4 * Copyright (C) Jim McDonough, 2006
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 #include "nfs4_acls.h"
24 #define DBGC_CLASS DBGC_ACLS
26 #define SMBACL4_PARAM_TYPE_NAME "nfs4"
28 #define SMB_ACE4_INT_MAGIC 0x76F8A967
29 typedef struct _SMB_ACE4_INT_T
36 #define SMB_ACL4_INT_MAGIC 0x29A3E792
37 typedef struct _SMB_ACL4_INT_T
41 SMB_ACE4_INT_T
*first
;
45 extern int try_chown(connection_struct
*conn
, const char *fname
, uid_t uid
, gid_t gid
);
46 extern NTSTATUS
unpack_nt_owners(int snum
, uid_t
*puser
, gid_t
*pgrp
,
47 uint32 security_info_sent
, SEC_DESC
*psd
);
49 static SMB_ACL4_INT_T
*get_validated_aclint(SMB4ACL_T
*acl
)
51 SMB_ACL4_INT_T
*aclint
= (SMB_ACL4_INT_T
*)acl
;
54 DEBUG(2, ("acl is NULL\n"));
58 if (aclint
->magic
!=SMB_ACL4_INT_MAGIC
)
60 DEBUG(2, ("aclint bad magic 0x%x\n", aclint
->magic
));
67 static SMB_ACE4_INT_T
*get_validated_aceint(SMB4ACE_T
*ace
)
69 SMB_ACE4_INT_T
*aceint
= (SMB_ACE4_INT_T
*)ace
;
72 DEBUG(2, ("ace is NULL\n"));
76 if (aceint
->magic
!=SMB_ACE4_INT_MAGIC
)
78 DEBUG(2, ("aceint bad magic 0x%x\n", aceint
->magic
));
85 SMB4ACL_T
*smb_create_smb4acl(void)
87 TALLOC_CTX
*mem_ctx
= talloc_tos();
88 SMB_ACL4_INT_T
*acl
= (SMB_ACL4_INT_T
*)TALLOC_ZERO_SIZE(mem_ctx
, sizeof(SMB_ACL4_INT_T
));
91 DEBUG(0, ("TALLOC_SIZE failed\n"));
95 acl
->magic
= SMB_ACL4_INT_MAGIC
;
96 /* acl->first, last = NULL not needed */
97 return (SMB4ACL_T
*)acl
;
100 SMB4ACE_T
*smb_add_ace4(SMB4ACL_T
*acl
, SMB_ACE4PROP_T
*prop
)
102 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
103 TALLOC_CTX
*mem_ctx
= talloc_tos();
106 ace
= (SMB_ACE4_INT_T
*)TALLOC_ZERO_SIZE(mem_ctx
, sizeof(SMB_ACE4_INT_T
));
109 DEBUG(0, ("TALLOC_SIZE failed\n"));
113 ace
->magic
= SMB_ACE4_INT_MAGIC
;
114 /* ace->next = NULL not needed */
115 memcpy(&ace
->prop
, prop
, sizeof(SMB_ACE4PROP_T
));
117 if (aclint
->first
==NULL
)
122 aclint
->last
->next
= (void *)ace
;
127 return (SMB4ACE_T
*)ace
;
130 SMB_ACE4PROP_T
*smb_get_ace4(SMB4ACE_T
*ace
)
132 SMB_ACE4_INT_T
*aceint
= get_validated_aceint(ace
);
136 return &aceint
->prop
;
139 SMB4ACE_T
*smb_next_ace4(SMB4ACE_T
*ace
)
141 SMB_ACE4_INT_T
*aceint
= get_validated_aceint(ace
);
145 return (SMB4ACE_T
*)aceint
->next
;
148 SMB4ACE_T
*smb_first_ace4(SMB4ACL_T
*acl
)
150 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
154 return (SMB4ACE_T
*)aclint
->first
;
157 uint32
smb_get_naces(SMB4ACL_T
*acl
)
159 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
163 return aclint
->naces
;
166 static int smbacl4_GetFileOwner(struct connection_struct
*conn
,
