2 Unix SMB/CIFS implementation.
3 SMB NT Security Descriptor / Unix permission conversion.
4 Copyright (C) Jeremy Allison 1994-2009.
5 Copyright (C) Andreas Gruenbacher 2002.
6 Copyright (C) Simo Sorce <idra@samba.org> 2009.
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/smbd.h"
24 #include "system/filesys.h"
25 #include "../libcli/security/security.h"
27 #include "passdb/lookup_sid.h"
30 extern const struct generic_mapping file_generic_mapping;
33 #define DBGC_CLASS DBGC_ACLS
35 /****************************************************************************
36 Data structures representing the internal ACE format.
37 ****************************************************************************/
39 enum ace_owner {UID_ACE, GID_ACE, WORLD_ACE};
40 enum ace_attribute {ALLOW_ACE, DENY_ACE}; /* Used for incoming NT ACLS. */
42 typedef union posix_id {
48 typedef struct canon_ace {
49 struct canon_ace *next, *prev;
51 mode_t perms; /* Only use S_I(R|W|X)USR mode bits here. */
52 struct dom_sid trustee;
53 enum ace_owner owner_type;
54 enum ace_attribute attr;
56 uint8_t ace_flags; /* From windows ACE entry. */
59 #define ALL_ACE_PERMS (S_IRUSR|S_IWUSR|S_IXUSR)
62 * EA format of user.SAMBA_PAI (Samba_Posix_Acl_Interitance)
63 * attribute on disk - version 1.
64 * All values are little endian.
66 * | 1 | 1 | 2 | 2 | ....
67 * +------+------+-------------+---------------------+-------------+--------------------+
68 * | vers | flag | num_entries | num_default_entries | ..entries.. | default_entries... |
69 * +------+------+-------------+---------------------+-------------+--------------------+
74 * +------+-------------------+
75 * | value| uid/gid or world |
77 * +------+-------------------+
79 * Version 2 format. Stores extra Windows metadata about an ACL.
81 * | 1 | 2 | 2 | 2 | ....
82 * +------+----------+-------------+---------------------+-------------+--------------------+
83 * | vers | ace | num_entries | num_default_entries | ..entries.. | default_entries... |
84 * | 2 | type | | | | |
85 * +------+----------+-------------+---------------------+-------------+--------------------+
90 * +------+------+-------------------+
91 * | ace | value| uid/gid or world |
92 * | flag | type | value |
93 * +------+-------------------+------+
97 #define PAI_VERSION_OFFSET 0
99 #define PAI_V1_FLAG_OFFSET 1
100 #define PAI_V1_NUM_ENTRIES_OFFSET 2
101 #define PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET 4
102 #define PAI_V1_ENTRIES_BASE 6
103 #define PAI_V1_ACL_FLAG_PROTECTED 0x1
104 #define PAI_V1_ENTRY_LENGTH 5
106 #define PAI_V1_VERSION 1
108 #define PAI_V2_TYPE_OFFSET 1
109 #define PAI_V2_NUM_ENTRIES_OFFSET 3
110 #define PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET 5
111 #define PAI_V2_ENTRIES_BASE 7
112 #define PAI_V2_ENTRY_LENGTH 6
114 #define PAI_V2_VERSION 2
117 * In memory format of user.SAMBA_PAI attribute.
121 struct pai_entry *next, *prev;
123 enum ace_owner owner_type;
129 unsigned int num_entries;
130 struct pai_entry *entry_list;
131 unsigned int num_def_entries;
132 struct pai_entry *def_entry_list;
135 /************************************************************************
136 Return a uint32 of the pai_entry principal.
137 ************************************************************************/
139 static uint32_t get_pai_entry_val(struct pai_entry *paie)
141 switch (paie->owner_type) {
143 DEBUG(10,("get_pai_entry_val: uid = %u\n", (unsigned int)paie->unix_ug.uid ));
144 return (uint32_t)paie->unix_ug.uid;
146 DEBUG(10,("get_pai_entry_val: gid = %u\n", (unsigned int)paie->unix_ug.gid ));
147 return (uint32_t)paie->unix_ug.gid;
150 DEBUG(10,("get_pai_entry_val: world ace\n"));
155 /************************************************************************
156 Return a uint32 of the entry principal.
157 ************************************************************************/
159 static uint32_t get_entry_val(canon_ace *ace_entry)
161 switch (ace_entry->owner_type) {
163 DEBUG(10,("get_entry_val: uid = %u\n", (unsigned int)ace_entry->unix_ug.uid ));
164 return (uint32_t)ace_entry->unix_ug.uid;
166 DEBUG(10,("get_entry_val: gid = %u\n", (unsigned int)ace_entry->unix_ug.gid ));
167 return (uint32_t)ace_entry->unix_ug.gid;
170 DEBUG(10,("get_entry_val: world ace\n"));
175 /************************************************************************
176 Create the on-disk format (always v2 now). Caller must free.
177 ************************************************************************/
179 static char *create_pai_buf_v2(canon_ace *file_ace_list,
180 canon_ace *dir_ace_list,
184 char *pai_buf = NULL;
185 canon_ace *ace_list = NULL;
186 char *entry_offset = NULL;
187 unsigned int num_entries = 0;
188 unsigned int num_def_entries = 0;
191 for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next) {
195 for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next) {
199 DEBUG(10,("create_pai_buf_v2: num_entries = %u, num_def_entries = %u\n", num_entries, num_def_entries ));
201 *store_size = PAI_V2_ENTRIES_BASE +
202 ((num_entries + num_def_entries)*PAI_V2_ENTRY_LENGTH);
204 pai_buf = (char *)SMB_MALLOC(*store_size);
209 /* Set up the header. */
210 memset(pai_buf, '\0', PAI_V2_ENTRIES_BASE);
211 SCVAL(pai_buf,PAI_VERSION_OFFSET,PAI_V2_VERSION);
212 SSVAL(pai_buf,PAI_V2_TYPE_OFFSET, sd_type);
213 SSVAL(pai_buf,PAI_V2_NUM_ENTRIES_OFFSET,num_entries);
214 SSVAL(pai_buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET,num_def_entries);
216 DEBUG(10,("create_pai_buf_v2: sd_type = 0x%x\n",
217 (unsigned int)sd_type ));
219 entry_offset = pai_buf + PAI_V2_ENTRIES_BASE;
222 for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next) {
223 uint8_t type_val = (uint8_t)ace_list->owner_type;
224 uint32_t entry_val = get_entry_val(ace_list);
226 SCVAL(entry_offset,0,ace_list->ace_flags);
227 SCVAL(entry_offset,1,type_val);
228 SIVAL(entry_offset,2,entry_val);
229 DEBUG(10,("create_pai_buf_v2: entry %u [0x%x] [0x%x] [0x%x]\n",
231 (unsigned int)ace_list->ace_flags,
232 (unsigned int)type_val,
233 (unsigned int)entry_val ));
235 entry_offset += PAI_V2_ENTRY_LENGTH;
238 for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next) {
239 uint8_t type_val = (uint8_t)ace_list->owner_type;
240 uint32_t entry_val = get_entry_val(ace_list);
242 SCVAL(entry_offset,0,ace_list->ace_flags);
243 SCVAL(entry_offset,1,type_val);
244 SIVAL(entry_offset,2,entry_val);
245 DEBUG(10,("create_pai_buf_v2: entry %u [0x%x] [0x%x] [0x%x]\n",
247 (unsigned int)ace_list->ace_flags,
248 (unsigned int)type_val,
249 (unsigned int)entry_val ));
251 entry_offset += PAI_V2_ENTRY_LENGTH;
257 /************************************************************************
258 Store the user.SAMBA_PAI attribute on disk.
259 ************************************************************************/
261 static void store_inheritance_attributes(files_struct *fsp,
262 canon_ace *file_ace_list,
263 canon_ace *dir_ace_list,
270 if (!lp_map_acl_inherit(SNUM(fsp->conn))) {
274 pai_buf = create_pai_buf_v2(file_ace_list, dir_ace_list,
275 sd_type, &store_size);
277 if (fsp->fh->fd != -1) {
278 ret = SMB_VFS_FSETXATTR(fsp, SAMBA_POSIX_INHERITANCE_EA_NAME,
279 pai_buf, store_size, 0);
281 ret = SMB_VFS_SETXATTR(fsp->conn, fsp->fsp_name->base_name,
282 SAMBA_POSIX_INHERITANCE_EA_NAME,
283 pai_buf, store_size, 0);
288 DEBUG(10,("store_inheritance_attribute: type 0x%x for file %s\n",
289 (unsigned int)sd_type,
292 if (ret == -1 && !no_acl_syscall_error(errno)) {
293 DEBUG(1,("store_inheritance_attribute: Error %s\n", strerror(errno) ));
297 /************************************************************************
298 Delete the in memory inheritance info.
299 ************************************************************************/
301 static void free_inherited_info(struct pai_val *pal)
304 struct pai_entry *paie, *paie_next;
305 for (paie = pal->entry_list; paie; paie = paie_next) {
306 paie_next = paie->next;
309 for (paie = pal->def_entry_list; paie; paie = paie_next) {
310 paie_next = paie->next;
317 /************************************************************************
318 Get any stored ACE flags.
319 ************************************************************************/
321 static uint16_t get_pai_flags(struct pai_val *pal, canon_ace *ace_entry, bool default_ace)
323 struct pai_entry *paie;
329 /* If the entry exists it is inherited. */
330 for (paie = (default_ace ? pal->def_entry_list : pal->entry_list); paie; paie = paie->next) {
331 if (ace_entry->owner_type == paie->owner_type &&
332 get_entry_val(ace_entry) == get_pai_entry_val(paie))
333 return paie->ace_flags;
338 /************************************************************************
339 Ensure an attribute just read is valid - v1.
340 ************************************************************************/
342 static bool check_pai_ok_v1(const char *pai_buf, size_t pai_buf_data_size)
345 uint16 num_def_entries;
347 if (pai_buf_data_size < PAI_V1_ENTRIES_BASE) {
348 /* Corrupted - too small. */
352 if (CVAL(pai_buf,PAI_VERSION_OFFSET) != PAI_V1_VERSION) {
356 num_entries = SVAL(pai_buf,PAI_V1_NUM_ENTRIES_OFFSET);
357 num_def_entries = SVAL(pai_buf,PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET);
359 /* Check the entry lists match. */
360 /* Each entry is 5 bytes (type plus 4 bytes of uid or gid). */
362 if (((num_entries + num_def_entries)*PAI_V1_ENTRY_LENGTH) +
363 PAI_V1_ENTRIES_BASE != pai_buf_data_size) {
370 /************************************************************************
371 Ensure an attribute just read is valid - v2.
372 ************************************************************************/
374 static bool check_pai_ok_v2(const char *pai_buf, size_t pai_buf_data_size)
377 uint16 num_def_entries;
379 if (pai_buf_data_size < PAI_V2_ENTRIES_BASE) {
380 /* Corrupted - too small. */
384 if (CVAL(pai_buf,PAI_VERSION_OFFSET) != PAI_V2_VERSION) {
388 num_entries = SVAL(pai_buf,PAI_V2_NUM_ENTRIES_OFFSET);
389 num_def_entries = SVAL(pai_buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET);
391 /* Check the entry lists match. */
392 /* Each entry is 6 bytes (flags + type + 4 bytes of uid or gid). */
394 if (((num_entries + num_def_entries)*PAI_V2_ENTRY_LENGTH) +
395 PAI_V2_ENTRIES_BASE != pai_buf_data_size) {
402 /************************************************************************
404 ************************************************************************/
406 static bool get_pai_owner_type(struct pai_entry *paie, const char *entry_offset)
408 paie->owner_type = (enum ace_owner)CVAL(entry_offset,0);
409 switch( paie->owner_type) {
411 paie->unix_ug.uid = (uid_t)IVAL(entry_offset,1);
412 DEBUG(10,("get_pai_owner_type: uid = %u\n",
413 (unsigned int)paie->unix_ug.uid ));
416 paie->unix_ug.gid = (gid_t)IVAL(entry_offset,1);
417 DEBUG(10,("get_pai_owner_type: gid = %u\n",
418 (unsigned int)paie->unix_ug.gid ));
421 paie->unix_ug.world = -1;
422 DEBUG(10,("get_pai_owner_type: world ace\n"));
425 DEBUG(10,("get_pai_owner_type: unknown type %u\n",
426 (unsigned int)paie->owner_type ));
432 /************************************************************************
434 ************************************************************************/
436 static const char *create_pai_v1_entries(struct pai_val *paiv,
437 const char *entry_offset,
442 for (i = 0; i < paiv->num_entries; i++) {
443 struct pai_entry *paie = SMB_MALLOC_P(struct pai_entry);
448 paie->ace_flags = SEC_ACE_FLAG_INHERITED_ACE;
449 if (!get_pai_owner_type(paie, entry_offset)) {
455 DLIST_ADD(paiv->entry_list, paie);
457 DLIST_ADD(paiv->def_entry_list, paie);
459 entry_offset += PAI_V1_ENTRY_LENGTH;
464 /************************************************************************
465 Convert to in-memory format from version 1.
466 ************************************************************************/
468 static struct pai_val *create_pai_val_v1(const char *buf, size_t size)
470 const char *entry_offset;
471 struct pai_val *paiv = NULL;
473 if (!check_pai_ok_v1(buf, size)) {
477 paiv = SMB_MALLOC_P(struct pai_val);
482 memset(paiv, '\0', sizeof(struct pai_val));
484 paiv->sd_type = (CVAL(buf,PAI_V1_FLAG_OFFSET) == PAI_V1_ACL_FLAG_PROTECTED) ?
