?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: Convert some callers of vfs_stat_smb_fname to SMB_VFS_STAT()
[Samba/fernandojvsilva.git] / source3 / smbd / posix_acls.c
blob0a3b0dff7597a22d9da813465e9113262881252a
1 /*
2 Unix SMB/CIFS implementation.
3 SMB NT Security Descriptor / Unix permission conversion.
4 Copyright (C) Jeremy Allison 1994-2009.
5 Copyright (C) Andreas Gruenbacher 2002.
6 Copyright (C) Simo Sorce <idra@samba.org> 2009.
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23
24 extern struct current_user current_user;
25 extern const struct generic_mapping file_generic_mapping;
26
27 #undef DBGC_CLASS
28 #define DBGC_CLASS DBGC_ACLS
29
30 /****************************************************************************
31 Data structures representing the internal ACE format.
32 ****************************************************************************/
33
34 enum ace_owner {UID_ACE, GID_ACE, WORLD_ACE};
35 enum ace_attribute {ALLOW_ACE, DENY_ACE}; /* Used for incoming NT ACLS. */
36
37 typedef union posix_id {
38 uid_t uid;
39 gid_t gid;
40 int world;
41 } posix_id;
42
43 typedef struct canon_ace {
44 struct canon_ace *next, *prev;
45 SMB_ACL_TAG_T type;
46 mode_t perms; /* Only use S_I(R|W|X)USR mode bits here. */
47 DOM_SID trustee;
48 enum ace_owner owner_type;
49 enum ace_attribute attr;
50 posix_id unix_ug;
51 uint8_t ace_flags; /* From windows ACE entry. */
52 } canon_ace;
53
54 #define ALL_ACE_PERMS (S_IRUSR|S_IWUSR|S_IXUSR)
55
56 /*
57 * EA format of user.SAMBA_PAI (Samba_Posix_Acl_Interitance)
58 * attribute on disk - version 1.
59 * All values are little endian.
60 *
61 * | 1 | 1 | 2 | 2 | ....
62 * +------+------+-------------+---------------------+-------------+--------------------+
63 * | vers | flag | num_entries | num_default_entries | ..entries.. | default_entries... |
64 * +------+------+-------------+---------------------+-------------+--------------------+
65 *
66 * Entry format is :
67 *
68 * | 1 | 4 |
69 * +------+-------------------+
70 * | value| uid/gid or world |
71 * | type | value |
72 * +------+-------------------+
73 *
74 * Version 2 format. Stores extra Windows metadata about an ACL.
75 *
76 * | 1 | 2 | 2 | 2 | ....
77 * +------+----------+-------------+---------------------+-------------+--------------------+
78 * | vers | ace | num_entries | num_default_entries | ..entries.. | default_entries... |
79 * | 2 | type | | | | |
80 * +------+----------+-------------+---------------------+-------------+--------------------+
81 *
82 * Entry format is :
83 *
84 * | 1 | 1 | 4 |
85 * +------+------+-------------------+
86 * | ace | value| uid/gid or world |
87 * | flag | type | value |
88 * +------+-------------------+------+
89 *
90 */
91
92 #define PAI_VERSION_OFFSET 0
93
94 #define PAI_V1_FLAG_OFFSET 1
95 #define PAI_V1_NUM_ENTRIES_OFFSET 2
96 #define PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET 4
97 #define PAI_V1_ENTRIES_BASE 6
98 #define PAI_V1_ACL_FLAG_PROTECTED 0x1
99 #define PAI_V1_ENTRY_LENGTH 5
100
101 #define PAI_V1_VERSION 1
102
103 #define PAI_V2_TYPE_OFFSET 1
104 #define PAI_V2_NUM_ENTRIES_OFFSET 3
105 #define PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET 5
106 #define PAI_V2_ENTRIES_BASE 7
107 #define PAI_V2_ENTRY_LENGTH 6
108
109 #define PAI_V2_VERSION 2
110
111 /*
112 * In memory format of user.SAMBA_PAI attribute.
113 */
114
115 struct pai_entry {
116 struct pai_entry *next, *prev;
117 uint8_t ace_flags;
118 enum ace_owner owner_type;
119 posix_id unix_ug;
120 };
121
122 struct pai_val {
123 uint16_t sd_type;
124 unsigned int num_entries;
125 struct pai_entry *entry_list;
126 unsigned int num_def_entries;
127 struct pai_entry *def_entry_list;
128 };
129
130 /************************************************************************
131 Return a uint32 of the pai_entry principal.
132 ************************************************************************/
133
134 static uint32_t get_pai_entry_val(struct pai_entry *paie)
135 {
136 switch (paie->owner_type) {
137 case UID_ACE:
138 DEBUG(10,("get_pai_entry_val: uid = %u\n", (unsigned int)paie->unix_ug.uid ));
139 return (uint32_t)paie->unix_ug.uid;
140 case GID_ACE:
141 DEBUG(10,("get_pai_entry_val: gid = %u\n", (unsigned int)paie->unix_ug.gid ));
142 return (uint32_t)paie->unix_ug.gid;
143 case WORLD_ACE:
144 default:
145 DEBUG(10,("get_pai_entry_val: world ace\n"));
146 return (uint32_t)-1;
147 }
148 }
149
150 /************************************************************************
151 Return a uint32 of the entry principal.
152 ************************************************************************/
153
154 static uint32_t get_entry_val(canon_ace *ace_entry)
155 {
156 switch (ace_entry->owner_type) {
157 case UID_ACE:
158 DEBUG(10,("get_entry_val: uid = %u\n", (unsigned int)ace_entry->unix_ug.uid ));
159 return (uint32_t)ace_entry->unix_ug.uid;
160 case GID_ACE:
161 DEBUG(10,("get_entry_val: gid = %u\n", (unsigned int)ace_entry->unix_ug.gid ));
162 return (uint32_t)ace_entry->unix_ug.gid;
163 case WORLD_ACE:
164 default:
165 DEBUG(10,("get_entry_val: world ace\n"));
166 return (uint32_t)-1;
167 }
168 }
169
170 /************************************************************************
171 Create the on-disk format (always v2 now). Caller must free.
172 ************************************************************************/
173
174 static char *create_pai_buf_v2(canon_ace *file_ace_list,
175 canon_ace *dir_ace_list,
176 uint16_t sd_type,
177 size_t *store_size)
178 {
179 char *pai_buf = NULL;
180 canon_ace *ace_list = NULL;
181 char *entry_offset = NULL;
182 unsigned int num_entries = 0;
183 unsigned int num_def_entries = 0;
184
185 for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next) {
186 num_entries++;
187 }
188
189 for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next) {
190 num_def_entries++;
191 }
192
193 DEBUG(10,("create_pai_buf_v2: num_entries = %u, num_def_entries = %u\n", num_entries, num_def_entries ));
194
195 *store_size = PAI_V2_ENTRIES_BASE +
196 ((num_entries + num_def_entries)*PAI_V2_ENTRY_LENGTH);
197
198 pai_buf = (char *)SMB_MALLOC(*store_size);
199 if (!pai_buf) {
200 return NULL;
201 }
202
203 /* Set up the header. */
204 memset(pai_buf, '\0', PAI_V2_ENTRIES_BASE);
205 SCVAL(pai_buf,PAI_VERSION_OFFSET,PAI_V2_VERSION);
206 SSVAL(pai_buf,PAI_V2_TYPE_OFFSET, sd_type);
207 SSVAL(pai_buf,PAI_V2_NUM_ENTRIES_OFFSET,num_entries);
208 SSVAL(pai_buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET,num_def_entries);
209
210 entry_offset = pai_buf + PAI_V2_ENTRIES_BASE;
211
212 for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next) {
213 uint8_t type_val = (uint8_t)ace_list->owner_type;
214 uint32_t entry_val = get_entry_val(ace_list);
215
216 SCVAL(entry_offset,0,ace_list->ace_flags);
217 SCVAL(entry_offset,1,type_val);
218 SIVAL(entry_offset,2,entry_val);
219 entry_offset += PAI_V2_ENTRY_LENGTH;
220 }
221
222 for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next) {
223 uint8_t type_val = (uint8_t)ace_list->owner_type;
224 uint32_t entry_val = get_entry_val(ace_list);
225
226 SCVAL(entry_offset,0,ace_list->ace_flags);
227 SCVAL(entry_offset,1,type_val);
228 SIVAL(entry_offset,2,entry_val);
229 entry_offset += PAI_V2_ENTRY_LENGTH;
230 }
231
232 return pai_buf;
233 }
234
235 /************************************************************************
236 Store the user.SAMBA_PAI attribute on disk.
237 ************************************************************************/
238
239 static void store_inheritance_attributes(files_struct *fsp,
240 canon_ace *file_ace_list,
241 canon_ace *dir_ace_list,
242 uint16_t sd_type)
243 {
244 int ret;
245 size_t store_size;
246 char *pai_buf;
247
248 if (!lp_map_acl_inherit(SNUM(fsp->conn))) {
249 return;
250 }
251
252 pai_buf = create_pai_buf_v2(file_ace_list, dir_ace_list,
253 sd_type, &store_size);
254
255 if (fsp->fh->fd != -1) {
256 ret = SMB_VFS_FSETXATTR(fsp, SAMBA_POSIX_INHERITANCE_EA_NAME,
257 pai_buf, store_size, 0);
258 } else {
259 ret = SMB_VFS_SETXATTR(fsp->conn, fsp->fsp_name->base_name,
260 SAMBA_POSIX_INHERITANCE_EA_NAME,
261 pai_buf, store_size, 0);
262 }
263
264 SAFE_FREE(pai_buf);
265
266 DEBUG(10,("store_inheritance_attribute: type 0x%x for file %s\n",
267 (unsigned int)sd_type,
268 fsp_str_dbg(fsp)));
269
270 if (ret == -1 && !no_acl_syscall_error(errno)) {
271 DEBUG(1,("store_inheritance_attribute: Error %s\n", strerror(errno) ));
272 }
273 }
274
275 /************************************************************************
276 Delete the in memory inheritance info.
277 ************************************************************************/
278
279 static void free_inherited_info(struct pai_val *pal)
280 {
281 if (pal) {
282 struct pai_entry *paie, *paie_next;
283 for (paie = pal->entry_list; paie; paie = paie_next) {
284 paie_next = paie->next;
285 SAFE_FREE(paie);
286 }
287 for (paie = pal->def_entry_list; paie; paie = paie_next) {
288 paie_next = paie->next;
289 SAFE_FREE(paie);
290 }
291 SAFE_FREE(pal);
292 }
293 }
294
295 /************************************************************************
296 Get any stored ACE flags.
297 ************************************************************************/
298
299 static uint16_t get_pai_flags(struct pai_val *pal, canon_ace *ace_entry, bool default_ace)
300 {
301 struct pai_entry *paie;
302
303 if (!pal) {
304 return 0;
305 }
306
307 /* If the entry exists it is inherited. */
308 for (paie = (default_ace ? pal->def_entry_list : pal->entry_list); paie; paie = paie->next) {
309 if (ace_entry->owner_type == paie->owner_type &&
310 get_entry_val(ace_entry) == get_pai_entry_val(paie))
311 return paie->ace_flags;
312 }
313 return 0;
314 }
315
316 /************************************************************************
317 Ensure an attribute just read is valid - v1.
318 ************************************************************************/
319
320 static bool check_pai_ok_v1(const char *pai_buf, size_t pai_buf_data_size)
321 {
322 uint16 num_entries;
323 uint16 num_def_entries;
324
325 if (pai_buf_data_size < PAI_V1_ENTRIES_BASE) {
326 /* Corrupted - too small. */
327 return false;
328 }
329
330 if (CVAL(pai_buf,PAI_VERSION_OFFSET) != PAI_V1_VERSION) {
331 return false;
332 }
333
334 num_entries = SVAL(pai_buf,PAI_V1_NUM_ENTRIES_OFFSET);
335 num_def_entries = SVAL(pai_buf,PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET);
336
337 /* Check the entry lists match. */
338 /* Each entry is 5 bytes (type plus 4 bytes of uid or gid). */
339
340 if (((num_entries + num_def_entries)*PAI_V1_ENTRY_LENGTH) +
341 PAI_V1_ENTRIES_BASE != pai_buf_data_size) {
342 return false;
343 }
344
345 return true;
346 }
347
348 /************************************************************************
349 Ensure an attribute just read is valid - v2.
350 ************************************************************************/
351
352 static bool check_pai_ok_v2(const char *pai_buf, size_t pai_buf_data_size)
353 {
354 uint16 num_entries;
355 uint16 num_def_entries;
356
357 if (pai_buf_data_size < PAI_V2_ENTRIES_BASE) {
358 /* Corrupted - too small. */
359 return false;
360 }
361
362 if (CVAL(pai_buf,PAI_VERSION_OFFSET) != PAI_V2_VERSION) {
363 return false;
364 }
365
366 num_entries = SVAL(pai_buf,PAI_V2_NUM_ENTRIES_OFFSET);
367 num_def_entries = SVAL(pai_buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET);
368
369 /* Check the entry lists match. */
370 /* Each entry is 6 bytes (flags + type + 4 bytes of uid or gid). */
371
372 if (((num_entries + num_def_entries)*PAI_V2_ENTRY_LENGTH) +
373 PAI_V2_ENTRIES_BASE != pai_buf_data_size) {
374 return false;
375 }
376
377 return true;
378 }
379
380 /************************************************************************
381 Decode the owner.
382 ************************************************************************/
383
384 static bool get_pai_owner_type(struct pai_entry *paie, const char *entry_offset)
385 {
386 paie->owner_type = (enum ace_owner)CVAL(entry_offset,0);
387 switch( paie->owner_type) {
388 case UID_ACE:
389 paie->unix_ug.uid = (uid_t)IVAL(entry_offset,1);
390 DEBUG(10,("get_pai_owner_type: uid = %u\n",
391 (unsigned int)paie->unix_ug.uid ));
392 break;
393 case GID_ACE:
394 paie->unix_ug.gid = (gid_t)IVAL(entry_offset,1);
395 DEBUG(10,("get_pai_owner_type: gid = %u\n",
396 (unsigned int)paie->unix_ug.gid ));
397 break;
398 case WORLD_ACE:
399 paie->unix_ug.world = -1;
400 DEBUG(10,("get_pai_owner_type: world ace\n"));
401 break;
402 default:
403 return false;
404 }
405 return true;
406 }
407
408 /************************************************************************
409 Process v2 entries.
410 ************************************************************************/
411
412 static const char *create_pai_v1_entries(struct pai_val *paiv,
413 const char *entry_offset,
414 bool def_entry)
415 {
416 int i;
417
418 for (i = 0; i < paiv->num_entries; i++) {
419 struct pai_entry *paie = SMB_MALLOC_P(struct pai_entry);
420 if (!paie) {
421 return NULL;
422 }
423
424 paie->ace_flags = SEC_ACE_FLAG_INHERITED_ACE;
425 if (!get_pai_owner_type(paie, entry_offset)) {
426 return NULL;
427 }
428
429 if (!def_entry) {
430 DLIST_ADD(paiv->entry_list, paie);
431 } else {
432 DLIST_ADD(paiv->def_entry_list, paie);
433 }
434 entry_offset += PAI_V1_ENTRY_LENGTH;
435 }
436 return entry_offset;
437 }
438
439 /************************************************************************
440 Convert to in-memory format from version 1.
441 ************************************************************************/
442
443 static struct pai_val *create_pai_val_v1(const char *buf, size_t size)
444 {
445 const char *entry_offset;
446 struct pai_val *paiv = NULL;
447
448 if (!check_pai_ok_v1(buf, size)) {
449 return NULL;
450 }
451
452 paiv = SMB_MALLOC_P(struct pai_val);
453 if (!paiv) {
454 return NULL;
455 }
456
457 memset(paiv, '\0', sizeof(struct pai_val));
458
459 paiv->sd_type = (CVAL(buf,PAI_V1_FLAG_OFFSET) == PAI_V1_ACL_FLAG_PROTECTED) ?
460 SE_DESC_DACL_PROTECTED : 0;
461
462 paiv->num_entries = SVAL(buf,PAI_V1_NUM_ENTRIES_OFFSET);
463 paiv->num_def_entries = SVAL(buf,PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET);
464
465 entry_offset = buf + PAI_V1_ENTRIES_BASE;
466
467 DEBUG(10,("create_pai_val: num_entries = %u, num_def_entries = %u\n",
468 paiv->num_entries, paiv->num_def_entries ));
469
470 entry_offset = create_pai_v1_entries(paiv, entry_offset, false);
471 if (entry_offset == NULL) {
472 free_inherited_info(paiv);
473 return NULL;
474 }
475 entry_offset = create_pai_v1_entries(paiv, entry_offset, true);
476 if (entry_offset == NULL) {
477 free_inherited_info(paiv);
478 return NULL;
479 }
480
481 return paiv;
482 }
483
484 /************************************************************************
485 Process v2 entries.
486 ************************************************************************/
487
488 static const char *create_pai_v2_entries(struct pai_val *paiv,
489 const char *entry_offset,
490 bool def_entry)
491 {
492 int i;
493
494 for (i = 0; i < paiv->num_entries; i++) {
495 struct pai_entry *paie = SMB_MALLOC_P(struct pai_entry);
496 if (!paie) {
497 return NULL;
498 }
499
500 paie->ace_flags = CVAL(entry_offset,0);
501
502 entry_offset++;
503
504 if (!get_pai_owner_type(paie, entry_offset)) {
505 return NULL;
506 }
507 if (!def_entry) {
508 DLIST_ADD(paiv->entry_list, paie);
509 } else {
510 DLIST_ADD(paiv->def_entry_list, paie);
511 }
512 entry_offset += PAI_V2_ENTRY_LENGTH;
513 }
514 return entry_offset;
515 }
516
517 /************************************************************************
518 Convert to in-memory format from version 2.
519 ************************************************************************/
520
521 static struct pai_val *create_pai_val_v2(const char *buf, size_t size)
522 {
523 const char *entry_offset;
524 struct pai_val *paiv = NULL;
525
526 if (!check_pai_ok_v2(buf, size)) {
527 return NULL;
528 }
529
530 paiv = SMB_MALLOC_P(struct pai_val);
531 if (!paiv) {
532 return NULL;
533 }
534
535 memset(paiv, '\0', sizeof(struct pai_val));
536
537 paiv->sd_type = SVAL(buf,PAI_V2_TYPE_OFFSET);
538
539 paiv->num_entries = SVAL(buf,PAI_V2_NUM_ENTRIES_OFFSET);
540 paiv->num_def_entries = SVAL(buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET);
541
542 entry_offset = buf + PAI_V2_ENTRIES_BASE;
543
544 DEBUG(10,("create_pai_val_v2: num_entries = %u, num_def_entries = %u\n",
545 paiv->num_entries, paiv->num_def_entries ));
546
547 entry_offset = create_pai_v2_entries(paiv, entry_offset, false);
548 if (entry_offset == NULL) {
549 free_inherited_info(paiv);
550 return NULL;
551 }
552 entry_offset = create_pai_v2_entries(paiv, entry_offset, true);
553 if (entry_offset == NULL) {
554 free_inherited_info(paiv);
555 return NULL;
556 }
557
558 return paiv;
559 }
560
561 /************************************************************************
562 Convert to in-memory format - from either version 1 or 2.
563 ************************************************************************/
564
565 static struct pai_val *create_pai_val(const char *buf, size_t size)
566 {
567 if (size < 1) {
568 return NULL;
569 }
570 if (CVAL(buf,PAI_VERSION_OFFSET) == PAI_V1_VERSION) {
571 return create_pai_val_v1(buf, size);
572 } else if (CVAL(buf,PAI_VERSION_OFFSET) == PAI_V2_VERSION) {
573 return create_pai_val_v2(buf, size);
574 } else {
575 return NULL;
576 }
577 }
578
579 /************************************************************************
580 Load the user.SAMBA_PAI attribute.
581 ************************************************************************/
582
583 static struct pai_val *fload_inherited_info(files_struct *fsp)
584 {
585 char *pai_buf;
586 size_t pai_buf_size = 1024;
587 struct pai_val *paiv = NULL;
588 ssize_t ret;
589
590 if (!lp_map_acl_inherit(SNUM(fsp->conn))) {
591 return NULL;
592 }
593
594 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL) {
595 return NULL;
596 }
597
598 do {
599 if (fsp->fh->fd != -1) {
600 ret = SMB_VFS_FGETXATTR(fsp, SAMBA_POSIX_INHERITANCE_EA_NAME,
601 pai_buf, pai_buf_size);
602 } else {
603 ret = SMB_VFS_GETXATTR(fsp->conn,
604 fsp->fsp_name->base_name,
605 SAMBA_POSIX_INHERITANCE_EA_NAME,
606 pai_buf, pai_buf_size);
607 }
608
609 if (ret == -1) {
610 if (errno != ERANGE) {
611 break;
612 }
613 /* Buffer too small - enlarge it. */
614 pai_buf_size *= 2;
615 SAFE_FREE(pai_buf);
616 if (pai_buf_size > 1024*1024) {
617 return NULL; /* Limit malloc to 1mb. */
618 }
619 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL)
620 return NULL;
621 }
622 } while (ret == -1);
623
624 DEBUG(10,("load_inherited_info: ret = %lu for file %s\n",
625 (unsigned long)ret, fsp_str_dbg(fsp)));
626
627 if (ret == -1) {
628 /* No attribute or not supported. */
629 #if defined(ENOATTR)
630 if (errno != ENOATTR)
631 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
632 #else
633 if (errno != ENOSYS)
634 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
635 #endif
636 SAFE_FREE(pai_buf);
637 return NULL;
638 }
639
640 paiv = create_pai_val(pai_buf, ret);
641
642 if (paiv) {
643 DEBUG(10,("load_inherited_info: ACL type is 0x%x for file %s\n",
644 (unsigned int)paiv->sd_type, fsp_str_dbg(fsp)));
645 }
646
647 SAFE_FREE(pai_buf);
648 return paiv;