167 const char *filename
,
168 SMB_STRUCT_STAT
*psbuf
)
170 memset(psbuf
, 0, sizeof(SMB_STRUCT_STAT
));
172 /* Get the stat struct for the owner info. */
173 if (SMB_VFS_STAT(conn
, filename
, psbuf
) != 0)
175 DEBUG(8, ("SMB_VFS_STAT failed with error %s\n",
183 static int smbacl4_fGetFileOwner(files_struct
*fsp
, SMB_STRUCT_STAT
*psbuf
)
185 memset(psbuf
, 0, sizeof(SMB_STRUCT_STAT
));
187 if (fsp
->is_directory
|| fsp
->fh
->fd
== -1) {
188 return smbacl4_GetFileOwner(fsp
->conn
, fsp
->fsp_name
, psbuf
);
190 if (SMB_VFS_FSTAT(fsp
, psbuf
) != 0)
192 DEBUG(8, ("SMB_VFS_FSTAT failed with error %s\n",
200 static bool smbacl4_nfs42win(TALLOC_CTX
*mem_ctx
, SMB4ACL_T
*acl
, /* in */
201 DOM_SID
*psid_owner
, /* in */
202 DOM_SID
*psid_group
, /* in */
203 SEC_ACE
**ppnt_ace_list
, /* out */
204 int *pgood_aces
/* out */
207 SMB_ACL4_INT_T
*aclint
= (SMB_ACL4_INT_T
*)acl
;
208 SMB_ACE4_INT_T
*aceint
;
209 SEC_ACE
*nt_ace_list
= NULL
;
212 DEBUG(10, ("smbacl_nfs42win entered"));
214 aclint
= get_validated_aclint(acl
);
215 /* We do not check for naces being 0 or acl being NULL here because it is done upstream */
216 /* in smb_get_nt_acl_nfs4(). */
217 nt_ace_list
= (SEC_ACE
*)TALLOC_ZERO_SIZE(mem_ctx
, aclint
->naces
* sizeof(SEC_ACE
));
218 if (nt_ace_list
==NULL
)
220 DEBUG(10, ("talloc error"));
225 for (aceint
=aclint
->first
; aceint
!=NULL
; aceint
=(SMB_ACE4_INT_T
*)aceint
->next
) {
228 SMB_ACE4PROP_T
*ace
= &aceint
->prop
;
230 DEBUG(10, ("magic: 0x%x, type: %d, iflags: %x, flags: %x, mask: %x, "
231 "who: %d\n", aceint
->magic
, ace
->aceType
, ace
->flags
,
232 ace
->aceFlags
, ace
->aceMask
, ace
->who
.id
));
234 SMB_ASSERT(aceint
->magic
==SMB_ACE4_INT_MAGIC
);
236 if (ace
->flags
& SMB_ACE4_ID_SPECIAL
) {
237 switch (ace
->who
.special_id
) {
238 case SMB_ACE4_WHO_OWNER
:
239 sid_copy(&sid
, psid_owner
);
241 case SMB_ACE4_WHO_GROUP
:
242 sid_copy(&sid
, psid_group
);
244 case SMB_ACE4_WHO_EVERYONE
:
245 sid_copy(&sid
, &global_sid_World
);
248 DEBUG(8, ("invalid special who id %d "
249 "ignored\n", ace
->who
.special_id
));
252 if (ace
->aceFlags
& SMB_ACE4_IDENTIFIER_GROUP
) {
253 gid_to_sid(&sid
, ace
->who
.gid
);
255 uid_to_sid(&sid
, ace
->who
.uid
);
258 DEBUG(10, ("mapped %d to %s\n", ace
->who
.id
,
259 sid_string_dbg(&sid
)));
261 init_sec_access(&mask
, ace
->aceMask
);
262 init_sec_ace(&nt_ace_list
[good_aces
++], &sid
,
264 ace
->aceFlags
& 0xf);
267 *ppnt_ace_list
= nt_ace_list
;
268 *pgood_aces
= good_aces
;
273 static NTSTATUS
smb_get_nt_acl_nfs4_common(const SMB_STRUCT_STAT
*sbuf
,
