1 # Unix SMB/CIFS implementation.
2 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2010
5 # This program is free software; you can redistribute it and/or modify
6 # it under the terms of the GNU General Public License as published by
7 # the Free Software Foundation; either version 3 of the License, or
8 # (at your option) any later version.
10 # This program is distributed in the hope that it will be useful,
11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 # GNU General Public License for more details.
15 # You should have received a copy of the GNU General Public License
16 # along with this program. If not, see <http://www.gnu.org/licenses/>.
23 import samba
.xattr_native
, samba
.xattr_tdb
, samba
.posix_eadb
24 from samba
.dcerpc
import security
, xattr
, idmap
25 from samba
.ndr
import ndr_pack
, ndr_unpack
26 from samba
.samba3
import smbd
28 class XattrBackendError(Exception):
29 """A generic xattr backend error."""
32 def checkset_backend(lp
, backend
, eadbfile
):
33 '''return the path to the eadb, or None'''
35 xattr_tdb
= lp
.get("xattr_tdb:file")
36 if xattr_tdb
is not None:
37 return (samba
.xattr_tdb
, lp
.get("xattr_tdb:file"))
38 posix_eadb
= lp
.get("posix:eadb")
39 if posix_eadb
is not None:
40 return (samba
.posix_eadb
, lp
.get("posix:eadb"))
42 elif backend
== "native":
44 elif backend
== "eadb":
45 if eadbfile
is not None:
46 return (samba
.posix_eadb
, eadbfile
)
48 return (samba
.posix_eadb
, os
.path
.abspath(os
.path
.join(lp
.get("private dir"), "eadb.tdb")))
49 elif backend
== "tdb":
50 if eadbfile
is not None:
51 return (samba
.xattr_tdb
, eadbfile
)
53 return (samba
.xattr_tdb
, os
.path
.abspath(os
.path
.join(lp
.get("state dir"), "xattr.tdb")))
55 raise XattrBackendError("Invalid xattr backend choice %s"%backend
)
58 def getntacl(lp
, file, backend
=None, eadbfile
=None, direct_db_access
=True):
60 (backend_obj
, dbname
) = checkset_backend(lp
, backend
, eadbfile
)
61 if dbname
is not None:
63 attribute
= backend_obj
.wrap_getxattr(dbname
, file,
64 xattr
.XATTR_NTACL_NAME
)
66 # FIXME: Don't catch all exceptions, just those related to opening
68 print "Fail to open %s" % dbname
69 attribute
= samba
.xattr_native
.wrap_getxattr(file,
70 xattr
.XATTR_NTACL_NAME
)
72 attribute
= samba
.xattr_native
.wrap_getxattr(file,
73 xattr
.XATTR_NTACL_NAME
)
74 ntacl
= ndr_unpack(xattr
.NTACL
, attribute
)
75 if ntacl
.version
== 1:
77 elif ntacl
.version
== 2:
79 elif ntacl
.version
== 3:
81 elif ntacl
.version
== 4:
84 return smbd
.get_nt_acl(file, security
.SECINFO_OWNER | security
.SECINFO_GROUP | security
.SECINFO_DACL | security
.SECINFO_SACL
)
87 def setntacl(lp
, file, sddl
, domsid
, backend
=None, eadbfile
=None, use_ntvfs
=True, skip_invalid_chown
=False, passdb
=None):
88 sid
= security
.dom_sid(domsid
)
89 sd
= security
.descriptor
.from_sddl(sddl
, sid
)
91 if not use_ntvfs
and skip_invalid_chown
:
92 # Check if the owner can be resolved as a UID
93 (owner_id
, owner_type
) = passdb
.sid_to_id(sd
.owner_sid
)
94 if ((owner_type
!= idmap
.ID_TYPE_UID
) and (owner_type
!= idmap
.ID_TYPE_BOTH
)):
95 # Check if this particular owner SID was domain admins,
96 # because we special-case this as mapping to
97 # 'administrator' instead.
98 if sd
.owner_sid
== security
.dom_sid("%s-%d" % (domsid
, security
.DOMAIN_RID_ADMINS
)):
99 administrator
= security
.dom_sid("%s-%d" % (domsid
, security
.DOMAIN_RID_ADMINISTRATOR
))
100 (admin_id
, admin_type
) = passdb
.sid_to_id(administrator
)
102 # Confirm we have a UID for administrator
103 if ((admin_type
== idmap
.ID_TYPE_UID
) or (admin_type
== idmap
.ID_TYPE_BOTH
)):
105 # Set it, changing the owner to 'administrator' rather than domain admins
106 sd2
= security
.descriptor
.from_sddl(sddl
, sid
)
107 sd2
.owner_sid
= administrator
109 smbd
.set_nt_acl(file, security
.SECINFO_OWNER |security
.SECINFO_GROUP | security
.SECINFO_DACL | security
.SECINFO_SACL
, sd2
)
111 # and then set an NTVFS ACL (which does not set the posix ACL) to pretend the owner really was set
114 raise XattrBackendError("Unable to find UID for domain administrator %s, got id %d of type %d" % (administrator
, admin_id
, admin_type
))
116 # For all other owning users, reset the owner to root
117 # and then set the ACL without changing the owner
119 # This won't work in test environments, as it tries a real (rather than xattr-based fake) chown
122 smbd
.set_nt_acl(file, security
.SECINFO_GROUP | security
.SECINFO_DACL | security
.SECINFO_SACL
, sd
)
125 (backend_obj
, dbname
) = checkset_backend(lp
, backend
, eadbfile
)
126 ntacl
= xattr
.NTACL()
129 if dbname
is not None:
131 backend_obj
.wrap_setxattr(dbname
,
132 file, xattr
.XATTR_NTACL_NAME
, ndr_pack(ntacl
))
134 # FIXME: Don't catch all exceptions, just those related to opening
136 print "Fail to open %s" % dbname
137 samba
.xattr_native
.wrap_setxattr(file, xattr
.XATTR_NTACL_NAME
,
140 samba
.xattr_native
.wrap_setxattr(file, xattr
.XATTR_NTACL_NAME
,
143 smbd
.set_nt_acl(file, security
.SECINFO_OWNER | security
.SECINFO_GROUP | security
.SECINFO_DACL | security
.SECINFO_SACL
, sd
)
146 def ldapmask2filemask(ldm
):
147 """Takes the access mask of a DS ACE and transform them in a File ACE mask.
