4 * Copyright (C) Jim McDonough, 2006
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 #include "nfs4_acls.h"
24 #define DBGC_CLASS DBGC_ACLS
26 #define SMBACL4_PARAM_TYPE_NAME "nfs4"
28 extern const struct generic_mapping file_generic_mapping
;
30 #define SMB_ACE4_INT_MAGIC 0x76F8A967
31 typedef struct _SMB_ACE4_INT_T
38 #define SMB_ACL4_INT_MAGIC 0x29A3E792
39 typedef struct _SMB_ACL4_INT_T
43 SMB_ACE4_INT_T
*first
;
47 static SMB_ACL4_INT_T
*get_validated_aclint(SMB4ACL_T
*theacl
)
49 SMB_ACL4_INT_T
*aclint
= (SMB_ACL4_INT_T
*)theacl
;
52 DEBUG(2, ("acl is NULL\n"));
56 if (aclint
->magic
!=SMB_ACL4_INT_MAGIC
)
58 DEBUG(2, ("aclint bad magic 0x%x\n", aclint
->magic
));
65 static SMB_ACE4_INT_T
*get_validated_aceint(SMB4ACE_T
*ace
)
67 SMB_ACE4_INT_T
*aceint
= (SMB_ACE4_INT_T
*)ace
;
70 DEBUG(2, ("ace is NULL\n"));
74 if (aceint
->magic
!=SMB_ACE4_INT_MAGIC
)
76 DEBUG(2, ("aceint bad magic 0x%x\n", aceint
->magic
));
83 SMB4ACL_T
*smb_create_smb4acl(void)
85 TALLOC_CTX
*mem_ctx
= talloc_tos();
86 SMB_ACL4_INT_T
*theacl
= (SMB_ACL4_INT_T
*)TALLOC_ZERO_SIZE(mem_ctx
, sizeof(SMB_ACL4_INT_T
));
89 DEBUG(0, ("TALLOC_SIZE failed\n"));
93 theacl
->magic
= SMB_ACL4_INT_MAGIC
;
94 /* theacl->first, last = NULL not needed */
95 return (SMB4ACL_T
*)theacl
;
98 SMB4ACE_T
*smb_add_ace4(SMB4ACL_T
*theacl
, SMB_ACE4PROP_T
*prop
)
100 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(theacl
);
101 TALLOC_CTX
*mem_ctx
= talloc_tos();
104 ace
= (SMB_ACE4_INT_T
*)TALLOC_ZERO_SIZE(mem_ctx
, sizeof(SMB_ACE4_INT_T
));
107 DEBUG(0, ("TALLOC_SIZE failed\n"));
111 ace
->magic
= SMB_ACE4_INT_MAGIC
;
112 /* ace->next = NULL not needed */
113 memcpy(&ace
->prop
, prop
, sizeof(SMB_ACE4PROP_T
));
115 if (aclint
->first
==NULL
)
120 aclint
->last
->next
= (void *)ace
;
125 return (SMB4ACE_T
*)ace
;
128 SMB_ACE4PROP_T
*smb_get_ace4(SMB4ACE_T
*ace
)
130 SMB_ACE4_INT_T
*aceint
= get_validated_aceint(ace
);
134 return &aceint
->prop
;
137 SMB4ACE_T
*smb_next_ace4(SMB4ACE_T
*ace
)
139 SMB_ACE4_INT_T
*aceint
= get_validated_aceint(ace
);
143 return (SMB4ACE_T
*)aceint
->next
;
146 SMB4ACE_T
*smb_first_ace4(SMB4ACL_T
*theacl
)
148 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(theacl
);
152 return (SMB4ACE_T
*)aclint
->first
;
155 uint32
smb_get_naces(SMB4ACL_T
*theacl
)
157 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(theacl
);
161 return aclint
->naces
;
164 static int smbacl4_GetFileOwner(struct connection_struct
*conn
,
165 const char *filename
,
166 SMB_STRUCT_STAT
