librpc: Shorten dcerpc_binding_handle_call a bit
[Samba/gebeck_regimport.git] / source3 / smbd / pysmbd.c
blob683c48ccf75a24b67270c7b3fe9ee840420cdb0c
1 /*
2 Unix SMB/CIFS implementation.
3 Set NT and POSIX ACLs and other VFS operations from Python
5 Copyrigyt (C) Andrew Bartlett 2012
6 Copyright (C) Jeremy Allison 1994-2009.
7 Copyright (C) Andreas Gruenbacher 2002.
8 Copyright (C) Simo Sorce <idra@samba.org> 2009.
9 Copyright (C) Simo Sorce 2002
10 Copyright (C) Eric Lorimer 2002
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "includes.h"
27 #include "smbd/smbd.h"
28 #include <Python.h>
29 #include "libcli/util/pyerrors.h"
30 #include "librpc/rpc/pyrpc_util.h"
31 #include <pytalloc.h>
32 #include "system/filesys.h"
34 extern const struct generic_mapping file_generic_mapping;
36 #undef DBGC_CLASS
37 #define DBGC_CLASS DBGC_ACLS
39 static int conn_free_wrapper(connection_struct *conn)
41 conn_free(conn);
42 return 0;
45 static connection_struct *get_conn(TALLOC_CTX *mem_ctx, const char *service)
47 connection_struct *conn;
48 TALLOC_CTX *frame = talloc_stackframe();
49 int snum = -1;
50 NTSTATUS status;
52 if (!posix_locking_init(false)) {
53 PyErr_NoMemory();
54 TALLOC_FREE(frame);
55 return NULL;
58 if (service) {
59 snum = lp_servicenumber(service);
60 if (snum == -1) {
61 TALLOC_FREE(frame);
62 PyErr_SetString(PyExc_RuntimeError, "unknown service");
63 return NULL;
67 status = create_conn_struct(mem_ctx, NULL, NULL, &conn, snum, "/",
68 NULL);
69 PyErr_NTSTATUS_IS_ERR_RAISE(status);
71 TALLOC_FREE(frame);
72 /* Ignore read-only and share restrictions */
73 conn->read_only = false;
74 conn->share_access = SEC_RIGHTS_FILE_ALL;
75 talloc_set_destructor(conn, conn_free_wrapper);
76 return conn;
79 static NTSTATUS set_sys_acl_conn(const char *fname,
80 SMB_ACL_TYPE_T acltype,
81 SMB_ACL_T theacl, connection_struct *conn)
83 NTSTATUS status = NT_STATUS_OK;
84 int ret;
85 mode_t saved_umask;
87 TALLOC_CTX *frame = talloc_stackframe();
89 /* we want total control over the permissions on created files,
90 so set our umask to 0 */
91 saved_umask = umask(0);
93 ret = SMB_VFS_SYS_ACL_SET_FILE( conn, fname, acltype, theacl);
94 if (ret != 0) {
95 status = map_nt_error_from_unix_common(ret);
96 DEBUG(0,("set_sys_acl_conn: SMB_VFS_SYS_ACL_SET_FILE "
97 "returned zero.\n"));
100 umask(saved_umask);
102 TALLOC_FREE(frame);
103 return status;
106 static NTSTATUS set_nt_acl_conn(const char *fname,
107 uint32 security_info_sent, const struct security_descriptor *sd,
108 connection_struct *conn)
110 TALLOC_CTX *frame = talloc_stackframe();
111 NTSTATUS status = NT_STATUS_OK;
112 files_struct *fsp;
113 struct smb_filename *smb_fname = NULL;
114 int flags, ret;
115 mode_t saved_umask;
117 fsp = talloc_zero(frame, struct files_struct);
118 if (fsp == NULL) {
119 TALLOC_FREE(frame);
120 return NT_STATUS_NO_MEMORY;
122 fsp->fh = talloc(fsp, struct fd_handle);
123 if (fsp->fh == NULL) {
124 TALLOC_FREE(frame);
125 return NT_STATUS_NO_MEMORY;
127 fsp->conn = conn;
129 /* we want total control over the permissions on created files,
130 so set our umask to 0 */
131 saved_umask = umask(0);
133 smb_fname = synthetic_smb_fname_split(fsp, fname, NULL);
