source3/modules/vfs_solarisacl.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    VFS module to get and set Solaris ACLs
   4    Copyright (C) Michael Adam 2006,2008
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20
  21 #include "includes.h"
  22 #include "system/filesys.h"
  23 #include "smbd/smbd.h"
  24 #include "modules/vfs_solarisacl.h"
  25
  26 /* typedef struct acl SOLARIS_ACE_T; */
  27 typedef aclent_t SOLARIS_ACE_T;
  28 typedef aclent_t *SOLARIS_ACL_T;
  29 typedef int SOLARIS_ACL_TAG_T;   /* the type of an ACL entry */
  30 typedef o_mode_t SOLARIS_PERM_T;
  31
  32 /* for convenience: check if solaris acl entry is a default entry?  */
  33 #define _IS_DEFAULT(ace) ((ace).a_type & ACL_DEFAULT)
  34 #define _IS_OF_TYPE(ace, type) ( \
  35         (((type) == SMB_ACL_TYPE_ACCESS) && !_IS_DEFAULT(ace)) \
  36         || \
  37         (((type) == SMB_ACL_TYPE_DEFAULT) && _IS_DEFAULT(ace)) \
  38 )
  39
  40
  41 /* prototypes for private functions */
  42
  43 static SOLARIS_ACL_T solaris_acl_init(int count);
  44 static bool smb_acl_to_solaris_acl(SMB_ACL_T smb_acl,
  45                 SOLARIS_ACL_T *solariacl, int *count,
  46                 SMB_ACL_TYPE_T type);
  47 static SMB_ACL_T solaris_acl_to_smb_acl(SOLARIS_ACL_T solarisacl, int count,
  48                                         SMB_ACL_TYPE_T type, TALLOC_CTX *mem_ctx);
  49 static SOLARIS_ACL_TAG_T smb_tag_to_solaris_tag(SMB_ACL_TAG_T smb_tag);
  50 static SMB_ACL_TAG_T solaris_tag_to_smb_tag(SOLARIS_ACL_TAG_T solaris_tag);
  51 static bool solaris_add_to_acl(SOLARIS_ACL_T *solaris_acl, int *count,
  52                 SOLARIS_ACL_T add_acl, int add_count, SMB_ACL_TYPE_T type);
  53 static bool solaris_acl_get_file(const char *name, SOLARIS_ACL_T *solarisacl,
  54                 int *count);
  55 static bool solaris_acl_get_fd(int fd, SOLARIS_ACL_T *solarisacl, int *count);
  56 static bool solaris_acl_sort(SOLARIS_ACL_T theacl, int count);
  57 static SMB_ACL_PERM_T solaris_perm_to_smb_perm(const SOLARIS_PERM_T perm);
  58 static SOLARIS_PERM_T smb_perm_to_solaris_perm(const SMB_ACL_PERM_T perm);
  59 #if 0
  60 static bool solaris_acl_check(SOLARIS_ACL_T solaris_acl, int count);
  61 #endif
  62
  63 /* public functions - the api */
  64
  65 SMB_ACL_T solarisacl_sys_acl_get_file(vfs_handle_struct *handle,
  66                                       const char *path_p,
  67                                       SMB_ACL_TYPE_T type, TALLOC_CTX *mem_ctx)
  68 {
  69         SMB_ACL_T result = NULL;
  70         int count;
  71         SOLARIS_ACL_T solaris_acl = NULL;
  72
  73         DEBUG(10, ("solarisacl_sys_acl_get_file called for file '%s'.\n",
  74                    path_p));
  75
  76         if (type != SMB_ACL_TYPE_ACCESS && type != SMB_ACL_TYPE_DEFAULT) {
  77                 DEBUG(10, ("invalid SMB_ACL_TYPE given (%d)\n", type));
  78                 errno = EINVAL;
  79                 goto done;
  80         }
  81
  82         DEBUGADD(10, ("getting %s acl\n",
  83                       ((type == SMB_ACL_TYPE_ACCESS) ? "access" : "default")));
  84
  85         if (!solaris_acl_get_file(path_p, &solaris_acl, &count)) {
  86                 goto done;
  87         }
  88         result = solaris_acl_to_smb_acl(solaris_acl, count, type, mem_ctx);
  89         if (result == NULL) {
  90                 DEBUG(10, ("conversion solaris_acl -> smb_acl failed (%s).\n",
  91                            strerror(errno)));
  92         }
  93
  94  done:
  95         DEBUG(10, ("solarisacl_sys_acl_get_file %s.\n",
  96                    ((result == NULL) ? "failed" : "succeeded" )));
  97         SAFE_FREE(solaris_acl);
  98         return result;
  99 }
 100
 101
 102 /*
 103  * get the access ACL of a file referred to by a fd
 104  */
 105 SMB_ACL_T solarisacl_sys_acl_get_fd(vfs_handle_struct *handle,
 106                                     files_struct *fsp, TALLOC_CTX *mem_ctx)
 107 {
 108         SMB_ACL_T result = NULL;
 109         int count;
 110         SOLARIS_ACL_T solaris_acl = NULL;
 111
 112         DEBUG(10, ("entering solarisacl_sys_acl_get_fd.\n"));
 113
 114         if (!solaris_acl_get_fd(fsp->fh->fd, &solaris_acl, &count)) {
 115                 goto done;
 116         }
 117         /*
 118          * The facl call returns both ACCESS and DEFAULT acls (as present).
