2 Unix SMB/CIFS implementation.
3 file opening and share modes
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Jeremy Allison 2001-2004
6 Copyright (C) Volker Lendecke 2005
7 Copyright (C) Ralph Boehme 2017
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "system/filesys.h"
25 #include "lib/util/server_id.h"
27 #include "locking/share_mode_lock.h"
28 #include "smbd/smbd.h"
29 #include "smbd/globals.h"
30 #include "fake_file.h"
31 #include "../libcli/security/security.h"
32 #include "../librpc/gen_ndr/ndr_security.h"
33 #include "../librpc/gen_ndr/ndr_open_files.h"
34 #include "../librpc/gen_ndr/idmap.h"
35 #include "../librpc/gen_ndr/ioctl.h"
36 #include "passdb/lookup_sid.h"
40 #include "source3/lib/dbwrap/dbwrap_watch.h"
41 #include "locking/leases_db.h"
42 #include "librpc/gen_ndr/ndr_leases_db.h"
43 #include "lib/util/time_basic.h"
45 extern const struct generic_mapping file_generic_mapping
;
47 struct deferred_open_record
{
48 struct smbXsrv_connection
*xconn
;
54 * Timer for async opens, needed because they don't use a watch on
55 * a locking.tdb record. This is currently only used for real async
56 * opens and just terminates smbd if the async open times out.
58 struct tevent_timer
*te
;
61 * For the samba kernel oplock case we use both a timeout and
62 * a watch on locking.tdb. This way in case it's smbd holding
63 * the kernel oplock we get directly notified for the retry
64 * once the kernel oplock is properly broken. Store the req
65 * here so that it can be timely discarded once the timer
68 struct tevent_req
*watch_req
;
71 /****************************************************************************
72 If the requester wanted DELETE_ACCESS and was rejected because
73 the file ACL didn't include DELETE_ACCESS, see if the parent ACL
75 ****************************************************************************/
77 static bool parent_override_delete(connection_struct
*conn
,
78 struct files_struct
*dirfsp
,
79 const struct smb_filename
*smb_fname
,
81 uint32_t rejected_mask
)
83 if ((access_mask
& DELETE_ACCESS
) &&
84 (rejected_mask
& DELETE_ACCESS
) &&
85 can_delete_file_in_directory(conn
,
94 /****************************************************************************
95 Check if we have open rights.
96 ****************************************************************************/
98 static NTSTATUS
smbd_check_access_rights_fname(
99 struct connection_struct
*conn
,
100 const struct smb_filename
*smb_fname
,
102 uint32_t access_mask
,
103 uint32_t do_not_check_mask
)
105 uint32_t rejected_share_access
;
106 uint32_t effective_access
;
108 rejected_share_access
= access_mask
& ~(conn
->share_access
);
110 if (rejected_share_access
) {
111 DBG_DEBUG("rejected share access 0x%"PRIx32
" on "
112 "%s (0x%"PRIx32
")\n",
114 smb_fname_str_dbg(smb_fname
),
115 rejected_share_access
);
116 return NT_STATUS_ACCESS_DENIED
;
119 effective_access
= access_mask
& ~do_not_check_mask
;
120 if (effective_access
== 0) {
121 DBG_DEBUG("do_not_check_mask override on %s. Granting 0x%x for free.\n",
122 smb_fname_str_dbg(smb_fname
),
123 (unsigned int)access_mask
);
127 if (!use_privs
&& get_current_uid(conn
) == (uid_t
)0) {
128 /* I'm sorry sir, I didn't know you were root... */
129 DBG_DEBUG("root override on %s. Granting 0x%x\n",
130 smb_fname_str_dbg(smb_fname
),
131 (unsigned int)access_mask
);
135 if ((access_mask
& DELETE_ACCESS
) &&
136 !lp_acl_check_permissions(SNUM(conn
)))
138 DBG_DEBUG("Not checking ACL on DELETE_ACCESS on file %s. "
139 "Granting 0x%"PRIx32
"\n",
140 smb_fname_str_dbg(smb_fname
),
145 if (access_mask
== DELETE_ACCESS
&&
146 VALID_STAT(smb_fname
->st
) &&
147 S_ISLNK(smb_fname
->st
.st_ex_mode
))
149 /* We can always delete a symlink. */
150 DBG_DEBUG("Not checking ACL on DELETE_ACCESS on symlink %s.\n",
151 smb_fname_str_dbg(smb_fname
));
155 return NT_STATUS_MORE_PROCESSING_REQUIRED
;
158 static NTSTATUS
smbd_check_access_rights_sd(
159 struct connection_struct
*conn
,
160 struct files_struct
*dirfsp
,
161 const struct smb_filename
*smb_fname
,
162 struct security_descriptor
*sd
,
164 uint32_t access_mask
,
165 uint32_t do_not_check_mask
)
167 uint32_t rejected_mask
= access_mask
;
174 status
= se_file_access_check(sd
,
175 get_current_nttok(conn
),
177 (access_mask
& ~do_not_check_mask
),
180 DBG_DEBUG("File [%s] requesting [0x%"PRIx32
"] "
181 "returning [0x%"PRIx32
"] (%s)\n",
182 smb_fname_str_dbg(smb_fname
),
187 if (!NT_STATUS_IS_OK(status
)) {
188 if (DEBUGLEVEL
>= 10) {
189 DBG_DEBUG("acl for %s is:\n",
190 smb_fname_str_dbg(smb_fname
));
191 NDR_PRINT_DEBUG(security_descriptor
, sd
);
197 if (NT_STATUS_IS_OK(status
) ||
198 !NT_STATUS_EQUAL(status
, NT_STATUS_ACCESS_DENIED
))
203 /* Here we know status == NT_STATUS_ACCESS_DENIED. */
207 if ((access_mask
& FILE_WRITE_ATTRIBUTES
) &&
208 (rejected_mask
& FILE_WRITE_ATTRIBUTES
) &&
209 !lp_store_dos_attributes(SNUM(conn
)) &&
210 (lp_map_readonly(SNUM(conn
)) ||
211 lp_map_archive(SNUM(conn
)) ||
212 lp_map_hidden(SNUM(conn
)) ||
213 lp_map_system(SNUM(conn
))))
215 rejected_mask
&= ~FILE_WRITE_ATTRIBUTES
;
217 DBG_DEBUG("overrode FILE_WRITE_ATTRIBUTES on file %s\n",
218 smb_fname_str_dbg(smb_fname
));
221 if (parent_override_delete(conn
,
228 * Were we trying to do an open for delete and didn't get DELETE
229 * access. Check if the directory allows DELETE_CHILD.
231 * http://blogs.msdn.com/oldnewthing/archive/2004/06/04/148426.aspx
235 rejected_mask
&= ~DELETE_ACCESS
;
237 DBG_DEBUG("Overrode DELETE_ACCESS on file %s\n",
238 smb_fname_str_dbg(smb_fname
));
241 if (rejected_mask
!= 0) {
242 return NT_STATUS_ACCESS_DENIED
;
247 NTSTATUS
smbd_check_access_rights_fsp(struct files_struct
*dirfsp
,
248 struct files_struct
*fsp
,
250 uint32_t access_mask
)
252 struct security_descriptor
*sd
= NULL
;
253 uint32_t do_not_check_mask
= 0;
256 /* Cope with fake/printer fsp's. */
257 if (fsp
->fake_file_handle
!= NULL
|| fsp
->print_file
!= NULL
) {
258 if ((fsp
->access_mask
& access_mask
) != access_mask
) {
259 return NT_STATUS_ACCESS_DENIED
;
264 if (fsp_get_pathref_fd(fsp
) == -1) {
266 * This is a POSIX open on a symlink. For the pathname
267 * version of this function we used to return the st_mode
268 * bits turned into an NT ACL. For a symlink the mode bits
269 * are always rwxrwxrwx which means the pathname version always
270 * returned NT_STATUS_OK for a symlink. For the handle reference
271 * to a symlink use the handle access bits.
273 if ((fsp
->access_mask
& access_mask
) != access_mask
) {
274 return NT_STATUS_ACCESS_DENIED
;
280 * If we can access the path to this file, by
281 * default we have FILE_READ_ATTRIBUTES from the
282 * containing directory. See the section:
283 * "Algorithm to Check Access to an Existing File"
286 * se_file_access_check() also takes care of
287 * owner WRITE_DAC and READ_CONTROL.
289 do_not_check_mask
= FILE_READ_ATTRIBUTES
;
292 * Samba 3.6 and earlier granted execute access even
293 * if the ACL did not contain execute rights.
294 * Samba 4.0 is more correct and checks it.
295 * The compatibility mode allows one to skip this check
296 * to smoothen upgrades.
298 if (lp_acl_allow_execute_always(SNUM(fsp
->conn
))) {
299 do_not_check_mask
|= FILE_EXECUTE
;
302 status
= smbd_check_access_rights_fname(fsp
->conn
,
307 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
311 status
= SMB_VFS_FGET_NT_ACL(metadata_fsp(fsp
),
317 if (!NT_STATUS_IS_OK(status
)) {
318 DBG_DEBUG("Could not get acl on %s: %s\n",
324 return smbd_check_access_rights_sd(fsp
->conn
,
334 * Given an fsp that represents a parent directory,
335 * check if the requested access can be granted.
337 NTSTATUS
check_parent_access_fsp(struct files_struct
*fsp
,
338 uint32_t access_mask
)
341 struct security_descriptor
*parent_sd
= NULL
;
342 uint32_t access_granted
= 0;
343 struct share_mode_lock
*lck
= NULL
;
345 bool delete_on_close_set
;
346 TALLOC_CTX
*frame
= talloc_stackframe();
348 if (get_current_uid(fsp
->conn
) == (uid_t
)0) {
349 /* I'm sorry sir, I didn't know you were root... */
350 DBG_DEBUG("root override on %s. Granting 0x%x\n",
352 (unsigned int)access_mask
);
353 status
= NT_STATUS_OK
;
357 status
= SMB_VFS_FGET_NT_ACL(fsp
,
362 if (!NT_STATUS_IS_OK(status
)) {
363 DBG_INFO("SMB_VFS_FGET_NT_ACL failed for "
364 "%s with error %s\n",
371 * If we can access the path to this file, by
372 * default we have FILE_READ_ATTRIBUTES from the
373 * containing directory. See the section:
374 * "Algorithm to Check Access to an Existing File"
377 * se_file_access_check() also takes care of
378 * owner WRITE_DAC and READ_CONTROL.
380 status
= se_file_access_check(parent_sd
,
381 get_current_nttok(fsp
->conn
),
383 (access_mask
& ~FILE_READ_ATTRIBUTES
),
385 if(!NT_STATUS_IS_OK(status
)) {
386 DBG_INFO("access check "
387 "on directory %s for mask 0x%x returned (0x%x) %s\n",
395 if (!(access_mask
& (SEC_DIR_ADD_FILE
| SEC_DIR_ADD_SUBDIR
))) {
396 status
= NT_STATUS_OK
;
399 if (!lp_check_parent_directory_delete_on_close(SNUM(fsp
->conn
))) {
400 status
= NT_STATUS_OK
;
404 /* Check if the directory has delete-on-close set */
405 status
= file_name_hash(fsp
->conn
,
406 fsp
->fsp_name
->base_name
,
408 if (!NT_STATUS_IS_OK(status
)) {
413 * Don't take a lock here. We just need a snapshot
414 * of the current state of delete on close and this is
415 * called in a codepath where we may already have a lock
416 * (and we explicitly can't hold 2 locks at the same time
417 * as that may deadlock).
419 lck
= fetch_share_mode_unlocked(frame
, fsp
->file_id
);
421 status
= NT_STATUS_OK
;
425 delete_on_close_set
= is_delete_on_close_set(lck
, name_hash
);
426 if (delete_on_close_set
) {
427 status
= NT_STATUS_DELETE_PENDING
;
431 status
= NT_STATUS_OK
;
438 /****************************************************************************
439 Ensure when opening a base file for a stream open that we have permissions
440 to do so given the access mask on the base file.
441 ****************************************************************************/
443 static NTSTATUS
check_base_file_access(struct files_struct
*fsp
,
444 uint32_t access_mask
)
448 status
= smbd_calculate_access_mask_fsp(fsp
->conn
->cwd_fsp
,
453 if (!NT_STATUS_IS_OK(status
)) {
454 DEBUG(10, ("smbd_calculate_access_mask "
455 "on file %s returned %s\n",
461 if (access_mask
& (FILE_WRITE_DATA
|FILE_APPEND_DATA
)) {
463 if (!CAN_WRITE(fsp
->conn
)) {
464 return NT_STATUS_ACCESS_DENIED
;
466 dosattrs
= fdos_mode(fsp
);
467 if (dosattrs
& FILE_ATTRIBUTE_READONLY
) {
468 return NT_STATUS_ACCESS_DENIED
;
472 return smbd_check_access_rights_fsp(fsp
->conn
->cwd_fsp
,
478 static NTSTATUS
chdir_below_conn(
480 connection_struct
*conn
,
481 const char *connectpath
,
482 size_t connectpath_len
,
483 struct smb_filename
*dir_fname
,
484 struct smb_filename
**_oldwd_fname
)
486 struct smb_filename
*oldwd_fname
= NULL
;
487 struct smb_filename
*smb_fname_dot
= NULL
;
488 struct smb_filename
*real_fname
= NULL
;
489 const char *relative
= NULL
;
494 if (!ISDOT(dir_fname
->base_name
)) {
496 oldwd_fname
= vfs_GetWd(talloc_tos(), conn
);
497 if (oldwd_fname
== NULL
) {
498 status
= map_nt_error_from_unix(errno
);
502 /* Pin parent directory in place. */
503 ret
= vfs_ChDir(conn
, dir_fname
);
505 status
= map_nt_error_from_unix(errno
);
506 DBG_DEBUG("chdir to %s failed: %s\n",
507 dir_fname
->base_name
,
513 smb_fname_dot
= synthetic_smb_fname(
520 if (smb_fname_dot
== NULL
) {
521 status
= NT_STATUS_NO_MEMORY
;
525 real_fname
= SMB_VFS_REALPATH(conn
, talloc_tos(), smb_fname_dot
);
526 if (real_fname
== NULL
) {
527 status
= map_nt_error_from_unix(errno
);
528 DBG_DEBUG("realpath in %s failed: %s\n",
529 dir_fname
->base_name
,
533 TALLOC_FREE(smb_fname_dot
);
535 ok
= subdir_of(connectpath
,
537 real_fname
->base_name
,
540 TALLOC_FREE(real_fname
);
541 *_oldwd_fname
= oldwd_fname
;
545 DBG_NOTICE("Bad access attempt: %s is a symlink "
546 "outside the share path\n"
548 "resolved_name=%s\n",
549 dir_fname
->base_name
,
551 real_fname
->base_name
);
552 TALLOC_FREE(real_fname
);
554 status
= NT_STATUS_OBJECT_NAME_NOT_FOUND
;
557 if (oldwd_fname
!= NULL
) {
558 ret
= vfs_ChDir(conn
, oldwd_fname
);
559 SMB_ASSERT(ret
== 0);
560 TALLOC_FREE(oldwd_fname
);
567 * Get the symlink target of dirfsp/symlink_name, making sure the
568 * target is below connection_path.
571 static NTSTATUS
symlink_target_below_conn(
573 const char *connection_path
,
574 size_t connection_path_len
,
575 struct files_struct
*fsp
,
576 struct files_struct
*dirfsp
,
577 struct smb_filename
*symlink_name
,
581 char *absolute
= NULL
;
582 const char *relative
= NULL
;
586 if (fsp_get_pathref_fd(fsp
) != -1) {
588 * fsp is an O_PATH open, Linux does a "freadlink"
589 * with an empty name argument to readlinkat
591 status
= readlink_talloc(talloc_tos(), fsp
, NULL
, &target
);
593 status
= readlink_talloc(
594 talloc_tos(), dirfsp
, symlink_name
, &target
);
597 if (!NT_STATUS_IS_OK(status
)) {
598 DBG_DEBUG("readlink_talloc failed: %s\n", nt_errstr(status
));
602 if (target
[0] != '/') {
603 char *tmp
= talloc_asprintf(
607 dirfsp
->fsp_name
->base_name
,
613 return NT_STATUS_NO_MEMORY
;
618 DBG_DEBUG("redirecting to %s\n", target
);
620 absolute
= canonicalize_absolute_path(talloc_tos(), target
);
623 if (absolute
== NULL
) {
624 return NT_STATUS_NO_MEMORY
;
628 * We're doing the "below connection_path" here because it's
629 * cheap. It might be that we get a symlink out of the share,
630 * pointing to yet another symlink getting us back into the
631 * share. If we need that, we would have to remove the check
640 DBG_NOTICE("Bad access attempt: %s is a symlink "
641 "outside the share path\n"
643 "resolved_name=%s\n",
644 symlink_name
->base_name
,
647 TALLOC_FREE(absolute
);
648 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
651 if (relative
[0] == '\0') {
653 * special case symlink to share root: "." is our
654 * share root filename
659 memmove(absolute
, relative
, strlen(relative
)+1);
666 /****************************************************************************
668 ****************************************************************************/
670 static NTSTATUS
non_widelink_open(const struct files_struct
*dirfsp
,
672 struct smb_filename
*smb_fname
,
673 const struct vfs_open_how
*_how
)
675 struct connection_struct
*conn
= fsp
->conn
;
676 const char *connpath
= SMB_VFS_CONNECTPATH(conn
, dirfsp
, smb_fname
);
678 NTSTATUS status
= NT_STATUS_OK
;
680 char *orig_smb_fname_base
= smb_fname
->base_name
;
681 struct smb_filename
*orig_fsp_name
= fsp
->fsp_name
;
682 struct smb_filename
*smb_fname_rel
= NULL
;
683 struct smb_filename
*oldwd_fname
= NULL
;
684 struct smb_filename
*parent_dir_fname
= NULL
;
685 struct vfs_open_how how
= *_how
;
687 size_t link_depth
= 0;
690 SMB_ASSERT(!fsp_is_alternate_stream(fsp
));
692 if (connpath
== NULL
) {
694 * This can happen with shadow_copy2 if the snapshot
697 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
699 connpath_len
= strlen(connpath
);
702 if (smb_fname
->base_name
[0] == '/') {
703 int cmp
= strcmp(connpath
, smb_fname
->base_name
);
705 smb_fname
->base_name
= talloc_strdup(smb_fname
, "");
706 if (smb_fname
->base_name
== NULL
) {
707 status
= NT_STATUS_NO_MEMORY
;
713 if (dirfsp
== conn
->cwd_fsp
) {
715 status
= SMB_VFS_PARENT_PATHNAME(fsp
->conn
,
720 if (!NT_STATUS_IS_OK(status
)) {
724 status
= chdir_below_conn(
731 if (!NT_STATUS_IS_OK(status
)) {
735 /* Setup fsp->fsp_name to be relative to cwd */
736 fsp
->fsp_name
= smb_fname_rel
;
739 * fsp->fsp_name is unchanged as it is already correctly
740 * relative to conn->cwd.
742 smb_fname_rel
= smb_fname
;
747 * Assert nobody can step in with a symlink on the
748 * path, there is no path anymore and we'll use
749 * O_NOFOLLOW to open.
751 char *slash
= strchr_m(smb_fname_rel
->base_name
, '/');
752 SMB_ASSERT(slash
== NULL
);
755 how
.flags
|= O_NOFOLLOW
;
757 fd
= SMB_VFS_OPENAT(conn
,
762 fsp_set_fd(fsp
, fd
); /* This preserves errno */
765 status
= map_nt_error_from_unix(errno
);
767 if (errno
== ENOENT
) {
772 * ENOENT makes it worthless retrying with a
773 * stat, we know for sure the file does not
774 * exist. For everything else we want to know
777 ret
= SMB_VFS_FSTATAT(
782 AT_SYMLINK_NOFOLLOW
);
786 * Keep the original error. Otherwise we would
787 * mask for example EROFS for open(O_CREAT),
788 * turning it into ENOENT.
793 ret
= SMB_VFS_FSTAT(fsp
, &fsp
->fsp_name
->st
);
797 status
= map_nt_error_from_unix(errno
);
798 DBG_DEBUG("fstat[at](%s) failed: %s\n",
799 smb_fname_str_dbg(smb_fname
),
804 fsp
->fsp_flags
.is_directory
= S_ISDIR(fsp
->fsp_name
->st
.st_ex_mode
);
805 orig_fsp_name
->st
= fsp
->fsp_name
->st
;
807 if (!S_ISLNK(fsp
->fsp_name
->st
.st_ex_mode
)) {
812 * Found a symlink to follow in user space
815 if (fsp
->fsp_name
->flags
& SMB_FILENAME_POSIX_PATH
) {
816 /* Never follow symlinks on posix open. */
817 status
= NT_STATUS_STOPPED_ON_SYMLINK
;
820 if (!lp_follow_symlinks(SNUM(conn
))) {
821 /* Explicitly no symlinks. */
822 status
= NT_STATUS_STOPPED_ON_SYMLINK
;
827 if (link_depth
>= 40) {
828 status
= NT_STATUS_STOPPED_ON_SYMLINK
;
832 fsp
->fsp_name
= orig_fsp_name
;
834 status
= symlink_target_below_conn(
839 discard_const_p(files_struct
, dirfsp
),
843 if (!NT_STATUS_IS_OK(status
)) {
844 DBG_DEBUG("symlink_target_below_conn() failed: %s\n",
850 * Close what openat(O_PATH) potentially left behind
854 if (smb_fname
->base_name
!= orig_smb_fname_base
) {
855 TALLOC_FREE(smb_fname
->base_name
);
857 smb_fname
->base_name
= target
;
859 if (oldwd_fname
!= NULL
) {
860 ret
= vfs_ChDir(conn
, oldwd_fname
);
862 smb_panic("unable to get back to old directory\n");
864 TALLOC_FREE(oldwd_fname
);
868 * And do it all again... As smb_fname is not relative to the passed in
869 * dirfsp anymore, we pass conn->cwd_fsp as dirfsp to
870 * non_widelink_open() to trigger the chdir(parentdir) logic.
872 dirfsp
= conn
->cwd_fsp
;
877 fsp
->fsp_name
= orig_fsp_name
;
878 smb_fname
->base_name
= orig_smb_fname_base
;
880 TALLOC_FREE(parent_dir_fname
);
882 if (!NT_STATUS_IS_OK(status
)) {
886 if (oldwd_fname
!= NULL
) {
887 ret
= vfs_ChDir(conn
, oldwd_fname
);
889 smb_panic("unable to get back to old directory\n");
891 TALLOC_FREE(oldwd_fname
);
896 /****************************************************************************
897 fd support routines - attempt to do a dos_open.
898 ****************************************************************************/
900 NTSTATUS
fd_openat(const struct files_struct
*dirfsp
,
901 struct smb_filename
*smb_fname
,
903 const struct vfs_open_how
*_how
)
905 struct vfs_open_how how
= *_how
;
906 struct connection_struct
*conn
= fsp
->conn
;
907 NTSTATUS status
= NT_STATUS_OK
;
908 bool fsp_is_stream
= fsp_is_alternate_stream(fsp
);
909 bool smb_fname_is_stream
= is_named_stream(smb_fname
);
911 SMB_ASSERT(fsp_is_stream
== smb_fname_is_stream
);
914 * Never follow symlinks on a POSIX client. The
915 * client should be doing this.
