| blob | da0498f9e7dccea9589388529823dce1ba54a828 |
1 /*
2 Unix SMB/CIFS implementation.
3 file opening and share modes
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Jeremy Allison 2001-2004
6 Copyright (C) Volker Lendecke 2005
7 Copyright (C) Ralph Boehme 2017
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
53 /*
54 * Timer for async opens, needed because they don't use a watch on
55 * a locking.tdb record. This is currently only used for real async
56 * opens and just terminates smbd if the async open times out.
57 */
60 /*
61 * For the samba kernel oplock case we use both a timeout and
62 * a watch on locking.tdb. This way in case it's smbd holding
63 * the kernel oplock we get directly notified for the retry
64 * once the kernel oplock is properly broken. Store the req
65 * here so that it can be timely discarded once the timer
66 * above fires.
67 */
69 };
71 /****************************************************************************
72 If the requester wanted DELETE_ACCESS and was rejected because
73 the file ACL didn't include DELETE_ACCESS, see if the parent ACL
74 overrides this.
75 ****************************************************************************/
82 {
86 dirfsp,
87 smb_fname))
88 {
90 }
92 }
94 /****************************************************************************
95 Check if we have open rights.
96 ****************************************************************************/
104 {
113 access_mask,
115 rejected_share_access);
117 }
125 }
128 /* I'm sorry sir, I didn't know you were root... */
133 }
137 {
141 access_mask);
143 }
148 {
149 /* We can always delete a symlink. */
153 }
156 }
166 {
168 NTSTATUS status;
172 }
176 use_privs,
183 access_mask,
184 rejected_mask,
192 }
193 }
199 {
201 }
203 /* Here we know status == NT_STATUS_ACCESS_DENIED. */
205 access_denied:
214 {
219 }
222 dirfsp,
223 smb_fname,
224 access_mask,
225 rejected_mask))
226 {
227 /*
228 * Were we trying to do an open for delete and didn't get DELETE
229 * access. Check if the directory allows DELETE_CHILD.
230 * See here:
231 * http://blogs.msdn.com/oldnewthing/archive/2004/06/04/148426.aspx
232 * for details.
233 */
239 }
243 }
245 }
251 {
254 NTSTATUS status;
256 /* Cope with fake/printer fsp's. */
260 }
262 }
265 /*
266 * This is a POSIX open on a symlink. For the pathname
267 * version of this function we used to return the st_mode
268 * bits turned into an NT ACL. For a symlink the mode bits
269 * are always rwxrwxrwx which means the pathname version always
270 * returned NT_STATUS_OK for a symlink. For the handle reference
271 * to a symlink use the handle access bits.
272 */
275 }
277 }
279 /*
280 * If we can access the path to this file, by
281 * default we have FILE_READ_ATTRIBUTES from the
282 * containing directory. See the section:
283 * "Algorithm to Check Access to an Existing File"
284 * in MS-FSA.pdf.
285 *
286 * se_file_access_check() also takes care of
287 * owner WRITE_DAC and READ_CONTROL.
288 */
291 /*
292 * Samba 3.6 and earlier granted execute access even
293 * if the ACL did not contain execute rights.
294 * Samba 4.0 is more correct and checks it.
295 * The compatibilty mode allows one to skip this check
296 * to smoothen upgrades.
297 */
300 }
304 use_privs,
305 access_mask,
306 do_not_check_mask);
309 }
313 SECINFO_GROUP |
314 SECINFO_DACL),
322 }
325 dirfsp,
327 sd,
328 use_privs,
329 access_mask,
330 do_not_check_mask);
331 }
333 /*
334 * Given an fsp that represents a parent directory,
335 * check if the requested access can be granted.
336 */
339 {
340 NTSTATUS status;
349 /* I'm sorry sir, I didn't know you were root... */
355 }
358 SECINFO_DACL,
359 frame,
368 }
370 /*
371 * If we can access the path to this file, by
372 * default we have FILE_READ_ATTRIBUTES from the
373 * containing directory. See the section:
374 * "Algorithm to Check Access to an Existing File"
375 * in MS-FSA.pdf.
376 *
377 * se_file_access_check() also takes care of
378 * owner WRITE_DAC and READ_CONTROL.
379 */
389 access_mask,
390 access_granted,
393 }
398 }
402 }
404 /* Check if the directory has delete-on-close set */
410 }
412 /*
413 * Don't take a lock here. We just need a snapshot
414 * of the current state of delete on close and this is
415 * called in a codepath where we may already have a lock
416 * (and we explicitly can't hold 2 locks at the same time
417 * as that may deadlock).
418 */
423 }
429 }
433 out:
436 }
438 /****************************************************************************
439 Ensure when opening a base file for a stream open that we have permissions
440 to do so given the access mask on the base file.
441 ****************************************************************************/
445 {
446 NTSTATUS status;
449 fsp,
451 access_mask,
459 }
465 }
469 }
470 }
473 fsp,
475 access_mask);
476 }
485 {
490 NTSTATUS status;
500 }
502 /* Pin parent directory in place. */
510 }
511 }
516 NULL,
517 NULL,
523 }
532 }
536 connectpath_len,
543 }
550 connectpath,
556 out:
561 }
564 }
566 /*
567 * Get the symlink target of dirfsp/symlink_name, making sure the
568 * target is below connection_path.
569 */
579 {
583 NTSTATUS status;
587 /*
588 * fsp is an O_PATH open, Linux does a "freadlink"
589 * with an empty name argument to readlinkat
590 */
595 }
600 }
606 connection_path,
608 target);
614 }
616 }
625 }
627 /*
628 * We're doing the "below connection_path" here because it's
629 * cheap. It might be that we get a symlink out of the share,
630 * pointing to yet another symlink getting us back into the
631 * share. If we need that, we would have to remove the check
632 * here.
633 */
635 connection_path,
636 connection_path_len,
637 absolute,
645 connection_path,
646 absolute);
649 }
652 /*
653 * special case symlink to share root: "." is our
654 * share root filename
655 */
660 }
664 }
666 /****************************************************************************
667 Non-widelink open.
668 ****************************************************************************/
674 {
693 /*
694 * This can happen with shadow_copy2 if the snapshot
695 * path is not found
696 */
698 }
701 again:
709 }
710 }
711 }
717 smb_fname,
722 }
726 conn,
727 connpath,
728 connpath_len,
729 parent_dir_fname,
733 }
735 /* Setup fsp->fsp_name to be relative to cwd */
738 /*
739 * fsp->fsp_name is unchanged as it is already correctly
740 * relative to conn->cwd.
741 */
743 }
745 {
746 /*
747 * Assert nobody can step in with a symlink on the
748 * path, there is no path anymore and we'll use
749 * O_NOFOLLOW to open.
750 */
753 }
758 dirfsp,
759 smb_fname_rel,
760 fsp,
769 }
771 /*
772 * ENOENT makes it worthless retrying with a
773 * stat, we know for sure the file does not
774 * exist. For everything else we want to know
775 * what's there.
776 */
779 dirfsp,
780 smb_fname_rel,
782 AT_SYMLINK_NOFOLLOW);
785 }
793 }
800 }
802 /*
803 * Found a symlink to follow in user space
804 */
807 /* Never follow symlinks on posix open. */
810 }
812 /* Explicitly no symlinks. */
815 }
821 }
827 connpath,
828 connpath_len,
829 fsp,
831 smb_fname_rel,
838 }
840 /*
841 * Close what openat(O_PATH) potentially left behind
842 */
847 }
854 }
856 }
858 /*
859 * And do it all again... As smb_fname is not relative to the passed in
860 * dirfsp anymore, we pass conn->cwd_fsp as dirfsp to
861 * non_widelink_open() to trigger the chdir(parentdir) logic.
