2 Unix SMB/CIFS implementation.
3 Set NT and POSIX ACLs and other VFS operations from Python
5 Copyrigyt (C) Andrew Bartlett 2012
6 Copyright (C) Jeremy Allison 1994-2009.
7 Copyright (C) Andreas Gruenbacher 2002.
8 Copyright (C) Simo Sorce <idra@samba.org> 2009.
9 Copyright (C) Simo Sorce 2002
10 Copyright (C) Eric Lorimer 2002
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #include "smbd/smbd.h"
29 #include "libcli/util/pyerrors.h"
30 #include "librpc/rpc/pyrpc_util.h"
32 #include "system/filesys.h"
34 extern const struct generic_mapping file_generic_mapping
;
37 #define DBGC_CLASS DBGC_ACLS
39 static NTSTATUS
set_sys_acl_no_snum(const char *fname
,
40 SMB_ACL_TYPE_T acltype
,
43 connection_struct
*conn
;
44 NTSTATUS status
= NT_STATUS_OK
;
47 conn
= talloc_zero(NULL
, connection_struct
);
49 DEBUG(0, ("talloc failed\n"));
50 return NT_STATUS_NO_MEMORY
;
53 if (!(conn
->params
= talloc(conn
, struct share_params
))) {
54 DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
56 return NT_STATUS_NO_MEMORY
;
59 conn
->params
->service
= -1;
61 set_conn_connectpath(conn
, "/");
65 ret
= SMB_VFS_SYS_ACL_SET_FILE( conn
, fname
, acltype
, theacl
);
67 status
= map_nt_error_from_unix_common(ret
);
68 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned zero.\n"));
76 static NTSTATUS
set_nt_acl_no_snum(const char *fname
,
77 uint32 security_info_sent
, const struct security_descriptor
*sd
)
79 TALLOC_CTX
*frame
= talloc_stackframe();
80 connection_struct
*conn
;
81 NTSTATUS status
= NT_STATUS_OK
;
83 struct smb_filename
*smb_fname
= NULL
;
86 conn
= talloc_zero(frame
, connection_struct
);
88 DEBUG(0, ("talloc failed\n"));
89 return NT_STATUS_NO_MEMORY
;
92 if (!(conn
->params
= talloc(conn
, struct share_params
))) {
93 DEBUG(0,("set_nt_acl_no_snum: talloc() failed!\n"));
95 return NT_STATUS_NO_MEMORY
;
98 conn
->params
->service
= -1;
100 set_conn_connectpath(conn
, "/");
104 fsp
= talloc_zero(frame
, struct files_struct
);
107 return NT_STATUS_NO_MEMORY
;
109 fsp
->fh
= talloc(fsp
, struct fd_handle
);
110 if (fsp
->fh
== NULL
) {
112 return NT_STATUS_NO_MEMORY
;
116 status
= create_synthetic_smb_fname_split(fsp
, fname
, NULL
,
118 if (!NT_STATUS_IS_OK(status
)) {
123 fsp
->fsp_name
= smb_fname
;
126 flags
= O_RDONLY
|O_DIRECTORY
;
128 /* POSIX allows us to open a directory with O_RDONLY. */
132 fsp
->fh
->fd
= SMB_VFS_OPEN(conn
, smb_fname
, fsp
, O_RDWR
, 00400);
133 if (fsp
->fh
->fd
== -1 && errno
== EISDIR
) {
134 fsp
->fh
->fd
= SMB_VFS_OPEN(conn
, smb_fname
, fsp
, flags
, 00400);
136 if (fsp
->fh
->fd
== -1) {
137 printf("open: error=%d (%s)\n", errno
, strerror(errno
));
139 return NT_STATUS_UNSUCCESSFUL
;
142 status
= SMB_VFS_FSET_NT_ACL( fsp
, security_info_sent
, sd
);
143 if (!NT_STATUS_IS_OK(status
)) {
144 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned %s.\n", nt_errstr(status
)));
154 static SMB_ACL_T
make_simple_acl(gid_t gid
, mode_t chmod_mode
)
156 mode_t mode
= SMB_ACL_READ
|SMB_ACL_WRITE
;
158 mode_t mode_user
= (chmod_mode
& 0700) >> 16;
159 mode_t mode_group
= (chmod_mode
& 070) >> 8;
160 mode_t mode_other
= chmod_mode
& 07;
162 SMB_ACL_ENTRY_T entry
;
163 SMB_ACL_T acl
= sys_acl_init(4);
169 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
174 if (sys_acl_set_tag_type(entry
, SMB_ACL_USER_OBJ
) != 0) {
179 if (sys_acl_set_permset(entry
, &mode_user
) != 0) {
184 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
189 if (sys_acl_set_tag_type(entry
, SMB_ACL_GROUP_OBJ
) != 0) {
194 if (sys_acl_set_permset(entry
, &mode_group
) != 0) {
199 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
204 if (sys_acl_set_tag_type(entry
, SMB_ACL_OTHER
) != 0) {
209 if (sys_acl_set_permset(entry
, &mode_other
) != 0) {
215 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
220 if (sys_acl_set_tag_type(entry
, SMB_ACL_GROUP
) != 0) {
225 if (sys_acl_set_qualifier(entry
, &gid
) != 0) {
230 if (sys_acl_set_permset(entry
, &mode_group
) != 0) {
236 if (sys_acl_create_entry(&acl
, &entry
) != 0) {
241 if (sys_acl_set_tag_type(entry
, SMB_ACL_MASK
) != 0) {
246 if (sys_acl_set_permset(entry
, &mode
) != 0) {
