4 * Copyright (C) Jim McDonough, 2006
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 #include "nfs4_acls.h"
24 #define SMBACL4_PARAM_TYPE_NAME "nfs4"
26 #define SMB_ACE4_INT_MAGIC 0x76F8A967
27 typedef struct _SMB_ACE4_INT_T
34 #define SMB_ACL4_INT_MAGIC 0x29A3E792
35 typedef struct _SMB_ACL4_INT_T
39 SMB_ACE4_INT_T
*first
;
43 extern struct current_user current_user
;
44 extern int try_chown(connection_struct
*conn
, const char *fname
, uid_t uid
, gid_t gid
);
45 extern NTSTATUS
unpack_nt_owners(int snum
, uid_t
*puser
, gid_t
*pgrp
,
46 uint32 security_info_sent
, SEC_DESC
*psd
);
48 static SMB_ACL4_INT_T
*get_validated_aclint(SMB4ACL_T
*acl
)
50 SMB_ACL4_INT_T
*aclint
= (SMB_ACL4_INT_T
*)acl
;
53 DEBUG(2, ("acl is NULL\n"));
57 if (aclint
->magic
!=SMB_ACL4_INT_MAGIC
)
59 DEBUG(2, ("aclint bad magic 0x%x\n", aclint
->magic
));
66 static SMB_ACE4_INT_T
*get_validated_aceint(SMB4ACE_T
*ace
)
68 SMB_ACE4_INT_T
*aceint
= (SMB_ACE4_INT_T
*)ace
;
71 DEBUG(2, ("ace is NULL\n"));
75 if (aceint
->magic
!=SMB_ACE4_INT_MAGIC
)
77 DEBUG(2, ("aceint bad magic 0x%x\n", aceint
->magic
));
84 SMB4ACL_T
*smb_create_smb4acl(void)
86 TALLOC_CTX
*mem_ctx
= main_loop_talloc_get();
87 SMB_ACL4_INT_T
*acl
= (SMB_ACL4_INT_T
*)TALLOC_ZERO_SIZE(mem_ctx
, sizeof(SMB_ACL4_INT_T
));
90 DEBUG(0, ("TALLOC_SIZE failed\n"));
94 acl
->magic
= SMB_ACL4_INT_MAGIC
;
95 /* acl->first, last = NULL not needed */
96 return (SMB4ACL_T
*)acl
;
99 SMB4ACE_T
*smb_add_ace4(SMB4ACL_T
*acl
, SMB_ACE4PROP_T
*prop
)
101 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
102 TALLOC_CTX
*mem_ctx
= main_loop_talloc_get();
105 ace
= (SMB_ACE4_INT_T
*)TALLOC_ZERO_SIZE(mem_ctx
, sizeof(SMB_ACE4_INT_T
));
108 DEBUG(0, ("TALLOC_SIZE failed\n"));
112 ace
->magic
= SMB_ACE4_INT_MAGIC
;
113 /* ace->next = NULL not needed */
114 memcpy(&ace
->prop
, prop
, sizeof(SMB_ACE4PROP_T
));
116 if (aclint
->first
==NULL
)
121 aclint
->last
->next
= (void *)ace
;
126 return (SMB4ACE_T
*)ace
;
129 SMB_ACE4PROP_T
*smb_get_ace4(SMB4ACE_T
*ace
)
131 SMB_ACE4_INT_T
*aceint
= get_validated_aceint(ace
);
135 return &aceint
->prop
;
138 SMB4ACE_T
*smb_next_ace4(SMB4ACE_T
*ace
)
140 SMB_ACE4_INT_T
*aceint
= get_validated_aceint(ace
);
144 return (SMB4ACE_T
*)aceint
->next
;
147 SMB4ACE_T
*smb_first_ace4(SMB4ACL_T
*acl
)
149 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
153 return (SMB4ACE_T
*)aclint
->first
;
156 uint32
smb_get_naces(SMB4ACL_T
*acl
)
158 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
162 return aclint
->naces
;
165 static int smbacl4_GetFileOwner(files_struct
*fsp
, SMB_STRUCT_STAT
*psbuf
)
167 memset(psbuf
, 0, sizeof(SMB_STRUCT_STAT
));
168 if (fsp