862 */
867 out:
875 }
881 }
883 }
885 }
887 /****************************************************************************
888 fd support routines - attempt to do a dos_open.
889 ****************************************************************************/
895 {
904 /*
905 * Never follow symlinks on a POSIX client. The
906 * client should be doing this.
907 */
911 }
917 conn,
919 smb_fname,
920 fsp,
924 }
933 }
934 }
937 }
939 /*
940 * Only follow symlinks within a share
941 * definition.
942 */
950 "to open more! smbd's max "
954 }
955 }
964 }
973 }
975 /****************************************************************************
976 Close the file associated with a fsp.
977 ****************************************************************************/
980 {
981 NTSTATUS status;
986 }
992 }
993 }
997 }
999 /*
1000 * Either a directory where the dptr_CloseDir() already closed
1001 * the fd or a stat open.
1002 */
1004 }
1007 }
1013 }
1015 }
1017 /****************************************************************************
1018 Change the ownership of a file to that of the parent directory.
1019 Do this by fd if possible.
1020 ****************************************************************************/
1024 {
1028 /* Already this uid - no need to change. */
1033 }
1042 "file %s to parent directory uid %u. Error "
1052 /* Ensure the uid entry is updated. */
1055 }
1056 }
1060 {
1061 NTSTATUS status;
1065 /* Already this uid - no need to change. */
1070 }
1080 "directory %s to parent directory uid %u. "
1086 }
1093 /* Ensure the uid entry is updated. */
1097 }
1099 /****************************************************************************
1100 Open a file - returning a guaranteed ATOMIC indication of if the
1101 file was created or not.
1102 ****************************************************************************/
1108 mode_t mode,
1110 {
1113 NTSTATUS retry_status;
1117 /*
1118 * We're not creating the file, just pass through.
1119 */
1123 }
1126 /*
1127 * Fail if already exists, just pass through.
1128 */
1131 /*
1132 * Here we've opened with O_CREAT|O_EXCL. If that went
1133 * NT_STATUS_OK, we *know* we created this file.
1134 */
1138 }
1140 /*
1141 * Now it gets tricky. We have O_CREAT, but not O_EXCL.
1142 * To know absolutely if we created the file or not,
1143 * we can never call O_CREAT without O_EXCL. So if
1144 * we think the file existed, try without O_CREAT|O_EXCL.
1145 * If we think the file didn't exist, try with
1146 * O_CREAT|O_EXCL.
1147 *
1148 * The big problem here is dangling symlinks. Opening
1149 * without O_NOFOLLOW means both bad symlink
1150 * and missing path return -1, ENOENT from open(). As POSIX
1151 * is pathname based it's not possible to tell
1152 * the difference between these two cases in a
1153 * non-racy way, so change to try only two attempts before
1154 * giving up.
1155 *
1156 * We don't have this problem for the O_NOFOLLOW
1157 * case as it just returns NT_STATUS_OBJECT_PATH_NOT_FOUND
1158 * mapped from the ELOOP POSIX error.
1159 */
1167 }
1173 }
1186 }
1189 }
1193 }
1197 mode_t mode)
1198 {
1205 NTSTATUS status;
1209 }
1214 }
1219 #ifdef DEVELOPER
1221 #endif
1223 }
1228 }
1232 };
1239 fsp,
1245 }
1250 }
1254 }
1260 mode_t mode,
1262 {
1264 NTSTATUS status;
1268 }
1270 /*
1271 * TODO: should we move this to the VFS layer?
1272 * SMB_VFS_REOPEN_FSP()?
1273 */
1276 flags,
1277 mode);
1280 }
1282 /*
1283 * Close the existing pathref fd and set the fsp flag
1284 * is_pathref to false so we get a "normal" fd this time.
1285 */
1289 }
1294 dirfsp,
1295 smb_fname,
1296 fsp,
1297 flags,
1298 mode,
1299 p_file_created);
1301 }
1303 /****************************************************************************
1304 Open a file.
1305 ****************************************************************************/
1312 mode_t unx_mode,
1317 {
1325 FILE_READ_DATA |
1326 FILE_WRITE_DATA |
1327 FILE_APPEND_DATA |
1328 FILE_EXECUTE |
1329 SEC_FLAG_SYSTEM_SECURITY;
1335 /*
1336 * Catch early an attempt to open an existing
1337 * directory as a file.
1338 */
1341 }
1343 /* Check permissions */
1345 /*
1346 * This code was changed after seeing a client open request
1347 * containing the open mode of (DENY_WRITE/read-only) with
1348 * the 'create if not exist' bit set. The previous code
1349 * would fail to open the file read only on a read-only share
1350 * as it was checking the flags parameter directly against O_RDONLY,
1351 * this was failing as the flags parameter was set to O_RDONLY|O_CREAT.
1352 * JRA.
1353 */
1356 /* It's a read-only share - fail if we wanted to write. */
1361 }
1363 /* We don't want to write - but we must make sure that
1364 O_CREAT doesn't create the file if we have write
1365 access into the directory.
1366 */
1369 }
1370 }
1372 /*
1373 * This little piece of insanity is inspired by the
1374 * fact that an NT client can open a file for O_RDONLY,
1375 * but set the create disposition to FILE_EXISTS_TRUNCATE.
1376 * If the client *can* write to the file, then it expects to
1377 * truncate the file, even though it is opening for readonly.
1378 * Quicken uses this stupid trick in backup file creation...
1379 * Thanks *greatly* to "David W. Chapman Jr." <dwcjr@inethouston.net>
1380 * for helping track this one down. It didn't bite us in 2.0.x
1381 * as we always opened files read-write in that release. JRA.
1382 */
1388 }
1392 }
1398 #if defined(O_NONBLOCK) && defined(S_ISFIFO)
1399 /*
1400 * We would block on opening a FIFO with no one else on the
1401 * other end. Do what we used to do and add O_NONBLOCK to the
1402 * open flags. JRA.
1403 */
1409 }
1410 #endif
1412 /* Don't create files with Microsoft wildcard characters. */
1414 /*
1415 * wildcard characters are allowed in stream names
1416 * only test the basefilename
1417 */
1421 }
1426 }
1428 /* Can we access this file ? */
1430 /* Only do this check on non-stream open. */
1433 dirfsp,
1434 fsp,
1436 access_mask);
1443 }
1447 NT_STATUS_OBJECT_NAME_NOT_FOUND))
1448 {
1450 }
1453 NT_STATUS_OBJECT_NAME_NOT_FOUND))
1454 {
1456 "file %s vanished since we "
1461 }
1462 }
1466 /* File didn't exist and no O_CREAT. */
1468 }
1471 dirfsp,
1472 SEC_DIR_ADD_FILE);
1475 "directory %s for file %s "
1482 }
1483 }
1484 }
1486 /*
1487 * Actually do the open - if O_TRUNC is needed handle it
1488 * below under the share mode lock.
1489 */
1491 smb_fname_atname,
1492 fsp,
1494 unx_mode,
1495 p_file_created);
1497 /*
1498 * Non-O_PATH reopen that hit a race
1499 * condition: Someone has put a symlink where
1500 * we used to have a file. Can't happen with
1501 * O_PATH and reopening from /proc/self/fd/ or
1502 * equivalent.
1503 */
1505 }
1511 }
1514 /*
1515 * GPFS can return ETIMEDOUT for pread on
1516 * nonblocking file descriptors when files
1517 * migrated to tape need to be recalled. I
1518 * could imagine this happens elsewhere
1519 * too. With blocking file descriptors this
1520 * does not happen.
1521 */
1529 }
1530 }
1533 /* We created this file. */
1536 /* Do all inheritance work after we've
1537 done a successful fstat call and filled
1538 in the stat struct in fsp->fsp_name. */
1540 /* Inherit the ACL if required */
1543 dirfsp,
1544 smb_fname,
1545 unx_mode);
1547 }
1549 /* Change the owner if required. */
1553 }
1557 /*
1558 * If we have an fd, this stat should succeed.
