| blob | 68e5eb957f2923ac87a30bb6fcc357a11ce7c512 |
1 /*
2 Unix SMB/CIFS implementation.
3 file opening and share modes
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Jeremy Allison 2001-2004
6 Copyright (C) Volker Lendecke 2005
7 Copyright (C) Ralph Boehme 2017
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
54 /*
55 * Timer for async opens, needed because they don't use a watch on
56 * a locking.tdb record. This is currently only used for real async
57 * opens and just terminates smbd if the async open times out.
58 */
61 /*
62 * For the samba kernel oplock case we use both a timeout and
63 * a watch on locking.tdb. This way in case it's smbd holding
64 * the kernel oplock we get directly notified for the retry
65 * once the kernel oplock is properly broken. Store the req
66 * here so that it can be timely discarded once the timer
67 * above fires.
68 */
70 };
72 /****************************************************************************
73 If the requester wanted DELETE_ACCESS and was rejected because
74 the file ACL didn't include DELETE_ACCESS, see if the parent ACL
75 overrides this.
76 ****************************************************************************/
83 {
87 dirfsp,
88 smb_fname))
89 {
91 }
93 }
95 /****************************************************************************
96 Check if we have open rights.
97 ****************************************************************************/
105 {
114 access_mask,
116 rejected_share_access);
118 }
126 }
129 /* I'm sorry sir, I didn't know you were root... */
134 }
138 {
142 access_mask);
144 }
149 {
150 /* We can always delete a symlink. */
154 }
157 }
167 {
169 NTSTATUS status;
173 }
177 use_privs,
184 access_mask,
185 rejected_mask,
193 }
194 }
200 {
202 }
204 /* Here we know status == NT_STATUS_ACCESS_DENIED. */
206 access_denied:
215 {
220 }
223 dirfsp,
224 smb_fname,
225 access_mask,
226 rejected_mask))
227 {
228 /*
229 * Were we trying to do an open for delete and didn't get DELETE
230 * access. Check if the directory allows DELETE_CHILD.
231 * See here:
232 * http://blogs.msdn.com/oldnewthing/archive/2004/06/04/148426.aspx
233 * for details.
234 */
240 }
244 }
246 }
252 {
255 NTSTATUS status;
257 /* Cope with fake/printer fsp's. */
261 }
263 }
266 /*
267 * This is a POSIX open on a symlink. For the pathname
268 * version of this function we used to return the st_mode
269 * bits turned into an NT ACL. For a symlink the mode bits
270 * are always rwxrwxrwx which means the pathname version always
271 * returned NT_STATUS_OK for a symlink. For the handle reference
272 * to a symlink use the handle access bits.
273 */
276 }
278 }
280 /*
281 * If we can access the path to this file, by
282 * default we have FILE_READ_ATTRIBUTES from the
283 * containing directory. See the section:
284 * "Algorithm to Check Access to an Existing File"
285 * in MS-FSA.pdf.
286 *
287 * se_file_access_check() also takes care of
288 * owner WRITE_DAC and READ_CONTROL.
289 */
292 /*
293 * Samba 3.6 and earlier granted execute access even
294 * if the ACL did not contain execute rights.
295 * Samba 4.0 is more correct and checks it.
296 * The compatibility mode allows one to skip this check
297 * to smoothen upgrades.
298 */
301 }
305 use_privs,
306 access_mask,
307 do_not_check_mask);
310 }
314 SECINFO_GROUP |
315 SECINFO_DACL),
323 }
326 dirfsp,
328 sd,
329 use_privs,
330 access_mask,
331 do_not_check_mask);
332 }
334 /*
335 * Given an fsp that represents a parent directory,
336 * check if the requested access can be granted.
337 */
340 {
341 NTSTATUS status;
350 /* I'm sorry sir, I didn't know you were root... */
356 }
359 SECINFO_DACL,
360 frame,
369 }
371 /*
372 * If we can access the path to this file, by
373 * default we have FILE_READ_ATTRIBUTES from the
374 * containing directory. See the section:
375 * "Algorithm to Check Access to an Existing File"
376 * in MS-FSA.pdf.
377 *
378 * se_file_access_check() also takes care of
379 * owner WRITE_DAC and READ_CONTROL.
380 */
390 access_mask,
391 access_granted,
394 }
399 }
403 }
405 /* Check if the directory has delete-on-close set */
411 }
413 /*
414 * Don't take a lock here. We just need a snapshot
415 * of the current state of delete on close and this is
416 * called in a codepath where we may already have a lock
417 * (and we explicitly can't hold 2 locks at the same time
418 * as that may deadlock).
419 */
424 }
430 }
434 out:
437 }
439 /****************************************************************************
440 Ensure when opening a base file for a stream open that we have permissions
441 to do so given the access mask on the base file.
442 ****************************************************************************/
446 {
447 NTSTATUS status;
450 fsp,
452 access_mask,
460 }
466 }
470 }
471 }
474 fsp,
476 access_mask);
477 }
486 {
491 NTSTATUS status;
501 }
503 /* Pin parent directory in place. */
511 }
512 }
517 NULL,
518 NULL,
524 }
533 }
537 connectpath_len,
544 }
551 connectpath,
557 out:
562 }
565 }
567 /*
568 * Get the symlink target of dirfsp/symlink_name, making sure the
569 * target is below connection_path.
570 */
579 {
582 NTSTATUS status;
585 /*
586 * fsp is an O_PATH open, Linux does a "freadlink"
587 * with an empty name argument to readlinkat
588 */
593 }
596 connection_path,
598 target,
605 }
608 /*
609 * special case symlink to share root: "." is our
610 * share root filename
611 */
616 }
617 }
621 }
623 /****************************************************************************
624 Non-widelink open.
625 ****************************************************************************/
631 {
650 /*
651 * This can happen with shadow_copy2 if the snapshot
652 * path is not found
653 */
655 }
658 again:
666 }
667 }
668 }
674 smb_fname,
679 }
683 conn,
684 connpath,
685 connpath_len,
686 parent_dir_fname,
690 }
692 /* Setup fsp->fsp_name to be relative to cwd */
695 /*
696 * fsp->fsp_name is unchanged as it is already correctly
697 * relative to dirfsp.
698 */
700 }
702 {
703 /*
704 * Assert nobody can step in with a symlink on the
705 * path, there is no path anymore and we'll use
706 * O_NOFOLLOW to open.
707 */
710 }
715 dirfsp,
716 smb_fname_rel,
717 fsp,
726 }
728 /*
729 * ENOENT makes it worthless retrying with a
730 * stat, we know for sure the file does not
731 * exist. For everything else we want to know
732 * what's there.
733 */
736 dirfsp,
737 smb_fname_rel,
739 AT_SYMLINK_NOFOLLOW);
742 /*
743 * Keep the original error. Otherwise we would
744 * mask for example EROFS for open(O_CREAT),
745 * turning it into ENOENT.
746 */
748 }
751 }
759 }
766 }
768 /*
769 * Found a symlink to follow in user space
770 */
773 /* Never follow symlinks on posix open. */
776 }
778 /* Explicitly no symlinks. */
781 }
787 }
793 connpath,
794 fsp,
796 smb_fname_rel,
803 }
805 /*
806 * Close what openat(O_PATH) potentially left behind
807 */
812 }
819 }
821 }
823 /*
824 * And do it all again... As smb_fname is not relative to the passed in
825 * dirfsp anymore, we pass conn->cwd_fsp as dirfsp to
826 * non_widelink_open() to trigger the chdir(parentdir) logic.
827 */
832 out:
840 }
846 }
848 }
850 }
852 /****************************************************************************
853 fd support routines - attempt to do a dos_open.
854 ****************************************************************************/
860 {
869 /*
870 * Never follow symlinks on a POSIX client. The
871 * client should be doing this.