918 if ((fsp
->posix_flags
& FSP_POSIX_FLAGS_OPEN
) || !lp_follow_symlinks(SNUM(conn
))) {
919 how
.flags
|= O_NOFOLLOW
;
927 NULL
, /* stream open is relative to fsp->base_fsp */
932 status
= map_nt_error_from_unix(errno
);
937 status
= vfs_stat_fsp(fsp
);
938 if (!NT_STATUS_IS_OK(status
)) {
939 DBG_DEBUG("vfs_stat_fsp failed: %s\n",
949 * Only follow symlinks within a share
952 status
= non_widelink_open(dirfsp
, fsp
, smb_fname
, &how
);
953 if (!NT_STATUS_IS_OK(status
)) {
954 if (NT_STATUS_EQUAL(status
, NT_STATUS_TOO_MANY_OPENED_FILES
)) {
955 static time_t last_warned
= 0L;
957 if (time((time_t *) NULL
) > last_warned
) {
958 DEBUG(0,("Too many open files, unable "
959 "to open more! smbd's max "
961 lp_max_open_files()));
962 last_warned
= time((time_t *) NULL
);
966 DBG_DEBUG("name %s, flags = 0%o mode = 0%o, fd = %d. %s\n",
967 smb_fname_str_dbg(smb_fname
),
970 fsp_get_pathref_fd(fsp
),
975 DBG_DEBUG("name %s, flags = 0%o mode = 0%o, fd = %d\n",
976 smb_fname_str_dbg(smb_fname
),
979 fsp_get_pathref_fd(fsp
));
984 /****************************************************************************
985 Close the file associated with a fsp.
986 ****************************************************************************/
988 NTSTATUS
fd_close(files_struct
*fsp
)
993 if (fsp
== fsp
->conn
->cwd_fsp
) {
997 if (fsp
->fsp_flags
.fstat_before_close
) {
998 status
= vfs_stat_fsp(fsp
);
999 if (!NT_STATUS_IS_OK(status
)) {
1001 * If this is a stream and delete-on-close was set, the
1002 * backing object (an xattr from streams_xattr) might
1003 * already be deleted so fstat() fails with
1004 * NT_STATUS_NOT_FOUND. So if fsp refers to a stream we
1005 * ignore the error and only bail for normal files where
1006 * an fstat() should still work. NB. We cannot use
1007 * fsp_is_alternate_stream(fsp) for this as the base_fsp
1008 * has already been closed at this point and so the value
1009 * fsp_is_alternate_stream() checks for is already NULL.
1011 if (fsp
->fsp_name
->stream_name
== NULL
) {
1020 if (fsp_get_pathref_fd(fsp
) == -1) {
1022 * Either a directory where the dptr_CloseDir() already closed
1023 * the fd or a stat open.
1025 return NT_STATUS_OK
;
1027 if (fh_get_refcount(fsp
->fh
) > 1) {
1028 return NT_STATUS_OK
; /* Shared handle. Only close last reference. */
1031 ret
= SMB_VFS_CLOSE(fsp
);
1032 fsp_set_fd(fsp
, -1);
1034 return map_nt_error_from_unix(errno
);
1036 return NT_STATUS_OK
;
1039 /****************************************************************************
1040 Change the ownership of a file to that of the parent directory.
1041 Do this by fd if possible.
1042 ****************************************************************************/
1044 static void change_file_owner_to_parent_fsp(struct files_struct
*parent_fsp
,
1045 struct files_struct
*fsp
)
1049 if (parent_fsp
->fsp_name
->st
.st_ex_uid
== fsp
->fsp_name
->st
.st_ex_uid
) {
1050 /* Already this uid - no need to change. */
1051 DBG_DEBUG("file %s is already owned by uid %u\n",
1053 (unsigned int)fsp
->fsp_name
->st
.st_ex_uid
);
1058 ret
= SMB_VFS_FCHOWN(fsp
,
1059 parent_fsp
->fsp_name
->st
.st_ex_uid
,
1063 DBG_ERR("failed to fchown "
1064 "file %s to parent directory uid %u. Error "
1067 (unsigned int)parent_fsp
->fsp_name
->st
.st_ex_uid
,
1070 DBG_DEBUG("changed new file %s to "
1071 "parent directory uid %u.\n",
1073 (unsigned int)parent_fsp
->fsp_name
->st
.st_ex_uid
);
1074 /* Ensure the uid entry is updated. */
1075 fsp
->fsp_name
->st
.st_ex_uid
=
1076 parent_fsp
->fsp_name
->st
.st_ex_uid
;
1080 static NTSTATUS
change_dir_owner_to_parent_fsp(struct files_struct
*parent_fsp
,
1081 struct files_struct
*fsp
)
1086 if (parent_fsp
->fsp_name
->st
.st_ex_uid
== fsp
->fsp_name
->st
.st_ex_uid
) {
1087 /* Already this uid - no need to change. */
1088 DBG_DEBUG("directory %s is already owned by uid %u\n",
1090 (unsigned int)fsp
->fsp_name
->st
.st_ex_uid
);
1091 return NT_STATUS_OK
;
1095 ret
= SMB_VFS_FCHOWN(fsp
,
1096 parent_fsp
->fsp_name
->st
.st_ex_uid
,
1100 status
= map_nt_error_from_unix(errno
);
1101 DBG_ERR("failed to chown "
1102 "directory %s to parent directory uid %u. "
1105 (unsigned int)parent_fsp
->fsp_name
->st
.st_ex_uid
,
1110 DBG_DEBUG("changed ownership of new "
1111 "directory %s to parent directory uid %u.\n",
1113 (unsigned int)parent_fsp
->fsp_name
->st
.st_ex_uid
);
1115 /* Ensure the uid entry is updated. */
1116 fsp
->fsp_name
->st
.st_ex_uid
= parent_fsp
->fsp_name
->st
.st_ex_uid
;
1118 return NT_STATUS_OK
;
1121 /****************************************************************************
1122 Open a file - returning a guaranteed ATOMIC indication of if the
1123 file was created or not.
1124 ****************************************************************************/
1126 static NTSTATUS
fd_open_atomic(struct files_struct
*dirfsp
,
1127 struct smb_filename
*smb_fname
,
1129 const struct vfs_open_how
*_how
,
1132 struct vfs_open_how how
= *_how
;
1133 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
1134 NTSTATUS retry_status
;
1135 bool file_existed
= VALID_STAT(smb_fname
->st
);
1137 if (!(how
.flags
& O_CREAT
)) {
1139 * We're not creating the file, just pass through.
1141 status
= fd_openat(dirfsp
, smb_fname
, fsp
, &how
);
1142 *file_created
= false;
1146 if (how
.flags
& O_EXCL
) {
1148 * Fail if already exists, just pass through.
1150 status
= fd_openat(dirfsp
, smb_fname
, fsp
, &how
);
1153 * Here we've opened with O_CREAT|O_EXCL. If that went
1154 * NT_STATUS_OK, we *know* we created this file.
1156 *file_created
= NT_STATUS_IS_OK(status
);
1162 * Now it gets tricky. We have O_CREAT, but not O_EXCL.
1163 * To know absolutely if we created the file or not,
1164 * we can never call O_CREAT without O_EXCL. So if
1165 * we think the file existed, try without O_CREAT|O_EXCL.
1166 * If we think the file didn't exist, try with
1169 * The big problem here is dangling symlinks. Opening
1170 * without O_NOFOLLOW means both bad symlink
1171 * and missing path return -1, ENOENT from open(). As POSIX
1172 * is pathname based it's not possible to tell
1173 * the difference between these two cases in a
1174 * non-racy way, so change to try only two attempts before
1177 * We don't have this problem for the O_NOFOLLOW
1178 * case as it just returns NT_STATUS_OBJECT_PATH_NOT_FOUND
1179 * mapped from the ELOOP POSIX error.
1183 how
.flags
= _how
->flags
& ~(O_CREAT
);
1184 retry_status
= NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1186 how
.flags
= _how
->flags
| O_EXCL
;
1187 retry_status
= NT_STATUS_OBJECT_NAME_COLLISION
;
1190 status
= fd_openat(dirfsp
, smb_fname
, fsp
, &how
);
1191 if (NT_STATUS_IS_OK(status
)) {
1192 *file_created
= !file_existed
;
1193 return NT_STATUS_OK
;
1195 if (NT_STATUS_EQUAL(status
, retry_status
)) {
1197 file_existed
= !file_existed
;
1199 DBG_DEBUG("File %s %s. Retry.\n",
1201 file_existed
? "existed" : "did not exist");
1204 how
.flags
= _how
->flags
& ~(O_CREAT
);
1206 how
.flags
= _how
->flags
| O_EXCL
;
1209 status
= fd_openat(dirfsp
, smb_fname
, fsp
, &how
);
1212 *file_created
= (NT_STATUS_IS_OK(status
) && !file_existed
);
1216 static NTSTATUS
reopen_from_fsp(struct files_struct
*dirfsp
,
1217 struct smb_filename
*smb_fname
,
1218 struct files_struct
*fsp
,
1219 const struct vfs_open_how
*how
,
1220 bool *p_file_created
)
1225 if (fsp
->fsp_flags
.have_proc_fds
&&
1226 ((old_fd
= fsp_get_pathref_fd(fsp
)) != -1)) {
1228 struct sys_proc_fd_path_buf buf
;
1229 struct smb_filename proc_fname
= (struct smb_filename
){
1230 .base_name
= sys_proc_fd_path(old_fd
, &buf
),
1232 mode_t mode
= fsp
->fsp_name
->st
.st_ex_mode
;
1235 SMB_ASSERT(fsp
->fsp_flags
.is_pathref
);
1237 if (S_ISLNK(mode
)) {
1238 return NT_STATUS_STOPPED_ON_SYMLINK
;
1240 if (!(S_ISREG(mode
) || S_ISDIR(mode
))) {
1241 return NT_STATUS_IO_REPARSE_TAG_NOT_HANDLED
;
1244 fsp
->fsp_flags
.is_pathref
= false;
1246 new_fd
= SMB_VFS_OPENAT(fsp
->conn
,
1252 status
= map_nt_error_from_unix(errno
);
1257 status
= fd_close(fsp
);
1258 if (!NT_STATUS_IS_OK(status
)) {
1262 fsp_set_fd(fsp
, new_fd
);
1263 return NT_STATUS_OK
;
1267 * Close the existing pathref fd and set the fsp flag
1268 * is_pathref to false so we get a "normal" fd this time.
1270 status
= fd_close(fsp
);
1271 if (!NT_STATUS_IS_OK(status
)) {
1275 fsp
->fsp_flags
.is_pathref
= false;
1277 status
= fd_open_atomic(dirfsp
, smb_fname
, fsp
, how
, p_file_created
);
1281 /****************************************************************************
1283 ****************************************************************************/
1285 static NTSTATUS
open_file(
1286 struct smb_request
*req
,
1287 struct files_struct
*dirfsp
,
1288 struct smb_filename
*smb_fname_atname
,
1290 const struct vfs_open_how
*_how
,
1291 uint32_t access_mask
, /* client requested access mask. */
1292 uint32_t open_access_mask
, /* what we're actually using in the open. */
1293 uint32_t private_flags
,
1294 bool *p_file_created
)
1296 connection_struct
*conn
= fsp
->conn
;
1297 struct smb_filename
*smb_fname
= fsp
->fsp_name
;
1298 struct vfs_open_how how
= *_how
;
1299 NTSTATUS status
= NT_STATUS_OK
;
1300 bool file_existed
= VALID_STAT(fsp
->fsp_name
->st
);
1301 const uint32_t need_fd_mask
=
1306 SEC_FLAG_SYSTEM_SECURITY
;
1307 bool creating
= !file_existed
&& (how
.flags
& O_CREAT
);
1308 bool open_fd
= false;
1309 bool posix_open
= (fsp
->posix_flags
& FSP_POSIX_FLAGS_OPEN
);
1312 * Catch early an attempt to open an existing
1313 * directory as a file.
1315 if (file_existed
&& S_ISDIR(fsp
->fsp_name
->st
.st_ex_mode
)) {
1316 return NT_STATUS_FILE_IS_A_DIRECTORY
;
1320 * This little piece of insanity is inspired by the
1321 * fact that an NT client can open a file for O_RDONLY,
1322 * but set the create disposition to FILE_EXISTS_TRUNCATE.
1323 * If the client *can* write to the file, then it expects to
1324 * truncate the file, even though it is opening for readonly.
1325 * Quicken uses this stupid trick in backup file creation...
1326 * Thanks *greatly* to "David W. Chapman Jr." <dwcjr@inethouston.net>
1327 * for helping track this one down. It didn't bite us in 2.0.x
1328 * as we always opened files read-write in that release. JRA.
1331 if (((how
.flags
& O_ACCMODE
) == O_RDONLY
) && (how
.flags
& O_TRUNC
)) {
1332 DBG_DEBUG("truncate requested on read-only open for file %s\n",
1333 smb_fname_str_dbg(smb_fname
));
1334 how
.flags
= (how
.flags
& ~O_ACCMODE
) | O_RDWR
;
1337 /* Check permissions */
1340 * This code was changed after seeing a client open request
1341 * containing the open mode of (DENY_WRITE/read-only) with
1342 * the 'create if not exist' bit set. The previous code
1343 * would fail to open the file read only on a read-only share
1344 * as it was checking the flags parameter directly against O_RDONLY,
1345 * this was failing as the flags parameter was set to O_RDONLY|O_CREAT.
1349 if (!CAN_WRITE(conn
)) {
1350 /* It's a read-only share - fail if we wanted to write. */
1351 if ((how
.flags
& O_ACCMODE
) != O_RDONLY
||
1352 (how
.flags
& O_TRUNC
) || (how
.flags
& O_APPEND
)) {
1353 DEBUG(3,("Permission denied opening %s\n",
1354 smb_fname_str_dbg(smb_fname
)));
1355 return NT_STATUS_ACCESS_DENIED
;
1358 * We don't want to write - but we must make sure that
1359 * O_CREAT doesn't create the file if we have write
1360 * access into the directory.
1362 how
.flags
&= ~(O_CREAT
| O_EXCL
);
1365 if ((open_access_mask
& need_fd_mask
) || creating
||
1366 (how
.flags
& O_TRUNC
)) {
1373 #if defined(O_NONBLOCK) && defined(S_ISFIFO)
1375 * We would block on opening a FIFO with no one else on the
1376 * other end. Do what we used to do and add O_NONBLOCK to the
1380 if (file_existed
&& S_ISFIFO(smb_fname
->st
.st_ex_mode
)) {
1381 how
.flags
|= O_NONBLOCK
;
1386 const char *wild
= smb_fname
->base_name
;
1388 * Don't open files with Microsoft wildcard characters.
1390 if (fsp_is_alternate_stream(fsp
)) {
1392 * wildcard characters are allowed in stream
1393 * names only test the basefilename
1395 wild
= fsp
->base_fsp
->fsp_name
->base_name
;
1398 if (ms_has_wild(wild
)) {
1399 return NT_STATUS_OBJECT_NAME_INVALID
;
1403 /* Can we access this file ? */
1404 if (!fsp_is_alternate_stream(fsp
)) {
1405 /* Only do this check on non-stream open. */
1407 status
= smbd_check_access_rights_fsp(
1413 if (!NT_STATUS_IS_OK(status
)) {
1414 DBG_DEBUG("smbd_check_access_rights_fsp"
1415 " on file %s returned %s\n",
1420 if (!NT_STATUS_IS_OK(status
) &&
1421 !NT_STATUS_EQUAL(status
,
1422 NT_STATUS_OBJECT_NAME_NOT_FOUND
))
1427 if (NT_STATUS_EQUAL(status
,
1428 NT_STATUS_OBJECT_NAME_NOT_FOUND
))
1430 DEBUG(10, ("open_file: "
1431 "file %s vanished since we "
1432 "checked for existence.\n",
1433 smb_fname_str_dbg(smb_fname
)));
1434 file_existed
= false;
1435 SET_STAT_INVALID(fsp
->fsp_name
->st
);
1439 if (!file_existed
) {
1440 if (!(how
.flags
& O_CREAT
)) {
1441 /* File didn't exist and no O_CREAT. */
1442 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1445 status
= check_parent_access_fsp(
1448 if (!NT_STATUS_IS_OK(status
)) {
1449 DBG_DEBUG("check_parent_access_fsp on "
1450 "directory %s for file %s "
1454 smb_fname_str_dbg(smb_fname
),
1462 * Actually do the open - if O_TRUNC is needed handle it
1463 * below under the share mode lock.
1465 how
.flags
&= ~O_TRUNC
;
1466 status
= reopen_from_fsp(dirfsp
,
1471 if (NT_STATUS_EQUAL(status
, NT_STATUS_STOPPED_ON_SYMLINK
)) {
1473 * Non-O_PATH reopen that hit a race
1474 * condition: Someone has put a symlink where
1475 * we used to have a file. Can't happen with
1476 * O_PATH and reopening from /proc/self/fd/ or
1479 status
= NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1481 if (!NT_STATUS_IS_OK(status
)) {
1482 DBG_NOTICE("Error opening file %s (%s) (in_flags=%d) "
1484 smb_fname_str_dbg(smb_fname
),
1491 if (how
.flags
& O_NONBLOCK
) {
1493 * GPFS can return ETIMEDOUT for pread on
1494 * nonblocking file descriptors when files
1495 * migrated to tape need to be recalled. I
1496 * could imagine this happens elsewhere
1497 * too. With blocking file descriptors this
1500 ret
= vfs_set_blocking(fsp
, true);
1502 status
= map_nt_error_from_unix(errno
);
1503 DBG_WARNING("Could not set fd to blocking: "
1504 "%s\n", strerror(errno
));
1510 if (*p_file_created
) {
1511 /* We created this file. */
1513 bool need_re_stat
= false;
1514 /* Do all inheritance work after we've
1515 done a successful fstat call and filled
1516 in the stat struct in fsp->fsp_name. */
1518 /* Inherit the ACL if required */
1519 if (lp_inherit_permissions(SNUM(conn
))) {
1520 inherit_access_posix_acl(conn
,
1524 need_re_stat
= true;
1527 /* Change the owner if required. */
1528 if (lp_inherit_owner(SNUM(conn
)) != INHERIT_OWNER_NO
) {
1529 change_file_owner_to_parent_fsp(dirfsp
, fsp
);
1530 need_re_stat
= true;
1534 status
= vfs_stat_fsp(fsp
);
1536 * If we have an fd, this stat should succeed.
1538 if (!NT_STATUS_IS_OK(status
)) {
1539 DBG_ERR("Error doing fstat on open "
1541 smb_fname_str_dbg(smb_fname
),
1548 notify_fname(conn
, NOTIFY_ACTION_ADDED
,
1549 FILE_NOTIFY_CHANGE_FILE_NAME
,
1550 smb_fname
->base_name
);
1553 if (!file_existed
) {
1554 /* File must exist for a stat open. */
1555 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1558 if (S_ISLNK(smb_fname
->st
.st_ex_mode
) &&
1562 * Don't allow stat opens on symlinks directly unless
1563 * it's a POSIX open. Match the return code from
1564 * openat_pathref_fsp().
1566 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1569 if (!fsp
->fsp_flags
.is_pathref
) {
1571 * There is only one legit case where end up here:
1572 * openat_pathref_fsp() failed to open a symlink, so the
1573 * fsp was created by fsp_new() which doesn't set
1574 * is_pathref. Other than that, we should always have a
1575 * pathref fsp at this point. The subsequent checks
1578 if (!(smb_fname
->flags
& SMB_FILENAME_POSIX_PATH
)) {
1579 DBG_ERR("[%s] is not a POSIX pathname\n",
1580 smb_fname_str_dbg(smb_fname
));
1581 return NT_STATUS_INTERNAL_ERROR
;
1583 if (!S_ISLNK(smb_fname
->st
.st_ex_mode
)) {
1584 DBG_ERR("[%s] is not a symlink\n",
1585 smb_fname_str_dbg(smb_fname
));
1586 return NT_STATUS_INTERNAL_ERROR
;
1588 if (fsp_get_pathref_fd(fsp
) != -1) {
1589 DBG_ERR("fd for [%s] is not -1: fd [%d]\n",
1590 smb_fname_str_dbg(smb_fname
),
1591 fsp_get_pathref_fd(fsp
));
1592 return NT_STATUS_INTERNAL_ERROR
;
1597 * Access to streams is checked by checking the basefile and
1598 * that has already been checked by check_base_file_access()
1599 * in create_file_unixpath().
1601 if (!fsp_is_alternate_stream(fsp
)) {
1602 status
= smbd_check_access_rights_fsp(dirfsp
,
1607 if (NT_STATUS_EQUAL(status
, NT_STATUS_OBJECT_NAME_NOT_FOUND
) &&
1609 S_ISLNK(smb_fname
->st
.st_ex_mode
)) {
1610 /* This is a POSIX stat open for delete
1611 * or rename on a symlink that points
1612 * nowhere. Allow. */
1613 DEBUG(10,("open_file: allowing POSIX "
1614 "open on bad symlink %s\n",
1615 smb_fname_str_dbg(smb_fname
)));
1616 status
= NT_STATUS_OK
;
1619 if (!NT_STATUS_IS_OK(status
)) {
1620 DBG_DEBUG("smbd_check_access_rights_fsp on file "
1629 fsp
->file_id
= vfs_file_id_from_sbuf(conn
, &smb_fname
->st
);
1630 fsp
->vuid
= req
? req
->vuid
: UID_FIELD_INVALID
;
1631 fsp
->file_pid
= req
? req
->smbpid
: 0;
1632 fsp
->fsp_flags
.can_lock
= true;
1633 fsp
->fsp_flags
.can_read
= ((access_mask
& FILE_READ_DATA
) != 0);
1634 fsp
->fsp_flags
.can_write
=
1636 ((access_mask
& (FILE_WRITE_DATA
| FILE_APPEND_DATA
)) != 0);
1637 fsp
->print_file
= NULL
;
1638 fsp
->fsp_flags
.modified
= false;
1639 fsp
->sent_oplock_break
= NO_BREAK_SENT
;
1640 fsp
->fsp_flags
.is_directory
= false;
1641 if (is_in_path(smb_fname
->base_name
,
1642 conn
->aio_write_behind_list
,
1643 posix_open
? true : conn
->case_sensitive
)) {
1644 fsp
->fsp_flags
.aio_write_behind
= true;
1647 DEBUG(2,("%s opened file %s read=%s write=%s (numopen=%d)\n",
1648 conn
->session_info
->unix_info
->unix_name
,
1649 smb_fname_str_dbg(smb_fname
),
1650 BOOLSTR(fsp
->fsp_flags
.can_read
),
1651 BOOLSTR(fsp
->fsp_flags
.can_write
),
1652 conn
->num_files_open
));
1654 return NT_STATUS_OK
;
1657 static bool mask_conflict(
1658 uint32_t new_access
,
1659 uint32_t existing_access
,
1660 uint32_t access_mask
,
1661 uint32_t new_sharemode
,
1662 uint32_t existing_sharemode
,
1663 uint32_t sharemode_mask
)
1665 bool want_access
= (new_access
& access_mask
);
1666 bool allow_existing
= (existing_sharemode
& sharemode_mask
);
1667 bool have_access
= (existing_access
& access_mask
);
1668 bool allow_new
= (new_sharemode
& sharemode_mask
);
1670 if (want_access
&& !allow_existing
) {
1671 DBG_DEBUG("Access request 0x%"PRIx32
"/0x%"PRIx32
" conflicts "
1672 "with existing sharemode 0x%"PRIx32
"/0x%"PRIx32
"\n",
1679 if (have_access
&& !allow_new
) {
1680 DBG_DEBUG("Sharemode request 0x%"PRIx32
"/0x%"PRIx32
" conflicts "
1681 "with existing access 0x%"PRIx32
"/0x%"PRIx32
"\n",
1691 /****************************************************************************
