?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix bug #9724 - is_encrypted_packet() function incorrectly used inside server.
[Samba.git] / source3 / smbd / posix_acls.c
blob8d6e7ecea487e62366d76c8344edf5902cf0c866
1 /*
2 Unix SMB/CIFS implementation.
3 SMB NT Security Descriptor / Unix permission conversion.
4 Copyright (C) Jeremy Allison 1994-2009.
5 Copyright (C) Andreas Gruenbacher 2002.
6 Copyright (C) Simo Sorce <idra@samba.org> 2009.
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "smbd/smbd.h"
24 #include "system/filesys.h"
25 #include "../libcli/security/security.h"
26 #include "trans2.h"
27 #include "passdb/lookup_sid.h"
28 #include "auth.h"
29
30 extern const struct generic_mapping file_generic_mapping;
31
32 #undef DBGC_CLASS
33 #define DBGC_CLASS DBGC_ACLS
34
35 /****************************************************************************
36 Data structures representing the internal ACE format.
37 ****************************************************************************/
38
39 enum ace_owner {UID_ACE, GID_ACE, WORLD_ACE};
40 enum ace_attribute {ALLOW_ACE, DENY_ACE}; /* Used for incoming NT ACLS. */
41
42 typedef union posix_id {
43 uid_t uid;
44 gid_t gid;
45 int world;
46 } posix_id;
47
48 typedef struct canon_ace {
49 struct canon_ace *next, *prev;
50 SMB_ACL_TAG_T type;
51 mode_t perms; /* Only use S_I(R|W|X)USR mode bits here. */
52 struct dom_sid trustee;
53 enum ace_owner owner_type;
54 enum ace_attribute attr;
55 posix_id unix_ug;
56 uint8_t ace_flags; /* From windows ACE entry. */
57 } canon_ace;
58
59 #define ALL_ACE_PERMS (S_IRUSR|S_IWUSR|S_IXUSR)
60
61 /*
62 * EA format of user.SAMBA_PAI (Samba_Posix_Acl_Interitance)
63 * attribute on disk - version 1.
64 * All values are little endian.
65 *
66 * | 1 | 1 | 2 | 2 | ....
67 * +------+------+-------------+---------------------+-------------+--------------------+
68 * | vers | flag | num_entries | num_default_entries | ..entries.. | default_entries... |
69 * +------+------+-------------+---------------------+-------------+--------------------+
70 *
71 * Entry format is :
72 *
73 * | 1 | 4 |
74 * +------+-------------------+
75 * | value| uid/gid or world |
76 * | type | value |
77 * +------+-------------------+
78 *
79 * Version 2 format. Stores extra Windows metadata about an ACL.
80 *
81 * | 1 | 2 | 2 | 2 | ....
82 * +------+----------+-------------+---------------------+-------------+--------------------+
83 * | vers | ace | num_entries | num_default_entries | ..entries.. | default_entries... |
84 * | 2 | type | | | | |
85 * +------+----------+-------------+---------------------+-------------+--------------------+
86 *
87 * Entry format is :
88 *
89 * | 1 | 1 | 4 |
90 * +------+------+-------------------+
91 * | ace | value| uid/gid or world |
92 * | flag | type | value |
93 * +------+-------------------+------+
94 *
95 */
96
97 #define PAI_VERSION_OFFSET 0
98
99 #define PAI_V1_FLAG_OFFSET 1
100 #define PAI_V1_NUM_ENTRIES_OFFSET 2
101 #define PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET 4
102 #define PAI_V1_ENTRIES_BASE 6
103 #define PAI_V1_ACL_FLAG_PROTECTED 0x1
104 #define PAI_V1_ENTRY_LENGTH 5
105
106 #define PAI_V1_VERSION 1
107
108 #define PAI_V2_TYPE_OFFSET 1
109 #define PAI_V2_NUM_ENTRIES_OFFSET 3
110 #define PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET 5
111 #define PAI_V2_ENTRIES_BASE 7
112 #define PAI_V2_ENTRY_LENGTH 6
113
114 #define PAI_V2_VERSION 2
115
116 /*
117 * In memory format of user.SAMBA_PAI attribute.
118 */
119
120 struct pai_entry {
121 struct pai_entry *next, *prev;
122 uint8_t ace_flags;
123 enum ace_owner owner_type;
124 posix_id unix_ug;
125 };
126
127 struct pai_val {
128 uint16_t sd_type;
129 unsigned int num_entries;
130 struct pai_entry *entry_list;
131 unsigned int num_def_entries;
132 struct pai_entry *def_entry_list;
133 };
134
135 /************************************************************************
136 Return a uint32 of the pai_entry principal.
137 ************************************************************************/
138
139 static uint32_t get_pai_entry_val(struct pai_entry *paie)
140 {
141 switch (paie->owner_type) {
142 case UID_ACE:
143 DEBUG(10,("get_pai_entry_val: uid = %u\n", (unsigned int)paie->unix_ug.uid ));
144 return (uint32_t)paie->unix_ug.uid;
145 case GID_ACE:
146 DEBUG(10,("get_pai_entry_val: gid = %u\n", (unsigned int)paie->unix_ug.gid ));
147 return (uint32_t)paie->unix_ug.gid;
148 case WORLD_ACE:
149 default:
150 DEBUG(10,("get_pai_entry_val: world ace\n"));
151 return (uint32_t)-1;
152 }
153 }
154
155 /************************************************************************
156 Return a uint32 of the entry principal.
157 ************************************************************************/
158
159 static uint32_t get_entry_val(canon_ace *ace_entry)
160 {
161 switch (ace_entry->owner_type) {
162 case UID_ACE:
163 DEBUG(10,("get_entry_val: uid = %u\n", (unsigned int)ace_entry->unix_ug.uid ));
164 return (uint32_t)ace_entry->unix_ug.uid;
165 case GID_ACE:
166 DEBUG(10,("get_entry_val: gid = %u\n", (unsigned int)ace_entry->unix_ug.gid ));
167 return (uint32_t)ace_entry->unix_ug.gid;
168 case WORLD_ACE:
169 default:
170 DEBUG(10,("get_entry_val: world ace\n"));
171 return (uint32_t)-1;
172 }
173 }
174
175 /************************************************************************
176 Create the on-disk format (always v2 now). Caller must free.
177 ************************************************************************/
178
179 static char *create_pai_buf_v2(canon_ace *file_ace_list,
180 canon_ace *dir_ace_list,
181 uint16_t sd_type,
182 size_t *store_size)
183 {
184 char *pai_buf = NULL;
185 canon_ace *ace_list = NULL;
186 char *entry_offset = NULL;
187 unsigned int num_entries = 0;
188 unsigned int num_def_entries = 0;
189 unsigned int i;
190
191 for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next) {
192 num_entries++;
193 }
194
195 for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next) {
196 num_def_entries++;
197 }
198
199 DEBUG(10,("create_pai_buf_v2: num_entries = %u, num_def_entries = %u\n", num_entries, num_def_entries ));
200
201 *store_size = PAI_V2_ENTRIES_BASE +
202 ((num_entries + num_def_entries)*PAI_V2_ENTRY_LENGTH);
203
204 pai_buf = (char *)SMB_MALLOC(*store_size);
205 if (!pai_buf) {
206 return NULL;
207 }
208
209 /* Set up the header. */
210 memset(pai_buf, '\0', PAI_V2_ENTRIES_BASE);
211 SCVAL(pai_buf,PAI_VERSION_OFFSET,PAI_V2_VERSION);
212 SSVAL(pai_buf,PAI_V2_TYPE_OFFSET, sd_type);
213 SSVAL(pai_buf,PAI_V2_NUM_ENTRIES_OFFSET,num_entries);
214 SSVAL(pai_buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET,num_def_entries);
215
216 DEBUG(10,("create_pai_buf_v2: sd_type = 0x%x\n",
217 (unsigned int)sd_type ));
218
219 entry_offset = pai_buf + PAI_V2_ENTRIES_BASE;
220
221 i = 0;
222 for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next) {
223 uint8_t type_val = (uint8_t)ace_list->owner_type;
224 uint32_t entry_val = get_entry_val(ace_list);
225
226 SCVAL(entry_offset,0,ace_list->ace_flags);
227 SCVAL(entry_offset,1,type_val);
228 SIVAL(entry_offset,2,entry_val);
229 DEBUG(10,("create_pai_buf_v2: entry %u [0x%x] [0x%x] [0x%x]\n",
230 i,
231 (unsigned int)ace_list->ace_flags,
232 (unsigned int)type_val,
233 (unsigned int)entry_val ));
234 i++;
235 entry_offset += PAI_V2_ENTRY_LENGTH;
236 }
237
238 for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next) {
239 uint8_t type_val = (uint8_t)ace_list->owner_type;
240 uint32_t entry_val = get_entry_val(ace_list);
241
242 SCVAL(entry_offset,0,ace_list->ace_flags);
243 SCVAL(entry_offset,1,type_val);
244 SIVAL(entry_offset,2,entry_val);
245 DEBUG(10,("create_pai_buf_v2: entry %u [0x%x] [0x%x] [0x%x]\n",
246 i,
247 (unsigned int)ace_list->ace_flags,
248 (unsigned int)type_val,
249 (unsigned int)entry_val ));
250 i++;
251 entry_offset += PAI_V2_ENTRY_LENGTH;
252 }
253
254 return pai_buf;
255 }
256
257 /************************************************************************
258 Store the user.SAMBA_PAI attribute on disk.
259 ************************************************************************/
260
261 static void store_inheritance_attributes(files_struct *fsp,
262 canon_ace *file_ace_list,
263 canon_ace *dir_ace_list,
264 uint16_t sd_type)
265 {
266 int ret;
267 size_t store_size;
268 char *pai_buf;
269
270 if (!lp_map_acl_inherit(SNUM(fsp->conn))) {
271 return;
272 }
273
274 pai_buf = create_pai_buf_v2(file_ace_list, dir_ace_list,
275 sd_type, &store_size);
276
277 if (fsp->fh->fd != -1) {
278 ret = SMB_VFS_FSETXATTR(fsp, SAMBA_POSIX_INHERITANCE_EA_NAME,
279 pai_buf, store_size, 0);
280 } else {
281 ret = SMB_VFS_SETXATTR(fsp->conn, fsp->fsp_name->base_name,
282 SAMBA_POSIX_INHERITANCE_EA_NAME,
283 pai_buf, store_size, 0);
284 }
285
286 SAFE_FREE(pai_buf);
287
288 DEBUG(10,("store_inheritance_attribute: type 0x%x for file %s\n",
289 (unsigned int)sd_type,
290 fsp_str_dbg(fsp)));
291
292 if (ret == -1 && !no_acl_syscall_error(errno)) {
293 DEBUG(1,("store_inheritance_attribute: Error %s\n", strerror(errno) ));
294 }
295 }
296
297 /************************************************************************
298 Delete the in memory inheritance info.
299 ************************************************************************/
300
301 static void free_inherited_info(struct pai_val *pal)
302 {
303 if (pal) {
304 struct pai_entry *paie, *paie_next;
305 for (paie = pal->entry_list; paie; paie = paie_next) {
306 paie_next = paie->next;
307 SAFE_FREE(paie);
308 }
309 for (paie = pal->def_entry_list; paie; paie = paie_next) {
310 paie_next = paie->next;
311 SAFE_FREE(paie);
312 }
313 SAFE_FREE(pal);
314 }
315 }
316
317 /************************************************************************
318 Get any stored ACE flags.
319 ************************************************************************/
320
321 static uint16_t get_pai_flags(struct pai_val *pal, canon_ace *ace_entry, bool default_ace)
322 {
323 struct pai_entry *paie;
324
325 if (!pal) {
326 return 0;
327 }
328
329 /* If the entry exists it is inherited. */
330 for (paie = (default_ace ? pal->def_entry_list : pal->entry_list); paie; paie = paie->next) {
331 if (ace_entry->owner_type == paie->owner_type &&
332 get_entry_val(ace_entry) == get_pai_entry_val(paie))
333 return paie->ace_flags;
334 }
335 return 0;
336 }
337
338 /************************************************************************
339 Ensure an attribute just read is valid - v1.
340 ************************************************************************/
341
342 static bool check_pai_ok_v1(const char *pai_buf, size_t pai_buf_data_size)
343 {
344 uint16 num_entries;
345 uint16 num_def_entries;
346
347 if (pai_buf_data_size < PAI_V1_ENTRIES_BASE) {
348 /* Corrupted - too small. */
349 return false;
350 }
351
352 if (CVAL(pai_buf,PAI_VERSION_OFFSET) != PAI_V1_VERSION) {
353 return false;
354 }
355
356 num_entries = SVAL(pai_buf,PAI_V1_NUM_ENTRIES_OFFSET);
357 num_def_entries = SVAL(pai_buf,PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET);
358
359 /* Check the entry lists match. */
360 /* Each entry is 5 bytes (type plus 4 bytes of uid or gid). */
361
362 if (((num_entries + num_def_entries)*PAI_V1_ENTRY_LENGTH) +
363 PAI_V1_ENTRIES_BASE != pai_buf_data_size) {
364 return false;
365 }
366
367 return true;
368 }
369
370 /************************************************************************
371 Ensure an attribute just read is valid - v2.
372 ************************************************************************/
373
374 static bool check_pai_ok_v2(const char *pai_buf, size_t pai_buf_data_size)
375 {
376 uint16 num_entries;
377 uint16 num_def_entries;
378
379 if (pai_buf_data_size < PAI_V2_ENTRIES_BASE) {
380 /* Corrupted - too small. */
381 return false;
382 }
383
384 if (CVAL(pai_buf,PAI_VERSION_OFFSET) != PAI_V2_VERSION) {
385 return false;
386 }
387
388 num_entries = SVAL(pai_buf,PAI_V2_NUM_ENTRIES_OFFSET);
389 num_def_entries = SVAL(pai_buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET);
390
391 /* Check the entry lists match. */
392 /* Each entry is 6 bytes (flags + type + 4 bytes of uid or gid). */
393
394 if (((num_entries + num_def_entries)*PAI_V2_ENTRY_LENGTH) +
395 PAI_V2_ENTRIES_BASE != pai_buf_data_size) {
396 return false;
397 }
398
399 return true;
400 }
401
402 /************************************************************************
403 Decode the owner.
404 ************************************************************************/
405
406 static bool get_pai_owner_type(struct pai_entry *paie, const char *entry_offset)
407 {
408 paie->owner_type = (enum ace_owner)CVAL(entry_offset,0);
409 switch( paie->owner_type) {
410 case UID_ACE:
411 paie->unix_ug.uid = (uid_t)IVAL(entry_offset,1);
412 DEBUG(10,("get_pai_owner_type: uid = %u\n",
413 (unsigned int)paie->unix_ug.uid ));
414 break;
415 case GID_ACE:
416 paie->unix_ug.gid = (gid_t)IVAL(entry_offset,1);
417 DEBUG(10,("get_pai_owner_type: gid = %u\n",
418 (unsigned int)paie->unix_ug.gid ));
419 break;
420 case WORLD_ACE:
421 paie->unix_ug.world = -1;
422 DEBUG(10,("get_pai_owner_type: world ace\n"));
423 break;
424 default:
425 DEBUG(10,("get_pai_owner_type: unknown type %u\n",
426 (unsigned int)paie->owner_type ));
427 return false;
428 }
429 return true;
430 }
431
432 /************************************************************************
433 Process v2 entries.
434 ************************************************************************/
435
436 static const char *create_pai_v1_entries(struct pai_val *paiv,
437 const char *entry_offset,
438 bool def_entry)
439 {
440 int i;
441
442 for (i = 0; i < paiv->num_entries; i++) {
443 struct pai_entry *paie = SMB_MALLOC_P(struct pai_entry);
444 if (!paie) {
445 return NULL;
446 }
447
448 paie->ace_flags = SEC_ACE_FLAG_INHERITED_ACE;
449 if (!get_pai_owner_type(paie, entry_offset)) {
450 SAFE_FREE(paie);
451 return NULL;
452 }
453
454 if (!def_entry) {
455 DLIST_ADD(paiv->entry_list, paie);
456 } else {
457 DLIST_ADD(paiv->def_entry_list, paie);
458 }
459 entry_offset += PAI_V1_ENTRY_LENGTH;
460 }
461 return entry_offset;
462 }
463
464 /************************************************************************
465 Convert to in-memory format from version 1.
466 ************************************************************************/
467
468 static struct pai_val *create_pai_val_v1(const char *buf, size_t size)
469 {
470 const char *entry_offset;
471 struct pai_val *paiv = NULL;
472
473 if (!check_pai_ok_v1(buf, size)) {
474 return NULL;
475 }
476
477 paiv = SMB_MALLOC_P(struct pai_val);
478 if (!paiv) {
479 return NULL;
480 }
481
482 memset(paiv, '\0', sizeof(struct pai_val));
483
484 paiv->sd_type = (CVAL(buf,PAI_V1_FLAG_OFFSET) == PAI_V1_ACL_FLAG_PROTECTED) ?
485 SEC_DESC_DACL_PROTECTED : 0;
486
487 paiv->num_entries = SVAL(buf,PAI_V1_NUM_ENTRIES_OFFSET);
488 paiv->num_def_entries = SVAL(buf,PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET);
489
490 entry_offset = buf + PAI_V1_ENTRIES_BASE;
491
492 DEBUG(10,("create_pai_val: num_entries = %u, num_def_entries = %u\n",
493 paiv->num_entries, paiv->num_def_entries ));
494
495 entry_offset = create_pai_v1_entries(paiv, entry_offset, false);
496 if (entry_offset == NULL) {
497 free_inherited_info(paiv);
498 return NULL;
499 }
500 entry_offset = create_pai_v1_entries(paiv, entry_offset, true);
501 if (entry_offset == NULL) {
502 free_inherited_info(paiv);
503 return NULL;
504 }
505
506 return paiv;
507 }
508
509 /************************************************************************
510 Process v2 entries.
511 ************************************************************************/
512
513 static const char *create_pai_v2_entries(struct pai_val *paiv,
514 unsigned int num_entries,
515 const char *entry_offset,
516 bool def_entry)
517 {
518 unsigned int i;
519
520 for (i = 0; i < num_entries; i++) {
521 struct pai_entry *paie = SMB_MALLOC_P(struct pai_entry);
522 if (!paie) {
523 return NULL;
524 }
525
526 paie->ace_flags = CVAL(entry_offset,0);
527
528 if (!get_pai_owner_type(paie, entry_offset+1)) {
529 SAFE_FREE(paie);
530 return NULL;
531 }
532 if (!def_entry) {
533 DLIST_ADD(paiv->entry_list, paie);
534 } else {
535 DLIST_ADD(paiv->def_entry_list, paie);
536 }
537 entry_offset += PAI_V2_ENTRY_LENGTH;
538 }
539 return entry_offset;
540 }
541
542 /************************************************************************
543 Convert to in-memory format from version 2.
544 ************************************************************************/
545
546 static struct pai_val *create_pai_val_v2(const char *buf, size_t size)
547 {
548 const char *entry_offset;
549 struct pai_val *paiv = NULL;
550
551 if (!check_pai_ok_v2(buf, size)) {
552 return NULL;
553 }
554
555 paiv = SMB_MALLOC_P(struct pai_val);
556 if (!paiv) {
557 return NULL;
558 }
559
560 memset(paiv, '\0', sizeof(struct pai_val));
561
562 paiv->sd_type = SVAL(buf,PAI_V2_TYPE_OFFSET);
563
564 paiv->num_entries = SVAL(buf,PAI_V2_NUM_ENTRIES_OFFSET);
565 paiv->num_def_entries = SVAL(buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET);
566
567 entry_offset = buf + PAI_V2_ENTRIES_BASE;
568
569 DEBUG(10,("create_pai_val_v2: sd_type = 0x%x num_entries = %u, num_def_entries = %u\n",
570 (unsigned int)paiv->sd_type,
571 paiv->num_entries, paiv->num_def_entries ));
572
573 entry_offset = create_pai_v2_entries(paiv, paiv->num_entries,
574 entry_offset, false);
575 if (entry_offset == NULL) {
576 free_inherited_info(paiv);
577 return NULL;
578 }
579 entry_offset = create_pai_v2_entries(paiv, paiv->num_def_entries,
580 entry_offset, true);
581 if (entry_offset == NULL) {
582 free_inherited_info(paiv);
583 return NULL;
584 }
585
586 return paiv;
587 }
588
589 /************************************************************************
590 Convert to in-memory format - from either version 1 or 2.
591 ************************************************************************/
592
593 static struct pai_val *create_pai_val(const char *buf, size_t size)
594 {
595 if (size < 1) {
596 return NULL;
597 }
598 if (CVAL(buf,PAI_VERSION_OFFSET) == PAI_V1_VERSION) {
599 return create_pai_val_v1(buf, size);
600 } else if (CVAL(buf,PAI_VERSION_OFFSET) == PAI_V2_VERSION) {
601 return create_pai_val_v2(buf, size);
602 } else {
603 return NULL;