649 }
650
651 /************************************************************************
652 Load the user.SAMBA_PAI attribute.
653 ************************************************************************/
654
655 static struct pai_val *load_inherited_info(const struct connection_struct *conn,
656 const char *fname)
657 {
658 char *pai_buf;
659 size_t pai_buf_size = 1024;
660 struct pai_val *paiv = NULL;
661 ssize_t ret;
662
663 if (!lp_map_acl_inherit(SNUM(conn))) {
664 return NULL;
665 }
666
667 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL) {
668 return NULL;
669 }
670
671 do {
672 ret = SMB_VFS_GETXATTR(conn, fname,
673 SAMBA_POSIX_INHERITANCE_EA_NAME,
674 pai_buf, pai_buf_size);
675
676 if (ret == -1) {
677 if (errno != ERANGE) {
678 break;
679 }
680 /* Buffer too small - enlarge it. */
681 pai_buf_size *= 2;
682 SAFE_FREE(pai_buf);
683 if (pai_buf_size > 1024*1024) {
684 return NULL; /* Limit malloc to 1mb. */
685 }
686 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL)
687 return NULL;
688 }
689 } while (ret == -1);
690
691 DEBUG(10,("load_inherited_info: ret = %lu for file %s\n", (unsigned long)ret, fname));
692
693 if (ret == -1) {
694 /* No attribute or not supported. */
695 #if defined(ENOATTR)
696 if (errno != ENOATTR)
697 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
698 #else
699 if (errno != ENOSYS)
700 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
701 #endif
702 SAFE_FREE(pai_buf);
703 return NULL;
704 }
705
706 paiv = create_pai_val(pai_buf, ret);
707
708 if (paiv) {
709 DEBUG(10,("load_inherited_info: ACL type 0x%x for file %s\n",
710 (unsigned int)paiv->sd_type,
711 fname));
712 }
713
714 SAFE_FREE(pai_buf);
715 return paiv;
716 }
717
718 /****************************************************************************
719 Functions to manipulate the internal ACE format.
720 ****************************************************************************/
721
722 /****************************************************************************
723 Count a linked list of canonical ACE entries.
724 ****************************************************************************/
725
726 static size_t count_canon_ace_list( canon_ace *l_head )
727 {
728 size_t count = 0;
729 canon_ace *ace;
730
731 for (ace = l_head; ace; ace = ace->next)
732 count++;
733
734 return count;
735 }
736
737 /****************************************************************************
738 Free a linked list of canonical ACE entries.
739 ****************************************************************************/
740
741 static void free_canon_ace_list( canon_ace *l_head )
742 {
743 canon_ace *list, *next;
744
745 for (list = l_head; list; list = next) {
746 next = list->next;
747 DLIST_REMOVE(l_head, list);
748 SAFE_FREE(list);
749 }
750 }
751
752 /****************************************************************************
753 Function to duplicate a canon_ace entry.
754 ****************************************************************************/
755
756 static canon_ace *dup_canon_ace( canon_ace *src_ace)
757 {
758 canon_ace *dst_ace = SMB_MALLOC_P(canon_ace);
759
760 if (dst_ace == NULL)
761 return NULL;
762
763 *dst_ace = *src_ace;
764 dst_ace->prev = dst_ace->next = NULL;
765 return dst_ace;
766 }
767
768 /****************************************************************************
769 Print out a canon ace.
770 ****************************************************************************/
771
772 static void print_canon_ace(canon_ace *pace, int num)
773 {
774 dbgtext( "canon_ace index %d. Type = %s ", num, pace->attr == ALLOW_ACE ? "allow" : "deny" );
775 dbgtext( "SID = %s ", sid_string_dbg(&pace->trustee));
776 if (pace->owner_type == UID_ACE) {
777 const char *u_name = uidtoname(pace->unix_ug.uid);
778 dbgtext( "uid %u (%s) ", (unsigned int)pace->unix_ug.uid, u_name );
779 } else if (pace->owner_type == GID_ACE) {
780 char *g_name = gidtoname(pace->unix_ug.gid);
781 dbgtext( "gid %u (%s) ", (unsigned int)pace->unix_ug.gid, g_name );
782 } else
783 dbgtext( "other ");
784 switch (pace->type) {
785 case SMB_ACL_USER:
786 dbgtext( "SMB_ACL_USER ");
787 break;
788 case SMB_ACL_USER_OBJ:
789 dbgtext( "SMB_ACL_USER_OBJ ");
790 break;
791 case SMB_ACL_GROUP:
792 dbgtext( "SMB_ACL_GROUP ");
793 break;
794 case SMB_ACL_GROUP_OBJ:
795 dbgtext( "SMB_ACL_GROUP_OBJ ");
796 break;
797 case SMB_ACL_OTHER:
798 dbgtext( "SMB_ACL_OTHER ");
799 break;
800 default:
801 dbgtext( "MASK " );
802 break;
803 }
804
805 dbgtext( "ace_flags = 0x%x ", (unsigned int)pace->ace_flags);
806 dbgtext( "perms ");
807 dbgtext( "%c", pace->perms & S_IRUSR ? 'r' : '-');
808 dbgtext( "%c", pace->perms & S_IWUSR ? 'w' : '-');
809 dbgtext( "%c\n", pace->perms & S_IXUSR ? 'x' : '-');
810 }
811
812 /****************************************************************************
813 Print out a canon ace list.
814 ****************************************************************************/
815
816 static void print_canon_ace_list(const char *name, canon_ace *ace_list)
817 {
818 int count = 0;
819
820 if( DEBUGLVL( 10 )) {
821 dbgtext( "print_canon_ace_list: %s\n", name );
822 for (;ace_list; ace_list = ace_list->next, count++)
823 print_canon_ace(ace_list, count );
824 }
825 }
826
827 /****************************************************************************
828 Map POSIX ACL perms to canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits).
829 ****************************************************************************/
830
831 static mode_t convert_permset_to_mode_t(connection_struct *conn, SMB_ACL_PERMSET_T permset)
832 {
833 mode_t ret = 0;
834
835 ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ) ? S_IRUSR : 0);
836 ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE) ? S_IWUSR : 0);
837 ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_EXECUTE) ? S_IXUSR : 0);
838
839 return ret;
840 }
841
842 /****************************************************************************
843 Map generic UNIX permissions to canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits).
844 ****************************************************************************/
845
846 static mode_t unix_perms_to_acl_perms(mode_t mode, int r_mask, int w_mask, int x_mask)
847 {
848 mode_t ret = 0;
849
850 if (mode & r_mask)
851 ret |= S_IRUSR;
852 if (mode & w_mask)
853 ret |= S_IWUSR;
854 if (mode & x_mask)
855 ret |= S_IXUSR;
856
857 return ret;
858 }
859
860 /****************************************************************************
861 Map canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits) to
862 an SMB_ACL_PERMSET_T.
863 ****************************************************************************/
864
865 static int map_acl_perms_to_permset(connection_struct *conn, mode_t mode, SMB_ACL_PERMSET_T *p_permset)
866 {
867 if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn, *p_permset) == -1)
868 return -1;
869 if (mode & S_IRUSR) {
870 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_READ) == -1)
871 return -1;
872 }
873 if (mode & S_IWUSR) {
874 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_WRITE) == -1)
875 return -1;
876 }
877 if (mode & S_IXUSR) {
878 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_EXECUTE) == -1)
879 return -1;
880 }
881 return 0;
882 }
883
884 /****************************************************************************
885 Function to create owner and group SIDs from a SMB_STRUCT_STAT.
886 ****************************************************************************/
887
888 void create_file_sids(const SMB_STRUCT_STAT *psbuf, DOM_SID *powner_sid, DOM_SID *pgroup_sid)
889 {
890 uid_to_sid( powner_sid, psbuf->st_ex_uid );
891 gid_to_sid( pgroup_sid, psbuf->st_ex_gid );
892 }
893
894 /****************************************************************************
895 Is the identity in two ACEs equal ? Check both SID and uid/gid.
896 ****************************************************************************/
897
898 static bool identity_in_ace_equal(canon_ace *ace1, canon_ace *ace2)
899 {
900 if (sid_equal(&ace1->trustee, &ace2->trustee)) {
901 return True;
902 }
903 if (ace1->owner_type == ace2->owner_type) {
904 if (ace1->owner_type == UID_ACE &&
905 ace1->unix_ug.uid == ace2->unix_ug.uid) {
906 return True;
907 } else if (ace1->owner_type == GID_ACE &&
908 ace1->unix_ug.gid == ace2->unix_ug.gid) {
909 return True;
910 }
911 }
912 return False;
913 }
914
915 /****************************************************************************
916 Merge aces with a common sid - if both are allow or deny, OR the permissions together and
917 delete the second one. If the first is deny, mask the permissions off and delete the allow
918 if the permissions become zero, delete the deny if the permissions are non zero.
919 ****************************************************************************/
920
921 static void merge_aces( canon_ace **pp_list_head )
922 {
923 canon_ace *l_head = *pp_list_head;
924 canon_ace *curr_ace_outer;
925 canon_ace *curr_ace_outer_next;
926
927 /*
928 * First, merge allow entries with identical SIDs, and deny entries
929 * with identical SIDs.
930 */
931
932 for (curr_ace_outer = l_head; curr_ace_outer; curr_ace_outer = curr_ace_outer_next) {
933 canon_ace *curr_ace;
934 canon_ace *curr_ace_next;
935
936 curr_ace_outer_next = curr_ace_outer->next; /* Save the link in case we delete. */
937
938 for (curr_ace = curr_ace_outer->next; curr_ace; curr_ace = curr_ace_next) {
939
940 curr_ace_next = curr_ace->next; /* Save the link in case of delete. */
941
942 if (identity_in_ace_equal(curr_ace, curr_ace_outer) &&
943 (curr_ace->attr == curr_ace_outer->attr)) {
944
945 if( DEBUGLVL( 10 )) {
946 dbgtext("merge_aces: Merging ACE's\n");
947 print_canon_ace( curr_ace_outer, 0);
948 print_canon_ace( curr_ace, 0);
949 }
950
951 /* Merge two allow or two deny ACE's. */
952
953 curr_ace_outer->perms |= curr_ace->perms;
954 DLIST_REMOVE(l_head, curr_ace);
955 SAFE_FREE(curr_ace);
956 curr_ace_outer_next = curr_ace_outer->next; /* We may have deleted the link. */
957 }
958 }
959 }
960
961 /*
962 * Now go through and mask off allow permissions with deny permissions.
963 * We can delete either the allow or deny here as we know that each SID
964 * appears only once in the list.
965 */
966
967 for (curr_ace_outer = l_head; curr_ace_outer; curr_ace_outer = curr_ace_outer_next) {
968 canon_ace *curr_ace;
969 canon_ace *curr_ace_next;
970
971 curr_ace_outer_next = curr_ace_outer->next; /* Save the link in case we delete. */
972
973 for (curr_ace = curr_ace_outer->next; curr_ace; curr_ace = curr_ace_next) {
974
975 curr_ace_next = curr_ace->next; /* Save the link in case of delete. */
976
977 /*
978 * Subtract ACE's with different entries. Due to the ordering constraints
979 * we've put on the ACL, we know the deny must be the first one.
980 */
981
982 if (identity_in_ace_equal(curr_ace, curr_ace_outer) &&
983 (curr_ace_outer->attr == DENY_ACE) && (curr_ace->attr == ALLOW_ACE)) {
984
985 if( DEBUGLVL( 10 )) {
986 dbgtext("merge_aces: Masking ACE's\n");
987 print_canon_ace( curr_ace_outer, 0);
988 print_canon_ace( curr_ace, 0);
989 }
990
991 curr_ace->perms &= ~curr_ace_outer->perms;
992
993 if (curr_ace->perms == 0) {
994
995 /*
996 * The deny overrides the allow. Remove the allow.
997 */
998
999 DLIST_REMOVE(l_head, curr_ace);
1000 SAFE_FREE(curr_ace);
1001 curr_ace_outer_next = curr_ace_outer->next; /* We may have deleted the link. */
1002
1003 } else {
1004
1005 /*
1006 * Even after removing permissions, there
1007 * are still allow permissions - delete the deny.
1008 * It is safe to delete the deny here,
1009 * as we are guarenteed by the deny first
1010 * ordering that all the deny entries for
1011 * this SID have already been merged into one
1012 * before we can get to an allow ace.
1013 */
1014
1015 DLIST_REMOVE(l_head, curr_ace_outer);
1016 SAFE_FREE(curr_ace_outer);
1017 break;
1018 }
1019 }
1020
1021 } /* end for curr_ace */
1022 } /* end for curr_ace_outer */
1023
1024 /* We may have modified the list. */
1025
1026 *pp_list_head = l_head;
1027 }
1028
1029 /****************************************************************************
1030 Check if we need to return NT4.x compatible ACL entries.
1031 ****************************************************************************/
1032
1033 bool nt4_compatible_acls(void)
1034 {
1035 int compat = lp_acl_compatibility();
1036
1037 if (compat == ACL_COMPAT_AUTO) {
1038 enum remote_arch_types ra_type = get_remote_arch();
1039
1040 /* Automatically adapt to client */
1041 return (ra_type <= RA_WINNT);
1042 } else
1043 return (compat == ACL_COMPAT_WINNT);
1044 }
1045
1046
1047 /****************************************************************************
1048 Map canon_ace perms to permission bits NT.
1049 The attr element is not used here - we only process deny entries on set,
1050 not get. Deny entries are implicit on get with ace->perms = 0.
1051 ****************************************************************************/
1052
1053 static uint32_t map_canon_ace_perms(int snum,
1054 enum security_ace_type *pacl_type,
1055 mode_t perms,
1056 bool directory_ace)
1057 {
1058 uint32_t nt_mask = 0;
1059
1060 *pacl_type = SEC_ACE_TYPE_ACCESS_ALLOWED;
1061
1062 if (lp_acl_map_full_control(snum) && ((perms & ALL_ACE_PERMS) == ALL_ACE_PERMS)) {
1063 if (directory_ace) {
1064 nt_mask = UNIX_DIRECTORY_ACCESS_RWX;
1065 } else {
1066 nt_mask = (UNIX_ACCESS_RWX & ~DELETE_ACCESS);
1067 }
1068 } else if ((perms & ALL_ACE_PERMS) == (mode_t)0) {
1069 /*
1070 * Windows NT refuses to display ACEs with no permissions in them (but
1071 * they are perfectly legal with Windows 2000). If the ACE has empty
1072 * permissions we cannot use 0, so we use the otherwise unused
1073 * WRITE_OWNER permission, which we ignore when we set an ACL.
1074 * We abstract this into a #define of UNIX_ACCESS_NONE to allow this
1075 * to be changed in the future.
1076 */
1077
1078 if (nt4_compatible_acls())
1079 nt_mask = UNIX_ACCESS_NONE;
1080 else
1081 nt_mask = 0;
1082 } else {
1083 if (directory_ace) {
1084 nt_mask |= ((perms & S_IRUSR) ? UNIX_DIRECTORY_ACCESS_R : 0 );
1085 nt_mask |= ((perms & S_IWUSR) ? UNIX_DIRECTORY_ACCESS_W : 0 );
1086 nt_mask |= ((perms & S_IXUSR) ? UNIX_DIRECTORY_ACCESS_X : 0 );
1087 } else {
1088 nt_mask |= ((perms & S_IRUSR) ? UNIX_ACCESS_R : 0 );
1089 nt_mask |= ((perms & S_IWUSR) ? UNIX_ACCESS_W : 0 );
1090 nt_mask |= ((perms & S_IXUSR) ? UNIX_ACCESS_X : 0 );
1091 }
1092 }
1093
1094 DEBUG(10,("map_canon_ace_perms: Mapped (UNIX) %x to (NT) %x\n",
1095 (unsigned int)perms, (unsigned int)nt_mask ));
1096
1097 return nt_mask;
1098 }
1099
1100 /****************************************************************************
1101 Map NT perms to a UNIX mode_t.
1102 ****************************************************************************/
1103
1104 #define FILE_SPECIFIC_READ_BITS (FILE_READ_DATA|FILE_READ_EA|FILE_READ_ATTRIBUTES)
1105 #define FILE_SPECIFIC_WRITE_BITS (FILE_WRITE_DATA|FILE_APPEND_DATA|FILE_WRITE_EA|FILE_WRITE_ATTRIBUTES)
1106 #define FILE_SPECIFIC_EXECUTE_BITS (FILE_EXECUTE)
1107
1108 static mode_t map_nt_perms( uint32 *mask, int type)
1109 {
1110 mode_t mode = 0;
1111
1112 switch(type) {
1113 case S_IRUSR:
1114 if((*mask) & GENERIC_ALL_ACCESS)
1115 mode = S_IRUSR|S_IWUSR|S_IXUSR;
1116 else {
1117 mode |= ((*mask) & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IRUSR : 0;
1118 mode |= ((*mask) & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWUSR : 0;
1119 mode |= ((*mask) & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXUSR : 0;
1120 }
1121 break;
1122 case S_IRGRP:
1123 if((*mask) & GENERIC_ALL_ACCESS)
1124 mode = S_IRGRP|S_IWGRP|S_IXGRP;
1125 else {
1126 mode |= ((*mask) & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IRGRP : 0;
1127 mode |= ((*mask) & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWGRP : 0;
1128 mode |= ((*mask) & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXGRP : 0;
1129 }
1130 break;
1131 case S_IROTH:
1132 if((*mask) & GENERIC_ALL_ACCESS)
1133 mode = S_IROTH|S_IWOTH|S_IXOTH;
1134 else {
1135 mode |= ((*mask) & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IROTH : 0;
1136 mode |= ((*mask) & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWOTH : 0;
1137 mode |= ((*mask) & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXOTH : 0;
1138 }
1139 break;
1140 }
1141
1142 return mode;
1143 }
1144
1145 /****************************************************************************
1146 Unpack a SEC_DESC into a UNIX owner and group.
1147 ****************************************************************************/
1148
1149 NTSTATUS unpack_nt_owners(int snum, uid_t *puser, gid_t *pgrp, uint32 security_info_sent, const SEC_DESC *psd)
1150 {
1151 DOM_SID owner_sid;
1152 DOM_SID grp_sid;
1153
1154 *puser = (uid_t)-1;
1155 *pgrp = (gid_t)-1;
1156
1157 if(security_info_sent == 0) {
1158 DEBUG(0,("unpack_nt_owners: no security info sent !\n"));
1159 return NT_STATUS_OK;
1160 }
1161
1162 /*
1163 * Validate the owner and group SID's.
1164 */
1165
1166 memset(&owner_sid, '\0', sizeof(owner_sid));
1167 memset(&grp_sid, '\0', sizeof(grp_sid));
1168
1169 DEBUG(5,("unpack_nt_owners: validating owner_sids.\n"));
1170
1171 /*
1172 * Don't immediately fail if the owner sid cannot be validated.
1173 * This may be a group chown only set.
1174 */
1175
1176 if (security_info_sent & OWNER_SECURITY_INFORMATION) {
1177 sid_copy(&owner_sid, psd->owner_sid);
1178 if (!sid_to_uid(&owner_sid, puser)) {
1179 if (lp_force_unknown_acl_user(snum)) {
1180 /* this allows take ownership to work
1181 * reasonably */
1182 *puser = current_user.ut.uid;
1183 } else {
1184 DEBUG(3,("unpack_nt_owners: unable to validate"
1185 " owner sid for %s\n",
1186 sid_string_dbg(&owner_sid)));
1187 return NT_STATUS_INVALID_OWNER;
1188 }
1189 }
1190 DEBUG(3,("unpack_nt_owners: owner sid mapped to uid %u\n",
1191 (unsigned int)*puser ));
1192 }
1193
1194 /*
1195 * Don't immediately fail if the group sid cannot be validated.
1196 * This may be an owner chown only set.
