?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:winbind add timeouts to winbind cache
[Samba.git] / source3 / smbd / posix_acls.c
blob78b373a1cd136750a47f3cf7f40605ae5b781537
1 /*
2 Unix SMB/CIFS implementation.
3 SMB NT Security Descriptor / Unix permission conversion.
4 Copyright (C) Jeremy Allison 1994-2009.
5 Copyright (C) Andreas Gruenbacher 2002.
6 Copyright (C) Simo Sorce <idra@samba.org> 2009.
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23
24 extern struct current_user current_user;
25 extern const struct generic_mapping file_generic_mapping;
26
27 #undef DBGC_CLASS
28 #define DBGC_CLASS DBGC_ACLS
29
30 /****************************************************************************
31 Data structures representing the internal ACE format.
32 ****************************************************************************/
33
34 enum ace_owner {UID_ACE, GID_ACE, WORLD_ACE};
35 enum ace_attribute {ALLOW_ACE, DENY_ACE}; /* Used for incoming NT ACLS. */
36
37 typedef union posix_id {
38 uid_t uid;
39 gid_t gid;
40 int world;
41 } posix_id;
42
43 typedef struct canon_ace {
44 struct canon_ace *next, *prev;
45 SMB_ACL_TAG_T type;
46 mode_t perms; /* Only use S_I(R|W|X)USR mode bits here. */
47 DOM_SID trustee;
48 enum ace_owner owner_type;
49 enum ace_attribute attr;
50 posix_id unix_ug;
51 uint8_t ace_flags; /* From windows ACE entry. */
52 } canon_ace;
53
54 #define ALL_ACE_PERMS (S_IRUSR|S_IWUSR|S_IXUSR)
55
56 /*
57 * EA format of user.SAMBA_PAI (Samba_Posix_Acl_Interitance)
58 * attribute on disk - version 1.
59 * All values are little endian.
60 *
61 * | 1 | 1 | 2 | 2 | ....
62 * +------+------+-------------+---------------------+-------------+--------------------+
63 * | vers | flag | num_entries | num_default_entries | ..entries.. | default_entries... |
64 * +------+------+-------------+---------------------+-------------+--------------------+
65 *
66 * Entry format is :
67 *
68 * | 1 | 4 |
69 * +------+-------------------+
70 * | value| uid/gid or world |
71 * | type | value |
72 * +------+-------------------+
73 *
74 * Version 2 format. Stores extra Windows metadata about an ACL.
75 *
76 * | 1 | 2 | 2 | 2 | ....
77 * +------+----------+-------------+---------------------+-------------+--------------------+
78 * | vers | ace | num_entries | num_default_entries | ..entries.. | default_entries... |
79 * | 2 | type | | | | |
80 * +------+----------+-------------+---------------------+-------------+--------------------+
81 *
82 * Entry format is :
83 *
84 * | 1 | 1 | 4 |
85 * +------+------+-------------------+
86 * | ace | value| uid/gid or world |
87 * | flag | type | value |
88 * +------+-------------------+------+
89 *
90 */
91
92 #define PAI_VERSION_OFFSET 0
93
94 #define PAI_V1_FLAG_OFFSET 1
95 #define PAI_V1_NUM_ENTRIES_OFFSET 2
96 #define PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET 4
97 #define PAI_V1_ENTRIES_BASE 6
98 #define PAI_V1_ACL_FLAG_PROTECTED 0x1
99 #define PAI_V1_ENTRY_LENGTH 5
100
101 #define PAI_V1_VERSION 1
102
103 #define PAI_V2_TYPE_OFFSET 1
104 #define PAI_V2_NUM_ENTRIES_OFFSET 3
105 #define PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET 5
106 #define PAI_V2_ENTRIES_BASE 7
107 #define PAI_V2_ENTRY_LENGTH 6
108
109 #define PAI_V2_VERSION 2
110
111 /*
112 * In memory format of user.SAMBA_PAI attribute.
113 */
114
115 struct pai_entry {
116 struct pai_entry *next, *prev;
117 uint8_t ace_flags;
118 enum ace_owner owner_type;
119 posix_id unix_ug;
120 };
121
122 struct pai_val {
123 uint16_t sd_type;
124 unsigned int num_entries;
125 struct pai_entry *entry_list;
126 unsigned int num_def_entries;
127 struct pai_entry *def_entry_list;
128 };
129
130 /************************************************************************
131 Return a uint32 of the pai_entry principal.
132 ************************************************************************/
133
134 static uint32_t get_pai_entry_val(struct pai_entry *paie)
135 {
136 switch (paie->owner_type) {
137 case UID_ACE:
138 DEBUG(10,("get_pai_entry_val: uid = %u\n", (unsigned int)paie->unix_ug.uid ));
139 return (uint32_t)paie->unix_ug.uid;
140 case GID_ACE:
141 DEBUG(10,("get_pai_entry_val: gid = %u\n", (unsigned int)paie->unix_ug.gid ));
142 return (uint32_t)paie->unix_ug.gid;
143 case WORLD_ACE:
144 default:
145 DEBUG(10,("get_pai_entry_val: world ace\n"));
146 return (uint32_t)-1;
147 }
148 }
149
150 /************************************************************************
151 Return a uint32 of the entry principal.
152 ************************************************************************/
153
154 static uint32_t get_entry_val(canon_ace *ace_entry)
155 {
156 switch (ace_entry->owner_type) {
157 case UID_ACE:
158 DEBUG(10,("get_entry_val: uid = %u\n", (unsigned int)ace_entry->unix_ug.uid ));
159 return (uint32_t)ace_entry->unix_ug.uid;
160 case GID_ACE:
161 DEBUG(10,("get_entry_val: gid = %u\n", (unsigned int)ace_entry->unix_ug.gid ));
162 return (uint32_t)ace_entry->unix_ug.gid;
163 case WORLD_ACE:
164 default:
165 DEBUG(10,("get_entry_val: world ace\n"));
166 return (uint32_t)-1;
167 }
168 }
169
170 /************************************************************************
171 Create the on-disk format (always v2 now). Caller must free.
172 ************************************************************************/
173
174 static char *create_pai_buf_v2(canon_ace *file_ace_list,
175 canon_ace *dir_ace_list,
176 uint16_t sd_type,
177 size_t *store_size)
178 {
179 char *pai_buf = NULL;
180 canon_ace *ace_list = NULL;
181 char *entry_offset = NULL;
182 unsigned int num_entries = 0;
183 unsigned int num_def_entries = 0;
184 unsigned int i;
185
186 for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next) {
187 num_entries++;
188 }
189
190 for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next) {
191 num_def_entries++;
192 }
193
194 DEBUG(10,("create_pai_buf_v2: num_entries = %u, num_def_entries = %u\n", num_entries, num_def_entries ));
195
196 *store_size = PAI_V2_ENTRIES_BASE +
197 ((num_entries + num_def_entries)*PAI_V2_ENTRY_LENGTH);
198
199 pai_buf = (char *)SMB_MALLOC(*store_size);
200 if (!pai_buf) {
201 return NULL;
202 }
203
204 /* Set up the header. */
205 memset(pai_buf, '\0', PAI_V2_ENTRIES_BASE);
206 SCVAL(pai_buf,PAI_VERSION_OFFSET,PAI_V2_VERSION);
207 SSVAL(pai_buf,PAI_V2_TYPE_OFFSET, sd_type);
208 SSVAL(pai_buf,PAI_V2_NUM_ENTRIES_OFFSET,num_entries);
209 SSVAL(pai_buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET,num_def_entries);
210
211 DEBUG(10,("create_pai_buf_v2: sd_type = 0x%x\n",
212 (unsigned int)sd_type ));
213
214 entry_offset = pai_buf + PAI_V2_ENTRIES_BASE;
215
216 i = 0;
217 for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next) {
218 uint8_t type_val = (uint8_t)ace_list->owner_type;
219 uint32_t entry_val = get_entry_val(ace_list);
220
221 SCVAL(entry_offset,0,ace_list->ace_flags);
222 SCVAL(entry_offset,1,type_val);
223 SIVAL(entry_offset,2,entry_val);
224 DEBUG(10,("create_pai_buf_v2: entry %u [0x%x] [0x%x] [0x%x]\n",
225 i,
226 (unsigned int)ace_list->ace_flags,
227 (unsigned int)type_val,
228 (unsigned int)entry_val ));
229 i++;
230 entry_offset += PAI_V2_ENTRY_LENGTH;
231 }
232
233 for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next) {
234 uint8_t type_val = (uint8_t)ace_list->owner_type;
235 uint32_t entry_val = get_entry_val(ace_list);
236
237 SCVAL(entry_offset,0,ace_list->ace_flags);
238 SCVAL(entry_offset,1,type_val);
239 SIVAL(entry_offset,2,entry_val);
240 DEBUG(10,("create_pai_buf_v2: entry %u [0x%x] [0x%x] [0x%x]\n",
241 i,
242 (unsigned int)ace_list->ace_flags,
243 (unsigned int)type_val,
244 (unsigned int)entry_val ));
245 i++;
246 entry_offset += PAI_V2_ENTRY_LENGTH;
247 }
248
249 return pai_buf;
250 }
251
252 /************************************************************************
253 Store the user.SAMBA_PAI attribute on disk.
254 ************************************************************************/
255
256 static void store_inheritance_attributes(files_struct *fsp,
257 canon_ace *file_ace_list,
258 canon_ace *dir_ace_list,
259 uint16_t sd_type)
260 {
261 int ret;
262 size_t store_size;
263 char *pai_buf;
264
265 if (!lp_map_acl_inherit(SNUM(fsp->conn))) {
266 return;
267 }
268
269 pai_buf = create_pai_buf_v2(file_ace_list, dir_ace_list,
270 sd_type, &store_size);
271
272 if (fsp->fh->fd != -1) {
273 ret = SMB_VFS_FSETXATTR(fsp, SAMBA_POSIX_INHERITANCE_EA_NAME,
274 pai_buf, store_size, 0);
275 } else {
276 ret = SMB_VFS_SETXATTR(fsp->conn, fsp->fsp_name->base_name,
277 SAMBA_POSIX_INHERITANCE_EA_NAME,
278 pai_buf, store_size, 0);
279 }
280
281 SAFE_FREE(pai_buf);
282
283 DEBUG(10,("store_inheritance_attribute: type 0x%x for file %s\n",
284 (unsigned int)sd_type,
285 fsp_str_dbg(fsp)));
286
287 if (ret == -1 && !no_acl_syscall_error(errno)) {
288 DEBUG(1,("store_inheritance_attribute: Error %s\n", strerror(errno) ));
289 }
290 }
291
292 /************************************************************************
293 Delete the in memory inheritance info.
294 ************************************************************************/
295
296 static void free_inherited_info(struct pai_val *pal)
297 {
298 if (pal) {
299 struct pai_entry *paie, *paie_next;
300 for (paie = pal->entry_list; paie; paie = paie_next) {
301 paie_next = paie->next;
302 SAFE_FREE(paie);
303 }
304 for (paie = pal->def_entry_list; paie; paie = paie_next) {
305 paie_next = paie->next;
306 SAFE_FREE(paie);
307 }
308 SAFE_FREE(pal);
309 }
310 }
311
312 /************************************************************************
313 Get any stored ACE flags.
314 ************************************************************************/
315
316 static uint16_t get_pai_flags(struct pai_val *pal, canon_ace *ace_entry, bool default_ace)
317 {
318 struct pai_entry *paie;
319
320 if (!pal) {
321 return 0;
322 }
323
324 /* If the entry exists it is inherited. */
325 for (paie = (default_ace ? pal->def_entry_list : pal->entry_list); paie; paie = paie->next) {
326 if (ace_entry->owner_type == paie->owner_type &&
327 get_entry_val(ace_entry) == get_pai_entry_val(paie))
328 return paie->ace_flags;
329 }
330 return 0;
331 }
332
333 /************************************************************************
334 Ensure an attribute just read is valid - v1.
335 ************************************************************************/
336
337 static bool check_pai_ok_v1(const char *pai_buf, size_t pai_buf_data_size)
338 {
339 uint16 num_entries;
340 uint16 num_def_entries;
341
342 if (pai_buf_data_size < PAI_V1_ENTRIES_BASE) {
343 /* Corrupted - too small. */
344 return false;
345 }
346
347 if (CVAL(pai_buf,PAI_VERSION_OFFSET) != PAI_V1_VERSION) {
348 return false;
349 }
350
351 num_entries = SVAL(pai_buf,PAI_V1_NUM_ENTRIES_OFFSET);
352 num_def_entries = SVAL(pai_buf,PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET);
353
354 /* Check the entry lists match. */
355 /* Each entry is 5 bytes (type plus 4 bytes of uid or gid). */
356
357 if (((num_entries + num_def_entries)*PAI_V1_ENTRY_LENGTH) +
358 PAI_V1_ENTRIES_BASE != pai_buf_data_size) {
359 return false;
360 }
361
362 return true;
363 }
364
365 /************************************************************************
366 Ensure an attribute just read is valid - v2.
367 ************************************************************************/
368
369 static bool check_pai_ok_v2(const char *pai_buf, size_t pai_buf_data_size)
370 {
371 uint16 num_entries;
372 uint16 num_def_entries;
373
374 if (pai_buf_data_size < PAI_V2_ENTRIES_BASE) {
375 /* Corrupted - too small. */
376 return false;
377 }
378
379 if (CVAL(pai_buf,PAI_VERSION_OFFSET) != PAI_V2_VERSION) {
380 return false;
381 }
382
383 num_entries = SVAL(pai_buf,PAI_V2_NUM_ENTRIES_OFFSET);
384 num_def_entries = SVAL(pai_buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET);
385
386 /* Check the entry lists match. */
387 /* Each entry is 6 bytes (flags + type + 4 bytes of uid or gid). */
388
389 if (((num_entries + num_def_entries)*PAI_V2_ENTRY_LENGTH) +
390 PAI_V2_ENTRIES_BASE != pai_buf_data_size) {
391 return false;
392 }
393
394 return true;
395 }
396
397 /************************************************************************
398 Decode the owner.
399 ************************************************************************/
400
401 static bool get_pai_owner_type(struct pai_entry *paie, const char *entry_offset)
402 {
403 paie->owner_type = (enum ace_owner)CVAL(entry_offset,0);
404 switch( paie->owner_type) {
405 case UID_ACE:
406 paie->unix_ug.uid = (uid_t)IVAL(entry_offset,1);
407 DEBUG(10,("get_pai_owner_type: uid = %u\n",
408 (unsigned int)paie->unix_ug.uid ));
409 break;
410 case GID_ACE:
411 paie->unix_ug.gid = (gid_t)IVAL(entry_offset,1);
412 DEBUG(10,("get_pai_owner_type: gid = %u\n",
413 (unsigned int)paie->unix_ug.gid ));
414 break;
415 case WORLD_ACE:
416 paie->unix_ug.world = -1;
417 DEBUG(10,("get_pai_owner_type: world ace\n"));
418 break;
419 default:
420 DEBUG(10,("get_pai_owner_type: unknown type %u\n",
421 (unsigned int)paie->owner_type ));
422 return false;
423 }
424 return true;
425 }
426
427 /************************************************************************
428 Process v2 entries.
429 ************************************************************************/
430
431 static const char *create_pai_v1_entries(struct pai_val *paiv,
432 const char *entry_offset,
433 bool def_entry)
434 {
435 int i;
436
437 for (i = 0; i < paiv->num_entries; i++) {
438 struct pai_entry *paie = SMB_MALLOC_P(struct pai_entry);
439 if (!paie) {
440 return NULL;
441 }
442
443 paie->ace_flags = SEC_ACE_FLAG_INHERITED_ACE;
444 if (!get_pai_owner_type(paie, entry_offset)) {
445 return NULL;
446 }
447
448 if (!def_entry) {
449 DLIST_ADD(paiv->entry_list, paie);
450 } else {
451 DLIST_ADD(paiv->def_entry_list, paie);
452 }
453 entry_offset += PAI_V1_ENTRY_LENGTH;
454 }
455 return entry_offset;
456 }
457
458 /************************************************************************
459 Convert to in-memory format from version 1.
460 ************************************************************************/
461
462 static struct pai_val *create_pai_val_v1(const char *buf, size_t size)
463 {
464 const char *entry_offset;
465 struct pai_val *paiv = NULL;
466
467 if (!check_pai_ok_v1(buf, size)) {
468 return NULL;
469 }
470
471 paiv = SMB_MALLOC_P(struct pai_val);
472 if (!paiv) {
473 return NULL;
474 }
475
476 memset(paiv, '\0', sizeof(struct pai_val));
477
478 paiv->sd_type = (CVAL(buf,PAI_V1_FLAG_OFFSET) == PAI_V1_ACL_FLAG_PROTECTED) ?
479 SE_DESC_DACL_PROTECTED : 0;
480
481 paiv->num_entries = SVAL(buf,PAI_V1_NUM_ENTRIES_OFFSET);
482 paiv->num_def_entries = SVAL(buf,PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET);
483
484 entry_offset = buf + PAI_V1_ENTRIES_BASE;
485
486 DEBUG(10,("create_pai_val: num_entries = %u, num_def_entries = %u\n",
487 paiv->num_entries, paiv->num_def_entries ));
488
489 entry_offset = create_pai_v1_entries(paiv, entry_offset, false);
490 if (entry_offset == NULL) {
491 free_inherited_info(paiv);
492 return NULL;
493 }
494 entry_offset = create_pai_v1_entries(paiv, entry_offset, true);
495 if (entry_offset == NULL) {
496 free_inherited_info(paiv);
497 return NULL;
498 }
499
500 return paiv;
501 }
502
503 /************************************************************************
504 Process v2 entries.
505 ************************************************************************/
506
507 static const char *create_pai_v2_entries(struct pai_val *paiv,
508 unsigned int num_entries,
509 const char *entry_offset,
510 bool def_entry)
511 {
512 unsigned int i;
513
514 for (i = 0; i < num_entries; i++) {
515 struct pai_entry *paie = SMB_MALLOC_P(struct pai_entry);
516 if (!paie) {
517 return NULL;
518 }
519
520 paie->ace_flags = CVAL(entry_offset,0);
521
522 if (!get_pai_owner_type(paie, entry_offset+1)) {
523 return NULL;
524 }
525 if (!def_entry) {
526 DLIST_ADD(paiv->entry_list, paie);
527 } else {
528 DLIST_ADD(paiv->def_entry_list, paie);
529 }
530 entry_offset += PAI_V2_ENTRY_LENGTH;
531 }
532 return entry_offset;
533 }
534
535 /************************************************************************
536 Convert to in-memory format from version 2.
537 ************************************************************************/
538
539 static struct pai_val *create_pai_val_v2(const char *buf, size_t size)
540 {
541 const char *entry_offset;
542 struct pai_val *paiv = NULL;
543
544 if (!check_pai_ok_v2(buf, size)) {
545 return NULL;
546 }
547
548 paiv = SMB_MALLOC_P(struct pai_val);
549 if (!paiv) {
550 return NULL;
551 }
552
553 memset(paiv, '\0', sizeof(struct pai_val));
554
555 paiv->sd_type = SVAL(buf,PAI_V2_TYPE_OFFSET);
556
557 paiv->num_entries = SVAL(buf,PAI_V2_NUM_ENTRIES_OFFSET);
558 paiv->num_def_entries = SVAL(buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET);
559
560 entry_offset = buf + PAI_V2_ENTRIES_BASE;
561
562 DEBUG(10,("create_pai_val_v2: sd_type = 0x%x num_entries = %u, num_def_entries = %u\n",
563 (unsigned int)paiv->sd_type,
564 paiv->num_entries, paiv->num_def_entries ));
565
566 entry_offset = create_pai_v2_entries(paiv, paiv->num_entries,
567 entry_offset, false);
568 if (entry_offset == NULL) {
569 free_inherited_info(paiv);
570 return NULL;
571 }
572 entry_offset = create_pai_v2_entries(paiv, paiv->num_def_entries,
573 entry_offset, true);
574 if (entry_offset == NULL) {
575 free_inherited_info(paiv);
576 return NULL;
577 }
578
579 return paiv;
580 }
581
582 /************************************************************************
583 Convert to in-memory format - from either version 1 or 2.
584 ************************************************************************/
585
586 static struct pai_val *create_pai_val(const char *buf, size_t size)
587 {
588 if (size < 1) {
589 return NULL;
590 }
591 if (CVAL(buf,PAI_VERSION_OFFSET) == PAI_V1_VERSION) {
592 return create_pai_val_v1(buf, size);
593 } else if (CVAL(buf,PAI_VERSION_OFFSET) == PAI_V2_VERSION) {
594 return create_pai_val_v2(buf, size);
595 } else {
596 return NULL;
597 }
598 }
599
600 /************************************************************************
601 Load the user.SAMBA_PAI attribute.
602 ************************************************************************/
603
604 static struct pai_val *fload_inherited_info(files_struct *fsp)
605 {
606 char *pai_buf;
607 size_t pai_buf_size = 1024;
608 struct pai_val *paiv = NULL;
609 ssize_t ret;
610
611 if (!lp_map_acl_inherit(SNUM(fsp->conn))) {
612 return NULL;
613 }
614
615 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL) {
616 return NULL;
617 }
618
619 do {
620 if (fsp->fh->fd != -1) {
621 ret = SMB_VFS_FGETXATTR(fsp, SAMBA_POSIX_INHERITANCE_EA_NAME,
622 pai_buf, pai_buf_size);
623 } else {
624 ret = SMB_VFS_GETXATTR(fsp->conn,
625 fsp->fsp_name->base_name,
626 SAMBA_POSIX_INHERITANCE_EA_NAME,
627 pai_buf, pai_buf_size);
628 }
629
630 if (ret == -1) {
631 if (errno != ERANGE) {
632 break;
633 }
634 /* Buffer too small - enlarge it. */
635 pai_buf_size *= 2;
636 SAFE_FREE(pai_buf);
637 if (pai_buf_size > 1024*1024) {
638 return NULL; /* Limit malloc to 1mb. */
639 }
640 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL)
641 return NULL;
642 }
643 } while (ret == -1);
644
645 DEBUG(10,("load_inherited_info: ret = %lu for file %s\n",
646 (unsigned long)ret, fsp_str_dbg(fsp)));
647
648 if (ret == -1) {
649 /* No attribute or not supported. */
650 #if defined(ENOATTR)
651 if (errno != ENOATTR)
652 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
653 #else
654 if (errno != ENOSYS)
655 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
656 #endif
657 SAFE_FREE(pai_buf);
658 return NULL;
659 }
660
661 paiv = create_pai_val(pai_buf, ret);
662
663 if (paiv) {
664 DEBUG(10,("load_inherited_info: ACL type is 0x%x for file %s\n",
665 (unsigned int)paiv->sd_type, fsp_str_dbg(fsp)));
666 }
667
668 SAFE_FREE(pai_buf);
669 return paiv;