134 if (smb_fname == NULL) {
135 TALLOC_FREE(frame);
136 umask(saved_umask);
137 return NT_STATUS_NO_MEMORY;
140 fsp->fsp_name = smb_fname;
142 #ifdef O_DIRECTORY
143 flags = O_RDONLY|O_DIRECTORY;
144 #else
145 /* POSIX allows us to open a directory with O_RDONLY. */
146 flags = O_RDONLY;
147 #endif
149 fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, O_RDWR, 00400);
150 if (fsp->fh->fd == -1 && errno == EISDIR) {
151 fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, flags, 00400);
153 if (fsp->fh->fd == -1) {
154 printf("open: error=%d (%s)\n", errno, strerror(errno));
155 TALLOC_FREE(frame);
156 umask(saved_umask);
157 return NT_STATUS_UNSUCCESSFUL;
160 ret = SMB_VFS_FSTAT(fsp, &smb_fname->st);
161 if (ret == -1) {
162 /* If we have an fd, this stat should succeed. */
163 DEBUG(0,("Error doing fstat on open file %s "
164 "(%s)\n",
165 smb_fname_str_dbg(smb_fname),
166 strerror(errno) ));
167 TALLOC_FREE(frame);
168 umask(saved_umask);
169 return map_nt_error_from_unix(errno);
172 fsp->file_id = vfs_file_id_from_sbuf(conn, &smb_fname->st);
173 fsp->vuid = UID_FIELD_INVALID;
174 fsp->file_pid = 0;
175 fsp->can_lock = True;
176 fsp->can_read = True;
177 fsp->can_write = True;
178 fsp->print_file = NULL;
179 fsp->modified = False;
180 fsp->sent_oplock_break = NO_BREAK_SENT;
181 fsp->is_directory = S_ISDIR(smb_fname->st.st_ex_mode);
183 status = SMB_VFS_FSET_NT_ACL( fsp, security_info_sent, sd);
184 if (!NT_STATUS_IS_OK(status)) {
185 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned %s.\n", nt_errstr(status)));
188 SMB_VFS_CLOSE(fsp);
190 conn_free(conn);
191 TALLOC_FREE(frame);
193 umask(saved_umask);
194 return status;
197 static NTSTATUS get_nt_acl_conn(TALLOC_CTX *mem_ctx,
198 const char *fname,
199 connection_struct *conn,
200 uint32 security_info_wanted,
201 struct security_descriptor **sd)
203 TALLOC_CTX *frame = talloc_stackframe();
204 NTSTATUS status = SMB_VFS_GET_NT_ACL( conn, fname, security_info_wanted,
205 mem_ctx, sd);
206 if (!NT_STATUS_IS_OK(status)) {
207 DEBUG(0,("get_nt_acl_conn: get_nt_acl returned %s.\n", nt_errstr(status)));
210 TALLOC_FREE(frame);
212 return status;
216 static SMB_ACL_T make_simple_acl(gid_t gid, mode_t chmod_mode)
218 TALLOC_CTX *frame = talloc_stackframe();
220 mode_t mode = SMB_ACL_READ|SMB_ACL_WRITE|SMB_ACL_EXECUTE;
222 mode_t mode_user = (chmod_mode & 0700) >> 6;
223 mode_t mode_group = (chmod_mode & 070) >> 3;
224 mode_t mode_other = chmod_mode & 07;
225 SMB_ACL_ENTRY_T entry;
226 SMB_ACL_T acl = sys_acl_init(frame);
228 if (!acl) {
229 return NULL;
232 if (sys_acl_create_entry(&acl, &entry) != 0) {
233 TALLOC_FREE(frame);
234 return NULL;
237 if (sys_acl_set_tag_type(entry, SMB_ACL_USER_OBJ) != 0) {
238 TALLOC_FREE(frame);
239 return NULL;
242 if (sys_acl_set_permset(entry, &mode_user) != 0) {
243 TALLOC_FREE(frame);
244 return NULL;
247 if (sys_acl_create_entry(&acl, &entry) != 0) {
248 TALLOC_FREE(frame);
249 return NULL;
252 if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP_OBJ) != 0) {
253 TALLOC_FREE(frame);
254 return NULL;
257 if (sys_acl_set_permset(entry, &mode_group) != 0) {
258 TALLOC_FREE(frame);
259 return NULL;
