4 * Copyright (C) Jim McDonough, 2006
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 #include "nfs4_acls.h"
24 #define DBGC_CLASS DBGC_ACLS
26 #define SMBACL4_PARAM_TYPE_NAME "nfs4"
28 extern const struct generic_mapping file_generic_mapping
;
30 #define SMB_ACE4_INT_MAGIC 0x76F8A967
31 typedef struct _SMB_ACE4_INT_T
38 #define SMB_ACL4_INT_MAGIC 0x29A3E792
39 typedef struct _SMB_ACL4_INT_T
43 SMB_ACE4_INT_T
*first
;
47 extern struct current_user current_user
;
48 extern int try_chown(connection_struct
*conn
, const char *fname
, uid_t uid
, gid_t gid
);
49 extern NTSTATUS
unpack_nt_owners(int snum
, uid_t
*puser
, gid_t
*pgrp
,
50 uint32 security_info_sent
, SEC_DESC
*psd
);
52 static SMB_ACL4_INT_T
*get_validated_aclint(SMB4ACL_T
*acl
)
54 SMB_ACL4_INT_T
*aclint
= (SMB_ACL4_INT_T
*)acl
;
57 DEBUG(2, ("acl is NULL\n"));
61 if (aclint
->magic
!=SMB_ACL4_INT_MAGIC
)
63 DEBUG(2, ("aclint bad magic 0x%x\n", aclint
->magic
));
70 static SMB_ACE4_INT_T
*get_validated_aceint(SMB4ACE_T
*ace
)
72 SMB_ACE4_INT_T
*aceint
= (SMB_ACE4_INT_T
*)ace
;
75 DEBUG(2, ("ace is NULL\n"));
79 if (aceint
->magic
!=SMB_ACE4_INT_MAGIC
)
81 DEBUG(2, ("aceint bad magic 0x%x\n", aceint
->magic
));
88 SMB4ACL_T
*smb_create_smb4acl(void)
90 TALLOC_CTX
*mem_ctx
= talloc_tos();
91 SMB_ACL4_INT_T
*acl
= (SMB_ACL4_INT_T
*)TALLOC_ZERO_SIZE(mem_ctx
, sizeof(SMB_ACL4_INT_T
));
94 DEBUG(0, ("TALLOC_SIZE failed\n"));
98 acl
->magic
= SMB_ACL4_INT_MAGIC
;
99 /* acl->first, last = NULL not needed */
100 return (SMB4ACL_T
*)acl
;
103 SMB4ACE_T
*smb_add_ace4(SMB4ACL_T
*acl
, SMB_ACE4PROP_T
*prop
)
105 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
106 TALLOC_CTX
*mem_ctx
= talloc_tos();
109 ace
= (SMB_ACE4_INT_T
*)TALLOC_ZERO_SIZE(mem_ctx
, sizeof(SMB_ACE4_INT_T
));
112 DEBUG(0, ("TALLOC_SIZE failed\n"));
116 ace
->magic
= SMB_ACE4_INT_MAGIC
;
117 /* ace->next = NULL not needed */
118 memcpy(&ace
->prop
, prop
, sizeof(SMB_ACE4PROP_T
));
120 if (aclint
->first
==NULL
)
125 aclint
->last
->next
= (void *)ace
;
130 return (SMB4ACE_T
*)ace
;
133 SMB_ACE4PROP_T
*smb_get_ace4(SMB4ACE_T
*ace
)
135 SMB_ACE4_INT_T
*aceint
= get_validated_aceint(ace
);
139 return &aceint
->prop
;
142 SMB4ACE_T
*smb_next_ace4(SMB4ACE_T
*ace
)
144 SMB_ACE4_INT_T
*aceint
= get_validated_aceint(ace
);
148 return (SMB4ACE_T
*)aceint
->next
;
151 SMB4ACE_T