485 SEC_DESC_DACL_PROTECTED : 0;
487 paiv->num_entries = SVAL(buf,PAI_V1_NUM_ENTRIES_OFFSET);
488 paiv->num_def_entries = SVAL(buf,PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET);
490 entry_offset = buf + PAI_V1_ENTRIES_BASE;
492 DEBUG(10,("create_pai_val: num_entries = %u, num_def_entries = %u\n",
493 paiv->num_entries, paiv->num_def_entries ));
495 entry_offset = create_pai_v1_entries(paiv, entry_offset, false);
496 if (entry_offset == NULL) {
497 free_inherited_info(paiv);
500 entry_offset = create_pai_v1_entries(paiv, entry_offset, true);
501 if (entry_offset == NULL) {
502 free_inherited_info(paiv);
509 /************************************************************************
511 ************************************************************************/
513 static const char *create_pai_v2_entries(struct pai_val *paiv,
514 unsigned int num_entries,
515 const char *entry_offset,
520 for (i = 0; i < num_entries; i++) {
521 struct pai_entry *paie = SMB_MALLOC_P(struct pai_entry);
526 paie->ace_flags = CVAL(entry_offset,0);
528 if (!get_pai_owner_type(paie, entry_offset+1)) {
533 DLIST_ADD(paiv->entry_list, paie);
535 DLIST_ADD(paiv->def_entry_list, paie);
537 entry_offset += PAI_V2_ENTRY_LENGTH;
542 /************************************************************************
543 Convert to in-memory format from version 2.
544 ************************************************************************/
546 static struct pai_val *create_pai_val_v2(const char *buf, size_t size)
548 const char *entry_offset;
549 struct pai_val *paiv = NULL;
551 if (!check_pai_ok_v2(buf, size)) {
555 paiv = SMB_MALLOC_P(struct pai_val);
560 memset(paiv, '\0', sizeof(struct pai_val));
562 paiv->sd_type = SVAL(buf,PAI_V2_TYPE_OFFSET);
564 paiv->num_entries = SVAL(buf,PAI_V2_NUM_ENTRIES_OFFSET);
565 paiv->num_def_entries = SVAL(buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET);
567 entry_offset = buf + PAI_V2_ENTRIES_BASE;
569 DEBUG(10,("create_pai_val_v2: sd_type = 0x%x num_entries = %u, num_def_entries = %u\n",
570 (unsigned int)paiv->sd_type,
571 paiv->num_entries, paiv->num_def_entries ));
573 entry_offset = create_pai_v2_entries(paiv, paiv->num_entries,
574 entry_offset, false);
575 if (entry_offset == NULL) {
576 free_inherited_info(paiv);
579 entry_offset = create_pai_v2_entries(paiv, paiv->num_def_entries,
581 if (entry_offset == NULL) {
582 free_inherited_info(paiv);
589 /************************************************************************
590 Convert to in-memory format - from either version 1 or 2.
591 ************************************************************************/
593 static struct pai_val *create_pai_val(const char *buf, size_t size)
598 if (CVAL(buf,PAI_VERSION_OFFSET) == PAI_V1_VERSION) {
599 return create_pai_val_v1(buf, size);
600 } else if (CVAL(buf,PAI_VERSION_OFFSET) == PAI_V2_VERSION) {
601 return create_pai_val_v2(buf, size);
607 /************************************************************************
608 Load the user.SAMBA_PAI attribute.
609 ************************************************************************/
611 static struct pai_val *fload_inherited_info(files_struct *fsp)
614 size_t pai_buf_size = 1024;
615 struct pai_val *paiv = NULL;
618 if (!lp_map_acl_inherit(SNUM(fsp->conn))) {
622 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL) {
627 if (fsp->fh->fd != -1) {
628 ret = SMB_VFS_FGETXATTR(fsp, SAMBA_POSIX_INHERITANCE_EA_NAME,
629 pai_buf, pai_buf_size);
631 ret = SMB_VFS_GETXATTR(fsp->conn,
632 fsp->fsp_name->base_name,
633 SAMBA_POSIX_INHERITANCE_EA_NAME,
634 pai_buf, pai_buf_size);
638 if (errno != ERANGE) {
641 /* Buffer too small - enlarge it. */
644 if (pai_buf_size > 1024*1024) {
645 return NULL; /* Limit malloc to 1mb. */
647 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL)
652 DEBUG(10,("load_inherited_info: ret = %lu for file %s\n",
653 (unsigned long)ret, fsp_str_dbg(fsp)));
656 /* No attribute or not supported. */
658 if (errno != ENOATTR)
659 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
662 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
668 paiv = create_pai_val(pai_buf, ret);
671 DEBUG(10,("load_inherited_info: ACL type is 0x%x for file %s\n",
672 (unsigned int)paiv->sd_type, fsp_str_dbg(fsp)));
679 /************************************************************************
680 Load the user.SAMBA_PAI attribute.
681 ************************************************************************/
683 static struct pai_val *load_inherited_info(const struct connection_struct *conn,
687 size_t pai_buf_size = 1024;
688 struct pai_val *paiv = NULL;
691 if (!lp_map_acl_inherit(SNUM(conn))) {
695 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL) {
700 ret = SMB_VFS_GETXATTR(conn, fname,
701 SAMBA_POSIX_INHERITANCE_EA_NAME,
702 pai_buf, pai_buf_size);
705 if (errno != ERANGE) {
708 /* Buffer too small - enlarge it. */
711 if (pai_buf_size > 1024*1024) {
712 return NULL; /* Limit malloc to 1mb. */
714 if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL)
719 DEBUG(10,("load_inherited_info: ret = %lu for file %s\n", (unsigned long)ret, fname));
722 /* No attribute or not supported. */
724 if (errno != ENOATTR)
725 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
728 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
734 paiv = create_pai_val(pai_buf, ret);
737 DEBUG(10,("load_inherited_info: ACL type 0x%x for file %s\n",
738 (unsigned int)paiv->sd_type,
746 /****************************************************************************
747 Functions to manipulate the internal ACE format.
748 ****************************************************************************/
750 /****************************************************************************
751 Count a linked list of canonical ACE entries.
752 ****************************************************************************/
754 static size_t count_canon_ace_list( canon_ace *l_head )
759 for (ace = l_head; ace; ace = ace->next)
765 /****************************************************************************
766 Free a linked list of canonical ACE entries.
767 ****************************************************************************/
769 static void free_canon_ace_list( canon_ace *l_head )
771 canon_ace *list, *next;
773 for (list = l_head; list; list = next) {
775 DLIST_REMOVE(l_head, list);
780 /****************************************************************************
781 Function to duplicate a canon_ace entry.
782 ****************************************************************************/
784 static canon_ace *dup_canon_ace( canon_ace *src_ace)
786 canon_ace *dst_ace = SMB_MALLOC_P(canon_ace);
792 dst_ace->prev = dst_ace->next = NULL;
796 /****************************************************************************
797 Print out a canon ace.
798 ****************************************************************************/
800 static void print_canon_ace(canon_ace *pace, int num)
802 dbgtext( "canon_ace index %d. Type = %s ", num, pace->attr == ALLOW_ACE ? "allow" : "deny" );
803 dbgtext( "SID = %s ", sid_string_dbg(&pace->trustee));
804 if (pace->owner_type == UID_ACE) {
805 const char *u_name = uidtoname(pace->unix_ug.uid);
806 dbgtext( "uid %u (%s) ", (unsigned int)pace->unix_ug.uid, u_name );
807 } else if (pace->owner_type == GID_ACE) {
808 char *g_name = gidtoname(pace->unix_ug.gid);
809 dbgtext( "gid %u (%s) ", (unsigned int)pace->unix_ug.gid, g_name );
812 switch (pace->type) {
814 dbgtext( "SMB_ACL_USER ");
816 case SMB_ACL_USER_OBJ:
817 dbgtext( "SMB_ACL_USER_OBJ ");
820 dbgtext( "SMB_ACL_GROUP ");
822 case SMB_ACL_GROUP_OBJ:
823 dbgtext( "SMB_ACL_GROUP_OBJ ");
826 dbgtext( "SMB_ACL_OTHER ");
833 dbgtext( "ace_flags = 0x%x ", (unsigned int)pace->ace_flags);
835 dbgtext( "%c", pace->perms & S_IRUSR ? 'r' : '-');
836 dbgtext( "%c", pace->perms & S_IWUSR ? 'w' : '-');
837 dbgtext( "%c\n", pace->perms & S_IXUSR ? 'x' : '-');
840 /****************************************************************************
841 Print out a canon ace list.
842 ****************************************************************************/
844 static void print_canon_ace_list(const char *name, canon_ace *ace_list)
848 if( DEBUGLVL( 10 )) {
849 dbgtext( "print_canon_ace_list: %s\n", name );
850 for (;ace_list; ace_list = ace_list->next, count++)
851 print_canon_ace(ace_list, count );
855 /****************************************************************************
856 Map POSIX ACL perms to canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits).
857 ****************************************************************************/
859 static mode_t convert_permset_to_mode_t(connection_struct *conn, SMB_ACL_PERMSET_T permset)
863 ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ) ? S_IRUSR : 0);
864 ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE) ? S_IWUSR : 0);
865 ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_EXECUTE) ? S_IXUSR : 0);
870 /****************************************************************************
871 Map generic UNIX permissions to canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits).
872 ****************************************************************************/
874 static mode_t unix_perms_to_acl_perms(mode_t mode, int r_mask, int w_mask, int x_mask)
888 /****************************************************************************
889 Map canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits) to
890 an SMB_ACL_PERMSET_T.
891 ****************************************************************************/
893 static int map_acl_perms_to_permset(connection_struct *conn, mode_t mode, SMB_ACL_PERMSET_T *p_permset)
895 if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn, *p_permset) == -1)
897 if (mode & S_IRUSR) {
898 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_READ) == -1)
901 if (mode & S_IWUSR) {
902 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_WRITE) == -1)
905 if (mode & S_IXUSR) {
906 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_EXECUTE) == -1)
912 /****************************************************************************
913 Function to create owner and group SIDs from a SMB_STRUCT_STAT.
914 ****************************************************************************/
916 void create_file_sids(const SMB_STRUCT_STAT *psbuf, struct dom_sid *powner_sid, struct dom_sid *pgroup_sid)
918 uid_to_sid( powner_sid, psbuf->st_ex_uid );
919 gid_to_sid( pgroup_sid, psbuf->st_ex_gid );
922 /****************************************************************************
923 Merge aces with a common sid - if both are allow or deny, OR the permissions together and
924 delete the second one. If the first is deny, mask the permissions off and delete the allow
925 if the permissions become zero, delete the deny if the permissions are non zero.