 119          * The posix acl_get_fd function returns only the
 120          * access acl. So we need to filter this out here.
 121          */
 122         result = solaris_acl_to_smb_acl(solaris_acl, count,
 123                                         SMB_ACL_TYPE_ACCESS, mem_ctx);
 124         if (result == NULL) {
 125                 DEBUG(10, ("conversion solaris_acl -> smb_acl failed (%s).\n",
 126                            strerror(errno)));
 127         }
 128
 129  done:
 130         DEBUG(10, ("solarisacl_sys_acl_get_fd %s.\n",
 131                    ((result == NULL) ? "failed" : "succeeded")));
 132         SAFE_FREE(solaris_acl);
 133         return result;
 134 }
 135
 136 int solarisacl_sys_acl_set_file(vfs_handle_struct *handle,
 137                                 const char *name,
 138                                 SMB_ACL_TYPE_T type,
 139                                 SMB_ACL_T theacl)
 140 {
 141         int ret = -1;
 142         SOLARIS_ACL_T solaris_acl = NULL;
 143         int count;
 144         struct smb_filename smb_fname = {
 145                 .base_name = discard_const_p(char, name)
 146         };
 147
 148         DEBUG(10, ("solarisacl_sys_acl_set_file called for file '%s'\n",
 149                    name));
 150
 151         if ((type != SMB_ACL_TYPE_ACCESS) && (type != SMB_ACL_TYPE_DEFAULT)) {
 152                 errno = EINVAL;
 153                 DEBUG(10, ("invalid smb acl type given (%d).\n", type));
 154                 goto done;
 155         }
 156         DEBUGADD(10, ("setting %s acl\n",
 157                       ((type == SMB_ACL_TYPE_ACCESS) ? "access" : "default")));
 158
 159         if(!smb_acl_to_solaris_acl(theacl, &solaris_acl, &count, type)) {
 160                 DEBUG(10, ("conversion smb_acl -> solaris_acl failed (%s).\n",
 161                            strerror(errno)));
 162                 goto done;
 163         }
 164
 165         /*
 166          * if the file is a directory, there is extra work to do:
 167          * since the solaris acl call stores both the access acl and
 168          * the default acl as provided, we have to get the acl part
 169          * that has not been specified in "type" from the file first
 170          * and concatenate it with the acl provided.
 171          *
 172          * We can directly use SMB_VFS_STAT here, as if this was a
 173          * POSIX call on a symlink, we've already refused it.
 174          * For a Windows acl mapped call on a symlink, we want to follow
 175          * it.
