source3/smbd/pysmbd.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Set NT and POSIX ACLs and other VFS operations from Python
   4
   5    Copyrigyt (C) Andrew Bartlett 2012
   6    Copyright (C) Jeremy Allison 1994-2009.
   7    Copyright (C) Andreas Gruenbacher 2002.
   8    Copyright (C) Simo Sorce <idra@samba.org> 2009.
   9    Copyright (C) Simo Sorce 2002
  10    Copyright (C) Eric Lorimer 2002
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "smbd/smbd.h"
  28 #include <Python.h>
  29 #include "libcli/util/pyerrors.h"
  30 #include "librpc/rpc/pyrpc_util.h"
  31 #include <pytalloc.h>
  32 #include "system/filesys.h"
  33
  34 extern const struct generic_mapping file_generic_mapping;
  35
  36 #undef  DBGC_CLASS
  37 #define DBGC_CLASS DBGC_ACLS
  38
  39 static NTSTATUS set_sys_acl_no_snum(const char *fname,
  40                                      SMB_ACL_TYPE_T acltype,
  41                                      SMB_ACL_T theacl)
  42 {
  43         connection_struct *conn;
  44         NTSTATUS status = NT_STATUS_OK;
  45         int ret;
  46
  47         conn = talloc_zero(NULL, connection_struct);
  48         if (conn == NULL) {
  49                 DEBUG(0, ("talloc failed\n"));
  50                 return NT_STATUS_NO_MEMORY;
  51         }
  52
  53         if (!(conn->params = talloc(conn, struct share_params))) {
  54                 DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
  55                 TALLOC_FREE(conn);
  56                 return NT_STATUS_NO_MEMORY;
  57         }
  58
  59         conn->params->service = -1;
  60
  61         set_conn_connectpath(conn, "/");
  62
  63         smbd_vfs_init(conn);
  64
  65         ret = SMB_VFS_SYS_ACL_SET_FILE( conn, fname, acltype, theacl);
  66         if (ret != 0) {
  67                 status = map_nt_error_from_unix_common(ret);
  68                 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned zero.\n"));
  69         }
  70
  71         conn_free(conn);
  72
  73         return status;
  74 }
  75
  76 static NTSTATUS set_nt_acl_no_snum(const char *fname,
  77                                    uint32 security_info_sent, const struct security_descriptor *sd)
  78 {
  79         TALLOC_CTX *frame = talloc_stackframe();
  80         connection_struct *conn;
  81         NTSTATUS status = NT_STATUS_OK;
  82         files_struct *fsp;
  83         struct smb_filename *smb_fname = NULL;
  84         int flags;
  85
  86         conn = talloc_zero(frame, connection_struct);
  87         if (conn == NULL) {
  88                 DEBUG(0, ("talloc failed\n"));
  89                 return NT_STATUS_NO_MEMORY;
  90         }
  91
  92         if (!(conn->params = talloc(conn, struct share_params))) {
  93                 DEBUG(0,("set_nt_acl_no_snum: talloc() failed!\n"));
  94                 TALLOC_FREE(frame);
  95                 return NT_STATUS_NO_MEMORY;
  96         }
  97
  98         conn->params->service = -1;
  99
 100         set_conn_connectpath(conn, "/");
 101
 102         smbd_vfs_init(conn);
 103
 104         fsp = talloc_zero(frame, struct files_struct);
 105         if (fsp == NULL) {
 106                 TALLOC_FREE(frame);
 107                 return NT_STATUS_NO_MEMORY;
 108         }
 109         fsp->fh = talloc(fsp, struct fd_handle);
 110         if (fsp->fh == NULL) {
 111                 TALLOC_FREE(frame);
 112                 return NT_STATUS_NO_MEMORY;
 113         }
 114         fsp->conn = conn;
 115
 116         status = create_synthetic_smb_fname_split(fsp, fname, NULL,
 117                                                   &smb_fname);