274 uint32 security_info
,
275 SEC_DESC
**ppdesc
, SMB4ACL_T
*acl
)
278 DOM_SID sid_owner
, sid_group
;
280 SEC_ACE
*nt_ace_list
= NULL
;
282 TALLOC_CTX
*mem_ctx
= talloc_tos();
284 if (acl
==NULL
|| smb_get_naces(acl
)==0)
285 return NT_STATUS_ACCESS_DENIED
; /* special because we
286 * shouldn't alloc 0 for
289 uid_to_sid(&sid_owner
, sbuf
->st_uid
);
290 gid_to_sid(&sid_group
, sbuf
->st_gid
);
292 if (smbacl4_nfs42win(mem_ctx
, acl
, &sid_owner
, &sid_group
, &nt_ace_list
, &good_aces
)==False
) {
293 DEBUG(8,("smbacl4_nfs42win failed\n"));
294 return map_nt_error_from_unix(errno
);
297 psa
= make_sec_acl(mem_ctx
, NT4_ACL_REVISION
, good_aces
, nt_ace_list
);
299 DEBUG(2,("make_sec_acl failed\n"));
300 return NT_STATUS_NO_MEMORY
;
303 DEBUG(10,("after make sec_acl\n"));
304 *ppdesc
= make_sec_desc(mem_ctx
, SEC_DESC_REVISION
, SEC_DESC_SELF_RELATIVE
,
305 (security_info
& OWNER_SECURITY_INFORMATION
) ? &sid_owner
: NULL
,
306 (security_info
& GROUP_SECURITY_INFORMATION
) ? &sid_group
: NULL
,
307 NULL
, psa
, &sd_size
);
309 DEBUG(2,("make_sec_desc failed\n"));
310 return NT_STATUS_NO_MEMORY
;
313 DEBUG(10, ("smb_get_nt_acl_nfs4_common successfully exited with sd_size %d\n",
314 ndr_size_security_descriptor(*ppdesc
, 0)));
319 NTSTATUS
smb_fget_nt_acl_nfs4(files_struct
*fsp
,
320 uint32 security_info
,
321 SEC_DESC
**ppdesc
, SMB4ACL_T
*acl
)
323 SMB_STRUCT_STAT sbuf
;
325 DEBUG(10, ("smb_fget_nt_acl_nfs4 invoked for %s\n", fsp
->fsp_name
));
327 if (smbacl4_fGetFileOwner(fsp
, &sbuf
)) {
328 return map_nt_error_from_unix(errno
);
331 return smb_get_nt_acl_nfs4_common(&sbuf
, security_info
, ppdesc
, acl
);
334 NTSTATUS
smb_get_nt_acl_nfs4(struct connection_struct
*conn
,
336 uint32 security_info
,
337 SEC_DESC
**ppdesc
, SMB4ACL_T
*acl
)
339 SMB_STRUCT_STAT sbuf
;
341 DEBUG(10, ("smb_get_nt_acl_nfs4 invoked for %s\n", name
));
343 if (smbacl4_GetFileOwner(conn
, name
, &sbuf
)) {
344 return map_nt_error_from_unix(errno
);
347 return smb_get_nt_acl_nfs4_common(&sbuf
, security_info
, ppdesc
, acl
);
350 enum smbacl4_mode_enum
{e_simple
=0, e_special
=1};
351 enum smbacl4_acedup_enum
{e_dontcare
=0, e_reject
=1, e_ignore
=2, e_merge
=3};
353 typedef struct _smbacl4_vfs_params
{
354 enum smbacl4_mode_enum mode
;
356 enum smbacl4_acedup_enum acedup
;
357 struct db_context
*sid_mapping_table
;
358 } smbacl4_vfs_params
;
361 * Gather special parameters for NFS4 ACL handling
363 static int smbacl4_get_vfs_params(
364 const char *type_name
,
366 smbacl4_vfs_params
*params
369 static const struct enum_list enum_smbacl4_modes