262 if (sys_acl_create_entry(&acl, &entry) != 0) {
263 TALLOC_FREE(frame);
264 return NULL;
267 if (sys_acl_set_tag_type(entry, SMB_ACL_OTHER) != 0) {
268 TALLOC_FREE(frame);
269 return NULL;
272 if (sys_acl_set_permset(entry, &mode_other) != 0) {
273 TALLOC_FREE(frame);
274 return NULL;
277 if (gid != -1) {
278 if (sys_acl_create_entry(&acl, &entry) != 0) {
279 TALLOC_FREE(frame);
280 return NULL;
283 if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP) != 0) {
284 TALLOC_FREE(frame);
285 return NULL;
288 if (sys_acl_set_qualifier(entry, &gid) != 0) {
289 TALLOC_FREE(frame);
290 return NULL;
293 if (sys_acl_set_permset(entry, &mode_group) != 0) {
294 TALLOC_FREE(frame);
295 return NULL;
299 if (sys_acl_create_entry(&acl, &entry) != 0) {
300 TALLOC_FREE(frame);
301 return NULL;
304 if (sys_acl_set_tag_type(entry, SMB_ACL_MASK) != 0) {
305 TALLOC_FREE(frame);
306 return NULL;
309 if (sys_acl_set_permset(entry, &mode) != 0) {
310 TALLOC_FREE(frame);
311 return NULL;
313 return acl;
317 set a simple ACL on a file, as a test
319 static PyObject *py_smbd_set_simple_acl(PyObject *self, PyObject *args, PyObject *kwargs)
321 const char * const kwnames[] = { "fname", "mode", "gid", "service", NULL };
322 NTSTATUS status;
323 char *fname, *service = NULL;
324 int mode, gid = -1;
325 SMB_ACL_T acl;
326 TALLOC_CTX *frame;
327 connection_struct *conn;
329 if (!PyArg_ParseTupleAndKeywords(args, kwargs, "si|iz",
330 discard_const_p(char *, kwnames),
331 &fname, &mode, &gid, &service))
332 return NULL;
334 acl = make_simple_acl(gid, mode);
336 frame = talloc_stackframe();
338 conn = get_conn(frame, service);
339 if (!conn) {
340 return NULL;
343 status = set_sys_acl_conn(fname, SMB_ACL_TYPE_ACCESS, acl, conn);
344 TALLOC_FREE(acl);
346 TALLOC_FREE(frame);
348 PyErr_NTSTATUS_IS_ERR_RAISE(status);
350 Py_RETURN_NONE;
354 chown a file
356 static PyObject *py_smbd_chown(PyObject *self, PyObject *args, PyObject *kwargs)
358 const char * const kwnames[] = { "fname", "uid", "gid", "service", NULL };
359 connection_struct *conn;
360 NTSTATUS status = NT_STATUS_OK;
361 int ret;
363 char *fname, *service = NULL;
364 int uid, gid;
365 TALLOC_CTX *frame;
366 mode_t saved_umask;
368 if (!PyArg_ParseTupleAndKeywords(args, kwargs, "sii|z",
369 discard_const_p(char *, kwnames),
370 &fname, &uid, &gid, &service))
371 return NULL;
373 frame = talloc_stackframe();
375 conn = get_conn(frame, service);
376 if (!conn) {
377 return NULL;
380 /* we want total control over the permissions on created files,
381 so set our umask to 0 */
382 saved_umask = umask(0);
384 ret = SMB_VFS_CHOWN( conn, fname, uid, gid);
385 if (ret != 0) {
386 status = map_nt_error_from_unix_common(errno);
387 DEBUG(0,("chown returned failure: %s\n", strerror(errno)));
390 umask(saved_umask);
392 TALLOC_FREE(frame);
394 PyErr_NTSTATUS_IS_ERR_RAISE(status);
396 Py_RETURN_NONE;
400 chown a file
402 static PyObject *py_smbd_unlink(PyObject *self, PyObject *args, PyObject *kwargs)
404 const char * const kwnames[] = { "fname", "service", NULL };
405 connection_struct *conn;
406 NTSTATUS status = NT_STATUS_OK;
407 int ret;
408 struct smb_filename *smb_fname = NULL;