 118         if (!NT_STATUS_IS_OK(status)) {
 119                 TALLOC_FREE(frame);
 120                 return status;
 121         }
 122
 123         fsp->fsp_name = smb_fname;
 124
 125 #ifdef O_DIRECTORY
 126         flags = O_RDONLY|O_DIRECTORY;
 127 #else
 128         /* POSIX allows us to open a directory with O_RDONLY. */
 129         flags = O_RDONLY;
 130 #endif
 131
 132         fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, O_RDWR, 00400);
 133         if (fsp->fh->fd == -1 && errno == EISDIR) {
 134                 fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, flags, 00400);
 135         }
 136         if (fsp->fh->fd == -1) {
 137                 printf("open: error=%d (%s)\n", errno, strerror(errno));
 138                 TALLOC_FREE(frame);
 139                 return NT_STATUS_UNSUCCESSFUL;
 140         }
 141
 142         status = SMB_VFS_FSET_NT_ACL( fsp, security_info_sent, sd);
 143         if (!NT_STATUS_IS_OK(status)) {
 144                 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned %s.\n", nt_errstr(status)));
 145         }
 146
 147         conn_free(conn);
 148         TALLOC_FREE(frame);
 149
 150         return status;
 151 }
 152
 153
 154 static SMB_ACL_T make_simple_acl(gid_t gid, mode_t chmod_mode)
 155 {
 156         TALLOC_CTX *frame = talloc_stackframe();
 157
 158         mode_t mode = SMB_ACL_READ|SMB_ACL_WRITE;
 159
 160         mode_t mode_user = (chmod_mode & 0700) >> 6;
 161         mode_t mode_group = (chmod_mode & 070) >> 3;
 162         mode_t mode_other = chmod_mode &  07;
 163         SMB_ACL_ENTRY_T entry;
 164         SMB_ACL_T acl = sys_acl_init(frame);
 165
 166         if (!acl) {
 167                 return NULL;
 168         }
 169
 170         if (sys_acl_create_entry(&acl, &entry) != 0) {
 171                 TALLOC_FREE(frame);
 172                 return NULL;
 173         }
 174
 175         if (sys_acl_set_tag_type(entry, SMB_ACL_USER_OBJ) != 0) {
 176                 TALLOC_FREE(frame);
 177                 return NULL;
 178         }
 179
 180         if (sys_acl_set_permset(entry, &mode_user) != 0) {
 181                 TALLOC_FREE(frame);
 182                 return NULL;
 183         }
 184
 185         if (sys_acl_create_entry(&acl, &entry) != 0) {
 186                 TALLOC_FREE(frame);
 187                 return NULL;
 188         }
 189
 190         if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP_OBJ) != 0) {
 191                 TALLOC_FREE(frame);
 192                 return NULL;
 193         }
 194
 195         if (sys_acl_set_permset(entry, &mode_group) != 0) {
 196                 TALLOC_FREE(frame);
 197                 return NULL;
 198         }
 199
 200         if (sys_acl_create_entry(&acl, &entry) != 0) {
 201                 TALLOC_FREE(frame);
 202                 return NULL;
 203         }
 204
 205         if (sys_acl_set_tag_type(entry, SMB_ACL_OTHER) != 0) {
 206                 TALLOC_FREE(frame);
 207                 return NULL;
 208         }
 209
 210         if (sys_acl_set_permset(entry, &mode_other) != 0) {
 211                 TALLOC_FREE(frame);
 212                 return NULL;
 213         }
 214
 215         if (gid != -1) {
 216                 if (sys_acl_create_entry(&acl, &entry) != 0) {
 217                         TALLOC_FREE(frame);
 218                         return NULL;
 219                 }
 220
 221                 if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP) != 0) {
 222                         TALLOC_FREE(frame);
 223                         return NULL;
 224                 }
 225