[] = {
370 { e_simple
, "simple" },
371 { e_special
, "special" }
373 static const struct enum_list enum_smbacl4_acedups
[] = {
374 { e_dontcare
, "dontcare" },
375 { e_reject
, "reject" },
376 { e_ignore
, "ignore" },
377 { e_merge
, "merge" },
380 memset(params
, 0, sizeof(smbacl4_vfs_params
));
381 params
->mode
= (enum smbacl4_mode_enum
)lp_parm_enum(
382 SNUM(fsp
->conn
), type_name
,
383 "mode", enum_smbacl4_modes
, e_simple
);
384 params
->do_chown
= lp_parm_bool(SNUM(fsp
->conn
), type_name
,
386 params
->acedup
= (enum smbacl4_acedup_enum
)lp_parm_enum(
387 SNUM(fsp
->conn
), type_name
,
388 "acedup", enum_smbacl4_acedups
, e_dontcare
);
390 DEBUG(10, ("mode:%s, do_chown:%s, acedup: %s\n",
391 enum_smbacl4_modes
[params
->mode
].name
,
392 params
->do_chown
? "true" : "false",
393 enum_smbacl4_acedups
[params
->acedup
].name
));
398 static void smbacl4_dump_nfs4acl(int level
, SMB4ACL_T
*acl
)
400 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
401 SMB_ACE4_INT_T
*aceint
;
403 DEBUG(level
, ("NFS4ACL: size=%d\n", aclint
->naces
));
405 for(aceint
= aclint
->first
; aceint
!=NULL
; aceint
=(SMB_ACE4_INT_T
*)aceint
->next
) {
406 SMB_ACE4PROP_T
*ace
= &aceint
->prop
;
408 DEBUG(level
, ("\tACE: type=%d, flags=0x%x, fflags=0x%x, mask=0x%x, id=%d\n",
410 ace
->aceFlags
, ace
->flags
,
417 * Find 2 NFS4 who-special ACE property (non-copy!!!)
418 * match nonzero if "special" and who is equal
419 * return ace if found matching; otherwise NULL
421 static SMB_ACE4PROP_T
*smbacl4_find_equal_special(
423 SMB_ACE4PROP_T
*aceNew
)
425 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
426 SMB_ACE4_INT_T
*aceint
;
428 for(aceint
= aclint
->first
; aceint
!=NULL
; aceint
=(SMB_ACE4_INT_T
*)aceint
->next
) {
429 SMB_ACE4PROP_T
*ace
= &aceint
->prop
;
431 if (ace
->flags
== aceNew
->flags
&&
432 ace
->aceType
==aceNew
->aceType
&&
433 (ace
->aceFlags
&SMB_ACE4_IDENTIFIER_GROUP
)==
434 (aceNew
->aceFlags
&SMB_ACE4_IDENTIFIER_GROUP
)
436 /* keep type safety; e.g. gid is an u.short */
437 if (ace
->flags
& SMB_ACE4_ID_SPECIAL
)
439 if (ace
->who
.special_id
==aceNew
->who
.special_id
)
442 if (ace
->aceFlags
& SMB_ACE4_IDENTIFIER_GROUP
)
444 if (ace
->who
.gid
==aceNew
->who
.gid
)
447 if (ace
->who
.uid
==aceNew
->who
.uid
)
457 static bool nfs4_map_sid(smbacl4_vfs_params
*params
, const DOM_SID
*src
,
460 static struct db_context
*mapping_db
= NULL
;
463 if (mapping_db
== NULL
) {
464 const char *dbname
= lp_parm_const_string(
465 -1, SMBACL4_PARAM_TYPE_NAME
, "sidmap", NULL
);
467 if (dbname
== NULL
) {
