2 * Fake ACLs VFS module. Implements passthrough operation of all VFS
3 * calls to disk functions, except for file ownership and ACLs, which
4 * are stored in xattrs.
6 * Copyright (C) Tim Potter, 1999-2000
7 * Copyright (C) Alexander Bokovoy, 2002
8 * Copyright (C) Andrew Bartlett, 2002,2012
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 3 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, see <http://www.gnu.org/licenses/>.
25 #include "smbd/smbd.h"
26 #include "system/filesys.h"
28 #include "librpc/gen_ndr/ndr_smb_acl.h"
31 #define DBGC_CLASS DBGC_VFS
33 #define FAKE_UID "system.fake_uid"
34 #define FAKE_GID "system.fake_gid"
35 #define FAKE_ACL_ACCESS_XATTR "system.fake_access_acl"
36 #define FAKE_ACL_DEFAULT_XATTR "system.fake_default_acl"
38 static int fake_acls_uid(vfs_handle_struct *handle,
44 size = SMB_VFS_NEXT_GETXATTR(handle, path, FAKE_UID, uid_buf, sizeof(uid_buf));
45 if (size == -1 && errno == ENOATTR) {
51 *uid = IVAL(uid_buf, 0);
55 static int fake_acls_gid(vfs_handle_struct *handle,
62 size = SMB_VFS_NEXT_GETXATTR(handle, path, FAKE_GID, gid_buf, sizeof(gid_buf));
63 if (size == -1 && errno == ENOATTR) {
69 *gid = IVAL(gid_buf, 0);
73 static int fake_acls_fuid(vfs_handle_struct *handle,
80 size = SMB_VFS_NEXT_FGETXATTR(handle, fsp, FAKE_UID, uid_buf, sizeof(uid_buf));
81 if (size == -1 && errno == ENOATTR) {
87 *uid = IVAL(uid_buf, 0);
91 static int fake_acls_fgid(vfs_handle_struct *handle,
98 size = SMB_VFS_NEXT_FGETXATTR(handle, fsp, FAKE_GID, gid_buf, sizeof(gid_buf));
99 if (size == -1 && errno == ENOATTR) {
105 *gid = IVAL(gid_buf, 0);
109 static int fake_acls_stat(vfs_handle_struct *handle,
110 struct smb_filename *smb_fname)
114 ret = SMB_VFS_NEXT_STAT(handle, smb_fname);
116 TALLOC_CTX *frame = talloc_stackframe();
118 struct smb_filename smb_fname_base = {
119 .base_name = smb_fname->base_name
123 * As we're calling getxattr directly here
124 * we need to use only the base_name, not
125 * the full name containing any stream name.
127 status = get_full_smb_filename(frame, &smb_fname_base, &path);
128 if (!NT_STATUS_IS_OK(status)) {
129 errno = map_errno_from_nt_status(status);
134 ret = fake_acls_uid(handle, path, &smb_fname->st.st_ex_uid);
139 ret = fake_acls_gid(handle, path, &smb_fname->st.st_ex_gid);
150 static int fake_acls_lstat(vfs_handle_struct *handle,
151 struct smb_filename *smb_fname)
155 ret = SMB_VFS_NEXT_LSTAT(handle, smb_fname);
157 TALLOC_CTX *frame = talloc_stackframe();
159 struct smb_filename smb_fname_base = {
160 .base_name = smb_fname->base_name
164 * As we're calling getxattr directly here
165 * we need to use only the base_name, not
166 * the full name containing any stream name.