1692 Check if we can open a file with a share mode.
1693 Returns True if conflict, False if not.
1694 ****************************************************************************/
1696 static const uint32_t conflicting_access
=
1703 static bool share_conflict(uint32_t e_access_mask
,
1704 uint32_t e_share_access
,
1705 uint32_t access_mask
,
1706 uint32_t share_access
)
1710 DBG_DEBUG("existing access_mask = 0x%"PRIx32
", "
1711 "existing share access = 0x%"PRIx32
", "
1712 "access_mask = 0x%"PRIx32
", "
1713 "share_access = 0x%"PRIx32
"\n",
1719 if ((e_access_mask
& conflicting_access
) == 0) {
1720 DBG_DEBUG("No conflict due to "
1721 "existing access_mask = 0x%"PRIx32
"\n",
1725 if ((access_mask
& conflicting_access
) == 0) {
1726 DBG_DEBUG("No conflict due to access_mask = 0x%"PRIx32
"\n",
1731 conflict
= mask_conflict(
1732 access_mask
, e_access_mask
, FILE_WRITE_DATA
| FILE_APPEND_DATA
,
1733 share_access
, e_share_access
, FILE_SHARE_WRITE
);
1734 conflict
|= mask_conflict(
1735 access_mask
, e_access_mask
, FILE_READ_DATA
| FILE_EXECUTE
,
1736 share_access
, e_share_access
, FILE_SHARE_READ
);
1737 conflict
|= mask_conflict(
1738 access_mask
, e_access_mask
, DELETE_ACCESS
,
1739 share_access
, e_share_access
, FILE_SHARE_DELETE
);
1741 DBG_DEBUG("conflict=%s\n", conflict
? "true" : "false");
1745 #if defined(DEVELOPER)
1747 struct validate_my_share_entries_state
{
1748 struct smbd_server_connection
*sconn
;
1750 struct server_id self
;
1753 static bool validate_my_share_entries_fn(
1754 struct share_mode_entry
*e
,
1758 struct validate_my_share_entries_state
*state
= private_data
;
1761 if (!server_id_equal(&state
->self
, &e
->pid
)) {
1765 if (e
->op_mid
== 0) {
1766 /* INTERNAL_OPEN_ONLY */
1770 fsp
= file_find_dif(state
->sconn
, state
->fid
, e
->share_file_id
);
1772 DBG_ERR("PANIC : %s\n",
1773 share_mode_str(talloc_tos(), 0, &state
->fid
, e
));
1774 smb_panic("validate_my_share_entries: Cannot match a "
1775 "share entry with an open file\n");
1778 if (((uint16_t)fsp
->oplock_type
) != e
->op_type
) {
1787 DBG_ERR("validate_my_share_entries: PANIC : %s\n",
1788 share_mode_str(talloc_tos(), 0, &state
->fid
, e
));
1789 str
= talloc_asprintf(talloc_tos(),
1790 "validate_my_share_entries: "
1791 "file %s, oplock_type = 0x%x, op_type = 0x%x\n",
1792 fsp
->fsp_name
->base_name
,
1793 (unsigned int)fsp
->oplock_type
,
1794 (unsigned int)e
->op_type
);
1803 * Allowed access mask for stat opens relevant to oplocks
1805 bool is_oplock_stat_open(uint32_t access_mask
)
1807 const uint32_t stat_open_bits
=
1808 (SYNCHRONIZE_ACCESS
|
1809 FILE_READ_ATTRIBUTES
|
1810 FILE_WRITE_ATTRIBUTES
);
1812 return (((access_mask
& stat_open_bits
) != 0) &&
1813 ((access_mask
& ~stat_open_bits
) == 0));
1817 * Allowed access mask for stat opens relevant to leases
1819 bool is_lease_stat_open(uint32_t access_mask
)
1821 const uint32_t stat_open_bits
=
1822 (SYNCHRONIZE_ACCESS
|
1823 FILE_READ_ATTRIBUTES
|
1824 FILE_WRITE_ATTRIBUTES
|
1825 READ_CONTROL_ACCESS
);
1827 return (((access_mask
& stat_open_bits
) != 0) &&
1828 ((access_mask
& ~stat_open_bits
) == 0));
1831 struct has_delete_on_close_state
{
1835 static bool has_delete_on_close_fn(
1836 struct share_mode_entry
*e
,
1840 struct has_delete_on_close_state
*state
= private_data
;
1841 state
->ret
= !share_entry_stale_pid(e
);
1845 static bool has_delete_on_close(struct share_mode_lock
*lck
,
1848 struct has_delete_on_close_state state
= { .ret
= false };
1851 if (!is_delete_on_close_set(lck
, name_hash
)) {
1855 ok
= share_mode_forall_entries(lck
, has_delete_on_close_fn
, &state
);
1857 DBG_DEBUG("share_mode_forall_entries failed\n");
1863 static void share_mode_flags_restrict(
1864 struct share_mode_lock
*lck
,
1865 uint32_t access_mask
,
1866 uint32_t share_mode
,
1867 uint32_t lease_type
)
1869 uint32_t existing_access_mask
, existing_share_mode
;
1870 uint32_t existing_lease_type
;
1872 share_mode_flags_get(
1874 &existing_access_mask
,
1875 &existing_share_mode
,
1876 &existing_lease_type
);
1878 existing_access_mask
|= access_mask
;
1879 if (access_mask
& conflicting_access
) {
1880 existing_share_mode
&= share_mode
;
1882 existing_lease_type
|= lease_type
;
1884 share_mode_flags_set(
1886 existing_access_mask
,
1887 existing_share_mode
,
1888 existing_lease_type
,
1892 /****************************************************************************
1893 Deal with share modes
1894 Invariant: Share mode must be locked on entry and exit.
1895 Returns -1 on error, or number of share modes on success (may be zero).
1896 ****************************************************************************/
1898 struct open_mode_check_state
{
1900 uint32_t access_mask
;
1901 uint32_t share_access
;
1902 uint32_t lease_type
;
1905 static bool open_mode_check_fn(
1906 struct share_mode_entry
*e
,
1910 struct open_mode_check_state
*state
= private_data
;
1911 bool disconnected
, stale
;
1912 uint32_t access_mask
, share_access
, lease_type
;
1914 disconnected
= server_id_is_disconnected(&e
->pid
);
1919 access_mask
= state
->access_mask
| e
->access_mask
;
1920 share_access
= state
->share_access
;
1921 if (e
->access_mask
& conflicting_access
) {
1922 share_access
&= e
->share_access
;
1924 lease_type
= state
->lease_type
| get_lease_type(e
, state
->fid
);
1926 if ((access_mask
== state
->access_mask
) &&
1927 (share_access
== state
->share_access
) &&
1928 (lease_type
== state
->lease_type
)) {
1932 stale
= share_entry_stale_pid(e
);
1937 state
->access_mask
= access_mask
;
1938 state
->share_access
= share_access
;
1939 state
->lease_type
= lease_type
;
1944 static NTSTATUS
open_mode_check(connection_struct
*conn
,
1946 struct share_mode_lock
*lck
,
1947 uint32_t access_mask
,
1948 uint32_t share_access
)
1950 struct open_mode_check_state state
;
1952 bool modified
= false;
1954 if (is_oplock_stat_open(access_mask
)) {
1955 /* Stat open that doesn't trigger oplock breaks or share mode
1956 * checks... ! JRA. */
1957 return NT_STATUS_OK
;
1961 * Check if the share modes will give us access.
1964 #if defined(DEVELOPER)
1966 struct validate_my_share_entries_state validate_state
= {
1967 .sconn
= conn
->sconn
,
1969 .self
= messaging_server_id(conn
->sconn
->msg_ctx
),
1971 ok
= share_mode_forall_entries(
1972 lck
, validate_my_share_entries_fn
, &validate_state
);
1977 share_mode_flags_get(
1978 lck
, &state
.access_mask
, &state
.share_access
, NULL
);
1980 conflict
= share_conflict(
1986 DBG_DEBUG("No conflict due to share_mode_flags access\n");
1987 return NT_STATUS_OK
;
1990 state
= (struct open_mode_check_state
) {
1992 .share_access
= (FILE_SHARE_READ
|
1998 * Walk the share mode array to recalculate d->flags
2001 ok
= share_mode_forall_entries(lck
, open_mode_check_fn
, &state
);
2003 DBG_DEBUG("share_mode_forall_entries failed\n");
2004 return NT_STATUS_INTERNAL_ERROR
;
2007 share_mode_flags_set(
2015 * We only end up here if we had a sharing violation
2016 * from d->flags and have recalculated it.
2018 return NT_STATUS_SHARING_VIOLATION
;
2021 conflict
= share_conflict(
2027 DBG_DEBUG("No conflict due to share_mode_flags access\n");
2028 return NT_STATUS_OK
;
2031 return NT_STATUS_SHARING_VIOLATION
;
2035 * Send a break message to the oplock holder and delay the open for
2039 NTSTATUS
send_break_message(struct messaging_context
*msg_ctx
,
2040 const struct file_id
*id
,
2041 const struct share_mode_entry
*exclusive
,
2044 struct oplock_break_message msg
= {
2046 .share_file_id
= exclusive
->share_file_id
,
2047 .break_to
= break_to
,
2049 enum ndr_err_code ndr_err
;
2054 struct server_id_buf buf
;
2055 DBG_DEBUG("Sending break message to %s\n",
2056 server_id_str_buf(exclusive
->pid
, &buf
));
2057 NDR_PRINT_DEBUG(oplock_break_message
, &msg
);
2060 ndr_err
= ndr_push_struct_blob(
2064 (ndr_push_flags_fn_t
)ndr_push_oplock_break_message
);
2065 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
2066 DBG_WARNING("ndr_push_oplock_break_message failed: %s\n",
2067 ndr_errstr(ndr_err
));
2068 return ndr_map_error2ntstatus(ndr_err
);
2071 status
= messaging_send(
2072 msg_ctx
, exclusive
->pid
, MSG_SMB_BREAK_REQUEST
, &blob
);
2073 TALLOC_FREE(blob
.data
);
2074 if (!NT_STATUS_IS_OK(status
)) {
2075 DEBUG(3, ("Could not send oplock break message: %s\n",
2076 nt_errstr(status
)));
2082 struct validate_oplock_types_state
{
2088 uint32_t num_non_stat_opens
;
2091 static bool validate_oplock_types_fn(
2092 struct share_mode_entry
*e
,
2096 struct validate_oplock_types_state
*state
= private_data
;
2098 if (e
->op_mid
== 0) {
2099 /* INTERNAL_OPEN_ONLY */
2103 if (e
->op_type
== NO_OPLOCK
&& is_oplock_stat_open(e
->access_mask
)) {
2105 * We ignore stat opens in the table - they always
2106 * have NO_OPLOCK and never get or cause breaks. JRA.
2111 state
->num_non_stat_opens
+= 1;
2113 if (BATCH_OPLOCK_TYPE(e
->op_type
)) {
2114 /* batch - can only be one. */
2115 if (share_entry_stale_pid(e
)) {
2116 DBG_DEBUG("Found stale batch oplock\n");
2119 if (state
->ex_or_batch
||
2123 DBG_ERR("Bad batch oplock entry\n");
2124 state
->valid
= false;
2127 state
->batch
= true;
2130 if (EXCLUSIVE_OPLOCK_TYPE(e
->op_type
)) {
2131 if (share_entry_stale_pid(e
)) {
2132 DBG_DEBUG("Found stale duplicate oplock\n");
2135 /* Exclusive or batch - can only be one. */
2136 if (state
->ex_or_batch
||
2139 DBG_ERR("Bad exclusive or batch oplock entry\n");
2140 state
->valid
= false;
2143 state
->ex_or_batch
= true;
2146 if (LEVEL_II_OPLOCK_TYPE(e
->op_type
)) {
2147 if (state
->batch
|| state
->ex_or_batch
) {
2148 if (share_entry_stale_pid(e
)) {
2149 DBG_DEBUG("Found stale LevelII oplock\n");
2152 DBG_DEBUG("Bad levelII oplock entry\n");
2153 state
->valid
= false;
2156 state
->level2
= true;
2159 if (e
->op_type
== NO_OPLOCK
) {
2160 if (state
->batch
|| state
->ex_or_batch
) {
2161 if (share_entry_stale_pid(e
)) {
2162 DBG_DEBUG("Found stale NO_OPLOCK entry\n");
2165 DBG_ERR("Bad no oplock entry\n");
2166 state
->valid
= false;
2169 state
->no_oplock
= true;
2176 * Do internal consistency checks on the share mode for a file.
2179 static bool validate_oplock_types(struct share_mode_lock
*lck
)
2181 struct validate_oplock_types_state state
= { .valid
= true };
2182 static bool skip_validation
;
2186 if (skip_validation
) {
2190 validate
= lp_parm_bool(-1, "smbd", "validate_oplock_types", false);
2192 DBG_DEBUG("smbd:validate_oplock_types not set to yes\n");
2193 skip_validation
= true;
2197 ok
= share_mode_forall_entries(lck
, validate_oplock_types_fn
, &state
);
2199 DBG_DEBUG("share_mode_forall_entries failed\n");
2203 DBG_DEBUG("Got invalid oplock configuration\n");
2207 if ((state
.batch
|| state
.ex_or_batch
) &&
2208 (state
.num_non_stat_opens
!= 1)) {
2209 DBG_WARNING("got batch (%d) or ex (%d) non-exclusively "
2212 (int)state
.ex_or_batch
,
2213 state
.num_non_stat_opens
);
2220 static bool is_same_lease(const files_struct
*fsp
,
2221 const struct share_mode_entry
*e
,
2222 const struct smb2_lease
*lease
)
2224 if (e
->op_type
!= LEASE_OPLOCK
) {
2227 if (lease
== NULL
) {
2231 return smb2_lease_equal(fsp_client_guid(fsp
),
2237 static bool file_has_brlocks(files_struct
*fsp
)
2239 struct byte_range_lock
*br_lck
;
2241 br_lck
= brl_get_locks_readonly(fsp
);
2245 return (brl_num_locks(br_lck
) > 0);
2248 struct fsp_lease
*find_fsp_lease(struct files_struct
*new_fsp
,
2249 const struct smb2_lease_key
*key
,
2250 uint32_t current_state
,
2251 uint16_t lease_version
,
2252 uint16_t lease_epoch
)
2254 struct files_struct
*fsp
;
2257 * TODO: Measure how expensive this loop is with thousands of open
2261 for (fsp
= file_find_di_first(new_fsp
->conn
->sconn
, new_fsp
->file_id
, true);
2263 fsp
= file_find_di_next(fsp
, true)) {
2265 if (fsp
== new_fsp
) {
2268 if (fsp
->oplock_type
!= LEASE_OPLOCK
) {
2271 if (smb2_lease_key_equal(&fsp
->lease
->lease
.lease_key
, key
)) {
2272 fsp
->lease
->ref_count
+= 1;
2277 /* Not found - must be leased in another smbd. */
2278 new_fsp
->lease
= talloc_zero(new_fsp
->conn
->sconn
, struct fsp_lease
);
2279 if (new_fsp
->lease
== NULL
) {
2282 new_fsp
->lease
->ref_count
= 1;
2283 new_fsp
->lease
->sconn
= new_fsp
->conn
->sconn
;
2284 new_fsp
->lease
->lease
.lease_key
= *key
;
2285 new_fsp
->lease
->lease
.lease_state
= current_state
;
2287 * We internally treat all leases as V2 and update
2288 * the epoch, but when sending breaks it matters if
2289 * the requesting lease was v1 or v2.
2291 new_fsp
->lease
->lease
.lease_version
= lease_version
;
2292 new_fsp
->lease
->lease
.lease_epoch
= lease_epoch
;
2293 return new_fsp
->lease
;
2296 static NTSTATUS
try_lease_upgrade(struct files_struct
*fsp
,
2297 struct share_mode_lock
*lck
,
2298 const struct GUID
*client_guid
,
2299 const struct smb2_lease
*lease
,
2303 uint32_t current_state
, breaking_to_requested
, breaking_to_required
;
2305 uint16_t lease_version
, epoch
;
2306 uint32_t existing
, requested
;
2309 status
= leases_db_get(
2315 &breaking_to_requested
,
2316 &breaking_to_required
,
2319 if (!NT_STATUS_IS_OK(status
)) {
2323 fsp
->lease
= find_fsp_lease(
2329 if (fsp
->lease
== NULL
) {
2330 DEBUG(1, ("Did not find existing lease for file %s\n",
2332 return NT_STATUS_NO_MEMORY
;
2336 * Upgrade only if the requested lease is a strict upgrade.
2338 existing
= current_state
;
2339 requested
= lease
->lease_state
;
2342 * Tricky: This test makes sure that "requested" is a
2343 * strict bitwise superset of "existing".
2345 do_upgrade
= ((existing
& requested
) == existing
);
2348 * Upgrade only if there's a change.
2350 do_upgrade
&= (granted
!= existing
);
2353 * Upgrade only if other leases don't prevent what was asked
2356 do_upgrade
&= (granted
== requested
);
2359 * only upgrade if we are not in breaking state
2361 do_upgrade
&= !breaking
;
2363 DEBUG(10, ("existing=%"PRIu32
", requested=%"PRIu32
", "
2364 "granted=%"PRIu32
", do_upgrade=%d\n",
2365 existing
, requested
, granted
, (int)do_upgrade
));
2368 NTSTATUS set_status
;
2370 current_state
= granted
;
2373 set_status
= leases_db_set(
2378 breaking_to_requested
,
2379 breaking_to_required
,
2383 if (!NT_STATUS_IS_OK(set_status
)) {
2384 DBG_DEBUG("leases_db_set failed: %s\n",
2385 nt_errstr(set_status
));
2390 fsp_lease_update(fsp
);
2392 return NT_STATUS_OK
;
2395 static NTSTATUS
grant_new_fsp_lease(struct files_struct
*fsp
,
2396 struct share_mode_lock
*lck
,
2397 const struct GUID
*client_guid
,
2398 const struct smb2_lease
*lease
,
2403 fsp
->lease
= talloc_zero(fsp
->conn
->sconn
, struct fsp_lease
);
2404 if (fsp
->lease
== NULL
) {
2405 return NT_STATUS_INSUFFICIENT_RESOURCES
;
2407 fsp
->lease
->ref_count
= 1;
2408 fsp
->lease
->sconn
= fsp
->conn
->sconn
;
2409 fsp
->lease
->lease
.lease_version
= lease
->lease_version
;
2410 fsp
->lease
->lease
.lease_key
= lease
->lease_key
;
2411 fsp
->lease
->lease
.lease_state
= granted
;
2412 fsp
->lease
->lease
.lease_epoch
= lease
->lease_epoch
+ 1;
2414 status
= leases_db_add(client_guid
,
2417 fsp
->lease
->lease
.lease_state
,
2418 fsp
->lease
->lease
.lease_version
,
2419 fsp
->lease
->lease
.lease_epoch
,
2420 fsp
->conn
->connectpath
,
2421 fsp
->fsp_name
->base_name
,
2422 fsp
->fsp_name
->stream_name
);
2423 if (!NT_STATUS_IS_OK(status
)) {
2424 DEBUG(10, ("%s: leases_db_add failed: %s\n", __func__
,
2425 nt_errstr(status
)));
2426 TALLOC_FREE(fsp
->lease
);
2427 return NT_STATUS_INSUFFICIENT_RESOURCES
;
2431 * We used to set lck->data->modified=true here without
2432 * actually modifying lck->data, triggering a needless
2433 * writeback of lck->data.
2435 * Apart from that writeback, setting modified=true has the
2436 * effect of triggering all waiters for this file to
2437 * retry. This only makes sense if any blocking condition
2438 * (i.e. waiting for a lease to be downgraded or removed) is
2439 * gone. This routine here only adds a lease, so it will never
2440 * free up resources that blocked waiters can now claim. So
2441 * that second effect also does not matter in this
2442 * routine. Thus setting lck->data->modified=true does not
2443 * need to be done here.
2446 return NT_STATUS_OK
;
2449 static NTSTATUS
grant_fsp_lease(struct files_struct
*fsp
,
2450 struct share_mode_lock
*lck
,
2451 const struct smb2_lease
*lease
,
2454 const struct GUID
*client_guid
= fsp_client_guid(fsp
);
2457 status
= try_lease_upgrade(fsp
, lck
, client_guid
, lease
, granted
);
2459 if (NT_STATUS_EQUAL(status
, NT_STATUS_NOT_FOUND
)) {
2460 status
= grant_new_fsp_lease(
2461 fsp
, lck
, client_guid
, lease
, granted
);
2467 static int map_lease_type_to_oplock(uint32_t lease_type
)
2469 int result
= NO_OPLOCK
;
2471 switch (lease_type
) {
2472 case SMB2_LEASE_READ
|SMB2_LEASE_WRITE
|SMB2_LEASE_HANDLE
:
2473 result
= BATCH_OPLOCK
|EXCLUSIVE_OPLOCK
;
2475 case SMB2_LEASE_READ
|SMB2_LEASE_WRITE
:
2476 result
= EXCLUSIVE_OPLOCK
;
2478 case SMB2_LEASE_READ
|SMB2_LEASE_HANDLE
:
2479 case SMB2_LEASE_READ
:
2480 result
= LEVEL_II_OPLOCK
;
2487 struct delay_for_oplock_state
{
2488 struct files_struct
*fsp
;
2489 const struct smb2_lease
*lease
;
2490 bool will_overwrite
;
2491 uint32_t delay_mask
;
2492 bool first_open_attempt
;
2493 bool got_handle_lease
;
2495 bool have_other_lease
;
2496 uint32_t total_lease_types
;
2500 static bool delay_for_oplock_fn(
2501 struct share_mode_entry
*e
,
2505 struct delay_for_oplock_state
*state
= private_data
;
2506 struct files_struct
*fsp
= state
->fsp
;
2507 const struct smb2_lease
*lease
= state
->lease
;
2508 bool e_is_lease
= (e
->op_type
== LEASE_OPLOCK
);
2509 uint32_t e_lease_type
= SMB2_LEASE_NONE
;
2511 bool lease_is_breaking
= false;
2516 if (lease
!= NULL
) {
2517 bool our_lease
= is_same_lease(fsp
, e
, lease
);
2519 DBG_DEBUG("Ignoring our own lease\n");
2524 status
= leases_db_get(
2528 &e_lease_type
, /* current_state */
2530 NULL
, /* breaking_to_requested */
2531 NULL
, /* breaking_to_required */
2532 NULL
, /* lease_version */
2536 * leases_db_get() can return NT_STATUS_NOT_FOUND
2537 * if the share_mode_entry e is stale and the
2538 * lease record was already removed. In this case return
2539 * false so the traverse continues.
2542 if (NT_STATUS_EQUAL(status
, NT_STATUS_NOT_FOUND
) &&
2543 share_entry_stale_pid(e
))
2545 struct GUID_txt_buf guid_strbuf
;
2546 struct file_id_buf file_id_strbuf
;
2547 DBG_DEBUG("leases_db_get for client_guid [%s] "
2548 "lease_key [%"PRIu64
"/%"PRIu64
"] "
2549 "file_id [%s] failed for stale "
2550 "share_mode_entry\n",
2551 GUID_buf_string(&e
->client_guid
, &guid_strbuf
),
2552 e
->lease_key
.data
[0],
2553 e
->lease_key
.data
[1],
2554 file_id_str_buf(fsp
->file_id
, &file_id_strbuf
));
2557 if (!NT_STATUS_IS_OK(status
)) {
2558 struct GUID_txt_buf guid_strbuf
;
2559 struct file_id_buf file_id_strbuf
;
2560 DBG_ERR("leases_db_get for client_guid [%s] "
2561 "lease_key [%"PRIu64
"/%"PRIu64
"] "
2562 "file_id [%s] failed: %s\n",
2563 GUID_buf_string(&e
->client_guid
, &guid_strbuf
),
2564 e
->lease_key
.data
[0],
2565 e
->lease_key
.data
[1],
2566 file_id_str_buf(fsp
->file_id
, &file_id_strbuf
),
2568 smb_panic("leases_db_get() failed");
2571 e_lease_type
= get_lease_type(e
, fsp
->file_id
);
2574 if (((e_lease_type
& ~state
->total_lease_types
) != 0) &&
2575 !share_entry_stale_pid(e
))
2577 state
->total_lease_types
|= e_lease_type
;
2580 if (!state
->got_handle_lease
&&
2581 ((e_lease_type
& SMB2_LEASE_HANDLE
) != 0) &&
2582 !share_entry_stale_pid(e
)) {
2583 state
->got_handle_lease
= true;
2586 if (!state
->got_oplock
&&
2587 (e
->op_type
!= LEASE_OPLOCK
) &&
2588 !share_entry_stale_pid(e
)) {
2589 state
->got_oplock
= true;
2592 if (!state
->have_other_lease
&&
2593 !is_same_lease(fsp
, e
, lease
) &&
2594 !share_entry_stale_pid(e
)) {
2595 state
->have_other_lease
= true;
2598 if (e_is_lease
&& is_lease_stat_open(fsp
->access_mask
)) {
2602 break_to
= e_lease_type
& ~state
->delay_mask
;
2604 if (state
->will_overwrite
) {
2605 break_to
&= ~(SMB2_LEASE_HANDLE
|SMB2_LEASE_READ
);
2608 DBG_DEBUG("e_lease_type %u, will_overwrite: %u\n",
2609 (unsigned)e_lease_type
,
2610 (unsigned)state
->will_overwrite
);
2612 if ((e_lease_type
& ~break_to
) == 0) {
2613 if (lease_is_breaking
) {
2614 state
->delay
= true;
2619 if (share_entry_stale_pid(e
)) {
2623 if (state
->will_overwrite
) {
2625 * If we break anyway break to NONE directly.