*psbuf
)
168 memset(psbuf
, 0, sizeof(SMB_STRUCT_STAT
));
170 /* Get the stat struct for the owner info. */
171 if (SMB_VFS_STAT(conn
, filename
, psbuf
) != 0)
173 DEBUG(8, ("SMB_VFS_STAT failed with error %s\n",
181 static int smbacl4_fGetFileOwner(files_struct
*fsp
, SMB_STRUCT_STAT
*psbuf
)
183 memset(psbuf
, 0, sizeof(SMB_STRUCT_STAT
));
185 if (fsp
->is_directory
|| fsp
->fh
->fd
== -1) {
186 return smbacl4_GetFileOwner(fsp
->conn
, fsp
->fsp_name
, psbuf
);
188 if (SMB_VFS_FSTAT(fsp
, psbuf
) != 0)
190 DEBUG(8, ("SMB_VFS_FSTAT failed with error %s\n",
198 static bool smbacl4_nfs42win(TALLOC_CTX
*mem_ctx
, SMB4ACL_T
*theacl
, /* in */
199 DOM_SID
*psid_owner
, /* in */
200 DOM_SID
*psid_group
, /* in */
201 bool is_directory
, /* in */
202 SEC_ACE
**ppnt_ace_list
, /* out */
203 int *pgood_aces
/* out */
206 SMB_ACL4_INT_T
*aclint
= (SMB_ACL4_INT_T
*)theacl
;
207 SMB_ACE4_INT_T
*aceint
;
208 SEC_ACE
*nt_ace_list
= NULL
;
211 DEBUG(10, ("smbacl_nfs42win entered"));
213 aclint
= get_validated_aclint(theacl
);
214 /* We do not check for naces being 0 or theacl being NULL here because it is done upstream */
215 /* in smb_get_nt_acl_nfs4(). */
216 nt_ace_list
= (SEC_ACE
*)TALLOC_ZERO_SIZE(mem_ctx
, aclint
->naces
* sizeof(SEC_ACE
));
217 if (nt_ace_list
==NULL
)
219 DEBUG(10, ("talloc error"));
224 for (aceint
=aclint
->first
; aceint
!=NULL
; aceint
=(SMB_ACE4_INT_T
*)aceint
->next
) {
227 SMB_ACE4PROP_T
*ace
= &aceint
->prop
;
229 DEBUG(10, ("magic: 0x%x, type: %d, iflags: %x, flags: %x, mask: %x, "
230 "who: %d\n", aceint
->magic
, ace
->aceType
, ace
->flags
,
231 ace
->aceFlags
, ace
->aceMask
, ace
->who
.id
));
233 SMB_ASSERT(aceint
->magic
==SMB_ACE4_INT_MAGIC
);
235 if (ace
->flags
& SMB_ACE4_ID_SPECIAL
) {
236 switch (ace
->who
.special_id
) {
237 case SMB_ACE4_WHO_OWNER
:
238 sid_copy(&sid
, psid_owner
);
240 case SMB_ACE4_WHO_GROUP
:
241 sid_copy(&sid
, psid_group
);
243 case SMB_ACE4_WHO_EVERYONE
:
244 sid_copy(&sid
, &global_sid_World
);
247 DEBUG(8, ("invalid special who id %d "
248 "ignored\n", ace
->who
.special_id
));
251 if (ace
->aceFlags
& SMB_ACE4_IDENTIFIER_GROUP
) {
252 gid_to_sid(&sid
, ace
->who
.gid
);
254 uid_to_sid(&sid
, ace
->who
.uid
);
257 DEBUG(10, ("mapped %d to %s\n", ace
->who
.id
,
258 sid_string_dbg(&sid
)));
260 if (is_directory
&& (ace
->aceMask
& SMB_ACE4_ADD_FILE
)) {
261 ace
->aceMask
|= SMB_ACE4_DELETE_CHILD
;
265 init_sec_ace(&nt_ace_list
[good_aces
++], &sid
,
267 ace
->aceFlags
& 0xf);
270 *ppnt_ace_list
= nt_ace_list