926 ****************************************************************************/
928 static void merge_aces( canon_ace **pp_list_head, bool dir_acl)
930 canon_ace *l_head = *pp_list_head;
931 canon_ace *curr_ace_outer;
932 canon_ace *curr_ace_outer_next;
935 * First, merge allow entries with identical SIDs, and deny entries
936 * with identical SIDs.
939 for (curr_ace_outer = l_head; curr_ace_outer; curr_ace_outer = curr_ace_outer_next) {
941 canon_ace *curr_ace_next;
943 curr_ace_outer_next = curr_ace_outer->next; /* Save the link in case we delete. */
945 for (curr_ace = curr_ace_outer->next; curr_ace; curr_ace = curr_ace_next) {
946 bool can_merge = false;
948 curr_ace_next = curr_ace->next; /* Save the link in case of delete. */
950 /* For file ACLs we can merge if the SIDs and ALLOW/DENY
951 * types are the same. For directory acls we must also
952 * ensure the POSIX ACL types are the same. */
955 can_merge = (dom_sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
956 (curr_ace->attr == curr_ace_outer->attr));
958 can_merge = (dom_sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
959 (curr_ace->type == curr_ace_outer->type) &&
960 (curr_ace->attr == curr_ace_outer->attr));
964 if( DEBUGLVL( 10 )) {
965 dbgtext("merge_aces: Merging ACE's\n");
966 print_canon_ace( curr_ace_outer, 0);
967 print_canon_ace( curr_ace, 0);
970 /* Merge two allow or two deny ACE's. */
972 /* Theoretically we shouldn't merge a dir ACE if
973 * one ACE has the CI flag set, and the other
974 * ACE has the OI flag set, but this is rare
975 * enough we can ignore it. */
977 curr_ace_outer->perms |= curr_ace->perms;
978 curr_ace_outer->ace_flags |= curr_ace->ace_flags;
979 DLIST_REMOVE(l_head, curr_ace);
981 curr_ace_outer_next = curr_ace_outer->next; /* We may have deleted the link. */
987 * Now go through and mask off allow permissions with deny permissions.
988 * We can delete either the allow or deny here as we know that each SID
989 * appears only once in the list.
992 for (curr_ace_outer = l_head; curr_ace_outer; curr_ace_outer = curr_ace_outer_next) {
994 canon_ace *curr_ace_next;
996 curr_ace_outer_next = curr_ace_outer->next; /* Save the link in case we delete. */
998 for (curr_ace = curr_ace_outer->next; curr_ace; curr_ace = curr_ace_next) {
1000 curr_ace_next = curr_ace->next; /* Save the link in case of delete. */
1003 * Subtract ACE's with different entries. Due to the ordering constraints
1004 * we've put on the ACL, we know the deny must be the first one.
1007 if (dom_sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
1008 (curr_ace_outer->attr == DENY_ACE) && (curr_ace->attr == ALLOW_ACE)) {
1010 if( DEBUGLVL( 10 )) {
1011 dbgtext("merge_aces: Masking ACE's\n");
1012 print_canon_ace( curr_ace_outer, 0);
1013 print_canon_ace( curr_ace, 0);
1016 curr_ace->perms &= ~curr_ace_outer->perms;
1018 if (curr_ace->perms == 0) {
1021 * The deny overrides the allow. Remove the allow.
1024 DLIST_REMOVE(l_head, curr_ace);
1025 SAFE_FREE(curr_ace);
1026 curr_ace_outer_next = curr_ace_outer->next; /* We may have deleted the link. */
1031 * Even after removing permissions, there
1032 * are still allow permissions - delete the deny.
1033 * It is safe to delete the deny here,
1034 * as we are guarenteed by the deny first
1035 * ordering that all the deny entries for
1036 * this SID have already been merged into one
1037 * before we can get to an allow ace.
1040 DLIST_REMOVE(l_head, curr_ace_outer);
1041 SAFE_FREE(curr_ace_outer);
1046 } /* end for curr_ace */
1047 } /* end for curr_ace_outer */
1049 /* We may have modified the list. */
1051 *pp_list_head = l_head;
1054 /****************************************************************************
1055 Check if we need to return NT4.x compatible ACL entries.
1056 ****************************************************************************/
1058 bool nt4_compatible_acls(void)
1060 int compat = lp_acl_compatibility();
1062 if (compat == ACL_COMPAT_AUTO) {
1063 enum remote_arch_types ra_type = get_remote_arch();
1065 /* Automatically adapt to client */
1066 return (ra_type <= RA_WINNT);
1068 return (compat == ACL_COMPAT_WINNT);
1072 /****************************************************************************
1073 Map canon_ace perms to permission bits NT.
1074 The attr element is not used here - we only process deny entries on set,
1075 not get. Deny entries are implicit on get with ace->perms = 0.
1076 ****************************************************************************/
1078 uint32_t map_canon_ace_perms(int snum,
1079 enum security_ace_type *pacl_type,
1083 uint32_t nt_mask = 0;
1085 *pacl_type = SEC_ACE_TYPE_ACCESS_ALLOWED;
1087 if (lp_acl_map_full_control(snum) && ((perms & ALL_ACE_PERMS) == ALL_ACE_PERMS)) {
1088 if (directory_ace) {
1089 nt_mask = UNIX_DIRECTORY_ACCESS_RWX;
1091 nt_mask = (UNIX_ACCESS_RWX & ~DELETE_ACCESS);
1093 } else if ((perms & ALL_ACE_PERMS) == (mode_t)0) {
1095 * Windows NT refuses to display ACEs with no permissions in them (but
1096 * they are perfectly legal with Windows 2000). If the ACE has empty
1097 * permissions we cannot use 0, so we use the otherwise unused
1098 * WRITE_OWNER permission, which we ignore when we set an ACL.
1099 * We abstract this into a #define of UNIX_ACCESS_NONE to allow this
1100 * to be changed in the future.
1103 if (nt4_compatible_acls())
1104 nt_mask = UNIX_ACCESS_NONE;
1108 if (directory_ace) {
1109 nt_mask |= ((perms & S_IRUSR) ? UNIX_DIRECTORY_ACCESS_R : 0 );
1110 nt_mask |= ((perms & S_IWUSR) ? UNIX_DIRECTORY_ACCESS_W : 0 );
1111 nt_mask |= ((perms & S_IXUSR) ? UNIX_DIRECTORY_ACCESS_X : 0 );
1113 nt_mask |= ((perms & S_IRUSR) ? UNIX_ACCESS_R : 0 );
1114 nt_mask |= ((perms & S_IWUSR) ? UNIX_ACCESS_W : 0 );
1115 nt_mask |= ((perms & S_IXUSR) ? UNIX_ACCESS_X : 0 );
1119 if ((perms & S_IWUSR) && lp_dos_filemode(snum)) {
1120 nt_mask |= (SEC_STD_WRITE_DAC|SEC_STD_WRITE_OWNER|DELETE_ACCESS);
1123 DEBUG(10,("map_canon_ace_perms: Mapped (UNIX) %x to (NT) %x\n",
1124 (unsigned int)perms, (unsigned int)nt_mask ));
1129 /****************************************************************************
1130 Map NT perms to a UNIX mode_t.
1131 ****************************************************************************/
1133 #define FILE_SPECIFIC_READ_BITS (FILE_READ_DATA|FILE_READ_EA|FILE_READ_ATTRIBUTES)
1134 #define FILE_SPECIFIC_WRITE_BITS (FILE_WRITE_DATA|FILE_APPEND_DATA|FILE_WRITE_EA|FILE_WRITE_ATTRIBUTES)
1135 #define FILE_SPECIFIC_EXECUTE_BITS (FILE_EXECUTE)
1137 static mode_t map_nt_perms( uint32 *mask, int type)
1143 if((*mask) & GENERIC_ALL_ACCESS)
1144 mode = S_IRUSR|S_IWUSR|S_IXUSR;
1146 mode |= ((*mask) & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IRUSR : 0;
1147 mode |= ((*mask) & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWUSR : 0;
1148 mode |= ((*mask) & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXUSR : 0;
1152 if((*mask) & GENERIC_ALL_ACCESS)
1153 mode = S_IRGRP|S_IWGRP|S_IXGRP;
1155 mode |= ((*mask) & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IRGRP : 0;
1156 mode |= ((*mask) & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWGRP : 0;
1157 mode |= ((*mask) & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXGRP : 0;
1161 if((*mask) & GENERIC_ALL_ACCESS)
1162 mode = S_IROTH|S_IWOTH|S_IXOTH;
1164 mode |= ((*mask) & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IROTH : 0;
1165 mode |= ((*mask) & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWOTH : 0;
1166 mode |= ((*mask) & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXOTH : 0;
1174 /****************************************************************************
1175 Unpack a struct security_descriptor into a UNIX owner and group.
1176 ****************************************************************************/
1178 NTSTATUS unpack_nt_owners(struct connection_struct *conn,
1179 uid_t *puser, gid_t *pgrp,
1180 uint32 security_info_sent, const struct
1181 security_descriptor *psd)
1183 struct dom_sid owner_sid;
1184 struct dom_sid grp_sid;
1189 if(security_info_sent == 0) {
1190 DEBUG(0,("unpack_nt_owners: no security info sent !\n"));
1191 return NT_STATUS_OK;
1195 * Validate the owner and group SID's.
1198 memset(&owner_sid, '\0', sizeof(owner_sid));
1199 memset(&grp_sid, '\0', sizeof(grp_sid));
1201 DEBUG(5,("unpack_nt_owners: validating owner_sids.\n"));
1204 * Don't immediately fail if the owner sid cannot be validated.
1205 * This may be a group chown only set.
1208 if (security_info_sent & SECINFO_OWNER) {
1209 sid_copy(&owner_sid, psd->owner_sid);
1210 if (!sid_to_uid(&owner_sid, puser)) {
1211 if (lp_force_unknown_acl_user(SNUM(conn))) {
1212 /* this allows take ownership to work
1214 *puser = get_current_uid(conn);
1216 DEBUG(3,("unpack_nt_owners: unable to validate"
1217 " owner sid for %s\n",
1218 sid_string_dbg(&owner_sid)));
1219 return NT_STATUS_INVALID_OWNER;
1222 DEBUG(3,("unpack_nt_owners: owner sid mapped to uid %u\n",
1223 (unsigned int)*puser ));
1227 * Don't immediately fail if the group sid cannot be validated.
1228 * This may be an owner chown only set.
1231 if (security_info_sent & SECINFO_GROUP) {
1232 sid_copy(&grp_sid, psd->group_sid);
1233 if (!sid_to_gid( &grp_sid, pgrp)) {
1234 if (lp_force_unknown_acl_user(SNUM(conn))) {
1235 /* this allows take group ownership to work
1237 *pgrp = get_current_gid(conn);
1239 DEBUG(3,("unpack_nt_owners: unable to validate"
1241 return NT_STATUS_INVALID_OWNER;
1244 DEBUG(3,("unpack_nt_owners: group sid mapped to gid %u\n",
1245 (unsigned int)*pgrp));
1248 DEBUG(5,("unpack_nt_owners: owner_sids validated.\n"));
1250 return NT_STATUS_OK;
1253 /****************************************************************************
1254 Ensure the enforced permissions for this share apply.
1255 ****************************************************************************/
1257 static void apply_default_perms(const struct share_params *params,
1258 const bool is_directory, canon_ace *pace,
1261 mode_t and_bits = (mode_t)0;
1262 mode_t or_bits = (mode_t)0;
1264 /* Get the initial bits to apply. */
1267 and_bits = lp_dir_security_mask(params->service);
1268 or_bits = lp_force_dir_security_mode(params->service);
1270 and_bits = lp_security_mask(params->service);
1271 or_bits = lp_force_security_mode(params->service);
1274 /* Now bounce them into the S_USR space. */
1277 /* Ensure owner has read access. */
1278 pace->perms |= S_IRUSR;
1280 pace->perms |= (S_IWUSR|S_IXUSR);
1281 and_bits = unix_perms_to_acl_perms(and_bits, S_IRUSR, S_IWUSR, S_IXUSR);
1282 or_bits = unix_perms_to_acl_perms(or_bits, S_IRUSR, S_IWUSR, S_IXUSR);
1285 and_bits = unix_perms_to_acl_perms(and_bits, S_IRGRP, S_IWGRP, S_IXGRP);
1286 or_bits = unix_perms_to_acl_perms(or_bits, S_IRGRP, S_IWGRP, S_IXGRP);
1289 and_bits = unix_perms_to_acl_perms(and_bits, S_IROTH, S_IWOTH, S_IXOTH);
1290 or_bits = unix_perms_to_acl_perms(or_bits, S_IROTH, S_IWOTH, S_IXOTH);
1294 pace->perms = ((pace->perms & and_bits)|or_bits);
1297 /****************************************************************************
1298 Check if a given uid/SID is in a group gid/SID. This is probably very
1299 expensive and will need optimisation. A *lot* of optimisation :-). JRA.
