637 errno = map_errno_from_nt_status(status);
638 return -1;
639 }
640
641 static int mkdir_acl_common(vfs_handle_struct *handle, const char *path, mode_t mode)
642 {
643 int ret;
644 NTSTATUS status;
645 SMB_STRUCT_STAT sbuf;
646
647 ret = vfs_stat_smb_fname(handle->conn, path, &sbuf);
648 if (ret == -1 && errno == ENOENT) {
649 struct security_descriptor *parent_desc = NULL;
650 struct security_descriptor *psd = NULL;
651
652 /* We're creating a new directory. */
653 status = check_parent_acl_common(handle, path,
654 SEC_DIR_ADD_SUBDIR, &parent_desc);
655 if (!NT_STATUS_IS_OK(status)) {
656 errno = map_errno_from_nt_status(status);
657 return -1;
658 }
659
660 /* Cache the parent security descriptor for
661 * later use. We don't have an fsp here so
662 * use the handle. */
663
664 /* Attach this to the conn, move from talloc_tos(). */
665 psd = (struct security_descriptor *)talloc_move(handle->conn,
666 &parent_desc);
667
668 if (!psd) {
669 return -1;
670 }
671 SMB_VFS_HANDLE_SET_DATA(handle, psd, free_sd_common,
672 struct security_descriptor *, return -1);
673 }
674
675 return SMB_VFS_NEXT_MKDIR(handle, path, mode);
676 }
677
678 /*********************************************************************
679 Fetch a security descriptor given an fsp.
680 *********************************************************************/
681
682 static NTSTATUS fget_nt_acl_common(vfs_handle_struct *handle, files_struct *fsp,
683 uint32_t security_info, struct security_descriptor **ppdesc)
684 {
685 return get_nt_acl_internal(handle, fsp,
686 NULL, security_info, ppdesc);
687 }
688
689 /*********************************************************************
690 Fetch a security descriptor given a pathname.
691 *********************************************************************/
692
693 static NTSTATUS get_nt_acl_common(vfs_handle_struct *handle,
694 const char *name, uint32_t security_info, struct security_descriptor **ppdesc)
695 {
696 return get_nt_acl_internal(handle, NULL,
697 name, security_info, ppdesc);
698 }
699
700 /*********************************************************************
701 Store a security descriptor given an fsp.
702 *********************************************************************/
703
704 static NTSTATUS fset_nt_acl_common(vfs_handle_struct *handle, files_struct *fsp,
705 uint32_t security_info_sent, const struct security_descriptor *orig_psd)
706 {
707 NTSTATUS status;
708 DATA_BLOB blob;
709 struct security_descriptor *pdesc_next = NULL;
710 struct security_descriptor *psd = NULL;
711 uint8_t hash[XATTR_SD_HASH_SIZE];
712
713 if (DEBUGLEVEL >= 10) {
714 DEBUG(10,("fset_nt_acl_xattr: incoming sd for file %s\n",
715 fsp_str_dbg(fsp)));
716 NDR_PRINT_DEBUG(security_descriptor,
717 CONST_DISCARD(struct security_descriptor *,orig_psd));
718 }
719
720 status = get_nt_acl_internal(handle, fsp,
721 NULL,
722 SECINFO_OWNER|SECINFO_GROUP|SECINFO_DACL|SECINFO_SACL,
723 &psd);
724
725 if (!NT_STATUS_IS_OK(status)) {
726 return status;
727 }
728
729 psd->revision = orig_psd->revision;
730 /* All our SD's are self relative. */
731 psd->type = orig_psd->type | SEC_DESC_SELF_RELATIVE;
