2 Unix SMB/CIFS implementation.
3 SMB NT Security Descriptor / Unix permission conversion.
4 Copyright (C) Jeremy Allison 1994-2009.
5 Copyright (C) Andreas Gruenbacher 2002.
6 Copyright (C) Simo Sorce <idra@samba.org> 2009.
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 extern struct current_user current_user
;
25 extern const struct generic_mapping file_generic_mapping
;
28 #define DBGC_CLASS DBGC_ACLS
30 /****************************************************************************
31 Data structures representing the internal ACE format.
32 ****************************************************************************/
34 enum ace_owner
{UID_ACE
, GID_ACE
, WORLD_ACE
};
35 enum ace_attribute
{ALLOW_ACE
, DENY_ACE
}; /* Used for incoming NT ACLS. */
37 typedef union posix_id
{
43 typedef struct canon_ace
{
44 struct canon_ace
*next
, *prev
;
46 mode_t perms
; /* Only use S_I(R|W|X)USR mode bits here. */
48 enum ace_owner owner_type
;
49 enum ace_attribute attr
;
51 uint8_t ace_flags
; /* From windows ACE entry. */
54 #define ALL_ACE_PERMS (S_IRUSR|S_IWUSR|S_IXUSR)
57 * EA format of user.SAMBA_PAI (Samba_Posix_Acl_Interitance)
58 * attribute on disk - version 1.
59 * All values are little endian.
61 * | 1 | 1 | 2 | 2 | ....
62 * +------+------+-------------+---------------------+-------------+--------------------+
63 * | vers | flag | num_entries | num_default_entries | ..entries.. | default_entries... |
64 * +------+------+-------------+---------------------+-------------+--------------------+
69 * +------+-------------------+
70 * | value| uid/gid or world |
72 * +------+-------------------+
74 * Version 2 format. Stores extra Windows metadata about an ACL.
76 * | 1 | 2 | 2 | 2 | ....
77 * +------+----------+-------------+---------------------+-------------+--------------------+
78 * | vers | ace | num_entries | num_default_entries | ..entries.. | default_entries... |
79 * | 2 | type | | | | |
80 * +------+----------+-------------+---------------------+-------------+--------------------+
85 * +------+------+-------------------+
86 * | ace | value| uid/gid or world |
87 * | flag | type | value |
88 * +------+-------------------+------+
92 #define PAI_VERSION_OFFSET 0
94 #define PAI_V1_FLAG_OFFSET 1
95 #define PAI_V1_NUM_ENTRIES_OFFSET 2
96 #define PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET 4
97 #define PAI_V1_ENTRIES_BASE 6
98 #define PAI_V1_ACL_FLAG_PROTECTED 0x1
99 #define PAI_V1_ENTRY_LENGTH 5
101 #define PAI_V1_VERSION 1
103 #define PAI_V2_TYPE_OFFSET 1
104 #define PAI_V2_NUM_ENTRIES_OFFSET 3
105 #define PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET 5
106 #define PAI_V2_ENTRIES_BASE 7
107 #define PAI_V2_ENTRY_LENGTH 6
109 #define PAI_V2_VERSION 2
112 * In memory format of user.SAMBA_PAI attribute.
116 struct pai_entry
*next
, *prev
;
118 enum ace_owner owner_type
;
124 unsigned int num_entries
;
125 struct pai_entry
*entry_list
;
126 unsigned int num_def_entries
;
127 struct pai_entry
*def_entry_list
;
130 /************************************************************************
131 Return a uint32 of the pai_entry principal.
132 ************************************************************************/
134 static uint32_t get_pai_entry_val(struct pai_entry
*paie
)
136 switch (paie
->owner_type
) {
138 DEBUG(10,("get_pai_entry_val: uid = %u\n", (unsigned int)paie
->unix_ug
.uid
));
139 return (uint32_t)paie
->unix_ug
.uid
;
141 DEBUG(10,("get_pai_entry_val: gid = %u\n", (unsigned int)paie
->unix_ug
.gid
));
142 return (uint32_t)paie
->unix_ug
.gid
;
145 DEBUG(10,("get_pai_entry_val: world ace\n"));
150 /************************************************************************
151 Return a uint32 of the entry principal.
152 ************************************************************************/
154 static uint32_t get_entry_val(canon_ace
*ace_entry
)
156 switch (ace_entry
->owner_type
) {
158 DEBUG(10,("get_entry_val: uid = %u\n", (unsigned int)ace_entry
->unix_ug
.uid
));
159 return (uint32_t)ace_entry
->unix_ug
.uid
;
161 DEBUG(10,("get_entry_val: gid = %u\n", (unsigned int)ace_entry
->unix_ug
.gid
));
162 return (uint32_t)ace_entry
->unix_ug
.gid
;
165 DEBUG(10,("get_entry_val: world ace\n"));
170 /************************************************************************
171 Create the on-disk format (always v2 now). Caller must free.
172 ************************************************************************/
174 static char *create_pai_buf_v2(canon_ace
*file_ace_list
,
175 canon_ace
*dir_ace_list
,
179 char *pai_buf
= NULL
;
180 canon_ace
*ace_list
= NULL
;
181 char *entry_offset
= NULL
;
182 unsigned int num_entries
= 0;
183 unsigned int num_def_entries
= 0;
185 for (ace_list
= file_ace_list
; ace_list
; ace_list
= ace_list
->next
) {
189 for (ace_list
= dir_ace_list
; ace_list
; ace_list
= ace_list
->next
) {
193 DEBUG(10,("create_pai_buf_v2: num_entries = %u, num_def_entries = %u\n", num_entries
, num_def_entries
));
195 *store_size
= PAI_V2_ENTRIES_BASE
+
196 ((num_entries
+ num_def_entries
)*PAI_V2_ENTRY_LENGTH
);
198 pai_buf
= (char *)SMB_MALLOC(*store_size
);
203 /* Set up the header. */
204 memset(pai_buf
, '\0', PAI_V2_ENTRIES_BASE
);
205 SCVAL(pai_buf
,PAI_VERSION_OFFSET
,PAI_V2_VERSION
);
206 SSVAL(pai_buf
,PAI_V2_TYPE_OFFSET
, sd_type
);
207 SSVAL(pai_buf
,PAI_V2_NUM_ENTRIES_OFFSET
,num_entries
);
208 SSVAL(pai_buf
,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET
,num_def_entries
);
210 entry_offset
= pai_buf
+ PAI_V2_ENTRIES_BASE
;
212 for (ace_list
= file_ace_list
; ace_list
; ace_list
= ace_list
->next
) {
213 uint8_t type_val
= (uint8_t)ace_list
->owner_type
;
214 uint32_t entry_val
= get_entry_val(ace_list
);
216 SCVAL(entry_offset
,0,ace_list
->ace_flags
);
217 SCVAL(entry_offset
,1,type_val
);
218 SIVAL(entry_offset
,2,entry_val
);
219 entry_offset
+= PAI_V2_ENTRY_LENGTH
;
222 for (ace_list
= dir_ace_list
; ace_list
; ace_list
= ace_list
->next
) {
223 uint8_t type_val
= (uint8_t)ace_list
->owner_type
;
224 uint32_t entry_val
= get_entry_val(ace_list
);
226 SCVAL(entry_offset
,0,ace_list
->ace_flags
);
227 SCVAL(entry_offset
,1,type_val
);
228 SIVAL(entry_offset
,2,entry_val
);
229 entry_offset
+= PAI_V2_ENTRY_LENGTH
;
235 /************************************************************************
236 Store the user.SAMBA_PAI attribute on disk.
237 ************************************************************************/
239 static void store_inheritance_attributes(files_struct
*fsp
,
240 canon_ace
*file_ace_list
,
241 canon_ace
*dir_ace_list
,
248 if (!lp_map_acl_inherit(SNUM(fsp
->conn
))) {
252 pai_buf
= create_pai_buf_v2(file_ace_list
, dir_ace_list
,
253 sd_type
, &store_size
);
255 if (fsp
->fh
->fd
!= -1) {
256 ret
= SMB_VFS_FSETXATTR(fsp
, SAMBA_POSIX_INHERITANCE_EA_NAME
,
257 pai_buf
, store_size
, 0);
259 ret
= SMB_VFS_SETXATTR(fsp
->conn
, fsp
->fsp_name
->base_name
,
260 SAMBA_POSIX_INHERITANCE_EA_NAME
,
261 pai_buf
, store_size
, 0);
266 DEBUG(10,("store_inheritance_attribute: type 0x%x for file %s\n",
267 (unsigned int)sd_type
,
270 if (ret
== -1 && !no_acl_syscall_error(errno
)) {
271 DEBUG(1,("store_inheritance_attribute: Error %s\n", strerror(errno
) ));
275 /************************************************************************
276 Delete the in memory inheritance info.
277 ************************************************************************/
279 static void free_inherited_info(struct pai_val
*pal
)
282 struct pai_entry
*paie
, *paie_next
;
283 for (paie
= pal
->entry_list
; paie
; paie
= paie_next
) {
284 paie_next
= paie
->next
;
287 for (paie
= pal
->def_entry_list
; paie
; paie
= paie_next
) {
288 paie_next
= paie
->next
;
295 /************************************************************************
296 Get any stored ACE flags.
297 ************************************************************************/
299 static uint16_t get_pai_flags(struct pai_val
*pal
, canon_ace
*ace_entry
, bool default_ace
)
301 struct pai_entry
*paie
;
307 /* If the entry exists it is inherited. */
308 for (paie
= (default_ace
? pal
->def_entry_list
: pal
->entry_list
); paie
; paie
= paie
->next
) {
309 if (ace_entry
->owner_type
== paie
->owner_type
&&
310 get_entry_val(ace_entry
) == get_pai_entry_val(paie
))
311 return paie
->ace_flags
;
316 /************************************************************************
317 Ensure an attribute just read is valid - v1.
318 ************************************************************************/
320 static bool check_pai_ok_v1(const char *pai_buf
, size_t pai_buf_data_size
)
323 uint16 num_def_entries
;
325 if (pai_buf_data_size
< PAI_V1_ENTRIES_BASE
) {
326 /* Corrupted - too small. */
330 if (CVAL(pai_buf
,PAI_VERSION_OFFSET
) != PAI_V1_VERSION
) {
334 num_entries
= SVAL(pai_buf
,PAI_V1_NUM_ENTRIES_OFFSET
);
335 num_def_entries
= SVAL(pai_buf
,PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET
);
337 /* Check the entry lists match. */
338 /* Each entry is 5 bytes (type plus 4 bytes of uid or gid). */
340 if (((num_entries
+ num_def_entries
)*PAI_V1_ENTRY_LENGTH
) +
341 PAI_V1_ENTRIES_BASE
!= pai_buf_data_size
) {
348 /************************************************************************
349 Ensure an attribute just read is valid - v2.
350 ************************************************************************/
352 static bool check_pai_ok_v2(const char *pai_buf
, size_t pai_buf_data_size
)
355 uint16 num_def_entries
;
357 if (pai_buf_data_size
< PAI_V2_ENTRIES_BASE
) {
358 /* Corrupted - too small. */
362 if (CVAL(pai_buf
,PAI_VERSION_OFFSET
) != PAI_V2_VERSION
) {
366 num_entries
= SVAL(pai_buf
,PAI_V2_NUM_ENTRIES_OFFSET
);
367 num_def_entries
= SVAL(pai_buf
,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET
);
369 /* Check the entry lists match. */
370 /* Each entry is 6 bytes (flags + type + 4 bytes of uid or gid). */
372 if (((num_entries
+ num_def_entries
)*PAI_V2_ENTRY_LENGTH
) +
373 PAI_V2_ENTRIES_BASE
!= pai_buf_data_size
) {
380 /************************************************************************
382 ************************************************************************/
384 static bool get_pai_owner_type(struct pai_entry
*paie
, const char *entry_offset
)
386 paie
->owner_type
= (enum ace_owner
)CVAL(entry_offset
,0);
387 switch( paie
->owner_type
) {
389 paie
->unix_ug
.uid
= (uid_t
)IVAL(entry_offset
,1);
390 DEBUG(10,("get_pai_owner_type: uid = %u\n",
391 (unsigned int)paie
->unix_ug
.uid
));
394 paie
->unix_ug
.gid
= (gid_t
)IVAL(entry_offset
,1);
395 DEBUG(10,("get_pai_owner_type: gid = %u\n",
396 (unsigned int)paie
->unix_ug
.gid
));
399 paie
->unix_ug
.world
= -1;
400 DEBUG(10,("get_pai_owner_type: world ace\n"));
408 /************************************************************************
410 ************************************************************************/
412 static const char *create_pai_v1_entries(struct pai_val
*paiv
,
413 const char *entry_offset
,
418 for (i
= 0; i
< paiv
->num_entries
; i
++) {
419 struct pai_entry
*paie
= SMB_MALLOC_P(struct pai_entry
);
424 paie
->ace_flags
= SEC_ACE_FLAG_INHERITED_ACE
;
425 if (!get_pai_owner_type(paie
, entry_offset
)) {
430 DLIST_ADD(paiv
->entry_list
, paie
);
432 DLIST_ADD(paiv
->def_entry_list
, paie
);
434 entry_offset
+= PAI_V1_ENTRY_LENGTH
;
439 /************************************************************************
440 Convert to in-memory format from version 1.
441 ************************************************************************/
443 static struct pai_val
*create_pai_val_v1(const char *buf
, size_t size
)
445 const char *entry_offset
;
446 struct pai_val
*paiv
= NULL
;
448 if (!check_pai_ok_v1(buf
, size
)) {
452 paiv
= SMB_MALLOC_P(struct pai_val
);
457 memset(paiv
, '\0', sizeof(struct pai_val
));
459 paiv
->sd_type
= (CVAL(buf
,PAI_V1_FLAG_OFFSET
) == PAI_V1_ACL_FLAG_PROTECTED
) ?
460 SE_DESC_DACL_PROTECTED
: 0;
462 paiv
->num_entries
= SVAL(buf
,PAI_V1_NUM_ENTRIES_OFFSET
);
463 paiv
->num_def_entries
= SVAL(buf
,PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET
);
465 entry_offset
= buf
+ PAI_V1_ENTRIES_BASE
;
467 DEBUG(10,("create_pai_val: num_entries = %u, num_def_entries = %u\n",
468 paiv
->num_entries
, paiv
->num_def_entries
));
470 entry_offset
= create_pai_v1_entries(paiv
, entry_offset
, false);
471 if (entry_offset
== NULL
) {
472 free_inherited_info(paiv
);
475 entry_offset
= create_pai_v1_entries(paiv
, entry_offset
, true);
476 if (entry_offset
== NULL
) {
477 free_inherited_info(paiv
);
484 /************************************************************************
486 ************************************************************************/
488 static const char *create_pai_v2_entries(struct pai_val
*paiv
,
489 const char *entry_offset
,
494 for (i
= 0; i
< paiv
->num_entries
; i
++) {
495 struct pai_entry
*paie
= SMB_MALLOC_P(struct pai_entry
);
500 paie
->ace_flags
= CVAL(entry_offset
,0);
504 if (!get_pai_owner_type(paie
, entry_offset
)) {
508 DLIST_ADD(paiv
->entry_list
, paie
);
510 DLIST_ADD(paiv
->def_entry_list
, paie
);
512 entry_offset
+= PAI_V2_ENTRY_LENGTH
;
517 /************************************************************************
518 Convert to in-memory format from version 2.
519 ************************************************************************/
521 static struct pai_val
*create_pai_val_v2(const char *buf
, size_t size
)
523 const char *entry_offset
;
524 struct pai_val
*paiv
= NULL
;
526 if (!check_pai_ok_v2(buf
, size
)) {
530 paiv
= SMB_MALLOC_P(struct pai_val
);
535 memset(paiv
, '\0', sizeof(struct pai_val
));
537 paiv
->sd_type
= SVAL(buf
,PAI_V2_TYPE_OFFSET
);
539 paiv
->num_entries
= SVAL(buf
,PAI_V2_NUM_ENTRIES_OFFSET
);
540 paiv
->num_def_entries
= SVAL(buf
,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET
);
542 entry_offset
= buf
+ PAI_V2_ENTRIES_BASE
;
544 DEBUG(10,("create_pai_val_v2: num_entries = %u, num_def_entries = %u\n",
545 paiv
->num_entries
, paiv
->num_def_entries
));
547 entry_offset
= create_pai_v2_entries(paiv
, entry_offset
, false);
548 if (entry_offset
== NULL
) {
549 free_inherited_info(paiv
);
552 entry_offset
= create_pai_v2_entries(paiv
, entry_offset
, true);
553 if (entry_offset
== NULL
) {
554 free_inherited_info(paiv
);
561 /************************************************************************
562 Convert to in-memory format - from either version 1 or 2.
563 ************************************************************************/
565 static struct pai_val
*create_pai_val(const char *buf
, size_t size
)
570 if (CVAL(buf
,PAI_VERSION_OFFSET
) == PAI_V1_VERSION
) {
571 return create_pai_val_v1(buf
, size
);
572 } else if (CVAL(buf
,PAI_VERSION_OFFSET
) == PAI_V2_VERSION
) {
573 return create_pai_val_v2(buf
, size
);
579 /************************************************************************
580 Load the user.SAMBA_PAI attribute.
581 ************************************************************************/
583 static struct pai_val
*fload_inherited_info(files_struct
*fsp
)
586 size_t pai_buf_size
= 1024;
587 struct pai_val
*paiv
= NULL
;
590 if (!lp_map_acl_inherit(SNUM(fsp
->conn
))) {
594 if ((pai_buf
= (char *)SMB_MALLOC(pai_buf_size
)) == NULL
) {
599 if (fsp
->fh
->fd
!= -1) {
600 ret
= SMB_VFS_FGETXATTR(fsp
, SAMBA_POSIX_INHERITANCE_EA_NAME
,
601 pai_buf
, pai_buf_size
);
603 ret
= SMB_VFS_GETXATTR(fsp
->conn
,
604 fsp
->fsp_name
->base_name
,
605 SAMBA_POSIX_INHERITANCE_EA_NAME
,
606 pai_buf
, pai_buf_size
);
610 if (errno
!= ERANGE
) {
613 /* Buffer too small - enlarge it. */
616 if (pai_buf_size
> 1024*1024) {
617 return NULL
; /* Limit malloc to 1mb. */
619 if ((pai_buf
= (char *)SMB_MALLOC(pai_buf_size
)) == NULL
)
624 DEBUG(10,("load_inherited_info: ret = %lu for file %s\n",
625 (unsigned long)ret
, fsp_str_dbg(fsp
)));
628 /* No attribute or not supported. */
630 if (errno
!= ENOATTR
)
631 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno
) ));
634 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno
) ));
640 paiv
= create_pai_val(pai_buf
, ret
);
643 DEBUG(10,("load_inherited_info: ACL type is 0x%x for file %s\n",
644 (unsigned int)paiv
->sd_type
, fsp_str_dbg(fsp
)));