604 }
605 }
606
607 /************************************************************************
608 Load the user.SAMBA_PAI attribute.
609 ************************************************************************/
610
611 static struct pai_val *fload_inherited_info(files_struct *fsp)
612 {
613 char *pai_buf;
614 size_t pai_buf_size = 1024;
615 struct pai_val *paiv = NULL;
616 ssize_t ret;
617
618 if (!lp_map_acl_inherit(SNUM(fsp->conn))) {
619 return NULL;
620 }
621
622 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL) {
623 return NULL;
624 }
625
626 do {
627 if (fsp->fh->fd != -1) {
628 ret = SMB_VFS_FGETXATTR(fsp, SAMBA_POSIX_INHERITANCE_EA_NAME,
629 pai_buf, pai_buf_size);
630 } else {
631 ret = SMB_VFS_GETXATTR(fsp->conn,
632 fsp->fsp_name->base_name,
633 SAMBA_POSIX_INHERITANCE_EA_NAME,
634 pai_buf, pai_buf_size);
635 }
636
637 if (ret == -1) {
638 if (errno != ERANGE) {
639 break;
640 }
641 /* Buffer too small - enlarge it. */
642 pai_buf_size *= 2;
643 SAFE_FREE(pai_buf);
644 if (pai_buf_size > 1024*1024) {
645 return NULL; /* Limit malloc to 1mb. */
646 }
647 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL)
648 return NULL;
649 }
650 } while (ret == -1);
651
652 DEBUG(10,("load_inherited_info: ret = %lu for file %s\n",
653 (unsigned long)ret, fsp_str_dbg(fsp)));
654
655 if (ret == -1) {
656 /* No attribute or not supported. */
657 #if defined(ENOATTR)
658 if (errno != ENOATTR)
659 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
660 #else
661 if (errno != ENOSYS)
662 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
663 #endif
664 SAFE_FREE(pai_buf);
665 return NULL;
666 }
667
668 paiv = create_pai_val(pai_buf, ret);
669
670 if (paiv) {
671 DEBUG(10,("load_inherited_info: ACL type is 0x%x for file %s\n",
672 (unsigned int)paiv->sd_type, fsp_str_dbg(fsp)));
673 }
674
675 SAFE_FREE(pai_buf);
676 return paiv;
677 }
678
679 /************************************************************************
680 Load the user.SAMBA_PAI attribute.
681 ************************************************************************/
682
683 static struct pai_val *load_inherited_info(const struct connection_struct *conn,
684 const char *fname)
685 {
686 char *pai_buf;
687 size_t pai_buf_size = 1024;
688 struct pai_val *paiv = NULL;
689 ssize_t ret;
690
691 if (!lp_map_acl_inherit(SNUM(conn))) {
692 return NULL;
693 }
694
695 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL) {
696 return NULL;
697 }
698
699 do {
700 ret = SMB_VFS_GETXATTR(conn, fname,
701 SAMBA_POSIX_INHERITANCE_EA_NAME,
702 pai_buf, pai_buf_size);
703
704 if (ret == -1) {
705 if (errno != ERANGE) {
706 break;
707 }
708 /* Buffer too small - enlarge it. */
709 pai_buf_size *= 2;
710 SAFE_FREE(pai_buf);
711 if (pai_buf_size > 1024*1024) {
712 return NULL; /* Limit malloc to 1mb. */
713 }
714 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL)
715 return NULL;
716 }
717 } while (ret == -1);
718
719 DEBUG(10,("load_inherited_info: ret = %lu for file %s\n", (unsigned long)ret, fname));
720
721 if (ret == -1) {
722 /* No attribute or not supported. */
723 #if defined(ENOATTR)
724 if (errno != ENOATTR)
725 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
726 #else
727 if (errno != ENOSYS)
728 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
729 #endif
730 SAFE_FREE(pai_buf);
731 return NULL;
732 }
733
734 paiv = create_pai_val(pai_buf, ret);
735
736 if (paiv) {
737 DEBUG(10,("load_inherited_info: ACL type 0x%x for file %s\n",
738 (unsigned int)paiv->sd_type,
739 fname));
740 }
741
742 SAFE_FREE(pai_buf);
743 return paiv;
744 }
745
746 /****************************************************************************
747 Functions to manipulate the internal ACE format.
748 ****************************************************************************/
749
750 /****************************************************************************
751 Count a linked list of canonical ACE entries.
752 ****************************************************************************/
753
754 static size_t count_canon_ace_list( canon_ace *l_head )
755 {
756 size_t count = 0;
757 canon_ace *ace;
758
759 for (ace = l_head; ace; ace = ace->next)
760 count++;
761
762 return count;
763 }
764
765 /****************************************************************************
766 Free a linked list of canonical ACE entries.
767 ****************************************************************************/
768
769 static void free_canon_ace_list( canon_ace *l_head )
770 {
771 canon_ace *list, *next;
772
773 for (list = l_head; list; list = next) {
774 next = list->next;
775 DLIST_REMOVE(l_head, list);
776 SAFE_FREE(list);
777 }
778 }
779
780 /****************************************************************************
781 Function to duplicate a canon_ace entry.
782 ****************************************************************************/
783
784 static canon_ace *dup_canon_ace( canon_ace *src_ace)
785 {
786 canon_ace *dst_ace = SMB_MALLOC_P(canon_ace);
787
788 if (dst_ace == NULL)
789 return NULL;
790
791 *dst_ace = *src_ace;
792 dst_ace->prev = dst_ace->next = NULL;
793 return dst_ace;
794 }
795
796 /****************************************************************************
797 Print out a canon ace.
798 ****************************************************************************/
799
800 static void print_canon_ace(canon_ace *pace, int num)
801 {
802 dbgtext( "canon_ace index %d. Type = %s ", num, pace->attr == ALLOW_ACE ? "allow" : "deny" );
803 dbgtext( "SID = %s ", sid_string_dbg(&pace->trustee));
804 if (pace->owner_type == UID_ACE) {
805 const char *u_name = uidtoname(pace->unix_ug.uid);
806 dbgtext( "uid %u (%s) ", (unsigned int)pace->unix_ug.uid, u_name );
807 } else if (pace->owner_type == GID_ACE) {
808 char *g_name = gidtoname(pace->unix_ug.gid);
809 dbgtext( "gid %u (%s) ", (unsigned int)pace->unix_ug.gid, g_name );
810 } else
811 dbgtext( "other ");
812 switch (pace->type) {
813 case SMB_ACL_USER:
814 dbgtext( "SMB_ACL_USER ");
815 break;
816 case SMB_ACL_USER_OBJ:
817 dbgtext( "SMB_ACL_USER_OBJ ");
818 break;
819 case SMB_ACL_GROUP:
820 dbgtext( "SMB_ACL_GROUP ");
821 break;
822 case SMB_ACL_GROUP_OBJ:
823 dbgtext( "SMB_ACL_GROUP_OBJ ");
824 break;
825 case SMB_ACL_OTHER:
826 dbgtext( "SMB_ACL_OTHER ");
827 break;
828 default:
829 dbgtext( "MASK " );
830 break;
831 }
832
833 dbgtext( "ace_flags = 0x%x ", (unsigned int)pace->ace_flags);
834 dbgtext( "perms ");
835 dbgtext( "%c", pace->perms & S_IRUSR ? 'r' : '-');
836 dbgtext( "%c", pace->perms & S_IWUSR ? 'w' : '-');
837 dbgtext( "%c\n", pace->perms & S_IXUSR ? 'x' : '-');
838 }
839
840 /****************************************************************************
841 Print out a canon ace list.
842 ****************************************************************************/
843
844 static void print_canon_ace_list(const char *name, canon_ace *ace_list)
845 {
846 int count = 0;
847
848 if( DEBUGLVL( 10 )) {
849 dbgtext( "print_canon_ace_list: %s\n", name );
850 for (;ace_list; ace_list = ace_list->next, count++)
851 print_canon_ace(ace_list, count );
852 }
853 }
854
855 /****************************************************************************
856 Map POSIX ACL perms to canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits).
857 ****************************************************************************/
858
859 static mode_t convert_permset_to_mode_t(connection_struct *conn, SMB_ACL_PERMSET_T permset)
860 {
861 mode_t ret = 0;
862
863 ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ) ? S_IRUSR : 0);
864 ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE) ? S_IWUSR : 0);
865 ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_EXECUTE) ? S_IXUSR : 0);
866
867 return ret;
868 }
869
870 /****************************************************************************
871 Map generic UNIX permissions to canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits).
872 ****************************************************************************/
873
874 static mode_t unix_perms_to_acl_perms(mode_t mode, int r_mask, int w_mask, int x_mask)
875 {
876 mode_t ret = 0;
877
878 if (mode & r_mask)
879 ret |= S_IRUSR;
880 if (mode & w_mask)
881 ret |= S_IWUSR;
882 if (mode & x_mask)
883 ret |= S_IXUSR;
884
885 return ret;
886 }
887
888 /****************************************************************************
889 Map canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits) to
890 an SMB_ACL_PERMSET_T.
891 ****************************************************************************/
892
893 static int map_acl_perms_to_permset(connection_struct *conn, mode_t mode, SMB_ACL_PERMSET_T *p_permset)
894 {
895 if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn, *p_permset) == -1)
896 return -1;
897 if (mode & S_IRUSR) {
898 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_READ) == -1)
899 return -1;
900 }
901 if (mode & S_IWUSR) {
902 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_WRITE) == -1)
903 return -1;
904 }
905 if (mode & S_IXUSR) {
906 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_EXECUTE) == -1)
907 return -1;
908 }
909 return 0;
910 }
911
912 /****************************************************************************
913 Function to create owner and group SIDs from a SMB_STRUCT_STAT.
914 ****************************************************************************/
915
916 void create_file_sids(const SMB_STRUCT_STAT *psbuf, struct dom_sid *powner_sid, struct dom_sid *pgroup_sid)
917 {
918 uid_to_sid( powner_sid, psbuf->st_ex_uid );
919 gid_to_sid( pgroup_sid, psbuf->st_ex_gid );
920 }
921
922 /****************************************************************************
923 Merge aces with a common sid - if both are allow or deny, OR the permissions together and
924 delete the second one. If the first is deny, mask the permissions off and delete the allow
925 if the permissions become zero, delete the deny if the permissions are non zero.
926 ****************************************************************************/
927
928 static void merge_aces( canon_ace **pp_list_head, bool dir_acl)
929 {
930 canon_ace *l_head = *pp_list_head;
931 canon_ace *curr_ace_outer;
932 canon_ace *curr_ace_outer_next;
933
934 /*
935 * First, merge allow entries with identical SIDs, and deny entries
936 * with identical SIDs.
937 */
938
939 for (curr_ace_outer = l_head; curr_ace_outer; curr_ace_outer = curr_ace_outer_next) {
940 canon_ace *curr_ace;
941 canon_ace *curr_ace_next;
942
943 curr_ace_outer_next = curr_ace_outer->next; /* Save the link in case we delete. */
944
945 for (curr_ace = curr_ace_outer->next; curr_ace; curr_ace = curr_ace_next) {
946 bool can_merge = false;
947
948 curr_ace_next = curr_ace->next; /* Save the link in case of delete. */
949
950 /* For file ACLs we can merge if the SIDs and ALLOW/DENY
951 * types are the same. For directory acls we must also
952 * ensure the POSIX ACL types are the same. */
953
954 if (!dir_acl) {
955 can_merge = (dom_sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
956 (curr_ace->attr == curr_ace_outer->attr));
957 } else {
958 can_merge = (dom_sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
959 (curr_ace->type == curr_ace_outer->type) &&
960 (curr_ace->attr == curr_ace_outer->attr));
961 }
962
963 if (can_merge) {
964 if( DEBUGLVL( 10 )) {
965 dbgtext("merge_aces: Merging ACE's\n");
966 print_canon_ace( curr_ace_outer, 0);
967 print_canon_ace( curr_ace, 0);
968 }
969
970 /* Merge two allow or two deny ACE's. */
971
972 /* Theoretically we shouldn't merge a dir ACE if
973 * one ACE has the CI flag set, and the other
974 * ACE has the OI flag set, but this is rare
975 * enough we can ignore it. */
976
977 curr_ace_outer->perms |= curr_ace->perms;
978 curr_ace_outer->ace_flags |= curr_ace->ace_flags;
979 DLIST_REMOVE(l_head, curr_ace);
980 SAFE_FREE(curr_ace);
981 curr_ace_outer_next = curr_ace_outer->next; /* We may have deleted the link. */
982 }
983 }
984 }
985
986 /*
987 * Now go through and mask off allow permissions with deny permissions.
988 * We can delete either the allow or deny here as we know that each SID
989 * appears only once in the list.
990 */
991
992 for (curr_ace_outer = l_head; curr_ace_outer; curr_ace_outer = curr_ace_outer_next) {
993 canon_ace *curr_ace;
994 canon_ace *curr_ace_next;
995
996 curr_ace_outer_next = curr_ace_outer->next; /* Save the link in case we delete. */
997
998 for (curr_ace = curr_ace_outer->next; curr_ace; curr_ace = curr_ace_next) {
999
1000 curr_ace_next = curr_ace->next; /* Save the link in case of delete. */
1001
1002 /*
1003 * Subtract ACE's with different entries. Due to the ordering constraints
1004 * we've put on the ACL, we know the deny must be the first one.
1005 */
1006
1007 if (dom_sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
1008 (curr_ace_outer->attr == DENY_ACE) && (curr_ace->attr == ALLOW_ACE)) {
1009
1010 if( DEBUGLVL( 10 )) {
1011 dbgtext("merge_aces: Masking ACE's\n");
1012 print_canon_ace( curr_ace_outer, 0);
1013 print_canon_ace( curr_ace, 0);
1014 }
1015
1016 curr_ace->perms &= ~curr_ace_outer->perms;
1017
1018 if (curr_ace->perms == 0) {
1019
1020 /*
1021 * The deny overrides the allow. Remove the allow.
1022 */
1023
1024 DLIST_REMOVE(l_head, curr_ace);
1025 SAFE_FREE(curr_ace);
1026 curr_ace_outer_next = curr_ace_outer->next; /* We may have deleted the link. */
1027
1028 } else {
1029
1030 /*
1031 * Even after removing permissions, there
1032 * are still allow permissions - delete the deny.
1033 * It is safe to delete the deny here,
1034 * as we are guarenteed by the deny first
1035 * ordering that all the deny entries for
1036 * this SID have already been merged into one
1037 * before we can get to an allow ace.
1038 */
1039
1040 DLIST_REMOVE(l_head, curr_ace_outer);
1041 SAFE_FREE(curr_ace_outer);
1042 break;
1043 }
1044 }
1045
1046 } /* end for curr_ace */
1047 } /* end for curr_ace_outer */
1048
1049 /* We may have modified the list. */
1050
1051 *pp_list_head = l_head;
1052 }
1053
1054 /****************************************************************************
1055 Check if we need to return NT4.x compatible ACL entries.
1056 ****************************************************************************/
1057
1058 bool nt4_compatible_acls(void)
1059 {
1060 int compat = lp_acl_compatibility();
1061
1062 if (compat == ACL_COMPAT_AUTO) {
1063 enum remote_arch_types ra_type = get_remote_arch();
1064
1065 /* Automatically adapt to client */
1066 return (ra_type <= RA_WINNT);
1067 } else
1068 return (compat == ACL_COMPAT_WINNT);
1069 }
1070
1071
1072 /****************************************************************************
1073 Map canon_ace perms to permission bits NT.
1074 The attr element is not used here - we only process deny entries on set,
1075 not get. Deny entries are implicit on get with ace->perms = 0.
1076 ****************************************************************************/
1077
1078 uint32_t map_canon_ace_perms(int snum,
1079 enum security_ace_type *pacl_type,
1080 mode_t perms,
1081 bool directory_ace)
1082 {
1083 uint32_t nt_mask = 0;
1084
1085 *pacl_type = SEC_ACE_TYPE_ACCESS_ALLOWED;
1086
1087 if (lp_acl_map_full_control(snum) && ((perms & ALL_ACE_PERMS) == ALL_ACE_PERMS)) {
1088 if (directory_ace) {
1089 nt_mask = UNIX_DIRECTORY_ACCESS_RWX;
1090 } else {
1091 nt_mask = (UNIX_ACCESS_RWX & ~DELETE_ACCESS);
1092 }
1093 } else if ((perms & ALL_ACE_PERMS) == (mode_t)0) {
1094 /*
1095 * Windows NT refuses to display ACEs with no permissions in them (but
1096 * they are perfectly legal with Windows 2000). If the ACE has empty
1097 * permissions we cannot use 0, so we use the otherwise unused
1098 * WRITE_OWNER permission, which we ignore when we set an ACL.
1099 * We abstract this into a #define of UNIX_ACCESS_NONE to allow this
1100 * to be changed in the future.
1101 */
1102
1103 if (nt4_compatible_acls())
1104 nt_mask = UNIX_ACCESS_NONE;
1105 else
1106 nt_mask = 0;
1107 } else {
1108 if (directory_ace) {
1109 nt_mask |= ((perms & S_IRUSR) ? UNIX_DIRECTORY_ACCESS_R : 0 );
1110 nt_mask |= ((perms & S_IWUSR) ? UNIX_DIRECTORY_ACCESS_W : 0 );
1111 nt_mask |= ((perms & S_IXUSR) ? UNIX_DIRECTORY_ACCESS_X : 0 );
1112 } else {
1113 nt_mask |= ((perms & S_IRUSR) ? UNIX_ACCESS_R : 0 );
1114 nt_mask |= ((perms & S_IWUSR) ? UNIX_ACCESS_W : 0 );
1115 nt_mask |= ((perms & S_IXUSR) ? UNIX_ACCESS_X : 0 );
1116 }
1117 }
1118
1119 if ((perms & S_IWUSR) && lp_dos_filemode(snum)) {
1120 nt_mask |= (SEC_STD_WRITE_DAC|SEC_STD_WRITE_OWNER|DELETE_ACCESS);
1121 }
1122
1123 DEBUG(10,("map_canon_ace_perms: Mapped (UNIX) %x to (NT) %x\n",
1124 (unsigned int)perms, (unsigned int)nt_mask ));
1125
1126 return nt_mask;
1127 }
1128
1129 /****************************************************************************
1130 Map NT perms to a UNIX mode_t.
1131 ****************************************************************************/
1132
1133 #define FILE_SPECIFIC_READ_BITS (FILE_READ_DATA|FILE_READ_EA)
1134 #define FILE_SPECIFIC_WRITE_BITS (FILE_WRITE_DATA|FILE_APPEND_DATA|FILE_WRITE_EA)
1135 #define FILE_SPECIFIC_EXECUTE_BITS (FILE_EXECUTE)
1136
1137 static mode_t map_nt_perms( uint32 *mask, int type)
1138 {
1139 mode_t mode = 0;
1140
1141 switch(type) {
1142 case S_IRUSR:
1143 if((*mask) & GENERIC_ALL_ACCESS)
1144 mode = S_IRUSR|S_IWUSR|S_IXUSR;
1145 else {
1146 mode |= ((*mask) & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IRUSR : 0;
1147 mode |= ((*mask) & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWUSR : 0;
1148 mode |= ((*mask) & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXUSR : 0;
1149 }
1150 break;
1151 case S_IRGRP:
1152 if((*mask) & GENERIC_ALL_ACCESS)
1153 mode = S_IRGRP|S_IWGRP|S_IXGRP;
1154 else {
1155 mode |= ((*mask) & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IRGRP : 0;
1156 mode |= ((*mask) & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWGRP : 0;
1157 mode |= ((*mask) & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXGRP : 0;
1158 }
1159 break;
1160 case S_IROTH:
1161 if((*mask) & GENERIC_ALL_ACCESS)
1162 mode = S_IROTH|S_IWOTH|S_IXOTH;
1163 else {
1164 mode |= ((*mask) & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IROTH : 0;
1165 mode |= ((*mask) & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWOTH : 0;
1166 mode |= ((*mask) & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXOTH : 0;
1167 }
1168 break;
1169 }
1170
1171 return mode;
1172 }
1173
1174 /****************************************************************************
1175 Unpack a struct security_descriptor into a UNIX owner and group.
1176 ****************************************************************************/
1177
1178 NTSTATUS unpack_nt_owners(struct connection_struct *conn,
1179 uid_t *puser, gid_t *pgrp,
1180 uint32 security_info_sent, const struct
1181 security_descriptor *psd)
1182 {
1183 struct dom_sid owner_sid;
1184 struct dom_sid grp_sid;
1185
1186 *puser = (uid_t)-1;
1187 *pgrp = (gid_t)-1;
1188
1189 if(security_info_sent == 0) {
1190 DEBUG(0,("unpack_nt_owners: no security info sent !\n"));
1191 return NT_STATUS_OK;
1192 }
1193
1194 /*
1195 * Validate the owner and group SID's.
1196 */
1197
1198 memset(&owner_sid, '\0', sizeof(owner_sid));
1199 memset(&grp_sid, '\0', sizeof(grp_sid));
1200
1201 DEBUG(5,("unpack_nt_owners: validating owner_sids.\n"));
1202
1203 /*
1204 * Don't immediately fail if the owner sid cannot be validated.
1205 * This may be a group chown only set.
1206 */
1207
1208 if (security_info_sent & SECINFO_OWNER) {
1209 sid_copy(&owner_sid, psd->owner_sid);
1210 if (!sid_to_uid(&owner_sid, puser)) {
1211 if (lp_force_unknown_acl_user(SNUM(conn))) {
1212 /* this allows take ownership to work
1213 * reasonably */
1214 *puser = get_current_uid(conn);
1215 } else {
1216 DEBUG(3,("unpack_nt_owners: unable to validate"
1217 " owner sid for %s\n",
1218 sid_string_dbg(&owner_sid)));
1219 return NT_STATUS_INVALID_OWNER;
1220 }
1221 }
1222 DEBUG(3,("unpack_nt_owners: owner sid mapped to uid %u\n",
1223 (unsigned int)*puser ));
1224 }
1225
1226 /*
1227 * Don't immediately fail if the group sid cannot be validated.
1228 * This may be an owner chown only set.