872 */
876 }
882 conn,
884 smb_fname,
885 fsp,
889 }
898 }
899 }
902 }
904 /*
905 * Only follow symlinks within a share
906 * definition.
907 */
915 "to open more! smbd's max "
919 }
920 }
929 }
938 }
940 /****************************************************************************
941 Close the file associated with a fsp.
942 ****************************************************************************/
945 {
951 }
954 /*
955 * capture status, if failure
956 * continue close processing
957 * and return status
958 */
960 }
964 }
966 /*
967 * Either a directory where the dptr_CloseDir() already closed
968 * the fd or a stat open.
969 */
971 }
974 }
980 }
982 }
984 /****************************************************************************
985 Change the ownership of a file to that of the parent directory.
986 Do this by fd if possible.
987 ****************************************************************************/
991 {
995 /* Already this uid - no need to change. */
1000 }
1009 "file %s to parent directory uid %u. Error "
1019 /* Ensure the uid entry is updated. */
1022 }
1023 }
1027 {
1028 NTSTATUS status;
1032 /* Already this uid - no need to change. */
1037 }
1047 "directory %s to parent directory uid %u. "
1053 }
1060 /* Ensure the uid entry is updated. */
1064 }
1066 /****************************************************************************
1067 Open a file - returning a guaranteed ATOMIC indication of if the
1068 file was created or not.
1069 ****************************************************************************/
1076 {
1079 NTSTATUS retry_status;
1083 /*
1084 * We're not creating the file, just pass through.
1085 */
1089 }
1092 /*
1093 * Fail if already exists, just pass through.
1094 */
1097 /*
1098 * Here we've opened with O_CREAT|O_EXCL. If that went
1099 * NT_STATUS_OK, we *know* we created this file.
1100 */
1104 }
1106 /*
1107 * Now it gets tricky. We have O_CREAT, but not O_EXCL.
1108 * To know absolutely if we created the file or not,
1109 * we can never call O_CREAT without O_EXCL. So if
1110 * we think the file existed, try without O_CREAT|O_EXCL.
1111 * If we think the file didn't exist, try with
1112 * O_CREAT|O_EXCL.
1113 *
1114 * The big problem here is dangling symlinks. Opening
1115 * without O_NOFOLLOW means both bad symlink
1116 * and missing path return -1, ENOENT from open(). As POSIX
1117 * is pathname based it's not possible to tell
1118 * the difference between these two cases in a
1119 * non-racy way, so change to try only two attempts before
1120 * giving up.
1121 *
1122 * We don't have this problem for the O_NOFOLLOW
1123 * case as it just returns NT_STATUS_OBJECT_PATH_NOT_FOUND
1124 * mapped from the ELOOP POSIX error.
1125 */
1133 }
1139 }
1152 }
1155 }
1159 }
1166 {
1167 NTSTATUS status;
1176 };
1184 }
1187 }
1194 fsp,
1195 how);
1200 }
1205 }
1209 }
1211 /*
1212 * Close the existing pathref fd and set the fsp flag
1213 * is_pathref to false so we get a "normal" fd this time.
1214 */
1218 }
1224 }
1226 /****************************************************************************
1227 Open a file.
1228 ****************************************************************************/
1240 {
1247 FILE_READ_DATA |
1248 FILE_WRITE_DATA |
1249 FILE_APPEND_DATA |
1250 FILE_EXECUTE |
1251 SEC_FLAG_SYSTEM_SECURITY;
1256 /*
1257 * Catch early an attempt to open an existing
1258 * directory as a file.
1259 */
1262 }
1264 /*
1265 * This little piece of insanity is inspired by the
1266 * fact that an NT client can open a file for O_RDONLY,
1267 * but set the create disposition to FILE_EXISTS_TRUNCATE.
1268 * If the client *can* write to the file, then it expects to
1269 * truncate the file, even though it is opening for readonly.
1270 * Quicken uses this stupid trick in backup file creation...
1271 * Thanks *greatly* to "David W. Chapman Jr." <dwcjr@inethouston.net>
1272 * for helping track this one down. It didn't bite us in 2.0.x
1273 * as we always opened files read-write in that release. JRA.
1274 */
1280 }
1282 /* Check permissions */
1284 /*
1285 * This code was changed after seeing a client open request
1286 * containing the open mode of (DENY_WRITE/read-only) with
1287 * the 'create if not exist' bit set. The previous code
1288 * would fail to open the file read only on a read-only share
1289 * as it was checking the flags parameter directly against O_RDONLY,
1290 * this was failing as the flags parameter was set to O_RDONLY|O_CREAT.
1291 * JRA.
1292 */
1295 /* It's a read-only share - fail if we wanted to write. */
1301 }
1302 /*
1303 * We don't want to write - but we must make sure that
1304 * O_CREAT doesn't create the file if we have write
1305 * access into the directory.
1306 */
1308 }
1313 }
1318 #if defined(O_NONBLOCK) && defined(S_ISFIFO)
1319 /*
1320 * We would block on opening a FIFO with no one else on the
1321 * other end. Do what we used to do and add O_NONBLOCK to the
1322 * open flags. JRA.
1323 */
1327 }
1328 #endif
1332 /*
1333 * Don't open files with Microsoft wildcard characters.
1334 */
1336 /*
1337 * wildcard characters are allowed in stream
1338 * names only test the basefilename
1339 */
1341 }
1345 }
1346 }
1348 /* Can we access this file ? */
1350 /* Only do this check on non-stream open. */
1353 dirfsp,
1354 fsp,
1356 open_access_mask);
1363 }
1367 NT_STATUS_OBJECT_NAME_NOT_FOUND))
1368 {
1370 }
1373 NT_STATUS_OBJECT_NAME_NOT_FOUND))
1374 {
1376 "file %s vanished since we "
1381 }
1382 }
1386 /* File didn't exist and no O_CREAT. */
1388 }
1391 dirfsp,
1392 SEC_DIR_ADD_FILE);
1395 "directory %s for file %s "
1402 }
1403 }
1404 }
1406 /*
1407 * Actually do the open - if O_TRUNC is needed handle it
1408 * below under the share mode lock.
1409 */
1412 smb_fname_atname,
1413 fsp,
1415 p_file_created);
1417 /*
1418 * Non-O_PATH reopen that hit a race
1419 * condition: Someone has put a symlink where
1420 * we used to have a file. Can't happen with
1421 * O_PATH and reopening from /proc/self/fd/ or
1422 * equivalent.
1423 */
1425 }
1434 }
1437 /*
1438 * GPFS can return ETIMEDOUT for pread on
1439 * nonblocking file descriptors when files
1440 * migrated to tape need to be recalled. I
1441 * could imagine this happens elsewhere
1442 * too. With blocking file descriptors this
1443 * does not happen.
1444 */
1452 }
1453 }
1456 /* We created this file. */
1459 /* Do all inheritance work after we've
1460 done a successful fstat call and filled
1461 in the stat struct in fsp->fsp_name. */
1463 /* Inherit the ACL if required */
1466 dirfsp,
1467 smb_fname,
1470 }
1472 /* Change the owner if required. */
1476 }
1480 /*
1481 * If we have an fd, this stat should succeed.
1482 */
1490 }
1491 }
1494 FILE_NOTIFY_CHANGE_FILE_NAME,
1496 }
1499 /* File must exist for a stat open. */
1501 }
1505 {
1506 /*
1507 * Don't allow stat opens on symlinks directly unless
1508 * it's a POSIX open. Match the return code from
1509 * openat_pathref_fsp().
1510 */
1512 }
1515 /*
1516 * There is only one legit case where end up here:
1517 * openat_pathref_fsp() failed to open a symlink, so the
1518 * fsp was created by fsp_new() which doesn't set
1519 * is_pathref. Other than that, we should always have a
1520 * pathref fsp at this point. The subsequent checks
1521 * assert this.