;
271 *pgood_aces
= good_aces
;
276 static NTSTATUS
smb_get_nt_acl_nfs4_common(const SMB_STRUCT_STAT
*sbuf
,
277 uint32 security_info
,
278 SEC_DESC
**ppdesc
, SMB4ACL_T
*theacl
)
281 DOM_SID sid_owner
, sid_group
;
283 SEC_ACE
*nt_ace_list
= NULL
;
285 TALLOC_CTX
*mem_ctx
= talloc_tos();
287 if (theacl
==NULL
|| smb_get_naces(theacl
)==0)
288 return NT_STATUS_ACCESS_DENIED
; /* special because we
289 * shouldn't alloc 0 for
292 uid_to_sid(&sid_owner
, sbuf
->st_ex_uid
);
293 gid_to_sid(&sid_group
, sbuf
->st_ex_gid
);
295 if (smbacl4_nfs42win(mem_ctx
, theacl
, &sid_owner
, &sid_group
,
296 S_ISDIR(sbuf
->st_ex_mode
),
297 &nt_ace_list
, &good_aces
)==False
) {
298 DEBUG(8,("smbacl4_nfs42win failed\n"));
299 return map_nt_error_from_unix(errno
);
302 psa
= make_sec_acl(mem_ctx
, NT4_ACL_REVISION
, good_aces
, nt_ace_list
);
304 DEBUG(2,("make_sec_acl failed\n"));
305 return NT_STATUS_NO_MEMORY
;
308 DEBUG(10,("after make sec_acl\n"));
309 *ppdesc
= make_sec_desc(mem_ctx
, SEC_DESC_REVISION
, SEC_DESC_SELF_RELATIVE
,
310 (security_info
& OWNER_SECURITY_INFORMATION
) ? &sid_owner
: NULL
,
311 (security_info
& GROUP_SECURITY_INFORMATION
) ? &sid_group
: NULL
,
312 NULL
, psa
, &sd_size
);
314 DEBUG(2,("make_sec_desc failed\n"));
315 return NT_STATUS_NO_MEMORY
;
318 DEBUG(10, ("smb_get_nt_acl_nfs4_common successfully exited with sd_size %d\n",
319 (int)ndr_size_security_descriptor(*ppdesc
, NULL
, 0)));
324 NTSTATUS
smb_fget_nt_acl_nfs4(files_struct
*fsp
,
325 uint32 security_info
,
326 SEC_DESC
**ppdesc
, SMB4ACL_T
*theacl
)
328 SMB_STRUCT_STAT sbuf
;
330 DEBUG(10, ("smb_fget_nt_acl_nfs4 invoked for %s\n", fsp
->fsp_name
));
332 if (smbacl4_fGetFileOwner(fsp
, &sbuf
)) {
333 return map_nt_error_from_unix(errno
);
336 return smb_get_nt_acl_nfs4_common(&sbuf
, security_info
, ppdesc
, theacl
);
339 NTSTATUS
smb_get_nt_acl_nfs4(struct connection_struct
*conn
,
341 uint32 security_info
,
342 SEC_DESC
**ppdesc
, SMB4ACL_T
*theacl
)
344 SMB_STRUCT_STAT sbuf
;
346 DEBUG(10, ("smb_get_nt_acl_nfs4 invoked for %s\n", name
));
348 if (smbacl4_GetFileOwner(conn
, name
, &sbuf
)) {
349 return map_nt_error_from_unix(errno
);
352 return smb_get_nt_acl_nfs4_common(&sbuf
, security_info
, ppdesc
, theacl
);
355 enum smbacl4_mode_enum
{e_simple
=0, e_special
=1};
356 enum smbacl4_acedup_enum
{e_dontcare
=0, e_reject
=1, e_ignore
=2, e_merge
=3};
358 typedef struct _smbacl4_vfs_params
{
359 enum smbacl4_mode_enum mode
;
361 enum smbacl4_acedup_enum acedup
;
362 struct db_context