->is_directory
|| fsp
->fh
->fd
== -1) {
169 /* Get the stat struct for the owner info. */
170 if (SMB_VFS_STAT(fsp
->conn
,fsp
->fsp_name
, psbuf
) != 0)
172 DEBUG(8, ("SMB_VFS_STAT failed with error %s\n",
177 if (SMB_VFS_FSTAT(fsp
,fsp
->fh
->fd
, psbuf
) != 0)
179 DEBUG(8, ("SMB_VFS_FSTAT failed with error %s\n",
188 static BOOL
smbacl4_nfs42win(TALLOC_CTX
*mem_ctx
, SMB4ACL_T
*acl
, /* in */
189 DOM_SID
*psid_owner
, /* in */
190 DOM_SID
*psid_group
, /* in */
191 SEC_ACE
**ppnt_ace_list
, /* out */
192 int *pgood_aces
/* out */
195 SMB_ACL4_INT_T
*aclint
= (SMB_ACL4_INT_T
*)acl
;
196 SMB_ACE4_INT_T
*aceint
;
197 SEC_ACE
*nt_ace_list
= NULL
;
200 DEBUG(10, ("smbacl_nfs42win entered"));
202 aclint
= get_validated_aclint(acl
);
203 /* We do not check for naces being 0 or acl being NULL here because it is done upstream */
204 /* in smb_get_nt_acl_nfs4(). */
205 nt_ace_list
= (SEC_ACE
*)TALLOC_ZERO_SIZE(mem_ctx
, aclint
->naces
* sizeof(SEC_ACE
));
206 if (nt_ace_list
==NULL
)
208 DEBUG(10, ("talloc error"));
213 for (aceint
=aclint
->first
; aceint
!=NULL
; aceint
=(SMB_ACE4_INT_T
*)aceint
->next
) {
216 SMB_ACE4PROP_T
*ace
= &aceint
->prop
;
218 DEBUG(10, ("magic: 0x%x, type: %d, iflags: %x, flags: %x, mask: %x, "
219 "who: %d\n", aceint
->magic
, ace
->aceType
, ace
->flags
,
220 ace
->aceFlags
, ace
->aceMask
, ace
->who
.id
));
222 SMB_ASSERT(aceint
->magic
==SMB_ACE4_INT_MAGIC
);
224 if (ace
->flags
& SMB_ACE4_ID_SPECIAL
) {
225 switch (ace
->who
.special_id
) {
226 case SMB_ACE4_WHO_OWNER
:
227 sid_copy(&sid
, psid_owner
);
229 case SMB_ACE4_WHO_GROUP
:
230 sid_copy(&sid
, psid_group
);
232 case SMB_ACE4_WHO_EVERYONE
:
233 sid_copy(&sid
, &global_sid_World
);
236 DEBUG(8, ("invalid special who id %d "
237 "ignored\n", ace
->who
.special_id
));
240 if (ace
->aceFlags
& SMB_ACE4_IDENTIFIER_GROUP
) {
241 gid_to_sid(&sid
, ace
->who
.gid
);
243 uid_to_sid(&sid
, ace
->who
.uid
);
246 DEBUG(10, ("mapped %d to %s\n", ace
->who
.id
,
247 sid_string_static(&sid
)));
249 init_sec_access(&mask
, ace
->aceMask
);
250 init_sec_ace(&nt_ace_list
[good_aces
++], &sid
,
252 ace
->aceFlags
& 0xf);
255 *ppnt_ace_list
= nt_ace_list
;
256 *pgood_aces
= good_aces
;
261 size_t smb_get_nt_acl_nfs4(files_struct
*fsp
,
262 uint32 security_info
,
263 SEC_DESC
**ppdesc
, SMB4ACL_T
*acl
)
266 SMB_STRUCT_STAT sbuf
;
267 DOM_SID sid_owner
, sid_group
;
269 SEC_ACE
*nt_ace_list
= NULL
;
271 TALLOC_CTX
*mem_ctx
= main_loop_talloc_get();
273 DEBUG(10, ("smb_get_nt_acl_nfs4 invoked for %s\n", fsp
->fsp_name
));
275 if (acl
==NULL
|| smb_get_naces(acl
)==0)
276 return 0; /* special because we shouldn't alloc 0 for win */
278 if (smbacl4_GetFileOwner(fsp