409 char *fname, *service = NULL;
410 TALLOC_CTX *frame;
412 frame = talloc_stackframe();
414 if (!PyArg_ParseTupleAndKeywords(args, kwargs, "s|z",
415 discard_const_p(char *, kwnames),
416 &fname, &service)) {
417 TALLOC_FREE(frame);
418 return NULL;
421 conn = get_conn(frame, service);
422 if (!conn) {
423 TALLOC_FREE(frame);
424 return NULL;
427 smb_fname = synthetic_smb_fname_split(frame, fname, NULL);
428 if (smb_fname == NULL) {
429 TALLOC_FREE(frame);
430 PyErr_NTSTATUS_IS_ERR_RAISE(NT_STATUS_NO_MEMORY);
433 ret = SMB_VFS_UNLINK(conn, smb_fname);
434 if (ret != 0) {
435 status = map_nt_error_from_unix_common(errno);
436 DEBUG(0,("unlink returned failure: %s\n", strerror(errno)));
439 TALLOC_FREE(frame);
441 PyErr_NTSTATUS_IS_ERR_RAISE(status);
443 Py_RETURN_NONE;
447 check if we have ACL support
449 static PyObject *py_smbd_have_posix_acls(PyObject *self)
451 #ifdef HAVE_POSIX_ACLS
452 return PyBool_FromLong(true);
453 #else
454 return PyBool_FromLong(false);
455 #endif
459 set the NT ACL on a file
461 static PyObject *py_smbd_set_nt_acl(PyObject *self, PyObject *args, PyObject *kwargs)
463 const char * const kwnames[] = { "fname", "security_info_sent", "sd", "service", NULL };
464 NTSTATUS status;
465 char *fname, *service = NULL;
466 int security_info_sent;
467 PyObject *py_sd;
468 struct security_descriptor *sd;
469 connection_struct *conn;
470 TALLOC_CTX *frame;
472 frame = talloc_stackframe();
474 if (!PyArg_ParseTupleAndKeywords(args, kwargs,
475 "siO|z", discard_const_p(char *, kwnames),
476 &fname, &security_info_sent, &py_sd, &service)) {
477 TALLOC_FREE(frame);
478 return NULL;
481 if (!py_check_dcerpc_type(py_sd, "samba.dcerpc.security", "descriptor")) {
482 TALLOC_FREE(frame);
483 return NULL;
486 conn = get_conn(frame, service);
487 if (!conn) {
488 TALLOC_FREE(frame);
489 return NULL;
492 sd = pytalloc_get_type(py_sd, struct security_descriptor);
494 status = set_nt_acl_conn(fname, security_info_sent, sd, conn);
495 TALLOC_FREE(frame);
496 PyErr_NTSTATUS_IS_ERR_RAISE(status);
498 Py_RETURN_NONE;
502 Return the NT ACL on a file
504 static PyObject *py_smbd_get_nt_acl(PyObject *self, PyObject *args, PyObject *kwargs)
506 const char * const kwnames[] = { "fname", "security_info_wanted", "service", NULL };
507 char *fname, *service = NULL;
508 int security_info_wanted;
509 PyObject *py_sd;
510 struct security_descriptor *sd;
511 TALLOC_CTX *tmp_ctx = talloc_new(NULL);
512 connection_struct *conn;
513 NTSTATUS status;
515 if (!PyArg_ParseTupleAndKeywords(args, kwargs, "si|z", discard_const_p(char *, kwnames),
516 &fname, &security_info_wanted, &service)) {
517 TALLOC_FREE(tmp_ctx);
518 return NULL;
521 conn = get_conn(tmp_ctx, service);
522 if (!conn) {
523 TALLOC_FREE(tmp_ctx);
524 return NULL;
527 status = get_nt_acl_conn(tmp_ctx, fname, conn, security_info_wanted, &sd);
528 PyErr_NTSTATUS_IS_ERR_RAISE(status);
530 py_sd = py_return_ndr_struct("samba.dcerpc.security", "descriptor", sd, sd);
532 TALLOC_FREE(tmp_ctx);
534 return py_sd;
538 set the posix (or similar) ACL on a file
540 static PyObject *py_smbd_set_sys_acl(PyObject *self, PyObject *args, PyObject *kwargs)