*sid_mapping_table
;
363 } smbacl4_vfs_params
;
366 * Gather special parameters for NFS4 ACL handling
368 static int smbacl4_get_vfs_params(
369 const char *type_name
,
371 smbacl4_vfs_params
*params
374 static const struct enum_list enum_smbacl4_modes
[] = {
375 { e_simple
, "simple" },
376 { e_special
, "special" }
378 static const struct enum_list enum_smbacl4_acedups
[] = {
379 { e_dontcare
, "dontcare" },
380 { e_reject
, "reject" },
381 { e_ignore
, "ignore" },
382 { e_merge
, "merge" },
385 memset(params
, 0, sizeof(smbacl4_vfs_params
));
386 params
->mode
= (enum smbacl4_mode_enum
)lp_parm_enum(
387 SNUM(fsp
->conn
), type_name
,
388 "mode", enum_smbacl4_modes
, e_simple
);
389 params
->do_chown
= lp_parm_bool(SNUM(fsp
->conn
), type_name
,
391 params
->acedup
= (enum smbacl4_acedup_enum
)lp_parm_enum(
392 SNUM(fsp
->conn
), type_name
,
393 "acedup", enum_smbacl4_acedups
, e_dontcare
);
395 DEBUG(10, ("mode:%s, do_chown:%s, acedup: %s\n",
396 enum_smbacl4_modes
[params
->mode
].name
,
397 params
->do_chown
? "true" : "false",
398 enum_smbacl4_acedups
[params
->acedup
].name
));
403 static void smbacl4_dump_nfs4acl(int level
, SMB4ACL_T
*theacl
)
405 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(theacl
);
406 SMB_ACE4_INT_T
*aceint
;
408 DEBUG(level
, ("NFS4ACL: size=%d\n", aclint
->naces
));
410 for(aceint
= aclint
->first
; aceint
!=NULL
; aceint
=(SMB_ACE4_INT_T
*)aceint
->next
) {
411 SMB_ACE4PROP_T
*ace
= &aceint
->prop
;
413 DEBUG(level
, ("\tACE: type=%d, flags=0x%x, fflags=0x%x, mask=0x%x, id=%d\n",
415 ace
->aceFlags
, ace
->flags
,
422 * Find 2 NFS4 who-special ACE property (non-copy!!!)
423 * match nonzero if "special" and who is equal
424 * return ace if found matching; otherwise NULL
426 static SMB_ACE4PROP_T
*smbacl4_find_equal_special(
428 SMB_ACE4PROP_T
*aceNew
)
430 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(theacl
);
431 SMB_ACE4_INT_T
*aceint
;
433 for(aceint
= aclint
->first
; aceint
!=NULL
; aceint
=(SMB_ACE4_INT_T
*)aceint
->next
) {
434 SMB_ACE4PROP_T
*ace
= &aceint
->prop
;
436 if (ace
->flags
== aceNew
->flags
&&
437 ace
->aceType
==aceNew
->aceType
&&
438 (ace
->aceFlags
&SMB_ACE4_IDENTIFIER_GROUP
)==
439 (aceNew
->aceFlags
&SMB_ACE4_IDENTIFIER_GROUP
)
441 /* keep type safety; e.g. gid is an u.short */
442 if (ace
->flags
& SMB_ACE4_ID_SPECIAL
)
444 if (ace
->who
.special_id
==aceNew
->who
.special_id
)
447 if (ace
->aceFlags
& SMB_ACE4_IDENTIFIER_GROUP
)
449 if (ace
->who
.gid
==aceNew
->who
.gid
)
452 if (ace