468 DEBUG(10, ("%s:sidmap not defined\n",
469 SMBACL4_PARAM_TYPE_NAME
));
474 mapping_db
= db_open(NULL
, dbname
, 0, TDB_DEFAULT
,
478 if (mapping_db
== NULL
) {
479 DEBUG(1, ("could not open sidmap: %s\n",
485 if (mapping_db
->fetch(mapping_db
, NULL
,
486 string_term_tdb_data(sid_string_tos(src
)),
488 DEBUG(10, ("could not find mapping for SID %s\n",
489 sid_string_dbg(src
)));
493 if ((data
.dptr
== NULL
) || (data
.dsize
<= 0)
494 || (data
.dptr
[data
.dsize
-1] != '\0')) {
495 DEBUG(5, ("invalid mapping for SID %s\n",
496 sid_string_dbg(src
)));
497 TALLOC_FREE(data
.dptr
);
501 if (!string_to_sid(dst
, (char *)data
.dptr
)) {
502 DEBUG(1, ("invalid mapping %s for SID %s\n",
503 (char *)data
.dptr
, sid_string_dbg(src
)));
504 TALLOC_FREE(data
.dptr
);
508 TALLOC_FREE(data
.dptr
);
513 static bool smbacl4_fill_ace4(
515 const char *filename
,
516 smbacl4_vfs_params
*params
,
519 SEC_ACE
*ace_nt
, /* input */
520 SMB_ACE4PROP_T
*ace_v4
/* output */
523 DEBUG(10, ("got ace for %s\n", sid_string_dbg(&ace_nt
->trustee
)));
525 memset(ace_v4
, 0, sizeof(SMB_ACE4PROP_T
));
526 ace_v4
->aceType
= ace_nt
->type
; /* only ACCESS|DENY supported right now */
527 ace_v4
->aceFlags
= ace_nt
->flags
& SEC_ACE_FLAG_VALID_INHERIT
;
528 ace_v4
->aceMask
= ace_nt
->access_mask
&
529 (STD_RIGHT_ALL_ACCESS
| SA_RIGHT_FILE_ALL_ACCESS
);
531 if (ace_v4
->aceFlags
!=ace_nt
->flags
)
532 DEBUG(9, ("ace_v4->aceFlags(0x%x)!=ace_nt->flags(0x%x)\n",
533 ace_v4
->aceFlags
, ace_nt
->flags
));
535 if (ace_v4
->aceMask
!=ace_nt
->access_mask
)
536 DEBUG(9, ("ace_v4->aceMask(0x%x)!=ace_nt->access_mask(0x%x)\n",
537 ace_v4
->aceMask
, ace_nt
->access_mask
));
539 if (sid_equal(&ace_nt
->trustee
, &global_sid_World
)) {
540 ace_v4
->who
.special_id
= SMB_ACE4_WHO_EVERYONE
;
541 ace_v4
->flags
|= SMB_ACE4_ID_SPECIAL
;
543 const char *dom
, *name
;
544 enum lsa_SidType type
;
549 sid_copy(&sid
, &ace_nt
->trustee
);
551 if (!lookup_sid(mem_ctx
, &sid
, &dom
, &name
, &type
)) {
555 if (!nfs4_map_sid(params
, &sid
, &mapped
)) {
556 DEBUG(1, ("nfs4_acls.c: file [%s]: SID %s "
557 "unknown\n", filename
, sid_string_dbg(&sid
)));
562 DEBUG(2, ("nfs4_acls.c: file [%s]: mapped SID %s "
563 "to %s\n", filename
, sid_string_dbg(&sid
), sid_string_dbg(&mapped
)));
565 if (!lookup_sid(mem_ctx
, &mapped
, &dom
,
567 DEBUG(1, ("nfs4_acls.c: file [%s]: SID %s "
568 "mapped from %s is unknown\n",
569 filename
, sid_string_dbg(&mapped
), sid_string_dbg(&sid
)));
574 sid_copy(&sid
, &mapped
);
577 if (type
== SID_NAME_USER
) {
578 if (!sid_to_uid(&sid
, &uid