1197 */
1198
1199 if (security_info_sent & GROUP_SECURITY_INFORMATION) {
1200 sid_copy(&grp_sid, psd->group_sid);
1201 if (!sid_to_gid( &grp_sid, pgrp)) {
1202 if (lp_force_unknown_acl_user(snum)) {
1203 /* this allows take group ownership to work
1204 * reasonably */
1205 *pgrp = current_user.ut.gid;
1206 } else {
1207 DEBUG(3,("unpack_nt_owners: unable to validate"
1208 " group sid.\n"));
1209 return NT_STATUS_INVALID_OWNER;
1210 }
1211 }
1212 DEBUG(3,("unpack_nt_owners: group sid mapped to gid %u\n",
1213 (unsigned int)*pgrp));
1214 }
1215
1216 DEBUG(5,("unpack_nt_owners: owner_sids validated.\n"));
1217
1218 return NT_STATUS_OK;
1219 }
1220
1221 /****************************************************************************
1222 Ensure the enforced permissions for this share apply.
1223 ****************************************************************************/
1224
1225 static void apply_default_perms(const struct share_params *params,
1226 const bool is_directory, canon_ace *pace,
1227 mode_t type)
1228 {
1229 mode_t and_bits = (mode_t)0;
1230 mode_t or_bits = (mode_t)0;
1231
1232 /* Get the initial bits to apply. */
1233
1234 if (is_directory) {
1235 and_bits = lp_dir_security_mask(params->service);
1236 or_bits = lp_force_dir_security_mode(params->service);
1237 } else {
1238 and_bits = lp_security_mask(params->service);
1239 or_bits = lp_force_security_mode(params->service);
1240 }
1241
1242 /* Now bounce them into the S_USR space. */
1243 switch(type) {
1244 case S_IRUSR:
1245 /* Ensure owner has read access. */
1246 pace->perms |= S_IRUSR;
1247 if (is_directory)
1248 pace->perms |= (S_IWUSR|S_IXUSR);
1249 and_bits = unix_perms_to_acl_perms(and_bits, S_IRUSR, S_IWUSR, S_IXUSR);
1250 or_bits = unix_perms_to_acl_perms(or_bits, S_IRUSR, S_IWUSR, S_IXUSR);
1251 break;
1252 case S_IRGRP:
1253 and_bits = unix_perms_to_acl_perms(and_bits, S_IRGRP, S_IWGRP, S_IXGRP);
1254 or_bits = unix_perms_to_acl_perms(or_bits, S_IRGRP, S_IWGRP, S_IXGRP);
1255 break;
1256 case S_IROTH:
1257 and_bits = unix_perms_to_acl_perms(and_bits, S_IROTH, S_IWOTH, S_IXOTH);
1258 or_bits = unix_perms_to_acl_perms(or_bits, S_IROTH, S_IWOTH, S_IXOTH);
1259 break;
1260 }
1261
1262 pace->perms = ((pace->perms & and_bits)|or_bits);
1263 }
1264
1265 /****************************************************************************
1266 Check if a given uid/SID is in a group gid/SID. This is probably very
1267 expensive and will need optimisation. A *lot* of optimisation :-). JRA.
1268 ****************************************************************************/
1269
1270 static bool uid_entry_in_group( canon_ace *uid_ace, canon_ace *group_ace )
1271 {
1272 const char *u_name = NULL;
1273
1274 /* "Everyone" always matches every uid. */
1275
1276 if (sid_equal(&group_ace->trustee, &global_sid_World))
1277 return True;
1278
1279 /*
1280 * if it's the current user, we already have the unix token
1281 * and don't need to do the complex user_in_group_sid() call
1282 */
1283 if (uid_ace->unix_ug.uid == current_user.ut.uid) {
1284 size_t i;
1285
1286 if (group_ace->unix_ug.gid == current_user.ut.gid) {
1287 return True;
1288 }
1289
1290 for (i=0; i < current_user.ut.ngroups; i++) {
1291 if (group_ace->unix_ug.gid == current_user.ut.groups[i]) {
1292 return True;
1293 }
1294 }
1295 }
1296
1297 /* u_name talloc'ed off tos. */
1298 u_name = uidtoname(uid_ace->unix_ug.uid);
1299 if (!u_name) {
1300 return False;
1301 }
1302
1303 /*
1304 * user_in_group_sid() uses create_token_from_username()
1305 * which creates an artificial NT token given just a username,
1306 * so this is not reliable for users from foreign domains
1307 * exported by winbindd!
1308 */
1309 return user_in_group_sid(u_name, &group_ace->trustee);
1310 }
1311
1312 /****************************************************************************
1313 A well formed POSIX file or default ACL has at least 3 entries, a
1314 SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ.
1315 In addition, the owner must always have at least read access.
1316 When using this call on get_acl, the pst struct is valid and contains
1317 the mode of the file. When using this call on set_acl, the pst struct has
1318 been modified to have a mode containing the default for this file or directory
1319 type.
1320 ****************************************************************************/
1321
1322 static bool ensure_canon_entry_valid(canon_ace **pp_ace,
1323 const struct share_params *params,
1324 const bool is_directory,
1325 const DOM_SID *pfile_owner_sid,
1326 const DOM_SID *pfile_grp_sid,
1327 const SMB_STRUCT_STAT *pst,
1328 bool setting_acl)
1329 {
1330 canon_ace *pace;
1331 bool got_user = False;
1332 bool got_grp = False;
1333 bool got_other = False;
1334 canon_ace *pace_other = NULL;
1335
1336 for (pace = *pp_ace; pace; pace = pace->next) {
1337 if (pace->type == SMB_ACL_USER_OBJ) {
1338
1339 if (setting_acl)
1340 apply_default_perms(params, is_directory, pace, S_IRUSR);
1341 got_user = True;
1342
1343 } else if (pace->type == SMB_ACL_GROUP_OBJ) {
1344
1345 /*
1346 * Ensure create mask/force create mode is respected on set.
1347 */
1348
1349 if (setting_acl)
1350 apply_default_perms(params, is_directory, pace, S_IRGRP);
1351 got_grp = True;
1352
1353 } else if (pace->type == SMB_ACL_OTHER) {
1354
1355 /*
1356 * Ensure create mask/force create mode is respected on set.
1357 */
1358
1359 if (setting_acl)
1360 apply_default_perms(params, is_directory, pace, S_IROTH);
1361 got_other = True;
1362 pace_other = pace;
1363 }
1364 }
1365
1366 if (!got_user) {
1367 if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1368 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1369 return False;
1370 }
1371
1372 ZERO_STRUCTP(pace);
1373 pace->type = SMB_ACL_USER_OBJ;
1374 pace->owner_type = UID_ACE;
1375 pace->unix_ug.uid = pst->st_ex_uid;
1376 pace->trustee = *pfile_owner_sid;
1377 pace->attr = ALLOW_ACE;
1378
1379 if (setting_acl) {
1380 /* See if the owning user is in any of the other groups in
1381 the ACE. If so, OR in the permissions from that group. */
1382
1383 bool group_matched = False;
1384 canon_ace *pace_iter;
1385
1386 for (pace_iter = *pp_ace; pace_iter; pace_iter = pace_iter->next) {
1387 if (pace_iter->type == SMB_ACL_GROUP_OBJ || pace_iter->type == SMB_ACL_GROUP) {
1388 if (uid_entry_in_group(pace, pace_iter)) {
1389 pace->perms |= pace_iter->perms;
1390 group_matched = True;
1391 }
1392 }
1393 }
1394
1395 /* If we only got an "everyone" perm, just use that. */
1396 if (!group_matched) {
1397 if (got_other)
1398 pace->perms = pace_other->perms;
1399 else
1400 pace->perms = 0;
1401 }
1402
1403 apply_default_perms(params, is_directory, pace, S_IRUSR);
1404 } else {
1405 pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRUSR, S_IWUSR, S_IXUSR);
1406 }
1407
1408 DLIST_ADD(*pp_ace, pace);
1409 }
1410
1411 if (!got_grp) {
1412 if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1413 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1414 return False;
1415 }
1416
1417 ZERO_STRUCTP(pace);
1418 pace->type = SMB_ACL_GROUP_OBJ;
1419 pace->owner_type = GID_ACE;
1420 pace->unix_ug.uid = pst->st_ex_gid;
1421 pace->trustee = *pfile_grp_sid;
1422 pace->attr = ALLOW_ACE;
1423 if (setting_acl) {
1424 /* If we only got an "everyone" perm, just use that. */
1425 if (got_other)
1426 pace->perms = pace_other->perms;
1427 else
1428 pace->perms = 0;
1429 apply_default_perms(params, is_directory, pace, S_IRGRP);
1430 } else {
1431 pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRGRP, S_IWGRP, S_IXGRP);
1432 }
1433
1434 DLIST_ADD(*pp_ace, pace);
1435 }
1436
1437 if (!got_other) {
1438 if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1439 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1440 return False;
1441 }
1442
1443 ZERO_STRUCTP(pace);
1444 pace->type = SMB_ACL_OTHER;
1445 pace->owner_type = WORLD_ACE;
1446 pace->unix_ug.world = -1;
1447 pace->trustee = global_sid_World;
1448 pace->attr = ALLOW_ACE;
1449 if (setting_acl) {
1450 pace->perms = 0;
1451 apply_default_perms(params, is_directory, pace, S_IROTH);
1452 } else
1453 pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IROTH, S_IWOTH, S_IXOTH);
1454
1455 DLIST_ADD(*pp_ace, pace);
1456 }
1457
1458 return True;
1459 }
1460
1461 /****************************************************************************
1462 Check if a POSIX ACL has the required SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries.
1463 If it does not have them, check if there are any entries where the trustee is the
1464 file owner or the owning group, and map these to SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ.
1465 ****************************************************************************/
1466
1467 static void check_owning_objs(canon_ace *ace, DOM_SID *pfile_owner_sid, DOM_SID *pfile_grp_sid)
1468 {
1469 bool got_user_obj, got_group_obj;
1470 canon_ace *current_ace;
1471 int i, entries;
1472
1473 entries = count_canon_ace_list(ace);
1474 got_user_obj = False;
1475 got_group_obj = False;
1476
1477 for (i=0, current_ace = ace; i < entries; i++, current_ace = current_ace->next) {
1478 if (current_ace->type == SMB_ACL_USER_OBJ)
1479 got_user_obj = True;
1480 else if (current_ace->type == SMB_ACL_GROUP_OBJ)
1481 got_group_obj = True;
1482 }
1483 if (got_user_obj && got_group_obj) {
1484 DEBUG(10,("check_owning_objs: ACL had owning user/group entries.\n"));
1485 return;
1486 }
1487
1488 for (i=0, current_ace = ace; i < entries; i++, current_ace = current_ace->next) {
1489 if (!got_user_obj && current_ace->owner_type == UID_ACE &&
1490 sid_equal(&current_ace->trustee, pfile_owner_sid)) {
1491 current_ace->type = SMB_ACL_USER_OBJ;
1492 got_user_obj = True;
1493 }
1494 if (!got_group_obj && current_ace->owner_type == GID_ACE &&
1495 sid_equal(&current_ace->trustee, pfile_grp_sid)) {
1496 current_ace->type = SMB_ACL_GROUP_OBJ;
1497 got_group_obj = True;
1498 }
1499 }
1500 if (!got_user_obj)
1501 DEBUG(10,("check_owning_objs: ACL is missing an owner entry.\n"));
1502 if (!got_group_obj)
1503 DEBUG(10,("check_owning_objs: ACL is missing an owning group entry.\n"));
1504 }
1505
1506 /****************************************************************************
1507 Unpack a SEC_DESC into two canonical ace lists.
1508 ****************************************************************************/
1509
1510 static bool create_canon_ace_lists(files_struct *fsp,
1511 SMB_STRUCT_STAT *pst,
1512 DOM_SID *pfile_owner_sid,
1513 DOM_SID *pfile_grp_sid,
1514 canon_ace **ppfile_ace,
1515 canon_ace **ppdir_ace,
1516 const SEC_ACL *dacl)
1517 {
1518 bool all_aces_are_inherit_only = (fsp->is_directory ? True : False);
1519 canon_ace *file_ace = NULL;
1520 canon_ace *dir_ace = NULL;
1521 canon_ace *current_ace = NULL;
1522 bool got_dir_allow = False;
1523 bool got_file_allow = False;
1524 int i, j;
1525
1526 *ppfile_ace = NULL;
1527 *ppdir_ace = NULL;
1528
1529 /*
1530 * Convert the incoming ACL into a more regular form.
1531 */
1532
1533 for(i = 0; i < dacl->num_aces; i++) {
1534 SEC_ACE *psa = &dacl->aces[i];
1535
1536 if((psa->type != SEC_ACE_TYPE_ACCESS_ALLOWED) && (psa->type != SEC_ACE_TYPE_ACCESS_DENIED)) {
1537 DEBUG(3,("create_canon_ace_lists: unable to set anything but an ALLOW or DENY ACE.\n"));
1538 return False;
1539 }
1540
1541 if (nt4_compatible_acls()) {
1542 /*
1543 * The security mask may be UNIX_ACCESS_NONE which should map into
1544 * no permissions (we overload the WRITE_OWNER bit for this) or it
1545 * should be one of the ALL/EXECUTE/READ/WRITE bits. Arrange for this
1546 * to be so. Any other bits override the UNIX_ACCESS_NONE bit.
1547 */
1548
1549 /*
1550 * Convert GENERIC bits to specific bits.
1551 */
1552
1553 se_map_generic(&psa->access_mask, &file_generic_mapping);
1554
1555 psa->access_mask &= (UNIX_ACCESS_NONE|FILE_ALL_ACCESS);
1556
1557 if(psa->access_mask != UNIX_ACCESS_NONE)
1558 psa->access_mask &= ~UNIX_ACCESS_NONE;
1559 }
1560 }
1561
1562 /*
1563 * Deal with the fact that NT 4.x re-writes the canonical format
1564 * that we return for default ACLs. If a directory ACE is identical
1565 * to a inherited directory ACE then NT changes the bits so that the
1566 * first ACE is set to OI|IO and the second ACE for this SID is set
1567 * to CI. We need to repair this. JRA.
1568 */
1569
1570 for(i = 0; i < dacl->num_aces; i++) {
1571 SEC_ACE *psa1 = &dacl->aces[i];
1572
1573 for (j = i + 1; j < dacl->num_aces; j++) {
1574 SEC_ACE *psa2 = &dacl->aces[j];
1575
1576 if (psa1->access_mask != psa2->access_mask)
1577 continue;
1578
1579 if (!sid_equal(&psa1->trustee, &psa2->trustee))
1580 continue;
1581
1582 /*
1583 * Ok - permission bits and SIDs are equal.
1584 * Check if flags were re-written.
1585 */
1586
1587 if (psa1->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
1588
1589 psa1->flags |= (psa2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT));
1590 psa2->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT);
1591
1592 } else if (psa2->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
1593
1594 psa2->flags |= (psa1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT));
1595 psa1->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT);
1596
1597 }
1598 }
1599 }
1600
1601 for(i = 0; i < dacl->num_aces; i++) {
1602 SEC_ACE *psa = &dacl->aces[i];
1603
1604 /*
1605 * Create a cannon_ace entry representing this NT DACL ACE.
1606 */
1607
1608 if ((current_ace = SMB_MALLOC_P(canon_ace)) == NULL) {
1609 free_canon_ace_list(file_ace);
1610 free_canon_ace_list(dir_ace);
1611 DEBUG(0,("create_canon_ace_lists: malloc fail.\n"));
1612 return False;
1613 }
1614
1615 ZERO_STRUCTP(current_ace);
1616
1617 sid_copy(&current_ace->trustee, &psa->trustee);
1618
1619 /*
1620 * Try and work out if the SID is a user or group
1621 * as we need to flag these differently for POSIX.
1622 * Note what kind of a POSIX ACL this should map to.
1623 */
1624
1625 if( sid_equal(&current_ace->trustee, &global_sid_World)) {
1626 current_ace->owner_type = WORLD_ACE;
1627 current_ace->unix_ug.world = -1;
1628 current_ace->type = SMB_ACL_OTHER;
1629 } else if (sid_equal(&current_ace->trustee, &global_sid_Creator_Owner)) {
1630 current_ace->owner_type = UID_ACE;
1631 current_ace->unix_ug.uid = pst->st_ex_uid;
1632 current_ace->type = SMB_ACL_USER_OBJ;
1633
1634 /*
1635 * The Creator Owner entry only specifies inheritable permissions,
1636 * never access permissions. WinNT doesn't always set the ACE to
1637 *INHERIT_ONLY, though.
1638 */
1639
1640 if (nt4_compatible_acls())
1641 psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
1642 } else if (sid_equal(&current_ace->trustee, &global_sid_Creator_Group)) {
1643 current_ace->owner_type = GID_ACE;
1644 current_ace->unix_ug.gid = pst->st_ex_gid;
1645 current_ace->type = SMB_ACL_GROUP_OBJ;
1646
1647 /*
1648 * The Creator Group entry only specifies inheritable permissions,
1649 * never access permissions. WinNT doesn't always set the ACE to
1650 *INHERIT_ONLY, though.
1651 */
1652 if (nt4_compatible_acls())
1653 psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
1654
1655 } else if (sid_to_uid( &current_ace->trustee, &current_ace->unix_ug.uid)) {
1656 current_ace->owner_type = UID_ACE;
1657 /* If it's the owning user, this is a user_obj, not
1658 * a user. */
1659 if (current_ace->unix_ug.uid == pst->st_ex_uid) {
1660 current_ace->type = SMB_ACL_USER_OBJ;
1661 } else {
1662 current_ace->type = SMB_ACL_USER;
1663 }
1664 } else if (sid_to_gid( &current_ace->trustee, &current_ace->unix_ug.gid)) {
1665 current_ace->owner_type = GID_ACE;
1666 /* If it's the primary group, this is a group_obj, not
1667 * a group. */
1668 if (current_ace->unix_ug.gid == pst->st_ex_gid) {
1669 current_ace->type = SMB_ACL_GROUP_OBJ;
1670 } else {
1671 current_ace->type = SMB_ACL_GROUP;
1672 }
1673 } else {
1674 /*
1675 * Silently ignore map failures in non-mappable SIDs (NT Authority, BUILTIN etc).
1676 */
1677
1678 if (non_mappable_sid(&psa->trustee)) {
1679 DEBUG(10, ("create_canon_ace_lists: ignoring "
1680 "non-mappable SID %s\n",
1681 sid_string_dbg(&psa->trustee)));
1682 SAFE_FREE(current_ace);
1683 continue;
1684 }
1685
1686 free_canon_ace_list(file_ace);
1687 free_canon_ace_list(dir_ace);
1688 DEBUG(0, ("create_canon_ace_lists: unable to map SID "
1689 "%s to uid or gid.\n",
1690 sid_string_dbg(&current_ace->trustee)));
1691 SAFE_FREE(current_ace);
1692 return False;
1693 }
1694
1695 /*
1696 * Map the given NT permissions into a UNIX mode_t containing only
1697 * S_I(R|W|X)USR bits.
1698 */
1699
1700 current_ace->perms |= map_nt_perms( &psa->access_mask, S_IRUSR);
1701 current_ace->attr = (psa->type == SEC_ACE_TYPE_ACCESS_ALLOWED) ? ALLOW_ACE : DENY_ACE;
1702
1703 /* Store the ace_flag. */
1704 current_ace->ace_flags = psa->flags;
1705
1706 /*
1707 * Now add the created ace to either the file list, the directory
1708 * list, or both. We *MUST* preserve the order here (hence we use
1709 * DLIST_ADD_END) as NT ACLs are order dependent.
1710 */
1711
1712 if (fsp->is_directory) {
1713
1714 /*
1715 * We can only add to the default POSIX ACE list if the ACE is
1716 * designed to be inherited by both files and directories.
1717 */
1718
1719 if ((psa->flags & (SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT)) ==
1720 (SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT)) {
1721
1722 DLIST_ADD_END(dir_ace, current_ace, canon_ace *);
1723
1724 /*
1725 * Note if this was an allow ace. We can't process
1726 * any further deny ace's after this.
1727 */
1728
1729 if (current_ace->attr == ALLOW_ACE)
1730 got_dir_allow = True;
1731
1732 if ((current_ace->attr == DENY_ACE) && got_dir_allow) {
1733 DEBUG(0,("create_canon_ace_lists: "
1734 "malformed ACL in "
1735 "inheritable ACL! Deny entry "
1736 "after Allow entry. Failing "
1737 "to set on file %s.\n",
1738 fsp_str_dbg(fsp)));
1739 free_canon_ace_list(file_ace);
1740 free_canon_ace_list(dir_ace);
1741 return False;
1742 }
1743
1744 if( DEBUGLVL( 10 )) {
1745 dbgtext("create_canon_ace_lists: adding dir ACL:\n");
1746 print_canon_ace( current_ace, 0);
1747 }
1748
1749 /*
1750 * If this is not an inherit only ACE we need to add a duplicate
1751 * to the file acl.
1752 */
1753
1754 if (!(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
1755 canon_ace *dup_ace = dup_canon_ace(current_ace);
1756
1757 if (!dup_ace) {
1758 DEBUG(0,("create_canon_ace_lists: malloc fail !\n"));
1759 free_canon_ace_list(file_ace);
1760 free_canon_ace_list(dir_ace);
1761 return False;
1762 }
1763
1764 /*
1765 * We must not free current_ace here as its
1766 * pointer is now owned by the dir_ace list.
1767 */
1768 current_ace = dup_ace;
1769 } else {
1770 /*
1771 * We must not free current_ace here as its
1772 * pointer is now owned by the dir_ace list.
1773 */
1774 current_ace = NULL;
1775 }
1776 }
1777 }
1778
1779 /*
1780 * Only add to the file ACL if not inherit only.
1781 */
1782
1783 if (current_ace && !(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
1784 DLIST_ADD_END(file_ace, current_ace, canon_ace *);
1785
1786 /*
1787 * Note if this was an allow ace. We can't process
1788 * any further deny ace's after this.