670 }
671
672 /************************************************************************
673 Load the user.SAMBA_PAI attribute.
674 ************************************************************************/
675
676 static struct pai_val *load_inherited_info(const struct connection_struct *conn,
677 const char *fname)
678 {
679 char *pai_buf;
680 size_t pai_buf_size = 1024;
681 struct pai_val *paiv = NULL;
682 ssize_t ret;
683
684 if (!lp_map_acl_inherit(SNUM(conn))) {
685 return NULL;
686 }
687
688 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL) {
689 return NULL;
690 }
691
692 do {
693 ret = SMB_VFS_GETXATTR(conn, fname,
694 SAMBA_POSIX_INHERITANCE_EA_NAME,
695 pai_buf, pai_buf_size);
696
697 if (ret == -1) {
698 if (errno != ERANGE) {
699 break;
700 }
701 /* Buffer too small - enlarge it. */
702 pai_buf_size *= 2;
703 SAFE_FREE(pai_buf);
704 if (pai_buf_size > 1024*1024) {
705 return NULL; /* Limit malloc to 1mb. */
706 }
707 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL)
708 return NULL;
709 }
710 } while (ret == -1);
711
712 DEBUG(10,("load_inherited_info: ret = %lu for file %s\n", (unsigned long)ret, fname));
713
714 if (ret == -1) {
715 /* No attribute or not supported. */
716 #if defined(ENOATTR)
717 if (errno != ENOATTR)
718 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
719 #else
720 if (errno != ENOSYS)
721 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
722 #endif
723 SAFE_FREE(pai_buf);
724 return NULL;
725 }
726
727 paiv = create_pai_val(pai_buf, ret);
728
729 if (paiv) {
730 DEBUG(10,("load_inherited_info: ACL type 0x%x for file %s\n",
731 (unsigned int)paiv->sd_type,
732 fname));
733 }
734
735 SAFE_FREE(pai_buf);
736 return paiv;
737 }
738
739 /****************************************************************************
740 Functions to manipulate the internal ACE format.
741 ****************************************************************************/
742
743 /****************************************************************************
744 Count a linked list of canonical ACE entries.
745 ****************************************************************************/
746
747 static size_t count_canon_ace_list( canon_ace *l_head )
748 {
749 size_t count = 0;
750 canon_ace *ace;
751
752 for (ace = l_head; ace; ace = ace->next)
753 count++;
754
755 return count;
756 }
757
758 /****************************************************************************
759 Free a linked list of canonical ACE entries.
760 ****************************************************************************/
761
762 static void free_canon_ace_list( canon_ace *l_head )
763 {
764 canon_ace *list, *next;
765
766 for (list = l_head; list; list = next) {
767 next = list->next;
768 DLIST_REMOVE(l_head, list);
769 SAFE_FREE(list);
770 }
771 }
772
773 /****************************************************************************
774 Function to duplicate a canon_ace entry.
775 ****************************************************************************/
776
777 static canon_ace *dup_canon_ace( canon_ace *src_ace)
778 {
779 canon_ace *dst_ace = SMB_MALLOC_P(canon_ace);
780
781 if (dst_ace == NULL)
782 return NULL;
783
784 *dst_ace = *src_ace;
785 dst_ace->prev = dst_ace->next = NULL;
786 return dst_ace;
787 }
788
789 /****************************************************************************
790 Print out a canon ace.
791 ****************************************************************************/
792
793 static void print_canon_ace(canon_ace *pace, int num)
794 {
795 dbgtext( "canon_ace index %d. Type = %s ", num, pace->attr == ALLOW_ACE ? "allow" : "deny" );
796 dbgtext( "SID = %s ", sid_string_dbg(&pace->trustee));
797 if (pace->owner_type == UID_ACE) {
798 const char *u_name = uidtoname(pace->unix_ug.uid);
799 dbgtext( "uid %u (%s) ", (unsigned int)pace->unix_ug.uid, u_name );
800 } else if (pace->owner_type == GID_ACE) {
801 char *g_name = gidtoname(pace->unix_ug.gid);
802 dbgtext( "gid %u (%s) ", (unsigned int)pace->unix_ug.gid, g_name );
803 } else
804 dbgtext( "other ");
805 switch (pace->type) {
806 case SMB_ACL_USER:
807 dbgtext( "SMB_ACL_USER ");
808 break;
809 case SMB_ACL_USER_OBJ:
810 dbgtext( "SMB_ACL_USER_OBJ ");
811 break;
812 case SMB_ACL_GROUP:
813 dbgtext( "SMB_ACL_GROUP ");
814 break;
815 case SMB_ACL_GROUP_OBJ:
816 dbgtext( "SMB_ACL_GROUP_OBJ ");
817 break;
818 case SMB_ACL_OTHER:
819 dbgtext( "SMB_ACL_OTHER ");
820 break;
821 default:
822 dbgtext( "MASK " );
823 break;
824 }
825
826 dbgtext( "ace_flags = 0x%x ", (unsigned int)pace->ace_flags);
827 dbgtext( "perms ");
828 dbgtext( "%c", pace->perms & S_IRUSR ? 'r' : '-');
829 dbgtext( "%c", pace->perms & S_IWUSR ? 'w' : '-');
830 dbgtext( "%c\n", pace->perms & S_IXUSR ? 'x' : '-');
831 }
832
833 /****************************************************************************
834 Print out a canon ace list.
835 ****************************************************************************/
836
837 static void print_canon_ace_list(const char *name, canon_ace *ace_list)
838 {
839 int count = 0;
840
841 if( DEBUGLVL( 10 )) {
842 dbgtext( "print_canon_ace_list: %s\n", name );
843 for (;ace_list; ace_list = ace_list->next, count++)
844 print_canon_ace(ace_list, count );
845 }
846 }
847
848 /****************************************************************************
849 Map POSIX ACL perms to canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits).
850 ****************************************************************************/
851
852 static mode_t convert_permset_to_mode_t(connection_struct *conn, SMB_ACL_PERMSET_T permset)
853 {
854 mode_t ret = 0;
855
856 ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ) ? S_IRUSR : 0);
857 ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE) ? S_IWUSR : 0);
858 ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_EXECUTE) ? S_IXUSR : 0);
859
860 return ret;
861 }
862
863 /****************************************************************************
864 Map generic UNIX permissions to canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits).
865 ****************************************************************************/
866
867 static mode_t unix_perms_to_acl_perms(mode_t mode, int r_mask, int w_mask, int x_mask)
868 {
869 mode_t ret = 0;
870
871 if (mode & r_mask)
872 ret |= S_IRUSR;
873 if (mode & w_mask)
874 ret |= S_IWUSR;
875 if (mode & x_mask)
876 ret |= S_IXUSR;
877
878 return ret;
879 }
880
881 /****************************************************************************
882 Map canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits) to
883 an SMB_ACL_PERMSET_T.
884 ****************************************************************************/
885
886 static int map_acl_perms_to_permset(connection_struct *conn, mode_t mode, SMB_ACL_PERMSET_T *p_permset)
887 {
888 if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn, *p_permset) == -1)
889 return -1;
890 if (mode & S_IRUSR) {
891 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_READ) == -1)
892 return -1;
893 }
894 if (mode & S_IWUSR) {
895 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_WRITE) == -1)
896 return -1;
897 }
898 if (mode & S_IXUSR) {
899 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_EXECUTE) == -1)
900 return -1;
901 }
902 return 0;
903 }
904
905 /****************************************************************************
906 Function to create owner and group SIDs from a SMB_STRUCT_STAT.
907 ****************************************************************************/
908
909 void create_file_sids(const SMB_STRUCT_STAT *psbuf, DOM_SID *powner_sid, DOM_SID *pgroup_sid)
910 {
911 uid_to_sid( powner_sid, psbuf->st_ex_uid );
912 gid_to_sid( pgroup_sid, psbuf->st_ex_gid );
913 }
914
915 /****************************************************************************
916 Merge aces with a common sid - if both are allow or deny, OR the permissions together and
917 delete the second one. If the first is deny, mask the permissions off and delete the allow
918 if the permissions become zero, delete the deny if the permissions are non zero.
919 ****************************************************************************/
920
921 static void merge_aces( canon_ace **pp_list_head, bool dir_acl)
922 {
923 canon_ace *l_head = *pp_list_head;
924 canon_ace *curr_ace_outer;
925 canon_ace *curr_ace_outer_next;
926
927 /*
928 * First, merge allow entries with identical SIDs, and deny entries
929 * with identical SIDs.
930 */
931
932 for (curr_ace_outer = l_head; curr_ace_outer; curr_ace_outer = curr_ace_outer_next) {
933 canon_ace *curr_ace;
934 canon_ace *curr_ace_next;
935
936 curr_ace_outer_next = curr_ace_outer->next; /* Save the link in case we delete. */
937
938 for (curr_ace = curr_ace_outer->next; curr_ace; curr_ace = curr_ace_next) {
939 bool can_merge = false;
940
941 curr_ace_next = curr_ace->next; /* Save the link in case of delete. */
942
943 /* For file ACLs we can merge if the SIDs and ALLOW/DENY
944 * types are the same. For directory acls we must also
945 * ensure the POSIX ACL types are the same. */
946
947 if (!dir_acl) {
948 can_merge = (sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
949 (curr_ace->attr == curr_ace_outer->attr));
950 } else {
951 can_merge = (sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
952 (curr_ace->type == curr_ace_outer->type) &&
953 (curr_ace->attr == curr_ace_outer->attr));
954 }
955
956 if (can_merge) {
957 if( DEBUGLVL( 10 )) {
958 dbgtext("merge_aces: Merging ACE's\n");
959 print_canon_ace( curr_ace_outer, 0);
960 print_canon_ace( curr_ace, 0);
961 }
962
963 /* Merge two allow or two deny ACE's. */
964
965 /* Theoretically we shouldn't merge a dir ACE if
966 * one ACE has the CI flag set, and the other
967 * ACE has the OI flag set, but this is rare
968 * enough we can ignore it. */
969
970 curr_ace_outer->perms |= curr_ace->perms;
971 curr_ace_outer->ace_flags |= curr_ace->ace_flags;
972 DLIST_REMOVE(l_head, curr_ace);
973 SAFE_FREE(curr_ace);
974 curr_ace_outer_next = curr_ace_outer->next; /* We may have deleted the link. */
975 }
976 }
977 }
978
979 /*
980 * Now go through and mask off allow permissions with deny permissions.
981 * We can delete either the allow or deny here as we know that each SID
982 * appears only once in the list.
983 */
984
985 for (curr_ace_outer = l_head; curr_ace_outer; curr_ace_outer = curr_ace_outer_next) {
986 canon_ace *curr_ace;
987 canon_ace *curr_ace_next;
988
989 curr_ace_outer_next = curr_ace_outer->next; /* Save the link in case we delete. */
990
991 for (curr_ace = curr_ace_outer->next; curr_ace; curr_ace = curr_ace_next) {
992
993 curr_ace_next = curr_ace->next; /* Save the link in case of delete. */
994
995 /*
996 * Subtract ACE's with different entries. Due to the ordering constraints
997 * we've put on the ACL, we know the deny must be the first one.
998 */
999
1000 if (sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
1001 (curr_ace_outer->attr == DENY_ACE) && (curr_ace->attr == ALLOW_ACE)) {
1002
1003 if( DEBUGLVL( 10 )) {
1004 dbgtext("merge_aces: Masking ACE's\n");
1005 print_canon_ace( curr_ace_outer, 0);
1006 print_canon_ace( curr_ace, 0);
1007 }
1008
1009 curr_ace->perms &= ~curr_ace_outer->perms;
1010
1011 if (curr_ace->perms == 0) {
1012
1013 /*
1014 * The deny overrides the allow. Remove the allow.
1015 */
1016
1017 DLIST_REMOVE(l_head, curr_ace);
1018 SAFE_FREE(curr_ace);
1019 curr_ace_outer_next = curr_ace_outer->next; /* We may have deleted the link. */
1020
1021 } else {
1022
1023 /*
1024 * Even after removing permissions, there
1025 * are still allow permissions - delete the deny.
1026 * It is safe to delete the deny here,
1027 * as we are guarenteed by the deny first
1028 * ordering that all the deny entries for
1029 * this SID have already been merged into one
1030 * before we can get to an allow ace.
1031 */
1032
1033 DLIST_REMOVE(l_head, curr_ace_outer);
1034 SAFE_FREE(curr_ace_outer);
1035 break;
1036 }
1037 }
1038
1039 } /* end for curr_ace */
1040 } /* end for curr_ace_outer */
1041
1042 /* We may have modified the list. */
1043
1044 *pp_list_head = l_head;
1045 }
1046
1047 /****************************************************************************
1048 Check if we need to return NT4.x compatible ACL entries.
1049 ****************************************************************************/
1050
1051 bool nt4_compatible_acls(void)
1052 {
1053 int compat = lp_acl_compatibility();
1054
1055 if (compat == ACL_COMPAT_AUTO) {
1056 enum remote_arch_types ra_type = get_remote_arch();
1057
1058 /* Automatically adapt to client */
1059 return (ra_type <= RA_WINNT);
1060 } else
1061 return (compat == ACL_COMPAT_WINNT);
1062 }
1063
1064
1065 /****************************************************************************
1066 Map canon_ace perms to permission bits NT.
1067 The attr element is not used here - we only process deny entries on set,
1068 not get. Deny entries are implicit on get with ace->perms = 0.
1069 ****************************************************************************/
1070
1071 uint32_t map_canon_ace_perms(int snum,
1072 enum security_ace_type *pacl_type,
1073 mode_t perms,
1074 bool directory_ace)
1075 {
1076 uint32_t nt_mask = 0;
1077
1078 *pacl_type = SEC_ACE_TYPE_ACCESS_ALLOWED;
1079
1080 if (lp_acl_map_full_control(snum) && ((perms & ALL_ACE_PERMS) == ALL_ACE_PERMS)) {
1081 if (directory_ace) {
1082 nt_mask = UNIX_DIRECTORY_ACCESS_RWX;
1083 } else {
1084 nt_mask = (UNIX_ACCESS_RWX & ~DELETE_ACCESS);
1085 }
1086 } else if ((perms & ALL_ACE_PERMS) == (mode_t)0) {
1087 /*
1088 * Windows NT refuses to display ACEs with no permissions in them (but
1089 * they are perfectly legal with Windows 2000). If the ACE has empty
1090 * permissions we cannot use 0, so we use the otherwise unused
1091 * WRITE_OWNER permission, which we ignore when we set an ACL.
1092 * We abstract this into a #define of UNIX_ACCESS_NONE to allow this
1093 * to be changed in the future.
1094 */
1095
1096 if (nt4_compatible_acls())
1097 nt_mask = UNIX_ACCESS_NONE;
1098 else
1099 nt_mask = 0;
1100 } else {
1101 if (directory_ace) {
1102 nt_mask |= ((perms & S_IRUSR) ? UNIX_DIRECTORY_ACCESS_R : 0 );
1103 nt_mask |= ((perms & S_IWUSR) ? UNIX_DIRECTORY_ACCESS_W : 0 );
1104 nt_mask |= ((perms & S_IXUSR) ? UNIX_DIRECTORY_ACCESS_X : 0 );
1105 } else {
1106 nt_mask |= ((perms & S_IRUSR) ? UNIX_ACCESS_R : 0 );
1107 nt_mask |= ((perms & S_IWUSR) ? UNIX_ACCESS_W : 0 );
1108 nt_mask |= ((perms & S_IXUSR) ? UNIX_ACCESS_X : 0 );
1109 }
1110 }
1111
1112 if ((perms & S_IWUSR) && lp_dos_filemode(snum)) {
1113 nt_mask |= (SEC_STD_WRITE_DAC|SEC_STD_WRITE_OWNER|DELETE_ACCESS);
1114 }
1115
1116 DEBUG(10,("map_canon_ace_perms: Mapped (UNIX) %x to (NT) %x\n",
1117 (unsigned int)perms, (unsigned int)nt_mask ));
1118
1119 return nt_mask;
1120 }
1121
1122 /****************************************************************************
1123 Map NT perms to a UNIX mode_t.
1124 ****************************************************************************/
1125
1126 #define FILE_SPECIFIC_READ_BITS (FILE_READ_DATA|FILE_READ_EA)
1127 #define FILE_SPECIFIC_WRITE_BITS (FILE_WRITE_DATA|FILE_APPEND_DATA|FILE_WRITE_EA)
1128 #define FILE_SPECIFIC_EXECUTE_BITS (FILE_EXECUTE)
1129
1130 static mode_t map_nt_perms( uint32 *mask, int type)
1131 {
1132 mode_t mode = 0;
1133
1134 switch(type) {
1135 case S_IRUSR:
1136 if((*mask) & GENERIC_ALL_ACCESS)
1137 mode = S_IRUSR|S_IWUSR|S_IXUSR;
1138 else {
1139 mode |= ((*mask) & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IRUSR : 0;
1140 mode |= ((*mask) & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWUSR : 0;
1141 mode |= ((*mask) & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXUSR : 0;
1142 }
1143 break;
1144 case S_IRGRP:
1145 if((*mask) & GENERIC_ALL_ACCESS)
1146 mode = S_IRGRP|S_IWGRP|S_IXGRP;
1147 else {
1148 mode |= ((*mask) & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IRGRP : 0;
1149 mode |= ((*mask) & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWGRP : 0;
1150 mode |= ((*mask) & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXGRP : 0;
1151 }
1152 break;
1153 case S_IROTH:
1154 if((*mask) & GENERIC_ALL_ACCESS)
1155 mode = S_IROTH|S_IWOTH|S_IXOTH;
1156 else {
1157 mode |= ((*mask) & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IROTH : 0;
1158 mode |= ((*mask) & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWOTH : 0;
1159 mode |= ((*mask) & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXOTH : 0;
1160 }
1161 break;
1162 }
1163
1164 return mode;
1165 }
1166
1167 /****************************************************************************
1168 Unpack a SEC_DESC into a UNIX owner and group.
1169 ****************************************************************************/
1170
1171 NTSTATUS unpack_nt_owners(int snum, uid_t *puser, gid_t *pgrp, uint32 security_info_sent, const SEC_DESC *psd)
1172 {
1173 DOM_SID owner_sid;
1174 DOM_SID grp_sid;
1175
1176 *puser = (uid_t)-1;
1177 *pgrp = (gid_t)-1;
1178
1179 if(security_info_sent == 0) {
1180 DEBUG(0,("unpack_nt_owners: no security info sent !\n"));
1181 return NT_STATUS_OK;
1182 }
1183
1184 /*
1185 * Validate the owner and group SID's.
1186 */
1187
1188 memset(&owner_sid, '\0', sizeof(owner_sid));
1189 memset(&grp_sid, '\0', sizeof(grp_sid));
1190
1191 DEBUG(5,("unpack_nt_owners: validating owner_sids.\n"));
1192
1193 /*
1194 * Don't immediately fail if the owner sid cannot be validated.
1195 * This may be a group chown only set.
1196 */
1197
1198 if (security_info_sent & OWNER_SECURITY_INFORMATION) {
1199 sid_copy(&owner_sid, psd->owner_sid);
1200 if (!sid_to_uid(&owner_sid, puser)) {
1201 if (lp_force_unknown_acl_user(snum)) {
1202 /* this allows take ownership to work
1203 * reasonably */
1204 *puser = current_user.ut.uid;
1205 } else {
1206 DEBUG(3,("unpack_nt_owners: unable to validate"
1207 " owner sid for %s\n",
1208 sid_string_dbg(&owner_sid)));
1209 return NT_STATUS_INVALID_OWNER;
1210 }
1211 }
1212 DEBUG(3,("unpack_nt_owners: owner sid mapped to uid %u\n",
1213 (unsigned int)*puser ));
1214 }
1215
1216 /*
1217 * Don't immediately fail if the group sid cannot be validated.
1218 * This may be an owner chown only set.