->who
.uid
==aceNew
->who
.uid
)
462 static bool nfs4_map_sid(smbacl4_vfs_params
*params
, const DOM_SID
*src
,
465 static struct db_context
*mapping_db
= NULL
;
468 if (mapping_db
== NULL
) {
469 const char *dbname
= lp_parm_const_string(
470 -1, SMBACL4_PARAM_TYPE_NAME
, "sidmap", NULL
);
472 if (dbname
== NULL
) {
473 DEBUG(10, ("%s:sidmap not defined\n",
474 SMBACL4_PARAM_TYPE_NAME
));
479 mapping_db
= db_open(NULL
, dbname
, 0, TDB_DEFAULT
,
483 if (mapping_db
== NULL
) {
484 DEBUG(1, ("could not open sidmap: %s\n",
490 if (mapping_db
->fetch(mapping_db
, NULL
,
491 string_term_tdb_data(sid_string_tos(src
)),
493 DEBUG(10, ("could not find mapping for SID %s\n",
494 sid_string_dbg(src
)));
498 if ((data
.dptr
== NULL
) || (data
.dsize
<= 0)
499 || (data
.dptr
[data
.dsize
-1] != '\0')) {
500 DEBUG(5, ("invalid mapping for SID %s\n",
501 sid_string_dbg(src
)));
502 TALLOC_FREE(data
.dptr
);
506 if (!string_to_sid(dst
, (char *)data
.dptr
)) {
507 DEBUG(1, ("invalid mapping %s for SID %s\n",
508 (char *)data
.dptr
, sid_string_dbg(src
)));
509 TALLOC_FREE(data
.dptr
);
513 TALLOC_FREE(data
.dptr
);
518 static bool smbacl4_fill_ace4(
520 const char *filename
,
521 smbacl4_vfs_params
*params
,
524 const SEC_ACE
*ace_nt
, /* input */
525 SMB_ACE4PROP_T
*ace_v4
/* output */
528 DEBUG(10, ("got ace for %s\n", sid_string_dbg(&ace_nt
->trustee
)));
530 memset(ace_v4
, 0, sizeof(SMB_ACE4PROP_T
));
531 ace_v4
->aceType
= ace_nt
->type
; /* only ACCESS|DENY supported right now */
532 ace_v4
->aceFlags
= ace_nt
->flags
& SEC_ACE_FLAG_VALID_INHERIT
;
533 ace_v4
->aceMask
= ace_nt
->access_mask
&
534 (STD_RIGHT_ALL_ACCESS
| SA_RIGHT_FILE_ALL_ACCESS
);
536 se_map_generic(&ace_v4
->aceMask
, &file_generic_mapping
);
538 if (ace_v4
->aceFlags
!=ace_nt
->flags
)
539 DEBUG(9, ("ace_v4->aceFlags(0x%x)!=ace_nt->flags(0x%x)\n",
540 ace_v4
->aceFlags
, ace_nt
->flags
));
542 if (ace_v4
->aceMask
!=ace_nt
->access_mask
)
543 DEBUG(9, ("ace_v4->aceMask(0x%x)!=ace_nt->access_mask(0x%x)\n",
544 ace_v4
->aceMask
, ace_nt
->access_mask
));
546 if (sid_equal(&ace_nt
->trustee
, &global_sid_World
)) {
547 ace_v4
->who
.special_id
= SMB_ACE4_WHO_EVERYONE
;
548 ace_v4
->flags
|= SMB_ACE4_ID_SPECIAL
;
550 const char *dom
, *name
;
551 enum lsa_SidType type
;
556 sid_copy(&sid
, &ace_nt
->trustee
);
558 if (!lookup_sid(mem_ctx
, &sid
, &dom
, &name
, &type
)) {
562 if (!nfs4_map_sid(params
, &sid
, &mapped
)) {
563 DEBUG(1, ("nfs4_acls.c: file [%s]: SID %s "
564 "unknown\n", filename