1789 */
1790
1791 if (current_ace->attr == ALLOW_ACE)
1792 got_file_allow = True;
1793
1794 if ((current_ace->attr == DENY_ACE) && got_file_allow) {
1795 DEBUG(0,("create_canon_ace_lists: malformed "
1796 "ACL in file ACL ! Deny entry after "
1797 "Allow entry. Failing to set on file "
1798 "%s.\n", fsp_str_dbg(fsp)));
1799 free_canon_ace_list(file_ace);
1800 free_canon_ace_list(dir_ace);
1801 return False;
1802 }
1803
1804 if( DEBUGLVL( 10 )) {
1805 dbgtext("create_canon_ace_lists: adding file ACL:\n");
1806 print_canon_ace( current_ace, 0);
1807 }
1808 all_aces_are_inherit_only = False;
1809 /*
1810 * We must not free current_ace here as its
1811 * pointer is now owned by the file_ace list.
1812 */
1813 current_ace = NULL;
1814 }
1815
1816 /*
1817 * Free if ACE was not added.
1818 */
1819
1820 SAFE_FREE(current_ace);
1821 }
1822
1823 if (fsp->is_directory && all_aces_are_inherit_only) {
1824 /*
1825 * Windows 2000 is doing one of these weird 'inherit acl'
1826 * traverses to conserve NTFS ACL resources. Just pretend
1827 * there was no DACL sent. JRA.
1828 */
1829
1830 DEBUG(10,("create_canon_ace_lists: Win2k inherit acl traverse. Ignoring DACL.\n"));
1831 free_canon_ace_list(file_ace);
1832 free_canon_ace_list(dir_ace);
1833 file_ace = NULL;
1834 dir_ace = NULL;
1835 } else {
1836 /*
1837 * Check if we have SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries in each
1838 * ACL. If we don't have them, check if any SMB_ACL_USER/SMB_ACL_GROUP
1839 * entries can be converted to *_OBJ. Usually we will already have these
1840 * entries in the Default ACL, and the Access ACL will not have them.
1841 */
1842 if (file_ace) {
1843 check_owning_objs(file_ace, pfile_owner_sid, pfile_grp_sid);
1844 }
1845 if (dir_ace) {
1846 check_owning_objs(dir_ace, pfile_owner_sid, pfile_grp_sid);
1847 }
1848 }
1849
1850 *ppfile_ace = file_ace;
1851 *ppdir_ace = dir_ace;
1852
1853 return True;
1854 }
1855
1856 /****************************************************************************
1857 ASCII art time again... JRA :-).
1858
1859 We have 4 cases to process when moving from an NT ACL to a POSIX ACL. Firstly,
1860 we insist the ACL is in canonical form (ie. all DENY entries preceede ALLOW
1861 entries). Secondly, the merge code has ensured that all duplicate SID entries for
1862 allow or deny have been merged, so the same SID can only appear once in the deny
1863 list or once in the allow list.
1864
1865 We then process as follows :
1866
1867 ---------------------------------------------------------------------------
1868 First pass - look for a Everyone DENY entry.
1869
1870 If it is deny all (rwx) trunate the list at this point.
1871 Else, walk the list from this point and use the deny permissions of this
1872 entry as a mask on all following allow entries. Finally, delete
1873 the Everyone DENY entry (we have applied it to everything possible).
1874
1875 In addition, in this pass we remove any DENY entries that have
1876 no permissions (ie. they are a DENY nothing).
1877 ---------------------------------------------------------------------------
1878 Second pass - only deal with deny user entries.
1879
1880 DENY user1 (perms XXX)
1881
1882 new_perms = 0
1883 for all following allow group entries where user1 is in group
1884 new_perms |= group_perms;
1885
1886 user1 entry perms = new_perms & ~ XXX;
1887
1888 Convert the deny entry to an allow entry with the new perms and
1889 push to the end of the list. Note if the user was in no groups
1890 this maps to a specific allow nothing entry for this user.
1891
1892 The common case from the NT ACL choser (userX deny all) is
1893 optimised so we don't do the group lookup - we just map to
1894 an allow nothing entry.
1895
1896 What we're doing here is inferring the allow permissions the
1897 person setting the ACE on user1 wanted by looking at the allow
1898 permissions on the groups the user is currently in. This will
1899 be a snapshot, depending on group membership but is the best
1900 we can do and has the advantage of failing closed rather than
1901 open.
1902 ---------------------------------------------------------------------------
1903 Third pass - only deal with deny group entries.
1904
1905 DENY group1 (perms XXX)
1906
1907 for all following allow user entries where user is in group1
1908 user entry perms = user entry perms & ~ XXX;
1909
1910 If there is a group Everyone allow entry with permissions YYY,
1911 convert the group1 entry to an allow entry and modify its
1912 permissions to be :
1913
1914 new_perms = YYY & ~ XXX
1915
1916 and push to the end of the list.
1917
1918 If there is no group Everyone allow entry then convert the
1919 group1 entry to a allow nothing entry and push to the end of the list.
1920
1921 Note that the common case from the NT ACL choser (groupX deny all)
1922 cannot be optimised here as we need to modify user entries who are
1923 in the group to change them to a deny all also.
1924
1925 What we're doing here is modifying the allow permissions of
1926 user entries (which are more specific in POSIX ACLs) to mask
1927 out the explicit deny set on the group they are in. This will
1928 be a snapshot depending on current group membership but is the
1929 best we can do and has the advantage of failing closed rather
1930 than open.
1931 ---------------------------------------------------------------------------
1932 Fourth pass - cope with cumulative permissions.
1933
1934 for all allow user entries, if there exists an allow group entry with
1935 more permissive permissions, and the user is in that group, rewrite the
1936 allow user permissions to contain both sets of permissions.
1937
1938 Currently the code for this is #ifdef'ed out as these semantics make
1939 no sense to me. JRA.
1940 ---------------------------------------------------------------------------
1941
1942 Note we *MUST* do the deny user pass first as this will convert deny user
1943 entries into allow user entries which can then be processed by the deny
1944 group pass.
1945
1946 The above algorithm took a *lot* of thinking about - hence this
1947 explaination :-). JRA.
1948 ****************************************************************************/
1949
1950 /****************************************************************************
1951 Process a canon_ace list entries. This is very complex code. We need
1952 to go through and remove the "deny" permissions from any allow entry that matches
1953 the id of this entry. We have already refused any NT ACL that wasn't in correct
1954 order (DENY followed by ALLOW). If any allow entry ends up with zero permissions,
1955 we just remove it (to fail safe). We have already removed any duplicate ace
1956 entries. Treat an "Everyone" DENY_ACE as a special case - use it to mask all
1957 allow entries.
1958 ****************************************************************************/
1959
1960 static void process_deny_list( canon_ace **pp_ace_list )
1961 {
1962 canon_ace *ace_list = *pp_ace_list;
1963 canon_ace *curr_ace = NULL;
1964 canon_ace *curr_ace_next = NULL;
1965
1966 /* Pass 1 above - look for an Everyone, deny entry. */
1967
1968 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
1969 canon_ace *allow_ace_p;
1970
1971 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
1972
1973 if (curr_ace->attr != DENY_ACE)
1974 continue;
1975
1976 if (curr_ace->perms == (mode_t)0) {
1977
1978 /* Deny nothing entry - delete. */
1979
1980 DLIST_REMOVE(ace_list, curr_ace);
1981 continue;
1982 }
1983
1984 if (!sid_equal(&curr_ace->trustee, &global_sid_World))
1985 continue;
1986
1987 /* JRATEST - assert. */
1988 SMB_ASSERT(curr_ace->owner_type == WORLD_ACE);
1989
1990 if (curr_ace->perms == ALL_ACE_PERMS) {
1991
1992 /*
1993 * Optimisation. This is a DENY_ALL to Everyone. Truncate the
1994 * list at this point including this entry.
1995 */
1996
1997 canon_ace *prev_entry = curr_ace->prev;
1998
1999 free_canon_ace_list( curr_ace );
2000 if (prev_entry)
2001 prev_entry->next = NULL;
2002 else {
2003 /* We deleted the entire list. */
2004 ace_list = NULL;
2005 }
2006 break;
2007 }
2008
2009 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2010
2011 /*
2012 * Only mask off allow entries.
2013 */
2014
2015 if (allow_ace_p->attr != ALLOW_ACE)
2016 continue;
2017
2018 allow_ace_p->perms &= ~curr_ace->perms;
2019 }
2020
2021 /*
2022 * Now it's been applied, remove it.
2023 */
2024
2025 DLIST_REMOVE(ace_list, curr_ace);
2026 }
2027
2028 /* Pass 2 above - deal with deny user entries. */
2029
2030 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2031 mode_t new_perms = (mode_t)0;
2032 canon_ace *allow_ace_p;
2033
2034 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2035
2036 if (curr_ace->attr != DENY_ACE)
2037 continue;
2038
2039 if (curr_ace->owner_type != UID_ACE)
2040 continue;
2041
2042 if (curr_ace->perms == ALL_ACE_PERMS) {
2043
2044 /*
2045 * Optimisation - this is a deny everything to this user.
2046 * Convert to an allow nothing and push to the end of the list.
2047 */
2048
2049 curr_ace->attr = ALLOW_ACE;
2050 curr_ace->perms = (mode_t)0;
2051 DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2052 continue;
2053 }
2054
2055 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2056
2057 if (allow_ace_p->attr != ALLOW_ACE)
2058 continue;
2059
2060 /* We process GID_ACE and WORLD_ACE entries only. */
2061
2062 if (allow_ace_p->owner_type == UID_ACE)
2063 continue;
2064
2065 if (uid_entry_in_group( curr_ace, allow_ace_p))
2066 new_perms |= allow_ace_p->perms;
2067 }
2068
2069 /*
2070 * Convert to a allow entry, modify the perms and push to the end
2071 * of the list.
2072 */
2073
2074 curr_ace->attr = ALLOW_ACE;
2075 curr_ace->perms = (new_perms & ~curr_ace->perms);
2076 DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2077 }
2078
2079 /* Pass 3 above - deal with deny group entries. */
2080
2081 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2082 canon_ace *allow_ace_p;
2083 canon_ace *allow_everyone_p = NULL;
2084
2085 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2086
2087 if (curr_ace->attr != DENY_ACE)
2088 continue;
2089
2090 if (curr_ace->owner_type != GID_ACE)
2091 continue;
2092
2093 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2094
2095 if (allow_ace_p->attr != ALLOW_ACE)
2096 continue;
2097
2098 /* Store a pointer to the Everyone allow, if it exists. */
2099 if (allow_ace_p->owner_type == WORLD_ACE)
2100 allow_everyone_p = allow_ace_p;
2101
2102 /* We process UID_ACE entries only. */
2103
2104 if (allow_ace_p->owner_type != UID_ACE)
2105 continue;
2106
2107 /* Mask off the deny group perms. */
2108
2109 if (uid_entry_in_group( allow_ace_p, curr_ace))
2110 allow_ace_p->perms &= ~curr_ace->perms;
2111 }
2112
2113 /*
2114 * Convert the deny to an allow with the correct perms and
2115 * push to the end of the list.
2116 */
2117
2118 curr_ace->attr = ALLOW_ACE;
2119 if (allow_everyone_p)
2120 curr_ace->perms = allow_everyone_p->perms & ~curr_ace->perms;
2121 else
2122 curr_ace->perms = (mode_t)0;
2123 DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2124 }
2125
2126 /* Doing this fourth pass allows Windows semantics to be layered
2127 * on top of POSIX semantics. I'm not sure if this is desirable.
2128 * For example, in W2K ACLs there is no way to say, "Group X no
2129 * access, user Y full access" if user Y is a member of group X.
2130 * This seems completely broken semantics to me.... JRA.
2131 */
2132
2133 #if 0
2134 /* Pass 4 above - deal with allow entries. */
2135
2136 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2137 canon_ace *allow_ace_p;
2138
2139 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2140
2141 if (curr_ace->attr != ALLOW_ACE)
2142 continue;
2143
2144 if (curr_ace->owner_type != UID_ACE)
2145 continue;
2146
2147 for (allow_ace_p = ace_list; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2148
2149 if (allow_ace_p->attr != ALLOW_ACE)
2150 continue;
2151
2152 /* We process GID_ACE entries only. */
2153
2154 if (allow_ace_p->owner_type != GID_ACE)
2155 continue;
2156
2157 /* OR in the group perms. */
2158
2159 if (uid_entry_in_group( curr_ace, allow_ace_p))
2160 curr_ace->perms |= allow_ace_p->perms;
2161 }
2162 }
2163 #endif
2164
2165 *pp_ace_list = ace_list;
2166 }
2167
2168 /****************************************************************************
2169 Create a default mode that will be used if a security descriptor entry has
2170 no user/group/world entries.
2171 ****************************************************************************/
2172
2173 static mode_t create_default_mode(files_struct *fsp, bool interitable_mode)
2174 {
2175 int snum = SNUM(fsp->conn);
2176 mode_t and_bits = (mode_t)0;
2177 mode_t or_bits = (mode_t)0;
2178 mode_t mode;
2179
2180 if (interitable_mode) {
2181 mode = unix_mode(fsp->conn, FILE_ATTRIBUTE_ARCHIVE,
2182 fsp->fsp_name, NULL);
2183 } else {
2184 mode = S_IRUSR;
2185 }
2186
2187 if (fsp->is_directory)
2188 mode |= (S_IWUSR|S_IXUSR);
2189
2190 /*
2191 * Now AND with the create mode/directory mode bits then OR with the
2192 * force create mode/force directory mode bits.
2193 */
2194
2195 if (fsp->is_directory) {
2196 and_bits = lp_dir_security_mask(snum);
2197 or_bits = lp_force_dir_security_mode(snum);
2198 } else {
2199 and_bits = lp_security_mask(snum);
2200 or_bits = lp_force_security_mode(snum);
2201 }
2202
2203 return ((mode & and_bits)|or_bits);
2204 }
2205
2206 /****************************************************************************
2207 Unpack a SEC_DESC into two canonical ace lists. We don't depend on this
2208 succeeding.
2209 ****************************************************************************/
2210
2211 static bool unpack_canon_ace(files_struct *fsp,
2212 SMB_STRUCT_STAT *pst,
2213 DOM_SID *pfile_owner_sid,
2214 DOM_SID *pfile_grp_sid,
2215 canon_ace **ppfile_ace,
2216 canon_ace **ppdir_ace,
2217 uint32 security_info_sent,
2218 const SEC_DESC *psd)
2219 {
2220 canon_ace *file_ace = NULL;
2221 canon_ace *dir_ace = NULL;
2222
2223 *ppfile_ace = NULL;
2224 *ppdir_ace = NULL;
2225
2226 if(security_info_sent == 0) {
2227 DEBUG(0,("unpack_canon_ace: no security info sent !\n"));
2228 return False;
2229 }
2230
2231 /*
2232 * If no DACL then this is a chown only security descriptor.
2233 */
2234
2235 if(!(security_info_sent & DACL_SECURITY_INFORMATION) || !psd->dacl)
2236 return True;
2237
2238 /*
2239 * Now go through the DACL and create the canon_ace lists.
2240 */
2241
2242 if (!create_canon_ace_lists( fsp, pst, pfile_owner_sid, pfile_grp_sid,
2243 &file_ace, &dir_ace, psd->dacl))
2244 return False;
2245
2246 if ((file_ace == NULL) && (dir_ace == NULL)) {
2247 /* W2K traverse DACL set - ignore. */
2248 return True;
2249 }
2250
2251 /*
2252 * Go through the canon_ace list and merge entries
2253 * belonging to identical users of identical allow or deny type.
2254 * We can do this as all deny entries come first, followed by
2255 * all allow entries (we have mandated this before accepting this acl).
2256 */
2257
2258 print_canon_ace_list( "file ace - before merge", file_ace);
2259 merge_aces( &file_ace );
2260
2261 print_canon_ace_list( "dir ace - before merge", dir_ace);
2262 merge_aces( &dir_ace );
2263
2264 /*
2265 * NT ACLs are order dependent. Go through the acl lists and
2266 * process DENY entries by masking the allow entries.
2267 */
2268
2269 print_canon_ace_list( "file ace - before deny", file_ace);
2270 process_deny_list( &file_ace);
2271
2272 print_canon_ace_list( "dir ace - before deny", dir_ace);
2273 process_deny_list( &dir_ace);
2274
2275 /*
2276 * A well formed POSIX file or default ACL has at least 3 entries, a
2277 * SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ
2278 * and optionally a mask entry. Ensure this is the case.
2279 */
2280
2281 print_canon_ace_list( "file ace - before valid", file_ace);
2282
2283 /*
2284 * A default 3 element mode entry for a file should be r-- --- ---.
2285 * A default 3 element mode entry for a directory should be rwx --- ---.
2286 */
2287
2288 pst->st_ex_mode = create_default_mode(fsp, False);
2289
2290 if (!ensure_canon_entry_valid(&file_ace, fsp->conn->params, fsp->is_directory, pfile_owner_sid, pfile_grp_sid, pst, True)) {
2291 free_canon_ace_list(file_ace);
2292 free_canon_ace_list(dir_ace);
2293 return False;
2294 }
2295
2296 print_canon_ace_list( "dir ace - before valid", dir_ace);
2297
2298 /*
2299 * A default inheritable 3 element mode entry for a directory should be the
2300 * mode Samba will use to create a file within. Ensure user rwx bits are set if
2301 * it's a directory.
2302 */
2303
2304 pst->st_ex_mode = create_default_mode(fsp, True);
2305
2306 if (dir_ace && !ensure_canon_entry_valid(&dir_ace, fsp->conn->params, fsp->is_directory, pfile_owner_sid, pfile_grp_sid, pst, True)) {
2307 free_canon_ace_list(file_ace);
2308 free_canon_ace_list(dir_ace);
2309 return False;
2310 }
2311
2312 print_canon_ace_list( "file ace - return", file_ace);
2313 print_canon_ace_list( "dir ace - return", dir_ace);
2314
2315 *ppfile_ace = file_ace;
2316 *ppdir_ace = dir_ace;
2317 return True;
2318
2319 }
2320
2321 /******************************************************************************
2322 When returning permissions, try and fit NT display
2323 semantics if possible. Note the the canon_entries here must have been malloced.
2324 The list format should be - first entry = owner, followed by group and other user
2325 entries, last entry = other.
2326
2327 Note that this doesn't exactly match the NT semantics for an ACL. As POSIX entries
2328 are not ordered, and match on the most specific entry rather than walking a list,
2329 then a simple POSIX permission of rw-r--r-- should really map to 5 entries,
2330
2331 Entry 0: owner : deny all except read and write.
2332 Entry 1: owner : allow read and write.
2333 Entry 2: group : deny all except read.
2334 Entry 3: group : allow read.
2335 Entry 4: Everyone : allow read.
2336
2337 But NT cannot display this in their ACL editor !
2338 ********************************************************************************/
2339
2340 static void arrange_posix_perms(const char *filename, canon_ace **pp_list_head)
2341 {
2342 canon_ace *l_head = *pp_list_head;
2343 canon_ace *owner_ace = NULL;
2344 canon_ace *other_ace = NULL;
2345 canon_ace *ace = NULL;
2346
2347 for (ace = l_head; ace; ace = ace->next) {
2348 if (ace->type == SMB_ACL_USER_OBJ)
2349 owner_ace = ace;
2350 else if (ace->type == SMB_ACL_OTHER) {
2351 /* Last ace - this is "other" */
2352 other_ace = ace;
2353 }
2354 }
2355
2356 if (!owner_ace || !other_ace) {
2357 DEBUG(0,("arrange_posix_perms: Invalid POSIX permissions for file %s, missing owner or other.\n",
2358 filename ));
2359 return;
2360 }
2361
2362 /*
2363 * The POSIX algorithm applies to owner first, and other last,
2364 * so ensure they are arranged in this order.
2365 */
2366
2367 if (owner_ace) {
2368 DLIST_PROMOTE(l_head, owner_ace);
2369 }
2370
2371 if (other_ace) {
2372 DLIST_DEMOTE(l_head, other_ace, canon_ace *);
2373 }
2374
2375 /* We have probably changed the head of the list. */
2376
2377 *pp_list_head = l_head;
2378 }
2379
2380 /****************************************************************************
2381 Create a linked list of canonical ACE entries.
2382 ****************************************************************************/
2383
2384 static canon_ace *canonicalise_acl(struct connection_struct *conn,
2385 const char *fname, SMB_ACL_T posix_acl,
2386 const SMB_STRUCT_STAT *psbuf,
2387 const DOM_SID *powner, const DOM_SID *pgroup, struct pai_val *pal, SMB_ACL_TYPE_T the_acl_type)
2388 {
2389 mode_t acl_mask = (S_IRUSR|S_IWUSR|S_IXUSR);
2390 canon_ace *l_head = NULL;
2391 canon_ace *ace = NULL;
2392 canon_ace *next_ace = NULL;
2393 int entry_id = SMB_ACL_FIRST_ENTRY;
2394 SMB_ACL_ENTRY_T entry;
2395 size_t ace_count;
2396
2397 while ( posix_acl && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1)) {
2398 SMB_ACL_TAG_T tagtype;
2399 SMB_ACL_PERMSET_T permset;
2400 DOM_SID sid;
2401 posix_id unix_ug;
2402 enum ace_owner owner_type;
2403
2404 entry_id = SMB_ACL_NEXT_ENTRY;
2405
2406 /* Is this a MASK entry ? */
2407 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1)
2408 continue;
2409
2410 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1)
2411 continue;
2412
2413 /* Decide which SID to use based on the ACL type. */
2414 switch(tagtype) {
2415 case SMB_ACL_USER_OBJ:
2416 /* Get the SID from the owner. */
2417 sid_copy(&sid, powner);
2418 unix_ug.uid = psbuf->st_ex_uid;
2419 owner_type = UID_ACE;
2420 break;
2421 case SMB_ACL_USER:
2422 {
2423 uid_t *puid = (uid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
2424 if (puid == NULL) {
2425 DEBUG(0,("canonicalise_acl: Failed to get uid.\n"));
2426 continue;
2427 }
2428 /*
2429 * A SMB_ACL_USER entry for the owner is shadowed by the
2430 * SMB_ACL_USER_OBJ entry and Windows also cannot represent
2431 * that entry, so we ignore it. We also don't create such
2432 * entries out of the blue when setting ACLs, so a get/set
2433 * cycle will drop them.
