2 Unix SMB/CIFS implementation.
3 Set NT and POSIX ACLs and other VFS operations from Python
5 Copyrigyt (C) Andrew Bartlett 2012
6 Copyright (C) Jeremy Allison 1994-2009.
7 Copyright (C) Andreas Gruenbacher 2002.
8 Copyright (C) Simo Sorce <idra@samba.org> 2009.
9 Copyright (C) Simo Sorce 2002
10 Copyright (C) Eric Lorimer 2002
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #include "smbd/smbd.h"
29 #include "libcli/util/pyerrors.h"
30 #include "librpc/rpc/pyrpc_util.h"
32 #include "system/filesys.h"
34 extern const struct generic_mapping file_generic_mapping
;
37 #define DBGC_CLASS DBGC_ACLS
39 static NTSTATUS
set_sys_acl_no_snum(const char *fname
,
40 SMB_ACL_TYPE_T acltype
,
43 connection_struct
*conn
;
44 NTSTATUS status
= NT_STATUS_OK
;
47 conn
= talloc_zero(NULL
, connection_struct
);
49 DEBUG(0, ("talloc failed\n"));
50 return NT_STATUS_NO_MEMORY
;
53 if (!(conn
->params
= talloc(conn
, struct share_params
))) {
54 DEBUG(0,("set_sys_acl_no_snum: talloc() failed!\n"));
56 return NT_STATUS_NO_MEMORY
;
59 conn
->params
->service
= -1;
61 set_conn_connectpath(conn
, "/");
65 ret
= SMB_VFS_SYS_ACL_SET_FILE( conn
, fname
, acltype
, theacl
);
67 status
= map_nt_error_from_unix_common(ret
);
68 DEBUG(0,("set_sys_acl_no_snum: SMB_VFS_SYS_ACL_SET_FILE "
77 static NTSTATUS
set_nt_acl_no_snum(const char *fname
,
78 uint32 security_info_sent
, const struct security_descriptor
*sd
)
80 TALLOC_CTX
*frame
= talloc_stackframe();
81 connection_struct
*conn
;
82 NTSTATUS status
= NT_STATUS_OK
;
84 struct smb_filename
*smb_fname
= NULL
;
87 conn
= talloc_zero(frame
, connection_struct
);
89 DEBUG(0, ("talloc failed\n"));
90 return NT_STATUS_NO_MEMORY
;
93 if (!(conn
->params
= talloc(conn
, struct share_params
))) {
94 DEBUG(0,("set_nt_acl_no_snum: talloc() failed!\n"));
96 return NT_STATUS_NO_MEMORY
;
99 conn
->params
->service
= -1;
101 set_conn_connectpath(conn
, "/");
105 fsp
= talloc_zero(frame
, struct files_struct
);
108 return NT_STATUS_NO_MEMORY
;
110 fsp
->fh
= talloc(fsp
, struct fd_handle
);
111 if (fsp
->fh
== NULL
) {
113 return NT_STATUS_NO_MEMORY
;
117 status
= create_synthetic_smb_fname_split(fsp
, fname
, NULL
,
119 if (!NT_STATUS_IS_OK(status
)) {
124 fsp
->fsp_name
= smb_fname
;
127 flags
= O_RDONLY
|O_DIRECTORY
;
129 /* POSIX allows us to open a directory with O_RDONLY. */
133 fsp
->fh
->fd
= SMB_VFS_OPEN(conn
, smb_fname
, fsp
, O_RDWR
, 00400);
134 if (fsp
->fh
->fd
== -1 && errno
== EISDIR
) {
135 fsp
->fh
->fd
= SMB_VFS_OPEN(conn
, smb_fname
, fsp
, flags
, 00400);
137 if (fsp
->fh
->fd
== -1) {
138 printf("open: error=%d (%s)\n", errno
, strerror(errno
));
140 return NT_STATUS_UNSUCCESSFUL
;
143 status
= SMB_VFS_FSET_NT_ACL( fsp
, security_info_sent
, sd
);
144 if (!NT_STATUS_IS_OK(status
)) {
145 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned %s.\n", nt_errstr(status
)));
155 static SMB_ACL_T
make_simple_acl(gid_t gid
, mode_t chmod_mode
)
157 mode_t mode
= SMB_ACL_READ
|SMB_ACL_WRITE
;
159 mode_t mode_user
= (chmod_mode
& 0700) >> 16;
160 mode_t mode_group
= (chmod_mode
& 070) >> 8;
161 mode_t mode_other
= chmod_mode
& 07;
163 SMB_ACL_ENTRY_T entry
;
164 SMB_ACL_T acl
= sys_acl_init();
170 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
175 if (sys_acl_set_tag_type(entry
, SMB_ACL_USER_OBJ
) != 0) {
180 if (sys_acl_set_permset(entry
, &mode_user
) != 0) {
185 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
190 if (sys_acl_set_tag_type(entry
, SMB_ACL_GROUP_OBJ
) != 0) {
195 if (sys_acl_set_permset(entry
, &mode_group
) != 0) {
200 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
205 if (sys_acl_set_tag_type(entry
, SMB_ACL_OTHER
) != 0) {
210 if (sys_acl_set_permset(entry
, &mode_other
) != 0) {
216 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
221 if (sys_acl_set_tag_type(entry
, SMB_ACL_GROUP
) != 0) {
226 if (sys_acl_set_qualifier(entry
, &gid
) != 0) {
231 if (sys_acl_set_permset(entry
, &mode_group
) != 0) {
237 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
242 if (sys_acl_set_tag_type(entry
, SMB_ACL_MASK
) != 0) {
247 if (sys_acl_set_permset(entry
, &mode
) != 0) {
255 set a simple ACL on a file, as a test