1219 */
1220
1221 if (security_info_sent & GROUP_SECURITY_INFORMATION) {
1222 sid_copy(&grp_sid, psd->group_sid);
1223 if (!sid_to_gid( &grp_sid, pgrp)) {
1224 if (lp_force_unknown_acl_user(snum)) {
1225 /* this allows take group ownership to work
1226 * reasonably */
1227 *pgrp = current_user.ut.gid;
1228 } else {
1229 DEBUG(3,("unpack_nt_owners: unable to validate"
1230 " group sid.\n"));
1231 return NT_STATUS_INVALID_OWNER;
1232 }
1233 }
1234 DEBUG(3,("unpack_nt_owners: group sid mapped to gid %u\n",
1235 (unsigned int)*pgrp));
1236 }
1237
1238 DEBUG(5,("unpack_nt_owners: owner_sids validated.\n"));
1239
1240 return NT_STATUS_OK;
1241 }
1242
1243 /****************************************************************************
1244 Ensure the enforced permissions for this share apply.
1245 ****************************************************************************/
1246
1247 static void apply_default_perms(const struct share_params *params,
1248 const bool is_directory, canon_ace *pace,
1249 mode_t type)
1250 {
1251 mode_t and_bits = (mode_t)0;
1252 mode_t or_bits = (mode_t)0;
1253
1254 /* Get the initial bits to apply. */
1255
1256 if (is_directory) {
1257 and_bits = lp_dir_security_mask(params->service);
1258 or_bits = lp_force_dir_security_mode(params->service);
1259 } else {
1260 and_bits = lp_security_mask(params->service);
1261 or_bits = lp_force_security_mode(params->service);
1262 }
1263
1264 /* Now bounce them into the S_USR space. */
1265 switch(type) {
1266 case S_IRUSR:
1267 /* Ensure owner has read access. */
1268 pace->perms |= S_IRUSR;
1269 if (is_directory)
1270 pace->perms |= (S_IWUSR|S_IXUSR);
1271 and_bits = unix_perms_to_acl_perms(and_bits, S_IRUSR, S_IWUSR, S_IXUSR);
1272 or_bits = unix_perms_to_acl_perms(or_bits, S_IRUSR, S_IWUSR, S_IXUSR);
1273 break;
1274 case S_IRGRP:
1275 and_bits = unix_perms_to_acl_perms(and_bits, S_IRGRP, S_IWGRP, S_IXGRP);
1276 or_bits = unix_perms_to_acl_perms(or_bits, S_IRGRP, S_IWGRP, S_IXGRP);
1277 break;
1278 case S_IROTH:
1279 and_bits = unix_perms_to_acl_perms(and_bits, S_IROTH, S_IWOTH, S_IXOTH);
1280 or_bits = unix_perms_to_acl_perms(or_bits, S_IROTH, S_IWOTH, S_IXOTH);
1281 break;
1282 }
1283
1284 pace->perms = ((pace->perms & and_bits)|or_bits);
1285 }
1286
1287 /****************************************************************************
1288 Check if a given uid/SID is in a group gid/SID. This is probably very
1289 expensive and will need optimisation. A *lot* of optimisation :-). JRA.
1290 ****************************************************************************/
1291
1292 static bool uid_entry_in_group( canon_ace *uid_ace, canon_ace *group_ace )
1293 {
1294 const char *u_name = NULL;
1295
1296 /* "Everyone" always matches every uid. */
1297
1298 if (sid_equal(&group_ace->trustee, &global_sid_World))
1299 return True;
1300
1301 /*
1302 * if it's the current user, we already have the unix token
1303 * and don't need to do the complex user_in_group_sid() call
1304 */
1305 if (uid_ace->unix_ug.uid == current_user.ut.uid) {
1306 size_t i;
1307
1308 if (group_ace->unix_ug.gid == current_user.ut.gid) {
1309 return True;
1310 }
1311
1312 for (i=0; i < current_user.ut.ngroups; i++) {
1313 if (group_ace->unix_ug.gid == current_user.ut.groups[i]) {
1314 return True;
1315 }
1316 }
1317 }
1318
1319 /* u_name talloc'ed off tos. */
1320 u_name = uidtoname(uid_ace->unix_ug.uid);
1321 if (!u_name) {
1322 return False;
1323 }
1324
1325 /*
1326 * user_in_group_sid() uses create_token_from_username()
1327 * which creates an artificial NT token given just a username,
1328 * so this is not reliable for users from foreign domains
1329 * exported by winbindd!
1330 */
1331 return user_in_group_sid(u_name, &group_ace->trustee);
1332 }
1333
1334 /****************************************************************************
1335 A well formed POSIX file or default ACL has at least 3 entries, a
1336 SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ.
1337 In addition, the owner must always have at least read access.
1338 When using this call on get_acl, the pst struct is valid and contains
1339 the mode of the file. When using this call on set_acl, the pst struct has
1340 been modified to have a mode containing the default for this file or directory
1341 type.
1342 ****************************************************************************/
1343
1344 static bool ensure_canon_entry_valid(canon_ace **pp_ace,
1345 const struct share_params *params,
1346 const bool is_directory,
1347 const DOM_SID *pfile_owner_sid,
1348 const DOM_SID *pfile_grp_sid,
1349 const SMB_STRUCT_STAT *pst,
1350 bool setting_acl)
1351 {
1352 canon_ace *pace;
1353 bool got_user = False;
1354 bool got_grp = False;
1355 bool got_other = False;
1356 canon_ace *pace_other = NULL;
1357
1358 for (pace = *pp_ace; pace; pace = pace->next) {
1359 if (pace->type == SMB_ACL_USER_OBJ) {
1360
1361 if (setting_acl)
1362 apply_default_perms(params, is_directory, pace, S_IRUSR);
1363 got_user = True;
1364
1365 } else if (pace->type == SMB_ACL_GROUP_OBJ) {
1366
1367 /*
1368 * Ensure create mask/force create mode is respected on set.
1369 */
1370
1371 if (setting_acl)
1372 apply_default_perms(params, is_directory, pace, S_IRGRP);
1373 got_grp = True;
1374
1375 } else if (pace->type == SMB_ACL_OTHER) {
1376
1377 /*
1378 * Ensure create mask/force create mode is respected on set.
1379 */
1380
1381 if (setting_acl)
1382 apply_default_perms(params, is_directory, pace, S_IROTH);
1383 got_other = True;
1384 pace_other = pace;
1385 }
1386 }
1387
1388 if (!got_user) {
1389 if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1390 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1391 return False;
1392 }
1393
1394 ZERO_STRUCTP(pace);
1395 pace->type = SMB_ACL_USER_OBJ;
1396 pace->owner_type = UID_ACE;
1397 pace->unix_ug.uid = pst->st_ex_uid;
1398 pace->trustee = *pfile_owner_sid;
1399 pace->attr = ALLOW_ACE;
1400 /* Start with existing permissions, principle of least
1401 surprises for the user. */
1402 pace->perms = pst->st_ex_mode;
1403
1404 if (setting_acl) {
1405 /* See if the owning user is in any of the other groups in
1406 the ACE, or if there's a matching user entry.
1407 If so, OR in the permissions from that entry. */
1408
1409 canon_ace *pace_iter;
1410
1411 for (pace_iter = *pp_ace; pace_iter; pace_iter = pace_iter->next) {
1412 if (pace_iter->type == SMB_ACL_USER &&
1413 pace_iter->unix_ug.uid == pace->unix_ug.uid) {
1414 pace->perms |= pace_iter->perms;
1415 } else if (pace_iter->type == SMB_ACL_GROUP_OBJ || pace_iter->type == SMB_ACL_GROUP) {
1416 if (uid_entry_in_group(pace, pace_iter)) {
1417 pace->perms |= pace_iter->perms;
1418 }
1419 }
1420 }
1421
1422 if (pace->perms == 0) {
1423 /* If we only got an "everyone" perm, just use that. */
1424 if (got_other)
1425 pace->perms = pace_other->perms;
1426 }
1427
1428 apply_default_perms(params, is_directory, pace, S_IRUSR);
1429 } else {
1430 pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRUSR, S_IWUSR, S_IXUSR);
1431 }
1432
1433 DLIST_ADD(*pp_ace, pace);
1434 }
1435
1436 if (!got_grp) {
1437 if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1438 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1439 return False;
1440 }
1441
1442 ZERO_STRUCTP(pace);
1443 pace->type = SMB_ACL_GROUP_OBJ;
1444 pace->owner_type = GID_ACE;
1445 pace->unix_ug.uid = pst->st_ex_gid;
1446 pace->trustee = *pfile_grp_sid;
1447 pace->attr = ALLOW_ACE;
1448 if (setting_acl) {
1449 /* If we only got an "everyone" perm, just use that. */
1450 if (got_other)
1451 pace->perms = pace_other->perms;
1452 else
1453 pace->perms = 0;
1454 apply_default_perms(params, is_directory, pace, S_IRGRP);
1455 } else {
1456 pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRGRP, S_IWGRP, S_IXGRP);
1457 }
1458
1459 DLIST_ADD(*pp_ace, pace);
1460 }
1461
1462 if (!got_other) {
1463 if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1464 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1465 return False;
1466 }
1467
1468 ZERO_STRUCTP(pace);
1469 pace->type = SMB_ACL_OTHER;
1470 pace->owner_type = WORLD_ACE;
1471 pace->unix_ug.world = -1;
1472 pace->trustee = global_sid_World;
1473 pace->attr = ALLOW_ACE;
1474 if (setting_acl) {
1475 pace->perms = 0;
1476 apply_default_perms(params, is_directory, pace, S_IROTH);
1477 } else
1478 pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IROTH, S_IWOTH, S_IXOTH);
1479
1480 DLIST_ADD(*pp_ace, pace);
1481 }
1482
1483 return True;
1484 }
1485
1486 /****************************************************************************
1487 Check if a POSIX ACL has the required SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries.
1488 If it does not have them, check if there are any entries where the trustee is the
1489 file owner or the owning group, and map these to SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ.
1490 Note we must not do this to default directory ACLs.
1491 ****************************************************************************/
1492
1493 static void check_owning_objs(canon_ace *ace, DOM_SID *pfile_owner_sid, DOM_SID *pfile_grp_sid)
1494 {
1495 bool got_user_obj, got_group_obj;
1496 canon_ace *current_ace;
1497 int i, entries;
1498
1499 entries = count_canon_ace_list(ace);
1500 got_user_obj = False;
1501 got_group_obj = False;
1502
1503 for (i=0, current_ace = ace; i < entries; i++, current_ace = current_ace->next) {
1504 if (current_ace->type == SMB_ACL_USER_OBJ)
1505 got_user_obj = True;
1506 else if (current_ace->type == SMB_ACL_GROUP_OBJ)
1507 got_group_obj = True;
1508 }
1509 if (got_user_obj && got_group_obj) {
1510 DEBUG(10,("check_owning_objs: ACL had owning user/group entries.\n"));
1511 return;
1512 }
1513
1514 for (i=0, current_ace = ace; i < entries; i++, current_ace = current_ace->next) {
1515 if (!got_user_obj && current_ace->owner_type == UID_ACE &&
1516 sid_equal(&current_ace->trustee, pfile_owner_sid)) {
1517 current_ace->type = SMB_ACL_USER_OBJ;
1518 got_user_obj = True;
1519 }
1520 if (!got_group_obj && current_ace->owner_type == GID_ACE &&
1521 sid_equal(&current_ace->trustee, pfile_grp_sid)) {
1522 current_ace->type = SMB_ACL_GROUP_OBJ;
1523 got_group_obj = True;
1524 }
1525 }
1526 if (!got_user_obj)
1527 DEBUG(10,("check_owning_objs: ACL is missing an owner entry.\n"));
1528 if (!got_group_obj)
1529 DEBUG(10,("check_owning_objs: ACL is missing an owning group entry.\n"));
1530 }
1531
1532 /****************************************************************************
1533 Unpack a SEC_DESC into two canonical ace lists.
1534 ****************************************************************************/
1535
1536 static bool create_canon_ace_lists(files_struct *fsp,
1537 const SMB_STRUCT_STAT *pst,
1538 DOM_SID *pfile_owner_sid,
1539 DOM_SID *pfile_grp_sid,
1540 canon_ace **ppfile_ace,
1541 canon_ace **ppdir_ace,
1542 const SEC_ACL *dacl)
1543 {
1544 bool all_aces_are_inherit_only = (fsp->is_directory ? True : False);
1545 canon_ace *file_ace = NULL;
1546 canon_ace *dir_ace = NULL;
1547 canon_ace *current_ace = NULL;
1548 bool got_dir_allow = False;
1549 bool got_file_allow = False;
1550 int i, j;
1551
1552 *ppfile_ace = NULL;
1553 *ppdir_ace = NULL;
1554
1555 /*
1556 * Convert the incoming ACL into a more regular form.
1557 */
1558
1559 for(i = 0; i < dacl->num_aces; i++) {
1560 SEC_ACE *psa = &dacl->aces[i];
1561
1562 if((psa->type != SEC_ACE_TYPE_ACCESS_ALLOWED) && (psa->type != SEC_ACE_TYPE_ACCESS_DENIED)) {
1563 DEBUG(3,("create_canon_ace_lists: unable to set anything but an ALLOW or DENY ACE.\n"));
1564 return False;
1565 }
1566
1567 if (nt4_compatible_acls()) {
1568 /*
1569 * The security mask may be UNIX_ACCESS_NONE which should map into
1570 * no permissions (we overload the WRITE_OWNER bit for this) or it
1571 * should be one of the ALL/EXECUTE/READ/WRITE bits. Arrange for this
1572 * to be so. Any other bits override the UNIX_ACCESS_NONE bit.
1573 */
1574
1575 /*
1576 * Convert GENERIC bits to specific bits.
1577 */
1578
1579 se_map_generic(&psa->access_mask, &file_generic_mapping);
1580
1581 psa->access_mask &= (UNIX_ACCESS_NONE|FILE_ALL_ACCESS);
1582
1583 if(psa->access_mask != UNIX_ACCESS_NONE)
1584 psa->access_mask &= ~UNIX_ACCESS_NONE;
1585 }
1586 }
1587
1588 /*
1589 * Deal with the fact that NT 4.x re-writes the canonical format
1590 * that we return for default ACLs. If a directory ACE is identical
1591 * to a inherited directory ACE then NT changes the bits so that the
1592 * first ACE is set to OI|IO and the second ACE for this SID is set
1593 * to CI. We need to repair this. JRA.
1594 */
1595
1596 for(i = 0; i < dacl->num_aces; i++) {
1597 SEC_ACE *psa1 = &dacl->aces[i];
1598
1599 for (j = i + 1; j < dacl->num_aces; j++) {
1600 SEC_ACE *psa2 = &dacl->aces[j];
1601
1602 if (psa1->access_mask != psa2->access_mask)
1603 continue;
1604
1605 if (!sid_equal(&psa1->trustee, &psa2->trustee))
1606 continue;
1607
1608 /*
1609 * Ok - permission bits and SIDs are equal.
1610 * Check if flags were re-written.
1611 */
1612
1613 if (psa1->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
1614
1615 psa1->flags |= (psa2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT));
1616 psa2->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT);
1617
1618 } else if (psa2->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
1619
1620 psa2->flags |= (psa1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT));
1621 psa1->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT);
1622
1623 }
1624 }
1625 }
1626
1627 for(i = 0; i < dacl->num_aces; i++) {
1628 SEC_ACE *psa = &dacl->aces[i];
1629
1630 /*
1631 * Create a cannon_ace entry representing this NT DACL ACE.
1632 */
1633
1634 if ((current_ace = SMB_MALLOC_P(canon_ace)) == NULL) {
1635 free_canon_ace_list(file_ace);
1636 free_canon_ace_list(dir_ace);
1637 DEBUG(0,("create_canon_ace_lists: malloc fail.\n"));
1638 return False;
1639 }
1640
1641 ZERO_STRUCTP(current_ace);
1642
1643 sid_copy(&current_ace->trustee, &psa->trustee);
1644
1645 /*
1646 * Try and work out if the SID is a user or group
1647 * as we need to flag these differently for POSIX.
1648 * Note what kind of a POSIX ACL this should map to.
1649 */
1650
1651 if( sid_equal(&current_ace->trustee, &global_sid_World)) {
1652 current_ace->owner_type = WORLD_ACE;
1653 current_ace->unix_ug.world = -1;
1654 current_ace->type = SMB_ACL_OTHER;
1655 } else if (sid_equal(&current_ace->trustee, &global_sid_Creator_Owner)) {
1656 current_ace->owner_type = UID_ACE;
1657 current_ace->unix_ug.uid = pst->st_ex_uid;
1658 current_ace->type = SMB_ACL_USER_OBJ;
1659
1660 /*
1661 * The Creator Owner entry only specifies inheritable permissions,
1662 * never access permissions. WinNT doesn't always set the ACE to
1663 * INHERIT_ONLY, though.
1664 */
1665
1666 psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
1667
1668 } else if (sid_equal(&current_ace->trustee, &global_sid_Creator_Group)) {
1669 current_ace->owner_type = GID_ACE;
1670 current_ace->unix_ug.gid = pst->st_ex_gid;
1671 current_ace->type = SMB_ACL_GROUP_OBJ;
1672
1673 /*
1674 * The Creator Group entry only specifies inheritable permissions,
1675 * never access permissions. WinNT doesn't always set the ACE to
1676 * INHERIT_ONLY, though.
1677 */
1678 psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
1679
1680 } else if (sid_to_uid( &current_ace->trustee, &current_ace->unix_ug.uid)) {
1681 current_ace->owner_type = UID_ACE;
1682 /* If it's the owning user, this is a user_obj, not
1683 * a user. */
1684 if (current_ace->unix_ug.uid == pst->st_ex_uid) {
1685 current_ace->type = SMB_ACL_USER_OBJ;
1686 } else {
1687 current_ace->type = SMB_ACL_USER;
1688 }
1689 } else if (sid_to_gid( &current_ace->trustee, &current_ace->unix_ug.gid)) {
1690 current_ace->owner_type = GID_ACE;
1691 /* If it's the primary group, this is a group_obj, not
1692 * a group. */
1693 if (current_ace->unix_ug.gid == pst->st_ex_gid) {
1694 current_ace->type = SMB_ACL_GROUP_OBJ;
1695 } else {
1696 current_ace->type = SMB_ACL_GROUP;
1697 }
1698 } else {
1699 /*
1700 * Silently ignore map failures in non-mappable SIDs (NT Authority, BUILTIN etc).
1701 */
1702
1703 if (non_mappable_sid(&psa->trustee)) {
1704 DEBUG(10, ("create_canon_ace_lists: ignoring "
1705 "non-mappable SID %s\n",
1706 sid_string_dbg(&psa->trustee)));
1707 SAFE_FREE(current_ace);
1708 continue;
1709 }
1710
1711 if (lp_force_unknown_acl_user(SNUM(fsp->conn))) {
1712 DEBUG(10, ("create_canon_ace_lists: ignoring "
1713 "unknown or foreign SID %s\n",
1714 sid_string_dbg(&psa->trustee)));
1715 SAFE_FREE(current_ace);
1716 continue;
1717 }
1718
1719 free_canon_ace_list(file_ace);
1720 free_canon_ace_list(dir_ace);
1721 DEBUG(0, ("create_canon_ace_lists: unable to map SID "
1722 "%s to uid or gid.\n",
1723 sid_string_dbg(&current_ace->trustee)));
1724 SAFE_FREE(current_ace);
1725 return False;
1726 }
1727
1728 /*
1729 * Map the given NT permissions into a UNIX mode_t containing only
1730 * S_I(R|W|X)USR bits.
1731 */
1732
1733 current_ace->perms |= map_nt_perms( &psa->access_mask, S_IRUSR);
1734 current_ace->attr = (psa->type == SEC_ACE_TYPE_ACCESS_ALLOWED) ? ALLOW_ACE : DENY_ACE;
1735
1736 /* Store the ace_flag. */
1737 current_ace->ace_flags = psa->flags;
1738
1739 /*
1740 * Now add the created ace to either the file list, the directory
1741 * list, or both. We *MUST* preserve the order here (hence we use
1742 * DLIST_ADD_END) as NT ACLs are order dependent.
1743 */
1744
1745 if (fsp->is_directory) {
1746
1747 /*
1748 * We can only add to the default POSIX ACE list if the ACE is
1749 * designed to be inherited by both files and directories.
1750 */
1751
1752 if ((psa->flags & (SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT)) ==
1753 (SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT)) {
1754
1755 canon_ace *current_dir_ace = current_ace;
1756 DLIST_ADD_END(dir_ace, current_ace, canon_ace *);
1757
1758 /*
1759 * Note if this was an allow ace. We can't process
1760 * any further deny ace's after this.
1761 */
1762
1763 if (current_ace->attr == ALLOW_ACE)
1764 got_dir_allow = True;
1765
1766 if ((current_ace->attr == DENY_ACE) && got_dir_allow) {
1767 DEBUG(0,("create_canon_ace_lists: "
1768 "malformed ACL in "
1769 "inheritable ACL! Deny entry "
1770 "after Allow entry. Failing "
1771 "to set on file %s.\n",
1772 fsp_str_dbg(fsp)));
1773 free_canon_ace_list(file_ace);
1774 free_canon_ace_list(dir_ace);
1775 return False;
1776 }
1777
1778 if( DEBUGLVL( 10 )) {
1779 dbgtext("create_canon_ace_lists: adding dir ACL:\n");
1780 print_canon_ace( current_ace, 0);
1781 }
1782
1783 /*
1784 * If this is not an inherit only ACE we need to add a duplicate
1785 * to the file acl.
1786 */
1787
1788 if (!(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
1789 canon_ace *dup_ace = dup_canon_ace(current_ace);
1790
1791 if (!dup_ace) {
1792 DEBUG(0,("create_canon_ace_lists: malloc fail !\n"));
1793 free_canon_ace_list(file_ace);
1794 free_canon_ace_list(dir_ace);
1795 return False;
1796 }
1797
1798 /*
1799 * We must not free current_ace here as its
1800 * pointer is now owned by the dir_ace list.
1801 */
1802 current_ace = dup_ace;
1803 /* We've essentially split this ace into two,
1804 * and added the ace with inheritance request
1805 * bits to the directory ACL. Drop those bits for
1806 * the ACE we're adding to the file list. */
1807 current_ace->ace_flags &= ~(SEC_ACE_FLAG_OBJECT_INHERIT|
1808 SEC_ACE_FLAG_CONTAINER_INHERIT|
1809 SEC_ACE_FLAG_INHERIT_ONLY);
1810 } else {
1811 /*
1812 * We must not free current_ace here as its
1813 * pointer is now owned by the dir_ace list.
1814 */
1815 current_ace = NULL;
1816 }
1817
1818 /*
1819 * current_ace is now either owned by file_ace
1820 * or is NULL. We can safely operate on current_dir_ace
1821 * to treat mapping for default acl entries differently
1822 * than access acl entries.
1823 */
1824
1825 if (current_dir_ace->owner_type == UID_ACE) {
1826 /*
1827 * We already decided above this is a uid,
1828 * for default acls ace's only CREATOR_OWNER
1829 * maps to ACL_USER_OBJ. All other uid
1830 * ace's are ACL_USER.
1831 */
1832 if (sid_equal(&current_dir_ace->trustee,
1833 &global_sid_Creator_Owner)) {
1834 current_dir_ace->type = SMB_ACL_USER_OBJ;
1835 } else {
1836 current_dir_ace->type = SMB_ACL_USER;
1837 }
1838 }
1839
1840 if (current_dir_ace->owner_type == GID_ACE) {
1841 /*
1842 * We already decided above this is a gid,
1843 * for default acls ace's only CREATOR_GROUP
1844 * maps to ACL_GROUP_OBJ. All other uid
1845 * ace's are ACL_GROUP.
