2 Unix SMB/CIFS implementation.
3 Samba system utilities for ACL support.
4 Copyright (C) Jeremy Allison 2000.
5 Copyright (C) Volker Lendecke 2006
6 Copyright (C) Michael Adam 2006,2008
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "system/passwd.h"
25 #if defined(HAVE_POSIX_ACLS)
26 #include "modules/vfs_posixacl.h"
29 #if defined(HAVE_TRU64_ACLS)
30 #include "modules/vfs_tru64acl.h"
33 #if defined(HAVE_SOLARIS_UNIXWARE_ACLS)
34 #include "modules/vfs_solarisacl.h"
37 #if defined(HAVE_HPUX_ACLS)
38 #include "modules/vfs_hpuxacl.h"
42 #define DBGC_CLASS DBGC_ACLS
45 * Note that while this code implements sufficient functionality
46 * to support the sys_acl_* interfaces it does not provide all
47 * of the semantics of the POSIX ACL interfaces.
49 * In particular, an ACL entry descriptor (SMB_ACL_ENTRY_T) returned
50 * from a call to sys_acl_get_entry() should not be assumed to be
51 * valid after calling any of the following functions, which may
52 * reorder the entries in the ACL.
59 int sys_acl_get_entry(SMB_ACL_T acl_d
, int entry_id
, SMB_ACL_ENTRY_T
*entry_p
)
61 if (entry_id
!= SMB_ACL_FIRST_ENTRY
&& entry_id
!= SMB_ACL_NEXT_ENTRY
) {
66 if (entry_p
== NULL
) {
71 if (entry_id
== SMB_ACL_FIRST_ENTRY
) {
75 if (acl_d
->next
< 0) {
80 if (acl_d
->next
>= acl_d
->count
) {
84 *entry_p
= &acl_d
->acl
[acl_d
->next
++];
89 int sys_acl_get_tag_type(SMB_ACL_ENTRY_T entry_d
, SMB_ACL_TAG_T
*type_p
)
91 *type_p
= entry_d
->a_type
;
96 int sys_acl_get_permset(SMB_ACL_ENTRY_T entry_d
, SMB_ACL_PERMSET_T
*permset_p
)
98 *permset_p
= &entry_d
->a_perm
;
103 void *sys_acl_get_qualifier(SMB_ACL_ENTRY_T entry_d
)
105 if (entry_d
->a_type
== SMB_ACL_USER
) {
106 return &entry_d
->info
.user
.uid
;
109 if (entry_d
->a_type
== SMB_ACL_GROUP
) {
110 return &entry_d
->info
.group
.gid
;
117 int sys_acl_clear_perms(SMB_ACL_PERMSET_T permset_d
)
124 int sys_acl_add_perm(SMB_ACL_PERMSET_T permset_d
, SMB_ACL_PERM_T perm
)
126 if (perm
!= SMB_ACL_READ
&& perm
!= SMB_ACL_WRITE
127 && perm
!= SMB_ACL_EXECUTE
) {
132 if (permset_d
== NULL
) {
142 int sys_acl_get_perm(SMB_ACL_PERMSET_T permset_d
, SMB_ACL_PERM_T perm
)
144 return *permset_d
& perm
;
147 char *sys_acl_to_text(const struct smb_acl_t
*acl_d
, ssize_t
*len_p
)
154 * use an initial estimate of 20 bytes per ACL entry
155 * when allocating memory for the text representation
159 maxlen
= 20 * acl_d
->count
;
160 if ((text
= (char *)SMB_MALLOC(maxlen
)) == NULL
) {
165 for (i
= 0; i
< acl_d
->count
; i
++) {
166 struct smb_acl_entry
*ap
= &acl_d
->acl
[i
];
175 switch (ap
->a_type
) {
177 * for debugging purposes it's probably more
178 * useful to dump unknown tag types rather
179 * than just returning an error
182 slprintf(tagbuf
, sizeof(tagbuf
)-1, "0x%x",
188 id
= uidtoname(ap
->info
.user
.uid
);
190 case SMB_ACL_USER_OBJ
:
195 if ((gr
= getgrgid(ap
->info
.group
.gid
)) == NULL
) {
196 slprintf(idbuf
, sizeof(idbuf
)-1, "%ld",
197 (long)ap
->info
.group
.gid
);
203 case SMB_ACL_GROUP_OBJ
:
217 perms
[0] = (ap
->a_perm
& SMB_ACL_READ
) ? 'r' : '-';
218 perms
[1] = (ap
->a_perm
& SMB_ACL_WRITE
) ? 'w' : '-';
219 perms
[2] = (ap
->a_perm
& SMB_ACL_EXECUTE
) ? 'x' : '-';
222 /* <tag> : <qualifier> : rwx \n \0 */
223 nbytes
= strlen(tag
) + 1 + strlen(id
) + 1 + 3 + 1 + 1;
226 * If this entry would overflow the buffer
