source3/smbd/pysmbd.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Set NT and POSIX ACLs and other VFS operations from Python
   4
   5    Copyrigyt (C) Andrew Bartlett 2012
   6    Copyright (C) Jeremy Allison 1994-2009.
   7    Copyright (C) Andreas Gruenbacher 2002.
   8    Copyright (C) Simo Sorce <idra@samba.org> 2009.
   9    Copyright (C) Simo Sorce 2002
  10    Copyright (C) Eric Lorimer 2002
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "smbd/smbd.h"
  28 #include <Python.h>
  29 #include "libcli/util/pyerrors.h"
  30 #include "librpc/rpc/pyrpc_util.h"
  31 #include <pytalloc.h>
  32 #include "system/filesys.h"
  33
  34 extern const struct generic_mapping file_generic_mapping;
  35
  36 #undef  DBGC_CLASS
  37 #define DBGC_CLASS DBGC_ACLS
  38
  39 static int conn_free_wrapper(connection_struct *conn)
  40 {
  41         conn_free(conn);
  42         return 0;
  43 };
  44
  45 static connection_struct *get_conn(TALLOC_CTX *mem_ctx, const char *service)
  46 {
  47         connection_struct *conn;
  48         TALLOC_CTX *frame = talloc_stackframe();
  49         if (!posix_locking_init(false)) {
  50                 PyErr_NoMemory();
  51                 TALLOC_FREE(frame);
  52                 return NULL;
  53         }
  54
  55         if (service) {
  56                 NTSTATUS status;
  57                 int snum = lp_servicenumber(service);
  58                 if (snum == -1) {
  59                         TALLOC_FREE(frame);
  60                         PyErr_SetString(PyExc_RuntimeError, "unknown service");
  61                         return NULL;
  62                 }
  63                 status = create_conn_struct(mem_ctx, NULL, NULL, &conn, snum, "/",
  64                                             NULL);
  65                 PyErr_NTSTATUS_IS_ERR_RAISE(status);
  66         } else {
  67                 conn = talloc_zero(mem_ctx, connection_struct);
  68                 if (conn == NULL) {
  69                         DEBUG(0, ("talloc failed\n"));
  70                         TALLOC_FREE(frame);
  71                         PyErr_NoMemory();
  72                         return NULL;
  73                 }
  74
  75                 if (!(conn->params = talloc(conn, struct share_params))) {
  76                         TALLOC_FREE(frame);
  77                         DEBUG(0,("get_conn: talloc() failed!\n"));
  78                         PyErr_NoMemory();
  79                         return NULL;
  80                 }
  81                 conn->params->service = -1;
  82
  83                 set_conn_connectpath(conn, "/");
  84
  85                 smbd_vfs_init(conn);
  86         }
  87         TALLOC_FREE(frame);
  88         conn->read_only = false;
  89         talloc_set_destructor(conn, conn_free_wrapper);
  90         return conn;
  91 }
  92
  93 static NTSTATUS set_sys_acl_conn(const char *fname,
  94                                  SMB_ACL_TYPE_T acltype,
  95                                  SMB_ACL_T theacl, connection_struct *conn)
  96 {
  97         NTSTATUS status = NT_STATUS_OK;
  98         int ret;
  99         mode_t saved_umask;
 100
 101         TALLOC_CTX *frame = talloc_stackframe();
 102
 103         /* we want total control over the permissions on created files,
 104            so set our umask to 0 */
 105         saved_umask = umask(0);
 106
 107         ret = SMB_VFS_SYS_ACL_SET_FILE( conn, fname, acltype, theacl);
 108         if (ret != 0) {
 109                 status = map_nt_error_from_unix_common(ret);
 110                 DEBUG(0,("set_sys_acl_conn: SMB_VFS_SYS_ACL_SET_FILE "
 111                          "returned zero.\n"));