254 set a simple ACL on a file, as a test
256 static PyObject
*py_smbd_set_simple_acl(PyObject
*self
, PyObject
*args
)
264 if (!PyArg_ParseTuple(args
, "si|i", &fname
, &mode
, &gid
))
267 acl
= make_simple_acl(gid
, mode
);
269 frame
= talloc_stackframe();
271 status
= set_sys_acl_no_snum(fname
, SMB_ACL_TYPE_ACCESS
, acl
);
276 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
284 static PyObject
*py_smbd_chown(PyObject
*self
, PyObject
*args
)
286 connection_struct
*conn
;
287 NTSTATUS status
= NT_STATUS_OK
;
294 if (!PyArg_ParseTuple(args
, "sii", &fname
, &uid
, &gid
))
297 frame
= talloc_stackframe();
299 conn
= talloc_zero(frame
, connection_struct
);
305 if (!(conn
->params
= talloc(conn
, struct share_params
))) {
310 conn
->params
->service
= -1;
312 set_conn_connectpath(conn
, "/");
316 ret
= SMB_VFS_CHOWN( conn
, fname
, uid
, gid
);
318 status
= map_nt_error_from_unix_common(errno
);
319 DEBUG(0,("chown returned failure: %s\n", strerror(errno
)));
326 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
332 check if we have ACL support
334 static PyObject
*py_smbd_have_posix_acls(PyObject
*self
, PyObject
*args
)
336 #ifdef HAVE_POSIX_ACLS
337 return PyBool_FromLong(true);
339 return PyBool_FromLong(false);
344 set the NT ACL on a file
346 static PyObject
*py_smbd_set_nt_acl(PyObject
*self
, PyObject
*args
)
350 int security_info_sent
;
352 struct security_descriptor
*sd
;
354 if (!PyArg_ParseTuple(args
, "siO", &fname
, &security_info_sent
, &py_sd
))
357 if (!py_check_dcerpc_type(py_sd
, "samba.dcerpc.security", "descriptor")) {
361 sd
= pytalloc_get_type(py_sd
, struct security_descriptor
);
363 status
= set_nt_acl_no_snum(fname
, security_info_sent
, sd
);
364 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
370 Return the NT ACL on a file
372 static PyObject
*py_smbd_get_nt_acl(PyObject
*self
, PyObject
*args
)
375 int security_info_sent
;
377 struct security_descriptor
*sd
;
378 TALLOC_CTX
*tmp_ctx
= talloc_new(NULL
);
380 if (!PyArg_ParseTuple(args
, "si", &fname
, &security_info_sent
))
383 sd
= get_nt_acl_no_snum(tmp_ctx
, fname
);
385 py_sd
= py_return_ndr_struct("samba.dcerpc.security", "security_descriptor", sd
, sd
);
387 talloc_free(tmp_ctx
);
393 set the posix (or similar) ACL on a file
395 static PyObject
*py_smbd_set_sys_acl(PyObject
*self
, PyObject
*args
)
400 struct smb_acl_t
*acl
;
403 if (!PyArg_ParseTuple(args
, "siO", &fname
, &acl_type
, &py_acl
))
406 if (!py_check_dcerpc_type(py_acl
, "samba.dcerpc.smb_acl", "t")) {
410 acl
= pytalloc_get_type(py_acl
, struct smb_acl_t
);
412 status
= set_sys_acl_no_snum(fname
, acl_type
, acl
);
413 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
419 Return the posix (or similar) ACL on a file
421 static PyObject
*py_smbd_get_sys_acl(PyObject
*self
, PyObject
*args
)
425 struct smb_acl_t
*acl
;
427 TALLOC_CTX
*frame
= talloc_stackframe();
428 connection_struct
*conn
;
429 NTSTATUS status
= NT_STATUS_OK
;
431 if (!PyArg_ParseTuple(args
, "si", &fname
, &acl_type
)) {
436 conn
= talloc_zero(frame
, connection_struct
);
438 DEBUG(0, ("talloc failed\n"));
444 if (!(conn
->params
= talloc(conn
, struct share_params
))) {
445 DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
451 conn
->params
->service
= -1;
453 set_conn_connectpath(conn
, "/");
457 acl
= SMB_VFS_SYS_ACL_GET_FILE( conn
, fname
, acl_type
);
460 status
= map_nt_error_from_unix_common(errno
);
461 DEBUG(0,("sys_acl_get_file returned NULL: %s\n", strerror(errno
)));
462 PyErr_NTSTATUS_IS_ERR_RAISE(status
);
465 talloc_steal(frame
, acl
);
468 py_acl
= py_return_ndr_struct("samba.dcerpc.smb_acl", "t", acl
, acl
);
475 static PyMethodDef py_smbd_methods
[] = {
477 (PyCFunction
)py_smbd_have_posix_acls
, METH_VARARGS
,
480 (PyCFunction
)py_smbd_set_simple_acl
, METH_VARARGS
,
483 (PyCFunction
)py_smbd_set_nt_acl
, METH_VARARGS
,
486 (PyCFunction
)py_smbd_get_nt_acl
, METH_VARARGS
,
489 (PyCFunction
)py_smbd_get_sys_acl
, METH_VARARGS
,
492 (PyCFunction
)py_smbd_set_sys_acl
, METH_VARARGS
,
495 (PyCFunction
)py_smbd_chown
, METH_VARARGS
,
505 m
= Py_InitModule3("smbd", py_smbd_methods
,
506 "Python bindings for the smbd file server.");