source3/smbd/pysmbd.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Set NT and POSIX ACLs and other VFS operations from Python
   4
   5    Copyrigyt (C) Andrew Bartlett 2012
   6    Copyright (C) Jeremy Allison 1994-2009.
   7    Copyright (C) Andreas Gruenbacher 2002.
   8    Copyright (C) Simo Sorce <idra@samba.org> 2009.
   9    Copyright (C) Simo Sorce 2002
  10    Copyright (C) Eric Lorimer 2002
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "smbd/smbd.h"
  28 #include <Python.h>
  29 #include "libcli/util/pyerrors.h"
  30 #include "librpc/rpc/pyrpc_util.h"
  31 #include <pytalloc.h>
  32 #include "system/filesys.h"
  33
  34 extern const struct generic_mapping file_generic_mapping;
  35
  36 #undef  DBGC_CLASS
  37 #define DBGC_CLASS DBGC_ACLS
  38
  39 static NTSTATUS set_sys_acl_no_snum(const char *fname,
  40                                      SMB_ACL_TYPE_T acltype,
  41                                      SMB_ACL_T theacl)
  42 {
  43         connection_struct *conn;
  44         NTSTATUS status = NT_STATUS_OK;
  45         int ret;
  46
  47         conn = talloc_zero(NULL, connection_struct);
  48         if (conn == NULL) {
  49                 DEBUG(0, ("talloc failed\n"));
  50                 return NT_STATUS_NO_MEMORY;
  51         }
  52
  53         if (!(conn->params = talloc(conn, struct share_params))) {
  54                 DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
  55                 TALLOC_FREE(conn);
  56                 return NT_STATUS_NO_MEMORY;
  57         }
  58
  59         conn->params->service = -1;
  60
  61         set_conn_connectpath(conn, "/");
  62
  63         smbd_vfs_init(conn);
  64
  65         ret = SMB_VFS_SYS_ACL_SET_FILE( conn, fname, acltype, theacl);
  66         if (ret != 0) {
  67                 status = map_nt_error_from_unix_common(ret);
  68                 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned zero.\n"));
  69         }
  70
  71         conn_free(conn);
  72
  73         return status;
  74 }
  75
  76 static NTSTATUS set_nt_acl_no_snum(const char *fname,
  77                                    uint32 security_info_sent, const struct security_descriptor *sd)
  78 {
  79         TALLOC_CTX *frame = talloc_stackframe();
  80         connection_struct *conn;
  81         NTSTATUS status = NT_STATUS_OK;
  82         files_struct *fsp;
  83         struct smb_filename *smb_fname = NULL;
  84         int flags;
  85
  86         conn = talloc_zero(frame, connection_struct);
  87         if (conn == NULL) {
  88                 DEBUG(0, ("talloc failed\n"));
  89                 return NT_STATUS_NO_MEMORY;
  90         }
  91
  92         if (!(conn->params = talloc(conn, struct share_params))) {
  93                 DEBUG(0,("set_nt_acl_no_snum: talloc() failed!\n"));
  94                 TALLOC_FREE(frame);
  95                 return NT_STATUS_NO_MEMORY;
  96         }
  97
  98         conn->params->service = -1;
  99
 100         set_conn_connectpath(conn, "/");
 101
 102         smbd_vfs_init(conn);
 103
 104         fsp = talloc_zero(frame, struct files_struct);
 105         if (fsp == NULL) {
 106                 TALLOC_FREE(frame);
 107                 return NT_STATUS_NO_MEMORY;
 108         }
 109         fsp->fh = talloc(fsp, struct fd_handle);
 110         if (fsp->fh == NULL) {
 111                 TALLOC_FREE(frame);
 112                 return NT_STATUS_NO_MEMORY;
 113         }
 114         fsp->conn = conn;
 115
 116         status = create_synthetic_smb_fname_split(fsp, fname, NULL,
 117                                                   &smb_fname);
 118         if (!NT_STATUS_IS_OK(status)) {
 119                 TALLOC_FREE(frame);
 120                 return status;
 121         }
 122
 123         fsp->fsp_name = smb_fname;
 124
 125 #ifdef O_DIRECTORY
 126         flags = O_RDONLY|O_DIRECTORY;
 127 #else
 128         /* POSIX allows us to open a directory with O_RDONLY. */
 129         flags = O_RDONLY;
