source3/modules/vfs_acl_tdb.c

   1 /*
   2  * Store Windows ACLs in a tdb.
   3  *
   4  * Copyright (C) Volker Lendecke, 2008
   5  * Copyright (C) Jeremy Allison, 2008
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 3 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "includes.h"
  22 #include "smbd/smbd.h"
  23 #include "system/filesys.h"
  24 #include "librpc/gen_ndr/xattr.h"
  25 #include "librpc/gen_ndr/ndr_xattr.h"
  26 #include "../lib/crypto/crypto.h"
  27 #include "dbwrap.h"
  28 #include "auth.h"
  29 #include "util_tdb.h"
  30
  31 #undef DBGC_CLASS
  32 #define DBGC_CLASS DBGC_VFS
  33
  34 #define ACL_MODULE_NAME "acl_tdb"
  35 #include "modules/vfs_acl_common.c"
  36
  37 static unsigned int ref_count;
  38 static struct db_context *acl_db;
  39
  40 /*******************************************************************
  41  Open acl_db if not already open, increment ref count.
  42 *******************************************************************/
  43
  44 static bool acl_tdb_init(void)
  45 {
  46         char *dbname;
  47
  48         if (acl_db) {
  49                 ref_count++;
  50                 return true;
  51         }
  52
  53         dbname = state_path("file_ntacls.tdb");
  54
  55         if (dbname == NULL) {
  56                 errno = ENOSYS;
  57                 return false;
  58         }
  59
  60         become_root();
  61         acl_db = db_open(NULL, dbname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
  62         unbecome_root();
  63
  64         if (acl_db == NULL) {
  65 #if defined(ENOTSUP)
  66                 errno = ENOTSUP;
  67 #else
  68                 errno = ENOSYS;
  69 #endif
  70                 TALLOC_FREE(dbname);
  71                 return false;
  72         }
  73
  74         ref_count++;
  75         TALLOC_FREE(dbname);
  76         return true;
  77 }
  78
  79 /*******************************************************************
  80  Lower ref count and close acl_db if zero.
  81 *******************************************************************/
  82
  83 static void disconnect_acl_tdb(struct vfs_handle_struct *handle)
  84 {
  85         SMB_VFS_NEXT_DISCONNECT(handle);
  86         ref_count--;
  87         if (ref_count == 0) {
  88                 TALLOC_FREE(acl_db);
  89         }
  90 }
  91
  92 /*******************************************************************
  93  Fetch_lock the tdb acl record for a file
  94 *******************************************************************/
  95
  96 static struct db_record *acl_tdb_lock(TALLOC_CTX *mem_ctx,
  97                                         struct db_context *db,
  98                                         const struct file_id *id)
  99 {
 100         uint8 id_buf[16];
 101
 102         /* For backwards compatibility only store the dev/inode. */
 103         push_file_id_16((char *)id_buf, id);
 104         return db->fetch_locked(db,
 105                                 mem_ctx,
 106                                 make_tdb_data(id_buf,
 107                                         sizeof(id_buf)));
 108 }
 109
 110 /*******************************************************************
 111  Delete the tdb acl record for a file
 112 *******************************************************************/
 113
 114 static NTSTATUS acl_tdb_delete(vfs_handle_struct *handle,
 115                                 struct db_context *db,
 116                                 SMB_STRUCT_STAT *psbuf)
 117 {
 118         NTSTATUS status;
 119         struct file_id id = vfs_file_id_from_sbuf(handle->conn, psbuf);
 120         struct db_record *rec = acl_tdb_lock(talloc_tos(), db, &id);
 121
 122         /*
 123          * If rec == NULL there's not much we can do about it
 124          */
 125
 126         if (rec == NULL) {
 127                 DEBUG(10,("acl_tdb_delete: rec == NULL\n"));
 128                 TALLOC_FREE(rec);
 129                 return NT_STATUS_OK;
 130         }
 131
 132         status = rec->delete_rec(rec);
 133         TALLOC_FREE(rec);
 134         return status;
