2 Unix SMB/CIFS implementation.
3 Set NT and POSIX ACLs and other VFS operations from Python
5 Copyrigyt (C) Andrew Bartlett 2012
6 Copyright (C) Jeremy Allison 1994-2009.
7 Copyright (C) Andreas Gruenbacher 2002.
8 Copyright (C) Simo Sorce <idra@samba.org> 2009.
9 Copyright (C) Simo Sorce 2002
10 Copyright (C) Eric Lorimer 2002
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
28 #include "smbd/smbd.h"
29 #include "libcli/util/pyerrors.h"
30 #include "librpc/rpc/pyrpc_util.h"
32 #include "system/filesys.h"
34 extern const struct generic_mapping file_generic_mapping
;
37 #define DBGC_CLASS DBGC_ACLS
39 static int conn_free_wrapper(connection_struct
*conn
)
45 static connection_struct
*get_conn(TALLOC_CTX
*mem_ctx
, const char *service
)
47 connection_struct
*conn
;
48 TALLOC_CTX
*frame
= talloc_stackframe();
52 if (!posix_locking_init(false)) {
59 snum
= lp_servicenumber(service
);
62 PyErr_SetString(PyExc_RuntimeError
, "unknown service");
67 status
= create_conn_struct(mem_ctx
, NULL
, NULL
, &conn
, snum
, "/",
69 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
72 /* Ignore read-only and share restrictions */
73 conn
->read_only
= false;
74 conn
->share_access
= SEC_RIGHTS_FILE_ALL
;
75 talloc_set_destructor(conn
, conn_free_wrapper
);
79 static int set_sys_acl_conn(const char *fname
,
80 SMB_ACL_TYPE_T acltype
,
81 SMB_ACL_T theacl
, connection_struct
*conn
)
84 struct smb_filename
*smb_fname
= NULL
;
87 TALLOC_CTX
*frame
= talloc_stackframe();
89 /* we want total control over the permissions on created files,
90 so set our umask to 0 */
91 saved_umask
= umask(0);
93 smb_fname
= synthetic_smb_fname_split(frame
,
95 lp_posix_pathnames());
96 if (smb_fname
== NULL
) {
102 ret
= SMB_VFS_SYS_ACL_SET_FILE( conn
, smb_fname
, acltype
, theacl
);
110 static NTSTATUS
set_nt_acl_conn(const char *fname
,
111 uint32_t security_info_sent
, const struct security_descriptor
*sd
,
112 connection_struct
*conn
)
114 TALLOC_CTX
*frame
= talloc_stackframe();
115 NTSTATUS status
= NT_STATUS_OK
;
117 struct smb_filename
*smb_fname
= NULL
;
121 fsp
= talloc_zero(frame
, struct files_struct
);
124 return NT_STATUS_NO_MEMORY
;
126 fsp
->fh
= talloc(fsp
, struct fd_handle
);
127 if (fsp
->fh
== NULL
) {
129 return NT_STATUS_NO_MEMORY
;
133 /* we want total control over the permissions on created files,
134 so set our umask to 0 */
135 saved_umask
= umask(0);
137 smb_fname
= synthetic_smb_fname_split(fsp
,
139 lp_posix_pathnames());
140 if (smb_fname
== NULL
) {
143 return NT_STATUS_NO_MEMORY
;
146 fsp
->fsp_name
= smb_fname
;
149 flags
= O_RDONLY
|O_DIRECTORY
;
151 /* POSIX allows us to open a directory with O_RDONLY. */
155 fsp
->fh
->fd
= SMB_VFS_OPEN(conn
, smb_fname
, fsp
, O_RDWR
, 00400);
156 if (fsp
->fh
->fd
== -1 && errno
== EISDIR
) {
157 fsp
->fh
->fd
= SMB_VFS_OPEN(conn
, smb_fname
, fsp
, flags
, 00400);
159 if (fsp
->fh
->fd
== -1) {
160 printf("open: error=%d (%s)\n", errno
, strerror(errno
));
163 return NT_STATUS_UNSUCCESSFUL
;
166 ret
= SMB_VFS_FSTAT(fsp
, &smb_fname
->st
);
168 /* If we have an fd, this stat should succeed. */
169 DEBUG(0,("Error doing fstat on open file %s "
171 smb_fname_str_dbg(smb_fname
),
175 return map_nt_error_from_unix(errno
);
178 fsp
->file_id
= vfs_file_id_from_sbuf(conn
, &smb_fname
->st
);
179 fsp
->vuid
= UID_FIELD_INVALID
;
181 fsp
->can_lock
= True
;
182 fsp
->can_read
= True
;
183 fsp
->can_write
= True
;
184 fsp
->print_file
= NULL
;
185 fsp
->modified
= False
;
186 fsp
->sent_oplock_break
= NO_BREAK_SENT
;
187 fsp
->is_directory
= S_ISDIR(smb_fname
->st
.st_ex_mode
);
189 status
= SMB_VFS_FSET_NT_ACL( fsp
, security_info_sent
, sd
);
190 if (!NT_STATUS_IS_OK(status
)) {
191 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned %s.\n", nt_errstr(status
)));
203 static NTSTATUS
get_nt_acl_conn(TALLOC_CTX
*mem_ctx
,
205 connection_struct
*conn
,
206 uint32_t security_info_wanted
,
207 struct security_descriptor
**sd
)
209 TALLOC_CTX
*frame
= talloc_stackframe();
211 struct smb_filename
*smb_fname
= synthetic_smb_fname(talloc_tos(),
215 lp_posix_pathnames() ?