*smb_first_ace4(SMB4ACL_T
*acl
)
153 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
157 return (SMB4ACE_T
*)aclint
->first
;
160 uint32
smb_get_naces(SMB4ACL_T
*acl
)
162 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
166 return aclint
->naces
;
169 static int smbacl4_GetFileOwner(struct connection_struct
*conn
,
170 const char *filename
,
171 SMB_STRUCT_STAT
*psbuf
)
173 memset(psbuf
, 0, sizeof(SMB_STRUCT_STAT
));
175 /* Get the stat struct for the owner info. */
176 if (SMB_VFS_STAT(conn
, filename
, psbuf
) != 0)
178 DEBUG(8, ("SMB_VFS_STAT failed with error %s\n",
186 static int smbacl4_fGetFileOwner(files_struct
*fsp
, SMB_STRUCT_STAT
*psbuf
)
188 memset(psbuf
, 0, sizeof(SMB_STRUCT_STAT
));
190 if (fsp
->is_directory
|| fsp
->fh
->fd
== -1) {
191 return smbacl4_GetFileOwner(fsp
->conn
, fsp
->fsp_name
, psbuf
);
193 if (SMB_VFS_FSTAT(fsp
, psbuf
) != 0)
195 DEBUG(8, ("SMB_VFS_FSTAT failed with error %s\n",
203 static bool smbacl4_nfs42win(TALLOC_CTX
*mem_ctx
, SMB4ACL_T
*acl
, /* in */
204 DOM_SID
*psid_owner
, /* in */
205 DOM_SID
*psid_group
, /* in */
206 bool is_directory
, /* in */
207 SEC_ACE
**ppnt_ace_list
, /* out */
208 int *pgood_aces
/* out */
211 SMB_ACL4_INT_T
*aclint
= (SMB_ACL4_INT_T
*)acl
;
212 SMB_ACE4_INT_T
*aceint
;
213 SEC_ACE
*nt_ace_list
= NULL
;
216 DEBUG(10, ("smbacl_nfs42win entered"));
218 aclint
= get_validated_aclint(acl
);
219 /* We do not check for naces being 0 or acl being NULL here because it is done upstream */
220 /* in smb_get_nt_acl_nfs4(). */
221 nt_ace_list
= (SEC_ACE
*)TALLOC_ZERO_SIZE(mem_ctx
, aclint
->naces
* sizeof(SEC_ACE
));
222 if (nt_ace_list
==NULL
)
224 DEBUG(10, ("talloc error"));
229 for (aceint
=aclint
->first
; aceint
!=NULL
; aceint
=(SMB_ACE4_INT_T
*)aceint
->next
) {
232 SMB_ACE4PROP_T
*ace
= &aceint
->prop
;
234 DEBUG(10, ("magic: 0x%x, type: %d, iflags: %x, flags: %x, mask: %x, "
235 "who: %d\n", aceint
->magic
, ace
->aceType
, ace
->flags
,
236 ace
->aceFlags
, ace
->aceMask
, ace
->who
.id
));
238 SMB_ASSERT(aceint
->magic
==SMB_ACE4_INT_MAGIC
);
240 if (ace
->flags
& SMB_ACE4_ID_SPECIAL
) {
241 switch (ace
->who
.special_id
) {
242 case SMB_ACE4_WHO_OWNER
:
243 sid_copy(&sid
, psid_owner
);
245 case SMB_ACE4_WHO_GROUP
:
246 sid_copy(&sid
, psid_group
);
248 case SMB_ACE4_WHO_EVERYONE
:
249 sid_copy(&sid