 112         }
 113
 114         umask(saved_umask);
 115
 116         TALLOC_FREE(frame);
 117         return status;
 118 }
 119
 120 static NTSTATUS set_nt_acl_conn(const char *fname,
 121                                 uint32 security_info_sent, const struct security_descriptor *sd,
 122                                 connection_struct *conn)
 123 {
 124         TALLOC_CTX *frame = talloc_stackframe();
 125         NTSTATUS status = NT_STATUS_OK;
 126         files_struct *fsp;
 127         struct smb_filename *smb_fname = NULL;
 128         int flags, ret;
 129         mode_t saved_umask;
 130
 131         fsp = talloc_zero(frame, struct files_struct);
 132         if (fsp == NULL) {
 133                 TALLOC_FREE(frame);
 134                 return NT_STATUS_NO_MEMORY;
 135         }
 136         fsp->fh = talloc(fsp, struct fd_handle);
 137         if (fsp->fh == NULL) {
 138                 TALLOC_FREE(frame);
 139                 return NT_STATUS_NO_MEMORY;
 140         }
 141         fsp->conn = conn;
 142
 143         /* we want total control over the permissions on created files,
 144            so set our umask to 0 */
 145         saved_umask = umask(0);
 146
 147         status = create_synthetic_smb_fname_split(fsp, fname, NULL,
 148                                                   &smb_fname);
 149         if (!NT_STATUS_IS_OK(status)) {
 150                 TALLOC_FREE(frame);
 151                 umask(saved_umask);
 152                 return status;
 153         }
 154
 155         fsp->fsp_name = smb_fname;
 156
 157 #ifdef O_DIRECTORY
 158         flags = O_RDONLY|O_DIRECTORY;
 159 #else
 160         /* POSIX allows us to open a directory with O_RDONLY. */
 161         flags = O_RDONLY;
 162 #endif
 163
 164         fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, O_RDWR, 00400);
 165         if (fsp->fh->fd == -1 && errno == EISDIR) {
 166                 fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, flags, 00400);
 167         }
 168         if (fsp->fh->fd == -1) {
 169                 printf("open: error=%d (%s)\n", errno, strerror(errno));
 170                 TALLOC_FREE(frame);
 171                 umask(saved_umask);
 172                 return NT_STATUS_UNSUCCESSFUL;
 173         }
 174
 175         ret = SMB_VFS_FSTAT(fsp, &smb_fname->st);
 176         if (ret == -1) {
 177                 /* If we have an fd, this stat should succeed. */
 178                 DEBUG(0,("Error doing fstat on open file %s "
 179                         "(%s)\n",
 180                         smb_fname_str_dbg(smb_fname),
 181                         strerror(errno) ));
 182                 TALLOC_FREE(frame);
 183                 umask(saved_umask);
 184                 return map_nt_error_from_unix(errno);
 185         }
 186
 187         fsp->file_id = vfs_file_id_from_sbuf(conn, &smb_fname->st);
 188         fsp->vuid = UID_FIELD_INVALID;
 189         fsp->file_pid = 0;
 190         fsp->can_lock = True;
 191         fsp->can_read = True;
 192         fsp->can_write = True;
 193         fsp->print_file = NULL;
 194         fsp->modified = False;
 195         fsp->sent_oplock_break = NO_BREAK_SENT;
 196         fsp->is_directory = S_ISDIR(smb_fname->st.st_ex_mode);
 197
 198         status = SMB_VFS_FSET_NT_ACL( fsp, security_info_sent, sd);
 199         if (!NT_STATUS_IS_OK(status)) {
 200                 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned %s.\n", nt_errstr(status)));
 201         }
 202
 203         SMB_VFS_CLOSE(fsp);
 204
 205         conn_free(conn);
 206         TALLOC_FREE(frame);
 207
 208         umask(saved_umask);
 209         return status;