651 /************************************************************************
652 Load the user.SAMBA_PAI attribute.
653 ************************************************************************/
655 static struct pai_val
*load_inherited_info(const struct connection_struct
*conn
,
659 size_t pai_buf_size
= 1024;
660 struct pai_val
*paiv
= NULL
;
663 if (!lp_map_acl_inherit(SNUM(conn
))) {
667 if ((pai_buf
= (char *)SMB_MALLOC(pai_buf_size
)) == NULL
) {
672 ret
= SMB_VFS_GETXATTR(conn
, fname
,
673 SAMBA_POSIX_INHERITANCE_EA_NAME
,
674 pai_buf
, pai_buf_size
);
677 if (errno
!= ERANGE
) {
680 /* Buffer too small - enlarge it. */
683 if (pai_buf_size
> 1024*1024) {
684 return NULL
; /* Limit malloc to 1mb. */
686 if ((pai_buf
= (char *)SMB_MALLOC(pai_buf_size
)) == NULL
)
691 DEBUG(10,("load_inherited_info: ret = %lu for file %s\n", (unsigned long)ret
, fname
));
694 /* No attribute or not supported. */
696 if (errno
!= ENOATTR
)
697 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno
) ));
700 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno
) ));
706 paiv
= create_pai_val(pai_buf
, ret
);
709 DEBUG(10,("load_inherited_info: ACL type 0x%x for file %s\n",
710 (unsigned int)paiv
->sd_type
,
718 /****************************************************************************
719 Functions to manipulate the internal ACE format.
720 ****************************************************************************/
722 /****************************************************************************
723 Count a linked list of canonical ACE entries.
724 ****************************************************************************/
726 static size_t count_canon_ace_list( canon_ace
*l_head
)
731 for (ace
= l_head
; ace
; ace
= ace
->next
)
737 /****************************************************************************
738 Free a linked list of canonical ACE entries.
739 ****************************************************************************/
741 static void free_canon_ace_list( canon_ace
*l_head
)
743 canon_ace
*list
, *next
;
745 for (list
= l_head
; list
; list
= next
) {
747 DLIST_REMOVE(l_head
, list
);
752 /****************************************************************************
753 Function to duplicate a canon_ace entry.
754 ****************************************************************************/
756 static canon_ace
*dup_canon_ace( canon_ace
*src_ace
)
758 canon_ace
*dst_ace
= SMB_MALLOC_P(canon_ace
);
764 dst_ace
->prev
= dst_ace
->next
= NULL
;
768 /****************************************************************************
769 Print out a canon ace.
770 ****************************************************************************/
772 static void print_canon_ace(canon_ace
*pace
, int num
)
774 dbgtext( "canon_ace index %d. Type = %s ", num
, pace
->attr
== ALLOW_ACE
? "allow" : "deny" );
775 dbgtext( "SID = %s ", sid_string_dbg(&pace
->trustee
));
776 if (pace
->owner_type
== UID_ACE
) {
777 const char *u_name
= uidtoname(pace
->unix_ug
.uid
);
778 dbgtext( "uid %u (%s) ", (unsigned int)pace
->unix_ug
.uid
, u_name
);
779 } else if (pace
->owner_type
== GID_ACE
) {
780 char *g_name
= gidtoname(pace
->unix_ug
.gid
);
781 dbgtext( "gid %u (%s) ", (unsigned int)pace
->unix_ug
.gid
, g_name
);
784 switch (pace
->type
) {
786 dbgtext( "SMB_ACL_USER ");
788 case SMB_ACL_USER_OBJ
:
789 dbgtext( "SMB_ACL_USER_OBJ ");
792 dbgtext( "SMB_ACL_GROUP ");
794 case SMB_ACL_GROUP_OBJ
:
795 dbgtext( "SMB_ACL_GROUP_OBJ ");
798 dbgtext( "SMB_ACL_OTHER ");
805 dbgtext( "ace_flags = 0x%x ", (unsigned int)pace
->ace_flags
);
807 dbgtext( "%c", pace
->perms
& S_IRUSR
? 'r' : '-');
808 dbgtext( "%c", pace
->perms
& S_IWUSR
? 'w' : '-');
809 dbgtext( "%c\n", pace
->perms
& S_IXUSR
? 'x' : '-');
812 /****************************************************************************
813 Print out a canon ace list.
814 ****************************************************************************/
816 static void print_canon_ace_list(const char *name
, canon_ace
*ace_list
)
820 if( DEBUGLVL( 10 )) {
821 dbgtext( "print_canon_ace_list: %s\n", name
);
822 for (;ace_list
; ace_list
= ace_list
->next
, count
++)
823 print_canon_ace(ace_list
, count
);
827 /****************************************************************************
828 Map POSIX ACL perms to canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits).
829 ****************************************************************************/
831 static mode_t
convert_permset_to_mode_t(connection_struct
*conn
, SMB_ACL_PERMSET_T permset
)
835 ret
|= (SMB_VFS_SYS_ACL_GET_PERM(conn
, permset
, SMB_ACL_READ
) ? S_IRUSR
: 0);
836 ret
|= (SMB_VFS_SYS_ACL_GET_PERM(conn
, permset
, SMB_ACL_WRITE
) ? S_IWUSR
: 0);
837 ret
|= (SMB_VFS_SYS_ACL_GET_PERM(conn
, permset
, SMB_ACL_EXECUTE
) ? S_IXUSR
: 0);
842 /****************************************************************************
843 Map generic UNIX permissions to canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits).
844 ****************************************************************************/
846 static mode_t
unix_perms_to_acl_perms(mode_t mode
, int r_mask
, int w_mask
, int x_mask
)
860 /****************************************************************************
861 Map canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits) to
862 an SMB_ACL_PERMSET_T.
863 ****************************************************************************/
865 static int map_acl_perms_to_permset(connection_struct
*conn
, mode_t mode
, SMB_ACL_PERMSET_T
*p_permset
)
867 if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn
, *p_permset
) == -1)
869 if (mode
& S_IRUSR
) {
870 if (SMB_VFS_SYS_ACL_ADD_PERM(conn
, *p_permset
, SMB_ACL_READ
) == -1)
873 if (mode
& S_IWUSR
) {
874 if (SMB_VFS_SYS_ACL_ADD_PERM(conn
, *p_permset
, SMB_ACL_WRITE
) == -1)
877 if (mode
& S_IXUSR
) {
878 if (SMB_VFS_SYS_ACL_ADD_PERM(conn
, *p_permset
, SMB_ACL_EXECUTE
) == -1)
884 /****************************************************************************
885 Function to create owner and group SIDs from a SMB_STRUCT_STAT.
886 ****************************************************************************/
888 void create_file_sids(const SMB_STRUCT_STAT
*psbuf
, DOM_SID
*powner_sid
, DOM_SID
*pgroup_sid
)
890 uid_to_sid( powner_sid
, psbuf
->st_ex_uid
);
891 gid_to_sid( pgroup_sid
, psbuf
->st_ex_gid
);
894 /****************************************************************************
895 Is the identity in two ACEs equal ? Check both SID and uid/gid.
896 ****************************************************************************/
898 static bool identity_in_ace_equal(canon_ace
*ace1
, canon_ace
*ace2
)
900 if (sid_equal(&ace1
->trustee
, &ace2
->trustee
)) {
903 if (ace1
->owner_type
== ace2
->owner_type
) {
904 if (ace1
->owner_type
== UID_ACE
&&
905 ace1
->unix_ug
.uid
== ace2
->unix_ug
.uid
) {
907 } else if (ace1
->owner_type
== GID_ACE
&&
908 ace1
->unix_ug
.gid
== ace2
->unix_ug
.gid
) {
915 /****************************************************************************
916 Merge aces with a common sid - if both are allow or deny, OR the permissions together and
917 delete the second one. If the first is deny, mask the permissions off and delete the allow
918 if the permissions become zero, delete the deny if the permissions are non zero.
919 ****************************************************************************/
921 static void merge_aces( canon_ace
**pp_list_head
)
923 canon_ace
*l_head
= *pp_list_head
;
924 canon_ace
*curr_ace_outer
;
925 canon_ace
*curr_ace_outer_next
;
928 * First, merge allow entries with identical SIDs, and deny entries
929 * with identical SIDs.
932 for (curr_ace_outer
= l_head
; curr_ace_outer
; curr_ace_outer
= curr_ace_outer_next
) {
934 canon_ace
*curr_ace_next
;
936 curr_ace_outer_next
= curr_ace_outer
->next
; /* Save the link in case we delete. */
938 for (curr_ace
= curr_ace_outer
->next
; curr_ace
; curr_ace
= curr_ace_next
) {
940 curr_ace_next
= curr_ace
->next
; /* Save the link in case of delete. */
942 if (identity_in_ace_equal(curr_ace
, curr_ace_outer
) &&
943 (curr_ace
->attr
== curr_ace_outer
->attr
)) {
945 if( DEBUGLVL( 10 )) {
946 dbgtext("merge_aces: Merging ACE's\n");
947 print_canon_ace( curr_ace_outer
, 0);
948 print_canon_ace( curr_ace
, 0);
951 /* Merge two allow or two deny ACE's. */
953 curr_ace_outer
->perms
|= curr_ace
->perms
;
954 DLIST_REMOVE(l_head
, curr_ace
);
956 curr_ace_outer_next
= curr_ace_outer
->next
; /* We may have deleted the link. */
962 * Now go through and mask off allow permissions with deny permissions.
963 * We can delete either the allow or deny here as we know that each SID
964 * appears only once in the list.
967 for (curr_ace_outer
= l_head
; curr_ace_outer
; curr_ace_outer
= curr_ace_outer_next
) {
969 canon_ace
*curr_ace_next
;
971 curr_ace_outer_next
= curr_ace_outer
->next
; /* Save the link in case we delete. */
973 for (curr_ace
= curr_ace_outer
->next
; curr_ace
; curr_ace
= curr_ace_next
) {
975 curr_ace_next
= curr_ace
->next
; /* Save the link in case of delete. */
978 * Subtract ACE's with different entries. Due to the ordering constraints
979 * we've put on the ACL, we know the deny must be the first one.
982 if (identity_in_ace_equal(curr_ace
, curr_ace_outer
) &&
983 (curr_ace_outer
->attr
== DENY_ACE
) && (curr_ace
->attr
== ALLOW_ACE
)) {
985 if( DEBUGLVL( 10 )) {
986 dbgtext("merge_aces: Masking ACE's\n");
987 print_canon_ace( curr_ace_outer
, 0);
988 print_canon_ace( curr_ace
, 0);
991 curr_ace
->perms
&= ~curr_ace_outer
->perms
;
993 if (curr_ace
->perms
== 0) {
996 * The deny overrides the allow. Remove the allow.
999 DLIST_REMOVE(l_head
, curr_ace
);
1000 SAFE_FREE(curr_ace
);
1001 curr_ace_outer_next
= curr_ace_outer
->next
; /* We may have deleted the link. */
1006 * Even after removing permissions, there
1007 * are still allow permissions - delete the deny.
1008 * It is safe to delete the deny here,
1009 * as we are guarenteed by the deny first
1010 * ordering that all the deny entries for
1011 * this SID have already been merged into one
1012 * before we can get to an allow ace.
1015 DLIST_REMOVE(l_head
, curr_ace_outer
);
1016 SAFE_FREE(curr_ace_outer
);
1021 } /* end for curr_ace */
1022 } /* end for curr_ace_outer */
1024 /* We may have modified the list. */
1026 *pp_list_head
= l_head
;
1029 /****************************************************************************
1030 Check if we need to return NT4.x compatible ACL entries.
1031 ****************************************************************************/
1033 bool nt4_compatible_acls(void)
1035 int compat
= lp_acl_compatibility();
1037 if (compat
== ACL_COMPAT_AUTO
) {
1038 enum remote_arch_types ra_type
= get_remote_arch();
1040 /* Automatically adapt to client */
1041 return (ra_type
<= RA_WINNT
);
1043 return (compat
== ACL_COMPAT_WINNT
);
1047 /****************************************************************************
1048 Map canon_ace perms to permission bits NT.
1049 The attr element is not used here - we only process deny entries on set,
1050 not get. Deny entries are implicit on get with ace->perms = 0.
1051 ****************************************************************************/
1053 static uint32_t map_canon_ace_perms(int snum
,
1054 enum security_ace_type
*pacl_type
,
1058 uint32_t nt_mask
= 0;
1060 *pacl_type
= SEC_ACE_TYPE_ACCESS_ALLOWED
;
1062 if (lp_acl_map_full_control(snum
) && ((perms
& ALL_ACE_PERMS
) == ALL_ACE_PERMS
)) {
1063 if (directory_ace
) {
1064 nt_mask
= UNIX_DIRECTORY_ACCESS_RWX
;
1066 nt_mask
= (UNIX_ACCESS_RWX
& ~DELETE_ACCESS
);
1068 } else if ((perms
& ALL_ACE_PERMS
) == (mode_t
)0) {
1070 * Windows NT refuses to display ACEs with no permissions in them (but
1071 * they are perfectly legal with Windows 2000). If the ACE has empty
1072 * permissions we cannot use 0, so we use the otherwise unused
1073 * WRITE_OWNER permission, which we ignore when we set an ACL.
1074 * We abstract this into a #define of UNIX_ACCESS_NONE to allow this
1075 * to be changed in the future.
1078 if (nt4_compatible_acls())
1079 nt_mask
= UNIX_ACCESS_NONE
;
1083 if (directory_ace
) {
1084 nt_mask
|= ((perms
& S_IRUSR
) ? UNIX_DIRECTORY_ACCESS_R
: 0 );
1085 nt_mask
|= ((perms
& S_IWUSR
) ? UNIX_DIRECTORY_ACCESS_W
: 0 );
1086 nt_mask
|= ((perms
& S_IXUSR
) ? UNIX_DIRECTORY_ACCESS_X
: 0 );
1088 nt_mask
|= ((perms
& S_IRUSR
) ? UNIX_ACCESS_R
: 0 );
1089 nt_mask
|= ((perms
& S_IWUSR
) ? UNIX_ACCESS_W
: 0 );
1090 nt_mask
|= ((perms
& S_IXUSR
) ? UNIX_ACCESS_X
: 0 );
1094 DEBUG(10,("map_canon_ace_perms: Mapped (UNIX) %x to (NT) %x\n",
1095 (unsigned int)perms
, (unsigned int)nt_mask
));
1100 /****************************************************************************
1101 Map NT perms to a UNIX mode_t.
1102 ****************************************************************************/
1104 #define FILE_SPECIFIC_READ_BITS (FILE_READ_DATA|FILE_READ_EA|FILE_READ_ATTRIBUTES)
1105 #define FILE_SPECIFIC_WRITE_BITS (FILE_WRITE_DATA|FILE_APPEND_DATA|FILE_WRITE_EA|FILE_WRITE_ATTRIBUTES)
1106 #define FILE_SPECIFIC_EXECUTE_BITS (FILE_EXECUTE)
1108 static mode_t
map_nt_perms( uint32
*mask
, int type
)
1114 if((*mask
) & GENERIC_ALL_ACCESS
)
1115 mode
= S_IRUSR
|S_IWUSR
|S_IXUSR
;
1117 mode
|= ((*mask
) & (GENERIC_READ_ACCESS
|FILE_SPECIFIC_READ_BITS
)) ? S_IRUSR
: 0;
1118 mode
|= ((*mask
) & (GENERIC_WRITE_ACCESS
|FILE_SPECIFIC_WRITE_BITS
)) ? S_IWUSR
: 0;
1119 mode
|= ((*mask
) & (GENERIC_EXECUTE_ACCESS
|FILE_SPECIFIC_EXECUTE_BITS
)) ? S_IXUSR
: 0;
1123 if((*mask
) & GENERIC_ALL_ACCESS
)
1124 mode
= S_IRGRP
|S_IWGRP
|S_IXGRP
;
1126 mode
|= ((*mask
) & (GENERIC_READ_ACCESS
|FILE_SPECIFIC_READ_BITS
)) ? S_IRGRP
: 0;
1127 mode
|= ((*mask
) & (GENERIC_WRITE_ACCESS
|FILE_SPECIFIC_WRITE_BITS
)) ? S_IWGRP
: 0;
1128 mode
|= ((*mask
) & (GENERIC_EXECUTE_ACCESS
|FILE_SPECIFIC_EXECUTE_BITS
)) ? S_IXGRP
: 0;
1132 if((*mask
) & GENERIC_ALL_ACCESS
)
1133 mode
= S_IROTH
|S_IWOTH
|S_IXOTH
;
1135 mode
|= ((*mask
) & (GENERIC_READ_ACCESS
|FILE_SPECIFIC_READ_BITS
)) ? S_IROTH
: 0;
1136 mode
|= ((*mask
) & (GENERIC_WRITE_ACCESS
|FILE_SPECIFIC_WRITE_BITS
)) ? S_IWOTH
: 0;
1137 mode
|= ((*mask
) & (GENERIC_EXECUTE_ACCESS
|FILE_SPECIFIC_EXECUTE_BITS
)) ? S_IXOTH
: 0;
1145 /****************************************************************************
1146 Unpack a SEC_DESC into a UNIX owner and group.
1147 ****************************************************************************/
1149 NTSTATUS
unpack_nt_owners(int snum
, uid_t
*puser
, gid_t
*pgrp
, uint32 security_info_sent
, const SEC_DESC
*psd
)
1157 if(security_info_sent
== 0) {
1158 DEBUG(0,("unpack_nt_owners: no security info sent !\n"));
1159 return NT_STATUS_OK
;
1163 * Validate the owner and group SID's.
1166 memset(&owner_sid
, '\0', sizeof(owner_sid
));
1167 memset(&grp_sid
, '\0', sizeof(grp_sid
));
1169 DEBUG(5,("unpack_nt_owners: validating owner_sids.\n"));
1172 * Don't immediately fail if the owner sid cannot be validated.
1173 * This may be a group chown only set.
1176 if (security_info_sent
& OWNER_SECURITY_INFORMATION
) {
1177 sid_copy(&owner_sid
, psd
->owner_sid
);
1178 if (!sid_to_uid(&owner_sid
, puser
)) {
1179 if (lp_force_unknown_acl_user(snum
)) {
1180 /* this allows take ownership to work
1182 *puser
= current_user
.ut
.uid
;
1184 DEBUG(3,("unpack_nt_owners: unable to validate"
1185 " owner sid for %s\n",
1186 sid_string_dbg(&owner_sid
)));
1187 return NT_STATUS_INVALID_OWNER
;
1190 DEBUG(3,("unpack_nt_owners: owner sid mapped to uid %u\n",
1191 (unsigned int)*puser
));
1195 * Don't immediately fail if the group sid cannot be validated.
1196 * This may be an owner chown only set.
1199 if (security_info_sent
& GROUP_SECURITY_INFORMATION
) {
1200 sid_copy(&grp_sid
, psd
->group_sid
);
1201 if (!sid_to_gid( &grp_sid
, pgrp
)) {
1202 if (lp_force_unknown_acl_user(snum
)) {
1203 /* this allows take group ownership to work
1205 *pgrp
= current_user
.ut
.gid
;
1207 DEBUG(3,("unpack_nt_owners: unable to validate"
1209 return NT_STATUS_INVALID_OWNER
;
1212 DEBUG(3,("unpack_nt_owners: group sid mapped to gid %u\n",
1213 (unsigned int)*pgrp
));
1216 DEBUG(5,("unpack_nt_owners: owner_sids validated.\n"));
1218 return NT_STATUS_OK
;
1221 /****************************************************************************
1222 Ensure the enforced permissions for this share apply.
1223 ****************************************************************************/
1225 static void apply_default_perms(const struct share_params
*params
,
1226 const bool is_directory
, canon_ace
*pace
,
1229 mode_t and_bits
= (mode_t
)0;
1230 mode_t or_bits
= (mode_t
)0;
1232 /* Get the initial bits to apply. */
1235 and_bits
= lp_dir_security_mask(params
->service
);
1236 or_bits
= lp_force_dir_security_mode(params
->service
);
1238 and_bits
= lp_security_mask(params
->service
);
1239 or_bits
= lp_force_security_mode(params
->service
);
1242 /* Now bounce them into the S_USR space. */
1245 /* Ensure owner has read access. */
1246 pace
->perms
|= S_IRUSR
;
1248 pace
->perms
|= (S_IWUSR
|S_IXUSR
);
1249 and_bits
= unix_perms_to_acl_perms(and_bits
, S_IRUSR
, S_IWUSR
, S_IXUSR
);
1250 or_bits
= unix_perms_to_acl_perms(or_bits
, S_IRUSR
, S_IWUSR
, S_IXUSR
);
1253 and_bits
= unix_perms_to_acl_perms(and_bits
, S_IRGRP
, S_IWGRP
, S_IXGRP
);
1254 or_bits
= unix_perms_to_acl_perms(or_bits
, S_IRGRP
, S_IWGRP
, S_IXGRP
);
1257 and_bits
= unix_perms_to_acl_perms(and_bits
, S_IROTH
, S_IWOTH
, S_IXOTH
);
1258 or_bits
= unix_perms_to_acl_perms(or_bits
, S_IROTH
, S_IWOTH
, S_IXOTH
);
1262 pace
->perms
= ((pace
->perms
& and_bits
)|or_bits
);
1265 /****************************************************************************
1266 Check if a given uid/SID is in a group gid/SID. This is probably very
1267 expensive and will need optimisation. A *lot* of optimisation :-). JRA.