 130 #endif
 131
 132         fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, O_RDWR, 00400);
 133         if (fsp->fh->fd == -1 && errno == EISDIR) {
 134                 fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, flags, 00400);
 135         }
 136         if (fsp->fh->fd == -1) {
 137                 printf("open: error=%d (%s)\n", errno, strerror(errno));
 138                 TALLOC_FREE(frame);
 139                 return NT_STATUS_UNSUCCESSFUL;
 140         }
 141
 142         status = SMB_VFS_FSET_NT_ACL( fsp, security_info_sent, sd);
 143         if (!NT_STATUS_IS_OK(status)) {
 144                 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned %s.\n", nt_errstr(status)));
 145         }
 146
 147         conn_free(conn);
 148         TALLOC_FREE(frame);
 149
 150         return status;
 151 }
 152
 153
 154 static SMB_ACL_T make_simple_acl(gid_t gid, mode_t chmod_mode)
 155 {
 156         mode_t mode = SMB_ACL_READ|SMB_ACL_WRITE;
 157
 158         mode_t mode_user = (chmod_mode & 0700) >> 16;
 159         mode_t mode_group = (chmod_mode & 070) >> 8;
 160         mode_t mode_other = chmod_mode &  07;
 161
 162         SMB_ACL_ENTRY_T entry;
 163         SMB_ACL_T acl = sys_acl_init();
 164
 165         if (!acl) {
 166                 return NULL;
 167         }
 168
 169         if (sys_acl_create_entry(&acl, &entry) != 0) {
 170                 TALLOC_FREE(acl);
 171                 return NULL;
 172         }
 173
 174         if (sys_acl_set_tag_type(entry, SMB_ACL_USER_OBJ) != 0) {
 175                 TALLOC_FREE(acl);
 176                 return NULL;
 177         }
 178
 179         if (sys_acl_set_permset(entry, &mode_user) != 0) {
 180                 TALLOC_FREE(acl);
 181                 return NULL;
 182         }
 183
 184         if (sys_acl_create_entry(&acl, &entry) != 0) {
 185                 TALLOC_FREE(acl);
 186                 return NULL;
 187         }
 188
 189         if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP_OBJ) != 0) {
 190                 TALLOC_FREE(acl);
 191                 return NULL;
 192         }
 193
 194         if (sys_acl_set_permset(entry, &mode_group) != 0) {
 195                 TALLOC_FREE(acl);
 196                 return NULL;
 197         }
 198
 199         if (sys_acl_create_entry(&acl, &entry) != 0) {
 200                 TALLOC_FREE(acl);
 201                 return NULL;
 202         }
 203
 204         if (sys_acl_set_tag_type(entry, SMB_ACL_OTHER) != 0) {
 205                 TALLOC_FREE(acl);
 206                 return NULL;
 207         }
 208
 209         if (sys_acl_set_permset(entry, &mode_other) != 0) {
 210                 TALLOC_FREE(acl);
 211                 return NULL;
 212         }
 213
 214         if (gid != -1) {
 215                 if (sys_acl_create_entry(&acl, &entry) != 0) {
 216                         TALLOC_FREE(acl);
 217                         return NULL;
 218                 }
 219
 220                 if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP) != 0) {
 221                         TALLOC_FREE(acl);
 222                         return NULL;
 223                 }
 224
 225                 if (sys_acl_set_qualifier(entry, &gid) != 0) {
 226                         TALLOC_FREE(acl);
 227                         return NULL;
 228                 }
 229
 230                 if (sys_acl_set_permset(entry, &mode_group) != 0) {
 231                         TALLOC_FREE(acl);
 232                         return NULL;
 233                 }
 234         }
 235
 236         if (sys_acl_create_entry(&acl, &entry) != 0) {
 237                 TALLOC_FREE(acl);
 238                 return NULL;
 239         }
 240
 241         if (sys_acl_set_tag_type(entry, SMB_ACL_MASK) != 0) {
 242                 TALLOC_FREE(acl);
 243                 return NULL;
 244         }
 245
 246         if (sys_acl_set_permset(entry, &mode) != 0) {
 247                 TALLOC_FREE(acl);
 248                 return NULL;