257 static PyObject
*py_smbd_set_simple_acl(PyObject
*self
, PyObject
*args
)
265 if (!PyArg_ParseTuple(args
, "si|i", &fname
, &mode
, &gid
))
268 acl
= make_simple_acl(gid
, mode
);
270 frame
= talloc_stackframe();
272 status
= set_sys_acl_no_snum(fname
, SMB_ACL_TYPE_ACCESS
, acl
);
277 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
285 static PyObject
*py_smbd_chown(PyObject
*self
, PyObject
*args
)
287 connection_struct
*conn
;
288 NTSTATUS status
= NT_STATUS_OK
;
295 if (!PyArg_ParseTuple(args
, "sii", &fname
, &uid
, &gid
))
298 frame
= talloc_stackframe();
300 conn
= talloc_zero(frame
, connection_struct
);
306 if (!(conn
->params
= talloc(conn
, struct share_params
))) {
311 conn
->params
->service
= -1;
313 set_conn_connectpath(conn
, "/");
317 ret
= SMB_VFS_CHOWN( conn
, fname
, uid
, gid
);
319 status
= map_nt_error_from_unix_common(errno
);
320 DEBUG(0,("chown returned failure: %s\n", strerror(errno
)));
327 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
333 check if we have ACL support
335 static PyObject
*py_smbd_have_posix_acls(PyObject
*self
, PyObject
*args
)
337 #ifdef HAVE_POSIX_ACLS
338 return PyBool_FromLong(true);
340 return PyBool_FromLong(false);
345 set the NT ACL on a file
347 static PyObject
*py_smbd_set_nt_acl(PyObject
*self
, PyObject
*args
)
351 int security_info_sent
;
353 struct security_descriptor
*sd
;
355 if (!PyArg_ParseTuple(args
, "siO", &fname
, &security_info_sent
, &py_sd
))
358 if (!py_check_dcerpc_type(py_sd
, "samba.dcerpc.security", "descriptor")) {
362 sd
= pytalloc_get_type(py_sd
, struct security_descriptor
);
364 status
= set_nt_acl_no_snum(fname
, security_info_sent
, sd
);
365 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
371 Return the NT ACL on a file
373 static PyObject
*py_smbd_get_nt_acl(PyObject
*self
, PyObject
*args
)
376 int security_info_wanted
;
378 struct security_descriptor
*sd
;
379 TALLOC_CTX
*tmp_ctx
= talloc_new(NULL
);
381 if (!PyArg_ParseTuple(args
, "si", &fname
, &security_info_wanted
))
384 sd
= get_nt_acl_no_snum(tmp_ctx
, fname
, security_info_wanted
);
386 py_sd
= py_return_ndr_struct("samba.dcerpc.security", "descriptor", sd
, sd
);
388 talloc_free(tmp_ctx
);
394 set the posix (or similar) ACL on a file
396 static PyObject
*py_smbd_set_sys_acl(PyObject
*self
, PyObject
*args
)
401 struct smb_acl_t
*acl
;
404 if (!PyArg_ParseTuple(args
, "siO", &fname
, &acl_type
, &py_acl
))
407 if (!py_check_dcerpc_type(py_acl
, "samba.dcerpc.smb_acl", "t")) {
411 acl
= pytalloc_get_type(py_acl
, struct smb_acl_t
);
413 status
= set_sys_acl_no_snum(fname
, acl_type
, acl
);
414 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
420 Return the posix (or similar) ACL on a file
422 static PyObject
*py_smbd_get_sys_acl(PyObject
*self
, PyObject
*args
)
426 struct smb_acl_t
*acl
;
428 TALLOC_CTX
*frame
= talloc_stackframe();
429 connection_struct
*conn
;
430 NTSTATUS status
= NT_STATUS_OK
;
432 if (!PyArg_ParseTuple(args
, "si", &fname
, &acl_type
)) {
437 conn
= talloc_zero(frame
, connection_struct
);
439 DEBUG(0, ("talloc failed\n"));
445 if (!(conn
->params
= talloc(conn
, struct share_params
))) {
446 DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
452 conn
->params
->service
= -1;
454 set_conn_connectpath(conn
, "/");
458 acl
= SMB_VFS_SYS_ACL_GET_FILE( conn
, fname
, acl_type
);
461 status
= map_nt_error_from_unix_common(errno
);
462 DEBUG(0,("sys_acl_get_file returned NULL: %s\n", strerror(errno
)));
463 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
466 talloc_steal(frame
, acl
);
469 py_acl
= py_return_ndr_struct("samba.dcerpc.smb_acl", "t", acl
, acl
);
476 static PyMethodDef py_smbd_methods
[] = {
478 (PyCFunction
)py_smbd_have_posix_acls
, METH_VARARGS
,
481 (PyCFunction
)py_smbd_set_simple_acl
, METH_VARARGS
,
484 (PyCFunction
)py_smbd_set_nt_acl
, METH_VARARGS
,
487 (PyCFunction
)py_smbd_get_nt_acl
, METH_VARARGS
,
490 (PyCFunction
)py_smbd_get_sys_acl
, METH_VARARGS
,
493 (PyCFunction
)py_smbd_set_sys_acl
, METH_VARARGS
,
496 (PyCFunction
)py_smbd_chown
, METH_VARARGS
,
506 m
= Py_InitModule3("smbd", py_smbd_methods
,
507 "Python bindings for the smbd file server.");