1268 ****************************************************************************/
1270 static bool uid_entry_in_group( canon_ace
*uid_ace
, canon_ace
*group_ace
)
1272 const char *u_name
= NULL
;
1274 /* "Everyone" always matches every uid. */
1276 if (sid_equal(&group_ace
->trustee
, &global_sid_World
))
1280 * if it's the current user, we already have the unix token
1281 * and don't need to do the complex user_in_group_sid() call
1283 if (uid_ace
->unix_ug
.uid
== current_user
.ut
.uid
) {
1286 if (group_ace
->unix_ug
.gid
== current_user
.ut
.gid
) {
1290 for (i
=0; i
< current_user
.ut
.ngroups
; i
++) {
1291 if (group_ace
->unix_ug
.gid
== current_user
.ut
.groups
[i
]) {
1297 /* u_name talloc'ed off tos. */
1298 u_name
= uidtoname(uid_ace
->unix_ug
.uid
);
1304 * user_in_group_sid() uses create_token_from_username()
1305 * which creates an artificial NT token given just a username,
1306 * so this is not reliable for users from foreign domains
1307 * exported by winbindd!
1309 return user_in_group_sid(u_name
, &group_ace
->trustee
);
1312 /****************************************************************************
1313 A well formed POSIX file or default ACL has at least 3 entries, a
1314 SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ.
1315 In addition, the owner must always have at least read access.
1316 When using this call on get_acl, the pst struct is valid and contains
1317 the mode of the file. When using this call on set_acl, the pst struct has
1318 been modified to have a mode containing the default for this file or directory
1320 ****************************************************************************/
1322 static bool ensure_canon_entry_valid(canon_ace
**pp_ace
,
1323 const struct share_params
*params
,
1324 const bool is_directory
,
1325 const DOM_SID
*pfile_owner_sid
,
1326 const DOM_SID
*pfile_grp_sid
,
1327 const SMB_STRUCT_STAT
*pst
,
1331 bool got_user
= False
;
1332 bool got_grp
= False
;
1333 bool got_other
= False
;
1334 canon_ace
*pace_other
= NULL
;
1336 for (pace
= *pp_ace
; pace
; pace
= pace
->next
) {
1337 if (pace
->type
== SMB_ACL_USER_OBJ
) {
1340 apply_default_perms(params
, is_directory
, pace
, S_IRUSR
);
1343 } else if (pace
->type
== SMB_ACL_GROUP_OBJ
) {
1346 * Ensure create mask/force create mode is respected on set.
1350 apply_default_perms(params
, is_directory
, pace
, S_IRGRP
);
1353 } else if (pace
->type
== SMB_ACL_OTHER
) {
1356 * Ensure create mask/force create mode is respected on set.
1360 apply_default_perms(params
, is_directory
, pace
, S_IROTH
);
1367 if ((pace
= SMB_MALLOC_P(canon_ace
)) == NULL
) {
1368 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1373 pace
->type
= SMB_ACL_USER_OBJ
;
1374 pace
->owner_type
= UID_ACE
;
1375 pace
->unix_ug
.uid
= pst
->st_ex_uid
;
1376 pace
->trustee
= *pfile_owner_sid
;
1377 pace
->attr
= ALLOW_ACE
;
1380 /* See if the owning user is in any of the other groups in
1381 the ACE. If so, OR in the permissions from that group. */
1383 bool group_matched
= False
;
1384 canon_ace
*pace_iter
;
1386 for (pace_iter
= *pp_ace
; pace_iter
; pace_iter
= pace_iter
->next
) {
1387 if (pace_iter
->type
== SMB_ACL_GROUP_OBJ
|| pace_iter
->type
== SMB_ACL_GROUP
) {
1388 if (uid_entry_in_group(pace
, pace_iter
)) {
1389 pace
->perms
|= pace_iter
->perms
;
1390 group_matched
= True
;
1395 /* If we only got an "everyone" perm, just use that. */
1396 if (!group_matched
) {
1398 pace
->perms
= pace_other
->perms
;
1403 apply_default_perms(params
, is_directory
, pace
, S_IRUSR
);
1405 pace
->perms
= unix_perms_to_acl_perms(pst
->st_ex_mode
, S_IRUSR
, S_IWUSR
, S_IXUSR
);
1408 DLIST_ADD(*pp_ace
, pace
);
1412 if ((pace
= SMB_MALLOC_P(canon_ace
)) == NULL
) {
1413 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1418 pace
->type
= SMB_ACL_GROUP_OBJ
;
1419 pace
->owner_type
= GID_ACE
;
1420 pace
->unix_ug
.uid
= pst
->st_ex_gid
;
1421 pace
->trustee
= *pfile_grp_sid
;
1422 pace
->attr
= ALLOW_ACE
;
1424 /* If we only got an "everyone" perm, just use that. */
1426 pace
->perms
= pace_other
->perms
;
1429 apply_default_perms(params
, is_directory
, pace
, S_IRGRP
);
1431 pace
->perms
= unix_perms_to_acl_perms(pst
->st_ex_mode
, S_IRGRP
, S_IWGRP
, S_IXGRP
);
1434 DLIST_ADD(*pp_ace
, pace
);
1438 if ((pace
= SMB_MALLOC_P(canon_ace
)) == NULL
) {
1439 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1444 pace
->type
= SMB_ACL_OTHER
;
1445 pace
->owner_type
= WORLD_ACE
;
1446 pace
->unix_ug
.world
= -1;
1447 pace
->trustee
= global_sid_World
;
1448 pace
->attr
= ALLOW_ACE
;
1451 apply_default_perms(params
, is_directory
, pace
, S_IROTH
);
1453 pace
->perms
= unix_perms_to_acl_perms(pst
->st_ex_mode
, S_IROTH
, S_IWOTH
, S_IXOTH
);
1455 DLIST_ADD(*pp_ace
, pace
);
1461 /****************************************************************************
1462 Check if a POSIX ACL has the required SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries.
1463 If it does not have them, check if there are any entries where the trustee is the
1464 file owner or the owning group, and map these to SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ.
1465 ****************************************************************************/
1467 static void check_owning_objs(canon_ace
*ace
, DOM_SID
*pfile_owner_sid
, DOM_SID
*pfile_grp_sid
)
1469 bool got_user_obj
, got_group_obj
;
1470 canon_ace
*current_ace
;
1473 entries
= count_canon_ace_list(ace
);
1474 got_user_obj
= False
;
1475 got_group_obj
= False
;
1477 for (i
=0, current_ace
= ace
; i
< entries
; i
++, current_ace
= current_ace
->next
) {
1478 if (current_ace
->type
== SMB_ACL_USER_OBJ
)
1479 got_user_obj
= True
;
1480 else if (current_ace
->type
== SMB_ACL_GROUP_OBJ
)
1481 got_group_obj
= True
;
1483 if (got_user_obj
&& got_group_obj
) {
1484 DEBUG(10,("check_owning_objs: ACL had owning user/group entries.\n"));
1488 for (i
=0, current_ace
= ace
; i
< entries
; i
++, current_ace
= current_ace
->next
) {
1489 if (!got_user_obj
&& current_ace
->owner_type
== UID_ACE
&&
1490 sid_equal(¤t_ace
->trustee
, pfile_owner_sid
)) {
1491 current_ace
->type
= SMB_ACL_USER_OBJ
;
1492 got_user_obj
= True
;
1494 if (!got_group_obj
&& current_ace
->owner_type
== GID_ACE
&&
1495 sid_equal(¤t_ace
->trustee
, pfile_grp_sid
)) {
1496 current_ace
->type
= SMB_ACL_GROUP_OBJ
;
1497 got_group_obj
= True
;
1501 DEBUG(10,("check_owning_objs: ACL is missing an owner entry.\n"));
1503 DEBUG(10,("check_owning_objs: ACL is missing an owning group entry.\n"));
1506 /****************************************************************************
1507 Unpack a SEC_DESC into two canonical ace lists.
1508 ****************************************************************************/
1510 static bool create_canon_ace_lists(files_struct
*fsp
,
1511 SMB_STRUCT_STAT
*pst
,
1512 DOM_SID
*pfile_owner_sid
,
1513 DOM_SID
*pfile_grp_sid
,
1514 canon_ace
**ppfile_ace
,
1515 canon_ace
**ppdir_ace
,
1516 const SEC_ACL
*dacl
)
1518 bool all_aces_are_inherit_only
= (fsp
->is_directory
? True
: False
);
1519 canon_ace
*file_ace
= NULL
;
1520 canon_ace
*dir_ace
= NULL
;
1521 canon_ace
*current_ace
= NULL
;
1522 bool got_dir_allow
= False
;
1523 bool got_file_allow
= False
;
1530 * Convert the incoming ACL into a more regular form.
1533 for(i
= 0; i
< dacl
->num_aces
; i
++) {
1534 SEC_ACE
*psa
= &dacl
->aces
[i
];
1536 if((psa
->type
!= SEC_ACE_TYPE_ACCESS_ALLOWED
) && (psa
->type
!= SEC_ACE_TYPE_ACCESS_DENIED
)) {
1537 DEBUG(3,("create_canon_ace_lists: unable to set anything but an ALLOW or DENY ACE.\n"));
1541 if (nt4_compatible_acls()) {
1543 * The security mask may be UNIX_ACCESS_NONE which should map into
1544 * no permissions (we overload the WRITE_OWNER bit for this) or it
1545 * should be one of the ALL/EXECUTE/READ/WRITE bits. Arrange for this
1546 * to be so. Any other bits override the UNIX_ACCESS_NONE bit.
1550 * Convert GENERIC bits to specific bits.
1553 se_map_generic(&psa
->access_mask
, &file_generic_mapping
);
1555 psa
->access_mask
&= (UNIX_ACCESS_NONE
|FILE_ALL_ACCESS
);
1557 if(psa
->access_mask
!= UNIX_ACCESS_NONE
)
1558 psa
->access_mask
&= ~UNIX_ACCESS_NONE
;
1563 * Deal with the fact that NT 4.x re-writes the canonical format
1564 * that we return for default ACLs. If a directory ACE is identical
1565 * to a inherited directory ACE then NT changes the bits so that the
1566 * first ACE is set to OI|IO and the second ACE for this SID is set
1567 * to CI. We need to repair this. JRA.
1570 for(i
= 0; i
< dacl
->num_aces
; i
++) {
1571 SEC_ACE
*psa1
= &dacl
->aces
[i
];
1573 for (j
= i
+ 1; j
< dacl
->num_aces
; j
++) {
1574 SEC_ACE
*psa2
= &dacl
->aces
[j
];
1576 if (psa1
->access_mask
!= psa2
->access_mask
)
1579 if (!sid_equal(&psa1
->trustee
, &psa2
->trustee
))
1583 * Ok - permission bits and SIDs are equal.
1584 * Check if flags were re-written.
1587 if (psa1
->flags
& SEC_ACE_FLAG_INHERIT_ONLY
) {
1589 psa1
->flags
|= (psa2
->flags
& (SEC_ACE_FLAG_CONTAINER_INHERIT
|SEC_ACE_FLAG_OBJECT_INHERIT
));
1590 psa2
->flags
&= ~(SEC_ACE_FLAG_CONTAINER_INHERIT
|SEC_ACE_FLAG_OBJECT_INHERIT
);
1592 } else if (psa2
->flags
& SEC_ACE_FLAG_INHERIT_ONLY
) {
1594 psa2
->flags
|= (psa1
->flags
& (SEC_ACE_FLAG_CONTAINER_INHERIT
|SEC_ACE_FLAG_OBJECT_INHERIT
));
1595 psa1
->flags
&= ~(SEC_ACE_FLAG_CONTAINER_INHERIT
|SEC_ACE_FLAG_OBJECT_INHERIT
);
1601 for(i
= 0; i
< dacl
->num_aces
; i
++) {
1602 SEC_ACE
*psa
= &dacl
->aces
[i
];
1605 * Create a cannon_ace entry representing this NT DACL ACE.
1608 if ((current_ace
= SMB_MALLOC_P(canon_ace
)) == NULL
) {
1609 free_canon_ace_list(file_ace
);
1610 free_canon_ace_list(dir_ace
);
1611 DEBUG(0,("create_canon_ace_lists: malloc fail.\n"));
1615 ZERO_STRUCTP(current_ace
);
1617 sid_copy(¤t_ace
->trustee
, &psa
->trustee
);
1620 * Try and work out if the SID is a user or group
1621 * as we need to flag these differently for POSIX.
1622 * Note what kind of a POSIX ACL this should map to.
1625 if( sid_equal(¤t_ace
->trustee
, &global_sid_World
)) {
1626 current_ace
->owner_type
= WORLD_ACE
;
1627 current_ace
->unix_ug
.world
= -1;
1628 current_ace
->type
= SMB_ACL_OTHER
;
1629 } else if (sid_equal(¤t_ace
->trustee
, &global_sid_Creator_Owner
)) {
1630 current_ace
->owner_type
= UID_ACE
;
1631 current_ace
->unix_ug
.uid
= pst
->st_ex_uid
;
1632 current_ace
->type
= SMB_ACL_USER_OBJ
;
1635 * The Creator Owner entry only specifies inheritable permissions,
1636 * never access permissions. WinNT doesn't always set the ACE to
1637 *INHERIT_ONLY, though.
1640 if (nt4_compatible_acls())
1641 psa
->flags
|= SEC_ACE_FLAG_INHERIT_ONLY
;
1642 } else if (sid_equal(¤t_ace
->trustee
, &global_sid_Creator_Group
)) {
1643 current_ace
->owner_type
= GID_ACE
;
1644 current_ace
->unix_ug
.gid
= pst
->st_ex_gid
;
1645 current_ace
->type
= SMB_ACL_GROUP_OBJ
;
1648 * The Creator Group entry only specifies inheritable permissions,
1649 * never access permissions. WinNT doesn't always set the ACE to
1650 *INHERIT_ONLY, though.
1652 if (nt4_compatible_acls())
1653 psa
->flags
|= SEC_ACE_FLAG_INHERIT_ONLY
;
1655 } else if (sid_to_uid( ¤t_ace
->trustee
, ¤t_ace
->unix_ug
.uid
)) {
1656 current_ace
->owner_type
= UID_ACE
;
1657 /* If it's the owning user, this is a user_obj, not
1659 if (current_ace
->unix_ug
.uid
== pst
->st_ex_uid
) {
1660 current_ace
->type
= SMB_ACL_USER_OBJ
;
1662 current_ace
->type
= SMB_ACL_USER
;
1664 } else if (sid_to_gid( ¤t_ace
->trustee
, ¤t_ace
->unix_ug
.gid
)) {
1665 current_ace
->owner_type
= GID_ACE
;
1666 /* If it's the primary group, this is a group_obj, not
1668 if (current_ace
->unix_ug
.gid
== pst
->st_ex_gid
) {
1669 current_ace
->type
= SMB_ACL_GROUP_OBJ
;
1671 current_ace
->type
= SMB_ACL_GROUP
;
1675 * Silently ignore map failures in non-mappable SIDs (NT Authority, BUILTIN etc).
1678 if (non_mappable_sid(&psa
->trustee
)) {
1679 DEBUG(10, ("create_canon_ace_lists: ignoring "
1680 "non-mappable SID %s\n",
1681 sid_string_dbg(&psa
->trustee
)));
1682 SAFE_FREE(current_ace
);
1686 free_canon_ace_list(file_ace
);
1687 free_canon_ace_list(dir_ace
);
1688 DEBUG(0, ("create_canon_ace_lists: unable to map SID "
1689 "%s to uid or gid.\n",
1690 sid_string_dbg(¤t_ace
->trustee
)));
1691 SAFE_FREE(current_ace
);
1696 * Map the given NT permissions into a UNIX mode_t containing only
1697 * S_I(R|W|X)USR bits.
1700 current_ace
->perms
|= map_nt_perms( &psa
->access_mask
, S_IRUSR
);
1701 current_ace
->attr
= (psa
->type
== SEC_ACE_TYPE_ACCESS_ALLOWED
) ? ALLOW_ACE
: DENY_ACE
;
1703 /* Store the ace_flag. */
1704 current_ace
->ace_flags
= psa
->flags
;
1707 * Now add the created ace to either the file list, the directory
1708 * list, or both. We *MUST* preserve the order here (hence we use
1709 * DLIST_ADD_END) as NT ACLs are order dependent.
1712 if (fsp
->is_directory
) {
1715 * We can only add to the default POSIX ACE list if the ACE is
1716 * designed to be inherited by both files and directories.
1719 if ((psa
->flags
& (SEC_ACE_FLAG_OBJECT_INHERIT
|SEC_ACE_FLAG_CONTAINER_INHERIT
)) ==
1720 (SEC_ACE_FLAG_OBJECT_INHERIT
|SEC_ACE_FLAG_CONTAINER_INHERIT
)) {
1722 DLIST_ADD_END(dir_ace
, current_ace
, canon_ace
*);
1725 * Note if this was an allow ace. We can't process
1726 * any further deny ace's after this.
1729 if (current_ace
->attr
== ALLOW_ACE
)
1730 got_dir_allow
= True
;
1732 if ((current_ace
->attr
== DENY_ACE
) && got_dir_allow
) {
1733 DEBUG(0,("create_canon_ace_lists: "
1735 "inheritable ACL! Deny entry "
1736 "after Allow entry. Failing "
1737 "to set on file %s.\n",
1739 free_canon_ace_list(file_ace
);
1740 free_canon_ace_list(dir_ace
);
1744 if( DEBUGLVL( 10 )) {
1745 dbgtext("create_canon_ace_lists: adding dir ACL:\n");
1746 print_canon_ace( current_ace
, 0);
1750 * If this is not an inherit only ACE we need to add a duplicate
1754 if (!(psa
->flags
& SEC_ACE_FLAG_INHERIT_ONLY
)) {
1755 canon_ace
*dup_ace
= dup_canon_ace(current_ace
);
1758 DEBUG(0,("create_canon_ace_lists: malloc fail !\n"));
1759 free_canon_ace_list(file_ace
);
1760 free_canon_ace_list(dir_ace
);
1765 * We must not free current_ace here as its
1766 * pointer is now owned by the dir_ace list.
1768 current_ace
= dup_ace
;
1771 * We must not free current_ace here as its
1772 * pointer is now owned by the dir_ace list.
1780 * Only add to the file ACL if not inherit only.