 210 }
 211
 212 static NTSTATUS get_nt_acl_conn(TALLOC_CTX *mem_ctx,
 213                                 const char *fname,
 214                                 connection_struct *conn,
 215                                 uint32 security_info_wanted,
 216                                 struct security_descriptor **sd)
 217 {
 218         TALLOC_CTX *frame = talloc_stackframe();
 219         NTSTATUS status = SMB_VFS_GET_NT_ACL( conn, fname, security_info_wanted,
 220                                      mem_ctx, sd);
 221         if (!NT_STATUS_IS_OK(status)) {
 222                 DEBUG(0,("get_nt_acl_conn: get_nt_acl returned %s.\n", nt_errstr(status)));
 223         }
 224
 225         TALLOC_FREE(frame);
 226
 227         return status;
 228 }
 229
 230
 231 static SMB_ACL_T make_simple_acl(gid_t gid, mode_t chmod_mode)
 232 {
 233         TALLOC_CTX *frame = talloc_stackframe();
 234
 235         mode_t mode = SMB_ACL_READ|SMB_ACL_WRITE|SMB_ACL_EXECUTE;
 236
 237         mode_t mode_user = (chmod_mode & 0700) >> 6;
 238         mode_t mode_group = (chmod_mode & 070) >> 3;
 239         mode_t mode_other = chmod_mode &  07;
 240         SMB_ACL_ENTRY_T entry;
 241         SMB_ACL_T acl = sys_acl_init(frame);
 242
 243         if (!acl) {
 244                 return NULL;
 245         }
 246
 247         if (sys_acl_create_entry(&acl, &entry) != 0) {
 248                 TALLOC_FREE(frame);
 249                 return NULL;
 250         }
 251
 252         if (sys_acl_set_tag_type(entry, SMB_ACL_USER_OBJ) != 0) {
 253                 TALLOC_FREE(frame);
 254                 return NULL;
 255         }
 256
 257         if (sys_acl_set_permset(entry, &mode_user) != 0) {
 258                 TALLOC_FREE(frame);
 259                 return NULL;
 260         }
 261
 262         if (sys_acl_create_entry(&acl, &entry) != 0) {
 263                 TALLOC_FREE(frame);
 264                 return NULL;
 265         }
 266
 267         if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP_OBJ) != 0) {
 268                 TALLOC_FREE(frame);
 269                 return NULL;
 270         }
 271
 272         if (sys_acl_set_permset(entry, &mode_group) != 0) {
 273                 TALLOC_FREE(frame);
 274                 return NULL;
 275         }
 276
 277         if (sys_acl_create_entry(&acl, &entry) != 0) {
 278                 TALLOC_FREE(frame);
 279                 return NULL;
 280         }
 281
 282         if (sys_acl_set_tag_type(entry, SMB_ACL_OTHER) != 0) {
 283                 TALLOC_FREE(frame);
 284                 return NULL;
 285         }
 286
 287         if (sys_acl_set_permset(entry, &mode_other) != 0) {
 288                 TALLOC_FREE(frame);
 289                 return NULL;
 290         }
 291
 292         if (gid != -1) {
 293                 if (sys_acl_create_entry(&acl, &entry) != 0) {
 294                         TALLOC_FREE(frame);
 295                         return NULL;
 296                 }
 297
 298                 if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP) != 0) {
 299                         TALLOC_FREE(frame);
 300                         return NULL;
 301                 }
 302
 303                 if (sys_acl_set_qualifier(entry, &gid) != 0) {
 304                         TALLOC_FREE(frame);
 305                         return NULL;
 306                 }
 307
 308                 if (sys_acl_set_permset(entry, &mode_group) != 0) {
 309                         TALLOC_FREE(frame);
 310                         return NULL;
 311                 }
 312         }
 313
 314         if (sys_acl_create_entry(&acl, &entry) != 0) {
 315                 TALLOC_FREE(frame);
