source3/smbd/pysmbd.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Set NT and POSIX ACLs and other VFS operations from Python
   4
   5    Copyrigyt (C) Andrew Bartlett 2012
   6    Copyright (C) Jeremy Allison 1994-2009.
   7    Copyright (C) Andreas Gruenbacher 2002.
   8    Copyright (C) Simo Sorce <idra@samba.org> 2009.
   9    Copyright (C) Simo Sorce 2002
  10    Copyright (C) Eric Lorimer 2002
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "smbd/smbd.h"
  28 #include <Python.h>
  29 #include "libcli/util/pyerrors.h"
  30 #include "librpc/rpc/pyrpc_util.h"
  31 #include <pytalloc.h>
  32 #include "system/filesys.h"
  33
  34 extern const struct generic_mapping file_generic_mapping;
  35
  36 #undef  DBGC_CLASS
  37 #define DBGC_CLASS DBGC_ACLS
  38
  39 static NTSTATUS set_sys_acl_no_snum(const char *fname,
  40                                      SMB_ACL_TYPE_T acltype,
  41                                      SMB_ACL_T theacl)
  42 {
  43         connection_struct *conn;
  44         NTSTATUS status = NT_STATUS_OK;
  45         int ret;
  46         mode_t saved_umask;
  47
  48         conn = talloc_zero(NULL, connection_struct);
  49         if (conn == NULL) {
  50                 DEBUG(0, ("talloc failed\n"));
  51                 return NT_STATUS_NO_MEMORY;
  52         }
  53
  54         if (!(conn->params = talloc(conn, struct share_params))) {
  55                 DEBUG(0,("set_sys_acl_no_snum: talloc() failed!\n"));
  56                 TALLOC_FREE(conn);
  57                 return NT_STATUS_NO_MEMORY;
  58         }
  59
  60         /* we want total control over the permissions on created files,
  61            so set our umask to 0 */
  62         saved_umask = umask(0);
  63
  64         conn->params->service = -1;
  65
  66         set_conn_connectpath(conn, "/");
  67
  68         smbd_vfs_init(conn);
  69
  70         ret = SMB_VFS_SYS_ACL_SET_FILE( conn, fname, acltype, theacl);
  71         if (ret != 0) {
  72                 status = map_nt_error_from_unix_common(ret);
  73                 DEBUG(0,("set_sys_acl_no_snum: SMB_VFS_SYS_ACL_SET_FILE "
  74                          "returned zero.\n"));
  75         }
  76
  77         umask(saved_umask);
  78
  79         conn_free(conn);
  80
  81         return status;
  82 }
  83
  84 static NTSTATUS set_nt_acl_no_snum(const char *fname,
  85                                    uint32 security_info_sent, const struct security_descriptor *sd)
  86 {
  87         TALLOC_CTX *frame = talloc_stackframe();
  88         connection_struct *conn;
  89         NTSTATUS status = NT_STATUS_OK;
  90         files_struct *fsp;
  91         struct smb_filename *smb_fname = NULL;
  92         int flags, ret;
  93         mode_t saved_umask;
  94
  95         if (!posix_locking_init(false)) {
  96                 TALLOC_FREE(frame);
  97                 return NT_STATUS_NO_MEMORY;
  98         }
  99
 100         conn = talloc_zero(frame, connection_struct);
 101         if (conn == NULL) {
 102                 TALLOC_FREE(frame);
 103                 DEBUG(0, ("talloc failed\n"));
 104                 return NT_STATUS_NO_MEMORY;
 105         }
 106
 107         if (!(conn->params = talloc(conn, struct share_params))) {
 108                 DEBUG(0,("set_nt_acl_no_snum: talloc() failed!\n"));
 109                 TALLOC_FREE(frame);
 110                 return NT_STATUS_NO_MEMORY;
 111         }
 112
 113         fsp = talloc_zero(frame, struct files_struct);
 114         if (fsp == NULL) {
 115                 TALLOC_FREE(frame);
 116                 return NT_STATUS_NO_MEMORY;
 117         }
 118         fsp->fh = talloc(fsp, struct fd_handle);
 119         if (fsp->fh == NULL) {
 120                 TALLOC_FREE(frame);
 121                 return NT_STATUS_NO_MEMORY;
 122         }
 123         fsp->conn = conn;
 124
 125         /* we want total control over the permissions on created files,
 126            so set our umask to 0 */
 127         saved_umask = umask(0);
 128
 129         conn->params->service = -1;