1783 if (current_ace
&& !(psa
->flags
& SEC_ACE_FLAG_INHERIT_ONLY
)) {
1784 DLIST_ADD_END(file_ace
, current_ace
, canon_ace
*);
1787 * Note if this was an allow ace. We can't process
1788 * any further deny ace's after this.
1791 if (current_ace
->attr
== ALLOW_ACE
)
1792 got_file_allow
= True
;
1794 if ((current_ace
->attr
== DENY_ACE
) && got_file_allow
) {
1795 DEBUG(0,("create_canon_ace_lists: malformed "
1796 "ACL in file ACL ! Deny entry after "
1797 "Allow entry. Failing to set on file "
1798 "%s.\n", fsp_str_dbg(fsp
)));
1799 free_canon_ace_list(file_ace
);
1800 free_canon_ace_list(dir_ace
);
1804 if( DEBUGLVL( 10 )) {
1805 dbgtext("create_canon_ace_lists: adding file ACL:\n");
1806 print_canon_ace( current_ace
, 0);
1808 all_aces_are_inherit_only
= False
;
1810 * We must not free current_ace here as its
1811 * pointer is now owned by the file_ace list.
1817 * Free if ACE was not added.
1820 SAFE_FREE(current_ace
);
1823 if (fsp
->is_directory
&& all_aces_are_inherit_only
) {
1825 * Windows 2000 is doing one of these weird 'inherit acl'
1826 * traverses to conserve NTFS ACL resources. Just pretend
1827 * there was no DACL sent. JRA.
1830 DEBUG(10,("create_canon_ace_lists: Win2k inherit acl traverse. Ignoring DACL.\n"));
1831 free_canon_ace_list(file_ace
);
1832 free_canon_ace_list(dir_ace
);
1837 * Check if we have SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries in each
1838 * ACL. If we don't have them, check if any SMB_ACL_USER/SMB_ACL_GROUP
1839 * entries can be converted to *_OBJ. Usually we will already have these
1840 * entries in the Default ACL, and the Access ACL will not have them.
1843 check_owning_objs(file_ace
, pfile_owner_sid
, pfile_grp_sid
);
1846 check_owning_objs(dir_ace
, pfile_owner_sid
, pfile_grp_sid
);
1850 *ppfile_ace
= file_ace
;
1851 *ppdir_ace
= dir_ace
;
1856 /****************************************************************************
1857 ASCII art time again... JRA :-).
1859 We have 4 cases to process when moving from an NT ACL to a POSIX ACL. Firstly,
1860 we insist the ACL is in canonical form (ie. all DENY entries preceede ALLOW
1861 entries). Secondly, the merge code has ensured that all duplicate SID entries for
1862 allow or deny have been merged, so the same SID can only appear once in the deny
1863 list or once in the allow list.
1865 We then process as follows :
1867 ---------------------------------------------------------------------------
1868 First pass - look for a Everyone DENY entry.
1870 If it is deny all (rwx) trunate the list at this point.
1871 Else, walk the list from this point and use the deny permissions of this
1872 entry as a mask on all following allow entries. Finally, delete
1873 the Everyone DENY entry (we have applied it to everything possible).
1875 In addition, in this pass we remove any DENY entries that have
1876 no permissions (ie. they are a DENY nothing).
1877 ---------------------------------------------------------------------------
1878 Second pass - only deal with deny user entries.
1880 DENY user1 (perms XXX)
1883 for all following allow group entries where user1 is in group
1884 new_perms |= group_perms;
1886 user1 entry perms = new_perms & ~ XXX;
1888 Convert the deny entry to an allow entry with the new perms and
1889 push to the end of the list. Note if the user was in no groups
1890 this maps to a specific allow nothing entry for this user.
1892 The common case from the NT ACL choser (userX deny all) is
1893 optimised so we don't do the group lookup - we just map to
1894 an allow nothing entry.
1896 What we're doing here is inferring the allow permissions the
1897 person setting the ACE on user1 wanted by looking at the allow
1898 permissions on the groups the user is currently in. This will
1899 be a snapshot, depending on group membership but is the best
1900 we can do and has the advantage of failing closed rather than
1902 ---------------------------------------------------------------------------
1903 Third pass - only deal with deny group entries.
1905 DENY group1 (perms XXX)
1907 for all following allow user entries where user is in group1
1908 user entry perms = user entry perms & ~ XXX;
1910 If there is a group Everyone allow entry with permissions YYY,
1911 convert the group1 entry to an allow entry and modify its
1914 new_perms = YYY & ~ XXX
1916 and push to the end of the list.
1918 If there is no group Everyone allow entry then convert the
1919 group1 entry to a allow nothing entry and push to the end of the list.
1921 Note that the common case from the NT ACL choser (groupX deny all)
1922 cannot be optimised here as we need to modify user entries who are
1923 in the group to change them to a deny all also.
1925 What we're doing here is modifying the allow permissions of
1926 user entries (which are more specific in POSIX ACLs) to mask
1927 out the explicit deny set on the group they are in. This will
1928 be a snapshot depending on current group membership but is the
1929 best we can do and has the advantage of failing closed rather
1931 ---------------------------------------------------------------------------
1932 Fourth pass - cope with cumulative permissions.
1934 for all allow user entries, if there exists an allow group entry with
1935 more permissive permissions, and the user is in that group, rewrite the
1936 allow user permissions to contain both sets of permissions.
1938 Currently the code for this is #ifdef'ed out as these semantics make
1939 no sense to me. JRA.
1940 ---------------------------------------------------------------------------
1942 Note we *MUST* do the deny user pass first as this will convert deny user
1943 entries into allow user entries which can then be processed by the deny
1946 The above algorithm took a *lot* of thinking about - hence this
1947 explaination :-). JRA.
1948 ****************************************************************************/
1950 /****************************************************************************
1951 Process a canon_ace list entries. This is very complex code. We need
1952 to go through and remove the "deny" permissions from any allow entry that matches
1953 the id of this entry. We have already refused any NT ACL that wasn't in correct
1954 order (DENY followed by ALLOW). If any allow entry ends up with zero permissions,
1955 we just remove it (to fail safe). We have already removed any duplicate ace
1956 entries. Treat an "Everyone" DENY_ACE as a special case - use it to mask all
1958 ****************************************************************************/
1960 static void process_deny_list( canon_ace
**pp_ace_list
)
1962 canon_ace
*ace_list
= *pp_ace_list
;
1963 canon_ace
*curr_ace
= NULL
;
1964 canon_ace
*curr_ace_next
= NULL
;
1966 /* Pass 1 above - look for an Everyone, deny entry. */
1968 for (curr_ace
= ace_list
; curr_ace
; curr_ace
= curr_ace_next
) {
1969 canon_ace
*allow_ace_p
;
1971 curr_ace_next
= curr_ace
->next
; /* So we can't lose the link. */
1973 if (curr_ace
->attr
!= DENY_ACE
)
1976 if (curr_ace
->perms
== (mode_t
)0) {
1978 /* Deny nothing entry - delete. */
1980 DLIST_REMOVE(ace_list
, curr_ace
);
1984 if (!sid_equal(&curr_ace
->trustee
, &global_sid_World
))
1987 /* JRATEST - assert. */
1988 SMB_ASSERT(curr_ace
->owner_type
== WORLD_ACE
);
1990 if (curr_ace
->perms
== ALL_ACE_PERMS
) {
1993 * Optimisation. This is a DENY_ALL to Everyone. Truncate the
1994 * list at this point including this entry.
1997 canon_ace
*prev_entry
= curr_ace
->prev
;
1999 free_canon_ace_list( curr_ace
);
2001 prev_entry
->next
= NULL
;
2003 /* We deleted the entire list. */
2009 for (allow_ace_p
= curr_ace
->next
; allow_ace_p
; allow_ace_p
= allow_ace_p
->next
) {
2012 * Only mask off allow entries.
2015 if (allow_ace_p
->attr
!= ALLOW_ACE
)
2018 allow_ace_p
->perms
&= ~curr_ace
->perms
;
2022 * Now it's been applied, remove it.
2025 DLIST_REMOVE(ace_list
, curr_ace
);
2028 /* Pass 2 above - deal with deny user entries. */
2030 for (curr_ace
= ace_list
; curr_ace
; curr_ace
= curr_ace_next
) {
2031 mode_t new_perms
= (mode_t
)0;
2032 canon_ace
*allow_ace_p
;
2034 curr_ace_next
= curr_ace
->next
; /* So we can't lose the link. */
2036 if (curr_ace
->attr
!= DENY_ACE
)
2039 if (curr_ace
->owner_type
!= UID_ACE
)
2042 if (curr_ace
->perms
== ALL_ACE_PERMS
) {
2045 * Optimisation - this is a deny everything to this user.
2046 * Convert to an allow nothing and push to the end of the list.
2049 curr_ace
->attr
= ALLOW_ACE
;
2050 curr_ace
->perms
= (mode_t
)0;
2051 DLIST_DEMOTE(ace_list
, curr_ace
, canon_ace
*);
2055 for (allow_ace_p
= curr_ace
->next
; allow_ace_p
; allow_ace_p
= allow_ace_p
->next
) {
2057 if (allow_ace_p
->attr
!= ALLOW_ACE
)
2060 /* We process GID_ACE and WORLD_ACE entries only. */
2062 if (allow_ace_p
->owner_type
== UID_ACE
)
2065 if (uid_entry_in_group( curr_ace
, allow_ace_p
))
2066 new_perms
|= allow_ace_p
->perms
;
2070 * Convert to a allow entry, modify the perms and push to the end
2074 curr_ace
->attr
= ALLOW_ACE
;
2075 curr_ace
->perms
= (new_perms
& ~curr_ace
->perms
);
2076 DLIST_DEMOTE(ace_list
, curr_ace
, canon_ace
*);
2079 /* Pass 3 above - deal with deny group entries. */
2081 for (curr_ace
= ace_list
; curr_ace
; curr_ace
= curr_ace_next
) {
2082 canon_ace
*allow_ace_p
;
2083 canon_ace
*allow_everyone_p
= NULL
;
2085 curr_ace_next
= curr_ace
->next
; /* So we can't lose the link. */
2087 if (curr_ace
->attr
!= DENY_ACE
)
2090 if (curr_ace
->owner_type
!= GID_ACE
)
2093 for (allow_ace_p
= curr_ace
->next
; allow_ace_p
; allow_ace_p
= allow_ace_p
->next
) {
2095 if (allow_ace_p
->attr
!= ALLOW_ACE
)
2098 /* Store a pointer to the Everyone allow, if it exists. */
2099 if (allow_ace_p
->owner_type
== WORLD_ACE
)
2100 allow_everyone_p
= allow_ace_p
;
2102 /* We process UID_ACE entries only. */
2104 if (allow_ace_p
->owner_type
!= UID_ACE
)
2107 /* Mask off the deny group perms. */
2109 if (uid_entry_in_group( allow_ace_p
, curr_ace
))
2110 allow_ace_p
->perms
&= ~curr_ace
->perms
;
2114 * Convert the deny to an allow with the correct perms and
2115 * push to the end of the list.
2118 curr_ace
->attr
= ALLOW_ACE
;
2119 if (allow_everyone_p
)
2120 curr_ace
->perms
= allow_everyone_p
->perms
& ~curr_ace
->perms
;
2122 curr_ace
->perms
= (mode_t
)0;
2123 DLIST_DEMOTE(ace_list
, curr_ace
, canon_ace
*);
2126 /* Doing this fourth pass allows Windows semantics to be layered
2127 * on top of POSIX semantics. I'm not sure if this is desirable.
2128 * For example, in W2K ACLs there is no way to say, "Group X no
2129 * access, user Y full access" if user Y is a member of group X.
2130 * This seems completely broken semantics to me.... JRA.
2134 /* Pass 4 above - deal with allow entries. */
2136 for (curr_ace
= ace_list
; curr_ace
; curr_ace
= curr_ace_next
) {
2137 canon_ace
*allow_ace_p
;
2139 curr_ace_next
= curr_ace
->next
; /* So we can't lose the link. */
2141 if (curr_ace
->attr
!= ALLOW_ACE
)
2144 if (curr_ace
->owner_type
!= UID_ACE
)
2147 for (allow_ace_p
= ace_list
; allow_ace_p
; allow_ace_p
= allow_ace_p
->next
) {
2149 if (allow_ace_p
->attr
!= ALLOW_ACE
)
2152 /* We process GID_ACE entries only. */
2154 if (allow_ace_p
->owner_type
!= GID_ACE
)
2157 /* OR in the group perms. */
2159 if (uid_entry_in_group( curr_ace
, allow_ace_p
))
2160 curr_ace
->perms
|= allow_ace_p
->perms
;
2165 *pp_ace_list
= ace_list
;
2168 /****************************************************************************
2169 Create a default mode that will be used if a security descriptor entry has
2170 no user/group/world entries.
2171 ****************************************************************************/
2173 static mode_t
create_default_mode(files_struct
*fsp
, bool interitable_mode
)
2175 int snum
= SNUM(fsp
->conn
);
2176 mode_t and_bits
= (mode_t
)0;
2177 mode_t or_bits
= (mode_t
)0;
2180 if (interitable_mode
) {
2181 mode
= unix_mode(fsp
->conn
, FILE_ATTRIBUTE_ARCHIVE
,
2182 fsp
->fsp_name
, NULL
);
2187 if (fsp
->is_directory
)
2188 mode
|= (S_IWUSR
|S_IXUSR
);
2191 * Now AND with the create mode/directory mode bits then OR with the
2192 * force create mode/force directory mode bits.
2195 if (fsp
->is_directory
) {
2196 and_bits
= lp_dir_security_mask(snum
);
2197 or_bits
= lp_force_dir_security_mode(snum
);
2199 and_bits
= lp_security_mask(snum
);
2200 or_bits
= lp_force_security_mode(snum
);
2203 return ((mode
& and_bits
)|or_bits
);
2206 /****************************************************************************
2207 Unpack a SEC_DESC into two canonical ace lists. We don't depend on this
2209 ****************************************************************************/
2211 static bool unpack_canon_ace(files_struct
*fsp
,
2212 SMB_STRUCT_STAT
*pst
,
2213 DOM_SID
*pfile_owner_sid
,
2214 DOM_SID
*pfile_grp_sid
,
2215 canon_ace
**ppfile_ace
,
2216 canon_ace
**ppdir_ace
,
2217 uint32 security_info_sent
,
2218 const SEC_DESC
*psd
)
2220 canon_ace
*file_ace
= NULL
;
2221 canon_ace
*dir_ace
= NULL
;
2226 if(security_info_sent
== 0) {
2227 DEBUG(0,("unpack_canon_ace: no security info sent !\n"));
2232 * If no DACL then this is a chown only security descriptor.
2235 if(!(security_info_sent
& DACL_SECURITY_INFORMATION
) || !psd
->dacl
)
2239 * Now go through the DACL and create the canon_ace lists.
2242 if (!create_canon_ace_lists( fsp
, pst
, pfile_owner_sid
, pfile_grp_sid
,
2243 &file_ace
, &dir_ace
, psd
->dacl
))
2246 if ((file_ace
== NULL
) && (dir_ace
== NULL
)) {
2247 /* W2K traverse DACL set - ignore. */
2252 * Go through the canon_ace list and merge entries
2253 * belonging to identical users of identical allow or deny type.
2254 * We can do this as all deny entries come first, followed by
2255 * all allow entries (we have mandated this before accepting this acl).
2258 print_canon_ace_list( "file ace - before merge", file_ace
);
2259 merge_aces( &file_ace
);
2261 print_canon_ace_list( "dir ace - before merge", dir_ace
);
2262 merge_aces( &dir_ace
);
2265 * NT ACLs are order dependent. Go through the acl lists and
2266 * process DENY entries by masking the allow entries.
2269 print_canon_ace_list( "file ace - before deny", file_ace
);
2270 process_deny_list( &file_ace
);
2272 print_canon_ace_list( "dir ace - before deny", dir_ace
);
2273 process_deny_list( &dir_ace
);
2276 * A well formed POSIX file or default ACL has at least 3 entries, a
2277 * SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ
2278 * and optionally a mask entry. Ensure this is the case.
2281 print_canon_ace_list( "file ace - before valid", file_ace
);
2284 * A default 3 element mode entry for a file should be r-- --- ---.
2285 * A default 3 element mode entry for a directory should be rwx --- ---.
2288 pst
->st_ex_mode
= create_default_mode(fsp
, False
);
2290 if (!ensure_canon_entry_valid(&file_ace
, fsp
->conn
->params
, fsp
->is_directory
, pfile_owner_sid
, pfile_grp_sid
, pst
, True
)) {
2291 free_canon_ace_list(file_ace
);
2292 free_canon_ace_list(dir_ace
);
2296 print_canon_ace_list( "dir ace - before valid", dir_ace
);
2299 * A default inheritable 3 element mode entry for a directory should be the
2300 * mode Samba will use to create a file within. Ensure user rwx bits are set if
2304 pst
->st_ex_mode
= create_default_mode(fsp
, True
);
2306 if (dir_ace
&& !ensure_canon_entry_valid(&dir_ace
, fsp
->conn
->params
, fsp
->is_directory
, pfile_owner_sid
, pfile_grp_sid
, pst
, True
)) {
2307 free_canon_ace_list(file_ace
);
2308 free_canon_ace_list(dir_ace
);
2312 print_canon_ace_list( "file ace - return", file_ace
);
2313 print_canon_ace_list( "dir ace - return", dir_ace
);
2315 *ppfile_ace
= file_ace
;
2316 *ppdir_ace
= dir_ace
;
2321 /******************************************************************************
2322 When returning permissions, try and fit NT display
2323 semantics if possible. Note the the canon_entries here must have been malloced.
2324 The list format should be - first entry = owner, followed by group and other user
2325 entries, last entry = other.
2327 Note that this doesn't exactly match the NT semantics for an ACL. As POSIX entries
2328 are not ordered, and match on the most specific entry rather than walking a list,
2329 then a simple POSIX permission of rw-r--r-- should really map to 5 entries,
2331 Entry 0: owner : deny all except read and write.
2332 Entry 1: owner : allow read and write.
2333 Entry 2: group : deny all except read.
2334 Entry 3: group : allow read.
2335 Entry 4: Everyone : allow read.
2337 But NT cannot display this in their ACL editor !
2338 ********************************************************************************/
2340 static void arrange_posix_perms(const char *filename
, canon_ace
**pp_list_head
)
2342 canon_ace
*l_head
= *pp_list_head
;
2343 canon_ace
*owner_ace
= NULL
;
2344 canon_ace
*other_ace
= NULL
;
2345 canon_ace
*ace
= NULL
;
2347 for (ace
= l_head
; ace
; ace
= ace
->next
) {
2348 if (ace
->type
== SMB_ACL_USER_OBJ
)
2350 else if (ace
->type
== SMB_ACL_OTHER
) {
2351 /* Last ace - this is "other" */
2356 if (!owner_ace
|| !other_ace
) {
2357 DEBUG(0,("arrange_posix_perms: Invalid POSIX permissions for file %s, missing owner or other.\n",
2363 * The POSIX algorithm applies to owner first, and other last,
2364 * so ensure they are arranged in this order.