 316                 return NULL;
 317         }
 318
 319         if (sys_acl_set_tag_type(entry, SMB_ACL_MASK) != 0) {
 320                 TALLOC_FREE(frame);
 321                 return NULL;
 322         }
 323
 324         if (sys_acl_set_permset(entry, &mode) != 0) {
 325                 TALLOC_FREE(frame);
 326                 return NULL;
 327         }
 328         return acl;
 329 }
 330
 331 /*
 332   set a simple ACL on a file, as a test
 333  */
 334 static PyObject *py_smbd_set_simple_acl(PyObject *self, PyObject *args)
 335 {
 336         NTSTATUS status;
 337         char *fname, *service = NULL;
 338         int mode, gid = -1;
 339         SMB_ACL_T acl;
 340         TALLOC_CTX *frame;
 341         connection_struct *conn;
 342
 343         if (!PyArg_ParseTuple(args, "si|iz", &fname, &mode, &gid, &service))
 344                 return NULL;
 345
 346         acl = make_simple_acl(gid, mode);
 347
 348         frame = talloc_stackframe();
 349
 350         conn = get_conn(frame, service);
 351         if (!conn) {
 352                 return NULL;
 353         }
 354
 355         status = set_sys_acl_conn(fname, SMB_ACL_TYPE_ACCESS, acl, conn);
 356         TALLOC_FREE(acl);
 357
 358         TALLOC_FREE(frame);
 359
 360         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 361
 362         Py_RETURN_NONE;
 363 }
 364
 365 /*
 366   chown a file
 367  */
 368 static PyObject *py_smbd_chown(PyObject *self, PyObject *args)
 369 {
 370         connection_struct *conn;
 371         NTSTATUS status = NT_STATUS_OK;
 372         int ret;
 373
 374         char *fname, *service = NULL;
 375         int uid, gid;
 376         TALLOC_CTX *frame;
 377         mode_t saved_umask;
 378
 379         if (!PyArg_ParseTuple(args, "sii|z", &fname, &uid, &gid, &service))
 380                 return NULL;
 381
 382         frame = talloc_stackframe();
 383
 384         conn = get_conn(frame, service);
 385         if (!conn) {
 386                 return NULL;
 387         }
 388
 389         /* we want total control over the permissions on created files,
 390            so set our umask to 0 */
 391         saved_umask = umask(0);
 392
 393         ret = SMB_VFS_CHOWN( conn, fname, uid, gid);
 394         if (ret != 0) {
 395                 status = map_nt_error_from_unix_common(errno);
 396                 DEBUG(0,("chown returned failure: %s\n", strerror(errno)));
 397         }
 398
 399         umask(saved_umask);
 400
 401         TALLOC_FREE(frame);
 402
 403         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 404
 405         Py_RETURN_NONE;
 406 }
 407
 408 /*
 409   chown a file
 410  */
 411 static PyObject *py_smbd_unlink(PyObject *self, PyObject *args)
 412 {
 413         connection_struct *conn;
 414         NTSTATUS status = NT_STATUS_OK;
 415         int ret;
 416         struct smb_filename *smb_fname = NULL;
 417         char *fname, *service = NULL;
 418         TALLOC_CTX *frame;
 419
 420         frame = talloc_stackframe();
 421
 422         if (!PyArg_ParseTuple(args, "s|z", &fname, &service)) {
 423                 TALLOC_FREE(frame);
 424                 return NULL;
 425         }
 426
 427         conn = get_conn(frame, service);
 428         if (!conn) {
 429                 TALLOC_FREE(frame);
 430                 return NULL;
 431         }
 432
 433         status = create_synthetic_smb_fname_split(frame, fname, NULL,
 434                                                   &smb_fname);
 435         if (!NT_STATUS_IS_OK(status)) {
 436                 TALLOC_FREE(frame);
 437                 PyErr_NTSTATUS_IS_ERR_RAISE(status);
 438         }
 439