1229 */
1230
1231 if (security_info_sent & SECINFO_GROUP) {
1232 sid_copy(&grp_sid, psd->group_sid);
1233 if (!sid_to_gid( &grp_sid, pgrp)) {
1234 if (lp_force_unknown_acl_user(SNUM(conn))) {
1235 /* this allows take group ownership to work
1236 * reasonably */
1237 *pgrp = get_current_gid(conn);
1238 } else {
1239 DEBUG(3,("unpack_nt_owners: unable to validate"
1240 " group sid.\n"));
1241 return NT_STATUS_INVALID_OWNER;
1242 }
1243 }
1244 DEBUG(3,("unpack_nt_owners: group sid mapped to gid %u\n",
1245 (unsigned int)*pgrp));
1246 }
1247
1248 DEBUG(5,("unpack_nt_owners: owner_sids validated.\n"));
1249
1250 return NT_STATUS_OK;
1251 }
1252
1253 /****************************************************************************
1254 Ensure the enforced permissions for this share apply.
1255 ****************************************************************************/
1256
1257 static void apply_default_perms(const struct share_params *params,
1258 const bool is_directory, canon_ace *pace,
1259 mode_t type)
1260 {
1261 mode_t and_bits = (mode_t)0;
1262 mode_t or_bits = (mode_t)0;
1263
1264 /* Get the initial bits to apply. */
1265
1266 if (is_directory) {
1267 and_bits = lp_dir_security_mask(params->service);
1268 or_bits = lp_force_dir_security_mode(params->service);
1269 } else {
1270 and_bits = lp_security_mask(params->service);
1271 or_bits = lp_force_security_mode(params->service);
1272 }
1273
1274 /* Now bounce them into the S_USR space. */
1275 switch(type) {
1276 case S_IRUSR:
1277 /* Ensure owner has read access. */
1278 pace->perms |= S_IRUSR;
1279 if (is_directory)
1280 pace->perms |= (S_IWUSR|S_IXUSR);
1281 and_bits = unix_perms_to_acl_perms(and_bits, S_IRUSR, S_IWUSR, S_IXUSR);
1282 or_bits = unix_perms_to_acl_perms(or_bits, S_IRUSR, S_IWUSR, S_IXUSR);
1283 break;
1284 case S_IRGRP:
1285 and_bits = unix_perms_to_acl_perms(and_bits, S_IRGRP, S_IWGRP, S_IXGRP);
1286 or_bits = unix_perms_to_acl_perms(or_bits, S_IRGRP, S_IWGRP, S_IXGRP);
1287 break;
1288 case S_IROTH:
1289 and_bits = unix_perms_to_acl_perms(and_bits, S_IROTH, S_IWOTH, S_IXOTH);
1290 or_bits = unix_perms_to_acl_perms(or_bits, S_IROTH, S_IWOTH, S_IXOTH);
1291 break;
1292 }
1293
1294 pace->perms = ((pace->perms & and_bits)|or_bits);
1295 }
1296
1297 /****************************************************************************
1298 Check if a given uid/SID is in a group gid/SID. This is probably very
1299 expensive and will need optimisation. A *lot* of optimisation :-). JRA.
1300 ****************************************************************************/
1301
1302 static bool uid_entry_in_group(connection_struct *conn, canon_ace *uid_ace, canon_ace *group_ace )
1303 {
1304 const char *u_name = NULL;
1305
1306 /* "Everyone" always matches every uid. */
1307
1308 if (dom_sid_equal(&group_ace->trustee, &global_sid_World))
1309 return True;
1310
1311 /*
1312 * if it's the current user, we already have the unix token
1313 * and don't need to do the complex user_in_group_sid() call
1314 */
1315 if (uid_ace->unix_ug.uid == get_current_uid(conn)) {
1316 const struct security_unix_token *curr_utok = NULL;
1317 size_t i;
1318
1319 if (group_ace->unix_ug.gid == get_current_gid(conn)) {
1320 return True;
1321 }
1322
1323 curr_utok = get_current_utok(conn);
1324 for (i=0; i < curr_utok->ngroups; i++) {
1325 if (group_ace->unix_ug.gid == curr_utok->groups[i]) {
1326 return True;
1327 }
1328 }
1329 }
1330
1331 /* u_name talloc'ed off tos. */
1332 u_name = uidtoname(uid_ace->unix_ug.uid);
1333 if (!u_name) {
1334 return False;
1335 }
1336
1337 /*
1338 * user_in_group_sid() uses create_token_from_username()
1339 * which creates an artificial NT token given just a username,
1340 * so this is not reliable for users from foreign domains
1341 * exported by winbindd!
1342 */
1343 return user_in_group_sid(u_name, &group_ace->trustee);
1344 }
1345
1346 /****************************************************************************
1347 A well formed POSIX file or default ACL has at least 3 entries, a
1348 SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ.
1349 In addition, the owner must always have at least read access.
1350 When using this call on get_acl, the pst struct is valid and contains
1351 the mode of the file. When using this call on set_acl, the pst struct has
1352 been modified to have a mode containing the default for this file or directory
1353 type.
1354 ****************************************************************************/
1355
1356 static bool ensure_canon_entry_valid(connection_struct *conn,
1357 canon_ace **pp_ace,
1358 bool is_default_acl,
1359 const struct share_params *params,
1360 const bool is_directory,
1361 const struct dom_sid *pfile_owner_sid,
1362 const struct dom_sid *pfile_grp_sid,
1363 const SMB_STRUCT_STAT *pst,
1364 bool setting_acl)
1365 {
1366 canon_ace *pace;
1367 bool got_user = False;
1368 bool got_grp = False;
1369 bool got_other = False;
1370 canon_ace *pace_other = NULL;
1371
1372 for (pace = *pp_ace; pace; pace = pace->next) {
1373 if (pace->type == SMB_ACL_USER_OBJ) {
1374
1375 if (setting_acl) {
1376 /*
1377 * Ensure we have default parameters for the
1378 * user (owner) even on default ACLs.
1379 */
1380 apply_default_perms(params, is_directory, pace, S_IRUSR);
1381 }
1382 got_user = True;
1383
1384 } else if (pace->type == SMB_ACL_GROUP_OBJ) {
1385
1386 /*
1387 * Ensure create mask/force create mode is respected on set.
1388 */
1389
1390 if (setting_acl && !is_default_acl) {
1391 apply_default_perms(params, is_directory, pace, S_IRGRP);
1392 }
1393 got_grp = True;
1394
1395 } else if (pace->type == SMB_ACL_OTHER) {
1396
1397 /*
1398 * Ensure create mask/force create mode is respected on set.
1399 */
1400
1401 if (setting_acl && !is_default_acl) {
1402 apply_default_perms(params, is_directory, pace, S_IROTH);
1403 }
1404 got_other = True;
1405 pace_other = pace;
1406
1407 } else if (pace->type == SMB_ACL_USER || pace->type == SMB_ACL_GROUP) {
1408
1409 /*
1410 * Ensure create mask/force create mode is respected on set.
1411 */
1412
1413 if (setting_acl && !is_default_acl) {
1414 apply_default_perms(params, is_directory, pace, S_IRGRP);
1415 }
1416 }
1417 }
1418
1419 if (!got_user) {
1420 if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1421 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1422 return False;
1423 }
1424
1425 ZERO_STRUCTP(pace);
1426 pace->type = SMB_ACL_USER_OBJ;
1427 pace->owner_type = UID_ACE;
1428 pace->unix_ug.uid = pst->st_ex_uid;
1429 pace->trustee = *pfile_owner_sid;
1430 pace->attr = ALLOW_ACE;
1431 /* Start with existing permissions, principle of least
1432 surprises for the user. */
1433 pace->perms = pst->st_ex_mode;
1434
1435 if (setting_acl) {
1436 /* See if the owning user is in any of the other groups in
1437 the ACE, or if there's a matching user entry.
1438 If so, OR in the permissions from that entry. */
1439
1440 canon_ace *pace_iter;
1441
1442 for (pace_iter = *pp_ace; pace_iter; pace_iter = pace_iter->next) {
1443 if (pace_iter->type == SMB_ACL_USER &&
1444 pace_iter->unix_ug.uid == pace->unix_ug.uid) {
1445 pace->perms |= pace_iter->perms;
1446 } else if (pace_iter->type == SMB_ACL_GROUP_OBJ || pace_iter->type == SMB_ACL_GROUP) {
1447 if (uid_entry_in_group(conn, pace, pace_iter)) {
1448 pace->perms |= pace_iter->perms;
1449 }
1450 }
1451 }
1452
1453 if (pace->perms == 0) {
1454 /* If we only got an "everyone" perm, just use that. */
1455 if (got_other)
1456 pace->perms = pace_other->perms;
1457 }
1458
1459 /*
1460 * Ensure we have default parameters for the
1461 * user (owner) even on default ACLs.
1462 */
1463 apply_default_perms(params, is_directory, pace, S_IRUSR);
1464 } else {
1465 pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRUSR, S_IWUSR, S_IXUSR);
1466 }
1467
1468 DLIST_ADD(*pp_ace, pace);
1469 }
1470
1471 if (!got_grp) {
1472 if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1473 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1474 return False;
1475 }
1476
1477 ZERO_STRUCTP(pace);
1478 pace->type = SMB_ACL_GROUP_OBJ;
1479 pace->owner_type = GID_ACE;
1480 pace->unix_ug.uid = pst->st_ex_gid;
1481 pace->trustee = *pfile_grp_sid;
1482 pace->attr = ALLOW_ACE;
1483 if (setting_acl) {
1484 /* If we only got an "everyone" perm, just use that. */
1485 if (got_other)
1486 pace->perms = pace_other->perms;
1487 else
1488 pace->perms = 0;
1489 if (!is_default_acl) {
1490 apply_default_perms(params, is_directory, pace, S_IRGRP);
1491 }
1492 } else {
1493 pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRGRP, S_IWGRP, S_IXGRP);
1494 }
1495
1496 DLIST_ADD(*pp_ace, pace);
1497 }
1498
1499 if (!got_other) {
1500 if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1501 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1502 return False;
1503 }
1504
1505 ZERO_STRUCTP(pace);
1506 pace->type = SMB_ACL_OTHER;
1507 pace->owner_type = WORLD_ACE;
1508 pace->unix_ug.world = -1;
1509 pace->trustee = global_sid_World;
1510 pace->attr = ALLOW_ACE;
1511 if (setting_acl) {
1512 pace->perms = 0;
1513 if (!is_default_acl) {
1514 apply_default_perms(params, is_directory, pace, S_IROTH);
1515 }
1516 } else
1517 pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IROTH, S_IWOTH, S_IXOTH);
1518
1519 DLIST_ADD(*pp_ace, pace);
1520 }
1521
1522 return True;
1523 }
1524
1525 /****************************************************************************
1526 Check if a POSIX ACL has the required SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries.
1527 If it does not have them, check if there are any entries where the trustee is the
1528 file owner or the owning group, and map these to SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ.
1529 Note we must not do this to default directory ACLs.
1530 ****************************************************************************/
1531
1532 static void check_owning_objs(canon_ace *ace, struct dom_sid *pfile_owner_sid, struct dom_sid *pfile_grp_sid)
1533 {
1534 bool got_user_obj, got_group_obj;
1535 canon_ace *current_ace;
1536 int i, entries;
1537
1538 entries = count_canon_ace_list(ace);
1539 got_user_obj = False;
1540 got_group_obj = False;
1541
1542 for (i=0, current_ace = ace; i < entries; i++, current_ace = current_ace->next) {
1543 if (current_ace->type == SMB_ACL_USER_OBJ)
1544 got_user_obj = True;
1545 else if (current_ace->type == SMB_ACL_GROUP_OBJ)
1546 got_group_obj = True;
1547 }
1548 if (got_user_obj && got_group_obj) {
1549 DEBUG(10,("check_owning_objs: ACL had owning user/group entries.\n"));
1550 return;
1551 }
1552
1553 for (i=0, current_ace = ace; i < entries; i++, current_ace = current_ace->next) {
1554 if (!got_user_obj && current_ace->owner_type == UID_ACE &&
1555 dom_sid_equal(&current_ace->trustee, pfile_owner_sid)) {
1556 current_ace->type = SMB_ACL_USER_OBJ;
1557 got_user_obj = True;
1558 }
1559 if (!got_group_obj && current_ace->owner_type == GID_ACE &&
1560 dom_sid_equal(&current_ace->trustee, pfile_grp_sid)) {
1561 current_ace->type = SMB_ACL_GROUP_OBJ;
1562 got_group_obj = True;
1563 }
1564 }
1565 if (!got_user_obj)
1566 DEBUG(10,("check_owning_objs: ACL is missing an owner entry.\n"));
1567 if (!got_group_obj)
1568 DEBUG(10,("check_owning_objs: ACL is missing an owning group entry.\n"));
1569 }
1570
1571 /****************************************************************************
1572 Unpack a struct security_descriptor into two canonical ace lists.
1573 ****************************************************************************/
1574
1575 static bool create_canon_ace_lists(files_struct *fsp,
1576 const SMB_STRUCT_STAT *pst,
1577 struct dom_sid *pfile_owner_sid,
1578 struct dom_sid *pfile_grp_sid,
1579 canon_ace **ppfile_ace,
1580 canon_ace **ppdir_ace,
1581 const struct security_acl *dacl)
1582 {
1583 bool all_aces_are_inherit_only = (fsp->is_directory ? True : False);
1584 canon_ace *file_ace = NULL;
1585 canon_ace *dir_ace = NULL;
1586 canon_ace *current_ace = NULL;
1587 bool got_dir_allow = False;
1588 bool got_file_allow = False;
1589 int i, j;
1590
1591 *ppfile_ace = NULL;
1592 *ppdir_ace = NULL;
1593
1594 /*
1595 * Convert the incoming ACL into a more regular form.
1596 */
1597
1598 for(i = 0; i < dacl->num_aces; i++) {
1599 struct security_ace *psa = &dacl->aces[i];
1600
1601 if((psa->type != SEC_ACE_TYPE_ACCESS_ALLOWED) && (psa->type != SEC_ACE_TYPE_ACCESS_DENIED)) {
1602 DEBUG(3,("create_canon_ace_lists: unable to set anything but an ALLOW or DENY ACE.\n"));
1603 return False;
1604 }
1605
1606 if (nt4_compatible_acls()) {
1607 /*
1608 * The security mask may be UNIX_ACCESS_NONE which should map into
1609 * no permissions (we overload the WRITE_OWNER bit for this) or it
1610 * should be one of the ALL/EXECUTE/READ/WRITE bits. Arrange for this
1611 * to be so. Any other bits override the UNIX_ACCESS_NONE bit.
1612 */
1613
1614 /*
1615 * Convert GENERIC bits to specific bits.
1616 */
1617
1618 se_map_generic(&psa->access_mask, &file_generic_mapping);
1619
1620 psa->access_mask &= (UNIX_ACCESS_NONE|FILE_ALL_ACCESS);
1621
1622 if(psa->access_mask != UNIX_ACCESS_NONE)
1623 psa->access_mask &= ~UNIX_ACCESS_NONE;
1624 }
1625 }
1626
1627 /*
1628 * Deal with the fact that NT 4.x re-writes the canonical format
1629 * that we return for default ACLs. If a directory ACE is identical
1630 * to a inherited directory ACE then NT changes the bits so that the
1631 * first ACE is set to OI|IO and the second ACE for this SID is set
1632 * to CI. We need to repair this. JRA.
1633 */
1634
1635 for(i = 0; i < dacl->num_aces; i++) {
1636 struct security_ace *psa1 = &dacl->aces[i];
1637
1638 for (j = i + 1; j < dacl->num_aces; j++) {
1639 struct security_ace *psa2 = &dacl->aces[j];
1640
1641 if (psa1->access_mask != psa2->access_mask)
1642 continue;
1643
1644 if (!dom_sid_equal(&psa1->trustee, &psa2->trustee))
1645 continue;
1646
1647 /*
1648 * Ok - permission bits and SIDs are equal.
1649 * Check if flags were re-written.
1650 */
1651
1652 if (psa1->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
1653
1654 psa1->flags |= (psa2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT));
1655 psa2->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT);
1656
1657 } else if (psa2->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
1658
1659 psa2->flags |= (psa1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT));
1660 psa1->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT);
1661
1662 }
1663 }
1664 }
1665
1666 for(i = 0; i < dacl->num_aces; i++) {
1667 struct security_ace *psa = &dacl->aces[i];
1668
1669 /*
1670 * Create a canon_ace entry representing this NT DACL ACE.
1671 */
1672
1673 if ((current_ace = SMB_MALLOC_P(canon_ace)) == NULL) {
1674 free_canon_ace_list(file_ace);
1675 free_canon_ace_list(dir_ace);
1676 DEBUG(0,("create_canon_ace_lists: malloc fail.\n"));
1677 return False;
1678 }
1679
1680 ZERO_STRUCTP(current_ace);
1681
1682 sid_copy(&current_ace->trustee, &psa->trustee);
1683
1684 /*
1685 * Try and work out if the SID is a user or group
1686 * as we need to flag these differently for POSIX.
1687 * Note what kind of a POSIX ACL this should map to.
1688 */
1689
1690 if( dom_sid_equal(&current_ace->trustee, &global_sid_World)) {
1691 current_ace->owner_type = WORLD_ACE;
1692 current_ace->unix_ug.world = -1;
1693 current_ace->type = SMB_ACL_OTHER;
1694 } else if (dom_sid_equal(&current_ace->trustee, &global_sid_Creator_Owner)) {
1695 current_ace->owner_type = UID_ACE;
1696 current_ace->unix_ug.uid = pst->st_ex_uid;
1697 current_ace->type = SMB_ACL_USER_OBJ;
1698
1699 /*
1700 * The Creator Owner entry only specifies inheritable permissions,
1701 * never access permissions. WinNT doesn't always set the ACE to
1702 * INHERIT_ONLY, though.
1703 */
1704
1705 psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
1706
1707 } else if (dom_sid_equal(&current_ace->trustee, &global_sid_Creator_Group)) {
1708 current_ace->owner_type = GID_ACE;
1709 current_ace->unix_ug.gid = pst->st_ex_gid;
1710 current_ace->type = SMB_ACL_GROUP_OBJ;
1711
1712 /*
1713 * The Creator Group entry only specifies inheritable permissions,
1714 * never access permissions. WinNT doesn't always set the ACE to
1715 * INHERIT_ONLY, though.
1716 */
1717 psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
1718
1719 } else if (sid_to_uid( &current_ace->trustee, &current_ace->unix_ug.uid)) {
1720 current_ace->owner_type = UID_ACE;
1721 /* If it's the owning user, this is a user_obj, not
1722 * a user. */
1723 if (current_ace->unix_ug.uid == pst->st_ex_uid) {
1724 current_ace->type = SMB_ACL_USER_OBJ;
1725 } else {
1726 current_ace->type = SMB_ACL_USER;
1727 }
1728 } else if (sid_to_gid( &current_ace->trustee, &current_ace->unix_ug.gid)) {
1729 current_ace->owner_type = GID_ACE;
1730 /* If it's the primary group, this is a group_obj, not
1731 * a group. */
1732 if (current_ace->unix_ug.gid == pst->st_ex_gid) {
1733 current_ace->type = SMB_ACL_GROUP_OBJ;
1734 } else {
1735 current_ace->type = SMB_ACL_GROUP;
1736 }
1737 } else {
1738 /*
1739 * Silently ignore map failures in non-mappable SIDs (NT Authority, BUILTIN etc).
1740 */
1741
1742 if (non_mappable_sid(&psa->trustee)) {
1743 DEBUG(10, ("create_canon_ace_lists: ignoring "
1744 "non-mappable SID %s\n",
1745 sid_string_dbg(&psa->trustee)));
1746 SAFE_FREE(current_ace);
1747 continue;
1748 }
1749
1750 if (lp_force_unknown_acl_user(SNUM(fsp->conn))) {
1751 DEBUG(10, ("create_canon_ace_lists: ignoring "
1752 "unknown or foreign SID %s\n",
1753 sid_string_dbg(&psa->trustee)));
1754 SAFE_FREE(current_ace);
1755 continue;
1756 }
1757
1758 free_canon_ace_list(file_ace);
1759 free_canon_ace_list(dir_ace);
1760 DEBUG(0, ("create_canon_ace_lists: unable to map SID "
1761 "%s to uid or gid.\n",
1762 sid_string_dbg(&current_ace->trustee)));
1763 SAFE_FREE(current_ace);
1764 return False;
1765 }
1766
1767 /*
1768 * Map the given NT permissions into a UNIX mode_t containing only
1769 * S_I(R|W|X)USR bits.
1770 */
1771
1772 current_ace->perms |= map_nt_perms( &psa->access_mask, S_IRUSR);
1773 current_ace->attr = (psa->type == SEC_ACE_TYPE_ACCESS_ALLOWED) ? ALLOW_ACE : DENY_ACE;
1774
1775 /* Store the ace_flag. */
1776 current_ace->ace_flags = psa->flags;
1777
1778 /*
1779 * Now add the created ace to either the file list, the directory
1780 * list, or both. We *MUST* preserve the order here (hence we use
1781 * DLIST_ADD_END) as NT ACLs are order dependent.
1782 */
1783
1784 if (fsp->is_directory) {
1785
1786 /*
1787 * We can only add to the default POSIX ACE list if the ACE is
1788 * designed to be inherited by both files and directories.
1789 */
1790
1791 if ((psa->flags & (SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT)) ==
1792 (SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT)) {
1793
1794 canon_ace *current_dir_ace = current_ace;
1795 DLIST_ADD_END(dir_ace, current_ace, canon_ace *);
1796
1797 /*
1798 * Note if this was an allow ace. We can't process
1799 * any further deny ace's after this.
1800 */
1801
1802 if (current_ace->attr == ALLOW_ACE)
1803 got_dir_allow = True;
1804
1805 if ((current_ace->attr == DENY_ACE) && got_dir_allow) {
1806 DEBUG(0,("create_canon_ace_lists: "
1807 "malformed ACL in "
1808 "inheritable ACL! Deny entry "
1809 "after Allow entry. Failing "
1810 "to set on file %s.\n",
1811 fsp_str_dbg(fsp)));
1812 free_canon_ace_list(file_ace);
1813 free_canon_ace_list(dir_ace);
1814 return False;
1815 }
1816
1817 if( DEBUGLVL( 10 )) {
1818 dbgtext("create_canon_ace_lists: adding dir ACL:\n");
1819 print_canon_ace( current_ace, 0);
1820 }
1821
1822 /*
1823 * If this is not an inherit only ACE we need to add a duplicate
1824 * to the file acl.
1825 */
1826
1827 if (!(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
1828 canon_ace *dup_ace = dup_canon_ace(current_ace);
1829
1830 if (!dup_ace) {
1831 DEBUG(0,("create_canon_ace_lists: malloc fail !\n"));
1832 free_canon_ace_list(file_ace);
1833 free_canon_ace_list(dir_ace);
1834 return False;
1835 }
1836
1837 /*
1838 * We must not free current_ace here as its
1839 * pointer is now owned by the dir_ace list.
