2 Unix SMB/CIFS implementation.
4 POSIX NTVFS backend - NT ACLs mapped to NFS4 ACLs, as per
5 http://www.suse.de/~agruen/nfs4acl/
7 Copyright (C) Andrew Tridgell 2006
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "vfs_posix.h"
25 #include "../lib/util/unix_privs.h"
26 #include "librpc/gen_ndr/ndr_nfs4acl.h"
27 #include "libcli/security/security.h"
29 NTSTATUS
pvfs_acl_nfs4_init(void);
31 #define ACE4_IDENTIFIER_GROUP 0x40
34 load the current ACL from system.nfs4acl
36 static NTSTATUS
pvfs_acl_load_nfs4(struct pvfs_state
*pvfs
, struct pvfs_filename
*name
, int fd
,
38 struct security_descriptor
**psd
)
42 struct security_descriptor
*sd
;
45 struct composite_context
*ctx
;
47 acl
= talloc_zero(mem_ctx
, struct nfs4acl
);
48 NT_STATUS_HAVE_NO_MEMORY(acl
);
50 status
= pvfs_xattr_ndr_load(pvfs
, mem_ctx
, name
->full_name
, fd
,
52 acl
, (void *) ndr_pull_nfs4acl
);
53 if (!NT_STATUS_IS_OK(status
)) {
58 *psd
= security_descriptor_initialise(mem_ctx
);
59 NT_STATUS_HAVE_NO_MEMORY(*psd
);
63 sd
->type
|= acl
->a_flags
;
65 /* the number of ids to map is the acl count plus uid and gid */
66 num_ids
= acl
->a_count
+2;
67 ids
= talloc_array(sd
, struct id_map
, num_ids
);
68 NT_STATUS_HAVE_NO_MEMORY(ids
);
70 ids
[0].xid
.id
= name
->st
.st_uid
;
71 ids
[0].xid
.type
= ID_TYPE_UID
;
73 ids
[0].status
= ID_UNKNOWN
;
75 ids
[1].xid
.id
= name
->st
.st_gid
;
76 ids
[1].xid
.type
= ID_TYPE_GID
;
78 ids
[1].status
= ID_UNKNOWN
;
80 for (i
=0;i
<acl
->a_count
;i
++) {
81 struct nfs4ace
*a
= &acl
->ace
[i
];
82 ids
[i
+2].xid
.id
= a
->e_id
;
83 if (a
->e_flags
& ACE4_IDENTIFIER_GROUP
) {
84 ids
[i
+2].xid
.type
= ID_TYPE_GID
;
86 ids
[i
+2].xid
.type
= ID_TYPE_UID
;
89 ids
[i
+2].status
= ID_UNKNOWN
;
92 /* Allocate memory for the sids from the security descriptor to be on
94 ctx
= wbc_xids_to_sids_send(pvfs
->wbc_ctx
, sd
, num_ids
, ids
);
95 NT_STATUS_HAVE_NO_MEMORY(ctx
);
96 status
= wbc_xids_to_sids_recv(ctx
, &ids
);
97 NT_STATUS_NOT_OK_RETURN(status
);
99 sd
->owner_sid
= talloc_steal(sd
, ids
[0].sid
);
100 sd
->group_sid
= talloc_steal(sd
, ids
[1].sid
);
102 for (i
=0;i
<acl
->a_count
;i
++) {
103 struct nfs4ace
*a
= &acl
->ace
[i
];
104 struct security_ace ace
;
105 ace
.type
= a
->e_type
;
106 ace
.flags
= a
->e_flags
;
107 ace
.access_mask
= a
->e_mask
;
108 ace
.trustee
= *ids
[i
+2].sid
;
109 security_descriptor_dacl_add(sd
, &ace
);
116 save the acl for a file into system.nfs4acl
118 static NTSTATUS
pvfs_acl_save_nfs4(struct pvfs_state
*pvfs
, struct pvfs_filename
*name
, int fd
,
119 struct security_descriptor
*sd
)
127 struct composite_context
*ctx
;
129 tmp_ctx
= talloc_new(pvfs
);
130 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx
);
133 acl
.a_flags
= sd
->type
;
134 acl
.a_count
= sd
->dacl
?sd
->dacl
->num_aces
:0;
135 acl
.a_owner_mask
= 0;
136 acl
.a_group_mask
= 0;
137 acl
.a_other_mask
= 0;
139 acl
.ace
= talloc_array(tmp_ctx
, struct nfs4ace
, acl
.a_count
);
141 talloc_free(tmp_ctx
);
142 return NT_STATUS_NO_MEMORY
;
145 ids
= talloc_array(tmp_ctx
, struct id_map
, acl
.a_count
);
147 talloc_free(tmp_ctx
);
148 return NT_STATUS_NO_MEMORY
;
151 for (i
=0;i
<acl
.a_count
;i
++) {
152 struct security_ace
*ace
= &sd
->dacl
->aces
[i
];
153 ZERO_STRUCT(ids
[i
].xid
);
154 ids
[i
].sid
= dom_sid_dup(ids
, &ace
->trustee
);
155 if (ids
[i
].sid
== NULL
) {
156 talloc_free(tmp_ctx
);
157 return NT_STATUS_NO_MEMORY
;
159 ids
[i
].status
= ID_UNKNOWN
;
162 ctx
= wbc_sids_to_xids_send(pvfs
->wbc_ctx
,ids
, acl
.a_count
, ids
);
164 talloc_free(tmp_ctx
);
165 return NT_STATUS_NO_MEMORY
;
167 status
= wbc_sids_to_xids_recv(ctx
, &ids
);
168 if (!NT_STATUS_IS_OK(status
)) {
169 talloc_free(tmp_ctx
);
173 for (i
=0;i
<acl
.a_count
;i
++) {
174 struct nfs4ace
*a
= &acl
.ace
[i
];
175 struct security_ace
*ace
= &sd
->dacl
->aces
[i
];
176 a
->e_type
= ace
->type
;
177 a
->e_flags
= ace
->flags
;
178 a
->e_mask
= ace
->access_mask
;
179 if (ids
[i
].xid
.type
!= ID_TYPE_UID
) {
180 a
->e_flags
|= ACE4_IDENTIFIER_GROUP
;
182 a
->e_id
= ids
[i
].xid
.id
;
186 privs
= root_privileges();
187 status
= pvfs_xattr_ndr_save(pvfs
, name
->full_name
, fd
,
189 &acl
, (void *) ndr_push_nfs4acl
);
192 talloc_free(tmp_ctx
);
198 initialise pvfs acl NFS4 backend
200 NTSTATUS
pvfs_acl_nfs4_init(void)
202 struct pvfs_acl_ops ops
= {
204 .acl_load
= pvfs_acl_load_nfs4
,
205 .acl_save
= pvfs_acl_save_nfs4
207 return pvfs_acl_register(&ops
);