732
733 if ((security_info_sent & SECINFO_OWNER) && (orig_psd->owner_sid != NULL)) {
734 psd->owner_sid = orig_psd->owner_sid;
735 }
736 if ((security_info_sent & SECINFO_GROUP) && (orig_psd->group_sid != NULL)) {
737 psd->group_sid = orig_psd->group_sid;
738 }
739 if (security_info_sent & SECINFO_DACL) {
740 psd->dacl = orig_psd->dacl;
741 psd->type |= SEC_DESC_DACL_PRESENT;
742 }
743 if (security_info_sent & SECINFO_SACL) {
744 psd->sacl = orig_psd->sacl;
745 psd->type |= SEC_DESC_SACL_PRESENT;
746 }
747
748 status = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
749 if (!NT_STATUS_IS_OK(status)) {
750 return status;
751 }
752
753 /* Get the full underlying sd, then hash. */
754 status = SMB_VFS_NEXT_FGET_NT_ACL(handle,
755 fsp,
756 HASH_SECURITY_INFO,
757 &pdesc_next);
758
759 if (!NT_STATUS_IS_OK(status)) {
760 return status;
761 }
762
763 status = hash_sd_sha256(pdesc_next, hash);
764 if (!NT_STATUS_IS_OK(status)) {
765 return status;
766 }
767
768 if (DEBUGLEVEL >= 10) {
769 DEBUG(10,("fset_nt_acl_xattr: storing xattr sd for file %s\n",
770 fsp_str_dbg(fsp)));
771 NDR_PRINT_DEBUG(security_descriptor,
772 CONST_DISCARD(struct security_descriptor *,psd));
773 }
774 create_acl_blob(psd, &blob, XATTR_SD_HASH_TYPE_SHA256, hash);
775 store_acl_blob_fsp(handle, fsp, &blob);
776
777 return NT_STATUS_OK;
778 }
779
780 static SMB_STRUCT_DIR *opendir_acl_common(vfs_handle_struct *handle,
781 const char *fname, const char *mask, uint32 attr)
782 {
783 NTSTATUS status = check_parent_acl_common(handle, fname,
784 SEC_DIR_LIST, NULL);
785
786 if (!NT_STATUS_IS_OK(status)) {
787 errno = map_errno_from_nt_status(status);
788 return NULL;
789 }
790 return SMB_VFS_NEXT_OPENDIR(handle, fname, mask, attr);
791 }
792
793 static int acl_common_remove_object(vfs_handle_struct *handle,
794 const char *path,
795 bool is_directory)
796 {
797 connection_struct *conn = handle->conn;
798 struct file_id id;
799 files_struct *fsp = NULL;
800 int ret = 0;
801 char *parent_dir = NULL;
802 const char *final_component = NULL;
803 struct smb_filename local_fname;
804 int saved_errno = 0;
805
806 if (!parent_dirname(talloc_tos(), path,
807 &parent_dir, &final_component)) {
808 saved_errno = ENOMEM;
809 goto out;
810 }
811
812 DEBUG(10,("acl_common_remove_object: removing %s %s/%s\n",
813 is_directory ? "directory" : "file",
814 parent_dir, final_component ));
815
816 /* cd into the parent dir to pin it. */
817 ret = SMB_VFS_CHDIR(conn, parent_dir);
818 if (ret == -1) {
819 saved_errno = errno;
820 goto out;
821 }
822
823 ZERO_STRUCT(local_fname);
824 local_fname.base_name = CONST_DISCARD(char *,final_component);
825
826 /* Must use lstat here. */
827 ret = SMB_VFS_LSTAT(conn, &local_fname);
828 if (ret == -1) {
829 saved_errno = errno;
830 goto out;
831 }
832
833 /* Ensure we have this file open with DELETE access. */
834 id = vfs_file_id_from_sbuf(conn, &local_fname.st);
835 for (fsp = file_find_di_first(conn->sconn, id); fsp;
836 file_find_di_next(fsp)) {
837 if (fsp->access_mask & DELETE_ACCESS &&
838 fsp->delete_on_close) {
839 /* We did open this for delete,
840 * allow the delete as root.