2368 DLIST_PROMOTE(l_head
, owner_ace
);
2372 DLIST_DEMOTE(l_head
, other_ace
, canon_ace
*);
2375 /* We have probably changed the head of the list. */
2377 *pp_list_head
= l_head
;
2380 /****************************************************************************
2381 Create a linked list of canonical ACE entries.
2382 ****************************************************************************/
2384 static canon_ace
*canonicalise_acl(struct connection_struct
*conn
,
2385 const char *fname
, SMB_ACL_T posix_acl
,
2386 const SMB_STRUCT_STAT
*psbuf
,
2387 const DOM_SID
*powner
, const DOM_SID
*pgroup
, struct pai_val
*pal
, SMB_ACL_TYPE_T the_acl_type
)
2389 mode_t acl_mask
= (S_IRUSR
|S_IWUSR
|S_IXUSR
);
2390 canon_ace
*l_head
= NULL
;
2391 canon_ace
*ace
= NULL
;
2392 canon_ace
*next_ace
= NULL
;
2393 int entry_id
= SMB_ACL_FIRST_ENTRY
;
2394 SMB_ACL_ENTRY_T entry
;
2397 while ( posix_acl
&& (SMB_VFS_SYS_ACL_GET_ENTRY(conn
, posix_acl
, entry_id
, &entry
) == 1)) {
2398 SMB_ACL_TAG_T tagtype
;
2399 SMB_ACL_PERMSET_T permset
;
2402 enum ace_owner owner_type
;
2404 entry_id
= SMB_ACL_NEXT_ENTRY
;
2406 /* Is this a MASK entry ? */
2407 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn
, entry
, &tagtype
) == -1)
2410 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn
, entry
, &permset
) == -1)
2413 /* Decide which SID to use based on the ACL type. */
2415 case SMB_ACL_USER_OBJ
:
2416 /* Get the SID from the owner. */
2417 sid_copy(&sid
, powner
);
2418 unix_ug
.uid
= psbuf
->st_ex_uid
;
2419 owner_type
= UID_ACE
;
2423 uid_t
*puid
= (uid_t
*)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn
, entry
);
2425 DEBUG(0,("canonicalise_acl: Failed to get uid.\n"));
2429 * A SMB_ACL_USER entry for the owner is shadowed by the
2430 * SMB_ACL_USER_OBJ entry and Windows also cannot represent
2431 * that entry, so we ignore it. We also don't create such
2432 * entries out of the blue when setting ACLs, so a get/set
2433 * cycle will drop them.
2435 if (the_acl_type
== SMB_ACL_TYPE_ACCESS
&& *puid
== psbuf
->st_ex_uid
) {
2436 SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn
, (void *)puid
,tagtype
);
2439 uid_to_sid( &sid
, *puid
);
2440 unix_ug
.uid
= *puid
;
2441 owner_type
= UID_ACE
;
2442 SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn
, (void *)puid
,tagtype
);
2445 case SMB_ACL_GROUP_OBJ
:
2446 /* Get the SID from the owning group. */
2447 sid_copy(&sid
, pgroup
);
2448 unix_ug
.gid
= psbuf
->st_ex_gid
;
2449 owner_type
= GID_ACE
;
2453 gid_t
*pgid
= (gid_t
*)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn
, entry
);
2455 DEBUG(0,("canonicalise_acl: Failed to get gid.\n"));
2458 gid_to_sid( &sid
, *pgid
);
2459 unix_ug
.gid
= *pgid
;
2460 owner_type
= GID_ACE
;
2461 SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn
, (void *)pgid
,tagtype
);
2465 acl_mask
= convert_permset_to_mode_t(conn
, permset
);
2466 continue; /* Don't count the mask as an entry. */
2468 /* Use the Everyone SID */
2469 sid
= global_sid_World
;
2471 owner_type
= WORLD_ACE
;
2474 DEBUG(0,("canonicalise_acl: Unknown tagtype %u\n", (unsigned int)tagtype
));
2479 * Add this entry to the list.
2482 if ((ace
= SMB_MALLOC_P(canon_ace
)) == NULL
)
2486 ace
->type
= tagtype
;
2487 ace
->perms
= convert_permset_to_mode_t(conn
, permset
);
2488 ace
->attr
= ALLOW_ACE
;
2490 ace
->unix_ug
= unix_ug
;
2491 ace
->owner_type
= owner_type
;
2492 ace
->ace_flags
= get_pai_flags(pal
, ace
, (the_acl_type
== SMB_ACL_TYPE_DEFAULT
));
2494 DLIST_ADD(l_head
, ace
);
2498 * This next call will ensure we have at least a user/group/world set.
2501 if (!ensure_canon_entry_valid(&l_head
, conn
->params
,
2502 S_ISDIR(psbuf
->st_ex_mode
), powner
, pgroup
,
2507 * Now go through the list, masking the permissions with the
2508 * acl_mask. Ensure all DENY Entries are at the start of the list.
2511 DEBUG(10,("canonicalise_acl: %s ace entries before arrange :\n", the_acl_type
== SMB_ACL_TYPE_ACCESS
? "Access" : "Default" ));
2513 for ( ace_count
= 0, ace
= l_head
; ace
; ace
= next_ace
, ace_count
++) {
2514 next_ace
= ace
->next
;
2516 /* Masks are only applied to entries other than USER_OBJ and OTHER. */
2517 if (ace
->type
!= SMB_ACL_OTHER
&& ace
->type
!= SMB_ACL_USER_OBJ
)
2518 ace
->perms
&= acl_mask
;
2520 if (ace
->perms
== 0) {
2521 DLIST_PROMOTE(l_head
, ace
);
2524 if( DEBUGLVL( 10 ) ) {
2525 print_canon_ace(ace
, ace_count
);
2529 arrange_posix_perms(fname
,&l_head
);
2531 print_canon_ace_list( "canonicalise_acl: ace entries after arrange", l_head
);
2537 free_canon_ace_list(l_head
);
2541 /****************************************************************************
2542 Check if the current user group list contains a given group.
2543 ****************************************************************************/
2545 static bool current_user_in_group(gid_t gid
)
2549 for (i
= 0; i
< current_user
.ut
.ngroups
; i
++) {
2550 if (current_user
.ut
.groups
[i
] == gid
) {
2558 /****************************************************************************
2559 Should we override a deny ? Check 'acl group control' and 'dos filemode'.
2560 ****************************************************************************/
2562 static bool acl_group_override(connection_struct
*conn
,
2563 const struct smb_filename
*smb_fname
)
2565 if ((errno
!= EPERM
) && (errno
!= EACCES
)) {
2569 /* file primary group == user primary or supplementary group */
2570 if (lp_acl_group_control(SNUM(conn
)) &&
2571 current_user_in_group(smb_fname
->st
.st_ex_gid
)) {
2575 /* user has writeable permission */
2576 if (lp_dos_filemode(SNUM(conn
)) &&
2577 can_write_to_file(conn
, smb_fname
)) {
2584 /****************************************************************************
2585 Attempt to apply an ACL to a file or directory.
2586 ****************************************************************************/
2588 static bool set_canon_ace_list(files_struct
*fsp
,
2591 const SMB_STRUCT_STAT
*psbuf
,
2592 bool *pacl_set_support
)
2594 connection_struct
*conn
= fsp
->conn
;
2596 SMB_ACL_T the_acl
= SMB_VFS_SYS_ACL_INIT(conn
, (int)count_canon_ace_list(the_ace
) + 1);
2599 SMB_ACL_ENTRY_T mask_entry
;
2600 bool got_mask_entry
= False
;
2601 SMB_ACL_PERMSET_T mask_permset
;
2602 SMB_ACL_TYPE_T the_acl_type
= (default_ace
? SMB_ACL_TYPE_DEFAULT
: SMB_ACL_TYPE_ACCESS
);
2603 bool needs_mask
= False
;
2604 mode_t mask_perms
= 0;
2606 /* Use the psbuf that was passed in. */
2607 fsp
->fsp_name
->st
= *psbuf
;
2609 #if defined(POSIX_ACL_NEEDS_MASK)
2610 /* HP-UX always wants to have a mask (called "class" there). */
2614 if (the_acl
== NULL
) {
2616 if (!no_acl_syscall_error(errno
)) {
2618 * Only print this error message if we have some kind of ACL
2619 * support that's not working. Otherwise we would always get this.
2621 DEBUG(0,("set_canon_ace_list: Unable to init %s ACL. (%s)\n",
2622 default_ace
? "default" : "file", strerror(errno
) ));
2624 *pacl_set_support
= False
;
2628 if( DEBUGLVL( 10 )) {
2629 dbgtext("set_canon_ace_list: setting ACL:\n");
2630 for (i
= 0, p_ace
= the_ace
; p_ace
; p_ace
= p_ace
->next
, i
++ ) {
2631 print_canon_ace( p_ace
, i
);
2635 for (i
= 0, p_ace
= the_ace
; p_ace
; p_ace
= p_ace
->next
, i
++ ) {
2636 SMB_ACL_ENTRY_T the_entry
;
2637 SMB_ACL_PERMSET_T the_permset
;
2640 * ACLs only "need" an ACL_MASK entry if there are any named user or
2641 * named group entries. But if there is an ACL_MASK entry, it applies
2642 * to ACL_USER, ACL_GROUP, and ACL_GROUP_OBJ entries. Set the mask
2643 * so that it doesn't deny (i.e., mask off) any permissions.
2646 if (p_ace
->type
== SMB_ACL_USER
|| p_ace
->type
== SMB_ACL_GROUP
) {
2648 mask_perms
|= p_ace
->perms
;
2649 } else if (p_ace
->type
== SMB_ACL_GROUP_OBJ
) {
2650 mask_perms
|= p_ace
->perms
;
2654 * Get the entry for this ACE.
2657 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn
, &the_acl
, &the_entry
) == -1) {
2658 DEBUG(0,("set_canon_ace_list: Failed to create entry %d. (%s)\n",
2659 i
, strerror(errno
) ));
2663 if (p_ace
->type
== SMB_ACL_MASK
) {
2664 mask_entry
= the_entry
;
2665 got_mask_entry
= True
;
2669 * Ok - we now know the ACL calls should be working, don't
2670 * allow fallback to chmod.
2673 *pacl_set_support
= True
;
2676 * Initialise the entry from the canon_ace.
2680 * First tell the entry what type of ACE this is.
2683 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn
, the_entry
, p_ace
->type
) == -1) {
2684 DEBUG(0,("set_canon_ace_list: Failed to set tag type on entry %d. (%s)\n",
2685 i
, strerror(errno
) ));
2690 * Only set the qualifier (user or group id) if the entry is a user
2694 if ((p_ace
->type
== SMB_ACL_USER
) || (p_ace
->type
== SMB_ACL_GROUP
)) {
2695 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn
, the_entry
,(void *)&p_ace
->unix_ug
.uid
) == -1) {
2696 DEBUG(0,("set_canon_ace_list: Failed to set qualifier on entry %d. (%s)\n",
2697 i
, strerror(errno
) ));
2703 * Convert the mode_t perms in the canon_ace to a POSIX permset.
2706 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn
, the_entry
, &the_permset
) == -1) {
2707 DEBUG(0,("set_canon_ace_list: Failed to get permset on entry %d. (%s)\n",
2708 i
, strerror(errno
) ));
2712 if (map_acl_perms_to_permset(conn
, p_ace
->perms
, &the_permset
) == -1) {
2713 DEBUG(0,("set_canon_ace_list: Failed to create permset for mode (%u) on entry %d. (%s)\n",
2714 (unsigned int)p_ace
->perms
, i
, strerror(errno
) ));
2719 * ..and apply them to the entry.
2722 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn
, the_entry
, the_permset
) == -1) {
2723 DEBUG(0,("set_canon_ace_list: Failed to add permset on entry %d. (%s)\n",
2724 i
, strerror(errno
) ));
2729 print_canon_ace( p_ace
, i
);
2733 if (needs_mask
&& !got_mask_entry
) {
2734 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn
, &the_acl
, &mask_entry
) == -1) {
2735 DEBUG(0,("set_canon_ace_list: Failed to create mask entry. (%s)\n", strerror(errno
) ));
2739 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn
, mask_entry
, SMB_ACL_MASK
) == -1) {
2740 DEBUG(0,("set_canon_ace_list: Failed to set tag type on mask entry. (%s)\n",strerror(errno
) ));
2744 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn
, mask_entry
, &mask_permset
) == -1) {
2745 DEBUG(0,("set_canon_ace_list: Failed to get mask permset. (%s)\n", strerror(errno
) ));
2749 if (map_acl_perms_to_permset(conn
, S_IRUSR
|S_IWUSR
|S_IXUSR
, &mask_permset
) == -1) {
2750 DEBUG(0,("set_canon_ace_list: Failed to create mask permset. (%s)\n", strerror(errno
) ));
2754 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn
, mask_entry
, mask_permset
) == -1) {
2755 DEBUG(0,("set_canon_ace_list: Failed to add mask permset. (%s)\n", strerror(errno
) ));
2761 * Finally apply it to the file or directory.
2764 if(default_ace
|| fsp
->is_directory
|| fsp
->fh
->fd
== -1) {
2765 if (SMB_VFS_SYS_ACL_SET_FILE(conn
, fsp
->fsp_name
->base_name
,
2766 the_acl_type
, the_acl
) == -1) {
2768 * Some systems allow all the above calls and only fail with no ACL support
2769 * when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
2771 if (no_acl_syscall_error(errno
)) {
2772 *pacl_set_support
= False
;
2775 if (acl_group_override(conn
, fsp
->fsp_name
)) {
2778 DEBUG(5,("set_canon_ace_list: acl group "
2779 "control on and current user in file "
2780 "%s primary group.\n",
2784 sret
= SMB_VFS_SYS_ACL_SET_FILE(conn
,
2785 fsp
->fsp_name
->base_name
, the_acl_type
,
2794 DEBUG(2,("set_canon_ace_list: "
2795 "sys_acl_set_file type %s failed for "
2797 the_acl_type
== SMB_ACL_TYPE_DEFAULT
?
2798 "directory default" : "file",
2799 fsp_str_dbg(fsp
), strerror(errno
)));
2804 if (SMB_VFS_SYS_ACL_SET_FD(fsp
, the_acl
) == -1) {
2806 * Some systems allow all the above calls and only fail with no ACL support
2807 * when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
2809 if (no_acl_syscall_error(errno
)) {
2810 *pacl_set_support
= False
;
2813 if (acl_group_override(conn
, fsp
->fsp_name
)) {
2816 DEBUG(5,("set_canon_ace_list: acl group "
2817 "control on and current user in file "
2818 "%s primary group.\n",
2822 sret
= SMB_VFS_SYS_ACL_SET_FD(fsp
, the_acl
);
2830 DEBUG(2,("set_canon_ace_list: "
2831 "sys_acl_set_file failed for file %s "
2833 fsp_str_dbg(fsp
), strerror(errno
)));
2843 if (the_acl
!= NULL
) {
2844 SMB_VFS_SYS_ACL_FREE_ACL(conn
, the_acl
);
2850 /****************************************************************************
2851 Find a particular canon_ace entry.
2852 ****************************************************************************/
2854 static struct canon_ace
*canon_ace_entry_for(struct canon_ace
*list
, SMB_ACL_TAG_T type
, posix_id
*id
)
2857 if (list
->type
== type
&& ((type
!= SMB_ACL_USER
&& type
!= SMB_ACL_GROUP
) ||
2858 (type
== SMB_ACL_USER
&& id
&& id
->uid
== list
->unix_ug
.uid
) ||
2859 (type
== SMB_ACL_GROUP
&& id
&& id
->gid
== list
->unix_ug
.gid
)))
2866 /****************************************************************************
2868 ****************************************************************************/
2870 SMB_ACL_T
free_empty_sys_acl(connection_struct
*conn
, SMB_ACL_T the_acl
)
2872 SMB_ACL_ENTRY_T entry
;
2876 if (SMB_VFS_SYS_ACL_GET_ENTRY(conn
, the_acl
, SMB_ACL_FIRST_ENTRY
, &entry
) != 1) {
2877 SMB_VFS_SYS_ACL_FREE_ACL(conn
, the_acl
);
2883 /****************************************************************************
2884 Convert a canon_ace to a generic 3 element permission - if possible.
2885 ****************************************************************************/
2887 #define MAP_PERM(p,mask,result) (((p) & (mask)) ? (result) : 0 )
2889 static bool convert_canon_ace_to_posix_perms( files_struct
*fsp
, canon_ace
*file_ace_list
, mode_t
*posix_perms
)
2891 int snum
= SNUM(fsp
->conn
);
2892 size_t ace_count
= count_canon_ace_list(file_ace_list
);
2894 canon_ace
*owner_ace
= NULL
;
2895 canon_ace
*group_ace
= NULL
;
2896 canon_ace
*other_ace
= NULL
;
2900 if (ace_count
!= 3) {
2901 DEBUG(3,("convert_canon_ace_to_posix_perms: Too many ACE "
2902 "entries for file %s to convert to posix perms.\n",
2907 for (ace_p
= file_ace_list
; ace_p
; ace_p
= ace_p
->next
) {
2908 if (ace_p
->owner_type
== UID_ACE
)
2910 else if (ace_p
->owner_type
== GID_ACE
)
2912 else if (ace_p
->owner_type
== WORLD_ACE
)
2916 if (!owner_ace
|| !group_ace
|| !other_ace
) {
2917 DEBUG(3,("convert_canon_ace_to_posix_perms: Can't get "
2918 "standard entries for file %s.\n", fsp_str_dbg(fsp
)));
2922 *posix_perms
= (mode_t
)0;
2924 *posix_perms
|= owner_ace
->perms
;
2925 *posix_perms
|= MAP_PERM(group_ace
->perms
, S_IRUSR
, S_IRGRP
);
2926 *posix_perms
|= MAP_PERM(group_ace
->perms
, S_IWUSR
, S_IWGRP
);
2927 *posix_perms
|= MAP_PERM(group_ace
->perms
, S_IXUSR
, S_IXGRP
);
2928 *posix_perms
|= MAP_PERM(other_ace
->perms
, S_IRUSR
, S_IROTH
);
2929 *posix_perms
|= MAP_PERM(other_ace
->perms
, S_IWUSR
, S_IWOTH
);
2930 *posix_perms
|= MAP_PERM(other_ace
->perms
, S_IXUSR
, S_IXOTH
);
2932 /* The owner must have at least read access. */
2934 *posix_perms
|= S_IRUSR
;
2935 if (fsp
->is_directory
)
2936 *posix_perms
|= (S_IWUSR
|S_IXUSR
);
2938 /* If requested apply the masks. */
2940 /* Get the initial bits to apply. */
2942 if (fsp
->is_directory
) {
2943 and_bits
= lp_dir_security_mask(snum
);
2944 or_bits
= lp_force_dir_security_mode(snum
);
2946 and_bits
= lp_security_mask(snum
);
2947 or_bits
= lp_force_security_mode(snum
);
2950 *posix_perms
= (((*posix_perms
) & and_bits
)|or_bits
);
2952 DEBUG(10,("convert_canon_ace_to_posix_perms: converted u=%o,g=%o,w=%o "
2953 "to perm=0%o for file %s.\n", (int)owner_ace
->perms
,
2954 (int)group_ace
->perms
, (int)other_ace
->perms
,
2955 (int)*posix_perms
, fsp_str_dbg(fsp
)));
2960 /****************************************************************************
2961 Incoming NT ACLs on a directory can be split into a default POSIX acl (CI|OI|IO) and
2962 a normal POSIX acl. Win2k needs these split acls re-merging into one ACL
2963 with CI|OI set so it is inherited and also applies to the directory.