2434 */
2435 if (the_acl_type == SMB_ACL_TYPE_ACCESS && *puid == psbuf->st_ex_uid) {
2436 SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)puid,tagtype);
2437 continue;
2438 }
2439 uid_to_sid( &sid, *puid);
2440 unix_ug.uid = *puid;
2441 owner_type = UID_ACE;
2442 SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)puid,tagtype);
2443 break;
2444 }
2445 case SMB_ACL_GROUP_OBJ:
2446 /* Get the SID from the owning group. */
2447 sid_copy(&sid, pgroup);
2448 unix_ug.gid = psbuf->st_ex_gid;
2449 owner_type = GID_ACE;
2450 break;
2451 case SMB_ACL_GROUP:
2452 {
2453 gid_t *pgid = (gid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
2454 if (pgid == NULL) {
2455 DEBUG(0,("canonicalise_acl: Failed to get gid.\n"));
2456 continue;
2457 }
2458 gid_to_sid( &sid, *pgid);
2459 unix_ug.gid = *pgid;
2460 owner_type = GID_ACE;
2461 SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)pgid,tagtype);
2462 break;
2463 }
2464 case SMB_ACL_MASK:
2465 acl_mask = convert_permset_to_mode_t(conn, permset);
2466 continue; /* Don't count the mask as an entry. */
2467 case SMB_ACL_OTHER:
2468 /* Use the Everyone SID */
2469 sid = global_sid_World;
2470 unix_ug.world = -1;
2471 owner_type = WORLD_ACE;
2472 break;
2473 default:
2474 DEBUG(0,("canonicalise_acl: Unknown tagtype %u\n", (unsigned int)tagtype));
2475 continue;
2476 }
2477
2478 /*
2479 * Add this entry to the list.
2480 */
2481
2482 if ((ace = SMB_MALLOC_P(canon_ace)) == NULL)
2483 goto fail;
2484
2485 ZERO_STRUCTP(ace);
2486 ace->type = tagtype;
2487 ace->perms = convert_permset_to_mode_t(conn, permset);
2488 ace->attr = ALLOW_ACE;
2489 ace->trustee = sid;
2490 ace->unix_ug = unix_ug;
2491 ace->owner_type = owner_type;
2492 ace->ace_flags = get_pai_flags(pal, ace, (the_acl_type == SMB_ACL_TYPE_DEFAULT));
2493
2494 DLIST_ADD(l_head, ace);
2495 }
2496
2497 /*
2498 * This next call will ensure we have at least a user/group/world set.
2499 */
2500
2501 if (!ensure_canon_entry_valid(&l_head, conn->params,
2502 S_ISDIR(psbuf->st_ex_mode), powner, pgroup,
2503 psbuf, False))
2504 goto fail;
2505
2506 /*
2507 * Now go through the list, masking the permissions with the
2508 * acl_mask. Ensure all DENY Entries are at the start of the list.
2509 */
2510
2511 DEBUG(10,("canonicalise_acl: %s ace entries before arrange :\n", the_acl_type == SMB_ACL_TYPE_ACCESS ? "Access" : "Default" ));
2512
2513 for ( ace_count = 0, ace = l_head; ace; ace = next_ace, ace_count++) {
2514 next_ace = ace->next;
2515
2516 /* Masks are only applied to entries other than USER_OBJ and OTHER. */
2517 if (ace->type != SMB_ACL_OTHER && ace->type != SMB_ACL_USER_OBJ)
2518 ace->perms &= acl_mask;
2519
2520 if (ace->perms == 0) {
2521 DLIST_PROMOTE(l_head, ace);
2522 }
2523
2524 if( DEBUGLVL( 10 ) ) {
2525 print_canon_ace(ace, ace_count);
2526 }
2527 }
2528
2529 arrange_posix_perms(fname,&l_head );
2530
2531 print_canon_ace_list( "canonicalise_acl: ace entries after arrange", l_head );
2532
2533 return l_head;
2534
2535 fail:
2536
2537 free_canon_ace_list(l_head);
2538 return NULL;
2539 }
2540
2541 /****************************************************************************
2542 Check if the current user group list contains a given group.
2543 ****************************************************************************/
2544
2545 static bool current_user_in_group(gid_t gid)
2546 {
2547 int i;
2548
2549 for (i = 0; i < current_user.ut.ngroups; i++) {
2550 if (current_user.ut.groups[i] == gid) {
2551 return True;
2552 }
2553 }
2554
2555 return False;
2556 }
2557
2558 /****************************************************************************
2559 Should we override a deny ? Check 'acl group control' and 'dos filemode'.
2560 ****************************************************************************/
2561
2562 static bool acl_group_override(connection_struct *conn,
2563 const struct smb_filename *smb_fname)
2564 {
2565 if ((errno != EPERM) && (errno != EACCES)) {
2566 return false;
2567 }
2568
2569 /* file primary group == user primary or supplementary group */
2570 if (lp_acl_group_control(SNUM(conn)) &&
2571 current_user_in_group(smb_fname->st.st_ex_gid)) {
2572 return true;
2573 }
2574
2575 /* user has writeable permission */
2576 if (lp_dos_filemode(SNUM(conn)) &&
2577 can_write_to_file(conn, smb_fname)) {
2578 return true;
2579 }
2580
2581 return false;
2582 }
2583
2584 /****************************************************************************
2585 Attempt to apply an ACL to a file or directory.
2586 ****************************************************************************/
2587
2588 static bool set_canon_ace_list(files_struct *fsp,
2589 canon_ace *the_ace,
2590 bool default_ace,
2591 const SMB_STRUCT_STAT *psbuf,
2592 bool *pacl_set_support)
2593 {
2594 connection_struct *conn = fsp->conn;
2595 bool ret = False;
2596 SMB_ACL_T the_acl = SMB_VFS_SYS_ACL_INIT(conn, (int)count_canon_ace_list(the_ace) + 1);
2597 canon_ace *p_ace;
2598 int i;
2599 SMB_ACL_ENTRY_T mask_entry;
2600 bool got_mask_entry = False;
2601 SMB_ACL_PERMSET_T mask_permset;
2602 SMB_ACL_TYPE_T the_acl_type = (default_ace ? SMB_ACL_TYPE_DEFAULT : SMB_ACL_TYPE_ACCESS);
2603 bool needs_mask = False;
2604 mode_t mask_perms = 0;
2605
2606 /* Use the psbuf that was passed in. */
2607 fsp->fsp_name->st = *psbuf;
2608
2609 #if defined(POSIX_ACL_NEEDS_MASK)
2610 /* HP-UX always wants to have a mask (called "class" there). */
2611 needs_mask = True;
2612 #endif
2613
2614 if (the_acl == NULL) {
2615
2616 if (!no_acl_syscall_error(errno)) {
2617 /*
2618 * Only print this error message if we have some kind of ACL
2619 * support that's not working. Otherwise we would always get this.
2620 */
2621 DEBUG(0,("set_canon_ace_list: Unable to init %s ACL. (%s)\n",
2622 default_ace ? "default" : "file", strerror(errno) ));
2623 }
2624 *pacl_set_support = False;
2625 goto fail;
2626 }
2627
2628 if( DEBUGLVL( 10 )) {
2629 dbgtext("set_canon_ace_list: setting ACL:\n");
2630 for (i = 0, p_ace = the_ace; p_ace; p_ace = p_ace->next, i++ ) {
2631 print_canon_ace( p_ace, i);
2632 }
2633 }
2634
2635 for (i = 0, p_ace = the_ace; p_ace; p_ace = p_ace->next, i++ ) {
2636 SMB_ACL_ENTRY_T the_entry;
2637 SMB_ACL_PERMSET_T the_permset;
2638
2639 /*
2640 * ACLs only "need" an ACL_MASK entry if there are any named user or
2641 * named group entries. But if there is an ACL_MASK entry, it applies
2642 * to ACL_USER, ACL_GROUP, and ACL_GROUP_OBJ entries. Set the mask
2643 * so that it doesn't deny (i.e., mask off) any permissions.
2644 */
2645
2646 if (p_ace->type == SMB_ACL_USER || p_ace->type == SMB_ACL_GROUP) {
2647 needs_mask = True;
2648 mask_perms |= p_ace->perms;
2649 } else if (p_ace->type == SMB_ACL_GROUP_OBJ) {
2650 mask_perms |= p_ace->perms;
2651 }
2652
2653 /*
2654 * Get the entry for this ACE.
2655 */
2656
2657 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &the_entry) == -1) {
2658 DEBUG(0,("set_canon_ace_list: Failed to create entry %d. (%s)\n",
2659 i, strerror(errno) ));
2660 goto fail;
2661 }
2662
2663 if (p_ace->type == SMB_ACL_MASK) {
2664 mask_entry = the_entry;
2665 got_mask_entry = True;
2666 }
2667
2668 /*
2669 * Ok - we now know the ACL calls should be working, don't
2670 * allow fallback to chmod.
2671 */
2672
2673 *pacl_set_support = True;
2674
2675 /*
2676 * Initialise the entry from the canon_ace.
2677 */
2678
2679 /*
2680 * First tell the entry what type of ACE this is.
2681 */
2682
2683 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, the_entry, p_ace->type) == -1) {
2684 DEBUG(0,("set_canon_ace_list: Failed to set tag type on entry %d. (%s)\n",
2685 i, strerror(errno) ));
2686 goto fail;
2687 }
2688
2689 /*
2690 * Only set the qualifier (user or group id) if the entry is a user
2691 * or group id ACE.
2692 */
2693
2694 if ((p_ace->type == SMB_ACL_USER) || (p_ace->type == SMB_ACL_GROUP)) {
2695 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&p_ace->unix_ug.uid) == -1) {
2696 DEBUG(0,("set_canon_ace_list: Failed to set qualifier on entry %d. (%s)\n",
2697 i, strerror(errno) ));
2698 goto fail;
2699 }
2700 }
2701
2702 /*
2703 * Convert the mode_t perms in the canon_ace to a POSIX permset.
2704 */
2705
2706 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, the_entry, &the_permset) == -1) {
2707 DEBUG(0,("set_canon_ace_list: Failed to get permset on entry %d. (%s)\n",
2708 i, strerror(errno) ));
2709 goto fail;
2710 }
2711
2712 if (map_acl_perms_to_permset(conn, p_ace->perms, &the_permset) == -1) {
2713 DEBUG(0,("set_canon_ace_list: Failed to create permset for mode (%u) on entry %d. (%s)\n",
2714 (unsigned int)p_ace->perms, i, strerror(errno) ));
2715 goto fail;
2716 }
2717
2718 /*
2719 * ..and apply them to the entry.
2720 */
2721
2722 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, the_entry, the_permset) == -1) {
2723 DEBUG(0,("set_canon_ace_list: Failed to add permset on entry %d. (%s)\n",
2724 i, strerror(errno) ));
2725 goto fail;
2726 }
2727
2728 if( DEBUGLVL( 10 ))
2729 print_canon_ace( p_ace, i);
2730
2731 }
2732
2733 if (needs_mask && !got_mask_entry) {
2734 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &mask_entry) == -1) {
2735 DEBUG(0,("set_canon_ace_list: Failed to create mask entry. (%s)\n", strerror(errno) ));
2736 goto fail;
2737 }
2738
2739 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, mask_entry, SMB_ACL_MASK) == -1) {
2740 DEBUG(0,("set_canon_ace_list: Failed to set tag type on mask entry. (%s)\n",strerror(errno) ));
2741 goto fail;
2742 }
2743
2744 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, mask_entry, &mask_permset) == -1) {
2745 DEBUG(0,("set_canon_ace_list: Failed to get mask permset. (%s)\n", strerror(errno) ));
2746 goto fail;
2747 }
2748
2749 if (map_acl_perms_to_permset(conn, S_IRUSR|S_IWUSR|S_IXUSR, &mask_permset) == -1) {
2750 DEBUG(0,("set_canon_ace_list: Failed to create mask permset. (%s)\n", strerror(errno) ));
2751 goto fail;
2752 }
2753
2754 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, mask_entry, mask_permset) == -1) {
2755 DEBUG(0,("set_canon_ace_list: Failed to add mask permset. (%s)\n", strerror(errno) ));
2756 goto fail;
2757 }
2758 }
2759
2760 /*
2761 * Finally apply it to the file or directory.
2762 */
2763
2764 if(default_ace || fsp->is_directory || fsp->fh->fd == -1) {
2765 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fsp->fsp_name->base_name,
2766 the_acl_type, the_acl) == -1) {
2767 /*
2768 * Some systems allow all the above calls and only fail with no ACL support
2769 * when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
2770 */
2771 if (no_acl_syscall_error(errno)) {
2772 *pacl_set_support = False;
2773 }
2774
2775 if (acl_group_override(conn, fsp->fsp_name)) {
2776 int sret;
2777
2778 DEBUG(5,("set_canon_ace_list: acl group "
2779 "control on and current user in file "
2780 "%s primary group.\n",
2781 fsp_str_dbg(fsp)));
2782
2783 become_root();
2784 sret = SMB_VFS_SYS_ACL_SET_FILE(conn,
2785 fsp->fsp_name->base_name, the_acl_type,
2786 the_acl);
2787 unbecome_root();
2788 if (sret == 0) {
2789 ret = True;
2790 }
2791 }
2792
2793 if (ret == False) {
2794 DEBUG(2,("set_canon_ace_list: "
2795 "sys_acl_set_file type %s failed for "
2796 "file %s (%s).\n",
2797 the_acl_type == SMB_ACL_TYPE_DEFAULT ?
2798 "directory default" : "file",
2799 fsp_str_dbg(fsp), strerror(errno)));
2800 goto fail;
2801 }
2802 }
2803 } else {
2804 if (SMB_VFS_SYS_ACL_SET_FD(fsp, the_acl) == -1) {
2805 /*
2806 * Some systems allow all the above calls and only fail with no ACL support
2807 * when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
2808 */
2809 if (no_acl_syscall_error(errno)) {
2810 *pacl_set_support = False;
2811 }
2812
2813 if (acl_group_override(conn, fsp->fsp_name)) {
2814 int sret;
2815
2816 DEBUG(5,("set_canon_ace_list: acl group "
2817 "control on and current user in file "
2818 "%s primary group.\n",
2819 fsp_str_dbg(fsp)));
2820
2821 become_root();
2822 sret = SMB_VFS_SYS_ACL_SET_FD(fsp, the_acl);
2823 unbecome_root();
2824 if (sret == 0) {
2825 ret = True;
2826 }
2827 }
2828
2829 if (ret == False) {
2830 DEBUG(2,("set_canon_ace_list: "
2831 "sys_acl_set_file failed for file %s "
2832 "(%s).\n",
2833 fsp_str_dbg(fsp), strerror(errno)));
2834 goto fail;
2835 }
2836 }
2837 }
2838
2839 ret = True;
2840
2841 fail:
2842
2843 if (the_acl != NULL) {
2844 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
2845 }
2846
2847 return ret;
2848 }
2849
2850 /****************************************************************************
2851 Find a particular canon_ace entry.
2852 ****************************************************************************/
2853
2854 static struct canon_ace *canon_ace_entry_for(struct canon_ace *list, SMB_ACL_TAG_T type, posix_id *id)
2855 {
2856 while (list) {
2857 if (list->type == type && ((type != SMB_ACL_USER && type != SMB_ACL_GROUP) ||
2858 (type == SMB_ACL_USER && id && id->uid == list->unix_ug.uid) ||
2859 (type == SMB_ACL_GROUP && id && id->gid == list->unix_ug.gid)))
2860 break;
2861 list = list->next;
2862 }
2863 return list;
2864 }
2865
2866 /****************************************************************************
2867
2868 ****************************************************************************/
2869
2870 SMB_ACL_T free_empty_sys_acl(connection_struct *conn, SMB_ACL_T the_acl)
2871 {
2872 SMB_ACL_ENTRY_T entry;
2873
2874 if (!the_acl)
2875 return NULL;
2876 if (SMB_VFS_SYS_ACL_GET_ENTRY(conn, the_acl, SMB_ACL_FIRST_ENTRY, &entry) != 1) {
2877 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
2878 return NULL;
2879 }
2880 return the_acl;
2881 }
2882
2883 /****************************************************************************
2884 Convert a canon_ace to a generic 3 element permission - if possible.
2885 ****************************************************************************/
2886
2887 #define MAP_PERM(p,mask,result) (((p) & (mask)) ? (result) : 0 )
2888
2889 static bool convert_canon_ace_to_posix_perms( files_struct *fsp, canon_ace *file_ace_list, mode_t *posix_perms)
2890 {
2891 int snum = SNUM(fsp->conn);
2892 size_t ace_count = count_canon_ace_list(file_ace_list);
2893 canon_ace *ace_p;
2894 canon_ace *owner_ace = NULL;
2895 canon_ace *group_ace = NULL;
2896 canon_ace *other_ace = NULL;
2897 mode_t and_bits;
2898 mode_t or_bits;
2899
2900 if (ace_count != 3) {
2901 DEBUG(3,("convert_canon_ace_to_posix_perms: Too many ACE "
2902 "entries for file %s to convert to posix perms.\n",
2903 fsp_str_dbg(fsp)));
2904 return False;
2905 }
2906
2907 for (ace_p = file_ace_list; ace_p; ace_p = ace_p->next) {
2908 if (ace_p->owner_type == UID_ACE)
2909 owner_ace = ace_p;
2910 else if (ace_p->owner_type == GID_ACE)
2911 group_ace = ace_p;
2912 else if (ace_p->owner_type == WORLD_ACE)
2913 other_ace = ace_p;
2914 }
2915
2916 if (!owner_ace || !group_ace || !other_ace) {
2917 DEBUG(3,("convert_canon_ace_to_posix_perms: Can't get "
2918 "standard entries for file %s.\n", fsp_str_dbg(fsp)));
2919 return False;
2920 }
2921
2922 *posix_perms = (mode_t)0;
2923
2924 *posix_perms |= owner_ace->perms;
2925 *posix_perms |= MAP_PERM(group_ace->perms, S_IRUSR, S_IRGRP);
2926 *posix_perms |= MAP_PERM(group_ace->perms, S_IWUSR, S_IWGRP);
2927 *posix_perms |= MAP_PERM(group_ace->perms, S_IXUSR, S_IXGRP);
2928 *posix_perms |= MAP_PERM(other_ace->perms, S_IRUSR, S_IROTH);
2929 *posix_perms |= MAP_PERM(other_ace->perms, S_IWUSR, S_IWOTH);
2930 *posix_perms |= MAP_PERM(other_ace->perms, S_IXUSR, S_IXOTH);
2931
2932 /* The owner must have at least read access. */
2933
2934 *posix_perms |= S_IRUSR;
2935 if (fsp->is_directory)
2936 *posix_perms |= (S_IWUSR|S_IXUSR);
2937
2938 /* If requested apply the masks. */
2939
2940 /* Get the initial bits to apply. */
2941
2942 if (fsp->is_directory) {
2943 and_bits = lp_dir_security_mask(snum);
2944 or_bits = lp_force_dir_security_mode(snum);
2945 } else {
2946 and_bits = lp_security_mask(snum);
2947 or_bits = lp_force_security_mode(snum);
2948 }
2949
2950 *posix_perms = (((*posix_perms) & and_bits)|or_bits);
2951
2952 DEBUG(10,("convert_canon_ace_to_posix_perms: converted u=%o,g=%o,w=%o "
2953 "to perm=0%o for file %s.\n", (int)owner_ace->perms,
2954 (int)group_ace->perms, (int)other_ace->perms,
2955 (int)*posix_perms, fsp_str_dbg(fsp)));
2956
2957 return True;
2958 }
2959
2960 /****************************************************************************
2961 Incoming NT ACLs on a directory can be split into a default POSIX acl (CI|OI|IO) and
2962 a normal POSIX acl. Win2k needs these split acls re-merging into one ACL
2963 with CI|OI set so it is inherited and also applies to the directory.