1522 */
1527 }
1532 }
1538 }
1539 }
1541 /*
1542 * Access to streams is checked by checking the basefile and
1543 * that has already been checked by check_base_file_access()
1544 * in create_file_unixpath().
1545 */
1548 fsp,
1550 open_access_mask);
1553 posix_open &&
1555 /* This is a POSIX stat open for delete
1556 * or rename on a symlink that points
1557 * nowhere. Allow. */
1562 }
1570 }
1571 }
1572 }
1584 }
1593 }
1603 }
1612 {
1621 new_access,
1622 access_mask,
1623 existing_sharemode,
1624 sharemode_mask);
1626 }
1630 new_sharemode,
1631 sharemode_mask,
1632 existing_access,
1633 access_mask);
1635 }
1637 }
1639 /****************************************************************************
1640 Check if we can open a file with a share mode.
1641 Returns True if conflict, False if not.
1642 ****************************************************************************/
1645 FILE_WRITE_DATA|
1646 FILE_APPEND_DATA|
1647 FILE_READ_DATA|
1648 FILE_EXECUTE|
1649 DELETE_ACCESS;
1655 {
1662 e_access_mask,
1663 e_share_access,
1664 access_mask,
1665 share_access);
1670 e_access_mask);
1672 }
1675 access_mask);
1677 }
1691 }
1693 #if defined(DEVELOPER)
1699 };
1705 {
1711 }
1714 /* INTERNAL_OPEN_ONLY */
1716 }
1724 }
1728 }
1732 panic:
1733 {
1738 "validate_my_share_entries: "
1744 }
1747 }
1748 #endif
1750 /**
1751 * Allowed access mask for stat opens relevant to oplocks
1752 **/
1754 {
1757 FILE_READ_ATTRIBUTES|
1758 FILE_WRITE_ATTRIBUTES);
1762 }
1764 /**
1765 * Allowed access mask for stat opens relevant to leases
1766 **/
1768 {
1771 FILE_READ_ATTRIBUTES|
1772 FILE_WRITE_ATTRIBUTES|
1773 READ_CONTROL_ACCESS);
1777 }
1781 };
1787 {
1791 }
1795 {
1801 }
1807 }
1809 }
1816 {
1821 lck,
1829 }
1833 lck,
1834 existing_access_mask,
1835 existing_share_mode,
1836 existing_lease_type,
1837 NULL);
1838 }
1840 /****************************************************************************
1841 Deal with share modes
1842 Invariant: Share mode must be locked on entry and exit.
1843 Returns -1 on error, or number of share modes on success (may be zero).
1844 ****************************************************************************/
1851 };
1857 {
1865 }
1871 }
1878 }
1883 }
1890 }
1897 {
1903 /* Stat open that doesn't trigger oplock breaks or share mode
1904 * checks... ! JRA. */
1906 }
1908 /*
1909 * Check if the share modes will give us access.
1910 */
1912 #if defined(DEVELOPER)
1913 {
1918 };
1922 }
1923 #endif
1931 access_mask,
1932 share_access);
1936 }
1941 FILE_SHARE_WRITE|
1942 FILE_SHARE_DELETE),
1943 };
1945 /*
1946 * Walk the share mode array to recalculate d->flags
1947 */
1953 }
1956 lck,
1962 /*
1963 * We only end up here if we had a sharing violation
1964 * from d->flags and have recalculated it.
1965 */
1967 }
1972 access_mask,
1973 share_access);
1977 }
1980 }
1982 /*
1983 * Send a break message to the oplock holder and delay the open for
1984 * our client.
1985 */
1991 {
1996 };
2000 NTSTATUS status;
2007 }
2017 }
2021 MSG_SMB_BREAK_REQUEST,
2026 }
2029 }
2038 };
2044 {
2048 /* INTERNAL_OPEN_ONLY */
2050 }
2053 /*
2054 * We ignore stat opens in the table - they always
2055 * have NO_OPLOCK and never get or cause breaks. JRA.
2056 */
2058 }
2063 /* batch - can only be one. */
2067 }
2075 }
2077 }
2083 }
2084 /* Exclusive or batch - can only be one. */
2091 }
2093 }
2100 }
2104 }
2106 }
2113 }
2117 }
2119 }
2122 }
2124 /*
2125 * Do internal consistency checks on the share mode for a file.
2126 */
2129 {
2137 }
2144 }
2150 }
2154 }
2164 }
2167 }
2172 {
2175 }
2178 }
2184 }
2187 {
2195 }
2202 {
2205 /*
2206 * TODO: Measure how expensive this loop is with thousands of open
2207 * handles...
2208 */
2216 }
2219 }
2223 }
2224 }
2226 /* Not found - must be leased in another smbd. */
2230 }
2235 /*
2236 * We internally treat all leases as V2 and update
2237 * the epoch, but when sending breaks it matters if
2238 * the requesting lease was v1 or v2.
2239 */
2243 }
2250 {
2256 NTSTATUS status;
2259 client_guid,
2270 }
2273 fsp,
2275 current_state,
2276 lease_version,
2277 epoch);
2282 }
2284 /*
2285 * Upgrade only if the requested lease is a strict upgrade.
2286 */
2290 /*
2291 * Tricky: This test makes sure that "requested" is a
2292 * strict bitwise superset of "existing".
2293 */
2296 /*
2297 * Upgrade only if there's a change.
2298 */
2301 /*
2302 * Upgrade only if other leases don't prevent what was asked
2303 * for.
2304 */
2307 /*
2308 * only upgrade if we are not in breaking state
2309 */
2317 NTSTATUS set_status;
2323 client_guid,
2325 current_state,
2326 breaking,
2327 breaking_to_requested,
2328 breaking_to_required,
2329 lease_version,
2330 epoch);
2336 }
2337 }
2342 }
2349 {
2350 NTSTATUS status;
2355 }
2377 }
2379 /*
2380 * We used to set lck->data->modified=true here without
2381 * actually modifying lck->data, triggering a needless
2382 * writeback of lck->data.
2383 *
2384 * Apart from that writeback, setting modified=true has the
2385 * effect of triggering all waiters for this file to
2386 * retry. This only makes sense if any blocking condition
2387 * (i.e. waiting for a lease to be downgraded or removed) is
2388 * gone. This routine here only adds a lease, so it will never
2389 * free up resources that blocked waiters can now claim. So
2390 * that second effect also does not matter in this
2391 * routine. Thus setting lck->data->modified=true does not
2392 * need to be done here.
2393 */
2396 }
2402 {
2404 NTSTATUS status;
2411 }
2414 }
2417 {
2431 }
2434 }
2447 };
2453 {
2463 NTSTATUS status;
2470 }
2471 }
2484 /*
2485 * leases_db_get() can return NT_STATUS_NOT_FOUND
2486 * if the share_mode_entry e is stale and the
2487 * lease record was already removed. In this case return
2488 * false so the traverse continues.
2489 */
2493 {
2498 "file_id [%s] failed for stale "
2505 }
2518 }
2521 }
2525 {
2527 }
2533 }
2539 }
2545 }
2549 }
2555 }
2564 }
2566 }
2570 }
2573 /*
2574 * If we break anyway break to NONE directly.
2575 * Otherwise vfs_set_filelen() will trigger the
2576 * break.
2577 */
2579 }
2582 /*
2583 * Oplocks only support breaking to R or NONE.
2584 */
2586 }
2595 }
2598 }
2601 };
2612 {
2617 };
2627 /*
2628 * No directory leases yet
2629 */
2633 }
2635 }
2639 /*
2640 * The SMB2 layer should have checked this
2641 */
2643 }
2649 }
2655 }
2669 }
2675 }
2679 }
2681 grant:
2684 }
2692 }
2696 }
2700 }
2704 }
2705 }
2711 }
2714 /*
2715 * Can grant only one writer
2716 */
2718 }
2727 }
2728 }
2733 }
2739 }
2741 /*
2742 * Reflect possible downgrades from:
2743 * - map_lease_type_to_oplock() => "RH" to just LEVEL_II
2744 */
2747 }
2751 {
2756 }
2764 granted,
2766 oplock_request,
2770 requested,
2779 }
2792 {
2794 NTSTATUS status;
2804 }
2808 }
2814 }
2816 /*
2817 * Internal opens never do oplocks or leases. We don't
2818 * need to go through delay_for_oplock().