 130
 131         set_conn_connectpath(conn, "/");
 132
 133         smbd_vfs_init(conn);
 134
 135         status = create_synthetic_smb_fname_split(fsp, fname, NULL,
 136                                                   &smb_fname);
 137         if (!NT_STATUS_IS_OK(status)) {
 138                 TALLOC_FREE(frame);
 139                 umask(saved_umask);
 140                 return status;
 141         }
 142
 143         fsp->fsp_name = smb_fname;
 144
 145 #ifdef O_DIRECTORY
 146         flags = O_RDONLY|O_DIRECTORY;
 147 #else
 148         /* POSIX allows us to open a directory with O_RDONLY. */
 149         flags = O_RDONLY;
 150 #endif
 151
 152         fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, O_RDWR, 00400);
 153         if (fsp->fh->fd == -1 && errno == EISDIR) {
 154                 fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, flags, 00400);
 155         }
 156         if (fsp->fh->fd == -1) {
 157                 printf("open: error=%d (%s)\n", errno, strerror(errno));
 158                 TALLOC_FREE(frame);
 159                 umask(saved_umask);
 160                 return NT_STATUS_UNSUCCESSFUL;
 161         }
 162
 163         ret = SMB_VFS_FSTAT(fsp, &smb_fname->st);
 164         if (ret == -1) {
 165                 /* If we have an fd, this stat should succeed. */
 166                 DEBUG(0,("Error doing fstat on open file %s "
 167                         "(%s)\n",
 168                         smb_fname_str_dbg(smb_fname),
 169                         strerror(errno) ));
 170                 TALLOC_FREE(frame);
 171                 umask(saved_umask);
 172                 return map_nt_error_from_unix(errno);
 173         }
 174
 175         fsp->file_id = vfs_file_id_from_sbuf(conn, &smb_fname->st);
 176         fsp->vuid = UID_FIELD_INVALID;
 177         fsp->file_pid = 0;
 178         fsp->can_lock = True;
 179         fsp->can_read = True;
 180         fsp->can_write = True;
 181         fsp->print_file = NULL;
 182         fsp->modified = False;
 183         fsp->sent_oplock_break = NO_BREAK_SENT;
 184         fsp->is_directory = S_ISDIR(smb_fname->st.st_ex_mode);
 185
 186         status = SMB_VFS_FSET_NT_ACL( fsp, security_info_sent, sd);
 187         if (!NT_STATUS_IS_OK(status)) {
 188                 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned %s.\n", nt_errstr(status)));
 189         }
 190
 191         SMB_VFS_CLOSE(fsp);
 192
 193         conn_free(conn);
 194         TALLOC_FREE(frame);
 195
 196         umask(saved_umask);
 197         return status;
 198 }
 199
 200
 201 static SMB_ACL_T make_simple_acl(gid_t gid, mode_t chmod_mode)
 202 {
 203         TALLOC_CTX *frame = talloc_stackframe();
 204
 205         mode_t mode = SMB_ACL_READ|SMB_ACL_WRITE|SMB_ACL_EXECUTE;
 206
 207         mode_t mode_user = (chmod_mode & 0700) >> 6;
 208         mode_t mode_group = (chmod_mode & 070) >> 3;
 209         mode_t mode_other = chmod_mode &  07;
 210         SMB_ACL_ENTRY_T entry;
 211         SMB_ACL_T acl = sys_acl_init(frame);
 212
 213         if (!acl) {
 214                 return NULL;
 215         }
 216
 217         if (sys_acl_create_entry(&acl, &entry) != 0) {
 218                 TALLOC_FREE(frame);
 219                 return NULL;
 220         }
 221
 222         if (sys_acl_set_tag_type(entry, SMB_ACL_USER_OBJ) != 0) {
 223                 TALLOC_FREE(frame);
 224                 return NULL;
 225         }
 226
 227         if (sys_acl_set_permset(entry, &mode_user) != 0) {
 228                 TALLOC_FREE(frame);
 229                 return NULL;
 230         }
 231
 232         if (sys_acl_create_entry(&acl, &entry) != 0) {
 233                 TALLOC_FREE(frame);
 234                 return NULL;
 235         }
 236
 237         if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP_OBJ) != 0) {
 238                 TALLOC_FREE(frame);
 239                 return NULL;
 240         }
 241
 242         if (sys_acl_set_permset(entry, &mode_group) != 0) {
 243                 TALLOC_FREE(frame);
