?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Use is_default_acl variable in canonicalise_acl().
[Samba.git] / source3 / smbd / posix_acls.c
blob338ee6cfcaaf803afcd198117834c72ec3fce500
1 /*
2 Unix SMB/CIFS implementation.
3 SMB NT Security Descriptor / Unix permission conversion.
4 Copyright (C) Jeremy Allison 1994-2009.
5 Copyright (C) Andreas Gruenbacher 2002.
6 Copyright (C) Simo Sorce <idra@samba.org> 2009.
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23
24 extern struct current_user current_user;
25 extern const struct generic_mapping file_generic_mapping;
26
27 #undef DBGC_CLASS
28 #define DBGC_CLASS DBGC_ACLS
29
30 /****************************************************************************
31 Data structures representing the internal ACE format.
32 ****************************************************************************/
33
34 enum ace_owner {UID_ACE, GID_ACE, WORLD_ACE};
35 enum ace_attribute {ALLOW_ACE, DENY_ACE}; /* Used for incoming NT ACLS. */
36
37 typedef union posix_id {
38 uid_t uid;
39 gid_t gid;
40 int world;
41 } posix_id;
42
43 typedef struct canon_ace {
44 struct canon_ace *next, *prev;
45 SMB_ACL_TAG_T type;
46 mode_t perms; /* Only use S_I(R|W|X)USR mode bits here. */
47 DOM_SID trustee;
48 enum ace_owner owner_type;
49 enum ace_attribute attr;
50 posix_id unix_ug;
51 uint8_t ace_flags; /* From windows ACE entry. */
52 } canon_ace;
53
54 #define ALL_ACE_PERMS (S_IRUSR|S_IWUSR|S_IXUSR)
55
56 /*
57 * EA format of user.SAMBA_PAI (Samba_Posix_Acl_Interitance)
58 * attribute on disk - version 1.
59 * All values are little endian.
60 *
61 * | 1 | 1 | 2 | 2 | ....
62 * +------+------+-------------+---------------------+-------------+--------------------+
63 * | vers | flag | num_entries | num_default_entries | ..entries.. | default_entries... |
64 * +------+------+-------------+---------------------+-------------+--------------------+
65 *
66 * Entry format is :
67 *
68 * | 1 | 4 |
69 * +------+-------------------+
70 * | value| uid/gid or world |
71 * | type | value |
72 * +------+-------------------+
73 *
74 * Version 2 format. Stores extra Windows metadata about an ACL.
75 *
76 * | 1 | 2 | 2 | 2 | ....
77 * +------+----------+-------------+---------------------+-------------+--------------------+
78 * | vers | ace | num_entries | num_default_entries | ..entries.. | default_entries... |
79 * | 2 | type | | | | |
80 * +------+----------+-------------+---------------------+-------------+--------------------+
81 *
82 * Entry format is :
83 *
84 * | 1 | 1 | 4 |
85 * +------+------+-------------------+
86 * | ace | value| uid/gid or world |
87 * | flag | type | value |
88 * +------+-------------------+------+
89 *
90 */
91
92 #define PAI_VERSION_OFFSET 0
93
94 #define PAI_V1_FLAG_OFFSET 1
95 #define PAI_V1_NUM_ENTRIES_OFFSET 2
96 #define PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET 4
97 #define PAI_V1_ENTRIES_BASE 6
98 #define PAI_V1_ACL_FLAG_PROTECTED 0x1
99 #define PAI_V1_ENTRY_LENGTH 5
100
101 #define PAI_V1_VERSION 1
102
103 #define PAI_V2_TYPE_OFFSET 1
104 #define PAI_V2_NUM_ENTRIES_OFFSET 3
105 #define PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET 5
106 #define PAI_V2_ENTRIES_BASE 7
107 #define PAI_V2_ENTRY_LENGTH 6
108
109 #define PAI_V2_VERSION 2
110
111 /*
112 * In memory format of user.SAMBA_PAI attribute.
113 */
114
115 struct pai_entry {
116 struct pai_entry *next, *prev;
117 uint8_t ace_flags;
118 enum ace_owner owner_type;
119 posix_id unix_ug;
120 };
121
122 struct pai_val {
123 uint16_t sd_type;
124 unsigned int num_entries;
125 struct pai_entry *entry_list;
126 unsigned int num_def_entries;
127 struct pai_entry *def_entry_list;
128 };
129
130 /************************************************************************
131 Return a uint32 of the pai_entry principal.
132 ************************************************************************/
133
134 static uint32_t get_pai_entry_val(struct pai_entry *paie)
135 {
136 switch (paie->owner_type) {
137 case UID_ACE:
138 DEBUG(10,("get_pai_entry_val: uid = %u\n", (unsigned int)paie->unix_ug.uid ));
139 return (uint32_t)paie->unix_ug.uid;
140 case GID_ACE:
141 DEBUG(10,("get_pai_entry_val: gid = %u\n", (unsigned int)paie->unix_ug.gid ));
142 return (uint32_t)paie->unix_ug.gid;
143 case WORLD_ACE:
144 default:
145 DEBUG(10,("get_pai_entry_val: world ace\n"));
146 return (uint32_t)-1;
147 }
148 }
149
150 /************************************************************************
151 Return a uint32 of the entry principal.
152 ************************************************************************/
153
154 static uint32_t get_entry_val(canon_ace *ace_entry)
155 {
156 switch (ace_entry->owner_type) {
157 case UID_ACE:
158 DEBUG(10,("get_entry_val: uid = %u\n", (unsigned int)ace_entry->unix_ug.uid ));
159 return (uint32_t)ace_entry->unix_ug.uid;
160 case GID_ACE:
161 DEBUG(10,("get_entry_val: gid = %u\n", (unsigned int)ace_entry->unix_ug.gid ));
162 return (uint32_t)ace_entry->unix_ug.gid;
163 case WORLD_ACE:
164 default:
165 DEBUG(10,("get_entry_val: world ace\n"));
166 return (uint32_t)-1;
167 }
168 }
169
170 /************************************************************************
171 Create the on-disk format (always v2 now). Caller must free.
172 ************************************************************************/
173
174 static char *create_pai_buf_v2(canon_ace *file_ace_list,
175 canon_ace *dir_ace_list,
176 uint16_t sd_type,
177 size_t *store_size)
178 {
179 char *pai_buf = NULL;
180 canon_ace *ace_list = NULL;
181 char *entry_offset = NULL;
182 unsigned int num_entries = 0;
183 unsigned int num_def_entries = 0;
184 unsigned int i;
185
186 for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next) {
187 num_entries++;
188 }
189
190 for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next) {
191 num_def_entries++;
192 }
193
194 DEBUG(10,("create_pai_buf_v2: num_entries = %u, num_def_entries = %u\n", num_entries, num_def_entries ));
195
196 *store_size = PAI_V2_ENTRIES_BASE +
197 ((num_entries + num_def_entries)*PAI_V2_ENTRY_LENGTH);
198
199 pai_buf = (char *)SMB_MALLOC(*store_size);
200 if (!pai_buf) {
201 return NULL;
202 }
203
204 /* Set up the header. */
205 memset(pai_buf, '\0', PAI_V2_ENTRIES_BASE);
206 SCVAL(pai_buf,PAI_VERSION_OFFSET,PAI_V2_VERSION);
207 SSVAL(pai_buf,PAI_V2_TYPE_OFFSET, sd_type);
208 SSVAL(pai_buf,PAI_V2_NUM_ENTRIES_OFFSET,num_entries);
209 SSVAL(pai_buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET,num_def_entries);
210
211 DEBUG(10,("create_pai_buf_v2: sd_type = 0x%x\n",
212 (unsigned int)sd_type ));
213
214 entry_offset = pai_buf + PAI_V2_ENTRIES_BASE;
215
216 i = 0;
217 for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next) {
218 uint8_t type_val = (uint8_t)ace_list->owner_type;
219 uint32_t entry_val = get_entry_val(ace_list);
220
221 SCVAL(entry_offset,0,ace_list->ace_flags);
222 SCVAL(entry_offset,1,type_val);
223 SIVAL(entry_offset,2,entry_val);
224 DEBUG(10,("create_pai_buf_v2: entry %u [0x%x] [0x%x] [0x%x]\n",
225 i,
226 (unsigned int)ace_list->ace_flags,
227 (unsigned int)type_val,
228 (unsigned int)entry_val ));
229 i++;
230 entry_offset += PAI_V2_ENTRY_LENGTH;
231 }
232
233 for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next) {
234 uint8_t type_val = (uint8_t)ace_list->owner_type;
235 uint32_t entry_val = get_entry_val(ace_list);
236
237 SCVAL(entry_offset,0,ace_list->ace_flags);
238 SCVAL(entry_offset,1,type_val);
239 SIVAL(entry_offset,2,entry_val);
240 DEBUG(10,("create_pai_buf_v2: entry %u [0x%x] [0x%x] [0x%x]\n",
241 i,
242 (unsigned int)ace_list->ace_flags,
243 (unsigned int)type_val,
244 (unsigned int)entry_val ));
245 i++;
246 entry_offset += PAI_V2_ENTRY_LENGTH;
247 }
248
249 return pai_buf;
250 }
251
252 /************************************************************************
253 Store the user.SAMBA_PAI attribute on disk.
254 ************************************************************************/
255
256 static void store_inheritance_attributes(files_struct *fsp,
257 canon_ace *file_ace_list,
258 canon_ace *dir_ace_list,
259 uint16_t sd_type)
260 {
261 int ret;
262 size_t store_size;
263 char *pai_buf;
264
265 if (!lp_map_acl_inherit(SNUM(fsp->conn))) {
266 return;
267 }
268
269 pai_buf = create_pai_buf_v2(file_ace_list, dir_ace_list,
270 sd_type, &store_size);
271
272 if (fsp->fh->fd != -1) {
273 ret = SMB_VFS_FSETXATTR(fsp, SAMBA_POSIX_INHERITANCE_EA_NAME,
274 pai_buf, store_size, 0);
275 } else {
276 ret = SMB_VFS_SETXATTR(fsp->conn, fsp->fsp_name->base_name,
277 SAMBA_POSIX_INHERITANCE_EA_NAME,
278 pai_buf, store_size, 0);
279 }
280
281 SAFE_FREE(pai_buf);
282
283 DEBUG(10,("store_inheritance_attribute: type 0x%x for file %s\n",
284 (unsigned int)sd_type,
285 fsp_str_dbg(fsp)));
286
287 if (ret == -1 && !no_acl_syscall_error(errno)) {
288 DEBUG(1,("store_inheritance_attribute: Error %s\n", strerror(errno) ));
289 }
290 }
291
292 /************************************************************************
293 Delete the in memory inheritance info.
294 ************************************************************************/
295
296 static void free_inherited_info(struct pai_val *pal)
297 {
298 if (pal) {
299 struct pai_entry *paie, *paie_next;
300 for (paie = pal->entry_list; paie; paie = paie_next) {
301 paie_next = paie->next;
302 SAFE_FREE(paie);
303 }
304 for (paie = pal->def_entry_list; paie; paie = paie_next) {
305 paie_next = paie->next;
306 SAFE_FREE(paie);
307 }
308 SAFE_FREE(pal);
309 }
310 }
311
312 /************************************************************************
313 Get any stored ACE flags.
314 ************************************************************************/
315
316 static uint16_t get_pai_flags(struct pai_val *pal, canon_ace *ace_entry, bool default_ace)
317 {
318 struct pai_entry *paie;
319
320 if (!pal) {
321 return 0;
322 }
323
324 /* If the entry exists it is inherited. */
325 for (paie = (default_ace ? pal->def_entry_list : pal->entry_list); paie; paie = paie->next) {
326 if (ace_entry->owner_type == paie->owner_type &&
327 get_entry_val(ace_entry) == get_pai_entry_val(paie))
328 return paie->ace_flags;
329 }
330 return 0;
331 }
332
333 /************************************************************************
334 Ensure an attribute just read is valid - v1.
335 ************************************************************************/
336
337 static bool check_pai_ok_v1(const char *pai_buf, size_t pai_buf_data_size)
338 {
339 uint16 num_entries;
340 uint16 num_def_entries;
341
342 if (pai_buf_data_size < PAI_V1_ENTRIES_BASE) {
343 /* Corrupted - too small. */
344 return false;
345 }
346
347 if (CVAL(pai_buf,PAI_VERSION_OFFSET) != PAI_V1_VERSION) {
348 return false;
349 }
350
351 num_entries = SVAL(pai_buf,PAI_V1_NUM_ENTRIES_OFFSET);
352 num_def_entries = SVAL(pai_buf,PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET);
353
354 /* Check the entry lists match. */
355 /* Each entry is 5 bytes (type plus 4 bytes of uid or gid). */
356
357 if (((num_entries + num_def_entries)*PAI_V1_ENTRY_LENGTH) +
358 PAI_V1_ENTRIES_BASE != pai_buf_data_size) {
359 return false;
360 }
361
362 return true;
363 }
364
365 /************************************************************************
366 Ensure an attribute just read is valid - v2.
367 ************************************************************************/
368
369 static bool check_pai_ok_v2(const char *pai_buf, size_t pai_buf_data_size)
370 {
371 uint16 num_entries;
372 uint16 num_def_entries;
373
374 if (pai_buf_data_size < PAI_V2_ENTRIES_BASE) {
375 /* Corrupted - too small. */
376 return false;
377 }
378
379 if (CVAL(pai_buf,PAI_VERSION_OFFSET) != PAI_V2_VERSION) {
380 return false;
381 }
382
383 num_entries = SVAL(pai_buf,PAI_V2_NUM_ENTRIES_OFFSET);
384 num_def_entries = SVAL(pai_buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET);
385
386 /* Check the entry lists match. */
387 /* Each entry is 6 bytes (flags + type + 4 bytes of uid or gid). */
388
389 if (((num_entries + num_def_entries)*PAI_V2_ENTRY_LENGTH) +
390 PAI_V2_ENTRIES_BASE != pai_buf_data_size) {
391 return false;
392 }
393
394 return true;
395 }
396
397 /************************************************************************
398 Decode the owner.
399 ************************************************************************/
400
401 static bool get_pai_owner_type(struct pai_entry *paie, const char *entry_offset)
402 {
403 paie->owner_type = (enum ace_owner)CVAL(entry_offset,0);
404 switch( paie->owner_type) {
405 case UID_ACE:
406 paie->unix_ug.uid = (uid_t)IVAL(entry_offset,1);
407 DEBUG(10,("get_pai_owner_type: uid = %u\n",
408 (unsigned int)paie->unix_ug.uid ));
409 break;
410 case GID_ACE:
411 paie->unix_ug.gid = (gid_t)IVAL(entry_offset,1);
412 DEBUG(10,("get_pai_owner_type: gid = %u\n",
413 (unsigned int)paie->unix_ug.gid ));
414 break;
415 case WORLD_ACE:
416 paie->unix_ug.world = -1;
417 DEBUG(10,("get_pai_owner_type: world ace\n"));
418 break;
419 default:
420 DEBUG(10,("get_pai_owner_type: unknown type %u\n",
421 (unsigned int)paie->owner_type ));
422 return false;
423 }
424 return true;
425 }
426
427 /************************************************************************
428 Process v2 entries.
429 ************************************************************************/
430
431 static const char *create_pai_v1_entries(struct pai_val *paiv,
432 const char *entry_offset,
433 bool def_entry)
434 {
435 int i;
436
437 for (i = 0; i < paiv->num_entries; i++) {
438 struct pai_entry *paie = SMB_MALLOC_P(struct pai_entry);
439 if (!paie) {
440 return NULL;
441 }
442
443 paie->ace_flags = SEC_ACE_FLAG_INHERITED_ACE;
444 if (!get_pai_owner_type(paie, entry_offset)) {
445 return NULL;
446 }
447
448 if (!def_entry) {
449 DLIST_ADD(paiv->entry_list, paie);
450 } else {
451 DLIST_ADD(paiv->def_entry_list, paie);
452 }
453 entry_offset += PAI_V1_ENTRY_LENGTH;
454 }
455 return entry_offset;
456 }
457
458 /************************************************************************
459 Convert to in-memory format from version 1.
460 ************************************************************************/
461
462 static struct pai_val *create_pai_val_v1(const char *buf, size_t size)
463 {
464 const char *entry_offset;
465 struct pai_val *paiv = NULL;
466
467 if (!check_pai_ok_v1(buf, size)) {
468 return NULL;
469 }
470
471 paiv = SMB_MALLOC_P(struct pai_val);
472 if (!paiv) {
473 return NULL;
474 }
475
476 memset(paiv, '\0', sizeof(struct pai_val));
477
478 paiv->sd_type = (CVAL(buf,PAI_V1_FLAG_OFFSET) == PAI_V1_ACL_FLAG_PROTECTED) ?
479 SE_DESC_DACL_PROTECTED : 0;
480
481 paiv->num_entries = SVAL(buf,PAI_V1_NUM_ENTRIES_OFFSET);
482 paiv->num_def_entries = SVAL(buf,PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET);
483
484 entry_offset = buf + PAI_V1_ENTRIES_BASE;
485
486 DEBUG(10,("create_pai_val: num_entries = %u, num_def_entries = %u\n",
487 paiv->num_entries, paiv->num_def_entries ));
488
489 entry_offset = create_pai_v1_entries(paiv, entry_offset, false);
490 if (entry_offset == NULL) {
491 free_inherited_info(paiv);
492 return NULL;
493 }
494 entry_offset = create_pai_v1_entries(paiv, entry_offset, true);
495 if (entry_offset == NULL) {
496 free_inherited_info(paiv);
497 return NULL;
498 }
499
500 return paiv;
501 }
502
503 /************************************************************************
504 Process v2 entries.
505 ************************************************************************/
506
507 static const char *create_pai_v2_entries(struct pai_val *paiv,
508 unsigned int num_entries,
509 const char *entry_offset,
510 bool def_entry)
511 {
512 unsigned int i;
513
514 for (i = 0; i < num_entries; i++) {
515 struct pai_entry *paie = SMB_MALLOC_P(struct pai_entry);
516 if (!paie) {
517 return NULL;
518 }
519
520 paie->ace_flags = CVAL(entry_offset,0);
521
522 if (!get_pai_owner_type(paie, entry_offset+1)) {
523 return NULL;
524 }
525 if (!def_entry) {
526 DLIST_ADD(paiv->entry_list, paie);
527 } else {
528 DLIST_ADD(paiv->def_entry_list, paie);
529 }
530 entry_offset += PAI_V2_ENTRY_LENGTH;
531 }
532 return entry_offset;
533 }
534
535 /************************************************************************
536 Convert to in-memory format from version 2.
537 ************************************************************************/
538
539 static struct pai_val *create_pai_val_v2(const char *buf, size_t size)
540 {
541 const char *entry_offset;
542 struct pai_val *paiv = NULL;
543
544 if (!check_pai_ok_v2(buf, size)) {
545 return NULL;
546 }
547
548 paiv = SMB_MALLOC_P(struct pai_val);
549 if (!paiv) {
550 return NULL;
551 }
552
553 memset(paiv, '\0', sizeof(struct pai_val));
554
555 paiv->sd_type = SVAL(buf,PAI_V2_TYPE_OFFSET);
556
557 paiv->num_entries = SVAL(buf,PAI_V2_NUM_ENTRIES_OFFSET);
558 paiv->num_def_entries = SVAL(buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET);
559
560 entry_offset = buf + PAI_V2_ENTRIES_BASE;
561
562 DEBUG(10,("create_pai_val_v2: sd_type = 0x%x num_entries = %u, num_def_entries = %u\n",
563 (unsigned int)paiv->sd_type,
564 paiv->num_entries, paiv->num_def_entries ));
565
566 entry_offset = create_pai_v2_entries(paiv, paiv->num_entries,
567 entry_offset, false);
568 if (entry_offset == NULL) {
569 free_inherited_info(paiv);
570 return NULL;
571 }
572 entry_offset = create_pai_v2_entries(paiv, paiv->num_def_entries,
573 entry_offset, true);
574 if (entry_offset == NULL) {
575 free_inherited_info(paiv);
576 return NULL;
577 }
578
579 return paiv;
580 }
581
582 /************************************************************************
583 Convert to in-memory format - from either version 1 or 2.
584 ************************************************************************/
585
586 static struct pai_val *create_pai_val(const char *buf, size_t size)
587 {
588 if (size < 1) {
589 return NULL;
590 }
591 if (CVAL(buf,PAI_VERSION_OFFSET) == PAI_V1_VERSION) {
592 return create_pai_val_v1(buf, size);
593 } else if (CVAL(buf,PAI_VERSION_OFFSET) == PAI_V2_VERSION) {
594 return create_pai_val_v2(buf, size);
595 } else {
596 return NULL;
597 }
598 }
599
600 /************************************************************************
601 Load the user.SAMBA_PAI attribute.
602 ************************************************************************/
603
604 static struct pai_val *fload_inherited_info(files_struct *fsp)
605 {
606 char *pai_buf;
607 size_t pai_buf_size = 1024;
608 struct pai_val *paiv = NULL;
609 ssize_t ret;
610
611 if (!lp_map_acl_inherit(SNUM(fsp->conn))) {
612 return NULL;
613 }
614
615 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL) {
616 return NULL;
617 }
618
619 do {
620 if (fsp->fh->fd != -1) {
621 ret = SMB_VFS_FGETXATTR(fsp, SAMBA_POSIX_INHERITANCE_EA_NAME,
622 pai_buf, pai_buf_size);
623 } else {
624 ret = SMB_VFS_GETXATTR(fsp->conn,
625 fsp->fsp_name->base_name,
626 SAMBA_POSIX_INHERITANCE_EA_NAME,
627 pai_buf, pai_buf_size);
628 }
629
630 if (ret == -1) {
631 if (errno != ERANGE) {
632 break;
633 }
634 /* Buffer too small - enlarge it. */
635 pai_buf_size *= 2;
636 SAFE_FREE(pai_buf);
637 if (pai_buf_size > 1024*1024) {
638 return NULL; /* Limit malloc to 1mb. */
639 }
640 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL)
641 return NULL;
642 }
643 } while (ret == -1);
644
645 DEBUG(10,("load_inherited_info: ret = %lu for file %s\n",
646 (unsigned long)ret, fsp_str_dbg(fsp)));
647
648 if (ret == -1) {
649 /* No attribute or not supported. */
650 #if defined(ENOATTR)
651 if (errno != ENOATTR)
652 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
653 #else
654 if (errno != ENOSYS)
655 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
656 #endif
657 SAFE_FREE(pai_buf);
658 return NULL;
659 }
660
661 paiv = create_pai_val(pai_buf, ret);
662
663 if (paiv) {
664 DEBUG(10,("load_inherited_info: ACL type is 0x%x for file %s\n",
665 (unsigned int)paiv->sd_type, fsp_str_dbg(fsp)));
666 }
667
668 SAFE_FREE(pai_buf);
669 return paiv;