2626 * Otherwise vfs_set_filelen() will trigger the
2629 break_to
&= ~(SMB2_LEASE_READ
|SMB2_LEASE_WRITE
);
2634 * Oplocks only support breaking to R or NONE.
2636 break_to
&= ~(SMB2_LEASE_HANDLE
|SMB2_LEASE_WRITE
);
2639 DBG_DEBUG("breaking from %d to %d\n",
2643 fsp
->conn
->sconn
->msg_ctx
, &fsp
->file_id
, e
, break_to
);
2644 if (e_lease_type
& state
->delay_mask
) {
2645 state
->delay
= true;
2647 if (lease_is_breaking
&& !state
->first_open_attempt
) {
2648 state
->delay
= true;
2654 static NTSTATUS
delay_for_oplock(files_struct
*fsp
,
2656 const struct smb2_lease
*lease
,
2657 struct share_mode_lock
*lck
,
2658 bool have_sharing_violation
,
2659 uint32_t create_disposition
,
2660 bool first_open_attempt
,
2664 struct delay_for_oplock_state state
= {
2667 .first_open_attempt
= first_open_attempt
,
2674 *poplock_type
= NO_OPLOCK
;
2677 if (fsp
->fsp_flags
.is_directory
) {
2679 * No directory leases yet
2681 SMB_ASSERT(oplock_request
== NO_OPLOCK
);
2682 if (have_sharing_violation
) {
2683 return NT_STATUS_SHARING_VIOLATION
;
2685 return NT_STATUS_OK
;
2688 if (oplock_request
== LEASE_OPLOCK
) {
2689 if (lease
== NULL
) {
2691 * The SMB2 layer should have checked this
2693 return NT_STATUS_INTERNAL_ERROR
;
2696 requested
= lease
->lease_state
;
2698 requested
= map_oplock_to_lease_type(
2699 oplock_request
& ~SAMBA_PRIVATE_OPLOCK_MASK
);
2702 share_mode_flags_get(lck
, NULL
, NULL
, &state
.total_lease_types
);
2704 if (is_oplock_stat_open(fsp
->access_mask
)) {
2708 state
.delay_mask
= have_sharing_violation
?
2709 SMB2_LEASE_HANDLE
: SMB2_LEASE_WRITE
;
2711 switch (create_disposition
) {
2712 case FILE_SUPERSEDE
:
2713 case FILE_OVERWRITE
:
2714 case FILE_OVERWRITE_IF
:
2715 state
.will_overwrite
= true;
2718 state
.will_overwrite
= false;
2722 state
.total_lease_types
= SMB2_LEASE_NONE
;
2723 ok
= share_mode_forall_entries(lck
, delay_for_oplock_fn
, &state
);
2725 return NT_STATUS_INTERNAL_ERROR
;
2729 return NT_STATUS_RETRY
;
2733 if (have_sharing_violation
) {
2734 return NT_STATUS_SHARING_VIOLATION
;
2737 granted
= requested
;
2739 if (oplock_request
== LEASE_OPLOCK
) {
2740 if (lp_kernel_oplocks(SNUM(fsp
->conn
))) {
2741 DEBUG(10, ("No lease granted because kernel oplocks are enabled\n"));
2742 granted
= SMB2_LEASE_NONE
;
2744 if ((granted
& (SMB2_LEASE_READ
|SMB2_LEASE_WRITE
)) == 0) {
2745 DEBUG(10, ("No read or write lease requested\n"));
2746 granted
= SMB2_LEASE_NONE
;
2748 if (granted
== SMB2_LEASE_WRITE
) {
2749 DEBUG(10, ("pure write lease requested\n"));
2750 granted
= SMB2_LEASE_NONE
;
2752 if (granted
== (SMB2_LEASE_WRITE
|SMB2_LEASE_HANDLE
)) {
2753 DEBUG(10, ("write and handle lease requested\n"));
2754 granted
= SMB2_LEASE_NONE
;
2758 if (lp_locking(fsp
->conn
->params
) && file_has_brlocks(fsp
)) {
2759 DBG_DEBUG("file %s has byte range locks\n",
2761 granted
&= ~SMB2_LEASE_READ
;
2764 if (state
.have_other_lease
) {
2766 * Can grant only one writer
2768 granted
&= ~SMB2_LEASE_WRITE
;
2771 if ((granted
& SMB2_LEASE_READ
) && !(granted
& SMB2_LEASE_WRITE
)) {
2773 (global_client_caps
& CAP_LEVEL_II_OPLOCKS
) &&
2774 lp_level2_oplocks(SNUM(fsp
->conn
));
2776 if (!allow_level2
) {
2777 granted
= SMB2_LEASE_NONE
;
2781 if (oplock_request
== LEASE_OPLOCK
) {
2782 if (state
.got_oplock
) {
2783 granted
&= ~SMB2_LEASE_HANDLE
;
2786 oplock_type
= LEASE_OPLOCK
;
2788 if (state
.got_handle_lease
) {
2789 granted
= SMB2_LEASE_NONE
;
2793 * Reflect possible downgrades from:
2794 * - map_lease_type_to_oplock() => "RH" to just LEVEL_II
2796 oplock_type
= map_lease_type_to_oplock(granted
);
2797 granted
= map_oplock_to_lease_type(oplock_type
);
2800 state
.total_lease_types
|= granted
;
2803 uint32_t acc
, sh
, ls
;
2804 share_mode_flags_get(lck
, &acc
, &sh
, &ls
);
2805 ls
= state
.total_lease_types
;
2806 share_mode_flags_set(lck
, acc
, sh
, ls
, NULL
);
2809 DBG_DEBUG("oplock type 0x%x granted (%s%s%s)(0x%x), on file %s, "
2810 "requested 0x%x (%s%s%s)(0x%x) => total (%s%s%s)(0x%x)\n",
2812 granted
& SMB2_LEASE_READ
? "R":"",
2813 granted
& SMB2_LEASE_WRITE
? "W":"",
2814 granted
& SMB2_LEASE_HANDLE
? "H":"",
2818 requested
& SMB2_LEASE_READ
? "R":"",
2819 requested
& SMB2_LEASE_WRITE
? "W":"",
2820 requested
& SMB2_LEASE_HANDLE
? "H":"",
2822 state
.total_lease_types
& SMB2_LEASE_READ
? "R":"",
2823 state
.total_lease_types
& SMB2_LEASE_WRITE
? "W":"",
2824 state
.total_lease_types
& SMB2_LEASE_HANDLE
? "H":"",
2825 state
.total_lease_types
);
2827 *poplock_type
= oplock_type
;
2828 *pgranted
= granted
;
2829 return NT_STATUS_OK
;
2832 static NTSTATUS
handle_share_mode_lease(
2834 struct share_mode_lock
*lck
,
2835 uint32_t create_disposition
,
2836 uint32_t access_mask
,
2837 uint32_t share_access
,
2839 const struct smb2_lease
*lease
,
2840 bool first_open_attempt
,
2844 bool sharing_violation
= false;
2847 *poplock_type
= NO_OPLOCK
;
2850 status
= open_mode_check(
2851 fsp
->conn
, fsp
->file_id
, lck
, access_mask
, share_access
);
2852 if (NT_STATUS_EQUAL(status
, NT_STATUS_SHARING_VIOLATION
)) {
2853 sharing_violation
= true;
2854 status
= NT_STATUS_OK
; /* handled later */
2857 if (!NT_STATUS_IS_OK(status
)) {
2861 if (oplock_request
== INTERNAL_OPEN_ONLY
) {
2862 if (sharing_violation
) {
2863 DBG_DEBUG("Sharing violation for internal open\n");
2864 return NT_STATUS_SHARING_VIOLATION
;
2868 * Internal opens never do oplocks or leases. We don't
2869 * need to go through delay_for_oplock().
2871 return NT_STATUS_OK
;
2874 status
= delay_for_oplock(
2884 if (!NT_STATUS_IS_OK(status
)) {
2888 return NT_STATUS_OK
;
2891 static bool request_timed_out(struct smb_request
*req
, struct timeval timeout
)
2893 struct timeval now
, end_time
;
2895 end_time
= timeval_sum(&req
->request_time
, &timeout
);
2896 return (timeval_compare(&end_time
, &now
) < 0);
2899 struct defer_open_state
{
2900 struct smbXsrv_connection
*xconn
;
2904 static void defer_open_done(struct tevent_req
*req
);
2907 * Defer an open and watch a locking.tdb record
2909 * This defers an open that gets rescheduled once the locking.tdb record watch
2910 * is triggered by a change to the record.
2912 * It is used to defer opens that triggered an oplock break and for the SMB1
2913 * sharing violation delay.
2915 static void defer_open(struct share_mode_lock
*lck
,
2916 struct timeval timeout
,
2917 struct smb_request
*req
,
2920 struct deferred_open_record
*open_rec
= NULL
;
2921 struct timeval abs_timeout
;
2922 struct defer_open_state
*watch_state
;
2923 struct tevent_req
*watch_req
;
2924 struct timeval_buf tvbuf1
, tvbuf2
;
2925 struct file_id_buf fbuf
;
2928 abs_timeout
= timeval_sum(&req
->request_time
, &timeout
);
2930 DBG_DEBUG("request time [%s] timeout [%s] mid [%" PRIu64
"] "
2932 timeval_str_buf(&req
->request_time
, false, true, &tvbuf1
),
2933 timeval_str_buf(&abs_timeout
, false, true, &tvbuf2
),
2935 file_id_str_buf(id
, &fbuf
));
2937 open_rec
= talloc_zero(NULL
, struct deferred_open_record
);
2938 if (open_rec
== NULL
) {
2940 exit_server("talloc failed");
2943 watch_state
= talloc(open_rec
, struct defer_open_state
);
2944 if (watch_state
== NULL
) {
2945 exit_server("talloc failed");
2947 watch_state
->xconn
= req
->xconn
;
2948 watch_state
->mid
= req
->mid
;
2950 DBG_DEBUG("deferring mid %" PRIu64
"\n", req
->mid
);
2952 watch_req
= share_mode_watch_send(
2956 (struct server_id
){0});
2957 if (watch_req
== NULL
) {
2958 exit_server("Could not watch share mode record");
2960 tevent_req_set_callback(watch_req
, defer_open_done
, watch_state
);
2962 ok
= tevent_req_set_endtime(watch_req
, req
->sconn
->ev_ctx
, abs_timeout
);
2964 exit_server("tevent_req_set_endtime failed");
2967 ok
= push_deferred_open_message_smb(req
, timeout
, id
, open_rec
);
2970 exit_server("push_deferred_open_message_smb failed");
2974 static void defer_open_done(struct tevent_req
*req
)
2976 struct defer_open_state
*state
= tevent_req_callback_data(
2977 req
, struct defer_open_state
);
2981 status
= share_mode_watch_recv(req
, NULL
, NULL
);
2983 if (!NT_STATUS_IS_OK(status
)) {
2984 DEBUG(5, ("dbwrap_watched_watch_recv returned %s\n",
2985 nt_errstr(status
)));
2987 * Even if it failed, retry anyway. TODO: We need a way to
2988 * tell a re-scheduled open about that error.
2992 DEBUG(10, ("scheduling mid %llu\n", (unsigned long long)state
->mid
));
2994 ret
= schedule_deferred_open_message_smb(state
->xconn
, state
->mid
);
3000 * Actually attempt the kernel oplock polling open.
3003 static void poll_open_fn(struct tevent_context
*ev
,
3004 struct tevent_timer
*te
,
3005 struct timeval current_time
,
3008 struct deferred_open_record
*open_rec
= talloc_get_type_abort(
3009 private_data
, struct deferred_open_record
);
3012 TALLOC_FREE(open_rec
->watch_req
);
3014 ok
= schedule_deferred_open_message_smb(
3015 open_rec
->xconn
, open_rec
->mid
);
3017 exit_server("schedule_deferred_open_message_smb failed");
3019 DBG_DEBUG("timer fired. Retrying open !\n");
3022 static void poll_open_done(struct tevent_req
*subreq
);
3024 struct poll_open_setup_watcher_state
{
3025 TALLOC_CTX
*mem_ctx
;
3026 struct tevent_context
*ev_ctx
;
3027 struct tevent_req
*watch_req
;
3030 static void poll_open_setup_watcher_fn(struct share_mode_lock
*lck
,
3033 struct poll_open_setup_watcher_state
*state
=
3034 (struct poll_open_setup_watcher_state
*)private_data
;
3036 if (!validate_oplock_types(lck
)) {
3037 smb_panic("validate_oplock_types failed");
3040 state
->watch_req
= share_mode_watch_send(
3044 (struct server_id
) {0});
3045 if (state
->watch_req
== NULL
) {
3046 DBG_WARNING("share_mode_watch_send failed\n");
3052 * Reschedule an open for 1 second from now, if not timed out.
3054 static bool setup_poll_open(
3055 struct smb_request
*req
,
3056 const struct file_id
*id
,
3057 struct timeval max_timeout
,
3058 struct timeval interval
)
3060 static struct file_id zero_id
= {};
3062 struct deferred_open_record
*open_rec
= NULL
;
3063 struct timeval endtime
, next_interval
;
3064 struct file_id_buf ftmp
;
3066 if (request_timed_out(req
, max_timeout
)) {
3070 open_rec
= talloc_zero(NULL
, struct deferred_open_record
);
3071 if (open_rec
== NULL
) {
3072 DBG_WARNING("talloc failed\n");
3075 open_rec
->xconn
= req
->xconn
;
3076 open_rec
->mid
= req
->mid
;
3079 * Make sure open_rec->te does not come later than the
3080 * request's maximum endtime.
3083 endtime
= timeval_sum(&req
->request_time
, &max_timeout
);
3084 next_interval
= timeval_current_ofs(interval
.tv_sec
, interval
.tv_usec
);
3085 next_interval
= timeval_min(&endtime
, &next_interval
);
3087 open_rec
->te
= tevent_add_timer(
3093 if (open_rec
->te
== NULL
) {
3094 DBG_WARNING("tevent_add_timer failed\n");
3095 TALLOC_FREE(open_rec
);
3100 struct poll_open_setup_watcher_state wstate
= {
3101 .mem_ctx
= open_rec
,
3102 .ev_ctx
= req
->sconn
->ev_ctx
,
3106 status
= share_mode_do_locked_vfs_denied(*id
,
3107 poll_open_setup_watcher_fn
,
3109 if (NT_STATUS_IS_OK(status
)) {
3110 if (wstate
.watch_req
== NULL
) {
3111 DBG_WARNING("share_mode_watch_send failed\n");
3112 TALLOC_FREE(open_rec
);
3115 open_rec
->watch_req
= wstate
.watch_req
;
3116 tevent_req_set_callback(open_rec
->watch_req
,
3119 } else if (!NT_STATUS_EQUAL(status
, NT_STATUS_NOT_FOUND
)) {
3120 DBG_WARNING("share_mode_do_locked_vfs_denied failed - %s\n",
3122 TALLOC_FREE(open_rec
);
3129 ok
= push_deferred_open_message_smb(req
, max_timeout
, *id
, open_rec
);
3131 DBG_WARNING("push_deferred_open_message_smb failed\n");
3132 TALLOC_FREE(open_rec
);
3136 DBG_DEBUG("poll request time [%s] mid [%" PRIu64
"] file_id [%s]\n",
3137 timeval_string(talloc_tos(), &req
->request_time
, false),
3139 file_id_str_buf(*id
, &ftmp
));
3144 static void poll_open_done(struct tevent_req
*subreq
)
3146 struct deferred_open_record
*open_rec
= tevent_req_callback_data(
3147 subreq
, struct deferred_open_record
);
3151 status
= share_mode_watch_recv(subreq
, NULL
, NULL
);
3152 TALLOC_FREE(subreq
);
3153 open_rec
->watch_req
= NULL
;
3154 TALLOC_FREE(open_rec
->te
);
3156 DBG_DEBUG("dbwrap_watched_watch_recv returned %s\n",
3159 ok
= schedule_deferred_open_message_smb(
3160 open_rec
->xconn
, open_rec
->mid
);
3162 exit_server("schedule_deferred_open_message_smb failed");
3166 bool defer_smb1_sharing_violation(struct smb_request
*req
)
3171 if (!lp_defer_sharing_violations()) {
3176 * Try every 200msec up to (by default) one second. To be
3177 * precise, according to behaviour note <247> in [MS-CIFS],
3178 * the server tries 5 times. But up to one second should be
3182 timeout_usecs
= lp_parm_int(
3186 SHARING_VIOLATION_USEC_WAIT
);
3188 ok
= setup_poll_open(
3191 (struct timeval
) { .tv_usec
= timeout_usecs
},
3192 (struct timeval
) { .tv_usec
= 200000 });
3196 /****************************************************************************
3197 On overwrite open ensure that the attributes match.
3198 ****************************************************************************/
3200 static bool open_match_attributes(connection_struct
*conn
,
3201 uint32_t old_dos_attr
,
3202 uint32_t new_dos_attr
,
3203 mode_t new_unx_mode
,
3204 mode_t
*returned_unx_mode
)
3206 uint32_t noarch_old_dos_attr
, noarch_new_dos_attr
;
3208 noarch_old_dos_attr
= (old_dos_attr
& ~FILE_ATTRIBUTE_ARCHIVE
);
3209 noarch_new_dos_attr
= (new_dos_attr
& ~FILE_ATTRIBUTE_ARCHIVE
);
3211 if((noarch_old_dos_attr
== 0 && noarch_new_dos_attr
!= 0) ||
3212 (noarch_old_dos_attr
!= 0 && ((noarch_old_dos_attr
& noarch_new_dos_attr
) == noarch_old_dos_attr
))) {
3213 *returned_unx_mode
= new_unx_mode
;
3215 *returned_unx_mode
= (mode_t
)0;
3218 DEBUG(10,("open_match_attributes: old_dos_attr = 0x%x, "
3219 "new_dos_attr = 0x%x "
3220 "returned_unx_mode = 0%o\n",
3221 (unsigned int)old_dos_attr
,
3222 (unsigned int)new_dos_attr
,
3223 (unsigned int)*returned_unx_mode
));
3225 /* If we're mapping SYSTEM and HIDDEN ensure they match. */
3226 if (lp_map_system(SNUM(conn
)) || lp_store_dos_attributes(SNUM(conn
))) {
3227 if ((old_dos_attr
& FILE_ATTRIBUTE_SYSTEM
) &&
3228 !(new_dos_attr
& FILE_ATTRIBUTE_SYSTEM
)) {
3232 if (lp_map_hidden(SNUM(conn
)) || lp_store_dos_attributes(SNUM(conn
))) {
3233 if ((old_dos_attr
& FILE_ATTRIBUTE_HIDDEN
) &&
3234 !(new_dos_attr
& FILE_ATTRIBUTE_HIDDEN
)) {
3241 static void schedule_defer_open(struct share_mode_lock
*lck
,
3243 struct smb_request
*req
)
3245 /* This is a relative time, added to the absolute
3246 request_time value to get the absolute timeout time.
3247 Note that if this is the second or greater time we enter
3248 this codepath for this particular request mid then
3249 request_time is left as the absolute time of the *first*
3250 time this request mid was processed. This is what allows
3251 the request to eventually time out. */
3253 struct timeval timeout
;
3255 /* Normally the smbd we asked should respond within
3256 * OPLOCK_BREAK_TIMEOUT seconds regardless of whether
3257 * the client did, give twice the timeout as a safety
3258 * measure here in case the other smbd is stuck
3259 * somewhere else. */
3261 timeout
= timeval_set(OPLOCK_BREAK_TIMEOUT
*2, 0);
3263 if (request_timed_out(req
, timeout
)) {
3267 defer_open(lck
, timeout
, req
, id
);
3270 /****************************************************************************
3271 Reschedule an open call that went asynchronous.
3272 ****************************************************************************/
3274 static void schedule_async_open_timer(struct tevent_context
*ev
,
3275 struct tevent_timer
*te
,
3276 struct timeval current_time
,
3279 exit_server("async open timeout");
3282 static void schedule_async_open(struct smb_request
*req
)
3284 struct deferred_open_record
*open_rec
= NULL
;
3285 struct timeval timeout
= timeval_set(20, 0);
3288 if (request_timed_out(req
, timeout
)) {
3292 open_rec
= talloc_zero(NULL
, struct deferred_open_record
);
3293 if (open_rec
== NULL
) {
3294 exit_server("deferred_open_record_create failed");
3296 open_rec
->async_open
= true;
3298 ok
= push_deferred_open_message_smb(
3299 req
, timeout
, (struct file_id
){0}, open_rec
);
3301 exit_server("push_deferred_open_message_smb failed");
3304 open_rec
->te
= tevent_add_timer(req
->sconn
->ev_ctx
,
3306 timeval_current_ofs(20, 0),
3307 schedule_async_open_timer
,
3309 if (open_rec
->te
== NULL
) {
3310 exit_server("tevent_add_timer failed");
3314 static NTSTATUS
check_and_store_share_mode(
3315 struct files_struct
*fsp
,
3316 struct smb_request
*req
,
3317 struct share_mode_lock
*lck
,
3318 uint32_t create_disposition
,
3319 uint32_t access_mask
,
3320 uint32_t share_access
,
3322 const struct smb2_lease
*lease
,
3323 bool first_open_attempt
)
3326 int oplock_type
= NO_OPLOCK
;
3327 uint32_t granted_lease
= 0;
3328 const struct smb2_lease_key
*lease_key
= NULL
;
3329 bool delete_on_close
;
3332 /* Get the types we need to examine. */
3333 if (!validate_oplock_types(lck
)) {
3334 smb_panic("validate_oplock_types failed");
3337 delete_on_close
= has_delete_on_close(lck
, fsp
->name_hash
);
3338 if (delete_on_close
) {
3339 return NT_STATUS_DELETE_PENDING
;
3342 status
= handle_share_mode_lease(fsp
,
3352 if (NT_STATUS_EQUAL(status
, NT_STATUS_RETRY
)) {
3353 schedule_defer_open(lck
, fsp
->file_id
, req
);
3354 return NT_STATUS_SHARING_VIOLATION
;
3356 if (!NT_STATUS_IS_OK(status
)) {
3360 if (oplock_type
== LEASE_OPLOCK
) {
3361 lease_key
= &lease
->lease_key
;
3364 share_mode_flags_restrict(lck
, access_mask
, share_access
, 0);
3366 ok
= set_share_mode(lck
,
3368 get_current_uid(fsp
->conn
),
3375 return NT_STATUS_NO_MEMORY
;
3378 if (oplock_type
== LEASE_OPLOCK
) {
3379 status
= grant_fsp_lease(fsp
, lck
, lease
, granted_lease
);
3380 if (!NT_STATUS_IS_OK(status
)) {
3381 del_share_mode(lck
, fsp
);
3385 DBG_DEBUG("lease_state=%d\n", fsp
->lease
->lease
.lease_state
);
3388 fsp
->oplock_type
= oplock_type
;
3390 return NT_STATUS_OK
;
3393 /****************************************************************************
3394 Work out what access_mask to use from what the client sent us.
3395 ****************************************************************************/
3397 static NTSTATUS
smbd_calculate_maximum_allowed_access_fsp(
3398 struct files_struct
*dirfsp
,
3399 struct files_struct
*fsp
,
3401 uint32_t *p_access_mask
)
3403 struct security_descriptor
*sd
= NULL
;
3404 uint32_t access_granted
= 0;
3408 /* Cope with symlinks */
3409 if (fsp
== NULL
|| fsp_get_pathref_fd(fsp
) == -1) {
3410 *p_access_mask
= FILE_GENERIC_ALL
;
3411 return NT_STATUS_OK
;
3414 /* Cope with fake/printer fsp's. */
3415 if (fsp
->fake_file_handle
!= NULL
|| fsp
->print_file
!= NULL
) {
3416 *p_access_mask
= FILE_GENERIC_ALL
;
3417 return NT_STATUS_OK
;
3420 if (!use_privs
&& (get_current_uid(fsp
->conn
) == (uid_t
)0)) {
3421 *p_access_mask
|= FILE_GENERIC_ALL
;
3422 return NT_STATUS_OK
;
3425 status
= SMB_VFS_FGET_NT_ACL(metadata_fsp(fsp
),
3432 if (NT_STATUS_EQUAL(status
, NT_STATUS_OBJECT_NAME_NOT_FOUND
)) {
3434 * File did not exist
3436 *p_access_mask
= FILE_GENERIC_ALL
;
3437 return NT_STATUS_OK
;
3439 if (!NT_STATUS_IS_OK(status
)) {
3440 DBG_ERR("Could not get acl on file %s: %s\n",
3447 * If we can access the path to this file, by
3448 * default we have FILE_READ_ATTRIBUTES from the
3449 * containing directory. See the section:
3450 * "Algorithm to Check Access to an Existing File"
3453 * se_file_access_check()
3454 * also takes care of owner WRITE_DAC and READ_CONTROL.