, sid_string_dbg(&sid
)));
569 DEBUG(2, ("nfs4_acls.c: file [%s]: mapped SID %s "
570 "to %s\n", filename
, sid_string_dbg(&sid
), sid_string_dbg(&mapped
)));
572 if (!lookup_sid(mem_ctx
, &mapped
, &dom
,
574 DEBUG(1, ("nfs4_acls.c: file [%s]: SID %s "
575 "mapped from %s is unknown\n",
576 filename
, sid_string_dbg(&mapped
), sid_string_dbg(&sid
)));
581 sid_copy(&sid
, &mapped
);
584 if (type
== SID_NAME_USER
) {
585 if (!sid_to_uid(&sid
, &uid
)) {
586 DEBUG(1, ("nfs4_acls.c: file [%s]: could not "
587 "convert %s to uid\n", filename
,
588 sid_string_dbg(&sid
)));
592 if (params
->mode
==e_special
&& uid
==ownerUID
) {
593 ace_v4
->flags
|= SMB_ACE4_ID_SPECIAL
;
594 ace_v4
->who
.special_id
= SMB_ACE4_WHO_OWNER
;
596 ace_v4
->who
.uid
= uid
;
598 } else { /* else group? - TODO check it... */
599 if (!sid_to_gid(&sid
, &gid
)) {
600 DEBUG(1, ("nfs4_acls.c: file [%s]: could not "
601 "convert %s to gid\n", filename
,
602 sid_string_dbg(&sid
)));
606 ace_v4
->aceFlags
|= SMB_ACE4_IDENTIFIER_GROUP
;
608 if (params
->mode
==e_special
&& gid
==ownerGID
) {
609 ace_v4
->flags
|= SMB_ACE4_ID_SPECIAL
;
610 ace_v4
->who
.special_id
= SMB_ACE4_WHO_GROUP
;
612 ace_v4
->who
.gid
= gid
;
617 return True
; /* OK */
620 static int smbacl4_MergeIgnoreReject(
621 enum smbacl4_acedup_enum acedup
,
622 SMB4ACL_T
*theacl
, /* may modify it */
623 SMB_ACE4PROP_T
*ace
, /* the "new" ACE */
629 SMB_ACE4PROP_T
*ace4found
= smbacl4_find_equal_special(theacl
, ace
);
634 case e_merge
: /* "merge" flags */
636 ace4found
->aceFlags
|= ace
->aceFlags
;
637 ace4found
->aceMask
|= ace
->aceMask
;
639 case e_ignore
: /* leave out this record */
642 case e_reject
: /* do an error */
643 DEBUG(8, ("ACL rejected by duplicate nt ace#%d\n", i
));
644 errno
= EINVAL
; /* SHOULD be set on any _real_ error */
654 static SMB4ACL_T
*smbacl4_win2nfs4(
655 const char *filename
,
657 smbacl4_vfs_params
*pparams
,
664 TALLOC_CTX
*mem_ctx
= talloc_tos();
666 DEBUG(10, ("smbacl4_win2nfs4 invoked\n"));
668 theacl
= smb_create_smb4acl();
672 for(i
=0; i
<dacl
->num_aces
; i
++) {
673 SMB_ACE4PROP_T ace_v4
;
674 bool addNewACE
= True
;
676 if (!smbacl4_fill_ace4(mem_ctx
, filename
, pparams
,
678 dacl
->aces
+ i
, &ace_v4
)) {
679 DEBUG(3, ("Could not fill ace for file %s, SID %s\n",
681 sid_string_dbg(&((dacl
->aces
+i
)->trustee
))));
685 if (pparams
->acedup
!=e_dontcare
) {
686 if (smbacl4_MergeIgnoreReject(pparams
->acedup
, theacl
,
687 &ace_v4
, &addNewACE
, i
))
692 smb_add_ace4(theacl
, &ace_v4
);
698 NTSTATUS
