source3/modules/vfs_acl_common.c

   1 /*
   2  * Store Windows ACLs in data store - common functions.
   3  *
   4  * Copyright (C) Volker Lendecke, 2008
   5  * Copyright (C) Jeremy Allison, 2009
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 3 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 /* NOTE: This is an experimental module, not yet finished. JRA. */
  22
  23 #include "includes.h"
  24 #include "librpc/gen_ndr/xattr.h"
  25 #include "librpc/gen_ndr/ndr_xattr.h"
  26 #include "../lib/crypto/crypto.h"
  27
  28 #undef DBGC_CLASS
  29 #define DBGC_CLASS DBGC_VFS
  30
  31 static NTSTATUS create_acl_blob(const struct security_descriptor *psd,
  32                         DATA_BLOB *pblob,
  33                         uint16_t hash_type,
  34                         uint8_t hash[XATTR_SD_HASH_SIZE]);
  35
  36 #define HASH_SECURITY_INFO (OWNER_SECURITY_INFORMATION | \
  37                                 GROUP_SECURITY_INFORMATION | \
  38                                 DACL_SECURITY_INFORMATION | \
  39                                 SACL_SECURITY_INFORMATION)
  40
  41 /*******************************************************************
  42  Hash a security descriptor.
  43 *******************************************************************/
  44
  45 static NTSTATUS hash_sd_sha256(struct security_descriptor *psd,
  46                         uint8_t *hash)
  47 {
  48         DATA_BLOB blob;
  49         SHA256_CTX tctx;
  50         NTSTATUS status;
  51
  52         memset(hash, '\0', XATTR_SD_HASH_SIZE);
  53         status = create_acl_blob(psd, &blob, XATTR_SD_HASH_TYPE_SHA256, hash);
  54         if (!NT_STATUS_IS_OK(status)) {
  55                 return status;
  56         }
  57
  58         SHA256_Init(&tctx);
  59         SHA256_Update(&tctx, blob.data, blob.length);
  60         SHA256_Final(hash, &tctx);
  61
  62         return NT_STATUS_OK;
  63 }
  64
  65 /*******************************************************************
  66  Parse out a struct security_descriptor from a DATA_BLOB.
  67 *******************************************************************/
  68
  69 static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
  70                                 struct security_descriptor **ppdesc,
  71                                 uint16_t *p_hash_type,
  72                                 uint8_t hash[XATTR_SD_HASH_SIZE])
  73 {
  74         TALLOC_CTX *ctx = talloc_tos();
  75         struct xattr_NTACL xacl;
  76         enum ndr_err_code ndr_err;
  77         size_t sd_size;
  78
  79         ndr_err = ndr_pull_struct_blob(pblob, ctx, NULL, &xacl,
  80                         (ndr_pull_flags_fn_t)ndr_pull_xattr_NTACL);
  81
  82         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
  83                 DEBUG(5, ("parse_acl_blob: ndr_pull_xattr_NTACL failed: %s\n",
  84                         ndr_errstr(ndr_err)));
  85                 return ndr_map_error2ntstatus(ndr_err);;
  86         }
  87
  88         switch (xacl.version) {
  89                 case 2:
  90                         *ppdesc = make_sec_desc(ctx, SEC_DESC_REVISION,
  91                                         xacl.info.sd_hs2->sd->type | SEC_DESC_SELF_RELATIVE,
  92                                         xacl.info.sd_hs2->sd->owner_sid,
  93                                         xacl.info.sd_hs2->sd->group_sid,
  94                                         xacl.info.sd_hs2->sd->sacl,
  95                                         xacl.info.sd_hs2->sd->dacl,
  96                                         &sd_size);
  97                         /* No hash - null out. */
  98                         *p_hash_type = XATTR_SD_HASH_TYPE_NONE;
  99                         memset(hash, '\0', XATTR_SD_HASH_SIZE);
 100                         break;
 101                 case 3:
 102                         *ppdesc = make_sec_desc(ctx, SEC_DESC_REVISION,
 103                                         xacl.info.sd_hs3->sd->type | SEC_DESC_SELF_RELATIVE,
 104                                         xacl.info.sd_hs3->sd->owner_sid,
 105                                         xacl.info.sd_hs3->sd->group_sid,
 106                                         xacl.info.sd_hs3->sd->sacl,
 107                                         xacl.info.sd_hs3->sd->dacl,
 108                                         &sd_size);
 109                         *p_hash_type = xacl.info.sd_hs3->hash_type;
 110                         /* Current version 3. */
 111                         memcpy(hash, xacl.info.sd_hs3->hash, XATTR_SD_HASH_SIZE);
 112                         break;
 113                 default:
 114                         return NT_STATUS_REVISION_MISMATCH;
 115         }
 116
 117         TALLOC_FREE(xacl.info.sd);
 118
 119         return (*ppdesc != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