3456 status
= se_file_access_check(sd
,
3457 get_current_nttok(fsp
->conn
),
3459 (*p_access_mask
& ~FILE_READ_ATTRIBUTES
),
3464 if (!NT_STATUS_IS_OK(status
)) {
3465 DBG_ERR("Status %s on file %s: "
3466 "when calculating maximum access\n",
3472 *p_access_mask
= (access_granted
| FILE_READ_ATTRIBUTES
);
3474 if (!(access_granted
& DELETE_ACCESS
)) {
3475 if (can_delete_file_in_directory(fsp
->conn
,
3478 *p_access_mask
|= DELETE_ACCESS
;
3482 dosattrs
= fdos_mode(fsp
);
3483 if ((dosattrs
& FILE_ATTRIBUTE_READONLY
) || !CAN_WRITE(fsp
->conn
)) {
3484 *p_access_mask
&= ~(FILE_GENERIC_WRITE
| DELETE_ACCESS
);
3487 return NT_STATUS_OK
;
3490 NTSTATUS
smbd_calculate_access_mask_fsp(struct files_struct
*dirfsp
,
3491 struct files_struct
*fsp
,
3493 uint32_t access_mask
,
3494 uint32_t *access_mask_out
)
3497 uint32_t orig_access_mask
= access_mask
;
3498 uint32_t rejected_share_access
;
3500 if (access_mask
& SEC_MASK_INVALID
) {
3501 DBG_DEBUG("access_mask [%8x] contains invalid bits\n",
3503 return NT_STATUS_ACCESS_DENIED
;
3507 * Convert GENERIC bits to specific bits.
3510 se_map_generic(&access_mask
, &file_generic_mapping
);
3512 /* Calculate MAXIMUM_ALLOWED_ACCESS if requested. */
3513 if (access_mask
& MAXIMUM_ALLOWED_ACCESS
) {
3515 status
= smbd_calculate_maximum_allowed_access_fsp(
3521 if (!NT_STATUS_IS_OK(status
)) {
3525 access_mask
&= fsp
->conn
->share_access
;
3528 rejected_share_access
= access_mask
& ~(fsp
->conn
->share_access
);
3530 if (rejected_share_access
) {
3531 DBG_INFO("Access denied on file %s: "
3532 "rejected by share access mask[0x%08X] "
3533 "orig[0x%08X] mapped[0x%08X] reject[0x%08X]\n",
3535 fsp
->conn
->share_access
,
3536 orig_access_mask
, access_mask
,
3537 rejected_share_access
);
3538 return NT_STATUS_ACCESS_DENIED
;
3541 *access_mask_out
= access_mask
;
3542 return NT_STATUS_OK
;
3545 /****************************************************************************
3546 Remove the deferred open entry under lock.
3547 ****************************************************************************/
3549 /****************************************************************************
3550 Return true if this is a state pointer to an asynchronous create.
3551 ****************************************************************************/
3553 bool is_deferred_open_async(const struct deferred_open_record
*rec
)
3555 return rec
->async_open
;
3558 static bool clear_ads(uint32_t create_disposition
)
3562 switch (create_disposition
) {
3563 case FILE_SUPERSEDE
:
3564 case FILE_OVERWRITE_IF
:
3565 case FILE_OVERWRITE
:
3574 static int disposition_to_open_flags(uint32_t create_disposition
)
3579 * Currently we're using FILE_SUPERSEDE as the same as
3580 * FILE_OVERWRITE_IF but they really are
3581 * different. FILE_SUPERSEDE deletes an existing file
3582 * (requiring delete access) then recreates it.
3585 switch (create_disposition
) {
3586 case FILE_SUPERSEDE
:
3587 case FILE_OVERWRITE_IF
:
3589 * If file exists replace/overwrite. If file doesn't
3592 ret
= O_CREAT
|O_TRUNC
;
3597 * If file exists open. If file doesn't exist error.
3602 case FILE_OVERWRITE
:
3604 * If file exists overwrite. If file doesn't exist
3612 * If file exists error. If file doesn't exist create.
3614 ret
= O_CREAT
|O_EXCL
;
3619 * If file exists open. If file doesn't exist create.
3627 static int calculate_open_access_flags(uint32_t access_mask
,
3628 uint32_t private_flags
)
3630 bool need_write
, need_read
;
3633 * Note that we ignore the append flag as append does not
3634 * mean the same thing under DOS and Unix.
3637 need_write
= (access_mask
& (FILE_WRITE_DATA
| FILE_APPEND_DATA
));
3642 /* DENY_DOS opens are always underlying read-write on the
3643 file handle, no matter what the requested access mask
3647 ((private_flags
& NTCREATEX_FLAG_DENY_DOS
) ||
3648 access_mask
& (FILE_READ_ATTRIBUTES
|FILE_READ_DATA
|
3649 FILE_READ_EA
|FILE_EXECUTE
));
3657 struct open_ntcreate_lock_state
{
3658 struct share_mode_entry_prepare_state prepare_state
;
3659 struct files_struct
*fsp
;
3660 const char *object_type
;
3661 struct smb_request
*req
;
3662 uint32_t create_disposition
;
3663 uint32_t access_mask
;
3664 uint32_t share_access
;
3666 const struct smb2_lease
*lease
;
3667 bool first_open_attempt
;
3670 struct timespec write_time
;
3671 share_mode_entry_prepare_unlock_fn_t cleanup_fn
;
3674 static void open_ntcreate_lock_add_entry(struct share_mode_lock
*lck
,
3678 struct open_ntcreate_lock_state
*state
=
3679 (struct open_ntcreate_lock_state
*)private_data
;
3682 * By default drop the g_lock again if we leave the
3685 *keep_locked
= false;
3687 state
->status
= check_and_store_share_mode(state
->fsp
,
3690 state
->create_disposition
,
3692 state
->share_access
,
3693 state
->oplock_request
,
3695 state
->first_open_attempt
);
3696 if (!NT_STATUS_IS_OK(state
->status
)) {
3700 state
->write_time
= get_share_mode_write_time(lck
);
3703 * keep the g_lock while existing the tdb chainlock,
3704 * we we're asked to, which mean we'll keep
3705 * the share_mode_lock during object creation,
3706 * or setting delete on close.
3708 *keep_locked
= state
->keep_locked
;
3711 static void open_ntcreate_lock_cleanup_oplock(struct share_mode_lock
*lck
,
3714 struct open_ntcreate_lock_state
*state
=
3715 (struct open_ntcreate_lock_state
*)private_data
;
3718 ok
= remove_share_oplock(lck
, state
->fsp
);
3720 DBG_ERR("Could not remove oplock for %s %s\n",
3721 state
->object_type
, fsp_str_dbg(state
->fsp
));
3725 static void open_ntcreate_lock_cleanup_entry(struct share_mode_lock
*lck
,
3728 struct open_ntcreate_lock_state
*state
=
3729 (struct open_ntcreate_lock_state
*)private_data
;
3732 ok
= del_share_mode(lck
, state
->fsp
);
3734 DBG_ERR("Could not delete share entry for %s %s\n",
3735 state
->object_type
, fsp_str_dbg(state
->fsp
));
3739 static void possibly_set_archive(struct connection_struct
*conn
,
3740 struct files_struct
*fsp
,
3741 struct smb_filename
*smb_fname
,
3742 struct smb_filename
*parent_dir_fname
,
3747 bool set_archive
= false;
3750 if (info
== FILE_WAS_OPENED
) {
3754 /* Overwritten files should be initially set as archive */
3755 if ((info
== FILE_WAS_OVERWRITTEN
&& lp_map_archive(SNUM(conn
)))) {
3757 } else if (lp_store_dos_attributes(SNUM(conn
))) {
3764 ret
= file_set_dosmode(conn
,
3766 dosattrs
| FILE_ATTRIBUTE_ARCHIVE
,
3772 *unx_mode
= smb_fname
->st
.st_ex_mode
;
3775 /****************************************************************************
3776 Open a file with a share mode. Passed in an already created files_struct *.
3777 ****************************************************************************/
3779 static NTSTATUS
open_file_ntcreate(connection_struct
*conn
,
3780 struct smb_request
*req
,
3781 uint32_t access_mask
, /* access bits (FILE_READ_DATA etc.) */
3782 uint32_t share_access
, /* share constants (FILE_SHARE_READ etc) */
3783 uint32_t create_disposition
, /* FILE_OPEN_IF etc. */
3784 uint32_t create_options
, /* options such as delete on close. */
3785 uint32_t new_dos_attributes
, /* attributes used for new file. */
3786 int oplock_request
, /* internal Samba oplock codes. */
3787 const struct smb2_lease
*lease
,
3788 /* Information (FILE_EXISTS etc.) */
3789 uint32_t private_flags
, /* Samba specific flags. */
3790 struct smb_filename
*parent_dir_fname
, /* parent. */
3791 struct smb_filename
*smb_fname_atname
, /* atname relative to parent. */
3795 struct smb_filename
*smb_fname
= fsp
->fsp_name
;
3797 bool file_existed
= VALID_STAT(smb_fname
->st
);
3798 bool def_acl
= False
;
3799 bool posix_open
= False
;
3800 bool new_file_created
= False
;
3801 bool first_open_attempt
= true;
3802 NTSTATUS fsp_open
= NT_STATUS_ACCESS_DENIED
;
3803 mode_t new_unx_mode
= (mode_t
)0;
3804 mode_t unx_mode
= (mode_t
)0;
3806 uint32_t existing_dos_attributes
= 0;
3807 struct open_ntcreate_lock_state lck_state
= {};
3808 bool keep_locked
= false;
3809 uint32_t open_access_mask
= access_mask
;
3811 SMB_STRUCT_STAT saved_stat
= smb_fname
->st
;
3812 struct timespec old_write_time
;
3813 bool setup_poll
= false;
3816 if (conn
->printer
) {
3818 * Printers are handled completely differently.
3819 * Most of the passed parameters are ignored.
3823 *pinfo
= FILE_WAS_CREATED
;
3826 DBG_DEBUG("printer open fname=%s\n",
3827 smb_fname_str_dbg(smb_fname
));
3830 DBG_ERR("printer open without an SMB request!\n");
3831 return NT_STATUS_INTERNAL_ERROR
;
3834 return print_spool_open(fsp
, smb_fname
->base_name
,
3838 if (new_dos_attributes
& FILE_FLAG_POSIX_SEMANTICS
) {
3840 unx_mode
= (mode_t
)(new_dos_attributes
& ~FILE_FLAG_POSIX_SEMANTICS
);
3841 new_dos_attributes
= 0;
3843 /* Windows allows a new file to be created and
3844 silently removes a FILE_ATTRIBUTE_DIRECTORY
3845 sent by the client. Do the same. */
3847 new_dos_attributes
&= ~FILE_ATTRIBUTE_DIRECTORY
;
3849 /* We add FILE_ATTRIBUTE_ARCHIVE to this as this mode is only used if the file is
3851 unx_mode
= unix_mode(
3853 new_dos_attributes
| FILE_ATTRIBUTE_ARCHIVE
,
3855 parent_dir_fname
->fsp
);
3858 DEBUG(10, ("open_file_ntcreate: fname=%s, dos_attrs=0x%x "
3859 "access_mask=0x%x share_access=0x%x "
3860 "create_disposition = 0x%x create_options=0x%x "
3861 "unix mode=0%o oplock_request=%d private_flags = 0x%x\n",
3862 smb_fname_str_dbg(smb_fname
), new_dos_attributes
,
3863 access_mask
, share_access
, create_disposition
,
3864 create_options
, (unsigned int)unx_mode
, oplock_request
,
3865 (unsigned int)private_flags
));
3868 /* Ensure req == NULL means INTERNAL_OPEN_ONLY */
3869 SMB_ASSERT(oplock_request
== INTERNAL_OPEN_ONLY
);
3871 /* And req != NULL means no INTERNAL_OPEN_ONLY */
3872 SMB_ASSERT(((oplock_request
& INTERNAL_OPEN_ONLY
) == 0));
3876 * Only non-internal opens can be deferred at all
3880 struct deferred_open_record
*open_rec
;
3881 if (get_deferred_open_message_state(req
, NULL
, &open_rec
)) {
3883 /* If it was an async create retry, the file
3886 if (is_deferred_open_async(open_rec
)) {
3887 SET_STAT_INVALID(smb_fname
->st
);
3888 file_existed
= false;
3891 /* Ensure we don't reprocess this message. */
3892 remove_deferred_open_message_smb(req
->xconn
, req
->mid
);
3894 first_open_attempt
= false;
3899 new_dos_attributes
&= SAMBA_ATTRIBUTES_MASK
;
3902 * Only use stored DOS attributes for checks
3903 * against requested attributes (below via
3904 * open_match_attributes()), cf bug #11992
3905 * for details. -slow
3909 status
= vfs_fget_dos_attributes(smb_fname
->fsp
, &attr
);
3910 if (NT_STATUS_IS_OK(status
)) {
3911 existing_dos_attributes
= attr
;
3916 /* ignore any oplock requests if oplocks are disabled */
3917 if (!lp_oplocks(SNUM(conn
)) ||
3918 IS_VETO_OPLOCK_PATH(conn
, smb_fname
->base_name
)) {
3919 /* Mask off everything except the private Samba bits. */
3920 oplock_request
&= SAMBA_PRIVATE_OPLOCK_MASK
;
3923 /* this is for OS/2 long file names - say we don't support them */
3924 if (req
!= NULL
&& !req
->posix_pathnames
&&
3925 strstr(smb_fname
->base_name
,".+,;=[].")) {
3926 /* OS/2 Workplace shell fix may be main code stream in a later
3928 DEBUG(5,("open_file_ntcreate: OS/2 long filenames are not "
3930 if (use_nt_status()) {
3931 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
3933 return NT_STATUS_DOS(ERRDOS
, ERRcannotopen
);
3936 switch( create_disposition
) {
3938 /* If file exists open. If file doesn't exist error. */
3939 if (!file_existed
) {
3940 DEBUG(5,("open_file_ntcreate: FILE_OPEN "
3941 "requested for file %s and file "
3943 smb_fname_str_dbg(smb_fname
)));
3944 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
3948 case FILE_OVERWRITE
:
3949 /* If file exists overwrite. If file doesn't exist
3951 if (!file_existed
) {
3952 DEBUG(5,("open_file_ntcreate: FILE_OVERWRITE "
3953 "requested for file %s and file "
3955 smb_fname_str_dbg(smb_fname
) ));
3956 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
3961 /* If file exists error. If file doesn't exist
3964 DEBUG(5,("open_file_ntcreate: FILE_CREATE "
3965 "requested for file %s and file "
3966 "already exists.\n",
3967 smb_fname_str_dbg(smb_fname
)));
3968 if (S_ISDIR(smb_fname
->st
.st_ex_mode
)) {
3969 return NT_STATUS_FILE_IS_A_DIRECTORY
;
3971 return NT_STATUS_OBJECT_NAME_COLLISION
;
3975 case FILE_SUPERSEDE
:
3976 case FILE_OVERWRITE_IF
:
3980 return NT_STATUS_INVALID_PARAMETER
;
3983 flags
= disposition_to_open_flags(create_disposition
);
3985 /* We only care about matching attributes on file exists and
3988 if (!posix_open
&& file_existed
&&
3989 ((create_disposition
== FILE_OVERWRITE
) ||
3990 (create_disposition
== FILE_OVERWRITE_IF
))) {
3991 if (!open_match_attributes(conn
, existing_dos_attributes
,
3993 unx_mode
, &new_unx_mode
)) {
3994 DEBUG(5,("open_file_ntcreate: attributes mismatch "
3995 "for file %s (%x %x) (0%o, 0%o)\n",
3996 smb_fname_str_dbg(smb_fname
),
3997 existing_dos_attributes
,
3999 (unsigned int)smb_fname
->st
.st_ex_mode
,
4000 (unsigned int)unx_mode
));
4001 return NT_STATUS_ACCESS_DENIED
;
4005 status
= smbd_calculate_access_mask_fsp(parent_dir_fname
->fsp
,
4010 if (!NT_STATUS_IS_OK(status
)) {
4011 DBG_DEBUG("smbd_calculate_access_mask_fsp "
4012 "on file %s returned %s\n",
4013 smb_fname_str_dbg(smb_fname
),
4018 open_access_mask
= access_mask
;
4020 if (flags
& O_TRUNC
) {
4021 open_access_mask
|= FILE_WRITE_DATA
; /* This will cause oplock breaks. */
4026 * stat opens on existing files don't get oplocks.
4027 * They can get leases.
4029 * Note that we check for stat open on the *open_access_mask*,
4030 * i.e. the access mask we actually used to do the open,
4031 * not the one the client asked for (which is in
4032 * fsp->access_mask). This is due to the fact that
4033 * FILE_OVERWRITE and FILE_OVERWRITE_IF add in O_TRUNC,
4034 * which adds FILE_WRITE_DATA to open_access_mask.
4036 if (is_oplock_stat_open(open_access_mask
) && lease
== NULL
) {
4037 oplock_request
= NO_OPLOCK
;
4041 DEBUG(10, ("open_file_ntcreate: fname=%s, after mapping "
4042 "access_mask=0x%x\n", smb_fname_str_dbg(smb_fname
),
4046 * Note that we ignore the append flag as append does not
4047 * mean the same thing under DOS and Unix.
4050 flags
|= calculate_open_access_flags(access_mask
, private_flags
);
4053 * Currently we only look at FILE_WRITE_THROUGH for create options.
4057 if ((create_options
& FILE_WRITE_THROUGH
) && lp_strict_sync(SNUM(conn
))) {
4062 if (posix_open
&& (access_mask
& FILE_APPEND_DATA
)) {
4066 if (!posix_open
&& !CAN_WRITE(conn
)) {
4068 * We should really return a permission denied error if either
4069 * O_CREAT or O_TRUNC are set, but for compatibility with
4070 * older versions of Samba we just AND them out.
4072 flags
&= ~(O_CREAT
| O_TRUNC
);
4076 * With kernel oplocks the open breaking an oplock
4077 * blocks until the oplock holder has given up the
4078 * oplock or closed the file. We prevent this by always
4079 * trying to open the file with O_NONBLOCK (see "man
4082 * If a process that doesn't use the smbd open files
4083 * database or communication methods holds a kernel
4084 * oplock we must periodically poll for available open
4087 flags
|= O_NONBLOCK
;
4090 * Ensure we can't write on a read-only share or file.
4093 if (((flags
& O_ACCMODE
) != O_RDONLY
) && file_existed
&&
4094 (!CAN_WRITE(conn
) ||
4095 (existing_dos_attributes
& FILE_ATTRIBUTE_READONLY
))) {
4096 DEBUG(5,("open_file_ntcreate: write access requested for "
4097 "file %s on read only %s\n",
4098 smb_fname_str_dbg(smb_fname
),
4099 !CAN_WRITE(conn
) ? "share" : "file" ));
4100 return NT_STATUS_ACCESS_DENIED
;
4103 if (VALID_STAT(smb_fname
->st
)) {
4105 * Only try and create a file id before open
4106 * for an existing file. For a file being created
4107 * this won't do anything useful until the file
4108 * exists and has a valid stat struct.
4110 fsp
->file_id
= vfs_file_id_from_sbuf(conn
, &smb_fname
->st
);
4112 fh_set_private_options(fsp
->fh
, private_flags
);
4113 fsp
->access_mask
= open_access_mask
; /* We change this to the
4114 * requested access_mask after
4115 * the open is done. */
4117 fsp
->posix_flags
|= FSP_POSIX_FLAGS_ALL
;
4120 if ((create_options
& FILE_DELETE_ON_CLOSE
) && (flags
& O_CREAT
) &&
4122 /* Delete on close semantics for new files. */
4123 status
= can_set_delete_on_close(fsp
,
4124 new_dos_attributes
);
4125 if (!NT_STATUS_IS_OK(status
)) {
4132 * Ensure we pay attention to default ACLs on directories if required.
4135 if ((flags
& O_CREAT
) && lp_inherit_acls(SNUM(conn
)) &&
4136 (def_acl
= directory_has_default_acl_fsp(parent_dir_fname
->fsp
))) {
4137 unx_mode
= (0777 & lp_create_mask(SNUM(conn
)));
4141 ("calling open_file with flags=0x%X mode=0%o, "
4142 "access_mask = 0x%x, open_access_mask = 0x%x\n",
4143 (unsigned int)flags
,
4144 (unsigned int)unx_mode
,
4145 (unsigned int)access_mask
,
4146 (unsigned int)open_access_mask
));
4149 struct vfs_open_how how
= {
4154 if (create_options
& FILE_OPEN_FOR_BACKUP_INTENT
) {
4155 how
.resolve
|= VFS_OPEN_HOW_WITH_BACKUP_INTENT
;
4158 fsp_open
= open_file(req
,
4159 parent_dir_fname
->fsp
,
4168 if (NT_STATUS_EQUAL(fsp_open
, NT_STATUS_NETWORK_BUSY
)) {
4169 if (file_existed
&& S_ISFIFO(fsp
->fsp_name
->st
.st_ex_mode
)) {
4170 DEBUG(10, ("FIFO busy\n"));
4171 return NT_STATUS_NETWORK_BUSY
;
4174 DEBUG(10, ("Internal open busy\n"));
4175 return NT_STATUS_NETWORK_BUSY
;
4178 * This handles the kernel oplock case:
4180 * the file has an active kernel oplock and the open() returned
4181 * EWOULDBLOCK/EAGAIN which maps to NETWORK_BUSY.
4183 * "Samba locking.tdb oplocks" are handled below after acquiring
4184 * the sharemode lock with get_share_mode_lock().