smb_set_nt_acl_nfs4(files_struct
*fsp
,
699 uint32 security_info_sent
,
701 set_nfs4acl_native_fn_t set_nfs4_native
)
703 smbacl4_vfs_params params
;
704 SMB4ACL_T
*theacl
= NULL
;
707 SMB_STRUCT_STAT sbuf
;
708 bool set_acl_as_root
= false;
709 uid_t newUID
= (uid_t
)-1;
710 gid_t newGID
= (gid_t
)-1;
713 DEBUG(10, ("smb_set_nt_acl_nfs4 invoked for %s\n", fsp
->fsp_name
));
715 if ((security_info_sent
& (DACL_SECURITY_INFORMATION
|
716 GROUP_SECURITY_INFORMATION
| OWNER_SECURITY_INFORMATION
)) == 0)
718 DEBUG(9, ("security_info_sent (0x%x) ignored\n",
719 security_info_sent
));
720 return NT_STATUS_OK
; /* won't show error - later to be refined... */
723 /* Special behaviours */
724 if (smbacl4_get_vfs_params(SMBACL4_PARAM_TYPE_NAME
, fsp
, ¶ms
))
725 return NT_STATUS_NO_MEMORY
;
727 if (smbacl4_fGetFileOwner(fsp
, &sbuf
))
728 return map_nt_error_from_unix(errno
);
730 if (params
.do_chown
) {
731 /* chown logic is a copy/paste from posix_acl.c:set_nt_acl */
732 NTSTATUS status
= unpack_nt_owners(SNUM(fsp
->conn
), &newUID
, &newGID
, security_info_sent
, psd
);
733 if (!NT_STATUS_IS_OK(status
)) {
734 DEBUG(8, ("unpack_nt_owners failed"));
737 if (((newUID
!= (uid_t
)-1) && (sbuf
.st_ex_uid
!= newUID
)) ||
738 ((newGID
!= (gid_t
)-1) && (sbuf
.st_ex_gid
!= newGID
))) {
739 if(try_chown(fsp
->conn
, fsp
->fsp_name
, newUID
, newGID
)) {
740 DEBUG(3,("chown %s, %u, %u failed. Error = %s.\n",
741 fsp
->fsp_name
, (unsigned int)newUID
, (unsigned int)newGID
,
743 return map_nt_error_from_unix(errno
);
746 DEBUG(10,("chown %s, %u, %u succeeded.\n",
747 fsp
->fsp_name
, (unsigned int)newUID
, (unsigned int)newGID
));
748 if (smbacl4_GetFileOwner(fsp
->conn
, fsp
->fsp_name
, &sbuf
))
749 return map_nt_error_from_unix(errno
);
751 /* If we successfully chowned, we know we must
752 * be able to set the acl, so do it as root.
754 set_acl_as_root
= true;
758 if (!(security_info_sent
& DACL_SECURITY_INFORMATION
) || psd
->dacl
==NULL
) {
759 DEBUG(10, ("no dacl found; security_info_sent = 0x%x\n", security_info_sent
));
763 theacl
= smbacl4_win2nfs4(fsp
->fsp_name
, psd
->dacl
, ¶ms
,
764 sbuf
.st_ex_uid
, sbuf
.st_ex_gid
);
766 return map_nt_error_from_unix(errno
);
768 smbacl4_dump_nfs4acl(10, theacl
);
770 if (set_acl_as_root
) {
773 result
= set_nfs4_native(fsp
, theacl
);
775 if (set_acl_as_root
) {
780 DEBUG(10, ("set_nfs4_native failed with %s\n", strerror(errno
)));
781 return map_nt_error_from_unix(errno
);
784 DEBUG(10, ("smb_set_nt_acl_nfs4 succeeded\n"));