841 */
842 break;
843 }
844 }
845
846 if (!fsp) {
847 DEBUG(10,("acl_common_remove_object: %s %s/%s "
848 "not an open file\n",
849 is_directory ? "directory" : "file",
850 parent_dir, final_component ));
851 saved_errno = EACCES;
852 goto out;
853 }
854
855 become_root();
856 if (is_directory) {
857 ret = SMB_VFS_NEXT_RMDIR(handle, final_component);
858 } else {
859 ret = SMB_VFS_NEXT_UNLINK(handle, &local_fname);
860 }
861 unbecome_root();
862
863 if (ret == -1) {
864 saved_errno = errno;
865 }
866
867 out:
868
869 TALLOC_FREE(parent_dir);
870
871 vfs_ChDir(conn, conn->connectpath);
872 if (saved_errno) {
873 errno = saved_errno;
874 }
875 return ret;
876 }
877
878 static int rmdir_acl_common(struct vfs_handle_struct *handle,
879 const char *path)
880 {
881 int ret;
882
883 ret = SMB_VFS_NEXT_RMDIR(handle, path);
884 if (!(ret == -1 && (errno == EACCES || errno == EPERM))) {
885 DEBUG(10,("rmdir_acl_common: unlink of %s failed %s\n",
886 path,
887 strerror(errno) ));
888 return ret;
889 }
890
891 return acl_common_remove_object(handle,
892 path,
893 true);
894 }
895
896 static NTSTATUS create_file_acl_common(struct vfs_handle_struct *handle,
897 struct smb_request *req,
898 uint16_t root_dir_fid,
899 struct smb_filename *smb_fname,
900 uint32_t access_mask,
901 uint32_t share_access,
902 uint32_t create_disposition,
903 uint32_t create_options,
904 uint32_t file_attributes,
905 uint32_t oplock_request,
906 uint64_t allocation_size,
907 uint32_t private_flags,
908 struct security_descriptor *sd,
909 struct ea_list *ea_list,
910 files_struct **result,
911 int *pinfo)
912 {
913 NTSTATUS status, status1;
914 files_struct *fsp = NULL;
915 int info;
916 struct security_descriptor *parent_sd = NULL;
917
918 status = SMB_VFS_NEXT_CREATE_FILE(handle,
919 req,
920 root_dir_fid,
921 smb_fname,
922 access_mask,
923 share_access,
924 create_disposition,
925 create_options,
926 file_attributes,
927 oplock_request,
928 allocation_size,
929 private_flags,
930 sd,
931 ea_list,
932 result,
933 &info);
934
935 if (!NT_STATUS_IS_OK(status)) {
936 goto out;
937 }
938
939 if (info != FILE_WAS_CREATED) {
940 /* File/directory was opened, not created. */
941 goto out;
942 }
943
944 fsp = *result;
945
946 if (fsp == NULL) {
947 /* Only handle success. */
948 goto out;
949 }
950
951 if (sd) {
952 /* Security descriptor already set. */
953 goto out;
954 }
955
956 if (fsp->base_fsp) {
957 /* Stream open. */
958 goto out;
959 }
960
961
962 /* We must have a cached parent sd in this case.
963 * attached to the handle. */
964
965 SMB_VFS_HANDLE_GET_DATA(handle, parent_sd,
966 struct security_descriptor,
967 goto err);
968
969 if (!parent_sd) {
970 goto err;
971 }
972
973 /* New directory - inherit from parent. */
974 status1 = inherit_new_acl(handle, fsp, parent_sd, fsp->is_directory);
975
976 if (!NT_STATUS_IS_OK(status1)) {
977 DEBUG(1,("create_file_acl_common: error setting "
978 "sd for %s (%s)\n",
979 fsp_str_dbg(fsp),
980 nt_errstr(status1) ));
981 }
982
983 out:
984
985 /* Ensure we never leave attached data around. */
986 SMB_VFS_HANDLE_FREE_DATA(handle);
987
988 if (NT_STATUS_IS_OK(status) && pinfo) {
989 *pinfo = info;
990 }
991 return status;
992
993 err:
994
995 smb_panic("create_file_acl_common: logic error.\n");
996 /* NOTREACHED */
997 return status;
998 }
999
1000 static int unlink_acl_common(struct vfs_handle_struct *handle,
1001 const struct smb_filename *smb_fname)
1002 {
1003 int ret;
1004
1005 ret = SMB_VFS_NEXT_UNLINK(handle, smb_fname);
1006 if (!(ret == -1 && (errno == EACCES || errno == EPERM))) {
1007 DEBUG(10,("unlink_acl_common: unlink of %s failed %s\n",
1008 smb_fname->base_name,
1009 strerror(errno) ));
1010 return ret;
1011 }
1012 /* Don't do anything fancy for streams. */
1013 if (smb_fname->stream_name) {
1014 return ret;
1015 }
1016
1017 return acl_common_remove_object(handle,
1018 smb_fname->base_name,
1019 false);
1020 }
Samba GIT mirror