4189 if (NT_STATUS_EQUAL(fsp_open
, NT_STATUS_RETRY
)) {
4191 * EINTR from the open(2) syscall. Just setup a retry
4192 * in a bit. We can't use the sys_write() tight retry
4193 * loop here, as we might have to actually deal with
4194 * lease-break signals to avoid a deadlock.
4201 * Retry once a second. If there's a share_mode_lock
4202 * around, also wait for it in case it was smbd
4203 * holding that kernel oplock that can quickly tell us
4204 * the oplock got removed.
4210 timeval_set(OPLOCK_BREAK_TIMEOUT
*2, 0),
4213 return NT_STATUS_SHARING_VIOLATION
;
4216 if (!NT_STATUS_IS_OK(fsp_open
)) {
4217 bool wait_for_aio
= NT_STATUS_EQUAL(
4218 fsp_open
, NT_STATUS_MORE_PROCESSING_REQUIRED
);
4220 schedule_async_open(req
);
4225 if (new_file_created
) {
4227 * As we atomically create using O_CREAT|O_EXCL,
4228 * then if new_file_created is true, then
4229 * file_existed *MUST* have been false (even
4230 * if the file was previously detected as being
4233 file_existed
= false;
4236 if (file_existed
&& !check_same_dev_ino(&saved_stat
, &smb_fname
->st
)) {
4238 * The file did exist, but some other (local or NFS)
4239 * process either renamed/unlinked and re-created the
4240 * file with different dev/ino after we walked the path,
4241 * but before we did the open. We could retry the
4242 * open but it's a rare enough case it's easier to
4243 * just fail the open to prevent creating any problems
4244 * in the open file db having the wrong dev/ino key.
4247 DBG_WARNING("file %s - dev/ino mismatch. "
4248 "Old (dev=%ju, ino=%ju). "
4249 "New (dev=%ju, ino=%ju). Failing open "
4250 "with NT_STATUS_ACCESS_DENIED.\n",
4251 smb_fname_str_dbg(smb_fname
),
4252 (uintmax_t)saved_stat
.st_ex_dev
,
4253 (uintmax_t)saved_stat
.st_ex_ino
,
4254 (uintmax_t)smb_fname
->st
.st_ex_dev
,
4255 (uintmax_t)smb_fname
->st
.st_ex_ino
);
4256 return NT_STATUS_ACCESS_DENIED
;
4259 old_write_time
= smb_fname
->st
.st_ex_mtime
;
4262 * Deal with the race condition where two smbd's detect the
4263 * file doesn't exist and do the create at the same time. One
4264 * of them will win and set a share mode, the other (ie. this
4265 * one) should check if the requested share mode for this
4266 * create is allowed.
4270 * Now the file exists and fsp is successfully opened,
4271 * fsp->dev and fsp->inode are valid and should replace the
4272 * dev=0,inode=0 from a non existent file. Spotted by
4273 * Nadav Danieli <nadavd@exanet.com>. JRA.
4276 if (new_file_created
) {
4277 info
= FILE_WAS_CREATED
;
4279 if (flags
& O_TRUNC
) {
4280 info
= FILE_WAS_OVERWRITTEN
;
4282 info
= FILE_WAS_OPENED
;
4287 * If we created a new file, overwrite an existing one
4288 * or going to delete it later, we should keep
4289 * the share_mode_lock (g_lock) until we call
4290 * share_mode_entry_prepare_unlock()
4292 if (info
!= FILE_WAS_OPENED
) {
4294 } else if (create_options
& FILE_DELETE_ON_CLOSE
) {
4298 lck_state
= (struct open_ntcreate_lock_state
) {
4300 .object_type
= "file",
4302 .create_disposition
= create_disposition
,
4303 .access_mask
= access_mask
,
4304 .share_access
= share_access
,
4305 .oplock_request
= oplock_request
,
4307 .first_open_attempt
= first_open_attempt
,
4308 .keep_locked
= keep_locked
,
4311 status
= share_mode_entry_prepare_lock_add(&lck_state
.prepare_state
,
4316 open_ntcreate_lock_add_entry
,
4318 if (!NT_STATUS_IS_OK(status
)) {
4319 DBG_ERR("share_mode_entry_prepare_lock_add() failed for %s - %s\n",
4320 smb_fname_str_dbg(smb_fname
), nt_errstr(status
));
4325 status
= lck_state
.status
;
4326 if (!NT_STATUS_IS_OK(status
)) {
4332 * From here we need to use 'goto unlock;' instead of return !!!
4335 if (fsp
->oplock_type
!= NO_OPLOCK
&& fsp
->oplock_type
!= LEASE_OPLOCK
) {
4337 * Now ask for kernel oplocks
4338 * and cleanup on failure.
4340 status
= set_file_oplock(fsp
);
4341 if (!NT_STATUS_IS_OK(status
)) {
4343 * Could not get the kernel oplock
4345 lck_state
.cleanup_fn
=
4346 open_ntcreate_lock_cleanup_oplock
;
4347 fsp
->oplock_type
= NO_OPLOCK
;
4351 /* Should we atomically (to the client at least) truncate ? */
4352 if ((!new_file_created
) && (flags
& O_TRUNC
) &&
4353 (S_ISREG(fsp
->fsp_name
->st
.st_ex_mode
))) {
4356 ret
= SMB_VFS_FTRUNCATE(fsp
, 0);
4358 status
= map_nt_error_from_unix(errno
);
4359 lck_state
.cleanup_fn
=
4360 open_ntcreate_lock_cleanup_entry
;
4363 notify_fname(fsp
->conn
, NOTIFY_ACTION_MODIFIED
,
4364 FILE_NOTIFY_CHANGE_SIZE
4365 | FILE_NOTIFY_CHANGE_ATTRIBUTES
,
4366 fsp
->fsp_name
->base_name
);
4370 * We have the share entry *locked*.....
4373 /* Delete streams if create_disposition requires it */
4374 if (!new_file_created
&&
4375 clear_ads(create_disposition
) &&
4376 !fsp_is_alternate_stream(fsp
)) {
4377 status
= delete_all_streams(conn
, smb_fname
);
4378 if (!NT_STATUS_IS_OK(status
)) {
4379 lck_state
.cleanup_fn
=
4380 open_ntcreate_lock_cleanup_entry
;
4385 if (!fsp
->fsp_flags
.is_pathref
&&
4386 fsp_get_io_fd(fsp
) != -1 &&
4387 lp_kernel_share_modes(SNUM(conn
)))
4391 * Beware: streams implementing VFS modules may
4392 * implement streams in a way that fsp will have the
4393 * basefile open in the fsp fd, so lacking a distinct
4394 * fd for the stream the file-system sharemode will
4395 * apply on the basefile which is wrong. The actual
4396 * check is deferred to the VFS module implementing
4397 * the file-system sharemode call.
4399 ret
= SMB_VFS_FILESYSTEM_SHAREMODE(fsp
,
4403 status
= NT_STATUS_SHARING_VIOLATION
;
4404 lck_state
.cleanup_fn
=
4405 open_ntcreate_lock_cleanup_entry
;
4409 fsp
->fsp_flags
.kernel_share_modes_taken
= true;
4413 * At this point onwards, we can guarantee that the share entry
4414 * is locked, whether we created the file or not, and that the
4415 * deny mode is compatible with all current opens.
4419 * According to Samba4, SEC_FILE_READ_ATTRIBUTE is always granted,
4420 * but we don't have to store this - just ignore it on access check.
4422 if (conn
->sconn
->using_smb2
) {
4424 * SMB2 doesn't return it (according to Microsoft tests).
4425 * Test Case: TestSuite_ScenarioNo009GrantedAccessTestS0
4426 * File created with access = 0x7 (Read, Write, Delete)
4427 * Query Info on file returns 0x87 (Read, Write, Delete, Read Attributes)
4429 fsp
->access_mask
= access_mask
;
4431 /* But SMB1 does. */
4432 fsp
->access_mask
= access_mask
| FILE_READ_ATTRIBUTES
;
4439 /* Handle strange delete on close create semantics. */
4440 if (create_options
& FILE_DELETE_ON_CLOSE
) {
4441 if (!new_file_created
) {
4442 status
= can_set_delete_on_close(fsp
,
4443 existing_dos_attributes
);
4445 if (!NT_STATUS_IS_OK(status
)) {
4446 /* Remember to delete the mode we just added. */
4447 lck_state
.cleanup_fn
=
4448 open_ntcreate_lock_cleanup_entry
;
4452 /* Note that here we set the *initial* delete on close flag,
4453 not the regular one. The magic gets handled in close. */
4454 fsp
->fsp_flags
.initial_delete_on_close
= true;
4457 possibly_set_archive(conn
,
4463 &smb_fname
->st
.st_ex_mode
);
4465 /* Determine sparse flag. */
4467 /* POSIX opens are sparse by default. */
4468 fsp
->fsp_flags
.is_sparse
= true;
4470 fsp
->fsp_flags
.is_sparse
=
4471 (existing_dos_attributes
& FILE_ATTRIBUTE_SPARSE
);
4475 * Take care of inherited ACLs on created files - if default ACL not
4479 if (!posix_open
&& new_file_created
&& !def_acl
) {
4480 if (unx_mode
!= smb_fname
->st
.st_ex_mode
) {
4481 int ret
= SMB_VFS_FCHMOD(fsp
, unx_mode
);
4483 DBG_INFO("failed to reset "
4484 "attributes of file %s to 0%o\n",
4485 smb_fname_str_dbg(smb_fname
),
4486 (unsigned int)unx_mode
);
4490 } else if (new_unx_mode
) {
4492 * We only get here in the case of:
4494 * a). Not a POSIX open.
4495 * b). File already existed.
4496 * c). File was overwritten.
4497 * d). Requested DOS attributes didn't match
4498 * the DOS attributes on the existing file.
4500 * In that case new_unx_mode has been set
4501 * equal to the calculated mode (including
4502 * possible inheritance of the mode from the
4503 * containing directory).
4505 * Note this mode was calculated with the
4506 * DOS attribute FILE_ATTRIBUTE_ARCHIVE added,
4507 * so the mode change here is suitable for
4508 * an overwritten file.
4511 if (new_unx_mode
!= smb_fname
->st
.st_ex_mode
) {
4512 int ret
= SMB_VFS_FCHMOD(fsp
, new_unx_mode
);
4514 DBG_INFO("failed to reset "
4515 "attributes of file %s to 0%o\n",
4516 smb_fname_str_dbg(smb_fname
),
4517 (unsigned int)new_unx_mode
);
4523 * Deal with other opens having a modified write time.
4525 if (fsp_getinfo_ask_sharemode(fsp
) &&
4526 !is_omit_timespec(&lck_state
.write_time
))
4528 update_stat_ex_mtime(&fsp
->fsp_name
->st
, lck_state
.write_time
);
4531 status
= NT_STATUS_OK
;
4534 ulstatus
= share_mode_entry_prepare_unlock(&lck_state
.prepare_state
,
4535 lck_state
.cleanup_fn
,
4537 if (!NT_STATUS_IS_OK(ulstatus
)) {
4538 DBG_ERR("share_mode_entry_prepare_unlock() failed for %s - %s\n",
4539 smb_fname_str_dbg(smb_fname
), nt_errstr(ulstatus
));
4540 smb_panic("share_mode_entry_prepare_unlock() failed!");
4543 if (!NT_STATUS_IS_OK(status
)) {
4548 return NT_STATUS_OK
;
4551 static NTSTATUS
mkdir_internal(connection_struct
*conn
,
4552 struct smb_filename
*parent_dir_fname
, /* parent. */
4553 struct smb_filename
*smb_fname_atname
, /* atname relative to parent. */
4554 struct smb_filename
*smb_dname
, /* full pathname from root of share. */
4555 uint32_t file_attributes
,
4556 struct files_struct
*fsp
)
4558 const struct loadparm_substitution
*lp_sub
=
4559 loadparm_s3_global_substitution();
4562 bool posix_open
= false;
4563 bool need_re_stat
= false;
4564 uint32_t access_mask
= SEC_DIR_ADD_SUBDIR
;
4565 struct vfs_open_how how
= { .flags
= O_RDONLY
|O_DIRECTORY
, };
4568 if (!CAN_WRITE(conn
) || (access_mask
& ~(conn
->share_access
))) {
4569 DEBUG(5,("mkdir_internal: failing share access "
4570 "%s\n", lp_servicename(talloc_tos(), lp_sub
, SNUM(conn
))));
4571 return NT_STATUS_ACCESS_DENIED
;
4574 if (file_attributes
& FILE_FLAG_POSIX_SEMANTICS
) {
4576 mode
= (mode_t
)(file_attributes
& ~FILE_FLAG_POSIX_SEMANTICS
);
4578 mode
= unix_mode(conn
,
4579 FILE_ATTRIBUTE_DIRECTORY
,
4581 parent_dir_fname
->fsp
);
4584 status
= check_parent_access_fsp(parent_dir_fname
->fsp
, access_mask
);
4585 if(!NT_STATUS_IS_OK(status
)) {
4586 DBG_INFO("check_parent_access_fsp "
4587 "on directory %s for path %s returned %s\n",
4588 smb_fname_str_dbg(parent_dir_fname
),
4589 smb_dname
->base_name
,
4594 if (lp_inherit_acls(SNUM(conn
))) {
4595 if (directory_has_default_acl_fsp(parent_dir_fname
->fsp
)) {
4596 mode
= (0777 & lp_directory_mask(SNUM(conn
)));
4600 ret
= SMB_VFS_MKDIRAT(conn
,
4601 parent_dir_fname
->fsp
,
4605 return map_nt_error_from_unix(errno
);
4609 * Make this a pathref fsp for now. open_directory() will reopen as a
4612 fsp
->fsp_flags
.is_pathref
= true;
4614 status
= fd_openat(parent_dir_fname
->fsp
, smb_fname_atname
, fsp
, &how
);
4615 if (!NT_STATUS_IS_OK(status
)) {
4619 /* Ensure we're checking for a symlink here.... */
4620 /* We don't want to get caught by a symlink racer. */
4622 status
= vfs_stat_fsp(fsp
);
4623 if (!NT_STATUS_IS_OK(status
)) {
4624 DEBUG(2, ("Could not stat directory '%s' just created: %s\n",
4625 smb_fname_str_dbg(smb_dname
), nt_errstr(status
)));
4629 if (!S_ISDIR(smb_dname
->st
.st_ex_mode
)) {
4630 DEBUG(0, ("Directory '%s' just created is not a directory !\n",
4631 smb_fname_str_dbg(smb_dname
)));
4632 return NT_STATUS_NOT_A_DIRECTORY
;
4635 if (lp_store_dos_attributes(SNUM(conn
))) {
4636 file_set_dosmode(conn
,
4638 file_attributes
| FILE_ATTRIBUTE_DIRECTORY
,
4643 if (lp_inherit_permissions(SNUM(conn
))) {
4644 inherit_access_posix_acl(conn
, parent_dir_fname
->fsp
,
4646 need_re_stat
= true;
4651 * Check if high bits should have been set,
4652 * then (if bits are missing): add them.
4653 * Consider bits automagically set by UNIX, i.e. SGID bit from parent
4656 if ((mode
& ~(S_IRWXU
|S_IRWXG
|S_IRWXO
)) &&
4657 (mode
& ~smb_dname
->st
.st_ex_mode
)) {
4659 (smb_dname
->st
.st_ex_mode
|
4660 (mode
& ~smb_dname
->st
.st_ex_mode
)));
4661 need_re_stat
= true;
4665 /* Change the owner if required. */
4666 if (lp_inherit_owner(SNUM(conn
)) != INHERIT_OWNER_NO
) {
4667 change_dir_owner_to_parent_fsp(parent_dir_fname
->fsp
,
4669 need_re_stat
= true;
4673 status
= vfs_stat_fsp(fsp
);
4674 if (!NT_STATUS_IS_OK(status
)) {
4675 DEBUG(2, ("Could not stat directory '%s' just created: %s\n",
4676 smb_fname_str_dbg(smb_dname
), nt_errstr(status
)));
4681 notify_fname(conn
, NOTIFY_ACTION_ADDED
, FILE_NOTIFY_CHANGE_DIR_NAME
,
4682 smb_dname
->base_name
);
4684 return NT_STATUS_OK
;
4687 /****************************************************************************
4688 Open a directory from an NT SMB call.
4689 ****************************************************************************/
4691 static NTSTATUS
open_directory(connection_struct
*conn
,
4692 struct smb_request
*req
,
4693 uint32_t access_mask
,
4694 uint32_t share_access
,
4695 uint32_t create_disposition
,
4696 uint32_t create_options
,
4697 uint32_t file_attributes
,
4698 struct smb_filename
*parent_dir_fname
,
4699 struct smb_filename
*smb_fname_atname
,
4701 struct files_struct
*fsp
)
4703 struct smb_filename
*smb_dname
= fsp
->fsp_name
;
4704 bool dir_existed
= VALID_STAT(smb_dname
->st
);
4705 struct open_ntcreate_lock_state lck_state
= {};
4706 bool keep_locked
= false;
4708 struct timespec mtimespec
;
4710 uint32_t need_fd_access
;
4713 if (is_ntfs_stream_smb_fname(smb_dname
)) {
4714 DEBUG(2, ("open_directory: %s is a stream name!\n",
4715 smb_fname_str_dbg(smb_dname
)));
4716 return NT_STATUS_NOT_A_DIRECTORY
;
4719 if (!(file_attributes
& FILE_FLAG_POSIX_SEMANTICS
)) {
4720 /* Ensure we have a directory attribute. */
4721 file_attributes
|= FILE_ATTRIBUTE_DIRECTORY
;
4724 DBG_INFO("opening directory %s, access_mask = 0x%"PRIx32
", "
4725 "share_access = 0x%"PRIx32
" create_options = 0x%"PRIx32
", "
4726 "create_disposition = 0x%"PRIx32
", "
4727 "file_attributes = 0x%"PRIx32
"\n",
4728 smb_fname_str_dbg(smb_dname
),
4735 status
= smbd_calculate_access_mask_fsp(parent_dir_fname
->fsp
,
4740 if (!NT_STATUS_IS_OK(status
)) {
4741 DBG_DEBUG("smbd_calculate_access_mask_fsp "
4742 "on file %s returned %s\n",
4743 smb_fname_str_dbg(smb_dname
),
4748 if ((access_mask
& SEC_FLAG_SYSTEM_SECURITY
) &&
4749 !security_token_has_privilege(get_current_nttok(conn
),
4750 SEC_PRIV_SECURITY
)) {
4751 DEBUG(10, ("open_directory: open on %s "
4752 "failed - SEC_FLAG_SYSTEM_SECURITY denied.\n",
4753 smb_fname_str_dbg(smb_dname
)));
4754 return NT_STATUS_PRIVILEGE_NOT_HELD
;
4757 switch( create_disposition
) {
4761 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
4764 info
= FILE_WAS_OPENED
;
4769 /* If directory exists error. If directory doesn't
4773 status
= NT_STATUS_OBJECT_NAME_COLLISION
;
4774 DEBUG(2, ("open_directory: unable to create "
4775 "%s. Error was %s\n",
4776 smb_fname_str_dbg(smb_dname
),
4777 nt_errstr(status
)));
4781 status
= mkdir_internal(conn
,
4788 if (!NT_STATUS_IS_OK(status
)) {
4789 DEBUG(2, ("open_directory: unable to create "
4790 "%s. Error was %s\n",
4791 smb_fname_str_dbg(smb_dname
),
4792 nt_errstr(status
)));
4796 info
= FILE_WAS_CREATED
;
4801 * If directory exists open. If directory doesn't
4806 status
= NT_STATUS_OK
;
4807 info
= FILE_WAS_OPENED
;
4809 status
= mkdir_internal(conn
,
4816 if (NT_STATUS_IS_OK(status
)) {
4817 info
= FILE_WAS_CREATED
;
4820 /* Cope with create race. */
4821 if (!NT_STATUS_EQUAL(status
,
4822 NT_STATUS_OBJECT_NAME_COLLISION
)) {
4823 DEBUG(2, ("open_directory: unable to create "
4824 "%s. Error was %s\n",
4825 smb_fname_str_dbg(smb_dname
),
4826 nt_errstr(status
)));
4831 * If mkdir_internal() returned
4832 * NT_STATUS_OBJECT_NAME_COLLISION
4833 * we still must lstat the path.
4835 ret
= SMB_VFS_FSTATAT(
4837 parent_dir_fname
->fsp
,
4840 AT_SYMLINK_NOFOLLOW
);
4842 DEBUG(2, ("Could not stat "
4843 "directory '%s' just "
4848 return map_nt_error_from_unix(
4852 info
= FILE_WAS_OPENED
;
4858 case FILE_SUPERSEDE
:
4859 case FILE_OVERWRITE
:
4860 case FILE_OVERWRITE_IF
:
4862 DEBUG(5,("open_directory: invalid create_disposition "
4863 "0x%x for directory %s\n",
4864 (unsigned int)create_disposition
,
4865 smb_fname_str_dbg(smb_dname
)));
4866 return NT_STATUS_INVALID_PARAMETER
;
4869 if(!S_ISDIR(smb_dname
->st
.st_ex_mode
)) {
4870 DEBUG(5,("open_directory: %s is not a directory !\n",
4871 smb_fname_str_dbg(smb_dname
)));
4872 return NT_STATUS_NOT_A_DIRECTORY
;
4876 * Setup the files_struct for it.
4879 fsp
->file_id
= vfs_file_id_from_sbuf(conn
, &smb_dname
->st
);
4880 fsp
->vuid
= req
? req
->vuid
: UID_FIELD_INVALID
;
4881 fsp
->file_pid
= req
? req
->smbpid
: 0;
4882 fsp
->fsp_flags
.can_lock
= false;
4883 fsp
->fsp_flags
.can_read
= false;
4884 fsp
->fsp_flags
.can_write
= false;
4886 fh_set_private_options(fsp
->fh
, 0);
4888 * According to Samba4, SEC_FILE_READ_ATTRIBUTE is always granted,
4890 fsp
->access_mask
= access_mask
| FILE_READ_ATTRIBUTES
;
4891 fsp
->print_file
= NULL
;
4892 fsp
->fsp_flags
.modified
= false;
4893 fsp
->oplock_type
= NO_OPLOCK
;
4894 fsp
->sent_oplock_break
= NO_BREAK_SENT
;
4895 fsp
->fsp_flags
.is_directory
= true;
4896 if (file_attributes
& FILE_FLAG_POSIX_SEMANTICS
) {
4897 fsp
->posix_flags
|= FSP_POSIX_FLAGS_ALL
;
4900 /* Don't store old timestamps for directory
4901 handles in the internal database. We don't
4902 update them in there if new objects
4903 are created in the directory. Currently
4904 we only update timestamps on file writes.
4907 mtimespec
= make_omit_timespec();
4910 * Obviously for FILE_LIST_DIRECTORY we need to reopen to get an fd
4911 * usable for reading a directory. SMB2_FLUSH may be called on
4912 * directories opened with FILE_ADD_FILE and FILE_ADD_SUBDIRECTORY so
4913 * for those we need to reopen as well.