1559 */
1567 }
1568 }
1571 FILE_NOTIFY_CHANGE_FILE_NAME,
1573 }
1576 /* File must exist for a stat open. */
1578 }
1582 {
1583 /*
1584 * Don't allow stat opens on symlinks directly unless
1585 * it's a POSIX open. Match the return code from
1586 * openat_pathref_fsp().
1587 */
1589 }
1592 /*
1593 * There is only one legit case where end up here:
1594 * openat_pathref_fsp() failed to open a symlink, so the
1595 * fsp was created by fsp_new() which doesn't set
1596 * is_pathref. Other then that, we should always have a
1597 * pathref fsp at this point. The subsequent checks
1598 * assert this.
1599 */
1604 }
1609 }
1615 }
1616 }
1618 /*
1619 * Access to streams is checked by checking the basefile and
1620 * that has alreay been checked by check_base_file_access()
1621 * in create_file_unixpath().
1622 */
1625 fsp,
1627 access_mask);
1630 posix_open &&
1632 /* This is a POSIX stat open for delete
1633 * or rename on a symlink that points
1634 * nowhere. Allow. */
1639 }
1647 }
1648 }
1649 }
1667 }
1677 }
1686 {
1695 new_access,
1696 access_mask,
1697 existing_sharemode,
1698 sharemode_mask);
1700 }
1704 new_sharemode,
1705 sharemode_mask,
1706 existing_access,
1707 access_mask);
1709 }
1711 }
1713 /****************************************************************************
1714 Check if we can open a file with a share mode.
1715 Returns True if conflict, False if not.
1716 ****************************************************************************/
1719 FILE_WRITE_DATA|
1720 FILE_APPEND_DATA|
1721 FILE_READ_DATA|
1722 FILE_EXECUTE|
1723 DELETE_ACCESS;
1729 {
1736 e_access_mask,
1737 e_share_access,
1738 access_mask,
1739 share_access);
1744 e_access_mask);
1746 }
1749 access_mask);
1751 }
1765 }
1767 #if defined(DEVELOPER)
1773 };
1779 {
1785 }
1788 /* INTERNAL_OPEN_ONLY */
1790 }
1798 }
1802 }
1806 panic:
1807 {
1812 "validate_my_share_entries: "
1818 }
1821 }
1822 #endif
1824 /**
1825 * Allowed access mask for stat opens relevant to oplocks
1826 **/
1828 {
1831 FILE_READ_ATTRIBUTES|
1832 FILE_WRITE_ATTRIBUTES);
1836 }
1838 /**
1839 * Allowed access mask for stat opens relevant to leases
1840 **/
1842 {
1845 FILE_READ_ATTRIBUTES|
1846 FILE_WRITE_ATTRIBUTES|
1847 READ_CONTROL_ACCESS);
1851 }
1855 };
1861 {
1865 }
1869 {
1875 }
1881 }
1883 }
1890 {
1895 lck,
1903 }
1907 lck,
1908 existing_access_mask,
1909 existing_share_mode,
1910 existing_lease_type,
1911 NULL);
1912 }
1914 /****************************************************************************
1915 Deal with share modes
1916 Invariant: Share mode must be locked on entry and exit.
1917 Returns -1 on error, or number of share modes on success (may be zero).
1918 ****************************************************************************/
1925 };
1931 {
1939 }
1945 }
1952 }
1957 }
1964 }
1971 {
1977 /* Stat open that doesn't trigger oplock breaks or share mode
1978 * checks... ! JRA. */
1980 }
1982 /*
1983 * Check if the share modes will give us access.
1984 */
1986 #if defined(DEVELOPER)
1987 {
1992 };
1996 }
1997 #endif
2005 access_mask,
2006 share_access);
2010 }
2015 FILE_SHARE_WRITE|
2016 FILE_SHARE_DELETE),
2017 };
2019 /*
2020 * Walk the share mode array to recalculate d->flags
2021 */
2027 }
2030 lck,
2036 /*
2037 * We only end up here if we had a sharing violation
2038 * from d->flags and have recalculated it.
2039 */
2041 }
2046 access_mask,
2047 share_access);
2051 }
2054 }
2056 /*
2057 * Send a break message to the oplock holder and delay the open for
2058 * our client.
2059 */
2065 {
2070 };
2072 DATA_BLOB blob;
2073 NTSTATUS status;
2080 }
2091 }
2099 }
2102 }
2111 };
2117 {
2121 /* INTERNAL_OPEN_ONLY */
2123 }
2126 /*
2127 * We ignore stat opens in the table - they always
2128 * have NO_OPLOCK and never get or cause breaks. JRA.
2129 */
2131 }
2136 /* batch - can only be one. */
2140 }
2148 }
2150 }
2156 }
2157 /* Exclusive or batch - can only be one. */
2164 }
2166 }
2173 }
2177 }
2179 }
2186 }
2190 }
2192 }
2195 }
2197 /*
2198 * Do internal consistency checks on the share mode for a file.
2199 */
2202 {
2210 }
2217 }
2223 }
2227 }
2237 }
2240 }
2245 {
2248 }
2251 }
2257 }
2260 {
2268 }
2275 {
2278 /*
2279 * TODO: Measure how expensive this loop is with thousands of open
2280 * handles...
2281 */
2289 }
2292 }
2296 }
2297 }
2299 /* Not found - must be leased in another smbd. */
2303 }
2308 /*
2309 * We internally treat all leases as V2 and update
2310 * the epoch, but when sending breaks it matters if
2311 * the requesting lease was v1 or v2.
2312 */
2316 }
2323 {
2329 NTSTATUS status;
2332 client_guid,
2343 }
2346 fsp,
2348 current_state,
2349 lease_version,
2350 epoch);
2355 }
2357 /*
2358 * Upgrade only if the requested lease is a strict upgrade.
2359 */
2363 /*
2364 * Tricky: This test makes sure that "requested" is a
2365 * strict bitwise superset of "existing".
2366 */
2369 /*
2370 * Upgrade only if there's a change.
2371 */
2374 /*
2375 * Upgrade only if other leases don't prevent what was asked
2376 * for.
2377 */
2380 /*
2381 * only upgrade if we are not in breaking state
2382 */
2390 NTSTATUS set_status;
2396 client_guid,
2398 current_state,
2399 breaking,
2400 breaking_to_requested,
2401 breaking_to_required,
2402 lease_version,
2403 epoch);
2409 }
2410 }
2415 }
2422 {
2423 NTSTATUS status;
2428 }
2450 }
2452 /*
2453 * We used to set lck->data->modified=true here without
2454 * actually modifying lck->data, triggering a needless
2455 * writeback of lck->data.
2456 *
2457 * Apart from that writeback, setting modified=true has the
2458 * effect of triggering all waiters for this file to
2459 * retry. This only makes sense if any blocking condition
2460 * (i.e. waiting for a lease to be downgraded or removed) is
2461 * gone. This routine here only adds a lease, so it will never
2462 * free up resources that blocked waiters can now claim. So
2463 * that second effect also does not matter in this
2464 * routine. Thus setting lck->data->modified=true does not
2465 * need to be done here.
2466 */
2469 }
2475 {
2477 NTSTATUS status;
2484 }
2487 }
2490 {
2504 }
2507 }
2520 };
2526 {
2536 NTSTATUS status;
2543 }
2544 }
2557 /*
2558 * leases_db_get() can return NT_STATUS_NOT_FOUND
2559 * if the share_mode_entry e is stale and the
2560 * lease record was already removed. In this case return
2561 * false so the traverse continues.
2562 */
2566 {
2571 "file_id [%s] failed for stale "
2578 }
2591 }
2594 }
2598 {
2600 }
2606 }
2612 }
2618 }
2622 }
2628 }
2637 }
2639 }
2643 }
2646 /*
2647 * If we break anyway break to NONE directly.