2964 Based on code from "Jim McDonough" <jmcd@us.ibm.com>.
2965 ****************************************************************************/
2966
2967 static size_t merge_default_aces( SEC_ACE *nt_ace_list, size_t num_aces)
2968 {
2969 size_t i, j;
2970
2971 for (i = 0; i < num_aces; i++) {
2972 for (j = i+1; j < num_aces; j++) {
2973 uint32 i_flags_ni = (nt_ace_list[i].flags & ~SEC_ACE_FLAG_INHERITED_ACE);
2974 uint32 j_flags_ni = (nt_ace_list[j].flags & ~SEC_ACE_FLAG_INHERITED_ACE);
2975 bool i_inh = (nt_ace_list[i].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False;
2976 bool j_inh = (nt_ace_list[j].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False;
2977
2978 /* We know the lower number ACE's are file entries. */
2979 if ((nt_ace_list[i].type == nt_ace_list[j].type) &&
2980 (nt_ace_list[i].size == nt_ace_list[j].size) &&
2981 (nt_ace_list[i].access_mask == nt_ace_list[j].access_mask) &&
2982 sid_equal(&nt_ace_list[i].trustee, &nt_ace_list[j].trustee) &&
2983 (i_inh == j_inh) &&
2984 (i_flags_ni == 0) &&
2985 (j_flags_ni == (SEC_ACE_FLAG_OBJECT_INHERIT|
2986 SEC_ACE_FLAG_CONTAINER_INHERIT|
2987 SEC_ACE_FLAG_INHERIT_ONLY))) {
2988 /*
2989 * W2K wants to have access allowed zero access ACE's
2990 * at the end of the list. If the mask is zero, merge
2991 * the non-inherited ACE onto the inherited ACE.
2992 */
2993
2994 if (nt_ace_list[i].access_mask == 0) {
2995 nt_ace_list[j].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
2996 (i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0);
2997 if (num_aces - i - 1 > 0)
2998 memmove(&nt_ace_list[i], &nt_ace_list[i+1], (num_aces-i-1) *
2999 sizeof(SEC_ACE));
3000
3001 DEBUG(10,("merge_default_aces: Merging zero access ACE %u onto ACE %u.\n",
3002 (unsigned int)i, (unsigned int)j ));
3003 } else {
3004 /*
3005 * These are identical except for the flags.
3006 * Merge the inherited ACE onto the non-inherited ACE.
3007 */
3008
3009 nt_ace_list[i].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
3010 (i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0);
3011 if (num_aces - j - 1 > 0)
3012 memmove(&nt_ace_list[j], &nt_ace_list[j+1], (num_aces-j-1) *
3013 sizeof(SEC_ACE));
3014
3015 DEBUG(10,("merge_default_aces: Merging ACE %u onto ACE %u.\n",
3016 (unsigned int)j, (unsigned int)i ));
3017 }
3018 num_aces--;
3019 break;
3020 }
3021 }
3022 }
3023
3024 return num_aces;
3025 }
3026
3027 /*
3028 * Add or Replace ACE entry.
3029 * In some cases we need to add a specific ACE for compatibility reasons.
3030 * When doing that we must make sure we are not actually creating a duplicate
3031 * entry. So we need to search whether an ACE entry already exist and eventually
3032 * replacce the access mask, or add a completely new entry if none was found.
3033 *
3034 * This function assumes the array has enough space to add a new entry without
3035 * any reallocation of memory.
3036 */
3037
3038 static void add_or_replace_ace(SEC_ACE *nt_ace_list, size_t *num_aces,
3039 const DOM_SID *sid, enum security_ace_type type,
3040 uint32_t mask, uint8_t flags)
3041 {
3042 int i;
3043
3044 /* first search for a duplicate */
3045 for (i = 0; i < *num_aces; i++) {
3046 if (sid_equal(&nt_ace_list[i].trustee, sid) &&
3047 (nt_ace_list[i].flags == flags)) break;
3048 }
3049
3050 if (i < *num_aces) { /* found */
3051 nt_ace_list[i].type = type;
3052 nt_ace_list[i].access_mask = mask;
3053 DEBUG(10, ("Replacing ACE %d with SID %s and flags %02x\n",
3054 i, sid_string_dbg(sid), flags));
3055 return;
3056 }
3057
3058 /* not found, append it */
3059 init_sec_ace(&nt_ace_list[(*num_aces)++], sid, type, mask, flags);
3060 }
3061
3062
3063 /****************************************************************************
3064 Reply to query a security descriptor from an fsp. If it succeeds it allocates
3065 the space for the return elements and returns the size needed to return the
3066 security descriptor. This should be the only external function needed for
3067 the UNIX style get ACL.
3068 ****************************************************************************/
3069
3070 static NTSTATUS posix_get_nt_acl_common(struct connection_struct *conn,
3071 const char *name,
3072 const SMB_STRUCT_STAT *sbuf,
3073 struct pai_val *pal,
3074 SMB_ACL_T posix_acl,
3075 SMB_ACL_T def_acl,
3076 uint32_t security_info,
3077 SEC_DESC **ppdesc)
3078 {
3079 DOM_SID owner_sid;
3080 DOM_SID group_sid;
3081 size_t sd_size = 0;
3082 SEC_ACL *psa = NULL;
3083 size_t num_acls = 0;
3084 size_t num_def_acls = 0;
3085 size_t num_aces = 0;
3086 canon_ace *file_ace = NULL;
3087 canon_ace *dir_ace = NULL;
3088 SEC_ACE *nt_ace_list = NULL;
3089 size_t num_profile_acls = 0;
3090 DOM_SID orig_owner_sid;
3091 SEC_DESC *psd = NULL;
3092 int i;
3093
3094 /*
3095 * Get the owner, group and world SIDs.
3096 */
3097
3098 create_file_sids(sbuf, &owner_sid, &group_sid);
3099
3100 if (lp_profile_acls(SNUM(conn))) {
3101 /* For WXP SP1 the owner must be administrators. */
3102 sid_copy(&orig_owner_sid, &owner_sid);
3103 sid_copy(&owner_sid, &global_sid_Builtin_Administrators);
3104 sid_copy(&group_sid, &global_sid_Builtin_Users);
3105 num_profile_acls = 3;
3106 }
3107
3108 if ((security_info & DACL_SECURITY_INFORMATION) && !(security_info & PROTECTED_DACL_SECURITY_INFORMATION)) {
3109
3110 /*
3111 * In the optimum case Creator Owner and Creator Group would be used for
3112 * the ACL_USER_OBJ and ACL_GROUP_OBJ entries, respectively, but this
3113 * would lead to usability problems under Windows: The Creator entries
3114 * are only available in browse lists of directories and not for files;
3115 * additionally the identity of the owning group couldn't be determined.
3116 * We therefore use those identities only for Default ACLs.
3117 */
3118
3119 /* Create the canon_ace lists. */
3120 file_ace = canonicalise_acl(conn, name, posix_acl, sbuf,
3121 &owner_sid, &group_sid, pal,
3122 SMB_ACL_TYPE_ACCESS);
3123
3124 /* We must have *some* ACLS. */
3125
3126 if (count_canon_ace_list(file_ace) == 0) {
3127 DEBUG(0,("get_nt_acl : No ACLs on file (%s) !\n", name));
3128 goto done;
3129 }
3130
3131 if (S_ISDIR(sbuf->st_ex_mode) && def_acl) {
3132 dir_ace = canonicalise_acl(conn, name, def_acl,
3133 sbuf,
3134 &global_sid_Creator_Owner,
3135 &global_sid_Creator_Group,
3136 pal, SMB_ACL_TYPE_DEFAULT);
3137 }
3138
3139 /*
3140 * Create the NT ACE list from the canonical ace lists.
3141 */
3142
3143 {
3144 canon_ace *ace;
3145 enum security_ace_type nt_acl_type;
3146
3147 if (nt4_compatible_acls() && dir_ace) {
3148 /*
3149 * NT 4 chokes if an ACL contains an INHERIT_ONLY entry
3150 * but no non-INHERIT_ONLY entry for one SID. So we only
3151 * remove entries from the Access ACL if the
3152 * corresponding Default ACL entries have also been
3153 * removed. ACEs for CREATOR-OWNER and CREATOR-GROUP
3154 * are exceptions. We can do nothing
3155 * intelligent if the Default ACL contains entries that
3156 * are not also contained in the Access ACL, so this
3157 * case will still fail under NT 4.
3158 */
3159
3160 ace = canon_ace_entry_for(dir_ace, SMB_ACL_OTHER, NULL);
3161 if (ace && !ace->perms) {
3162 DLIST_REMOVE(dir_ace, ace);
3163 SAFE_FREE(ace);
3164
3165 ace = canon_ace_entry_for(file_ace, SMB_ACL_OTHER, NULL);
3166 if (ace && !ace->perms) {
3167 DLIST_REMOVE(file_ace, ace);
3168 SAFE_FREE(ace);
3169 }
3170 }
3171
3172 /*
3173 * WinNT doesn't usually have Creator Group
3174 * in browse lists, so we send this entry to
3175 * WinNT even if it contains no relevant
3176 * permissions. Once we can add
3177 * Creator Group to browse lists we can
3178 * re-enable this.
3179 */
3180
3181 #if 0
3182 ace = canon_ace_entry_for(dir_ace, SMB_ACL_GROUP_OBJ, NULL);
3183 if (ace && !ace->perms) {
3184 DLIST_REMOVE(dir_ace, ace);
3185 SAFE_FREE(ace);
3186 }
3187 #endif
3188
3189 ace = canon_ace_entry_for(file_ace, SMB_ACL_GROUP_OBJ, NULL);
3190 if (ace && !ace->perms) {
3191 DLIST_REMOVE(file_ace, ace);
3192 SAFE_FREE(ace);
3193 }
3194 }
3195
3196 num_acls = count_canon_ace_list(file_ace);
3197 num_def_acls = count_canon_ace_list(dir_ace);
3198
3199 /* Allocate the ace list. */
3200 if ((nt_ace_list = SMB_MALLOC_ARRAY(SEC_ACE,num_acls + num_profile_acls + num_def_acls)) == NULL) {
3201 DEBUG(0,("get_nt_acl: Unable to malloc space for nt_ace_list.\n"));
3202 goto done;
3203 }
3204
3205 memset(nt_ace_list, '\0', (num_acls + num_def_acls) * sizeof(SEC_ACE) );
3206
3207 /*
3208 * Create the NT ACE list from the canonical ace lists.
3209 */
3210
3211 for (ace = file_ace; ace != NULL; ace = ace->next) {
3212 uint32_t acc = map_canon_ace_perms(SNUM(conn),
3213 &nt_acl_type,
3214 ace->perms,
3215 S_ISDIR(sbuf->st_ex_mode));
3216 init_sec_ace(&nt_ace_list[num_aces++],
3217 &ace->trustee,
3218 nt_acl_type,
3219 acc,
3220 ace->ace_flags);
3221 }
3222
3223 /* The User must have access to a profile share - even
3224 * if we can't map the SID. */
3225 if (lp_profile_acls(SNUM(conn))) {
3226 add_or_replace_ace(nt_ace_list, &num_aces,
3227 &global_sid_Builtin_Users,
3228 SEC_ACE_TYPE_ACCESS_ALLOWED,
3229 FILE_GENERIC_ALL, 0);
3230 }
3231
3232 for (ace = dir_ace; ace != NULL; ace = ace->next) {
3233 uint32_t acc = map_canon_ace_perms(SNUM(conn),
3234 &nt_acl_type,
3235 ace->perms,
3236 S_ISDIR(sbuf->st_ex_mode));
3237 init_sec_ace(&nt_ace_list[num_aces++],
3238 &ace->trustee,
3239 nt_acl_type,
3240 acc,
3241 ace->ace_flags |
3242 SEC_ACE_FLAG_OBJECT_INHERIT|
3243 SEC_ACE_FLAG_CONTAINER_INHERIT|
3244 SEC_ACE_FLAG_INHERIT_ONLY);
3245 }
3246
3247 /* The User must have access to a profile share - even
3248 * if we can't map the SID. */
3249 if (lp_profile_acls(SNUM(conn))) {
3250 add_or_replace_ace(nt_ace_list, &num_aces,
3251 &global_sid_Builtin_Users,
3252 SEC_ACE_TYPE_ACCESS_ALLOWED,
3253 FILE_GENERIC_ALL,
3254 SEC_ACE_FLAG_OBJECT_INHERIT |
3255 SEC_ACE_FLAG_CONTAINER_INHERIT |
3256 SEC_ACE_FLAG_INHERIT_ONLY);
3257 }
3258
3259 /*
3260 * Merge POSIX default ACLs and normal ACLs into one NT ACE.
3261 * Win2K needs this to get the inheritance correct when replacing ACLs
3262 * on a directory tree. Based on work by Jim @ IBM.
3263 */
3264
3265 num_aces = merge_default_aces(nt_ace_list, num_aces);
3266
3267 if (lp_profile_acls(SNUM(conn))) {
3268 for (i = 0; i < num_aces; i++) {
3269 if (sid_equal(&nt_ace_list[i].trustee, &owner_sid)) {
3270 add_or_replace_ace(nt_ace_list, &num_aces,
3271 &orig_owner_sid,
3272 nt_ace_list[i].type,
3273 nt_ace_list[i].access_mask,
3274 nt_ace_list[i].flags);
3275 break;
3276 }
3277 }
3278 }
3279 }
3280
3281 if (num_aces) {
3282 if((psa = make_sec_acl( talloc_tos(), NT4_ACL_REVISION, num_aces, nt_ace_list)) == NULL) {
3283 DEBUG(0,("get_nt_acl: Unable to malloc space for acl.\n"));
3284 goto done;
3285 }
3286 }
3287 } /* security_info & DACL_SECURITY_INFORMATION */
3288
3289 psd = make_standard_sec_desc( talloc_tos(),
3290 (security_info & OWNER_SECURITY_INFORMATION) ? &owner_sid : NULL,
3291 (security_info & GROUP_SECURITY_INFORMATION) ? &group_sid : NULL,
3292 psa,
3293 &sd_size);
3294
3295 if(!psd) {
3296 DEBUG(0,("get_nt_acl: Unable to malloc space for security descriptor.\n"));
3297 sd_size = 0;
3298 goto done;
3299 }
3300
3301 /*
3302 * Windows 2000: The DACL_PROTECTED flag in the security
3303 * descriptor marks the ACL as non-inheriting, i.e., no
3304 * ACEs from higher level directories propagate to this
3305 * ACL. In the POSIX ACL model permissions are only
3306 * inherited at file create time, so ACLs never contain
3307 * any ACEs that are inherited dynamically. The DACL_PROTECTED
3308 * flag doesn't seem to bother Windows NT.
3309 * Always set this if map acl inherit is turned off.
3310 */
3311 if (pal == NULL || !lp_map_acl_inherit(SNUM(conn))) {
3312 psd->type |= SEC_DESC_DACL_PROTECTED;
3313 } else {
3314 psd->type |= pal->sd_type;
3315 }
3316
3317 if (psd->dacl) {
3318 dacl_sort_into_canonical_order(psd->dacl->aces, (unsigned int)psd->dacl->num_aces);
3319 }
3320
3321 *ppdesc = psd;
3322
3323 done:
3324
3325 if (posix_acl) {
3326 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
3327 }
3328 if (def_acl) {
3329 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
3330 }
3331 free_canon_ace_list(file_ace);
3332 free_canon_ace_list(dir_ace);
3333 free_inherited_info(pal);
3334 SAFE_FREE(nt_ace_list);
3335
3336 return NT_STATUS_OK;
3337 }
3338
3339 NTSTATUS posix_fget_nt_acl(struct files_struct *fsp, uint32_t security_info,
3340 SEC_DESC **ppdesc)
3341 {
3342 SMB_STRUCT_STAT sbuf;
3343 SMB_ACL_T posix_acl = NULL;
3344 struct pai_val *pal;
3345
3346 *ppdesc = NULL;
3347
3348 DEBUG(10,("posix_fget_nt_acl: called for file %s\n",
3349 fsp_str_dbg(fsp)));
3350
3351 /* can it happen that fsp_name == NULL ? */
3352 if (fsp->is_directory || fsp->fh->fd == -1) {
3353 return posix_get_nt_acl(fsp->conn, fsp->fsp_name->base_name,
3354 security_info, ppdesc);
3355 }
3356
3357 /* Get the stat struct for the owner info. */
3358 if(SMB_VFS_FSTAT(fsp, &sbuf) != 0) {
3359 return map_nt_error_from_unix(errno);
3360 }
3361
3362 /* Get the ACL from the fd. */
3363 posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp);
3364
3365 pal = fload_inherited_info(fsp);
3366
3367 return posix_get_nt_acl_common(fsp->conn, fsp->fsp_name->base_name,
3368 &sbuf, pal, posix_acl, NULL,
3369 security_info, ppdesc);
3370 }
3371
3372 NTSTATUS posix_get_nt_acl(struct connection_struct *conn, const char *name,
3373 uint32_t security_info, SEC_DESC **ppdesc)
3374 {
3375 SMB_ACL_T posix_acl = NULL;
3376 SMB_ACL_T def_acl = NULL;
3377 struct pai_val *pal;
3378 struct smb_filename *smb_fname = NULL;
3379 NTSTATUS status;
3380
3381 *ppdesc = NULL;
3382
3383 DEBUG(10,("posix_get_nt_acl: called for file %s\n", name ));
3384
3385 status = create_synthetic_smb_fname(talloc_tos(), name, NULL, NULL,
3386 &smb_fname);
3387 if (!NT_STATUS_IS_OK(status)) {
3388 return status;
3389 }
3390
3391 /* Get the stat struct for the owner info. */
3392 if(SMB_VFS_STAT(conn, smb_fname) != 0) {
3393 status = map_nt_error_from_unix(errno);
3394 goto out;
3395 }
3396
3397 /* Get the ACL from the path. */
3398 posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name, SMB_ACL_TYPE_ACCESS);
3399
3400 /* If it's a directory get the default POSIX ACL. */
3401 if(S_ISDIR(smb_fname->st.st_ex_mode)) {
3402 def_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name, SMB_ACL_TYPE_DEFAULT);
3403 def_acl = free_empty_sys_acl(conn, def_acl);
3404 }
3405
3406 pal = load_inherited_info(conn, name);
3407
3408 status = posix_get_nt_acl_common(conn, name, &smb_fname->st, pal,
3409 posix_acl, def_acl, security_info,
3410 ppdesc);
3411 out:
3412 TALLOC_FREE(smb_fname);
3413 return status;
3414 }
3415
3416 /****************************************************************************
3417 Try to chown a file. We will be able to chown it under the following conditions.
3418
3419 1) If we have root privileges, then it will just work.
3420 2) If we have SeTakeOwnershipPrivilege we can change the user to the current user.
3421 3) If we have SeRestorePrivilege we can change the user to any other user.
3422 4) If we have write permission to the file and dos_filemodes is set
3423 then allow chown to the currently authenticated user.