 440         ret = SMB_VFS_UNLINK(conn, smb_fname);
 441         if (ret != 0) {
 442                 status = map_nt_error_from_unix_common(errno);
 443                 DEBUG(0,("unlink returned failure: %s\n", strerror(errno)));
 444         }
 445
 446         TALLOC_FREE(frame);
 447
 448         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 449
 450         Py_RETURN_NONE;
 451 }
 452
 453 /*
 454   check if we have ACL support
 455  */
 456 static PyObject *py_smbd_have_posix_acls(PyObject *self, PyObject *args)
 457 {
 458 #ifdef HAVE_POSIX_ACLS
 459         return PyBool_FromLong(true);
 460 #else
 461         return PyBool_FromLong(false);
 462 #endif
 463 }
 464
 465 /*
 466   set the NT ACL on a file
 467  */
 468 static PyObject *py_smbd_set_nt_acl(PyObject *self, PyObject *args)
 469 {
 470         NTSTATUS status;
 471         char *fname, *service = NULL;
 472         int security_info_sent;
 473         PyObject *py_sd;
 474         struct security_descriptor *sd;
 475         connection_struct *conn;
 476         TALLOC_CTX *frame;
 477
 478         frame = talloc_stackframe();
 479
 480         if (!PyArg_ParseTuple(args, "siO|z", &fname, &security_info_sent, &py_sd, &service)) {
 481                 TALLOC_FREE(frame);
 482                 return NULL;
 483         }
 484
 485         if (!py_check_dcerpc_type(py_sd, "samba.dcerpc.security", "descriptor")) {
 486                 TALLOC_FREE(frame);
 487                 return NULL;
 488         }
 489
 490         conn = get_conn(frame, service);
 491         if (!conn) {
 492                 TALLOC_FREE(frame);
 493                 return NULL;
 494         }
 495
 496         sd = pytalloc_get_type(py_sd, struct security_descriptor);
 497
 498         status = set_nt_acl_conn(fname, security_info_sent, sd, conn);
 499         TALLOC_FREE(frame);
 500         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 501
 502         Py_RETURN_NONE;
 503 }
 504
 505 /*
 506   Return the NT ACL on a file
 507  */
 508 static PyObject *py_smbd_get_nt_acl(PyObject *self, PyObject *args)
 509 {
 510         char *fname, *service = NULL;
 511         int security_info_wanted;
 512         PyObject *py_sd;
 513         struct security_descriptor *sd;
 514         TALLOC_CTX *tmp_ctx = talloc_new(NULL);
 515         connection_struct *conn;
 516         NTSTATUS status;
 517
 518         if (!PyArg_ParseTuple(args, "si|z", &fname, &security_info_wanted, &service)) {
 519                 TALLOC_FREE(tmp_ctx);
 520                 return NULL;
 521         }
 522
 523         conn = get_conn(tmp_ctx, service);
 524         if (!conn) {
 525                 TALLOC_FREE(tmp_ctx);
 526                 return NULL;
 527         }
 528
 529         status = get_nt_acl_conn(tmp_ctx, fname, conn, security_info_wanted, &sd);
 530         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 531
 532         py_sd = py_return_ndr_struct("samba.dcerpc.security", "descriptor", sd, sd);
 533
 534         TALLOC_FREE(tmp_ctx);
 535
 536         return py_sd;
 537 }
 538
 539 /*
 540   set the posix (or similar) ACL on a file
 541  */
 542 static PyObject *py_smbd_set_sys_acl(PyObject *self, PyObject *args)
 543 {
 544         TALLOC_CTX *frame = talloc_stackframe();
 545         NTSTATUS status;
 546         char *fname, *service = NULL;
 547         PyObject *py_acl;
 548         struct smb_acl_t *acl;
 549         int acl_type;
 550         connection_struct *conn;
 551
 552         if (!PyArg_ParseTuple(args, "siO|z", &fname, &acl_type, &py_acl, &service)) {
 553                 TALLOC_FREE(frame);
 554                 return NULL;
 555         }
 556