2648 * Otherwise vfs_set_filelen() will trigger the
2649 * break.
2650 */
2652 }
2655 /*
2656 * Oplocks only support breaking to R or NONE.
2657 */
2659 }
2668 }
2671 }
2674 };
2685 {
2690 };
2700 /*
2701 * No directory leases yet
2702 */
2706 }
2708 }
2712 /*
2713 * The SMB2 layer should have checked this
2714 */
2716 }
2722 }
2728 }
2742 }
2748 }
2752 }
2754 grant:
2757 }
2765 }
2769 }
2773 }
2777 }
2778 }
2784 }
2787 /*
2788 * Can grant only one writer
2789 */
2791 }
2800 }
2801 }
2806 }
2812 }
2814 /*
2815 * Reflect possible downgrades from:
2816 * - map_lease_type_to_oplock() => "RH" to just LEVEL_II
2817 */
2820 }
2824 {
2829 }
2837 granted,
2839 oplock_request,
2843 requested,
2852 }
2865 {
2867 NTSTATUS status;
2877 }
2881 }
2887 }
2889 /*
2890 * Internal opens never do oplocks or leases. We don't
2891 * need to go through delay_for_oplock().
2892 */
2894 }
2897 fsp,
2898 oplock_request,
2899 lease,
2900 lck,
2901 sharing_violation,
2902 create_disposition,
2903 first_open_attempt,
2904 poplock_type,
2905 pgranted);
2908 }
2911 }
2914 {
2919 }
2924 };
2928 /**
2929 * Defer an open and watch a locking.tdb record
2930 *
2931 * This defers an open that gets rescheduled once the locking.tdb record watch
2932 * is triggered by a change to the record.
2933 *
2934 * It is used to defer opens that triggered an oplock break and for the SMB1
2935 * sharing violation delay.
2936 **/
2941 {
2963 }
2968 }
2975 watch_state,
2977 lck,
2981 }
2987 }
2993 }
2994 }
2997 {
3000 NTSTATUS status;
3008 /*
3009 * Even if it failed, retry anyway. TODO: We need a way to
3010 * tell a re-scheduled open about that error.
3011 */
3012 }
3019 }
3021 /**
3022 * Actually attempt the kernel oplock polling open.
3023 */
3029 {
3040 }
3042 }
3050 };
3054 {
3060 }
3065 lck,
3070 }
3071 }
3073 /**
3074 * Reschedule an open for 1 second from now, if not timed out.
3075 **/
3081 {
3090 }
3096 }
3100 /*
3101 * Make sure open_rec->te does not come later than the
3102 * request's maximum endtime.
3103 */
3111 open_rec,
3112 next_interval,
3113 poll_open_fn,
3114 open_rec);
3119 }
3125 };
3126 NTSTATUS status;
3129 poll_open_setup_watcher_fn,
3136 }
3139 poll_open_done,
3140 open_rec);
3146 }
3149 }
3156 }
3164 }
3167 {
3170 NTSTATUS status;
3185 }
3186 }
3189 {
3195 }
3197 /*
3198 * Try every 200msec up to (by default) one second. To be
3199 * precise, according to behaviour note <247> in [MS-CIFS],
3200 * the server tries 5 times. But up to one second should be
3201 * close enough.
3202 */
3208 SHARING_VIOLATION_USEC_WAIT);
3211 req,
3212 NULL,
3216 }
3218 /****************************************************************************
3219 On overwrite open ensure that the attributes match.
3220 ****************************************************************************/
3225 mode_t new_unx_mode,
3227 {
3234 (noarch_old_dos_attr != 0 && ((noarch_old_dos_attr & noarch_new_dos_attr) == noarch_old_dos_attr))) {
3238 }
3241 "new_dos_attr = 0x%x "
3247 /* If we're mapping SYSTEM and HIDDEN ensure they match. */
3252 }
3253 }
3258 }
3259 }
3261 }
3266 {
3267 /* This is a relative time, added to the absolute
3268 request_time value to get the absolute timeout time.
3269 Note that if this is the second or greater time we enter
3270 this codepath for this particular request mid then
3271 request_time is left as the absolute time of the *first*
3272 time this request mid was processed. This is what allows
3273 the request to eventually time out. */
3277 /* Normally the smbd we asked should respond within
3278 * OPLOCK_BREAK_TIMEOUT seconds regardless of whether
3279 * the client did, give twice the timeout as a safety
3280 * measure here in case the other smbd is stuck
3281 * somewhere else. */
3287 }
3290 }
3292 /****************************************************************************
3293 Reschedule an open call that went asynchronous.
3294 ****************************************************************************/
3300 {
3302 }
3305 {
3312 }
3317 }
3324 }
3327 req,
3329 schedule_async_open_timer,
3330 open_rec);
3333 }
3334 }
3346 {
3347 NTSTATUS status;
3354 /* Get the types we need to examine. */
3357 }
3362 }
3365 lck,
3366 create_disposition,
3367 access_mask,
3368 share_access,
3369 oplock_request,
3370 lease,
3371 first_open_attempt,
3377 }
3380 }
3384 }
3389 fsp,
3392 oplock_type,
3393 lease_key,
3394 share_access,
3395 access_mask);
3398 }
3405 }
3408 }
3413 }
3415 /****************************************************************************
3416 Work out what access_mask to use from what the client sent us.
3417 ****************************************************************************/
3424 {
3428 NTSTATUS status;
3430 /* Cope with symlinks */
3434 }
3436 /* Cope with fake/printer fsp's. */
3440 }
3445 }
3449 SECINFO_GROUP |
3450 SECINFO_DACL),
3455 /*
3456 * File did not exist
3457 */
3460 }
3466 }
3468 /*
3469 * If we can access the path to this file, by
3470 * default we have FILE_READ_ATTRIBUTES from the
3471 * containing directory. See the section:
3472 * "Algorithm to Check Access to an Existing File"
3473 * in MS-FSA.pdf.
3474 *
3475 * se_file_access_check()
3476 * also takes care of owner WRITE_DAC and READ_CONTROL.
3477 */
3480 use_privs,
3492 }
3498 dirfsp,
3501 }
3502 }
3507 }
3510 }
3517 {
3518 NTSTATUS status;
3524 access_mask);
3526 }
3528 /*
3529 * Convert GENERIC bits to specific bits.
3530 */
3534 /* Calculate MAXIMUM_ALLOWED_ACCESS if requested. */
3538 dirfsp,
3539 fsp,
3540 use_privs,
3545 }
3548 }
3554 "rejected by share access mask[0x%08X] "
3559 rejected_share_access);
3561 }
3565 }
3567 /****************************************************************************
3568 Remove the deferred open entry under lock.
3569 ****************************************************************************/
3571 /****************************************************************************
3572 Return true if this is a state pointer to an asynchronous create.
3573 ****************************************************************************/
3576 {
3578 }
3581 {
3592 }
3594 }
3597 {
3600 /*
3601 * Currently we're using FILE_SUPERSEDE as the same as
3602 * FILE_OVERWRITE_IF but they really are
3603 * different. FILE_SUPERSEDE deletes an existing file
3604 * (requiring delete access) then recreates it.
3605 */
3610 /*
3611 * If file exists replace/overwrite. If file doesn't
3612 * exist create.
3613 */
3618 /*
3619 * If file exists open. If file doesn't exist error.
3620 */
3625 /*
3626 * If file exists overwrite. If file doesn't exist
3627 * error.
3628 */
3633 /*
3634 * If file exists error. If file doesn't exist create.
3635 */
3640 /*
3641 * If file exists open. If file doesn't exist create.