227 * allocate enough additional memory for this
228 * entry and an estimate of another 20 bytes
229 * for each entry still to be processed
231 if ((len
+ nbytes
) > maxlen
) {
232 maxlen
+= nbytes
+ 20 * (acl_d
->count
- i
);
233 if ((text
= (char *)SMB_REALLOC(text
, maxlen
)) == NULL
) {
240 slprintf(&text
[len
], nbytes
, "%s:%s:%s\n", tag
, id
, perms
);
250 SMB_ACL_T
sys_acl_init(TALLOC_CTX
*mem_ctx
)
254 if ((a
= talloc(mem_ctx
, struct smb_acl_t
)) == NULL
) {
262 a
->acl
= talloc_array(a
, struct smb_acl_entry
, 0);
272 int sys_acl_create_entry(SMB_ACL_T
*acl_p
, SMB_ACL_ENTRY_T
*entry_p
)
275 SMB_ACL_ENTRY_T entry_d
;
276 struct smb_acl_entry
*acl
;
278 if (acl_p
== NULL
|| entry_p
== NULL
|| (acl_d
= *acl_p
) == NULL
) {
283 acl
= talloc_realloc(acl_d
, acl_d
->acl
, struct smb_acl_entry
, acl_d
->count
+1);
289 entry_d
= &acl_d
->acl
[acl_d
->count
];
290 entry_d
->a_type
= SMB_ACL_TAG_INVALID
;
298 int sys_acl_set_tag_type(SMB_ACL_ENTRY_T entry_d
, SMB_ACL_TAG_T tag_type
)
302 case SMB_ACL_USER_OBJ
:
304 case SMB_ACL_GROUP_OBJ
:
307 entry_d
->a_type
= tag_type
;
317 int sys_acl_set_qualifier(SMB_ACL_ENTRY_T entry_d
, void *qual_p
)
319 if (entry_d
->a_type
== SMB_ACL_USER
) {
320 entry_d
->info
.user
.uid
= *((uid_t
*)qual_p
);
323 if (entry_d
->a_type
== SMB_ACL_GROUP
) {
324 entry_d
->info
.group
.gid
= *((gid_t
*)qual_p
);
332 int sys_acl_set_permset(SMB_ACL_ENTRY_T entry_d
, SMB_ACL_PERMSET_T permset_d
)
334 if (*permset_d
& ~(SMB_ACL_READ
|SMB_ACL_WRITE
|SMB_ACL_EXECUTE
)) {
339 entry_d
->a_perm
= *permset_d
;
344 int sys_acl_free_text(char *text
)
350 int sys_acl_valid(SMB_ACL_T acl_d
)
357 * acl_get_file, acl_get_fd, acl_set_file, acl_set_fd and
358 * sys_acl_delete_def_file are to be redirected to the default
359 * statically-bound acl vfs module, but they are replacable.
362 #if defined(HAVE_POSIX_ACLS)
364 SMB_ACL_T
sys_acl_get_file(vfs_handle_struct
*handle
,
365 const struct smb_filename
*smb_fname
,
369 return posixacl_sys_acl_get_file(handle
, smb_fname
, type
, mem_ctx
);
372 SMB_ACL_T
sys_acl_get_fd(vfs_handle_struct
*handle
, files_struct
*fsp
, TALLOC_CTX
*mem_ctx
)
374 return posixacl_sys_acl_get_fd(handle
, fsp
, mem_ctx
);
377 int sys_acl_set_file(vfs_handle_struct
*handle
,
378 const struct smb_filename
*smb_fname
,
382 return posixacl_sys_acl_set_file(handle
, smb_fname
, type
, acl_d
);
385 int sys_acl_set_fd(vfs_handle_struct
*handle
, files_struct
*fsp
,
388 return posixacl_sys_acl_set_fd(handle
, fsp
, acl_d
);
391 int sys_acl_delete_def_file(vfs_handle_struct
*handle
,
392 const struct smb_filename
*smb_fname
)
394 return posixacl_sys_acl_delete_def_file(handle
, smb_fname
);
397 #elif defined(HAVE_AIX_ACLS)
399 SMB_ACL_T
sys_acl_get_file(vfs_handle_struct
*handle
,
400 const struct smb_filename
*smb_fname
,
404 return aixacl_sys_acl_get_file(handle
, smb_fname
, type
, mem_ctx
);
407 SMB_ACL_T
sys_acl_get_fd(vfs_handle_struct
*handle
, files_struct
*fsp
,
410 return aixacl_sys_acl_get_fd(handle
, fsp
, mem_ctx
);
413 int sys_acl_set_file(vfs_handle_struct
*handle
,
414 const struct smb_filename
*smb_fname
,
418 return aixacl_sys_acl_set_file(handle
, smb_fname
, type
, acl_d
);
421 int sys_acl_set_fd(vfs_handle_struct
*handle
, files_struct
*fsp
,
424 return aixacl_sys_acl_set_fd(handle
, fsp
, acl_d
);
427 int sys_acl_delete_def_file(vfs_handle_struct