670 }
671
672 /************************************************************************
673 Load the user.SAMBA_PAI attribute.
674 ************************************************************************/
675
676 static struct pai_val *load_inherited_info(const struct connection_struct *conn,
677 const char *fname)
678 {
679 char *pai_buf;
680 size_t pai_buf_size = 1024;
681 struct pai_val *paiv = NULL;
682 ssize_t ret;
683
684 if (!lp_map_acl_inherit(SNUM(conn))) {
685 return NULL;
686 }
687
688 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL) {
689 return NULL;
690 }
691
692 do {
693 ret = SMB_VFS_GETXATTR(conn, fname,
694 SAMBA_POSIX_INHERITANCE_EA_NAME,
695 pai_buf, pai_buf_size);
696
697 if (ret == -1) {
698 if (errno != ERANGE) {
699 break;
700 }
701 /* Buffer too small - enlarge it. */
702 pai_buf_size *= 2;
703 SAFE_FREE(pai_buf);
704 if (pai_buf_size > 1024*1024) {
705 return NULL; /* Limit malloc to 1mb. */
706 }
707 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL)
708 return NULL;
709 }
710 } while (ret == -1);
711
712 DEBUG(10,("load_inherited_info: ret = %lu for file %s\n", (unsigned long)ret, fname));
713
714 if (ret == -1) {
715 /* No attribute or not supported. */
716 #if defined(ENOATTR)
717 if (errno != ENOATTR)
718 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
719 #else
720 if (errno != ENOSYS)
721 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
722 #endif
723 SAFE_FREE(pai_buf);
724 return NULL;
725 }
726
727 paiv = create_pai_val(pai_buf, ret);
728
729 if (paiv) {
730 DEBUG(10,("load_inherited_info: ACL type 0x%x for file %s\n",
731 (unsigned int)paiv->sd_type,
732 fname));
733 }
734
735 SAFE_FREE(pai_buf);
736 return paiv;
737 }
738
739 /****************************************************************************
740 Functions to manipulate the internal ACE format.
741 ****************************************************************************/
742
743 /****************************************************************************
744 Count a linked list of canonical ACE entries.
745 ****************************************************************************/
746
747 static size_t count_canon_ace_list( canon_ace *l_head )
748 {
749 size_t count = 0;
750 canon_ace *ace;
751
752 for (ace = l_head; ace; ace = ace->next)
753 count++;
754
755 return count;
756 }
757
758 /****************************************************************************
759 Free a linked list of canonical ACE entries.
760 ****************************************************************************/
761
762 static void free_canon_ace_list( canon_ace *l_head )
763 {
764 canon_ace *list, *next;
765
766 for (list = l_head; list; list = next) {
767 next = list->next;
768 DLIST_REMOVE(l_head, list);
769 SAFE_FREE(list);
770 }
771 }
772
773 /****************************************************************************
774 Function to duplicate a canon_ace entry.
775 ****************************************************************************/
776
777 static canon_ace *dup_canon_ace( canon_ace *src_ace)
778 {
779 canon_ace *dst_ace = SMB_MALLOC_P(canon_ace);
780
781 if (dst_ace == NULL)
782 return NULL;
783
784 *dst_ace = *src_ace;
785 dst_ace->prev = dst_ace->next = NULL;
786 return dst_ace;
787 }
788
789 /****************************************************************************
790 Print out a canon ace.
791 ****************************************************************************/
792
793 static void print_canon_ace(canon_ace *pace, int num)
794 {
795 dbgtext( "canon_ace index %d. Type = %s ", num, pace->attr == ALLOW_ACE ? "allow" : "deny" );
796 dbgtext( "SID = %s ", sid_string_dbg(&pace->trustee));
797 if (pace->owner_type == UID_ACE) {
798 const char *u_name = uidtoname(pace->unix_ug.uid);
799 dbgtext( "uid %u (%s) ", (unsigned int)pace->unix_ug.uid, u_name );
800 } else if (pace->owner_type == GID_ACE) {
801 char *g_name = gidtoname(pace->unix_ug.gid);
802 dbgtext( "gid %u (%s) ", (unsigned int)pace->unix_ug.gid, g_name );
803 } else
804 dbgtext( "other ");
805 switch (pace->type) {
806 case SMB_ACL_USER:
807 dbgtext( "SMB_ACL_USER ");
808 break;
809 case SMB_ACL_USER_OBJ:
810 dbgtext( "SMB_ACL_USER_OBJ ");
811 break;
812 case SMB_ACL_GROUP:
813 dbgtext( "SMB_ACL_GROUP ");
814 break;
815 case SMB_ACL_GROUP_OBJ:
816 dbgtext( "SMB_ACL_GROUP_OBJ ");
817 break;
818 case SMB_ACL_OTHER:
819 dbgtext( "SMB_ACL_OTHER ");
820 break;
821 default:
822 dbgtext( "MASK " );
823 break;
824 }
825
826 dbgtext( "ace_flags = 0x%x ", (unsigned int)pace->ace_flags);
827 dbgtext( "perms ");
828 dbgtext( "%c", pace->perms & S_IRUSR ? 'r' : '-');
829 dbgtext( "%c", pace->perms & S_IWUSR ? 'w' : '-');
830 dbgtext( "%c\n", pace->perms & S_IXUSR ? 'x' : '-');
831 }
832
833 /****************************************************************************
834 Print out a canon ace list.
835 ****************************************************************************/
836
837 static void print_canon_ace_list(const char *name, canon_ace *ace_list)
838 {
839 int count = 0;
840
841 if( DEBUGLVL( 10 )) {
842 dbgtext( "print_canon_ace_list: %s\n", name );
843 for (;ace_list; ace_list = ace_list->next, count++)
844 print_canon_ace(ace_list, count );
845 }
846 }
847
848 /****************************************************************************
849 Map POSIX ACL perms to canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits).
850 ****************************************************************************/
851
852 static mode_t convert_permset_to_mode_t(connection_struct *conn, SMB_ACL_PERMSET_T permset)
853 {
854 mode_t ret = 0;
855
856 ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ) ? S_IRUSR : 0);
857 ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE) ? S_IWUSR : 0);
858 ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_EXECUTE) ? S_IXUSR : 0);
859
860 return ret;
861 }
862
863 /****************************************************************************
864 Map generic UNIX permissions to canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits).
865 ****************************************************************************/
866
867 static mode_t unix_perms_to_acl_perms(mode_t mode, int r_mask, int w_mask, int x_mask)
868 {
869 mode_t ret = 0;
870
871 if (mode & r_mask)
872 ret |= S_IRUSR;
873 if (mode & w_mask)
874 ret |= S_IWUSR;
875 if (mode & x_mask)
876 ret |= S_IXUSR;
877
878 return ret;
879 }
880
881 /****************************************************************************
882 Map canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits) to
883 an SMB_ACL_PERMSET_T.
884 ****************************************************************************/
885
886 static int map_acl_perms_to_permset(connection_struct *conn, mode_t mode, SMB_ACL_PERMSET_T *p_permset)
887 {
888 if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn, *p_permset) == -1)
889 return -1;
890 if (mode & S_IRUSR) {
891 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_READ) == -1)
892 return -1;
893 }
894 if (mode & S_IWUSR) {
895 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_WRITE) == -1)
896 return -1;
897 }
898 if (mode & S_IXUSR) {
899 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_EXECUTE) == -1)
900 return -1;
901 }
902 return 0;
903 }
904
905 /****************************************************************************
906 Function to create owner and group SIDs from a SMB_STRUCT_STAT.
907 ****************************************************************************/
908
909 void create_file_sids(const SMB_STRUCT_STAT *psbuf, DOM_SID *powner_sid, DOM_SID *pgroup_sid)
910 {
911 uid_to_sid( powner_sid, psbuf->st_ex_uid );
912 gid_to_sid( pgroup_sid, psbuf->st_ex_gid );
913 }
914
915 /****************************************************************************
916 Merge aces with a common sid - if both are allow or deny, OR the permissions together and
917 delete the second one. If the first is deny, mask the permissions off and delete the allow
918 if the permissions become zero, delete the deny if the permissions are non zero.
919 ****************************************************************************/
920
921 static void merge_aces( canon_ace **pp_list_head, bool dir_acl)
922 {
923 canon_ace *l_head = *pp_list_head;
924 canon_ace *curr_ace_outer;
925 canon_ace *curr_ace_outer_next;
926
927 /*
928 * First, merge allow entries with identical SIDs, and deny entries
929 * with identical SIDs.
930 */
931
932 for (curr_ace_outer = l_head; curr_ace_outer; curr_ace_outer = curr_ace_outer_next) {
933 canon_ace *curr_ace;
934 canon_ace *curr_ace_next;
935
936 curr_ace_outer_next = curr_ace_outer->next; /* Save the link in case we delete. */
937
938 for (curr_ace = curr_ace_outer->next; curr_ace; curr_ace = curr_ace_next) {
939 bool can_merge = false;
940
941 curr_ace_next = curr_ace->next; /* Save the link in case of delete. */
942
943 /* For file ACLs we can merge if the SIDs and ALLOW/DENY
944 * types are the same. For directory acls we must also
945 * ensure the POSIX ACL types are the same. */
946
947 if (!dir_acl) {
948 can_merge = (sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
949 (curr_ace->attr == curr_ace_outer->attr));
950 } else {
951 can_merge = (sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
952 (curr_ace->type == curr_ace_outer->type) &&
953 (curr_ace->attr == curr_ace_outer->attr));
954 }
955
956 if (can_merge) {
957 if( DEBUGLVL( 10 )) {
958 dbgtext("merge_aces: Merging ACE's\n");
959 print_canon_ace( curr_ace_outer, 0);
960 print_canon_ace( curr_ace, 0);
961 }
962
963 /* Merge two allow or two deny ACE's. */
964
965 /* Theoretically we shouldn't merge a dir ACE if
966 * one ACE has the CI flag set, and the other
967 * ACE has the OI flag set, but this is rare
968 * enough we can ignore it. */
969
970 curr_ace_outer->perms |= curr_ace->perms;
971 curr_ace_outer->ace_flags |= curr_ace->ace_flags;
972 DLIST_REMOVE(l_head, curr_ace);
973 SAFE_FREE(curr_ace);
974 curr_ace_outer_next = curr_ace_outer->next; /* We may have deleted the link. */
975 }
976 }
977 }
978
979 /*
980 * Now go through and mask off allow permissions with deny permissions.
981 * We can delete either the allow or deny here as we know that each SID
982 * appears only once in the list.
983 */
984
985 for (curr_ace_outer = l_head; curr_ace_outer; curr_ace_outer = curr_ace_outer_next) {
986 canon_ace *curr_ace;
987 canon_ace *curr_ace_next;
988
989 curr_ace_outer_next = curr_ace_outer->next; /* Save the link in case we delete. */
990
991 for (curr_ace = curr_ace_outer->next; curr_ace; curr_ace = curr_ace_next) {
992
993 curr_ace_next = curr_ace->next; /* Save the link in case of delete. */
994
995 /*
996 * Subtract ACE's with different entries. Due to the ordering constraints
997 * we've put on the ACL, we know the deny must be the first one.
998 */
999
1000 if (sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
1001 (curr_ace_outer->attr == DENY_ACE) && (curr_ace->attr == ALLOW_ACE)) {
1002
1003 if( DEBUGLVL( 10 )) {
1004 dbgtext("merge_aces: Masking ACE's\n");
1005 print_canon_ace( curr_ace_outer, 0);
1006 print_canon_ace( curr_ace, 0);
1007 }
1008
1009 curr_ace->perms &= ~curr_ace_outer->perms;
1010
1011 if (curr_ace->perms == 0) {
1012
1013 /*
1014 * The deny overrides the allow. Remove the allow.
1015 */
1016
1017 DLIST_REMOVE(l_head, curr_ace);
1018 SAFE_FREE(curr_ace);
1019 curr_ace_outer_next = curr_ace_outer->next; /* We may have deleted the link. */
1020
1021 } else {
1022
1023 /*
1024 * Even after removing permissions, there
1025 * are still allow permissions - delete the deny.
1026 * It is safe to delete the deny here,
1027 * as we are guarenteed by the deny first
1028 * ordering that all the deny entries for
1029 * this SID have already been merged into one
1030 * before we can get to an allow ace.
1031 */
1032
1033 DLIST_REMOVE(l_head, curr_ace_outer);
1034 SAFE_FREE(curr_ace_outer);
1035 break;
1036 }
1037 }
1038
1039 } /* end for curr_ace */
1040 } /* end for curr_ace_outer */
1041
1042 /* We may have modified the list. */
1043
1044 *pp_list_head = l_head;
1045 }
1046
1047 /****************************************************************************
1048 Check if we need to return NT4.x compatible ACL entries.
1049 ****************************************************************************/
1050
1051 bool nt4_compatible_acls(void)
1052 {
1053 int compat = lp_acl_compatibility();
1054
1055 if (compat == ACL_COMPAT_AUTO) {
1056 enum remote_arch_types ra_type = get_remote_arch();
1057
1058 /* Automatically adapt to client */
1059 return (ra_type <= RA_WINNT);
1060 } else
1061 return (compat == ACL_COMPAT_WINNT);
1062 }
1063
1064
1065 /****************************************************************************
1066 Map canon_ace perms to permission bits NT.
1067 The attr element is not used here - we only process deny entries on set,
1068 not get. Deny entries are implicit on get with ace->perms = 0.
1069 ****************************************************************************/
1070
1071 uint32_t map_canon_ace_perms(int snum,
1072 enum security_ace_type *pacl_type,
1073 mode_t perms,
1074 bool directory_ace)
1075 {
1076 uint32_t nt_mask = 0;
1077
1078 *pacl_type = SEC_ACE_TYPE_ACCESS_ALLOWED;
1079
1080 if (lp_acl_map_full_control(snum) && ((perms & ALL_ACE_PERMS) == ALL_ACE_PERMS)) {
1081 if (directory_ace) {
1082 nt_mask = UNIX_DIRECTORY_ACCESS_RWX;
1083 } else {
1084 nt_mask = (UNIX_ACCESS_RWX & ~DELETE_ACCESS);
1085 }
1086 } else if ((perms & ALL_ACE_PERMS) == (mode_t)0) {
1087 /*
1088 * Windows NT refuses to display ACEs with no permissions in them (but
1089 * they are perfectly legal with Windows 2000). If the ACE has empty
1090 * permissions we cannot use 0, so we use the otherwise unused
1091 * WRITE_OWNER permission, which we ignore when we set an ACL.
1092 * We abstract this into a #define of UNIX_ACCESS_NONE to allow this
1093 * to be changed in the future.
1094 */
1095
1096 if (nt4_compatible_acls())
1097 nt_mask = UNIX_ACCESS_NONE;
1098 else
1099 nt_mask = 0;
1100 } else {
1101 if (directory_ace) {
1102 nt_mask |= ((perms & S_IRUSR) ? UNIX_DIRECTORY_ACCESS_R : 0 );
1103 nt_mask |= ((perms & S_IWUSR) ? UNIX_DIRECTORY_ACCESS_W : 0 );
1104 nt_mask |= ((perms & S_IXUSR) ? UNIX_DIRECTORY_ACCESS_X : 0 );
1105 } else {
1106 nt_mask |= ((perms & S_IRUSR) ? UNIX_ACCESS_R : 0 );
1107 nt_mask |= ((perms & S_IWUSR) ? UNIX_ACCESS_W : 0 );
1108 nt_mask |= ((perms & S_IXUSR) ? UNIX_ACCESS_X : 0 );
1109 }
1110 }
1111
1112 if ((perms & S_IWUSR) && lp_dos_filemode(snum)) {
1113 nt_mask |= (SEC_STD_WRITE_DAC|SEC_STD_WRITE_OWNER|DELETE_ACCESS);
1114 }
1115
1116 DEBUG(10,("map_canon_ace_perms: Mapped (UNIX) %x to (NT) %x\n",
1117 (unsigned int)perms, (unsigned int)nt_mask ));
1118
1119 return nt_mask;
1120 }
1121
1122 /****************************************************************************
1123 Map NT perms to a UNIX mode_t.
1124 ****************************************************************************/
1125
1126 #define FILE_SPECIFIC_READ_BITS (FILE_READ_DATA|FILE_READ_EA)
1127 #define FILE_SPECIFIC_WRITE_BITS (FILE_WRITE_DATA|FILE_APPEND_DATA|FILE_WRITE_EA)
1128 #define FILE_SPECIFIC_EXECUTE_BITS (FILE_EXECUTE)
1129
1130 static mode_t map_nt_perms( uint32 *mask, int type)
1131 {
1132 mode_t mode = 0;
1133
1134 switch(type) {
1135 case S_IRUSR:
1136 if((*mask) & GENERIC_ALL_ACCESS)
1137 mode = S_IRUSR|S_IWUSR|S_IXUSR;
1138 else {
1139 mode |= ((*mask) & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IRUSR : 0;
1140 mode |= ((*mask) & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWUSR : 0;
1141 mode |= ((*mask) & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXUSR : 0;
1142 }
1143 break;
1144 case S_IRGRP:
1145 if((*mask) & GENERIC_ALL_ACCESS)
1146 mode = S_IRGRP|S_IWGRP|S_IXGRP;
1147 else {
1148 mode |= ((*mask) & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IRGRP : 0;
1149 mode |= ((*mask) & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWGRP : 0;
1150 mode |= ((*mask) & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXGRP : 0;
1151 }
1152 break;
1153 case S_IROTH:
1154 if((*mask) & GENERIC_ALL_ACCESS)
1155 mode = S_IROTH|S_IWOTH|S_IXOTH;
1156 else {
1157 mode |= ((*mask) & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IROTH : 0;
1158 mode |= ((*mask) & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWOTH : 0;
1159 mode |= ((*mask) & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXOTH : 0;
1160 }
1161 break;
1162 }
1163
1164 return mode;
1165 }
1166
1167 /****************************************************************************
1168 Unpack a SEC_DESC into a UNIX owner and group.
1169 ****************************************************************************/
1170
1171 NTSTATUS unpack_nt_owners(int snum, uid_t *puser, gid_t *pgrp, uint32 security_info_sent, const SEC_DESC *psd)
1172 {
1173 DOM_SID owner_sid;
1174 DOM_SID grp_sid;
1175
1176 *puser = (uid_t)-1;
1177 *pgrp = (gid_t)-1;
1178
1179 if(security_info_sent == 0) {
1180 DEBUG(0,("unpack_nt_owners: no security info sent !\n"));
1181 return NT_STATUS_OK;
1182 }
1183
1184 /*
1185 * Validate the owner and group SID's.
1186 */
1187
1188 memset(&owner_sid, '\0', sizeof(owner_sid));
1189 memset(&grp_sid, '\0', sizeof(grp_sid));
1190
1191 DEBUG(5,("unpack_nt_owners: validating owner_sids.\n"));
1192
1193 /*
1194 * Don't immediately fail if the owner sid cannot be validated.
1195 * This may be a group chown only set.
1196 */
1197
1198 if (security_info_sent & OWNER_SECURITY_INFORMATION) {
1199 sid_copy(&owner_sid, psd->owner_sid);
1200 if (!sid_to_uid(&owner_sid, puser)) {
1201 if (lp_force_unknown_acl_user(snum)) {
1202 /* this allows take ownership to work
1203 * reasonably */
1204 *puser = current_user.ut.uid;
1205 } else {
1206 DEBUG(3,("unpack_nt_owners: unable to validate"
1207 " owner sid for %s\n",
1208 sid_string_dbg(&owner_sid)));
1209 return NT_STATUS_INVALID_OWNER;
1210 }
1211 }
1212 DEBUG(3,("unpack_nt_owners: owner sid mapped to uid %u\n",
1213 (unsigned int)*puser ));
1214 }
1215
1216 /*
1217 * Don't immediately fail if the group sid cannot be validated.
1218 * This may be an owner chown only set.