 120 }
 121
 122 /*******************************************************************
 123  Create a DATA_BLOB from a security descriptor.
 124 *******************************************************************/
 125
 126 static NTSTATUS create_acl_blob(const struct security_descriptor *psd,
 127                         DATA_BLOB *pblob,
 128                         uint16_t hash_type,
 129                         uint8_t hash[XATTR_SD_HASH_SIZE])
 130 {
 131         struct xattr_NTACL xacl;
 132         struct security_descriptor_hash_v3 sd_hs3;
 133         enum ndr_err_code ndr_err;
 134         TALLOC_CTX *ctx = talloc_tos();
 135
 136         ZERO_STRUCT(xacl);
 137         ZERO_STRUCT(sd_hs3);
 138
 139         xacl.version = 3;
 140         xacl.info.sd_hs3 = &sd_hs3;
 141         xacl.info.sd_hs3->sd = CONST_DISCARD(struct security_descriptor *, psd);
 142         xacl.info.sd_hs3->hash_type = hash_type;
 143         memcpy(&xacl.info.sd_hs3->hash[0], hash, XATTR_SD_HASH_SIZE);
 144
 145         ndr_err = ndr_push_struct_blob(
 146                         pblob, ctx, NULL, &xacl,
 147                         (ndr_push_flags_fn_t)ndr_push_xattr_NTACL);
 148
 149         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 150                 DEBUG(5, ("create_acl_blob: ndr_push_xattr_NTACL failed: %s\n",
 151                         ndr_errstr(ndr_err)));
 152                 return ndr_map_error2ntstatus(ndr_err);;
 153         }
 154
 155         return NT_STATUS_OK;
 156 }
 157
 158 /*******************************************************************
 159  Store a DATA_BLOB into an xattr given a pathname.
 160 *******************************************************************/
 161
 162 static NTSTATUS get_nt_acl_internal(vfs_handle_struct *handle,
 163                                 files_struct *fsp,
 164                                 const char *name,
 165                                 uint32_t security_info,
 166                                 struct security_descriptor **ppdesc)
 167 {
 168         DATA_BLOB blob;
 169         NTSTATUS status;
 170         uint16_t hash_type;
 171         uint8_t hash[XATTR_SD_HASH_SIZE];
 172         uint8_t hash_tmp[XATTR_SD_HASH_SIZE];
 173         struct security_descriptor *pdesc_next = NULL;
 174
 175         if (fsp && name == NULL) {
 176                 name = fsp->fsp_name->base_name;
 177         }
 178
 179         DEBUG(10, ("get_nt_acl_internal: name=%s\n", name));
 180
 181         status = get_acl_blob(talloc_tos(), handle, fsp, name, &blob);
 182         if (!NT_STATUS_IS_OK(status)) {
 183                 DEBUG(10, ("get_acl_blob returned %s\n", nt_errstr(status)));
 184                 return status;
 185         }
 186
 187         status = parse_acl_blob(&blob, ppdesc,
 188                                 &hash_type, &hash[0]);
 189         if (!NT_STATUS_IS_OK(status)) {
 190                 DEBUG(10, ("parse_acl_blob returned %s\n",
 191                                 nt_errstr(status)));
 192                 return status;
 193         }
 194
 195         /* Ensure the hash type is one we know. */
 196         switch (hash_type) {
 197                 case XATTR_SD_HASH_TYPE_NONE:
 198                         /* No hash, goto return blob sd. */
 199                         goto out;
 200                 case XATTR_SD_HASH_TYPE_SHA256:
 201                         break;
 202                 default:
 203                         return NT_STATUS_REVISION_MISMATCH;
 204         }
 205
 206         /* Get the full underlying sd, then hash. */
 207         if (fsp) {
 208                 status = SMB_VFS_NEXT_FGET_NT_ACL(handle,
 209                                 fsp,
 210                                 HASH_SECURITY_INFO,
 211                                 &pdesc_next);
 212         } else {
 213                 status = SMB_VFS_NEXT_GET_NT_ACL(handle,
 214                                 name,
 215                                 HASH_SECURITY_INFO,
 216                                 &pdesc_next);
 217         }
 218
 219         if (!NT_STATUS_IS_OK(status)) {
 220                 goto out;
 221         }
 222
 223         status = hash_sd_sha256(pdesc_next, hash_tmp);
 224         if (!NT_STATUS_IS_OK(status)) {
 225                 goto out;
 226         }