 176          */
 177         ret = SMB_VFS_STAT(handle->conn, &smb_fname);
 178         if (ret != 0) {
 179                 DEBUG(10, ("Error in stat call: %s\n", strerror(errno)));
 180                 goto done;
 181         }
 182         if (S_ISDIR(smb_fname.st.st_ex_mode)) {
 183                 SOLARIS_ACL_T other_acl = NULL;
 184                 int other_count;
 185                 SMB_ACL_TYPE_T other_type;
 186
 187                 other_type = (type == SMB_ACL_TYPE_ACCESS)
 188                         ? SMB_ACL_TYPE_DEFAULT
 189                         : SMB_ACL_TYPE_ACCESS;
 190                 DEBUGADD(10, ("getting acl from filesystem\n"));
 191                 if (!solaris_acl_get_file(name, &other_acl, &other_count)) {
 192                         DEBUG(10, ("error getting acl from directory\n"));
 193                         goto done;
 194                 }
 195                 DEBUG(10, ("adding %s part of fs acl to given acl\n",
 196                            ((other_type == SMB_ACL_TYPE_ACCESS)
 197                             ? "access"
 198                             : "default")));
 199                 if (!solaris_add_to_acl(&solaris_acl, &count, other_acl,
 200                                         other_count, other_type))
 201                 {
 202                         DEBUG(10, ("error adding other acl.\n"));
 203                         SAFE_FREE(other_acl);
 204                         goto done;
 205                 }
 206                 SAFE_FREE(other_acl);
 207         }
 208         else if (type != SMB_ACL_TYPE_ACCESS) {
 209                 errno = EINVAL;
 210                 goto done;
 211         }
 212
 213         if (!solaris_acl_sort(solaris_acl, count)) {
 214                 DEBUG(10, ("resulting acl is not valid!\n"));
 215                 goto done;
 216         }
 217
 218         ret = acl(name, SETACL, count, solaris_acl);
 219
 220  done:
 221         DEBUG(10, ("solarisacl_sys_acl_set_file %s.\n",
 222                    ((ret != 0) ? "failed" : "succeeded")));
 223         SAFE_FREE(solaris_acl);
 224         return ret;
 225 }
 226
 227 /*
 228  * set the access ACL on the file referred to by a fd
 229  */
 230 int solarisacl_sys_acl_set_fd(vfs_handle_struct *handle,
 231                               files_struct *fsp,
 232                               SMB_ACL_T theacl)
 233 {
 234         SOLARIS_ACL_T solaris_acl = NULL;
 235         SOLARIS_ACL_T default_acl = NULL;
 236         int count, default_count;
 237         int ret = -1;
 238
 239         DEBUG(10, ("entering solarisacl_sys_acl_set_fd\n"));
 240
 241         /*
 242          * the posix acl_set_fd call sets the access acl of the
 243          * file referred to by fd. the solaris facl-SETACL call
 244          * sets the access and default acl as provided, so we
 245          * have to retrieve the default acl of the file and
 246          * concatenate it with the access acl provided.
 247          */
 248         if (!smb_acl_to_solaris_acl(theacl, &solaris_acl, &count,
 249                                     SMB_ACL_TYPE_ACCESS))
 250         {
 251                 DEBUG(10, ("conversion smb_acl -> solaris_acl failed (%s).\n",
 252                            strerror(errno)));
 253                 goto done;
 254         }
 255         if (!solaris_acl_get_fd(fsp->fh->fd, &default_acl, &default_count)) {
 256                 DEBUG(10, ("error getting (default) acl from fd\n"));
 257                 goto done;
 258         }
 259         if (!solaris_add_to_acl(&solaris_acl, &count,
 260                                 default_acl, default_count,
 261                                 SMB_ACL_TYPE_DEFAULT))
 262         {
 263                 DEBUG(10, ("error adding default acl to solaris acl\n"));
 264                 goto done;
 265         }
 266         if (!solaris_acl_sort(solaris_acl, count)) {
 267                 DEBUG(10, ("resulting acl is not valid!\n"));
 268                 goto done;
 269         }
 270
 271         ret = facl(fsp->fh->fd, SETACL, count, solaris_acl);
 272         if (ret != 0) {
 273                 DEBUG(10, ("call of facl failed (%s).\n", strerror(errno)));
 274         }
 275
 276  done:
 277         DEBUG(10, ("solarisacl_sys_acl_set_fd %s.\n",
 278                    ((ret == 0) ? "succeeded" : "failed" )));
 279         SAFE_FREE(solaris_acl);
 280         SAFE_FREE(default_acl);
 281         return ret;
 282 }
 283
 284 /*
 285  * delete the default ACL of a directory
 286  *
 287  * This is achieved by fetching the access ACL and rewriting it
 288  * directly, via the solaris system call: the SETACL call on
 289  * directories writes both the access and the default ACL as provided.