1219 */
1220
1221 if (security_info_sent & GROUP_SECURITY_INFORMATION) {
1222 sid_copy(&grp_sid, psd->group_sid);
1223 if (!sid_to_gid( &grp_sid, pgrp)) {
1224 if (lp_force_unknown_acl_user(snum)) {
1225 /* this allows take group ownership to work
1226 * reasonably */
1227 *pgrp = current_user.ut.gid;
1228 } else {
1229 DEBUG(3,("unpack_nt_owners: unable to validate"
1230 " group sid.\n"));
1231 return NT_STATUS_INVALID_OWNER;
1232 }
1233 }
1234 DEBUG(3,("unpack_nt_owners: group sid mapped to gid %u\n",
1235 (unsigned int)*pgrp));
1236 }
1237
1238 DEBUG(5,("unpack_nt_owners: owner_sids validated.\n"));
1239
1240 return NT_STATUS_OK;
1241 }
1242
1243 /****************************************************************************
1244 Ensure the enforced permissions for this share apply.
1245 ****************************************************************************/
1246
1247 static void apply_default_perms(const struct share_params *params,
1248 const bool is_directory, canon_ace *pace,
1249 mode_t type)
1250 {
1251 mode_t and_bits = (mode_t)0;
1252 mode_t or_bits = (mode_t)0;
1253
1254 /* Get the initial bits to apply. */
1255
1256 if (is_directory) {
1257 and_bits = lp_dir_security_mask(params->service);
1258 or_bits = lp_force_dir_security_mode(params->service);
1259 } else {
1260 and_bits = lp_security_mask(params->service);
1261 or_bits = lp_force_security_mode(params->service);
1262 }
1263
1264 /* Now bounce them into the S_USR space. */
1265 switch(type) {
1266 case S_IRUSR:
1267 /* Ensure owner has read access. */
1268 pace->perms |= S_IRUSR;
1269 if (is_directory)
1270 pace->perms |= (S_IWUSR|S_IXUSR);
1271 and_bits = unix_perms_to_acl_perms(and_bits, S_IRUSR, S_IWUSR, S_IXUSR);
1272 or_bits = unix_perms_to_acl_perms(or_bits, S_IRUSR, S_IWUSR, S_IXUSR);
1273 break;
1274 case S_IRGRP:
1275 and_bits = unix_perms_to_acl_perms(and_bits, S_IRGRP, S_IWGRP, S_IXGRP);
1276 or_bits = unix_perms_to_acl_perms(or_bits, S_IRGRP, S_IWGRP, S_IXGRP);
1277 break;
1278 case S_IROTH:
1279 and_bits = unix_perms_to_acl_perms(and_bits, S_IROTH, S_IWOTH, S_IXOTH);
1280 or_bits = unix_perms_to_acl_perms(or_bits, S_IROTH, S_IWOTH, S_IXOTH);
1281 break;
1282 }
1283
1284 pace->perms = ((pace->perms & and_bits)|or_bits);
1285 }
1286
1287 /****************************************************************************
1288 Check if a given uid/SID is in a group gid/SID. This is probably very
1289 expensive and will need optimisation. A *lot* of optimisation :-). JRA.
1290 ****************************************************************************/
1291
1292 static bool uid_entry_in_group( canon_ace *uid_ace, canon_ace *group_ace )
1293 {
1294 const char *u_name = NULL;
1295
1296 /* "Everyone" always matches every uid. */
1297
1298 if (sid_equal(&group_ace->trustee, &global_sid_World))
1299 return True;
1300
1301 /*
1302 * if it's the current user, we already have the unix token
1303 * and don't need to do the complex user_in_group_sid() call
1304 */
1305 if (uid_ace->unix_ug.uid == current_user.ut.uid) {
1306 size_t i;
1307
1308 if (group_ace->unix_ug.gid == current_user.ut.gid) {
1309 return True;
1310 }
1311
1312 for (i=0; i < current_user.ut.ngroups; i++) {
1313 if (group_ace->unix_ug.gid == current_user.ut.groups[i]) {
1314 return True;
1315 }
1316 }
1317 }
1318
1319 /* u_name talloc'ed off tos. */
1320 u_name = uidtoname(uid_ace->unix_ug.uid);
1321 if (!u_name) {
1322 return False;
1323 }
1324
1325 /*
1326 * user_in_group_sid() uses create_token_from_username()
1327 * which creates an artificial NT token given just a username,
1328 * so this is not reliable for users from foreign domains
1329 * exported by winbindd!
1330 */
1331 return user_in_group_sid(u_name, &group_ace->trustee);
1332 }
1333
1334 /****************************************************************************
1335 A well formed POSIX file or default ACL has at least 3 entries, a
1336 SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ.
1337 In addition, the owner must always have at least read access.
1338 When using this call on get_acl, the pst struct is valid and contains
1339 the mode of the file. When using this call on set_acl, the pst struct has
1340 been modified to have a mode containing the default for this file or directory
1341 type.
1342 ****************************************************************************/
1343
1344 static bool ensure_canon_entry_valid(canon_ace **pp_ace,
1345 const struct share_params *params,
1346 const bool is_directory,
1347 const DOM_SID *pfile_owner_sid,
1348 const DOM_SID *pfile_grp_sid,
1349 const SMB_STRUCT_STAT *pst,
1350 bool setting_acl)
1351 {
1352 canon_ace *pace;
1353 bool got_user = False;
1354 bool got_grp = False;
1355 bool got_other = False;
1356 canon_ace *pace_other = NULL;
1357
1358 for (pace = *pp_ace; pace; pace = pace->next) {
1359 if (pace->type == SMB_ACL_USER_OBJ) {
1360
1361 if (setting_acl)
1362 apply_default_perms(params, is_directory, pace, S_IRUSR);
1363 got_user = True;
1364
1365 } else if (pace->type == SMB_ACL_GROUP_OBJ) {
1366
1367 /*
1368 * Ensure create mask/force create mode is respected on set.
1369 */
1370
1371 if (setting_acl)
1372 apply_default_perms(params, is_directory, pace, S_IRGRP);
1373 got_grp = True;
1374
1375 } else if (pace->type == SMB_ACL_OTHER) {
1376
1377 /*
1378 * Ensure create mask/force create mode is respected on set.
1379 */
1380
1381 if (setting_acl)
1382 apply_default_perms(params, is_directory, pace, S_IROTH);
1383 got_other = True;
1384 pace_other = pace;
1385 }
1386 }
1387
1388 if (!got_user) {
1389 if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1390 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1391 return False;
1392 }
1393
1394 ZERO_STRUCTP(pace);
1395 pace->type = SMB_ACL_USER_OBJ;
1396 pace->owner_type = UID_ACE;
1397 pace->unix_ug.uid = pst->st_ex_uid;
1398 pace->trustee = *pfile_owner_sid;
1399 pace->attr = ALLOW_ACE;
1400 /* Start with existing permissions, principle of least
1401 surprises for the user. */
1402 pace->perms = pst->st_ex_mode;
1403
1404 if (setting_acl) {
1405 /* See if the owning user is in any of the other groups in
1406 the ACE, or if there's a matching user entry.
1407 If so, OR in the permissions from that entry. */
1408
1409 canon_ace *pace_iter;
1410
1411 for (pace_iter = *pp_ace; pace_iter; pace_iter = pace_iter->next) {
1412 if (pace_iter->type == SMB_ACL_USER &&
1413 pace_iter->unix_ug.uid == pace->unix_ug.uid) {
1414 pace->perms |= pace_iter->perms;
1415 } else if (pace_iter->type == SMB_ACL_GROUP_OBJ || pace_iter->type == SMB_ACL_GROUP) {
1416 if (uid_entry_in_group(pace, pace_iter)) {
1417 pace->perms |= pace_iter->perms;
1418 }
1419 }
1420 }
1421
1422 if (pace->perms == 0) {
1423 /* If we only got an "everyone" perm, just use that. */
1424 if (got_other)
1425 pace->perms = pace_other->perms;
1426 }
1427
1428 apply_default_perms(params, is_directory, pace, S_IRUSR);
1429 } else {
1430 pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRUSR, S_IWUSR, S_IXUSR);
1431 }
1432
1433 DLIST_ADD(*pp_ace, pace);
1434 }
1435
1436 if (!got_grp) {
1437 if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1438 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1439 return False;
1440 }
1441
1442 ZERO_STRUCTP(pace);
1443 pace->type = SMB_ACL_GROUP_OBJ;
1444 pace->owner_type = GID_ACE;
1445 pace->unix_ug.uid = pst->st_ex_gid;
1446 pace->trustee = *pfile_grp_sid;
1447 pace->attr = ALLOW_ACE;
1448 if (setting_acl) {
1449 /* If we only got an "everyone" perm, just use that. */
1450 if (got_other)
1451 pace->perms = pace_other->perms;
1452 else
1453 pace->perms = 0;
1454 apply_default_perms(params, is_directory, pace, S_IRGRP);
1455 } else {
1456 pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRGRP, S_IWGRP, S_IXGRP);
1457 }
1458
1459 DLIST_ADD(*pp_ace, pace);
1460 }
1461
1462 if (!got_other) {
1463 if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1464 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1465 return False;
1466 }
1467
1468 ZERO_STRUCTP(pace);
1469 pace->type = SMB_ACL_OTHER;
1470 pace->owner_type = WORLD_ACE;
1471 pace->unix_ug.world = -1;
1472 pace->trustee = global_sid_World;
1473 pace->attr = ALLOW_ACE;
1474 if (setting_acl) {
1475 pace->perms = 0;
1476 apply_default_perms(params, is_directory, pace, S_IROTH);
1477 } else
1478 pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IROTH, S_IWOTH, S_IXOTH);
1479
1480 DLIST_ADD(*pp_ace, pace);
1481 }
1482
1483 return True;
1484 }
1485
1486 /****************************************************************************
1487 Check if a POSIX ACL has the required SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries.
1488 If it does not have them, check if there are any entries where the trustee is the
1489 file owner or the owning group, and map these to SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ.
1490 Note we must not do this to default directory ACLs.
1491 ****************************************************************************/
1492
1493 static void check_owning_objs(canon_ace *ace, DOM_SID *pfile_owner_sid, DOM_SID *pfile_grp_sid)
1494 {
1495 bool got_user_obj, got_group_obj;
1496 canon_ace *current_ace;
1497 int i, entries;
1498
1499 entries = count_canon_ace_list(ace);
1500 got_user_obj = False;
1501 got_group_obj = False;
1502
1503 for (i=0, current_ace = ace; i < entries; i++, current_ace = current_ace->next) {
1504 if (current_ace->type == SMB_ACL_USER_OBJ)
1505 got_user_obj = True;
1506 else if (current_ace->type == SMB_ACL_GROUP_OBJ)
1507 got_group_obj = True;
1508 }
1509 if (got_user_obj && got_group_obj) {
1510 DEBUG(10,("check_owning_objs: ACL had owning user/group entries.\n"));
1511 return;
1512 }
1513
1514 for (i=0, current_ace = ace; i < entries; i++, current_ace = current_ace->next) {
1515 if (!got_user_obj && current_ace->owner_type == UID_ACE &&
1516 sid_equal(&current_ace->trustee, pfile_owner_sid)) {
1517 current_ace->type = SMB_ACL_USER_OBJ;
1518 got_user_obj = True;
1519 }
1520 if (!got_group_obj && current_ace->owner_type == GID_ACE &&
1521 sid_equal(&current_ace->trustee, pfile_grp_sid)) {
1522 current_ace->type = SMB_ACL_GROUP_OBJ;
1523 got_group_obj = True;
1524 }
1525 }
1526 if (!got_user_obj)
1527 DEBUG(10,("check_owning_objs: ACL is missing an owner entry.\n"));
1528 if (!got_group_obj)
1529 DEBUG(10,("check_owning_objs: ACL is missing an owning group entry.\n"));
1530 }
1531
1532 /****************************************************************************
1533 Unpack a SEC_DESC into two canonical ace lists.
1534 ****************************************************************************/
1535
1536 static bool create_canon_ace_lists(files_struct *fsp,
1537 const SMB_STRUCT_STAT *pst,
1538 DOM_SID *pfile_owner_sid,
1539 DOM_SID *pfile_grp_sid,
1540 canon_ace **ppfile_ace,
1541 canon_ace **ppdir_ace,
1542 const SEC_ACL *dacl)
1543 {
1544 bool all_aces_are_inherit_only = (fsp->is_directory ? True : False);
1545 canon_ace *file_ace = NULL;
1546 canon_ace *dir_ace = NULL;
1547 canon_ace *current_ace = NULL;
1548 bool got_dir_allow = False;
1549 bool got_file_allow = False;
1550 int i, j;
1551
1552 *ppfile_ace = NULL;
1553 *ppdir_ace = NULL;
1554
1555 /*
1556 * Convert the incoming ACL into a more regular form.
1557 */
1558
1559 for(i = 0; i < dacl->num_aces; i++) {
1560 SEC_ACE *psa = &dacl->aces[i];
1561
1562 if((psa->type != SEC_ACE_TYPE_ACCESS_ALLOWED) && (psa->type != SEC_ACE_TYPE_ACCESS_DENIED)) {
1563 DEBUG(3,("create_canon_ace_lists: unable to set anything but an ALLOW or DENY ACE.\n"));
1564 return False;
1565 }
1566
1567 if (nt4_compatible_acls()) {
1568 /*
1569 * The security mask may be UNIX_ACCESS_NONE which should map into
1570 * no permissions (we overload the WRITE_OWNER bit for this) or it
1571 * should be one of the ALL/EXECUTE/READ/WRITE bits. Arrange for this
1572 * to be so. Any other bits override the UNIX_ACCESS_NONE bit.
1573 */
1574
1575 /*
1576 * Convert GENERIC bits to specific bits.
1577 */
1578
1579 se_map_generic(&psa->access_mask, &file_generic_mapping);
1580
1581 psa->access_mask &= (UNIX_ACCESS_NONE|FILE_ALL_ACCESS);
1582
1583 if(psa->access_mask != UNIX_ACCESS_NONE)
1584 psa->access_mask &= ~UNIX_ACCESS_NONE;
1585 }
1586 }
1587
1588 /*
1589 * Deal with the fact that NT 4.x re-writes the canonical format
1590 * that we return for default ACLs. If a directory ACE is identical
1591 * to a inherited directory ACE then NT changes the bits so that the
1592 * first ACE is set to OI|IO and the second ACE for this SID is set
1593 * to CI. We need to repair this. JRA.
1594 */
1595
1596 for(i = 0; i < dacl->num_aces; i++) {
1597 SEC_ACE *psa1 = &dacl->aces[i];
1598
1599 for (j = i + 1; j < dacl->num_aces; j++) {
1600 SEC_ACE *psa2 = &dacl->aces[j];
1601
1602 if (psa1->access_mask != psa2->access_mask)
1603 continue;
1604
1605 if (!sid_equal(&psa1->trustee, &psa2->trustee))
1606 continue;
1607
1608 /*
1609 * Ok - permission bits and SIDs are equal.
1610 * Check if flags were re-written.
1611 */
1612
1613 if (psa1->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
1614
1615 psa1->flags |= (psa2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT));
1616 psa2->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT);
1617
1618 } else if (psa2->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
1619
1620 psa2->flags |= (psa1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT));
1621 psa1->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT);
1622
1623 }
1624 }
1625 }
1626
1627 for(i = 0; i < dacl->num_aces; i++) {
1628 SEC_ACE *psa = &dacl->aces[i];
1629
1630 /*
1631 * Create a cannon_ace entry representing this NT DACL ACE.
1632 */
1633
1634 if ((current_ace = SMB_MALLOC_P(canon_ace)) == NULL) {
1635 free_canon_ace_list(file_ace);
1636 free_canon_ace_list(dir_ace);
1637 DEBUG(0,("create_canon_ace_lists: malloc fail.\n"));
1638 return False;
1639 }
1640
1641 ZERO_STRUCTP(current_ace);
1642
1643 sid_copy(&current_ace->trustee, &psa->trustee);
1644
1645 /*
1646 * Try and work out if the SID is a user or group
1647 * as we need to flag these differently for POSIX.
1648 * Note what kind of a POSIX ACL this should map to.
1649 */
1650
1651 if( sid_equal(&current_ace->trustee, &global_sid_World)) {
1652 current_ace->owner_type = WORLD_ACE;
1653 current_ace->unix_ug.world = -1;
1654 current_ace->type = SMB_ACL_OTHER;
1655 } else if (sid_equal(&current_ace->trustee, &global_sid_Creator_Owner)) {
1656 current_ace->owner_type = UID_ACE;
1657 current_ace->unix_ug.uid = pst->st_ex_uid;
1658 current_ace->type = SMB_ACL_USER_OBJ;
1659
1660 /*
1661 * The Creator Owner entry only specifies inheritable permissions,
1662 * never access permissions. WinNT doesn't always set the ACE to
1663 * INHERIT_ONLY, though.
1664 */
1665
1666 psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
1667
1668 } else if (sid_equal(&current_ace->trustee, &global_sid_Creator_Group)) {
1669 current_ace->owner_type = GID_ACE;
1670 current_ace->unix_ug.gid = pst->st_ex_gid;
1671 current_ace->type = SMB_ACL_GROUP_OBJ;
1672
1673 /*
1674 * The Creator Group entry only specifies inheritable permissions,
1675 * never access permissions. WinNT doesn't always set the ACE to
1676 * INHERIT_ONLY, though.
1677 */
1678 psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
1679
1680 } else if (sid_to_uid( &current_ace->trustee, &current_ace->unix_ug.uid)) {
1681 current_ace->owner_type = UID_ACE;
1682 /* If it's the owning user, this is a user_obj, not
1683 * a user. */
1684 if (current_ace->unix_ug.uid == pst->st_ex_uid) {
1685 current_ace->type = SMB_ACL_USER_OBJ;
1686 } else {
1687 current_ace->type = SMB_ACL_USER;
1688 }
1689 } else if (sid_to_gid( &current_ace->trustee, &current_ace->unix_ug.gid)) {
1690 current_ace->owner_type = GID_ACE;
1691 /* If it's the primary group, this is a group_obj, not
1692 * a group. */
1693 if (current_ace->unix_ug.gid == pst->st_ex_gid) {
1694 current_ace->type = SMB_ACL_GROUP_OBJ;
1695 } else {
1696 current_ace->type = SMB_ACL_GROUP;
1697 }
1698 } else {
1699 /*
1700 * Silently ignore map failures in non-mappable SIDs (NT Authority, BUILTIN etc).
1701 */
1702
1703 if (non_mappable_sid(&psa->trustee)) {
1704 DEBUG(10, ("create_canon_ace_lists: ignoring "
1705 "non-mappable SID %s\n",
1706 sid_string_dbg(&psa->trustee)));
1707 SAFE_FREE(current_ace);
1708 continue;
1709 }
1710
1711 if (lp_force_unknown_acl_user(SNUM(fsp->conn))) {
1712 DEBUG(10, ("create_canon_ace_lists: ignoring "
1713 "unknown or foreign SID %s\n",
1714 sid_string_dbg(&psa->trustee)));
1715 SAFE_FREE(current_ace);
1716 continue;
1717 }
1718
1719 free_canon_ace_list(file_ace);
1720 free_canon_ace_list(dir_ace);
1721 DEBUG(0, ("create_canon_ace_lists: unable to map SID "
1722 "%s to uid or gid.\n",
1723 sid_string_dbg(&current_ace->trustee)));
1724 SAFE_FREE(current_ace);
1725 return False;
1726 }
1727
1728 /*
1729 * Map the given NT permissions into a UNIX mode_t containing only
1730 * S_I(R|W|X)USR bits.
1731 */
1732
1733 current_ace->perms |= map_nt_perms( &psa->access_mask, S_IRUSR);
1734 current_ace->attr = (psa->type == SEC_ACE_TYPE_ACCESS_ALLOWED) ? ALLOW_ACE : DENY_ACE;
1735
1736 /* Store the ace_flag. */
1737 current_ace->ace_flags = psa->flags;
1738
1739 /*
1740 * Now add the created ace to either the file list, the directory
1741 * list, or both. We *MUST* preserve the order here (hence we use
1742 * DLIST_ADD_END) as NT ACLs are order dependent.
1743 */
1744
1745 if (fsp->is_directory) {
1746
1747 /*
1748 * We can only add to the default POSIX ACE list if the ACE is
1749 * designed to be inherited by both files and directories.
1750 */
1751
1752 if ((psa->flags & (SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT)) ==
1753 (SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT)) {
1754
1755 canon_ace *current_dir_ace = current_ace;
1756 DLIST_ADD_END(dir_ace, current_ace, canon_ace *);
1757
1758 /*
1759 * Note if this was an allow ace. We can't process
1760 * any further deny ace's after this.
1761 */
1762
1763 if (current_ace->attr == ALLOW_ACE)
1764 got_dir_allow = True;
1765
1766 if ((current_ace->attr == DENY_ACE) && got_dir_allow) {
1767 DEBUG(0,("create_canon_ace_lists: "
1768 "malformed ACL in "
1769 "inheritable ACL! Deny entry "
1770 "after Allow entry. Failing "
1771 "to set on file %s.\n",
1772 fsp_str_dbg(fsp)));
1773 free_canon_ace_list(file_ace);
1774 free_canon_ace_list(dir_ace);
1775 return False;
1776 }
1777
1778 if( DEBUGLVL( 10 )) {
1779 dbgtext("create_canon_ace_lists: adding dir ACL:\n");
1780 print_canon_ace( current_ace, 0);
1781 }
1782
1783 /*
1784 * If this is not an inherit only ACE we need to add a duplicate
1785 * to the file acl.
1786 */
1787
1788 if (!(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
1789 canon_ace *dup_ace = dup_canon_ace(current_ace);
1790
1791 if (!dup_ace) {
1792 DEBUG(0,("create_canon_ace_lists: malloc fail !\n"));
1793 free_canon_ace_list(file_ace);
1794 free_canon_ace_list(dir_ace);
1795 return False;
1796 }
1797
1798 /*
1799 * We must not free current_ace here as its
1800 * pointer is now owned by the dir_ace list.
1801 */
1802 current_ace = dup_ace;
1803 /* We've essentially split this ace into two,
1804 * and added the ace with inheritance request
1805 * bits to the directory ACL. Drop those bits for
1806 * the ACE we're adding to the file list. */
1807 current_ace->ace_flags &= ~(SEC_ACE_FLAG_OBJECT_INHERIT|
1808 SEC_ACE_FLAG_CONTAINER_INHERIT|
1809 SEC_ACE_FLAG_INHERIT_ONLY);
1810 } else {
1811 /*
1812 * We must not free current_ace here as its
1813 * pointer is now owned by the dir_ace list.
1814 */
1815 current_ace = NULL;
1816 }
1817
1818 /*
1819 * current_ace is now either owned by file_ace
1820 * or is NULL. We can safely operate on current_dir_ace
1821 * to treat mapping for default acl entries differently
1822 * than access acl entries.
1823 */
1824
1825 if (current_dir_ace->owner_type == UID_ACE) {
1826 /*
1827 * We already decided above this is a uid,
1828 * for default acls ace's only CREATOR_OWNER
1829 * maps to ACL_USER_OBJ. All other uid
1830 * ace's are ACL_USER.
1831 */
1832 if (sid_equal(&current_dir_ace->trustee,
1833 &global_sid_Creator_Owner)) {
1834 current_dir_ace->type = SMB_ACL_USER_OBJ;
1835 } else {
1836 current_dir_ace->type = SMB_ACL_USER;
1837 }
1838 }
1839
1840 if (current_dir_ace->owner_type == GID_ACE) {
1841 /*
1842 * We already decided above this is a gid,
1843 * for default acls ace's only CREATOR_GROUP
1844 * maps to ACL_GROUP_OBJ. All other uid
1845 * ace's are ACL_GROUP.