 226                 if (sys_acl_set_qualifier(entry, &gid) != 0) {
 227                         TALLOC_FREE(frame);
 228                         return NULL;
 229                 }
 230
 231                 if (sys_acl_set_permset(entry, &mode_group) != 0) {
 232                         TALLOC_FREE(frame);
 233                         return NULL;
 234                 }
 235         }
 236
 237         if (sys_acl_create_entry(&acl, &entry) != 0) {
 238                 TALLOC_FREE(frame);
 239                 return NULL;
 240         }
 241
 242         if (sys_acl_set_tag_type(entry, SMB_ACL_MASK) != 0) {
 243                 TALLOC_FREE(frame);
 244                 return NULL;
 245         }
 246
 247         if (sys_acl_set_permset(entry, &mode) != 0) {
 248                 TALLOC_FREE(frame);
 249                 return NULL;
 250         }
 251         return acl;
 252 }
 253
 254 /*
 255   set a simple ACL on a file, as a test
 256  */
 257 static PyObject *py_smbd_set_simple_acl(PyObject *self, PyObject *args)
 258 {
 259         NTSTATUS status;
 260         char *fname;
 261         int mode, gid = -1;
 262         SMB_ACL_T acl;
 263         TALLOC_CTX *frame;
 264
 265         if (!PyArg_ParseTuple(args, "si|i", &fname, &mode, &gid))
 266                 return NULL;
 267
 268         acl = make_simple_acl(gid, mode);
 269
 270         frame = talloc_stackframe();
 271
 272         status = set_sys_acl_no_snum(fname, SMB_ACL_TYPE_ACCESS, acl);
 273         TALLOC_FREE(acl);
 274
 275         TALLOC_FREE(frame);
 276
 277         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 278
 279         Py_RETURN_NONE;
 280 }
 281
 282 /*
 283   chown a file
 284  */
 285 static PyObject *py_smbd_chown(PyObject *self, PyObject *args)
 286 {
 287         connection_struct *conn;
 288         NTSTATUS status = NT_STATUS_OK;
 289         int ret;
 290
 291         char *fname;
 292         int uid, gid;
 293         TALLOC_CTX *frame;
 294
 295         if (!PyArg_ParseTuple(args, "sii", &fname, &uid, &gid))
 296                 return NULL;
 297
 298         frame = talloc_stackframe();
 299
 300         conn = talloc_zero(frame, connection_struct);
 301         if (conn == NULL) {
 302                 PyErr_NoMemory();
 303                 return NULL;
 304         }
 305
 306         if (!(conn->params = talloc(conn, struct share_params))) {
 307                 PyErr_NoMemory();
 308                 return NULL;
 309         }
 310
 311         conn->params->service = -1;
 312
 313         set_conn_connectpath(conn, "/");
 314
 315         smbd_vfs_init(conn);
 316
 317         ret = SMB_VFS_CHOWN( conn, fname, uid, gid);
 318         if (ret != 0) {
 319                 status = map_nt_error_from_unix_common(errno);
 320                 DEBUG(0,("chown returned failure: %s\n", strerror(errno)));
 321         }
 322
 323         conn_free(conn);
 324
 325         TALLOC_FREE(frame);
 326
 327         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 328
 329         Py_RETURN_NONE;
 330 }
 331
 332 /*
 333   chown a file
 334  */
 335 static PyObject *py_smbd_unlink(PyObject *self, PyObject *args)
 336 {
 337         connection_struct *conn;
 338         NTSTATUS status = NT_STATUS_OK;
 339         int ret;
 340         struct smb_filename *smb_fname = NULL;
 341         char *fname;
 342         int uid, gid;
 343         TALLOC_CTX *frame;
 344         mode_t saved_umask;
 345
 346         if (!PyArg_ParseTuple(args, "s", &fname))
 347                 return NULL;
 348
 349         frame = talloc_stackframe();
 350
 351         conn = talloc_zero(frame, connection_struct);