3642 */
3645 }
3647 }
3651 {
3654 /*
3655 * Note that we ignore the append flag as append does not
3656 * mean the same thing under DOS and Unix.
3657 */
3662 }
3664 /* DENY_DOS opens are always underlying read-write on the
3665 file handle, no matter what the requested access mask
3666 says. */
3668 need_read =
3675 }
3677 }
3691 NTSTATUS status;
3693 share_mode_entry_prepare_unlock_fn_t cleanup_fn;
3694 };
3699 {
3703 /*
3704 * By default drop the g_lock again if we leave the
3705 * tdb chainlock.
3706 */
3711 lck,
3720 }
3724 /*
3725 * keep the g_lock while existing the tdb chainlock,
3726 * we we're asked to, which mean we'll keep
3727 * the share_mode_lock during object creation,
3728 * or setting delete on close.
3729 */
3731 }
3735 {
3744 }
3745 }
3749 {
3758 }
3759 }
3761 /****************************************************************************
3762 Open a file with a share mode. Passed in an already created files_struct *.
3763 ****************************************************************************/
3774 /* Information (FILE_EXISTS etc.) */
3780 {
3797 NTSTATUS status;
3801 NTSTATUS ulstatus;
3804 /*
3805 * Printers are handled completely differently.
3806 * Most of the passed parameters are ignored.
3807 */
3811 }
3820 }
3824 }
3831 /* Windows allows a new file to be created and
3832 silently removes a FILE_ATTRIBUTE_DIRECTORY
3833 sent by the client. Do the same. */
3837 /* We add FILE_ATTRIBUTE_ARCHIVE to this as this mode is only used if the file is
3838 * created new. */
3840 conn,
3842 smb_fname,
3844 }
3847 "access_mask=0x%x share_access=0x%x "
3848 "create_disposition = 0x%x create_options=0x%x "
3856 /* Ensure req == NULL means INTERNAL_OPEN_ONLY */
3859 /* And req != NULL means no INTERNAL_OPEN_ONLY */
3861 }
3863 /*
3864 * Only non-internal opens can be deferred at all
3865 */
3871 /* If it was an async create retry, the file
3872 didn't exist. */
3877 }
3879 /* Ensure we don't reprocess this message. */
3883 }
3884 }
3889 /*
3890 * Only use stored DOS attributes for checks
3891 * against requested attributes (below via
3892 * open_match_attributes()), cf bug #11992
3893 * for details. -slow
3894 */
3900 }
3901 }
3902 }
3904 /* ignore any oplock requests if oplocks are disabled */
3907 /* Mask off everything except the private Samba bits. */
3909 }
3911 /* this is for OS/2 long file names - say we don't support them */
3914 /* OS/2 Workplace shell fix may be main code stream in a later
3915 * release. */
3920 }
3922 }
3926 /* If file exists open. If file doesn't exist error. */
3929 "requested for file %s and file "
3933 }
3937 /* If file exists overwrite. If file doesn't exist
3938 * error. */
3941 "requested for file %s and file "
3945 }
3949 /* If file exists error. If file doesn't exist
3950 * create. */
3953 "requested for file %s and file "
3958 }
3960 }
3969 }
3973 /* We only care about matching attributes on file exists and
3974 * overwrite. */
3980 new_dos_attributes,
3985 existing_dos_attributes,
3986 new_dos_attributes,
3990 }
3991 }
3996 access_mask,
4004 }
4010 }
4013 /*
4014 * stat opens on existing files don't get oplocks.
4015 * They can get leases.
4016 *
4017 * Note that we check for stat open on the *open_access_mask*,
4018 * i.e. the access mask we actually used to do the open,
4019 * not the one the client asked for (which is in
4020 * fsp->access_mask). This is due to the fact that
4021 * FILE_OVERWRITE and FILE_OVERWRITE_IF add in O_TRUNC,
4022 * which adds FILE_WRITE_DATA to open_access_mask.
4023 */
4026 }
4027 }
4031 access_mask));
4033 /*
4034 * Note that we ignore the append flag as append does not
4035 * mean the same thing under DOS and Unix.
4036 */
4040 /*
4041 * Currently we only look at FILE_WRITE_THROUGH for create options.
4042 */
4044 #if defined(O_SYNC)
4047 }
4052 }
4055 /*
4056 * We should really return a permission denied error if either
4057 * O_CREAT or O_TRUNC are set, but for compatibility with
4058 * older versions of Samba we just AND them out.
4059 */
4061 }
4063 /*
4064 * With kernel oplocks the open breaking an oplock
4065 * blocks until the oplock holder has given up the
4066 * oplock or closed the file. We prevent this by always
4067 * trying to open the file with O_NONBLOCK (see "man
4068 * fcntl" on Linux).
4069 *
4070 * If a process that doesn't use the smbd open files
4071 * database or communication methods holds a kernel
4072 * oplock we must periodically poll for available open
4073 * using O_NONBLOCK.
4074 */
4077 /*
4078 * Ensure we can't write on a read-only share or file.
4079 */
4088 }
4091 /*
4092 * Only try and create a file id before open
4093 * for an existing file. For a file being created
4094 * this won't do anything useful until the file
4095 * exists and has a valid stat struct.
4096 */
4098 }
4101 * requested access_mask after
4102 * the open is done. */
4105 }
4110 /* Delete on close semantics for new files. */
4112 new_dos_attributes);
4116 }
4117 }
4119 /*
4120 * Ensure we pay attention to default ACLs on directories if required.
4121 */
4125 {
4127 }
4137 smb_fname_atname,
4138 fsp,
4140 unx_mode,
4141 access_mask,
4142 open_access_mask,
4143 private_flags,
4149 }
4153 }
4154 /*
4155 * This handles the kernel oplock case:
4156 *
4157 * the file has an active kernel oplock and the open() returned
4158 * EWOULDBLOCK/EAGAIN which maps to NETWORK_BUSY.
4159 *
4160 * "Samba locking.tdb oplocks" are handled below after acquiring
4161 * the sharemode lock with get_share_mode_lock().
4162 */
4164 }
4167 /*
4168 * EINTR from the open(2) syscall. Just setup a retry
4169 * in a bit. We can't use the sys_write() tight retry
4170 * loop here, as we might have to actually deal with
4171 * lease-break signals to avoid a deadlock.
4172 */
4174 }
4177 /*
4178 * Retry once a second. If there's a share_mode_lock
4179 * around, also wait for it in case it was smbd
4180 * holding that kernel oplock that can quickly tell us
4181 * the oplock got removed.
4182 */
4185 req,
4191 }
4198 }
4200 }
4203 /*
4204 * As we atomically create using O_CREAT|O_EXCL,
4205 * then if new_file_created is true, then
4206 * file_existed *MUST* have been false (even
4207 * if the file was previously detected as being
4208 * there).
4209 */
4211 }
4214 /*
4215 * The file did exist, but some other (local or NFS)
4216 * process either renamed/unlinked and re-created the
4217 * file with different dev/ino after we walked the path,
4218 * but before we did the open. We could retry the
4219 * open but it's a rare enough case it's easier to
4220 * just fail the open to prevent creating any problems
4221 * in the open file db having the wrong dev/ino key.
4222 */
4225 "Old (dev=%ju, ino=%ju). "
4226 "New (dev=%ju, ino=%ju). Failing open "
4234 }
4238 /*
4239 * Deal with the race condition where two smbd's detect the
4240 * file doesn't exist and do the create at the same time. One
4241 * of them will win and set a share mode, the other (ie. this
4242 * one) should check if the requested share mode for this
4243 * create is allowed.
4244 */
4246 /*
4247 * Now the file exists and fsp is successfully opened,
4248 * fsp->dev and fsp->inode are valid and should replace the
4249 * dev=0,inode=0 from a non existent file. Spotted by
4250 * Nadav Danieli <nadavd@exanet.com>. JRA.