 557         if (!py_check_dcerpc_type(py_acl, "samba.dcerpc.smb_acl", "t")) {
 558                 TALLOC_FREE(frame);
 559                 return NULL;
 560         }
 561
 562         conn = get_conn(frame, service);
 563         if (!conn) {
 564                 TALLOC_FREE(frame);
 565                 return NULL;
 566         }
 567
 568         acl = pytalloc_get_type(py_acl, struct smb_acl_t);
 569
 570         status = set_sys_acl_conn(fname, acl_type, acl, conn);
 571         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 572
 573         TALLOC_FREE(frame);
 574         Py_RETURN_NONE;
 575 }
 576
 577 /*
 578   Return the posix (or similar) ACL on a file
 579  */
 580 static PyObject *py_smbd_get_sys_acl(PyObject *self, PyObject *args)
 581 {
 582         char *fname;
 583         PyObject *py_acl;
 584         struct smb_acl_t *acl;
 585         int acl_type;
 586         TALLOC_CTX *frame = talloc_stackframe();
 587         TALLOC_CTX *tmp_ctx = talloc_new(NULL);
 588         connection_struct *conn;
 589         NTSTATUS status = NT_STATUS_OK;
 590         char *service = NULL;
 591         if (!tmp_ctx) {
 592                 PyErr_NoMemory();
 593                 return NULL;
 594         }
 595
 596         if (!PyArg_ParseTuple(args, "si|z", &fname, &acl_type, &service)) {
 597                 TALLOC_FREE(frame);
 598                 TALLOC_FREE(tmp_ctx);
 599                 return NULL;
 600         }
 601
 602         conn = get_conn(frame, service);
 603         if (!conn) {
 604                 TALLOC_FREE(frame);
 605                 TALLOC_FREE(tmp_ctx);
 606                 return NULL;
 607         }
 608
 609         acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, acl_type, tmp_ctx);
 610         if (!acl) {
 611                 TALLOC_FREE(frame);
 612                 TALLOC_FREE(tmp_ctx);
 613                 status = map_nt_error_from_unix_common(errno);
 614                 DEBUG(0,("sys_acl_get_file returned NULL: %s\n", strerror(errno)));
 615                 PyErr_NTSTATUS_IS_ERR_RAISE(status);
 616         }
 617
 618         py_acl = py_return_ndr_struct("samba.dcerpc.smb_acl", "t", acl, acl);
 619
 620         TALLOC_FREE(frame);
 621         TALLOC_FREE(tmp_ctx);
 622
 623         return py_acl;
 624 }
 625
 626 static PyMethodDef py_smbd_methods[] = {
 627         { "have_posix_acls",
 628                 (PyCFunction)py_smbd_have_posix_acls, METH_VARARGS,
 629                 NULL },
 630         { "set_simple_acl",
 631                 (PyCFunction)py_smbd_set_simple_acl, METH_VARARGS,
 632                 NULL },
 633         { "set_nt_acl",
 634                 (PyCFunction)py_smbd_set_nt_acl, METH_VARARGS,
 635                 NULL },
 636         { "get_nt_acl",
 637                 (PyCFunction)py_smbd_get_nt_acl, METH_VARARGS,
 638                 NULL },
 639         { "get_sys_acl",
 640                 (PyCFunction)py_smbd_get_sys_acl, METH_VARARGS,
 641                 NULL },
 642         { "set_sys_acl",
 643                 (PyCFunction)py_smbd_set_sys_acl, METH_VARARGS,
 644                 NULL },
 645         { "chown",
 646                 (PyCFunction)py_smbd_chown, METH_VARARGS,
 647                 NULL },
 648         { "unlink",
 649                 (PyCFunction)py_smbd_unlink, METH_VARARGS,
 650                 NULL },
 651         { NULL }
 652 };
 653
 654 void initsmbd(void);
 655 void initsmbd(void)
 656 {
 657         PyObject *m;
 658
 659         m = Py_InitModule3("smbd", py_smbd_methods,
 660                            "Python bindings for the smbd file server.");
 661         if (m == NULL)
 662                 return;
 663
 664 }