1 # Unix SMB/CIFS implementation.
2 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2010
5 # This program is free software; you can redistribute it and/or modify
6 # it under the terms of the GNU General Public License as published by
7 # the Free Software Foundation; either version 3 of the License, or
8 # (at your option) any later version.
10 # This program is distributed in the hope that it will be useful,
11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 # GNU General Public License for more details.
15 # You should have received a copy of the GNU General Public License
16 # along with this program. If not, see <http://www.gnu.org/licenses/>.
23 import samba
.xattr_native
, samba
.xattr_tdb
, samba
.posix_eadb
24 from samba
.dcerpc
import security
, xattr
25 from samba
.ndr
import ndr_pack
, ndr_unpack
27 class XattrBackendError(Exception):
28 """A generic xattr backend error."""
31 def checkset_backend(lp
, backend
, eadbfile
):
32 '''return the path to the eadb, or None'''
34 xattr_tdb
= lp
.get("xattr_tdb:file")
35 if xattr_tdb
is not None:
36 return (samba
.xattr_tdb
, lp
.get("xattr_tdb:file"))
37 posix_eadb
= lp
.get("posix:eadb")
38 if posix_eadb
is not None:
39 return (samba
.posix_eadb
, lp
.get("posix:eadb"))
41 elif backend
== "native":
43 elif backend
== "eadb":
44 if eadbfile
is not None:
45 return (samba
.posix_eadb
, eadbfile
)
47 return (samba
.posix_eadb
, os
.path
.abspath(os
.path
.join(lp
.get("private dir"), "eadb.tdb")))
48 elif backend
== "tdb":
49 if eadbfile
is not None:
50 return (samba
.xattr_tdb
, eadbfile
)
52 return (samba
.xattr_tdb
, os
.path
.abspath(os
.path
.join(lp
.get("state dir"), "xattr.tdb")))
54 raise XattrBackendError("Invalid xattr backend choice %s"%backend
)
57 def getntacl(lp
, file, backend
=None, eadbfile
=None):
58 (backend_obj
, dbname
) = checkset_backend(lp
, backend
, eadbfile
)
59 if dbname
is not None:
61 attribute
= backend_obj
.wrap_getxattr(dbname
, file,
62 xattr
.XATTR_NTACL_NAME
)
64 # FIXME: Don't catch all exceptions, just those related to opening
66 print "Fail to open %s" % dbname
67 attribute
= samba
.xattr_native
.wrap_getxattr(file,
68 xattr
.XATTR_NTACL_NAME
)
70 attribute
= samba
.xattr_native
.wrap_getxattr(file,
71 xattr
.XATTR_NTACL_NAME
)
72 ntacl
= ndr_unpack(xattr
.NTACL
, attribute
)
76 def setntacl(lp
, file, sddl
, domsid
, backend
=None, eadbfile
=None):
77 (backend_obj
, dbname
) = checkset_backend(lp
, backend
, eadbfile
)
80 sid
= security
.dom_sid(domsid
)
81 sd
= security
.descriptor
.from_sddl(sddl
, sid
)
83 if dbname
is not None:
85 backend_obj
.wrap_setxattr(dbname
,
86 file, xattr
.XATTR_NTACL_NAME
, ndr_pack(ntacl
))
88 # FIXME: Don't catch all exceptions, just those related to opening
90 print "Fail to open %s" % dbname
91 samba
.xattr_native
.wrap_setxattr(file, xattr
.XATTR_NTACL_NAME
,
94 samba
.xattr_native
.wrap_setxattr(file, xattr
.XATTR_NTACL_NAME
,
98 def ldapmask2filemask(ldm
):
99 """Takes the access mask of a DS ACE and transform them in a File ACE mask.