1840 */
1841 current_ace = dup_ace;
1842 /* We've essentially split this ace into two,
1843 * and added the ace with inheritance request
1844 * bits to the directory ACL. Drop those bits for
1845 * the ACE we're adding to the file list. */
1846 current_ace->ace_flags &= ~(SEC_ACE_FLAG_OBJECT_INHERIT|
1847 SEC_ACE_FLAG_CONTAINER_INHERIT|
1848 SEC_ACE_FLAG_INHERIT_ONLY);
1849 } else {
1850 /*
1851 * We must not free current_ace here as its
1852 * pointer is now owned by the dir_ace list.
1853 */
1854 current_ace = NULL;
1855 }
1856
1857 /*
1858 * current_ace is now either owned by file_ace
1859 * or is NULL. We can safely operate on current_dir_ace
1860 * to treat mapping for default acl entries differently
1861 * than access acl entries.
1862 */
1863
1864 if (current_dir_ace->owner_type == UID_ACE) {
1865 /*
1866 * We already decided above this is a uid,
1867 * for default acls ace's only CREATOR_OWNER
1868 * maps to ACL_USER_OBJ. All other uid
1869 * ace's are ACL_USER.
1870 */
1871 if (dom_sid_equal(&current_dir_ace->trustee,
1872 &global_sid_Creator_Owner)) {
1873 current_dir_ace->type = SMB_ACL_USER_OBJ;
1874 } else {
1875 current_dir_ace->type = SMB_ACL_USER;
1876 }
1877 }
1878
1879 if (current_dir_ace->owner_type == GID_ACE) {
1880 /*
1881 * We already decided above this is a gid,
1882 * for default acls ace's only CREATOR_GROUP
1883 * maps to ACL_GROUP_OBJ. All other uid
1884 * ace's are ACL_GROUP.
1885 */
1886 if (dom_sid_equal(&current_dir_ace->trustee,
1887 &global_sid_Creator_Group)) {
1888 current_dir_ace->type = SMB_ACL_GROUP_OBJ;
1889 } else {
1890 current_dir_ace->type = SMB_ACL_GROUP;
1891 }
1892 }
1893 }
1894 }
1895
1896 /*
1897 * Only add to the file ACL if not inherit only.
1898 */
1899
1900 if (current_ace && !(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
1901 DLIST_ADD_END(file_ace, current_ace, canon_ace *);
1902
1903 /*
1904 * Note if this was an allow ace. We can't process
1905 * any further deny ace's after this.
1906 */
1907
1908 if (current_ace->attr == ALLOW_ACE)
1909 got_file_allow = True;
1910
1911 if ((current_ace->attr == DENY_ACE) && got_file_allow) {
1912 DEBUG(0,("create_canon_ace_lists: malformed "
1913 "ACL in file ACL ! Deny entry after "
1914 "Allow entry. Failing to set on file "
1915 "%s.\n", fsp_str_dbg(fsp)));
1916 free_canon_ace_list(file_ace);
1917 free_canon_ace_list(dir_ace);
1918 return False;
1919 }
1920
1921 if( DEBUGLVL( 10 )) {
1922 dbgtext("create_canon_ace_lists: adding file ACL:\n");
1923 print_canon_ace( current_ace, 0);
1924 }
1925 all_aces_are_inherit_only = False;
1926 /*
1927 * We must not free current_ace here as its
1928 * pointer is now owned by the file_ace list.
1929 */
1930 current_ace = NULL;
1931 }
1932
1933 /*
1934 * Free if ACE was not added.
1935 */
1936
1937 SAFE_FREE(current_ace);
1938 }
1939
1940 if (fsp->is_directory && all_aces_are_inherit_only) {
1941 /*
1942 * Windows 2000 is doing one of these weird 'inherit acl'
1943 * traverses to conserve NTFS ACL resources. Just pretend
1944 * there was no DACL sent. JRA.
1945 */
1946
1947 DEBUG(10,("create_canon_ace_lists: Win2k inherit acl traverse. Ignoring DACL.\n"));
1948 free_canon_ace_list(file_ace);
1949 free_canon_ace_list(dir_ace);
1950 file_ace = NULL;
1951 dir_ace = NULL;
1952 } else {
1953 /*
1954 * Check if we have SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries in
1955 * the file ACL. If we don't have them, check if any SMB_ACL_USER/SMB_ACL_GROUP
1956 * entries can be converted to *_OBJ. Don't do this for the default
1957 * ACL, we will create them separately for this if needed inside
1958 * ensure_canon_entry_valid().
1959 */
1960 if (file_ace) {
1961 check_owning_objs(file_ace, pfile_owner_sid, pfile_grp_sid);
1962 }
1963 }
1964
1965 *ppfile_ace = file_ace;
1966 *ppdir_ace = dir_ace;
1967
1968 return True;
1969 }
1970
1971 /****************************************************************************
1972 ASCII art time again... JRA :-).
1973
1974 We have 4 cases to process when moving from an NT ACL to a POSIX ACL. Firstly,
1975 we insist the ACL is in canonical form (ie. all DENY entries preceede ALLOW
1976 entries). Secondly, the merge code has ensured that all duplicate SID entries for
1977 allow or deny have been merged, so the same SID can only appear once in the deny
1978 list or once in the allow list.
1979
1980 We then process as follows :
1981
1982 ---------------------------------------------------------------------------
1983 First pass - look for a Everyone DENY entry.
1984
1985 If it is deny all (rwx) trunate the list at this point.
1986 Else, walk the list from this point and use the deny permissions of this
1987 entry as a mask on all following allow entries. Finally, delete
1988 the Everyone DENY entry (we have applied it to everything possible).
1989
1990 In addition, in this pass we remove any DENY entries that have
1991 no permissions (ie. they are a DENY nothing).
1992 ---------------------------------------------------------------------------
1993 Second pass - only deal with deny user entries.
1994
1995 DENY user1 (perms XXX)
1996
1997 new_perms = 0
1998 for all following allow group entries where user1 is in group
1999 new_perms |= group_perms;
2000
2001 user1 entry perms = new_perms & ~ XXX;
2002
2003 Convert the deny entry to an allow entry with the new perms and
2004 push to the end of the list. Note if the user was in no groups
2005 this maps to a specific allow nothing entry for this user.
2006
2007 The common case from the NT ACL choser (userX deny all) is
2008 optimised so we don't do the group lookup - we just map to
2009 an allow nothing entry.
2010
2011 What we're doing here is inferring the allow permissions the
2012 person setting the ACE on user1 wanted by looking at the allow
2013 permissions on the groups the user is currently in. This will
2014 be a snapshot, depending on group membership but is the best
2015 we can do and has the advantage of failing closed rather than
2016 open.
2017 ---------------------------------------------------------------------------
2018 Third pass - only deal with deny group entries.
2019
2020 DENY group1 (perms XXX)
2021
2022 for all following allow user entries where user is in group1
2023 user entry perms = user entry perms & ~ XXX;
2024
2025 If there is a group Everyone allow entry with permissions YYY,
2026 convert the group1 entry to an allow entry and modify its
2027 permissions to be :
2028
2029 new_perms = YYY & ~ XXX
2030
2031 and push to the end of the list.
2032
2033 If there is no group Everyone allow entry then convert the
2034 group1 entry to a allow nothing entry and push to the end of the list.
2035
2036 Note that the common case from the NT ACL choser (groupX deny all)
2037 cannot be optimised here as we need to modify user entries who are
2038 in the group to change them to a deny all also.
2039
2040 What we're doing here is modifying the allow permissions of
2041 user entries (which are more specific in POSIX ACLs) to mask
2042 out the explicit deny set on the group they are in. This will
2043 be a snapshot depending on current group membership but is the
2044 best we can do and has the advantage of failing closed rather
2045 than open.
2046 ---------------------------------------------------------------------------
2047 Fourth pass - cope with cumulative permissions.
2048
2049 for all allow user entries, if there exists an allow group entry with
2050 more permissive permissions, and the user is in that group, rewrite the
2051 allow user permissions to contain both sets of permissions.
2052
2053 Currently the code for this is #ifdef'ed out as these semantics make
2054 no sense to me. JRA.
2055 ---------------------------------------------------------------------------
2056
2057 Note we *MUST* do the deny user pass first as this will convert deny user
2058 entries into allow user entries which can then be processed by the deny
2059 group pass.
2060
2061 The above algorithm took a *lot* of thinking about - hence this
2062 explaination :-). JRA.
2063 ****************************************************************************/
2064
2065 /****************************************************************************
2066 Process a canon_ace list entries. This is very complex code. We need
2067 to go through and remove the "deny" permissions from any allow entry that matches
2068 the id of this entry. We have already refused any NT ACL that wasn't in correct
2069 order (DENY followed by ALLOW). If any allow entry ends up with zero permissions,
2070 we just remove it (to fail safe). We have already removed any duplicate ace
2071 entries. Treat an "Everyone" DENY_ACE as a special case - use it to mask all
2072 allow entries.
2073 ****************************************************************************/
2074
2075 static void process_deny_list(connection_struct *conn, canon_ace **pp_ace_list )
2076 {
2077 canon_ace *ace_list = *pp_ace_list;
2078 canon_ace *curr_ace = NULL;
2079 canon_ace *curr_ace_next = NULL;
2080
2081 /* Pass 1 above - look for an Everyone, deny entry. */
2082
2083 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2084 canon_ace *allow_ace_p;
2085
2086 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2087
2088 if (curr_ace->attr != DENY_ACE)
2089 continue;
2090
2091 if (curr_ace->perms == (mode_t)0) {
2092
2093 /* Deny nothing entry - delete. */
2094
2095 DLIST_REMOVE(ace_list, curr_ace);
2096 continue;
2097 }
2098
2099 if (!dom_sid_equal(&curr_ace->trustee, &global_sid_World))
2100 continue;
2101
2102 /* JRATEST - assert. */
2103 SMB_ASSERT(curr_ace->owner_type == WORLD_ACE);
2104
2105 if (curr_ace->perms == ALL_ACE_PERMS) {
2106
2107 /*
2108 * Optimisation. This is a DENY_ALL to Everyone. Truncate the
2109 * list at this point including this entry.
2110 */
2111
2112 canon_ace *prev_entry = DLIST_PREV(curr_ace);
2113
2114 free_canon_ace_list( curr_ace );
2115 if (prev_entry)
2116 DLIST_REMOVE(ace_list, prev_entry);
2117 else {
2118 /* We deleted the entire list. */
2119 ace_list = NULL;
2120 }
2121 break;
2122 }
2123
2124 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2125
2126 /*
2127 * Only mask off allow entries.
2128 */
2129
2130 if (allow_ace_p->attr != ALLOW_ACE)
2131 continue;
2132
2133 allow_ace_p->perms &= ~curr_ace->perms;
2134 }
2135
2136 /*
2137 * Now it's been applied, remove it.
2138 */
2139
2140 DLIST_REMOVE(ace_list, curr_ace);
2141 }
2142
2143 /* Pass 2 above - deal with deny user entries. */
2144
2145 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2146 mode_t new_perms = (mode_t)0;
2147 canon_ace *allow_ace_p;
2148
2149 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2150
2151 if (curr_ace->attr != DENY_ACE)
2152 continue;
2153
2154 if (curr_ace->owner_type != UID_ACE)
2155 continue;
2156
2157 if (curr_ace->perms == ALL_ACE_PERMS) {
2158
2159 /*
2160 * Optimisation - this is a deny everything to this user.
2161 * Convert to an allow nothing and push to the end of the list.
2162 */
2163
2164 curr_ace->attr = ALLOW_ACE;
2165 curr_ace->perms = (mode_t)0;
2166 DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2167 continue;
2168 }
2169
2170 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2171
2172 if (allow_ace_p->attr != ALLOW_ACE)
2173 continue;
2174
2175 /* We process GID_ACE and WORLD_ACE entries only. */
2176
2177 if (allow_ace_p->owner_type == UID_ACE)
2178 continue;
2179
2180 if (uid_entry_in_group(conn, curr_ace, allow_ace_p))
2181 new_perms |= allow_ace_p->perms;
2182 }
2183
2184 /*
2185 * Convert to a allow entry, modify the perms and push to the end
2186 * of the list.
2187 */
2188
2189 curr_ace->attr = ALLOW_ACE;
2190 curr_ace->perms = (new_perms & ~curr_ace->perms);
2191 DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2192 }
2193
2194 /* Pass 3 above - deal with deny group entries. */
2195
2196 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2197 canon_ace *allow_ace_p;
2198 canon_ace *allow_everyone_p = NULL;
2199
2200 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2201
2202 if (curr_ace->attr != DENY_ACE)
2203 continue;
2204
2205 if (curr_ace->owner_type != GID_ACE)
2206 continue;
2207
2208 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2209
2210 if (allow_ace_p->attr != ALLOW_ACE)
2211 continue;
2212
2213 /* Store a pointer to the Everyone allow, if it exists. */
2214 if (allow_ace_p->owner_type == WORLD_ACE)
2215 allow_everyone_p = allow_ace_p;
2216
2217 /* We process UID_ACE entries only. */
2218
2219 if (allow_ace_p->owner_type != UID_ACE)
2220 continue;
2221
2222 /* Mask off the deny group perms. */
2223
2224 if (uid_entry_in_group(conn, allow_ace_p, curr_ace))
2225 allow_ace_p->perms &= ~curr_ace->perms;
2226 }
2227
2228 /*
2229 * Convert the deny to an allow with the correct perms and
2230 * push to the end of the list.
2231 */
2232
2233 curr_ace->attr = ALLOW_ACE;
2234 if (allow_everyone_p)
2235 curr_ace->perms = allow_everyone_p->perms & ~curr_ace->perms;
2236 else
2237 curr_ace->perms = (mode_t)0;
2238 DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2239 }
2240
2241 /* Doing this fourth pass allows Windows semantics to be layered
2242 * on top of POSIX semantics. I'm not sure if this is desirable.
2243 * For example, in W2K ACLs there is no way to say, "Group X no
2244 * access, user Y full access" if user Y is a member of group X.
2245 * This seems completely broken semantics to me.... JRA.
2246 */
2247
2248 #if 0
2249 /* Pass 4 above - deal with allow entries. */
2250
2251 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2252 canon_ace *allow_ace_p;
2253
2254 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2255
2256 if (curr_ace->attr != ALLOW_ACE)
2257 continue;
2258
2259 if (curr_ace->owner_type != UID_ACE)
2260 continue;
2261
2262 for (allow_ace_p = ace_list; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2263
2264 if (allow_ace_p->attr != ALLOW_ACE)
2265 continue;
2266
2267 /* We process GID_ACE entries only. */
2268
2269 if (allow_ace_p->owner_type != GID_ACE)
2270 continue;
2271
2272 /* OR in the group perms. */
2273
2274 if (uid_entry_in_group(conn, curr_ace, allow_ace_p))
2275 curr_ace->perms |= allow_ace_p->perms;
2276 }
2277 }
2278 #endif
2279
2280 *pp_ace_list = ace_list;
2281 }
2282
2283 /****************************************************************************
2284 Unpack a struct security_descriptor into two canonical ace lists. We don't depend on this
2285 succeeding.
2286 ****************************************************************************/
2287
2288 static bool unpack_canon_ace(files_struct *fsp,
2289 const SMB_STRUCT_STAT *pst,
2290 struct dom_sid *pfile_owner_sid,
2291 struct dom_sid *pfile_grp_sid,
2292 canon_ace **ppfile_ace,
2293 canon_ace **ppdir_ace,
2294 uint32 security_info_sent,
2295 const struct security_descriptor *psd)
2296 {
2297 canon_ace *file_ace = NULL;
2298 canon_ace *dir_ace = NULL;
2299
2300 *ppfile_ace = NULL;
2301 *ppdir_ace = NULL;
2302
2303 if(security_info_sent == 0) {
2304 DEBUG(0,("unpack_canon_ace: no security info sent !\n"));
2305 return False;
2306 }
2307
2308 /*
2309 * If no DACL then this is a chown only security descriptor.
2310 */
2311
2312 if(!(security_info_sent & SECINFO_DACL) || !psd->dacl)
2313 return True;
2314
2315 /*
2316 * Now go through the DACL and create the canon_ace lists.
2317 */
2318
2319 if (!create_canon_ace_lists( fsp, pst, pfile_owner_sid, pfile_grp_sid,
2320 &file_ace, &dir_ace, psd->dacl))
2321 return False;
2322
2323 if ((file_ace == NULL) && (dir_ace == NULL)) {
2324 /* W2K traverse DACL set - ignore. */
2325 return True;
2326 }
2327
2328 /*
2329 * Go through the canon_ace list and merge entries
2330 * belonging to identical users of identical allow or deny type.
2331 * We can do this as all deny entries come first, followed by
2332 * all allow entries (we have mandated this before accepting this acl).
2333 */
2334
2335 print_canon_ace_list( "file ace - before merge", file_ace);
2336 merge_aces( &file_ace, false);
2337
2338 print_canon_ace_list( "dir ace - before merge", dir_ace);
2339 merge_aces( &dir_ace, true);
2340
2341 /*
2342 * NT ACLs are order dependent. Go through the acl lists and
2343 * process DENY entries by masking the allow entries.
2344 */
2345
2346 print_canon_ace_list( "file ace - before deny", file_ace);
2347 process_deny_list(fsp->conn, &file_ace);
2348
2349 print_canon_ace_list( "dir ace - before deny", dir_ace);
2350 process_deny_list(fsp->conn, &dir_ace);
2351
2352 /*
2353 * A well formed POSIX file or default ACL has at least 3 entries, a
2354 * SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ
2355 * and optionally a mask entry. Ensure this is the case.
2356 */
2357
2358 print_canon_ace_list( "file ace - before valid", file_ace);
2359
2360 if (!ensure_canon_entry_valid(fsp->conn, &file_ace, false, fsp->conn->params,
2361 fsp->is_directory, pfile_owner_sid, pfile_grp_sid, pst, True)) {
2362 free_canon_ace_list(file_ace);
2363 free_canon_ace_list(dir_ace);
2364 return False;
2365 }
2366
2367 print_canon_ace_list( "dir ace - before valid", dir_ace);
2368
2369 if (dir_ace && !ensure_canon_entry_valid(fsp->conn, &dir_ace, true, fsp->conn->params,
2370 fsp->is_directory, pfile_owner_sid, pfile_grp_sid, pst, True)) {
2371 free_canon_ace_list(file_ace);
2372 free_canon_ace_list(dir_ace);
2373 return False;
2374 }
2375
2376 print_canon_ace_list( "file ace - return", file_ace);
2377 print_canon_ace_list( "dir ace - return", dir_ace);
2378
2379 *ppfile_ace = file_ace;
2380 *ppdir_ace = dir_ace;
2381 return True;
2382
2383 }
2384
2385 /******************************************************************************
2386 When returning permissions, try and fit NT display
2387 semantics if possible. Note the the canon_entries here must have been malloced.
2388 The list format should be - first entry = owner, followed by group and other user
2389 entries, last entry = other.
2390
2391 Note that this doesn't exactly match the NT semantics for an ACL. As POSIX entries
2392 are not ordered, and match on the most specific entry rather than walking a list,
2393 then a simple POSIX permission of rw-r--r-- should really map to 5 entries,
2394
2395 Entry 0: owner : deny all except read and write.
2396 Entry 1: owner : allow read and write.
2397 Entry 2: group : deny all except read.
2398 Entry 3: group : allow read.
2399 Entry 4: Everyone : allow read.
2400
2401 But NT cannot display this in their ACL editor !
2402 ********************************************************************************/
2403
2404 static void arrange_posix_perms(const char *filename, canon_ace **pp_list_head)
2405 {
2406 canon_ace *l_head = *pp_list_head;
2407 canon_ace *owner_ace = NULL;
2408 canon_ace *other_ace = NULL;
2409 canon_ace *ace = NULL;
2410
2411 for (ace = l_head; ace; ace = ace->next) {
2412 if (ace->type == SMB_ACL_USER_OBJ)
2413 owner_ace = ace;
2414 else if (ace->type == SMB_ACL_OTHER) {
2415 /* Last ace - this is "other" */
2416 other_ace = ace;
2417 }
2418 }
2419
2420 if (!owner_ace || !other_ace) {
2421 DEBUG(0,("arrange_posix_perms: Invalid POSIX permissions for file %s, missing owner or other.\n",
2422 filename ));
2423 return;
2424 }
2425
2426 /*
2427 * The POSIX algorithm applies to owner first, and other last,
2428 * so ensure they are arranged in this order.
2429 */
2430
2431 if (owner_ace) {
2432 DLIST_PROMOTE(l_head, owner_ace);
2433 }
2434
2435 if (other_ace) {
2436 DLIST_DEMOTE(l_head, other_ace, canon_ace *);
2437 }
2438
2439 /* We have probably changed the head of the list. */
2440
2441 *pp_list_head = l_head;
2442 }
2443
2444 /****************************************************************************
2445 Create a linked list of canonical ACE entries.
2446 ****************************************************************************/
2447
2448 static canon_ace *canonicalise_acl(struct connection_struct *conn,
2449 const char *fname, SMB_ACL_T posix_acl,
2450 const SMB_STRUCT_STAT *psbuf,
2451 const struct dom_sid *powner, const struct dom_sid *pgroup, struct pai_val *pal, SMB_ACL_TYPE_T the_acl_type)
2452 {
2453 mode_t acl_mask = (S_IRUSR|S_IWUSR|S_IXUSR);
2454 canon_ace *l_head = NULL;
2455 canon_ace *ace = NULL;
2456 canon_ace *next_ace = NULL;
2457 int entry_id = SMB_ACL_FIRST_ENTRY;
2458 bool is_default_acl = (the_acl_type == SMB_ACL_TYPE_DEFAULT);
2459 SMB_ACL_ENTRY_T entry;
2460 size_t ace_count;
2461
2462 while ( posix_acl && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1)) {
2463 SMB_ACL_TAG_T tagtype;
2464 SMB_ACL_PERMSET_T permset;
2465 struct dom_sid sid;
2466 posix_id unix_ug;
2467 enum ace_owner owner_type;
2468
2469 entry_id = SMB_ACL_NEXT_ENTRY;
2470
2471 /* Is this a MASK entry ? */
2472 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1)
2473 continue;
2474
2475 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1)
2476 continue;
2477
2478 /* Decide which SID to use based on the ACL type. */
2479 switch(tagtype) {
2480 case SMB_ACL_USER_OBJ:
2481 /* Get the SID from the owner. */
2482 sid_copy(&sid, powner);
2483 unix_ug.uid = psbuf->st_ex_uid;
2484 owner_type = UID_ACE;
2485 break;
2486 case SMB_ACL_USER:
2487 {
2488 uid_t *puid = (uid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
2489 if (puid == NULL) {
2490 DEBUG(0,("canonicalise_acl: Failed to get uid.\n"));
2491 continue;
2492 }
2493 uid_to_sid( &sid, *puid);
2494 unix_ug.uid = *puid;
2495 owner_type = UID_ACE;
2496 SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)puid,tagtype);
2497 break;
2498 }
2499 case SMB_ACL_GROUP_OBJ:
2500 /* Get the SID from the owning group. */
2501 sid_copy(&sid, pgroup);
2502 unix_ug.gid = psbuf->st_ex_gid;
2503 owner_type = GID_ACE;
2504 break;
2505 case SMB_ACL_GROUP:
2506 {
2507 gid_t *pgid = (gid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
2508 if (pgid == NULL) {
2509 DEBUG(0,("canonicalise_acl: Failed to get gid.\n"));
2510 continue;
2511 }
2512 gid_to_sid( &sid, *pgid);
2513 unix_ug.gid = *pgid;
2514 owner_type = GID_ACE;
2515 SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)pgid,tagtype);
2516 break;
2517 }
2518 case SMB_ACL_MASK:
2519 acl_mask = convert_permset_to_mode_t(conn, permset);
2520 continue; /* Don't count the mask as an entry. */
2521 case SMB_ACL_OTHER:
2522 /* Use the Everyone SID */
2523 sid = global_sid_World;
2524 unix_ug.world = -1;
2525 owner_type = WORLD_ACE;
2526 break;
2527 default:
2528 DEBUG(0,("canonicalise_acl: Unknown tagtype %u\n", (unsigned int)tagtype));
2529 continue;
2530 }
2531
2532 /*
2533 * Add this entry to the list.