2819 */
2821 }
2824 fsp,
2825 oplock_request,
2826 lease,
2827 lck,
2828 sharing_violation,
2829 create_disposition,
2830 first_open_attempt,
2831 poplock_type,
2832 pgranted);
2835 }
2838 }
2841 {
2846 }
2851 };
2855 /**
2856 * Defer an open and watch a locking.tdb record
2857 *
2858 * This defers an open that gets rescheduled once the locking.tdb record watch
2859 * is triggered by a change to the record.
2860 *
2861 * It is used to defer opens that triggered an oplock break and for the SMB1
2862 * sharing violation delay.
2863 **/
2868 {
2890 }
2895 }
2902 watch_state,
2904 lck,
2908 }
2914 }
2920 }
2921 }
2924 {
2927 NTSTATUS status;
2935 /*
2936 * Even if it failed, retry anyway. TODO: We need a way to
2937 * tell a re-scheduled open about that error.
2938 */
2939 }
2946 }
2948 /**
2949 * Actually attempt the kernel oplock polling open.
2950 */
2956 {
2967 }
2969 }
2977 };
2981 {
2987 }
2992 lck,
2997 }
2998 }
3000 /**
3001 * Reschedule an open for 1 second from now, if not timed out.
3002 **/
3008 {
3017 }
3023 }
3027 /*
3028 * Make sure open_rec->te does not come later than the
3029 * request's maximum endtime.
3030 */
3038 open_rec,
3039 next_interval,
3040 poll_open_fn,
3041 open_rec);
3046 }
3052 };
3053 NTSTATUS status;
3056 poll_open_setup_watcher_fn,
3063 }
3066 poll_open_done,
3067 open_rec);
3073 }
3076 }
3083 }
3091 }
3094 {
3097 NTSTATUS status;
3112 }
3113 }
3116 {
3122 }
3124 /*
3125 * Try every 200msec up to (by default) one second. To be
3126 * precise, according to behaviour note <247> in [MS-CIFS],
3127 * the server tries 5 times. But up to one second should be
3128 * close enough.
3129 */
3135 SHARING_VIOLATION_USEC_WAIT);
3138 req,
3139 NULL,
3143 }
3145 /****************************************************************************
3146 On overwrite open ensure that the attributes match.
3147 ****************************************************************************/
3152 mode_t new_unx_mode,
3154 {
3161 (noarch_old_dos_attr != 0 && ((noarch_old_dos_attr & noarch_new_dos_attr) == noarch_old_dos_attr))) {
3165 }
3168 "new_dos_attr = 0x%x "
3174 /* If we're mapping SYSTEM and HIDDEN ensure they match. */
3179 }
3180 }
3185 }
3186 }
3188 }
3193 {
3194 /* This is a relative time, added to the absolute
3195 request_time value to get the absolute timeout time.
3196 Note that if this is the second or greater time we enter
3197 this codepath for this particular request mid then
3198 request_time is left as the absolute time of the *first*
3199 time this request mid was processed. This is what allows
3200 the request to eventually time out. */
3204 /* Normally the smbd we asked should respond within
3205 * OPLOCK_BREAK_TIMEOUT seconds regardless of whether
3206 * the client did, give twice the timeout as a safety
3207 * measure here in case the other smbd is stuck
3208 * somewhere else. */
3214 }
3217 }
3219 /****************************************************************************
3220 Reschedule an open call that went asynchronous.
3221 ****************************************************************************/
3227 {
3229 }
3232 {
3239 }
3244 }
3251 }
3254 req,
3256 schedule_async_open_timer,
3257 open_rec);
3260 }
3261 }
3273 {
3274 NTSTATUS status;
3281 /* Get the types we need to examine. */
3284 }
3289 }
3292 lck,
3293 create_disposition,
3294 access_mask,
3295 share_access,
3296 oplock_request,
3297 lease,
3298 first_open_attempt,
3304 }
3307 }
3311 }
3316 fsp,
3319 oplock_type,
3320 lease_key,
3321 share_access,
3322 access_mask);
3325 }
3332 }
3335 }
3340 }
3342 /****************************************************************************
3343 Work out what access_mask to use from what the client sent us.
3344 ****************************************************************************/
3351 {
3355 NTSTATUS status;
3357 /* Cope with symlinks */
3361 }
3363 /* Cope with fake/printer fsp's. */
3367 }
3372 }
3376 SECINFO_GROUP |
3377 SECINFO_DACL),
3382 /*
3383 * File did not exist
3384 */
3387 }
3393 }
3395 /*
3396 * If we can access the path to this file, by
3397 * default we have FILE_READ_ATTRIBUTES from the
3398 * containing directory. See the section:
3399 * "Algorithm to Check Access to an Existing File"
3400 * in MS-FSA.pdf.
3401 *
3402 * se_file_access_check()
3403 * also takes care of owner WRITE_DAC and READ_CONTROL.
3404 */
3407 use_privs,
3419 }
3425 dirfsp,
3428 }
3429 }
3434 }
3437 }
3444 {
3445 NTSTATUS status;
3451 access_mask);
3453 }
3455 /*
3456 * Convert GENERIC bits to specific bits.
3457 */
3461 /* Calculate MAXIMUM_ALLOWED_ACCESS if requested. */
3465 dirfsp,
3466 fsp,
3467 use_privs,
3472 }
3475 }
3481 "rejected by share access mask[0x%08X] "
3486 rejected_share_access);
3488 }
3492 }
3494 /****************************************************************************
3495 Remove the deferred open entry under lock.
3496 ****************************************************************************/
3498 /****************************************************************************
3499 Return true if this is a state pointer to an asynchronous create.
3500 ****************************************************************************/
3503 {
3505 }
3508 {
3519 }
3521 }
3524 {
3527 /*
3528 * Currently we're using FILE_SUPERSEDE as the same as
3529 * FILE_OVERWRITE_IF but they really are
3530 * different. FILE_SUPERSEDE deletes an existing file
3531 * (requiring delete access) then recreates it.
3532 */
3537 /*
3538 * If file exists replace/overwrite. If file doesn't
3539 * exist create.
3540 */
3545 /*
3546 * If file exists open. If file doesn't exist error.
3547 */
3552 /*
3553 * If file exists overwrite. If file doesn't exist
3554 * error.
3555 */
3560 /*
3561 * If file exists error. If file doesn't exist create.
3562 */
3567 /*
3568 * If file exists open. If file doesn't exist create.
3569 */
3572 }
3574 }
3578 NTTIME twrp)
3579 {
3582 /*
3583 * Note that we ignore the append flag as append does not
3584 * mean the same thing under DOS and Unix.
3585 */
3588 /*
3589 * Pave over the user requested mode and force O_RDONLY for the
3590 * file handle. Windows allows opening a VSS file with O_RDWR,
3591 * even though actual writes on the handle will fail.
3592 */
3594 }
3599 }
3601 /* DENY_DOS opens are always underlying read-write on the
3602 file handle, no matter what the requested access mask
3603 says. */
3605 need_read =
3612 }
3614 }
3628 NTSTATUS status;
3630 share_mode_entry_prepare_unlock_fn_t cleanup_fn;
3631 };
3636 {
3640 /*
3641 * By default drop the g_lock again if we leave the
3642 * tdb chainlock.
3643 */
3648 lck,
3657 }
3661 /*
3662 * keep the g_lock while existing the tdb chainlock,
3663 * we we're asked to, which mean we'll keep
3664 * the share_mode_lock during object creation,
3665 * or setting delete on close.