101 RIGHT_DS_CREATE_CHILD
= 0x00000001
102 RIGHT_DS_DELETE_CHILD
= 0x00000002
103 RIGHT_DS_LIST_CONTENTS
= 0x00000004
104 ACTRL_DS_SELF
= 0x00000008
105 RIGHT_DS_READ_PROPERTY
= 0x00000010
106 RIGHT_DS_WRITE_PROPERTY
= 0x00000020
107 RIGHT_DS_DELETE_TREE
= 0x00000040
108 RIGHT_DS_LIST_OBJECT
= 0x00000080
109 RIGHT_DS_CONTROL_ACCESS
= 0x00000100
110 FILE_READ_DATA
= 0x0001
111 FILE_LIST_DIRECTORY
= 0x0001
112 FILE_WRITE_DATA
= 0x0002
113 FILE_ADD_FILE
= 0x0002
114 FILE_APPEND_DATA
= 0x0004
115 FILE_ADD_SUBDIRECTORY
= 0x0004
116 FILE_CREATE_PIPE_INSTANCE
= 0x0004
117 FILE_READ_EA
= 0x0008
118 FILE_WRITE_EA
= 0x0010
119 FILE_EXECUTE
= 0x0020
120 FILE_TRAVERSE
= 0x0020
121 FILE_DELETE_CHILD
= 0x0040
122 FILE_READ_ATTRIBUTES
= 0x0080
123 FILE_WRITE_ATTRIBUTES
= 0x0100
125 READ_CONTROL
= 0x00020000
126 WRITE_DAC
= 0x00040000
127 WRITE_OWNER
= 0x00080000
128 SYNCHRONIZE
= 0x00100000
129 STANDARD_RIGHTS_ALL
= 0x001F0000
131 filemask
= ldm
& STANDARD_RIGHTS_ALL
133 if (ldm
& RIGHT_DS_READ_PROPERTY
) and (ldm
& RIGHT_DS_LIST_CONTENTS
):
134 filemask
= filemask |
(SYNCHRONIZE | FILE_LIST_DIRECTORY |\
135 FILE_READ_ATTRIBUTES | FILE_READ_EA |\
136 FILE_READ_DATA | FILE_EXECUTE
)
138 if ldm
& RIGHT_DS_WRITE_PROPERTY
:
139 filemask
= filemask |
(SYNCHRONIZE | FILE_WRITE_DATA |\
140 FILE_APPEND_DATA | FILE_WRITE_EA |\
141 FILE_WRITE_ATTRIBUTES | FILE_ADD_FILE |\
142 FILE_ADD_SUBDIRECTORY
)
144 if ldm
& RIGHT_DS_CREATE_CHILD
:
145 filemask
= filemask |
(FILE_ADD_SUBDIRECTORY | FILE_ADD_FILE
)
147 if ldm
& RIGHT_DS_DELETE_CHILD
:
148 filemask
= filemask | FILE_DELETE_CHILD
153 def dsacl2fsacl(dssddl
, domsid
):
156 This function takes an the SDDL representation of a DS
157 ACL and return the SDDL representation of this ACL adapted
158 for files. It's used for Policy object provision
160 sid
= security
.dom_sid(domsid
)
161 ref
= security
.descriptor
.from_sddl(dssddl
, sid
)
162 fdescr
= security
.descriptor()
163 fdescr
.owner_sid
= ref
.owner_sid
164 fdescr
.group_sid
= ref
.group_sid
165 fdescr
.type = ref
.type
166 fdescr
.revision
= ref
.revision
167 fdescr
.sacl
= ref
.sacl
169 for i
in range(0, len(aces
)):
171 if not ace
.type & security
.SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT
and str(ace
.trustee
) != security
.SID_BUILTIN_PREW2K
:
172 # if fdescr.type & security.SEC_DESC_DACL_AUTO_INHERITED:
173 ace
.flags
= ace
.flags | security
.SEC_ACE_FLAG_OBJECT_INHERIT | security
.SEC_ACE_FLAG_CONTAINER_INHERIT
174 if str(ace
.trustee
) == security
.SID_CREATOR_OWNER
:
175 # For Creator/Owner the IO flag is set as this ACE has only a sense for child objects
176 ace
.flags
= ace
.flags | security
.SEC_ACE_FLAG_INHERIT_ONLY
177 ace
.access_mask
= ldapmask2filemask(ace
.access_mask
)
180 return fdescr
.as_sddl(sid
)