4 * Copyright (C) Jim McDonough, 2006
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 #include "nfs4_acls.h"
24 #define SMBACL4_PARAM_TYPE_NAME "nfs4"
26 #define SMB_ACE4_INT_MAGIC 0x76F8A967
27 typedef struct _SMB_ACE4_INT_T
34 #define SMB_ACL4_INT_MAGIC 0x29A3E792
35 typedef struct _SMB_ACL4_INT_T
39 SMB_ACE4_INT_T
*first
;
43 extern struct current_user current_user
;
44 extern int try_chown(connection_struct
*conn
, const char *fname
, uid_t uid
, gid_t gid
);
45 extern BOOL
unpack_nt_owners(int snum
, uid_t
*puser
, gid_t
*pgrp
,
46 uint32 security_info_sent
, SEC_DESC
*psd
);
48 static SMB_ACL4_INT_T
*get_validated_aclint(SMB4ACL_T
*acl
)
50 SMB_ACL4_INT_T
*aclint
= (SMB_ACL4_INT_T
*)acl
;
53 DEBUG(2, ("acl is NULL\n"));
57 if (aclint
->magic
!=SMB_ACL4_INT_MAGIC
)
59 DEBUG(2, ("aclint bad magic 0x%x\n", aclint
->magic
));
66 static SMB_ACE4_INT_T
*get_validated_aceint(SMB4ACE_T
*ace
)
68 SMB_ACE4_INT_T
*aceint
= (SMB_ACE4_INT_T
*)ace
;
71 DEBUG(2, ("ace is NULL\n"));
75 if (aceint
->magic
!=SMB_ACE4_INT_MAGIC
)
77 DEBUG(2, ("aceint bad magic 0x%x\n", aceint
->magic
));
84 SMB4ACL_T
*smb_create_smb4acl(void)
86 TALLOC_CTX
*mem_ctx
= main_loop_talloc_get();
87 SMB_ACL4_INT_T
*acl
= (SMB_ACL4_INT_T
*)TALLOC_SIZE(mem_ctx
, sizeof(SMB_ACL4_INT_T
));
90 DEBUG(0, ("TALLOC_SIZE failed\n"));
94 memset(acl
, 0, sizeof(SMB_ACL4_INT_T
));
95 acl
->magic
= SMB_ACL4_INT_MAGIC
;
96 /* acl->first, last = NULL not needed */
97 return (SMB4ACL_T
*)acl
;
100 SMB4ACE_T
*smb_add_ace4(SMB4ACL_T
*acl
, SMB_ACE4PROP_T
*prop
)
102 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
103 TALLOC_CTX
*mem_ctx
= main_loop_talloc_get();
106 ace
= (SMB_ACE4_INT_T
*)TALLOC_SIZE(mem_ctx
, sizeof(SMB_ACE4_INT_T
));
109 DEBUG(0, ("TALLOC_SIZE failed\n"));
113 memset(ace
, 0, sizeof(SMB_ACE4_INT_T
));
114 ace
->magic
= SMB_ACE4_INT_MAGIC
;
115 /* ace->next = NULL not needed */
116 memcpy(&ace
->prop
, prop
, sizeof(SMB_ACE4PROP_T
));
118 if (aclint
->first
==NULL
)
123 aclint
->last
->next
= (void *)ace
;
128 return (SMB4ACE_T
*)ace
;
131 SMB_ACE4PROP_T
*smb_get_ace4(SMB4ACE_T
*ace
)
133 SMB_ACE4_INT_T
*aceint
= get_validated_aceint(ace
);
137 return &aceint
->prop
;
140 SMB4ACE_T
*smb_next_ace4(SMB4ACE_T
*ace
)
142 SMB_ACE4_INT_T
*aceint
= get_validated_aceint(ace
);
146 return (SMB4ACE_T
*)aceint
->next
;
149 SMB4ACE_T
*smb_first_ace4(SMB4ACL_T
*acl
)
151 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
155 return (SMB4ACE_T
*)aclint
->first
;
158 uint32
smb_get_naces(SMB4ACL_T
*acl
)
160 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
164 return aclint
->naces
;
167 static int smbacl4_GetFileOwner(files_struct