 290  *
 291  * XXX: posix acl_delete_def_file returns an error if
 292  * the file referred to by path is not a directory.
 293  * this function does not complain but the actions
 294  * have no effect on a file other than a directory.
 295  * But sys_acl_delete_default_file is only called in
 296  * smbd/posixacls.c after having checked that the file
 297  * is a directory, anyways. So implementing the extra
 298  * check is considered unnecessary. --- Agreed? XXX
 299  */
 300 int solarisacl_sys_acl_delete_def_file(vfs_handle_struct *handle,
 301                                        const char *path)
 302 {
 303         SMB_ACL_T smb_acl;
 304         int ret = -1;
 305         SOLARIS_ACL_T solaris_acl = NULL;
 306         int count;
 307
 308         DEBUG(10, ("entering solarisacl_sys_acl_delete_def_file.\n"));
 309
 310         smb_acl = solarisacl_sys_acl_get_file(handle, path,
 311                                               SMB_ACL_TYPE_ACCESS, talloc_tos());
 312         if (smb_acl == NULL) {
 313                 DEBUG(10, ("getting file acl failed!\n"));
 314                 goto done;
 315         }
 316         if (!smb_acl_to_solaris_acl(smb_acl, &solaris_acl, &count,
 317                                     SMB_ACL_TYPE_ACCESS))
 318         {
 319                 DEBUG(10, ("conversion smb_acl -> solaris_acl failed.\n"));
 320                 goto done;
 321         }
 322         if (!solaris_acl_sort(solaris_acl, count)) {
 323                 DEBUG(10, ("resulting acl is not valid!\n"));
 324                 goto done;
 325         }
 326         ret = acl(path, SETACL, count, solaris_acl);
 327         if (ret != 0) {
 328                 DEBUG(10, ("settinge file acl failed!\n"));
 329         }
 330
 331  done:
 332         DEBUG(10, ("solarisacl_sys_acl_delete_def_file %s.\n",
 333                    ((ret != 0) ? "failed" : "succeeded" )));
 334         TALLOC_FREE(smb_acl);
 335         return ret;
 336 }
 337
 338
 339 /* private functions */
 340
 341 static SOLARIS_ACL_T solaris_acl_init(int count)
 342 {
 343         SOLARIS_ACL_T solaris_acl =
 344                 (SOLARIS_ACL_T)SMB_MALLOC(sizeof(aclent_t) * count);
 345         if (solaris_acl == NULL) {
 346                 errno = ENOMEM;
 347         }
 348         return solaris_acl;
 349 }
 350
 351 /*
 352  * Convert the SMB acl to the ACCESS or DEFAULT part of a
 353  * solaris ACL, as desired.
 354  */
 355 static bool smb_acl_to_solaris_acl(SMB_ACL_T smb_acl,
 356                                    SOLARIS_ACL_T *solaris_acl, int *count,
 357                                    SMB_ACL_TYPE_T type)
 358 {
 359         bool ret = False;
 360         int i;
 361
 362         DEBUG(10, ("entering smb_acl_to_solaris_acl\n"));
 363
 364         *solaris_acl = NULL;
 365         *count = 0;
 366
 367         for (i = 0; i < smb_acl->count; i++) {
 368                 const struct smb_acl_entry *smb_entry = &(smb_acl->acl[i]);
 369                 SOLARIS_ACE_T solaris_entry;
 370
 371                 ZERO_STRUCT(solaris_entry);
 372
 373                 solaris_entry.a_type = smb_tag_to_solaris_tag(smb_entry->a_type);
 374                 if (solaris_entry.a_type == 0) {
 375                         DEBUG(10, ("smb_tag to solaris_tag failed\n"));
 376                         goto fail;
 377                 }
 378                 switch(solaris_entry.a_type) {
 379                 case USER:
 380                         DEBUG(10, ("got tag type USER with uid %u\n",
 381                                    (unsigned int)smb_entry->info.user.uid));
 382                         solaris_entry.a_id = (uid_t)smb_entry->info.user.uid;
 383                         break;
 384                 case GROUP:
 385                         DEBUG(10, ("got tag type GROUP with gid %u\n",
 386                                    (unsigned int)smb_entry->info.group.gid));
 387                         solaris_entry.a_id = (uid_t)smb_entry->info.group.gid;
 388                         break;