*handle
,
428 const struct smb_filename
*smb_fname
)
430 return aixacl_sys_acl_delete_def_file(handle
, smb_fname
);
433 #elif defined(HAVE_TRU64_ACLS)
435 SMB_ACL_T
sys_acl_get_file(vfs_handle_struct
*handle
,
436 const struct smb_filename
*smb_fname
,
440 return tru64acl_sys_acl_get_file(handle
, smb_fname
, type
,
444 SMB_ACL_T
sys_acl_get_fd(vfs_handle_struct
*handle
, files_struct
*fsp
,
447 return tru64acl_sys_acl_get_fd(handle
, fsp
, mem_ctx
);
450 int sys_acl_set_file(vfs_handle_struct
*handle
,
451 const struct smb_filename
*smb_fname
,
455 return tru64acl_sys_acl_set_file(handle
, smb_fname
, type
, acl_d
);
458 int sys_acl_set_fd(vfs_handle_struct
*handle
, files_struct
*fsp
,
461 return tru64acl_sys_acl_set_fd(handle
, fsp
, acl_d
);
464 int sys_acl_delete_def_file(vfs_handle_struct
*handle
,
465 const struct smb_filename
*smb_fname
)
467 return tru64acl_sys_acl_delete_def_file(handle
, smb_fname
);
470 #elif defined(HAVE_SOLARIS_UNIXWARE_ACLS)
472 SMB_ACL_T
sys_acl_get_file(vfs_handle_struct
*handle
,
473 const struct smb_filename
*smb_fname
,
477 return solarisacl_sys_acl_get_file(handle
, smb_fname
, type
,
481 SMB_ACL_T
sys_acl_get_fd(vfs_handle_struct
*handle
, files_struct
*fsp
,
484 return solarisacl_sys_acl_get_fd(handle
, fsp
,
488 int sys_acl_set_file(vfs_handle_struct
*handle
,
489 const struct smb_filename
*smb_fname
,
493 return solarisacl_sys_acl_set_file(handle
, smb_fname
, type
, acl_d
);
496 int sys_acl_set_fd(vfs_handle_struct
*handle
, files_struct
*fsp
,
499 return solarisacl_sys_acl_set_fd(handle
, fsp
, acl_d
);
502 int sys_acl_delete_def_file(vfs_handle_struct
*handle
,
503 const struct smb_filename
*smb_fname
)
505 return solarisacl_sys_acl_delete_def_file(handle
, smb_fname
);
508 #elif defined(HAVE_HPUX_ACLS)
510 SMB_ACL_T
sys_acl_get_file(vfs_handle_struct
*handle
,
511 const struct smb_filename
*smb_fname
,
515 return hpuxacl_sys_acl_get_file(handle
, smb_fname
, type
, mem_ctx
);
518 SMB_ACL_T
sys_acl_get_fd(vfs_handle_struct
*handle
, files_struct
*fsp
,
521 return hpuxacl_sys_acl_get_fd(handle
, fsp
, mem_ctx
);
524 int sys_acl_set_file(vfs_handle_struct
*handle
,
525 const struct smb_filename
*smb_fname
,
529 return hpuxacl_sys_acl_set_file(handle
, smb_fname
, type
, acl_d
);
532 int sys_acl_set_fd(vfs_handle_struct
*handle
, files_struct
*fsp
,
535 return hpuxacl_sys_acl_set_fd(handle
, fsp
, acl_d
);
538 int sys_acl_delete_def_file(vfs_handle_struct
*handle
,
539 const struct smb_filename
*smb_fname
)
541 return hpuxacl_sys_acl_delete_def_file(handle
, smb_fname
);
546 SMB_ACL_T
sys_acl_get_file(vfs_handle_struct
*handle
,
547 const struct smb_filename
*smb_fname
,
559 SMB_ACL_T
sys_acl_get_fd(vfs_handle_struct
*handle
, files_struct
*fsp
,
570 int sys_acl_set_file(vfs_handle_struct
*handle
,
571 const struct smb_filename
*smb_fname
,
583 int sys_acl_set_fd(vfs_handle_struct
*handle
, files_struct
*fsp
,
594 int sys_acl_delete_def_file(vfs_handle_struct
*handle
,
595 const struct smb_filename
*smb_fname
)
607 /************************************************************************
608 Deliberately outside the ACL defines. Return 1 if this is a "no acls"
610 ************************************************************************/
612 int no_acl_syscall_error(int err
)
620 if (err
== ENOTSUP
) {