*fsp
, SMB_STRUCT_STAT
*psbuf
)
169 memset(psbuf
, 0, sizeof(SMB_STRUCT_STAT
));
170 if (fsp
->is_directory
|| fsp
->fh
->fd
== -1) {
171 /* Get the stat struct for the owner info. */
172 if (SMB_VFS_STAT(fsp
->conn
,fsp
->fsp_name
, psbuf
) != 0)
174 DEBUG(8, ("SMB_VFS_STAT failed with error %s\n",
179 if (SMB_VFS_FSTAT(fsp
,fsp
->fh
->fd
, psbuf
) != 0)
181 DEBUG(8, ("SMB_VFS_FSTAT failed with error %s\n",
190 static BOOL
smbacl4_nfs42win(SMB4ACL_T
*acl
, /* in */
191 DOM_SID
*psid_owner
, /* in */
192 DOM_SID
*psid_group
, /* in */
193 SEC_ACE
**ppnt_ace_list
, /* out */
194 int *pgood_aces
/* out */
197 SMB_ACL4_INT_T
*aclint
= (SMB_ACL4_INT_T
*)acl
;
198 SMB_ACE4_INT_T
*aceint
;
199 SEC_ACE
*nt_ace_list
= NULL
;
201 TALLOC_CTX
*mem_ctx
= main_loop_talloc_get();
203 DEBUG(10, ("smbacl_nfs42win entered"));
205 aclint
= get_validated_aclint(acl
);
210 nt_ace_list
= (SEC_ACE
*)TALLOC_SIZE(mem_ctx
, aclint
->naces
* sizeof(SEC_ACE
));
211 if (nt_ace_list
==NULL
)
213 DEBUG(10, ("talloc error"));
217 memset(nt_ace_list
, 0, aclint
->naces
* sizeof(SEC_ACE
));
222 for (aceint
=aclint
->first
; aceint
!=NULL
; aceint
=(SMB_ACE4_INT_T
*)aceint
->next
) {
225 SMB_ACE4PROP_T
*ace
= &aceint
->prop
;
227 DEBUG(10, ("magic: 0x%x, type: %d, iflags: %x, flags: %x, mask: %x, "
228 "who: %d\n", aceint
->magic
, ace
->aceType
, ace
->flags
,
229 ace
->aceFlags
, ace
->aceMask
, ace
->who
.id
));
231 SMB_ASSERT(aceint
->magic
==SMB_ACE4_INT_MAGIC
);
233 if (ace
->flags
& SMB_ACE4_ID_SPECIAL
) {
234 switch (ace
->who
.special_id
) {
235 case SMB_ACE4_WHO_OWNER
:
236 sid_copy(&sid
, psid_owner
);
238 case SMB_ACE4_WHO_GROUP
:
239 sid_copy(&sid
, psid_group
);
241 case SMB_ACE4_WHO_EVERYONE
:
242 sid_copy(&sid
, &global_sid_World
);
245 DEBUG(8, ("invalid special who id %d "
246 "ignored\n", ace
->who
.special_id
));
249 if (ace
->aceFlags
& SMB_ACE4_IDENTIFIER_GROUP
) {
250 gid_to_sid(&sid
, ace
->who
.gid
);
252 uid_to_sid(&sid
, ace
->who
.uid
);
255 DEBUG(10, ("mapped %d to %s\n", ace
->who
.id
,
256 sid_string_static(&sid
)));
258 init_sec_access(&mask
, ace
->aceMask
);
259 init_sec_ace(&nt_ace_list
[good_aces
++], &sid
,
261 ace
->aceFlags
& 0xf);
264 *ppnt_ace_list
= nt_ace_list
;
265 *pgood_aces
= good_aces
;
270 size_t smb_get_nt_acl_nfs4(files_struct
*fsp
,
271 uint32 security_info
,
272 SEC_DESC
**ppdesc
, SMB4ACL_T
*acl
)
275 SMB_STRUCT_STAT sbuf
;
276 DOM_SID sid_owner
, sid_group
;
278 SEC_ACE
*nt_ace_list
= NULL
;
280 TALLOC_CTX
*mem_ctx
= main_loop_talloc_get();
282 DEBUG(10, ("smb_get_nt_acl_nfs4 invoked for %s\n", fsp
->fsp_name
));
284 if (acl
==NULL
|| smb_get_naces(acl
)==0)