3666 */
3668 }
3672 {
3681 }
3682 }
3686 {
3695 }
3696 }
3705 {
3711 }
3713 /* Overwritten files should be initially set as archive */
3718 }
3721 }
3724 smb_fname,
3726 parent_dir_fname,
3730 }
3732 }
3734 /****************************************************************************
3735 Open a file with a share mode. Passed in an already created files_struct *.
3736 ****************************************************************************/
3747 /* Information (FILE_EXISTS etc.) */
3753 {
3770 NTSTATUS status;
3774 NTSTATUS ulstatus;
3777 /*
3778 * Printers are handled completely differently.
3779 * Most of the passed parameters are ignored.
3780 */
3784 }
3792 }
3796 }
3803 /* Windows allows a new file to be created and
3804 silently removes a FILE_ATTRIBUTE_DIRECTORY
3805 sent by the client. Do the same. */
3809 /* We add FILE_ATTRIBUTE_ARCHIVE to this as this mode is only used if the file is
3810 * created new. */
3812 conn,
3814 smb_fname,
3816 }
3819 "access_mask=0x%x share_access=0x%x "
3820 "create_disposition = 0x%x create_options=0x%x "
3828 /* Ensure req == NULL means INTERNAL_OPEN_ONLY */
3831 /* And req != NULL means no INTERNAL_OPEN_ONLY */
3833 }
3835 /*
3836 * Only non-internal opens can be deferred at all
3837 */
3843 /* If it was an async create retry, the file
3844 didn't exist. */
3849 }
3851 /* Ensure we don't reprocess this message. */
3855 }
3856 }
3861 /*
3862 * Only use stored DOS attributes for checks
3863 * against requested attributes (below via
3864 * open_match_attributes()), cf bug #11992
3865 * for details. -slow
3866 */
3870 conn,
3875 }
3876 }
3877 }
3879 /* ignore any oplock requests if oplocks are disabled */
3882 /* Mask off everything except the private Samba bits. */
3884 }
3886 /* this is for OS/2 long file names - say we don't support them */
3889 /* OS/2 Workplace shell fix may be main code stream in a later
3890 * release. */
3895 }
3897 }
3901 /* If file exists open. If file doesn't exist error. */
3904 "requested for file %s and file "
3908 }
3912 /* If file exists overwrite. If file doesn't exist
3913 * error. */
3916 "requested for file %s and file "
3920 }
3923 }
3927 /* If file exists error. If file doesn't exist
3928 * create. */
3931 "requested for file %s and file "
3936 }
3938 }
3941 }
3948 }
3954 }
3956 }
3960 }
3964 /* We only care about matching attributes on file exists and
3965 * overwrite. */
3971 new_dos_attributes,
3976 existing_dos_attributes,
3977 new_dos_attributes,
3981 }
3982 }
3987 access_mask,
3995 }
4001 }
4004 /*
4005 * stat opens on existing files don't get oplocks.
4006 * They can get leases.
4007 *
4008 * Note that we check for stat open on the *open_access_mask*,
4009 * i.e. the access mask we actually used to do the open,
4010 * not the one the client asked for (which is in
4011 * fsp->access_mask). This is due to the fact that
4012 * FILE_OVERWRITE and FILE_OVERWRITE_IF add in O_TRUNC,
4013 * which adds FILE_WRITE_DATA to open_access_mask.
4014 */
4017 }
4018 }
4022 access_mask));
4024 /*
4025 * Note that we ignore the append flag as append does not
4026 * mean the same thing under DOS and Unix.
4027 */
4030 private_flags,
4033 /*
4034 * Currently we only look at FILE_WRITE_THROUGH for create options.
4035 */
4037 #if defined(O_SYNC)
4040 }
4045 }
4048 /*
4049 * We should really return a permission denied error if either
4050 * O_CREAT or O_TRUNC are set, but for compatibility with
4051 * older versions of Samba we just AND them out.
4052 */
4054 }
4056 /*
4057 * With kernel oplocks the open breaking an oplock
4058 * blocks until the oplock holder has given up the
4059 * oplock or closed the file. We prevent this by always
4060 * trying to open the file with O_NONBLOCK (see "man
4061 * fcntl" on Linux).
4062 *
4063 * If a process that doesn't use the smbd open files
4064 * database or communication methods holds a kernel
4065 * oplock we must periodically poll for available open
4066 * using O_NONBLOCK.
4067 */
4070 /*
4071 * Ensure we can't write on a read-only share or file.
4072 */
4082 }
4085 /*
4086 * Only try and create a file id before open
4087 * for an existing file. For a file being created
4088 * this won't do anything useful until the file
4089 * exists and has a valid stat struct.
4090 */
4092 }
4095 * requested access_mask after
4096 * the open is done. */
4099 }
4103 /* Delete on close semantics for new files. */
4105 new_dos_attributes);
4109 }
4110 }
4112 /*
4113 * Ensure we pay attention to default ACLs on directories if required.
4114 */
4119 }
4129 {
4133 };
4137 }
4141 smb_fname_atname,
4142 fsp,
4144 access_mask,
4145 open_access_mask,
4146 private_flags,
4148 }
4153 }
4157 }
4158 /*
4159 * This handles the kernel oplock case:
4160 *
4161 * the file has an active kernel oplock and the open() returned
4162 * EWOULDBLOCK/EAGAIN which maps to NETWORK_BUSY.
4163 *
4164 * "Samba locking.tdb oplocks" are handled below after acquiring
4165 * the sharemode lock with get_share_mode_lock().
4166 */
4168 }
4171 /*
4172 * EINTR from the open(2) syscall. Just setup a retry
4173 * in a bit. We can't use the sys_write() tight retry
4174 * loop here, as we might have to actually deal with
4175 * lease-break signals to avoid a deadlock.
4176 */
4178 }
4181 /*
4182 * Retry once a second. If there's a share_mode_lock
4183 * around, also wait for it in case it was smbd
4184 * holding that kernel oplock that can quickly tell us
4185 * the oplock got removed.
4186 */
4195 }
4202 }
4204 }
4207 /*
4208 * As we atomically create using O_CREAT|O_EXCL,
4209 * then if new_file_created is true, then
4210 * file_existed *MUST* have been false (even
4211 * if the file was previously detected as being
4212 * there).
4213 */
4215 }
4218 /*
4219 * The file did exist, but some other (local or NFS)
4220 * process either renamed/unlinked and re-created the
4221 * file with different dev/ino after we walked the path,
4222 * but before we did the open. We could retry the
4223 * open but it's a rare enough case it's easier to
4224 * just fail the open to prevent creating any problems
4225 * in the open file db having the wrong dev/ino key.
4226 */
4229 "Old (dev=%ju, ino=%ju). "
4230 "New (dev=%ju, ino=%ju). Failing open "
4238 }
4242 /*
4243 * Deal with the race condition where two smbd's detect the
4244 * file doesn't exist and do the create at the same time. One
4245 * of them will win and set a share mode, the other (ie. this
4246 * one) should check if the requested share mode for this
4247 * create is allowed.
4248 */
4250 /*
4251 * Now the file exists and fsp is successfully opened,
4252 * fsp->dev and fsp->inode are valid and should replace the
4253 * dev=0,inode=0 from a non existent file. Spotted by
4254 * Nadav Danieli <nadavd@exanet.com>. JRA.
4255 */
4264 }
4265 }
4267 /*
4268 * If we created a new file, overwrite an existing one
4269 * or going to delete it later, we should keep
4270 * the share_mode_lock (g_lock) until we call
4271 * share_mode_entry_prepare_unlock()
4272 */
4277 }
4290 };
4295 smb_fname,
4297 open_ntcreate_lock_add_entry,
4304 }
4310 }
4312 /*
4313 * From here we need to use 'goto unlock;' instead of return !!!