, &global_sid_World
);
252 DEBUG(8, ("invalid special who id %d "
253 "ignored\n", ace
->who
.special_id
));
256 if (ace
->aceFlags
& SMB_ACE4_IDENTIFIER_GROUP
) {
257 gid_to_sid(&sid
, ace
->who
.gid
);
259 uid_to_sid(&sid
, ace
->who
.uid
);
262 DEBUG(10, ("mapped %d to %s\n", ace
->who
.id
,
263 sid_string_dbg(&sid
)));
265 if (is_directory
&& (ace
->aceMask
& SMB_ACE4_ADD_FILE
)) {
266 ace
->aceMask
|= SMB_ACE4_DELETE_CHILD
;
268 init_sec_access(&mask
, ace
->aceMask
);
269 init_sec_ace(&nt_ace_list
[good_aces
++], &sid
,
271 ace
->aceFlags
& 0xf);
274 *ppnt_ace_list
= nt_ace_list
;
275 *pgood_aces
= good_aces
;
280 static NTSTATUS
smb_get_nt_acl_nfs4_common(const SMB_STRUCT_STAT
*sbuf
,
281 uint32 security_info
,
282 SEC_DESC
**ppdesc
, SMB4ACL_T
*acl
)
285 DOM_SID sid_owner
, sid_group
;
287 SEC_ACE
*nt_ace_list
= NULL
;
289 TALLOC_CTX
*mem_ctx
= talloc_tos();
291 if (acl
==NULL
|| smb_get_naces(acl
)==0)
292 return NT_STATUS_ACCESS_DENIED
; /* special because we
293 * shouldn't alloc 0 for
296 uid_to_sid(&sid_owner
, sbuf
->st_uid
);
297 gid_to_sid(&sid_group
, sbuf
->st_gid
);
299 if (smbacl4_nfs42win(mem_ctx
, acl
, &sid_owner
, &sid_group
, S_ISDIR(sbuf
->st_mode
),
300 &nt_ace_list
, &good_aces
)==False
) {
301 DEBUG(8,("smbacl4_nfs42win failed\n"));
302 return map_nt_error_from_unix(errno
);
305 psa
= make_sec_acl(mem_ctx
, NT4_ACL_REVISION
, good_aces
, nt_ace_list
);
307 DEBUG(2,("make_sec_acl failed\n"));
308 return NT_STATUS_NO_MEMORY
;
311 DEBUG(10,("after make sec_acl\n"));
312 *ppdesc
= make_sec_desc(mem_ctx
, SEC_DESC_REVISION
, SEC_DESC_SELF_RELATIVE
,
313 (security_info
& OWNER_SECURITY_INFORMATION
) ? &sid_owner
: NULL
,
314 (security_info
& GROUP_SECURITY_INFORMATION
) ? &sid_group
: NULL
,
315 NULL
, psa
, &sd_size
);
317 DEBUG(2,("make_sec_desc failed\n"));
318 return NT_STATUS_NO_MEMORY
;
321 DEBUG(10, ("smb_get_nt_acl_nfs4_common successfully exited with sd_size %d\n",
322 ndr_size_security_descriptor(*ppdesc
, 0)));
327 NTSTATUS
smb_fget_nt_acl_nfs4(files_struct
*fsp
,
328 uint32 security_info
,
329 SEC_DESC
**ppdesc
, SMB4ACL_T
*acl
)
331 SMB_STRUCT_STAT sbuf
;
333 DEBUG(10, ("smb_fget_nt_acl_nfs4 invoked for %s\n", fsp
->fsp_name
));
335 if (smbacl4_fGetFileOwner(fsp
, &sbuf
)) {
336 return map_nt_error_from_unix(errno
);
339 return smb_get_nt_acl_nfs4_common(&sbuf