 389                 default:
 390                         break;
 391                 }
 392                 if (type == SMB_ACL_TYPE_DEFAULT) {
 393                         DEBUG(10, ("adding default bit to solaris ace\n"));
 394                         solaris_entry.a_type |= ACL_DEFAULT;
 395                 }
 396
 397                 solaris_entry.a_perm =
 398                         smb_perm_to_solaris_perm(smb_entry->a_perm);
 399                 DEBUG(10, ("assembled the following solaris ace:\n"));
 400                 DEBUGADD(10, (" - type: 0x%04x\n", solaris_entry.a_type));
 401                 DEBUGADD(10, (" - id: %u\n", (unsigned int)solaris_entry.a_id));
 402                 DEBUGADD(10, (" - perm: o%o\n", solaris_entry.a_perm));
 403                 if (!solaris_add_to_acl(solaris_acl, count, &solaris_entry,
 404                                         1, type))
 405                 {
 406                         DEBUG(10, ("error adding acl entry\n"));
 407                         goto fail;
 408                 }
 409                 DEBUG(10, ("count after adding: %d (i: %d)\n", *count, i));
 410                 DEBUG(10, ("test, if entry has been copied into acl:\n"));
 411                 DEBUGADD(10, (" - type: 0x%04x\n",
 412                               (*solaris_acl)[(*count)-1].a_type));
 413                 DEBUGADD(10, (" - id: %u\n",
 414                               (unsigned int)(*solaris_acl)[(*count)-1].a_id));
 415                 DEBUGADD(10, (" - perm: o%o\n",
 416                               (*solaris_acl)[(*count)-1].a_perm));
 417         }
 418
 419         ret = True;
 420         goto done;
 421
 422  fail:
 423         SAFE_FREE(*solaris_acl);
 424  done:
 425         DEBUG(10, ("smb_acl_to_solaris_acl %s\n",
 426                    ((ret == True) ? "succeeded" : "failed")));
 427         return ret;
 428 }
 429
 430 /*
 431  * convert either the access or the default part of a
 432  * soaris acl to the SMB_ACL format.
 433  */
 434 static SMB_ACL_T solaris_acl_to_smb_acl(SOLARIS_ACL_T solaris_acl, int count,
 435                                         SMB_ACL_TYPE_T type, TALLOC_CTX *mem_ctx)
 436 {
 437         SMB_ACL_T result;
 438         int i;
 439
 440         if ((result = sys_acl_init(mem_ctx)) == NULL) {
 441                 DEBUG(10, ("error allocating memory for SMB_ACL\n"));
 442                 goto fail;
 443         }
 444         for (i = 0; i < count; i++) {
 445                 SMB_ACL_ENTRY_T smb_entry;
 446                 SMB_ACL_PERM_T smb_perm;
 447
 448                 if (!_IS_OF_TYPE(solaris_acl[i], type)) {
 449                         continue;
 450                 }
 451                 result->acl = talloc_realloc(result, result->acl, struct smb_acl_entry, result->count + 1);
 452                 if (result->acl == NULL) {
 453                         DEBUG(10, ("error reallocating memory for SMB_ACL\n"));
 454                         goto fail;
 455                 }
 456                 smb_entry = &result->acl[result->count];
 457                 if (sys_acl_set_tag_type(smb_entry,
 458                                          solaris_tag_to_smb_tag(solaris_acl[i].a_type)) != 0)
 459                 {
 460                         DEBUG(10, ("invalid tag type given: 0x%04x\n",
 461                                    solaris_acl[i].a_type));
 462                         goto fail;
 463                 }
 464                 /* intentionally not checking return code here: */
 465                 sys_acl_set_qualifier(smb_entry, (void *)&solaris_acl[i].a_id);
 466                 smb_perm = solaris_perm_to_smb_perm(solaris_acl[i].a_perm);
 467                 if (sys_acl_set_permset(smb_entry, &smb_perm) != 0) {
 468                         DEBUG(10, ("invalid permset given: %d\n",
 469                                    solaris_acl[i].a_perm));
 470                         goto fail;
 471                 }
 472                 result->count += 1;
 473         }