4314 */
4317 /*
4318 * Now ask for kernel oplocks
4319 * and cleanup on failure.
4320 */
4323 /*
4324 * Could not get the kernel oplock
4325 */
4327 open_ntcreate_lock_cleanup_oplock;
4329 }
4330 }
4332 /* Should we atomically (to the client at least) truncate ? */
4341 open_ntcreate_lock_cleanup_entry;
4343 }
4345 FILE_NOTIFY_CHANGE_SIZE
4348 }
4350 /*
4351 * We have the share entry *locked*.....
4352 */
4354 /* Delete streams if create_disposition requires it */
4361 open_ntcreate_lock_cleanup_entry;
4363 }
4364 }
4369 {
4371 /*
4372 * Beware: streams implementing VFS modules may
4373 * implement streams in a way that fsp will have the
4374 * basefile open in the fsp fd, so lacking a distinct
4375 * fd for the stream the file-system sharemode will
4376 * apply on the basefile which is wrong. The actual
4377 * check is deferred to the VFS module implementing
4378 * the file-system sharemode call.
4379 */
4381 share_access,
4382 access_mask);
4386 open_ntcreate_lock_cleanup_entry;
4388 }
4391 }
4393 /*
4394 * At this point onwards, we can guarantee that the share entry
4395 * is locked, whether we created the file or not, and that the
4396 * deny mode is compatible with all current opens.
4397 */
4399 /*
4400 * According to Samba4, SEC_FILE_READ_ATTRIBUTE is always granted,
4401 * but we don't have to store this - just ignore it on access check.
4402 */
4404 /*
4405 * SMB2 doesn't return it (according to Microsoft tests).
4406 * Test Case: TestSuite_ScenarioNo009GrantedAccessTestS0
4407 * File created with access = 0x7 (Read, Write, Delete)
4408 * Query Info on file returns 0x87 (Read, Write, Delete, Read Attributes)
4409 */
4412 /* But SMB1 does. */
4414 }
4418 }
4420 /* Handle strange delete on close create semantics. */
4424 existing_dos_attributes);
4427 /* Remember to delete the mode we just added. */
4429 open_ntcreate_lock_cleanup_entry;
4431 }
4432 }
4433 /* Note that here we set the *initial* delete on close flag,
4434 not the regular one. The magic gets handled in close. */
4436 }
4439 fsp,
4440 smb_fname,
4441 parent_dir_fname,
4442 info,
4443 new_dos_attributes,
4446 /* Determine sparse flag. */
4448 /* POSIX opens are sparse by default. */
4453 }
4455 /*
4456 * Take care of inherited ACLs on created files - if default ACL not
4457 * selected.
4458 */
4468 }
4469 }
4472 /*
4473 * We only get here in the case of:
4474 *
4475 * a). Not a POSIX open.
4476 * b). File already existed.
4477 * c). File was overwritten.
4478 * d). Requested DOS attributes didn't match
4479 * the DOS attributes on the existing file.
4480 *
4481 * In that case new_unx_mode has been set
4482 * equal to the calculated mode (including
4483 * possible inheritance of the mode from the
4484 * containing directory).
4485 *
4486 * Note this mode was calculated with the
4487 * DOS attribute FILE_ATTRIBUTE_ARCHIVE added,
4488 * so the mode change here is suitable for
4489 * an overwritten file.
4490 */
4499 }
4500 }
4501 }
4503 /*
4504 * Deal with other opens having a modified write time.
4505 */
4508 {
4510 }
4514 unlock:
4522 }
4527 }
4530 }
4538 {
4541 mode_t mode;
4542 NTSTATUS status;
4553 }
4560 FILE_ATTRIBUTE_DIRECTORY,
4561 smb_dname,
4563 }
4573 }
4578 }
4579 }
4583 smb_fname_atname,
4584 mode);
4587 }
4589 /*
4590 * Make this a pathref fsp for now. open_directory() will reopen as a
4591 * full fsp.
4592 */
4598 }
4600 /* Ensure we're checking for a symlink here.... */
4601 /* We don't want to get caught by a symlink racer. */
4608 }
4614 }
4618 smb_dname,
4620 parent_dir_fname,
4622 }
4628 }
4631 /*
4632 * Check if high bits should have been set,
4633 * then (if bits are missing): add them.
4634 * Consider bits automagically set by UNIX, i.e. SGID bit from parent
4635 * dir.
4636 */
4643 }
4644 }
4646 /* Change the owner if required. */
4649 fsp);
4651 }
4659 }
4660 }
4666 }
4668 /****************************************************************************
4669 Open a directory from an NT SMB call.
4670 ****************************************************************************/
4683 {
4688 NTSTATUS status;
4692 NTSTATUS ulstatus;
4698 }
4701 /* Ensure we have a directory attribute. */
4703 }
4710 access_mask,
4711 share_access,
4712 create_options,
4713 create_disposition,
4714 file_attributes);
4719 access_mask,
4727 }
4731 SEC_PRIV_SECURITY)) {
4736 }
4743 }
4750 /* If directory exists error. If directory doesn't
4751 * exist create. */
4760 }
4764 }
4767 parent_dir_fname,
4768 smb_fname_atname,
4769 smb_dname,
4770 file_attributes,
4771 fsp);
4779 }
4785 /*
4786 * If directory exists open. If directory doesn't
4787 * exist create.
4788 */
4796 }
4798 parent_dir_fname,
4799 smb_fname_atname,
4800 smb_dname,
4801 file_attributes,
4802 fsp);
4808 /* Cope with create race. */
4810 NT_STATUS_OBJECT_NAME_COLLISION)) {
4816 }
4818 /*
4819 * If mkdir_internal() returned
4820 * NT_STATUS_OBJECT_NAME_COLLISION
4821 * we still must lstat the path.
4822 */
4824 conn,
4826 smb_fname_atname,
4828 AT_SYMLINK_NOFOLLOW);
4831 "directory '%s' just "
4834 smb_dname),
4837 errno);
4838 }
4841 }
4842 }
4855 }
4861 }
4863 /*
4864 * Setup the files_struct for it.
4865 */
4875 /*
4876 * According to Samba4, SEC_FILE_READ_ATTRIBUTE is always granted,
4877 */
4886 }
4888 /* Don't store old timestamps for directory
4889 handles in the internal database. We don't
4890 update them in there if new objects
4891 are created in the directory. Currently
4892 we only update timestamps on file writes.
4893 See bug #9870.
4894 */
4897 /*
4898 * Obviously for FILE_LIST_DIRECTORY we need to reopen to get an fd
4899 * usable for reading a directory. SMB2_FLUSH may be called on
4900 * directories opened with FILE_ADD_FILE and FILE_ADD_SUBDIRECTORY so
4901 * for those we need to reopen as well.
4902 */
4903 need_fd_access =
4904 FILE_LIST_DIRECTORY |
4905 FILE_ADD_FILE |
4906 FILE_ADD_SUBDIRECTORY;
4911 };
4915 smb_fname_atname,
4916 fsp,
4924 }
4925 }
4931 }
4938 }
4940 /* Ensure there was no race condition. We need to check
4941 * dev/inode but not permissions, as these can change
4942 * legitimately */
4949 }
4953 fsp,
4955 access_mask);
4963 }
4964 }
4966 /*
4967 * If we created a new directory or going to delete it later,
4968 * we should keep * the share_mode_lock (g_lock) until we call
4969 * share_mode_entry_prepare_unlock()
4970 */
4975 }
4988 };
4993 smb_dname,
4995 open_ntcreate_lock_add_entry,
5002 }
5008 }
5010 /*
5011 * From here we need to use 'goto unlock;' instead of return !!!