216 SMB_FILENAME_POSIX_PATH
: 0);
218 if (smb_fname
== NULL
) {
220 return NT_STATUS_NO_MEMORY
;
223 status
= SMB_VFS_GET_NT_ACL(conn
,
225 security_info_wanted
,
228 if (!NT_STATUS_IS_OK(status
)) {
229 DEBUG(0,("get_nt_acl_conn: get_nt_acl returned %s.\n", nt_errstr(status
)));
237 static int set_acl_entry_perms(SMB_ACL_ENTRY_T entry
, mode_t perm_mask
)
239 SMB_ACL_PERMSET_T perms
= NULL
;
241 if (sys_acl_get_permset(entry
, &perms
) != 0) {
245 if (sys_acl_clear_perms(perms
) != 0) {
249 if ((perm_mask
& SMB_ACL_READ
) != 0 &&
250 sys_acl_add_perm(perms
, SMB_ACL_READ
) != 0) {
254 if ((perm_mask
& SMB_ACL_WRITE
) != 0 &&
255 sys_acl_add_perm(perms
, SMB_ACL_WRITE
) != 0) {
259 if ((perm_mask
& SMB_ACL_EXECUTE
) != 0 &&
260 sys_acl_add_perm(perms
, SMB_ACL_EXECUTE
) != 0) {
264 if (sys_acl_set_permset(entry
, perms
) != 0) {
271 static SMB_ACL_T
make_simple_acl(gid_t gid
, mode_t chmod_mode
)
273 TALLOC_CTX
*frame
= talloc_stackframe();
275 mode_t mode
= SMB_ACL_READ
|SMB_ACL_WRITE
|SMB_ACL_EXECUTE
;
277 mode_t mode_user
= (chmod_mode
& 0700) >> 6;
278 mode_t mode_group
= (chmod_mode
& 070) >> 3;
279 mode_t mode_other
= chmod_mode
& 07;
280 SMB_ACL_ENTRY_T entry
;
281 SMB_ACL_T acl
= sys_acl_init(frame
);
287 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
292 if (sys_acl_set_tag_type(entry
, SMB_ACL_USER_OBJ
) != 0) {
297 if (set_acl_entry_perms(entry
, mode_user
) != 0) {
302 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
307 if (sys_acl_set_tag_type(entry
, SMB_ACL_GROUP_OBJ
) != 0) {
312 if (set_acl_entry_perms(entry
, mode_group
) != 0) {
317 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
322 if (sys_acl_set_tag_type(entry
, SMB_ACL_OTHER
) != 0) {
327 if (set_acl_entry_perms(entry
, mode_other
) != 0) {
333 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
338 if (sys_acl_set_tag_type(entry
, SMB_ACL_GROUP
) != 0) {
343 if (sys_acl_set_qualifier(entry
, &gid
) != 0) {
348 if (set_acl_entry_perms(entry
, mode_group
) != 0) {
354 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
359 if (sys_acl_set_tag_type(entry
, SMB_ACL_MASK
) != 0) {
364 if (set_acl_entry_perms(entry
, mode
) != 0) {
372 set a simple ACL on a file, as a test
374 static PyObject
*py_smbd_set_simple_acl(PyObject
*self
, PyObject
*args
, PyObject
*kwargs
)
376 const char * const kwnames
[] = { "fname", "mode", "gid", "service", NULL
};
377 char *fname
, *service
= NULL
;
382 connection_struct
*conn
;
384 if (!PyArg_ParseTupleAndKeywords(args
, kwargs
, "si|iz",
385 discard_const_p(char *, kwnames
),
386 &fname
, &mode
, &gid
, &service
))
389 acl
= make_simple_acl(gid
, mode
);
391 frame
= talloc_stackframe();
393 conn
= get_conn(frame
, service
);
398 ret
= set_sys_acl_conn(fname
, SMB_ACL_TYPE_ACCESS
, acl
, conn
);
404 return PyErr_SetFromErrno(PyExc_OSError
);
415 static PyObject
*py_smbd_chown(PyObject
*self
, PyObject
*args
, PyObject
*kwargs
)
417 const char * const kwnames