3424 ****************************************************************************/
3425
3426 int try_chown(connection_struct *conn, struct smb_filename *smb_fname,
3427 uid_t uid, gid_t gid)
3428 {
3429 int ret;
3430 files_struct *fsp;
3431
3432 if(!CAN_WRITE(conn)) {
3433 return -1;
3434 }
3435
3436 /* Case (1). */
3437 /* try the direct way first */
3438 ret = SMB_VFS_CHOWN(conn, smb_fname->base_name, uid, gid);
3439 if (ret == 0)
3440 return 0;
3441
3442 /* Case (2) / (3) */
3443 if (lp_enable_privileges()) {
3444
3445 bool has_take_ownership_priv = user_has_privileges(current_user.nt_user_token,
3446 &se_take_ownership);
3447 bool has_restore_priv = user_has_privileges(current_user.nt_user_token,
3448 &se_restore);
3449
3450 /* Case (2) */
3451 if ( ( has_take_ownership_priv && ( uid == current_user.ut.uid ) ) ||
3452 /* Case (3) */
3453 ( has_restore_priv ) ) {
3454
3455 become_root();
3456 /* Keep the current file gid the same - take ownership doesn't imply group change. */
3457 ret = SMB_VFS_CHOWN(conn, smb_fname->base_name, uid,
3458 (gid_t)-1);
3459 unbecome_root();
3460 return ret;
3461 }
3462 }
3463
3464 /* Case (4). */
3465 if (!lp_dos_filemode(SNUM(conn))) {
3466 errno = EPERM;
3467 return -1;
3468 }
3469
3470 /* only allow chown to the current user. This is more secure,
3471 and also copes with the case where the SID in a take ownership ACL is
3472 a local SID on the users workstation
3473 */
3474 if (uid != current_user.ut.uid) {
3475 errno = EPERM;
3476 return -1;
3477 }
3478
3479 if (SMB_VFS_STAT(conn, smb_fname)) {
3480 return -1;
3481 }
3482
3483 if (!NT_STATUS_IS_OK(open_file_fchmod(NULL, conn, smb_fname, &fsp))) {
3484 return -1;
3485 }
3486
3487 become_root();
3488 /* Keep the current file gid the same. */
3489 ret = SMB_VFS_FCHOWN(fsp, uid, (gid_t)-1);
3490 unbecome_root();
3491
3492 close_file_fchmod(NULL, fsp);
3493
3494 return ret;
3495 }
3496
3497 #if 0
3498 /* Disable this - prevents ACL inheritance from the ACL editor. JRA. */
3499
3500 /****************************************************************************
3501 Take care of parent ACL inheritance.
3502 ****************************************************************************/
3503
3504 NTSTATUS append_parent_acl(files_struct *fsp,
3505 const SEC_DESC *pcsd,
3506 SEC_DESC **pp_new_sd)
3507 {
3508 struct smb_filename *smb_dname = NULL;
3509 SEC_DESC *parent_sd = NULL;
3510 files_struct *parent_fsp = NULL;
3511 TALLOC_CTX *mem_ctx = talloc_tos();
3512 char *parent_name = NULL;
3513 SEC_ACE *new_ace = NULL;
3514 unsigned int num_aces = pcsd->dacl->num_aces;
3515 NTSTATUS status;
3516 int info;
3517 unsigned int i, j;
3518 SEC_DESC *psd = dup_sec_desc(talloc_tos(), pcsd);
3519 bool is_dacl_protected = (pcsd->type & SEC_DESC_DACL_PROTECTED);
3520
3521 if (psd == NULL) {
3522 return NT_STATUS_NO_MEMORY;
3523 }
3524
3525 if (!parent_dirname(mem_ctx, fsp->fsp_name->base_name, &parent_name,
3526 NULL)) {
3527 return NT_STATUS_NO_MEMORY;
3528 }
3529
3530 status = create_synthetic_smb_fname(mem_ctx, parent_name, NULL, NULL,
3531 &smb_dname);
3532 if (!NT_STATUS_IS_OK(status)) {
3533 goto fail;
3534 }
3535
3536 status = SMB_VFS_CREATE_FILE(
3537 fsp->conn, /* conn */
3538 NULL, /* req */
3539 0, /* root_dir_fid */
3540 smb_dname, /* fname */
3541 FILE_READ_ATTRIBUTES, /* access_mask */
3542 FILE_SHARE_NONE, /* share_access */
3543 FILE_OPEN, /* create_disposition*/
3544 FILE_DIRECTORY_FILE, /* create_options */
3545 0, /* file_attributes */
3546 INTERNAL_OPEN_ONLY, /* oplock_request */
3547 0, /* allocation_size */
3548 NULL, /* sd */
3549 NULL, /* ea_list */
3550 &parent_fsp, /* result */
3551 &info); /* pinfo */
3552
3553 if (!NT_STATUS_IS_OK(status)) {
3554 TALLOC_FREE(smb_dname);
3555 return status;
3556 }
3557
3558 status = SMB_VFS_GET_NT_ACL(parent_fsp->conn, smb_dname->base_name,
3559 DACL_SECURITY_INFORMATION, &parent_sd );
3560
3561 close_file(NULL, parent_fsp, NORMAL_CLOSE);
3562 TALLOC_FREE(smb_dname);
3563
3564 if (!NT_STATUS_IS_OK(status)) {
3565 return status;
3566 }
3567
3568 /*
3569 * Make room for potentially all the ACLs from
3570 * the parent. We used to add the ugw triple here,
3571 * as we knew we were dealing with POSIX ACLs.
3572 * We no longer need to do so as we can guarentee
3573 * that a default ACL from the parent directory will
3574 * be well formed for POSIX ACLs if it came from a
3575 * POSIX ACL source, and if we're not writing to a
3576 * POSIX ACL sink then we don't care if it's not well
3577 * formed. JRA.
3578 */
3579
3580 num_aces += parent_sd->dacl->num_aces;
3581
3582 if((new_ace = TALLOC_ZERO_ARRAY(mem_ctx, SEC_ACE,
3583 num_aces)) == NULL) {
3584 return NT_STATUS_NO_MEMORY;
3585 }
3586
3587 /* Start by copying in all the given ACE entries. */
3588 for (i = 0; i < psd->dacl->num_aces; i++) {
3589 sec_ace_copy(&new_ace[i], &psd->dacl->aces[i]);
3590 }
3591
3592 /*
3593 * Note that we're ignoring "inherit permissions" here
3594 * as that really only applies to newly created files. JRA.
3595 */
3596
3597 /* Finally append any inherited ACEs. */
3598 for (j = 0; j < parent_sd->dacl->num_aces; j++) {
3599 SEC_ACE *se = &parent_sd->dacl->aces[j];
3600
3601 if (fsp->is_directory) {
3602 if (!(se->flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
3603 /* Doesn't apply to a directory - ignore. */
3604 DEBUG(10,("append_parent_acl: directory %s "
3605 "ignoring non container "
3606 "inherit flags %u on ACE with sid %s "
3607 "from parent %s\n",
3608 fsp_str_dbg(fsp),
3609 (unsigned int)se->flags,
3610 sid_string_dbg(&se->trustee),
3611 parent_name));
3612 continue;
3613 }
3614 } else {
3615 if (!(se->flags & SEC_ACE_FLAG_OBJECT_INHERIT)) {
3616 /* Doesn't apply to a file - ignore. */
3617 DEBUG(10,("append_parent_acl: file %s "
3618 "ignoring non object "
3619 "inherit flags %u on ACE with sid %s "
3620 "from parent %s\n",
3621 fsp_str_dbg(fsp),
3622 (unsigned int)se->flags,
3623 sid_string_dbg(&se->trustee),
3624 parent_name));
3625 continue;
3626 }
3627 }
3628
3629 if (is_dacl_protected) {
3630 /* If the DACL is protected it means we must
3631 * not overwrite an existing ACE entry with the
3632 * same SID. This is order N^2. Ouch :-(. JRA. */
3633 unsigned int k;
3634 for (k = 0; k < psd->dacl->num_aces; k++) {
3635 if (sid_equal(&psd->dacl->aces[k].trustee,
3636 &se->trustee)) {
3637 break;
3638 }
3639 }
3640 if (k < psd->dacl->num_aces) {
3641 /* SID matched. Ignore. */
3642 DEBUG(10,("append_parent_acl: path %s "
3643 "ignoring ACE with protected sid %s "
3644 "from parent %s\n",
3645 fsp_str_dbg(fsp),
3646 sid_string_dbg(&se->trustee),
3647 parent_name));
3648 continue;
3649 }
3650 }
3651
3652 sec_ace_copy(&new_ace[i], se);
3653 if (se->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
3654 new_ace[i].flags &= ~(SEC_ACE_FLAG_VALID_INHERIT);
3655 }
3656 new_ace[i].flags |= SEC_ACE_FLAG_INHERITED_ACE;
3657
3658 if (fsp->is_directory) {
3659 /*
3660 * Strip off any inherit only. It's applied.
3661 */
3662 new_ace[i].flags &= ~(SEC_ACE_FLAG_INHERIT_ONLY);
3663 if (se->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
3664 /* No further inheritance. */
3665 new_ace[i].flags &=
3666 ~(SEC_ACE_FLAG_CONTAINER_INHERIT|
3667 SEC_ACE_FLAG_OBJECT_INHERIT);
3668 }
3669 } else {
3670 /*
3671 * Strip off any container or inherit
3672 * flags, they can't apply to objects.
3673 */
3674 new_ace[i].flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|
3675 SEC_ACE_FLAG_INHERIT_ONLY|
3676 SEC_ACE_FLAG_NO_PROPAGATE_INHERIT);
3677 }
3678 i++;
3679
3680 DEBUG(10,("append_parent_acl: path %s "
3681 "inheriting ACE with sid %s "
3682 "from parent %s\n",
3683 fsp_str_dbg(fsp),
3684 sid_string_dbg(&se->trustee),
3685 parent_name));
3686 }
3687
3688 psd->dacl->aces = new_ace;
3689 psd->dacl->num_aces = i;
3690 psd->type &= ~(SE_DESC_DACL_AUTO_INHERITED|
3691 SE_DESC_DACL_AUTO_INHERIT_REQ);
3692
3693 *pp_new_sd = psd;
3694 return status;
3695 }
3696 #endif
3697
3698 /****************************************************************************
3699 Reply to set a security descriptor on an fsp. security_info_sent is the
3700 description of the following NT ACL.
3701 This should be the only external function needed for the UNIX style set ACL.
3702 ****************************************************************************/
3703
3704 NTSTATUS set_nt_acl(files_struct *fsp, uint32 security_info_sent, const SEC_DESC *psd)
3705 {
3706 connection_struct *conn = fsp->conn;
3707 uid_t user = (uid_t)-1;
3708 gid_t grp = (gid_t)-1;
3709 DOM_SID file_owner_sid;
3710 DOM_SID file_grp_sid;
3711 canon_ace *file_ace_list = NULL;
3712 canon_ace *dir_ace_list = NULL;
3713 bool acl_perms = False;
3714 mode_t orig_mode = (mode_t)0;
3715 NTSTATUS status;
3716 bool set_acl_as_root = false;
3717 bool acl_set_support = false;
3718 bool ret = false;
3719
3720 DEBUG(10,("set_nt_acl: called for file %s\n",
3721 fsp_str_dbg(fsp)));
3722
3723 if (!CAN_WRITE(conn)) {
3724 DEBUG(10,("set acl rejected on read-only share\n"));
3725 return NT_STATUS_MEDIA_WRITE_PROTECTED;
3726 }
3727
3728 /*
3729 * Get the current state of the file.
3730 */
3731
3732 if(fsp->is_directory || fsp->fh->fd == -1) {
3733 if(SMB_VFS_STAT(fsp->conn, fsp->fsp_name) != 0) {
3734 return map_nt_error_from_unix(errno);
3735 }
3736 } else {
3737 if(SMB_VFS_FSTAT(fsp, &fsp->fsp_name->st) != 0) {
3738 return map_nt_error_from_unix(errno);
3739 }
3740 }
3741
3742 /* Save the original element we check against. */
3743 orig_mode = fsp->fsp_name->st.st_ex_mode;
3744
3745 /*
3746 * Unpack the user/group/world id's.
3747 */
3748
3749 status = unpack_nt_owners( SNUM(conn), &user, &grp, security_info_sent, psd);
3750 if (!NT_STATUS_IS_OK(status)) {
3751 return status;
3752 }
3753
3754 /*
3755 * Do we need to chown ? If so this must be done first as the incoming
3756 * CREATOR_OWNER acl will be relative to the *new* owner, not the old.
3757 * Noticed by Simo.
3758 */
3759
3760 if (((user != (uid_t)-1) && (fsp->fsp_name->st.st_ex_uid != user)) ||
3761 (( grp != (gid_t)-1) && (fsp->fsp_name->st.st_ex_gid != grp))) {
3762
3763 DEBUG(3,("set_nt_acl: chown %s. uid = %u, gid = %u.\n",
3764 fsp_str_dbg(fsp), (unsigned int)user,
3765 (unsigned int)grp));
3766
3767 if(try_chown(fsp->conn, fsp->fsp_name, user, grp) == -1) {
3768 DEBUG(3,("set_nt_acl: chown %s, %u, %u failed. Error "
3769 "= %s.\n", fsp_str_dbg(fsp),
3770 (unsigned int)user, (unsigned int)grp,
3771 strerror(errno)));
3772 if (errno == EPERM) {
3773 return NT_STATUS_INVALID_OWNER;
3774 }
3775 return map_nt_error_from_unix(errno);
3776 }
3777
3778 /*
3779 * Recheck the current state of the file, which may have changed.
3780 * (suid/sgid bits, for instance)
3781 */
3782
3783 if(fsp->is_directory) {
3784 if(SMB_VFS_STAT(fsp->conn, fsp->fsp_name) != 0) {
3785 return map_nt_error_from_unix(errno);
3786 }
3787 } else {
3788
3789 int sret;
3790
3791 if(fsp->fh->fd == -1)
3792 sret = SMB_VFS_STAT(fsp->conn, fsp->fsp_name);
3793 else
3794 sret = SMB_VFS_FSTAT(fsp, &fsp->fsp_name->st);
3795
3796 if(sret != 0)
3797 return map_nt_error_from_unix(errno);
3798 }
3799
3800 /* Save the original element we check against. */
3801 orig_mode = fsp->fsp_name->st.st_ex_mode;
3802
3803 /* If we successfully chowned, we know we must
3804 * be able to set the acl, so do it as root.
3805 */
3806 set_acl_as_root = true;
3807 }
3808
3809 create_file_sids(&fsp->fsp_name->st, &file_owner_sid, &file_grp_sid);
3810
3811 acl_perms = unpack_canon_ace(fsp, &fsp->fsp_name->st, &file_owner_sid,
3812 &file_grp_sid, &file_ace_list,
3813 &dir_ace_list, security_info_sent, psd);
3814
3815 /* Ignore W2K traverse DACL set. */
3816 if (!file_ace_list && !dir_ace_list) {
3817 return NT_STATUS_OK;
3818 }
3819
3820 if (!acl_perms) {
3821 DEBUG(3,("set_nt_acl: cannot set permissions\n"));
3822 free_canon_ace_list(file_ace_list);
3823 free_canon_ace_list(dir_ace_list);
3824 return NT_STATUS_ACCESS_DENIED;
3825 }
3826
3827 /*
3828 * Only change security if we got a DACL.
3829 */
3830
3831 if(!(security_info_sent & DACL_SECURITY_INFORMATION) || (psd->dacl == NULL)) {
3832 free_canon_ace_list(file_ace_list);
3833 free_canon_ace_list(dir_ace_list);
3834 return NT_STATUS_OK;
3835 }
3836
3837 /*
3838 * Try using the POSIX ACL set first. Fall back to chmod if
3839 * we have no ACL support on this filesystem.
3840 */
3841
3842 if (acl_perms && file_ace_list) {
3843 if (set_acl_as_root) {
3844 become_root();
3845 }
3846 ret = set_canon_ace_list(fsp, file_ace_list, false,
3847 &fsp->fsp_name->st, &acl_set_support);
3848 if (set_acl_as_root) {
3849 unbecome_root();
3850 }
3851 if (acl_set_support && ret == false) {
3852 DEBUG(3,("set_nt_acl: failed to set file acl on file "
3853 "%s (%s).\n", fsp_str_dbg(fsp),
3854 strerror(errno)));
3855 free_canon_ace_list(file_ace_list);
3856 free_canon_ace_list(dir_ace_list);
3857 return map_nt_error_from_unix(errno);
3858 }
3859 }
3860
3861 if (acl_perms && acl_set_support && fsp->is_directory) {
3862 if (dir_ace_list) {
3863 if (set_acl_as_root) {
3864 become_root();
3865 }
3866 ret = set_canon_ace_list(fsp, dir_ace_list, true,
3867 &fsp->fsp_name->st,
3868 &acl_set_support);
3869 if (set_acl_as_root) {
3870 unbecome_root();
3871 }
3872 if (ret == false) {
3873 DEBUG(3,("set_nt_acl: failed to set default "
3874 "acl on directory %s (%s).\n",
3875 fsp_str_dbg(fsp), strerror(errno)));
3876 free_canon_ace_list(file_ace_list);
3877 free_canon_ace_list(dir_ace_list);
3878 return map_nt_error_from_unix(errno);
3879 }
3880 } else {
3881 int sret = -1;
3882
3883 /*
3884 * No default ACL - delete one if it exists.
3885 */
3886
3887 if (set_acl_as_root) {
3888 become_root();
3889 }
3890 sret = SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn,
3891 fsp->fsp_name->base_name);
3892 if (set_acl_as_root) {
3893 unbecome_root();
3894 }
3895 if (sret == -1) {
3896 if (acl_group_override(conn, fsp->fsp_name)) {
3897 DEBUG(5,("set_nt_acl: acl group "
3898 "control on and current user "
3899 "in file %s primary group. "
3900 "Override delete_def_acl\n",
3901 fsp_str_dbg(fsp)));
3902
3903 become_root();
3904 sret =
3905 SMB_VFS_SYS_ACL_DELETE_DEF_FILE(
3906 conn,
3907 fsp->fsp_name->base_name);
3908 unbecome_root();
3909 }
3910
3911 if (sret == -1) {
3912 DEBUG(3,("set_nt_acl: sys_acl_delete_def_file failed (%s)\n", strerror(errno)));
3913 free_canon_ace_list(file_ace_list);
3914 free_canon_ace_list(dir_ace_list);
3915 return map_nt_error_from_unix(errno);
3916 }
3917 }
3918 }
3919 }
3920
3921 if (acl_set_support) {
3922 if (set_acl_as_root) {
3923 become_root();
3924 }
3925 store_inheritance_attributes(fsp,
3926 file_ace_list,
3927 dir_ace_list,
3928 psd->type);
3929 if (set_acl_as_root) {
3930 unbecome_root();
3931 }
3932 }
3933
3934 /*
3935 * If we cannot set using POSIX ACLs we fall back to checking if we need to chmod.
3936 */
3937
3938 if(!acl_set_support && acl_perms) {
3939 mode_t posix_perms;
3940
3941 if (!convert_canon_ace_to_posix_perms( fsp, file_ace_list, &posix_perms)) {
3942 free_canon_ace_list(file_ace_list);
3943 free_canon_ace_list(dir_ace_list);
3944 DEBUG(3,("set_nt_acl: failed to convert file acl to "
3945 "posix permissions for file %s.\n",
3946 fsp_str_dbg(fsp)));
3947 return NT_STATUS_ACCESS_DENIED;
3948 }
3949
3950 if (orig_mode != posix_perms) {
3951 int sret = -1;
3952
3953 DEBUG(3,("set_nt_acl: chmod %s. perms = 0%o.\n",
3954 fsp_str_dbg(fsp), (unsigned int)posix_perms));
3955
3956 if (set_acl_as_root) {
3957 become_root();
3958 }
3959 sret = SMB_VFS_CHMOD(conn, fsp->fsp_name->base_name,
3960 posix_perms);
3961 if (set_acl_as_root) {
3962 unbecome_root();
3963 }
3964 if(sret == -1) {
3965 if (acl_group_override(conn, fsp->fsp_name)) {
3966 DEBUG(5,("set_nt_acl: acl group "
3967 "control on and current user "
3968 "in file %s primary group. "
3969 "Override chmod\n",
3970 fsp_str_dbg(fsp)));
3971
3972 become_root();
3973 sret = SMB_VFS_CHMOD(conn,
3974 fsp->fsp_name->base_name,
3975 posix_perms);
3976 unbecome_root();
3977 }
3978
3979 if (sret == -1) {
3980 DEBUG(3,("set_nt_acl: chmod %s, 0%o "
3981 "failed. Error = %s.\n",
3982 fsp_str_dbg(fsp),
3983 (unsigned int)posix_perms,
3984 strerror(errno)));
3985 free_canon_ace_list(file_ace_list);
3986 free_canon_ace_list(dir_ace_list);
3987 return map_nt_error_from_unix(errno);
3988 }
3989 }
3990 }
3991 }
3992
3993 free_canon_ace_list(file_ace_list);
3994 free_canon_ace_list(dir_ace_list);
3995
3996 return NT_STATUS_OK;
3997 }
3998
3999 /****************************************************************************
4000 Get the actual group bits stored on a file with an ACL. Has no effect if
4001 the file has no ACL. Needed in dosmode code where the stat() will return
4002 the mask bits, not the real group bits, for a file with an ACL.
4003 ****************************************************************************/
4004
4005 int get_acl_group_bits( connection_struct *conn, const char *fname, mode_t *mode )
4006 {
4007 int entry_id = SMB_ACL_FIRST_ENTRY;
4008 SMB_ACL_ENTRY_T entry;
4009 SMB_ACL_T posix_acl;
4010 int result = -1;
4011
4012 posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS);
4013 if (posix_acl == (SMB_ACL_T)NULL)
4014 return -1;
4015
4016 while (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) {
4017 SMB_ACL_TAG_T tagtype;
4018 SMB_ACL_PERMSET_T permset;
4019
4020 entry_id = SMB_ACL_NEXT_ENTRY;
4021
4022 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) ==-1)
4023 break;
4024
4025 if (tagtype == SMB_ACL_GROUP_OBJ) {
4026 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1) {
4027 break;
4028 } else {
4029 *mode &= ~(S_IRGRP|S_IWGRP|S_IXGRP);
4030 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ) ? S_IRGRP : 0);
4031 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE) ? S_IWGRP : 0);
4032 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_EXECUTE) ? S_IXGRP : 0);
4033 result = 0;
4034 break;
4035 }
4036 }
4037 }
4038 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
4039 return result;
4040 }
4041
4042 /****************************************************************************
4043 Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4044 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4045 ****************************************************************************/
4046
4047 static int chmod_acl_internals( connection_struct *conn, SMB_ACL_T posix_acl, mode_t mode)
4048 {
4049 int entry_id = SMB_ACL_FIRST_ENTRY;
4050 SMB_ACL_ENTRY_T entry;
4051 int num_entries = 0;
4052
4053 while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) {
4054 SMB_ACL_TAG_T tagtype;
4055 SMB_ACL_PERMSET_T permset;
4056 mode_t perms;
4057
4058 entry_id = SMB_ACL_NEXT_ENTRY;
4059
4060 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1)
4061 return -1;
4062
4063 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1)
4064 return -1;
4065
4066 num_entries++;
4067
4068 switch(tagtype) {
4069 case SMB_ACL_USER_OBJ:
4070 perms = unix_perms_to_acl_perms(mode, S_IRUSR, S_IWUSR, S_IXUSR);
4071 break;
4072 case SMB_ACL_GROUP_OBJ:
4073 perms = unix_perms_to_acl_perms(mode, S_IRGRP, S_IWGRP, S_IXGRP);
4074 break;
4075 case SMB_ACL_MASK:
4076 /*
4077 * FIXME: The ACL_MASK entry permissions should really be set to
4078 * the union of the permissions of all ACL_USER,
4079 * ACL_GROUP_OBJ, and ACL_GROUP entries. That's what
4080 * acl_calc_mask() does, but Samba ACLs doesn't provide it.