1846 */
1847 if (sid_equal(&current_dir_ace->trustee,
1848 &global_sid_Creator_Group)) {
1849 current_dir_ace->type = SMB_ACL_GROUP_OBJ;
1850 } else {
1851 current_dir_ace->type = SMB_ACL_GROUP;
1852 }
1853 }
1854 }
1855 }
1856
1857 /*
1858 * Only add to the file ACL if not inherit only.
1859 */
1860
1861 if (current_ace && !(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
1862 DLIST_ADD_END(file_ace, current_ace, canon_ace *);
1863
1864 /*
1865 * Note if this was an allow ace. We can't process
1866 * any further deny ace's after this.
1867 */
1868
1869 if (current_ace->attr == ALLOW_ACE)
1870 got_file_allow = True;
1871
1872 if ((current_ace->attr == DENY_ACE) && got_file_allow) {
1873 DEBUG(0,("create_canon_ace_lists: malformed "
1874 "ACL in file ACL ! Deny entry after "
1875 "Allow entry. Failing to set on file "
1876 "%s.\n", fsp_str_dbg(fsp)));
1877 free_canon_ace_list(file_ace);
1878 free_canon_ace_list(dir_ace);
1879 return False;
1880 }
1881
1882 if( DEBUGLVL( 10 )) {
1883 dbgtext("create_canon_ace_lists: adding file ACL:\n");
1884 print_canon_ace( current_ace, 0);
1885 }
1886 all_aces_are_inherit_only = False;
1887 /*
1888 * We must not free current_ace here as its
1889 * pointer is now owned by the file_ace list.
1890 */
1891 current_ace = NULL;
1892 }
1893
1894 /*
1895 * Free if ACE was not added.
1896 */
1897
1898 SAFE_FREE(current_ace);
1899 }
1900
1901 if (fsp->is_directory && all_aces_are_inherit_only) {
1902 /*
1903 * Windows 2000 is doing one of these weird 'inherit acl'
1904 * traverses to conserve NTFS ACL resources. Just pretend
1905 * there was no DACL sent. JRA.
1906 */
1907
1908 DEBUG(10,("create_canon_ace_lists: Win2k inherit acl traverse. Ignoring DACL.\n"));
1909 free_canon_ace_list(file_ace);
1910 free_canon_ace_list(dir_ace);
1911 file_ace = NULL;
1912 dir_ace = NULL;
1913 } else {
1914 /*
1915 * Check if we have SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries in
1916 * the file ACL. If we don't have them, check if any SMB_ACL_USER/SMB_ACL_GROUP
1917 * entries can be converted to *_OBJ. Don't do this for the default
1918 * ACL, we will create them separately for this if needed inside
1919 * ensure_canon_entry_valid().
1920 */
1921 if (file_ace) {
1922 check_owning_objs(file_ace, pfile_owner_sid, pfile_grp_sid);
1923 }
1924 }
1925
1926 *ppfile_ace = file_ace;
1927 *ppdir_ace = dir_ace;
1928
1929 return True;
1930 }
1931
1932 /****************************************************************************
1933 ASCII art time again... JRA :-).
1934
1935 We have 4 cases to process when moving from an NT ACL to a POSIX ACL. Firstly,
1936 we insist the ACL is in canonical form (ie. all DENY entries preceede ALLOW
1937 entries). Secondly, the merge code has ensured that all duplicate SID entries for
1938 allow or deny have been merged, so the same SID can only appear once in the deny
1939 list or once in the allow list.
1940
1941 We then process as follows :
1942
1943 ---------------------------------------------------------------------------
1944 First pass - look for a Everyone DENY entry.
1945
1946 If it is deny all (rwx) trunate the list at this point.
1947 Else, walk the list from this point and use the deny permissions of this
1948 entry as a mask on all following allow entries. Finally, delete
1949 the Everyone DENY entry (we have applied it to everything possible).
1950
1951 In addition, in this pass we remove any DENY entries that have
1952 no permissions (ie. they are a DENY nothing).
1953 ---------------------------------------------------------------------------
1954 Second pass - only deal with deny user entries.
1955
1956 DENY user1 (perms XXX)
1957
1958 new_perms = 0
1959 for all following allow group entries where user1 is in group
1960 new_perms |= group_perms;
1961
1962 user1 entry perms = new_perms & ~ XXX;
1963
1964 Convert the deny entry to an allow entry with the new perms and
1965 push to the end of the list. Note if the user was in no groups
1966 this maps to a specific allow nothing entry for this user.
1967
1968 The common case from the NT ACL choser (userX deny all) is
1969 optimised so we don't do the group lookup - we just map to
1970 an allow nothing entry.
1971
1972 What we're doing here is inferring the allow permissions the
1973 person setting the ACE on user1 wanted by looking at the allow
1974 permissions on the groups the user is currently in. This will
1975 be a snapshot, depending on group membership but is the best
1976 we can do and has the advantage of failing closed rather than
1977 open.
1978 ---------------------------------------------------------------------------
1979 Third pass - only deal with deny group entries.
1980
1981 DENY group1 (perms XXX)
1982
1983 for all following allow user entries where user is in group1
1984 user entry perms = user entry perms & ~ XXX;
1985
1986 If there is a group Everyone allow entry with permissions YYY,
1987 convert the group1 entry to an allow entry and modify its
1988 permissions to be :
1989
1990 new_perms = YYY & ~ XXX
1991
1992 and push to the end of the list.
1993
1994 If there is no group Everyone allow entry then convert the
1995 group1 entry to a allow nothing entry and push to the end of the list.
1996
1997 Note that the common case from the NT ACL choser (groupX deny all)
1998 cannot be optimised here as we need to modify user entries who are
1999 in the group to change them to a deny all also.
2000
2001 What we're doing here is modifying the allow permissions of
2002 user entries (which are more specific in POSIX ACLs) to mask
2003 out the explicit deny set on the group they are in. This will
2004 be a snapshot depending on current group membership but is the
2005 best we can do and has the advantage of failing closed rather
2006 than open.
2007 ---------------------------------------------------------------------------
2008 Fourth pass - cope with cumulative permissions.
2009
2010 for all allow user entries, if there exists an allow group entry with
2011 more permissive permissions, and the user is in that group, rewrite the
2012 allow user permissions to contain both sets of permissions.
2013
2014 Currently the code for this is #ifdef'ed out as these semantics make
2015 no sense to me. JRA.
2016 ---------------------------------------------------------------------------
2017
2018 Note we *MUST* do the deny user pass first as this will convert deny user
2019 entries into allow user entries which can then be processed by the deny
2020 group pass.
2021
2022 The above algorithm took a *lot* of thinking about - hence this
2023 explaination :-). JRA.
2024 ****************************************************************************/
2025
2026 /****************************************************************************
2027 Process a canon_ace list entries. This is very complex code. We need
2028 to go through and remove the "deny" permissions from any allow entry that matches
2029 the id of this entry. We have already refused any NT ACL that wasn't in correct
2030 order (DENY followed by ALLOW). If any allow entry ends up with zero permissions,
2031 we just remove it (to fail safe). We have already removed any duplicate ace
2032 entries. Treat an "Everyone" DENY_ACE as a special case - use it to mask all
2033 allow entries.
2034 ****************************************************************************/
2035
2036 static void process_deny_list( canon_ace **pp_ace_list )
2037 {
2038 canon_ace *ace_list = *pp_ace_list;
2039 canon_ace *curr_ace = NULL;
2040 canon_ace *curr_ace_next = NULL;
2041
2042 /* Pass 1 above - look for an Everyone, deny entry. */
2043
2044 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2045 canon_ace *allow_ace_p;
2046
2047 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2048
2049 if (curr_ace->attr != DENY_ACE)
2050 continue;
2051
2052 if (curr_ace->perms == (mode_t)0) {
2053
2054 /* Deny nothing entry - delete. */
2055
2056 DLIST_REMOVE(ace_list, curr_ace);
2057 continue;
2058 }
2059
2060 if (!sid_equal(&curr_ace->trustee, &global_sid_World))
2061 continue;
2062
2063 /* JRATEST - assert. */
2064 SMB_ASSERT(curr_ace->owner_type == WORLD_ACE);
2065
2066 if (curr_ace->perms == ALL_ACE_PERMS) {
2067
2068 /*
2069 * Optimisation. This is a DENY_ALL to Everyone. Truncate the
2070 * list at this point including this entry.
2071 */
2072
2073 canon_ace *prev_entry = curr_ace->prev;
2074
2075 free_canon_ace_list( curr_ace );
2076 if (prev_entry)
2077 prev_entry->next = NULL;
2078 else {
2079 /* We deleted the entire list. */
2080 ace_list = NULL;
2081 }
2082 break;
2083 }
2084
2085 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2086
2087 /*
2088 * Only mask off allow entries.
2089 */
2090
2091 if (allow_ace_p->attr != ALLOW_ACE)
2092 continue;
2093
2094 allow_ace_p->perms &= ~curr_ace->perms;
2095 }
2096
2097 /*
2098 * Now it's been applied, remove it.
2099 */
2100
2101 DLIST_REMOVE(ace_list, curr_ace);
2102 }
2103
2104 /* Pass 2 above - deal with deny user entries. */
2105
2106 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2107 mode_t new_perms = (mode_t)0;
2108 canon_ace *allow_ace_p;
2109
2110 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2111
2112 if (curr_ace->attr != DENY_ACE)
2113 continue;
2114
2115 if (curr_ace->owner_type != UID_ACE)
2116 continue;
2117
2118 if (curr_ace->perms == ALL_ACE_PERMS) {
2119
2120 /*
2121 * Optimisation - this is a deny everything to this user.
2122 * Convert to an allow nothing and push to the end of the list.
2123 */
2124
2125 curr_ace->attr = ALLOW_ACE;
2126 curr_ace->perms = (mode_t)0;
2127 DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2128 continue;
2129 }
2130
2131 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2132
2133 if (allow_ace_p->attr != ALLOW_ACE)
2134 continue;
2135
2136 /* We process GID_ACE and WORLD_ACE entries only. */
2137
2138 if (allow_ace_p->owner_type == UID_ACE)
2139 continue;
2140
2141 if (uid_entry_in_group( curr_ace, allow_ace_p))
2142 new_perms |= allow_ace_p->perms;
2143 }
2144
2145 /*
2146 * Convert to a allow entry, modify the perms and push to the end
2147 * of the list.
2148 */
2149
2150 curr_ace->attr = ALLOW_ACE;
2151 curr_ace->perms = (new_perms & ~curr_ace->perms);
2152 DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2153 }
2154
2155 /* Pass 3 above - deal with deny group entries. */
2156
2157 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2158 canon_ace *allow_ace_p;
2159 canon_ace *allow_everyone_p = NULL;
2160
2161 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2162
2163 if (curr_ace->attr != DENY_ACE)
2164 continue;
2165
2166 if (curr_ace->owner_type != GID_ACE)
2167 continue;
2168
2169 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2170
2171 if (allow_ace_p->attr != ALLOW_ACE)
2172 continue;
2173
2174 /* Store a pointer to the Everyone allow, if it exists. */
2175 if (allow_ace_p->owner_type == WORLD_ACE)
2176 allow_everyone_p = allow_ace_p;
2177
2178 /* We process UID_ACE entries only. */
2179
2180 if (allow_ace_p->owner_type != UID_ACE)
2181 continue;
2182
2183 /* Mask off the deny group perms. */
2184
2185 if (uid_entry_in_group( allow_ace_p, curr_ace))
2186 allow_ace_p->perms &= ~curr_ace->perms;
2187 }
2188
2189 /*
2190 * Convert the deny to an allow with the correct perms and
2191 * push to the end of the list.
2192 */
2193
2194 curr_ace->attr = ALLOW_ACE;
2195 if (allow_everyone_p)
2196 curr_ace->perms = allow_everyone_p->perms & ~curr_ace->perms;
2197 else
2198 curr_ace->perms = (mode_t)0;
2199 DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2200 }
2201
2202 /* Doing this fourth pass allows Windows semantics to be layered
2203 * on top of POSIX semantics. I'm not sure if this is desirable.
2204 * For example, in W2K ACLs there is no way to say, "Group X no
2205 * access, user Y full access" if user Y is a member of group X.
2206 * This seems completely broken semantics to me.... JRA.
2207 */
2208
2209 #if 0
2210 /* Pass 4 above - deal with allow entries. */
2211
2212 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2213 canon_ace *allow_ace_p;
2214
2215 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2216
2217 if (curr_ace->attr != ALLOW_ACE)
2218 continue;
2219
2220 if (curr_ace->owner_type != UID_ACE)
2221 continue;
2222
2223 for (allow_ace_p = ace_list; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2224
2225 if (allow_ace_p->attr != ALLOW_ACE)
2226 continue;
2227
2228 /* We process GID_ACE entries only. */
2229
2230 if (allow_ace_p->owner_type != GID_ACE)
2231 continue;
2232
2233 /* OR in the group perms. */
2234
2235 if (uid_entry_in_group( curr_ace, allow_ace_p))
2236 curr_ace->perms |= allow_ace_p->perms;
2237 }
2238 }
2239 #endif
2240
2241 *pp_ace_list = ace_list;
2242 }
2243
2244 /****************************************************************************
2245 Unpack a SEC_DESC into two canonical ace lists. We don't depend on this
2246 succeeding.
2247 ****************************************************************************/
2248
2249 static bool unpack_canon_ace(files_struct *fsp,
2250 const SMB_STRUCT_STAT *pst,
2251 DOM_SID *pfile_owner_sid,
2252 DOM_SID *pfile_grp_sid,
2253 canon_ace **ppfile_ace,
2254 canon_ace **ppdir_ace,
2255 uint32 security_info_sent,
2256 const SEC_DESC *psd)
2257 {
2258 canon_ace *file_ace = NULL;
2259 canon_ace *dir_ace = NULL;
2260
2261 *ppfile_ace = NULL;
2262 *ppdir_ace = NULL;
2263
2264 if(security_info_sent == 0) {
2265 DEBUG(0,("unpack_canon_ace: no security info sent !\n"));
2266 return False;
2267 }
2268
2269 /*
2270 * If no DACL then this is a chown only security descriptor.
2271 */
2272
2273 if(!(security_info_sent & DACL_SECURITY_INFORMATION) || !psd->dacl)
2274 return True;
2275
2276 /*
2277 * Now go through the DACL and create the canon_ace lists.
2278 */
2279
2280 if (!create_canon_ace_lists( fsp, pst, pfile_owner_sid, pfile_grp_sid,
2281 &file_ace, &dir_ace, psd->dacl))
2282 return False;
2283
2284 if ((file_ace == NULL) && (dir_ace == NULL)) {
2285 /* W2K traverse DACL set - ignore. */
2286 return True;
2287 }
2288
2289 /*
2290 * Go through the canon_ace list and merge entries
2291 * belonging to identical users of identical allow or deny type.
2292 * We can do this as all deny entries come first, followed by
2293 * all allow entries (we have mandated this before accepting this acl).
2294 */
2295
2296 print_canon_ace_list( "file ace - before merge", file_ace);
2297 merge_aces( &file_ace, false);
2298
2299 print_canon_ace_list( "dir ace - before merge", dir_ace);
2300 merge_aces( &dir_ace, true);
2301
2302 /*
2303 * NT ACLs are order dependent. Go through the acl lists and
2304 * process DENY entries by masking the allow entries.
2305 */
2306
2307 print_canon_ace_list( "file ace - before deny", file_ace);
2308 process_deny_list( &file_ace);
2309
2310 print_canon_ace_list( "dir ace - before deny", dir_ace);
2311 process_deny_list( &dir_ace);
2312
2313 /*
2314 * A well formed POSIX file or default ACL has at least 3 entries, a
2315 * SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ
2316 * and optionally a mask entry. Ensure this is the case.
2317 */
2318
2319 print_canon_ace_list( "file ace - before valid", file_ace);
2320
2321 if (!ensure_canon_entry_valid(&file_ace, fsp->conn->params,
2322 fsp->is_directory, pfile_owner_sid, pfile_grp_sid, pst, True)) {
2323 free_canon_ace_list(file_ace);
2324 free_canon_ace_list(dir_ace);
2325 return False;
2326 }
2327
2328 print_canon_ace_list( "dir ace - before valid", dir_ace);
2329
2330 if (dir_ace && !ensure_canon_entry_valid(&dir_ace, fsp->conn->params,
2331 fsp->is_directory, pfile_owner_sid, pfile_grp_sid, pst, True)) {
2332 free_canon_ace_list(file_ace);
2333 free_canon_ace_list(dir_ace);
2334 return False;
2335 }
2336
2337 print_canon_ace_list( "file ace - return", file_ace);
2338 print_canon_ace_list( "dir ace - return", dir_ace);
2339
2340 *ppfile_ace = file_ace;
2341 *ppdir_ace = dir_ace;
2342 return True;
2343
2344 }
2345
2346 /******************************************************************************
2347 When returning permissions, try and fit NT display
2348 semantics if possible. Note the the canon_entries here must have been malloced.
2349 The list format should be - first entry = owner, followed by group and other user
2350 entries, last entry = other.
2351
2352 Note that this doesn't exactly match the NT semantics for an ACL. As POSIX entries
2353 are not ordered, and match on the most specific entry rather than walking a list,
2354 then a simple POSIX permission of rw-r--r-- should really map to 5 entries,
2355
2356 Entry 0: owner : deny all except read and write.
2357 Entry 1: owner : allow read and write.
2358 Entry 2: group : deny all except read.
2359 Entry 3: group : allow read.
2360 Entry 4: Everyone : allow read.
2361
2362 But NT cannot display this in their ACL editor !
2363 ********************************************************************************/
2364
2365 static void arrange_posix_perms(const char *filename, canon_ace **pp_list_head)
2366 {
2367 canon_ace *l_head = *pp_list_head;
2368 canon_ace *owner_ace = NULL;
2369 canon_ace *other_ace = NULL;
2370 canon_ace *ace = NULL;
2371
2372 for (ace = l_head; ace; ace = ace->next) {
2373 if (ace->type == SMB_ACL_USER_OBJ)
2374 owner_ace = ace;
2375 else if (ace->type == SMB_ACL_OTHER) {
2376 /* Last ace - this is "other" */
2377 other_ace = ace;
2378 }
2379 }
2380
2381 if (!owner_ace || !other_ace) {
2382 DEBUG(0,("arrange_posix_perms: Invalid POSIX permissions for file %s, missing owner or other.\n",
2383 filename ));
2384 return;
2385 }
2386
2387 /*
2388 * The POSIX algorithm applies to owner first, and other last,
2389 * so ensure they are arranged in this order.
2390 */
2391
2392 if (owner_ace) {
2393 DLIST_PROMOTE(l_head, owner_ace);
2394 }
2395
2396 if (other_ace) {
2397 DLIST_DEMOTE(l_head, other_ace, canon_ace *);
2398 }
2399
2400 /* We have probably changed the head of the list. */
2401
2402 *pp_list_head = l_head;
2403 }
2404
2405 /****************************************************************************
2406 Create a linked list of canonical ACE entries.
2407 ****************************************************************************/
2408
2409 static canon_ace *canonicalise_acl(struct connection_struct *conn,
2410 const char *fname, SMB_ACL_T posix_acl,
2411 const SMB_STRUCT_STAT *psbuf,
2412 const DOM_SID *powner, const DOM_SID *pgroup, struct pai_val *pal, SMB_ACL_TYPE_T the_acl_type)
2413 {
2414 mode_t acl_mask = (S_IRUSR|S_IWUSR|S_IXUSR);
2415 canon_ace *l_head = NULL;
2416 canon_ace *ace = NULL;
2417 canon_ace *next_ace = NULL;
2418 int entry_id = SMB_ACL_FIRST_ENTRY;
2419 SMB_ACL_ENTRY_T entry;
2420 size_t ace_count;
2421
2422 while ( posix_acl && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1)) {
2423 SMB_ACL_TAG_T tagtype;
2424 SMB_ACL_PERMSET_T permset;
2425 DOM_SID sid;
2426 posix_id unix_ug;
2427 enum ace_owner owner_type;
2428
2429 entry_id = SMB_ACL_NEXT_ENTRY;
2430
2431 /* Is this a MASK entry ? */
2432 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1)
2433 continue;
2434
2435 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1)
2436 continue;
2437
2438 /* Decide which SID to use based on the ACL type. */
2439 switch(tagtype) {
2440 case SMB_ACL_USER_OBJ:
2441 /* Get the SID from the owner. */
2442 sid_copy(&sid, powner);
2443 unix_ug.uid = psbuf->st_ex_uid;
2444 owner_type = UID_ACE;
2445 break;
2446 case SMB_ACL_USER:
2447 {
2448 uid_t *puid = (uid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
2449 if (puid == NULL) {
2450 DEBUG(0,("canonicalise_acl: Failed to get uid.\n"));
2451 continue;
2452 }
2453 uid_to_sid( &sid, *puid);
2454 unix_ug.uid = *puid;
2455 owner_type = UID_ACE;
2456 SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)puid,tagtype);
2457 break;
2458 }
2459 case SMB_ACL_GROUP_OBJ:
2460 /* Get the SID from the owning group. */
2461 sid_copy(&sid, pgroup);
2462 unix_ug.gid = psbuf->st_ex_gid;
2463 owner_type = GID_ACE;
2464 break;
2465 case SMB_ACL_GROUP:
2466 {
2467 gid_t *pgid = (gid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
2468 if (pgid == NULL) {
2469 DEBUG(0,("canonicalise_acl: Failed to get gid.\n"));
2470 continue;
2471 }
2472 gid_to_sid( &sid, *pgid);
2473 unix_ug.gid = *pgid;
2474 owner_type = GID_ACE;
2475 SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)pgid,tagtype);
2476 break;
2477 }
2478 case SMB_ACL_MASK:
2479 acl_mask = convert_permset_to_mode_t(conn, permset);
2480 continue; /* Don't count the mask as an entry. */
2481 case SMB_ACL_OTHER:
2482 /* Use the Everyone SID */
2483 sid = global_sid_World;
2484 unix_ug.world = -1;
2485 owner_type = WORLD_ACE;
2486 break;
2487 default:
2488 DEBUG(0,("canonicalise_acl: Unknown tagtype %u\n", (unsigned int)tagtype));
2489 continue;
2490 }
2491
2492 /*
2493 * Add this entry to the list.