1300 ****************************************************************************/
1302 static bool uid_entry_in_group(connection_struct *conn, canon_ace *uid_ace, canon_ace *group_ace )
1304 const char *u_name = NULL;
1306 /* "Everyone" always matches every uid. */
1308 if (dom_sid_equal(&group_ace->trustee, &global_sid_World))
1312 * if it's the current user, we already have the unix token
1313 * and don't need to do the complex user_in_group_sid() call
1315 if (uid_ace->unix_ug.uid == get_current_uid(conn)) {
1316 const struct security_unix_token *curr_utok = NULL;
1319 if (group_ace->unix_ug.gid == get_current_gid(conn)) {
1323 curr_utok = get_current_utok(conn);
1324 for (i=0; i < curr_utok->ngroups; i++) {
1325 if (group_ace->unix_ug.gid == curr_utok->groups[i]) {
1331 /* u_name talloc'ed off tos. */
1332 u_name = uidtoname(uid_ace->unix_ug.uid);
1338 * user_in_group_sid() uses create_token_from_username()
1339 * which creates an artificial NT token given just a username,
1340 * so this is not reliable for users from foreign domains
1341 * exported by winbindd!
1343 return user_in_group_sid(u_name, &group_ace->trustee);
1346 /****************************************************************************
1347 A well formed POSIX file or default ACL has at least 3 entries, a
1348 SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ.
1349 In addition, the owner must always have at least read access.
1350 When using this call on get_acl, the pst struct is valid and contains
1351 the mode of the file. When using this call on set_acl, the pst struct has
1352 been modified to have a mode containing the default for this file or directory
1354 ****************************************************************************/
1356 static bool ensure_canon_entry_valid(connection_struct *conn, canon_ace **pp_ace,
1357 const struct share_params *params,
1358 const bool is_directory,
1359 const struct dom_sid *pfile_owner_sid,
1360 const struct dom_sid *pfile_grp_sid,
1361 const SMB_STRUCT_STAT *pst,
1365 bool got_user = False;
1366 bool got_grp = False;
1367 bool got_other = False;
1368 canon_ace *pace_other = NULL;
1370 for (pace = *pp_ace; pace; pace = pace->next) {
1371 if (pace->type == SMB_ACL_USER_OBJ) {
1374 apply_default_perms(params, is_directory, pace, S_IRUSR);
1377 } else if (pace->type == SMB_ACL_GROUP_OBJ) {
1380 * Ensure create mask/force create mode is respected on set.
1384 apply_default_perms(params, is_directory, pace, S_IRGRP);
1387 } else if (pace->type == SMB_ACL_OTHER) {
1390 * Ensure create mask/force create mode is respected on set.
1394 apply_default_perms(params, is_directory, pace, S_IROTH);
1401 if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1402 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1407 pace->type = SMB_ACL_USER_OBJ;
1408 pace->owner_type = UID_ACE;
1409 pace->unix_ug.uid = pst->st_ex_uid;
1410 pace->trustee = *pfile_owner_sid;
1411 pace->attr = ALLOW_ACE;
1414 /* See if the owning user is in any of the other groups in
1415 the ACE. If so, OR in the permissions from that group. */
1417 bool group_matched = False;
1418 canon_ace *pace_iter;
1420 for (pace_iter = *pp_ace; pace_iter; pace_iter = pace_iter->next) {
1421 if (pace_iter->type == SMB_ACL_GROUP_OBJ || pace_iter->type == SMB_ACL_GROUP) {
1422 if (uid_entry_in_group(conn, pace, pace_iter)) {
1423 pace->perms |= pace_iter->perms;
1424 group_matched = True;
1429 /* If we only got an "everyone" perm, just use that. */
1430 if (!group_matched) {
1432 pace->perms = pace_other->perms;
1437 apply_default_perms(params, is_directory, pace, S_IRUSR);
1439 pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRUSR, S_IWUSR, S_IXUSR);
1442 DLIST_ADD(*pp_ace, pace);
1446 if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1447 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1452 pace->type = SMB_ACL_GROUP_OBJ;
1453 pace->owner_type = GID_ACE;
1454 pace->unix_ug.uid = pst->st_ex_gid;
1455 pace->trustee = *pfile_grp_sid;
1456 pace->attr = ALLOW_ACE;
1458 /* If we only got an "everyone" perm, just use that. */
1460 pace->perms = pace_other->perms;
1463 apply_default_perms(params, is_directory, pace, S_IRGRP);
1465 pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRGRP, S_IWGRP, S_IXGRP);
1468 DLIST_ADD(*pp_ace, pace);
1472 if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1473 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1478 pace->type = SMB_ACL_OTHER;
1479 pace->owner_type = WORLD_ACE;
1480 pace->unix_ug.world = -1;
1481 pace->trustee = global_sid_World;
1482 pace->attr = ALLOW_ACE;
1485 apply_default_perms(params, is_directory, pace, S_IROTH);
1487 pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IROTH, S_IWOTH, S_IXOTH);
1489 DLIST_ADD(*pp_ace, pace);
1495 /****************************************************************************
1496 Check if a POSIX ACL has the required SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries.
1497 If it does not have them, check if there are any entries where the trustee is the
1498 file owner or the owning group, and map these to SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ.
1499 ****************************************************************************/
1501 static void check_owning_objs(canon_ace *ace, struct dom_sid *pfile_owner_sid, struct dom_sid *pfile_grp_sid)
1503 bool got_user_obj, got_group_obj;
1504 canon_ace *current_ace;
1507 entries = count_canon_ace_list(ace);
1508 got_user_obj = False;
1509 got_group_obj = False;
1511 for (i=0, current_ace = ace; i < entries; i++, current_ace = current_ace->next) {
1512 if (current_ace->type == SMB_ACL_USER_OBJ)
1513 got_user_obj = True;
1514 else if (current_ace->type == SMB_ACL_GROUP_OBJ)
1515 got_group_obj = True;
1517 if (got_user_obj && got_group_obj) {
1518 DEBUG(10,("check_owning_objs: ACL had owning user/group entries.\n"));
1522 for (i=0, current_ace = ace; i < entries; i++, current_ace = current_ace->next) {
1523 if (!got_user_obj && current_ace->owner_type == UID_ACE &&
1524 dom_sid_equal(¤t_ace->trustee, pfile_owner_sid)) {
1525 current_ace->type = SMB_ACL_USER_OBJ;
1526 got_user_obj = True;
1528 if (!got_group_obj && current_ace->owner_type == GID_ACE &&
1529 dom_sid_equal(¤t_ace->trustee, pfile_grp_sid)) {
1530 current_ace->type = SMB_ACL_GROUP_OBJ;
1531 got_group_obj = True;
1535 DEBUG(10,("check_owning_objs: ACL is missing an owner entry.\n"));
1537 DEBUG(10,("check_owning_objs: ACL is missing an owning group entry.\n"));
1540 /****************************************************************************
1541 Unpack a struct security_descriptor into two canonical ace lists.
1542 ****************************************************************************/
1544 static bool create_canon_ace_lists(files_struct *fsp,
1545 const SMB_STRUCT_STAT *pst,
1546 struct dom_sid *pfile_owner_sid,
1547 struct dom_sid *pfile_grp_sid,
1548 canon_ace **ppfile_ace,
1549 canon_ace **ppdir_ace,
1550 const struct security_acl *dacl)
1552 bool all_aces_are_inherit_only = (fsp->is_directory ? True : False);
1553 canon_ace *file_ace = NULL;
1554 canon_ace *dir_ace = NULL;
1555 canon_ace *current_ace = NULL;
1556 bool got_dir_allow = False;
1557 bool got_file_allow = False;
1564 * Convert the incoming ACL into a more regular form.
1567 for(i = 0; i < dacl->num_aces; i++) {
1568 struct security_ace *psa = &dacl->aces[i];
1570 if((psa->type != SEC_ACE_TYPE_ACCESS_ALLOWED) && (psa->type != SEC_ACE_TYPE_ACCESS_DENIED)) {
1571 DEBUG(3,("create_canon_ace_lists: unable to set anything but an ALLOW or DENY ACE.\n"));
1575 if (nt4_compatible_acls()) {
1577 * The security mask may be UNIX_ACCESS_NONE which should map into
1578 * no permissions (we overload the WRITE_OWNER bit for this) or it
1579 * should be one of the ALL/EXECUTE/READ/WRITE bits. Arrange for this
1580 * to be so. Any other bits override the UNIX_ACCESS_NONE bit.
1584 * Convert GENERIC bits to specific bits.
1587 se_map_generic(&psa->access_mask, &file_generic_mapping);
1589 psa->access_mask &= (UNIX_ACCESS_NONE|FILE_ALL_ACCESS);
1591 if(psa->access_mask != UNIX_ACCESS_NONE)
1592 psa->access_mask &= ~UNIX_ACCESS_NONE;
1597 * Deal with the fact that NT 4.x re-writes the canonical format
1598 * that we return for default ACLs. If a directory ACE is identical
1599 * to a inherited directory ACE then NT changes the bits so that the
1600 * first ACE is set to OI|IO and the second ACE for this SID is set
1601 * to CI. We need to repair this. JRA.
1604 for(i = 0; i < dacl->num_aces; i++) {
1605 struct security_ace *psa1 = &dacl->aces[i];
1607 for (j = i + 1; j < dacl->num_aces; j++) {
1608 struct security_ace *psa2 = &dacl->aces[j];
1610 if (psa1->access_mask != psa2->access_mask)
1613 if (!dom_sid_equal(&psa1->trustee, &psa2->trustee))
1617 * Ok - permission bits and SIDs are equal.
1618 * Check if flags were re-written.
1621 if (psa1->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
1623 psa1->flags |= (psa2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT));
1624 psa2->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT);
1626 } else if (psa2->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
1628 psa2->flags |= (psa1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT));
1629 psa1->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT);
1635 for(i = 0; i < dacl->num_aces; i++) {
1636 struct security_ace *psa = &dacl->aces[i];
1639 * Create a canon_ace entry representing this NT DACL ACE.
1642 if ((current_ace = SMB_MALLOC_P(canon_ace)) == NULL) {
1643 free_canon_ace_list(file_ace);
1644 free_canon_ace_list(dir_ace);
1645 DEBUG(0,("create_canon_ace_lists: malloc fail.\n"));
1649 ZERO_STRUCTP(current_ace);
1651 sid_copy(¤t_ace->trustee, &psa->trustee);
1654 * Try and work out if the SID is a user or group
1655 * as we need to flag these differently for POSIX.
1656 * Note what kind of a POSIX ACL this should map to.
1659 if( dom_sid_equal(¤t_ace->trustee, &global_sid_World)) {
1660 current_ace->owner_type = WORLD_ACE;
1661 current_ace->unix_ug.world = -1;
1662 current_ace->type = SMB_ACL_OTHER;
1663 } else if (dom_sid_equal(¤t_ace->trustee, &global_sid_Creator_Owner)) {
1664 current_ace->owner_type = UID_ACE;
1665 current_ace->unix_ug.uid = pst->st_ex_uid;
1666 current_ace->type = SMB_ACL_USER_OBJ;
1669 * The Creator Owner entry only specifies inheritable permissions,
1670 * never access permissions. WinNT doesn't always set the ACE to
1671 * INHERIT_ONLY, though.