1846 */
1847 if (sid_equal(&current_dir_ace->trustee,
1848 &global_sid_Creator_Group)) {
1849 current_dir_ace->type = SMB_ACL_GROUP_OBJ;
1850 } else {
1851 current_dir_ace->type = SMB_ACL_GROUP;
1852 }
1853 }
1854 }
1855 }
1856
1857 /*
1858 * Only add to the file ACL if not inherit only.
1859 */
1860
1861 if (current_ace && !(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
1862 DLIST_ADD_END(file_ace, current_ace, canon_ace *);
1863
1864 /*
1865 * Note if this was an allow ace. We can't process
1866 * any further deny ace's after this.
1867 */
1868
1869 if (current_ace->attr == ALLOW_ACE)
1870 got_file_allow = True;
1871
1872 if ((current_ace->attr == DENY_ACE) && got_file_allow) {
1873 DEBUG(0,("create_canon_ace_lists: malformed "
1874 "ACL in file ACL ! Deny entry after "
1875 "Allow entry. Failing to set on file "
1876 "%s.\n", fsp_str_dbg(fsp)));
1877 free_canon_ace_list(file_ace);
1878 free_canon_ace_list(dir_ace);
1879 return False;
1880 }
1881
1882 if( DEBUGLVL( 10 )) {
1883 dbgtext("create_canon_ace_lists: adding file ACL:\n");
1884 print_canon_ace( current_ace, 0);
1885 }
1886 all_aces_are_inherit_only = False;
1887 /*
1888 * We must not free current_ace here as its
1889 * pointer is now owned by the file_ace list.
1890 */
1891 current_ace = NULL;
1892 }
1893
1894 /*
1895 * Free if ACE was not added.
1896 */
1897
1898 SAFE_FREE(current_ace);
1899 }
1900
1901 if (fsp->is_directory && all_aces_are_inherit_only) {
1902 /*
1903 * Windows 2000 is doing one of these weird 'inherit acl'
1904 * traverses to conserve NTFS ACL resources. Just pretend
1905 * there was no DACL sent. JRA.
1906 */
1907
1908 DEBUG(10,("create_canon_ace_lists: Win2k inherit acl traverse. Ignoring DACL.\n"));
1909 free_canon_ace_list(file_ace);
1910 free_canon_ace_list(dir_ace);
1911 file_ace = NULL;
1912 dir_ace = NULL;
1913 } else {
1914 /*
1915 * Check if we have SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries in
1916 * the file ACL. If we don't have them, check if any SMB_ACL_USER/SMB_ACL_GROUP
1917 * entries can be converted to *_OBJ. Don't do this for the default
1918 * ACL, we will create them separately for this if needed inside
1919 * ensure_canon_entry_valid().
1920 */
1921 if (file_ace) {
1922 check_owning_objs(file_ace, pfile_owner_sid, pfile_grp_sid);
1923 }
1924 }
1925
1926 *ppfile_ace = file_ace;
1927 *ppdir_ace = dir_ace;
1928
1929 return True;
1930 }
1931
1932 /****************************************************************************
1933 ASCII art time again... JRA :-).
1934
1935 We have 4 cases to process when moving from an NT ACL to a POSIX ACL. Firstly,
1936 we insist the ACL is in canonical form (ie. all DENY entries preceede ALLOW
1937 entries). Secondly, the merge code has ensured that all duplicate SID entries for
1938 allow or deny have been merged, so the same SID can only appear once in the deny
1939 list or once in the allow list.
1940
1941 We then process as follows :
1942
1943 ---------------------------------------------------------------------------
1944 First pass - look for a Everyone DENY entry.
1945
1946 If it is deny all (rwx) trunate the list at this point.
1947 Else, walk the list from this point and use the deny permissions of this
1948 entry as a mask on all following allow entries. Finally, delete
1949 the Everyone DENY entry (we have applied it to everything possible).
1950
1951 In addition, in this pass we remove any DENY entries that have
1952 no permissions (ie. they are a DENY nothing).
1953 ---------------------------------------------------------------------------
1954 Second pass - only deal with deny user entries.
1955
1956 DENY user1 (perms XXX)
1957
1958 new_perms = 0
1959 for all following allow group entries where user1 is in group
1960 new_perms |= group_perms;
1961
1962 user1 entry perms = new_perms & ~ XXX;
1963
1964 Convert the deny entry to an allow entry with the new perms and
1965 push to the end of the list. Note if the user was in no groups
1966 this maps to a specific allow nothing entry for this user.
1967
1968 The common case from the NT ACL choser (userX deny all) is
1969 optimised so we don't do the group lookup - we just map to
1970 an allow nothing entry.
1971
1972 What we're doing here is inferring the allow permissions the
1973 person setting the ACE on user1 wanted by looking at the allow
1974 permissions on the groups the user is currently in. This will
1975 be a snapshot, depending on group membership but is the best
1976 we can do and has the advantage of failing closed rather than
1977 open.
1978 ---------------------------------------------------------------------------
1979 Third pass - only deal with deny group entries.
1980
1981 DENY group1 (perms XXX)
1982
1983 for all following allow user entries where user is in group1
1984 user entry perms = user entry perms & ~ XXX;
1985
1986 If there is a group Everyone allow entry with permissions YYY,
1987 convert the group1 entry to an allow entry and modify its
1988 permissions to be :
1989
1990 new_perms = YYY & ~ XXX
1991
1992 and push to the end of the list.
1993
1994 If there is no group Everyone allow entry then convert the
1995 group1 entry to a allow nothing entry and push to the end of the list.
1996
1997 Note that the common case from the NT ACL choser (groupX deny all)
1998 cannot be optimised here as we need to modify user entries who are
1999 in the group to change them to a deny all also.
2000
2001 What we're doing here is modifying the allow permissions of
2002 user entries (which are more specific in POSIX ACLs) to mask
2003 out the explicit deny set on the group they are in. This will
2004 be a snapshot depending on current group membership but is the
2005 best we can do and has the advantage of failing closed rather
2006 than open.
2007 ---------------------------------------------------------------------------
2008 Fourth pass - cope with cumulative permissions.
2009
2010 for all allow user entries, if there exists an allow group entry with
2011 more permissive permissions, and the user is in that group, rewrite the
2012 allow user permissions to contain both sets of permissions.
2013
2014 Currently the code for this is #ifdef'ed out as these semantics make
2015 no sense to me. JRA.
2016 ---------------------------------------------------------------------------
2017
2018 Note we *MUST* do the deny user pass first as this will convert deny user
2019 entries into allow user entries which can then be processed by the deny
2020 group pass.
2021
2022 The above algorithm took a *lot* of thinking about - hence this
2023 explaination :-). JRA.
2024 ****************************************************************************/
2025
2026 /****************************************************************************
2027 Process a canon_ace list entries. This is very complex code. We need
2028 to go through and remove the "deny" permissions from any allow entry that matches
2029 the id of this entry. We have already refused any NT ACL that wasn't in correct
2030 order (DENY followed by ALLOW). If any allow entry ends up with zero permissions,
2031 we just remove it (to fail safe). We have already removed any duplicate ace
2032 entries. Treat an "Everyone" DENY_ACE as a special case - use it to mask all
2033 allow entries.
2034 ****************************************************************************/
2035
2036 static void process_deny_list( canon_ace **pp_ace_list )
2037 {
2038 canon_ace *ace_list = *pp_ace_list;
2039 canon_ace *curr_ace = NULL;
2040 canon_ace *curr_ace_next = NULL;
2041
2042 /* Pass 1 above - look for an Everyone, deny entry. */
2043
2044 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2045 canon_ace *allow_ace_p;
2046
2047 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2048
2049 if (curr_ace->attr != DENY_ACE)
2050 continue;
2051
2052 if (curr_ace->perms == (mode_t)0) {
2053
2054 /* Deny nothing entry - delete. */
2055
2056 DLIST_REMOVE(ace_list, curr_ace);
2057 continue;
2058 }
2059
2060 if (!sid_equal(&curr_ace->trustee, &global_sid_World))
2061 continue;
2062
2063 /* JRATEST - assert. */
2064 SMB_ASSERT(curr_ace->owner_type == WORLD_ACE);
2065
2066 if (curr_ace->perms == ALL_ACE_PERMS) {
2067
2068 /*
2069 * Optimisation. This is a DENY_ALL to Everyone. Truncate the
2070 * list at this point including this entry.
2071 */
2072
2073 canon_ace *prev_entry = curr_ace->prev;
2074
2075 free_canon_ace_list( curr_ace );
2076 if (prev_entry)
2077 prev_entry->next = NULL;
2078 else {
2079 /* We deleted the entire list. */
2080 ace_list = NULL;
2081 }
2082 break;
2083 }
2084
2085 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2086
2087 /*
2088 * Only mask off allow entries.
2089 */
2090
2091 if (allow_ace_p->attr != ALLOW_ACE)
2092 continue;
2093
2094 allow_ace_p->perms &= ~curr_ace->perms;
2095 }
2096
2097 /*
2098 * Now it's been applied, remove it.
2099 */
2100
2101 DLIST_REMOVE(ace_list, curr_ace);
2102 }
2103
2104 /* Pass 2 above - deal with deny user entries. */
2105
2106 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2107 mode_t new_perms = (mode_t)0;
2108 canon_ace *allow_ace_p;
2109
2110 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2111
2112 if (curr_ace->attr != DENY_ACE)
2113 continue;
2114
2115 if (curr_ace->owner_type != UID_ACE)
2116 continue;
2117
2118 if (curr_ace->perms == ALL_ACE_PERMS) {
2119
2120 /*
2121 * Optimisation - this is a deny everything to this user.
2122 * Convert to an allow nothing and push to the end of the list.
2123 */
2124
2125 curr_ace->attr = ALLOW_ACE;
2126 curr_ace->perms = (mode_t)0;
2127 DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2128 continue;
2129 }
2130
2131 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2132
2133 if (allow_ace_p->attr != ALLOW_ACE)
2134 continue;
2135
2136 /* We process GID_ACE and WORLD_ACE entries only. */
2137
2138 if (allow_ace_p->owner_type == UID_ACE)
2139 continue;
2140
2141 if (uid_entry_in_group( curr_ace, allow_ace_p))
2142 new_perms |= allow_ace_p->perms;
2143 }
2144
2145 /*
2146 * Convert to a allow entry, modify the perms and push to the end
2147 * of the list.
2148 */
2149
2150 curr_ace->attr = ALLOW_ACE;
2151 curr_ace->perms = (new_perms & ~curr_ace->perms);
2152 DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2153 }
2154
2155 /* Pass 3 above - deal with deny group entries. */
2156
2157 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2158 canon_ace *allow_ace_p;
2159 canon_ace *allow_everyone_p = NULL;
2160
2161 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2162
2163 if (curr_ace->attr != DENY_ACE)
2164 continue;
2165
2166 if (curr_ace->owner_type != GID_ACE)
2167 continue;
2168
2169 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2170
2171 if (allow_ace_p->attr != ALLOW_ACE)
2172 continue;
2173
2174 /* Store a pointer to the Everyone allow, if it exists. */
2175 if (allow_ace_p->owner_type == WORLD_ACE)
2176 allow_everyone_p = allow_ace_p;
2177
2178 /* We process UID_ACE entries only. */
2179
2180 if (allow_ace_p->owner_type != UID_ACE)
2181 continue;
2182
2183 /* Mask off the deny group perms. */
2184
2185 if (uid_entry_in_group( allow_ace_p, curr_ace))
2186 allow_ace_p->perms &= ~curr_ace->perms;
2187 }
2188
2189 /*
2190 * Convert the deny to an allow with the correct perms and
2191 * push to the end of the list.
2192 */
2193
2194 curr_ace->attr = ALLOW_ACE;
2195 if (allow_everyone_p)
2196 curr_ace->perms = allow_everyone_p->perms & ~curr_ace->perms;
2197 else
2198 curr_ace->perms = (mode_t)0;
2199 DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2200 }
2201
2202 /* Doing this fourth pass allows Windows semantics to be layered
2203 * on top of POSIX semantics. I'm not sure if this is desirable.
2204 * For example, in W2K ACLs there is no way to say, "Group X no
2205 * access, user Y full access" if user Y is a member of group X.
2206 * This seems completely broken semantics to me.... JRA.
2207 */
2208
2209 #if 0
2210 /* Pass 4 above - deal with allow entries. */
2211
2212 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2213 canon_ace *allow_ace_p;
2214
2215 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2216
2217 if (curr_ace->attr != ALLOW_ACE)
2218 continue;
2219
2220 if (curr_ace->owner_type != UID_ACE)
2221 continue;
2222
2223 for (allow_ace_p = ace_list; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2224
2225 if (allow_ace_p->attr != ALLOW_ACE)
2226 continue;
2227
2228 /* We process GID_ACE entries only. */
2229
2230 if (allow_ace_p->owner_type != GID_ACE)
2231 continue;
2232
2233 /* OR in the group perms. */
2234
2235 if (uid_entry_in_group( curr_ace, allow_ace_p))
2236 curr_ace->perms |= allow_ace_p->perms;
2237 }
2238 }
2239 #endif
2240
2241 *pp_ace_list = ace_list;
2242 }
2243
2244 /****************************************************************************
2245 Unpack a SEC_DESC into two canonical ace lists. We don't depend on this
2246 succeeding.
2247 ****************************************************************************/
2248
2249 static bool unpack_canon_ace(files_struct *fsp,
2250 const SMB_STRUCT_STAT *pst,
2251 DOM_SID *pfile_owner_sid,
2252 DOM_SID *pfile_grp_sid,
2253 canon_ace **ppfile_ace,
2254 canon_ace **ppdir_ace,
2255 uint32 security_info_sent,
2256 const SEC_DESC *psd)
2257 {
2258 canon_ace *file_ace = NULL;
2259 canon_ace *dir_ace = NULL;
2260
2261 *ppfile_ace = NULL;
2262 *ppdir_ace = NULL;
2263
2264 if(security_info_sent == 0) {
2265 DEBUG(0,("unpack_canon_ace: no security info sent !\n"));
2266 return False;
2267 }
2268
2269 /*
2270 * If no DACL then this is a chown only security descriptor.
2271 */
2272
2273 if(!(security_info_sent & DACL_SECURITY_INFORMATION) || !psd->dacl)
2274 return True;
2275
2276 /*
2277 * Now go through the DACL and create the canon_ace lists.
2278 */
2279
2280 if (!create_canon_ace_lists( fsp, pst, pfile_owner_sid, pfile_grp_sid,
2281 &file_ace, &dir_ace, psd->dacl))
2282 return False;
2283
2284 if ((file_ace == NULL) && (dir_ace == NULL)) {
2285 /* W2K traverse DACL set - ignore. */
2286 return True;
2287 }
2288
2289 /*
2290 * Go through the canon_ace list and merge entries
2291 * belonging to identical users of identical allow or deny type.
2292 * We can do this as all deny entries come first, followed by
2293 * all allow entries (we have mandated this before accepting this acl).
2294 */
2295
2296 print_canon_ace_list( "file ace - before merge", file_ace);
2297 merge_aces( &file_ace, false);
2298
2299 print_canon_ace_list( "dir ace - before merge", dir_ace);
2300 merge_aces( &dir_ace, true);
2301
2302 /*
2303 * NT ACLs are order dependent. Go through the acl lists and
2304 * process DENY entries by masking the allow entries.
2305 */
2306
2307 print_canon_ace_list( "file ace - before deny", file_ace);
2308 process_deny_list( &file_ace);
2309
2310 print_canon_ace_list( "dir ace - before deny", dir_ace);
2311 process_deny_list( &dir_ace);
2312
2313 /*
2314 * A well formed POSIX file or default ACL has at least 3 entries, a
2315 * SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ
2316 * and optionally a mask entry. Ensure this is the case.
2317 */
2318
2319 print_canon_ace_list( "file ace - before valid", file_ace);
2320
2321 if (!ensure_canon_entry_valid(&file_ace, fsp->conn->params,
2322 fsp->is_directory, pfile_owner_sid, pfile_grp_sid, pst, True)) {
2323 free_canon_ace_list(file_ace);
2324 free_canon_ace_list(dir_ace);
2325 return False;
2326 }
2327
2328 print_canon_ace_list( "dir ace - before valid", dir_ace);
2329
2330 if (dir_ace && !ensure_canon_entry_valid(&dir_ace, fsp->conn->params,
2331 fsp->is_directory, pfile_owner_sid, pfile_grp_sid, pst, True)) {
2332 free_canon_ace_list(file_ace);
2333 free_canon_ace_list(dir_ace);
2334 return False;
2335 }
2336
2337 print_canon_ace_list( "file ace - return", file_ace);
2338 print_canon_ace_list( "dir ace - return", dir_ace);
2339
2340 *ppfile_ace = file_ace;
2341 *ppdir_ace = dir_ace;
2342 return True;
2343
2344 }
2345
2346 /******************************************************************************
2347 When returning permissions, try and fit NT display
2348 semantics if possible. Note the the canon_entries here must have been malloced.
2349 The list format should be - first entry = owner, followed by group and other user
2350 entries, last entry = other.
2351
2352 Note that this doesn't exactly match the NT semantics for an ACL. As POSIX entries
2353 are not ordered, and match on the most specific entry rather than walking a list,
2354 then a simple POSIX permission of rw-r--r-- should really map to 5 entries,
2355
2356 Entry 0: owner : deny all except read and write.
2357 Entry 1: owner : allow read and write.
2358 Entry 2: group : deny all except read.
2359 Entry 3: group : allow read.
2360 Entry 4: Everyone : allow read.
2361
2362 But NT cannot display this in their ACL editor !
2363 ********************************************************************************/
2364
2365 static void arrange_posix_perms(const char *filename, canon_ace **pp_list_head)
2366 {
2367 canon_ace *l_head = *pp_list_head;
2368 canon_ace *owner_ace = NULL;
2369 canon_ace *other_ace = NULL;
2370 canon_ace *ace = NULL;
2371
2372 for (ace = l_head; ace; ace = ace->next) {
2373 if (ace->type == SMB_ACL_USER_OBJ)
2374 owner_ace = ace;
2375 else if (ace->type == SMB_ACL_OTHER) {
2376 /* Last ace - this is "other" */
2377 other_ace = ace;
2378 }
2379 }
2380
2381 if (!owner_ace || !other_ace) {
2382 DEBUG(0,("arrange_posix_perms: Invalid POSIX permissions for file %s, missing owner or other.\n",
2383 filename ));
2384 return;
2385 }
2386
2387 /*
2388 * The POSIX algorithm applies to owner first, and other last,
2389 * so ensure they are arranged in this order.
2390 */
2391
2392 if (owner_ace) {
2393 DLIST_PROMOTE(l_head, owner_ace);
2394 }
2395
2396 if (other_ace) {
2397 DLIST_DEMOTE(l_head, other_ace, canon_ace *);
2398 }
2399
2400 /* We have probably changed the head of the list. */
2401
2402 *pp_list_head = l_head;
2403 }
2404
2405 /****************************************************************************
2406 Create a linked list of canonical ACE entries.
2407 ****************************************************************************/
2408
2409 static canon_ace *canonicalise_acl(struct connection_struct *conn,
2410 const char *fname, SMB_ACL_T posix_acl,
2411 const SMB_STRUCT_STAT *psbuf,
2412 const DOM_SID *powner, const DOM_SID *pgroup, struct pai_val *pal, SMB_ACL_TYPE_T the_acl_type)
2413 {
2414 mode_t acl_mask = (S_IRUSR|S_IWUSR|S_IXUSR);
2415 canon_ace *l_head = NULL;
2416 canon_ace *ace = NULL;
2417 canon_ace *next_ace = NULL;
2418 int entry_id = SMB_ACL_FIRST_ENTRY;
2419 bool is_default_acl = (the_acl_type == SMB_ACL_TYPE_DEFAULT);
2420 SMB_ACL_ENTRY_T entry;
2421 size_t ace_count;
2422
2423 while ( posix_acl && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1)) {
2424 SMB_ACL_TAG_T tagtype;
2425 SMB_ACL_PERMSET_T permset;
2426 DOM_SID sid;
2427 posix_id unix_ug;
2428 enum ace_owner owner_type;
2429
2430 entry_id = SMB_ACL_NEXT_ENTRY;
2431
2432 /* Is this a MASK entry ? */
2433 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1)
2434 continue;
2435
2436 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1)
2437 continue;
2438
2439 /* Decide which SID to use based on the ACL type. */
2440 switch(tagtype) {
2441 case SMB_ACL_USER_OBJ:
2442 /* Get the SID from the owner. */
2443 sid_copy(&sid, powner);
2444 unix_ug.uid = psbuf->st_ex_uid;
2445 owner_type = UID_ACE;
2446 break;
2447 case SMB_ACL_USER:
2448 {
2449 uid_t *puid = (uid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
2450 if (puid == NULL) {
2451 DEBUG(0,("canonicalise_acl: Failed to get uid.\n"));
2452 continue;
2453 }
2454 uid_to_sid( &sid, *puid);
2455 unix_ug.uid = *puid;
2456 owner_type = UID_ACE;
2457 SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)puid,tagtype);
2458 break;
2459 }
2460 case SMB_ACL_GROUP_OBJ:
2461 /* Get the SID from the owning group. */
2462 sid_copy(&sid, pgroup);
2463 unix_ug.gid = psbuf->st_ex_gid;
2464 owner_type = GID_ACE;
2465 break;
2466 case SMB_ACL_GROUP:
2467 {
2468 gid_t *pgid = (gid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
2469 if (pgid == NULL) {
2470 DEBUG(0,("canonicalise_acl: Failed to get gid.\n"));
2471 continue;
2472 }
2473 gid_to_sid( &sid, *pgid);
2474 unix_ug.gid = *pgid;
2475 owner_type = GID_ACE;
2476 SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)pgid,tagtype);
2477 break;
2478 }
2479 case SMB_ACL_MASK:
2480 acl_mask = convert_permset_to_mode_t(conn, permset);
2481 continue; /* Don't count the mask as an entry. */
2482 case SMB_ACL_OTHER:
2483 /* Use the Everyone SID */
2484 sid = global_sid_World;
2485 unix_ug.world = -1;
2486 owner_type = WORLD_ACE;
2487 break;
2488 default:
2489 DEBUG(0,("canonicalise_acl: Unknown tagtype %u\n", (unsigned int)tagtype));
2490 continue;
2491 }
2492
2493 /*
2494 * Add this entry to the list.