 135 }
 136
 137 /*******************************************************************
 138  Pull a security descriptor into a DATA_BLOB from a tdb store.
 139 *******************************************************************/
 140
 141 static NTSTATUS get_acl_blob(TALLOC_CTX *ctx,
 142                         vfs_handle_struct *handle,
 143                         files_struct *fsp,
 144                         const char *name,
 145                         DATA_BLOB *pblob)
 146 {
 147         uint8 id_buf[16];
 148         TDB_DATA data;
 149         struct file_id id;
 150         struct db_context *db = acl_db;
 151         NTSTATUS status = NT_STATUS_OK;
 152         SMB_STRUCT_STAT sbuf;
 153
 154         ZERO_STRUCT(sbuf);
 155
 156         if (fsp) {
 157                 status = vfs_stat_fsp(fsp);
 158                 sbuf = fsp->fsp_name->st;
 159         } else {
 160                 int ret = vfs_stat_smb_fname(handle->conn, name, &sbuf);
 161                 if (ret == -1) {
 162                         status = map_nt_error_from_unix(errno);
 163                 }
 164         }
 165
 166         if (!NT_STATUS_IS_OK(status)) {
 167                 return status;
 168         }
 169
 170         id = vfs_file_id_from_sbuf(handle->conn, &sbuf);
 171
 172         /* For backwards compatibility only store the dev/inode. */
 173         push_file_id_16((char *)id_buf, &id);
 174
 175         if (db->fetch(db,
 176                         ctx,
 177                         make_tdb_data(id_buf, sizeof(id_buf)),
 178                         &data) == -1) {
 179                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 180         }
 181
 182         pblob->data = data.dptr;
 183         pblob->length = data.dsize;
 184
 185         DEBUG(10,("get_acl_blob: returned %u bytes from file %s\n",
 186                 (unsigned int)data.dsize, name ));
 187
 188         if (pblob->length == 0 || pblob->data == NULL) {
 189                 return NT_STATUS_NOT_FOUND;
 190         }
 191         return NT_STATUS_OK;
 192 }
 193
 194 /*******************************************************************
 195  Store a DATA_BLOB into a tdb record given an fsp pointer.
 196 *******************************************************************/
 197
 198 static NTSTATUS store_acl_blob_fsp(vfs_handle_struct *handle,
 199                                 files_struct *fsp,
 200                                 DATA_BLOB *pblob)
 201 {
 202         uint8 id_buf[16];
 203         struct file_id id;
 204         TDB_DATA data;
 205         struct db_context *db = acl_db;
 206         struct db_record *rec;
 207         NTSTATUS status;
 208
 209         DEBUG(10,("store_acl_blob_fsp: storing blob length %u on file %s\n",
 210                   (unsigned int)pblob->length, fsp_str_dbg(fsp)));
 211
 212         status = vfs_stat_fsp(fsp);
 213         if (!NT_STATUS_IS_OK(status)) {
 214                 return status;
 215         }
 216
 217         id = vfs_file_id_from_sbuf(handle->conn, &fsp->fsp_name->st);
 218
 219         /* For backwards compatibility only store the dev/inode. */
 220         push_file_id_16((char *)id_buf, &id);
 221         rec = db->fetch_locked(db, talloc_tos(),
 222                                 make_tdb_data(id_buf,
 223                                         sizeof(id_buf)));
 224         if (rec == NULL) {
 225                 DEBUG(0, ("store_acl_blob_fsp_tdb: fetch_lock failed\n"));
 226                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 227         }
 228         data.dptr = pblob->data;
 229         data.dsize = pblob->length;
 230         return rec->store(rec, data, 0);
 231 }
 232
 233 /*********************************************************************
 234  On unlink we need to delete the tdb record (if using tdb).
 235 *********************************************************************/
 236
 237 static int unlink_acl_tdb(vfs_handle_struct *handle,
 238                           const struct smb_filename *smb_fname)
 239 {
 240         struct smb_filename *smb_fname_tmp = NULL;
 241         struct db_context *db = acl_db;
 242         NTSTATUS status;
 243         int ret = -1;
 244
 245         status = copy_smb_filename(talloc_tos(), smb_fname, &smb_fname_tmp);
 246         if (!NT_STATUS_IS_OK(status)) {
 247                 errno = map_errno_from_nt_status(status);
 248                 goto out;
 249         }
 250
 251         if (lp_posix_pathnames()) {
 252                 ret = SMB_VFS_LSTAT(handle->conn, smb_fname_tmp);
 253         } else {
 254                 ret = SMB_VFS_STAT(handle->conn, smb_fname_tmp);
 255         }
 256
 257         if (ret == -1) {
 258                 goto out;
 259         }
 260
 261         ret = unlink_acl_common(handle, smb_fname_tmp);
 262
 263         if (ret == -1) {
 264                 goto out;
 265         }
 266
 267         acl_tdb_delete(handle, db, &smb_fname_tmp->st);
 268  out:
 269         return ret;
 270 }
 271
 272 /*********************************************************************
 273  On rmdir we need to delete the tdb record (if using tdb).
 274 *********************************************************************/
 275
 276 static int rmdir_acl_tdb(vfs_handle_struct *handle, const char *path)
 277 {
 278
 279         SMB_STRUCT_STAT sbuf;
 280         struct db_context *db = acl_db;
 281         int ret = -1;
 282
 283         if (lp_posix_pathnames()) {
 284                 ret = vfs_lstat_smb_fname(handle->conn, path, &sbuf);
 285         } else {
 286                 ret = vfs_stat_smb_fname(handle->conn, path, &sbuf);
 287         }
 288
 289         if (ret == -1) {
 290                 return -1;
 291         }
 292
 293         ret = rmdir_acl_common(handle, path);
 294         if (ret == -1) {
 295                 return -1;
 296         }
 297
 298         acl_tdb_delete(handle, db, &sbuf);
 299         return 0;