 352         if (conn == NULL) {
 353                 PyErr_NoMemory();
 354                 return NULL;
 355         }
 356
 357         if (!(conn->params = talloc(conn, struct share_params))) {
 358                 PyErr_NoMemory();
 359                 return NULL;
 360         }
 361
 362         /* we want total control over the permissions on created files,
 363            so set our umask to 0 */
 364         saved_umask = umask(0);
 365
 366         conn->params->service = -1;
 367
 368         set_conn_connectpath(conn, "/");
 369
 370         smbd_vfs_init(conn);
 371
 372         status = create_synthetic_smb_fname_split(frame, fname, NULL,
 373                                                   &smb_fname);
 374         if (!NT_STATUS_IS_OK(status)) {
 375                 TALLOC_FREE(frame);
 376                 umask(saved_umask);
 377                 PyErr_NTSTATUS_IS_ERR_RAISE(status);
 378         }
 379
 380         ret = SMB_VFS_UNLINK(conn, smb_fname);
 381         if (ret != 0) {
 382                 status = map_nt_error_from_unix_common(errno);
 383                 DEBUG(0,("unlink returned failure: %s\n", strerror(errno)));
 384         }
 385
 386         umask(saved_umask);
 387
 388         conn_free(conn);
 389
 390         TALLOC_FREE(frame);
 391
 392         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 393
 394         Py_RETURN_NONE;
 395 }
 396
 397 /*
 398   check if we have ACL support
 399  */
 400 static PyObject *py_smbd_have_posix_acls(PyObject *self, PyObject *args)
 401 {
 402 #ifdef HAVE_POSIX_ACLS
 403         return PyBool_FromLong(true);
 404 #else
 405         return PyBool_FromLong(false);
 406 #endif
 407 }
 408
 409 /*
 410   set the NT ACL on a file
 411  */
 412 static PyObject *py_smbd_set_nt_acl(PyObject *self, PyObject *args)
 413 {
 414         NTSTATUS status;
 415         char *fname;
 416         int security_info_sent;
 417         PyObject *py_sd;
 418         struct security_descriptor *sd;
 419
 420         if (!PyArg_ParseTuple(args, "siO", &fname, &security_info_sent, &py_sd))
 421                 return NULL;
 422
 423         if (!py_check_dcerpc_type(py_sd, "samba.dcerpc.security", "descriptor")) {
 424                 return NULL;
 425         }
 426
 427         sd = pytalloc_get_type(py_sd, struct security_descriptor);
 428
 429         status = set_nt_acl_no_snum(fname, security_info_sent, sd);
 430         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 431
 432         Py_RETURN_NONE;
 433 }
 434
 435 /*
 436   Return the NT ACL on a file
 437  */
 438 static PyObject *py_smbd_get_nt_acl(PyObject *self, PyObject *args)
 439 {
 440         char *fname;
 441         int security_info_wanted;
 442         PyObject *py_sd;
 443         struct security_descriptor *sd;
 444         TALLOC_CTX *tmp_ctx = talloc_new(NULL);
 445
 446         if (!PyArg_ParseTuple(args, "si", &fname, &security_info_wanted))
 447                 return NULL;
 448
 449         sd = get_nt_acl_no_snum(tmp_ctx, fname, security_info_wanted);
 450
 451         py_sd = py_return_ndr_struct("samba.dcerpc.security", "descriptor", sd, sd);
 452
 453         talloc_free(tmp_ctx);
 454
 455         return py_sd;
 456 }
 457
 458 /*
 459   set the posix (or similar) ACL on a file
 460  */
 461 static PyObject *py_smbd_set_sys_acl(PyObject *self, PyObject *args)
 462 {
 463         NTSTATUS status;
 464         char *fname;
 465         PyObject *py_acl;
 466         struct smb_acl_t *acl;
 467         int acl_type;
 468
 469         if (!PyArg_ParseTuple(args, "siO", &fname, &acl_type, &py_acl))
 470                 return NULL;