149 RIGHT_DS_CREATE_CHILD
= 0x00000001
150 RIGHT_DS_DELETE_CHILD
= 0x00000002
151 RIGHT_DS_LIST_CONTENTS
= 0x00000004
152 ACTRL_DS_SELF
= 0x00000008
153 RIGHT_DS_READ_PROPERTY
= 0x00000010
154 RIGHT_DS_WRITE_PROPERTY
= 0x00000020
155 RIGHT_DS_DELETE_TREE
= 0x00000040
156 RIGHT_DS_LIST_OBJECT
= 0x00000080
157 RIGHT_DS_CONTROL_ACCESS
= 0x00000100
158 FILE_READ_DATA
= 0x0001
159 FILE_LIST_DIRECTORY
= 0x0001
160 FILE_WRITE_DATA
= 0x0002
161 FILE_ADD_FILE
= 0x0002
162 FILE_APPEND_DATA
= 0x0004
163 FILE_ADD_SUBDIRECTORY
= 0x0004
164 FILE_CREATE_PIPE_INSTANCE
= 0x0004
165 FILE_READ_EA
= 0x0008
166 FILE_WRITE_EA
= 0x0010
167 FILE_EXECUTE
= 0x0020
168 FILE_TRAVERSE
= 0x0020
169 FILE_DELETE_CHILD
= 0x0040
170 FILE_READ_ATTRIBUTES
= 0x0080
171 FILE_WRITE_ATTRIBUTES
= 0x0100
173 READ_CONTROL
= 0x00020000
174 WRITE_DAC
= 0x00040000
175 WRITE_OWNER
= 0x00080000
176 SYNCHRONIZE
= 0x00100000
177 STANDARD_RIGHTS_ALL
= 0x001F0000
179 filemask
= ldm
& STANDARD_RIGHTS_ALL
181 if (ldm
& RIGHT_DS_READ_PROPERTY
) and (ldm
& RIGHT_DS_LIST_CONTENTS
):
182 filemask
= filemask |
(SYNCHRONIZE | FILE_LIST_DIRECTORY |
183 FILE_READ_ATTRIBUTES | FILE_READ_EA |
184 FILE_READ_DATA | FILE_EXECUTE
)
186 if ldm
& RIGHT_DS_WRITE_PROPERTY
:
187 filemask
= filemask |
(SYNCHRONIZE | FILE_WRITE_DATA |
188 FILE_APPEND_DATA | FILE_WRITE_EA |
189 FILE_WRITE_ATTRIBUTES | FILE_ADD_FILE |
190 FILE_ADD_SUBDIRECTORY
)
192 if ldm
& RIGHT_DS_CREATE_CHILD
:
193 filemask
= filemask |
(FILE_ADD_SUBDIRECTORY | FILE_ADD_FILE
)
195 if ldm
& RIGHT_DS_DELETE_CHILD
:
196 filemask
= filemask | FILE_DELETE_CHILD
201 def dsacl2fsacl(dssddl
, sid
):
204 This function takes an the SDDL representation of a DS
205 ACL and return the SDDL representation of this ACL adapted
206 for files. It's used for Policy object provision
208 ref
= security
.descriptor
.from_sddl(dssddl
, sid
)
209 fdescr
= security
.descriptor()
210 fdescr
.owner_sid
= ref
.owner_sid
211 fdescr
.group_sid
= ref
.group_sid
212 fdescr
.type = ref
.type
213 fdescr
.revision
= ref
.revision
215 for i
in range(0, len(aces
)):
217 if not ace
.type & security
.SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT
and str(ace
.trustee
) != security
.SID_BUILTIN_PREW2K
:
218 # if fdescr.type & security.SEC_DESC_DACL_AUTO_INHERITED:
219 ace
.flags
= ace
.flags | security
.SEC_ACE_FLAG_OBJECT_INHERIT | security
.SEC_ACE_FLAG_CONTAINER_INHERIT
220 if str(ace
.trustee
) == security
.SID_CREATOR_OWNER
:
221 # For Creator/Owner the IO flag is set as this ACE has only a sense for child objects
222 ace
.flags
= ace
.flags | security
.SEC_ACE_FLAG_INHERIT_ONLY
223 ace
.access_mask
= ldapmask2filemask(ace
.access_mask
)
226 return fdescr
.as_sddl(sid
)