 227
 228         if (memcmp(&hash[0], &hash_tmp[0], XATTR_SD_HASH_SIZE) == 0) {
 229                 TALLOC_FREE(pdesc_next);
 230                 /* Hash matches, return blob sd. */
 231                 goto out;
 232         }
 233
 234         /* Hash doesn't match, return underlying sd. */
 235
 236         if (!(security_info & OWNER_SECURITY_INFORMATION)) {
 237                 pdesc_next->owner_sid = NULL;
 238         }
 239         if (!(security_info & GROUP_SECURITY_INFORMATION)) {
 240                 pdesc_next->group_sid = NULL;
 241         }
 242         if (!(security_info & DACL_SECURITY_INFORMATION)) {
 243                 pdesc_next->dacl = NULL;
 244         }
 245         if (!(security_info & SACL_SECURITY_INFORMATION)) {
 246                 pdesc_next->sacl = NULL;
 247         }
 248
 249         TALLOC_FREE(*ppdesc);
 250         *ppdesc = pdesc_next;
 251
 252   out:
 253
 254         if (!(security_info & OWNER_SECURITY_INFORMATION)) {
 255                 (*ppdesc)->owner_sid = NULL;
 256         }
 257         if (!(security_info & GROUP_SECURITY_INFORMATION)) {
 258                 (*ppdesc)->group_sid = NULL;
 259         }
 260         if (!(security_info & DACL_SECURITY_INFORMATION)) {
 261                 (*ppdesc)->dacl = NULL;
 262         }
 263         if (!(security_info & SACL_SECURITY_INFORMATION)) {
 264                 (*ppdesc)->sacl = NULL;
 265         }
 266
 267         TALLOC_FREE(blob.data);
 268         return status;
 269 }
 270
 271 /*********************************************************************
 272  Create a default security descriptor for a file in case no inheritance
 273  exists. All permissions to the owner and SYSTEM.
 274 *********************************************************************/
 275
 276 static struct security_descriptor *default_file_sd(TALLOC_CTX *mem_ctx,
 277                                                 SMB_STRUCT_STAT *psbuf)
 278 {
 279         struct dom_sid owner_sid, group_sid;
 280         size_t sd_size;
 281         struct security_ace *pace = NULL;
 282         struct security_acl *pacl = NULL;
 283
 284         uid_to_sid(&owner_sid, psbuf->st_ex_uid);
 285         gid_to_sid(&group_sid, psbuf->st_ex_gid);
 286
 287         pace = TALLOC_ARRAY(mem_ctx, struct security_ace, 2);
 288         if (!pace) {
 289                 return NULL;
 290         }
 291
 292         init_sec_ace(&pace[0], &owner_sid, SEC_ACE_TYPE_ACCESS_ALLOWED,
 293                         SEC_RIGHTS_FILE_ALL, 0);
 294         init_sec_ace(&pace[1], &global_sid_System, SEC_ACE_TYPE_ACCESS_ALLOWED,
 295                         SEC_RIGHTS_FILE_ALL, 0);
 296
 297         pacl = make_sec_acl(mem_ctx,
 298                                 NT4_ACL_REVISION,
 299                                 2,
 300                                 pace);
 301         if (!pacl) {
 302                 return NULL;
 303         }
 304         return make_sec_desc(mem_ctx,
 305                         SECURITY_DESCRIPTOR_REVISION_1,
 306                         SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT,
 307                         &owner_sid,
 308                         &group_sid,
 309                         NULL,
 310                         pacl,
 311                         &sd_size);
 312 }
 313
 314 /*********************************************************************
 315 *********************************************************************/
 316
 317 static NTSTATUS inherit_new_acl(vfs_handle_struct *handle,
 318                                         struct smb_filename *smb_fname,
 319                                         files_struct *fsp,
 320                                         bool container)
 321 {
 322         TALLOC_CTX *ctx = talloc_tos();
 323         NTSTATUS status;
 324         struct security_descriptor *parent_desc = NULL;
 325         struct security_descriptor *psd = NULL;
 326         struct security_descriptor *pdesc_next = NULL;
 327         DATA_BLOB blob;
 328         size_t size;
 329         char *parent_name;
 330         uint8_t hash[XATTR_SD_HASH_SIZE];
 331
 332         if (!parent_dirname(ctx, smb_fname->base_name, &parent_name, NULL)) {
 333                 return NT_STATUS_NO_MEMORY;
 334         }
 335