[] = { "fname", "uid", "gid", "service", NULL
};
418 connection_struct
*conn
;
421 char *fname
, *service
= NULL
;
425 struct smb_filename
*smb_fname
= NULL
;
427 if (!PyArg_ParseTupleAndKeywords(args
, kwargs
, "sii|z",
428 discard_const_p(char *, kwnames
),
429 &fname
, &uid
, &gid
, &service
))
432 frame
= talloc_stackframe();
434 conn
= get_conn(frame
, service
);
439 /* we want total control over the permissions on created files,
440 so set our umask to 0 */
441 saved_umask
= umask(0);
443 smb_fname
= synthetic_smb_fname(talloc_tos(),
447 lp_posix_pathnames() ?
448 SMB_FILENAME_POSIX_PATH
: 0);
449 if (smb_fname
== NULL
) {
453 return PyErr_SetFromErrno(PyExc_OSError
);
456 ret
= SMB_VFS_CHOWN(conn
, smb_fname
, uid
, gid
);
461 return PyErr_SetFromErrno(PyExc_OSError
);
474 static PyObject
*py_smbd_unlink(PyObject
*self
, PyObject
*args
, PyObject
*kwargs
)
476 const char * const kwnames
[] = { "fname", "service", NULL
};
477 connection_struct
*conn
;
479 struct smb_filename
*smb_fname
= NULL
;
480 char *fname
, *service
= NULL
;
483 frame
= talloc_stackframe();
485 if (!PyArg_ParseTupleAndKeywords(args
, kwargs
, "s|z",
486 discard_const_p(char *, kwnames
),
492 conn
= get_conn(frame
, service
);
498 smb_fname
= synthetic_smb_fname_split(frame
,
500 lp_posix_pathnames());
501 if (smb_fname
== NULL
) {
503 return PyErr_NoMemory();
506 ret
= SMB_VFS_UNLINK(conn
, smb_fname
);
510 return PyErr_SetFromErrno(PyExc_OSError
);
519 check if we have ACL support
521 static PyObject
*py_smbd_have_posix_acls(PyObject
*self
)
523 #ifdef HAVE_POSIX_ACLS
524 return PyBool_FromLong(true);
526 return PyBool_FromLong(false);
531 set the NT ACL on a file
533 static PyObject
*py_smbd_set_nt_acl(PyObject
*self
, PyObject
*args
, PyObject
*kwargs
)
535 const char * const kwnames
[] = { "fname", "security_info_sent", "sd", "service", NULL
};
537 char *fname
, *service
= NULL
;
538 int security_info_sent
;
540 struct security_descriptor
*sd
;
541 connection_struct
*conn
;
544 frame
= talloc_stackframe();
546 if (!PyArg_ParseTupleAndKeywords(args
, kwargs
,
547 "siO|z", discard_const_p(char *, kwnames
),
548 &fname
, &security_info_sent
, &py_sd
, &service
)) {
553 if (!py_check_dcerpc_type(py_sd
, "samba.dcerpc.security", "descriptor")) {
558 conn
= get_conn(frame
, service
);
564 sd
= pytalloc_get_type(py_sd
, struct security_descriptor
);
566 status
= set_nt_acl_conn(fname
, security_info_sent
, sd
, conn
);
568 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
574 Return the NT ACL on a file
576 static PyObject
*py_smbd_get_nt_acl(PyObject
*self
, PyObject
*args
, PyObject
*kwargs
)
578 const char * const kwnames
[] = { "fname", "security_info_wanted", "service", NULL
};
579 char *fname
, *service
= NULL
;
580 int security_info_wanted
;
582 struct security_descriptor
*sd
;
583 TALLOC_CTX
*tmp_ctx
= talloc_new(NULL
);
584 connection_struct
*conn
;
587 if (!PyArg_ParseTupleAndKeywords(args
, kwargs
, "si|z", discard_const_p(char *, kwnames