4251 */
4260 }
4261 }
4263 /*
4264 * If we created a new file, overwrite an existing one
4265 * or going to delete it later, we should keep
4266 * the share_mode_lock (g_lock) until we call
4267 * share_mode_entry_prepare_unlock()
4268 */
4273 }
4286 };
4291 smb_fname,
4293 open_ntcreate_lock_add_entry,
4300 }
4306 }
4308 /*
4309 * From here we need to use 'goto unlock;' instead of return !!!
4310 */
4313 /*
4314 * Now ask for kernel oplocks
4315 * and cleanup on failure.
4316 */
4319 /*
4320 * Could not get the kernel oplock
4321 */
4323 open_ntcreate_lock_cleanup_oplock;
4325 }
4326 }
4328 /* Should we atomically (to the client at least) truncate ? */
4338 open_ntcreate_lock_cleanup_entry;
4340 }
4342 FILE_NOTIFY_CHANGE_SIZE
4345 }
4347 /*
4348 * We have the share entry *locked*.....
4349 */
4351 /* Delete streams if create_disposition requires it */
4358 open_ntcreate_lock_cleanup_entry;
4360 }
4361 }
4366 {
4368 /*
4369 * Beware: streams implementing VFS modules may
4370 * implement streams in a way that fsp will have the
4371 * basefile open in the fsp fd, so lacking a distinct
4372 * fd for the stream the file-system sharemode will
4373 * apply on the basefile which is wrong. The actual
4374 * check is deferred to the VFS module implementing
4375 * the file-system sharemode call.
4376 */
4378 share_access,
4379 access_mask);
4383 open_ntcreate_lock_cleanup_entry;
4385 }
4388 }
4390 /*
4391 * At this point onwards, we can guarantee that the share entry
4392 * is locked, whether we created the file or not, and that the
4393 * deny mode is compatible with all current opens.
4394 */
4396 /*
4397 * According to Samba4, SEC_FILE_READ_ATTRIBUTE is always granted,
4398 * but we don't have to store this - just ignore it on access check.
4399 */
4401 /*
4402 * SMB2 doesn't return it (according to Microsoft tests).
4403 * Test Case: TestSuite_ScenarioNo009GrantedAccessTestS0
4404 * File created with access = 0x7 (Read, Write, Delete)
4405 * Query Info on file returns 0x87 (Read, Write, Delete, Read Attributes)
4406 */
4409 /* But SMB1 does. */
4411 }
4415 }
4417 /* Handle strange delete on close create semantics. */
4421 existing_dos_attributes);
4424 /* Remember to delete the mode we just added. */
4426 open_ntcreate_lock_cleanup_entry;
4428 }
4429 }
4430 /* Note that here we set the *initial* delete on close flag,
4431 not the regular one. The magic gets handled in close. */
4433 }
4436 /* Overwritten files should be initially set as archive */
4445 }
4446 }
4447 }
4448 }
4450 /* Determine sparse flag. */
4452 /* POSIX opens are sparse by default. */
4457 }
4459 /*
4460 * Take care of inherited ACLs on created files - if default ACL not
4461 * selected.
4462 */
4472 }
4473 }
4476 /*
4477 * We only get here in the case of:
4478 *
4479 * a). Not a POSIX open.
4480 * b). File already existed.
4481 * c). File was overwritten.
4482 * d). Requested DOS attributes didn't match
4483 * the DOS attributes on the existing file.
4484 *
4485 * In that case new_unx_mode has been set
4486 * equal to the calculated mode (including
4487 * possible inheritance of the mode from the
4488 * containing directory).
4489 *
4490 * Note this mode was calculated with the
4491 * DOS attribute FILE_ATTRIBUTE_ARCHIVE added,
4492 * so the mode change here is suitable for
4493 * an overwritten file.
4494 */
4503 }
4504 }
4505 }
4507 /*
4508 * Deal with other opens having a modified write time.
4509 */
4512 {
4514 }
4518 unlock:
4526 }
4531 }
4534 }
4542 {
4545 mode_t mode;
4546 NTSTATUS status;
4557 }
4564 FILE_ATTRIBUTE_DIRECTORY,
4565 smb_dname,
4567 }
4577 }
4582 }
4583 }
4587 smb_fname_atname,
4588 mode);
4591 }
4593 /*
4594 * Make this a pathref fsp for now. open_directory() will reopen as a
4595 * full fsp.
4596 */
4602 }
4604 /* Ensure we're checking for a symlink here.... */
4605 /* We don't want to get caught by a symlink racer. */
4612 }
4618 }
4622 smb_dname,
4624 parent_dir_fname,
4626 }
4632 }
4635 /*
4636 * Check if high bits should have been set,
4637 * then (if bits are missing): add them.
4638 * Consider bits automagically set by UNIX, i.e. SGID bit from parent
4639 * dir.
4640 */
4647 }
4648 }
4650 /* Change the owner if required. */
4653 fsp);
4655 }
4663 }
4664 }
4670 }
4672 /****************************************************************************
4673 Open a directory from an NT SMB call.
4674 ****************************************************************************/
4687 {
4692 NTSTATUS status;
4696 NTSTATUS ulstatus;
4702 }
4705 /* Ensure we have a directory attribute. */
4707 }
4714 access_mask,
4715 share_access,
4716 create_options,
4717 create_disposition,
4718 file_attributes);
4723 access_mask,
4731 }
4735 SEC_PRIV_SECURITY)) {
4740 }
4747 }
4754 /* If directory exists error. If directory doesn't
4755 * exist create. */
4764 }
4767 parent_dir_fname,
4768 smb_fname_atname,
4769 smb_dname,
4770 file_attributes,
4771 fsp);
4779 }
4785 /*
4786 * If directory exists open. If directory doesn't
4787 * exist create.
4788 */
4795 parent_dir_fname,
4796 smb_fname_atname,
4797 smb_dname,
4798 file_attributes,
4799 fsp);
4804 /* Cope with create race. */
4806 NT_STATUS_OBJECT_NAME_COLLISION)) {
4812 }
4814 /*
4815 * If mkdir_internal() returned
4816 * NT_STATUS_OBJECT_NAME_COLLISION
4817 * we still must lstat the path.
4818 */
4823 "directory '%s' just "
4826 smb_dname),
4829 errno);
4830 }
4833 }
4834 }
4847 }
4853 }
4855 /*
4856 * Setup the files_struct for it.
4857 */
4867 /*
4868 * According to Samba4, SEC_FILE_READ_ATTRIBUTE is always granted,
4869 */
4878 }
4880 /* Don't store old timestamps for directory
4881 handles in the internal database. We don't
4882 update them in there if new objects
4883 are created in the directory. Currently
4884 we only update timestamps on file writes.
4885 See bug #9870.
4886 */
4889 /*
4890 * Obviously for FILE_LIST_DIRECTORY we need to reopen to get an fd
4891 * usable for reading a directory. SMB2_FLUSH may be called on
4892 * directories opened with FILE_ADD_FILE and FILE_ADD_SUBDIRECTORY so
4893 * for those we need to reopen as well.
4894 */
4895 need_fd_access =
4896 FILE_LIST_DIRECTORY |
4897 FILE_ADD_FILE |
4898 FILE_ADD_SUBDIRECTORY;
4904 fsp,
4907 NULL);
4913 }
4914 }
4920 }
4927 }
4929 /* Ensure there was no race condition. We need to check
4930 * dev/inode but not permissions, as these can change
4931 * legitimately */
4938 }
4942 fsp,
4944 access_mask);
4952 }
4953 }
4955 /*
4956 * If we created a new directory or going to delete it later,
4957 * we should keep * the share_mode_lock (g_lock) until we call
4958 * share_mode_entry_prepare_unlock()
4959 */
4964 }
4977 };
4982 smb_dname,
4984 open_ntcreate_lock_add_entry,
4991 }
4997 }
4999 /*
5000 * From here we need to use 'goto unlock;' instead of return !!!