)) {
579 DEBUG(1, ("nfs4_acls.c: file [%s]: could not "
580 "convert %s to uid\n", filename
,
581 sid_string_dbg(&sid
)));
585 if (params
->mode
==e_special
&& uid
==ownerUID
) {
586 ace_v4
->flags
|= SMB_ACE4_ID_SPECIAL
;
587 ace_v4
->who
.special_id
= SMB_ACE4_WHO_OWNER
;
589 ace_v4
->who
.uid
= uid
;
591 } else { /* else group? - TODO check it... */
592 if (!sid_to_gid(&sid
, &gid
)) {
593 DEBUG(1, ("nfs4_acls.c: file [%s]: could not "
594 "convert %s to gid\n", filename
,
595 sid_string_dbg(&sid
)));
599 ace_v4
->aceFlags
|= SMB_ACE4_IDENTIFIER_GROUP
;
601 if (params
->mode
==e_special
&& gid
==ownerGID
) {
602 ace_v4
->flags
|= SMB_ACE4_ID_SPECIAL
;
603 ace_v4
->who
.special_id
= SMB_ACE4_WHO_GROUP
;
605 ace_v4
->who
.gid
= gid
;
610 return True
; /* OK */
613 static int smbacl4_MergeIgnoreReject(
614 enum smbacl4_acedup_enum acedup
,
615 SMB4ACL_T
*acl
, /* may modify it */
616 SMB_ACE4PROP_T
*ace
, /* the "new" ACE */
622 SMB_ACE4PROP_T
*ace4found
= smbacl4_find_equal_special(acl
, ace
);
627 case e_merge
: /* "merge" flags */
629 ace4found
->aceFlags
|= ace
->aceFlags
;
630 ace4found
->aceMask
|= ace
->aceMask
;
632 case e_ignore
: /* leave out this record */
635 case e_reject
: /* do an error */
636 DEBUG(8, ("ACL rejected by duplicate nt ace#%d\n", i
));
637 errno
= EINVAL
; /* SHOULD be set on any _real_ error */
647 static SMB4ACL_T
*smbacl4_win2nfs4(
648 const char *filename
,
650 smbacl4_vfs_params
*pparams
,
657 TALLOC_CTX
*mem_ctx
= talloc_tos();
659 DEBUG(10, ("smbacl4_win2nfs4 invoked\n"));
661 acl
= smb_create_smb4acl();
665 for(i
=0; i
<dacl
->num_aces
; i
++) {
666 SMB_ACE4PROP_T ace_v4
;
667 bool addNewACE
= True
;
669 if (!smbacl4_fill_ace4(mem_ctx
, filename
, pparams
,
671 dacl
->aces
+ i
, &ace_v4
)) {
672 DEBUG(3, ("Could not fill ace for file %s, SID %s\n",
674 sid_string_dbg(&((dacl
->aces
+i
)->trustee
))));
678 if (pparams
->acedup
!=e_dontcare
) {
679 if (smbacl4_MergeIgnoreReject(pparams
->acedup
, acl
,
680 &ace_v4
, &addNewACE
, i
))
685 smb_add_ace4(acl
, &ace_v4
);
691 NTSTATUS
smb_set_nt_acl_nfs4(files_struct
*fsp
,
692 uint32 security_info_sent
,
694 set_nfs4acl_native_fn_t set_nfs4_native
)
696 smbacl4_vfs_params params
;
697 SMB4ACL_T
*acl
= NULL
;
700 SMB_STRUCT_STAT sbuf
;
701 bool need_chown
= False
;
702 uid_t newUID
= (uid_t
)-1;
703 gid_t newGID
= (gid_t
)-1;
705 DEBUG(10, ("smb_set_nt_acl_nfs4 invoked for %s\n", fsp
->fsp_name
));
707 if ((security_info_sent
& (DACL_SECURITY_INFORMATION
|
708 GROUP_SECURITY_INFORMATION
| OWNER_SECURITY_INFORMATION
)) == 0)