 336         DEBUG(10,("inherit_new_acl: check directory %s\n",
 337                         parent_name));
 338
 339         status = get_nt_acl_internal(handle,
 340                                 NULL,
 341                                 parent_name,
 342                                 (OWNER_SECURITY_INFORMATION |
 343                                  GROUP_SECURITY_INFORMATION |
 344                                  DACL_SECURITY_INFORMATION),
 345                                 &parent_desc);
 346         if (NT_STATUS_IS_OK(status)) {
 347                 /* Create an inherited descriptor from the parent. */
 348
 349                 if (DEBUGLEVEL >= 10) {
 350                         DEBUG(10,("inherit_new_acl: parent acl is:\n"));
 351                         NDR_PRINT_DEBUG(security_descriptor, parent_desc);
 352                 }
 353
 354                 status = se_create_child_secdesc(ctx,
 355                                 &psd,
 356                                 &size,
 357                                 parent_desc,
 358                                 &handle->conn->server_info->ptok->user_sids[PRIMARY_USER_SID_INDEX],
 359                                 &handle->conn->server_info->ptok->user_sids[PRIMARY_GROUP_SID_INDEX],
 360                                 container);
 361                 if (!NT_STATUS_IS_OK(status)) {
 362                         return status;
 363                 }
 364
 365                 if (DEBUGLEVEL >= 10) {
 366                         DEBUG(10,("inherit_new_acl: child acl is:\n"));
 367                         NDR_PRINT_DEBUG(security_descriptor, psd);
 368                 }
 369
 370         } else {
 371                 DEBUG(10,("inherit_new_acl: directory %s failed "
 372                         "to get acl %s\n",
 373                         parent_name,
 374                         nt_errstr(status) ));
 375         }
 376
 377         if (!psd || psd->dacl == NULL) {
 378                 int ret;
 379
 380                 TALLOC_FREE(psd);
 381                 if (fsp && !fsp->is_directory && fsp->fh->fd != -1) {
 382                         ret = SMB_VFS_FSTAT(fsp, &smb_fname->st);
 383                 } else {
 384                         if (fsp && fsp->posix_open) {
 385                                 ret = SMB_VFS_LSTAT(handle->conn, smb_fname);
 386                         } else {
 387                                 ret = SMB_VFS_STAT(handle->conn, smb_fname);
 388                         }
 389                 }
 390                 if (ret == -1) {
 391                         return map_nt_error_from_unix(errno);
 392                 }
 393                 psd = default_file_sd(ctx, &smb_fname->st);
 394                 if (!psd) {
 395                         return NT_STATUS_NO_MEMORY;
 396                 }
 397
 398                 if (DEBUGLEVEL >= 10) {
 399                         DEBUG(10,("inherit_new_acl: default acl is:\n"));
 400                         NDR_PRINT_DEBUG(security_descriptor, psd);
 401                 }
 402         }
 403
 404         /* Object exists. Read the current SD to get the hash. */
 405         if (fsp) {
 406                 status = SMB_VFS_NEXT_FGET_NT_ACL(handle,
 407                                 fsp,
 408                                 HASH_SECURITY_INFO,
 409                                 &pdesc_next);
 410         } else {
 411                 status = SMB_VFS_NEXT_GET_NT_ACL(handle,
 412                                 smb_fname->base_name,
 413                                 HASH_SECURITY_INFO,
 414                                 &pdesc_next);
 415         }
 416
 417         if (!NT_STATUS_IS_OK(status)) {
 418                 return status;
 419         }
 420
 421         status = hash_sd_sha256(pdesc_next, hash);
 422         if (!NT_STATUS_IS_OK(status)) {
 423                 return status;
 424         }
 425         status = create_acl_blob(psd, &blob, XATTR_SD_HASH_TYPE_SHA256, hash);
 426         if (!NT_STATUS_IS_OK(status)) {
 427                 return status;
 428         }
 429         if (fsp) {
 430                 return store_acl_blob_fsp(handle, fsp, &blob);
 431         } else {
 432                 return store_acl_blob_pathname(handle, smb_fname->base_name,
 433                                                &blob);