, &sbuf
))
281 uid_to_sid(&sid_owner
, sbuf
.st_uid
);
282 gid_to_sid(&sid_group
, sbuf
.st_gid
);
284 if (smbacl4_nfs42win(mem_ctx
, acl
, &sid_owner
, &sid_group
, &nt_ace_list
, &good_aces
)==False
) {
285 DEBUG(8,("smbacl4_nfs42win failed\n"));
289 psa
= make_sec_acl(mem_ctx
, NT4_ACL_REVISION
, good_aces
, nt_ace_list
);
291 DEBUG(2,("make_sec_acl failed\n"));
295 DEBUG(10,("after make sec_acl\n"));
296 *ppdesc
= make_sec_desc(mem_ctx
, SEC_DESC_REVISION
, SEC_DESC_SELF_RELATIVE
,
297 (security_info
& OWNER_SECURITY_INFORMATION
) ? &sid_owner
: NULL
,
298 (security_info
& GROUP_SECURITY_INFORMATION
) ? &sid_group
: NULL
,
299 NULL
, psa
, &sd_size
);
301 DEBUG(2,("make_sec_desc failed\n"));
305 DEBUG(10, ("smb_get_nt_acl_nfs4 successfully exited with sd_size %d\n", sd_size
));
309 enum smbacl4_mode_enum
{e_simple
=0, e_special
=1};
310 enum smbacl4_acedup_enum
{e_dontcare
=0, e_reject
=1, e_ignore
=2, e_merge
=3};
312 typedef struct _smbacl4_vfs_params
{
313 enum smbacl4_mode_enum mode
;
315 enum smbacl4_acedup_enum acedup
;
316 } smbacl4_vfs_params
;
319 * Gather special parameters for NFS4 ACL handling
321 static int smbacl4_get_vfs_params(
322 const char *type_name
,
324 smbacl4_vfs_params
*params
327 static const struct enum_list enum_smbacl4_modes
[] = {
328 { e_simple
, "simple" },
329 { e_special
, "special" }
331 static const struct enum_list enum_smbacl4_acedups
[] = {
332 { e_dontcare
, "dontcare" },
333 { e_reject
, "reject" },
334 { e_ignore
, "ignore" },
335 { e_merge
, "merge" },
338 memset(params
, 0, sizeof(smbacl4_vfs_params
));
339 params
->mode
= (enum smbacl4_mode_enum
)lp_parm_enum(
340 SNUM(fsp
->conn
), type_name
,
341 "mode", enum_smbacl4_modes
, e_simple
);
342 params
->do_chown
= lp_parm_bool(SNUM(fsp
->conn
), type_name
,
344 params
->acedup
= (enum smbacl4_acedup_enum
)lp_parm_enum(
345 SNUM(fsp
->conn
), type_name
,
346 "acedup", enum_smbacl4_acedups
, e_dontcare
);
348 DEBUG(10, ("mode:%s, do_chown:%s, acedup: %s\n",
349 enum_smbacl4_modes
[params
->mode
].name
,
350 params
->do_chown
? "true" : "false",
351 enum_smbacl4_acedups
[params
->acedup
].name
));
356 static void smbacl4_dump_nfs4acl(int level
, SMB4ACL_T
*acl
)
358 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
359 SMB_ACE4_INT_T
*aceint
;
361 DEBUG(level
, ("NFS4ACL: size=%d\n", aclint
->naces
));
363 for(aceint
= aclint
->first
; aceint
!=NULL
; aceint
=(SMB_ACE4_INT_T
*)aceint
->next
) {
364 SMB_ACE4PROP_T
*ace
= &aceint
->prop
;
366 DEBUG(level
, ("\tACE: type=%d, flags=0x%x, fflags=0x%x, mask=0x%x, id=%d\n",
368 ace
->aceFlags
, ace
->flags
,
375 * Find 2 NFS4 who-special ACE property (non-copy!!!)