710 DEBUG(9, ("security_info_sent (0x%x) ignored\n",
711 security_info_sent
));
712 return NT_STATUS_OK
; /* won't show error - later to be refined... */
715 /* Special behaviours */
716 if (smbacl4_get_vfs_params(SMBACL4_PARAM_TYPE_NAME
, fsp
, ¶ms
))
717 return NT_STATUS_NO_MEMORY
;
719 if (smbacl4_fGetFileOwner(fsp
, &sbuf
))
720 return map_nt_error_from_unix(errno
);
722 if (params
.do_chown
) {
723 /* chown logic is a copy/paste from posix_acl.c:set_nt_acl */
724 NTSTATUS status
= unpack_nt_owners(SNUM(fsp
->conn
), &newUID
, &newGID
, security_info_sent
, psd
);
725 if (!NT_STATUS_IS_OK(status
)) {
726 DEBUG(8, ("unpack_nt_owners failed"));
729 if (((newUID
!= (uid_t
)-1) && (sbuf
.st_uid
!= newUID
)) ||
730 ((newGID
!= (gid_t
)-1) && (sbuf
.st_gid
!= newGID
))) {
734 if ((newUID
== (uid_t
)-1
735 || newUID
== fsp
->conn
->server_info
->utok
.uid
)) {
736 if(try_chown(fsp
->conn
, fsp
->fsp_name
, newUID
, newGID
)) {
737 DEBUG(3,("chown %s, %u, %u failed. Error = %s.\n",
738 fsp
->fsp_name
, (unsigned int)newUID
, (unsigned int)newGID
,
740 return map_nt_error_from_unix(errno
);
743 DEBUG(10,("chown %s, %u, %u succeeded.\n",
744 fsp
->fsp_name
, (unsigned int)newUID
, (unsigned int)newGID
));
745 if (smbacl4_GetFileOwner(fsp
->conn
, fsp
->fsp_name
, &sbuf
))
746 return map_nt_error_from_unix(errno
);
748 } else { /* chown is needed, but _after_ changing acl */
749 sbuf
.st_uid
= newUID
; /* OWNER@ in case of e_special */
750 sbuf
.st_gid
= newGID
; /* GROUP@ in case of e_special */
755 if ((security_info_sent
& DACL_SECURITY_INFORMATION
)!=0 && psd
->dacl
!=NULL
)
757 acl
= smbacl4_win2nfs4(fsp
->fsp_name
, psd
->dacl
, ¶ms
, sbuf
.st_uid
, sbuf
.st_gid
);
759 return map_nt_error_from_unix(errno
);
761 smbacl4_dump_nfs4acl(10, acl
);
763 result
= set_nfs4_native(fsp
, acl
);
766 DEBUG(10, ("set_nfs4_native failed with %s\n", strerror(errno
)));
767 return map_nt_error_from_unix(errno
);
770 DEBUG(10, ("no dacl found; security_info_sent = 0x%x\n", security_info_sent
));
772 /* Any chown pending? */
774 DEBUG(3,("chown#2 %s. uid = %u, gid = %u.\n",
775 fsp
->fsp_name
, (unsigned int)newUID
, (unsigned int)newGID
));
776 if (try_chown(fsp
->conn
, fsp
->fsp_name
, newUID
, newGID
)) {
777 DEBUG(2,("chown#2 %s, %u, %u failed. Error = %s.\n",
778 fsp
->fsp_name
, (unsigned int)newUID
, (unsigned int)newGID
,
780 return map_nt_error_from_unix(errno
);
782 DEBUG(10,("chown#2 %s, %u, %u succeeded.\n",
783 fsp
->fsp_name
, (unsigned int)newUID
, (unsigned int)newGID
));
786 DEBUG(10, ("smb_set_nt_acl_nfs4 succeeded\n"));