 434         }
 435 }
 436
 437 /*********************************************************************
 438  Check ACL on open. For new files inherit from parent directory.
 439 *********************************************************************/
 440
 441 int open_acl_common(vfs_handle_struct *handle,
 442                         struct smb_filename *smb_fname,
 443                         files_struct *fsp,
 444                         int flags,
 445                         mode_t mode)
 446 {
 447         uint32_t access_granted = 0;
 448         struct security_descriptor *pdesc = NULL;
 449         bool file_existed = true;
 450         char *fname = NULL;
 451         NTSTATUS status;
 452
 453         if (fsp->base_fsp) {
 454                 /* Stream open. Base filename open already did the ACL check. */
 455                 DEBUG(10,("open_acl_common: stream open on %s\n",
 456                         smb_fname_str_dbg(smb_fname) ));
 457                 return SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
 458         }
 459
 460         status = get_full_smb_filename(talloc_tos(), smb_fname,
 461                                        &fname);
 462         if (!NT_STATUS_IS_OK(status)) {
 463                 errno = map_errno_from_nt_status(status);
 464                 return -1;
 465         }
 466
 467         status = get_nt_acl_internal(handle,
 468                                 NULL,
 469                                 fname,
 470                                 (OWNER_SECURITY_INFORMATION |
 471                                  GROUP_SECURITY_INFORMATION |
 472                                  DACL_SECURITY_INFORMATION),
 473                                 &pdesc);
 474         if (NT_STATUS_IS_OK(status)) {
 475                 /* See if we can access it. */
 476                 status = smb1_file_se_access_check(pdesc,
 477                                         handle->conn->server_info->ptok,
 478                                         fsp->access_mask,
 479                                         &access_granted);
 480                 if (!NT_STATUS_IS_OK(status)) {
 481                         DEBUG(10,("open_acl_xattr: file %s open "
 482                                 "refused with error %s\n",
 483                                 smb_fname_str_dbg(smb_fname),
 484                                 nt_errstr(status) ));
 485                         errno = map_errno_from_nt_status(status);
 486                         return -1;
 487                 }
 488         } else if (NT_STATUS_EQUAL(status,NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
 489                 file_existed = false;
 490         }
 491
 492         DEBUG(10,("open_acl_xattr: get_nt_acl_attr_internal for "
 493                 "file %s returned %s\n",
 494                 smb_fname_str_dbg(smb_fname),
 495                 nt_errstr(status) ));
 496
 497         fsp->fh->fd = SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
 498
 499         if (!file_existed && fsp->fh->fd != -1) {
 500                 /* File was created. Inherit from parent directory. */
 501                 status = fsp_set_smb_fname(fsp, smb_fname);
 502                 if (!NT_STATUS_IS_OK(status)) {
 503                         errno = map_errno_from_nt_status(status);
 504                         return -1;
 505                 }
 506                 inherit_new_acl(handle, smb_fname, fsp, false);
 507         }
 508
 509         return fsp->fh->fd;
 510 }
 511
 512 int mkdir_acl_common(vfs_handle_struct *handle, const char *path, mode_t mode)
 513 {
 514         struct smb_filename *smb_fname = NULL;
 515         int ret = SMB_VFS_NEXT_MKDIR(handle, path, mode);
 516         NTSTATUS status;
 517
 518         if (ret == -1) {
 519                 return ret;
 520         }
 521
 522         status = create_synthetic_smb_fname(talloc_tos(), path, NULL, NULL,
 523                                             &smb_fname);
 524         if (!NT_STATUS_IS_OK(status)) {
 525                 errno = map_errno_from_nt_status(status);
 526                 return -1;
 527         }
 528
 529         /* New directory - inherit from parent. */
 530         inherit_new_acl(handle, smb_fname, NULL, true);
 531         TALLOC_FREE(smb_fname);
 532         return ret;