, security_info
, ppdesc
, acl
);
342 NTSTATUS
smb_get_nt_acl_nfs4(struct connection_struct
*conn
,
344 uint32 security_info
,
345 SEC_DESC
**ppdesc
, SMB4ACL_T
*acl
)
347 SMB_STRUCT_STAT sbuf
;
349 DEBUG(10, ("smb_get_nt_acl_nfs4 invoked for %s\n", name
));
351 if (smbacl4_GetFileOwner(conn
, name
, &sbuf
)) {
352 return map_nt_error_from_unix(errno
);
355 return smb_get_nt_acl_nfs4_common(&sbuf
, security_info
, ppdesc
, acl
);
358 enum smbacl4_mode_enum
{e_simple
=0, e_special
=1};
359 enum smbacl4_acedup_enum
{e_dontcare
=0, e_reject
=1, e_ignore
=2, e_merge
=3};
361 typedef struct _smbacl4_vfs_params
{
362 enum smbacl4_mode_enum mode
;
364 enum smbacl4_acedup_enum acedup
;
365 struct db_context
*sid_mapping_table
;
366 } smbacl4_vfs_params
;
369 * Gather special parameters for NFS4 ACL handling
371 static int smbacl4_get_vfs_params(
372 const char *type_name
,
374 smbacl4_vfs_params
*params
377 static const struct enum_list enum_smbacl4_modes
[] = {
378 { e_simple
, "simple" },
379 { e_special
, "special" }
381 static const struct enum_list enum_smbacl4_acedups
[] = {
382 { e_dontcare
, "dontcare" },
383 { e_reject
, "reject" },
384 { e_ignore
, "ignore" },
385 { e_merge
, "merge" },
388 memset(params
, 0, sizeof(smbacl4_vfs_params
));
389 params
->mode
= (enum smbacl4_mode_enum
)lp_parm_enum(
390 SNUM(fsp
->conn
), type_name
,
391 "mode", enum_smbacl4_modes
, e_simple
);
392 params
->do_chown
= lp_parm_bool(SNUM(fsp
->conn
), type_name
,
394 params
->acedup
= (enum smbacl4_acedup_enum
)lp_parm_enum(
395 SNUM(fsp
->conn
), type_name
,
396 "acedup", enum_smbacl4_acedups
, e_dontcare
);
398 DEBUG(10, ("mode:%s, do_chown:%s, acedup: %s\n",
399 enum_smbacl4_modes
[params
->mode
].name
,
400 params
->do_chown
? "true" : "false",
401 enum_smbacl4_acedups
[params
->acedup
].name
));
406 static void smbacl4_dump_nfs4acl(int level
, SMB4ACL_T
*acl
)
408 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
409 SMB_ACE4_INT_T
*aceint
;
411 DEBUG(level
, ("NFS4ACL: size=%d\n", aclint
->naces
));
413 for(aceint
= aclint
->first
; aceint
!=NULL
; aceint
=(SMB_ACE4_INT_T
*)aceint
->next
) {
414 SMB_ACE4PROP_T
*ace
= &aceint
->prop
;
416 DEBUG(level
, ("\tACE: type=%d, flags=0x%x, fflags=0x%x, mask=0x%x, id=%d\n",
418 ace
->aceFlags
, ace
->flags
,
425 * Find 2 NFS4 who-special ACE property (non-copy!!!)