4916 FILE_LIST_DIRECTORY
|
4918 FILE_ADD_SUBDIRECTORY
;
4920 if (access_mask
& need_fd_access
) {
4921 struct vfs_open_how how
= {
4922 .flags
= O_RDONLY
| O_DIRECTORY
,
4926 status
= reopen_from_fsp(fsp
->conn
->cwd_fsp
,
4931 if (!NT_STATUS_IS_OK(status
)) {
4932 DBG_INFO("Could not open fd for [%s]: %s\n",
4933 smb_fname_str_dbg(smb_dname
),
4939 status
= vfs_stat_fsp(fsp
);
4940 if (!NT_STATUS_IS_OK(status
)) {
4945 if(!S_ISDIR(fsp
->fsp_name
->st
.st_ex_mode
)) {
4946 DEBUG(5,("open_directory: %s is not a directory !\n",
4947 smb_fname_str_dbg(smb_dname
)));
4949 return NT_STATUS_NOT_A_DIRECTORY
;
4952 /* Ensure there was no race condition. We need to check
4953 * dev/inode but not permissions, as these can change
4955 if (!check_same_dev_ino(&smb_dname
->st
, &fsp
->fsp_name
->st
)) {
4956 DEBUG(5,("open_directory: stat struct differs for "
4958 smb_fname_str_dbg(smb_dname
)));
4960 return NT_STATUS_ACCESS_DENIED
;
4963 if (info
== FILE_WAS_OPENED
) {
4964 status
= smbd_check_access_rights_fsp(parent_dir_fname
->fsp
,
4968 if (!NT_STATUS_IS_OK(status
)) {
4969 DBG_DEBUG("smbd_check_access_rights_fsp on "
4970 "file %s failed with %s\n",
4979 * If we created a new directory or going to delete it later,
4980 * we should keep * the share_mode_lock (g_lock) until we call
4981 * share_mode_entry_prepare_unlock()
4983 if (info
!= FILE_WAS_OPENED
) {
4985 } else if (create_options
& FILE_DELETE_ON_CLOSE
) {
4989 lck_state
= (struct open_ntcreate_lock_state
) {
4991 .object_type
= "directory",
4993 .create_disposition
= create_disposition
,
4994 .access_mask
= access_mask
,
4995 .share_access
= share_access
,
4996 .oplock_request
= NO_OPLOCK
,
4998 .first_open_attempt
= true,
4999 .keep_locked
= keep_locked
,
5002 status
= share_mode_entry_prepare_lock_add(&lck_state
.prepare_state
,
5007 open_ntcreate_lock_add_entry
,
5009 if (!NT_STATUS_IS_OK(status
)) {
5010 DBG_ERR("share_mode_entry_prepare_lock_add() failed for %s - %s\n",
5011 smb_fname_str_dbg(smb_dname
), nt_errstr(status
));
5016 status
= lck_state
.status
;
5017 if (!NT_STATUS_IS_OK(status
)) {
5023 * From here we need to use 'goto unlock;' instead of return !!!
5026 /* For directories the delete on close bit at open time seems
5027 always to be honored on close... See test 19 in Samba4 BASE-DELETE. */
5028 if (create_options
& FILE_DELETE_ON_CLOSE
) {
5029 status
= can_set_delete_on_close(fsp
, 0);
5030 if (!NT_STATUS_IS_OK(status
) && !NT_STATUS_EQUAL(status
, NT_STATUS_DIRECTORY_NOT_EMPTY
)) {
5031 lck_state
.cleanup_fn
=
5032 open_ntcreate_lock_cleanup_entry
;
5036 if (NT_STATUS_IS_OK(status
)) {
5037 /* Note that here we set the *initial* delete on close flag,
5038 not the regular one. The magic gets handled in close. */
5039 fsp
->fsp_flags
.initial_delete_on_close
= true;
5044 * Deal with other opens having a modified write time.
5046 if (!is_omit_timespec(&lck_state
.write_time
)) {
5047 update_stat_ex_mtime(&fsp
->fsp_name
->st
, lck_state
.write_time
);
5054 status
= NT_STATUS_OK
;
5057 ulstatus
= share_mode_entry_prepare_unlock(&lck_state
.prepare_state
,
5058 lck_state
.cleanup_fn
,
5060 if (!NT_STATUS_IS_OK(ulstatus
)) {
5061 DBG_ERR("share_mode_entry_prepare_unlock() failed for %s - %s\n",
5062 smb_fname_str_dbg(smb_dname
), nt_errstr(ulstatus
));
5063 smb_panic("share_mode_entry_prepare_unlock() failed!");
5066 if (!NT_STATUS_IS_OK(status
)) {
5071 return NT_STATUS_OK
;
5074 NTSTATUS
create_directory(connection_struct
*conn
,
5075 struct smb_request
*req
,
5076 struct files_struct
*dirfsp
,
5077 struct smb_filename
*smb_dname
)
5082 status
= SMB_VFS_CREATE_FILE(
5085 dirfsp
, /* dirfsp */
5086 smb_dname
, /* fname */
5087 FILE_READ_ATTRIBUTES
, /* access_mask */
5088 FILE_SHARE_NONE
, /* share_access */
5089 FILE_CREATE
, /* create_disposition*/
5090 FILE_DIRECTORY_FILE
, /* create_options */
5091 FILE_ATTRIBUTE_DIRECTORY
, /* file_attributes */
5092 0, /* oplock_request */
5094 0, /* allocation_size */
5095 0, /* private_flags */
5100 NULL
, NULL
); /* create context */
5102 if (NT_STATUS_IS_OK(status
)) {
5103 close_file_free(req
, &fsp
, NORMAL_CLOSE
);
5109 /****************************************************************************
5110 Receive notification that one of our open files has been renamed by another
5112 ****************************************************************************/
5114 void msg_file_was_renamed(struct messaging_context
*msg_ctx
,
5117 struct server_id src
,
5120 struct file_rename_message
*msg
= NULL
;
5121 enum ndr_err_code ndr_err
;
5123 struct smb_filename
*smb_fname
= NULL
;
5124 struct smbd_server_connection
*sconn
=
5125 talloc_get_type_abort(private_data
,
5126 struct smbd_server_connection
);
5128 msg
= talloc(talloc_tos(), struct file_rename_message
);
5130 DBG_WARNING("talloc failed\n");
5134 ndr_err
= ndr_pull_struct_blob_all(
5138 (ndr_pull_flags_fn_t
)ndr_pull_file_rename_message
);
5139 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
5140 DBG_DEBUG("ndr_pull_oplock_break_message failed: %s\n",
5141 ndr_errstr(ndr_err
));
5144 if (DEBUGLEVEL
>= 10) {
5145 struct server_id_buf buf
;
5146 DBG_DEBUG("Got rename message from %s\n",
5147 server_id_str_buf(src
, &buf
));
5148 NDR_PRINT_DEBUG(file_rename_message
, msg
);
5151 /* stream_name must always be NULL if there is no stream. */
5152 if ((msg
->stream_name
!= NULL
) && (msg
->stream_name
[0] == '\0')) {
5153 msg
->stream_name
= NULL
;
5156 smb_fname
= synthetic_smb_fname(msg
,
5162 if (smb_fname
== NULL
) {
5163 DBG_DEBUG("synthetic_smb_fname failed\n");
5167 fsp
= file_find_dif(sconn
, msg
->id
, msg
->share_file_id
);
5169 DBG_DEBUG("fsp not found\n");
5173 if (strcmp(fsp
->conn
->connectpath
, msg
->servicepath
) == 0) {
5174 SMB_STRUCT_STAT fsp_orig_sbuf
;
5176 DBG_DEBUG("renaming file %s from %s -> %s\n",
5179 smb_fname_str_dbg(smb_fname
));
5182 * The incoming smb_fname here has an
5183 * invalid stat struct from synthetic_smb_fname()
5185 * Preserve the existing stat from the
5186 * open fsp after fsp_set_smb_fname()
5187 * overwrites with the invalid stat.
5189 * (We could just copy this into
5190 * smb_fname->st, but keep this code
5191 * identical to the fix in rename_open_files()
5194 * We will do an fstat before returning
5195 * any of this metadata to the client anyway.
5197 fsp_orig_sbuf
= fsp
->fsp_name
->st
;
5198 status
= fsp_set_smb_fname(fsp
, smb_fname
);
5199 if (!NT_STATUS_IS_OK(status
)) {
5200 DBG_DEBUG("fsp_set_smb_fname failed: %s\n",
5203 fsp
->fsp_name
->st
= fsp_orig_sbuf
;
5207 * Now we have the complete path we can work out if
5208 * this is actually within this share and adjust
5209 * newname accordingly.
5211 DBG_DEBUG("share mismatch (sharepath %s not sharepath %s) "
5212 "%s from %s -> %s\n",
5213 fsp
->conn
->connectpath
,
5217 smb_fname_str_dbg(smb_fname
));
5224 * If a main file is opened for delete, all streams need to be checked for
5225 * !FILE_SHARE_DELETE. Do this by opening with DELETE_ACCESS.
5226 * If that works, delete them all by setting the delete on close and close.
5229 static NTSTATUS
open_streams_for_delete(connection_struct
*conn
,
5230 const struct smb_filename
*smb_fname
)
5232 struct stream_struct
*stream_info
= NULL
;
5233 files_struct
**streams
= NULL
;
5235 unsigned int i
, num_streams
= 0;
5236 TALLOC_CTX
*frame
= talloc_stackframe();
5237 const struct smb_filename
*pathref
= NULL
;
5240 if (smb_fname
->fsp
== NULL
) {
5241 struct smb_filename
*tmp
= NULL
;
5242 status
= synthetic_pathref(frame
,
5244 smb_fname
->base_name
,
5250 if (!NT_STATUS_IS_OK(status
)) {
5251 if (NT_STATUS_EQUAL(status
, NT_STATUS_NOT_IMPLEMENTED
)
5252 || NT_STATUS_EQUAL(status
,
5253 NT_STATUS_OBJECT_NAME_NOT_FOUND
)) {
5254 DBG_DEBUG("no streams around\n");
5256 return NT_STATUS_OK
;
5258 DBG_DEBUG("synthetic_pathref failed: %s\n",
5264 pathref
= smb_fname
;
5266 status
= vfs_fstreaminfo(pathref
->fsp
, talloc_tos(),
5267 &num_streams
, &stream_info
);
5269 if (NT_STATUS_EQUAL(status
, NT_STATUS_NOT_IMPLEMENTED
)
5270 || NT_STATUS_EQUAL(status
, NT_STATUS_OBJECT_NAME_NOT_FOUND
)) {
5271 DEBUG(10, ("no streams around\n"));
5273 return NT_STATUS_OK
;
5276 if (!NT_STATUS_IS_OK(status
)) {
5277 DEBUG(10, ("vfs_fstreaminfo failed: %s\n",
5278 nt_errstr(status
)));
5282 DEBUG(10, ("open_streams_for_delete found %d streams\n",
5285 if (num_streams
== 0) {
5287 return NT_STATUS_OK
;
5290 streams
= talloc_array(talloc_tos(), files_struct
*, num_streams
);
5291 if (streams
== NULL
) {
5292 DEBUG(0, ("talloc failed\n"));
5293 status
= NT_STATUS_NO_MEMORY
;
5297 for (i
=0; i
<num_streams
; i
++) {
5298 struct smb_filename
*smb_fname_cp
;
5300 if (strequal(stream_info
[i
].name
, "::$DATA")) {
5305 smb_fname_cp
= synthetic_smb_fname(talloc_tos(),
5306 smb_fname
->base_name
,
5307 stream_info
[i
].name
,
5311 ~SMB_FILENAME_POSIX_PATH
));
5312 if (smb_fname_cp
== NULL
) {
5313 status
= NT_STATUS_NO_MEMORY
;
5317 status
= openat_pathref_fsp(conn
->cwd_fsp
, smb_fname_cp
);
5318 if (!NT_STATUS_IS_OK(status
)) {
5319 DBG_DEBUG("Unable to open stream [%s]: %s\n",
5320 smb_fname_str_dbg(smb_fname_cp
),
5322 TALLOC_FREE(smb_fname_cp
);
5326 status
= SMB_VFS_CREATE_FILE(
5330 smb_fname_cp
, /* fname */
5331 DELETE_ACCESS
, /* access_mask */
5332 (FILE_SHARE_READ
| /* share_access */
5333 FILE_SHARE_WRITE
| FILE_SHARE_DELETE
),
5334 FILE_OPEN
, /* create_disposition*/
5335 0, /* create_options */
5336 FILE_ATTRIBUTE_NORMAL
, /* file_attributes */
5337 0, /* oplock_request */
5339 0, /* allocation_size */
5340 0, /* private_flags */
5343 &streams
[i
], /* result */
5345 NULL
, NULL
); /* create context */
5347 if (!NT_STATUS_IS_OK(status
)) {
5348 DEBUG(10, ("Could not open stream %s: %s\n",
5349 smb_fname_str_dbg(smb_fname_cp
),
5350 nt_errstr(status
)));
5352 TALLOC_FREE(smb_fname_cp
);
5355 TALLOC_FREE(smb_fname_cp
);
5359 * don't touch the variable "status" beyond this point :-)
5362 for (j
= i
-1 ; j
>= 0; j
--) {
5363 if (streams
[j
] == NULL
) {
5367 DEBUG(10, ("Closing stream # %d, %s\n", j
,
5368 fsp_str_dbg(streams
[j
])));
5369 close_file_free(NULL
, &streams
[j
], NORMAL_CLOSE
);
5377 /*********************************************************************
5378 Create a default ACL by inheriting from the parent. If no inheritance
5379 from the parent available, don't set anything. This will leave the actual
5380 permissions the new file or directory already got from the filesystem
5381 as the NT ACL when read.
5382 *********************************************************************/
5384 static NTSTATUS
inherit_new_acl(files_struct
*dirfsp
, files_struct
*fsp
)
5386 TALLOC_CTX
*frame
= talloc_stackframe();
5387 struct security_descriptor
*parent_desc
= NULL
;
5388 NTSTATUS status
= NT_STATUS_OK
;
5389 struct security_descriptor
*psd
= NULL
;
5390 const struct dom_sid
*owner_sid
= NULL
;
5391 const struct dom_sid
*group_sid
= NULL
;
5392 uint32_t security_info_sent
= (SECINFO_OWNER
| SECINFO_GROUP
| SECINFO_DACL
);
5393 struct security_token
*token
= fsp
->conn
->session_info
->security_token
;
5394 bool inherit_owner
=
5395 (lp_inherit_owner(SNUM(fsp
->conn
)) == INHERIT_OWNER_WINDOWS_AND_UNIX
);
5396 bool inheritable_components
= false;
5397 bool try_builtin_administrators
= false;
5398 const struct dom_sid
*BA_U_sid
= NULL
;
5399 const struct dom_sid
*BA_G_sid
= NULL
;
5400 bool try_system
= false;
5401 const struct dom_sid
*SY_U_sid
= NULL
;
5402 const struct dom_sid
*SY_G_sid
= NULL
;
5406 status
= SMB_VFS_FGET_NT_ACL(dirfsp
,
5407 (SECINFO_OWNER
| SECINFO_GROUP
| SECINFO_DACL
),
5410 if (!NT_STATUS_IS_OK(status
)) {
5415 inheritable_components
= sd_has_inheritable_components(parent_desc
,
5416 fsp
->fsp_flags
.is_directory
);
5418 if (!inheritable_components
&& !inherit_owner
) {
5420 /* Nothing to inherit and not setting owner. */
5421 return NT_STATUS_OK
;
5424 /* Create an inherited descriptor from the parent. */
5426 if (DEBUGLEVEL
>= 10) {
5427 DEBUG(10,("inherit_new_acl: parent acl for %s is:\n",
5428 fsp_str_dbg(fsp
) ));
5429 NDR_PRINT_DEBUG(security_descriptor
, parent_desc
);
5432 /* Inherit from parent descriptor if "inherit owner" set. */
5433 if (inherit_owner
) {
5434 owner_sid
= parent_desc
->owner_sid
;
5435 group_sid
= parent_desc
->group_sid
;
5438 if (owner_sid
== NULL
) {
5439 if (security_token_has_builtin_administrators(token
)) {
5440 try_builtin_administrators
= true;
5441 } else if (security_token_is_system(token
)) {
5442 try_builtin_administrators
= true;
5447 if (group_sid
== NULL
&&
5448 token
->num_sids
== PRIMARY_GROUP_SID_INDEX
)
5450 if (security_token_is_system(token
)) {
5451 try_builtin_administrators
= true;
5456 if (try_builtin_administrators
) {
5457 struct unixid ids
= { .id
= 0 };
5459 ok
= sids_to_unixids(&global_sid_Builtin_Administrators
, 1, &ids
);
5463 BA_U_sid
= &global_sid_Builtin_Administrators
;
5464 BA_G_sid
= &global_sid_Builtin_Administrators
;
5467 BA_U_sid
= &global_sid_Builtin_Administrators
;
5470 BA_G_sid
= &global_sid_Builtin_Administrators
;
5479 struct unixid ids
= { .id
= 0 };
5481 ok
= sids_to_unixids(&global_sid_System
, 1, &ids
);
5485 SY_U_sid
= &global_sid_System
;
5486 SY_G_sid
= &global_sid_System
;
5489 SY_U_sid
= &global_sid_System
;
5492 SY_G_sid
= &global_sid_System
;
5500 if (owner_sid
== NULL
) {
5501 owner_sid
= BA_U_sid
;
5504 if (owner_sid
== NULL
) {
5505 owner_sid
= SY_U_sid
;
5508 if (group_sid
== NULL
) {
5509 group_sid
= SY_G_sid
;
5512 if (try_system
&& group_sid
== NULL
) {
5513 group_sid
= BA_G_sid
;
5516 if (owner_sid
== NULL
) {
5517 owner_sid
= &token
->sids
[PRIMARY_USER_SID_INDEX
];
5519 if (group_sid
== NULL
) {
5520 if (token
->num_sids
== PRIMARY_GROUP_SID_INDEX
) {
5521 group_sid
= &token
->sids
[PRIMARY_USER_SID_INDEX
];
5523 group_sid
= &token
->sids
[PRIMARY_GROUP_SID_INDEX
];
5527 status
= se_create_child_secdesc(frame
,
5533 fsp
->fsp_flags
.is_directory
);
5534 if (!NT_STATUS_IS_OK(status
)) {
5539 /* If inheritable_components == false,
5540 se_create_child_secdesc()
5541 creates a security descriptor with a NULL dacl
5542 entry, but with SEC_DESC_DACL_PRESENT. We need
5543 to remove that flag. */
5545 if (!inheritable_components
) {
5546 security_info_sent
&= ~SECINFO_DACL
;
5547 psd
->type
&= ~SEC_DESC_DACL_PRESENT
;
5550 if (DEBUGLEVEL
>= 10) {
5551 DEBUG(10,("inherit_new_acl: child acl for %s is:\n",
5552 fsp_str_dbg(fsp
) ));
5553 NDR_PRINT_DEBUG(security_descriptor
, psd
);
5556 if (inherit_owner
) {
5557 /* We need to be root to force this. */
5560 status
= SMB_VFS_FSET_NT_ACL(metadata_fsp(fsp
),
5563 if (inherit_owner
) {
5571 * If we already have a lease, it must match the new file id. [MS-SMB2]
5572 * 3.3.5.9.8 speaks about INVALID_PARAMETER if an already used lease key is
5573 * used for a different file name.
5576 struct lease_match_state
{
5577 /* Input parameters. */
5578 TALLOC_CTX
*mem_ctx
;
5579 const char *servicepath
;
5580 const struct smb_filename
*fname
;
5583 /* Return parameters. */
5584 uint32_t num_file_ids
;
5585 struct file_id
*ids
;
5586 NTSTATUS match_status
;
5589 /*************************************************************
5590 File doesn't exist but this lease key+guid is already in use.
5592 This is only allowable in the dynamic share case where the
5593 service path must be different.
5595 There is a small race condition here in the multi-connection
5596 case where a client sends two create calls on different connections,
5597 where the file doesn't exist and one smbd creates the leases_db
5598 entry first, but this will get fixed by the multichannel cleanup
5599 when all identical client_guids get handled by a single smbd.
5600 **************************************************************/
5602 static void lease_match_parser_new_file(
5604 const struct leases_db_file
*files
,
5605 struct lease_match_state
*state
)
5609 for (i
= 0; i
< num_files
; i
++) {
5610 const struct leases_db_file
*f
= &files
[i
];
5611 if (strequal(state
->servicepath
, f
->servicepath
)) {
5612 state
->match_status
= NT_STATUS_INVALID_PARAMETER
;
5617 /* Dynamic share case. Break leases on all other files. */
5618 state
->match_status
= leases_db_copy_file_ids(state
->mem_ctx
,
5622 if (!NT_STATUS_IS_OK(state
->match_status
)) {
5626 state
->num_file_ids
= num_files
;
5627 state
->match_status
= NT_STATUS_OPLOCK_NOT_GRANTED
;
5631 static void lease_match_parser(
5633 const struct leases_db_file
*files
,
5636 struct lease_match_state
*state
=
5637 (struct lease_match_state
*)private_data
;
5640 if (!state
->file_existed
) {
5642 * Deal with name mismatch or
5643 * possible dynamic share case separately
5644 * to make code clearer.
5646 lease_match_parser_new_file(num_files
,
5653 state
->match_status
= NT_STATUS_OK
;
5655 for (i
= 0; i
< num_files
; i
++) {
5656 const struct leases_db_file
*f
= &files
[i
];
5658 /* Everything should be the same. */
5659 if (!file_id_equal(&state
->id
, &f
->id
)) {
5661 * The client asked for a lease on a
5662 * file that doesn't match the file_id
5665 * Maybe this is a dynamic share, i.e.
5666 * a share where the servicepath is
5667 * different for different users (e.g.
5668 * the [HOMES] share.
5670 * If the servicepath is different, but the requested
5671 * file name + stream name is the same then this is
5672 * a dynamic share, the client is using the same share
5673 * name and doesn't know that the underlying servicepath
5674 * is different. It was expecting a lease on the
5675 * same file. Return NT_STATUS_OPLOCK_NOT_GRANTED
5678 * Otherwise the client has messed up, or is
5679 * testing our error codes, so return
5680 * NT_STATUS_INVALID_PARAMETER.
5682 if (!strequal(f
->servicepath
, state
->servicepath
) &&
5683 strequal(f
->base_name
, state
->fname
->base_name
) &&
5684 strequal(f
->stream_name
, state
->fname
->stream_name
))
5687 * Name is the same but servicepath is
5688 * different, dynamic share. Break leases.
5690 state
->match_status
=
5691 NT_STATUS_OPLOCK_NOT_GRANTED
;
5693 state
->match_status
=
5694 NT_STATUS_INVALID_PARAMETER
;
5698 if (!strequal(f
->servicepath
, state
->servicepath
)) {
5699 state
->match_status
= NT_STATUS_INVALID_PARAMETER
;
5702 if (!strequal(f
->base_name
, state
->fname
->base_name
)) {
5703 state
->match_status
= NT_STATUS_INVALID_PARAMETER
;
5706 if (!strequal(f
->stream_name
, state
->fname
->stream_name
)) {
5707 state
->match_status
= NT_STATUS_INVALID_PARAMETER
;
5712 if (NT_STATUS_IS_OK(state
->match_status
)) {
5714 * Common case - just opening another handle on a
5715 * file on a non-dynamic share.
5720 if (NT_STATUS_EQUAL(state
->match_status
, NT_STATUS_INVALID_PARAMETER
)) {
5721 /* Mismatched path. Error back to client. */
5726 * File id mismatch. Dynamic share case NT_STATUS_OPLOCK_NOT_GRANTED.
5727 * Don't allow leases.
5730 state
->match_status
= leases_db_copy_file_ids(state
->mem_ctx
,
5734 if (!NT_STATUS_IS_OK(state
->match_status
)) {
5738 state
->num_file_ids
= num_files
;
5739 state
->match_status
= NT_STATUS_OPLOCK_NOT_GRANTED
;
5743 struct lease_match_break_state
{
5744 struct messaging_context
*msg_ctx
;
5745 const struct smb2_lease_key
*lease_key
;
5753 static bool lease_match_break_fn(
5754 struct share_mode_entry
*e
,
5757 struct lease_match_break_state
*state
= private_data
;
5759 uint32_t e_lease_type
= SMB2_LEASE_NONE
;
5762 stale
= share_entry_stale_pid(e
);
5767 equal
= smb2_lease_key_equal(&e
->lease_key
, state
->lease_key
);
5772 status
= leases_db_get(
5776 &e_lease_type
, /* current_state */
5777 NULL
, /* breaking */
5778 NULL
, /* breaking_to_requested */
5779 NULL
, /* breaking_to_required */
5780 &state
->version
, /* lease_version */
5781 &state
->epoch
); /* epoch */
5782 if (NT_STATUS_IS_OK(status
)) {
5783 state
->found_lease
= true;
5785 DBG_WARNING("Could not find version/epoch: %s\n",
5790 if (e_lease_type
== SMB2_LEASE_NONE
) {
5793 send_break_message(state
->msg_ctx
, &state
->id
, e
, SMB2_LEASE_NONE
);
5796 * Windows 7 and 8 lease clients are broken in that they will
5797 * not respond to lease break requests whilst waiting for an
5798 * outstanding open request on that lease handle on the same
5799 * TCP connection, due to holding an internal inode lock.