 249         }
 250         return acl;
 251 }
 252
 253 /*
 254   set a simple ACL on a file, as a test
 255  */
 256 static PyObject *py_smbd_set_simple_acl(PyObject *self, PyObject *args)
 257 {
 258         NTSTATUS status;
 259         char *fname;
 260         int mode, gid = -1;
 261         SMB_ACL_T acl;
 262         TALLOC_CTX *frame;
 263
 264         if (!PyArg_ParseTuple(args, "si|i", &fname, &mode, &gid))
 265                 return NULL;
 266
 267         acl = make_simple_acl(gid, mode);
 268
 269         frame = talloc_stackframe();
 270
 271         status = set_sys_acl_no_snum(fname, SMB_ACL_TYPE_ACCESS, acl);
 272         TALLOC_FREE(acl);
 273
 274         TALLOC_FREE(frame);
 275
 276         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 277
 278         Py_RETURN_NONE;
 279 }
 280
 281 /*
 282   chown a file
 283  */
 284 static PyObject *py_smbd_chown(PyObject *self, PyObject *args)
 285 {
 286         connection_struct *conn;
 287         NTSTATUS status = NT_STATUS_OK;
 288         int ret;
 289
 290         char *fname;
 291         int uid, gid;
 292         TALLOC_CTX *frame;
 293
 294         if (!PyArg_ParseTuple(args, "sii", &fname, &uid, &gid))
 295                 return NULL;
 296
 297         frame = talloc_stackframe();
 298
 299         conn = talloc_zero(frame, connection_struct);
 300         if (conn == NULL) {
 301                 PyErr_NoMemory();
 302                 return NULL;
 303         }
 304
 305         if (!(conn->params = talloc(conn, struct share_params))) {
 306                 PyErr_NoMemory();
 307                 return NULL;
 308         }
 309
 310         conn->params->service = -1;
 311
 312         set_conn_connectpath(conn, "/");
 313
 314         smbd_vfs_init(conn);
 315
 316         ret = SMB_VFS_CHOWN( conn, fname, uid, gid);
 317         if (ret != 0) {
 318                 status = map_nt_error_from_unix_common(errno);
 319                 DEBUG(0,("chown returned failure: %s\n", strerror(errno)));
 320         }
 321
 322         conn_free(conn);
 323
 324         TALLOC_FREE(frame);
 325
 326         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 327
 328         Py_RETURN_NONE;
 329 }
 330
 331 /*
 332   check if we have ACL support
 333  */
 334 static PyObject *py_smbd_have_posix_acls(PyObject *self, PyObject *args)
 335 {
 336 #ifdef HAVE_POSIX_ACLS
 337         return PyBool_FromLong(true);
 338 #else
 339         return PyBool_FromLong(false);
 340 #endif
 341 }
 342
 343 /*
 344   set the NT ACL on a file
 345  */
 346 static PyObject *py_smbd_set_nt_acl(PyObject *self, PyObject *args)
 347 {
 348         NTSTATUS status;
 349         char *fname;
 350         int security_info_sent;
 351         PyObject *py_sd;
 352         struct security_descriptor *sd;
 353
 354         if (!PyArg_ParseTuple(args, "siO", &fname, &security_info_sent, &py_sd))
 355                 return NULL;
 356
 357         if (!py_check_dcerpc_type(py_sd, "samba.dcerpc.security", "descriptor")) {
 358                 return NULL;
 359         }
 360
 361         sd = pytalloc_get_type(py_sd, struct security_descriptor);
 362
 363         status = set_nt_acl_no_snum(fname, security_info_sent, sd);
 364         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 365
 366         Py_RETURN_NONE;
 367 }
 368
 369 /*
 370   Return the NT ACL on a file
 371  */
 372 static PyObject *py_smbd_get_nt_acl(PyObject *self, PyObject *args)
 373 {
 374         char *fname;
 375         int security_info_wanted;
 376         PyObject *py_sd;
 377         struct security_descriptor *sd;
 378         TALLOC_CTX *tmp_ctx = talloc_new(NULL);
 379
 380         if (!PyArg_ParseTuple(args, "si", &fname, &security_info_wanted))
 381                 return NULL;
 382
 383         sd = get_nt_acl_no_snum(tmp_ctx, fname, security_info_wanted);
 384
 385         py_sd = py_return_ndr_struct("samba.dcerpc.security", "descriptor", sd, sd);
 386
 387         talloc_free(tmp_ctx);