2534 */
2535
2536 if ((ace = SMB_MALLOC_P(canon_ace)) == NULL)
2537 goto fail;
2538
2539 ZERO_STRUCTP(ace);
2540 ace->type = tagtype;
2541 ace->perms = convert_permset_to_mode_t(conn, permset);
2542 ace->attr = ALLOW_ACE;
2543 ace->trustee = sid;
2544 ace->unix_ug = unix_ug;
2545 ace->owner_type = owner_type;
2546 ace->ace_flags = get_pai_flags(pal, ace, is_default_acl);
2547
2548 DLIST_ADD(l_head, ace);
2549 }
2550
2551 /*
2552 * This next call will ensure we have at least a user/group/world set.
2553 */
2554
2555 if (!ensure_canon_entry_valid(conn, &l_head, is_default_acl, conn->params,
2556 S_ISDIR(psbuf->st_ex_mode), powner, pgroup,
2557 psbuf, False))
2558 goto fail;
2559
2560 /*
2561 * Now go through the list, masking the permissions with the
2562 * acl_mask. Ensure all DENY Entries are at the start of the list.
2563 */
2564
2565 DEBUG(10,("canonicalise_acl: %s ace entries before arrange :\n", is_default_acl ? "Default" : "Access"));
2566
2567 for ( ace_count = 0, ace = l_head; ace; ace = next_ace, ace_count++) {
2568 next_ace = ace->next;
2569
2570 /* Masks are only applied to entries other than USER_OBJ and OTHER. */
2571 if (ace->type != SMB_ACL_OTHER && ace->type != SMB_ACL_USER_OBJ)
2572 ace->perms &= acl_mask;
2573
2574 if (ace->perms == 0) {
2575 DLIST_PROMOTE(l_head, ace);
2576 }
2577
2578 if( DEBUGLVL( 10 ) ) {
2579 print_canon_ace(ace, ace_count);
2580 }
2581 }
2582
2583 arrange_posix_perms(fname,&l_head );
2584
2585 print_canon_ace_list( "canonicalise_acl: ace entries after arrange", l_head );
2586
2587 return l_head;
2588
2589 fail:
2590
2591 free_canon_ace_list(l_head);
2592 return NULL;
2593 }
2594
2595 /****************************************************************************
2596 Check if the current user group list contains a given group.
2597 ****************************************************************************/
2598
2599 bool current_user_in_group(connection_struct *conn, gid_t gid)
2600 {
2601 int i;
2602 const struct security_unix_token *utok = get_current_utok(conn);
2603
2604 for (i = 0; i < utok->ngroups; i++) {
2605 if (utok->groups[i] == gid) {
2606 return True;
2607 }
2608 }
2609
2610 return False;
2611 }
2612
2613 /****************************************************************************
2614 Should we override a deny ? Check 'acl group control' and 'dos filemode'.
2615 ****************************************************************************/
2616
2617 static bool acl_group_override(connection_struct *conn,
2618 const struct smb_filename *smb_fname)
2619 {
2620 if ((errno != EPERM) && (errno != EACCES)) {
2621 return false;
2622 }
2623
2624 /* file primary group == user primary or supplementary group */
2625 if (lp_acl_group_control(SNUM(conn)) &&
2626 current_user_in_group(conn, smb_fname->st.st_ex_gid)) {
2627 return true;
2628 }
2629
2630 /* user has writeable permission */
2631 if (lp_dos_filemode(SNUM(conn)) &&
2632 can_write_to_file(conn, smb_fname)) {
2633 return true;
2634 }
2635
2636 return false;
2637 }
2638
2639 /****************************************************************************
2640 Attempt to apply an ACL to a file or directory.
2641 ****************************************************************************/
2642
2643 static bool set_canon_ace_list(files_struct *fsp,
2644 canon_ace *the_ace,
2645 bool default_ace,
2646 const SMB_STRUCT_STAT *psbuf,
2647 bool *pacl_set_support)
2648 {
2649 connection_struct *conn = fsp->conn;
2650 bool ret = False;
2651 SMB_ACL_T the_acl = SMB_VFS_SYS_ACL_INIT(conn, (int)count_canon_ace_list(the_ace) + 1);
2652 canon_ace *p_ace;
2653 int i;
2654 SMB_ACL_ENTRY_T mask_entry;
2655 bool got_mask_entry = False;
2656 SMB_ACL_PERMSET_T mask_permset;
2657 SMB_ACL_TYPE_T the_acl_type = (default_ace ? SMB_ACL_TYPE_DEFAULT : SMB_ACL_TYPE_ACCESS);
2658 bool needs_mask = False;
2659 mode_t mask_perms = 0;
2660
2661 /* Use the psbuf that was passed in. */
2662 if (psbuf != &fsp->fsp_name->st) {
2663 fsp->fsp_name->st = *psbuf;
2664 }
2665
2666 #if defined(POSIX_ACL_NEEDS_MASK)
2667 /* HP-UX always wants to have a mask (called "class" there). */
2668 needs_mask = True;
2669 #endif
2670
2671 if (the_acl == NULL) {
2672
2673 if (!no_acl_syscall_error(errno)) {
2674 /*
2675 * Only print this error message if we have some kind of ACL
2676 * support that's not working. Otherwise we would always get this.
2677 */
2678 DEBUG(0,("set_canon_ace_list: Unable to init %s ACL. (%s)\n",
2679 default_ace ? "default" : "file", strerror(errno) ));
2680 }
2681 *pacl_set_support = False;
2682 goto fail;
2683 }
2684
2685 if( DEBUGLVL( 10 )) {
2686 dbgtext("set_canon_ace_list: setting ACL:\n");
2687 for (i = 0, p_ace = the_ace; p_ace; p_ace = p_ace->next, i++ ) {
2688 print_canon_ace( p_ace, i);
2689 }
2690 }
2691
2692 for (i = 0, p_ace = the_ace; p_ace; p_ace = p_ace->next, i++ ) {
2693 SMB_ACL_ENTRY_T the_entry;
2694 SMB_ACL_PERMSET_T the_permset;
2695
2696 /*
2697 * ACLs only "need" an ACL_MASK entry if there are any named user or
2698 * named group entries. But if there is an ACL_MASK entry, it applies
2699 * to ACL_USER, ACL_GROUP, and ACL_GROUP_OBJ entries. Set the mask
2700 * so that it doesn't deny (i.e., mask off) any permissions.
2701 */
2702
2703 if (p_ace->type == SMB_ACL_USER || p_ace->type == SMB_ACL_GROUP) {
2704 needs_mask = True;
2705 mask_perms |= p_ace->perms;
2706 } else if (p_ace->type == SMB_ACL_GROUP_OBJ) {
2707 mask_perms |= p_ace->perms;
2708 }
2709
2710 /*
2711 * Get the entry for this ACE.
2712 */
2713
2714 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &the_entry) == -1) {
2715 DEBUG(0,("set_canon_ace_list: Failed to create entry %d. (%s)\n",
2716 i, strerror(errno) ));
2717 goto fail;
2718 }
2719
2720 if (p_ace->type == SMB_ACL_MASK) {
2721 mask_entry = the_entry;
2722 got_mask_entry = True;
2723 }
2724
2725 /*
2726 * Ok - we now know the ACL calls should be working, don't
2727 * allow fallback to chmod.
2728 */
2729
2730 *pacl_set_support = True;
2731
2732 /*
2733 * Initialise the entry from the canon_ace.
2734 */
2735
2736 /*
2737 * First tell the entry what type of ACE this is.
2738 */
2739
2740 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, the_entry, p_ace->type) == -1) {
2741 DEBUG(0,("set_canon_ace_list: Failed to set tag type on entry %d. (%s)\n",
2742 i, strerror(errno) ));
2743 goto fail;
2744 }
2745
2746 /*
2747 * Only set the qualifier (user or group id) if the entry is a user
2748 * or group id ACE.
2749 */
2750
2751 if ((p_ace->type == SMB_ACL_USER) || (p_ace->type == SMB_ACL_GROUP)) {
2752 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&p_ace->unix_ug.uid) == -1) {
2753 DEBUG(0,("set_canon_ace_list: Failed to set qualifier on entry %d. (%s)\n",
2754 i, strerror(errno) ));
2755 goto fail;
2756 }
2757 }
2758
2759 /*
2760 * Convert the mode_t perms in the canon_ace to a POSIX permset.
2761 */
2762
2763 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, the_entry, &the_permset) == -1) {
2764 DEBUG(0,("set_canon_ace_list: Failed to get permset on entry %d. (%s)\n",
2765 i, strerror(errno) ));
2766 goto fail;
2767 }
2768
2769 if (map_acl_perms_to_permset(conn, p_ace->perms, &the_permset) == -1) {
2770 DEBUG(0,("set_canon_ace_list: Failed to create permset for mode (%u) on entry %d. (%s)\n",
2771 (unsigned int)p_ace->perms, i, strerror(errno) ));
2772 goto fail;
2773 }
2774
2775 /*
2776 * ..and apply them to the entry.
2777 */
2778
2779 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, the_entry, the_permset) == -1) {
2780 DEBUG(0,("set_canon_ace_list: Failed to add permset on entry %d. (%s)\n",
2781 i, strerror(errno) ));
2782 goto fail;
2783 }
2784
2785 if( DEBUGLVL( 10 ))
2786 print_canon_ace( p_ace, i);
2787
2788 }
2789
2790 if (needs_mask && !got_mask_entry) {
2791 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &mask_entry) == -1) {
2792 DEBUG(0,("set_canon_ace_list: Failed to create mask entry. (%s)\n", strerror(errno) ));
2793 goto fail;
2794 }
2795
2796 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, mask_entry, SMB_ACL_MASK) == -1) {
2797 DEBUG(0,("set_canon_ace_list: Failed to set tag type on mask entry. (%s)\n",strerror(errno) ));
2798 goto fail;
2799 }
2800
2801 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, mask_entry, &mask_permset) == -1) {
2802 DEBUG(0,("set_canon_ace_list: Failed to get mask permset. (%s)\n", strerror(errno) ));
2803 goto fail;
2804 }
2805
2806 if (map_acl_perms_to_permset(conn, S_IRUSR|S_IWUSR|S_IXUSR, &mask_permset) == -1) {
2807 DEBUG(0,("set_canon_ace_list: Failed to create mask permset. (%s)\n", strerror(errno) ));
2808 goto fail;
2809 }
2810
2811 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, mask_entry, mask_permset) == -1) {
2812 DEBUG(0,("set_canon_ace_list: Failed to add mask permset. (%s)\n", strerror(errno) ));
2813 goto fail;
2814 }
2815 }
2816
2817 /*
2818 * Finally apply it to the file or directory.
2819 */
2820
2821 if(default_ace || fsp->is_directory || fsp->fh->fd == -1) {
2822 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fsp->fsp_name->base_name,
2823 the_acl_type, the_acl) == -1) {
2824 /*
2825 * Some systems allow all the above calls and only fail with no ACL support
2826 * when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
2827 */
2828 if (no_acl_syscall_error(errno)) {
2829 *pacl_set_support = False;
2830 }
2831
2832 if (acl_group_override(conn, fsp->fsp_name)) {
2833 int sret;
2834
2835 DEBUG(5,("set_canon_ace_list: acl group "
2836 "control on and current user in file "
2837 "%s primary group.\n",
2838 fsp_str_dbg(fsp)));
2839
2840 become_root();
2841 sret = SMB_VFS_SYS_ACL_SET_FILE(conn,
2842 fsp->fsp_name->base_name, the_acl_type,
2843 the_acl);
2844 unbecome_root();
2845 if (sret == 0) {
2846 ret = True;
2847 }
2848 }
2849
2850 if (ret == False) {
2851 DEBUG(2,("set_canon_ace_list: "
2852 "sys_acl_set_file type %s failed for "
2853 "file %s (%s).\n",
2854 the_acl_type == SMB_ACL_TYPE_DEFAULT ?
2855 "directory default" : "file",
2856 fsp_str_dbg(fsp), strerror(errno)));
2857 goto fail;
2858 }
2859 }
2860 } else {
2861 if (SMB_VFS_SYS_ACL_SET_FD(fsp, the_acl) == -1) {
2862 /*
2863 * Some systems allow all the above calls and only fail with no ACL support
2864 * when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
2865 */
2866 if (no_acl_syscall_error(errno)) {
2867 *pacl_set_support = False;
2868 }
2869
2870 if (acl_group_override(conn, fsp->fsp_name)) {
2871 int sret;
2872
2873 DEBUG(5,("set_canon_ace_list: acl group "
2874 "control on and current user in file "
2875 "%s primary group.\n",
2876 fsp_str_dbg(fsp)));
2877
2878 become_root();
2879 sret = SMB_VFS_SYS_ACL_SET_FD(fsp, the_acl);
2880 unbecome_root();
2881 if (sret == 0) {
2882 ret = True;
2883 }
2884 }
2885
2886 if (ret == False) {
2887 DEBUG(2,("set_canon_ace_list: "
2888 "sys_acl_set_file failed for file %s "
2889 "(%s).\n",
2890 fsp_str_dbg(fsp), strerror(errno)));
2891 goto fail;
2892 }
2893 }
2894 }
2895
2896 ret = True;
2897
2898 fail:
2899
2900 if (the_acl != NULL) {
2901 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
2902 }
2903
2904 return ret;
2905 }
2906
2907 /****************************************************************************
2908 Find a particular canon_ace entry.
2909 ****************************************************************************/
2910
2911 static struct canon_ace *canon_ace_entry_for(struct canon_ace *list, SMB_ACL_TAG_T type, posix_id *id)
2912 {
2913 while (list) {
2914 if (list->type == type && ((type != SMB_ACL_USER && type != SMB_ACL_GROUP) ||
2915 (type == SMB_ACL_USER && id && id->uid == list->unix_ug.uid) ||
2916 (type == SMB_ACL_GROUP && id && id->gid == list->unix_ug.gid)))
2917 break;
2918 list = list->next;
2919 }
2920 return list;
2921 }
2922
2923 /****************************************************************************
2924
2925 ****************************************************************************/
2926
2927 SMB_ACL_T free_empty_sys_acl(connection_struct *conn, SMB_ACL_T the_acl)
2928 {
2929 SMB_ACL_ENTRY_T entry;
2930
2931 if (!the_acl)
2932 return NULL;
2933 if (SMB_VFS_SYS_ACL_GET_ENTRY(conn, the_acl, SMB_ACL_FIRST_ENTRY, &entry) != 1) {
2934 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
2935 return NULL;
2936 }
2937 return the_acl;
2938 }
2939
2940 /****************************************************************************
2941 Convert a canon_ace to a generic 3 element permission - if possible.
2942 ****************************************************************************/
2943
2944 #define MAP_PERM(p,mask,result) (((p) & (mask)) ? (result) : 0 )
2945
2946 static bool convert_canon_ace_to_posix_perms( files_struct *fsp, canon_ace *file_ace_list, mode_t *posix_perms)
2947 {
2948 int snum = SNUM(fsp->conn);
2949 size_t ace_count = count_canon_ace_list(file_ace_list);
2950 canon_ace *ace_p;
2951 canon_ace *owner_ace = NULL;
2952 canon_ace *group_ace = NULL;
2953 canon_ace *other_ace = NULL;
2954 mode_t and_bits;
2955 mode_t or_bits;
2956
2957 if (ace_count != 3) {
2958 DEBUG(3,("convert_canon_ace_to_posix_perms: Too many ACE "
2959 "entries for file %s to convert to posix perms.\n",
2960 fsp_str_dbg(fsp)));
2961 return False;
2962 }
2963
2964 for (ace_p = file_ace_list; ace_p; ace_p = ace_p->next) {
2965 if (ace_p->owner_type == UID_ACE)
2966 owner_ace = ace_p;
2967 else if (ace_p->owner_type == GID_ACE)
2968 group_ace = ace_p;
2969 else if (ace_p->owner_type == WORLD_ACE)
2970 other_ace = ace_p;
2971 }
2972
2973 if (!owner_ace || !group_ace || !other_ace) {
2974 DEBUG(3,("convert_canon_ace_to_posix_perms: Can't get "
2975 "standard entries for file %s.\n", fsp_str_dbg(fsp)));
2976 return False;
2977 }
2978
2979 *posix_perms = (mode_t)0;
2980
2981 *posix_perms |= owner_ace->perms;
2982 *posix_perms |= MAP_PERM(group_ace->perms, S_IRUSR, S_IRGRP);
2983 *posix_perms |= MAP_PERM(group_ace->perms, S_IWUSR, S_IWGRP);
2984 *posix_perms |= MAP_PERM(group_ace->perms, S_IXUSR, S_IXGRP);
2985 *posix_perms |= MAP_PERM(other_ace->perms, S_IRUSR, S_IROTH);
2986 *posix_perms |= MAP_PERM(other_ace->perms, S_IWUSR, S_IWOTH);
2987 *posix_perms |= MAP_PERM(other_ace->perms, S_IXUSR, S_IXOTH);
2988
2989 /* The owner must have at least read access. */
2990
2991 *posix_perms |= S_IRUSR;
2992 if (fsp->is_directory)
2993 *posix_perms |= (S_IWUSR|S_IXUSR);
2994
2995 /* If requested apply the masks. */
2996
2997 /* Get the initial bits to apply. */
2998
2999 if (fsp->is_directory) {
3000 and_bits = lp_dir_security_mask(snum);
3001 or_bits = lp_force_dir_security_mode(snum);
3002 } else {
3003 and_bits = lp_security_mask(snum);
3004 or_bits = lp_force_security_mode(snum);
3005 }
3006
3007 *posix_perms = (((*posix_perms) & and_bits)|or_bits);
3008
3009 DEBUG(10,("convert_canon_ace_to_posix_perms: converted u=%o,g=%o,w=%o "
3010 "to perm=0%o for file %s.\n", (int)owner_ace->perms,
3011 (int)group_ace->perms, (int)other_ace->perms,
3012 (int)*posix_perms, fsp_str_dbg(fsp)));
3013
3014 return True;
3015 }
3016
3017 /****************************************************************************
3018 Incoming NT ACLs on a directory can be split into a default POSIX acl (CI|OI|IO) and
3019 a normal POSIX acl. Win2k needs these split acls re-merging into one ACL
3020 with CI|OI set so it is inherited and also applies to the directory.
3021 Based on code from "Jim McDonough" <jmcd@us.ibm.com>.
3022 ****************************************************************************/
3023
3024 static size_t merge_default_aces( struct security_ace *nt_ace_list, size_t num_aces)
3025 {
3026 size_t i, j;
3027
3028 for (i = 0; i < num_aces; i++) {
3029 for (j = i+1; j < num_aces; j++) {
3030 uint32 i_flags_ni = (nt_ace_list[i].flags & ~SEC_ACE_FLAG_INHERITED_ACE);
3031 uint32 j_flags_ni = (nt_ace_list[j].flags & ~SEC_ACE_FLAG_INHERITED_ACE);
3032 bool i_inh = (nt_ace_list[i].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False;
3033 bool j_inh = (nt_ace_list[j].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False;
3034
3035 /* We know the lower number ACE's are file entries. */
3036 if ((nt_ace_list[i].type == nt_ace_list[j].type) &&
3037 (nt_ace_list[i].size == nt_ace_list[j].size) &&
3038 (nt_ace_list[i].access_mask == nt_ace_list[j].access_mask) &&
3039 dom_sid_equal(&nt_ace_list[i].trustee, &nt_ace_list[j].trustee) &&
3040 (i_inh == j_inh) &&
3041 (i_flags_ni == 0) &&
3042 (j_flags_ni == (SEC_ACE_FLAG_OBJECT_INHERIT|
3043 SEC_ACE_FLAG_CONTAINER_INHERIT|
3044 SEC_ACE_FLAG_INHERIT_ONLY))) {
3045 /*
3046 * W2K wants to have access allowed zero access ACE's
3047 * at the end of the list. If the mask is zero, merge
3048 * the non-inherited ACE onto the inherited ACE.
3049 */
3050
3051 if (nt_ace_list[i].access_mask == 0) {
3052 nt_ace_list[j].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
3053 (i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0);
3054 if (num_aces - i - 1 > 0)
3055 memmove(&nt_ace_list[i], &nt_ace_list[i+1], (num_aces-i-1) *
3056 sizeof(struct security_ace));
3057
3058 DEBUG(10,("merge_default_aces: Merging zero access ACE %u onto ACE %u.\n",
3059 (unsigned int)i, (unsigned int)j ));
3060 } else {
3061 /*
3062 * These are identical except for the flags.