2495 */
2496
2497 if ((ace = SMB_MALLOC_P(canon_ace)) == NULL)
2498 goto fail;
2499
2500 ZERO_STRUCTP(ace);
2501 ace->type = tagtype;
2502 ace->perms = convert_permset_to_mode_t(conn, permset);
2503 ace->attr = ALLOW_ACE;
2504 ace->trustee = sid;
2505 ace->unix_ug = unix_ug;
2506 ace->owner_type = owner_type;
2507 ace->ace_flags = get_pai_flags(pal, ace, is_default_acl);
2508
2509 DLIST_ADD(l_head, ace);
2510 }
2511
2512 /*
2513 * This next call will ensure we have at least a user/group/world set.
2514 */
2515
2516 if (!ensure_canon_entry_valid(&l_head, conn->params,
2517 S_ISDIR(psbuf->st_ex_mode), powner, pgroup,
2518 psbuf, False))
2519 goto fail;
2520
2521 /*
2522 * Now go through the list, masking the permissions with the
2523 * acl_mask. Ensure all DENY Entries are at the start of the list.
2524 */
2525
2526 DEBUG(10,("canonicalise_acl: %s ace entries before arrange :\n", is_default_acl ? "Default" : "Access"));
2527
2528 for ( ace_count = 0, ace = l_head; ace; ace = next_ace, ace_count++) {
2529 next_ace = ace->next;
2530
2531 /* Masks are only applied to entries other than USER_OBJ and OTHER. */
2532 if (ace->type != SMB_ACL_OTHER && ace->type != SMB_ACL_USER_OBJ)
2533 ace->perms &= acl_mask;
2534
2535 if (ace->perms == 0) {
2536 DLIST_PROMOTE(l_head, ace);
2537 }
2538
2539 if( DEBUGLVL( 10 ) ) {
2540 print_canon_ace(ace, ace_count);
2541 }
2542 }
2543
2544 arrange_posix_perms(fname,&l_head );
2545
2546 print_canon_ace_list( "canonicalise_acl: ace entries after arrange", l_head );
2547
2548 return l_head;
2549
2550 fail:
2551
2552 free_canon_ace_list(l_head);
2553 return NULL;
2554 }
2555
2556 /****************************************************************************
2557 Check if the current user group list contains a given group.
2558 ****************************************************************************/
2559
2560 bool current_user_in_group(gid_t gid)
2561 {
2562 int i;
2563
2564 for (i = 0; i < current_user.ut.ngroups; i++) {
2565 if (current_user.ut.groups[i] == gid) {
2566 return True;
2567 }
2568 }
2569
2570 return False;
2571 }
2572
2573 /****************************************************************************
2574 Should we override a deny ? Check 'acl group control' and 'dos filemode'.
2575 ****************************************************************************/
2576
2577 static bool acl_group_override(connection_struct *conn,
2578 const struct smb_filename *smb_fname)
2579 {
2580 if ((errno != EPERM) && (errno != EACCES)) {
2581 return false;
2582 }
2583
2584 /* file primary group == user primary or supplementary group */
2585 if (lp_acl_group_control(SNUM(conn)) &&
2586 current_user_in_group(smb_fname->st.st_ex_gid)) {
2587 return true;
2588 }
2589
2590 /* user has writeable permission */
2591 if (lp_dos_filemode(SNUM(conn)) &&
2592 can_write_to_file(conn, smb_fname)) {
2593 return true;
2594 }
2595
2596 return false;
2597 }
2598
2599 /****************************************************************************
2600 Attempt to apply an ACL to a file or directory.
2601 ****************************************************************************/
2602
2603 static bool set_canon_ace_list(files_struct *fsp,
2604 canon_ace *the_ace,
2605 bool default_ace,
2606 const SMB_STRUCT_STAT *psbuf,
2607 bool *pacl_set_support)
2608 {
2609 connection_struct *conn = fsp->conn;
2610 bool ret = False;
2611 SMB_ACL_T the_acl = SMB_VFS_SYS_ACL_INIT(conn, (int)count_canon_ace_list(the_ace) + 1);
2612 canon_ace *p_ace;
2613 int i;
2614 SMB_ACL_ENTRY_T mask_entry;
2615 bool got_mask_entry = False;
2616 SMB_ACL_PERMSET_T mask_permset;
2617 SMB_ACL_TYPE_T the_acl_type = (default_ace ? SMB_ACL_TYPE_DEFAULT : SMB_ACL_TYPE_ACCESS);
2618 bool needs_mask = False;
2619 mode_t mask_perms = 0;
2620
2621 /* Use the psbuf that was passed in. */
2622 if (psbuf != &fsp->fsp_name->st) {
2623 fsp->fsp_name->st = *psbuf;
2624 }
2625
2626 #if defined(POSIX_ACL_NEEDS_MASK)
2627 /* HP-UX always wants to have a mask (called "class" there). */
2628 needs_mask = True;
2629 #endif
2630
2631 if (the_acl == NULL) {
2632
2633 if (!no_acl_syscall_error(errno)) {
2634 /*
2635 * Only print this error message if we have some kind of ACL
2636 * support that's not working. Otherwise we would always get this.
2637 */
2638 DEBUG(0,("set_canon_ace_list: Unable to init %s ACL. (%s)\n",
2639 default_ace ? "default" : "file", strerror(errno) ));
2640 }
2641 *pacl_set_support = False;
2642 goto fail;
2643 }
2644
2645 if( DEBUGLVL( 10 )) {
2646 dbgtext("set_canon_ace_list: setting ACL:\n");
2647 for (i = 0, p_ace = the_ace; p_ace; p_ace = p_ace->next, i++ ) {
2648 print_canon_ace( p_ace, i);
2649 }
2650 }
2651
2652 for (i = 0, p_ace = the_ace; p_ace; p_ace = p_ace->next, i++ ) {
2653 SMB_ACL_ENTRY_T the_entry;
2654 SMB_ACL_PERMSET_T the_permset;
2655
2656 /*
2657 * ACLs only "need" an ACL_MASK entry if there are any named user or
2658 * named group entries. But if there is an ACL_MASK entry, it applies
2659 * to ACL_USER, ACL_GROUP, and ACL_GROUP_OBJ entries. Set the mask
2660 * so that it doesn't deny (i.e., mask off) any permissions.
2661 */
2662
2663 if (p_ace->type == SMB_ACL_USER || p_ace->type == SMB_ACL_GROUP) {
2664 needs_mask = True;
2665 mask_perms |= p_ace->perms;
2666 } else if (p_ace->type == SMB_ACL_GROUP_OBJ) {
2667 mask_perms |= p_ace->perms;
2668 }
2669
2670 /*
2671 * Get the entry for this ACE.
2672 */
2673
2674 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &the_entry) == -1) {
2675 DEBUG(0,("set_canon_ace_list: Failed to create entry %d. (%s)\n",
2676 i, strerror(errno) ));
2677 goto fail;
2678 }
2679
2680 if (p_ace->type == SMB_ACL_MASK) {
2681 mask_entry = the_entry;
2682 got_mask_entry = True;
2683 }
2684
2685 /*
2686 * Ok - we now know the ACL calls should be working, don't
2687 * allow fallback to chmod.
2688 */
2689
2690 *pacl_set_support = True;
2691
2692 /*
2693 * Initialise the entry from the canon_ace.
2694 */
2695
2696 /*
2697 * First tell the entry what type of ACE this is.
2698 */
2699
2700 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, the_entry, p_ace->type) == -1) {
2701 DEBUG(0,("set_canon_ace_list: Failed to set tag type on entry %d. (%s)\n",
2702 i, strerror(errno) ));
2703 goto fail;
2704 }
2705
2706 /*
2707 * Only set the qualifier (user or group id) if the entry is a user
2708 * or group id ACE.
2709 */
2710
2711 if ((p_ace->type == SMB_ACL_USER) || (p_ace->type == SMB_ACL_GROUP)) {
2712 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&p_ace->unix_ug.uid) == -1) {
2713 DEBUG(0,("set_canon_ace_list: Failed to set qualifier on entry %d. (%s)\n",
2714 i, strerror(errno) ));
2715 goto fail;
2716 }
2717 }
2718
2719 /*
2720 * Convert the mode_t perms in the canon_ace to a POSIX permset.
2721 */
2722
2723 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, the_entry, &the_permset) == -1) {
2724 DEBUG(0,("set_canon_ace_list: Failed to get permset on entry %d. (%s)\n",
2725 i, strerror(errno) ));
2726 goto fail;
2727 }
2728
2729 if (map_acl_perms_to_permset(conn, p_ace->perms, &the_permset) == -1) {
2730 DEBUG(0,("set_canon_ace_list: Failed to create permset for mode (%u) on entry %d. (%s)\n",
2731 (unsigned int)p_ace->perms, i, strerror(errno) ));
2732 goto fail;
2733 }
2734
2735 /*
2736 * ..and apply them to the entry.
2737 */
2738
2739 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, the_entry, the_permset) == -1) {
2740 DEBUG(0,("set_canon_ace_list: Failed to add permset on entry %d. (%s)\n",
2741 i, strerror(errno) ));
2742 goto fail;
2743 }
2744
2745 if( DEBUGLVL( 10 ))
2746 print_canon_ace( p_ace, i);
2747
2748 }
2749
2750 if (needs_mask && !got_mask_entry) {
2751 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &mask_entry) == -1) {
2752 DEBUG(0,("set_canon_ace_list: Failed to create mask entry. (%s)\n", strerror(errno) ));
2753 goto fail;
2754 }
2755
2756 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, mask_entry, SMB_ACL_MASK) == -1) {
2757 DEBUG(0,("set_canon_ace_list: Failed to set tag type on mask entry. (%s)\n",strerror(errno) ));
2758 goto fail;
2759 }
2760
2761 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, mask_entry, &mask_permset) == -1) {
2762 DEBUG(0,("set_canon_ace_list: Failed to get mask permset. (%s)\n", strerror(errno) ));
2763 goto fail;
2764 }
2765
2766 if (map_acl_perms_to_permset(conn, S_IRUSR|S_IWUSR|S_IXUSR, &mask_permset) == -1) {
2767 DEBUG(0,("set_canon_ace_list: Failed to create mask permset. (%s)\n", strerror(errno) ));
2768 goto fail;
2769 }
2770
2771 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, mask_entry, mask_permset) == -1) {
2772 DEBUG(0,("set_canon_ace_list: Failed to add mask permset. (%s)\n", strerror(errno) ));
2773 goto fail;
2774 }
2775 }
2776
2777 /*
2778 * Finally apply it to the file or directory.
2779 */
2780
2781 if(default_ace || fsp->is_directory || fsp->fh->fd == -1) {
2782 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fsp->fsp_name->base_name,
2783 the_acl_type, the_acl) == -1) {
2784 /*
2785 * Some systems allow all the above calls and only fail with no ACL support
2786 * when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
2787 */
2788 if (no_acl_syscall_error(errno)) {
2789 *pacl_set_support = False;
2790 }
2791
2792 if (acl_group_override(conn, fsp->fsp_name)) {
2793 int sret;
2794
2795 DEBUG(5,("set_canon_ace_list: acl group "
2796 "control on and current user in file "
2797 "%s primary group.\n",
2798 fsp_str_dbg(fsp)));
2799
2800 become_root();
2801 sret = SMB_VFS_SYS_ACL_SET_FILE(conn,
2802 fsp->fsp_name->base_name, the_acl_type,
2803 the_acl);
2804 unbecome_root();
2805 if (sret == 0) {
2806 ret = True;
2807 }
2808 }
2809
2810 if (ret == False) {
2811 DEBUG(2,("set_canon_ace_list: "
2812 "sys_acl_set_file type %s failed for "
2813 "file %s (%s).\n",
2814 the_acl_type == SMB_ACL_TYPE_DEFAULT ?
2815 "directory default" : "file",
2816 fsp_str_dbg(fsp), strerror(errno)));
2817 goto fail;
2818 }
2819 }
2820 } else {
2821 if (SMB_VFS_SYS_ACL_SET_FD(fsp, the_acl) == -1) {
2822 /*
2823 * Some systems allow all the above calls and only fail with no ACL support
2824 * when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
2825 */
2826 if (no_acl_syscall_error(errno)) {
2827 *pacl_set_support = False;
2828 }
2829
2830 if (acl_group_override(conn, fsp->fsp_name)) {
2831 int sret;
2832
2833 DEBUG(5,("set_canon_ace_list: acl group "
2834 "control on and current user in file "
2835 "%s primary group.\n",
2836 fsp_str_dbg(fsp)));
2837
2838 become_root();
2839 sret = SMB_VFS_SYS_ACL_SET_FD(fsp, the_acl);
2840 unbecome_root();
2841 if (sret == 0) {
2842 ret = True;
2843 }
2844 }
2845
2846 if (ret == False) {
2847 DEBUG(2,("set_canon_ace_list: "
2848 "sys_acl_set_file failed for file %s "
2849 "(%s).\n",
2850 fsp_str_dbg(fsp), strerror(errno)));
2851 goto fail;
2852 }
2853 }
2854 }
2855
2856 ret = True;
2857
2858 fail:
2859
2860 if (the_acl != NULL) {
2861 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
2862 }
2863
2864 return ret;
2865 }
2866
2867 /****************************************************************************
2868 Find a particular canon_ace entry.
2869 ****************************************************************************/
2870
2871 static struct canon_ace *canon_ace_entry_for(struct canon_ace *list, SMB_ACL_TAG_T type, posix_id *id)
2872 {
2873 while (list) {
2874 if (list->type == type && ((type != SMB_ACL_USER && type != SMB_ACL_GROUP) ||
2875 (type == SMB_ACL_USER && id && id->uid == list->unix_ug.uid) ||
2876 (type == SMB_ACL_GROUP && id && id->gid == list->unix_ug.gid)))
2877 break;
2878 list = list->next;
2879 }
2880 return list;
2881 }
2882
2883 /****************************************************************************
2884
2885 ****************************************************************************/
2886
2887 SMB_ACL_T free_empty_sys_acl(connection_struct *conn, SMB_ACL_T the_acl)
2888 {
2889 SMB_ACL_ENTRY_T entry;
2890
2891 if (!the_acl)
2892 return NULL;
2893 if (SMB_VFS_SYS_ACL_GET_ENTRY(conn, the_acl, SMB_ACL_FIRST_ENTRY, &entry) != 1) {
2894 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
2895 return NULL;
2896 }
2897 return the_acl;
2898 }
2899
2900 /****************************************************************************
2901 Convert a canon_ace to a generic 3 element permission - if possible.
2902 ****************************************************************************/
2903
2904 #define MAP_PERM(p,mask,result) (((p) & (mask)) ? (result) : 0 )
2905
2906 static bool convert_canon_ace_to_posix_perms( files_struct *fsp, canon_ace *file_ace_list, mode_t *posix_perms)
2907 {
2908 int snum = SNUM(fsp->conn);
2909 size_t ace_count = count_canon_ace_list(file_ace_list);
2910 canon_ace *ace_p;
2911 canon_ace *owner_ace = NULL;
2912 canon_ace *group_ace = NULL;
2913 canon_ace *other_ace = NULL;
2914 mode_t and_bits;
2915 mode_t or_bits;
2916
2917 if (ace_count != 3) {
2918 DEBUG(3,("convert_canon_ace_to_posix_perms: Too many ACE "
2919 "entries for file %s to convert to posix perms.\n",
2920 fsp_str_dbg(fsp)));
2921 return False;
2922 }
2923
2924 for (ace_p = file_ace_list; ace_p; ace_p = ace_p->next) {
2925 if (ace_p->owner_type == UID_ACE)
2926 owner_ace = ace_p;
2927 else if (ace_p->owner_type == GID_ACE)
2928 group_ace = ace_p;
2929 else if (ace_p->owner_type == WORLD_ACE)
2930 other_ace = ace_p;
2931 }
2932
2933 if (!owner_ace || !group_ace || !other_ace) {
2934 DEBUG(3,("convert_canon_ace_to_posix_perms: Can't get "
2935 "standard entries for file %s.\n", fsp_str_dbg(fsp)));
2936 return False;
2937 }
2938
2939 *posix_perms = (mode_t)0;
2940
2941 *posix_perms |= owner_ace->perms;
2942 *posix_perms |= MAP_PERM(group_ace->perms, S_IRUSR, S_IRGRP);
2943 *posix_perms |= MAP_PERM(group_ace->perms, S_IWUSR, S_IWGRP);
2944 *posix_perms |= MAP_PERM(group_ace->perms, S_IXUSR, S_IXGRP);
2945 *posix_perms |= MAP_PERM(other_ace->perms, S_IRUSR, S_IROTH);
2946 *posix_perms |= MAP_PERM(other_ace->perms, S_IWUSR, S_IWOTH);
2947 *posix_perms |= MAP_PERM(other_ace->perms, S_IXUSR, S_IXOTH);
2948
2949 /* The owner must have at least read access. */
2950
2951 *posix_perms |= S_IRUSR;
2952 if (fsp->is_directory)
2953 *posix_perms |= (S_IWUSR|S_IXUSR);
2954
2955 /* If requested apply the masks. */
2956
2957 /* Get the initial bits to apply. */
2958
2959 if (fsp->is_directory) {
2960 and_bits = lp_dir_security_mask(snum);
2961 or_bits = lp_force_dir_security_mode(snum);
2962 } else {
2963 and_bits = lp_security_mask(snum);
2964 or_bits = lp_force_security_mode(snum);
2965 }
2966
2967 *posix_perms = (((*posix_perms) & and_bits)|or_bits);
2968
2969 DEBUG(10,("convert_canon_ace_to_posix_perms: converted u=%o,g=%o,w=%o "
2970 "to perm=0%o for file %s.\n", (int)owner_ace->perms,
2971 (int)group_ace->perms, (int)other_ace->perms,
2972 (int)*posix_perms, fsp_str_dbg(fsp)));
2973
2974 return True;
2975 }
2976
2977 /****************************************************************************
2978 Incoming NT ACLs on a directory can be split into a default POSIX acl (CI|OI|IO) and
2979 a normal POSIX acl. Win2k needs these split acls re-merging into one ACL
2980 with CI|OI set so it is inherited and also applies to the directory.
2981 Based on code from "Jim McDonough" <jmcd@us.ibm.com>.
2982 ****************************************************************************/
2983
2984 static size_t merge_default_aces( SEC_ACE *nt_ace_list, size_t num_aces)
2985 {
2986 size_t i, j;
2987
2988 for (i = 0; i < num_aces; i++) {
2989 for (j = i+1; j < num_aces; j++) {
2990 uint32 i_flags_ni = (nt_ace_list[i].flags & ~SEC_ACE_FLAG_INHERITED_ACE);
2991 uint32 j_flags_ni = (nt_ace_list[j].flags & ~SEC_ACE_FLAG_INHERITED_ACE);
2992 bool i_inh = (nt_ace_list[i].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False;
2993 bool j_inh = (nt_ace_list[j].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False;
2994
2995 /* We know the lower number ACE's are file entries. */
2996 if ((nt_ace_list[i].type == nt_ace_list[j].type) &&
2997 (nt_ace_list[i].size == nt_ace_list[j].size) &&
2998 (nt_ace_list[i].access_mask == nt_ace_list[j].access_mask) &&
2999 sid_equal(&nt_ace_list[i].trustee, &nt_ace_list[j].trustee) &&
3000 (i_inh == j_inh) &&
3001 (i_flags_ni == 0) &&
3002 (j_flags_ni == (SEC_ACE_FLAG_OBJECT_INHERIT|
3003 SEC_ACE_FLAG_CONTAINER_INHERIT|
3004 SEC_ACE_FLAG_INHERIT_ONLY))) {
3005 /*
3006 * W2K wants to have access allowed zero access ACE's
3007 * at the end of the list. If the mask is zero, merge
3008 * the non-inherited ACE onto the inherited ACE.
3009 */
3010
3011 if (nt_ace_list[i].access_mask == 0) {
3012 nt_ace_list[j].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
3013 (i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0);
3014 if (num_aces - i - 1 > 0)
3015 memmove(&nt_ace_list[i], &nt_ace_list[i+1], (num_aces-i-1) *
3016 sizeof(SEC_ACE));
3017
3018 DEBUG(10,("merge_default_aces: Merging zero access ACE %u onto ACE %u.\n",
3019 (unsigned int)i, (unsigned int)j ));
3020 } else {
3021 /*
3022 * These are identical except for the flags.
3023 * Merge the inherited ACE onto the non-inherited ACE.
3024 */
3025
3026 nt_ace_list[i].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
3027 (i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0);
3028 if (num_aces - j - 1 > 0)
3029 memmove(&nt_ace_list[j], &nt_ace_list[j+1], (num_aces-j-1) *
3030 sizeof(SEC_ACE));
3031
3032 DEBUG(10,("merge_default_aces: Merging ACE %u onto ACE %u.\n",
3033 (unsigned int)j, (unsigned int)i ));
3034 }
3035 num_aces--;
3036 break;
3037 }
3038 }
3039 }
3040
3041 return num_aces;
3042 }
3043
3044 /*
3045 * Add or Replace ACE entry.
3046 * In some cases we need to add a specific ACE for compatibility reasons.
3047 * When doing that we must make sure we are not actually creating a duplicate
3048 * entry. So we need to search whether an ACE entry already exist and eventually
3049 * replacce the access mask, or add a completely new entry if none was found.
3050 *
3051 * This function assumes the array has enough space to add a new entry without
3052 * any reallocation of memory.