168 status = get_full_smb_filename(frame, &smb_fname_base, &path);
169 if (!NT_STATUS_IS_OK(status)) {
170 errno = map_errno_from_nt_status(status);
175 /* This isn't quite right (calling getxattr not
176 * lgetxattr), but for the test purposes of this
177 * module (fake NT ACLs from windows clients), it is
178 * close enough. We removed the l*xattr functions
179 * because linux doesn't support using them, but we
180 * could fake them in xattr_tdb if we really wanted
181 * to. We ignore errors because the link might not point anywhere */
182 fake_acls_uid(handle, path, &smb_fname->st.st_ex_uid);
183 fake_acls_gid(handle, path, &smb_fname->st.st_ex_gid);
190 static int fake_acls_fstat(vfs_handle_struct *handle, files_struct *fsp, SMB_STRUCT_STAT *sbuf)
194 ret = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
196 ret = fake_acls_fuid(handle, fsp, &sbuf->st_ex_uid);
200 ret = fake_acls_fgid(handle, fsp, &sbuf->st_ex_gid);
208 static SMB_ACL_T fake_acls_blob2acl(DATA_BLOB *blob, TALLOC_CTX *mem_ctx)
210 enum ndr_err_code ndr_err;
211 struct smb_acl_t *acl = talloc(mem_ctx, struct smb_acl_t);
217 ndr_err = ndr_pull_struct_blob(blob, acl, acl,
218 (ndr_pull_flags_fn_t)ndr_pull_smb_acl_t);
220 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
221 DEBUG(0, ("ndr_pull_acl_t failed: %s\n",
222 ndr_errstr(ndr_err)));
229 static DATA_BLOB fake_acls_acl2blob(TALLOC_CTX *mem_ctx, SMB_ACL_T acl)
231 enum ndr_err_code ndr_err;
233 ndr_err = ndr_push_struct_blob(&blob, mem_ctx, acl,
234 (ndr_push_flags_fn_t)ndr_push_smb_acl_t);
236 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
237 DEBUG(0, ("ndr_push_acl_t failed: %s\n",
238 ndr_errstr(ndr_err)));
239 return data_blob_null;
244 static SMB_ACL_T fake_acls_sys_acl_get_file(struct vfs_handle_struct *handle,
245 const struct smb_filename *smb_fname,
249 DATA_BLOB blob = data_blob_null;
251 const char *name = NULL;
252 struct smb_acl_t *acl = NULL;
253 const char *path = smb_fname->base_name;
254 TALLOC_CTX *frame = talloc_stackframe();
256 case SMB_ACL_TYPE_ACCESS:
257 name = FAKE_ACL_ACCESS_XATTR;
259 case SMB_ACL_TYPE_DEFAULT:
260 name = FAKE_ACL_DEFAULT_XATTR;
266 blob.data = talloc_realloc(frame, blob.data, uint8_t, blob.length);
272 length = SMB_VFS_NEXT_GETXATTR(handle, path, name, blob.data, blob.length);
273 blob.length = length;
274 } while (length == -1 && errno == ERANGE);
275 if (length == -1 && errno == ENOATTR) {
280 acl = fake_acls_blob2acl(&blob, mem_ctx);
286 static SMB_ACL_T fake_acls_sys_acl_get_fd(struct vfs_handle_struct *handle,
290 DATA_BLOB blob = data_blob_null;
292 const char *name = FAKE_ACL_ACCESS_XATTR;
293 struct smb_acl_t *acl = NULL;
294 TALLOC_CTX *frame = talloc_stackframe();
298 blob.data = talloc_realloc(frame, blob.data, uint8_t, blob.length);
304 length = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, blob.data, blob.length);
305 blob.length = length;
306 } while (length == -1 && errno == ERANGE);
307 if (length == -1 && errno == ENOATTR) {
312 acl = fake_acls_blob2acl(&blob, mem_ctx);
319 static int fake_acls_sys_acl_set_file(vfs_handle_struct *handle,
320 const struct smb_filename *smb_fname,
321 SMB_ACL_TYPE_T acltype,
325 const char *name = NULL;
326 TALLOC_CTX *frame = talloc_stackframe();
327 DATA_BLOB blob = fake_acls_acl2blob(frame, theacl);