 471
 472         if (!py_check_dcerpc_type(py_acl, "samba.dcerpc.smb_acl", "t")) {
 473                 return NULL;
 474         }
 475
 476         acl = pytalloc_get_type(py_acl, struct smb_acl_t);
 477
 478         status = set_sys_acl_no_snum(fname, acl_type, acl);
 479         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 480
 481         Py_RETURN_NONE;
 482 }
 483
 484 /*
 485   Return the posix (or similar) ACL on a file
 486  */
 487 static PyObject *py_smbd_get_sys_acl(PyObject *self, PyObject *args)
 488 {
 489         char *fname;
 490         PyObject *py_acl;
 491         struct smb_acl_t *acl;
 492         int acl_type;
 493         TALLOC_CTX *frame = talloc_stackframe();
 494         connection_struct *conn;
 495         NTSTATUS status = NT_STATUS_OK;
 496
 497         if (!PyArg_ParseTuple(args, "si", &fname, &acl_type)) {
 498                 TALLOC_FREE(frame);
 499                 return NULL;
 500         }
 501
 502         conn = talloc_zero(frame, connection_struct);
 503         if (conn == NULL) {
 504                 DEBUG(0, ("talloc failed\n"));
 505                 PyErr_NoMemory();
 506                 TALLOC_FREE(frame);
 507                 return NULL;
 508         }
 509
 510         if (!(conn->params = talloc(conn, struct share_params))) {
 511                 DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
 512                 PyErr_NoMemory();
 513                 TALLOC_FREE(frame);
 514                 return NULL;
 515         }
 516
 517         conn->params->service = -1;
 518
 519         set_conn_connectpath(conn, "/");
 520
 521         smbd_vfs_init(conn);
 522
 523         acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, acl_type, frame);
 524         if (!acl) {
 525                 TALLOC_FREE(frame);
 526                 status = map_nt_error_from_unix_common(errno);
 527                 DEBUG(0,("sys_acl_get_file returned NULL: %s\n", strerror(errno)));
 528                 PyErr_NTSTATUS_IS_ERR_RAISE(status);
 529         }
 530
 531         conn_free(conn);
 532
 533         py_acl = py_return_ndr_struct("samba.dcerpc.smb_acl", "t", acl, acl);
 534
 535         TALLOC_FREE(frame);
 536
 537         return py_acl;
 538 }
 539
 540 static PyMethodDef py_smbd_methods[] = {
 541         { "have_posix_acls",
 542                 (PyCFunction)py_smbd_have_posix_acls, METH_VARARGS,
 543                 NULL },
 544         { "set_simple_acl",
 545                 (PyCFunction)py_smbd_set_simple_acl, METH_VARARGS,
 546                 NULL },
 547         { "set_nt_acl",
 548                 (PyCFunction)py_smbd_set_nt_acl, METH_VARARGS,
 549                 NULL },
 550         { "get_nt_acl",
 551                 (PyCFunction)py_smbd_get_nt_acl, METH_VARARGS,
 552                 NULL },
 553         { "get_sys_acl",
 554                 (PyCFunction)py_smbd_get_sys_acl, METH_VARARGS,
 555                 NULL },
 556         { "set_sys_acl",
 557                 (PyCFunction)py_smbd_set_sys_acl, METH_VARARGS,
 558                 NULL },
 559         { "chown",
 560                 (PyCFunction)py_smbd_chown, METH_VARARGS,
 561                 NULL },
 562         { "unlink",
 563                 (PyCFunction)py_smbd_unlink, METH_VARARGS,
 564                 NULL },
 565         { NULL }
 566 };
 567
 568 void initsmbd(void);
 569 void initsmbd(void)
 570 {
 571         PyObject *m;
 572
 573         m = Py_InitModule3("smbd", py_smbd_methods,
 574                            "Python bindings for the smbd file server.");
 575         if (m == NULL)
 576                 return;
 577
 578 }