376 * match nonzero if "special" and who is equal
377 * return ace if found matching; otherwise NULL
379 static SMB_ACE4PROP_T
*smbacl4_find_equal_special(
381 SMB_ACE4PROP_T
*aceNew
)
383 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
384 SMB_ACE4_INT_T
*aceint
;
386 for(aceint
= aclint
->first
; aceint
!=NULL
; aceint
=(SMB_ACE4_INT_T
*)aceint
->next
) {
387 SMB_ACE4PROP_T
*ace
= &aceint
->prop
;
389 if (ace
->flags
== aceNew
->flags
&&
390 ace
->aceType
==aceNew
->aceType
&&
391 (ace
->aceFlags
&SMB_ACE4_IDENTIFIER_GROUP
)==
392 (aceNew
->aceFlags
&SMB_ACE4_IDENTIFIER_GROUP
)
394 /* keep type safety; e.g. gid is an u.short */
395 if (ace
->flags
& SMB_ACE4_ID_SPECIAL
)
397 if (ace
->who
.special_id
==aceNew
->who
.special_id
)
400 if (ace
->aceFlags
& SMB_ACE4_IDENTIFIER_GROUP
)
402 if (ace
->who
.gid
==aceNew
->who
.gid
)
405 if (ace
->who
.uid
==aceNew
->who
.uid
)
415 static int smbacl4_fill_ace4(
417 smbacl4_vfs_params
*params
,
420 SEC_ACE
*ace_nt
, /* input */
421 SMB_ACE4PROP_T
*ace_v4
/* output */
424 const char *dom
, *name
;
425 enum lsa_SidType type
;
429 DEBUG(10, ("got ace for %s\n",
430 sid_string_static(&ace_nt
->trustee
)));
432 memset(ace_v4
, 0, sizeof(SMB_ACE4PROP_T
));
433 ace_v4
->aceType
= ace_nt
->type
; /* only ACCESS|DENY supported right now */
434 ace_v4
->aceFlags
= ace_nt
->flags
& SEC_ACE_FLAG_VALID_INHERIT
;
435 ace_v4
->aceMask
= ace_nt
->access_mask
&
436 (STD_RIGHT_ALL_ACCESS
| SA_RIGHT_FILE_ALL_ACCESS
);
438 if (ace_v4
->aceFlags
!=ace_nt
->flags
)
439 DEBUG(9, ("ace_v4->aceFlags(0x%x)!=ace_nt->flags(0x%x)\n",
440 ace_v4
->aceFlags
, ace_nt
->flags
));
442 if (ace_v4
->aceMask
!=ace_nt
->access_mask
)
443 DEBUG(9, ("ace_v4->aceMask(0x%x)!=ace_nt->access_mask(0x%x)\n",
444 ace_v4
->aceMask
, ace_nt
->access_mask
));
446 if (sid_equal(&ace_nt
->trustee
, &global_sid_World
)) {
447 ace_v4
->who
.special_id
= SMB_ACE4_WHO_EVERYONE
;
448 ace_v4
->flags
|= SMB_ACE4_ID_SPECIAL
;
450 if (!lookup_sid(mem_ctx
, &ace_nt
->trustee
, &dom
, &name
, &type
)) {
451 DEBUG(8, ("Could not find %s' type\n",
452 sid_string_static(&ace_nt
->trustee
)));
457 if (type
== SID_NAME_USER
) {
458 if (!sid_to_uid(&ace_nt
->trustee
, &uid
)) {
459 DEBUG(2, ("Could not convert %s to uid\n",
460 sid_string_static(&ace_nt
->trustee
)));
464 if (params
->mode
==e_special
&& uid
==ownerUID
) {
465 ace_v4
->flags
|= SMB_ACE4_ID_SPECIAL
;
466 ace_v4
->who
.special_id
= SMB_ACE4_WHO_OWNER
;
468 ace_v4
->who
.uid
= uid
;
470 } else { /* else group? - TODO check it... */
471 if (!sid_to_gid(&ace_nt
->trustee
, &gid
)) {
472 DEBUG(2, ("Could not convert %s to gid\n",
473 sid_string_static(&ace_nt
->trustee
)));
476 ace_v4
->aceFlags
|= SMB_ACE4_IDENTIFIER_GROUP
;
478 if (params
->mode
==e_special
&& gid
==ownerGID
) {
479 ace_v4
->flags
|= SMB_ACE4_ID_SPECIAL
;
480 ace_v4
->who
.special_id
= SMB_ACE4_WHO_GROUP
;
482 ace_v4
->who
.gid
= gid
;
490 static int smbacl4_MergeIgnoreReject(
491 enum smbacl4_acedup_enum acedup
,
492 SMB4ACL_T
*acl
, /* may modify it */
493 SMB_ACE4PROP_T
*ace
, /* the "new" ACE */
499 SMB_ACE4PROP_T
*ace4found
= smbacl4_find_equal_special(acl
, ace
);
504 case e_merge
: /* "merge" flags */