426 * match nonzero if "special" and who is equal
427 * return ace if found matching; otherwise NULL
429 static SMB_ACE4PROP_T
*smbacl4_find_equal_special(
431 SMB_ACE4PROP_T
*aceNew
)
433 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
434 SMB_ACE4_INT_T
*aceint
;
436 for(aceint
= aclint
->first
; aceint
!=NULL
; aceint
=(SMB_ACE4_INT_T
*)aceint
->next
) {
437 SMB_ACE4PROP_T
*ace
= &aceint
->prop
;
439 if (ace
->flags
== aceNew
->flags
&&
440 ace
->aceType
==aceNew
->aceType
&&
441 (ace
->aceFlags
&SMB_ACE4_IDENTIFIER_GROUP
)==
442 (aceNew
->aceFlags
&SMB_ACE4_IDENTIFIER_GROUP
)
444 /* keep type safety; e.g. gid is an u.short */
445 if (ace
->flags
& SMB_ACE4_ID_SPECIAL
)
447 if (ace
->who
.special_id
==aceNew
->who
.special_id
)
450 if (ace
->aceFlags
& SMB_ACE4_IDENTIFIER_GROUP
)
452 if (ace
->who
.gid
==aceNew
->who
.gid
)
455 if (ace
->who
.uid
==aceNew
->who
.uid
)
465 static bool nfs4_map_sid(smbacl4_vfs_params
*params
, const DOM_SID
*src
,
468 static struct db_context
*mapping_db
= NULL
;
471 if (mapping_db
== NULL
) {
472 const char *dbname
= lp_parm_const_string(
473 -1, SMBACL4_PARAM_TYPE_NAME
, "sidmap", NULL
);
475 if (dbname
== NULL
) {
476 DEBUG(10, ("%s:sidmap not defined\n",
477 SMBACL4_PARAM_TYPE_NAME
));
482 mapping_db
= db_open(NULL
, dbname
, 0, TDB_DEFAULT
,
486 if (mapping_db
== NULL
) {
487 DEBUG(1, ("could not open sidmap: %s\n",
493 if (mapping_db
->fetch(mapping_db
, NULL
,
494 string_term_tdb_data(sid_string_tos(src
)),
496 DEBUG(10, ("could not find mapping for SID %s\n",
497 sid_string_dbg(src
)));
501 if ((data
.dptr
== NULL
) || (data
.dsize
<= 0)
502 || (data
.dptr
[data
.dsize
-1] != '\0')) {
503 DEBUG(5, ("invalid mapping for SID %s\n",
504 sid_string_dbg(src
)));
505 TALLOC_FREE(data
.dptr
);
509 if (!string_to_sid(dst
, (char *)data
.dptr
)) {
510 DEBUG(1, ("invalid mapping %s for SID %s\n",
511 (char *)data
.dptr
, sid_string_dbg(src
)));
512 TALLOC_FREE(data
.dptr
);
516 TALLOC_FREE(data
.dptr
);
521 static bool smbacl4_fill_ace4(
523 const char *filename
,
524 smbacl4_vfs_params
*params
,
527 SEC_ACE
*ace_nt
, /* input */
528 SMB_ACE4PROP_T
*ace_v4
/* output */
531 DEBUG(10, ("got ace for %s\n", sid_string_dbg(&ace_nt
->trustee
)));
533 memset(ace_v4
, 0, sizeof(SMB_ACE4PROP_T
));
534 ace_v4
->aceType
= ace_nt
->type
; /* only ACCESS|DENY supported right now */
535 ace_v4
->aceFlags
= ace_nt
->flags
& SEC_ACE_FLAG_VALID_INHERIT
;
536 ace_v4
->aceMask
= ace_nt
->access_mask
&
537 (STD_RIGHT_ALL_ACCESS
| SA_RIGHT_FILE_ALL_ACCESS
);
539 se_map_generic(&ace_v4
->aceMask
, &file_generic_mapping
);
541 if (ace_v4
->aceFlags
!=ace_nt
->flags
)
542 DEBUG(9, ("ace_v4->aceFlags(0x%x)!=ace_nt->flags(0x%x)\n",
543 ace_v4
->aceFlags
, ace_nt
->flags
));
545 if (ace_v4
->aceMask
!=ace_nt