1674 psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
1676 } else if (dom_sid_equal(¤t_ace->trustee, &global_sid_Creator_Group)) {
1677 current_ace->owner_type = GID_ACE;
1678 current_ace->unix_ug.gid = pst->st_ex_gid;
1679 current_ace->type = SMB_ACL_GROUP_OBJ;
1682 * The Creator Group entry only specifies inheritable permissions,
1683 * never access permissions. WinNT doesn't always set the ACE to
1684 * INHERIT_ONLY, though.
1686 psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
1688 } else if (sid_to_uid( ¤t_ace->trustee, ¤t_ace->unix_ug.uid)) {
1689 current_ace->owner_type = UID_ACE;
1690 /* If it's the owning user, this is a user_obj, not
1692 if (current_ace->unix_ug.uid == pst->st_ex_uid) {
1693 current_ace->type = SMB_ACL_USER_OBJ;
1695 current_ace->type = SMB_ACL_USER;
1697 } else if (sid_to_gid( ¤t_ace->trustee, ¤t_ace->unix_ug.gid)) {
1698 current_ace->owner_type = GID_ACE;
1699 /* If it's the primary group, this is a group_obj, not
1701 if (current_ace->unix_ug.gid == pst->st_ex_gid) {
1702 current_ace->type = SMB_ACL_GROUP_OBJ;
1704 current_ace->type = SMB_ACL_GROUP;
1708 * Silently ignore map failures in non-mappable SIDs (NT Authority, BUILTIN etc).
1711 if (non_mappable_sid(&psa->trustee)) {
1712 DEBUG(10, ("create_canon_ace_lists: ignoring "
1713 "non-mappable SID %s\n",
1714 sid_string_dbg(&psa->trustee)));
1715 SAFE_FREE(current_ace);
1719 if (lp_force_unknown_acl_user(SNUM(fsp->conn))) {
1720 DEBUG(10, ("create_canon_ace_lists: ignoring "
1721 "unknown or foreign SID %s\n",
1722 sid_string_dbg(&psa->trustee)));
1723 SAFE_FREE(current_ace);
1727 free_canon_ace_list(file_ace);
1728 free_canon_ace_list(dir_ace);
1729 DEBUG(0, ("create_canon_ace_lists: unable to map SID "
1730 "%s to uid or gid.\n",
1731 sid_string_dbg(¤t_ace->trustee)));
1732 SAFE_FREE(current_ace);
1737 * Map the given NT permissions into a UNIX mode_t containing only
1738 * S_I(R|W|X)USR bits.
1741 current_ace->perms |= map_nt_perms( &psa->access_mask, S_IRUSR);
1742 current_ace->attr = (psa->type == SEC_ACE_TYPE_ACCESS_ALLOWED) ? ALLOW_ACE : DENY_ACE;
1744 /* Store the ace_flag. */
1745 current_ace->ace_flags = psa->flags;
1748 * Now add the created ace to either the file list, the directory
1749 * list, or both. We *MUST* preserve the order here (hence we use
1750 * DLIST_ADD_END) as NT ACLs are order dependent.
1753 if (fsp->is_directory) {
1756 * We can only add to the default POSIX ACE list if the ACE is
1757 * designed to be inherited by both files and directories.
1760 if ((psa->flags & (SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT)) ==
1761 (SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT)) {
1763 DLIST_ADD_END(dir_ace, current_ace, canon_ace *);
1766 * Note if this was an allow ace. We can't process
1767 * any further deny ace's after this.
1770 if (current_ace->attr == ALLOW_ACE)
1771 got_dir_allow = True;
1773 if ((current_ace->attr == DENY_ACE) && got_dir_allow) {
1774 DEBUG(0,("create_canon_ace_lists: "
1776 "inheritable ACL! Deny entry "
1777 "after Allow entry. Failing "
1778 "to set on file %s.\n",
1780 free_canon_ace_list(file_ace);
1781 free_canon_ace_list(dir_ace);
1785 if( DEBUGLVL( 10 )) {
1786 dbgtext("create_canon_ace_lists: adding dir ACL:\n");
1787 print_canon_ace( current_ace, 0);
1791 * If this is not an inherit only ACE we need to add a duplicate
1795 if (!(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
1796 canon_ace *dup_ace = dup_canon_ace(current_ace);
1799 DEBUG(0,("create_canon_ace_lists: malloc fail !\n"));
1800 free_canon_ace_list(file_ace);
1801 free_canon_ace_list(dir_ace);
1806 * We must not free current_ace here as its
1807 * pointer is now owned by the dir_ace list.
1809 current_ace = dup_ace;
1810 /* We've essentially split this ace into two,
1811 * and added the ace with inheritance request
1812 * bits to the directory ACL. Drop those bits for
1813 * the ACE we're adding to the file list. */
1814 current_ace->ace_flags &= ~(SEC_ACE_FLAG_OBJECT_INHERIT|
1815 SEC_ACE_FLAG_CONTAINER_INHERIT|
1816 SEC_ACE_FLAG_INHERIT_ONLY);
1819 * We must not free current_ace here as its
1820 * pointer is now owned by the dir_ace list.
1828 * Only add to the file ACL if not inherit only.
1831 if (current_ace && !(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
1832 DLIST_ADD_END(file_ace, current_ace, canon_ace *);
1835 * Note if this was an allow ace. We can't process
1836 * any further deny ace's after this.
1839 if (current_ace->attr == ALLOW_ACE)
1840 got_file_allow = True;
1842 if ((current_ace->attr == DENY_ACE) && got_file_allow) {
1843 DEBUG(0,("create_canon_ace_lists: malformed "
1844 "ACL in file ACL ! Deny entry after "
1845 "Allow entry. Failing to set on file "
1846 "%s.\n", fsp_str_dbg(fsp)));
1847 free_canon_ace_list(file_ace);
1848 free_canon_ace_list(dir_ace);
1852 if( DEBUGLVL( 10 )) {
1853 dbgtext("create_canon_ace_lists: adding file ACL:\n");
1854 print_canon_ace( current_ace, 0);
1856 all_aces_are_inherit_only = False;
1858 * We must not free current_ace here as its
1859 * pointer is now owned by the file_ace list.
1865 * Free if ACE was not added.
1868 SAFE_FREE(current_ace);
1871 if (fsp->is_directory && all_aces_are_inherit_only) {
1873 * Windows 2000 is doing one of these weird 'inherit acl'
1874 * traverses to conserve NTFS ACL resources. Just pretend
1875 * there was no DACL sent. JRA.
1878 DEBUG(10,("create_canon_ace_lists: Win2k inherit acl traverse. Ignoring DACL.\n"));
1879 free_canon_ace_list(file_ace);
1880 free_canon_ace_list(dir_ace);
1885 * Check if we have SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries in each
1886 * ACL. If we don't have them, check if any SMB_ACL_USER/SMB_ACL_GROUP
1887 * entries can be converted to *_OBJ. Usually we will already have these
1888 * entries in the Default ACL, and the Access ACL will not have them.
1891 check_owning_objs(file_ace, pfile_owner_sid, pfile_grp_sid);
1894 check_owning_objs(dir_ace, pfile_owner_sid, pfile_grp_sid);
1898 *ppfile_ace = file_ace;
1899 *ppdir_ace = dir_ace;
1904 /****************************************************************************
1905 ASCII art time again... JRA :-).
1907 We have 4 cases to process when moving from an NT ACL to a POSIX ACL. Firstly,
1908 we insist the ACL is in canonical form (ie. all DENY entries preceede ALLOW
1909 entries). Secondly, the merge code has ensured that all duplicate SID entries for
1910 allow or deny have been merged, so the same SID can only appear once in the deny
1911 list or once in the allow list.
1913 We then process as follows :
1915 ---------------------------------------------------------------------------
1916 First pass - look for a Everyone DENY entry.
1918 If it is deny all (rwx) trunate the list at this point.
1919 Else, walk the list from this point and use the deny permissions of this
1920 entry as a mask on all following allow entries. Finally, delete
1921 the Everyone DENY entry (we have applied it to everything possible).
1923 In addition, in this pass we remove any DENY entries that have
1924 no permissions (ie. they are a DENY nothing).
1925 ---------------------------------------------------------------------------
1926 Second pass - only deal with deny user entries.
1928 DENY user1 (perms XXX)
1931 for all following allow group entries where user1 is in group
1932 new_perms |= group_perms;
1934 user1 entry perms = new_perms & ~ XXX;
1936 Convert the deny entry to an allow entry with the new perms and
1937 push to the end of the list. Note if the user was in no groups
1938 this maps to a specific allow nothing entry for this user.
1940 The common case from the NT ACL choser (userX deny all) is
1941 optimised so we don't do the group lookup - we just map to
1942 an allow nothing entry.
1944 What we're doing here is inferring the allow permissions the
1945 person setting the ACE on user1 wanted by looking at the allow
1946 permissions on the groups the user is currently in. This will
1947 be a snapshot, depending on group membership but is the best
1948 we can do and has the advantage of failing closed rather than
1950 ---------------------------------------------------------------------------
1951 Third pass - only deal with deny group entries.
1953 DENY group1 (perms XXX)
1955 for all following allow user entries where user is in group1
1956 user entry perms = user entry perms & ~ XXX;
1958 If there is a group Everyone allow entry with permissions YYY,
1959 convert the group1 entry to an allow entry and modify its
1962 new_perms = YYY & ~ XXX
1964 and push to the end of the list.
1966 If there is no group Everyone allow entry then convert the
1967 group1 entry to a allow nothing entry and push to the end of the list.
1969 Note that the common case from the NT ACL choser (groupX deny all)
1970 cannot be optimised here as we need to modify user entries who are
1971 in the group to change them to a deny all also.
1973 What we're doing here is modifying the allow permissions of
1974 user entries (which are more specific in POSIX ACLs) to mask
1975 out the explicit deny set on the group they are in. This will
1976 be a snapshot depending on current group membership but is the
1977 best we can do and has the advantage of failing closed rather
1979 ---------------------------------------------------------------------------
1980 Fourth pass - cope with cumulative permissions.
1982 for all allow user entries, if there exists an allow group entry with
1983 more permissive permissions, and the user is in that group, rewrite the
1984 allow user permissions to contain both sets of permissions.
1986 Currently the code for this is #ifdef'ed out as these semantics make
1987 no sense to me. JRA.
1988 ---------------------------------------------------------------------------
1990 Note we *MUST* do the deny user pass first as this will convert deny user
1991 entries into allow user entries which can then be processed by the deny
1994 The above algorithm took a *lot* of thinking about - hence this
1995 explaination :-). JRA.
1996 ****************************************************************************/
1998 /****************************************************************************
1999 Process a canon_ace list entries. This is very complex code. We need
2000 to go through and remove the "deny" permissions from any allow entry that matches
2001 the id of this entry. We have already refused any NT ACL that wasn't in correct
2002 order (DENY followed by ALLOW). If any allow entry ends up with zero permissions,
2003 we just remove it (to fail safe). We have already removed any duplicate ace
2004 entries. Treat an "Everyone" DENY_ACE as a special case - use it to mask all
2006 ****************************************************************************/
2008 static void process_deny_list(connection_struct *conn, canon_ace **pp_ace_list )
2010 canon_ace *ace_list = *pp_ace_list;
2011 canon_ace *curr_ace = NULL;
2012 canon_ace *curr_ace_next = NULL;
2014 /* Pass 1 above - look for an Everyone, deny entry. */
2016 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2017 canon_ace *allow_ace_p;
2019 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2021 if (curr_ace->attr != DENY_ACE)
2024 if (curr_ace->perms == (mode_t)0) {
2026 /* Deny nothing entry - delete. */
2028 DLIST_REMOVE(ace_list, curr_ace);
2032 if (!dom_sid_equal(&curr_ace->trustee, &global_sid_World))
2035 /* JRATEST - assert. */
2036 SMB_ASSERT(curr_ace->owner_type == WORLD_ACE);
2038 if (curr_ace->perms == ALL_ACE_PERMS) {
2041 * Optimisation. This is a DENY_ALL to Everyone. Truncate the
2042 * list at this point including this entry.