542 const char * const kwnames[] = { "fname", "acl_type", "acl", "service", NULL };
543 TALLOC_CTX *frame = talloc_stackframe();
544 NTSTATUS status;
545 char *fname, *service = NULL;
546 PyObject *py_acl;
547 struct smb_acl_t *acl;
548 int acl_type;
549 connection_struct *conn;
551 if (!PyArg_ParseTupleAndKeywords(args, kwargs, "siO|z",
552 discard_const_p(char *, kwnames),
553 &fname, &acl_type, &py_acl, &service)) {
554 TALLOC_FREE(frame);
555 return NULL;
558 if (!py_check_dcerpc_type(py_acl, "samba.dcerpc.smb_acl", "t")) {
559 TALLOC_FREE(frame);
560 return NULL;
563 conn = get_conn(frame, service);
564 if (!conn) {
565 TALLOC_FREE(frame);
566 return NULL;
569 acl = pytalloc_get_type(py_acl, struct smb_acl_t);
571 status = set_sys_acl_conn(fname, acl_type, acl, conn);
572 PyErr_NTSTATUS_IS_ERR_RAISE(status);
574 TALLOC_FREE(frame);
575 Py_RETURN_NONE;
579 Return the posix (or similar) ACL on a file
581 static PyObject *py_smbd_get_sys_acl(PyObject *self, PyObject *args, PyObject *kwargs)
583 const char * const kwnames[] = { "fname", "acl_type", "service", NULL };
584 char *fname;
585 PyObject *py_acl;
586 struct smb_acl_t *acl;
587 int acl_type;
588 TALLOC_CTX *frame = talloc_stackframe();
589 TALLOC_CTX *tmp_ctx = talloc_new(NULL);
590 connection_struct *conn;
591 NTSTATUS status = NT_STATUS_OK;
592 char *service = NULL;
593 if (!tmp_ctx) {
594 PyErr_NoMemory();
595 return NULL;
598 if (!PyArg_ParseTupleAndKeywords(args, kwargs, "si|z",
599 discard_const_p(char *, kwnames),
600 &fname, &acl_type, &service)) {
601 TALLOC_FREE(frame);
602 TALLOC_FREE(tmp_ctx);
603 return NULL;
606 conn = get_conn(frame, service);
607 if (!conn) {
608 TALLOC_FREE(frame);
609 TALLOC_FREE(tmp_ctx);
610 return NULL;
613 acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, acl_type, tmp_ctx);
614 if (!acl) {
615 TALLOC_FREE(frame);
616 TALLOC_FREE(tmp_ctx);
617 status = map_nt_error_from_unix_common(errno);
618 DEBUG(0,("sys_acl_get_file returned NULL: %s\n", strerror(errno)));
619 PyErr_NTSTATUS_IS_ERR_RAISE(status);
622 py_acl = py_return_ndr_struct("samba.dcerpc.smb_acl", "t", acl, acl);
624 TALLOC_FREE(frame);
625 TALLOC_FREE(tmp_ctx);
627 return py_acl;
630 static PyMethodDef py_smbd_methods[] = {
631 { "have_posix_acls",
632 (PyCFunction)py_smbd_have_posix_acls, METH_NOARGS,
633 NULL },
634 { "set_simple_acl",
635 (PyCFunction)py_smbd_set_simple_acl, METH_VARARGS|METH_KEYWORDS,
636 NULL },
637 { "set_nt_acl",
638 (PyCFunction)py_smbd_set_nt_acl, METH_VARARGS|METH_KEYWORDS,
639 NULL },
640 { "get_nt_acl",
641 (PyCFunction)py_smbd_get_nt_acl, METH_VARARGS|METH_KEYWORDS,
642 NULL },
643 { "get_sys_acl",
644 (PyCFunction)py_smbd_get_sys_acl, METH_VARARGS|METH_KEYWORDS,
645 NULL },
646 { "set_sys_acl",
647 (PyCFunction)py_smbd_set_sys_acl, METH_VARARGS|METH_KEYWORDS,
648 NULL },
649 { "chown",
650 (PyCFunction)py_smbd_chown, METH_VARARGS|METH_KEYWORDS,
651 NULL },
652 { "unlink",
653 (PyCFunction)py_smbd_unlink, METH_VARARGS|METH_KEYWORDS,
654 NULL },
655 { NULL }
658 void initsmbd(void);
659 void initsmbd(void)
661 PyObject *m;
663 m = Py_InitModule3("smbd", py_smbd_methods,
664 "Python bindings for the smbd file server.");
665 if (m == NULL)
666 return;