 533 }
 534
 535 /*********************************************************************
 536  Fetch a security descriptor given an fsp.
 537 *********************************************************************/
 538
 539 NTSTATUS fget_nt_acl_common(vfs_handle_struct *handle, files_struct *fsp,
 540         uint32_t security_info, struct security_descriptor **ppdesc)
 541 {
 542         return get_nt_acl_internal(handle, fsp,
 543                                 NULL, security_info, ppdesc);
 544 }
 545
 546 /*********************************************************************
 547  Fetch a security descriptor given a pathname.
 548 *********************************************************************/
 549
 550 NTSTATUS get_nt_acl_common(vfs_handle_struct *handle,
 551         const char *name, uint32_t security_info, struct security_descriptor **ppdesc)
 552 {
 553         return get_nt_acl_internal(handle, NULL,
 554                                 name, security_info, ppdesc);
 555 }
 556
 557 /*********************************************************************
 558  Store a security descriptor given an fsp.
 559 *********************************************************************/
 560
 561 NTSTATUS fset_nt_acl_common(vfs_handle_struct *handle, files_struct *fsp,
 562         uint32_t security_info_sent, const struct security_descriptor *psd)
 563 {
 564         NTSTATUS status;
 565         DATA_BLOB blob;
 566         struct security_descriptor *pdesc_next = NULL;
 567         uint8_t hash[XATTR_SD_HASH_SIZE];
 568
 569         if (DEBUGLEVEL >= 10) {
 570                 DEBUG(10,("fset_nt_acl_xattr: incoming sd for file %s\n",
 571                           fsp_str_dbg(fsp)));
 572                 NDR_PRINT_DEBUG(security_descriptor,
 573                         CONST_DISCARD(struct security_descriptor *,psd));
 574         }
 575
 576         /* Ensure owner and group are set. */
 577         if (!psd->owner_sid || !psd->group_sid) {
 578                 int ret;
 579                 DOM_SID owner_sid, group_sid;
 580                 struct security_descriptor *nc_psd = dup_sec_desc(talloc_tos(), psd);
 581
 582                 if (!nc_psd) {
 583                         return NT_STATUS_OK;
 584                 }
 585                 if (fsp->is_directory || fsp->fh->fd == -1) {
 586                         if (fsp->posix_open) {
 587                                 ret = SMB_VFS_LSTAT(fsp->conn, fsp->fsp_name);
 588                         } else {
 589                                 ret = SMB_VFS_STAT(fsp->conn, fsp->fsp_name);
 590                         }
 591                 } else {
 592                         ret = SMB_VFS_FSTAT(fsp, &fsp->fsp_name->st);
 593                 }
 594                 if (ret == -1) {
 595                         /* Lower level acl set succeeded,
 596                          * so still return OK. */
 597                         return NT_STATUS_OK;
 598                 }
 599                 create_file_sids(&fsp->fsp_name->st, &owner_sid, &group_sid);
 600                 /* This is safe as nc_psd is discarded at fn exit. */
 601                 nc_psd->owner_sid = &owner_sid;
 602                 nc_psd->group_sid = &group_sid;
 603                 security_info_sent |= (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION);
 604                 psd = nc_psd;
 605         }
 606
 607         status = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
 608         if (!NT_STATUS_IS_OK(status)) {
 609                 return status;
 610         }
 611
 612         /* Get the full underlying sd, then hash. */
 613         status = SMB_VFS_NEXT_FGET_NT_ACL(handle,
 614                                 fsp,
 615                                 HASH_SECURITY_INFO,
 616                                 &pdesc_next);
 617
 618         if (!NT_STATUS_IS_OK(status)) {
 619                 return status;
 620         }
 621
 622         status = hash_sd_sha256(pdesc_next, hash);
 623         if (!NT_STATUS_IS_OK(status)) {
 624                 return status;
 625         }
 626
 627         if (DEBUGLEVEL >= 10) {
 628                 DEBUG(10,("fset_nt_acl_xattr: storing xattr sd for file %s\n",
 629                           fsp_str_dbg(fsp)));
 630                 NDR_PRINT_DEBUG(security_descriptor,
 631                         CONST_DISCARD(struct security_descriptor *,psd));
 632         }
 633         create_acl_blob(psd, &blob, XATTR_SD_HASH_TYPE_SHA256, hash);
 634         store_acl_blob_fsp(handle, fsp, &blob);
 635
 636         return NT_STATUS_OK;
 637 }