2045 canon_ace *prev_entry = DLIST_PREV(curr_ace);
2047 free_canon_ace_list( curr_ace );
2049 DLIST_REMOVE(ace_list, prev_entry);
2051 /* We deleted the entire list. */
2057 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2060 * Only mask off allow entries.
2063 if (allow_ace_p->attr != ALLOW_ACE)
2066 allow_ace_p->perms &= ~curr_ace->perms;
2070 * Now it's been applied, remove it.
2073 DLIST_REMOVE(ace_list, curr_ace);
2076 /* Pass 2 above - deal with deny user entries. */
2078 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2079 mode_t new_perms = (mode_t)0;
2080 canon_ace *allow_ace_p;
2082 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2084 if (curr_ace->attr != DENY_ACE)
2087 if (curr_ace->owner_type != UID_ACE)
2090 if (curr_ace->perms == ALL_ACE_PERMS) {
2093 * Optimisation - this is a deny everything to this user.
2094 * Convert to an allow nothing and push to the end of the list.
2097 curr_ace->attr = ALLOW_ACE;
2098 curr_ace->perms = (mode_t)0;
2099 DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2103 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2105 if (allow_ace_p->attr != ALLOW_ACE)
2108 /* We process GID_ACE and WORLD_ACE entries only. */
2110 if (allow_ace_p->owner_type == UID_ACE)
2113 if (uid_entry_in_group(conn, curr_ace, allow_ace_p))
2114 new_perms |= allow_ace_p->perms;
2118 * Convert to a allow entry, modify the perms and push to the end
2122 curr_ace->attr = ALLOW_ACE;
2123 curr_ace->perms = (new_perms & ~curr_ace->perms);
2124 DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2127 /* Pass 3 above - deal with deny group entries. */
2129 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2130 canon_ace *allow_ace_p;
2131 canon_ace *allow_everyone_p = NULL;
2133 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2135 if (curr_ace->attr != DENY_ACE)
2138 if (curr_ace->owner_type != GID_ACE)
2141 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2143 if (allow_ace_p->attr != ALLOW_ACE)
2146 /* Store a pointer to the Everyone allow, if it exists. */
2147 if (allow_ace_p->owner_type == WORLD_ACE)
2148 allow_everyone_p = allow_ace_p;
2150 /* We process UID_ACE entries only. */
2152 if (allow_ace_p->owner_type != UID_ACE)
2155 /* Mask off the deny group perms. */
2157 if (uid_entry_in_group(conn, allow_ace_p, curr_ace))
2158 allow_ace_p->perms &= ~curr_ace->perms;
2162 * Convert the deny to an allow with the correct perms and
2163 * push to the end of the list.
2166 curr_ace->attr = ALLOW_ACE;
2167 if (allow_everyone_p)
2168 curr_ace->perms = allow_everyone_p->perms & ~curr_ace->perms;
2170 curr_ace->perms = (mode_t)0;
2171 DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2174 /* Doing this fourth pass allows Windows semantics to be layered
2175 * on top of POSIX semantics. I'm not sure if this is desirable.
2176 * For example, in W2K ACLs there is no way to say, "Group X no
2177 * access, user Y full access" if user Y is a member of group X.
2178 * This seems completely broken semantics to me.... JRA.
2182 /* Pass 4 above - deal with allow entries. */
2184 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2185 canon_ace *allow_ace_p;
2187 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2189 if (curr_ace->attr != ALLOW_ACE)
2192 if (curr_ace->owner_type != UID_ACE)
2195 for (allow_ace_p = ace_list; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2197 if (allow_ace_p->attr != ALLOW_ACE)
2200 /* We process GID_ACE entries only. */
2202 if (allow_ace_p->owner_type != GID_ACE)
2205 /* OR in the group perms. */
2207 if (uid_entry_in_group(conn, curr_ace, allow_ace_p))
2208 curr_ace->perms |= allow_ace_p->perms;
2213 *pp_ace_list = ace_list;
2216 /****************************************************************************
2217 Create a default mode that will be used if a security descriptor entry has
2218 no user/group/world entries.
2219 ****************************************************************************/
2221 static mode_t create_default_mode(files_struct *fsp, bool interitable_mode)
2223 int snum = SNUM(fsp->conn);
2224 mode_t and_bits = (mode_t)0;
2225 mode_t or_bits = (mode_t)0;
2228 if (interitable_mode) {
2229 mode = unix_mode(fsp->conn, FILE_ATTRIBUTE_ARCHIVE,
2230 fsp->fsp_name, NULL);
2235 if (fsp->is_directory)
2236 mode |= (S_IWUSR|S_IXUSR);
2239 * Now AND with the create mode/directory mode bits then OR with the
2240 * force create mode/force directory mode bits.
2243 if (fsp->is_directory) {
2244 and_bits = lp_dir_security_mask(snum);
2245 or_bits = lp_force_dir_security_mode(snum);
2247 and_bits = lp_security_mask(snum);
2248 or_bits = lp_force_security_mode(snum);
2251 return ((mode & and_bits)|or_bits);
2254 /****************************************************************************
2255 Unpack a struct security_descriptor into two canonical ace lists. We don't depend on this
2257 ****************************************************************************/
2259 static bool unpack_canon_ace(files_struct *fsp,
2260 const SMB_STRUCT_STAT *pst,
2261 struct dom_sid *pfile_owner_sid,
2262 struct dom_sid *pfile_grp_sid,
2263 canon_ace **ppfile_ace,
2264 canon_ace **ppdir_ace,
2265 uint32 security_info_sent,
2266 const struct security_descriptor *psd)
2269 canon_ace *file_ace = NULL;
2270 canon_ace *dir_ace = NULL;
2275 if(security_info_sent == 0) {
2276 DEBUG(0,("unpack_canon_ace: no security info sent !\n"));
2281 * If no DACL then this is a chown only security descriptor.
2284 if(!(security_info_sent & SECINFO_DACL) || !psd->dacl)
2288 * Now go through the DACL and create the canon_ace lists.
2291 if (!create_canon_ace_lists( fsp, pst, pfile_owner_sid, pfile_grp_sid,
2292 &file_ace, &dir_ace, psd->dacl))
2295 if ((file_ace == NULL) && (dir_ace == NULL)) {
2296 /* W2K traverse DACL set - ignore. */
2301 * Go through the canon_ace list and merge entries
2302 * belonging to identical users of identical allow or deny type.
2303 * We can do this as all deny entries come first, followed by
2304 * all allow entries (we have mandated this before accepting this acl).
2307 print_canon_ace_list( "file ace - before merge", file_ace);
2308 merge_aces( &file_ace, false);
2310 print_canon_ace_list( "dir ace - before merge", dir_ace);
2311 merge_aces( &dir_ace, true);
2314 * NT ACLs are order dependent. Go through the acl lists and
2315 * process DENY entries by masking the allow entries.
2318 print_canon_ace_list( "file ace - before deny", file_ace);
2319 process_deny_list(fsp->conn, &file_ace);
2321 print_canon_ace_list( "dir ace - before deny", dir_ace);
2322 process_deny_list(fsp->conn, &dir_ace);
2325 * A well formed POSIX file or default ACL has at least 3 entries, a
2326 * SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ
2327 * and optionally a mask entry. Ensure this is the case.
2330 print_canon_ace_list( "file ace - before valid", file_ace);
2335 * A default 3 element mode entry for a file should be r-- --- ---.
2336 * A default 3 element mode entry for a directory should be rwx --- ---.
2339 st.st_ex_mode = create_default_mode(fsp, False);
2341 if (!ensure_canon_entry_valid(fsp->conn, &file_ace, fsp->conn->params,
2342 fsp->is_directory, pfile_owner_sid, pfile_grp_sid, &st, True)) {
2343 free_canon_ace_list(file_ace);
2344 free_canon_ace_list(dir_ace);
2348 print_canon_ace_list( "dir ace - before valid", dir_ace);
2351 * A default inheritable 3 element mode entry for a directory should be the
2352 * mode Samba will use to create a file within. Ensure user rwx bits are set if
2356 st.st_ex_mode = create_default_mode(fsp, True);
2358 if (dir_ace && !ensure_canon_entry_valid(fsp->conn, &dir_ace, fsp->conn->params,
2359 fsp->is_directory, pfile_owner_sid, pfile_grp_sid, &st, True)) {
2360 free_canon_ace_list(file_ace);
2361 free_canon_ace_list(dir_ace);
2365 print_canon_ace_list( "file ace - return", file_ace);
2366 print_canon_ace_list( "dir ace - return", dir_ace);
2368 *ppfile_ace = file_ace;
2369 *ppdir_ace = dir_ace;
2374 /******************************************************************************
2375 When returning permissions, try and fit NT display
2376 semantics if possible. Note the the canon_entries here must have been malloced.
2377 The list format should be - first entry = owner, followed by group and other user
2378 entries, last entry = other.
2380 Note that this doesn't exactly match the NT semantics for an ACL. As POSIX entries
2381 are not ordered, and match on the most specific entry rather than walking a list,
2382 then a simple POSIX permission of rw-r--r-- should really map to 5 entries,
2384 Entry 0: owner : deny all except read and write.
2385 Entry 1: owner : allow read and write.
2386 Entry 2: group : deny all except read.
2387 Entry 3: group : allow read.
2388 Entry 4: Everyone : allow read.
2390 But NT cannot display this in their ACL editor !
2391 ********************************************************************************/
2393 static void arrange_posix_perms(const char *filename, canon_ace **pp_list_head)
2395 canon_ace *l_head = *pp_list_head;
2396 canon_ace *owner_ace = NULL;
2397 canon_ace *other_ace = NULL;
2398 canon_ace *ace = NULL;
2400 for (ace = l_head; ace; ace = ace->next) {
2401 if (ace->type == SMB_ACL_USER_OBJ)
2403 else if (ace->type == SMB_ACL_OTHER) {
2404 /* Last ace - this is "other" */
2409 if (!owner_ace || !other_ace) {
2410 DEBUG(0,("arrange_posix_perms: Invalid POSIX permissions for file %s, missing owner or other.\n",
2416 * The POSIX algorithm applies to owner first, and other last,
2417 * so ensure they are arranged in this order.
2421 DLIST_PROMOTE(l_head, owner_ace);
2425 DLIST_DEMOTE(l_head, other_ace, canon_ace *);
2428 /* We have probably changed the head of the list. */
2430 *pp_list_head = l_head;
2433 /****************************************************************************
2434 Create a linked list of canonical ACE entries.
2435 ****************************************************************************/
2437 static canon_ace *canonicalise_acl(struct connection_struct *conn,
2438 const char *fname, SMB_ACL_T posix_acl,
2439 const SMB_STRUCT_STAT *psbuf,
2440 const struct dom_sid *powner, const struct dom_sid *pgroup, struct pai_val *pal, SMB_ACL_TYPE_T the_acl_type)
2442 mode_t acl_mask = (S_IRUSR|S_IWUSR|S_IXUSR);
2443 canon_ace *l_head = NULL;
2444 canon_ace *ace = NULL;
2445 canon_ace *next_ace = NULL;
2446 int entry_id = SMB_ACL_FIRST_ENTRY;
2447 SMB_ACL_ENTRY_T entry;
2450 while ( posix_acl && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1)) {
2451 SMB_ACL_TAG_T tagtype;
2452 SMB_ACL_PERMSET_T permset;
2455 enum ace_owner owner_type;
2457 entry_id = SMB_ACL_NEXT_ENTRY;
2459 /* Is this a MASK entry ? */
2460 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1)
2463 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1)
2466 /* Decide which SID to use based on the ACL type. */
2468 case SMB_ACL_USER_OBJ:
2469 /* Get the SID from the owner. */
2470 sid_copy(&sid, powner);
2471 unix_ug.uid = psbuf->st_ex_uid;
2472 owner_type = UID_ACE;
2476 uid_t *puid = (uid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
2478 DEBUG(0,("canonicalise_acl: Failed to get uid.\n"));
2481 uid_to_sid( &sid, *puid);
2482 unix_ug.uid = *puid;
2483 owner_type = UID_ACE;
2484 SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)puid,tagtype);
2487 case SMB_ACL_GROUP_OBJ:
2488 /* Get the SID from the owning group. */
2489 sid_copy(&sid, pgroup);
2490 unix_ug.gid = psbuf->st_ex_gid;
2491 owner_type = GID_ACE;
2495 gid_t *pgid = (gid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
2497 DEBUG(0,("canonicalise_acl: Failed to get gid.\n"));
2500 gid_to_sid( &sid, *pgid);
2501 unix_ug.gid = *pgid;
2502 owner_type = GID_ACE;
2503 SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)pgid,tagtype);
2507 acl_mask = convert_permset_to_mode_t(conn, permset);
2508 continue; /* Don't count the mask as an entry. */
2510 /* Use the Everyone SID */
2511 sid = global_sid_World;
2513 owner_type = WORLD_ACE;
2516 DEBUG(0,("canonicalise_acl: Unknown tagtype %u\n", (unsigned int)tagtype));
2521 * Add this entry to the list.