 244                 return NULL;
 245         }
 246
 247         if (sys_acl_create_entry(&acl, &entry) != 0) {
 248                 TALLOC_FREE(frame);
 249                 return NULL;
 250         }
 251
 252         if (sys_acl_set_tag_type(entry, SMB_ACL_OTHER) != 0) {
 253                 TALLOC_FREE(frame);
 254                 return NULL;
 255         }
 256
 257         if (sys_acl_set_permset(entry, &mode_other) != 0) {
 258                 TALLOC_FREE(frame);
 259                 return NULL;
 260         }
 261
 262         if (gid != -1) {
 263                 if (sys_acl_create_entry(&acl, &entry) != 0) {
 264                         TALLOC_FREE(frame);
 265                         return NULL;
 266                 }
 267
 268                 if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP) != 0) {
 269                         TALLOC_FREE(frame);
 270                         return NULL;
 271                 }
 272
 273                 if (sys_acl_set_qualifier(entry, &gid) != 0) {
 274                         TALLOC_FREE(frame);
 275                         return NULL;
 276                 }
 277
 278                 if (sys_acl_set_permset(entry, &mode_group) != 0) {
 279                         TALLOC_FREE(frame);
 280                         return NULL;
 281                 }
 282         }
 283
 284         if (sys_acl_create_entry(&acl, &entry) != 0) {
 285                 TALLOC_FREE(frame);
 286                 return NULL;
 287         }
 288
 289         if (sys_acl_set_tag_type(entry, SMB_ACL_MASK) != 0) {
 290                 TALLOC_FREE(frame);
 291                 return NULL;
 292         }
 293
 294         if (sys_acl_set_permset(entry, &mode) != 0) {
 295                 TALLOC_FREE(frame);
 296                 return NULL;
 297         }
 298         return acl;
 299 }
 300
 301 /*
 302   set a simple ACL on a file, as a test
 303  */
 304 static PyObject *py_smbd_set_simple_acl(PyObject *self, PyObject *args)
 305 {
 306         NTSTATUS status;
 307         char *fname;
 308         int mode, gid = -1;
 309         SMB_ACL_T acl;
 310         TALLOC_CTX *frame;
 311
 312         if (!PyArg_ParseTuple(args, "si|i", &fname, &mode, &gid))
 313                 return NULL;
 314
 315         acl = make_simple_acl(gid, mode);
 316
 317         frame = talloc_stackframe();
 318
 319         status = set_sys_acl_no_snum(fname, SMB_ACL_TYPE_ACCESS, acl);
 320         TALLOC_FREE(acl);
 321
 322         TALLOC_FREE(frame);
 323
 324         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 325
 326         Py_RETURN_NONE;
 327 }
 328
 329 /*
 330   chown a file
 331  */
 332 static PyObject *py_smbd_chown(PyObject *self, PyObject *args)
 333 {
 334         connection_struct *conn;
 335         NTSTATUS status = NT_STATUS_OK;
 336         int ret;
 337
 338         char *fname;
 339         int uid, gid;
 340         TALLOC_CTX *frame;
 341         mode_t saved_umask;
 342
 343         if (!PyArg_ParseTuple(args, "sii", &fname, &uid, &gid))
 344                 return NULL;
 345
 346         frame = talloc_stackframe();
 347
 348         conn = talloc_zero(frame, connection_struct);
 349         if (conn == NULL) {
 350                 PyErr_NoMemory();
 351                 return NULL;
 352         }
 353
 354         if (!(conn->params = talloc(conn, struct share_params))) {
 355                 PyErr_NoMemory();
 356                 return NULL;
 357         }
 358
 359         /* we want total control over the permissions on created files,
 360            so set our umask to 0 */
 361         saved_umask = umask(0);
 362
 363         conn->params->service = -1;
 364
 365         set_conn_connectpath(conn, "/");
 366
 367         smbd_vfs_init(conn);
 368
 369         ret = SMB_VFS_CHOWN( conn, fname, uid, gid);
 370         if (ret != 0) {
 371                 status = map_nt_error_from_unix_common(errno);
 372                 DEBUG(0,("chown returned failure: %s\n", strerror(errno)));
 373         }
 374
 375         umask(saved_umask);
 376