5012 */
5014 /* For directories the delete on close bit at open time seems
5015 always to be honored on close... See test 19 in Samba4 BASE-DELETE. */
5020 open_ntcreate_lock_cleanup_entry;
5022 }
5025 /* Note that here we set the *initial* delete on close flag,
5026 not the regular one. The magic gets handled in close. */
5028 }
5029 }
5031 /*
5032 * Deal with other opens having a modified write time.
5033 */
5036 }
5040 }
5044 unlock:
5052 }
5057 }
5060 }
5066 {
5067 NTSTATUS status;
5092 }
5095 }
5097 /****************************************************************************
5098 Receive notification that one of our open files has been renamed by another
5099 smbd process.
5100 ****************************************************************************/
5107 {
5120 }
5123 data,
5124 msg,
5125 msg,
5131 }
5137 }
5139 /* stream_name must always be NULL if there is no stream. */
5142 }
5147 NULL,
5153 }
5159 }
5162 SMB_STRUCT_STAT fsp_orig_sbuf;
5163 NTSTATUS status;
5169 /*
5170 * The incoming smb_fname here has an
5171 * invalid stat struct from synthetic_smb_fname()
5172 * above.
5173 * Preserve the existing stat from the
5174 * open fsp after fsp_set_smb_fname()
5175 * overwrites with the invalid stat.
5176 *
5177 * (We could just copy this into
5178 * smb_fname->st, but keep this code
5179 * identical to the fix in rename_open_files()
5180 * for clarity.
5181 *
5182 * We will do an fstat before returning
5183 * any of this metadata to the client anyway.
5184 */
5190 }
5193 /* TODO. JRA. */
5194 /*
5195 * Now we have the complete path we can work out if
5196 * this is actually within this share and adjust
5197 * newname accordingly.
5198 */
5206 }
5207 out:
5209 }
5211 /*
5212 * If a main file is opened for delete, all streams need to be checked for
5213 * !FILE_SHARE_DELETE. Do this by opening with DELETE_ACCESS.
5214 * If that works, delete them all by setting the delete on close and close.
5215 */
5219 {
5226 NTSTATUS status;
5233 NULL,
5234 NULL,
5241 NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
5245 }
5249 }
5253 }
5262 }
5268 }
5271 num_streams));
5276 }
5283 }
5291 }
5296 NULL,
5303 }
5312 }
5342 }
5344 }
5346 /*
5347 * don't touch the variable "status" beyond this point :-)
5348 */
5353 }
5358 }
5360 fail:
5363 }
5365 /*********************************************************************
5366 Create a default ACL by inheriting from the parent. If no inheritance
5367 from the parent available, don't set anything. This will leave the actual
5368 permissions the new file or directory already got from the filesystem
5369 as the NT ACL when read.
5370 *********************************************************************/
5373 {
5396 frame,
5401 }
5408 /* Nothing to inherit and not setting owner. */
5410 }
5412 /* Create an inherited descriptor from the parent. */
5418 }
5420 /* Inherit from parent descriptor if "inherit owner" set. */
5424 }
5432 }
5433 }
5437 {
5441 }
5442 }
5462 }
5463 }
5464 }
5484 }
5485 }
5486 }
5490 }
5494 }
5498 }
5502 }
5506 }
5512 }
5513 }
5518 parent_desc,
5519 owner_sid,
5520 group_sid,
5525 }
5527 /* If inheritable_components == false,
5528 se_create_child_secdesc()
5529 creates a security descriptor with a NULL dacl
5530 entry, but with SEC_DESC_DACL_PRESENT. We need
5531 to remove that flag. */
5536 }
5542 }
5545 /* We need to be root to force this. */
5547 }
5549 security_info_sent,
5550 psd);
5553 }
5556 }
5558 /*
5559 * If we already have a lease, it must match the new file id. [MS-SMB2]
5560 * 3.3.5.9.8 speaks about INVALID_PARAMETER if an already used lease key is
5561 * used for a different file name.
5562 */
5565 /* Input parameters. */
5571 /* Return parameters. */
5574 NTSTATUS match_status;
5575 };
5577 /*************************************************************
5578 File doesn't exist but this lease key+guid is already in use.
5580 This is only allowable in the dynamic share case where the
5581 service path must be different.
5583 There is a small race condition here in the multi-connection
5584 case where a client sends two create calls on different connections,
5585 where the file doesn't exist and one smbd creates the leases_db
5586 entry first, but this will get fixed by the multichannel cleanup
5587 when all identical client_guids get handled by a single smbd.
5588 **************************************************************/
5594 {
5602 }
5603 }
5605 /* Dynamic share case. Break leases on all other files. */
5607 num_files,
5608 files,
5612 }
5617 }
5623 {
5629 /*
5630 * Deal with name mismatch or
5631 * possible dynamic share case separately
5632 * to make code clearer.
5633 */
5635 files,
5636 state);
5638 }
5640 /* File existed. */
5646 /* Everything should be the same. */
5648 /*
5649 * The client asked for a lease on a
5650 * file that doesn't match the file_id
5651 * in the database.
5652 *
5653 * Maybe this is a dynamic share, i.e.
5654 * a share where the servicepath is
5655 * different for different users (e.g.
5656 * the [HOMES] share.
5657 *
5658 * If the servicepath is different, but the requested
5659 * file name + stream name is the same then this is
5660 * a dynamic share, the client is using the same share
5661 * name and doesn't know that the underlying servicepath
5662 * is different. It was expecting a lease on the
5663 * same file. Return NT_STATUS_OPLOCK_NOT_GRANTED
5664 * to break leases
5665 *
5666 * Otherwise the client has messed up, or is
5667 * testing our error codes, so return
5668 * NT_STATUS_INVALID_PARAMETER.
5669 */
5673 {
5674 /*
5675 * Name is the same but servicepath is
5676 * different, dynamic share. Break leases.
5677 */
5679 NT_STATUS_OPLOCK_NOT_GRANTED;
5682 NT_STATUS_INVALID_PARAMETER;
5683 }
5685 }
5689 }
5693 }
5697 }
5698 }
5701 /*
5702 * Common case - just opening another handle on a
5703 * file on a non-dynamic share.
5704 */
5706 }
5709 /* Mismatched path. Error back to client. */
5711 }
5713 /*
5714 * File id mismatch. Dynamic share case NT_STATUS_OPLOCK_NOT_GRANTED.
5715 * Don't allow leases.
5716 */
5719 num_files,
5720 files,
5724 }
5729 }
5739 };
5744 {
5748 NTSTATUS status;
5753 }
5758 }
5776 }
5780 }
5783 /*
5784 * Windows 7 and 8 lease clients are broken in that they will
5785 * not respond to lease break requests whilst waiting for an
5786 * outstanding open request on that lease handle on the same
5787 * TCP connection, due to holding an internal inode lock.
5788 *
5789 * This means we can't reschedule ourselves here, but must
5790 * return from the create.
5791 *
5792 * Work around:
5793 *
5794 * Send the breaks and then return SMB2_LEASE_NONE in the
5795 * lease handle to cause them to acknowledge the lease
5796 * break. Consultation with Microsoft engineering confirmed
5797 * this approach is safe.
5798 */
5801 }
5805 {
5811 }
5812 }
5821 {
5829 };
5831 NTSTATUS status;
5836 }
5841 /*
5842 * Not found or error means okay: We can make the lease pass
5843 */
5845 }
5847 /*
5848 * Anything but NT_STATUS_OPLOCK_NOT_GRANTED, let the caller
5849 * deal with it.
5850 */
5852 }
5854 /* We have to break all existing leases. */
5859 };
5862 /* Don't need to break our own file. */
5864 }
5869 lease_match_fid_fn,
5872 /* Race condition - file already closed. */
5874 }
5879 }
5880 }
5881 /*
5882 * Ensure we don't grant anything more so we
5883 * never upgrade.