2524 if ((ace = SMB_MALLOC_P(canon_ace)) == NULL)
2528 ace->type = tagtype;
2529 ace->perms = convert_permset_to_mode_t(conn, permset);
2530 ace->attr = ALLOW_ACE;
2532 ace->unix_ug = unix_ug;
2533 ace->owner_type = owner_type;
2534 ace->ace_flags = get_pai_flags(pal, ace, (the_acl_type == SMB_ACL_TYPE_DEFAULT));
2536 DLIST_ADD(l_head, ace);
2540 * This next call will ensure we have at least a user/group/world set.
2543 if (!ensure_canon_entry_valid(conn, &l_head, conn->params,
2544 S_ISDIR(psbuf->st_ex_mode), powner, pgroup,
2549 * Now go through the list, masking the permissions with the
2550 * acl_mask. Ensure all DENY Entries are at the start of the list.
2553 DEBUG(10,("canonicalise_acl: %s ace entries before arrange :\n", the_acl_type == SMB_ACL_TYPE_ACCESS ? "Access" : "Default" ));
2555 for ( ace_count = 0, ace = l_head; ace; ace = next_ace, ace_count++) {
2556 next_ace = ace->next;
2558 /* Masks are only applied to entries other than USER_OBJ and OTHER. */
2559 if (ace->type != SMB_ACL_OTHER && ace->type != SMB_ACL_USER_OBJ)
2560 ace->perms &= acl_mask;
2562 if (ace->perms == 0) {
2563 DLIST_PROMOTE(l_head, ace);
2566 if( DEBUGLVL( 10 ) ) {
2567 print_canon_ace(ace, ace_count);
2571 arrange_posix_perms(fname,&l_head );
2573 print_canon_ace_list( "canonicalise_acl: ace entries after arrange", l_head );
2579 free_canon_ace_list(l_head);
2583 /****************************************************************************
2584 Check if the current user group list contains a given group.
2585 ****************************************************************************/
2587 bool current_user_in_group(connection_struct *conn, gid_t gid)
2590 const struct security_unix_token *utok = get_current_utok(conn);
2592 for (i = 0; i < utok->ngroups; i++) {
2593 if (utok->groups[i] == gid) {
2601 /****************************************************************************
2602 Should we override a deny ? Check 'acl group control' and 'dos filemode'.
2603 ****************************************************************************/
2605 static bool acl_group_override(connection_struct *conn,
2606 const struct smb_filename *smb_fname)
2608 if ((errno != EPERM) && (errno != EACCES)) {
2612 /* file primary group == user primary or supplementary group */
2613 if (lp_acl_group_control(SNUM(conn)) &&
2614 current_user_in_group(conn, smb_fname->st.st_ex_gid)) {
2618 /* user has writeable permission */
2619 if (lp_dos_filemode(SNUM(conn)) &&
2620 can_write_to_file(conn, smb_fname)) {
2627 /****************************************************************************
2628 Attempt to apply an ACL to a file or directory.
2629 ****************************************************************************/
2631 static bool set_canon_ace_list(files_struct *fsp,
2634 const SMB_STRUCT_STAT *psbuf,
2635 bool *pacl_set_support)
2637 connection_struct *conn = fsp->conn;
2639 SMB_ACL_T the_acl = SMB_VFS_SYS_ACL_INIT(conn, (int)count_canon_ace_list(the_ace) + 1);
2642 SMB_ACL_ENTRY_T mask_entry;
2643 bool got_mask_entry = False;
2644 SMB_ACL_PERMSET_T mask_permset;
2645 SMB_ACL_TYPE_T the_acl_type = (default_ace ? SMB_ACL_TYPE_DEFAULT : SMB_ACL_TYPE_ACCESS);
2646 bool needs_mask = False;
2647 mode_t mask_perms = 0;
2649 /* Use the psbuf that was passed in. */
2650 if (psbuf != &fsp->fsp_name->st) {
2651 fsp->fsp_name->st = *psbuf;
2654 #if defined(POSIX_ACL_NEEDS_MASK)
2655 /* HP-UX always wants to have a mask (called "class" there). */
2659 if (the_acl == NULL) {
2661 if (!no_acl_syscall_error(errno)) {
2663 * Only print this error message if we have some kind of ACL
2664 * support that's not working. Otherwise we would always get this.
2666 DEBUG(0,("set_canon_ace_list: Unable to init %s ACL. (%s)\n",
2667 default_ace ? "default" : "file", strerror(errno) ));
2669 *pacl_set_support = False;
2673 if( DEBUGLVL( 10 )) {
2674 dbgtext("set_canon_ace_list: setting ACL:\n");
2675 for (i = 0, p_ace = the_ace; p_ace; p_ace = p_ace->next, i++ ) {
2676 print_canon_ace( p_ace, i);
2680 for (i = 0, p_ace = the_ace; p_ace; p_ace = p_ace->next, i++ ) {
2681 SMB_ACL_ENTRY_T the_entry;
2682 SMB_ACL_PERMSET_T the_permset;
2685 * ACLs only "need" an ACL_MASK entry if there are any named user or
2686 * named group entries. But if there is an ACL_MASK entry, it applies
2687 * to ACL_USER, ACL_GROUP, and ACL_GROUP_OBJ entries. Set the mask
2688 * so that it doesn't deny (i.e., mask off) any permissions.
2691 if (p_ace->type == SMB_ACL_USER || p_ace->type == SMB_ACL_GROUP) {
2693 mask_perms |= p_ace->perms;
2694 } else if (p_ace->type == SMB_ACL_GROUP_OBJ) {
2695 mask_perms |= p_ace->perms;
2699 * Get the entry for this ACE.
2702 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &the_entry) == -1) {
2703 DEBUG(0,("set_canon_ace_list: Failed to create entry %d. (%s)\n",
2704 i, strerror(errno) ));
2708 if (p_ace->type == SMB_ACL_MASK) {
2709 mask_entry = the_entry;
2710 got_mask_entry = True;
2714 * Ok - we now know the ACL calls should be working, don't
2715 * allow fallback to chmod.
2718 *pacl_set_support = True;
2721 * Initialise the entry from the canon_ace.
2725 * First tell the entry what type of ACE this is.
2728 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, the_entry, p_ace->type) == -1) {
2729 DEBUG(0,("set_canon_ace_list: Failed to set tag type on entry %d. (%s)\n",
2730 i, strerror(errno) ));
2735 * Only set the qualifier (user or group id) if the entry is a user
2739 if ((p_ace->type == SMB_ACL_USER) || (p_ace->type == SMB_ACL_GROUP)) {
2740 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&p_ace->unix_ug.uid) == -1) {
2741 DEBUG(0,("set_canon_ace_list: Failed to set qualifier on entry %d. (%s)\n",
2742 i, strerror(errno) ));
2748 * Convert the mode_t perms in the canon_ace to a POSIX permset.
2751 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, the_entry, &the_permset) == -1) {
2752 DEBUG(0,("set_canon_ace_list: Failed to get permset on entry %d. (%s)\n",
2753 i, strerror(errno) ));
2757 if (map_acl_perms_to_permset(conn, p_ace->perms, &the_permset) == -1) {
2758 DEBUG(0,("set_canon_ace_list: Failed to create permset for mode (%u) on entry %d. (%s)\n",
2759 (unsigned int)p_ace->perms, i, strerror(errno) ));
2764 * ..and apply them to the entry.
2767 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, the_entry, the_permset) == -1) {
2768 DEBUG(0,("set_canon_ace_list: Failed to add permset on entry %d. (%s)\n",
2769 i, strerror(errno) ));
2774 print_canon_ace( p_ace, i);
2778 if (needs_mask && !got_mask_entry) {
2779 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &mask_entry) == -1) {
2780 DEBUG(0,("set_canon_ace_list: Failed to create mask entry. (%s)\n", strerror(errno) ));
2784 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, mask_entry, SMB_ACL_MASK) == -1) {
2785 DEBUG(0,("set_canon_ace_list: Failed to set tag type on mask entry. (%s)\n",strerror(errno) ));
2789 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, mask_entry, &mask_permset) == -1) {
2790 DEBUG(0,("set_canon_ace_list: Failed to get mask permset. (%s)\n", strerror(errno) ));
2794 if (map_acl_perms_to_permset(conn, S_IRUSR|S_IWUSR|S_IXUSR, &mask_permset) == -1) {
2795 DEBUG(0,("set_canon_ace_list: Failed to create mask permset. (%s)\n", strerror(errno) ));
2799 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, mask_entry, mask_permset) == -1) {
2800 DEBUG(0,("set_canon_ace_list: Failed to add mask permset. (%s)\n", strerror(errno) ));
2806 * Finally apply it to the file or directory.
2809 if(default_ace || fsp->is_directory || fsp->fh->fd == -1) {
2810 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fsp->fsp_name->base_name,
2811 the_acl_type, the_acl) == -1) {
2813 * Some systems allow all the above calls and only fail with no ACL support
2814 * when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
2816 if (no_acl_syscall_error(errno)) {
2817 *pacl_set_support = False;
2820 if (acl_group_override(conn, fsp->fsp_name)) {
2823 DEBUG(5,("set_canon_ace_list: acl group "
2824 "control on and current user in file "
2825 "%s primary group.\n",
2829 sret = SMB_VFS_SYS_ACL_SET_FILE(conn,
2830 fsp->fsp_name->base_name, the_acl_type,
2839 DEBUG(2,("set_canon_ace_list: "
2840 "sys_acl_set_file type %s failed for "
2842 the_acl_type == SMB_ACL_TYPE_DEFAULT ?