2494 */
2495
2496 if ((ace = SMB_MALLOC_P(canon_ace)) == NULL)
2497 goto fail;
2498
2499 ZERO_STRUCTP(ace);
2500 ace->type = tagtype;
2501 ace->perms = convert_permset_to_mode_t(conn, permset);
2502 ace->attr = ALLOW_ACE;
2503 ace->trustee = sid;
2504 ace->unix_ug = unix_ug;
2505 ace->owner_type = owner_type;
2506 ace->ace_flags = get_pai_flags(pal, ace, (the_acl_type == SMB_ACL_TYPE_DEFAULT));
2507
2508 DLIST_ADD(l_head, ace);
2509 }
2510
2511 /*
2512 * This next call will ensure we have at least a user/group/world set.
2513 */
2514
2515 if (!ensure_canon_entry_valid(&l_head, conn->params,
2516 S_ISDIR(psbuf->st_ex_mode), powner, pgroup,
2517 psbuf, False))
2518 goto fail;
2519
2520 /*
2521 * Now go through the list, masking the permissions with the
2522 * acl_mask. Ensure all DENY Entries are at the start of the list.
2523 */
2524
2525 DEBUG(10,("canonicalise_acl: %s ace entries before arrange :\n", the_acl_type == SMB_ACL_TYPE_ACCESS ? "Access" : "Default" ));
2526
2527 for ( ace_count = 0, ace = l_head; ace; ace = next_ace, ace_count++) {
2528 next_ace = ace->next;
2529
2530 /* Masks are only applied to entries other than USER_OBJ and OTHER. */
2531 if (ace->type != SMB_ACL_OTHER && ace->type != SMB_ACL_USER_OBJ)
2532 ace->perms &= acl_mask;
2533
2534 if (ace->perms == 0) {
2535 DLIST_PROMOTE(l_head, ace);
2536 }
2537
2538 if( DEBUGLVL( 10 ) ) {
2539 print_canon_ace(ace, ace_count);
2540 }
2541 }
2542
2543 arrange_posix_perms(fname,&l_head );
2544
2545 print_canon_ace_list( "canonicalise_acl: ace entries after arrange", l_head );
2546
2547 return l_head;
2548
2549 fail:
2550
2551 free_canon_ace_list(l_head);
2552 return NULL;
2553 }
2554
2555 /****************************************************************************
2556 Check if the current user group list contains a given group.
2557 ****************************************************************************/
2558
2559 bool current_user_in_group(gid_t gid)
2560 {
2561 int i;
2562
2563 for (i = 0; i < current_user.ut.ngroups; i++) {
2564 if (current_user.ut.groups[i] == gid) {
2565 return True;
2566 }
2567 }
2568
2569 return False;
2570 }
2571
2572 /****************************************************************************
2573 Should we override a deny ? Check 'acl group control' and 'dos filemode'.
2574 ****************************************************************************/
2575
2576 static bool acl_group_override(connection_struct *conn,
2577 const struct smb_filename *smb_fname)
2578 {
2579 if ((errno != EPERM) && (errno != EACCES)) {
2580 return false;
2581 }
2582
2583 /* file primary group == user primary or supplementary group */
2584 if (lp_acl_group_control(SNUM(conn)) &&
2585 current_user_in_group(smb_fname->st.st_ex_gid)) {
2586 return true;
2587 }
2588
2589 /* user has writeable permission */
2590 if (lp_dos_filemode(SNUM(conn)) &&
2591 can_write_to_file(conn, smb_fname)) {
2592 return true;
2593 }
2594
2595 return false;
2596 }
2597
2598 /****************************************************************************
2599 Attempt to apply an ACL to a file or directory.
2600 ****************************************************************************/
2601
2602 static bool set_canon_ace_list(files_struct *fsp,
2603 canon_ace *the_ace,
2604 bool default_ace,
2605 const SMB_STRUCT_STAT *psbuf,
2606 bool *pacl_set_support)
2607 {
2608 connection_struct *conn = fsp->conn;
2609 bool ret = False;
2610 SMB_ACL_T the_acl = SMB_VFS_SYS_ACL_INIT(conn, (int)count_canon_ace_list(the_ace) + 1);
2611 canon_ace *p_ace;
2612 int i;
2613 SMB_ACL_ENTRY_T mask_entry;
2614 bool got_mask_entry = False;
2615 SMB_ACL_PERMSET_T mask_permset;
2616 SMB_ACL_TYPE_T the_acl_type = (default_ace ? SMB_ACL_TYPE_DEFAULT : SMB_ACL_TYPE_ACCESS);
2617 bool needs_mask = False;
2618 mode_t mask_perms = 0;
2619
2620 /* Use the psbuf that was passed in. */
2621 if (psbuf != &fsp->fsp_name->st) {
2622 fsp->fsp_name->st = *psbuf;
2623 }
2624
2625 #if defined(POSIX_ACL_NEEDS_MASK)
2626 /* HP-UX always wants to have a mask (called "class" there). */
2627 needs_mask = True;
2628 #endif
2629
2630 if (the_acl == NULL) {
2631
2632 if (!no_acl_syscall_error(errno)) {
2633 /*
2634 * Only print this error message if we have some kind of ACL
2635 * support that's not working. Otherwise we would always get this.
2636 */
2637 DEBUG(0,("set_canon_ace_list: Unable to init %s ACL. (%s)\n",
2638 default_ace ? "default" : "file", strerror(errno) ));
2639 }
2640 *pacl_set_support = False;
2641 goto fail;
2642 }
2643
2644 if( DEBUGLVL( 10 )) {
2645 dbgtext("set_canon_ace_list: setting ACL:\n");
2646 for (i = 0, p_ace = the_ace; p_ace; p_ace = p_ace->next, i++ ) {
2647 print_canon_ace( p_ace, i);
2648 }
2649 }
2650
2651 for (i = 0, p_ace = the_ace; p_ace; p_ace = p_ace->next, i++ ) {
2652 SMB_ACL_ENTRY_T the_entry;
2653 SMB_ACL_PERMSET_T the_permset;
2654
2655 /*
2656 * ACLs only "need" an ACL_MASK entry if there are any named user or
2657 * named group entries. But if there is an ACL_MASK entry, it applies
2658 * to ACL_USER, ACL_GROUP, and ACL_GROUP_OBJ entries. Set the mask
2659 * so that it doesn't deny (i.e., mask off) any permissions.
2660 */
2661
2662 if (p_ace->type == SMB_ACL_USER || p_ace->type == SMB_ACL_GROUP) {
2663 needs_mask = True;
2664 mask_perms |= p_ace->perms;
2665 } else if (p_ace->type == SMB_ACL_GROUP_OBJ) {
2666 mask_perms |= p_ace->perms;
2667 }
2668
2669 /*
2670 * Get the entry for this ACE.
2671 */
2672
2673 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &the_entry) == -1) {
2674 DEBUG(0,("set_canon_ace_list: Failed to create entry %d. (%s)\n",
2675 i, strerror(errno) ));
2676 goto fail;
2677 }
2678
2679 if (p_ace->type == SMB_ACL_MASK) {
2680 mask_entry = the_entry;
2681 got_mask_entry = True;
2682 }
2683
2684 /*
2685 * Ok - we now know the ACL calls should be working, don't
2686 * allow fallback to chmod.
2687 */
2688
2689 *pacl_set_support = True;
2690
2691 /*
2692 * Initialise the entry from the canon_ace.
2693 */
2694
2695 /*
2696 * First tell the entry what type of ACE this is.
2697 */
2698
2699 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, the_entry, p_ace->type) == -1) {
2700 DEBUG(0,("set_canon_ace_list: Failed to set tag type on entry %d. (%s)\n",
2701 i, strerror(errno) ));
2702 goto fail;
2703 }
2704
2705 /*
2706 * Only set the qualifier (user or group id) if the entry is a user
2707 * or group id ACE.
2708 */
2709
2710 if ((p_ace->type == SMB_ACL_USER) || (p_ace->type == SMB_ACL_GROUP)) {
2711 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&p_ace->unix_ug.uid) == -1) {
2712 DEBUG(0,("set_canon_ace_list: Failed to set qualifier on entry %d. (%s)\n",
2713 i, strerror(errno) ));
2714 goto fail;
2715 }
2716 }
2717
2718 /*
2719 * Convert the mode_t perms in the canon_ace to a POSIX permset.
2720 */
2721
2722 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, the_entry, &the_permset) == -1) {
2723 DEBUG(0,("set_canon_ace_list: Failed to get permset on entry %d. (%s)\n",
2724 i, strerror(errno) ));
2725 goto fail;
2726 }
2727
2728 if (map_acl_perms_to_permset(conn, p_ace->perms, &the_permset) == -1) {
2729 DEBUG(0,("set_canon_ace_list: Failed to create permset for mode (%u) on entry %d. (%s)\n",
2730 (unsigned int)p_ace->perms, i, strerror(errno) ));
2731 goto fail;
2732 }
2733
2734 /*
2735 * ..and apply them to the entry.
2736 */
2737
2738 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, the_entry, the_permset) == -1) {
2739 DEBUG(0,("set_canon_ace_list: Failed to add permset on entry %d. (%s)\n",
2740 i, strerror(errno) ));
2741 goto fail;
2742 }
2743
2744 if( DEBUGLVL( 10 ))
2745 print_canon_ace( p_ace, i);
2746
2747 }
2748
2749 if (needs_mask && !got_mask_entry) {
2750 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &mask_entry) == -1) {
2751 DEBUG(0,("set_canon_ace_list: Failed to create mask entry. (%s)\n", strerror(errno) ));
2752 goto fail;
2753 }
2754
2755 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, mask_entry, SMB_ACL_MASK) == -1) {
2756 DEBUG(0,("set_canon_ace_list: Failed to set tag type on mask entry. (%s)\n",strerror(errno) ));
2757 goto fail;
2758 }
2759
2760 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, mask_entry, &mask_permset) == -1) {
2761 DEBUG(0,("set_canon_ace_list: Failed to get mask permset. (%s)\n", strerror(errno) ));
2762 goto fail;
2763 }
2764
2765 if (map_acl_perms_to_permset(conn, S_IRUSR|S_IWUSR|S_IXUSR, &mask_permset) == -1) {
2766 DEBUG(0,("set_canon_ace_list: Failed to create mask permset. (%s)\n", strerror(errno) ));
2767 goto fail;
2768 }
2769
2770 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, mask_entry, mask_permset) == -1) {
2771 DEBUG(0,("set_canon_ace_list: Failed to add mask permset. (%s)\n", strerror(errno) ));
2772 goto fail;
2773 }
2774 }
2775
2776 /*
2777 * Finally apply it to the file or directory.
2778 */
2779
2780 if(default_ace || fsp->is_directory || fsp->fh->fd == -1) {
2781 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fsp->fsp_name->base_name,
2782 the_acl_type, the_acl) == -1) {
2783 /*
2784 * Some systems allow all the above calls and only fail with no ACL support
2785 * when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
2786 */
2787 if (no_acl_syscall_error(errno)) {
2788 *pacl_set_support = False;
2789 }
2790
2791 if (acl_group_override(conn, fsp->fsp_name)) {
2792 int sret;
2793
2794 DEBUG(5,("set_canon_ace_list: acl group "
2795 "control on and current user in file "
2796 "%s primary group.\n",
2797 fsp_str_dbg(fsp)));
2798
2799 become_root();
2800 sret = SMB_VFS_SYS_ACL_SET_FILE(conn,
2801 fsp->fsp_name->base_name, the_acl_type,
2802 the_acl);
2803 unbecome_root();
2804 if (sret == 0) {
2805 ret = True;
2806 }
2807 }
2808
2809 if (ret == False) {
2810 DEBUG(2,("set_canon_ace_list: "
2811 "sys_acl_set_file type %s failed for "
2812 "file %s (%s).\n",
2813 the_acl_type == SMB_ACL_TYPE_DEFAULT ?
2814 "directory default" : "file",
2815 fsp_str_dbg(fsp), strerror(errno)));
2816 goto fail;
2817 }
2818 }
2819 } else {
2820 if (SMB_VFS_SYS_ACL_SET_FD(fsp, the_acl) == -1) {
2821 /*
2822 * Some systems allow all the above calls and only fail with no ACL support
2823 * when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
2824 */
2825 if (no_acl_syscall_error(errno)) {
2826 *pacl_set_support = False;
2827 }
2828
2829 if (acl_group_override(conn, fsp->fsp_name)) {
2830 int sret;
2831
2832 DEBUG(5,("set_canon_ace_list: acl group "
2833 "control on and current user in file "
2834 "%s primary group.\n",
2835 fsp_str_dbg(fsp)));
2836
2837 become_root();
2838 sret = SMB_VFS_SYS_ACL_SET_FD(fsp, the_acl);
2839 unbecome_root();
2840 if (sret == 0) {
2841 ret = True;
2842 }
2843 }
2844
2845 if (ret == False) {
2846 DEBUG(2,("set_canon_ace_list: "
2847 "sys_acl_set_file failed for file %s "
2848 "(%s).\n",
2849 fsp_str_dbg(fsp), strerror(errno)));
2850 goto fail;
2851 }
2852 }
2853 }
2854
2855 ret = True;
2856
2857 fail:
2858
2859 if (the_acl != NULL) {
2860 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
2861 }
2862
2863 return ret;
2864 }
2865
2866 /****************************************************************************
2867 Find a particular canon_ace entry.
2868 ****************************************************************************/
2869
2870 static struct canon_ace *canon_ace_entry_for(struct canon_ace *list, SMB_ACL_TAG_T type, posix_id *id)
2871 {
2872 while (list) {
2873 if (list->type == type && ((type != SMB_ACL_USER && type != SMB_ACL_GROUP) ||
2874 (type == SMB_ACL_USER && id && id->uid == list->unix_ug.uid) ||
2875 (type == SMB_ACL_GROUP && id && id->gid == list->unix_ug.gid)))
2876 break;
2877 list = list->next;
2878 }
2879 return list;
2880 }
2881
2882 /****************************************************************************
2883
2884 ****************************************************************************/
2885
2886 SMB_ACL_T free_empty_sys_acl(connection_struct *conn, SMB_ACL_T the_acl)
2887 {
2888 SMB_ACL_ENTRY_T entry;
2889
2890 if (!the_acl)
2891 return NULL;
2892 if (SMB_VFS_SYS_ACL_GET_ENTRY(conn, the_acl, SMB_ACL_FIRST_ENTRY, &entry) != 1) {
2893 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
2894 return NULL;
2895 }
2896 return the_acl;
2897 }
2898
2899 /****************************************************************************
2900 Convert a canon_ace to a generic 3 element permission - if possible.
2901 ****************************************************************************/
2902
2903 #define MAP_PERM(p,mask,result) (((p) & (mask)) ? (result) : 0 )
2904
2905 static bool convert_canon_ace_to_posix_perms( files_struct *fsp, canon_ace *file_ace_list, mode_t *posix_perms)
2906 {
2907 int snum = SNUM(fsp->conn);
2908 size_t ace_count = count_canon_ace_list(file_ace_list);
2909 canon_ace *ace_p;
2910 canon_ace *owner_ace = NULL;
2911 canon_ace *group_ace = NULL;
2912 canon_ace *other_ace = NULL;
2913 mode_t and_bits;
2914 mode_t or_bits;
2915
2916 if (ace_count != 3) {
2917 DEBUG(3,("convert_canon_ace_to_posix_perms: Too many ACE "
2918 "entries for file %s to convert to posix perms.\n",
2919 fsp_str_dbg(fsp)));
2920 return False;
2921 }
2922
2923 for (ace_p = file_ace_list; ace_p; ace_p = ace_p->next) {
2924 if (ace_p->owner_type == UID_ACE)
2925 owner_ace = ace_p;
2926 else if (ace_p->owner_type == GID_ACE)
2927 group_ace = ace_p;
2928 else if (ace_p->owner_type == WORLD_ACE)
2929 other_ace = ace_p;
2930 }
2931
2932 if (!owner_ace || !group_ace || !other_ace) {
2933 DEBUG(3,("convert_canon_ace_to_posix_perms: Can't get "
2934 "standard entries for file %s.\n", fsp_str_dbg(fsp)));
2935 return False;
2936 }
2937
2938 *posix_perms = (mode_t)0;
2939
2940 *posix_perms |= owner_ace->perms;
2941 *posix_perms |= MAP_PERM(group_ace->perms, S_IRUSR, S_IRGRP);
2942 *posix_perms |= MAP_PERM(group_ace->perms, S_IWUSR, S_IWGRP);
2943 *posix_perms |= MAP_PERM(group_ace->perms, S_IXUSR, S_IXGRP);
2944 *posix_perms |= MAP_PERM(other_ace->perms, S_IRUSR, S_IROTH);
2945 *posix_perms |= MAP_PERM(other_ace->perms, S_IWUSR, S_IWOTH);
2946 *posix_perms |= MAP_PERM(other_ace->perms, S_IXUSR, S_IXOTH);
2947
2948 /* The owner must have at least read access. */
2949
2950 *posix_perms |= S_IRUSR;
2951 if (fsp->is_directory)
2952 *posix_perms |= (S_IWUSR|S_IXUSR);
2953
2954 /* If requested apply the masks. */
2955
2956 /* Get the initial bits to apply. */
2957
2958 if (fsp->is_directory) {
2959 and_bits = lp_dir_security_mask(snum);
2960 or_bits = lp_force_dir_security_mode(snum);
2961 } else {
2962 and_bits = lp_security_mask(snum);
2963 or_bits = lp_force_security_mode(snum);
2964 }
2965
2966 *posix_perms = (((*posix_perms) & and_bits)|or_bits);
2967
2968 DEBUG(10,("convert_canon_ace_to_posix_perms: converted u=%o,g=%o,w=%o "
2969 "to perm=0%o for file %s.\n", (int)owner_ace->perms,
2970 (int)group_ace->perms, (int)other_ace->perms,
2971 (int)*posix_perms, fsp_str_dbg(fsp)));
2972
2973 return True;
2974 }
2975
2976 /****************************************************************************
2977 Incoming NT ACLs on a directory can be split into a default POSIX acl (CI|OI|IO) and
2978 a normal POSIX acl. Win2k needs these split acls re-merging into one ACL
2979 with CI|OI set so it is inherited and also applies to the directory.
2980 Based on code from "Jim McDonough" <jmcd@us.ibm.com>.
2981 ****************************************************************************/
2982
2983 static size_t merge_default_aces( SEC_ACE *nt_ace_list, size_t num_aces)
2984 {
2985 size_t i, j;
2986
2987 for (i = 0; i < num_aces; i++) {
2988 for (j = i+1; j < num_aces; j++) {
2989 uint32 i_flags_ni = (nt_ace_list[i].flags & ~SEC_ACE_FLAG_INHERITED_ACE);
2990 uint32 j_flags_ni = (nt_ace_list[j].flags & ~SEC_ACE_FLAG_INHERITED_ACE);
2991 bool i_inh = (nt_ace_list[i].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False;
2992 bool j_inh = (nt_ace_list[j].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False;
2993
2994 /* We know the lower number ACE's are file entries. */
2995 if ((nt_ace_list[i].type == nt_ace_list[j].type) &&
2996 (nt_ace_list[i].size == nt_ace_list[j].size) &&
2997 (nt_ace_list[i].access_mask == nt_ace_list[j].access_mask) &&
2998 sid_equal(&nt_ace_list[i].trustee, &nt_ace_list[j].trustee) &&
2999 (i_inh == j_inh) &&
3000 (i_flags_ni == 0) &&
3001 (j_flags_ni == (SEC_ACE_FLAG_OBJECT_INHERIT|
3002 SEC_ACE_FLAG_CONTAINER_INHERIT|
3003 SEC_ACE_FLAG_INHERIT_ONLY))) {
3004 /*
3005 * W2K wants to have access allowed zero access ACE's
3006 * at the end of the list. If the mask is zero, merge
3007 * the non-inherited ACE onto the inherited ACE.
3008 */
3009
3010 if (nt_ace_list[i].access_mask == 0) {
3011 nt_ace_list[j].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
3012 (i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0);
3013 if (num_aces - i - 1 > 0)
3014 memmove(&nt_ace_list[i], &nt_ace_list[i+1], (num_aces-i-1) *
3015 sizeof(SEC_ACE));
3016
3017 DEBUG(10,("merge_default_aces: Merging zero access ACE %u onto ACE %u.\n",
3018 (unsigned int)i, (unsigned int)j ));
3019 } else {
3020 /*
3021 * These are identical except for the flags.
3022 * Merge the inherited ACE onto the non-inherited ACE.
3023 */
3024
3025 nt_ace_list[i].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
3026 (i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0);
3027 if (num_aces - j - 1 > 0)
3028 memmove(&nt_ace_list[j], &nt_ace_list[j+1], (num_aces-j-1) *
3029 sizeof(SEC_ACE));
3030
3031 DEBUG(10,("merge_default_aces: Merging ACE %u onto ACE %u.\n",
3032 (unsigned int)j, (unsigned int)i ));
3033 }
3034 num_aces--;
3035 break;
3036 }
3037 }
3038 }
3039
3040 return num_aces;
3041 }
3042
3043 /*
3044 * Add or Replace ACE entry.
3045 * In some cases we need to add a specific ACE for compatibility reasons.
3046 * When doing that we must make sure we are not actually creating a duplicate
3047 * entry. So we need to search whether an ACE entry already exist and eventually
3048 * replacce the access mask, or add a completely new entry if none was found.
3049 *
3050 * This function assumes the array has enough space to add a new entry without
3051 * any reallocation of memory.