5001 */
5003 /* For directories the delete on close bit at open time seems
5004 always to be honored on close... See test 19 in Samba4 BASE-DELETE. */
5009 open_ntcreate_lock_cleanup_entry;
5011 }
5014 /* Note that here we set the *initial* delete on close flag,
5015 not the regular one. The magic gets handled in close. */
5017 }
5018 }
5020 /*
5021 * Deal with other opens having a modified write time.
5022 */
5025 }
5029 }
5033 unlock:
5041 }
5046 }
5049 }
5055 {
5056 NTSTATUS status;
5081 }
5084 }
5086 /****************************************************************************
5087 Receive notification that one of our open files has been renamed by another
5088 smbd process.
5089 ****************************************************************************/
5096 {
5109 }
5112 data,
5113 msg,
5114 msg,
5120 }
5126 }
5128 /* stream_name must always be NULL if there is no stream. */
5131 }
5136 NULL,
5142 }
5148 }
5151 SMB_STRUCT_STAT fsp_orig_sbuf;
5152 NTSTATUS status;
5158 /*
5159 * The incoming smb_fname here has an
5160 * invalid stat struct from synthetic_smb_fname()
5161 * above.
5162 * Preserve the existing stat from the
5163 * open fsp after fsp_set_smb_fname()
5164 * overwrites with the invalid stat.
5165 *
5166 * (We could just copy this into
5167 * smb_fname->st, but keep this code
5168 * identical to the fix in rename_open_files()
5169 * for clarity.
5170 *
5171 * We will do an fstat before returning
5172 * any of this metadata to the client anyway.
5173 */
5179 }
5182 /* TODO. JRA. */
5183 /*
5184 * Now we have the complete path we can work out if
5185 * this is actually within this share and adjust
5186 * newname accordingly.
5187 */
5195 }
5196 out:
5198 }
5200 /*
5201 * If a main file is opened for delete, all streams need to be checked for
5202 * !FILE_SHARE_DELETE. Do this by opening with DELETE_ACCESS.
5203 * If that works, delete them all by setting the delete on close and close.
5204 */
5208 {
5215 NTSTATUS status;
5222 NULL,
5223 NULL,
5230 NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
5234 }
5238 }
5242 }
5251 }
5257 }
5260 num_streams));
5265 }
5272 }
5280 }
5285 NULL,
5292 }
5301 }
5331 }
5333 }
5335 /*
5336 * don't touch the variable "status" beyond this point :-)
5337 */
5342 }
5347 }
5349 fail:
5352 }
5354 /*********************************************************************
5355 Create a default ACL by inheriting from the parent. If no inheritance
5356 from the parent available, don't set anything. This will leave the actual
5357 permissions the new file or directory already got from the filesystem
5358 as the NT ACL when read.
5359 *********************************************************************/
5362 {
5385 frame,
5390 }
5397 /* Nothing to inherit and not setting owner. */
5399 }
5401 /* Create an inherited descriptor from the parent. */
5407 }
5409 /* Inherit from parent descriptor if "inherit owner" set. */
5413 }
5421 }
5422 }
5426 {
5430 }
5431 }
5451 }
5452 }
5453 }
5473 }
5474 }
5475 }
5479 }
5483 }
5487 }
5491 }
5495 }
5501 }
5502 }
5507 parent_desc,
5508 owner_sid,
5509 group_sid,
5514 }
5516 /* If inheritable_components == false,
5517 se_create_child_secdesc()
5518 creates a security descriptor with a NULL dacl
5519 entry, but with SEC_DESC_DACL_PRESENT. We need
5520 to remove that flag. */
5525 }
5531 }
5534 /* We need to be root to force this. */
5536 }
5538 security_info_sent,
5539 psd);
5542 }
5545 }
5547 /*
5548 * If we already have a lease, it must match the new file id. [MS-SMB2]
5549 * 3.3.5.9.8 speaks about INVALID_PARAMETER if an already used lease key is
5550 * used for a different file name.
5551 */
5554 /* Input parameters. */
5560 /* Return parameters. */
5563 NTSTATUS match_status;
5564 };
5566 /*************************************************************
5567 File doesn't exist but this lease key+guid is already in use.
5569 This is only allowable in the dynamic share case where the
5570 service path must be different.
5572 There is a small race condition here in the multi-connection
5573 case where a client sends two create calls on different connections,
5574 where the file doesn't exist and one smbd creates the leases_db
5575 entry first, but this will get fixed by the multichannel cleanup
5576 when all identical client_guids get handled by a single smbd.
5577 **************************************************************/
5583 {
5591 }
5592 }
5594 /* Dynamic share case. Break leases on all other files. */
5596 num_files,
5597 files,
5601 }
5606 }
5612 {
5618 /*
5619 * Deal with name mismatch or
5620 * possible dynamic share case separately
5621 * to make code clearer.
5622 */
5624 files,
5625 state);
5627 }
5629 /* File existed. */
5635 /* Everything should be the same. */
5637 /*
5638 * The client asked for a lease on a
5639 * file that doesn't match the file_id
5640 * in the database.
5641 *
5642 * Maybe this is a dynamic share, i.e.
5643 * a share where the servicepath is
5644 * different for different users (e.g.
5645 * the [HOMES] share.
5646 *
5647 * If the servicepath is different, but the requested
5648 * file name + stream name is the same then this is
5649 * a dynamic share, the client is using the same share
5650 * name and doesn't know that the underlying servicepath
5651 * is different. It was expecting a lease on the
5652 * same file. Return NT_STATUS_OPLOCK_NOT_GRANTED
5653 * to break leases
5654 *
5655 * Otherwise the client has messed up, or is
5656 * testing our error codes, so return
5657 * NT_STATUS_INVALID_PARAMETER.
5658 */
5662 {
5663 /*
5664 * Name is the same but servicepath is
5665 * different, dynamic share. Break leases.
5666 */
5668 NT_STATUS_OPLOCK_NOT_GRANTED;
5671 NT_STATUS_INVALID_PARAMETER;
5672 }
5674 }
5678 }
5682 }
5686 }
5687 }
5690 /*
5691 * Common case - just opening another handle on a
5692 * file on a non-dynamic share.
5693 */
5695 }
5698 /* Mismatched path. Error back to client. */
5700 }
5702 /*
5703 * File id mismatch. Dynamic share case NT_STATUS_OPLOCK_NOT_GRANTED.
5704 * Don't allow leases.
5705 */
5708 num_files,
5709 files,
5713 }
5718 }
5728 };
5733 {
5737 NTSTATUS status;
5742 }
5747 }
5765 }
5769 }
5772 /*
5773 * Windows 7 and 8 lease clients are broken in that they will
5774 * not respond to lease break requests whilst waiting for an
5775 * outstanding open request on that lease handle on the same
5776 * TCP connection, due to holding an internal inode lock.
5777 *
5778 * This means we can't reschedule ourselves here, but must
5779 * return from the create.
5780 *
5781 * Work around:
5782 *
5783 * Send the breaks and then return SMB2_LEASE_NONE in the
5784 * lease handle to cause them to acknowledge the lease
5785 * break. Consultation with Microsoft engineering confirmed
5786 * this approach is safe.
5787 */
5790 }
5794 {
5800 }
5801 }
5810 {
5818 };
5820 NTSTATUS status;
5825 }
5830 /*
5831 * Not found or error means okay: We can make the lease pass
5832 */
5834 }
5836 /*
5837 * Anything but NT_STATUS_OPLOCK_NOT_GRANTED, let the caller
5838 * deal with it.