5884 */
5886 }
5888 /*
5889 * Wrapper around open_file_ntcreate and open_directory
5890 */
5910 {
5916 NTSTATUS status;
5928 "ea_list = %p, "
5929 "sd = %p, "
5931 access_mask,
5932 file_attributes,
5933 share_access,
5934 create_disposition,
5935 create_options,
5936 oplock_request,
5937 private_flags,
5938 ea_list,
5939 sd,
5945 }
5950 }
5955 {
5957 S_IFMT);
5961 FALL_THROUGH;
5965 /*
5966 * We should never get this far with a symlink
5967 * "as such". Report as not existing.
5968 */
5974 }
5975 }
5979 }
5989 }
5992 req,
5995 smb_fname,
5999 /* Dynamic share file. No leases and update epoch... */
6007 }
6008 }
6013 /*
6014 * We can't open a file with DELETE access if any of the
6015 * streams is open without FILE_SHARE_DELETE
6016 */
6021 }
6022 }
6028 SEC_PRIV_SECURITY);
6035 }
6039 {
6040 /*
6041 * No other bits set. Windows SMB2 refuses this.
6042 * See smbtorture3 SMB2-SACL test.
6043 *
6044 * Note this is an SMB2-only behavior,
6045 * smbtorture3 SMB1-SYSTEM-SECURITY already tests
6046 * that SMB1 allows this.
6047 */
6050 }
6051 }
6053 /*
6054 * Files or directories can't be opened DELETE_ON_CLOSE without
6055 * delete access.
6056 * BUG: https://bugzilla.samba.org/show_bug.cgi?id=13358
6057 */
6062 }
6066 {
6075 }
6084 }
6092 }
6094 /*
6095 * We may be creating the basefile as part of creating the
6096 * stream, so it's legal if the basefile doesn't exist at this
6097 * point, the create_file_unixpath() below will create it. But
6098 * if the basefile exists we want a handle so we can fstat() it.
6099 */
6106 }
6109 smb_fname_base);
6116 }
6118 /*
6119 * https://bugzilla.samba.org/show_bug.cgi?id=10229
6120 * We need to check if the requested access mask
6121 * could be used to open the underlying file (if
6122 * it existed), as we're passing in zero for the
6123 * access mask to the base filename.
6124 */
6126 access_mask);
6130 "for base %s failed: "
6135 }
6136 }
6140 /* Open the base file. */
6142 NULL,
6143 dirfsp,
6144 smb_fname_base,
6146 FILE_SHARE_READ
6147 | FILE_SHARE_WRITE
6149 base_create_disposition,
6153 NULL,
6155 base_privflags,
6156 NULL,
6157 NULL,
6159 NULL);
6167 }
6168 }
6174 /*
6175 * We're about to use smb_fname->fsp for the fresh open.
6176 *
6177 * Every fsp passed in via smb_fname->fsp already
6178 * holds a fsp->fsp_name. If it is already this
6179 * fsp->fsp_name that we got passed in as our input
6180 * argument smb_fname, these two are assumed to have
6181 * the same lifetime: Every fsp hangs of "conn", and
6182 * fsp->fsp_name is its talloc child.
6183 */
6186 /*
6187 * "smb_fname" is temporary in this case, but
6188 * the destructor of smb_fname would also tear
6189 * down the fsp we're about to use. Unlink
6190 * them from each other.
6191 */
6194 /*
6195 * "fsp" is ours now
6196 */
6198 }
6203 }
6212 }
6214 /*
6215 * No fsp passed in that we can use, create one
6216 */
6220 }
6226 }
6227 }
6233 /*
6234 * We're opening the stream element of a
6235 * base_fsp we already opened. Set up the
6236 * base_fsp pointer.
6237 */
6239 }
6243 conn,
6245 smb_fname,
6250 }
6252 /*
6253 * Get a pathref on the parent. We can re-use this for
6254 * multiple calls to check parent ACLs etc. to avoid
6255 * pathname calls.
6256 */
6259 smb_fname,
6264 }
6270 }
6271 }
6273 /*
6274 * If it's a request for a directory open, deal with it separately.
6275 */
6282 }
6284 /* Can't open a temp directory. IFS kit test. */
6289 }
6291 /*
6292 * We will get a create directory here if the Win32
6293 * app specified a security descriptor in the
6294 * CreateDirectory() call.
6295 */
6299 req,
6300 access_mask,
6301 share_access,
6302 create_disposition,
6303 create_options,
6304 file_attributes,
6306 smb_fname_atname,
6308 fsp);
6311 /*
6312 * Ordinary file case.
6313 */
6317 allocation_size);
6318 }
6321 req,
6322 access_mask,
6323 share_access,
6324 create_disposition,
6325 create_options,
6326 file_attributes,
6327 oplock_request,
6328 lease,
6329 private_flags,
6331 smb_fname_atname,
6333 fsp);
6336 /* A stream open never opens a directory */
6341 }
6343 /*
6344 * Fail the open if it was explicitly a non-directory
6345 * file.
6346 */
6351 }
6355 req,
6356 access_mask,
6357 share_access,
6358 create_disposition,
6359 create_options,
6360 file_attributes,
6362 smb_fname_atname,
6364 fsp);
6365 }
6366 }
6370 }
6379 }
6380 }
6384 {
6387 }
6389 /* Save the requested allocation size. */
6393 {
6400 }
6404 }
6407 }
6413 /*
6414 * According to the MS documentation, the only time the security
6415 * descriptor is applied to the opened file is iff we *created* the
6416 * file; an existing file stays the same.
6417 *
6418 * Also, it seems (from observation) that you can open the file with
6419 * any access mask but you can still write the sd. We need to override
6420 * the granted access before we call set_sd
6421 * Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
6422 */
6432 SECINFO_GROUP|
6433 SECINFO_DACL|
6434 SECINFO_SACL)) {
6436 }
6442 }
6444 /* Inherit from parent. Errors here are not fatal. */
6450 }
6451 }
6452 }
6458 COMPRESSION_FORMAT_NONE);
6462 }
6463 }
6470 }
6478 fail:
6482 /*
6483 * The close_file below will close
6484 * fsp->base_fsp.
6485 */
6491 }
6492 }
6495 }
6500 }
6521 {
6524 NTSTATUS status;
6529 " file_attributes = 0x%" PRIu32
6530 " share_access = 0x%" PRIu32
6531 " create_disposition = 0x%" PRIu32
6532 " create_options = 0x%" PRIu32
6533 " oplock_request = 0x%" PRIu32
6534 " private_flags = 0x%" PRIu32
6536 access_mask,
6537 file_attributes,
6538 share_access,
6539 create_disposition,
6540 create_options,
6541 oplock_request,
6542 private_flags,
6543 ea_list,
6544 sd,
6548 /*
6549 * Remember the absolute time of the original request
6550 * with this mid. We'll use it later to see if this
6551 * has timed out.
6552 */
6554 }
6556 /*
6557 * Check to see if this is a mac fork of some kind.
6558 */
6568 /*
6569 * Here we go! support for changing the disk quotas
6570 * --metze
6571 *
6572 * We need to fake up to open this MAGIC QUOTA file
6573 * and return a valid FID.
6574 *
6575 * w2k close this file directly after opening xp
6576 * also tries a QUERY_FILE_INFO on the file and then
6577 * close it
6578 */
6584 }
6588 }
6593 }
6594 }
6598 /* We have to handle this error here. */
6602 }
6607 }
6608 }
6623 }
6630 }
6631 /*
6632 * Remove type info from mode, leaving only the
6633 * permissions and setuid/gid bits.
6634 */
6638 }
6641 req,
6642 dirfsp,
6643 smb_fname,
6644 access_mask,
6645 share_access,
6646 create_disposition,
6647 create_options,
6648 file_attributes,
6649 oplock_request,
6650 lease,
6651 allocation_size,
6652 private_flags,
6653 sd,
6654 ea_list,
6659 }
6661 done:
6667 }
6670 fail:
6675 }
6677 }