3063 * Merge the inherited ACE onto the non-inherited ACE.
3064 */
3065
3066 nt_ace_list[i].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
3067 (i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0);
3068 if (num_aces - j - 1 > 0)
3069 memmove(&nt_ace_list[j], &nt_ace_list[j+1], (num_aces-j-1) *
3070 sizeof(struct security_ace));
3071
3072 DEBUG(10,("merge_default_aces: Merging ACE %u onto ACE %u.\n",
3073 (unsigned int)j, (unsigned int)i ));
3074 }
3075 num_aces--;
3076 break;
3077 }
3078 }
3079 }
3080
3081 return num_aces;
3082 }
3083
3084 /*
3085 * Add or Replace ACE entry.
3086 * In some cases we need to add a specific ACE for compatibility reasons.
3087 * When doing that we must make sure we are not actually creating a duplicate
3088 * entry. So we need to search whether an ACE entry already exist and eventually
3089 * replacce the access mask, or add a completely new entry if none was found.
3090 *
3091 * This function assumes the array has enough space to add a new entry without
3092 * any reallocation of memory.
3093 */
3094
3095 static void add_or_replace_ace(struct security_ace *nt_ace_list, size_t *num_aces,
3096 const struct dom_sid *sid, enum security_ace_type type,
3097 uint32_t mask, uint8_t flags)
3098 {
3099 int i;
3100
3101 /* first search for a duplicate */
3102 for (i = 0; i < *num_aces; i++) {
3103 if (dom_sid_equal(&nt_ace_list[i].trustee, sid) &&
3104 (nt_ace_list[i].flags == flags)) break;
3105 }
3106
3107 if (i < *num_aces) { /* found */
3108 nt_ace_list[i].type = type;
3109 nt_ace_list[i].access_mask = mask;
3110 DEBUG(10, ("Replacing ACE %d with SID %s and flags %02x\n",
3111 i, sid_string_dbg(sid), flags));
3112 return;
3113 }
3114
3115 /* not found, append it */
3116 init_sec_ace(&nt_ace_list[(*num_aces)++], sid, type, mask, flags);
3117 }
3118
3119
3120 /****************************************************************************
3121 Reply to query a security descriptor from an fsp. If it succeeds it allocates
3122 the space for the return elements and returns the size needed to return the
3123 security descriptor. This should be the only external function needed for
3124 the UNIX style get ACL.
3125 ****************************************************************************/
3126
3127 static NTSTATUS posix_get_nt_acl_common(struct connection_struct *conn,
3128 const char *name,
3129 const SMB_STRUCT_STAT *sbuf,
3130 struct pai_val *pal,
3131 SMB_ACL_T posix_acl,
3132 SMB_ACL_T def_acl,
3133 uint32_t security_info,
3134 struct security_descriptor **ppdesc)
3135 {
3136 struct dom_sid owner_sid;
3137 struct dom_sid group_sid;
3138 size_t sd_size = 0;
3139 struct security_acl *psa = NULL;
3140 size_t num_acls = 0;
3141 size_t num_def_acls = 0;
3142 size_t num_aces = 0;
3143 canon_ace *file_ace = NULL;
3144 canon_ace *dir_ace = NULL;
3145 struct security_ace *nt_ace_list = NULL;
3146 size_t num_profile_acls = 0;
3147 struct dom_sid orig_owner_sid;
3148 struct security_descriptor *psd = NULL;
3149 int i;
3150
3151 /*
3152 * Get the owner, group and world SIDs.
3153 */
3154
3155 create_file_sids(sbuf, &owner_sid, &group_sid);
3156
3157 if (lp_profile_acls(SNUM(conn))) {
3158 /* For WXP SP1 the owner must be administrators. */
3159 sid_copy(&orig_owner_sid, &owner_sid);
3160 sid_copy(&owner_sid, &global_sid_Builtin_Administrators);
3161 sid_copy(&group_sid, &global_sid_Builtin_Users);
3162 num_profile_acls = 3;
3163 }
3164
3165 if ((security_info & SECINFO_DACL) && !(security_info & SECINFO_PROTECTED_DACL)) {
3166
3167 /*
3168 * In the optimum case Creator Owner and Creator Group would be used for
3169 * the ACL_USER_OBJ and ACL_GROUP_OBJ entries, respectively, but this
3170 * would lead to usability problems under Windows: The Creator entries
3171 * are only available in browse lists of directories and not for files;
3172 * additionally the identity of the owning group couldn't be determined.
3173 * We therefore use those identities only for Default ACLs.
3174 */
3175
3176 /* Create the canon_ace lists. */
3177 file_ace = canonicalise_acl(conn, name, posix_acl, sbuf,
3178 &owner_sid, &group_sid, pal,
3179 SMB_ACL_TYPE_ACCESS);
3180
3181 /* We must have *some* ACLS. */
3182
3183 if (count_canon_ace_list(file_ace) == 0) {
3184 DEBUG(0,("get_nt_acl : No ACLs on file (%s) !\n", name));
3185 goto done;
3186 }
3187
3188 if (S_ISDIR(sbuf->st_ex_mode) && def_acl) {
3189 dir_ace = canonicalise_acl(conn, name, def_acl,
3190 sbuf,
3191 &global_sid_Creator_Owner,
3192 &global_sid_Creator_Group,
3193 pal, SMB_ACL_TYPE_DEFAULT);
3194 }
3195
3196 /*
3197 * Create the NT ACE list from the canonical ace lists.
3198 */
3199
3200 {
3201 canon_ace *ace;
3202 enum security_ace_type nt_acl_type;
3203
3204 if (nt4_compatible_acls() && dir_ace) {
3205 /*
3206 * NT 4 chokes if an ACL contains an INHERIT_ONLY entry
3207 * but no non-INHERIT_ONLY entry for one SID. So we only
3208 * remove entries from the Access ACL if the
3209 * corresponding Default ACL entries have also been
3210 * removed. ACEs for CREATOR-OWNER and CREATOR-GROUP
3211 * are exceptions. We can do nothing
3212 * intelligent if the Default ACL contains entries that
3213 * are not also contained in the Access ACL, so this
3214 * case will still fail under NT 4.
3215 */
3216
3217 ace = canon_ace_entry_for(dir_ace, SMB_ACL_OTHER, NULL);
3218 if (ace && !ace->perms) {
3219 DLIST_REMOVE(dir_ace, ace);
3220 SAFE_FREE(ace);
3221
3222 ace = canon_ace_entry_for(file_ace, SMB_ACL_OTHER, NULL);
3223 if (ace && !ace->perms) {
3224 DLIST_REMOVE(file_ace, ace);
3225 SAFE_FREE(ace);
3226 }
3227 }
3228
3229 /*
3230 * WinNT doesn't usually have Creator Group
3231 * in browse lists, so we send this entry to
3232 * WinNT even if it contains no relevant
3233 * permissions. Once we can add
3234 * Creator Group to browse lists we can
3235 * re-enable this.
3236 */
3237
3238 #if 0
3239 ace = canon_ace_entry_for(dir_ace, SMB_ACL_GROUP_OBJ, NULL);
3240 if (ace && !ace->perms) {
3241 DLIST_REMOVE(dir_ace, ace);
3242 SAFE_FREE(ace);
3243 }
3244 #endif
3245
3246 ace = canon_ace_entry_for(file_ace, SMB_ACL_GROUP_OBJ, NULL);
3247 if (ace && !ace->perms) {
3248 DLIST_REMOVE(file_ace, ace);
3249 SAFE_FREE(ace);
3250 }
3251 }
3252
3253 num_acls = count_canon_ace_list(file_ace);
3254 num_def_acls = count_canon_ace_list(dir_ace);
3255
3256 /* Allocate the ace list. */
3257 if ((nt_ace_list = SMB_MALLOC_ARRAY(struct security_ace,num_acls + num_profile_acls + num_def_acls)) == NULL) {
3258 DEBUG(0,("get_nt_acl: Unable to malloc space for nt_ace_list.\n"));
3259 goto done;
3260 }
3261
3262 memset(nt_ace_list, '\0', (num_acls + num_def_acls) * sizeof(struct security_ace) );
3263
3264 /*
3265 * Create the NT ACE list from the canonical ace lists.
3266 */
3267
3268 for (ace = file_ace; ace != NULL; ace = ace->next) {
3269 uint32_t acc = map_canon_ace_perms(SNUM(conn),
3270 &nt_acl_type,
3271 ace->perms,
3272 S_ISDIR(sbuf->st_ex_mode));
3273 init_sec_ace(&nt_ace_list[num_aces++],
3274 &ace->trustee,
3275 nt_acl_type,
3276 acc,
3277 ace->ace_flags);
3278 }
3279
3280 /* The User must have access to a profile share - even
3281 * if we can't map the SID. */
3282 if (lp_profile_acls(SNUM(conn))) {
3283 add_or_replace_ace(nt_ace_list, &num_aces,
3284 &global_sid_Builtin_Users,
3285 SEC_ACE_TYPE_ACCESS_ALLOWED,
3286 FILE_GENERIC_ALL, 0);
3287 }
3288
3289 for (ace = dir_ace; ace != NULL; ace = ace->next) {
3290 uint32_t acc = map_canon_ace_perms(SNUM(conn),
3291 &nt_acl_type,
3292 ace->perms,
3293 S_ISDIR(sbuf->st_ex_mode));
3294 init_sec_ace(&nt_ace_list[num_aces++],
3295 &ace->trustee,
3296 nt_acl_type,
3297 acc,
3298 ace->ace_flags |
3299 SEC_ACE_FLAG_OBJECT_INHERIT|
3300 SEC_ACE_FLAG_CONTAINER_INHERIT|
3301 SEC_ACE_FLAG_INHERIT_ONLY);
3302 }
3303
3304 /* The User must have access to a profile share - even
3305 * if we can't map the SID. */
3306 if (lp_profile_acls(SNUM(conn))) {
3307 add_or_replace_ace(nt_ace_list, &num_aces,
3308 &global_sid_Builtin_Users,
3309 SEC_ACE_TYPE_ACCESS_ALLOWED,
3310 FILE_GENERIC_ALL,
3311 SEC_ACE_FLAG_OBJECT_INHERIT |
3312 SEC_ACE_FLAG_CONTAINER_INHERIT |
3313 SEC_ACE_FLAG_INHERIT_ONLY);
3314 }
3315
3316 /*
3317 * Merge POSIX default ACLs and normal ACLs into one NT ACE.
3318 * Win2K needs this to get the inheritance correct when replacing ACLs
3319 * on a directory tree. Based on work by Jim @ IBM.
3320 */
3321
3322 num_aces = merge_default_aces(nt_ace_list, num_aces);
3323
3324 if (lp_profile_acls(SNUM(conn))) {
3325 for (i = 0; i < num_aces; i++) {
3326 if (dom_sid_equal(&nt_ace_list[i].trustee, &owner_sid)) {
3327 add_or_replace_ace(nt_ace_list, &num_aces,
3328 &orig_owner_sid,
3329 nt_ace_list[i].type,
3330 nt_ace_list[i].access_mask,
3331 nt_ace_list[i].flags);
3332 break;
3333 }
3334 }
3335 }
3336 }
3337
3338 if (num_aces) {
3339 if((psa = make_sec_acl( talloc_tos(), NT4_ACL_REVISION, num_aces, nt_ace_list)) == NULL) {
3340 DEBUG(0,("get_nt_acl: Unable to malloc space for acl.\n"));
3341 goto done;
3342 }
3343 }
3344 } /* security_info & SECINFO_DACL */
3345
3346 psd = make_standard_sec_desc( talloc_tos(),
3347 (security_info & SECINFO_OWNER) ? &owner_sid : NULL,
3348 (security_info & SECINFO_GROUP) ? &group_sid : NULL,
3349 psa,
3350 &sd_size);
3351
3352 if(!psd) {
3353 DEBUG(0,("get_nt_acl: Unable to malloc space for security descriptor.\n"));
3354 sd_size = 0;
3355 goto done;
3356 }
3357
3358 /*
3359 * Windows 2000: The DACL_PROTECTED flag in the security
3360 * descriptor marks the ACL as non-inheriting, i.e., no
3361 * ACEs from higher level directories propagate to this
3362 * ACL. In the POSIX ACL model permissions are only
3363 * inherited at file create time, so ACLs never contain
3364 * any ACEs that are inherited dynamically. The DACL_PROTECTED
3365 * flag doesn't seem to bother Windows NT.
3366 * Always set this if map acl inherit is turned off.
3367 */
3368 if (pal == NULL || !lp_map_acl_inherit(SNUM(conn))) {
3369 psd->type |= SEC_DESC_DACL_PROTECTED;
3370 } else {
3371 psd->type |= pal->sd_type;
3372 }
3373
3374 if (psd->dacl) {
3375 dacl_sort_into_canonical_order(psd->dacl->aces, (unsigned int)psd->dacl->num_aces);
3376 }
3377
3378 *ppdesc = psd;
3379
3380 done:
3381
3382 if (posix_acl) {
3383 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
3384 }
3385 if (def_acl) {
3386 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
3387 }
3388 free_canon_ace_list(file_ace);
3389 free_canon_ace_list(dir_ace);
3390 free_inherited_info(pal);
3391 SAFE_FREE(nt_ace_list);
3392
3393 return NT_STATUS_OK;
3394 }
3395
3396 NTSTATUS posix_fget_nt_acl(struct files_struct *fsp, uint32_t security_info,
3397 struct security_descriptor **ppdesc)
3398 {
3399 SMB_STRUCT_STAT sbuf;
3400 SMB_ACL_T posix_acl = NULL;
3401 struct pai_val *pal;
3402
3403 *ppdesc = NULL;
3404
3405 DEBUG(10,("posix_fget_nt_acl: called for file %s\n",
3406 fsp_str_dbg(fsp)));
3407
3408 /* can it happen that fsp_name == NULL ? */
3409 if (fsp->is_directory || fsp->fh->fd == -1) {
3410 return posix_get_nt_acl(fsp->conn, fsp->fsp_name->base_name,
3411 security_info, ppdesc);
3412 }
3413
3414 /* Get the stat struct for the owner info. */
3415 if(SMB_VFS_FSTAT(fsp, &sbuf) != 0) {
3416 return map_nt_error_from_unix(errno);
3417 }
3418
3419 /* Get the ACL from the fd. */
3420 posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp);
3421
3422 pal = fload_inherited_info(fsp);
3423
3424 return posix_get_nt_acl_common(fsp->conn, fsp->fsp_name->base_name,
3425 &sbuf, pal, posix_acl, NULL,
3426 security_info, ppdesc);
3427 }
3428
3429 NTSTATUS posix_get_nt_acl(struct connection_struct *conn, const char *name,
3430 uint32_t security_info, struct security_descriptor **ppdesc)
3431 {
3432 SMB_ACL_T posix_acl = NULL;
3433 SMB_ACL_T def_acl = NULL;
3434 struct pai_val *pal;
3435 struct smb_filename smb_fname;
3436 int ret;
3437
3438 *ppdesc = NULL;
3439
3440 DEBUG(10,("posix_get_nt_acl: called for file %s\n", name ));
3441
3442 ZERO_STRUCT(smb_fname);
3443 smb_fname.base_name = discard_const_p(char, name);
3444
3445 /* Get the stat struct for the owner info. */
3446 if (lp_posix_pathnames()) {
3447 ret = SMB_VFS_LSTAT(conn, &smb_fname);
3448 } else {
3449 ret = SMB_VFS_STAT(conn, &smb_fname);
3450 }
3451
3452 if (ret == -1) {
3453 return map_nt_error_from_unix(errno);
3454 }
3455
3456 /* Get the ACL from the path. */
3457 posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name, SMB_ACL_TYPE_ACCESS);
3458
3459 /* If it's a directory get the default POSIX ACL. */
3460 if(S_ISDIR(smb_fname.st.st_ex_mode)) {
3461 def_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name, SMB_ACL_TYPE_DEFAULT);
3462 def_acl = free_empty_sys_acl(conn, def_acl);
3463 }
3464
3465 pal = load_inherited_info(conn, name);
3466
3467 return posix_get_nt_acl_common(conn, name, &smb_fname.st, pal,
3468 posix_acl, def_acl, security_info,
3469 ppdesc);
3470 }
3471
3472 /****************************************************************************
3473 Try to chown a file. We will be able to chown it under the following conditions.
3474
3475 1) If we have root privileges, then it will just work.
3476 2) If we have SeRestorePrivilege we can change the user + group to any other user.
3477 3) If we have SeTakeOwnershipPrivilege we can change the user to the current user.
3478 4) If we have write permission to the file and dos_filemodes is set
3479 then allow chown to the currently authenticated user.
3480 ****************************************************************************/
3481
3482 NTSTATUS try_chown(files_struct *fsp, uid_t uid, gid_t gid)
3483 {
3484 NTSTATUS status;
3485
3486 if(!CAN_WRITE(fsp->conn)) {
3487 return NT_STATUS_MEDIA_WRITE_PROTECTED;
3488 }
3489
3490 /* Case (1). */
3491 status = vfs_chown_fsp(fsp, uid, gid);
3492 if (NT_STATUS_IS_OK(status)) {
3493 return status;
3494 }
3495
3496 /* Case (2) / (3) */
3497 if (lp_enable_privileges()) {
3498 bool has_take_ownership_priv = security_token_has_privilege(
3499 get_current_nttok(fsp->conn),
3500 SEC_PRIV_TAKE_OWNERSHIP);
3501 bool has_restore_priv = security_token_has_privilege(
3502 get_current_nttok(fsp->conn),
3503 SEC_PRIV_RESTORE);
3504
3505 if (has_restore_priv) {
3506 ; /* Case (2) */
3507 } else if (has_take_ownership_priv) {
3508 /* Case (3) */
3509 if (uid == get_current_uid(fsp->conn)) {
3510 gid = (gid_t)-1;
3511 } else {
3512 has_take_ownership_priv = false;
3513 }
3514 }
3515
3516 if (has_take_ownership_priv || has_restore_priv) {
3517 become_root();
3518 status = vfs_chown_fsp(fsp, uid, gid);
3519 unbecome_root();
3520 return status;
3521 }
3522 }
3523
3524 /* Case (4). */
3525 if (!lp_dos_filemode(SNUM(fsp->conn))) {
3526 return NT_STATUS_ACCESS_DENIED;
3527 }
3528
3529 /* only allow chown to the current user. This is more secure,
3530 and also copes with the case where the SID in a take ownership ACL is
3531 a local SID on the users workstation
3532 */
3533 if (uid != get_current_uid(fsp->conn)) {
3534 return NT_STATUS_ACCESS_DENIED;
3535 }
3536
3537 become_root();
3538 /* Keep the current file gid the same. */
3539 status = vfs_chown_fsp(fsp, uid, (gid_t)-1);
3540 unbecome_root();
3541
3542 return status;
3543 }
3544
3545 #if 0
3546 /* Disable this - prevents ACL inheritance from the ACL editor. JRA. */
3547
3548 /****************************************************************************
3549 Take care of parent ACL inheritance.
3550 ****************************************************************************/
3551
3552 NTSTATUS append_parent_acl(files_struct *fsp,
3553 const struct security_descriptor *pcsd,
3554 struct security_descriptor **pp_new_sd)
3555 {
3556 struct smb_filename *smb_dname = NULL;
3557 struct security_descriptor *parent_sd = NULL;
3558 files_struct *parent_fsp = NULL;
3559 TALLOC_CTX *mem_ctx = talloc_tos();
3560 char *parent_name = NULL;
3561 struct security_ace *new_ace = NULL;
3562 unsigned int num_aces = pcsd->dacl->num_aces;
3563 NTSTATUS status;
3564 int info;
3565 unsigned int i, j;
3566 struct security_descriptor *psd = dup_sec_desc(talloc_tos(), pcsd);
3567 bool is_dacl_protected = (pcsd->type & SEC_DESC_DACL_PROTECTED);
3568
3569 if (psd == NULL) {
3570 return NT_STATUS_NO_MEMORY;
3571 }
3572
3573 if (!parent_dirname(mem_ctx, fsp->fsp_name->base_name, &parent_name,
3574 NULL)) {
3575 return NT_STATUS_NO_MEMORY;
3576 }
3577
3578 status = create_synthetic_smb_fname(mem_ctx, parent_name, NULL, NULL,
3579 &smb_dname);
3580 if (!NT_STATUS_IS_OK(status)) {
3581 goto fail;
3582 }
3583
3584 status = SMB_VFS_CREATE_FILE(
3585 fsp->conn, /* conn */
3586 NULL, /* req */
3587 0, /* root_dir_fid */
3588 smb_dname, /* fname */
3589 FILE_READ_ATTRIBUTES, /* access_mask */
3590 FILE_SHARE_NONE, /* share_access */
3591 FILE_OPEN, /* create_disposition*/
3592 FILE_DIRECTORY_FILE, /* create_options */
3593 0, /* file_attributes */
3594 INTERNAL_OPEN_ONLY, /* oplock_request */
3595 0, /* allocation_size */
3596 NULL, /* sd */
3597 NULL, /* ea_list */
3598 &parent_fsp, /* result */
3599 &info); /* pinfo */
3600
3601 if (!NT_STATUS_IS_OK(status)) {
3602 TALLOC_FREE(smb_dname);
3603 return status;
3604 }
3605
3606 status = SMB_VFS_GET_NT_ACL(parent_fsp->conn, smb_dname->base_name,
3607 SECINFO_DACL, &parent_sd );
3608
3609 close_file(NULL, parent_fsp, NORMAL_CLOSE);
3610 TALLOC_FREE(smb_dname);
3611
3612 if (!NT_STATUS_IS_OK(status)) {
3613 return status;
3614 }
3615
3616 /*
3617 * Make room for potentially all the ACLs from
3618 * the parent. We used to add the ugw triple here,
3619 * as we knew we were dealing with POSIX ACLs.
3620 * We no longer need to do so as we can guarentee
3621 * that a default ACL from the parent directory will
3622 * be well formed for POSIX ACLs if it came from a
3623 * POSIX ACL source, and if we're not writing to a
3624 * POSIX ACL sink then we don't care if it's not well
3625 * formed. JRA.