 474         goto done;
 475
 476  fail:
 477         TALLOC_FREE(result);
 478  done:
 479         DEBUG(10, ("solaris_acl_to_smb_acl %s\n",
 480                    ((result == NULL) ? "failed" : "succeeded")));
 481         return result;
 482 }
 483
 484
 485
 486 static SOLARIS_ACL_TAG_T smb_tag_to_solaris_tag(SMB_ACL_TAG_T smb_tag)
 487 {
 488         SOLARIS_ACL_TAG_T solaris_tag = 0;
 489
 490         DEBUG(10, ("smb_tag_to_solaris_tag\n"));
 491         DEBUGADD(10, (" --> got smb tag 0x%04x\n", smb_tag));
 492
 493         switch (smb_tag) {
 494         case SMB_ACL_USER:
 495                 solaris_tag = USER;
 496                 break;
 497         case SMB_ACL_USER_OBJ:
 498                 solaris_tag = USER_OBJ;
 499                 break;
 500         case SMB_ACL_GROUP:
 501                 solaris_tag = GROUP;
 502                 break;
 503         case SMB_ACL_GROUP_OBJ:
 504                 solaris_tag = GROUP_OBJ;
 505                 break;
 506         case SMB_ACL_OTHER:
 507                 solaris_tag = OTHER_OBJ;
 508                 break;
 509         case SMB_ACL_MASK:
 510                 solaris_tag = CLASS_OBJ;
 511                 break;
 512         default:
 513                 DEBUGADD(10, (" !!! unknown smb tag type 0x%04x\n", smb_tag));
 514                 break;
 515         }
 516
 517         DEBUGADD(10, (" --> determined solaris tag 0x%04x\n", solaris_tag));
 518
 519         return solaris_tag;
 520 }
 521
 522 static SMB_ACL_TAG_T solaris_tag_to_smb_tag(SOLARIS_ACL_TAG_T solaris_tag)
 523 {
 524         SMB_ACL_TAG_T smb_tag = 0;
 525
 526         DEBUG(10, ("solaris_tag_to_smb_tag:\n"));
 527         DEBUGADD(10, (" --> got solaris tag 0x%04x\n", solaris_tag));
 528
 529         solaris_tag &= ~ACL_DEFAULT;
 530
 531         switch (solaris_tag) {
 532         case USER:
 533                 smb_tag = SMB_ACL_USER;
 534                 break;
 535         case USER_OBJ:
 536                 smb_tag = SMB_ACL_USER_OBJ;
 537                 break;
 538         case GROUP:
 539                 smb_tag = SMB_ACL_GROUP;
 540                 break;
 541         case GROUP_OBJ:
 542                 smb_tag = SMB_ACL_GROUP_OBJ;
 543                 break;
 544         case OTHER_OBJ:
 545                 smb_tag = SMB_ACL_OTHER;
 546                 break;
 547         case CLASS_OBJ:
 548                 smb_tag = SMB_ACL_MASK;
 549                 break;
 550         default:
 551                 DEBUGADD(10, (" !!! unknown solaris tag type: 0x%04x\n",
 552                                         solaris_tag));
 553                 break;
 554         }
 555
 556         DEBUGADD(10, (" --> determined smb tag 0x%04x\n", smb_tag));
 557
 558         return smb_tag;
 559 }
 560
 561
 562 static SMB_ACL_PERM_T solaris_perm_to_smb_perm(const SOLARIS_PERM_T perm)
 563 {
 564         SMB_ACL_PERM_T smb_perm = 0;
 565         smb_perm |= ((perm & SMB_ACL_READ) ? SMB_ACL_READ : 0);
 566         smb_perm |= ((perm & SMB_ACL_WRITE) ? SMB_ACL_WRITE : 0);
 567         smb_perm |= ((perm & SMB_ACL_EXECUTE) ? SMB_ACL_EXECUTE : 0);
 568         return smb_perm;
 569 }
 570
 571
 572 static SOLARIS_PERM_T smb_perm_to_solaris_perm(const SMB_ACL_PERM_T perm)
 573 {
 574         SOLARIS_PERM_T solaris_perm = 0;
 575         solaris_perm |= ((perm & SMB_ACL_READ) ? SMB_ACL_READ : 0);
 576         solaris_perm |= ((perm & SMB_ACL_WRITE) ? SMB_ACL_WRITE : 0);
 577         solaris_perm |= ((perm & SMB_ACL_EXECUTE) ? SMB_ACL_EXECUTE : 0);
 578         return solaris_perm;
 579 }
 580
 581
 582 static bool solaris_acl_get_file(const char *name, SOLARIS_ACL_T *solaris_acl,
 583                                  int *count)
 584 {
 585         bool result = False;
 586
 587         DEBUG(10, ("solaris_acl_get_file called for file '%s'\n", name));
 588
 589         /*
 590          * The original code tries some INITIAL_ACL_SIZE
 591          * and only did the GETACLCNT call upon failure
 592          * (for performance reasons).