 377         conn_free(conn);
 378
 379         TALLOC_FREE(frame);
 380
 381         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 382
 383         Py_RETURN_NONE;
 384 }
 385
 386 /*
 387   chown a file
 388  */
 389 static PyObject *py_smbd_unlink(PyObject *self, PyObject *args)
 390 {
 391         connection_struct *conn;
 392         NTSTATUS status = NT_STATUS_OK;
 393         int ret;
 394         struct smb_filename *smb_fname = NULL;
 395         char *fname;
 396         TALLOC_CTX *frame;
 397         mode_t saved_umask;
 398
 399         if (!PyArg_ParseTuple(args, "s", &fname))
 400                 return NULL;
 401
 402         frame = talloc_stackframe();
 403
 404         conn = talloc_zero(frame, connection_struct);
 405         if (conn == NULL) {
 406                 PyErr_NoMemory();
 407                 return NULL;
 408         }
 409
 410         if (!(conn->params = talloc(conn, struct share_params))) {
 411                 PyErr_NoMemory();
 412                 return NULL;
 413         }
 414
 415         /* we want total control over the permissions on created files,
 416            so set our umask to 0 */
 417         saved_umask = umask(0);
 418
 419         conn->params->service = -1;
 420
 421         set_conn_connectpath(conn, "/");
 422
 423         smbd_vfs_init(conn);
 424
 425         status = create_synthetic_smb_fname_split(frame, fname, NULL,
 426                                                   &smb_fname);
 427         if (!NT_STATUS_IS_OK(status)) {
 428                 TALLOC_FREE(frame);
 429                 umask(saved_umask);
 430                 PyErr_NTSTATUS_IS_ERR_RAISE(status);
 431         }
 432
 433         ret = SMB_VFS_UNLINK(conn, smb_fname);
 434         if (ret != 0) {
 435                 status = map_nt_error_from_unix_common(errno);
 436                 DEBUG(0,("unlink returned failure: %s\n", strerror(errno)));
 437         }
 438
 439         umask(saved_umask);
 440
 441         conn_free(conn);
 442
 443         TALLOC_FREE(frame);
 444
 445         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 446
 447         Py_RETURN_NONE;
 448 }
 449
 450 /*
 451   check if we have ACL support
 452  */
 453 static PyObject *py_smbd_have_posix_acls(PyObject *self, PyObject *args)
 454 {
 455 #ifdef HAVE_POSIX_ACLS
 456         return PyBool_FromLong(true);
 457 #else
 458         return PyBool_FromLong(false);
 459 #endif
 460 }
 461
 462 /*
 463   set the NT ACL on a file
 464  */
 465 static PyObject *py_smbd_set_nt_acl(PyObject *self, PyObject *args)
 466 {
 467         NTSTATUS status;
 468         char *fname;
 469         int security_info_sent;
 470         PyObject *py_sd;
 471         struct security_descriptor *sd;
 472
 473         if (!PyArg_ParseTuple(args, "siO", &fname, &security_info_sent, &py_sd))
 474                 return NULL;
 475
 476         if (!py_check_dcerpc_type(py_sd, "samba.dcerpc.security", "descriptor")) {
 477                 return NULL;
 478         }
 479
 480         sd = pytalloc_get_type(py_sd, struct security_descriptor);
 481
 482         status = set_nt_acl_no_snum(fname, security_info_sent, sd);
 483         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 484
 485         Py_RETURN_NONE;
 486 }
 487
 488 /*
 489   Return the NT ACL on a file
 490  */
 491 static PyObject *py_smbd_get_nt_acl(PyObject *self, PyObject *args)
 492 {
 493         char *fname;
 494         int security_info_wanted;
 495         PyObject *py_sd;
 496         struct security_descriptor *sd;
 497         TALLOC_CTX *tmp_ctx = talloc_new(NULL);
 498         NTSTATUS status;
 499
 500         if (!PyArg_ParseTuple(args, "si", &fname, &security_info_wanted))
 501                 return NULL;
 502
 503         status = get_nt_acl_no_snum(tmp_ctx, fname, security_info_wanted, &sd);
 504         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 505
 506         py_sd = py_return_ndr_struct("samba.dcerpc.security", "descriptor", sd, sd);
 507
 508         talloc_free(tmp_ctx);
 509
 510         return py_sd;