2964 Based on code from "Jim McDonough" <jmcd@us.ibm.com>.
2965 ****************************************************************************/
2967 static size_t merge_default_aces( SEC_ACE
*nt_ace_list
, size_t num_aces
)
2971 for (i
= 0; i
< num_aces
; i
++) {
2972 for (j
= i
+1; j
< num_aces
; j
++) {
2973 uint32 i_flags_ni
= (nt_ace_list
[i
].flags
& ~SEC_ACE_FLAG_INHERITED_ACE
);
2974 uint32 j_flags_ni
= (nt_ace_list
[j
].flags
& ~SEC_ACE_FLAG_INHERITED_ACE
);
2975 bool i_inh
= (nt_ace_list
[i
].flags
& SEC_ACE_FLAG_INHERITED_ACE
) ? True
: False
;
2976 bool j_inh
= (nt_ace_list
[j
].flags
& SEC_ACE_FLAG_INHERITED_ACE
) ? True
: False
;
2978 /* We know the lower number ACE's are file entries. */
2979 if ((nt_ace_list
[i
].type
== nt_ace_list
[j
].type
) &&
2980 (nt_ace_list
[i
].size
== nt_ace_list
[j
].size
) &&
2981 (nt_ace_list
[i
].access_mask
== nt_ace_list
[j
].access_mask
) &&
2982 sid_equal(&nt_ace_list
[i
].trustee
, &nt_ace_list
[j
].trustee
) &&
2984 (i_flags_ni
== 0) &&
2985 (j_flags_ni
== (SEC_ACE_FLAG_OBJECT_INHERIT
|
2986 SEC_ACE_FLAG_CONTAINER_INHERIT
|
2987 SEC_ACE_FLAG_INHERIT_ONLY
))) {
2989 * W2K wants to have access allowed zero access ACE's
2990 * at the end of the list. If the mask is zero, merge
2991 * the non-inherited ACE onto the inherited ACE.
2994 if (nt_ace_list
[i
].access_mask
== 0) {
2995 nt_ace_list
[j
].flags
= SEC_ACE_FLAG_OBJECT_INHERIT
|SEC_ACE_FLAG_CONTAINER_INHERIT
|
2996 (i_inh
? SEC_ACE_FLAG_INHERITED_ACE
: 0);
2997 if (num_aces
- i
- 1 > 0)
2998 memmove(&nt_ace_list
[i
], &nt_ace_list
[i
+1], (num_aces
-i
-1) *
3001 DEBUG(10,("merge_default_aces: Merging zero access ACE %u onto ACE %u.\n",
3002 (unsigned int)i
, (unsigned int)j
));
3005 * These are identical except for the flags.
3006 * Merge the inherited ACE onto the non-inherited ACE.
3009 nt_ace_list
[i
].flags
= SEC_ACE_FLAG_OBJECT_INHERIT
|SEC_ACE_FLAG_CONTAINER_INHERIT
|
3010 (i_inh
? SEC_ACE_FLAG_INHERITED_ACE
: 0);
3011 if (num_aces
- j
- 1 > 0)
3012 memmove(&nt_ace_list
[j
], &nt_ace_list
[j
+1], (num_aces
-j
-1) *
3015 DEBUG(10,("merge_default_aces: Merging ACE %u onto ACE %u.\n",
3016 (unsigned int)j
, (unsigned int)i
));
3028 * Add or Replace ACE entry.
3029 * In some cases we need to add a specific ACE for compatibility reasons.
3030 * When doing that we must make sure we are not actually creating a duplicate
3031 * entry. So we need to search whether an ACE entry already exist and eventually
3032 * replacce the access mask, or add a completely new entry if none was found.
3034 * This function assumes the array has enough space to add a new entry without
3035 * any reallocation of memory.
3038 static void add_or_replace_ace(SEC_ACE
*nt_ace_list
, size_t *num_aces
,
3039 const DOM_SID
*sid
, enum security_ace_type type
,
3040 uint32_t mask
, uint8_t flags
)
3044 /* first search for a duplicate */
3045 for (i
= 0; i
< *num_aces
; i
++) {
3046 if (sid_equal(&nt_ace_list
[i
].trustee
, sid
) &&
3047 (nt_ace_list
[i
].flags
== flags
)) break;
3050 if (i
< *num_aces
) { /* found */
3051 nt_ace_list
[i
].type
= type
;
3052 nt_ace_list
[i
].access_mask
= mask
;
3053 DEBUG(10, ("Replacing ACE %d with SID %s and flags %02x\n",
3054 i
, sid_string_dbg(sid
), flags
));
3058 /* not found, append it */
3059 init_sec_ace(&nt_ace_list
[(*num_aces
)++], sid
, type
, mask
, flags
);
3063 /****************************************************************************
3064 Reply to query a security descriptor from an fsp. If it succeeds it allocates
3065 the space for the return elements and returns the size needed to return the
3066 security descriptor. This should be the only external function needed for
3067 the UNIX style get ACL.
3068 ****************************************************************************/
3070 static NTSTATUS
posix_get_nt_acl_common(struct connection_struct
*conn
,
3072 const SMB_STRUCT_STAT
*sbuf
,
3073 struct pai_val
*pal
,
3074 SMB_ACL_T posix_acl
,
3076 uint32_t security_info
,
3082 SEC_ACL
*psa
= NULL
;
3083 size_t num_acls
= 0;
3084 size_t num_def_acls
= 0;
3085 size_t num_aces
= 0;
3086 canon_ace
*file_ace
= NULL
;
3087 canon_ace
*dir_ace
= NULL
;
3088 SEC_ACE
*nt_ace_list
= NULL
;
3089 size_t num_profile_acls
= 0;
3090 DOM_SID orig_owner_sid
;
3091 SEC_DESC
*psd
= NULL
;
3095 * Get the owner, group and world SIDs.
3098 create_file_sids(sbuf
, &owner_sid
, &group_sid
);
3100 if (lp_profile_acls(SNUM(conn
))) {
3101 /* For WXP SP1 the owner must be administrators. */
3102 sid_copy(&orig_owner_sid
, &owner_sid
);
3103 sid_copy(&owner_sid
, &global_sid_Builtin_Administrators
);
3104 sid_copy(&group_sid
, &global_sid_Builtin_Users
);
3105 num_profile_acls
= 3;
3108 if ((security_info
& DACL_SECURITY_INFORMATION
) && !(security_info
& PROTECTED_DACL_SECURITY_INFORMATION
)) {
3111 * In the optimum case Creator Owner and Creator Group would be used for
3112 * the ACL_USER_OBJ and ACL_GROUP_OBJ entries, respectively, but this
3113 * would lead to usability problems under Windows: The Creator entries
3114 * are only available in browse lists of directories and not for files;
3115 * additionally the identity of the owning group couldn't be determined.
3116 * We therefore use those identities only for Default ACLs.
3119 /* Create the canon_ace lists. */
3120 file_ace
= canonicalise_acl(conn
, name
, posix_acl
, sbuf
,
3121 &owner_sid
, &group_sid
, pal
,
3122 SMB_ACL_TYPE_ACCESS
);
3124 /* We must have *some* ACLS. */
3126 if (count_canon_ace_list(file_ace
) == 0) {
3127 DEBUG(0,("get_nt_acl : No ACLs on file (%s) !\n", name
));
3131 if (S_ISDIR(sbuf
->st_ex_mode
) && def_acl
) {
3132 dir_ace
= canonicalise_acl(conn
, name
, def_acl
,
3134 &global_sid_Creator_Owner
,
3135 &global_sid_Creator_Group
,
3136 pal
, SMB_ACL_TYPE_DEFAULT
);
3140 * Create the NT ACE list from the canonical ace lists.
3145 enum security_ace_type nt_acl_type
;
3147 if (nt4_compatible_acls() && dir_ace
) {
3149 * NT 4 chokes if an ACL contains an INHERIT_ONLY entry
3150 * but no non-INHERIT_ONLY entry for one SID. So we only
3151 * remove entries from the Access ACL if the
3152 * corresponding Default ACL entries have also been
3153 * removed. ACEs for CREATOR-OWNER and CREATOR-GROUP
3154 * are exceptions. We can do nothing
3155 * intelligent if the Default ACL contains entries that
3156 * are not also contained in the Access ACL, so this
3157 * case will still fail under NT 4.
3160 ace
= canon_ace_entry_for(dir_ace
, SMB_ACL_OTHER
, NULL
);
3161 if (ace
&& !ace
->perms
) {
3162 DLIST_REMOVE(dir_ace
, ace
);
3165 ace
= canon_ace_entry_for(file_ace
, SMB_ACL_OTHER
, NULL
);
3166 if (ace
&& !ace
->perms
) {
3167 DLIST_REMOVE(file_ace
, ace
);
3173 * WinNT doesn't usually have Creator Group
3174 * in browse lists, so we send this entry to
3175 * WinNT even if it contains no relevant
3176 * permissions. Once we can add
3177 * Creator Group to browse lists we can
3182 ace
= canon_ace_entry_for(dir_ace
, SMB_ACL_GROUP_OBJ
, NULL
);
3183 if (ace
&& !ace
->perms
) {
3184 DLIST_REMOVE(dir_ace
, ace
);
3189 ace
= canon_ace_entry_for(file_ace
, SMB_ACL_GROUP_OBJ
, NULL
);
3190 if (ace
&& !ace
->perms
) {
3191 DLIST_REMOVE(file_ace
, ace
);
3196 num_acls
= count_canon_ace_list(file_ace
);
3197 num_def_acls
= count_canon_ace_list(dir_ace
);
3199 /* Allocate the ace list. */
3200 if ((nt_ace_list
= SMB_MALLOC_ARRAY(SEC_ACE
,num_acls
+ num_profile_acls
+ num_def_acls
)) == NULL
) {
3201 DEBUG(0,("get_nt_acl: Unable to malloc space for nt_ace_list.\n"));
3205 memset(nt_ace_list
, '\0', (num_acls
+ num_def_acls
) * sizeof(SEC_ACE
) );
3208 * Create the NT ACE list from the canonical ace lists.
3211 for (ace
= file_ace
; ace
!= NULL
; ace
= ace
->next
) {
3212 uint32_t acc
= map_canon_ace_perms(SNUM(conn
),
3215 S_ISDIR(sbuf
->st_ex_mode
));
3216 init_sec_ace(&nt_ace_list
[num_aces
++],
3223 /* The User must have access to a profile share - even
3224 * if we can't map the SID. */
3225 if (lp_profile_acls(SNUM(conn
))) {
3226 add_or_replace_ace(nt_ace_list
, &num_aces
,
3227 &global_sid_Builtin_Users
,
3228 SEC_ACE_TYPE_ACCESS_ALLOWED
,
3229 FILE_GENERIC_ALL
, 0);
3232 for (ace
= dir_ace
; ace
!= NULL
; ace
= ace
->next
) {
3233 uint32_t acc
= map_canon_ace_perms(SNUM(conn
),
3236 S_ISDIR(sbuf
->st_ex_mode
));
3237 init_sec_ace(&nt_ace_list
[num_aces
++],
3242 SEC_ACE_FLAG_OBJECT_INHERIT
|
3243 SEC_ACE_FLAG_CONTAINER_INHERIT
|
3244 SEC_ACE_FLAG_INHERIT_ONLY
);
3247 /* The User must have access to a profile share - even
3248 * if we can't map the SID. */
3249 if (lp_profile_acls(SNUM(conn
))) {
3250 add_or_replace_ace(nt_ace_list
, &num_aces
,
3251 &global_sid_Builtin_Users
,
3252 SEC_ACE_TYPE_ACCESS_ALLOWED
,
3254 SEC_ACE_FLAG_OBJECT_INHERIT
|
3255 SEC_ACE_FLAG_CONTAINER_INHERIT
|
3256 SEC_ACE_FLAG_INHERIT_ONLY
);
3260 * Merge POSIX default ACLs and normal ACLs into one NT ACE.
3261 * Win2K needs this to get the inheritance correct when replacing ACLs
3262 * on a directory tree. Based on work by Jim @ IBM.
3265 num_aces
= merge_default_aces(nt_ace_list
, num_aces
);
3267 if (lp_profile_acls(SNUM(conn
))) {
3268 for (i
= 0; i
< num_aces
; i
++) {
3269 if (sid_equal(&nt_ace_list
[i
].trustee
, &owner_sid
)) {
3270 add_or_replace_ace(nt_ace_list
, &num_aces
,
3272 nt_ace_list
[i
].type
,
3273 nt_ace_list
[i
].access_mask
,
3274 nt_ace_list
[i
].flags
);
3282 if((psa
= make_sec_acl( talloc_tos(), NT4_ACL_REVISION
, num_aces
, nt_ace_list
)) == NULL
) {
3283 DEBUG(0,("get_nt_acl: Unable to malloc space for acl.\n"));
3287 } /* security_info & DACL_SECURITY_INFORMATION */
3289 psd
= make_standard_sec_desc( talloc_tos(),
3290 (security_info
& OWNER_SECURITY_INFORMATION
) ? &owner_sid
: NULL
,
3291 (security_info
& GROUP_SECURITY_INFORMATION
) ? &group_sid
: NULL
,
3296 DEBUG(0,("get_nt_acl: Unable to malloc space for security descriptor.\n"));
3302 * Windows 2000: The DACL_PROTECTED flag in the security
3303 * descriptor marks the ACL as non-inheriting, i.e., no
3304 * ACEs from higher level directories propagate to this
3305 * ACL. In the POSIX ACL model permissions are only
3306 * inherited at file create time, so ACLs never contain
3307 * any ACEs that are inherited dynamically. The DACL_PROTECTED
3308 * flag doesn't seem to bother Windows NT.
3309 * Always set this if map acl inherit is turned off.
3311 if (pal
== NULL
|| !lp_map_acl_inherit(SNUM(conn
))) {
3312 psd
->type
|= SEC_DESC_DACL_PROTECTED
;
3314 psd
->type
|= pal
->sd_type
;
3318 dacl_sort_into_canonical_order(psd
->dacl
->aces
, (unsigned int)psd
->dacl
->num_aces
);
3326 SMB_VFS_SYS_ACL_FREE_ACL(conn
, posix_acl
);
3329 SMB_VFS_SYS_ACL_FREE_ACL(conn
, def_acl
);
3331 free_canon_ace_list(file_ace
);
3332 free_canon_ace_list(dir_ace
);
3333 free_inherited_info(pal
);
3334 SAFE_FREE(nt_ace_list
);
3336 return NT_STATUS_OK
;
3339 NTSTATUS
posix_fget_nt_acl(struct files_struct
*fsp
, uint32_t security_info
,
3342 SMB_STRUCT_STAT sbuf
;
3343 SMB_ACL_T posix_acl
= NULL
;
3344 struct pai_val
*pal
;
3348 DEBUG(10,("posix_fget_nt_acl: called for file %s\n",
3351 /* can it happen that fsp_name == NULL ? */
3352 if (fsp
->is_directory
|| fsp
->fh
->fd
== -1) {
3353 return posix_get_nt_acl(fsp
->conn
, fsp
->fsp_name
->base_name
,
3354 security_info
, ppdesc
);
3357 /* Get the stat struct for the owner info. */
3358 if(SMB_VFS_FSTAT(fsp
, &sbuf
) != 0) {
3359 return map_nt_error_from_unix(errno
);
3362 /* Get the ACL from the fd. */
3363 posix_acl
= SMB_VFS_SYS_ACL_GET_FD(fsp
);
3365 pal
= fload_inherited_info(fsp
);
3367 return posix_get_nt_acl_common(fsp
->conn
, fsp
->fsp_name
->base_name
,
3368 &sbuf
, pal
, posix_acl
, NULL
,
3369 security_info
, ppdesc
);
3372 NTSTATUS
posix_get_nt_acl(struct connection_struct
*conn
, const char *name
,
3373 uint32_t security_info
, SEC_DESC
**ppdesc
)
3375 SMB_ACL_T posix_acl
= NULL
;
3376 SMB_ACL_T def_acl
= NULL
;
3377 struct pai_val
*pal
;
3378 struct smb_filename
*smb_fname
= NULL
;
3384 DEBUG(10,("posix_get_nt_acl: called for file %s\n", name
));
3386 status
= create_synthetic_smb_fname(talloc_tos(), name
, NULL
, NULL
,
3388 if (!NT_STATUS_IS_OK(status
)) {
3392 /* Get the stat struct for the owner info. */
3393 if (lp_posix_pathnames()) {
3394 ret
= SMB_VFS_LSTAT(conn
, smb_fname
);
3396 ret
= SMB_VFS_STAT(conn
, smb_fname
);
3400 status
= map_nt_error_from_unix(errno
);
3404 /* Get the ACL from the path. */
3405 posix_acl
= SMB_VFS_SYS_ACL_GET_FILE(conn
, name
, SMB_ACL_TYPE_ACCESS
);
3407 /* If it's a directory get the default POSIX ACL. */
3408 if(S_ISDIR(smb_fname
->st
.st_ex_mode
)) {
3409 def_acl
= SMB_VFS_SYS_ACL_GET_FILE(conn
, name
, SMB_ACL_TYPE_DEFAULT
);
3410 def_acl
= free_empty_sys_acl(conn
, def_acl
);
3413 pal
= load_inherited_info(conn
, name
);
3415 status
= posix_get_nt_acl_common(conn
, name
, &smb_fname
->st
, pal
,
3416 posix_acl
, def_acl
, security_info
,
3419 TALLOC_FREE(smb_fname
);
3423 /****************************************************************************
3424 Try to chown a file. We will be able to chown it under the following conditions.
3426 1) If we have root privileges, then it will just work.
3427 2) If we have SeTakeOwnershipPrivilege we can change the user to the current user.
3428 3) If we have SeRestorePrivilege we can change the user to any other user.
3429 4) If we have write permission to the file and dos_filemodes is set
3430 then allow chown to the currently authenticated user.