285 return 0; /* special because we shouldn't alloc 0 for win */
287 if (smbacl4_GetFileOwner(fsp
, &sbuf
))
290 uid_to_sid(&sid_owner
, sbuf
.st_uid
);
291 gid_to_sid(&sid_group
, sbuf
.st_gid
);
293 if (smbacl4_nfs42win(acl
,
299 DEBUG(8,("smbacl4_nfs42win failed\n"));
303 psa
= make_sec_acl(mem_ctx
, NT4_ACL_REVISION
,
304 good_aces
, nt_ace_list
);
306 DEBUG(2,("make_sec_acl failed\n"));
310 DEBUG(10,("after make sec_acl\n"));
311 *ppdesc
= make_sec_desc(mem_ctx
, SEC_DESC_REVISION
,
312 SEC_DESC_SELF_RELATIVE
,
313 (security_info
& OWNER_SECURITY_INFORMATION
)
315 (security_info
& GROUP_SECURITY_INFORMATION
)
317 NULL
, psa
, &sd_size
);
319 DEBUG(2,("make_sec_desc failed\n"));
323 DEBUG(10, ("smb_get_nt_acl_nfs4 successfully exited with sd_size %d\n", sd_size
));
327 enum smbacl4_mode_enum
{e_simple
=0, e_special
=1};
328 enum smbacl4_acedup_enum
{e_dontcare
=0, e_reject
=1, e_ignore
=2, e_merge
=3};
330 typedef struct _smbacl4_vfs_params
{
331 enum smbacl4_mode_enum mode
;
333 enum smbacl4_acedup_enum acedup
;
334 } smbacl4_vfs_params
;
337 * Gather special parameters for NFS4 ACL handling
339 static int smbacl4_get_vfs_params(
340 const char *type_name
,
342 smbacl4_vfs_params
*params
345 static const struct enum_list enum_smbacl4_modes
[] = {
346 { e_simple
, "simple" },
347 { e_special
, "special" }
349 static const struct enum_list enum_smbacl4_acedups
[] = {
350 { e_dontcare
, "dontcare" },
351 { e_reject
, "reject" },
352 { e_ignore
, "ignore" },
353 { e_merge
, "merge" },
356 memset(params
, 0, sizeof(smbacl4_vfs_params
));
357 params
->mode
= (enum smbacl4_mode_enum
)lp_parm_enum(
358 SNUM(fsp
->conn
), type_name
,
359 "mode", enum_smbacl4_modes
, e_simple
);
360 params
->do_chown
= lp_parm_bool(SNUM(fsp
->conn
), type_name
,
362 params
->acedup
= (enum smbacl4_acedup_enum
)lp_parm_enum(
363 SNUM(fsp
->conn
), type_name
,
364 "acedup", enum_smbacl4_acedups
, e_dontcare
);
366 DEBUG(10, ("mode:%s, do_chown:%s, acedup: %s\n",
367 enum_smbacl4_modes
[params
->mode
].name
,
368 params
->do_chown
? "true" : "false",
369 enum_smbacl4_acedups
[params
->acedup
].name
));
374 static void smbacl4_dump_nfs4acl(int level
, SMB4ACL_T
*acl
)
376 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
377 SMB_ACE4_INT_T
*aceint
;
379 DEBUG(level
, ("NFS4ACL: size=%d\n", aclint
->naces
));
381 for(aceint
= aclint
->first
; aceint
!=NULL
; aceint
=(SMB_ACE4_INT_T
*)aceint
->next
) {
382 SMB_ACE4PROP_T
*ace
= &aceint
->prop
;
384 DEBUG(level
, ("\tACE: type=%d, flags=0x%x, fflags=0x%x, mask=0x%x, id=%d\n",
386 ace
->aceFlags
, ace
->flags
,
393 * Find 2 NFS4 who-special ACE property (non-copy!!!)