),
588 &fname
, &security_info_wanted
, &service
)) {
589 TALLOC_FREE(tmp_ctx
);
593 conn
= get_conn(tmp_ctx
, service
);
595 TALLOC_FREE(tmp_ctx
);
599 status
= get_nt_acl_conn(tmp_ctx
, fname
, conn
, security_info_wanted
, &sd
);
600 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
602 py_sd
= py_return_ndr_struct("samba.dcerpc.security", "descriptor", sd
, sd
);
604 TALLOC_FREE(tmp_ctx
);
610 set the posix (or similar) ACL on a file
612 static PyObject
*py_smbd_set_sys_acl(PyObject
*self
, PyObject
*args
, PyObject
*kwargs
)
614 const char * const kwnames
[] = { "fname", "acl_type", "acl", "service", NULL
};
615 TALLOC_CTX
*frame
= talloc_stackframe();
617 char *fname
, *service
= NULL
;
619 struct smb_acl_t
*acl
;
621 connection_struct
*conn
;
623 if (!PyArg_ParseTupleAndKeywords(args
, kwargs
, "siO|z",
624 discard_const_p(char *, kwnames
),
625 &fname
, &acl_type
, &py_acl
, &service
)) {
630 if (!py_check_dcerpc_type(py_acl
, "samba.dcerpc.smb_acl", "t")) {
635 conn
= get_conn(frame
, service
);
641 acl
= pytalloc_get_type(py_acl
, struct smb_acl_t
);
643 ret
= set_sys_acl_conn(fname
, acl_type
, acl
, conn
);
647 return PyErr_SetFromErrno(PyExc_OSError
);
655 Return the posix (or similar) ACL on a file
657 static PyObject
*py_smbd_get_sys_acl(PyObject
*self
, PyObject
*args
, PyObject
*kwargs
)
659 const char * const kwnames
[] = { "fname", "acl_type", "service", NULL
};
662 struct smb_acl_t
*acl
;
664 TALLOC_CTX
*frame
= talloc_stackframe();
665 TALLOC_CTX
*tmp_ctx
= talloc_new(NULL
);
666 connection_struct
*conn
;
667 char *service
= NULL
;
668 struct smb_filename
*smb_fname
= NULL
;
675 if (!PyArg_ParseTupleAndKeywords(args
, kwargs
, "si|z",
676 discard_const_p(char *, kwnames
),
677 &fname
, &acl_type
, &service
)) {
679 TALLOC_FREE(tmp_ctx
);
683 conn
= get_conn(frame
, service
);
686 TALLOC_FREE(tmp_ctx
);
690 smb_fname
= synthetic_smb_fname_split(frame
,
692 lp_posix_pathnames());
693 if (smb_fname
== NULL
) {
695 TALLOC_FREE(tmp_ctx
);
698 acl
= SMB_VFS_SYS_ACL_GET_FILE( conn
, smb_fname
, acl_type
, tmp_ctx
);
701 TALLOC_FREE(tmp_ctx
);
702 return PyErr_SetFromErrno(PyExc_OSError
);
705 py_acl
= py_return_ndr_struct("samba.dcerpc.smb_acl", "t", acl
, acl
);
708 TALLOC_FREE(tmp_ctx
);
713 static PyMethodDef py_smbd_methods
[] = {
715 (PyCFunction
)py_smbd_have_posix_acls
, METH_NOARGS
,
718 (PyCFunction
)py_smbd_set_simple_acl
, METH_VARARGS
|METH_KEYWORDS
,
721 (PyCFunction
)py_smbd_set_nt_acl
, METH_VARARGS
|METH_KEYWORDS
,
724 (PyCFunction
)py_smbd_get_nt_acl
, METH_VARARGS
|METH_KEYWORDS
,
727 (PyCFunction
)py_smbd_get_sys_acl
, METH_VARARGS
|METH_KEYWORDS
,
730 (PyCFunction
)py_smbd_set_sys_acl
, METH_VARARGS
|METH_KEYWORDS
,
733 (PyCFunction
)py_smbd_chown
, METH_VARARGS
|METH_KEYWORDS
,
736 (PyCFunction
)py_smbd_unlink
, METH_VARARGS
|METH_KEYWORDS
,
746 m
= Py_InitModule3("smbd", py_smbd_methods
,
747 "Python bindings for the smbd file server.");