3431 ****************************************************************************/
3433 int try_chown(connection_struct
*conn
, struct smb_filename
*smb_fname
,
3434 uid_t uid
, gid_t gid
)
3439 if(!CAN_WRITE(conn
)) {
3444 /* try the direct way first */
3445 if (lp_posix_pathnames()) {
3446 ret
= SMB_VFS_LCHOWN(conn
, smb_fname
->base_name
, uid
, gid
);
3448 ret
= SMB_VFS_CHOWN(conn
, smb_fname
->base_name
, uid
, gid
);
3454 /* Case (2) / (3) */
3455 if (lp_enable_privileges()) {
3457 bool has_take_ownership_priv
= user_has_privileges(current_user
.nt_user_token
,
3458 &se_take_ownership
);
3459 bool has_restore_priv
= user_has_privileges(current_user
.nt_user_token
,
3463 if ( ( has_take_ownership_priv
&& ( uid
== current_user
.ut
.uid
) ) ||
3465 ( has_restore_priv
) ) {
3468 /* Keep the current file gid the same - take ownership doesn't imply group change. */
3469 if (lp_posix_pathnames()) {
3470 ret
= SMB_VFS_LCHOWN(conn
, smb_fname
->base_name
, uid
,
3473 ret
= SMB_VFS_CHOWN(conn
, smb_fname
->base_name
, uid
,
3482 if (!lp_dos_filemode(SNUM(conn
))) {
3487 /* only allow chown to the current user. This is more secure,
3488 and also copes with the case where the SID in a take ownership ACL is
3489 a local SID on the users workstation
3491 if (uid
!= current_user
.ut
.uid
) {
3496 if (lp_posix_pathnames()) {
3497 ret
= SMB_VFS_LSTAT(conn
, smb_fname
);
3499 ret
= SMB_VFS_STAT(conn
, smb_fname
);
3506 if (!NT_STATUS_IS_OK(open_file_fchmod(NULL
, conn
, smb_fname
, &fsp
))) {
3511 /* Keep the current file gid the same. */
3512 ret
= SMB_VFS_FCHOWN(fsp
, uid
, (gid_t
)-1);
3515 close_file_fchmod(NULL
, fsp
);
3521 /* Disable this - prevents ACL inheritance from the ACL editor. JRA. */
3523 /****************************************************************************
3524 Take care of parent ACL inheritance.
3525 ****************************************************************************/
3527 NTSTATUS
append_parent_acl(files_struct
*fsp
,
3528 const SEC_DESC
*pcsd
,
3529 SEC_DESC
**pp_new_sd
)
3531 struct smb_filename
*smb_dname
= NULL
;
3532 SEC_DESC
*parent_sd
= NULL
;
3533 files_struct
*parent_fsp
= NULL
;
3534 TALLOC_CTX
*mem_ctx
= talloc_tos();
3535 char *parent_name
= NULL
;
3536 SEC_ACE
*new_ace
= NULL
;
3537 unsigned int num_aces
= pcsd
->dacl
->num_aces
;
3541 SEC_DESC
*psd
= dup_sec_desc(talloc_tos(), pcsd
);
3542 bool is_dacl_protected
= (pcsd
->type
& SEC_DESC_DACL_PROTECTED
);
3545 return NT_STATUS_NO_MEMORY
;
3548 if (!parent_dirname(mem_ctx
, fsp
->fsp_name
->base_name
, &parent_name
,
3550 return NT_STATUS_NO_MEMORY
;
3553 status
= create_synthetic_smb_fname(mem_ctx
, parent_name
, NULL
, NULL
,
3555 if (!NT_STATUS_IS_OK(status
)) {
3559 status
= SMB_VFS_CREATE_FILE(
3560 fsp
->conn
, /* conn */
3562 0, /* root_dir_fid */
3563 smb_dname
, /* fname */
3564 FILE_READ_ATTRIBUTES
, /* access_mask */
3565 FILE_SHARE_NONE
, /* share_access */
3566 FILE_OPEN
, /* create_disposition*/
3567 FILE_DIRECTORY_FILE
, /* create_options */
3568 0, /* file_attributes */
3569 INTERNAL_OPEN_ONLY
, /* oplock_request */
3570 0, /* allocation_size */
3573 &parent_fsp
, /* result */
3576 if (!NT_STATUS_IS_OK(status
)) {
3577 TALLOC_FREE(smb_dname
);
3581 status
= SMB_VFS_GET_NT_ACL(parent_fsp
->conn
, smb_dname
->base_name
,
3582 DACL_SECURITY_INFORMATION
, &parent_sd
);
3584 close_file(NULL
, parent_fsp
, NORMAL_CLOSE
);
3585 TALLOC_FREE(smb_dname
);
3587 if (!NT_STATUS_IS_OK(status
)) {
3592 * Make room for potentially all the ACLs from
3593 * the parent. We used to add the ugw triple here,
3594 * as we knew we were dealing with POSIX ACLs.
3595 * We no longer need to do so as we can guarentee
3596 * that a default ACL from the parent directory will
3597 * be well formed for POSIX ACLs if it came from a
3598 * POSIX ACL source, and if we're not writing to a
3599 * POSIX ACL sink then we don't care if it's not well
3603 num_aces
+= parent_sd
->dacl
->num_aces
;
3605 if((new_ace
= TALLOC_ZERO_ARRAY(mem_ctx
, SEC_ACE
,
3606 num_aces
)) == NULL
) {
3607 return NT_STATUS_NO_MEMORY
;
3610 /* Start by copying in all the given ACE entries. */
3611 for (i
= 0; i
< psd
->dacl
->num_aces
; i
++) {
3612 sec_ace_copy(&new_ace
[i
], &psd
->dacl
->aces
[i
]);
3616 * Note that we're ignoring "inherit permissions" here
3617 * as that really only applies to newly created files. JRA.
3620 /* Finally append any inherited ACEs. */
3621 for (j
= 0; j
< parent_sd
->dacl
->num_aces
; j
++) {
3622 SEC_ACE
*se
= &parent_sd
->dacl
->aces
[j
];
3624 if (fsp
->is_directory
) {
3625 if (!(se
->flags
& SEC_ACE_FLAG_CONTAINER_INHERIT
)) {
3626 /* Doesn't apply to a directory - ignore. */
3627 DEBUG(10,("append_parent_acl: directory %s "
3628 "ignoring non container "
3629 "inherit flags %u on ACE with sid %s "
3632 (unsigned int)se
->flags
,
3633 sid_string_dbg(&se
->trustee
),
3638 if (!(se
->flags
& SEC_ACE_FLAG_OBJECT_INHERIT
)) {
3639 /* Doesn't apply to a file - ignore. */
3640 DEBUG(10,("append_parent_acl: file %s "
3641 "ignoring non object "
3642 "inherit flags %u on ACE with sid %s "
3645 (unsigned int)se
->flags
,
3646 sid_string_dbg(&se
->trustee
),
3652 if (is_dacl_protected
) {
3653 /* If the DACL is protected it means we must
3654 * not overwrite an existing ACE entry with the
3655 * same SID. This is order N^2. Ouch :-(. JRA. */
3657 for (k
= 0; k
< psd
->dacl
->num_aces
; k
++) {
3658 if (sid_equal(&psd
->dacl
->aces
[k
].trustee
,
3663 if (k
< psd
->dacl
->num_aces
) {
3664 /* SID matched. Ignore. */
3665 DEBUG(10,("append_parent_acl: path %s "
3666 "ignoring ACE with protected sid %s "
3669 sid_string_dbg(&se
->trustee
),
3675 sec_ace_copy(&new_ace
[i
], se
);
3676 if (se
->flags
& SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
) {
3677 new_ace
[i
].flags
&= ~(SEC_ACE_FLAG_VALID_INHERIT
);
3679 new_ace
[i
].flags
|= SEC_ACE_FLAG_INHERITED_ACE
;
3681 if (fsp
->is_directory
) {
3683 * Strip off any inherit only. It's applied.
3685 new_ace
[i
].flags
&= ~(SEC_ACE_FLAG_INHERIT_ONLY
);
3686 if (se
->flags
& SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
) {
3687 /* No further inheritance. */
3689 ~(SEC_ACE_FLAG_CONTAINER_INHERIT
|
3690 SEC_ACE_FLAG_OBJECT_INHERIT
);
3694 * Strip off any container or inherit
3695 * flags, they can't apply to objects.
3697 new_ace
[i
].flags
&= ~(SEC_ACE_FLAG_CONTAINER_INHERIT
|
3698 SEC_ACE_FLAG_INHERIT_ONLY
|
3699 SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
);
3703 DEBUG(10,("append_parent_acl: path %s "
3704 "inheriting ACE with sid %s "
3707 sid_string_dbg(&se
->trustee
),
3711 psd
->dacl
->aces
= new_ace
;
3712 psd
->dacl
->num_aces
= i
;
3713 psd
->type
&= ~(SE_DESC_DACL_AUTO_INHERITED
|
3714 SE_DESC_DACL_AUTO_INHERIT_REQ
);
3721 /****************************************************************************
3722 Reply to set a security descriptor on an fsp. security_info_sent is the
3723 description of the following NT ACL.
3724 This should be the only external function needed for the UNIX style set ACL.
3725 ****************************************************************************/
3727 NTSTATUS
set_nt_acl(files_struct
*fsp
, uint32 security_info_sent
, const SEC_DESC
*psd
)
3729 connection_struct
*conn
= fsp
->conn
;
3730 uid_t user
= (uid_t
)-1;
3731 gid_t grp
= (gid_t
)-1;
3732 DOM_SID file_owner_sid
;
3733 DOM_SID file_grp_sid
;
3734 canon_ace
*file_ace_list
= NULL
;
3735 canon_ace
*dir_ace_list
= NULL
;
3736 bool acl_perms
= False
;
3737 mode_t orig_mode
= (mode_t
)0;
3739 bool set_acl_as_root
= false;
3740 bool acl_set_support
= false;
3743 DEBUG(10,("set_nt_acl: called for file %s\n",
3746 if (!CAN_WRITE(conn
)) {
3747 DEBUG(10,("set acl rejected on read-only share\n"));
3748 return NT_STATUS_MEDIA_WRITE_PROTECTED
;
3752 * Get the current state of the file.
3755 status
= vfs_stat_fsp(fsp
);
3756 if (!NT_STATUS_IS_OK(status
)) {
3760 /* Save the original element we check against. */
3761 orig_mode
= fsp
->fsp_name
->st
.st_ex_mode
;
3764 * Unpack the user/group/world id's.
3767 status
= unpack_nt_owners( SNUM(conn
), &user
, &grp
, security_info_sent
, psd
);
3768 if (!NT_STATUS_IS_OK(status
)) {
3773 * Do we need to chown ? If so this must be done first as the incoming
3774 * CREATOR_OWNER acl will be relative to the *new* owner, not the old.
3778 if (((user
!= (uid_t
)-1) && (fsp
->fsp_name
->st
.st_ex_uid
!= user
)) ||
3779 (( grp
!= (gid_t
)-1) && (fsp
->fsp_name
->st
.st_ex_gid
!= grp
))) {
3781 DEBUG(3,("set_nt_acl: chown %s. uid = %u, gid = %u.\n",
3782 fsp_str_dbg(fsp
), (unsigned int)user
,
3783 (unsigned int)grp
));
3785 if(try_chown(fsp
->conn
, fsp
->fsp_name
, user
, grp
) == -1) {
3786 DEBUG(3,("set_nt_acl: chown %s, %u, %u failed. Error "
3787 "= %s.\n", fsp_str_dbg(fsp
),
3788 (unsigned int)user
, (unsigned int)grp
,
3790 if (errno
== EPERM
) {
3791 return NT_STATUS_INVALID_OWNER
;
3793 return map_nt_error_from_unix(errno
);
3797 * Recheck the current state of the file, which may have changed.
3798 * (suid/sgid bits, for instance)
3801 status
= vfs_stat_fsp(fsp
);
3802 if (!NT_STATUS_IS_OK(status
)) {
3806 /* Save the original element we check against. */
3807 orig_mode
= fsp
->fsp_name
->st
.st_ex_mode
;
3809 /* If we successfully chowned, we know we must
3810 * be able to set the acl, so do it as root.
3812 set_acl_as_root
= true;
3815 create_file_sids(&fsp
->fsp_name
->st
, &file_owner_sid
, &file_grp_sid
);
3817 acl_perms
= unpack_canon_ace(fsp
, &fsp
->fsp_name
->st
, &file_owner_sid
,
3818 &file_grp_sid
, &file_ace_list
,
3819 &dir_ace_list
, security_info_sent
, psd
);
3821 /* Ignore W2K traverse DACL set. */
3822 if (!file_ace_list
&& !dir_ace_list
) {
3823 return NT_STATUS_OK
;
3827 DEBUG(3,("set_nt_acl: cannot set permissions\n"));
3828 free_canon_ace_list(file_ace_list
);
3829 free_canon_ace_list(dir_ace_list
);
3830 return NT_STATUS_ACCESS_DENIED
;
3834 * Only change security if we got a DACL.
3837 if(!(security_info_sent
& DACL_SECURITY_INFORMATION
) || (psd
->dacl
== NULL
)) {
3838 free_canon_ace_list(file_ace_list
);
3839 free_canon_ace_list(dir_ace_list
);
3840 return NT_STATUS_OK
;
3844 * Try using the POSIX ACL set first. Fall back to chmod if
3845 * we have no ACL support on this filesystem.
3848 if (acl_perms
&& file_ace_list
) {
3849 if (set_acl_as_root
) {
3852 ret
= set_canon_ace_list(fsp
, file_ace_list
, false,
3853 &fsp
->fsp_name
->st
, &acl_set_support
);
3854 if (set_acl_as_root
) {
3857 if (acl_set_support
&& ret
== false) {
3858 DEBUG(3,("set_nt_acl: failed to set file acl on file "
3859 "%s (%s).\n", fsp_str_dbg(fsp
),
3861 free_canon_ace_list(file_ace_list
);
3862 free_canon_ace_list(dir_ace_list
);
3863 return map_nt_error_from_unix(errno
);
3867 if (acl_perms
&& acl_set_support
&& fsp
->is_directory
) {
3869 if (set_acl_as_root
) {
3872 ret
= set_canon_ace_list(fsp
, dir_ace_list
, true,
3875 if (set_acl_as_root
) {
3879 DEBUG(3,("set_nt_acl: failed to set default "
3880 "acl on directory %s (%s).\n",
3881 fsp_str_dbg(fsp
), strerror(errno
)));
3882 free_canon_ace_list(file_ace_list
);
3883 free_canon_ace_list(dir_ace_list
);
3884 return map_nt_error_from_unix(errno
);
3890 * No default ACL - delete one if it exists.
3893 if (set_acl_as_root
) {
3896 sret
= SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn
,
3897 fsp
->fsp_name
->base_name
);
3898 if (set_acl_as_root
) {
3902 if (acl_group_override(conn
, fsp
->fsp_name
)) {
3903 DEBUG(5,("set_nt_acl: acl group "
3904 "control on and current user "
3905 "in file %s primary group. "
3906 "Override delete_def_acl\n",
3911 SMB_VFS_SYS_ACL_DELETE_DEF_FILE(
3913 fsp
->fsp_name
->base_name
);
3918 DEBUG(3,("set_nt_acl: sys_acl_delete_def_file failed (%s)\n", strerror(errno
)));
3919 free_canon_ace_list(file_ace_list
);
3920 free_canon_ace_list(dir_ace_list
);
3921 return map_nt_error_from_unix(errno
);
3927 if (acl_set_support
) {
3928 if (set_acl_as_root
) {
3931 store_inheritance_attributes(fsp
,
3935 if (set_acl_as_root
) {
3941 * If we cannot set using POSIX ACLs we fall back to checking if we need to chmod.
3944 if(!acl_set_support
&& acl_perms
) {
3947 if (!convert_canon_ace_to_posix_perms( fsp
, file_ace_list
, &posix_perms
)) {
3948 free_canon_ace_list(file_ace_list
);
3949 free_canon_ace_list(dir_ace_list
);
3950 DEBUG(3,("set_nt_acl: failed to convert file acl to "
3951 "posix permissions for file %s.\n",
3953 return NT_STATUS_ACCESS_DENIED
;
3956 if (orig_mode
!= posix_perms
) {
3959 DEBUG(3,("set_nt_acl: chmod %s. perms = 0%o.\n",
3960 fsp_str_dbg(fsp
), (unsigned int)posix_perms
));
3962 if (set_acl_as_root
) {
3965 sret
= SMB_VFS_CHMOD(conn
, fsp
->fsp_name
->base_name
,
3967 if (set_acl_as_root
) {
3971 if (acl_group_override(conn
, fsp
->fsp_name
)) {
3972 DEBUG(5,("set_nt_acl: acl group "
3973 "control on and current user "
3974 "in file %s primary group. "
3979 sret
= SMB_VFS_CHMOD(conn
,
3980 fsp
->fsp_name
->base_name
,
3986 DEBUG(3,("set_nt_acl: chmod %s, 0%o "
3987 "failed. Error = %s.\n",
3989 (unsigned int)posix_perms
,
3991 free_canon_ace_list(file_ace_list
);
3992 free_canon_ace_list(dir_ace_list
);
3993 return map_nt_error_from_unix(errno
);
3999 free_canon_ace_list(file_ace_list
);
4000 free_canon_ace_list(dir_ace_list
);
4002 return NT_STATUS_OK
;
4005 /****************************************************************************
4006 Get the actual group bits stored on a file with an ACL. Has no effect if
4007 the file has no ACL. Needed in dosmode code where the stat() will return
4008 the mask bits, not the real group bits, for a file with an ACL.
4009 ****************************************************************************/
4011 int get_acl_group_bits( connection_struct
*conn
, const char *fname
, mode_t
*mode
)
4013 int entry_id
= SMB_ACL_FIRST_ENTRY
;
4014 SMB_ACL_ENTRY_T entry
;
4015 SMB_ACL_T posix_acl
;
4018 posix_acl
= SMB_VFS_SYS_ACL_GET_FILE(conn
, fname
, SMB_ACL_TYPE_ACCESS
);
4019 if (posix_acl
== (SMB_ACL_T
)NULL
)
4022 while (SMB_VFS_SYS_ACL_GET_ENTRY(conn
, posix_acl
, entry_id
, &entry
) == 1) {
4023 SMB_ACL_TAG_T tagtype
;
4024 SMB_ACL_PERMSET_T permset
;
4026 entry_id
= SMB_ACL_NEXT_ENTRY
;
4028 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn
, entry
, &tagtype
) ==-1)
4031 if (tagtype
== SMB_ACL_GROUP_OBJ
) {
4032 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn
, entry
, &permset
) == -1) {
4035 *mode
&= ~(S_IRGRP
|S_IWGRP
|S_IXGRP
);
4036 *mode
|= (SMB_VFS_SYS_ACL_GET_PERM(conn
, permset
, SMB_ACL_READ
) ? S_IRGRP
: 0);
4037 *mode
|= (SMB_VFS_SYS_ACL_GET_PERM(conn
, permset
, SMB_ACL_WRITE
) ? S_IWGRP
: 0);
4038 *mode
|= (SMB_VFS_SYS_ACL_GET_PERM(conn
, permset
, SMB_ACL_EXECUTE
) ? S_IXGRP
: 0);
4044 SMB_VFS_SYS_ACL_FREE_ACL(conn
, posix_acl
);
4048 /****************************************************************************
4049 Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4050 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4051 ****************************************************************************/
4053 static int chmod_acl_internals( connection_struct
*conn
, SMB_ACL_T posix_acl
, mode_t mode
)
4055 int entry_id
= SMB_ACL_FIRST_ENTRY
;
4056 SMB_ACL_ENTRY_T entry
;
4057 int num_entries
= 0;
4059 while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn
, posix_acl
, entry_id
, &entry
) == 1) {
4060 SMB_ACL_TAG_T tagtype
;
4061 SMB_ACL_PERMSET_T permset
;
4064 entry_id
= SMB_ACL_NEXT_ENTRY
;
4066 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn
, entry
, &tagtype
) == -1)
4069 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn
, entry
, &permset
) == -1)
4075 case SMB_ACL_USER_OBJ
:
4076 perms
= unix_perms_to_acl_perms(mode
, S_IRUSR
, S_IWUSR
, S_IXUSR
);
4078 case SMB_ACL_GROUP_OBJ
:
4079 perms
= unix_perms_to_acl_perms(mode
, S_IRGRP
, S_IWGRP
, S_IXGRP
);
4083 * FIXME: The ACL_MASK entry permissions should really be set to
4084 * the union of the permissions of all ACL_USER,
4085 * ACL_GROUP_OBJ, and ACL_GROUP entries. That's what
4086 * acl_calc_mask() does, but Samba ACLs doesn't provide it.
4088 perms
= S_IRUSR
|S_IWUSR
|S_IXUSR
;
4091 perms
= unix_perms_to_acl_perms(mode
, S_IROTH
, S_IWOTH
, S_IXOTH
);
4097 if (map_acl_perms_to_permset(conn
, perms
, &permset
) == -1)
4100 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn
, entry
, permset
) == -1)
4105 * If this is a simple 3 element ACL or no elements then it's a standard
4106 * UNIX permission set. Just use chmod...
4109 if ((num_entries
== 3) || (num_entries
== 0))
4115 /****************************************************************************
4116 Get the access ACL of FROM, do a chmod by setting the ACL USER_OBJ,
4117 GROUP_OBJ and OTHER bits in an ACL and set the mask to rwx. Set the
4118 resulting ACL on TO. Note that name is in UNIX character set.