394 * match nonzero if "special" and who is equal
395 * return ace if found matching; otherwise NULL
397 static SMB_ACE4PROP_T
*smbacl4_find_equal_special(
399 SMB_ACE4PROP_T
*aceNew
)
401 SMB_ACL4_INT_T
*aclint
= get_validated_aclint(acl
);
402 SMB_ACE4_INT_T
*aceint
;
404 for(aceint
= aclint
->first
; aceint
!=NULL
; aceint
=(SMB_ACE4_INT_T
*)aceint
->next
) {
405 SMB_ACE4PROP_T
*ace
= &aceint
->prop
;
407 if (ace
->flags
== aceNew
->flags
&&
408 ace
->aceType
==aceNew
->aceType
&&
409 (ace
->aceFlags
&SMB_ACE4_IDENTIFIER_GROUP
)==
410 (aceNew
->aceFlags
&SMB_ACE4_IDENTIFIER_GROUP
)
412 /* keep type safety; e.g. gid is an u.short */
413 if (ace
->flags
& SMB_ACE4_ID_SPECIAL
)
415 if (ace
->who
.special_id
==aceNew
->who
.special_id
)
418 if (ace
->aceFlags
& SMB_ACE4_IDENTIFIER_GROUP
)
420 if (ace
->who
.gid
==aceNew
->who
.gid
)
423 if (ace
->who
.uid
==aceNew
->who
.uid
)
433 static int smbacl4_fill_ace4(
435 smbacl4_vfs_params
*params
,
438 SEC_ACE
*ace_nt
, /* input */
439 SMB_ACE4PROP_T
*ace_v4
/* output */
442 const char *dom
, *name
;
443 enum lsa_SidType type
;
447 DEBUG(10, ("got ace for %s\n",
448 sid_string_static(&ace_nt
->trustee
)));
450 memset(ace_v4
, 0, sizeof(SMB_ACE4PROP_T
));
451 ace_v4
->aceType
= ace_nt
->type
; /* only ACCES|DENY supported right now */
452 ace_v4
->aceFlags
= ace_nt
->flags
& SEC_ACE_FLAG_VALID_INHERIT
;
453 ace_v4
->aceMask
= ace_nt
->access_mask
&
454 (STD_RIGHT_ALL_ACCESS
| SA_RIGHT_FILE_ALL_ACCESS
);
456 if (ace_v4
->aceFlags
!=ace_nt
->flags
)
457 DEBUG(9, ("ace_v4->aceFlags(0x%x)!=ace_nt->flags(0x%x)\n",
458 ace_v4
->aceFlags
, ace_nt
->flags
));
460 if (ace_v4
->aceMask
!=ace_nt
->access_mask
)
461 DEBUG(9, ("ace_v4->aceMask(0x%x)!=ace_nt->access_mask(0x%x)\n",
462 ace_v4
->aceMask
, ace_nt
->access_mask
));
464 if (sid_equal(&ace_nt
->trustee
, &global_sid_World
)) {
465 ace_v4
->who
.special_id
= SMB_ACE4_WHO_EVERYONE
;
466 ace_v4
->flags
|= SMB_ACE4_ID_SPECIAL
;
468 if (!lookup_sid(mem_ctx
, &ace_nt
->trustee
, &dom
, &name
, &type
)) {
469 DEBUG(8, ("Could not find %s' type\n",
470 sid_string_static(&ace_nt
->trustee
)));
475 if (type
== SID_NAME_USER
) {
476 if (!sid_to_uid(&ace_nt
->trustee
, &uid
)) {
477 DEBUG(2, ("Could not convert %s to uid\n",
478 sid_string_static(&ace_nt
->trustee
)));
482 if (params
->mode
==e_special
&& uid
==ownerUID
) {
483 ace_v4
->flags
|= SMB_ACE4_ID_SPECIAL
;
484 ace_v4
->who
.special_id
= SMB_ACE4_WHO_OWNER
;
486 ace_v4
->who
.uid
= uid
;
488 } else { /* else group? - TODO check it... */
489 if (!sid_to_gid(&ace_nt
->trustee
, &gid
)) {
490 DEBUG(2, ("Could not convert %s to gid\n",
491 sid_string_static(&ace_nt
->trustee
)));
494 ace_v4
->aceFlags
|= SMB_ACE4_IDENTIFIER_GROUP
;
496 if (params
->mode
==e_special
&& gid
==ownerGID
) {
497 ace_v4
->flags
|= SMB_ACE4_ID_SPECIAL
;
498 ace_v4
->who
.special_id
= SMB_ACE4_WHO_GROUP
;
500 ace_v4
->who
.gid
= gid
;
508 static int smbacl4_MergeIgnoreReject(
509 enum smbacl4_acedup_enum acedup
,
510 SMB4ACL_T
*acl
, /* may modify it */
511 SMB_ACE4PROP_T
*ace
, /* the "new" ACE */
517 SMB_ACE4PROP_T
*ace4found
= smbacl4_find_equal_special(acl
, ace
);
522 case e_merge
: /* "merge" flags */
524 ace4found
->aceFlags
|= ace
->aceFlags
;
525 ace4found
->aceMask
|= ace
->aceMask
;
527 case e_ignore
: /* leave out this record */
530 case e_reject
: /* do an error */