->access_mask
)
546 DEBUG(9, ("ace_v4->aceMask(0x%x)!=ace_nt->access_mask(0x%x)\n",
547 ace_v4
->aceMask
, ace_nt
->access_mask
));
549 if (sid_equal(&ace_nt
->trustee
, &global_sid_World
)) {
550 ace_v4
->who
.special_id
= SMB_ACE4_WHO_EVERYONE
;
551 ace_v4
->flags
|= SMB_ACE4_ID_SPECIAL
;
553 const char *dom
, *name
;
554 enum lsa_SidType type
;
559 sid_copy(&sid
, &ace_nt
->trustee
);
561 if (!lookup_sid(mem_ctx
, &sid
, &dom
, &name
, &type
)) {
565 if (!nfs4_map_sid(params
, &sid
, &mapped
)) {
566 DEBUG(1, ("nfs4_acls.c: file [%s]: SID %s "
567 "unknown\n", filename
, sid_string_dbg(&sid
)));
572 DEBUG(2, ("nfs4_acls.c: file [%s]: mapped SID %s "
573 "to %s\n", filename
, sid_string_dbg(&sid
), sid_string_dbg(&mapped
)));
575 if (!lookup_sid(mem_ctx
, &mapped
, &dom
,
577 DEBUG(1, ("nfs4_acls.c: file [%s]: SID %s "
578 "mapped from %s is unknown\n",
579 filename
, sid_string_dbg(&mapped
), sid_string_dbg(&sid
)));
584 sid_copy(&sid
, &mapped
);
587 if (type
== SID_NAME_USER
) {
588 if (!sid_to_uid(&sid
, &uid
)) {
589 DEBUG(1, ("nfs4_acls.c: file [%s]: could not "
590 "convert %s to uid\n", filename
,
591 sid_string_dbg(&sid
)));
595 if (params
->mode
==e_special
&& uid
==ownerUID
) {
596 ace_v4
->flags
|= SMB_ACE4_ID_SPECIAL
;
597 ace_v4
->who
.special_id
= SMB_ACE4_WHO_OWNER
;
599 ace_v4
->who
.uid
= uid
;
601 } else { /* else group? - TODO check it... */
602 if (!sid_to_gid(&sid
, &gid
)) {
603 DEBUG(1, ("nfs4_acls.c: file [%s]: could not "
604 "convert %s to gid\n", filename
,
605 sid_string_dbg(&sid
)));
609 ace_v4
->aceFlags
|= SMB_ACE4_IDENTIFIER_GROUP
;
611 if (params
->mode
==e_special
&& gid
==ownerGID
) {
612 ace_v4
->flags
|= SMB_ACE4_ID_SPECIAL
;
613 ace_v4
->who
.special_id
= SMB_ACE4_WHO_GROUP
;
615 ace_v4
->who
.gid
= gid
;
620 return True
; /* OK */
623 static int smbacl4_MergeIgnoreReject(
624 enum smbacl4_acedup_enum acedup
,
625 SMB4ACL_T
*acl
, /* may modify it */
626 SMB_ACE4PROP_T
*ace
, /* the "new" ACE */
632 SMB_ACE4PROP_T
*ace4found
= smbacl4_find_equal_special(acl
, ace
);
637 case e_merge
: /* "merge" flags */
639 ace4found
->aceFlags
|= ace
->aceFlags
;
640 ace4found
->aceMask
|= ace
->aceMask
;
642 case e_ignore
: /* leave out this record */
645 case e_reject
: /* do an error */
646 DEBUG(8, ("ACL rejected by duplicate nt ace#%d\n", i
));
647 errno
= EINVAL
; /* SHOULD be set on any _real_ error */
657 static SMB4ACL_T
*smbacl4_win2nfs4(
658 const char *filename
,
660 smbacl4_vfs_params
*pparams
,
667 TALLOC_CTX
*mem_ctx
= talloc_tos();
669 DEBUG(10, ("smbacl4_win2nfs4 invoked\n"));
671 acl
= smb_create_smb4acl();
675 for(i
=0; i
<dacl
->num_aces
; i
++) {
676 SMB_ACE4PROP_T ace_v4
;
677 bool addNewACE
= True
;
679 if (!smbacl4_fill_ace4(mem_ctx
, filename
, pparams
,
681 dacl
->aces
+ i
, &ace_v4