4119 ****************************************************************************/
4121 static int copy_access_posix_acl(connection_struct
*conn
, const char *from
, const char *to
, mode_t mode
)
4123 SMB_ACL_T posix_acl
= NULL
;
4126 if ((posix_acl
= SMB_VFS_SYS_ACL_GET_FILE(conn
, from
, SMB_ACL_TYPE_ACCESS
)) == NULL
)
4129 if ((ret
= chmod_acl_internals(conn
, posix_acl
, mode
)) == -1)
4132 ret
= SMB_VFS_SYS_ACL_SET_FILE(conn
, to
, SMB_ACL_TYPE_ACCESS
, posix_acl
);
4136 SMB_VFS_SYS_ACL_FREE_ACL(conn
, posix_acl
);
4140 /****************************************************************************
4141 Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4142 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4143 Note that name is in UNIX character set.
4144 ****************************************************************************/
4146 int chmod_acl(connection_struct
*conn
, const char *name
, mode_t mode
)
4148 return copy_access_posix_acl(conn
, name
, name
, mode
);
4151 /****************************************************************************
4152 Check for an existing default POSIX ACL on a directory.
4153 ****************************************************************************/
4155 static bool directory_has_default_posix_acl(connection_struct
*conn
, const char *fname
)
4157 SMB_ACL_T def_acl
= SMB_VFS_SYS_ACL_GET_FILE( conn
, fname
, SMB_ACL_TYPE_DEFAULT
);
4158 bool has_acl
= False
;
4159 SMB_ACL_ENTRY_T entry
;
4161 if (def_acl
!= NULL
&& (SMB_VFS_SYS_ACL_GET_ENTRY(conn
, def_acl
, SMB_ACL_FIRST_ENTRY
, &entry
) == 1)) {
4166 SMB_VFS_SYS_ACL_FREE_ACL(conn
, def_acl
);
4171 /****************************************************************************
4172 If the parent directory has no default ACL but it does have an Access ACL,
4173 inherit this Access ACL to file name.
4174 ****************************************************************************/
4176 int inherit_access_posix_acl(connection_struct
*conn
, const char *inherit_from_dir
,
4177 const char *name
, mode_t mode
)
4179 if (directory_has_default_posix_acl(conn
, inherit_from_dir
))
4182 return copy_access_posix_acl(conn
, inherit_from_dir
, name
, mode
);
4185 /****************************************************************************
4186 Do an fchmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4187 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4188 ****************************************************************************/
4190 int fchmod_acl(files_struct
*fsp
, mode_t mode
)
4192 connection_struct
*conn
= fsp
->conn
;
4193 SMB_ACL_T posix_acl
= NULL
;
4196 if ((posix_acl
= SMB_VFS_SYS_ACL_GET_FD(fsp
)) == NULL
)
4199 if ((ret
= chmod_acl_internals(conn
, posix_acl
, mode
)) == -1)
4202 ret
= SMB_VFS_SYS_ACL_SET_FD(fsp
, posix_acl
);
4206 SMB_VFS_SYS_ACL_FREE_ACL(conn
, posix_acl
);
4210 /****************************************************************************
4211 Map from wire type to permset.
4212 ****************************************************************************/
4214 static bool unix_ex_wire_to_permset(connection_struct
*conn
, unsigned char wire_perm
, SMB_ACL_PERMSET_T
*p_permset
)
4216 if (wire_perm
& ~(SMB_POSIX_ACL_READ
|SMB_POSIX_ACL_WRITE
|SMB_POSIX_ACL_EXECUTE
)) {
4220 if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn
, *p_permset
) == -1) {
4224 if (wire_perm
& SMB_POSIX_ACL_READ
) {
4225 if (SMB_VFS_SYS_ACL_ADD_PERM(conn
, *p_permset
, SMB_ACL_READ
) == -1) {
4229 if (wire_perm
& SMB_POSIX_ACL_WRITE
) {
4230 if (SMB_VFS_SYS_ACL_ADD_PERM(conn
, *p_permset
, SMB_ACL_WRITE
) == -1) {
4234 if (wire_perm
& SMB_POSIX_ACL_EXECUTE
) {
4235 if (SMB_VFS_SYS_ACL_ADD_PERM(conn
, *p_permset
, SMB_ACL_EXECUTE
) == -1) {
4242 /****************************************************************************
4243 Map from wire type to tagtype.
4244 ****************************************************************************/
4246 static bool unix_ex_wire_to_tagtype(unsigned char wire_tt
, SMB_ACL_TAG_T
*p_tt
)
4249 case SMB_POSIX_ACL_USER_OBJ
:
4250 *p_tt
= SMB_ACL_USER_OBJ
;
4252 case SMB_POSIX_ACL_USER
:
4253 *p_tt
= SMB_ACL_USER
;
4255 case SMB_POSIX_ACL_GROUP_OBJ
:
4256 *p_tt
= SMB_ACL_GROUP_OBJ
;
4258 case SMB_POSIX_ACL_GROUP
:
4259 *p_tt
= SMB_ACL_GROUP
;
4261 case SMB_POSIX_ACL_MASK
:
4262 *p_tt
= SMB_ACL_MASK
;
4264 case SMB_POSIX_ACL_OTHER
:
4265 *p_tt
= SMB_ACL_OTHER
;
4273 /****************************************************************************
4274 Create a new POSIX acl from wire permissions.
4275 FIXME ! How does the share mask/mode fit into this.... ?
4276 ****************************************************************************/
4278 static SMB_ACL_T
create_posix_acl_from_wire(connection_struct
*conn
, uint16 num_acls
, const char *pdata
)
4281 SMB_ACL_T the_acl
= SMB_VFS_SYS_ACL_INIT(conn
, num_acls
);
4283 if (the_acl
== NULL
) {
4287 for (i
= 0; i
< num_acls
; i
++) {
4288 SMB_ACL_ENTRY_T the_entry
;
4289 SMB_ACL_PERMSET_T the_permset
;
4290 SMB_ACL_TAG_T tag_type
;
4292 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn
, &the_acl
, &the_entry
) == -1) {
4293 DEBUG(0,("create_posix_acl_from_wire: Failed to create entry %u. (%s)\n",
4294 i
, strerror(errno
) ));
4298 if (!unix_ex_wire_to_tagtype(CVAL(pdata
,(i
*SMB_POSIX_ACL_ENTRY_SIZE
)), &tag_type
)) {
4299 DEBUG(0,("create_posix_acl_from_wire: invalid wire tagtype %u on entry %u.\n",
4300 CVAL(pdata
,(i
*SMB_POSIX_ACL_ENTRY_SIZE
)), i
));
4304 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn
, the_entry
, tag_type
) == -1) {
4305 DEBUG(0,("create_posix_acl_from_wire: Failed to set tagtype on entry %u. (%s)\n",
4306 i
, strerror(errno
) ));
4310 /* Get the permset pointer from the new ACL entry. */
4311 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn
, the_entry
, &the_permset
) == -1) {
4312 DEBUG(0,("create_posix_acl_from_wire: Failed to get permset on entry %u. (%s)\n",
4313 i
, strerror(errno
) ));
4317 /* Map from wire to permissions. */
4318 if (!unix_ex_wire_to_permset(conn
, CVAL(pdata
,(i
*SMB_POSIX_ACL_ENTRY_SIZE
)+1), &the_permset
)) {
4319 DEBUG(0,("create_posix_acl_from_wire: invalid permset %u on entry %u.\n",
4320 CVAL(pdata
,(i
*SMB_POSIX_ACL_ENTRY_SIZE
) + 1), i
));
4324 /* Now apply to the new ACL entry. */
4325 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn
, the_entry
, the_permset
) == -1) {
4326 DEBUG(0,("create_posix_acl_from_wire: Failed to add permset on entry %u. (%s)\n",
4327 i
, strerror(errno
) ));
4331 if (tag_type
== SMB_ACL_USER
) {
4332 uint32 uidval
= IVAL(pdata
,(i
*SMB_POSIX_ACL_ENTRY_SIZE
)+2);
4333 uid_t uid
= (uid_t
)uidval
;
4334 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn
, the_entry
,(void *)&uid
) == -1) {
4335 DEBUG(0,("create_posix_acl_from_wire: Failed to set uid %u on entry %u. (%s)\n",
4336 (unsigned int)uid
, i
, strerror(errno
) ));
4341 if (tag_type
== SMB_ACL_GROUP
) {
4342 uint32 gidval
= IVAL(pdata
,(i
*SMB_POSIX_ACL_ENTRY_SIZE
)+2);
4343 gid_t gid
= (uid_t
)gidval
;
4344 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn
, the_entry
,(void *)&gid
) == -1) {
4345 DEBUG(0,("create_posix_acl_from_wire: Failed to set gid %u on entry %u. (%s)\n",
4346 (unsigned int)gid
, i
, strerror(errno
) ));
4356 if (the_acl
!= NULL
) {
4357 SMB_VFS_SYS_ACL_FREE_ACL(conn
, the_acl
);
4362 /****************************************************************************
4363 Calls from UNIX extensions - Default POSIX ACL set.
4364 If num_def_acls == 0 and not a directory just return. If it is a directory
4365 and num_def_acls == 0 then remove the default acl. Else set the default acl
4367 ****************************************************************************/
4369 bool set_unix_posix_default_acl(connection_struct
*conn
, const char *fname
, const SMB_STRUCT_STAT
*psbuf
,
4370 uint16 num_def_acls
, const char *pdata
)
4372 SMB_ACL_T def_acl
= NULL
;
4374 if (!S_ISDIR(psbuf
->st_ex_mode
)) {
4376 DEBUG(5,("set_unix_posix_default_acl: Can't set default ACL on non-directory file %s\n", fname
));
4384 if (!num_def_acls
) {
4385 /* Remove the default ACL. */
4386 if (SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn
, fname
) == -1) {
4387 DEBUG(5,("set_unix_posix_default_acl: acl_delete_def_file failed on directory %s (%s)\n",
4388 fname
, strerror(errno
) ));
4394 if ((def_acl
= create_posix_acl_from_wire(conn
, num_def_acls
, pdata
)) == NULL
) {
4398 if (SMB_VFS_SYS_ACL_SET_FILE(conn
, fname
, SMB_ACL_TYPE_DEFAULT
, def_acl
) == -1) {
4399 DEBUG(5,("set_unix_posix_default_acl: acl_set_file failed on directory %s (%s)\n",
4400 fname
, strerror(errno
) ));
4401 SMB_VFS_SYS_ACL_FREE_ACL(conn
, def_acl
);
4405 DEBUG(10,("set_unix_posix_default_acl: set default acl for file %s\n", fname
));
4406 SMB_VFS_SYS_ACL_FREE_ACL(conn
, def_acl
);
4410 /****************************************************************************
4411 Remove an ACL from a file. As we don't have acl_delete_entry() available
4412 we must read the current acl and copy all entries except MASK, USER and GROUP
4413 to a new acl, then set that. This (at least on Linux) causes any ACL to be
4415 FIXME ! How does the share mask/mode fit into this.... ?
4416 ****************************************************************************/
4418 static bool remove_posix_acl(connection_struct
*conn
, files_struct
*fsp
, const char *fname
)
4420 SMB_ACL_T file_acl
= NULL
;
4421 int entry_id
= SMB_ACL_FIRST_ENTRY
;
4422 SMB_ACL_ENTRY_T entry
;
4424 /* Create a new ACL with only 3 entries, u/g/w. */
4425 SMB_ACL_T new_file_acl
= SMB_VFS_SYS_ACL_INIT(conn
, 3);
4426 SMB_ACL_ENTRY_T user_ent
= NULL
;
4427 SMB_ACL_ENTRY_T group_ent
= NULL
;
4428 SMB_ACL_ENTRY_T other_ent
= NULL
;
4430 if (new_file_acl
== NULL
) {
4431 DEBUG(5,("remove_posix_acl: failed to init new ACL with 3 entries for file %s.\n", fname
));
4435 /* Now create the u/g/w entries. */
4436 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn
, &new_file_acl
, &user_ent
) == -1) {
4437 DEBUG(5,("remove_posix_acl: Failed to create user entry for file %s. (%s)\n",
4438 fname
, strerror(errno
) ));
4441 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn
, user_ent
, SMB_ACL_USER_OBJ
) == -1) {
4442 DEBUG(5,("remove_posix_acl: Failed to set user entry for file %s. (%s)\n",
4443 fname
, strerror(errno
) ));
4447 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn
, &new_file_acl
, &group_ent
) == -1) {
4448 DEBUG(5,("remove_posix_acl: Failed to create group entry for file %s. (%s)\n",
4449 fname
, strerror(errno
) ));
4452 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn
, group_ent
, SMB_ACL_GROUP_OBJ
) == -1) {
4453 DEBUG(5,("remove_posix_acl: Failed to set group entry for file %s. (%s)\n",
4454 fname
, strerror(errno
) ));
4458 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn
, &new_file_acl
, &other_ent
) == -1) {
4459 DEBUG(5,("remove_posix_acl: Failed to create other entry for file %s. (%s)\n",
4460 fname
, strerror(errno
) ));
4463 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn
, other_ent
, SMB_ACL_OTHER
) == -1) {
4464 DEBUG(5,("remove_posix_acl: Failed to set other entry for file %s. (%s)\n",
4465 fname
, strerror(errno
) ));
4469 /* Get the current file ACL. */
4470 if (fsp
&& fsp
->fh
->fd
!= -1) {
4471 file_acl
= SMB_VFS_SYS_ACL_GET_FD(fsp
);
4473 file_acl
= SMB_VFS_SYS_ACL_GET_FILE( conn
, fname
, SMB_ACL_TYPE_ACCESS
);
4476 if (file_acl
== NULL
) {
4477 /* This is only returned if an error occurred. Even for a file with
4478 no acl a u/g/w acl should be returned. */
4479 DEBUG(5,("remove_posix_acl: failed to get ACL from file %s (%s).\n",
4480 fname
, strerror(errno
) ));
4484 while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn
, file_acl
, entry_id
, &entry
) == 1) {
4485 SMB_ACL_TAG_T tagtype
;
4486 SMB_ACL_PERMSET_T permset
;
4488 entry_id
= SMB_ACL_NEXT_ENTRY
;
4490 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn
, entry
, &tagtype
) == -1) {
4491 DEBUG(5,("remove_posix_acl: failed to get tagtype from ACL on file %s (%s).\n",
4492 fname
, strerror(errno
) ));
4496 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn
, entry
, &permset
) == -1) {
4497 DEBUG(5,("remove_posix_acl: failed to get permset from ACL on file %s (%s).\n",
4498 fname
, strerror(errno
) ));
4502 if (tagtype
== SMB_ACL_USER_OBJ
) {
4503 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn
, user_ent
, permset
) == -1) {
4504 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4505 fname
, strerror(errno
) ));
4507 } else if (tagtype
== SMB_ACL_GROUP_OBJ
) {
4508 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn
, group_ent
, permset
) == -1) {
4509 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4510 fname
, strerror(errno
) ));
4512 } else if (tagtype
== SMB_ACL_OTHER
) {
4513 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn
, other_ent
, permset
) == -1) {
4514 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4515 fname
, strerror(errno
) ));
4520 /* Set the new empty file ACL. */
4521 if (fsp
&& fsp
->fh
->fd
!= -1) {
4522 if (SMB_VFS_SYS_ACL_SET_FD(fsp
, new_file_acl
) == -1) {
4523 DEBUG(5,("remove_posix_acl: acl_set_file failed on %s (%s)\n",
4524 fname
, strerror(errno
) ));
4528 if (SMB_VFS_SYS_ACL_SET_FILE(conn
, fname
, SMB_ACL_TYPE_ACCESS
, new_file_acl
) == -1) {
4529 DEBUG(5,("remove_posix_acl: acl_set_file failed on %s (%s)\n",
4530 fname
, strerror(errno
) ));
4540 SMB_VFS_SYS_ACL_FREE_ACL(conn
, file_acl
);
4543 SMB_VFS_SYS_ACL_FREE_ACL(conn
, new_file_acl
);
4548 /****************************************************************************
4549 Calls from UNIX extensions - POSIX ACL set.
4550 If num_def_acls == 0 then read/modify/write acl after removing all entries
4551 except SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER.
4552 ****************************************************************************/
4554 bool set_unix_posix_acl(connection_struct
*conn
, files_struct
*fsp
, const char *fname
, uint16 num_acls
, const char *pdata
)
4556 SMB_ACL_T file_acl
= NULL
;
4559 /* Remove the ACL from the file. */
4560 return remove_posix_acl(conn
, fsp
, fname
);
4563 if ((file_acl
= create_posix_acl_from_wire(conn
, num_acls
, pdata
)) == NULL
) {
4567 if (fsp
&& fsp
->fh
->fd
!= -1) {
4568 /* The preferred way - use an open fd. */
4569 if (SMB_VFS_SYS_ACL_SET_FD(fsp
, file_acl
) == -1) {
4570 DEBUG(5,("set_unix_posix_acl: acl_set_file failed on %s (%s)\n",
4571 fname
, strerror(errno
) ));
4572 SMB_VFS_SYS_ACL_FREE_ACL(conn
, file_acl
);
4576 if (SMB_VFS_SYS_ACL_SET_FILE(conn
, fname
, SMB_ACL_TYPE_ACCESS
, file_acl
) == -1) {
4577 DEBUG(5,("set_unix_posix_acl: acl_set_file failed on %s (%s)\n",
4578 fname
, strerror(errno
) ));
4579 SMB_VFS_SYS_ACL_FREE_ACL(conn
, file_acl
);
4584 DEBUG(10,("set_unix_posix_acl: set acl for file %s\n", fname
));
4585 SMB_VFS_SYS_ACL_FREE_ACL(conn
, file_acl
);
4589 /********************************************************************
4590 Pull the NT ACL from a file on disk or the OpenEventlog() access
4591 check. Caller is responsible for freeing the returned security
4592 descriptor via TALLOC_FREE(). This is designed for dealing with
4593 user space access checks in smbd outside of the VFS. For example,
4594 checking access rights in OpenEventlog().
4596 Assume we are dealing with files (for now)
4597 ********************************************************************/
4599 SEC_DESC
*get_nt_acl_no_snum( TALLOC_CTX
*ctx
, const char *fname
)
4601 SEC_DESC
*psd
, *ret_sd
;
4602 connection_struct
*conn
;
4604 struct fd_handle fh
;
4607 conn
= TALLOC_ZERO_P(ctx
, connection_struct
);
4609 DEBUG(0, ("talloc failed\n"));
4613 if (!(conn
->params
= TALLOC_P(conn
, struct share_params
))) {
4614 DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
4619 conn
->params
->service
= -1;
4621 set_conn_connectpath(conn
, "/");
4623 if (!smbd_vfs_init(conn
)) {
4624 DEBUG(0,("get_nt_acl_no_snum: Unable to create a fake connection struct!\n"));
4629 ZERO_STRUCT( finfo
);
4637 status
= create_synthetic_smb_fname(talloc_tos(), fname
, NULL
, NULL
,
4639 if (!NT_STATUS_IS_OK(status
)) {
4644 if (!NT_STATUS_IS_OK(SMB_VFS_FGET_NT_ACL( &finfo
, DACL_SECURITY_INFORMATION
, &psd
))) {
4645 DEBUG(0,("get_nt_acl_no_snum: get_nt_acl returned zero.\n"));
4646 TALLOC_FREE(finfo
.fsp_name
);
4651 ret_sd
= dup_sec_desc( ctx
, psd
);
4653 TALLOC_FREE(finfo
.fsp_name
);