 511 }
 512
 513 /*
 514   set the posix (or similar) ACL on a file
 515  */
 516 static PyObject *py_smbd_set_sys_acl(PyObject *self, PyObject *args)
 517 {
 518         NTSTATUS status;
 519         char *fname;
 520         PyObject *py_acl;
 521         struct smb_acl_t *acl;
 522         int acl_type;
 523
 524         if (!PyArg_ParseTuple(args, "siO", &fname, &acl_type, &py_acl))
 525                 return NULL;
 526
 527         if (!py_check_dcerpc_type(py_acl, "samba.dcerpc.smb_acl", "t")) {
 528                 return NULL;
 529         }
 530
 531         acl = pytalloc_get_type(py_acl, struct smb_acl_t);
 532
 533         status = set_sys_acl_no_snum(fname, acl_type, acl);
 534         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 535
 536         Py_RETURN_NONE;
 537 }
 538
 539 /*
 540   Return the posix (or similar) ACL on a file
 541  */
 542 static PyObject *py_smbd_get_sys_acl(PyObject *self, PyObject *args)
 543 {
 544         char *fname;
 545         PyObject *py_acl;
 546         struct smb_acl_t *acl;
 547         int acl_type;
 548         TALLOC_CTX *frame = talloc_stackframe();
 549         connection_struct *conn;
 550         NTSTATUS status = NT_STATUS_OK;
 551
 552         if (!PyArg_ParseTuple(args, "si", &fname, &acl_type)) {
 553                 TALLOC_FREE(frame);
 554                 return NULL;
 555         }
 556
 557         conn = talloc_zero(frame, connection_struct);
 558         if (conn == NULL) {
 559                 DEBUG(0, ("talloc failed\n"));
 560                 PyErr_NoMemory();
 561                 TALLOC_FREE(frame);
 562                 return NULL;
 563         }
 564
 565         if (!(conn->params = talloc(conn, struct share_params))) {
 566                 DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
 567                 PyErr_NoMemory();
 568                 TALLOC_FREE(frame);
 569                 return NULL;
 570         }
 571
 572         conn->params->service = -1;
 573
 574         set_conn_connectpath(conn, "/");
 575
 576         smbd_vfs_init(conn);
 577
 578         acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, acl_type, frame);
 579         if (!acl) {
 580                 TALLOC_FREE(frame);
 581                 status = map_nt_error_from_unix_common(errno);
 582                 DEBUG(0,("sys_acl_get_file returned NULL: %s\n", strerror(errno)));
 583                 PyErr_NTSTATUS_IS_ERR_RAISE(status);
 584         }
 585
 586         conn_free(conn);
 587
 588         py_acl = py_return_ndr_struct("samba.dcerpc.smb_acl", "t", acl, acl);
 589
 590         TALLOC_FREE(frame);
 591
 592         return py_acl;
 593 }
 594
 595 static PyMethodDef py_smbd_methods[] = {
 596         { "have_posix_acls",
 597                 (PyCFunction)py_smbd_have_posix_acls, METH_VARARGS,
 598                 NULL },
 599         { "set_simple_acl",
 600                 (PyCFunction)py_smbd_set_simple_acl, METH_VARARGS,
 601                 NULL },
 602         { "set_nt_acl",
 603                 (PyCFunction)py_smbd_set_nt_acl, METH_VARARGS,
 604                 NULL },
 605         { "get_nt_acl",
 606                 (PyCFunction)py_smbd_get_nt_acl, METH_VARARGS,
 607                 NULL },
 608         { "get_sys_acl",
 609                 (PyCFunction)py_smbd_get_sys_acl, METH_VARARGS,
 610                 NULL },
 611         { "set_sys_acl",
 612                 (PyCFunction)py_smbd_set_sys_acl, METH_VARARGS,
 613                 NULL },
 614         { "chown",
 615                 (PyCFunction)py_smbd_chown, METH_VARARGS,
 616                 NULL },
 617         { "unlink",
 618                 (PyCFunction)py_smbd_unlink, METH_VARARGS,
 619                 NULL },
 620         { NULL }
 621 };
 622
 623 void initsmbd(void);
 624 void initsmbd(void)
 625 {
 626         PyObject *m;
 627
 628         m = Py_InitModule3("smbd", py_smbd_methods,
 629                            "Python bindings for the smbd file server.");
 630         if (m == NULL)
 631                 return;
 632
 633 }