3053 */
3054
3055 static void add_or_replace_ace(SEC_ACE *nt_ace_list, size_t *num_aces,
3056 const DOM_SID *sid, enum security_ace_type type,
3057 uint32_t mask, uint8_t flags)
3058 {
3059 int i;
3060
3061 /* first search for a duplicate */
3062 for (i = 0; i < *num_aces; i++) {
3063 if (sid_equal(&nt_ace_list[i].trustee, sid) &&
3064 (nt_ace_list[i].flags == flags)) break;
3065 }
3066
3067 if (i < *num_aces) { /* found */
3068 nt_ace_list[i].type = type;
3069 nt_ace_list[i].access_mask = mask;
3070 DEBUG(10, ("Replacing ACE %d with SID %s and flags %02x\n",
3071 i, sid_string_dbg(sid), flags));
3072 return;
3073 }
3074
3075 /* not found, append it */
3076 init_sec_ace(&nt_ace_list[(*num_aces)++], sid, type, mask, flags);
3077 }
3078
3079
3080 /****************************************************************************
3081 Reply to query a security descriptor from an fsp. If it succeeds it allocates
3082 the space for the return elements and returns the size needed to return the
3083 security descriptor. This should be the only external function needed for
3084 the UNIX style get ACL.
3085 ****************************************************************************/
3086
3087 static NTSTATUS posix_get_nt_acl_common(struct connection_struct *conn,
3088 const char *name,
3089 const SMB_STRUCT_STAT *sbuf,
3090 struct pai_val *pal,
3091 SMB_ACL_T posix_acl,
3092 SMB_ACL_T def_acl,
3093 uint32_t security_info,
3094 SEC_DESC **ppdesc)
3095 {
3096 DOM_SID owner_sid;
3097 DOM_SID group_sid;
3098 size_t sd_size = 0;
3099 SEC_ACL *psa = NULL;
3100 size_t num_acls = 0;
3101 size_t num_def_acls = 0;
3102 size_t num_aces = 0;
3103 canon_ace *file_ace = NULL;
3104 canon_ace *dir_ace = NULL;
3105 SEC_ACE *nt_ace_list = NULL;
3106 size_t num_profile_acls = 0;
3107 DOM_SID orig_owner_sid;
3108 SEC_DESC *psd = NULL;
3109 int i;
3110
3111 /*
3112 * Get the owner, group and world SIDs.
3113 */
3114
3115 create_file_sids(sbuf, &owner_sid, &group_sid);
3116
3117 if (lp_profile_acls(SNUM(conn))) {
3118 /* For WXP SP1 the owner must be administrators. */
3119 sid_copy(&orig_owner_sid, &owner_sid);
3120 sid_copy(&owner_sid, &global_sid_Builtin_Administrators);
3121 sid_copy(&group_sid, &global_sid_Builtin_Users);
3122 num_profile_acls = 3;
3123 }
3124
3125 if ((security_info & DACL_SECURITY_INFORMATION) && !(security_info & PROTECTED_DACL_SECURITY_INFORMATION)) {
3126
3127 /*
3128 * In the optimum case Creator Owner and Creator Group would be used for
3129 * the ACL_USER_OBJ and ACL_GROUP_OBJ entries, respectively, but this
3130 * would lead to usability problems under Windows: The Creator entries
3131 * are only available in browse lists of directories and not for files;
3132 * additionally the identity of the owning group couldn't be determined.
3133 * We therefore use those identities only for Default ACLs.
3134 */
3135
3136 /* Create the canon_ace lists. */
3137 file_ace = canonicalise_acl(conn, name, posix_acl, sbuf,
3138 &owner_sid, &group_sid, pal,
3139 SMB_ACL_TYPE_ACCESS);
3140
3141 /* We must have *some* ACLS. */
3142
3143 if (count_canon_ace_list(file_ace) == 0) {
3144 DEBUG(0,("get_nt_acl : No ACLs on file (%s) !\n", name));
3145 goto done;
3146 }
3147
3148 if (S_ISDIR(sbuf->st_ex_mode) && def_acl) {
3149 dir_ace = canonicalise_acl(conn, name, def_acl,
3150 sbuf,
3151 &global_sid_Creator_Owner,
3152 &global_sid_Creator_Group,
3153 pal, SMB_ACL_TYPE_DEFAULT);
3154 }
3155
3156 /*
3157 * Create the NT ACE list from the canonical ace lists.
3158 */
3159
3160 {
3161 canon_ace *ace;
3162 enum security_ace_type nt_acl_type;
3163
3164 if (nt4_compatible_acls() && dir_ace) {
3165 /*
3166 * NT 4 chokes if an ACL contains an INHERIT_ONLY entry
3167 * but no non-INHERIT_ONLY entry for one SID. So we only
3168 * remove entries from the Access ACL if the
3169 * corresponding Default ACL entries have also been
3170 * removed. ACEs for CREATOR-OWNER and CREATOR-GROUP
3171 * are exceptions. We can do nothing
3172 * intelligent if the Default ACL contains entries that
3173 * are not also contained in the Access ACL, so this
3174 * case will still fail under NT 4.
3175 */
3176
3177 ace = canon_ace_entry_for(dir_ace, SMB_ACL_OTHER, NULL);
3178 if (ace && !ace->perms) {
3179 DLIST_REMOVE(dir_ace, ace);
3180 SAFE_FREE(ace);
3181
3182 ace = canon_ace_entry_for(file_ace, SMB_ACL_OTHER, NULL);
3183 if (ace && !ace->perms) {
3184 DLIST_REMOVE(file_ace, ace);
3185 SAFE_FREE(ace);
3186 }
3187 }
3188
3189 /*
3190 * WinNT doesn't usually have Creator Group
3191 * in browse lists, so we send this entry to
3192 * WinNT even if it contains no relevant
3193 * permissions. Once we can add
3194 * Creator Group to browse lists we can
3195 * re-enable this.
3196 */
3197
3198 #if 0
3199 ace = canon_ace_entry_for(dir_ace, SMB_ACL_GROUP_OBJ, NULL);
3200 if (ace && !ace->perms) {
3201 DLIST_REMOVE(dir_ace, ace);
3202 SAFE_FREE(ace);
3203 }
3204 #endif
3205
3206 ace = canon_ace_entry_for(file_ace, SMB_ACL_GROUP_OBJ, NULL);
3207 if (ace && !ace->perms) {
3208 DLIST_REMOVE(file_ace, ace);
3209 SAFE_FREE(ace);
3210 }
3211 }
3212
3213 num_acls = count_canon_ace_list(file_ace);
3214 num_def_acls = count_canon_ace_list(dir_ace);
3215
3216 /* Allocate the ace list. */
3217 if ((nt_ace_list = SMB_MALLOC_ARRAY(SEC_ACE,num_acls + num_profile_acls + num_def_acls)) == NULL) {
3218 DEBUG(0,("get_nt_acl: Unable to malloc space for nt_ace_list.\n"));
3219 goto done;
3220 }
3221
3222 memset(nt_ace_list, '\0', (num_acls + num_def_acls) * sizeof(SEC_ACE) );
3223
3224 /*
3225 * Create the NT ACE list from the canonical ace lists.
3226 */
3227
3228 for (ace = file_ace; ace != NULL; ace = ace->next) {
3229 uint32_t acc = map_canon_ace_perms(SNUM(conn),
3230 &nt_acl_type,
3231 ace->perms,
3232 S_ISDIR(sbuf->st_ex_mode));
3233 init_sec_ace(&nt_ace_list[num_aces++],
3234 &ace->trustee,
3235 nt_acl_type,
3236 acc,
3237 ace->ace_flags);
3238 }
3239
3240 /* The User must have access to a profile share - even
3241 * if we can't map the SID. */
3242 if (lp_profile_acls(SNUM(conn))) {
3243 add_or_replace_ace(nt_ace_list, &num_aces,
3244 &global_sid_Builtin_Users,
3245 SEC_ACE_TYPE_ACCESS_ALLOWED,
3246 FILE_GENERIC_ALL, 0);
3247 }
3248
3249 for (ace = dir_ace; ace != NULL; ace = ace->next) {
3250 uint32_t acc = map_canon_ace_perms(SNUM(conn),
3251 &nt_acl_type,
3252 ace->perms,
3253 S_ISDIR(sbuf->st_ex_mode));
3254 init_sec_ace(&nt_ace_list[num_aces++],
3255 &ace->trustee,
3256 nt_acl_type,
3257 acc,
3258 ace->ace_flags |
3259 SEC_ACE_FLAG_OBJECT_INHERIT|
3260 SEC_ACE_FLAG_CONTAINER_INHERIT|
3261 SEC_ACE_FLAG_INHERIT_ONLY);
3262 }
3263
3264 /* The User must have access to a profile share - even
3265 * if we can't map the SID. */
3266 if (lp_profile_acls(SNUM(conn))) {
3267 add_or_replace_ace(nt_ace_list, &num_aces,
3268 &global_sid_Builtin_Users,
3269 SEC_ACE_TYPE_ACCESS_ALLOWED,
3270 FILE_GENERIC_ALL,
3271 SEC_ACE_FLAG_OBJECT_INHERIT |
3272 SEC_ACE_FLAG_CONTAINER_INHERIT |
3273 SEC_ACE_FLAG_INHERIT_ONLY);
3274 }
3275
3276 /*
3277 * Merge POSIX default ACLs and normal ACLs into one NT ACE.
3278 * Win2K needs this to get the inheritance correct when replacing ACLs
3279 * on a directory tree. Based on work by Jim @ IBM.
3280 */
3281
3282 num_aces = merge_default_aces(nt_ace_list, num_aces);
3283
3284 if (lp_profile_acls(SNUM(conn))) {
3285 for (i = 0; i < num_aces; i++) {
3286 if (sid_equal(&nt_ace_list[i].trustee, &owner_sid)) {
3287 add_or_replace_ace(nt_ace_list, &num_aces,
3288 &orig_owner_sid,
3289 nt_ace_list[i].type,
3290 nt_ace_list[i].access_mask,
3291 nt_ace_list[i].flags);
3292 break;
3293 }
3294 }
3295 }
3296 }
3297
3298 if (num_aces) {
3299 if((psa = make_sec_acl( talloc_tos(), NT4_ACL_REVISION, num_aces, nt_ace_list)) == NULL) {
3300 DEBUG(0,("get_nt_acl: Unable to malloc space for acl.\n"));
3301 goto done;
3302 }
3303 }
3304 } /* security_info & DACL_SECURITY_INFORMATION */
3305
3306 psd = make_standard_sec_desc( talloc_tos(),
3307 (security_info & OWNER_SECURITY_INFORMATION) ? &owner_sid : NULL,
3308 (security_info & GROUP_SECURITY_INFORMATION) ? &group_sid : NULL,
3309 psa,
3310 &sd_size);
3311
3312 if(!psd) {
3313 DEBUG(0,("get_nt_acl: Unable to malloc space for security descriptor.\n"));
3314 sd_size = 0;
3315 goto done;
3316 }
3317
3318 /*
3319 * Windows 2000: The DACL_PROTECTED flag in the security
3320 * descriptor marks the ACL as non-inheriting, i.e., no
3321 * ACEs from higher level directories propagate to this
3322 * ACL. In the POSIX ACL model permissions are only
3323 * inherited at file create time, so ACLs never contain
3324 * any ACEs that are inherited dynamically. The DACL_PROTECTED
3325 * flag doesn't seem to bother Windows NT.
3326 * Always set this if map acl inherit is turned off.
3327 */
3328 if (pal == NULL || !lp_map_acl_inherit(SNUM(conn))) {
3329 psd->type |= SEC_DESC_DACL_PROTECTED;
3330 } else {
3331 psd->type |= pal->sd_type;
3332 }
3333
3334 if (psd->dacl) {
3335 dacl_sort_into_canonical_order(psd->dacl->aces, (unsigned int)psd->dacl->num_aces);
3336 }
3337
3338 *ppdesc = psd;
3339
3340 done:
3341
3342 if (posix_acl) {
3343 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
3344 }
3345 if (def_acl) {
3346 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
3347 }
3348 free_canon_ace_list(file_ace);
3349 free_canon_ace_list(dir_ace);
3350 free_inherited_info(pal);
3351 SAFE_FREE(nt_ace_list);
3352
3353 return NT_STATUS_OK;
3354 }
3355
3356 NTSTATUS posix_fget_nt_acl(struct files_struct *fsp, uint32_t security_info,
3357 SEC_DESC **ppdesc)
3358 {
3359 SMB_STRUCT_STAT sbuf;
3360 SMB_ACL_T posix_acl = NULL;
3361 struct pai_val *pal;
3362
3363 *ppdesc = NULL;
3364
3365 DEBUG(10,("posix_fget_nt_acl: called for file %s\n",
3366 fsp_str_dbg(fsp)));
3367
3368 /* can it happen that fsp_name == NULL ? */
3369 if (fsp->is_directory || fsp->fh->fd == -1) {
3370 return posix_get_nt_acl(fsp->conn, fsp->fsp_name->base_name,
3371 security_info, ppdesc);
3372 }
3373
3374 /* Get the stat struct for the owner info. */
3375 if(SMB_VFS_FSTAT(fsp, &sbuf) != 0) {
3376 return map_nt_error_from_unix(errno);
3377 }
3378
3379 /* Get the ACL from the fd. */
3380 posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp);
3381
3382 pal = fload_inherited_info(fsp);
3383
3384 return posix_get_nt_acl_common(fsp->conn, fsp->fsp_name->base_name,
3385 &sbuf, pal, posix_acl, NULL,
3386 security_info, ppdesc);
3387 }
3388
3389 NTSTATUS posix_get_nt_acl(struct connection_struct *conn, const char *name,
3390 uint32_t security_info, SEC_DESC **ppdesc)
3391 {
3392 SMB_ACL_T posix_acl = NULL;
3393 SMB_ACL_T def_acl = NULL;
3394 struct pai_val *pal;
3395 struct smb_filename smb_fname;
3396 int ret;
3397
3398 *ppdesc = NULL;
3399
3400 DEBUG(10,("posix_get_nt_acl: called for file %s\n", name ));
3401
3402 ZERO_STRUCT(smb_fname);
3403 smb_fname.base_name = discard_const_p(char, name);
3404
3405 /* Get the stat struct for the owner info. */
3406 if (lp_posix_pathnames()) {
3407 ret = SMB_VFS_LSTAT(conn, &smb_fname);
3408 } else {
3409 ret = SMB_VFS_STAT(conn, &smb_fname);
3410 }
3411
3412 if (ret == -1) {
3413 return map_nt_error_from_unix(errno);
3414 }
3415
3416 /* Get the ACL from the path. */
3417 posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name, SMB_ACL_TYPE_ACCESS);
3418
3419 /* If it's a directory get the default POSIX ACL. */
3420 if(S_ISDIR(smb_fname.st.st_ex_mode)) {
3421 def_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name, SMB_ACL_TYPE_DEFAULT);
3422 def_acl = free_empty_sys_acl(conn, def_acl);
3423 }
3424
3425 pal = load_inherited_info(conn, name);
3426
3427 return posix_get_nt_acl_common(conn, name, &smb_fname.st, pal,
3428 posix_acl, def_acl, security_info,
3429 ppdesc);
3430 }
3431
3432 /****************************************************************************
3433 Try to chown a file. We will be able to chown it under the following conditions.
3434
3435 1) If we have root privileges, then it will just work.
3436 2) If we have SeTakeOwnershipPrivilege we can change the user to the current user.
3437 3) If we have SeRestorePrivilege we can change the user to any other user.
3438 4) If we have write permission to the file and dos_filemodes is set
3439 then allow chown to the currently authenticated user.
3440 ****************************************************************************/
3441
3442 int try_chown(connection_struct *conn, struct smb_filename *smb_fname,
3443 uid_t uid, gid_t gid)
3444 {
3445 int ret;
3446 files_struct *fsp;
3447
3448 if(!CAN_WRITE(conn)) {
3449 return -1;
3450 }
3451
3452 /* Case (1). */
3453 /* try the direct way first */
3454 if (lp_posix_pathnames()) {
3455 ret = SMB_VFS_LCHOWN(conn, smb_fname->base_name, uid, gid);
3456 } else {
3457 ret = SMB_VFS_CHOWN(conn, smb_fname->base_name, uid, gid);
3458 }
3459
3460 if (ret == 0)
3461 return 0;
3462
3463 /* Case (2) / (3) */
3464 if (lp_enable_privileges()) {
3465
3466 bool has_take_ownership_priv = user_has_privileges(current_user.nt_user_token,
3467 &se_take_ownership);
3468 bool has_restore_priv = user_has_privileges(current_user.nt_user_token,
3469 &se_restore);
3470
3471 /* Case (2) */
3472 if ( ( has_take_ownership_priv && ( uid == current_user.ut.uid ) ) ||
3473 /* Case (3) */
3474 ( has_restore_priv ) ) {
3475
3476 become_root();
3477 /* Keep the current file gid the same - take ownership doesn't imply group change. */
3478 if (lp_posix_pathnames()) {
3479 ret = SMB_VFS_LCHOWN(conn, smb_fname->base_name, uid,
3480 (gid_t)-1);
3481 } else {
3482 ret = SMB_VFS_CHOWN(conn, smb_fname->base_name, uid,
3483 (gid_t)-1);
3484 }
3485 unbecome_root();
3486 return ret;
3487 }
3488 }
3489
3490 /* Case (4). */
3491 if (!lp_dos_filemode(SNUM(conn))) {
3492 errno = EPERM;
3493 return -1;
3494 }
3495
3496 /* only allow chown to the current user. This is more secure,
3497 and also copes with the case where the SID in a take ownership ACL is
3498 a local SID on the users workstation
3499 */
3500 if (uid != current_user.ut.uid) {
3501 errno = EPERM;
3502 return -1;
3503 }
3504
3505 if (lp_posix_pathnames()) {
3506 ret = SMB_VFS_LSTAT(conn, smb_fname);
3507 } else {
3508 ret = SMB_VFS_STAT(conn, smb_fname);
3509 }
3510
3511 if (ret == -1) {
3512 return -1;
3513 }
3514
3515 if (!NT_STATUS_IS_OK(open_file_fchmod(conn, smb_fname, &fsp))) {
3516 return -1;
3517 }
3518
3519 become_root();
3520 /* Keep the current file gid the same. */
3521 if (fsp->fh->fd == -1) {
3522 if (lp_posix_pathnames()) {
3523 ret = SMB_VFS_LCHOWN(conn, smb_fname->base_name, uid,
3524 (gid_t)-1);
3525 } else {
3526 ret = SMB_VFS_CHOWN(conn, smb_fname->base_name, uid,
3527 (gid_t)-1);
3528 }
3529 } else {
3530 ret = SMB_VFS_FCHOWN(fsp, uid, (gid_t)-1);
3531 }
3532 unbecome_root();
3533
3534 close_file(NULL, fsp, NORMAL_CLOSE);
3535
3536 return ret;
3537 }
3538
3539 #if 0
3540 /* Disable this - prevents ACL inheritance from the ACL editor. JRA. */
3541
3542 /****************************************************************************
3543 Take care of parent ACL inheritance.
3544 ****************************************************************************/
3545
3546 NTSTATUS append_parent_acl(files_struct *fsp,
3547 const SEC_DESC *pcsd,
3548 SEC_DESC **pp_new_sd)
3549 {
3550 struct smb_filename *smb_dname = NULL;
3551 SEC_DESC *parent_sd = NULL;
3552 files_struct *parent_fsp = NULL;
3553 TALLOC_CTX *mem_ctx = talloc_tos();
3554 char *parent_name = NULL;
3555 SEC_ACE *new_ace = NULL;
3556 unsigned int num_aces = pcsd->dacl->num_aces;
3557 NTSTATUS status;
3558 int info;
3559 unsigned int i, j;
3560 SEC_DESC *psd = dup_sec_desc(talloc_tos(), pcsd);
3561 bool is_dacl_protected = (pcsd->type & SEC_DESC_DACL_PROTECTED);
3562
3563 if (psd == NULL) {
3564 return NT_STATUS_NO_MEMORY;
3565 }
3566
3567 if (!parent_dirname(mem_ctx, fsp->fsp_name->base_name, &parent_name,
3568 NULL)) {
3569 return NT_STATUS_NO_MEMORY;
3570 }
3571
3572 status = create_synthetic_smb_fname(mem_ctx, parent_name, NULL, NULL,
3573 &smb_dname);
3574 if (!NT_STATUS_IS_OK(status)) {
3575 goto fail;
3576 }
3577
3578 status = SMB_VFS_CREATE_FILE(
3579 fsp->conn, /* conn */
3580 NULL, /* req */
3581 0, /* root_dir_fid */
3582 smb_dname, /* fname */
3583 FILE_READ_ATTRIBUTES, /* access_mask */
3584 FILE_SHARE_NONE, /* share_access */
3585 FILE_OPEN, /* create_disposition*/
3586 FILE_DIRECTORY_FILE, /* create_options */
3587 0, /* file_attributes */
3588 INTERNAL_OPEN_ONLY, /* oplock_request */
3589 0, /* allocation_size */
3590 NULL, /* sd */
3591 NULL, /* ea_list */
3592 &parent_fsp, /* result */
3593 &info); /* pinfo */
3594
3595 if (!NT_STATUS_IS_OK(status)) {
3596 TALLOC_FREE(smb_dname);
3597 return status;
3598 }
3599
3600 status = SMB_VFS_GET_NT_ACL(parent_fsp->conn, smb_dname->base_name,
3601 DACL_SECURITY_INFORMATION, &parent_sd );
3602
3603 close_file(NULL, parent_fsp, NORMAL_CLOSE);
3604 TALLOC_FREE(smb_dname);
3605
3606 if (!NT_STATUS_IS_OK(status)) {
3607 return status;
3608 }
3609
3610 /*
3611 * Make room for potentially all the ACLs from
3612 * the parent. We used to add the ugw triple here,
3613 * as we knew we were dealing with POSIX ACLs.
3614 * We no longer need to do so as we can guarentee
3615 * that a default ACL from the parent directory will
3616 * be well formed for POSIX ACLs if it came from a
3617 * POSIX ACL source, and if we're not writing to a
3618 * POSIX ACL sink then we don't care if it's not well
3619 * formed. JRA.