3626 */
3627
3628 num_aces += parent_sd->dacl->num_aces;
3629
3630 if((new_ace = TALLOC_ZERO_ARRAY(mem_ctx, struct security_ace,
3631 num_aces)) == NULL) {
3632 return NT_STATUS_NO_MEMORY;
3633 }
3634
3635 /* Start by copying in all the given ACE entries. */
3636 for (i = 0; i < psd->dacl->num_aces; i++) {
3637 sec_ace_copy(&new_ace[i], &psd->dacl->aces[i]);
3638 }
3639
3640 /*
3641 * Note that we're ignoring "inherit permissions" here
3642 * as that really only applies to newly created files. JRA.
3643 */
3644
3645 /* Finally append any inherited ACEs. */
3646 for (j = 0; j < parent_sd->dacl->num_aces; j++) {
3647 struct security_ace *se = &parent_sd->dacl->aces[j];
3648
3649 if (fsp->is_directory) {
3650 if (!(se->flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
3651 /* Doesn't apply to a directory - ignore. */
3652 DEBUG(10,("append_parent_acl: directory %s "
3653 "ignoring non container "
3654 "inherit flags %u on ACE with sid %s "
3655 "from parent %s\n",
3656 fsp_str_dbg(fsp),
3657 (unsigned int)se->flags,
3658 sid_string_dbg(&se->trustee),
3659 parent_name));
3660 continue;
3661 }
3662 } else {
3663 if (!(se->flags & SEC_ACE_FLAG_OBJECT_INHERIT)) {
3664 /* Doesn't apply to a file - ignore. */
3665 DEBUG(10,("append_parent_acl: file %s "
3666 "ignoring non object "
3667 "inherit flags %u on ACE with sid %s "
3668 "from parent %s\n",
3669 fsp_str_dbg(fsp),
3670 (unsigned int)se->flags,
3671 sid_string_dbg(&se->trustee),
3672 parent_name));
3673 continue;
3674 }
3675 }
3676
3677 if (is_dacl_protected) {
3678 /* If the DACL is protected it means we must
3679 * not overwrite an existing ACE entry with the
3680 * same SID. This is order N^2. Ouch :-(. JRA. */
3681 unsigned int k;
3682 for (k = 0; k < psd->dacl->num_aces; k++) {
3683 if (dom_sid_equal(&psd->dacl->aces[k].trustee,
3684 &se->trustee)) {
3685 break;
3686 }
3687 }
3688 if (k < psd->dacl->num_aces) {
3689 /* SID matched. Ignore. */
3690 DEBUG(10,("append_parent_acl: path %s "
3691 "ignoring ACE with protected sid %s "
3692 "from parent %s\n",
3693 fsp_str_dbg(fsp),
3694 sid_string_dbg(&se->trustee),
3695 parent_name));
3696 continue;
3697 }
3698 }
3699
3700 sec_ace_copy(&new_ace[i], se);
3701 if (se->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
3702 new_ace[i].flags &= ~(SEC_ACE_FLAG_VALID_INHERIT);
3703 }
3704 new_ace[i].flags |= SEC_ACE_FLAG_INHERITED_ACE;
3705
3706 if (fsp->is_directory) {
3707 /*
3708 * Strip off any inherit only. It's applied.
3709 */
3710 new_ace[i].flags &= ~(SEC_ACE_FLAG_INHERIT_ONLY);
3711 if (se->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
3712 /* No further inheritance. */
3713 new_ace[i].flags &=
3714 ~(SEC_ACE_FLAG_CONTAINER_INHERIT|
3715 SEC_ACE_FLAG_OBJECT_INHERIT);
3716 }
3717 } else {
3718 /*
3719 * Strip off any container or inherit
3720 * flags, they can't apply to objects.
3721 */
3722 new_ace[i].flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|
3723 SEC_ACE_FLAG_INHERIT_ONLY|
3724 SEC_ACE_FLAG_NO_PROPAGATE_INHERIT);
3725 }
3726 i++;
3727
3728 DEBUG(10,("append_parent_acl: path %s "
3729 "inheriting ACE with sid %s "
3730 "from parent %s\n",
3731 fsp_str_dbg(fsp),
3732 sid_string_dbg(&se->trustee),
3733 parent_name));
3734 }
3735
3736 psd->dacl->aces = new_ace;
3737 psd->dacl->num_aces = i;
3738 psd->type &= ~(SEC_DESC_DACL_AUTO_INHERITED|
3739 SEC_DESC_DACL_AUTO_INHERIT_REQ);
3740
3741 *pp_new_sd = psd;
3742 return status;
3743 }
3744 #endif
3745
3746 /****************************************************************************
3747 Reply to set a security descriptor on an fsp. security_info_sent is the
3748 description of the following NT ACL.
3749 This should be the only external function needed for the UNIX style set ACL.
3750 We make a copy of psd_orig as internal functions modify the elements inside
3751 it, even though it's a const pointer.
3752 ****************************************************************************/
3753
3754 NTSTATUS set_nt_acl(files_struct *fsp, uint32 security_info_sent, const struct security_descriptor *psd_orig)
3755 {
3756 connection_struct *conn = fsp->conn;
3757 uid_t user = (uid_t)-1;
3758 gid_t grp = (gid_t)-1;
3759 struct dom_sid file_owner_sid;
3760 struct dom_sid file_grp_sid;
3761 canon_ace *file_ace_list = NULL;
3762 canon_ace *dir_ace_list = NULL;
3763 bool acl_perms = False;
3764 mode_t orig_mode = (mode_t)0;
3765 NTSTATUS status;
3766 bool set_acl_as_root = false;
3767 bool acl_set_support = false;
3768 bool ret = false;
3769 struct security_descriptor *psd = NULL;
3770
3771 DEBUG(10,("set_nt_acl: called for file %s\n",
3772 fsp_str_dbg(fsp)));
3773
3774 if (!CAN_WRITE(conn)) {
3775 DEBUG(10,("set acl rejected on read-only share\n"));
3776 return NT_STATUS_MEDIA_WRITE_PROTECTED;
3777 }
3778
3779 if (!psd_orig) {
3780 return NT_STATUS_INVALID_PARAMETER;
3781 }
3782
3783 psd = dup_sec_desc(talloc_tos(), psd_orig);
3784 if (!psd) {
3785 return NT_STATUS_NO_MEMORY;
3786 }
3787
3788 /*
3789 * Get the current state of the file.
3790 */
3791
3792 status = vfs_stat_fsp(fsp);
3793 if (!NT_STATUS_IS_OK(status)) {
3794 return status;
3795 }
3796
3797 /* Save the original element we check against. */
3798 orig_mode = fsp->fsp_name->st.st_ex_mode;
3799
3800 /*
3801 * Unpack the user/group/world id's.
3802 */
3803
3804 /* POSIX can't cope with missing owner/group. */
3805 if ((security_info_sent & SECINFO_OWNER) && (psd->owner_sid == NULL)) {
3806 security_info_sent &= ~SECINFO_OWNER;
3807 }
3808 if ((security_info_sent & SECINFO_GROUP) && (psd->group_sid == NULL)) {
3809 security_info_sent &= ~SECINFO_GROUP;
3810 }
3811
3812 status = unpack_nt_owners( conn, &user, &grp, security_info_sent, psd);
3813 if (!NT_STATUS_IS_OK(status)) {
3814 return status;
3815 }
3816
3817 /*
3818 * Do we need to chown ? If so this must be done first as the incoming
3819 * CREATOR_OWNER acl will be relative to the *new* owner, not the old.
3820 * Noticed by Simo.
3821 */
3822
3823 if (((user != (uid_t)-1) && (fsp->fsp_name->st.st_ex_uid != user)) ||
3824 (( grp != (gid_t)-1) && (fsp->fsp_name->st.st_ex_gid != grp))) {
3825
3826 DEBUG(3,("set_nt_acl: chown %s. uid = %u, gid = %u.\n",
3827 fsp_str_dbg(fsp), (unsigned int)user,
3828 (unsigned int)grp));
3829
3830 status = try_chown(fsp, user, grp);
3831 if(!NT_STATUS_IS_OK(status)) {
3832 DEBUG(3,("set_nt_acl: chown %s, %u, %u failed. Error "
3833 "= %s.\n", fsp_str_dbg(fsp),
3834 (unsigned int)user,
3835 (unsigned int)grp,
3836 nt_errstr(status)));
3837 return status;
3838 }
3839
3840 /*
3841 * Recheck the current state of the file, which may have changed.
3842 * (suid/sgid bits, for instance)
3843 */
3844
3845 status = vfs_stat_fsp(fsp);
3846 if (!NT_STATUS_IS_OK(status)) {
3847 return status;
3848 }
3849
3850 /* Save the original element we check against. */
3851 orig_mode = fsp->fsp_name->st.st_ex_mode;
3852
3853 /* If we successfully chowned, we know we must
3854 * be able to set the acl, so do it as root.
3855 */
3856 set_acl_as_root = true;
3857 }
3858
3859 create_file_sids(&fsp->fsp_name->st, &file_owner_sid, &file_grp_sid);
3860
3861 if((security_info_sent & SECINFO_DACL) &&
3862 (psd->type & SEC_DESC_DACL_PRESENT) &&
3863 (psd->dacl == NULL)) {
3864 struct security_ace ace[3];
3865
3866 /* We can't have NULL DACL in POSIX.
3867 Use owner/group/Everyone -> full access. */
3868
3869 init_sec_ace(&ace[0],
3870 &file_owner_sid,
3871 SEC_ACE_TYPE_ACCESS_ALLOWED,
3872 GENERIC_ALL_ACCESS,
3873 0);
3874 init_sec_ace(&ace[1],
3875 &file_grp_sid,
3876 SEC_ACE_TYPE_ACCESS_ALLOWED,
3877 GENERIC_ALL_ACCESS,
3878 0);
3879 init_sec_ace(&ace[2],
3880 &global_sid_World,
3881 SEC_ACE_TYPE_ACCESS_ALLOWED,
3882 GENERIC_ALL_ACCESS,
3883 0);
3884 psd->dacl = make_sec_acl(talloc_tos(),
3885 NT4_ACL_REVISION,
3886 3,
3887 ace);
3888 if (psd->dacl == NULL) {
3889 return NT_STATUS_NO_MEMORY;
3890 }
3891 security_acl_map_generic(psd->dacl, &file_generic_mapping);
3892 }
3893
3894 acl_perms = unpack_canon_ace(fsp, &fsp->fsp_name->st, &file_owner_sid,
3895 &file_grp_sid, &file_ace_list,
3896 &dir_ace_list, security_info_sent, psd);
3897
3898 /* Ignore W2K traverse DACL set. */
3899 if (!file_ace_list && !dir_ace_list) {
3900 return NT_STATUS_OK;
3901 }
3902
3903 if (!acl_perms) {
3904 DEBUG(3,("set_nt_acl: cannot set permissions\n"));
3905 free_canon_ace_list(file_ace_list);
3906 free_canon_ace_list(dir_ace_list);
3907 return NT_STATUS_ACCESS_DENIED;
3908 }
3909
3910 /*
3911 * Only change security if we got a DACL.
3912 */
3913
3914 if(!(security_info_sent & SECINFO_DACL) || (psd->dacl == NULL)) {
3915 free_canon_ace_list(file_ace_list);
3916 free_canon_ace_list(dir_ace_list);
3917 return NT_STATUS_OK;
3918 }
3919
3920 /*
3921 * Try using the POSIX ACL set first. Fall back to chmod if
3922 * we have no ACL support on this filesystem.
3923 */
3924
3925 if (acl_perms && file_ace_list) {
3926 if (set_acl_as_root) {
3927 become_root();
3928 }
3929 ret = set_canon_ace_list(fsp, file_ace_list, false,
3930 &fsp->fsp_name->st, &acl_set_support);
3931 if (set_acl_as_root) {
3932 unbecome_root();
3933 }
3934 if (acl_set_support && ret == false) {
3935 DEBUG(3,("set_nt_acl: failed to set file acl on file "
3936 "%s (%s).\n", fsp_str_dbg(fsp),
3937 strerror(errno)));
3938 free_canon_ace_list(file_ace_list);
3939 free_canon_ace_list(dir_ace_list);
3940 return map_nt_error_from_unix(errno);
3941 }
3942 }
3943
3944 if (acl_perms && acl_set_support && fsp->is_directory) {
3945 if (dir_ace_list) {
3946 if (set_acl_as_root) {
3947 become_root();
3948 }
3949 ret = set_canon_ace_list(fsp, dir_ace_list, true,
3950 &fsp->fsp_name->st,
3951 &acl_set_support);
3952 if (set_acl_as_root) {
3953 unbecome_root();
3954 }
3955 if (ret == false) {
3956 DEBUG(3,("set_nt_acl: failed to set default "
3957 "acl on directory %s (%s).\n",
3958 fsp_str_dbg(fsp), strerror(errno)));
3959 free_canon_ace_list(file_ace_list);
3960 free_canon_ace_list(dir_ace_list);
3961 return map_nt_error_from_unix(errno);
3962 }
3963 } else {
3964 int sret = -1;
3965
3966 /*
3967 * No default ACL - delete one if it exists.
3968 */
3969
3970 if (set_acl_as_root) {
3971 become_root();
3972 }
3973 sret = SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn,
3974 fsp->fsp_name->base_name);
3975 if (set_acl_as_root) {
3976 unbecome_root();
3977 }
3978 if (sret == -1) {
3979 if (acl_group_override(conn, fsp->fsp_name)) {
3980 DEBUG(5,("set_nt_acl: acl group "
3981 "control on and current user "
3982 "in file %s primary group. "
3983 "Override delete_def_acl\n",
3984 fsp_str_dbg(fsp)));
3985
3986 become_root();
3987 sret =
3988 SMB_VFS_SYS_ACL_DELETE_DEF_FILE(
3989 conn,
3990 fsp->fsp_name->base_name);
3991 unbecome_root();
3992 }
3993
3994 if (sret == -1) {
3995 DEBUG(3,("set_nt_acl: sys_acl_delete_def_file failed (%s)\n", strerror(errno)));
3996 free_canon_ace_list(file_ace_list);
3997 free_canon_ace_list(dir_ace_list);
3998 return map_nt_error_from_unix(errno);
3999 }
4000 }
4001 }
4002 }
4003
4004 if (acl_set_support) {
4005 if (set_acl_as_root) {
4006 become_root();
4007 }
4008 store_inheritance_attributes(fsp,
4009 file_ace_list,
4010 dir_ace_list,
4011 psd->type);
4012 if (set_acl_as_root) {
4013 unbecome_root();
4014 }
4015 }
4016
4017 /*
4018 * If we cannot set using POSIX ACLs we fall back to checking if we need to chmod.
4019 */
4020
4021 if(!acl_set_support && acl_perms) {
4022 mode_t posix_perms;
4023
4024 if (!convert_canon_ace_to_posix_perms( fsp, file_ace_list, &posix_perms)) {
4025 free_canon_ace_list(file_ace_list);
4026 free_canon_ace_list(dir_ace_list);
4027 DEBUG(3,("set_nt_acl: failed to convert file acl to "
4028 "posix permissions for file %s.\n",
4029 fsp_str_dbg(fsp)));
4030 return NT_STATUS_ACCESS_DENIED;
4031 }
4032
4033 if (orig_mode != posix_perms) {
4034 int sret = -1;
4035
4036 DEBUG(3,("set_nt_acl: chmod %s. perms = 0%o.\n",
4037 fsp_str_dbg(fsp), (unsigned int)posix_perms));
4038
4039 if (set_acl_as_root) {
4040 become_root();
4041 }
4042 sret = SMB_VFS_CHMOD(conn, fsp->fsp_name->base_name,
4043 posix_perms);
4044 if (set_acl_as_root) {
4045 unbecome_root();
4046 }
4047 if(sret == -1) {
4048 if (acl_group_override(conn, fsp->fsp_name)) {
4049 DEBUG(5,("set_nt_acl: acl group "
4050 "control on and current user "
4051 "in file %s primary group. "
4052 "Override chmod\n",
4053 fsp_str_dbg(fsp)));
4054
4055 become_root();
4056 sret = SMB_VFS_CHMOD(conn,
4057 fsp->fsp_name->base_name,
4058 posix_perms);
4059 unbecome_root();
4060 }
4061
4062 if (sret == -1) {
4063 DEBUG(3,("set_nt_acl: chmod %s, 0%o "
4064 "failed. Error = %s.\n",
4065 fsp_str_dbg(fsp),
4066 (unsigned int)posix_perms,
4067 strerror(errno)));
4068 free_canon_ace_list(file_ace_list);
4069 free_canon_ace_list(dir_ace_list);
4070 return map_nt_error_from_unix(errno);
4071 }
4072 }
4073 }
4074 }
4075
4076 free_canon_ace_list(file_ace_list);
4077 free_canon_ace_list(dir_ace_list);
4078
4079 /* Ensure the stat struct in the fsp is correct. */
4080 status = vfs_stat_fsp(fsp);
4081
4082 return NT_STATUS_OK;
4083 }
4084
4085 /****************************************************************************
4086 Get the actual group bits stored on a file with an ACL. Has no effect if
4087 the file has no ACL. Needed in dosmode code where the stat() will return
4088 the mask bits, not the real group bits, for a file with an ACL.
4089 ****************************************************************************/
4090
4091 int get_acl_group_bits( connection_struct *conn, const char *fname, mode_t *mode )
4092 {
4093 int entry_id = SMB_ACL_FIRST_ENTRY;
4094 SMB_ACL_ENTRY_T entry;
4095 SMB_ACL_T posix_acl;
4096 int result = -1;
4097
4098 posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS);
4099 if (posix_acl == (SMB_ACL_T)NULL)
4100 return -1;
4101
4102 while (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) {
4103 SMB_ACL_TAG_T tagtype;
4104 SMB_ACL_PERMSET_T permset;
4105
4106 entry_id = SMB_ACL_NEXT_ENTRY;
4107
4108 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) ==-1)
4109 break;
4110
4111 if (tagtype == SMB_ACL_GROUP_OBJ) {
4112 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1) {
4113 break;
4114 } else {
4115 *mode &= ~(S_IRGRP|S_IWGRP|S_IXGRP);
4116 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ) ? S_IRGRP : 0);
4117 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE) ? S_IWGRP : 0);
4118 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_EXECUTE) ? S_IXGRP : 0);
4119 result = 0;
4120 break;
4121 }
4122 }
4123 }
4124 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
4125 return result;
4126 }
4127
4128 /****************************************************************************
4129 Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4130 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4131 ****************************************************************************/
4132
4133 static int chmod_acl_internals( connection_struct *conn, SMB_ACL_T posix_acl, mode_t mode)
4134 {
4135 int entry_id = SMB_ACL_FIRST_ENTRY;
4136 SMB_ACL_ENTRY_T entry;
4137 int num_entries = 0;
4138
4139 while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) {
4140 SMB_ACL_TAG_T tagtype;
4141 SMB_ACL_PERMSET_T permset;
4142 mode_t perms;
4143
4144 entry_id = SMB_ACL_NEXT_ENTRY;
4145
4146 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1)
4147 return -1;
4148
4149 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1)
4150 return -1;
4151
4152 num_entries++;
4153
4154 switch(tagtype) {
4155 case SMB_ACL_USER_OBJ:
4156 perms = unix_perms_to_acl_perms(mode, S_IRUSR, S_IWUSR, S_IXUSR);
4157 break;
4158 case SMB_ACL_GROUP_OBJ:
4159 perms = unix_perms_to_acl_perms(mode, S_IRGRP, S_IWGRP, S_IXGRP);
4160 break;
4161 case SMB_ACL_MASK:
4162 /*
4163 * FIXME: The ACL_MASK entry permissions should really be set to
4164 * the union of the permissions of all ACL_USER,
4165 * ACL_GROUP_OBJ, and ACL_GROUP entries. That's what
4166 * acl_calc_mask() does, but Samba ACLs doesn't provide it.
4167 */
4168 perms = S_IRUSR|S_IWUSR|S_IXUSR;
4169 break;
4170 case SMB_ACL_OTHER:
4171 perms = unix_perms_to_acl_perms(mode, S_IROTH, S_IWOTH, S_IXOTH);
4172 break;
4173 default:
4174 continue;
4175 }
4176
4177 if (map_acl_perms_to_permset(conn, perms, &permset) == -1)
4178 return -1;
4179
4180 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, entry, permset) == -1)
4181 return -1;
4182 }
4183
4184 /*
4185 * If this is a simple 3 element ACL or no elements then it's a standard
4186 * UNIX permission set. Just use chmod...
4187 */
4188
4189 if ((num_entries == 3) || (num_entries == 0))
4190 return -1;
4191
4192 return 0;
4193 }
4194
4195 /****************************************************************************
4196 Get the access ACL of FROM, do a chmod by setting the ACL USER_OBJ,
4197 GROUP_OBJ and OTHER bits in an ACL and set the mask to rwx. Set the
4198 resulting ACL on TO. Note that name is in UNIX character set.
4199 ****************************************************************************/
4200
4201 static int copy_access_posix_acl(connection_struct *conn, const char *from, const char *to, mode_t mode)
4202 {
4203 SMB_ACL_T posix_acl = NULL;
4204 int ret = -1;
4205
4206 if ((posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, from, SMB_ACL_TYPE_ACCESS)) == NULL)
4207 return -1;
4208
4209 if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
4210 goto done;
4211
4212 ret = SMB_VFS_SYS_ACL_SET_FILE(conn, to, SMB_ACL_TYPE_ACCESS, posix_acl);
4213
4214 done:
4215
4216 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
4217 return ret;
4218 }
4219
4220 /****************************************************************************
4221 Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4222 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4223 Note that name is in UNIX character set.