 593          * For the sake of simplicity, I skip this for now.
 594          */
 595         *count = acl(name, GETACLCNT, 0, NULL);
 596         if (*count < 0) {
 597                 DEBUG(10, ("acl GETACLCNT failed: %s\n", strerror(errno)));
 598                 goto done;
 599         }
 600         *solaris_acl = solaris_acl_init(*count);
 601         if (*solaris_acl == NULL) {
 602                 DEBUG(10, ("error allocating memory for solaris acl...\n"));
 603                 goto done;
 604         }
 605         *count = acl(name, GETACL, *count, *solaris_acl);
 606         if (*count < 0) {
 607                 DEBUG(10, ("acl GETACL failed: %s\n", strerror(errno)));
 608                 goto done;
 609         }
 610         result = True;
 611
 612  done:
 613         DEBUG(10, ("solaris_acl_get_file %s.\n",
 614                    ((result == True) ? "succeeded" : "failed" )));
 615         return result;
 616 }
 617
 618
 619 static bool solaris_acl_get_fd(int fd, SOLARIS_ACL_T *solaris_acl, int *count)
 620 {
 621         bool ret = False;
 622
 623         DEBUG(10, ("entering solaris_acl_get_fd\n"));
 624
 625         /*
 626          * see solaris_acl_get_file for comment about omission
 627          * of INITIAL_ACL_SIZE...
 628          */
 629         *count = facl(fd, GETACLCNT, 0, NULL);
 630         if (*count < 0) {
 631                 DEBUG(10, ("facl GETACLCNT failed: %s\n", strerror(errno)));
 632                 goto done;
 633         }
 634         *solaris_acl = solaris_acl_init(*count);
 635         if (*solaris_acl == NULL) {
 636                 DEBUG(10, ("error allocating memory for solaris acl...\n"));
 637                 goto done;
 638         }
 639         *count = facl(fd, GETACL, *count, *solaris_acl);
 640         if (*count < 0) {
 641                 DEBUG(10, ("facl GETACL failed: %s\n", strerror(errno)));
 642                 goto done;
 643         }
 644         ret = True;
 645
 646  done:
 647         DEBUG(10, ("solaris_acl_get_fd %s\n",
 648                    ((ret == True) ? "succeeded" : "failed")));
 649         return ret;
 650 }
 651
 652
 653
 654 /*
 655  * Add entries to a solaris ACL.
 656  *
 657  * Entries are directly added to the solarisacl parameter.
 658  * if memory allocation fails, this may result in solarisacl
 659  * being NULL. if the resulting acl is to be checked and is
 660  * not valid, it is kept in solarisacl but False is returned.
 661  *
 662  * The type of ACEs (access/default) to be added to the ACL can
 663  * be selected via the type parameter.
 664  * I use the SMB_ACL_TYPE_T type here. Since SMB_ACL_TYPE_ACCESS
 665  * is defined as "0", this means that one can only add either
 666  * access or default ACEs, not both at the same time. If it
 667  * should become necessary to add all of an ACL, one would have
 668  * to replace this parameter by another type.