3620 */
3621
3622 num_aces += parent_sd->dacl->num_aces;
3623
3624 if((new_ace = TALLOC_ZERO_ARRAY(mem_ctx, SEC_ACE,
3625 num_aces)) == NULL) {
3626 return NT_STATUS_NO_MEMORY;
3627 }
3628
3629 /* Start by copying in all the given ACE entries. */
3630 for (i = 0; i < psd->dacl->num_aces; i++) {
3631 sec_ace_copy(&new_ace[i], &psd->dacl->aces[i]);
3632 }
3633
3634 /*
3635 * Note that we're ignoring "inherit permissions" here
3636 * as that really only applies to newly created files. JRA.
3637 */
3638
3639 /* Finally append any inherited ACEs. */
3640 for (j = 0; j < parent_sd->dacl->num_aces; j++) {
3641 SEC_ACE *se = &parent_sd->dacl->aces[j];
3642
3643 if (fsp->is_directory) {
3644 if (!(se->flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
3645 /* Doesn't apply to a directory - ignore. */
3646 DEBUG(10,("append_parent_acl: directory %s "
3647 "ignoring non container "
3648 "inherit flags %u on ACE with sid %s "
3649 "from parent %s\n",
3650 fsp_str_dbg(fsp),
3651 (unsigned int)se->flags,
3652 sid_string_dbg(&se->trustee),
3653 parent_name));
3654 continue;
3655 }
3656 } else {
3657 if (!(se->flags & SEC_ACE_FLAG_OBJECT_INHERIT)) {
3658 /* Doesn't apply to a file - ignore. */
3659 DEBUG(10,("append_parent_acl: file %s "
3660 "ignoring non object "
3661 "inherit flags %u on ACE with sid %s "
3662 "from parent %s\n",
3663 fsp_str_dbg(fsp),
3664 (unsigned int)se->flags,
3665 sid_string_dbg(&se->trustee),
3666 parent_name));
3667 continue;
3668 }
3669 }
3670
3671 if (is_dacl_protected) {
3672 /* If the DACL is protected it means we must
3673 * not overwrite an existing ACE entry with the
3674 * same SID. This is order N^2. Ouch :-(. JRA. */
3675 unsigned int k;
3676 for (k = 0; k < psd->dacl->num_aces; k++) {
3677 if (sid_equal(&psd->dacl->aces[k].trustee,
3678 &se->trustee)) {
3679 break;
3680 }
3681 }
3682 if (k < psd->dacl->num_aces) {
3683 /* SID matched. Ignore. */
3684 DEBUG(10,("append_parent_acl: path %s "
3685 "ignoring ACE with protected sid %s "
3686 "from parent %s\n",
3687 fsp_str_dbg(fsp),
3688 sid_string_dbg(&se->trustee),
3689 parent_name));
3690 continue;
3691 }
3692 }
3693
3694 sec_ace_copy(&new_ace[i], se);
3695 if (se->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
3696 new_ace[i].flags &= ~(SEC_ACE_FLAG_VALID_INHERIT);
3697 }
3698 new_ace[i].flags |= SEC_ACE_FLAG_INHERITED_ACE;
3699
3700 if (fsp->is_directory) {
3701 /*
3702 * Strip off any inherit only. It's applied.
3703 */
3704 new_ace[i].flags &= ~(SEC_ACE_FLAG_INHERIT_ONLY);
3705 if (se->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
3706 /* No further inheritance. */
3707 new_ace[i].flags &=
3708 ~(SEC_ACE_FLAG_CONTAINER_INHERIT|
3709 SEC_ACE_FLAG_OBJECT_INHERIT);
3710 }
3711 } else {
3712 /*
3713 * Strip off any container or inherit
3714 * flags, they can't apply to objects.
3715 */
3716 new_ace[i].flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|
3717 SEC_ACE_FLAG_INHERIT_ONLY|
3718 SEC_ACE_FLAG_NO_PROPAGATE_INHERIT);
3719 }
3720 i++;
3721
3722 DEBUG(10,("append_parent_acl: path %s "
3723 "inheriting ACE with sid %s "
3724 "from parent %s\n",
3725 fsp_str_dbg(fsp),
3726 sid_string_dbg(&se->trustee),
3727 parent_name));
3728 }
3729
3730 psd->dacl->aces = new_ace;
3731 psd->dacl->num_aces = i;
3732 psd->type &= ~(SE_DESC_DACL_AUTO_INHERITED|
3733 SE_DESC_DACL_AUTO_INHERIT_REQ);
3734
3735 *pp_new_sd = psd;
3736 return status;
3737 }
3738 #endif
3739
3740 /****************************************************************************
3741 Reply to set a security descriptor on an fsp. security_info_sent is the
3742 description of the following NT ACL.
3743 This should be the only external function needed for the UNIX style set ACL.
3744 ****************************************************************************/
3745
3746 NTSTATUS set_nt_acl(files_struct *fsp, uint32 security_info_sent, const SEC_DESC *psd_orig)
3747 {
3748 connection_struct *conn = fsp->conn;
3749 uid_t user = (uid_t)-1;
3750 gid_t grp = (gid_t)-1;
3751 DOM_SID file_owner_sid;
3752 DOM_SID file_grp_sid;
3753 canon_ace *file_ace_list = NULL;
3754 canon_ace *dir_ace_list = NULL;
3755 bool acl_perms = False;
3756 mode_t orig_mode = (mode_t)0;
3757 NTSTATUS status;
3758 bool set_acl_as_root = false;
3759 bool acl_set_support = false;
3760 bool ret = false;
3761 SEC_DESC *psd = NULL;
3762
3763 DEBUG(10,("set_nt_acl: called for file %s\n",
3764 fsp_str_dbg(fsp)));
3765
3766 if (!CAN_WRITE(conn)) {
3767 DEBUG(10,("set acl rejected on read-only share\n"));
3768 return NT_STATUS_MEDIA_WRITE_PROTECTED;
3769 }
3770
3771 if (!psd_orig) {
3772 return NT_STATUS_INVALID_PARAMETER;
3773 }
3774
3775 psd = dup_sec_desc(talloc_tos(), psd_orig);
3776 if (!psd) {
3777 return NT_STATUS_NO_MEMORY;
3778 }
3779
3780 /*
3781 * Get the current state of the file.
3782 */
3783
3784 status = vfs_stat_fsp(fsp);
3785 if (!NT_STATUS_IS_OK(status)) {
3786 return status;
3787 }
3788
3789 /* Save the original element we check against. */
3790 orig_mode = fsp->fsp_name->st.st_ex_mode;
3791
3792 /*
3793 * Unpack the user/group/world id's.
3794 */
3795
3796 /* POSIX can't cope with missing owner/group. */
3797 if ((security_info_sent & SECINFO_OWNER) && (psd->owner_sid == NULL)) {
3798 security_info_sent &= ~SECINFO_OWNER;
3799 }
3800 if ((security_info_sent & SECINFO_GROUP) && (psd->group_sid == NULL)) {
3801 security_info_sent &= ~SECINFO_GROUP;
3802 }
3803
3804 status = unpack_nt_owners( SNUM(conn), &user, &grp, security_info_sent, psd);
3805 if (!NT_STATUS_IS_OK(status)) {
3806 return status;
3807 }
3808
3809 /*
3810 * Do we need to chown ? If so this must be done first as the incoming
3811 * CREATOR_OWNER acl will be relative to the *new* owner, not the old.
3812 * Noticed by Simo.
3813 */
3814
3815 if (((user != (uid_t)-1) && (fsp->fsp_name->st.st_ex_uid != user)) ||
3816 (( grp != (gid_t)-1) && (fsp->fsp_name->st.st_ex_gid != grp))) {
3817
3818 DEBUG(3,("set_nt_acl: chown %s. uid = %u, gid = %u.\n",
3819 fsp_str_dbg(fsp), (unsigned int)user,
3820 (unsigned int)grp));
3821
3822 if(try_chown(fsp->conn, fsp->fsp_name, user, grp) == -1) {
3823 DEBUG(3,("set_nt_acl: chown %s, %u, %u failed. Error "
3824 "= %s.\n", fsp_str_dbg(fsp),
3825 (unsigned int)user, (unsigned int)grp,
3826 strerror(errno)));
3827 if (errno == EPERM) {
3828 return NT_STATUS_INVALID_OWNER;
3829 }
3830 return map_nt_error_from_unix(errno);
3831 }
3832
3833 /*
3834 * Recheck the current state of the file, which may have changed.
3835 * (suid/sgid bits, for instance)
3836 */
3837
3838 status = vfs_stat_fsp(fsp);
3839 if (!NT_STATUS_IS_OK(status)) {
3840 return status;
3841 }
3842
3843 /* Save the original element we check against. */
3844 orig_mode = fsp->fsp_name->st.st_ex_mode;
3845
3846 /* If we successfully chowned, we know we must
3847 * be able to set the acl, so do it as root.
3848 */
3849 set_acl_as_root = true;
3850 }
3851
3852 create_file_sids(&fsp->fsp_name->st, &file_owner_sid, &file_grp_sid);
3853
3854 if((security_info_sent & SECINFO_DACL) &&
3855 (psd->type & SEC_DESC_DACL_PRESENT) &&
3856 (psd->dacl == NULL)) {
3857 SEC_ACE ace[3];
3858
3859 /* We can't have NULL DACL in POSIX.
3860 Use owner/group/Everyone -> full access. */
3861
3862 init_sec_ace(&ace[0],
3863 &file_owner_sid,
3864 SEC_ACE_TYPE_ACCESS_ALLOWED,
3865 GENERIC_ALL_ACCESS,
3866 0);
3867 init_sec_ace(&ace[1],
3868 &file_grp_sid,
3869 SEC_ACE_TYPE_ACCESS_ALLOWED,
3870 GENERIC_ALL_ACCESS,
3871 0);
3872 init_sec_ace(&ace[2],
3873 &global_sid_World,
3874 SEC_ACE_TYPE_ACCESS_ALLOWED,
3875 GENERIC_ALL_ACCESS,
3876 0);
3877 psd->dacl = make_sec_acl(talloc_tos(),
3878 NT4_ACL_REVISION,
3879 3,
3880 ace);
3881 if (psd->dacl == NULL) {
3882 return NT_STATUS_NO_MEMORY;
3883 }
3884 security_acl_map_generic(psd->dacl, &file_generic_mapping);
3885 }
3886
3887 acl_perms = unpack_canon_ace(fsp, &fsp->fsp_name->st, &file_owner_sid,
3888 &file_grp_sid, &file_ace_list,
3889 &dir_ace_list, security_info_sent, psd);
3890
3891 /* Ignore W2K traverse DACL set. */
3892 if (!file_ace_list && !dir_ace_list) {
3893 return NT_STATUS_OK;
3894 }
3895
3896 if (!acl_perms) {
3897 DEBUG(3,("set_nt_acl: cannot set permissions\n"));
3898 free_canon_ace_list(file_ace_list);
3899 free_canon_ace_list(dir_ace_list);
3900 return NT_STATUS_ACCESS_DENIED;
3901 }
3902
3903 /*
3904 * Only change security if we got a DACL.
3905 */
3906
3907 if(!(security_info_sent & DACL_SECURITY_INFORMATION) || (psd->dacl == NULL)) {
3908 free_canon_ace_list(file_ace_list);
3909 free_canon_ace_list(dir_ace_list);
3910 return NT_STATUS_OK;
3911 }
3912
3913 /*
3914 * Try using the POSIX ACL set first. Fall back to chmod if
3915 * we have no ACL support on this filesystem.
3916 */
3917
3918 if (acl_perms && file_ace_list) {
3919 if (set_acl_as_root) {
3920 become_root();
3921 }
3922 ret = set_canon_ace_list(fsp, file_ace_list, false,
3923 &fsp->fsp_name->st, &acl_set_support);
3924 if (set_acl_as_root) {
3925 unbecome_root();
3926 }
3927 if (acl_set_support && ret == false) {
3928 DEBUG(3,("set_nt_acl: failed to set file acl on file "
3929 "%s (%s).\n", fsp_str_dbg(fsp),
3930 strerror(errno)));
3931 free_canon_ace_list(file_ace_list);
3932 free_canon_ace_list(dir_ace_list);
3933 return map_nt_error_from_unix(errno);
3934 }
3935 }
3936
3937 if (acl_perms && acl_set_support && fsp->is_directory) {
3938 if (dir_ace_list) {
3939 if (set_acl_as_root) {
3940 become_root();
3941 }
3942 ret = set_canon_ace_list(fsp, dir_ace_list, true,
3943 &fsp->fsp_name->st,
3944 &acl_set_support);
3945 if (set_acl_as_root) {
3946 unbecome_root();
3947 }
3948 if (ret == false) {
3949 DEBUG(3,("set_nt_acl: failed to set default "
3950 "acl on directory %s (%s).\n",
3951 fsp_str_dbg(fsp), strerror(errno)));
3952 free_canon_ace_list(file_ace_list);
3953 free_canon_ace_list(dir_ace_list);
3954 return map_nt_error_from_unix(errno);
3955 }
3956 } else {
3957 int sret = -1;
3958
3959 /*
3960 * No default ACL - delete one if it exists.
3961 */
3962
3963 if (set_acl_as_root) {
3964 become_root();
3965 }
3966 sret = SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn,
3967 fsp->fsp_name->base_name);
3968 if (set_acl_as_root) {
3969 unbecome_root();
3970 }
3971 if (sret == -1) {
3972 if (acl_group_override(conn, fsp->fsp_name)) {
3973 DEBUG(5,("set_nt_acl: acl group "
3974 "control on and current user "
3975 "in file %s primary group. "
3976 "Override delete_def_acl\n",
3977 fsp_str_dbg(fsp)));
3978
3979 become_root();
3980 sret =
3981 SMB_VFS_SYS_ACL_DELETE_DEF_FILE(
3982 conn,
3983 fsp->fsp_name->base_name);
3984 unbecome_root();
3985 }
3986
3987 if (sret == -1) {
3988 DEBUG(3,("set_nt_acl: sys_acl_delete_def_file failed (%s)\n", strerror(errno)));
3989 free_canon_ace_list(file_ace_list);
3990 free_canon_ace_list(dir_ace_list);
3991 return map_nt_error_from_unix(errno);
3992 }
3993 }
3994 }
3995 }
3996
3997 if (acl_set_support) {
3998 if (set_acl_as_root) {
3999 become_root();
4000 }
4001 store_inheritance_attributes(fsp,
4002 file_ace_list,
4003 dir_ace_list,
4004 psd->type);
4005 if (set_acl_as_root) {
4006 unbecome_root();
4007 }
4008 }
4009
4010 /*
4011 * If we cannot set using POSIX ACLs we fall back to checking if we need to chmod.
4012 */
4013
4014 if(!acl_set_support && acl_perms) {
4015 mode_t posix_perms;
4016
4017 if (!convert_canon_ace_to_posix_perms( fsp, file_ace_list, &posix_perms)) {
4018 free_canon_ace_list(file_ace_list);
4019 free_canon_ace_list(dir_ace_list);
4020 DEBUG(3,("set_nt_acl: failed to convert file acl to "
4021 "posix permissions for file %s.\n",
4022 fsp_str_dbg(fsp)));
4023 return NT_STATUS_ACCESS_DENIED;
4024 }
4025
4026 if (orig_mode != posix_perms) {
4027 int sret = -1;
4028
4029 DEBUG(3,("set_nt_acl: chmod %s. perms = 0%o.\n",
4030 fsp_str_dbg(fsp), (unsigned int)posix_perms));
4031
4032 if (set_acl_as_root) {
4033 become_root();
4034 }
4035 sret = SMB_VFS_CHMOD(conn, fsp->fsp_name->base_name,
4036 posix_perms);
4037 if (set_acl_as_root) {
4038 unbecome_root();
4039 }
4040 if(sret == -1) {
4041 if (acl_group_override(conn, fsp->fsp_name)) {
4042 DEBUG(5,("set_nt_acl: acl group "
4043 "control on and current user "
4044 "in file %s primary group. "
4045 "Override chmod\n",
4046 fsp_str_dbg(fsp)));
4047
4048 become_root();
4049 sret = SMB_VFS_CHMOD(conn,
4050 fsp->fsp_name->base_name,
4051 posix_perms);
4052 unbecome_root();
4053 }
4054
4055 if (sret == -1) {
4056 DEBUG(3,("set_nt_acl: chmod %s, 0%o "
4057 "failed. Error = %s.\n",
4058 fsp_str_dbg(fsp),
4059 (unsigned int)posix_perms,
4060 strerror(errno)));
4061 free_canon_ace_list(file_ace_list);
4062 free_canon_ace_list(dir_ace_list);
4063 return map_nt_error_from_unix(errno);
4064 }
4065 }
4066 }
4067 }
4068
4069 free_canon_ace_list(file_ace_list);
4070 free_canon_ace_list(dir_ace_list);
4071
4072 /* Ensure the stat struct in the fsp is correct. */
4073 status = vfs_stat_fsp(fsp);
4074
4075 return NT_STATUS_OK;
4076 }
4077
4078 /****************************************************************************
4079 Get the actual group bits stored on a file with an ACL. Has no effect if
4080 the file has no ACL. Needed in dosmode code where the stat() will return
4081 the mask bits, not the real group bits, for a file with an ACL.
4082 ****************************************************************************/
4083
4084 int get_acl_group_bits( connection_struct *conn, const char *fname, mode_t *mode )
4085 {
4086 int entry_id = SMB_ACL_FIRST_ENTRY;
4087 SMB_ACL_ENTRY_T entry;
4088 SMB_ACL_T posix_acl;
4089 int result = -1;
4090
4091 posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS);
4092 if (posix_acl == (SMB_ACL_T)NULL)
4093 return -1;
4094
4095 while (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) {
4096 SMB_ACL_TAG_T tagtype;
4097 SMB_ACL_PERMSET_T permset;
4098
4099 entry_id = SMB_ACL_NEXT_ENTRY;
4100
4101 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) ==-1)
4102 break;
4103
4104 if (tagtype == SMB_ACL_GROUP_OBJ) {
4105 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1) {
4106 break;
4107 } else {
4108 *mode &= ~(S_IRGRP|S_IWGRP|S_IXGRP);
4109 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ) ? S_IRGRP : 0);
4110 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE) ? S_IWGRP : 0);
4111 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_EXECUTE) ? S_IXGRP : 0);
4112 result = 0;
4113 break;
4114 }
4115 }
4116 }
4117 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
4118 return result;
4119 }
4120
4121 /****************************************************************************
4122 Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4123 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4124 ****************************************************************************/
4125
4126 static int chmod_acl_internals( connection_struct *conn, SMB_ACL_T posix_acl, mode_t mode)
4127 {
4128 int entry_id = SMB_ACL_FIRST_ENTRY;
4129 SMB_ACL_ENTRY_T entry;
4130 int num_entries = 0;
4131
4132 while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) {
4133 SMB_ACL_TAG_T tagtype;
4134 SMB_ACL_PERMSET_T permset;
4135 mode_t perms;
4136
4137 entry_id = SMB_ACL_NEXT_ENTRY;
4138
4139 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1)
4140 return -1;
4141
4142 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1)
4143 return -1;
4144
4145 num_entries++;
4146
4147 switch(tagtype) {
4148 case SMB_ACL_USER_OBJ:
4149 perms = unix_perms_to_acl_perms(mode, S_IRUSR, S_IWUSR, S_IXUSR);
4150 break;
4151 case SMB_ACL_GROUP_OBJ:
4152 perms = unix_perms_to_acl_perms(mode, S_IRGRP, S_IWGRP, S_IXGRP);
4153 break;
4154 case SMB_ACL_MASK:
4155 /*
4156 * FIXME: The ACL_MASK entry permissions should really be set to
4157 * the union of the permissions of all ACL_USER,
4158 * ACL_GROUP_OBJ, and ACL_GROUP entries. That's what
4159 * acl_calc_mask() does, but Samba ACLs doesn't provide it.
4160 */
4161 perms = S_IRUSR|S_IWUSR|S_IXUSR;
4162 break;
4163 case SMB_ACL_OTHER:
4164 perms = unix_perms_to_acl_perms(mode, S_IROTH, S_IWOTH, S_IXOTH);
4165 break;
4166 default:
4167 continue;
4168 }
4169
4170 if (map_acl_perms_to_permset(conn, perms, &permset) == -1)
4171 return -1;
4172
4173 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, entry, permset) == -1)
4174 return -1;
4175 }
4176
4177 /*
4178 * If this is a simple 3 element ACL or no elements then it's a standard
4179 * UNIX permission set. Just use chmod...
4180 */
4181
4182 if ((num_entries == 3) || (num_entries == 0))
4183 return -1;
4184
4185 return 0;
4186 }
4187
4188 /****************************************************************************
4189 Get the access ACL of FROM, do a chmod by setting the ACL USER_OBJ,
4190 GROUP_OBJ and OTHER bits in an ACL and set the mask to rwx. Set the
4191 resulting ACL on TO. Note that name is in UNIX character set.
4192 ****************************************************************************/
4193
4194 static int copy_access_posix_acl(connection_struct *conn, const char *from, const char *to, mode_t mode)
4195 {
4196 SMB_ACL_T posix_acl = NULL;
4197 int ret = -1;
4198
4199 if ((posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, from, SMB_ACL_TYPE_ACCESS)) == NULL)
4200 return -1;
4201
4202 if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
4203 goto done;
4204
4205 ret = SMB_VFS_SYS_ACL_SET_FILE(conn, to, SMB_ACL_TYPE_ACCESS, posix_acl);
4206
4207 done:
4208
4209 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
4210 return ret;
4211 }
4212
4213 /****************************************************************************
4214 Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4215 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4216 Note that name is in UNIX character set.