 388
 389         return py_sd;
 390 }
 391
 392 /*
 393   set the posix (or similar) ACL on a file
 394  */
 395 static PyObject *py_smbd_set_sys_acl(PyObject *self, PyObject *args)
 396 {
 397         NTSTATUS status;
 398         char *fname;
 399         PyObject *py_acl;
 400         struct smb_acl_t *acl;
 401         int acl_type;
 402
 403         if (!PyArg_ParseTuple(args, "siO", &fname, &acl_type, &py_acl))
 404                 return NULL;
 405
 406         if (!py_check_dcerpc_type(py_acl, "samba.dcerpc.smb_acl", "t")) {
 407                 return NULL;
 408         }
 409
 410         acl = pytalloc_get_type(py_acl, struct smb_acl_t);
 411
 412         status = set_sys_acl_no_snum(fname, acl_type, acl);
 413         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 414
 415         Py_RETURN_NONE;
 416 }
 417
 418 /*
 419   Return the posix (or similar) ACL on a file
 420  */
 421 static PyObject *py_smbd_get_sys_acl(PyObject *self, PyObject *args)
 422 {
 423         char *fname;
 424         PyObject *py_acl;
 425         struct smb_acl_t *acl;
 426         int acl_type;
 427         TALLOC_CTX *frame = talloc_stackframe();
 428         connection_struct *conn;
 429         NTSTATUS status = NT_STATUS_OK;
 430
 431         if (!PyArg_ParseTuple(args, "si", &fname, &acl_type)) {
 432                 TALLOC_FREE(frame);
 433                 return NULL;
 434         }
 435
 436         conn = talloc_zero(frame, connection_struct);
 437         if (conn == NULL) {
 438                 DEBUG(0, ("talloc failed\n"));
 439                 PyErr_NoMemory();
 440                 TALLOC_FREE(frame);
 441                 return NULL;
 442         }
 443
 444         if (!(conn->params = talloc(conn, struct share_params))) {
 445                 DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
 446                 PyErr_NoMemory();
 447                 TALLOC_FREE(frame);
 448                 return NULL;
 449         }
 450
 451         conn->params->service = -1;
 452
 453         set_conn_connectpath(conn, "/");
 454
 455         smbd_vfs_init(conn);
 456
 457         acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, acl_type);
 458         if (!acl) {
 459                 TALLOC_FREE(frame);
 460                 status = map_nt_error_from_unix_common(errno);
 461                 DEBUG(0,("sys_acl_get_file returned NULL: %s\n", strerror(errno)));
 462                 PyErr_NTSTATUS_IS_ERR_RAISE(status);
 463         }
 464
 465         talloc_steal(frame, acl);
 466         conn_free(conn);
 467
 468         py_acl = py_return_ndr_struct("samba.dcerpc.smb_acl", "t", acl, acl);
 469
 470         TALLOC_FREE(frame);
 471
 472         return py_acl;
 473 }
 474
 475 static PyMethodDef py_smbd_methods[] = {
 476         { "have_posix_acls",
 477                 (PyCFunction)py_smbd_have_posix_acls, METH_VARARGS,
 478                 NULL },
 479         { "set_simple_acl",
 480                 (PyCFunction)py_smbd_set_simple_acl, METH_VARARGS,
 481                 NULL },
 482         { "set_nt_acl",
 483                 (PyCFunction)py_smbd_set_nt_acl, METH_VARARGS,
 484                 NULL },
 485         { "get_nt_acl",
 486                 (PyCFunction)py_smbd_get_nt_acl, METH_VARARGS,
 487                 NULL },
 488         { "get_sys_acl",
 489                 (PyCFunction)py_smbd_get_sys_acl, METH_VARARGS,
 490                 NULL },
 491         { "set_sys_acl",
 492                 (PyCFunction)py_smbd_set_sys_acl, METH_VARARGS,
 493                 NULL },
 494         { "chown",
 495                 (PyCFunction)py_smbd_chown, METH_VARARGS,
 496                 NULL },
 497         { NULL }
 498 };
 499
 500 void initsmbd(void);
 501 void initsmbd(void)
 502 {
 503         PyObject *m;
 504
 505         m = Py_InitModule3("smbd", py_smbd_methods,
 506                            "Python bindings for the smbd file server.");
 507         if (m == NULL)
 508                 return;
 509
 510 }