531 DEBUG(8, ("ACL rejected by duplicate nt ace#%d\n", i
));
532 errno
= EINVAL
; /* SHOULD be set on any _real_ error */
542 static SMB4ACL_T
*smbacl4_win2nfs4(
544 smbacl4_vfs_params
*pparams
,
551 TALLOC_CTX
*mem_ctx
= main_loop_talloc_get();
553 DEBUG(10, ("smbacl4_win2nfs4 invoked\n"));
555 acl
= smb_create_smb4acl();
559 for(i
=0; i
<dacl
->num_aces
; i
++) {
560 SMB_ACE4PROP_T ace_v4
;
561 BOOL addNewACE
= True
;
563 if (smbacl4_fill_ace4(mem_ctx
, pparams
, ownerUID
, ownerGID
,
564 dacl
->aces
+ i
, &ace_v4
))
567 if (pparams
->acedup
!=e_dontcare
) {
568 if (smbacl4_MergeIgnoreReject(pparams
->acedup
, acl
,
569 &ace_v4
, &addNewACE
, i
))
574 smb_add_ace4(acl
, &ace_v4
);
580 BOOL
smb_set_nt_acl_nfs4(files_struct
*fsp
,
581 uint32 security_info_sent
,
583 set_nfs4acl_native_fn_t set_nfs4_native
)
585 smbacl4_vfs_params params
;
586 SMB4ACL_T
*acl
= NULL
;
589 SMB_STRUCT_STAT sbuf
;
590 BOOL need_chown
= False
;
591 uid_t newUID
= (uid_t
)-1;
592 gid_t newGID
= (gid_t
)-1;
594 DEBUG(10, ("smb_set_nt_acl_nfs4 invoked for %s\n", fsp
->fsp_name
));
596 if ((security_info_sent
& (DACL_SECURITY_INFORMATION
|
597 GROUP_SECURITY_INFORMATION
| OWNER_SECURITY_INFORMATION
)) == 0)
599 DEBUG(9, ("security_info_sent (0x%x) ignored\n",
600 security_info_sent
));
601 return True
; /* won't show error - later to be refined... */
604 /* Special behaviours */
605 if (smbacl4_get_vfs_params(SMBACL4_PARAM_TYPE_NAME
, fsp
, ¶ms
))
608 if (smbacl4_GetFileOwner(fsp
, &sbuf
))
611 if (params
.do_chown
) {
612 /* chown logic is a copy/paste from posix_acl.c:set_nt_acl */
613 if (!unpack_nt_owners(SNUM(fsp
->conn
), &newUID
, &newGID
, security_info_sent
, psd
))
615 DEBUG(8, ("unpack_nt_owners failed"));
618 if (((newUID
!= (uid_t
)-1) && (sbuf
.st_uid
!= newUID
)) ||
619 ((newGID
!= (gid_t
)-1) && (sbuf
.st_gid
!= newGID
))) {
623 if ((newUID
== (uid_t
)-1 || newUID
== current_user
.ut
.uid
)) {
624 if(try_chown(fsp
->conn
, fsp
->fsp_name
, newUID
, newGID
)) {
625 DEBUG(3,("chown %s, %u, %u failed. Error = %s.\n",
626 fsp
->fsp_name
, (unsigned int)newUID
, (unsigned int)newGID
, strerror(errno
) ));
629 DEBUG(10,("chown %s, %u, %u succeeded.\n",
630 fsp
->fsp_name
, (unsigned int)newUID
, (unsigned int)newGID
));
631 if (smbacl4_GetFileOwner(fsp
, &sbuf
))
634 } else { /* chown is needed, but _after_ changing acl */
635 sbuf
.st_uid
= newUID
; /* OWNER@ in case of e_special */
636 sbuf
.st_gid
= newGID
; /* GROUP@ in case of e_special */
641 if ((security_info_sent
& DACL_SECURITY_INFORMATION
)!=0 && psd
->dacl
!=NULL
)
643 acl
= smbacl4_win2nfs4(psd
->dacl
, ¶ms
, sbuf
.st_uid
, sbuf
.st_gid
);
647 smbacl4_dump_nfs4acl(10, acl
);
649 result
= set_nfs4_native(fsp
, acl
);
652 DEBUG(10, ("set_nfs4_native failed with %s\n", strerror(errno
)));
656 DEBUG(10, ("no dacl found; security_info_sent = 0x%x\n", security_info_sent
));
658 /* Any chown pending? */
660 DEBUG(3,("chown#2 %s. uid = %u, gid = %u.\n",
661 fsp
->fsp_name
, (unsigned int)newUID
, (unsigned int)newGID
));
662 if (try_chown(fsp
->conn
, fsp
->fsp_name
, newUID
, newGID
)) {
663 DEBUG(2,("chown#2 %s, %u, %u failed. Error = %s.\n",
664 fsp
->fsp_name
, (unsigned int)newUID
, (unsigned int)newGID
,
668 DEBUG(10,("chown#2 %s, %u, %u succeeded.\n",
669 fsp
->fsp_name
, (unsigned int)newUID
, (unsigned int)newGID
));
672 DEBUG(10, ("smb_set_nt_acl_nfs4 succeeded\n"));