506 ace4found
->aceFlags
|= ace
->aceFlags
;
507 ace4found
->aceMask
|= ace
->aceMask
;
509 case e_ignore
: /* leave out this record */
512 case e_reject
: /* do an error */
513 DEBUG(8, ("ACL rejected by duplicate nt ace#%d\n", i
));
514 errno
= EINVAL
; /* SHOULD be set on any _real_ error */
524 static SMB4ACL_T
*smbacl4_win2nfs4(
526 smbacl4_vfs_params
*pparams
,
533 TALLOC_CTX
*mem_ctx
= main_loop_talloc_get();
535 DEBUG(10, ("smbacl4_win2nfs4 invoked\n"));
537 acl
= smb_create_smb4acl();
541 for(i
=0; i
<dacl
->num_aces
; i
++) {
542 SMB_ACE4PROP_T ace_v4
;
543 BOOL addNewACE
= True
;
545 if (smbacl4_fill_ace4(mem_ctx
, pparams
, ownerUID
, ownerGID
,
546 dacl
->aces
+ i
, &ace_v4
))
549 if (pparams
->acedup
!=e_dontcare
) {
550 if (smbacl4_MergeIgnoreReject(pparams
->acedup
, acl
,
551 &ace_v4
, &addNewACE
, i
))
556 smb_add_ace4(acl
, &ace_v4
);
562 NTSTATUS
smb_set_nt_acl_nfs4(files_struct
*fsp
,
563 uint32 security_info_sent
,
565 set_nfs4acl_native_fn_t set_nfs4_native
)
567 smbacl4_vfs_params params
;
568 SMB4ACL_T
*acl
= NULL
;
571 SMB_STRUCT_STAT sbuf
;
572 uid_t newUID
= (uid_t
)-1;
573 gid_t newGID
= (gid_t
)-1;
575 DEBUG(10, ("smb_set_nt_acl_nfs4 invoked for %s\n", fsp
->fsp_name
));
577 if ((security_info_sent
& (DACL_SECURITY_INFORMATION
|
578 GROUP_SECURITY_INFORMATION
| OWNER_SECURITY_INFORMATION
)) == 0)
580 DEBUG(9, ("security_info_sent (0x%x) ignored\n",
581 security_info_sent
));
582 return NT_STATUS_OK
; /* won't show error - later to be refined... */
585 /* Special behaviours */
586 if (smbacl4_get_vfs_params(SMBACL4_PARAM_TYPE_NAME
, fsp
, ¶ms
))
587 return NT_STATUS_NO_MEMORY
;
589 if (smbacl4_GetFileOwner(fsp
, &sbuf
))
590 return map_nt_error_from_unix(errno
);
592 if (params
.do_chown
) {
593 /* chown logic is a copy/paste from posix_acl.c:set_nt_acl */
594 NTSTATUS status
= unpack_nt_owners(SNUM(fsp
->conn
), &newUID
, &newGID
, security_info_sent
, psd
);
595 if (!NT_STATUS_IS_OK(status
)) {
596 DEBUG(8, ("unpack_nt_owners failed"));
599 if (((newUID
!= (uid_t
)-1) && (sbuf
.st_uid
!= newUID
)) ||
600 ((newGID
!= (gid_t
)-1) && (sbuf
.st_gid
!= newGID
))) {
601 if(try_chown(fsp
->conn
, fsp
->fsp_name
, newUID
, newGID
)) {
602 DEBUG(3,("chown %s, %u, %u failed. Error = %s.\n",
603 fsp
->fsp_name
, (unsigned int)newUID
, (unsigned int)newGID
, strerror(errno
) ));
604 if (errno
== EPERM
) {
605 return NT_STATUS_INVALID_OWNER
;
607 return map_nt_error_from_unix(errno
);
609 DEBUG(10,("chown %s, %u, %u succeeded.\n",
610 fsp
->fsp_name
, (unsigned int)newUID
, (unsigned int)newGID
));
611 if (smbacl4_GetFileOwner(fsp
, &sbuf
))
612 return map_nt_error_from_unix(errno
);
616 if ((security_info_sent
& DACL_SECURITY_INFORMATION
)!=0 && psd
->dacl
!=NULL
)
618 acl
= smbacl4_win2nfs4(psd
->dacl
, ¶ms
, sbuf
.st_uid
, sbuf
.st_gid
);
620 return map_nt_error_from_unix(errno
);
622 smbacl4_dump_nfs4acl(10, acl
);
624 result
= set_nfs4_native(fsp
, acl
);
627 DEBUG(10, ("set_nfs4_native failed with %s\n", strerror(errno
)));
628 return map_nt_error_from_unix(errno
);
631 DEBUG(10, ("no dacl found; security_info_sent = 0x%x\n", security_info_sent
));
633 DEBUG(10, ("smb_set_nt_acl_nfs4 succeeded\n"));