2 Unix SMB/CIFS implementation.
4 POSIX NTVFS backend - NT ACLs mapped to NFS4 ACLs, as per
5 http://www.suse.de/~agruen/nfs4acl/
7 Copyright (C) Andrew Tridgell 2006
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "vfs_posix.h"
25 #include "../lib/util/unix_privs.h"
26 #include "librpc/gen_ndr/ndr_nfs4acl.h"
27 #include "libcli/security/security.h"
29 #define ACE4_IDENTIFIER_GROUP 0x40
32 load the current ACL from system.nfs4acl
34 static NTSTATUS
pvfs_acl_load_nfs4(struct pvfs_state
*pvfs
, struct pvfs_filename
*name
, int fd
,
36 struct security_descriptor
**psd
)
40 struct security_descriptor
*sd
;
43 struct composite_context
*ctx
;
45 acl
= talloc_zero(mem_ctx
, struct nfs4acl
);
46 NT_STATUS_HAVE_NO_MEMORY(acl
);
48 status
= pvfs_xattr_ndr_load(pvfs
, mem_ctx
, name
->full_name
, fd
,
50 acl
, ndr_pull_nfs4acl
);
51 if (!NT_STATUS_IS_OK(status
)) {
56 *psd
= security_descriptor_initialise(mem_ctx
);
57 NT_STATUS_HAVE_NO_MEMORY(*psd
);
61 sd
->type
|= acl
->a_flags
;
63 /* the number of ids to map is the acl count plus uid and gid */
64 num_ids
= acl
->a_count
+2;
65 ids
= talloc_array(sd
, struct id_map
, num_ids
);
66 NT_STATUS_HAVE_NO_MEMORY(ids
);
68 ids
[0].xid
.id
= name
->st
.st_uid
;
69 ids
[0].xid
.type
= ID_TYPE_UID
;
71 ids
[0].status
= ID_UNKNOWN
;
73 ids
[1].xid
.id
= name
->st
.st_gid
;
74 ids
[1].xid
.type
= ID_TYPE_GID
;
76 ids
[1].status
= ID_UNKNOWN
;
78 for (i
=0;i
<acl
->a_count
;i
++) {
79 struct nfs4ace
*a
= &acl
->ace
[i
];
80 ids
[i
+2].xid
.id
= a
->e_id
;
81 if (a
->e_flags
& ACE4_IDENTIFIER_GROUP
) {
82 ids
[i
+2].xid
.type
= ID_TYPE_GID
;
84 ids
[i
+2].xid
.type
= ID_TYPE_UID
;
87 ids
[i
+2].status
= ID_UNKNOWN
;
90 /* Allocate memory for the sids from the security descriptor to be on
92 ctx
= wbc_xids_to_sids_send(pvfs
->wbc_ctx
, sd
, num_ids
, ids
);
93 NT_STATUS_HAVE_NO_MEMORY(ctx
);
94 status
= wbc_xids_to_sids_recv(ctx
, &ids
);
95 NT_STATUS_NOT_OK_RETURN(status
);
97 sd
->owner_sid
= talloc_steal(sd
, ids
[0].sid
);
98 sd
->group_sid
= talloc_steal(sd
, ids
[1].sid
);
100 for (i
=0;i
<acl
->a_count
;i
++) {
101 struct nfs4ace
*a
= &acl
->ace
[i
];
102 struct security_ace ace
;
103 ace
.type
= a
->e_type
;
104 ace
.flags
= a
->e_flags
;
105 ace
.access_mask
= a
->e_mask
;
106 ace
.trustee
= *ids
[i
+2].sid
;
107 security_descriptor_dacl_add(sd
, &ace
);
114 save the acl for a file into system.nfs4acl
116 static NTSTATUS
pvfs_acl_save_nfs4(struct pvfs_state
*pvfs
, struct pvfs_filename
*name
, int fd
,
117 struct security_descriptor
*sd
)
125 struct composite_context
*ctx
;
127 tmp_ctx
= talloc_new(pvfs
);
128 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx
);
131 acl
.a_flags
= sd
->type
;
132 acl
.a_count
= sd
->dacl
?sd
->dacl
->num_aces
:0;
133 acl
.a_owner_mask
= 0;
134 acl
.a_group_mask
= 0;
135 acl
.a_other_mask
= 0;
137 acl
.ace
= talloc_array(tmp_ctx
, struct nfs4ace
, acl
.a_count
);
139 talloc_free(tmp_ctx
);
140 return NT_STATUS_NO_MEMORY
;
143 ids
= talloc_array(tmp_ctx
, struct id_map
, acl
.a_count
);
145 talloc_free(tmp_ctx
);
146 return NT_STATUS_NO_MEMORY
;
149 for (i
=0;i
<acl
.a_count
;i
++) {
150 struct security_ace
*ace
= &sd
->dacl
->aces
[i
];
151 ZERO_STRUCT(ids
[i
].xid
);
152 ids
[i
].sid
= dom_sid_dup(ids
, &ace
->trustee
);
153 if (ids
[i
].sid
== NULL
) {
154 talloc_free(tmp_ctx
);
155 return NT_STATUS_NO_MEMORY
;
157 ids
[i
].status
= ID_UNKNOWN
;
160 ctx
= wbc_sids_to_xids_send(pvfs
->wbc_ctx
,ids
, acl
.a_count
, ids
);
162 talloc_free(tmp_ctx
);
163 return NT_STATUS_NO_MEMORY
;
165 status
= wbc_sids_to_xids_recv(ctx
, &ids
);
166 if (!NT_STATUS_IS_OK(status
)) {
167 talloc_free(tmp_ctx
);
171 for (i
=0;i
<acl
.a_count
;i
++) {
172 struct nfs4ace
*a
= &acl
.ace
[i
];
173 struct security_ace
*ace
= &sd
->dacl
->aces
[i
];
174 a
->e_type
= ace
->type
;
175 a
->e_flags
= ace
->flags
;
176 a
->e_mask
= ace
->access_mask
;
177 if (ids
[i
].xid
.type
!= ID_TYPE_UID
) {
178 a
->e_flags
|= ACE4_IDENTIFIER_GROUP
;
180 a
->e_id
= ids
[i
].xid
.id
;
184 privs
= root_privileges();
185 status
= pvfs_xattr_ndr_save(pvfs
, name
->full_name
, fd
,
187 &acl
, ndr_push_nfs4acl
);
190 talloc_free(tmp_ctx
);
196 initialise pvfs acl NFS4 backend
198 NTSTATUS
pvfs_acl_nfs4_init(void)
200 struct pvfs_acl_ops ops
= {
202 .acl_load
= pvfs_acl_load_nfs4
,
203 .acl_save
= pvfs_acl_save_nfs4
205 return pvfs_acl_register(&ops
);