)) {
682 DEBUG(3, ("Could not fill ace for file %s, SID %s\n",
684 sid_string_dbg(&((dacl
->aces
+i
)->trustee
))));
688 if (pparams
->acedup
!=e_dontcare
) {
689 if (smbacl4_MergeIgnoreReject(pparams
->acedup
, acl
,
690 &ace_v4
, &addNewACE
, i
))
695 smb_add_ace4(acl
, &ace_v4
);
701 NTSTATUS
smb_set_nt_acl_nfs4(files_struct
*fsp
,
702 uint32 security_info_sent
,
704 set_nfs4acl_native_fn_t set_nfs4_native
)
706 smbacl4_vfs_params params
;
707 SMB4ACL_T
*acl
= NULL
;
710 SMB_STRUCT_STAT sbuf
;
711 bool set_acl_as_root
= false;
712 uid_t newUID
= (uid_t
)-1;
713 gid_t newGID
= (gid_t
)-1;
716 DEBUG(10, ("smb_set_nt_acl_nfs4 invoked for %s\n", fsp
->fsp_name
));
718 if ((security_info_sent
& (DACL_SECURITY_INFORMATION
|
719 GROUP_SECURITY_INFORMATION
| OWNER_SECURITY_INFORMATION
)) == 0)
721 DEBUG(9, ("security_info_sent (0x%x) ignored\n",
722 security_info_sent
));
723 return NT_STATUS_OK
; /* won't show error - later to be refined... */
726 /* Special behaviours */
727 if (smbacl4_get_vfs_params(SMBACL4_PARAM_TYPE_NAME
, fsp
, ¶ms
))
728 return NT_STATUS_NO_MEMORY
;
730 if (smbacl4_fGetFileOwner(fsp
, &sbuf
))
731 return map_nt_error_from_unix(errno
);
733 if (params
.do_chown
) {
734 /* chown logic is a copy/paste from posix_acl.c:set_nt_acl */
735 NTSTATUS status
= unpack_nt_owners(SNUM(fsp
->conn
), &newUID
, &newGID
, security_info_sent
, psd
);
736 if (!NT_STATUS_IS_OK(status
)) {
737 DEBUG(8, ("unpack_nt_owners failed"));
740 if (((newUID
!= (uid_t
)-1) && (sbuf
.st_uid
!= newUID
)) ||
741 ((newGID
!= (gid_t
)-1) && (sbuf
.st_gid
!= newGID
))) {
742 if(try_chown(fsp
->conn
, fsp
->fsp_name
, newUID
, newGID
)) {
743 DEBUG(3,("chown %s, %u, %u failed. Error = %s.\n",
744 fsp
->fsp_name
, (unsigned int)newUID
, (unsigned int)newGID
,
746 return map_nt_error_from_unix(errno
);
749 DEBUG(10,("chown %s, %u, %u succeeded.\n",
750 fsp
->fsp_name
, (unsigned int)newUID
, (unsigned int)newGID
));
751 if (smbacl4_GetFileOwner(fsp
->conn
, fsp
->fsp_name
, &sbuf
))
752 return map_nt_error_from_unix(errno
);
753 /* If we successfully chowned, we know we must
754 * be able to set the acl, so do it as root.
756 set_acl_as_root
= true;
760 if (!(security_info_sent
& DACL_SECURITY_INFORMATION
) || psd
->dacl
==NULL
) {
761 DEBUG(10, ("no dacl found; security_info_sent = 0x%x\n", security_info_sent
));
765 acl
= smbacl4_win2nfs4(fsp
->fsp_name
, psd
->dacl
, ¶ms
, sbuf
.st_uid
, sbuf
.st_gid
);
767 return map_nt_error_from_unix(errno
);
769 smbacl4_dump_nfs4acl(10, acl
);
771 if (set_acl_as_root
) {
774 result
= set_nfs4_native(fsp
, acl
);
776 if (set_acl_as_root
) {
781 DEBUG(10, ("set_nfs4_native failed with %s\n", strerror(errno
)));
782 return map_nt_error_from_unix(errno
);
785 DEBUG(10, ("smb_set_nt_acl_nfs4 succeeded\n"));