5801 * This means we can't reschedule ourselves here, but must
5802 * return from the create.
5806 * Send the breaks and then return SMB2_LEASE_NONE in the
5807 * lease handle to cause them to acknowledge the lease
5808 * break. Consultation with Microsoft engineering confirmed
5809 * this approach is safe.
5815 static void lease_match_fid_fn(struct share_mode_lock
*lck
,
5820 ok
= share_mode_forall_leases(lck
, lease_match_break_fn
, private_data
);
5822 DBG_DEBUG("share_mode_forall_leases failed\n");
5826 static NTSTATUS
lease_match(connection_struct
*conn
,
5827 struct smb_request
*req
,
5828 const struct smb2_lease_key
*lease_key
,
5829 const char *servicepath
,
5830 const struct smb_filename
*fname
,
5831 uint16_t *p_version
,
5834 struct smbd_server_connection
*sconn
= req
->sconn
;
5835 TALLOC_CTX
*tos
= talloc_tos();
5836 struct lease_match_state state
= {
5838 .servicepath
= servicepath
,
5840 .match_status
= NT_STATUS_OK
5845 state
.file_existed
= VALID_STAT(fname
->st
);
5846 if (state
.file_existed
) {
5847 state
.id
= vfs_file_id_from_sbuf(conn
, &fname
->st
);
5850 status
= leases_db_parse(&sconn
->client
->global
->client_guid
,
5851 lease_key
, lease_match_parser
, &state
);
5852 if (!NT_STATUS_IS_OK(status
)) {
5854 * Not found or error means okay: We can make the lease pass
5856 return NT_STATUS_OK
;
5858 if (!NT_STATUS_EQUAL(state
.match_status
, NT_STATUS_OPLOCK_NOT_GRANTED
)) {
5860 * Anything but NT_STATUS_OPLOCK_NOT_GRANTED, let the caller
5863 return state
.match_status
;
5866 /* We have to break all existing leases. */
5867 for (i
= 0; i
< state
.num_file_ids
; i
++) {
5868 struct lease_match_break_state break_state
= {
5869 .msg_ctx
= conn
->sconn
->msg_ctx
,
5870 .lease_key
= lease_key
,
5873 if (file_id_equal(&state
.ids
[i
], &state
.id
)) {
5874 /* Don't need to break our own file. */
5878 break_state
.id
= state
.ids
[i
];
5880 status
= share_mode_do_locked_vfs_denied(break_state
.id
,
5883 if (!NT_STATUS_IS_OK(status
)) {
5884 /* Race condition - file already closed. */
5888 if (break_state
.found_lease
) {
5889 *p_version
= break_state
.version
;
5890 *p_epoch
= break_state
.epoch
;
5894 * Ensure we don't grant anything more so we
5897 return NT_STATUS_OPLOCK_NOT_GRANTED
;
5901 * Wrapper around open_file_ntcreate and open_directory
5904 static NTSTATUS
create_file_unixpath(connection_struct
*conn
,
5905 struct smb_request
*req
,
5906 struct files_struct
*dirfsp
,
5907 struct smb_filename
*smb_fname
,
5908 uint32_t access_mask
,
5909 uint32_t share_access
,
5910 uint32_t create_disposition
,
5911 uint32_t create_options
,
5912 uint32_t file_attributes
,
5913 uint32_t oplock_request
,
5914 const struct smb2_lease
*lease
,
5915 uint64_t allocation_size
,
5916 uint32_t private_flags
,
5917 struct security_descriptor
*sd
,
5918 struct ea_list
*ea_list
,
5920 files_struct
**result
,
5923 struct smb2_lease none_lease
;
5924 int info
= FILE_WAS_OPENED
;
5925 files_struct
*base_fsp
= NULL
;
5926 files_struct
*fsp
= NULL
;
5927 bool free_fsp_on_error
= false;
5930 struct smb_filename
*parent_dir_fname
= NULL
;
5931 struct smb_filename
*smb_fname_atname
= NULL
;
5933 DBG_DEBUG("access_mask = 0x%"PRIx32
" "
5934 "file_attributes = 0x%"PRIx32
" "
5935 "share_access = 0x%"PRIx32
" "
5936 "create_disposition = 0x%"PRIx32
" "
5937 "create_options = 0x%"PRIx32
" "
5938 "oplock_request = 0x%"PRIx32
" "
5939 "private_flags = 0x%"PRIx32
" "
5952 smb_fname_str_dbg(smb_fname
));
5954 if (create_options
& FILE_OPEN_BY_FILE_ID
) {
5955 status
= NT_STATUS_NOT_SUPPORTED
;
5959 if (create_options
& NTCREATEX_OPTIONS_INVALID_PARAM_MASK
) {
5960 status
= NT_STATUS_INVALID_PARAMETER
;
5965 oplock_request
|= INTERNAL_OPEN_ONLY
;
5968 if (lease
!= NULL
) {
5969 uint16_t epoch
= lease
->lease_epoch
;
5970 uint16_t version
= lease
->lease_version
;
5973 DBG_WARNING("Got lease on internal open\n");
5974 status
= NT_STATUS_INTERNAL_ERROR
;
5978 status
= lease_match(conn
,
5985 if (NT_STATUS_EQUAL(status
, NT_STATUS_OPLOCK_NOT_GRANTED
)) {
5986 /* Dynamic share file. No leases and update epoch... */
5987 none_lease
= *lease
;
5988 none_lease
.lease_state
= SMB2_LEASE_NONE
;
5989 none_lease
.lease_epoch
= epoch
;
5990 none_lease
.lease_version
= version
;
5991 lease
= &none_lease
;
5992 } else if (!NT_STATUS_IS_OK(status
)) {
5997 if ((conn
->fs_capabilities
& FILE_NAMED_STREAMS
)
5998 && (access_mask
& DELETE_ACCESS
)
5999 && !is_named_stream(smb_fname
)) {
6001 * We can't open a file with DELETE access if any of the
6002 * streams is open without FILE_SHARE_DELETE
6004 status
= open_streams_for_delete(conn
, smb_fname
);
6006 if (!NT_STATUS_IS_OK(status
)) {
6011 if (access_mask
& SEC_FLAG_SYSTEM_SECURITY
) {
6014 ok
= security_token_has_privilege(get_current_nttok(conn
),
6017 DBG_DEBUG("open on %s failed - "
6018 "SEC_FLAG_SYSTEM_SECURITY denied.\n",
6019 smb_fname_str_dbg(smb_fname
));
6020 status
= NT_STATUS_PRIVILEGE_NOT_HELD
;
6024 if (conn
->sconn
->using_smb2
&&
6025 (access_mask
== SEC_FLAG_SYSTEM_SECURITY
))
6028 * No other bits set. Windows SMB2 refuses this.
6029 * See smbtorture3 SMB2-SACL test.
6031 * Note this is an SMB2-only behavior,
6032 * smbtorture3 SMB1-SYSTEM-SECURITY already tests
6033 * that SMB1 allows this.
6035 status
= NT_STATUS_ACCESS_DENIED
;
6041 * Files or directories can't be opened DELETE_ON_CLOSE without
6043 * BUG: https://bugzilla.samba.org/show_bug.cgi?id=13358
6045 if ((create_options
& FILE_DELETE_ON_CLOSE
) &&
6046 ((access_mask
& DELETE_ACCESS
) == 0)) {
6047 status
= NT_STATUS_INVALID_PARAMETER
;
6051 if ((conn
->fs_capabilities
& FILE_NAMED_STREAMS
)
6052 && is_named_stream(smb_fname
))
6054 uint32_t base_create_disposition
;
6055 struct smb_filename
*smb_fname_base
= NULL
;
6056 uint32_t base_privflags
;
6058 if (create_options
& FILE_DIRECTORY_FILE
) {
6059 DBG_DEBUG("Can't open a stream as directory\n");
6060 status
= NT_STATUS_NOT_A_DIRECTORY
;
6064 switch (create_disposition
) {
6066 base_create_disposition
= FILE_OPEN
;
6069 base_create_disposition
= FILE_OPEN_IF
;
6073 smb_fname_base
= cp_smb_filename_nostream(
6074 talloc_tos(), smb_fname
);
6076 if (smb_fname_base
== NULL
) {
6077 status
= NT_STATUS_NO_MEMORY
;
6082 * We may be creating the basefile as part of creating the
6083 * stream, so it's legal if the basefile doesn't exist at this
6084 * point, the create_file_unixpath() below will create it. But
6085 * if the basefile exists we want a handle so we can fstat() it.
6088 ret
= vfs_stat(conn
, smb_fname_base
);
6089 if (ret
== -1 && errno
!= ENOENT
) {
6090 status
= map_nt_error_from_unix(errno
);
6091 TALLOC_FREE(smb_fname_base
);
6095 status
= openat_pathref_fsp(conn
->cwd_fsp
,
6097 if (!NT_STATUS_IS_OK(status
)) {
6098 DBG_ERR("open_smb_fname_fsp [%s] failed: %s\n",
6099 smb_fname_str_dbg(smb_fname_base
),
6101 TALLOC_FREE(smb_fname_base
);
6106 * https://bugzilla.samba.org/show_bug.cgi?id=10229
6107 * We need to check if the requested access mask
6108 * could be used to open the underlying file (if
6109 * it existed), as we're passing in zero for the
6110 * access mask to the base filename.
6112 status
= check_base_file_access(smb_fname_base
->fsp
,
6115 if (!NT_STATUS_IS_OK(status
)) {
6116 DEBUG(10, ("Permission check "
6117 "for base %s failed: "
6118 "%s\n", smb_fname
->base_name
,
6119 nt_errstr(status
)));
6120 TALLOC_FREE(smb_fname_base
);
6125 base_privflags
= NTCREATEX_FLAG_STREAM_BASEOPEN
;
6127 /* Open the base file. */
6128 status
= create_file_unixpath(conn
,
6135 | FILE_SHARE_DELETE
,
6136 base_create_disposition
,
6147 TALLOC_FREE(smb_fname_base
);
6149 if (!NT_STATUS_IS_OK(status
)) {
6150 DEBUG(10, ("create_file_unixpath for base %s failed: "
6151 "%s\n", smb_fname
->base_name
,
6152 nt_errstr(status
)));
6157 if (smb_fname
->fsp
!= NULL
) {
6159 fsp
= smb_fname
->fsp
;
6162 * We're about to use smb_fname->fsp for the fresh open.
6164 * Every fsp passed in via smb_fname->fsp already
6165 * holds a fsp->fsp_name. If it is already this
6166 * fsp->fsp_name that we got passed in as our input
6167 * argument smb_fname, these two are assumed to have
6168 * the same lifetime: Every fsp hangs of "conn", and
6169 * fsp->fsp_name is its talloc child.
6172 if (smb_fname
!= smb_fname
->fsp
->fsp_name
) {
6174 * "smb_fname" is temporary in this case, but
6175 * the destructor of smb_fname would also tear
6176 * down the fsp we're about to use. Unlink
6177 * them from each other.
6179 smb_fname_fsp_unlink(smb_fname
);
6184 free_fsp_on_error
= true;
6187 status
= fsp_bind_smb(fsp
, req
);
6188 if (!NT_STATUS_IS_OK(status
)) {
6192 if (fsp_is_alternate_stream(fsp
)) {
6193 struct files_struct
*tmp_base_fsp
= fsp
->base_fsp
;
6195 fsp_set_base_fsp(fsp
, NULL
);
6197 fd_close(tmp_base_fsp
);
6198 file_free(NULL
, tmp_base_fsp
);
6202 * No fsp passed in that we can use, create one
6204 status
= file_new(req
, conn
, &fsp
);
6205 if(!NT_STATUS_IS_OK(status
)) {
6208 free_fsp_on_error
= true;
6210 status
= fsp_set_smb_fname(fsp
, smb_fname
);
6211 if (!NT_STATUS_IS_OK(status
)) {
6216 SMB_ASSERT(fsp
->fsp_name
->fsp
!= NULL
);
6217 SMB_ASSERT(fsp
->fsp_name
->fsp
== fsp
);
6221 * We're opening the stream element of a
6222 * base_fsp we already opened. Set up the
6225 fsp_set_base_fsp(fsp
, base_fsp
);
6228 if (dirfsp
!= NULL
) {
6229 status
= SMB_VFS_PARENT_PATHNAME(
6235 if (!NT_STATUS_IS_OK(status
)) {
6240 * Get a pathref on the parent. We can re-use this for
6241 * multiple calls to check parent ACLs etc. to avoid
6244 status
= parent_pathref(talloc_tos(),
6249 if (!NT_STATUS_IS_OK(status
)) {
6253 dirfsp
= parent_dir_fname
->fsp
;
6254 status
= fsp_set_smb_fname(dirfsp
, parent_dir_fname
);
6255 if (!NT_STATUS_IS_OK(status
)) {
6261 * If it's a request for a directory open, deal with it separately.
6264 if (create_options
& FILE_DIRECTORY_FILE
) {
6266 if (create_options
& FILE_NON_DIRECTORY_FILE
) {
6267 status
= NT_STATUS_INVALID_PARAMETER
;
6271 /* Can't open a temp directory. IFS kit test. */
6272 if (!(file_attributes
& FILE_FLAG_POSIX_SEMANTICS
) &&
6273 (file_attributes
& FILE_ATTRIBUTE_TEMPORARY
)) {
6274 status
= NT_STATUS_INVALID_PARAMETER
;
6279 * We will get a create directory here if the Win32
6280 * app specified a security descriptor in the
6281 * CreateDirectory() call.
6285 status
= open_directory(conn
,
6299 * Ordinary file case.
6302 if (allocation_size
) {
6303 fsp
->initial_allocation_size
= smb_roundup(fsp
->conn
,
6307 status
= open_file_ntcreate(conn
,
6321 if (NT_STATUS_EQUAL(status
, NT_STATUS_FILE_IS_A_DIRECTORY
)) {
6323 /* A stream open never opens a directory */
6326 status
= NT_STATUS_FILE_IS_A_DIRECTORY
;
6331 * Fail the open if it was explicitly a non-directory
6335 if (create_options
& FILE_NON_DIRECTORY_FILE
) {
6336 status
= NT_STATUS_FILE_IS_A_DIRECTORY
;
6341 status
= open_directory(conn
,
6355 if (!NT_STATUS_IS_OK(status
)) {
6359 fsp
->fsp_flags
.is_fsa
= true;
6361 if ((ea_list
!= NULL
) &&
6362 ((info
== FILE_WAS_CREATED
) || (info
== FILE_WAS_OVERWRITTEN
))) {
6363 status
= set_ea(conn
, fsp
, ea_list
);
6364 if (!NT_STATUS_IS_OK(status
)) {
6369 if (!fsp
->fsp_flags
.is_directory
&&
6370 S_ISDIR(fsp
->fsp_name
->st
.st_ex_mode
))
6372 status
= NT_STATUS_ACCESS_DENIED
;
6376 /* Save the requested allocation size. */
6377 if ((info
== FILE_WAS_CREATED
) || (info
== FILE_WAS_OVERWRITTEN
)) {
6378 if ((allocation_size
> (uint64_t)fsp
->fsp_name
->st
.st_ex_size
)
6379 && !(fsp
->fsp_flags
.is_directory
))
6381 fsp
->initial_allocation_size
= smb_roundup(
6382 fsp
->conn
, allocation_size
);
6383 if (vfs_allocate_file_space(
6384 fsp
, fsp
->initial_allocation_size
) == -1) {
6385 status
= NT_STATUS_DISK_FULL
;
6389 fsp
->initial_allocation_size
= smb_roundup(
6390 fsp
->conn
, (uint64_t)fsp
->fsp_name
->st
.st_ex_size
);
6393 fsp
->initial_allocation_size
= 0;
6396 if ((info
== FILE_WAS_CREATED
) &&
6397 lp_nt_acl_support(SNUM(conn
)) &&
6398 !fsp_is_alternate_stream(fsp
)) {
6401 * According to the MS documentation, the only time the security
6402 * descriptor is applied to the opened file is iff we *created* the
6403 * file; an existing file stays the same.
6405 * Also, it seems (from observation) that you can open the file with
6406 * any access mask but you can still write the sd. We need to override
6407 * the granted access before we call set_sd
6408 * Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
6411 uint32_t sec_info_sent
;
6412 uint32_t saved_access_mask
= fsp
->access_mask
;
6414 sec_info_sent
= get_sec_info(sd
);
6416 fsp
->access_mask
= FILE_GENERIC_ALL
;
6418 if (sec_info_sent
& (SECINFO_OWNER
|
6422 status
= set_sd(fsp
, sd
, sec_info_sent
);
6425 fsp
->access_mask
= saved_access_mask
;
6427 if (!NT_STATUS_IS_OK(status
)) {
6430 } else if (lp_inherit_acls(SNUM(conn
))) {
6431 /* Inherit from parent. Errors here are not fatal. */
6432 status
= inherit_new_acl(dirfsp
, fsp
);
6433 if (!NT_STATUS_IS_OK(status
)) {
6434 DEBUG(10,("inherit_new_acl: failed for %s with %s\n",
6436 nt_errstr(status
) ));
6441 if ((conn
->fs_capabilities
& FILE_FILE_COMPRESSION
)
6442 && (create_options
& FILE_NO_COMPRESSION
)
6443 && (info
== FILE_WAS_CREATED
)) {
6444 status
= SMB_VFS_SET_COMPRESSION(conn
, fsp
, fsp
,
6445 COMPRESSION_FORMAT_NONE
);
6446 if (!NT_STATUS_IS_OK(status
)) {
6447 DEBUG(1, ("failed to disable compression: %s\n",
6448 nt_errstr(status
)));
6452 DEBUG(10, ("create_file_unixpath: info=%d\n", info
));
6455 if (pinfo
!= NULL
) {
6459 smb_fname
->st
= fsp
->fsp_name
->st
;
6461 TALLOC_FREE(parent_dir_fname
);
6463 return NT_STATUS_OK
;
6466 DEBUG(10, ("create_file_unixpath: %s\n", nt_errstr(status
)));
6470 * The close_file below will close
6474 close_file_smb(req
, fsp
, ERROR_CLOSE
);
6475 if (free_fsp_on_error
) {
6476 file_free(req
, fsp
);
6480 if (base_fsp
!= NULL
) {
6481 close_file_free(req
, &base_fsp
, ERROR_CLOSE
);
6484 TALLOC_FREE(parent_dir_fname
);
6489 NTSTATUS
create_file_default(connection_struct
*conn
,
6490 struct smb_request
*req
,
6491 struct files_struct
*dirfsp
,
6492 struct smb_filename
*smb_fname
,
6493 uint32_t access_mask
,
6494 uint32_t share_access
,
6495 uint32_t create_disposition
,
6496 uint32_t create_options
,
6497 uint32_t file_attributes
,
6498 uint32_t oplock_request
,
6499 const struct smb2_lease
*lease
,
6500 uint64_t allocation_size
,
6501 uint32_t private_flags
,
6502 struct security_descriptor
*sd
,
6503 struct ea_list
*ea_list
,
6504 files_struct
**result
,
6506 const struct smb2_create_blobs
*in_context_blobs
,
6507 struct smb2_create_blobs
*out_context_blobs
)
6509 int info
= FILE_WAS_OPENED
;
6510 files_struct
*fsp
= NULL
;
6512 bool stream_name
= false;
6513 struct smb2_create_blob
*posx
= NULL
;
6515 DBG_DEBUG("access_mask = 0x%" PRIu32
6516 " file_attributes = 0x%" PRIu32
6517 " share_access = 0x%" PRIu32
6518 " create_disposition = 0x%" PRIu32
6519 " create_options = 0x%" PRIu32
6520 " oplock_request = 0x%" PRIu32
6521 " private_flags = 0x%" PRIu32
6522 " ea_list = %p, sd = %p, fname = %s\n",
6532 smb_fname_str_dbg(smb_fname
));
6536 * Remember the absolute time of the original request
6537 * with this mid. We'll use it later to see if this
6540 get_deferred_open_message_state(req
, &req
->request_time
, NULL
);
6544 * Check to see if this is a mac fork of some kind.
6547 stream_name
= is_ntfs_stream_smb_fname(smb_fname
);
6549 enum FAKE_FILE_TYPE fake_file_type
;
6551 fake_file_type
= is_fake_file(smb_fname
);
6553 if (req
!= NULL
&& fake_file_type
!= FAKE_FILE_TYPE_NONE
) {
6556 * Here we go! support for changing the disk quotas
6559 * We need to fake up to open this MAGIC QUOTA file
6560 * and return a valid FID.
6562 * w2k close this file directly after opening xp
6563 * also tries a QUERY_FILE_INFO on the file and then
6566 status
= open_fake_file(req
, conn
, req
->vuid
,
6567 fake_file_type
, smb_fname
,
6569 if (!NT_STATUS_IS_OK(status
)) {
6573 ZERO_STRUCT(smb_fname
->st
);
6577 if (!(conn
->fs_capabilities
& FILE_NAMED_STREAMS
)) {
6578 status
= NT_STATUS_OBJECT_NAME_INVALID
;
6583 if (is_ntfs_default_stream_smb_fname(smb_fname
)) {
6585 /* We have to handle this error here. */
6586 if (create_options
& FILE_DIRECTORY_FILE
) {
6587 status
= NT_STATUS_NOT_A_DIRECTORY
;
6590 ret
= vfs_stat(conn
, smb_fname
);
6591 if (ret
== 0 && VALID_STAT_OF_DIR(smb_fname
->st
)) {
6592 status
= NT_STATUS_FILE_IS_A_DIRECTORY
;
6597 posx
= smb2_create_blob_find(
6598 in_context_blobs
, SMB2_CREATE_TAG_POSIX
);
6600 uint32_t wire_mode_bits
= 0;
6601 mode_t mode_bits
= 0;
6602 SMB_STRUCT_STAT sbuf
= { 0 };
6603 enum perm_type ptype
=
6604 (create_options
& FILE_DIRECTORY_FILE
) ?
6605 PERM_NEW_DIR
: PERM_NEW_FILE
;
6607 if (posx
->data
.length
!= 4) {
6608 status
= NT_STATUS_INVALID_PARAMETER
;
6612 wire_mode_bits
= IVAL(posx
->data
.data
, 0);
6613 status
= unix_perms_from_wire(
6614 conn
, &sbuf
, wire_mode_bits
, ptype
, &mode_bits
);
6615 if (!NT_STATUS_IS_OK(status
)) {
6619 * Remove type info from mode, leaving only the
6620 * permissions and setuid/gid bits.
6622 mode_bits
&= ~S_IFMT
;
6624 file_attributes
= (FILE_FLAG_POSIX_SEMANTICS
| mode_bits
);
6627 status
= create_file_unixpath(conn
,
6644 if (!NT_STATUS_IS_OK(status
)) {
6649 DEBUG(10, ("create_file: info=%d\n", info
));
6652 if (pinfo
!= NULL
) {
6655 return NT_STATUS_OK
;
6658 DEBUG(10, ("create_file: %s\n", nt_errstr(status
)));
6661 close_file_free(req
, &fsp
, ERROR_CLOSE
);