329 DEBUG(0, ("Failed to convert ACL to linear blob for xattr storage\n"));
335 case SMB_ACL_TYPE_ACCESS:
336 name = FAKE_ACL_ACCESS_XATTR;
338 case SMB_ACL_TYPE_DEFAULT:
339 name = FAKE_ACL_DEFAULT_XATTR;
342 ret = SMB_VFS_NEXT_SETXATTR(handle, smb_fname->base_name,
343 name, blob.data, blob.length, 0);
348 static int fake_acls_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp, SMB_ACL_T theacl)
351 const char *name = FAKE_ACL_ACCESS_XATTR;
352 TALLOC_CTX *frame = talloc_stackframe();
353 DATA_BLOB blob = fake_acls_acl2blob(frame, theacl);
355 DEBUG(0, ("Failed to convert ACL to linear blob for xattr storage\n"));
360 ret = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, blob.data, blob.length, 0);
365 static int fake_acls_sys_acl_delete_def_file(vfs_handle_struct *handle,
366 const struct smb_filename *smb_fname_in)
369 const char *name = FAKE_ACL_DEFAULT_XATTR;
370 TALLOC_CTX *frame = talloc_stackframe();
371 struct smb_filename *smb_fname = cp_smb_filename_nostream(talloc_tos(),
374 if (smb_fname == NULL) {
380 ret = SMB_VFS_NEXT_STAT(handle, smb_fname);
386 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
392 ret = SMB_VFS_NEXT_REMOVEXATTR(handle, smb_fname, name);
393 if (ret == -1 && errno == ENOATTR) {
402 static int fake_acls_chown(vfs_handle_struct *handle,
403 const struct smb_filename *smb_fname,
410 SIVAL(id_buf, 0, uid);
411 ret = SMB_VFS_NEXT_SETXATTR(handle,
412 smb_fname->base_name,
422 SIVAL(id_buf, 0, gid);
423 ret = SMB_VFS_NEXT_SETXATTR(handle,
424 smb_fname->base_name,
436 static int fake_acls_lchown(vfs_handle_struct *handle,
437 const struct smb_filename *smb_fname,
444 /* This isn't quite right (calling setxattr not
445 * lsetxattr), but for the test purposes of this
446 * module (fake NT ACLs from windows clients), it is
447 * close enough. We removed the l*xattr functions
448 * because linux doesn't support using them, but we
449 * could fake them in xattr_tdb if we really wanted
452 SIVAL(id_buf, 0, uid);
453 ret = SMB_VFS_NEXT_SETXATTR(handle,
454 smb_fname->base_name,
464 SIVAL(id_buf, 0, gid);
465 ret = SMB_VFS_NEXT_SETXATTR(handle,
466 smb_fname->base_name,
478 static int fake_acls_fchown(vfs_handle_struct *handle, files_struct *fsp, uid_t uid, gid_t gid)
483 SIVAL(id_buf, 0, uid);
484 ret = SMB_VFS_NEXT_FSETXATTR(handle, fsp, FAKE_UID, id_buf, sizeof(id_buf), 0);
490 SIVAL(id_buf, 0, gid);
491 ret = SMB_VFS_NEXT_FSETXATTR(handle, fsp, FAKE_GID, id_buf, sizeof(id_buf), 0);
500 static struct vfs_fn_pointers vfs_fake_acls_fns = {
501 .stat_fn = fake_acls_stat,
502 .lstat_fn = fake_acls_lstat,
503 .fstat_fn = fake_acls_fstat,
504 .sys_acl_get_file_fn = fake_acls_sys_acl_get_file,
505 .sys_acl_get_fd_fn = fake_acls_sys_acl_get_fd,
506 .sys_acl_blob_get_file_fn = posix_sys_acl_blob_get_file,
507 .sys_acl_blob_get_fd_fn = posix_sys_acl_blob_get_fd,
508 .sys_acl_set_file_fn = fake_acls_sys_acl_set_file,
509 .sys_acl_set_fd_fn = fake_acls_sys_acl_set_fd,
510 .sys_acl_delete_def_file_fn = fake_acls_sys_acl_delete_def_file,
511 .chown_fn = fake_acls_chown,
512 .lchown_fn = fake_acls_lchown,
513 .fchown_fn = fake_acls_fchown,
517 NTSTATUS vfs_fake_acls_init(TALLOC_CTX *);
518 NTSTATUS vfs_fake_acls_init(TALLOC_CTX *ctx)
520 return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "fake_acls",