3052 */
3053
3054 static void add_or_replace_ace(SEC_ACE *nt_ace_list, size_t *num_aces,
3055 const DOM_SID *sid, enum security_ace_type type,
3056 uint32_t mask, uint8_t flags)
3057 {
3058 int i;
3059
3060 /* first search for a duplicate */
3061 for (i = 0; i < *num_aces; i++) {
3062 if (sid_equal(&nt_ace_list[i].trustee, sid) &&
3063 (nt_ace_list[i].flags == flags)) break;
3064 }
3065
3066 if (i < *num_aces) { /* found */
3067 nt_ace_list[i].type = type;
3068 nt_ace_list[i].access_mask = mask;
3069 DEBUG(10, ("Replacing ACE %d with SID %s and flags %02x\n",
3070 i, sid_string_dbg(sid), flags));
3071 return;
3072 }
3073
3074 /* not found, append it */
3075 init_sec_ace(&nt_ace_list[(*num_aces)++], sid, type, mask, flags);
3076 }
3077
3078
3079 /****************************************************************************
3080 Reply to query a security descriptor from an fsp. If it succeeds it allocates
3081 the space for the return elements and returns the size needed to return the
3082 security descriptor. This should be the only external function needed for
3083 the UNIX style get ACL.
3084 ****************************************************************************/
3085
3086 static NTSTATUS posix_get_nt_acl_common(struct connection_struct *conn,
3087 const char *name,
3088 const SMB_STRUCT_STAT *sbuf,
3089 struct pai_val *pal,
3090 SMB_ACL_T posix_acl,
3091 SMB_ACL_T def_acl,
3092 uint32_t security_info,
3093 SEC_DESC **ppdesc)
3094 {
3095 DOM_SID owner_sid;
3096 DOM_SID group_sid;
3097 size_t sd_size = 0;
3098 SEC_ACL *psa = NULL;
3099 size_t num_acls = 0;
3100 size_t num_def_acls = 0;
3101 size_t num_aces = 0;
3102 canon_ace *file_ace = NULL;
3103 canon_ace *dir_ace = NULL;
3104 SEC_ACE *nt_ace_list = NULL;
3105 size_t num_profile_acls = 0;
3106 DOM_SID orig_owner_sid;
3107 SEC_DESC *psd = NULL;
3108 int i;
3109
3110 /*
3111 * Get the owner, group and world SIDs.
3112 */
3113
3114 create_file_sids(sbuf, &owner_sid, &group_sid);
3115
3116 if (lp_profile_acls(SNUM(conn))) {
3117 /* For WXP SP1 the owner must be administrators. */
3118 sid_copy(&orig_owner_sid, &owner_sid);
3119 sid_copy(&owner_sid, &global_sid_Builtin_Administrators);
3120 sid_copy(&group_sid, &global_sid_Builtin_Users);
3121 num_profile_acls = 3;
3122 }
3123
3124 if ((security_info & DACL_SECURITY_INFORMATION) && !(security_info & PROTECTED_DACL_SECURITY_INFORMATION)) {
3125
3126 /*
3127 * In the optimum case Creator Owner and Creator Group would be used for
3128 * the ACL_USER_OBJ and ACL_GROUP_OBJ entries, respectively, but this
3129 * would lead to usability problems under Windows: The Creator entries
3130 * are only available in browse lists of directories and not for files;
3131 * additionally the identity of the owning group couldn't be determined.
3132 * We therefore use those identities only for Default ACLs.
3133 */
3134
3135 /* Create the canon_ace lists. */
3136 file_ace = canonicalise_acl(conn, name, posix_acl, sbuf,
3137 &owner_sid, &group_sid, pal,
3138 SMB_ACL_TYPE_ACCESS);
3139
3140 /* We must have *some* ACLS. */
3141
3142 if (count_canon_ace_list(file_ace) == 0) {
3143 DEBUG(0,("get_nt_acl : No ACLs on file (%s) !\n", name));
3144 goto done;
3145 }
3146
3147 if (S_ISDIR(sbuf->st_ex_mode) && def_acl) {
3148 dir_ace = canonicalise_acl(conn, name, def_acl,
3149 sbuf,
3150 &global_sid_Creator_Owner,
3151 &global_sid_Creator_Group,
3152 pal, SMB_ACL_TYPE_DEFAULT);
3153 }
3154
3155 /*
3156 * Create the NT ACE list from the canonical ace lists.
3157 */
3158
3159 {
3160 canon_ace *ace;
3161 enum security_ace_type nt_acl_type;
3162
3163 if (nt4_compatible_acls() && dir_ace) {
3164 /*
3165 * NT 4 chokes if an ACL contains an INHERIT_ONLY entry
3166 * but no non-INHERIT_ONLY entry for one SID. So we only
3167 * remove entries from the Access ACL if the
3168 * corresponding Default ACL entries have also been
3169 * removed. ACEs for CREATOR-OWNER and CREATOR-GROUP
3170 * are exceptions. We can do nothing
3171 * intelligent if the Default ACL contains entries that
3172 * are not also contained in the Access ACL, so this
3173 * case will still fail under NT 4.
3174 */
3175
3176 ace = canon_ace_entry_for(dir_ace, SMB_ACL_OTHER, NULL);
3177 if (ace && !ace->perms) {
3178 DLIST_REMOVE(dir_ace, ace);
3179 SAFE_FREE(ace);
3180
3181 ace = canon_ace_entry_for(file_ace, SMB_ACL_OTHER, NULL);
3182 if (ace && !ace->perms) {
3183 DLIST_REMOVE(file_ace, ace);
3184 SAFE_FREE(ace);
3185 }
3186 }
3187
3188 /*
3189 * WinNT doesn't usually have Creator Group
3190 * in browse lists, so we send this entry to
3191 * WinNT even if it contains no relevant
3192 * permissions. Once we can add
3193 * Creator Group to browse lists we can
3194 * re-enable this.
3195 */
3196
3197 #if 0
3198 ace = canon_ace_entry_for(dir_ace, SMB_ACL_GROUP_OBJ, NULL);
3199 if (ace && !ace->perms) {
3200 DLIST_REMOVE(dir_ace, ace);
3201 SAFE_FREE(ace);
3202 }
3203 #endif
3204
3205 ace = canon_ace_entry_for(file_ace, SMB_ACL_GROUP_OBJ, NULL);
3206 if (ace && !ace->perms) {
3207 DLIST_REMOVE(file_ace, ace);
3208 SAFE_FREE(ace);
3209 }
3210 }
3211
3212 num_acls = count_canon_ace_list(file_ace);
3213 num_def_acls = count_canon_ace_list(dir_ace);
3214
3215 /* Allocate the ace list. */
3216 if ((nt_ace_list = SMB_MALLOC_ARRAY(SEC_ACE,num_acls + num_profile_acls + num_def_acls)) == NULL) {
3217 DEBUG(0,("get_nt_acl: Unable to malloc space for nt_ace_list.\n"));
3218 goto done;
3219 }
3220
3221 memset(nt_ace_list, '\0', (num_acls + num_def_acls) * sizeof(SEC_ACE) );
3222
3223 /*
3224 * Create the NT ACE list from the canonical ace lists.
3225 */
3226
3227 for (ace = file_ace; ace != NULL; ace = ace->next) {
3228 uint32_t acc = map_canon_ace_perms(SNUM(conn),
3229 &nt_acl_type,
3230 ace->perms,
3231 S_ISDIR(sbuf->st_ex_mode));
3232 init_sec_ace(&nt_ace_list[num_aces++],
3233 &ace->trustee,
3234 nt_acl_type,
3235 acc,
3236 ace->ace_flags);
3237 }
3238
3239 /* The User must have access to a profile share - even
3240 * if we can't map the SID. */
3241 if (lp_profile_acls(SNUM(conn))) {
3242 add_or_replace_ace(nt_ace_list, &num_aces,
3243 &global_sid_Builtin_Users,
3244 SEC_ACE_TYPE_ACCESS_ALLOWED,
3245 FILE_GENERIC_ALL, 0);
3246 }
3247
3248 for (ace = dir_ace; ace != NULL; ace = ace->next) {
3249 uint32_t acc = map_canon_ace_perms(SNUM(conn),
3250 &nt_acl_type,
3251 ace->perms,
3252 S_ISDIR(sbuf->st_ex_mode));
3253 init_sec_ace(&nt_ace_list[num_aces++],
3254 &ace->trustee,
3255 nt_acl_type,
3256 acc,
3257 ace->ace_flags |
3258 SEC_ACE_FLAG_OBJECT_INHERIT|
3259 SEC_ACE_FLAG_CONTAINER_INHERIT|
3260 SEC_ACE_FLAG_INHERIT_ONLY);
3261 }
3262
3263 /* The User must have access to a profile share - even
3264 * if we can't map the SID. */
3265 if (lp_profile_acls(SNUM(conn))) {
3266 add_or_replace_ace(nt_ace_list, &num_aces,
3267 &global_sid_Builtin_Users,
3268 SEC_ACE_TYPE_ACCESS_ALLOWED,
3269 FILE_GENERIC_ALL,
3270 SEC_ACE_FLAG_OBJECT_INHERIT |
3271 SEC_ACE_FLAG_CONTAINER_INHERIT |
3272 SEC_ACE_FLAG_INHERIT_ONLY);
3273 }
3274
3275 /*
3276 * Merge POSIX default ACLs and normal ACLs into one NT ACE.
3277 * Win2K needs this to get the inheritance correct when replacing ACLs
3278 * on a directory tree. Based on work by Jim @ IBM.
3279 */
3280
3281 num_aces = merge_default_aces(nt_ace_list, num_aces);
3282
3283 if (lp_profile_acls(SNUM(conn))) {
3284 for (i = 0; i < num_aces; i++) {
3285 if (sid_equal(&nt_ace_list[i].trustee, &owner_sid)) {
3286 add_or_replace_ace(nt_ace_list, &num_aces,
3287 &orig_owner_sid,
3288 nt_ace_list[i].type,
3289 nt_ace_list[i].access_mask,
3290 nt_ace_list[i].flags);
3291 break;
3292 }
3293 }
3294 }
3295 }
3296
3297 if (num_aces) {
3298 if((psa = make_sec_acl( talloc_tos(), NT4_ACL_REVISION, num_aces, nt_ace_list)) == NULL) {
3299 DEBUG(0,("get_nt_acl: Unable to malloc space for acl.\n"));
3300 goto done;
3301 }
3302 }
3303 } /* security_info & DACL_SECURITY_INFORMATION */
3304
3305 psd = make_standard_sec_desc( talloc_tos(),
3306 (security_info & OWNER_SECURITY_INFORMATION) ? &owner_sid : NULL,
3307 (security_info & GROUP_SECURITY_INFORMATION) ? &group_sid : NULL,
3308 psa,
3309 &sd_size);
3310
3311 if(!psd) {
3312 DEBUG(0,("get_nt_acl: Unable to malloc space for security descriptor.\n"));
3313 sd_size = 0;
3314 goto done;
3315 }
3316
3317 /*
3318 * Windows 2000: The DACL_PROTECTED flag in the security
3319 * descriptor marks the ACL as non-inheriting, i.e., no
3320 * ACEs from higher level directories propagate to this
3321 * ACL. In the POSIX ACL model permissions are only
3322 * inherited at file create time, so ACLs never contain
3323 * any ACEs that are inherited dynamically. The DACL_PROTECTED
3324 * flag doesn't seem to bother Windows NT.
3325 * Always set this if map acl inherit is turned off.
3326 */
3327 if (pal == NULL || !lp_map_acl_inherit(SNUM(conn))) {
3328 psd->type |= SEC_DESC_DACL_PROTECTED;
3329 } else {
3330 psd->type |= pal->sd_type;
3331 }
3332
3333 if (psd->dacl) {
3334 dacl_sort_into_canonical_order(psd->dacl->aces, (unsigned int)psd->dacl->num_aces);
3335 }
3336
3337 *ppdesc = psd;
3338
3339 done:
3340
3341 if (posix_acl) {
3342 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
3343 }
3344 if (def_acl) {
3345 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
3346 }
3347 free_canon_ace_list(file_ace);
3348 free_canon_ace_list(dir_ace);
3349 free_inherited_info(pal);
3350 SAFE_FREE(nt_ace_list);
3351
3352 return NT_STATUS_OK;
3353 }
3354
3355 NTSTATUS posix_fget_nt_acl(struct files_struct *fsp, uint32_t security_info,
3356 SEC_DESC **ppdesc)
3357 {
3358 SMB_STRUCT_STAT sbuf;
3359 SMB_ACL_T posix_acl = NULL;
3360 struct pai_val *pal;
3361
3362 *ppdesc = NULL;
3363
3364 DEBUG(10,("posix_fget_nt_acl: called for file %s\n",
3365 fsp_str_dbg(fsp)));
3366
3367 /* can it happen that fsp_name == NULL ? */
3368 if (fsp->is_directory || fsp->fh->fd == -1) {
3369 return posix_get_nt_acl(fsp->conn, fsp->fsp_name->base_name,
3370 security_info, ppdesc);
3371 }
3372
3373 /* Get the stat struct for the owner info. */
3374 if(SMB_VFS_FSTAT(fsp, &sbuf) != 0) {
3375 return map_nt_error_from_unix(errno);
3376 }
3377
3378 /* Get the ACL from the fd. */
3379 posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp);
3380
3381 pal = fload_inherited_info(fsp);
3382
3383 return posix_get_nt_acl_common(fsp->conn, fsp->fsp_name->base_name,
3384 &sbuf, pal, posix_acl, NULL,
3385 security_info, ppdesc);
3386 }
3387
3388 NTSTATUS posix_get_nt_acl(struct connection_struct *conn, const char *name,
3389 uint32_t security_info, SEC_DESC **ppdesc)
3390 {
3391 SMB_ACL_T posix_acl = NULL;
3392 SMB_ACL_T def_acl = NULL;
3393 struct pai_val *pal;
3394 struct smb_filename smb_fname;
3395 int ret;
3396
3397 *ppdesc = NULL;
3398
3399 DEBUG(10,("posix_get_nt_acl: called for file %s\n", name ));
3400
3401 ZERO_STRUCT(smb_fname);
3402 smb_fname.base_name = discard_const_p(char, name);
3403
3404 /* Get the stat struct for the owner info. */
3405 if (lp_posix_pathnames()) {
3406 ret = SMB_VFS_LSTAT(conn, &smb_fname);
3407 } else {
3408 ret = SMB_VFS_STAT(conn, &smb_fname);
3409 }
3410
3411 if (ret == -1) {
3412 return map_nt_error_from_unix(errno);
3413 }
3414
3415 /* Get the ACL from the path. */
3416 posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name, SMB_ACL_TYPE_ACCESS);
3417
3418 /* If it's a directory get the default POSIX ACL. */
3419 if(S_ISDIR(smb_fname.st.st_ex_mode)) {
3420 def_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name, SMB_ACL_TYPE_DEFAULT);
3421 def_acl = free_empty_sys_acl(conn, def_acl);
3422 }
3423
3424 pal = load_inherited_info(conn, name);
3425
3426 return posix_get_nt_acl_common(conn, name, &smb_fname.st, pal,
3427 posix_acl, def_acl, security_info,
3428 ppdesc);
3429 }
3430
3431 /****************************************************************************
3432 Try to chown a file. We will be able to chown it under the following conditions.
3433
3434 1) If we have root privileges, then it will just work.
3435 2) If we have SeTakeOwnershipPrivilege we can change the user to the current user.
3436 3) If we have SeRestorePrivilege we can change the user to any other user.
3437 4) If we have write permission to the file and dos_filemodes is set
3438 then allow chown to the currently authenticated user.
3439 ****************************************************************************/
3440
3441 int try_chown(connection_struct *conn, struct smb_filename *smb_fname,
3442 uid_t uid, gid_t gid)
3443 {
3444 int ret;
3445 files_struct *fsp;
3446
3447 if(!CAN_WRITE(conn)) {
3448 return -1;
3449 }
3450
3451 /* Case (1). */
3452 /* try the direct way first */
3453 if (lp_posix_pathnames()) {
3454 ret = SMB_VFS_LCHOWN(conn, smb_fname->base_name, uid, gid);
3455 } else {
3456 ret = SMB_VFS_CHOWN(conn, smb_fname->base_name, uid, gid);
3457 }
3458
3459 if (ret == 0)
3460 return 0;
3461
3462 /* Case (2) / (3) */
3463 if (lp_enable_privileges()) {
3464
3465 bool has_take_ownership_priv = user_has_privileges(current_user.nt_user_token,
3466 &se_take_ownership);
3467 bool has_restore_priv = user_has_privileges(current_user.nt_user_token,
3468 &se_restore);
3469
3470 /* Case (2) */
3471 if ( ( has_take_ownership_priv && ( uid == current_user.ut.uid ) ) ||
3472 /* Case (3) */
3473 ( has_restore_priv ) ) {
3474
3475 become_root();
3476 /* Keep the current file gid the same - take ownership doesn't imply group change. */
3477 if (lp_posix_pathnames()) {
3478 ret = SMB_VFS_LCHOWN(conn, smb_fname->base_name, uid,
3479 (gid_t)-1);
3480 } else {
3481 ret = SMB_VFS_CHOWN(conn, smb_fname->base_name, uid,
3482 (gid_t)-1);
3483 }
3484 unbecome_root();
3485 return ret;
3486 }
3487 }
3488
3489 /* Case (4). */
3490 if (!lp_dos_filemode(SNUM(conn))) {
3491 errno = EPERM;
3492 return -1;
3493 }
3494
3495 /* only allow chown to the current user. This is more secure,
3496 and also copes with the case where the SID in a take ownership ACL is
3497 a local SID on the users workstation
3498 */
3499 if (uid != current_user.ut.uid) {
3500 errno = EPERM;
3501 return -1;
3502 }
3503
3504 if (lp_posix_pathnames()) {
3505 ret = SMB_VFS_LSTAT(conn, smb_fname);
3506 } else {
3507 ret = SMB_VFS_STAT(conn, smb_fname);
3508 }
3509
3510 if (ret == -1) {
3511 return -1;
3512 }
3513
3514 if (!NT_STATUS_IS_OK(open_file_fchmod(conn, smb_fname, &fsp))) {
3515 return -1;
3516 }
3517
3518 become_root();
3519 /* Keep the current file gid the same. */
3520 if (fsp->fh->fd == -1) {
3521 if (lp_posix_pathnames()) {
3522 ret = SMB_VFS_LCHOWN(conn, smb_fname->base_name, uid,
3523 (gid_t)-1);
3524 } else {
3525 ret = SMB_VFS_CHOWN(conn, smb_fname->base_name, uid,
3526 (gid_t)-1);
3527 }
3528 } else {
3529 ret = SMB_VFS_FCHOWN(fsp, uid, (gid_t)-1);
3530 }
3531 unbecome_root();
3532
3533 close_file(NULL, fsp, NORMAL_CLOSE);
3534
3535 return ret;
3536 }
3537
3538 #if 0
3539 /* Disable this - prevents ACL inheritance from the ACL editor. JRA. */
3540
3541 /****************************************************************************
3542 Take care of parent ACL inheritance.
3543 ****************************************************************************/
3544
3545 NTSTATUS append_parent_acl(files_struct *fsp,
3546 const SEC_DESC *pcsd,
3547 SEC_DESC **pp_new_sd)
3548 {
3549 struct smb_filename *smb_dname = NULL;
3550 SEC_DESC *parent_sd = NULL;
3551 files_struct *parent_fsp = NULL;
3552 TALLOC_CTX *mem_ctx = talloc_tos();
3553 char *parent_name = NULL;
3554 SEC_ACE *new_ace = NULL;
3555 unsigned int num_aces = pcsd->dacl->num_aces;
3556 NTSTATUS status;
3557 int info;
3558 unsigned int i, j;
3559 SEC_DESC *psd = dup_sec_desc(talloc_tos(), pcsd);
3560 bool is_dacl_protected = (pcsd->type & SEC_DESC_DACL_PROTECTED);
3561
3562 if (psd == NULL) {
3563 return NT_STATUS_NO_MEMORY;
3564 }
3565
3566 if (!parent_dirname(mem_ctx, fsp->fsp_name->base_name, &parent_name,
3567 NULL)) {
3568 return NT_STATUS_NO_MEMORY;
3569 }
3570
3571 status = create_synthetic_smb_fname(mem_ctx, parent_name, NULL, NULL,
3572 &smb_dname);
3573 if (!NT_STATUS_IS_OK(status)) {
3574 goto fail;
3575 }
3576
3577 status = SMB_VFS_CREATE_FILE(
3578 fsp->conn, /* conn */
3579 NULL, /* req */
3580 0, /* root_dir_fid */
3581 smb_dname, /* fname */
3582 FILE_READ_ATTRIBUTES, /* access_mask */
3583 FILE_SHARE_NONE, /* share_access */
3584 FILE_OPEN, /* create_disposition*/
3585 FILE_DIRECTORY_FILE, /* create_options */
3586 0, /* file_attributes */
3587 INTERNAL_OPEN_ONLY, /* oplock_request */
3588 0, /* allocation_size */
3589 NULL, /* sd */
3590 NULL, /* ea_list */
3591 &parent_fsp, /* result */
3592 &info); /* pinfo */
3593
3594 if (!NT_STATUS_IS_OK(status)) {
3595 TALLOC_FREE(smb_dname);
3596 return status;
3597 }
3598
3599 status = SMB_VFS_GET_NT_ACL(parent_fsp->conn, smb_dname->base_name,
3600 DACL_SECURITY_INFORMATION, &parent_sd );
3601
3602 close_file(NULL, parent_fsp, NORMAL_CLOSE);
3603 TALLOC_FREE(smb_dname);
3604
3605 if (!NT_STATUS_IS_OK(status)) {
3606 return status;
3607 }
3608
3609 /*
3610 * Make room for potentially all the ACLs from
3611 * the parent. We used to add the ugw triple here,
3612 * as we knew we were dealing with POSIX ACLs.
3613 * We no longer need to do so as we can guarentee
3614 * that a default ACL from the parent directory will
3615 * be well formed for POSIX ACLs if it came from a
3616 * POSIX ACL source, and if we're not writing to a
3617 * POSIX ACL sink then we don't care if it's not well
3618 * formed. JRA.