 300 }
 301
 302 /*******************************************************************
 303  Handle opening the storage tdb if so configured.
 304 *******************************************************************/
 305
 306 static int connect_acl_tdb(struct vfs_handle_struct *handle,
 307                                 const char *service,
 308                                 const char *user)
 309 {
 310         int ret = SMB_VFS_NEXT_CONNECT(handle, service, user);
 311
 312         if (ret < 0) {
 313                 return ret;
 314         }
 315
 316         if (!acl_tdb_init()) {
 317                 SMB_VFS_NEXT_DISCONNECT(handle);
 318                 return -1;
 319         }
 320
 321         /* Ensure we have the parameters correct if we're
 322          * using this module. */
 323         DEBUG(2,("connect_acl_tdb: setting 'inherit acls = true' "
 324                 "'dos filemode = true' and "
 325                 "'force unknown acl user = true' for service %s\n",
 326                 service ));
 327
 328         lp_do_parameter(SNUM(handle->conn), "inherit acls", "true");
 329         lp_do_parameter(SNUM(handle->conn), "dos filemode", "true");
 330         lp_do_parameter(SNUM(handle->conn), "force unknown acl user", "true");
 331
 332         return 0;
 333 }
 334
 335 /*********************************************************************
 336  Remove a Windows ACL - we're setting the underlying POSIX ACL.
 337 *********************************************************************/
 338
 339 static int sys_acl_set_file_tdb(vfs_handle_struct *handle,
 340                               const char *path,
 341                               SMB_ACL_TYPE_T type,
 342                               SMB_ACL_T theacl)
 343 {
 344         SMB_STRUCT_STAT sbuf;
 345         struct db_context *db = acl_db;
 346         int ret = -1;
 347
 348         if (lp_posix_pathnames()) {
 349                 ret = vfs_lstat_smb_fname(handle->conn, path, &sbuf);
 350         } else {
 351                 ret = vfs_stat_smb_fname(handle->conn, path, &sbuf);
 352         }
 353
 354         if (ret == -1) {
 355                 return -1;
 356         }
 357
 358         ret = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle,
 359                                                 path,
 360                                                 type,
 361                                                 theacl);
 362         if (ret == -1) {
 363                 return -1;
 364         }
 365
 366         acl_tdb_delete(handle, db, &sbuf);
 367         return 0;
 368 }
 369
 370 /*********************************************************************
 371  Remove a Windows ACL - we're setting the underlying POSIX ACL.
 372 *********************************************************************/
 373
 374 static int sys_acl_set_fd_tdb(vfs_handle_struct *handle,
 375                             files_struct *fsp,
 376                             SMB_ACL_T theacl)
 377 {
 378         struct db_context *db = acl_db;
 379         NTSTATUS status;
 380         int ret;
 381
 382         status = vfs_stat_fsp(fsp);
 383         if (!NT_STATUS_IS_OK(status)) {
 384                 return -1;
 385         }
 386
 387         ret = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle,
 388                                                 fsp,
 389                                                 theacl);
 390         if (ret == -1) {
 391                 return -1;
 392         }
 393
 394         acl_tdb_delete(handle, db, &fsp->fsp_name->st);
 395         return 0;
 396 }
 397
 398 static struct vfs_fn_pointers vfs_acl_tdb_fns = {
 399         .connect_fn = connect_acl_tdb,
 400         .disconnect = disconnect_acl_tdb,
 401         .opendir = opendir_acl_common,
 402         .mkdir = mkdir_acl_common,
 403         .rmdir = rmdir_acl_tdb,
 404         .open_fn = open_acl_common,
 405         .create_file = create_file_acl_common,
 406         .unlink = unlink_acl_tdb,
 407         .chmod = chmod_acl_module_common,
 408         .fchmod = fchmod_acl_module_common,
 409         .fget_nt_acl = fget_nt_acl_common,
 410         .get_nt_acl = get_nt_acl_common,
 411         .fset_nt_acl = fset_nt_acl_common,
 412         .chmod_acl = chmod_acl_acl_module_common,
 413         .fchmod_acl = fchmod_acl_acl_module_common,
 414         .sys_acl_set_file = sys_acl_set_file_tdb,
 415         .sys_acl_set_fd = sys_acl_set_fd_tdb
 416 };
 417
 418 NTSTATUS vfs_acl_tdb_init(void)
 419 {
 420         return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "acl_tdb",
 421                                 &vfs_acl_tdb_fns);
 422 }