 669  */
 670 static bool solaris_add_to_acl(SOLARIS_ACL_T *solaris_acl, int *count,
 671                                SOLARIS_ACL_T add_acl, int add_count,
 672                                SMB_ACL_TYPE_T type)
 673 {
 674         int i;
 675
 676         if ((type != SMB_ACL_TYPE_ACCESS) && (type != SMB_ACL_TYPE_DEFAULT))
 677         {
 678                 DEBUG(10, ("invalid acl type given: %d\n", type));
 679                 errno = EINVAL;
 680                 return False;
 681         }
 682         for (i = 0; i < add_count; i++) {
 683                 if (!_IS_OF_TYPE(add_acl[i], type)) {
 684                         continue;
 685                 }
 686                 ADD_TO_ARRAY(NULL, SOLARIS_ACE_T, add_acl[i],
 687                              solaris_acl, count);
 688                 if (solaris_acl == NULL) {
 689                         DEBUG(10, ("error enlarging acl.\n"));
 690                         errno = ENOMEM;
 691                         return False;
 692                 }
 693         }
 694         return True;
 695 }
 696
 697
 698 /*
 699  * sort the ACL and check it for validity
 700  *
 701  * [original comment from lib/sysacls.c:]
 702  *
 703  * if it's a minimal ACL with only 4 entries then we
 704  * need to recalculate the mask permissions to make
 705  * sure that they are the same as the GROUP_OBJ
 706  * permissions as required by the UnixWare acl() system call.
 707  *
 708  * (note: since POSIX allows minimal ACLs which only contain
 709  * 3 entries - ie there is no mask entry - we should, in theory,
 710  * check for this and add a mask entry if necessary - however
 711  * we "know" that the caller of this interface always specifies
 712  * a mask, so in practice "this never happens" (tm) - if it *does*
 713  * happen aclsort() will fail and return an error and someone will
 714  * have to fix it...)
 715  */
 716 static bool solaris_acl_sort(SOLARIS_ACL_T solaris_acl, int count)
 717 {
 718         int fixmask = (count <= 4);
 719
 720         if (aclsort(count, fixmask, solaris_acl) != 0) {
 721                 errno = EINVAL;
 722                 return False;
 723         }
 724         return True;
 725 }
 726
 727 #if 0
 728 /*
 729  * acl check function:
 730  *   unused at the moment but could be used to get more
 731  *   concrete error messages for debugging...
 732  *   (acl sort just says that the acl is invalid...)
 733  */
 734 static bool solaris_acl_check(SOLARIS_ACL_T solaris_acl, int count)
 735 {
 736         int check_rc;
 737         int check_which;
 738
 739         check_rc = aclcheck(solaris_acl, count, &check_which);
 740         if (check_rc != 0) {
 741                 DEBUG(10, ("acl is not valid:\n"));
 742                 DEBUGADD(10, (" - return code: %d\n", check_rc));
 743                 DEBUGADD(10, (" - which: %d\n", check_which));
 744                 if (check_which != -1) {
 745                         DEBUGADD(10, (" - invalid entry:\n"));
 746                         DEBUGADD(10, ("   * type: %d:\n",
 747                                       solaris_acl[check_which].a_type));
 748                         DEBUGADD(10, ("   * id: %d\n",
 749                                       solaris_acl[check_which].a_id));
 750                         DEBUGADD(10, ("   * perm: 0o%o\n",
 751                                       solaris_acl[check_which].a_perm));
 752                 }
 753                 return False;
 754         }
 755         return True;
 756 }
 757 #endif
 758
 759 static struct vfs_fn_pointers solarisacl_fns = {
 760         .sys_acl_get_file_fn = solarisacl_sys_acl_get_file,
 761         .sys_acl_get_fd_fn = solarisacl_sys_acl_get_fd,
 762         .sys_acl_blob_get_file_fn = posix_sys_acl_blob_get_file,
 763         .sys_acl_blob_get_fd_fn = posix_sys_acl_blob_get_fd,
 764         .sys_acl_set_file_fn = solarisacl_sys_acl_set_file,
 765         .sys_acl_set_fd_fn = solarisacl_sys_acl_set_fd,
 766         .sys_acl_delete_def_file_fn = solarisacl_sys_acl_delete_def_file,
 767 };
 768
 769 NTSTATUS vfs_solarisacl_init(void);
 770 NTSTATUS vfs_solarisacl_init(void)
 771 {
 772         return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "solarisacl",
 773                                 &solarisacl_fns);
 774 }
 775
 776 /* ENTE */