5839 */
5841 }
5843 /* We have to break all existing leases. */
5848 };
5851 /* Don't need to break our own file. */
5853 }
5858 lease_match_fid_fn,
5861 /* Race condition - file already closed. */
5863 }
5868 }
5869 }
5870 /*
5871 * Ensure we don't grant anything more so we
5872 * never upgrade.
5873 */
5875 }
5877 /*
5878 * Wrapper around open_file_ntcreate and open_directory
5879 */
5899 {
5905 NTSTATUS status;
5917 "ea_list = %p, "
5918 "sd = %p, "
5920 access_mask,
5921 file_attributes,
5922 share_access,
5923 create_disposition,
5924 create_options,
5925 oplock_request,
5926 private_flags,
5927 ea_list,
5928 sd,
5934 }
5939 }
5943 }
5953 }
5956 req,
5959 smb_fname,
5963 /* Dynamic share file. No leases and update epoch... */
5971 }
5972 }
5977 /*
5978 * We can't open a file with DELETE access if any of the
5979 * streams is open without FILE_SHARE_DELETE
5980 */
5985 }
5986 }
5992 SEC_PRIV_SECURITY);
5999 }
6003 {
6004 /*
6005 * No other bits set. Windows SMB2 refuses this.
6006 * See smbtorture3 SMB2-SACL test.
6007 *
6008 * Note this is an SMB2-only behavior,
6009 * smbtorture3 SMB1-SYSTEM-SECURITY already tests
6010 * that SMB1 allows this.
6011 */
6014 }
6015 }
6017 /*
6018 * Files or directories can't be opened DELETE_ON_CLOSE without
6019 * delete access.
6020 * BUG: https://bugzilla.samba.org/show_bug.cgi?id=13358
6021 */
6026 }
6027 }
6031 {
6040 }
6049 }
6057 }
6059 /*
6060 * We may be creating the basefile as part of creating the
6061 * stream, so it's legal if the basefile doesn't exist at this
6062 * point, the create_file_unixpath() below will create it. But
6063 * if the basefile exists we want a handle so we can fstat() it.
6064 */
6071 }
6074 smb_fname_base);
6081 }
6083 /*
6084 * https://bugzilla.samba.org/show_bug.cgi?id=10229
6085 * We need to check if the requested access mask
6086 * could be used to open the underlying file (if
6087 * it existed), as we're passing in zero for the
6088 * access mask to the base filename.
6089 */
6091 access_mask);
6095 "for base %s failed: "
6100 }
6101 }
6105 /* Open the base file. */
6107 NULL,
6108 dirfsp,
6109 smb_fname_base,
6111 FILE_SHARE_READ
6112 | FILE_SHARE_WRITE
6114 base_create_disposition,
6118 NULL,
6120 base_privflags,
6121 NULL,
6122 NULL,
6124 NULL);
6132 }
6133 }
6139 /*
6140 * We're about to use smb_fname->fsp for the fresh open.
6141 *
6142 * Every fsp passed in via smb_fname->fsp already
6143 * holds a fsp->fsp_name. If it is already this
6144 * fsp->fsp_name that we got passed in as our input
6145 * argument smb_fname, these two are assumed to have
6146 * the same lifetime: Every fsp hangs of "conn", and
6147 * fsp->fsp_name is its talloc child.
6148 */
6151 /*
6152 * "smb_fname" is temporary in this case, but
6153 * the destructor of smb_fname would also tear
6154 * down the fsp we're about to use. Unlink
6155 * them from each other.
6156 */
6159 /*
6160 * "fsp" is ours now
6161 */
6163 }
6168 }
6177 }
6179 /*
6180 * No fsp passed in that we can use, create one
6181 */
6185 }
6191 }
6192 }
6198 /*
6199 * We're opening the stream element of a
6200 * base_fsp we already opened. Set up the
6201 * base_fsp pointer.
6202 */
6204 }
6208 conn,
6210 smb_fname,
6215 }
6217 /*
6218 * Get a pathref on the parent. We can re-use this for
6219 * multiple calls to check parent ACLs etc. to avoid
6220 * pathname calls.
6221 */
6224 smb_fname,
6229 }
6235 }
6236 }
6238 /*
6239 * If it's a request for a directory open, deal with it separately.
6240 */
6247 }
6249 /* Can't open a temp directory. IFS kit test. */
6254 }
6256 /*
6257 * We will get a create directory here if the Win32
6258 * app specified a security descriptor in the
6259 * CreateDirectory() call.
6260 */
6264 req,
6265 access_mask,
6266 share_access,
6267 create_disposition,
6268 create_options,
6269 file_attributes,
6271 smb_fname_atname,
6273 fsp);
6276 /*
6277 * Ordinary file case.
6278 */
6282 allocation_size);
6283 }
6286 req,
6287 access_mask,
6288 share_access,
6289 create_disposition,
6290 create_options,
6291 file_attributes,
6292 oplock_request,
6293 lease,
6294 private_flags,
6296 smb_fname_atname,
6298 fsp);
6301 /* A stream open never opens a directory */
6306 }
6308 /*
6309 * Fail the open if it was explicitly a non-directory
6310 * file.
6311 */
6316 }
6320 req,
6321 access_mask,
6322 share_access,
6323 create_disposition,
6324 create_options,
6325 file_attributes,
6327 smb_fname_atname,
6329 fsp);
6330 }
6331 }
6335 }
6344 }
6345 }
6349 {
6352 }
6354 /* Save the requested allocation size. */
6358 {
6365 }
6369 }
6372 }
6378 /*
6379 * According to the MS documentation, the only time the security
6380 * descriptor is applied to the opened file is iff we *created* the
6381 * file; an existing file stays the same.
6382 *
6383 * Also, it seems (from observation) that you can open the file with
6384 * any access mask but you can still write the sd. We need to override
6385 * the granted access before we call set_sd
6386 * Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
6387 */
6397 SECINFO_GROUP|
6398 SECINFO_DACL|
6399 SECINFO_SACL)) {
6401 }
6407 }
6409 /* Inherit from parent. Errors here are not fatal. */
6415 }
6416 }
6417 }
6423 COMPRESSION_FORMAT_NONE);
6427 }
6428 }
6435 }
6443 fail:
6447 /*
6448 * The close_file below will close
6449 * fsp->base_fsp.
6450 */
6456 }
6457 }
6460 }
6465 }
6486 {
6489 NTSTATUS status;
6494 "file_attributes = 0x%x, share_access = 0x%x, "
6495 "create_disposition = 0x%x create_options = 0x%x "
6496 "oplock_request = 0x%x "
6497 "private_flags = 0x%x "
6498 "ea_list = %p, sd = %p, "
6507 ea_list,
6508 sd,
6512 /*
6513 * Remember the absolute time of the original request
6514 * with this mid. We'll use it later to see if this
6515 * has timed out.
6516 */
6518 }
6520 /*
6521 * Check to see if this is a mac fork of some kind.
6522 */
6532 /*
6533 * Here we go! support for changing the disk quotas
6534 * --metze
6535 *
6536 * We need to fake up to open this MAGIC QUOTA file
6537 * and return a valid FID.
6538 *
6539 * w2k close this file directly after openening xp
6540 * also tries a QUERY_FILE_INFO on the file and then
6541 * close it
6542 */
6548 }
6552 }
6557 }
6558 }
6562 /* We have to handle this error here. */
6566 }
6571 }
6572 }
6587 }
6594 }
6595 /*
6596 * Remove type info from mode, leaving only the
6597 * permissions and setuid/gid bits.
6598 */
6602 }
6605 req,
6606 dirfsp,
6607 smb_fname,
6608 access_mask,
6609 share_access,
6610 create_disposition,
6611 create_options,
6612 file_attributes,
6613 oplock_request,
6614 lease,
6615 allocation_size,
6616 private_flags,
6617 sd,
6618 ea_list,
6623 }
6625 done:
6631 }
6634 fail:
6639 }
6641 }