4224 ****************************************************************************/
4225
4226 int chmod_acl(connection_struct *conn, const char *name, mode_t mode)
4227 {
4228 return copy_access_posix_acl(conn, name, name, mode);
4229 }
4230
4231 /****************************************************************************
4232 Check for an existing default POSIX ACL on a directory.
4233 ****************************************************************************/
4234
4235 static bool directory_has_default_posix_acl(connection_struct *conn, const char *fname)
4236 {
4237 SMB_ACL_T def_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_DEFAULT);
4238 bool has_acl = False;
4239 SMB_ACL_ENTRY_T entry;
4240
4241 if (def_acl != NULL && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, def_acl, SMB_ACL_FIRST_ENTRY, &entry) == 1)) {
4242 has_acl = True;
4243 }
4244
4245 if (def_acl) {
4246 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4247 }
4248 return has_acl;
4249 }
4250
4251 /****************************************************************************
4252 If the parent directory has no default ACL but it does have an Access ACL,
4253 inherit this Access ACL to file name.
4254 ****************************************************************************/
4255
4256 int inherit_access_posix_acl(connection_struct *conn, const char *inherit_from_dir,
4257 const char *name, mode_t mode)
4258 {
4259 if (directory_has_default_posix_acl(conn, inherit_from_dir))
4260 return 0;
4261
4262 return copy_access_posix_acl(conn, inherit_from_dir, name, mode);
4263 }
4264
4265 /****************************************************************************
4266 Do an fchmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4267 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4268 ****************************************************************************/
4269
4270 int fchmod_acl(files_struct *fsp, mode_t mode)
4271 {
4272 connection_struct *conn = fsp->conn;
4273 SMB_ACL_T posix_acl = NULL;
4274 int ret = -1;
4275
4276 if ((posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp)) == NULL)
4277 return -1;
4278
4279 if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
4280 goto done;
4281
4282 ret = SMB_VFS_SYS_ACL_SET_FD(fsp, posix_acl);
4283
4284 done:
4285
4286 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
4287 return ret;
4288 }
4289
4290 /****************************************************************************
4291 Map from wire type to permset.
4292 ****************************************************************************/
4293
4294 static bool unix_ex_wire_to_permset(connection_struct *conn, unsigned char wire_perm, SMB_ACL_PERMSET_T *p_permset)
4295 {
4296 if (wire_perm & ~(SMB_POSIX_ACL_READ|SMB_POSIX_ACL_WRITE|SMB_POSIX_ACL_EXECUTE)) {
4297 return False;
4298 }
4299
4300 if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn, *p_permset) == -1) {
4301 return False;
4302 }
4303
4304 if (wire_perm & SMB_POSIX_ACL_READ) {
4305 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_READ) == -1) {
4306 return False;
4307 }
4308 }
4309 if (wire_perm & SMB_POSIX_ACL_WRITE) {
4310 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_WRITE) == -1) {
4311 return False;
4312 }
4313 }
4314 if (wire_perm & SMB_POSIX_ACL_EXECUTE) {
4315 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_EXECUTE) == -1) {
4316 return False;
4317 }
4318 }
4319 return True;
4320 }
4321
4322 /****************************************************************************
4323 Map from wire type to tagtype.
4324 ****************************************************************************/
4325
4326 static bool unix_ex_wire_to_tagtype(unsigned char wire_tt, SMB_ACL_TAG_T *p_tt)
4327 {
4328 switch (wire_tt) {
4329 case SMB_POSIX_ACL_USER_OBJ:
4330 *p_tt = SMB_ACL_USER_OBJ;
4331 break;
4332 case SMB_POSIX_ACL_USER:
4333 *p_tt = SMB_ACL_USER;
4334 break;
4335 case SMB_POSIX_ACL_GROUP_OBJ:
4336 *p_tt = SMB_ACL_GROUP_OBJ;
4337 break;
4338 case SMB_POSIX_ACL_GROUP:
4339 *p_tt = SMB_ACL_GROUP;
4340 break;
4341 case SMB_POSIX_ACL_MASK:
4342 *p_tt = SMB_ACL_MASK;
4343 break;
4344 case SMB_POSIX_ACL_OTHER:
4345 *p_tt = SMB_ACL_OTHER;
4346 break;
4347 default:
4348 return False;
4349 }
4350 return True;
4351 }
4352
4353 /****************************************************************************
4354 Create a new POSIX acl from wire permissions.
4355 FIXME ! How does the share mask/mode fit into this.... ?
4356 ****************************************************************************/
4357
4358 static SMB_ACL_T create_posix_acl_from_wire(connection_struct *conn, uint16 num_acls, const char *pdata)
4359 {
4360 unsigned int i;
4361 SMB_ACL_T the_acl = SMB_VFS_SYS_ACL_INIT(conn, num_acls);
4362
4363 if (the_acl == NULL) {
4364 return NULL;
4365 }
4366
4367 for (i = 0; i < num_acls; i++) {
4368 SMB_ACL_ENTRY_T the_entry;
4369 SMB_ACL_PERMSET_T the_permset;
4370 SMB_ACL_TAG_T tag_type;
4371
4372 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &the_entry) == -1) {
4373 DEBUG(0,("create_posix_acl_from_wire: Failed to create entry %u. (%s)\n",
4374 i, strerror(errno) ));
4375 goto fail;
4376 }
4377
4378 if (!unix_ex_wire_to_tagtype(CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)), &tag_type)) {
4379 DEBUG(0,("create_posix_acl_from_wire: invalid wire tagtype %u on entry %u.\n",
4380 CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)), i ));
4381 goto fail;
4382 }
4383
4384 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, the_entry, tag_type) == -1) {
4385 DEBUG(0,("create_posix_acl_from_wire: Failed to set tagtype on entry %u. (%s)\n",
4386 i, strerror(errno) ));
4387 goto fail;
4388 }
4389
4390 /* Get the permset pointer from the new ACL entry. */
4391 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, the_entry, &the_permset) == -1) {
4392 DEBUG(0,("create_posix_acl_from_wire: Failed to get permset on entry %u. (%s)\n",
4393 i, strerror(errno) ));
4394 goto fail;
4395 }
4396
4397 /* Map from wire to permissions. */
4398 if (!unix_ex_wire_to_permset(conn, CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+1), &the_permset)) {
4399 DEBUG(0,("create_posix_acl_from_wire: invalid permset %u on entry %u.\n",
4400 CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE) + 1), i ));
4401 goto fail;
4402 }
4403
4404 /* Now apply to the new ACL entry. */
4405 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, the_entry, the_permset) == -1) {
4406 DEBUG(0,("create_posix_acl_from_wire: Failed to add permset on entry %u. (%s)\n",
4407 i, strerror(errno) ));
4408 goto fail;
4409 }
4410
4411 if (tag_type == SMB_ACL_USER) {
4412 uint32 uidval = IVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+2);
4413 uid_t uid = (uid_t)uidval;
4414 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&uid) == -1) {
4415 DEBUG(0,("create_posix_acl_from_wire: Failed to set uid %u on entry %u. (%s)\n",
4416 (unsigned int)uid, i, strerror(errno) ));
4417 goto fail;
4418 }
4419 }
4420
4421 if (tag_type == SMB_ACL_GROUP) {
4422 uint32 gidval = IVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+2);
4423 gid_t gid = (uid_t)gidval;
4424 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&gid) == -1) {
4425 DEBUG(0,("create_posix_acl_from_wire: Failed to set gid %u on entry %u. (%s)\n",
4426 (unsigned int)gid, i, strerror(errno) ));
4427 goto fail;
4428 }
4429 }
4430 }
4431
4432 return the_acl;
4433
4434 fail:
4435
4436 if (the_acl != NULL) {
4437 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
4438 }
4439 return NULL;
4440 }
4441
4442 /****************************************************************************
4443 Calls from UNIX extensions - Default POSIX ACL set.
4444 If num_def_acls == 0 and not a directory just return. If it is a directory
4445 and num_def_acls == 0 then remove the default acl. Else set the default acl
4446 on the directory.
4447 ****************************************************************************/
4448
4449 bool set_unix_posix_default_acl(connection_struct *conn, const char *fname, const SMB_STRUCT_STAT *psbuf,
4450 uint16 num_def_acls, const char *pdata)
4451 {
4452 SMB_ACL_T def_acl = NULL;
4453
4454 if (!S_ISDIR(psbuf->st_ex_mode)) {
4455 if (num_def_acls) {
4456 DEBUG(5,("set_unix_posix_default_acl: Can't set default ACL on non-directory file %s\n", fname ));
4457 errno = EISDIR;
4458 return False;
4459 } else {
4460 return True;
4461 }
4462 }
4463
4464 if (!num_def_acls) {
4465 /* Remove the default ACL. */
4466 if (SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn, fname) == -1) {
4467 DEBUG(5,("set_unix_posix_default_acl: acl_delete_def_file failed on directory %s (%s)\n",
4468 fname, strerror(errno) ));
4469 return False;
4470 }
4471 return True;
4472 }
4473
4474 if ((def_acl = create_posix_acl_from_wire(conn, num_def_acls, pdata)) == NULL) {
4475 return False;
4476 }
4477
4478 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_DEFAULT, def_acl) == -1) {
4479 DEBUG(5,("set_unix_posix_default_acl: acl_set_file failed on directory %s (%s)\n",
4480 fname, strerror(errno) ));
4481 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4482 return False;
4483 }
4484
4485 DEBUG(10,("set_unix_posix_default_acl: set default acl for file %s\n", fname ));
4486 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4487 return True;
4488 }
4489
4490 /****************************************************************************
4491 Remove an ACL from a file. As we don't have acl_delete_entry() available
4492 we must read the current acl and copy all entries except MASK, USER and GROUP
4493 to a new acl, then set that. This (at least on Linux) causes any ACL to be
4494 removed.
4495 FIXME ! How does the share mask/mode fit into this.... ?
4496 ****************************************************************************/
4497
4498 static bool remove_posix_acl(connection_struct *conn, files_struct *fsp, const char *fname)
4499 {
4500 SMB_ACL_T file_acl = NULL;
4501 int entry_id = SMB_ACL_FIRST_ENTRY;
4502 SMB_ACL_ENTRY_T entry;
4503 bool ret = False;
4504 /* Create a new ACL with only 3 entries, u/g/w. */
4505 SMB_ACL_T new_file_acl = SMB_VFS_SYS_ACL_INIT(conn, 3);
4506 SMB_ACL_ENTRY_T user_ent = NULL;
4507 SMB_ACL_ENTRY_T group_ent = NULL;
4508 SMB_ACL_ENTRY_T other_ent = NULL;
4509
4510 if (new_file_acl == NULL) {
4511 DEBUG(5,("remove_posix_acl: failed to init new ACL with 3 entries for file %s.\n", fname));
4512 return False;
4513 }
4514
4515 /* Now create the u/g/w entries. */
4516 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &user_ent) == -1) {
4517 DEBUG(5,("remove_posix_acl: Failed to create user entry for file %s. (%s)\n",
4518 fname, strerror(errno) ));
4519 goto done;
4520 }
4521 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, user_ent, SMB_ACL_USER_OBJ) == -1) {
4522 DEBUG(5,("remove_posix_acl: Failed to set user entry for file %s. (%s)\n",
4523 fname, strerror(errno) ));
4524 goto done;
4525 }
4526
4527 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &group_ent) == -1) {
4528 DEBUG(5,("remove_posix_acl: Failed to create group entry for file %s. (%s)\n",
4529 fname, strerror(errno) ));
4530 goto done;
4531 }
4532 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, group_ent, SMB_ACL_GROUP_OBJ) == -1) {
4533 DEBUG(5,("remove_posix_acl: Failed to set group entry for file %s. (%s)\n",
4534 fname, strerror(errno) ));
4535 goto done;
4536 }
4537
4538 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &other_ent) == -1) {
4539 DEBUG(5,("remove_posix_acl: Failed to create other entry for file %s. (%s)\n",
4540 fname, strerror(errno) ));
4541 goto done;
4542 }
4543 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, other_ent, SMB_ACL_OTHER) == -1) {
4544 DEBUG(5,("remove_posix_acl: Failed to set other entry for file %s. (%s)\n",
4545 fname, strerror(errno) ));
4546 goto done;
4547 }
4548
4549 /* Get the current file ACL. */
4550 if (fsp && fsp->fh->fd != -1) {
4551 file_acl = SMB_VFS_SYS_ACL_GET_FD(fsp);
4552 } else {
4553 file_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_ACCESS);
4554 }
4555
4556 if (file_acl == NULL) {
4557 /* This is only returned if an error occurred. Even for a file with
4558 no acl a u/g/w acl should be returned. */
4559 DEBUG(5,("remove_posix_acl: failed to get ACL from file %s (%s).\n",
4560 fname, strerror(errno) ));
4561 goto done;
4562 }
4563
4564 while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, file_acl, entry_id, &entry) == 1) {
4565 SMB_ACL_TAG_T tagtype;
4566 SMB_ACL_PERMSET_T permset;
4567
4568 entry_id = SMB_ACL_NEXT_ENTRY;
4569
4570 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1) {
4571 DEBUG(5,("remove_posix_acl: failed to get tagtype from ACL on file %s (%s).\n",
4572 fname, strerror(errno) ));
4573 goto done;
4574 }
4575
4576 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1) {
4577 DEBUG(5,("remove_posix_acl: failed to get permset from ACL on file %s (%s).\n",
4578 fname, strerror(errno) ));
4579 goto done;
4580 }
4581
4582 if (tagtype == SMB_ACL_USER_OBJ) {
4583 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, user_ent, permset) == -1) {
4584 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4585 fname, strerror(errno) ));
4586 }
4587 } else if (tagtype == SMB_ACL_GROUP_OBJ) {
4588 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, group_ent, permset) == -1) {
4589 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4590 fname, strerror(errno) ));
4591 }
4592 } else if (tagtype == SMB_ACL_OTHER) {
4593 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, other_ent, permset) == -1) {
4594 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4595 fname, strerror(errno) ));
4596 }
4597 }
4598 }
4599
4600 /* Set the new empty file ACL. */
4601 if (fsp && fsp->fh->fd != -1) {
4602 if (SMB_VFS_SYS_ACL_SET_FD(fsp, new_file_acl) == -1) {
4603 DEBUG(5,("remove_posix_acl: acl_set_file failed on %s (%s)\n",
4604 fname, strerror(errno) ));
4605 goto done;
4606 }
4607 } else {
4608 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS, new_file_acl) == -1) {
4609 DEBUG(5,("remove_posix_acl: acl_set_file failed on %s (%s)\n",
4610 fname, strerror(errno) ));
4611 goto done;
4612 }
4613 }
4614
4615 ret = True;
4616
4617 done:
4618
4619 if (file_acl) {
4620 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4621 }
4622 if (new_file_acl) {
4623 SMB_VFS_SYS_ACL_FREE_ACL(conn, new_file_acl);
4624 }
4625 return ret;
4626 }
4627
4628 /****************************************************************************
4629 Calls from UNIX extensions - POSIX ACL set.
4630 If num_def_acls == 0 then read/modify/write acl after removing all entries
4631 except SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER.
4632 ****************************************************************************/
4633
4634 bool set_unix_posix_acl(connection_struct *conn, files_struct *fsp, const char *fname, uint16 num_acls, const char *pdata)
4635 {
4636 SMB_ACL_T file_acl = NULL;
4637
4638 if (!num_acls) {
4639 /* Remove the ACL from the file. */
4640 return remove_posix_acl(conn, fsp, fname);
4641 }
4642
4643 if ((file_acl = create_posix_acl_from_wire(conn, num_acls, pdata)) == NULL) {
4644 return False;
4645 }
4646
4647 if (fsp && fsp->fh->fd != -1) {
4648 /* The preferred way - use an open fd. */
4649 if (SMB_VFS_SYS_ACL_SET_FD(fsp, file_acl) == -1) {
4650 DEBUG(5,("set_unix_posix_acl: acl_set_file failed on %s (%s)\n",
4651 fname, strerror(errno) ));
4652 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4653 return False;
4654 }
4655 } else {
4656 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS, file_acl) == -1) {
4657 DEBUG(5,("set_unix_posix_acl: acl_set_file failed on %s (%s)\n",
4658 fname, strerror(errno) ));
4659 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4660 return False;
4661 }
4662 }
4663
4664 DEBUG(10,("set_unix_posix_acl: set acl for file %s\n", fname ));
4665 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4666 return True;
4667 }
4668
4669 /********************************************************************
4670 Pull the NT ACL from a file on disk or the OpenEventlog() access
4671 check. Caller is responsible for freeing the returned security
4672 descriptor via TALLOC_FREE(). This is designed for dealing with
4673 user space access checks in smbd outside of the VFS. For example,
4674 checking access rights in OpenEventlog().
4675
4676 Assume we are dealing with files (for now)
4677 ********************************************************************/
4678
4679 struct security_descriptor *get_nt_acl_no_snum( TALLOC_CTX *ctx, const char *fname)
4680 {
4681 struct security_descriptor *psd, *ret_sd;
4682 connection_struct *conn;
4683 files_struct finfo;
4684 struct fd_handle fh;
4685 NTSTATUS status;
4686
4687 conn = TALLOC_ZERO_P(ctx, connection_struct);
4688 if (conn == NULL) {
4689 DEBUG(0, ("talloc failed\n"));
4690 return NULL;
4691 }
4692
4693 if (!(conn->params = TALLOC_P(conn, struct share_params))) {
4694 DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
4695 TALLOC_FREE(conn);
4696 return NULL;
4697 }
4698
4699 conn->params->service = -1;
4700
4701 set_conn_connectpath(conn, "/");
4702
4703 if (!smbd_vfs_init(conn)) {
4704 DEBUG(0,("get_nt_acl_no_snum: Unable to create a fake connection struct!\n"));
4705 conn_free(conn);
4706 return NULL;
4707 }
4708
4709 ZERO_STRUCT( finfo );
4710 ZERO_STRUCT( fh );
4711
4712 finfo.fnum = -1;
4713 finfo.conn = conn;
4714 finfo.fh = &fh;
4715 finfo.fh->fd = -1;
4716
4717 status = create_synthetic_smb_fname(talloc_tos(), fname, NULL, NULL,
4718 &finfo.fsp_name);
4719 if (!NT_STATUS_IS_OK(status)) {
4720 conn_free(conn);
4721 return NULL;
4722 }
4723
4724 if (!NT_STATUS_IS_OK(SMB_VFS_FGET_NT_ACL( &finfo, SECINFO_DACL, &psd))) {
4725 DEBUG(0,("get_nt_acl_no_snum: get_nt_acl returned zero.\n"));
4726 TALLOC_FREE(finfo.fsp_name);
4727 conn_free(conn);
4728 return NULL;
4729 }
4730
4731 ret_sd = dup_sec_desc( ctx, psd );
4732
4733 TALLOC_FREE(finfo.fsp_name);
4734 conn_free(conn);
4735
4736 return ret_sd;
4737 }
4738
4739 /* Stolen shamelessly from pvfs_default_acl() in source4 :-). */
4740
4741 NTSTATUS make_default_filesystem_acl(TALLOC_CTX *ctx,
4742 const char *name,
4743 SMB_STRUCT_STAT *psbuf,
4744 struct security_descriptor **ppdesc)
4745 {
4746 struct dom_sid owner_sid, group_sid;
4747 size_t size = 0;
4748 struct security_ace aces[4];
4749 uint32_t access_mask = 0;
4750 mode_t mode = psbuf->st_ex_mode;
4751 struct security_acl *new_dacl = NULL;
4752 int idx = 0;
4753
4754 DEBUG(10,("make_default_filesystem_acl: file %s mode = 0%o\n",
4755 name, (int)mode ));
4756
4757 uid_to_sid(&owner_sid, psbuf->st_ex_uid);
4758 gid_to_sid(&group_sid, psbuf->st_ex_gid);
4759
4760 /*
4761 We provide up to 4 ACEs
4762 - Owner
4763 - Group
4764 - Everyone
4765 - NT System
4766 */
4767
4768 if (mode & S_IRUSR) {
4769 if (mode & S_IWUSR) {
4770 access_mask |= SEC_RIGHTS_FILE_ALL;
4771 } else {
4772 access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
4773 }
4774 }
4775 if (mode & S_IWUSR) {
4776 access_mask |= SEC_RIGHTS_FILE_WRITE | SEC_STD_DELETE;
4777 }
4778
4779 init_sec_ace(&aces[idx],
4780 &owner_sid,
4781 SEC_ACE_TYPE_ACCESS_ALLOWED,
4782 access_mask,
4783 0);
4784 idx++;
4785
4786 access_mask = 0;
4787 if (mode & S_IRGRP) {
4788 access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
4789 }
4790 if (mode & S_IWGRP) {
4791 /* note that delete is not granted - this matches posix behaviour */
4792 access_mask |= SEC_RIGHTS_FILE_WRITE;
4793 }
4794 if (access_mask) {
4795 init_sec_ace(&aces[idx],
4796 &group_sid,
4797 SEC_ACE_TYPE_ACCESS_ALLOWED,
4798 access_mask,
4799 0);
4800 idx++;
4801 }
4802
4803 access_mask = 0;
4804 if (mode & S_IROTH) {
4805 access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
4806 }
4807 if (mode & S_IWOTH) {
4808 access_mask |= SEC_RIGHTS_FILE_WRITE;
4809 }
4810 if (access_mask) {
4811 init_sec_ace(&aces[idx],
4812 &global_sid_World,
4813 SEC_ACE_TYPE_ACCESS_ALLOWED,
4814 access_mask,
4815 0);
4816 idx++;
4817 }
4818
4819 init_sec_ace(&aces[idx],
4820 &global_sid_System,
4821 SEC_ACE_TYPE_ACCESS_ALLOWED,
4822 SEC_RIGHTS_FILE_ALL,
4823 0);
4824 idx++;
4825
4826 new_dacl = make_sec_acl(ctx,
4827 NT4_ACL_REVISION,
4828 idx,
4829 aces);
4830
4831 if (!new_dacl) {
4832 return NT_STATUS_NO_MEMORY;
4833 }
4834
4835 *ppdesc = make_sec_desc(ctx,
4836 SECURITY_DESCRIPTOR_REVISION_1,
4837 SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT,
4838 &owner_sid,
4839 &group_sid,
4840 NULL,
4841 new_dacl,
4842 &size);
4843 if (!*ppdesc) {
4844 return NT_STATUS_NO_MEMORY;
4845 }
4846 return NT_STATUS_OK;
4847 }
Samba GIT mirror