4217 ****************************************************************************/
4218
4219 int chmod_acl(connection_struct *conn, const char *name, mode_t mode)
4220 {
4221 return copy_access_posix_acl(conn, name, name, mode);
4222 }
4223
4224 /****************************************************************************
4225 Check for an existing default POSIX ACL on a directory.
4226 ****************************************************************************/
4227
4228 static bool directory_has_default_posix_acl(connection_struct *conn, const char *fname)
4229 {
4230 SMB_ACL_T def_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_DEFAULT);
4231 bool has_acl = False;
4232 SMB_ACL_ENTRY_T entry;
4233
4234 if (def_acl != NULL && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, def_acl, SMB_ACL_FIRST_ENTRY, &entry) == 1)) {
4235 has_acl = True;
4236 }
4237
4238 if (def_acl) {
4239 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4240 }
4241 return has_acl;
4242 }
4243
4244 /****************************************************************************
4245 If the parent directory has no default ACL but it does have an Access ACL,
4246 inherit this Access ACL to file name.
4247 ****************************************************************************/
4248
4249 int inherit_access_posix_acl(connection_struct *conn, const char *inherit_from_dir,
4250 const char *name, mode_t mode)
4251 {
4252 if (directory_has_default_posix_acl(conn, inherit_from_dir))
4253 return 0;
4254
4255 return copy_access_posix_acl(conn, inherit_from_dir, name, mode);
4256 }
4257
4258 /****************************************************************************
4259 Do an fchmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4260 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4261 ****************************************************************************/
4262
4263 int fchmod_acl(files_struct *fsp, mode_t mode)
4264 {
4265 connection_struct *conn = fsp->conn;
4266 SMB_ACL_T posix_acl = NULL;
4267 int ret = -1;
4268
4269 if ((posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp)) == NULL)
4270 return -1;
4271
4272 if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
4273 goto done;
4274
4275 ret = SMB_VFS_SYS_ACL_SET_FD(fsp, posix_acl);
4276
4277 done:
4278
4279 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
4280 return ret;
4281 }
4282
4283 /****************************************************************************
4284 Map from wire type to permset.
4285 ****************************************************************************/
4286
4287 static bool unix_ex_wire_to_permset(connection_struct *conn, unsigned char wire_perm, SMB_ACL_PERMSET_T *p_permset)
4288 {
4289 if (wire_perm & ~(SMB_POSIX_ACL_READ|SMB_POSIX_ACL_WRITE|SMB_POSIX_ACL_EXECUTE)) {
4290 return False;
4291 }
4292
4293 if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn, *p_permset) == -1) {
4294 return False;
4295 }
4296
4297 if (wire_perm & SMB_POSIX_ACL_READ) {
4298 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_READ) == -1) {
4299 return False;
4300 }
4301 }
4302 if (wire_perm & SMB_POSIX_ACL_WRITE) {
4303 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_WRITE) == -1) {
4304 return False;
4305 }
4306 }
4307 if (wire_perm & SMB_POSIX_ACL_EXECUTE) {
4308 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_EXECUTE) == -1) {
4309 return False;
4310 }
4311 }
4312 return True;
4313 }
4314
4315 /****************************************************************************
4316 Map from wire type to tagtype.
4317 ****************************************************************************/
4318
4319 static bool unix_ex_wire_to_tagtype(unsigned char wire_tt, SMB_ACL_TAG_T *p_tt)
4320 {
4321 switch (wire_tt) {
4322 case SMB_POSIX_ACL_USER_OBJ:
4323 *p_tt = SMB_ACL_USER_OBJ;
4324 break;
4325 case SMB_POSIX_ACL_USER:
4326 *p_tt = SMB_ACL_USER;
4327 break;
4328 case SMB_POSIX_ACL_GROUP_OBJ:
4329 *p_tt = SMB_ACL_GROUP_OBJ;
4330 break;
4331 case SMB_POSIX_ACL_GROUP:
4332 *p_tt = SMB_ACL_GROUP;
4333 break;
4334 case SMB_POSIX_ACL_MASK:
4335 *p_tt = SMB_ACL_MASK;
4336 break;
4337 case SMB_POSIX_ACL_OTHER:
4338 *p_tt = SMB_ACL_OTHER;
4339 break;
4340 default:
4341 return False;
4342 }
4343 return True;
4344 }
4345
4346 /****************************************************************************
4347 Create a new POSIX acl from wire permissions.
4348 FIXME ! How does the share mask/mode fit into this.... ?
4349 ****************************************************************************/
4350
4351 static SMB_ACL_T create_posix_acl_from_wire(connection_struct *conn, uint16 num_acls, const char *pdata)
4352 {
4353 unsigned int i;
4354 SMB_ACL_T the_acl = SMB_VFS_SYS_ACL_INIT(conn, num_acls);
4355
4356 if (the_acl == NULL) {
4357 return NULL;
4358 }
4359
4360 for (i = 0; i < num_acls; i++) {
4361 SMB_ACL_ENTRY_T the_entry;
4362 SMB_ACL_PERMSET_T the_permset;
4363 SMB_ACL_TAG_T tag_type;
4364
4365 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &the_entry) == -1) {
4366 DEBUG(0,("create_posix_acl_from_wire: Failed to create entry %u. (%s)\n",
4367 i, strerror(errno) ));
4368 goto fail;
4369 }
4370
4371 if (!unix_ex_wire_to_tagtype(CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)), &tag_type)) {
4372 DEBUG(0,("create_posix_acl_from_wire: invalid wire tagtype %u on entry %u.\n",
4373 CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)), i ));
4374 goto fail;
4375 }
4376
4377 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, the_entry, tag_type) == -1) {
4378 DEBUG(0,("create_posix_acl_from_wire: Failed to set tagtype on entry %u. (%s)\n",
4379 i, strerror(errno) ));
4380 goto fail;
4381 }
4382
4383 /* Get the permset pointer from the new ACL entry. */
4384 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, the_entry, &the_permset) == -1) {
4385 DEBUG(0,("create_posix_acl_from_wire: Failed to get permset on entry %u. (%s)\n",
4386 i, strerror(errno) ));
4387 goto fail;
4388 }
4389
4390 /* Map from wire to permissions. */
4391 if (!unix_ex_wire_to_permset(conn, CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+1), &the_permset)) {
4392 DEBUG(0,("create_posix_acl_from_wire: invalid permset %u on entry %u.\n",
4393 CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE) + 1), i ));
4394 goto fail;
4395 }
4396
4397 /* Now apply to the new ACL entry. */
4398 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, the_entry, the_permset) == -1) {
4399 DEBUG(0,("create_posix_acl_from_wire: Failed to add permset on entry %u. (%s)\n",
4400 i, strerror(errno) ));
4401 goto fail;
4402 }
4403
4404 if (tag_type == SMB_ACL_USER) {
4405 uint32 uidval = IVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+2);
4406 uid_t uid = (uid_t)uidval;
4407 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&uid) == -1) {
4408 DEBUG(0,("create_posix_acl_from_wire: Failed to set uid %u on entry %u. (%s)\n",
4409 (unsigned int)uid, i, strerror(errno) ));
4410 goto fail;
4411 }
4412 }
4413
4414 if (tag_type == SMB_ACL_GROUP) {
4415 uint32 gidval = IVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+2);
4416 gid_t gid = (uid_t)gidval;
4417 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&gid) == -1) {
4418 DEBUG(0,("create_posix_acl_from_wire: Failed to set gid %u on entry %u. (%s)\n",
4419 (unsigned int)gid, i, strerror(errno) ));
4420 goto fail;
4421 }
4422 }
4423 }
4424
4425 return the_acl;
4426
4427 fail:
4428
4429 if (the_acl != NULL) {
4430 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
4431 }
4432 return NULL;
4433 }
4434
4435 /****************************************************************************
4436 Calls from UNIX extensions - Default POSIX ACL set.
4437 If num_def_acls == 0 and not a directory just return. If it is a directory
4438 and num_def_acls == 0 then remove the default acl. Else set the default acl
4439 on the directory.
4440 ****************************************************************************/
4441
4442 bool set_unix_posix_default_acl(connection_struct *conn, const char *fname, const SMB_STRUCT_STAT *psbuf,
4443 uint16 num_def_acls, const char *pdata)
4444 {
4445 SMB_ACL_T def_acl = NULL;
4446
4447 if (!S_ISDIR(psbuf->st_ex_mode)) {
4448 if (num_def_acls) {
4449 DEBUG(5,("set_unix_posix_default_acl: Can't set default ACL on non-directory file %s\n", fname ));
4450 errno = EISDIR;
4451 return False;
4452 } else {
4453 return True;
4454 }
4455 }
4456
4457 if (!num_def_acls) {
4458 /* Remove the default ACL. */
4459 if (SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn, fname) == -1) {
4460 DEBUG(5,("set_unix_posix_default_acl: acl_delete_def_file failed on directory %s (%s)\n",
4461 fname, strerror(errno) ));
4462 return False;
4463 }
4464 return True;
4465 }
4466
4467 if ((def_acl = create_posix_acl_from_wire(conn, num_def_acls, pdata)) == NULL) {
4468 return False;
4469 }
4470
4471 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_DEFAULT, def_acl) == -1) {
4472 DEBUG(5,("set_unix_posix_default_acl: acl_set_file failed on directory %s (%s)\n",
4473 fname, strerror(errno) ));
4474 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4475 return False;
4476 }
4477
4478 DEBUG(10,("set_unix_posix_default_acl: set default acl for file %s\n", fname ));
4479 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4480 return True;
4481 }
4482
4483 /****************************************************************************
4484 Remove an ACL from a file. As we don't have acl_delete_entry() available
4485 we must read the current acl and copy all entries except MASK, USER and GROUP
4486 to a new acl, then set that. This (at least on Linux) causes any ACL to be
4487 removed.
4488 FIXME ! How does the share mask/mode fit into this.... ?
4489 ****************************************************************************/
4490
4491 static bool remove_posix_acl(connection_struct *conn, files_struct *fsp, const char *fname)
4492 {
4493 SMB_ACL_T file_acl = NULL;
4494 int entry_id = SMB_ACL_FIRST_ENTRY;
4495 SMB_ACL_ENTRY_T entry;
4496 bool ret = False;
4497 /* Create a new ACL with only 3 entries, u/g/w. */
4498 SMB_ACL_T new_file_acl = SMB_VFS_SYS_ACL_INIT(conn, 3);
4499 SMB_ACL_ENTRY_T user_ent = NULL;
4500 SMB_ACL_ENTRY_T group_ent = NULL;
4501 SMB_ACL_ENTRY_T other_ent = NULL;
4502
4503 if (new_file_acl == NULL) {
4504 DEBUG(5,("remove_posix_acl: failed to init new ACL with 3 entries for file %s.\n", fname));
4505 return False;
4506 }
4507
4508 /* Now create the u/g/w entries. */
4509 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &user_ent) == -1) {
4510 DEBUG(5,("remove_posix_acl: Failed to create user entry for file %s. (%s)\n",
4511 fname, strerror(errno) ));
4512 goto done;
4513 }
4514 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, user_ent, SMB_ACL_USER_OBJ) == -1) {
4515 DEBUG(5,("remove_posix_acl: Failed to set user entry for file %s. (%s)\n",
4516 fname, strerror(errno) ));
4517 goto done;
4518 }
4519
4520 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &group_ent) == -1) {
4521 DEBUG(5,("remove_posix_acl: Failed to create group entry for file %s. (%s)\n",
4522 fname, strerror(errno) ));
4523 goto done;
4524 }
4525 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, group_ent, SMB_ACL_GROUP_OBJ) == -1) {
4526 DEBUG(5,("remove_posix_acl: Failed to set group entry for file %s. (%s)\n",
4527 fname, strerror(errno) ));
4528 goto done;
4529 }
4530
4531 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &other_ent) == -1) {
4532 DEBUG(5,("remove_posix_acl: Failed to create other entry for file %s. (%s)\n",
4533 fname, strerror(errno) ));
4534 goto done;
4535 }
4536 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, other_ent, SMB_ACL_OTHER) == -1) {
4537 DEBUG(5,("remove_posix_acl: Failed to set other entry for file %s. (%s)\n",
4538 fname, strerror(errno) ));
4539 goto done;
4540 }
4541
4542 /* Get the current file ACL. */
4543 if (fsp && fsp->fh->fd != -1) {
4544 file_acl = SMB_VFS_SYS_ACL_GET_FD(fsp);
4545 } else {
4546 file_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_ACCESS);
4547 }
4548
4549 if (file_acl == NULL) {
4550 /* This is only returned if an error occurred. Even for a file with
4551 no acl a u/g/w acl should be returned. */
4552 DEBUG(5,("remove_posix_acl: failed to get ACL from file %s (%s).\n",
4553 fname, strerror(errno) ));
4554 goto done;
4555 }
4556
4557 while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, file_acl, entry_id, &entry) == 1) {
4558 SMB_ACL_TAG_T tagtype;
4559 SMB_ACL_PERMSET_T permset;
4560
4561 entry_id = SMB_ACL_NEXT_ENTRY;
4562
4563 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1) {
4564 DEBUG(5,("remove_posix_acl: failed to get tagtype from ACL on file %s (%s).\n",
4565 fname, strerror(errno) ));
4566 goto done;
4567 }
4568
4569 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1) {
4570 DEBUG(5,("remove_posix_acl: failed to get permset from ACL on file %s (%s).\n",
4571 fname, strerror(errno) ));
4572 goto done;
4573 }
4574
4575 if (tagtype == SMB_ACL_USER_OBJ) {
4576 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, user_ent, permset) == -1) {
4577 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4578 fname, strerror(errno) ));
4579 }
4580 } else if (tagtype == SMB_ACL_GROUP_OBJ) {
4581 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, group_ent, permset) == -1) {
4582 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4583 fname, strerror(errno) ));
4584 }
4585 } else if (tagtype == SMB_ACL_OTHER) {
4586 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, other_ent, permset) == -1) {
4587 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4588 fname, strerror(errno) ));
4589 }
4590 }
4591 }
4592
4593 /* Set the new empty file ACL. */
4594 if (fsp && fsp->fh->fd != -1) {
4595 if (SMB_VFS_SYS_ACL_SET_FD(fsp, new_file_acl) == -1) {
4596 DEBUG(5,("remove_posix_acl: acl_set_file failed on %s (%s)\n",
4597 fname, strerror(errno) ));
4598 goto done;
4599 }
4600 } else {
4601 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS, new_file_acl) == -1) {
4602 DEBUG(5,("remove_posix_acl: acl_set_file failed on %s (%s)\n",
4603 fname, strerror(errno) ));
4604 goto done;
4605 }
4606 }
4607
4608 ret = True;
4609
4610 done:
4611
4612 if (file_acl) {
4613 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4614 }
4615 if (new_file_acl) {
4616 SMB_VFS_SYS_ACL_FREE_ACL(conn, new_file_acl);
4617 }
4618 return ret;
4619 }
4620
4621 /****************************************************************************
4622 Calls from UNIX extensions - POSIX ACL set.
4623 If num_def_acls == 0 then read/modify/write acl after removing all entries
4624 except SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER.
4625 ****************************************************************************/
4626
4627 bool set_unix_posix_acl(connection_struct *conn, files_struct *fsp, const char *fname, uint16 num_acls, const char *pdata)
4628 {
4629 SMB_ACL_T file_acl = NULL;
4630
4631 if (!num_acls) {
4632 /* Remove the ACL from the file. */
4633 return remove_posix_acl(conn, fsp, fname);
4634 }
4635
4636 if ((file_acl = create_posix_acl_from_wire(conn, num_acls, pdata)) == NULL) {
4637 return False;
4638 }
4639
4640 if (fsp && fsp->fh->fd != -1) {
4641 /* The preferred way - use an open fd. */
4642 if (SMB_VFS_SYS_ACL_SET_FD(fsp, file_acl) == -1) {
4643 DEBUG(5,("set_unix_posix_acl: acl_set_file failed on %s (%s)\n",
4644 fname, strerror(errno) ));
4645 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4646 return False;
4647 }
4648 } else {
4649 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS, file_acl) == -1) {
4650 DEBUG(5,("set_unix_posix_acl: acl_set_file failed on %s (%s)\n",
4651 fname, strerror(errno) ));
4652 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4653 return False;
4654 }
4655 }
4656
4657 DEBUG(10,("set_unix_posix_acl: set acl for file %s\n", fname ));
4658 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4659 return True;
4660 }
4661
4662 /********************************************************************
4663 Pull the NT ACL from a file on disk or the OpenEventlog() access
4664 check. Caller is responsible for freeing the returned security
4665 descriptor via TALLOC_FREE(). This is designed for dealing with
4666 user space access checks in smbd outside of the VFS. For example,
4667 checking access rights in OpenEventlog().
4668
4669 Assume we are dealing with files (for now)
4670 ********************************************************************/
4671
4672 SEC_DESC *get_nt_acl_no_snum( TALLOC_CTX *ctx, const char *fname)
4673 {
4674 SEC_DESC *psd, *ret_sd;
4675 connection_struct *conn;
4676 files_struct finfo;
4677 struct fd_handle fh;
4678 NTSTATUS status;
4679
4680 conn = TALLOC_ZERO_P(ctx, connection_struct);
4681 if (conn == NULL) {
4682 DEBUG(0, ("talloc failed\n"));
4683 return NULL;
4684 }
4685
4686 if (!(conn->params = TALLOC_P(conn, struct share_params))) {
4687 DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
4688 TALLOC_FREE(conn);
4689 return NULL;
4690 }
4691
4692 conn->params->service = -1;
4693
4694 set_conn_connectpath(conn, "/");
4695
4696 if (!smbd_vfs_init(conn)) {
4697 DEBUG(0,("get_nt_acl_no_snum: Unable to create a fake connection struct!\n"));
4698 conn_free(conn);
4699 return NULL;
4700 }
4701
4702 ZERO_STRUCT( finfo );
4703 ZERO_STRUCT( fh );
4704
4705 finfo.fnum = -1;
4706 finfo.conn = conn;
4707 finfo.fh = &fh;
4708 finfo.fh->fd = -1;
4709
4710 status = create_synthetic_smb_fname(talloc_tos(), fname, NULL, NULL,
4711 &finfo.fsp_name);
4712 if (!NT_STATUS_IS_OK(status)) {
4713 conn_free(conn);
4714 return NULL;
4715 }
4716
4717 if (!NT_STATUS_IS_OK(SMB_VFS_FGET_NT_ACL( &finfo, DACL_SECURITY_INFORMATION, &psd))) {
4718 DEBUG(0,("get_nt_acl_no_snum: get_nt_acl returned zero.\n"));
4719 TALLOC_FREE(finfo.fsp_name);
4720 conn_free(conn);
4721 return NULL;
4722 }
4723
4724 ret_sd = dup_sec_desc( ctx, psd );
4725
4726 TALLOC_FREE(finfo.fsp_name);
4727 conn_free(conn);
4728
4729 return ret_sd;
4730 }
4731
4732 /* Stolen shamelessly from pvfs_default_acl() in source4 :-). */
4733
4734 NTSTATUS make_default_filesystem_acl(TALLOC_CTX *ctx,
4735 const char *name,
4736 SMB_STRUCT_STAT *psbuf,
4737 SEC_DESC **ppdesc)
4738 {
4739 struct dom_sid owner_sid, group_sid;
4740 size_t size = 0;
4741 SEC_ACE aces[4];
4742 uint32_t access_mask = 0;
4743 mode_t mode = psbuf->st_ex_mode;
4744 SEC_ACL *new_dacl = NULL;
4745 int idx = 0;
4746
4747 DEBUG(10,("make_default_filesystem_acl: file %s mode = 0%o\n",
4748 name, (int)mode ));
4749
4750 uid_to_sid(&owner_sid, psbuf->st_ex_uid);
4751 gid_to_sid(&group_sid, psbuf->st_ex_gid);
4752
4753 /*
4754 We provide up to 4 ACEs
4755 - Owner
4756 - Group
4757 - Everyone
4758 - NT System
4759 */
4760
4761 if (mode & S_IRUSR) {
4762 if (mode & S_IWUSR) {
4763 access_mask |= SEC_RIGHTS_FILE_ALL;
4764 } else {
4765 access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
4766 }
4767 }
4768 if (mode & S_IWUSR) {
4769 access_mask |= SEC_RIGHTS_FILE_WRITE | SEC_STD_DELETE;
4770 }
4771
4772 init_sec_ace(&aces[idx],
4773 &owner_sid,
4774 SEC_ACE_TYPE_ACCESS_ALLOWED,
4775 access_mask,
4776 0);
4777 idx++;
4778
4779 access_mask = 0;
4780 if (mode & S_IRGRP) {
4781 access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
4782 }
4783 if (mode & S_IWGRP) {
4784 /* note that delete is not granted - this matches posix behaviour */
4785 access_mask |= SEC_RIGHTS_FILE_WRITE;
4786 }
4787 if (access_mask) {
4788 init_sec_ace(&aces[idx],
4789 &group_sid,
4790 SEC_ACE_TYPE_ACCESS_ALLOWED,
4791 access_mask,
4792 0);
4793 idx++;
4794 }
4795
4796 access_mask = 0;
4797 if (mode & S_IROTH) {
4798 access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
4799 }
4800 if (mode & S_IWOTH) {
4801 access_mask |= SEC_RIGHTS_FILE_WRITE;
4802 }
4803 if (access_mask) {
4804 init_sec_ace(&aces[idx],
4805 &global_sid_World,
4806 SEC_ACE_TYPE_ACCESS_ALLOWED,
4807 access_mask,
4808 0);
4809 idx++;
4810 }
4811
4812 init_sec_ace(&aces[idx],
4813 &global_sid_System,
4814 SEC_ACE_TYPE_ACCESS_ALLOWED,
4815 SEC_RIGHTS_FILE_ALL,
4816 0);
4817 idx++;
4818
4819 new_dacl = make_sec_acl(ctx,
4820 NT4_ACL_REVISION,
4821 idx,
4822 aces);
4823
4824 if (!new_dacl) {
4825 return NT_STATUS_NO_MEMORY;
4826 }
4827
4828 *ppdesc = make_sec_desc(ctx,
4829 SECURITY_DESCRIPTOR_REVISION_1,
4830 SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT,
4831 &owner_sid,
4832 &group_sid,
4833 NULL,
4834 new_dacl,
4835 &size);
4836 if (!*ppdesc) {
4837 return NT_STATUS_NO_MEMORY;
4838 }
4839 return NT_STATUS_OK;
4840 }
Samba GIT mirror