3619 */
3620
3621 num_aces += parent_sd->dacl->num_aces;
3622
3623 if((new_ace = TALLOC_ZERO_ARRAY(mem_ctx, SEC_ACE,
3624 num_aces)) == NULL) {
3625 return NT_STATUS_NO_MEMORY;
3626 }
3627
3628 /* Start by copying in all the given ACE entries. */
3629 for (i = 0; i < psd->dacl->num_aces; i++) {
3630 sec_ace_copy(&new_ace[i], &psd->dacl->aces[i]);
3631 }
3632
3633 /*
3634 * Note that we're ignoring "inherit permissions" here
3635 * as that really only applies to newly created files. JRA.
3636 */
3637
3638 /* Finally append any inherited ACEs. */
3639 for (j = 0; j < parent_sd->dacl->num_aces; j++) {
3640 SEC_ACE *se = &parent_sd->dacl->aces[j];
3641
3642 if (fsp->is_directory) {
3643 if (!(se->flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
3644 /* Doesn't apply to a directory - ignore. */
3645 DEBUG(10,("append_parent_acl: directory %s "
3646 "ignoring non container "
3647 "inherit flags %u on ACE with sid %s "
3648 "from parent %s\n",
3649 fsp_str_dbg(fsp),
3650 (unsigned int)se->flags,
3651 sid_string_dbg(&se->trustee),
3652 parent_name));
3653 continue;
3654 }
3655 } else {
3656 if (!(se->flags & SEC_ACE_FLAG_OBJECT_INHERIT)) {
3657 /* Doesn't apply to a file - ignore. */
3658 DEBUG(10,("append_parent_acl: file %s "
3659 "ignoring non object "
3660 "inherit flags %u on ACE with sid %s "
3661 "from parent %s\n",
3662 fsp_str_dbg(fsp),
3663 (unsigned int)se->flags,
3664 sid_string_dbg(&se->trustee),
3665 parent_name));
3666 continue;
3667 }
3668 }
3669
3670 if (is_dacl_protected) {
3671 /* If the DACL is protected it means we must
3672 * not overwrite an existing ACE entry with the
3673 * same SID. This is order N^2. Ouch :-(. JRA. */
3674 unsigned int k;
3675 for (k = 0; k < psd->dacl->num_aces; k++) {
3676 if (sid_equal(&psd->dacl->aces[k].trustee,
3677 &se->trustee)) {
3678 break;
3679 }
3680 }
3681 if (k < psd->dacl->num_aces) {
3682 /* SID matched. Ignore. */
3683 DEBUG(10,("append_parent_acl: path %s "
3684 "ignoring ACE with protected sid %s "
3685 "from parent %s\n",
3686 fsp_str_dbg(fsp),
3687 sid_string_dbg(&se->trustee),
3688 parent_name));
3689 continue;
3690 }
3691 }
3692
3693 sec_ace_copy(&new_ace[i], se);
3694 if (se->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
3695 new_ace[i].flags &= ~(SEC_ACE_FLAG_VALID_INHERIT);
3696 }
3697 new_ace[i].flags |= SEC_ACE_FLAG_INHERITED_ACE;
3698
3699 if (fsp->is_directory) {
3700 /*
3701 * Strip off any inherit only. It's applied.
3702 */
3703 new_ace[i].flags &= ~(SEC_ACE_FLAG_INHERIT_ONLY);
3704 if (se->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
3705 /* No further inheritance. */
3706 new_ace[i].flags &=
3707 ~(SEC_ACE_FLAG_CONTAINER_INHERIT|
3708 SEC_ACE_FLAG_OBJECT_INHERIT);
3709 }
3710 } else {
3711 /*
3712 * Strip off any container or inherit
3713 * flags, they can't apply to objects.
3714 */
3715 new_ace[i].flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|
3716 SEC_ACE_FLAG_INHERIT_ONLY|
3717 SEC_ACE_FLAG_NO_PROPAGATE_INHERIT);
3718 }
3719 i++;
3720
3721 DEBUG(10,("append_parent_acl: path %s "
3722 "inheriting ACE with sid %s "
3723 "from parent %s\n",
3724 fsp_str_dbg(fsp),
3725 sid_string_dbg(&se->trustee),
3726 parent_name));
3727 }
3728
3729 psd->dacl->aces = new_ace;
3730 psd->dacl->num_aces = i;
3731 psd->type &= ~(SE_DESC_DACL_AUTO_INHERITED|
3732 SE_DESC_DACL_AUTO_INHERIT_REQ);
3733
3734 *pp_new_sd = psd;
3735 return status;
3736 }
3737 #endif
3738
3739 /****************************************************************************
3740 Reply to set a security descriptor on an fsp. security_info_sent is the
3741 description of the following NT ACL.
3742 This should be the only external function needed for the UNIX style set ACL.
3743 ****************************************************************************/
3744
3745 NTSTATUS set_nt_acl(files_struct *fsp, uint32 security_info_sent, const SEC_DESC *psd_orig)
3746 {
3747 connection_struct *conn = fsp->conn;
3748 uid_t user = (uid_t)-1;
3749 gid_t grp = (gid_t)-1;
3750 DOM_SID file_owner_sid;
3751 DOM_SID file_grp_sid;
3752 canon_ace *file_ace_list = NULL;
3753 canon_ace *dir_ace_list = NULL;
3754 bool acl_perms = False;
3755 mode_t orig_mode = (mode_t)0;
3756 NTSTATUS status;
3757 bool set_acl_as_root = false;
3758 bool acl_set_support = false;
3759 bool ret = false;
3760 SEC_DESC *psd = NULL;
3761
3762 DEBUG(10,("set_nt_acl: called for file %s\n",
3763 fsp_str_dbg(fsp)));
3764
3765 if (!CAN_WRITE(conn)) {
3766 DEBUG(10,("set acl rejected on read-only share\n"));
3767 return NT_STATUS_MEDIA_WRITE_PROTECTED;
3768 }
3769
3770 if (!psd_orig) {
3771 return NT_STATUS_INVALID_PARAMETER;
3772 }
3773
3774 psd = dup_sec_desc(talloc_tos(), psd_orig);
3775 if (!psd) {
3776 return NT_STATUS_NO_MEMORY;
3777 }
3778
3779 /*
3780 * Get the current state of the file.
3781 */
3782
3783 status = vfs_stat_fsp(fsp);
3784 if (!NT_STATUS_IS_OK(status)) {
3785 return status;
3786 }
3787
3788 /* Save the original element we check against. */
3789 orig_mode = fsp->fsp_name->st.st_ex_mode;
3790
3791 /*
3792 * Unpack the user/group/world id's.
3793 */
3794
3795 /* POSIX can't cope with missing owner/group. */
3796 if ((security_info_sent & SECINFO_OWNER) && (psd->owner_sid == NULL)) {
3797 security_info_sent &= ~SECINFO_OWNER;
3798 }
3799 if ((security_info_sent & SECINFO_GROUP) && (psd->group_sid == NULL)) {
3800 security_info_sent &= ~SECINFO_GROUP;
3801 }
3802
3803 status = unpack_nt_owners( SNUM(conn), &user, &grp, security_info_sent, psd);
3804 if (!NT_STATUS_IS_OK(status)) {
3805 return status;
3806 }
3807
3808 /*
3809 * Do we need to chown ? If so this must be done first as the incoming
3810 * CREATOR_OWNER acl will be relative to the *new* owner, not the old.
3811 * Noticed by Simo.
3812 */
3813
3814 if (((user != (uid_t)-1) && (fsp->fsp_name->st.st_ex_uid != user)) ||
3815 (( grp != (gid_t)-1) && (fsp->fsp_name->st.st_ex_gid != grp))) {
3816
3817 DEBUG(3,("set_nt_acl: chown %s. uid = %u, gid = %u.\n",
3818 fsp_str_dbg(fsp), (unsigned int)user,
3819 (unsigned int)grp));
3820
3821 if(try_chown(fsp->conn, fsp->fsp_name, user, grp) == -1) {
3822 DEBUG(3,("set_nt_acl: chown %s, %u, %u failed. Error "
3823 "= %s.\n", fsp_str_dbg(fsp),
3824 (unsigned int)user, (unsigned int)grp,
3825 strerror(errno)));
3826 if (errno == EPERM) {
3827 return NT_STATUS_INVALID_OWNER;
3828 }
3829 return map_nt_error_from_unix(errno);
3830 }
3831
3832 /*
3833 * Recheck the current state of the file, which may have changed.
3834 * (suid/sgid bits, for instance)
3835 */
3836
3837 status = vfs_stat_fsp(fsp);
3838 if (!NT_STATUS_IS_OK(status)) {
3839 return status;
3840 }
3841
3842 /* Save the original element we check against. */
3843 orig_mode = fsp->fsp_name->st.st_ex_mode;
3844
3845 /* If we successfully chowned, we know we must
3846 * be able to set the acl, so do it as root.
3847 */
3848 set_acl_as_root = true;
3849 }
3850
3851 create_file_sids(&fsp->fsp_name->st, &file_owner_sid, &file_grp_sid);
3852
3853 if((security_info_sent & SECINFO_DACL) &&
3854 (psd->type & SEC_DESC_DACL_PRESENT) &&
3855 (psd->dacl == NULL)) {
3856 SEC_ACE ace[3];
3857
3858 /* We can't have NULL DACL in POSIX.
3859 Use owner/group/Everyone -> full access. */
3860
3861 init_sec_ace(&ace[0],
3862 &file_owner_sid,
3863 SEC_ACE_TYPE_ACCESS_ALLOWED,
3864 GENERIC_ALL_ACCESS,
3865 0);
3866 init_sec_ace(&ace[1],
3867 &file_grp_sid,
3868 SEC_ACE_TYPE_ACCESS_ALLOWED,
3869 GENERIC_ALL_ACCESS,
3870 0);
3871 init_sec_ace(&ace[2],
3872 &global_sid_World,
3873 SEC_ACE_TYPE_ACCESS_ALLOWED,
3874 GENERIC_ALL_ACCESS,
3875 0);
3876 psd->dacl = make_sec_acl(talloc_tos(),
3877 NT4_ACL_REVISION,
3878 3,
3879 ace);
3880 if (psd->dacl == NULL) {
3881 return NT_STATUS_NO_MEMORY;
3882 }
3883 security_acl_map_generic(psd->dacl, &file_generic_mapping);
3884 }
3885
3886 acl_perms = unpack_canon_ace(fsp, &fsp->fsp_name->st, &file_owner_sid,
3887 &file_grp_sid, &file_ace_list,
3888 &dir_ace_list, security_info_sent, psd);
3889
3890 /* Ignore W2K traverse DACL set. */
3891 if (!file_ace_list && !dir_ace_list) {
3892 return NT_STATUS_OK;
3893 }
3894
3895 if (!acl_perms) {
3896 DEBUG(3,("set_nt_acl: cannot set permissions\n"));
3897 free_canon_ace_list(file_ace_list);
3898 free_canon_ace_list(dir_ace_list);
3899 return NT_STATUS_ACCESS_DENIED;
3900 }
3901
3902 /*
3903 * Only change security if we got a DACL.
3904 */
3905
3906 if(!(security_info_sent & DACL_SECURITY_INFORMATION) || (psd->dacl == NULL)) {
3907 free_canon_ace_list(file_ace_list);
3908 free_canon_ace_list(dir_ace_list);
3909 return NT_STATUS_OK;
3910 }
3911
3912 /*
3913 * Try using the POSIX ACL set first. Fall back to chmod if
3914 * we have no ACL support on this filesystem.
3915 */
3916
3917 if (acl_perms && file_ace_list) {
3918 if (set_acl_as_root) {
3919 become_root();
3920 }
3921 ret = set_canon_ace_list(fsp, file_ace_list, false,
3922 &fsp->fsp_name->st, &acl_set_support);
3923 if (set_acl_as_root) {
3924 unbecome_root();
3925 }
3926 if (acl_set_support && ret == false) {
3927 DEBUG(3,("set_nt_acl: failed to set file acl on file "
3928 "%s (%s).\n", fsp_str_dbg(fsp),
3929 strerror(errno)));
3930 free_canon_ace_list(file_ace_list);
3931 free_canon_ace_list(dir_ace_list);
3932 return map_nt_error_from_unix(errno);
3933 }
3934 }
3935
3936 if (acl_perms && acl_set_support && fsp->is_directory) {
3937 if (dir_ace_list) {
3938 if (set_acl_as_root) {
3939 become_root();
3940 }
3941 ret = set_canon_ace_list(fsp, dir_ace_list, true,
3942 &fsp->fsp_name->st,
3943 &acl_set_support);
3944 if (set_acl_as_root) {
3945 unbecome_root();
3946 }
3947 if (ret == false) {
3948 DEBUG(3,("set_nt_acl: failed to set default "
3949 "acl on directory %s (%s).\n",
3950 fsp_str_dbg(fsp), strerror(errno)));
3951 free_canon_ace_list(file_ace_list);
3952 free_canon_ace_list(dir_ace_list);
3953 return map_nt_error_from_unix(errno);
3954 }
3955 } else {
3956 int sret = -1;
3957
3958 /*
3959 * No default ACL - delete one if it exists.
3960 */
3961
3962 if (set_acl_as_root) {
3963 become_root();
3964 }
3965 sret = SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn,
3966 fsp->fsp_name->base_name);
3967 if (set_acl_as_root) {
3968 unbecome_root();
3969 }
3970 if (sret == -1) {
3971 if (acl_group_override(conn, fsp->fsp_name)) {
3972 DEBUG(5,("set_nt_acl: acl group "
3973 "control on and current user "
3974 "in file %s primary group. "
3975 "Override delete_def_acl\n",
3976 fsp_str_dbg(fsp)));
3977
3978 become_root();
3979 sret =
3980 SMB_VFS_SYS_ACL_DELETE_DEF_FILE(
3981 conn,
3982 fsp->fsp_name->base_name);
3983 unbecome_root();
3984 }
3985
3986 if (sret == -1) {
3987 DEBUG(3,("set_nt_acl: sys_acl_delete_def_file failed (%s)\n", strerror(errno)));
3988 free_canon_ace_list(file_ace_list);
3989 free_canon_ace_list(dir_ace_list);
3990 return map_nt_error_from_unix(errno);
3991 }
3992 }
3993 }
3994 }
3995
3996 if (acl_set_support) {
3997 if (set_acl_as_root) {
3998 become_root();
3999 }
4000 store_inheritance_attributes(fsp,
4001 file_ace_list,
4002 dir_ace_list,
4003 psd->type);
4004 if (set_acl_as_root) {
4005 unbecome_root();
4006 }
4007 }
4008
4009 /*
4010 * If we cannot set using POSIX ACLs we fall back to checking if we need to chmod.
4011 */
4012
4013 if(!acl_set_support && acl_perms) {
4014 mode_t posix_perms;
4015
4016 if (!convert_canon_ace_to_posix_perms( fsp, file_ace_list, &posix_perms)) {
4017 free_canon_ace_list(file_ace_list);
4018 free_canon_ace_list(dir_ace_list);
4019 DEBUG(3,("set_nt_acl: failed to convert file acl to "
4020 "posix permissions for file %s.\n",
4021 fsp_str_dbg(fsp)));
4022 return NT_STATUS_ACCESS_DENIED;
4023 }
4024
4025 if (orig_mode != posix_perms) {
4026 int sret = -1;
4027
4028 DEBUG(3,("set_nt_acl: chmod %s. perms = 0%o.\n",
4029 fsp_str_dbg(fsp), (unsigned int)posix_perms));
4030
4031 if (set_acl_as_root) {
4032 become_root();
4033 }
4034 sret = SMB_VFS_CHMOD(conn, fsp->fsp_name->base_name,
4035 posix_perms);
4036 if (set_acl_as_root) {
4037 unbecome_root();
4038 }
4039 if(sret == -1) {
4040 if (acl_group_override(conn, fsp->fsp_name)) {
4041 DEBUG(5,("set_nt_acl: acl group "
4042 "control on and current user "
4043 "in file %s primary group. "
4044 "Override chmod\n",
4045 fsp_str_dbg(fsp)));
4046
4047 become_root();
4048 sret = SMB_VFS_CHMOD(conn,
4049 fsp->fsp_name->base_name,
4050 posix_perms);
4051 unbecome_root();
4052 }
4053
4054 if (sret == -1) {
4055 DEBUG(3,("set_nt_acl: chmod %s, 0%o "
4056 "failed. Error = %s.\n",
4057 fsp_str_dbg(fsp),
4058 (unsigned int)posix_perms,
4059 strerror(errno)));
4060 free_canon_ace_list(file_ace_list);
4061 free_canon_ace_list(dir_ace_list);
4062 return map_nt_error_from_unix(errno);
4063 }
4064 }
4065 }
4066 }
4067
4068 free_canon_ace_list(file_ace_list);
4069 free_canon_ace_list(dir_ace_list);
4070
4071 /* Ensure the stat struct in the fsp is correct. */
4072 status = vfs_stat_fsp(fsp);
4073
4074 return NT_STATUS_OK;
4075 }
4076
4077 /****************************************************************************
4078 Get the actual group bits stored on a file with an ACL. Has no effect if
4079 the file has no ACL. Needed in dosmode code where the stat() will return
4080 the mask bits, not the real group bits, for a file with an ACL.
4081 ****************************************************************************/
4082
4083 int get_acl_group_bits( connection_struct *conn, const char *fname, mode_t *mode )
4084 {
4085 int entry_id = SMB_ACL_FIRST_ENTRY;
4086 SMB_ACL_ENTRY_T entry;
4087 SMB_ACL_T posix_acl;
4088 int result = -1;
4089
4090 posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS);
4091 if (posix_acl == (SMB_ACL_T)NULL)
4092 return -1;
4093
4094 while (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) {
4095 SMB_ACL_TAG_T tagtype;
4096 SMB_ACL_PERMSET_T permset;
4097
4098 entry_id = SMB_ACL_NEXT_ENTRY;
4099
4100 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) ==-1)
4101 break;
4102
4103 if (tagtype == SMB_ACL_GROUP_OBJ) {
4104 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1) {
4105 break;
4106 } else {
4107 *mode &= ~(S_IRGRP|S_IWGRP|S_IXGRP);
4108 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ) ? S_IRGRP : 0);
4109 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE) ? S_IWGRP : 0);
4110 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_EXECUTE) ? S_IXGRP : 0);
4111 result = 0;
4112 break;
4113 }
4114 }
4115 }
4116 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
4117 return result;
4118 }
4119
4120 /****************************************************************************
4121 Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4122 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4123 ****************************************************************************/
4124
4125 static int chmod_acl_internals( connection_struct *conn, SMB_ACL_T posix_acl, mode_t mode)
4126 {
4127 int entry_id = SMB_ACL_FIRST_ENTRY;
4128 SMB_ACL_ENTRY_T entry;
4129 int num_entries = 0;
4130
4131 while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) {
4132 SMB_ACL_TAG_T tagtype;
4133 SMB_ACL_PERMSET_T permset;
4134 mode_t perms;
4135
4136 entry_id = SMB_ACL_NEXT_ENTRY;
4137
4138 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1)
4139 return -1;
4140
4141 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1)
4142 return -1;
4143
4144 num_entries++;
4145
4146 switch(tagtype) {
4147 case SMB_ACL_USER_OBJ:
4148 perms = unix_perms_to_acl_perms(mode, S_IRUSR, S_IWUSR, S_IXUSR);
4149 break;
4150 case SMB_ACL_GROUP_OBJ:
4151 perms = unix_perms_to_acl_perms(mode, S_IRGRP, S_IWGRP, S_IXGRP);
4152 break;
4153 case SMB_ACL_MASK:
4154 /*
4155 * FIXME: The ACL_MASK entry permissions should really be set to
4156 * the union of the permissions of all ACL_USER,
4157 * ACL_GROUP_OBJ, and ACL_GROUP entries. That's what
4158 * acl_calc_mask() does, but Samba ACLs doesn't provide it.
4159 */
4160 perms = S_IRUSR|S_IWUSR|S_IXUSR;
4161 break;
4162 case SMB_ACL_OTHER:
4163 perms = unix_perms_to_acl_perms(mode, S_IROTH, S_IWOTH, S_IXOTH);
4164 break;
4165 default:
4166 continue;
4167 }
4168
4169 if (map_acl_perms_to_permset(conn, perms, &permset) == -1)
4170 return -1;
4171
4172 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, entry, permset) == -1)
4173 return -1;
4174 }
4175
4176 /*
4177 * If this is a simple 3 element ACL or no elements then it's a standard
4178 * UNIX permission set. Just use chmod...
4179 */
4180
4181 if ((num_entries == 3) || (num_entries == 0))
4182 return -1;
4183
4184 return 0;
4185 }
4186
4187 /****************************************************************************
4188 Get the access ACL of FROM, do a chmod by setting the ACL USER_OBJ,
4189 GROUP_OBJ and OTHER bits in an ACL and set the mask to rwx. Set the
4190 resulting ACL on TO. Note that name is in UNIX character set.
4191 ****************************************************************************/
4192
4193 static int copy_access_posix_acl(connection_struct *conn, const char *from, const char *to, mode_t mode)
4194 {
4195 SMB_ACL_T posix_acl = NULL;
4196 int ret = -1;
4197
4198 if ((posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, from, SMB_ACL_TYPE_ACCESS)) == NULL)
4199 return -1;
4200
4201 if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
4202 goto done;
4203
4204 ret = SMB_VFS_SYS_ACL_SET_FILE(conn, to, SMB_ACL_TYPE_ACCESS, posix_acl);
4205
4206 done:
4207
4208 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
4209 return ret;
4210 }
4211
4212 /****************************************************************************
4213 Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4214 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4215 Note that name is in UNIX character set.