4081 */
4082 perms = S_IRUSR|S_IWUSR|S_IXUSR;
4083 break;
4084 case SMB_ACL_OTHER:
4085 perms = unix_perms_to_acl_perms(mode, S_IROTH, S_IWOTH, S_IXOTH);
4086 break;
4087 default:
4088 continue;
4089 }
4090
4091 if (map_acl_perms_to_permset(conn, perms, &permset) == -1)
4092 return -1;
4093
4094 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, entry, permset) == -1)
4095 return -1;
4096 }
4097
4098 /*
4099 * If this is a simple 3 element ACL or no elements then it's a standard
4100 * UNIX permission set. Just use chmod...
4101 */
4102
4103 if ((num_entries == 3) || (num_entries == 0))
4104 return -1;
4105
4106 return 0;
4107 }
4108
4109 /****************************************************************************
4110 Get the access ACL of FROM, do a chmod by setting the ACL USER_OBJ,
4111 GROUP_OBJ and OTHER bits in an ACL and set the mask to rwx. Set the
4112 resulting ACL on TO. Note that name is in UNIX character set.
4113 ****************************************************************************/
4114
4115 static int copy_access_posix_acl(connection_struct *conn, const char *from, const char *to, mode_t mode)
4116 {
4117 SMB_ACL_T posix_acl = NULL;
4118 int ret = -1;
4119
4120 if ((posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, from, SMB_ACL_TYPE_ACCESS)) == NULL)
4121 return -1;
4122
4123 if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
4124 goto done;
4125
4126 ret = SMB_VFS_SYS_ACL_SET_FILE(conn, to, SMB_ACL_TYPE_ACCESS, posix_acl);
4127
4128 done:
4129
4130 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
4131 return ret;
4132 }
4133
4134 /****************************************************************************
4135 Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4136 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4137 Note that name is in UNIX character set.
4138 ****************************************************************************/
4139
4140 int chmod_acl(connection_struct *conn, const char *name, mode_t mode)
4141 {
4142 return copy_access_posix_acl(conn, name, name, mode);
4143 }
4144
4145 /****************************************************************************
4146 Check for an existing default POSIX ACL on a directory.
4147 ****************************************************************************/
4148
4149 static bool directory_has_default_posix_acl(connection_struct *conn, const char *fname)
4150 {
4151 SMB_ACL_T def_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_DEFAULT);
4152 bool has_acl = False;
4153 SMB_ACL_ENTRY_T entry;
4154
4155 if (def_acl != NULL && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, def_acl, SMB_ACL_FIRST_ENTRY, &entry) == 1)) {
4156 has_acl = True;
4157 }
4158
4159 if (def_acl) {
4160 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4161 }
4162 return has_acl;
4163 }
4164
4165 /****************************************************************************
4166 If the parent directory has no default ACL but it does have an Access ACL,
4167 inherit this Access ACL to file name.
4168 ****************************************************************************/
4169
4170 int inherit_access_posix_acl(connection_struct *conn, const char *inherit_from_dir,
4171 const char *name, mode_t mode)
4172 {
4173 if (directory_has_default_posix_acl(conn, inherit_from_dir))
4174 return 0;
4175
4176 return copy_access_posix_acl(conn, inherit_from_dir, name, mode);
4177 }
4178
4179 /****************************************************************************
4180 Do an fchmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4181 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4182 ****************************************************************************/
4183
4184 int fchmod_acl(files_struct *fsp, mode_t mode)
4185 {
4186 connection_struct *conn = fsp->conn;
4187 SMB_ACL_T posix_acl = NULL;
4188 int ret = -1;
4189
4190 if ((posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp)) == NULL)
4191 return -1;
4192
4193 if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
4194 goto done;
4195
4196 ret = SMB_VFS_SYS_ACL_SET_FD(fsp, posix_acl);
4197
4198 done:
4199
4200 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
4201 return ret;
4202 }
4203
4204 /****************************************************************************
4205 Map from wire type to permset.
4206 ****************************************************************************/
4207
4208 static bool unix_ex_wire_to_permset(connection_struct *conn, unsigned char wire_perm, SMB_ACL_PERMSET_T *p_permset)
4209 {
4210 if (wire_perm & ~(SMB_POSIX_ACL_READ|SMB_POSIX_ACL_WRITE|SMB_POSIX_ACL_EXECUTE)) {
4211 return False;
4212 }
4213
4214 if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn, *p_permset) == -1) {
4215 return False;
4216 }
4217
4218 if (wire_perm & SMB_POSIX_ACL_READ) {
4219 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_READ) == -1) {
4220 return False;
4221 }
4222 }
4223 if (wire_perm & SMB_POSIX_ACL_WRITE) {
4224 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_WRITE) == -1) {
4225 return False;
4226 }
4227 }
4228 if (wire_perm & SMB_POSIX_ACL_EXECUTE) {
4229 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_EXECUTE) == -1) {
4230 return False;
4231 }
4232 }
4233 return True;
4234 }
4235
4236 /****************************************************************************
4237 Map from wire type to tagtype.
4238 ****************************************************************************/
4239
4240 static bool unix_ex_wire_to_tagtype(unsigned char wire_tt, SMB_ACL_TAG_T *p_tt)
4241 {
4242 switch (wire_tt) {
4243 case SMB_POSIX_ACL_USER_OBJ:
4244 *p_tt = SMB_ACL_USER_OBJ;
4245 break;
4246 case SMB_POSIX_ACL_USER:
4247 *p_tt = SMB_ACL_USER;
4248 break;
4249 case SMB_POSIX_ACL_GROUP_OBJ:
4250 *p_tt = SMB_ACL_GROUP_OBJ;
4251 break;
4252 case SMB_POSIX_ACL_GROUP:
4253 *p_tt = SMB_ACL_GROUP;
4254 break;
4255 case SMB_POSIX_ACL_MASK:
4256 *p_tt = SMB_ACL_MASK;
4257 break;
4258 case SMB_POSIX_ACL_OTHER:
4259 *p_tt = SMB_ACL_OTHER;
4260 break;
4261 default:
4262 return False;
4263 }
4264 return True;
4265 }
4266
4267 /****************************************************************************
4268 Create a new POSIX acl from wire permissions.
4269 FIXME ! How does the share mask/mode fit into this.... ?
4270 ****************************************************************************/
4271
4272 static SMB_ACL_T create_posix_acl_from_wire(connection_struct *conn, uint16 num_acls, const char *pdata)
4273 {
4274 unsigned int i;
4275 SMB_ACL_T the_acl = SMB_VFS_SYS_ACL_INIT(conn, num_acls);
4276
4277 if (the_acl == NULL) {
4278 return NULL;
4279 }
4280
4281 for (i = 0; i < num_acls; i++) {
4282 SMB_ACL_ENTRY_T the_entry;
4283 SMB_ACL_PERMSET_T the_permset;
4284 SMB_ACL_TAG_T tag_type;
4285
4286 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &the_entry) == -1) {
4287 DEBUG(0,("create_posix_acl_from_wire: Failed to create entry %u. (%s)\n",
4288 i, strerror(errno) ));
4289 goto fail;
4290 }
4291
4292 if (!unix_ex_wire_to_tagtype(CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)), &tag_type)) {
4293 DEBUG(0,("create_posix_acl_from_wire: invalid wire tagtype %u on entry %u.\n",
4294 CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)), i ));
4295 goto fail;
4296 }
4297
4298 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, the_entry, tag_type) == -1) {
4299 DEBUG(0,("create_posix_acl_from_wire: Failed to set tagtype on entry %u. (%s)\n",
4300 i, strerror(errno) ));
4301 goto fail;
4302 }
4303
4304 /* Get the permset pointer from the new ACL entry. */
4305 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, the_entry, &the_permset) == -1) {
4306 DEBUG(0,("create_posix_acl_from_wire: Failed to get permset on entry %u. (%s)\n",
4307 i, strerror(errno) ));
4308 goto fail;
4309 }
4310
4311 /* Map from wire to permissions. */
4312 if (!unix_ex_wire_to_permset(conn, CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+1), &the_permset)) {
4313 DEBUG(0,("create_posix_acl_from_wire: invalid permset %u on entry %u.\n",
4314 CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE) + 1), i ));
4315 goto fail;
4316 }
4317
4318 /* Now apply to the new ACL entry. */
4319 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, the_entry, the_permset) == -1) {
4320 DEBUG(0,("create_posix_acl_from_wire: Failed to add permset on entry %u. (%s)\n",
4321 i, strerror(errno) ));
4322 goto fail;
4323 }
4324
4325 if (tag_type == SMB_ACL_USER) {
4326 uint32 uidval = IVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+2);
4327 uid_t uid = (uid_t)uidval;
4328 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&uid) == -1) {
4329 DEBUG(0,("create_posix_acl_from_wire: Failed to set uid %u on entry %u. (%s)\n",
4330 (unsigned int)uid, i, strerror(errno) ));
4331 goto fail;
4332 }
4333 }
4334
4335 if (tag_type == SMB_ACL_GROUP) {
4336 uint32 gidval = IVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+2);
4337 gid_t gid = (uid_t)gidval;
4338 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&gid) == -1) {
4339 DEBUG(0,("create_posix_acl_from_wire: Failed to set gid %u on entry %u. (%s)\n",
4340 (unsigned int)gid, i, strerror(errno) ));
4341 goto fail;
4342 }
4343 }
4344 }
4345
4346 return the_acl;
4347
4348 fail:
4349
4350 if (the_acl != NULL) {
4351 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
4352 }
4353 return NULL;
4354 }
4355
4356 /****************************************************************************
4357 Calls from UNIX extensions - Default POSIX ACL set.
4358 If num_def_acls == 0 and not a directory just return. If it is a directory
4359 and num_def_acls == 0 then remove the default acl. Else set the default acl
4360 on the directory.
4361 ****************************************************************************/
4362
4363 bool set_unix_posix_default_acl(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *psbuf,
4364 uint16 num_def_acls, const char *pdata)
4365 {
4366 SMB_ACL_T def_acl = NULL;
4367
4368 if (!S_ISDIR(psbuf->st_ex_mode)) {
4369 if (num_def_acls) {
4370 DEBUG(5,("set_unix_posix_default_acl: Can't set default ACL on non-directory file %s\n", fname ));
4371 errno = EISDIR;
4372 return False;
4373 } else {
4374 return True;
4375 }
4376 }
4377
4378 if (!num_def_acls) {
4379 /* Remove the default ACL. */
4380 if (SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn, fname) == -1) {
4381 DEBUG(5,("set_unix_posix_default_acl: acl_delete_def_file failed on directory %s (%s)\n",
4382 fname, strerror(errno) ));
4383 return False;
4384 }
4385 return True;
4386 }
4387
4388 if ((def_acl = create_posix_acl_from_wire(conn, num_def_acls, pdata)) == NULL) {
4389 return False;
4390 }
4391
4392 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_DEFAULT, def_acl) == -1) {
4393 DEBUG(5,("set_unix_posix_default_acl: acl_set_file failed on directory %s (%s)\n",
4394 fname, strerror(errno) ));
4395 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4396 return False;
4397 }
4398
4399 DEBUG(10,("set_unix_posix_default_acl: set default acl for file %s\n", fname ));
4400 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4401 return True;
4402 }
4403
4404 /****************************************************************************
4405 Remove an ACL from a file. As we don't have acl_delete_entry() available
4406 we must read the current acl and copy all entries except MASK, USER and GROUP
4407 to a new acl, then set that. This (at least on Linux) causes any ACL to be
4408 removed.
4409 FIXME ! How does the share mask/mode fit into this.... ?
4410 ****************************************************************************/
4411
4412 static bool remove_posix_acl(connection_struct *conn, files_struct *fsp, const char *fname)
4413 {
4414 SMB_ACL_T file_acl = NULL;
4415 int entry_id = SMB_ACL_FIRST_ENTRY;
4416 SMB_ACL_ENTRY_T entry;
4417 bool ret = False;
4418 /* Create a new ACL with only 3 entries, u/g/w. */
4419 SMB_ACL_T new_file_acl = SMB_VFS_SYS_ACL_INIT(conn, 3);
4420 SMB_ACL_ENTRY_T user_ent = NULL;
4421 SMB_ACL_ENTRY_T group_ent = NULL;
4422 SMB_ACL_ENTRY_T other_ent = NULL;
4423
4424 if (new_file_acl == NULL) {
4425 DEBUG(5,("remove_posix_acl: failed to init new ACL with 3 entries for file %s.\n", fname));
4426 return False;
4427 }
4428
4429 /* Now create the u/g/w entries. */
4430 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &user_ent) == -1) {
4431 DEBUG(5,("remove_posix_acl: Failed to create user entry for file %s. (%s)\n",
4432 fname, strerror(errno) ));
4433 goto done;
4434 }
4435 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, user_ent, SMB_ACL_USER_OBJ) == -1) {
4436 DEBUG(5,("remove_posix_acl: Failed to set user entry for file %s. (%s)\n",
4437 fname, strerror(errno) ));
4438 goto done;
4439 }
4440
4441 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &group_ent) == -1) {
4442 DEBUG(5,("remove_posix_acl: Failed to create group entry for file %s. (%s)\n",
4443 fname, strerror(errno) ));
4444 goto done;
4445 }
4446 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, group_ent, SMB_ACL_GROUP_OBJ) == -1) {
4447 DEBUG(5,("remove_posix_acl: Failed to set group entry for file %s. (%s)\n",
4448 fname, strerror(errno) ));
4449 goto done;
4450 }
4451
4452 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &other_ent) == -1) {
4453 DEBUG(5,("remove_posix_acl: Failed to create other entry for file %s. (%s)\n",
4454 fname, strerror(errno) ));
4455 goto done;
4456 }
4457 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, other_ent, SMB_ACL_OTHER) == -1) {
4458 DEBUG(5,("remove_posix_acl: Failed to set other entry for file %s. (%s)\n",
4459 fname, strerror(errno) ));
4460 goto done;
4461 }
4462
4463 /* Get the current file ACL. */
4464 if (fsp && fsp->fh->fd != -1) {
4465 file_acl = SMB_VFS_SYS_ACL_GET_FD(fsp);
4466 } else {
4467 file_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_ACCESS);
4468 }
4469
4470 if (file_acl == NULL) {
4471 /* This is only returned if an error occurred. Even for a file with
4472 no acl a u/g/w acl should be returned. */
4473 DEBUG(5,("remove_posix_acl: failed to get ACL from file %s (%s).\n",
4474 fname, strerror(errno) ));
4475 goto done;
4476 }
4477
4478 while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, file_acl, entry_id, &entry) == 1) {
4479 SMB_ACL_TAG_T tagtype;
4480 SMB_ACL_PERMSET_T permset;
4481
4482 entry_id = SMB_ACL_NEXT_ENTRY;
4483
4484 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1) {
4485 DEBUG(5,("remove_posix_acl: failed to get tagtype from ACL on file %s (%s).\n",
4486 fname, strerror(errno) ));
4487 goto done;
4488 }
4489
4490 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1) {
4491 DEBUG(5,("remove_posix_acl: failed to get permset from ACL on file %s (%s).\n",
4492 fname, strerror(errno) ));
4493 goto done;
4494 }
4495
4496 if (tagtype == SMB_ACL_USER_OBJ) {
4497 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, user_ent, permset) == -1) {
4498 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4499 fname, strerror(errno) ));
4500 }
4501 } else if (tagtype == SMB_ACL_GROUP_OBJ) {
4502 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, group_ent, permset) == -1) {
4503 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4504 fname, strerror(errno) ));
4505 }
4506 } else if (tagtype == SMB_ACL_OTHER) {
4507 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, other_ent, permset) == -1) {
4508 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4509 fname, strerror(errno) ));
4510 }
4511 }
4512 }
4513
4514 /* Set the new empty file ACL. */
4515 if (fsp && fsp->fh->fd != -1) {
4516 if (SMB_VFS_SYS_ACL_SET_FD(fsp, new_file_acl) == -1) {
4517 DEBUG(5,("remove_posix_acl: acl_set_file failed on %s (%s)\n",
4518 fname, strerror(errno) ));
4519 goto done;
4520 }
4521 } else {
4522 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS, new_file_acl) == -1) {
4523 DEBUG(5,("remove_posix_acl: acl_set_file failed on %s (%s)\n",
4524 fname, strerror(errno) ));
4525 goto done;
4526 }
4527 }
4528
4529 ret = True;
4530
4531 done:
4532
4533 if (file_acl) {
4534 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4535 }
4536 if (new_file_acl) {
4537 SMB_VFS_SYS_ACL_FREE_ACL(conn, new_file_acl);
4538 }
4539 return ret;
4540 }
4541
4542 /****************************************************************************
4543 Calls from UNIX extensions - POSIX ACL set.
4544 If num_def_acls == 0 then read/modify/write acl after removing all entries
4545 except SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER.
4546 ****************************************************************************/
4547
4548 bool set_unix_posix_acl(connection_struct *conn, files_struct *fsp, const char *fname, uint16 num_acls, const char *pdata)
4549 {
4550 SMB_ACL_T file_acl = NULL;
4551
4552 if (!num_acls) {
4553 /* Remove the ACL from the file. */
4554 return remove_posix_acl(conn, fsp, fname);
4555 }
4556
4557 if ((file_acl = create_posix_acl_from_wire(conn, num_acls, pdata)) == NULL) {
4558 return False;
4559 }
4560
4561 if (fsp && fsp->fh->fd != -1) {
4562 /* The preferred way - use an open fd. */
4563 if (SMB_VFS_SYS_ACL_SET_FD(fsp, file_acl) == -1) {
4564 DEBUG(5,("set_unix_posix_acl: acl_set_file failed on %s (%s)\n",
4565 fname, strerror(errno) ));
4566 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4567 return False;
4568 }
4569 } else {
4570 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS, file_acl) == -1) {
4571 DEBUG(5,("set_unix_posix_acl: acl_set_file failed on %s (%s)\n",
4572 fname, strerror(errno) ));
4573 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4574 return False;
4575 }
4576 }
4577
4578 DEBUG(10,("set_unix_posix_acl: set acl for file %s\n", fname ));
4579 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4580 return True;
4581 }
4582
4583 /********************************************************************
4584 Pull the NT ACL from a file on disk or the OpenEventlog() access
4585 check. Caller is responsible for freeing the returned security
4586 descriptor via TALLOC_FREE(). This is designed for dealing with
4587 user space access checks in smbd outside of the VFS. For example,
4588 checking access rights in OpenEventlog().
4589
4590 Assume we are dealing with files (for now)
4591 ********************************************************************/
4592
4593 SEC_DESC *get_nt_acl_no_snum( TALLOC_CTX *ctx, const char *fname)
4594 {
4595 SEC_DESC *psd, *ret_sd;
4596 connection_struct *conn;
4597 files_struct finfo;
4598 struct fd_handle fh;
4599 NTSTATUS status;
4600
4601 conn = TALLOC_ZERO_P(ctx, connection_struct);
4602 if (conn == NULL) {
4603 DEBUG(0, ("talloc failed\n"));
4604 return NULL;
4605 }
4606
4607 if (!(conn->params = TALLOC_P(conn, struct share_params))) {
4608 DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
4609 TALLOC_FREE(conn);
4610 return NULL;
4611 }
4612
4613 conn->params->service = -1;
4614
4615 set_conn_connectpath(conn, "/");
4616
4617 if (!smbd_vfs_init(conn)) {
4618 DEBUG(0,("get_nt_acl_no_snum: Unable to create a fake connection struct!\n"));
4619 conn_free_internal( conn );
4620 return NULL;
4621 }
4622
4623 ZERO_STRUCT( finfo );
4624 ZERO_STRUCT( fh );
4625
4626 finfo.fnum = -1;
4627 finfo.conn = conn;
4628 finfo.fh = &fh;
4629 finfo.fh->fd = -1;
4630
4631 status = create_synthetic_smb_fname(talloc_tos(), fname, NULL, NULL,
4632 &finfo.fsp_name);
4633 if (!NT_STATUS_IS_OK(status)) {
4634 conn_free_internal( conn );
4635 return NULL;
4636 }
4637
4638 if (!NT_STATUS_IS_OK(SMB_VFS_FGET_NT_ACL( &finfo, DACL_SECURITY_INFORMATION, &psd))) {
4639 DEBUG(0,("get_nt_acl_no_snum: get_nt_acl returned zero.\n"));
4640 TALLOC_FREE(finfo.fsp_name);
4641 conn_free_internal( conn );
4642 return NULL;
4643 }
4644
4645 ret_sd = dup_sec_desc( ctx, psd );
4646
4647 TALLOC_FREE(finfo.fsp_name);
4648 conn_free_internal( conn );
4649
4650 return ret_sd;
4651 }
fernandojvsilva's samba4 branch