4216 ****************************************************************************/
4217
4218 int chmod_acl(connection_struct *conn, const char *name, mode_t mode)
4219 {
4220 return copy_access_posix_acl(conn, name, name, mode);
4221 }
4222
4223 /****************************************************************************
4224 Check for an existing default POSIX ACL on a directory.
4225 ****************************************************************************/
4226
4227 static bool directory_has_default_posix_acl(connection_struct *conn, const char *fname)
4228 {
4229 SMB_ACL_T def_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_DEFAULT);
4230 bool has_acl = False;
4231 SMB_ACL_ENTRY_T entry;
4232
4233 if (def_acl != NULL && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, def_acl, SMB_ACL_FIRST_ENTRY, &entry) == 1)) {
4234 has_acl = True;
4235 }
4236
4237 if (def_acl) {
4238 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4239 }
4240 return has_acl;
4241 }
4242
4243 /****************************************************************************
4244 If the parent directory has no default ACL but it does have an Access ACL,
4245 inherit this Access ACL to file name.
4246 ****************************************************************************/
4247
4248 int inherit_access_posix_acl(connection_struct *conn, const char *inherit_from_dir,
4249 const char *name, mode_t mode)
4250 {
4251 if (directory_has_default_posix_acl(conn, inherit_from_dir))
4252 return 0;
4253
4254 return copy_access_posix_acl(conn, inherit_from_dir, name, mode);
4255 }
4256
4257 /****************************************************************************
4258 Do an fchmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4259 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4260 ****************************************************************************/
4261
4262 int fchmod_acl(files_struct *fsp, mode_t mode)
4263 {
4264 connection_struct *conn = fsp->conn;
4265 SMB_ACL_T posix_acl = NULL;
4266 int ret = -1;
4267
4268 if ((posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp)) == NULL)
4269 return -1;
4270
4271 if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
4272 goto done;
4273
4274 ret = SMB_VFS_SYS_ACL_SET_FD(fsp, posix_acl);
4275
4276 done:
4277
4278 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
4279 return ret;
4280 }
4281
4282 /****************************************************************************
4283 Map from wire type to permset.
4284 ****************************************************************************/
4285
4286 static bool unix_ex_wire_to_permset(connection_struct *conn, unsigned char wire_perm, SMB_ACL_PERMSET_T *p_permset)
4287 {
4288 if (wire_perm & ~(SMB_POSIX_ACL_READ|SMB_POSIX_ACL_WRITE|SMB_POSIX_ACL_EXECUTE)) {
4289 return False;
4290 }
4291
4292 if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn, *p_permset) == -1) {
4293 return False;
4294 }
4295
4296 if (wire_perm & SMB_POSIX_ACL_READ) {
4297 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_READ) == -1) {
4298 return False;
4299 }
4300 }
4301 if (wire_perm & SMB_POSIX_ACL_WRITE) {
4302 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_WRITE) == -1) {
4303 return False;
4304 }
4305 }
4306 if (wire_perm & SMB_POSIX_ACL_EXECUTE) {
4307 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_EXECUTE) == -1) {
4308 return False;
4309 }
4310 }
4311 return True;
4312 }
4313
4314 /****************************************************************************
4315 Map from wire type to tagtype.
4316 ****************************************************************************/
4317
4318 static bool unix_ex_wire_to_tagtype(unsigned char wire_tt, SMB_ACL_TAG_T *p_tt)
4319 {
4320 switch (wire_tt) {
4321 case SMB_POSIX_ACL_USER_OBJ:
4322 *p_tt = SMB_ACL_USER_OBJ;
4323 break;
4324 case SMB_POSIX_ACL_USER:
4325 *p_tt = SMB_ACL_USER;
4326 break;
4327 case SMB_POSIX_ACL_GROUP_OBJ:
4328 *p_tt = SMB_ACL_GROUP_OBJ;
4329 break;
4330 case SMB_POSIX_ACL_GROUP:
4331 *p_tt = SMB_ACL_GROUP;
4332 break;
4333 case SMB_POSIX_ACL_MASK:
4334 *p_tt = SMB_ACL_MASK;
4335 break;
4336 case SMB_POSIX_ACL_OTHER:
4337 *p_tt = SMB_ACL_OTHER;
4338 break;
4339 default:
4340 return False;
4341 }
4342 return True;
4343 }
4344
4345 /****************************************************************************
4346 Create a new POSIX acl from wire permissions.
4347 FIXME ! How does the share mask/mode fit into this.... ?
4348 ****************************************************************************/
4349
4350 static SMB_ACL_T create_posix_acl_from_wire(connection_struct *conn, uint16 num_acls, const char *pdata)
4351 {
4352 unsigned int i;
4353 SMB_ACL_T the_acl = SMB_VFS_SYS_ACL_INIT(conn, num_acls);
4354
4355 if (the_acl == NULL) {
4356 return NULL;
4357 }
4358
4359 for (i = 0; i < num_acls; i++) {
4360 SMB_ACL_ENTRY_T the_entry;
4361 SMB_ACL_PERMSET_T the_permset;
4362 SMB_ACL_TAG_T tag_type;
4363
4364 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &the_entry) == -1) {
4365 DEBUG(0,("create_posix_acl_from_wire: Failed to create entry %u. (%s)\n",
4366 i, strerror(errno) ));
4367 goto fail;
4368 }
4369
4370 if (!unix_ex_wire_to_tagtype(CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)), &tag_type)) {
4371 DEBUG(0,("create_posix_acl_from_wire: invalid wire tagtype %u on entry %u.\n",
4372 CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)), i ));
4373 goto fail;
4374 }
4375
4376 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, the_entry, tag_type) == -1) {
4377 DEBUG(0,("create_posix_acl_from_wire: Failed to set tagtype on entry %u. (%s)\n",
4378 i, strerror(errno) ));
4379 goto fail;
4380 }
4381
4382 /* Get the permset pointer from the new ACL entry. */
4383 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, the_entry, &the_permset) == -1) {
4384 DEBUG(0,("create_posix_acl_from_wire: Failed to get permset on entry %u. (%s)\n",
4385 i, strerror(errno) ));
4386 goto fail;
4387 }
4388
4389 /* Map from wire to permissions. */
4390 if (!unix_ex_wire_to_permset(conn, CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+1), &the_permset)) {
4391 DEBUG(0,("create_posix_acl_from_wire: invalid permset %u on entry %u.\n",
4392 CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE) + 1), i ));
4393 goto fail;
4394 }
4395
4396 /* Now apply to the new ACL entry. */
4397 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, the_entry, the_permset) == -1) {
4398 DEBUG(0,("create_posix_acl_from_wire: Failed to add permset on entry %u. (%s)\n",
4399 i, strerror(errno) ));
4400 goto fail;
4401 }
4402
4403 if (tag_type == SMB_ACL_USER) {
4404 uint32 uidval = IVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+2);
4405 uid_t uid = (uid_t)uidval;
4406 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&uid) == -1) {
4407 DEBUG(0,("create_posix_acl_from_wire: Failed to set uid %u on entry %u. (%s)\n",
4408 (unsigned int)uid, i, strerror(errno) ));
4409 goto fail;
4410 }
4411 }
4412
4413 if (tag_type == SMB_ACL_GROUP) {
4414 uint32 gidval = IVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+2);
4415 gid_t gid = (uid_t)gidval;
4416 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&gid) == -1) {
4417 DEBUG(0,("create_posix_acl_from_wire: Failed to set gid %u on entry %u. (%s)\n",
4418 (unsigned int)gid, i, strerror(errno) ));
4419 goto fail;
4420 }
4421 }
4422 }
4423
4424 return the_acl;
4425
4426 fail:
4427
4428 if (the_acl != NULL) {
4429 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
4430 }
4431 return NULL;
4432 }
4433
4434 /****************************************************************************
4435 Calls from UNIX extensions - Default POSIX ACL set.
4436 If num_def_acls == 0 and not a directory just return. If it is a directory
4437 and num_def_acls == 0 then remove the default acl. Else set the default acl
4438 on the directory.
4439 ****************************************************************************/
4440
4441 bool set_unix_posix_default_acl(connection_struct *conn, const char *fname, const SMB_STRUCT_STAT *psbuf,
4442 uint16 num_def_acls, const char *pdata)
4443 {
4444 SMB_ACL_T def_acl = NULL;
4445
4446 if (!S_ISDIR(psbuf->st_ex_mode)) {
4447 if (num_def_acls) {
4448 DEBUG(5,("set_unix_posix_default_acl: Can't set default ACL on non-directory file %s\n", fname ));
4449 errno = EISDIR;
4450 return False;
4451 } else {
4452 return True;
4453 }
4454 }
4455
4456 if (!num_def_acls) {
4457 /* Remove the default ACL. */
4458 if (SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn, fname) == -1) {
4459 DEBUG(5,("set_unix_posix_default_acl: acl_delete_def_file failed on directory %s (%s)\n",
4460 fname, strerror(errno) ));
4461 return False;
4462 }
4463 return True;
4464 }
4465
4466 if ((def_acl = create_posix_acl_from_wire(conn, num_def_acls, pdata)) == NULL) {
4467 return False;
4468 }
4469
4470 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_DEFAULT, def_acl) == -1) {
4471 DEBUG(5,("set_unix_posix_default_acl: acl_set_file failed on directory %s (%s)\n",
4472 fname, strerror(errno) ));
4473 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4474 return False;
4475 }
4476
4477 DEBUG(10,("set_unix_posix_default_acl: set default acl for file %s\n", fname ));
4478 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4479 return True;
4480 }
4481
4482 /****************************************************************************
4483 Remove an ACL from a file. As we don't have acl_delete_entry() available
4484 we must read the current acl and copy all entries except MASK, USER and GROUP
4485 to a new acl, then set that. This (at least on Linux) causes any ACL to be
4486 removed.
4487 FIXME ! How does the share mask/mode fit into this.... ?
4488 ****************************************************************************/
4489
4490 static bool remove_posix_acl(connection_struct *conn, files_struct *fsp, const char *fname)
4491 {
4492 SMB_ACL_T file_acl = NULL;
4493 int entry_id = SMB_ACL_FIRST_ENTRY;
4494 SMB_ACL_ENTRY_T entry;
4495 bool ret = False;
4496 /* Create a new ACL with only 3 entries, u/g/w. */
4497 SMB_ACL_T new_file_acl = SMB_VFS_SYS_ACL_INIT(conn, 3);
4498 SMB_ACL_ENTRY_T user_ent = NULL;
4499 SMB_ACL_ENTRY_T group_ent = NULL;
4500 SMB_ACL_ENTRY_T other_ent = NULL;
4501
4502 if (new_file_acl == NULL) {
4503 DEBUG(5,("remove_posix_acl: failed to init new ACL with 3 entries for file %s.\n", fname));
4504 return False;
4505 }
4506
4507 /* Now create the u/g/w entries. */
4508 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &user_ent) == -1) {
4509 DEBUG(5,("remove_posix_acl: Failed to create user entry for file %s. (%s)\n",
4510 fname, strerror(errno) ));
4511 goto done;
4512 }
4513 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, user_ent, SMB_ACL_USER_OBJ) == -1) {
4514 DEBUG(5,("remove_posix_acl: Failed to set user entry for file %s. (%s)\n",
4515 fname, strerror(errno) ));
4516 goto done;
4517 }
4518
4519 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &group_ent) == -1) {
4520 DEBUG(5,("remove_posix_acl: Failed to create group entry for file %s. (%s)\n",
4521 fname, strerror(errno) ));
4522 goto done;
4523 }
4524 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, group_ent, SMB_ACL_GROUP_OBJ) == -1) {
4525 DEBUG(5,("remove_posix_acl: Failed to set group entry for file %s. (%s)\n",
4526 fname, strerror(errno) ));
4527 goto done;
4528 }
4529
4530 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &other_ent) == -1) {
4531 DEBUG(5,("remove_posix_acl: Failed to create other entry for file %s. (%s)\n",
4532 fname, strerror(errno) ));
4533 goto done;
4534 }
4535 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, other_ent, SMB_ACL_OTHER) == -1) {
4536 DEBUG(5,("remove_posix_acl: Failed to set other entry for file %s. (%s)\n",
4537 fname, strerror(errno) ));
4538 goto done;
4539 }
4540
4541 /* Get the current file ACL. */
4542 if (fsp && fsp->fh->fd != -1) {
4543 file_acl = SMB_VFS_SYS_ACL_GET_FD(fsp);
4544 } else {
4545 file_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_ACCESS);
4546 }
4547
4548 if (file_acl == NULL) {
4549 /* This is only returned if an error occurred. Even for a file with
4550 no acl a u/g/w acl should be returned. */
4551 DEBUG(5,("remove_posix_acl: failed to get ACL from file %s (%s).\n",
4552 fname, strerror(errno) ));
4553 goto done;
4554 }
4555
4556 while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, file_acl, entry_id, &entry) == 1) {
4557 SMB_ACL_TAG_T tagtype;
4558 SMB_ACL_PERMSET_T permset;
4559
4560 entry_id = SMB_ACL_NEXT_ENTRY;
4561
4562 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1) {
4563 DEBUG(5,("remove_posix_acl: failed to get tagtype from ACL on file %s (%s).\n",
4564 fname, strerror(errno) ));
4565 goto done;
4566 }
4567
4568 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1) {
4569 DEBUG(5,("remove_posix_acl: failed to get permset from ACL on file %s (%s).\n",
4570 fname, strerror(errno) ));
4571 goto done;
4572 }
4573
4574 if (tagtype == SMB_ACL_USER_OBJ) {
4575 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, user_ent, permset) == -1) {
4576 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4577 fname, strerror(errno) ));
4578 }
4579 } else if (tagtype == SMB_ACL_GROUP_OBJ) {
4580 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, group_ent, permset) == -1) {
4581 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4582 fname, strerror(errno) ));
4583 }
4584 } else if (tagtype == SMB_ACL_OTHER) {
4585 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, other_ent, permset) == -1) {
4586 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4587 fname, strerror(errno) ));
4588 }
4589 }
4590 }
4591
4592 /* Set the new empty file ACL. */
4593 if (fsp && fsp->fh->fd != -1) {
4594 if (SMB_VFS_SYS_ACL_SET_FD(fsp, new_file_acl) == -1) {
4595 DEBUG(5,("remove_posix_acl: acl_set_file failed on %s (%s)\n",
4596 fname, strerror(errno) ));
4597 goto done;
4598 }
4599 } else {
4600 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS, new_file_acl) == -1) {
4601 DEBUG(5,("remove_posix_acl: acl_set_file failed on %s (%s)\n",
4602 fname, strerror(errno) ));
4603 goto done;
4604 }
4605 }
4606
4607 ret = True;
4608
4609 done:
4610
4611 if (file_acl) {
4612 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4613 }
4614 if (new_file_acl) {
4615 SMB_VFS_SYS_ACL_FREE_ACL(conn, new_file_acl);
4616 }
4617 return ret;
4618 }
4619
4620 /****************************************************************************
4621 Calls from UNIX extensions - POSIX ACL set.
4622 If num_def_acls == 0 then read/modify/write acl after removing all entries
4623 except SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER.
4624 ****************************************************************************/
4625
4626 bool set_unix_posix_acl(connection_struct *conn, files_struct *fsp, const char *fname, uint16 num_acls, const char *pdata)
4627 {
4628 SMB_ACL_T file_acl = NULL;
4629
4630 if (!num_acls) {
4631 /* Remove the ACL from the file. */
4632 return remove_posix_acl(conn, fsp, fname);
4633 }
4634
4635 if ((file_acl = create_posix_acl_from_wire(conn, num_acls, pdata)) == NULL) {
4636 return False;
4637 }
4638
4639 if (fsp && fsp->fh->fd != -1) {
4640 /* The preferred way - use an open fd. */
4641 if (SMB_VFS_SYS_ACL_SET_FD(fsp, file_acl) == -1) {
4642 DEBUG(5,("set_unix_posix_acl: acl_set_file failed on %s (%s)\n",
4643 fname, strerror(errno) ));
4644 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4645 return False;
4646 }
4647 } else {
4648 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS, file_acl) == -1) {
4649 DEBUG(5,("set_unix_posix_acl: acl_set_file failed on %s (%s)\n",
4650 fname, strerror(errno) ));
4651 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4652 return False;
4653 }
4654 }
4655
4656 DEBUG(10,("set_unix_posix_acl: set acl for file %s\n", fname ));
4657 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4658 return True;
4659 }
4660
4661 /********************************************************************
4662 Pull the NT ACL from a file on disk or the OpenEventlog() access
4663 check. Caller is responsible for freeing the returned security
4664 descriptor via TALLOC_FREE(). This is designed for dealing with
4665 user space access checks in smbd outside of the VFS. For example,
4666 checking access rights in OpenEventlog().
4667
4668 Assume we are dealing with files (for now)
4669 ********************************************************************/
4670
4671 SEC_DESC *get_nt_acl_no_snum( TALLOC_CTX *ctx, const char *fname)
4672 {
4673 SEC_DESC *psd, *ret_sd;
4674 connection_struct *conn;
4675 files_struct finfo;
4676 struct fd_handle fh;
4677 NTSTATUS status;
4678
4679 conn = TALLOC_ZERO_P(ctx, connection_struct);
4680 if (conn == NULL) {
4681 DEBUG(0, ("talloc failed\n"));
4682 return NULL;
4683 }
4684
4685 if (!(conn->params = TALLOC_P(conn, struct share_params))) {
4686 DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
4687 TALLOC_FREE(conn);
4688 return NULL;
4689 }
4690
4691 conn->params->service = -1;
4692
4693 set_conn_connectpath(conn, "/");
4694
4695 if (!smbd_vfs_init(conn)) {
4696 DEBUG(0,("get_nt_acl_no_snum: Unable to create a fake connection struct!\n"));
4697 conn_free(conn);
4698 return NULL;
4699 }
4700
4701 ZERO_STRUCT( finfo );
4702 ZERO_STRUCT( fh );
4703
4704 finfo.fnum = -1;
4705 finfo.conn = conn;
4706 finfo.fh = &fh;
4707 finfo.fh->fd = -1;
4708
4709 status = create_synthetic_smb_fname(talloc_tos(), fname, NULL, NULL,
4710 &finfo.fsp_name);
4711 if (!NT_STATUS_IS_OK(status)) {
4712 conn_free(conn);
4713 return NULL;
4714 }
4715
4716 if (!NT_STATUS_IS_OK(SMB_VFS_FGET_NT_ACL( &finfo, DACL_SECURITY_INFORMATION, &psd))) {
4717 DEBUG(0,("get_nt_acl_no_snum: get_nt_acl returned zero.\n"));
4718 TALLOC_FREE(finfo.fsp_name);
4719 conn_free(conn);
4720 return NULL;
4721 }
4722
4723 ret_sd = dup_sec_desc( ctx, psd );
4724
4725 TALLOC_FREE(finfo.fsp_name);
4726 conn_free(conn);
4727
4728 return ret_sd;
4729 }
4730
4731 /* Stolen shamelessly from pvfs_default_acl() in source4 :-). */
4732
4733 NTSTATUS make_default_filesystem_acl(TALLOC_CTX *ctx,
4734 const char *name,
4735 SMB_STRUCT_STAT *psbuf,
4736 SEC_DESC **ppdesc)
4737 {
4738 struct dom_sid owner_sid, group_sid;
4739 size_t size = 0;
4740 SEC_ACE aces[4];
4741 uint32_t access_mask = 0;
4742 mode_t mode = psbuf->st_ex_mode;
4743 SEC_ACL *new_dacl = NULL;
4744 int idx = 0;
4745
4746 DEBUG(10,("make_default_filesystem_acl: file %s mode = 0%o\n",
4747 name, (int)mode ));
4748
4749 uid_to_sid(&owner_sid, psbuf->st_ex_uid);
4750 gid_to_sid(&group_sid, psbuf->st_ex_gid);
4751
4752 /*
4753 We provide up to 4 ACEs
4754 - Owner
4755 - Group
4756 - Everyone
4757 - NT System
4758 */
4759
4760 if (mode & S_IRUSR) {
4761 if (mode & S_IWUSR) {
4762 access_mask |= SEC_RIGHTS_FILE_ALL;
4763 } else {
4764 access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
4765 }
4766 }
4767 if (mode & S_IWUSR) {
4768 access_mask |= SEC_RIGHTS_FILE_WRITE | SEC_STD_DELETE;
4769 }
4770
4771 init_sec_ace(&aces[idx],
4772 &owner_sid,
4773 SEC_ACE_TYPE_ACCESS_ALLOWED,
4774 access_mask,
4775 0);
4776 idx++;
4777
4778 access_mask = 0;
4779 if (mode & S_IRGRP) {
4780 access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
4781 }
4782 if (mode & S_IWGRP) {
4783 /* note that delete is not granted - this matches posix behaviour */
4784 access_mask |= SEC_RIGHTS_FILE_WRITE;
4785 }
4786 if (access_mask) {
4787 init_sec_ace(&aces[idx],
4788 &group_sid,
4789 SEC_ACE_TYPE_ACCESS_ALLOWED,
4790 access_mask,
4791 0);
4792 idx++;
4793 }
4794
4795 access_mask = 0;
4796 if (mode & S_IROTH) {
4797 access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
4798 }
4799 if (mode & S_IWOTH) {
4800 access_mask |= SEC_RIGHTS_FILE_WRITE;
4801 }
4802 if (access_mask) {
4803 init_sec_ace(&aces[idx],
4804 &global_sid_World,
4805 SEC_ACE_TYPE_ACCESS_ALLOWED,
4806 access_mask,
4807 0);
4808 idx++;
4809 }
4810
4811 init_sec_ace(&aces[idx],
4812 &global_sid_System,
4813 SEC_ACE_TYPE_ACCESS_ALLOWED,
4814 SEC_RIGHTS_FILE_ALL,
4815 0);
4816 idx++;
4817
4818 new_dacl = make_sec_acl(ctx,
4819 NT4_ACL_REVISION,
4820 idx,
4821 aces);
4822
4823 if (!new_dacl) {
4824 return NT_STATUS_NO_MEMORY;
4825 }
4826
4827 *ppdesc = make_sec_desc(ctx,
4828 SECURITY_DESCRIPTOR_REVISION_1,
4829 SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT,
4830 &owner_sid,
4831 &group_sid,
4832 NULL,
4833 new_dacl,
4834 &size);
4835 if (!*ppdesc) {
4836 return NT_STATUS_NO_MEMORY;
4837 }
4838 return NT_STATUS_OK;
4839 }
Samba GIT mirror