2843 "directory default" : "file",
2844 fsp_str_dbg(fsp), strerror(errno)));
2849 if (SMB_VFS_SYS_ACL_SET_FD(fsp, the_acl) == -1) {
2851 * Some systems allow all the above calls and only fail with no ACL support
2852 * when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
2854 if (no_acl_syscall_error(errno)) {
2855 *pacl_set_support = False;
2858 if (acl_group_override(conn, fsp->fsp_name)) {
2861 DEBUG(5,("set_canon_ace_list: acl group "
2862 "control on and current user in file "
2863 "%s primary group.\n",
2867 sret = SMB_VFS_SYS_ACL_SET_FD(fsp, the_acl);
2875 DEBUG(2,("set_canon_ace_list: "
2876 "sys_acl_set_file failed for file %s "
2878 fsp_str_dbg(fsp), strerror(errno)));
2888 if (the_acl != NULL) {
2889 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
2895 /****************************************************************************
2896 Find a particular canon_ace entry.
2897 ****************************************************************************/
2899 static struct canon_ace *canon_ace_entry_for(struct canon_ace *list, SMB_ACL_TAG_T type, posix_id *id)
2902 if (list->type == type && ((type != SMB_ACL_USER && type != SMB_ACL_GROUP) ||
2903 (type == SMB_ACL_USER && id && id->uid == list->unix_ug.uid) ||
2904 (type == SMB_ACL_GROUP && id && id->gid == list->unix_ug.gid)))
2911 /****************************************************************************
2913 ****************************************************************************/
2915 SMB_ACL_T free_empty_sys_acl(connection_struct *conn, SMB_ACL_T the_acl)
2917 SMB_ACL_ENTRY_T entry;
2921 if (SMB_VFS_SYS_ACL_GET_ENTRY(conn, the_acl, SMB_ACL_FIRST_ENTRY, &entry) != 1) {
2922 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
2928 /****************************************************************************
2929 Convert a canon_ace to a generic 3 element permission - if possible.
2930 ****************************************************************************/
2932 #define MAP_PERM(p,mask,result) (((p) & (mask)) ? (result) : 0 )
2934 static bool convert_canon_ace_to_posix_perms( files_struct *fsp, canon_ace *file_ace_list, mode_t *posix_perms)
2936 int snum = SNUM(fsp->conn);
2937 size_t ace_count = count_canon_ace_list(file_ace_list);
2939 canon_ace *owner_ace = NULL;
2940 canon_ace *group_ace = NULL;
2941 canon_ace *other_ace = NULL;
2945 if (ace_count != 3) {
2946 DEBUG(3,("convert_canon_ace_to_posix_perms: Too many ACE "
2947 "entries for file %s to convert to posix perms.\n",
2952 for (ace_p = file_ace_list; ace_p; ace_p = ace_p->next) {
2953 if (ace_p->owner_type == UID_ACE)
2955 else if (ace_p->owner_type == GID_ACE)
2957 else if (ace_p->owner_type == WORLD_ACE)
2961 if (!owner_ace || !group_ace || !other_ace) {
2962 DEBUG(3,("convert_canon_ace_to_posix_perms: Can't get "
2963 "standard entries for file %s.\n", fsp_str_dbg(fsp)));
2967 *posix_perms = (mode_t)0;
2969 *posix_perms |= owner_ace->perms;
2970 *posix_perms |= MAP_PERM(group_ace->perms, S_IRUSR, S_IRGRP);
2971 *posix_perms |= MAP_PERM(group_ace->perms, S_IWUSR, S_IWGRP);
2972 *posix_perms |= MAP_PERM(group_ace->perms, S_IXUSR, S_IXGRP);
2973 *posix_perms |= MAP_PERM(other_ace->perms, S_IRUSR, S_IROTH);
2974 *posix_perms |= MAP_PERM(other_ace->perms, S_IWUSR, S_IWOTH);
2975 *posix_perms |= MAP_PERM(other_ace->perms, S_IXUSR, S_IXOTH);
2977 /* The owner must have at least read access. */
2979 *posix_perms |= S_IRUSR;
2980 if (fsp->is_directory)
2981 *posix_perms |= (S_IWUSR|S_IXUSR);
2983 /* If requested apply the masks. */
2985 /* Get the initial bits to apply. */
2987 if (fsp->is_directory) {
2988 and_bits = lp_dir_security_mask(snum);
2989 or_bits = lp_force_dir_security_mode(snum);
2991 and_bits = lp_security_mask(snum);
2992 or_bits = lp_force_security_mode(snum);
2995 *posix_perms = (((*posix_perms) & and_bits)|or_bits);
2997 DEBUG(10,("convert_canon_ace_to_posix_perms: converted u=%o,g=%o,w=%o "
2998 "to perm=0%o for file %s.\n", (int)owner_ace->perms,
2999 (int)group_ace->perms, (int)other_ace->perms,
3000 (int)*posix_perms, fsp_str_dbg(fsp)));
3005 /****************************************************************************
3006 Incoming NT ACLs on a directory can be split into a default POSIX acl (CI|OI|IO) and
3007 a normal POSIX acl. Win2k needs these split acls re-merging into one ACL
3008 with CI|OI set so it is inherited and also applies to the directory.
3009 Based on code from "Jim McDonough" <jmcd@us.ibm.com>.
3010 ****************************************************************************/
3012 static size_t merge_default_aces( struct security_ace *nt_ace_list, size_t num_aces)
3016 for (i = 0; i < num_aces; i++) {
3017 for (j = i+1; j < num_aces; j++) {
3018 uint32 i_flags_ni = (nt_ace_list[i].flags & ~SEC_ACE_FLAG_INHERITED_ACE);
3019 uint32 j_flags_ni = (nt_ace_list[j].flags & ~SEC_ACE_FLAG_INHERITED_ACE);
3020 bool i_inh = (nt_ace_list[i].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False;
3021 bool j_inh = (nt_ace_list[j].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False;
3023 /* We know the lower number ACE's are file entries. */
3024 if ((nt_ace_list[i].type == nt_ace_list[j].type) &&
3025 (nt_ace_list[i].size == nt_ace_list[j].size) &&
3026 (nt_ace_list[i].access_mask == nt_ace_list[j].access_mask) &&
3027 dom_sid_equal(&nt_ace_list[i].trustee, &nt_ace_list[j].trustee) &&
3029 (i_flags_ni == 0) &&
3030 (j_flags_ni == (SEC_ACE_FLAG_OBJECT_INHERIT|
3031 SEC_ACE_FLAG_CONTAINER_INHERIT|
3032 SEC_ACE_FLAG_INHERIT_ONLY))) {
3034 * W2K wants to have access allowed zero access ACE's
3035 * at the end of the list. If the mask is zero, merge
3036 * the non-inherited ACE onto the inherited ACE.
3039 if (nt_ace_list[i].access_mask == 0) {
3040 nt_ace_list[j].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
3041 (i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0);
3042 if (num_aces - i - 1 > 0)
3043 memmove(&nt_ace_list[i], &nt_ace_list[i+1], (num_aces-i-1) *
3044 sizeof(struct security_ace));
3046 DEBUG(10,("merge_default_aces: Merging zero access ACE %u onto ACE %u.\n",
3047 (unsigned int)i, (unsigned int)j ));
3050 * These are identical except for the flags.
3051 * Merge the inherited ACE onto the non-inherited ACE.
3054 nt_ace_list[i].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
3055 (i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0);
3056 if (num_aces - j - 1 > 0)
3057 memmove(&nt_ace_list[j], &nt_ace_list[j+1], (num_aces-j-1) *
3058 sizeof(struct security_ace));
3060 DEBUG(10,("merge_default_aces: Merging ACE %u onto ACE %u.\n",
3061 (unsigned int)j, (unsigned int)i ));
3073 * Add or Replace ACE entry.
3074 * In some cases we need to add a specific ACE for compatibility reasons.
3075 * When doing that we must make sure we are not actually creating a duplicate
3076 * entry. So we need to search whether an ACE entry already exist and eventually
3077 * replacce the access mask, or add a completely new entry if none was found.
3079 * This function assumes the array has enough space to add a new entry without
3080 * any reallocation of memory.
3083 static void add_or_replace_ace(struct security_ace *nt_ace_list, size_t *num_aces,
3084 const struct dom_sid *sid, enum security_ace_type type,
3085 uint32_t mask, uint8_t flags)
3089 /* first search for a duplicate */
3090 for (i = 0; i < *num_aces; i++) {
3091 if (dom_sid_equal(&nt_ace_list[i].trustee, sid) &&
3092 (nt_ace_list[i].flags == flags)) break;
3095 if (i < *num_aces) { /* found */
3096 nt_ace_list[i].type = type;
3097 nt_ace_list[i].access_mask = mask;
3098 DEBUG(10, ("Replacing ACE %d with SID %s and flags %02x\n",
3099 i, sid_string_dbg(sid), flags));
3103 /* not found, append it */
3104 init_sec_ace(&nt_ace_list[(*num_aces)++], sid, type, mask, flags);
3108 /****************************************************************************
3109 Reply to query a security descriptor from an fsp. If it succeeds it allocates
3110 the space for the return elements and returns the size needed to return the
3111 security descriptor. This should be the only external function needed for
3112 the UNIX style get ACL.
3113 ****************************************************************************/
3115 static NTSTATUS posix_get_nt_acl_common(struct connection_struct *conn,
3117 const SMB_STRUCT_STAT *sbuf,
3118 struct pai_val *pal,
3119 SMB_ACL_T posix_acl,
3121 uint32_t security_info,
3122 struct security_descriptor **ppdesc)
3124 struct dom_sid owner_sid;
3125 struct dom_sid group_sid;
3127 struct security_acl *psa = NULL;
3128 size_t num_acls = 0;
3129 size_t num_def_acls = 0;
3130 size_t num_aces = 0;
3131 canon_ace *file_ace = NULL;
3132 canon_ace *dir_ace = NULL;
3133 struct security_ace *nt_ace_list = NULL;
3134 size_t num_profile_acls = 0;
3135 struct dom_sid orig_owner_sid;
3136 struct security_descriptor *psd = NULL;
3140 * Get the owner, group and world SIDs.
3143 create_file_sids(sbuf, &owner_sid, &group_sid);
3145 if (lp_profile_acls(SNUM(conn))) {
3146 /* For WXP SP1 the owner must be administrators. */
3147 sid_copy(&orig_owner_sid, &owner_sid);
3148 sid_copy(&owner_sid, &global_sid_Builtin_Administrators);
3149 sid_copy(&group_sid, &global_sid_Builtin_Users);
3150 num_profile_acls = 3;
3153 if ((security_info & SECINFO_DACL) && !(security_info & SECINFO_PROTECTED_DACL)) {
3156 * In the optimum case Creator Owner and Creator Group would be used for
3157 * the ACL_USER_OBJ and ACL_GROUP_OBJ entries, respectively, but this
3158 * would lead to usability problems under Windows: The Creator entries
3159 * are only available in browse lists of directories and not for files;
3160 * additionally the identity of the owning group couldn't be determined.
3161 * We therefore use those identities only for Default ACLs.
3164 /* Create the canon_ace lists. */
3165 file_ace = canonicalise_acl(conn, name, posix_acl, sbuf,
3166 &owner_sid, &group_sid, pal,
3167 SMB_ACL_TYPE_ACCESS);
3169 /* We must have *some* ACLS. */
3171 if (count_canon_ace_list(file_ace) == 0) {
3172 DEBUG(0,("get_nt_acl : No ACLs on file (%s) !\n", name));
3176 if (S_ISDIR(sbuf->st_ex_mode) && def_acl) {
3177 dir_ace = canonicalise_acl(conn, name, def_acl,
3179 &global_sid_Creator_Owner,
3180 &global_sid_Creator_Group,
3181 pal, SMB_ACL_TYPE_DEFAULT);
3185 * Create the NT ACE list from the canonical ace lists.
3190 enum security_ace_type nt_acl_type;
3192 if (nt4_compatible_acls() && dir_ace) {
3194 * NT 4 chokes if an ACL contains an INHERIT_ONLY entry
3195 * but no non-INHERIT_ONLY entry for one SID. So we only
3196 * remove entries from the Access ACL if the
3197 * corresponding Default ACL entries have also been
3198 * removed. ACEs for CREATOR-OWNER and CREATOR-GROUP
3199 * are exceptions. We can do nothing
3200 * intelligent if the Default ACL contains entries that
3201 * are not also contained in the Access ACL, so this
3202 * case will still fail under NT 4.
3205 ace = canon_ace_entry_for(dir_ace, SMB_ACL_OTHER, NULL);
3206 if (ace && !ace->perms) {
3207 DLIST_REMOVE(dir_ace, ace);
3210 ace = canon_ace_entry_for(file_ace, SMB_ACL_OTHER, NULL);
3211 if (ace && !ace->perms) {
3212 DLIST_REMOVE(file_ace, ace);
3218 * WinNT doesn't usually have Creator Group
3219 * in browse lists, so we send this entry to
3220 * WinNT even if it contains no relevant
3221 * permissions. Once we can add
3222 * Creator Group to browse lists we can
3227 ace = canon_ace_entry_for(dir_ace, SMB_ACL_GROUP_OBJ, NULL);
3228 if (ace && !ace->perms) {
3229 DLIST_REMOVE(dir_ace, ace);
3234 ace = canon_ace_entry_for(file_ace, SMB_ACL_GROUP_OBJ, NULL);
3235 if (ace && !ace->perms) {
3236 DLIST_REMOVE(file_ace, ace);
3241 num_acls = count_canon_ace_list(file_ace);
3242 num_def_acls = count_canon_ace_list(dir_ace);
3244 /* Allocate the ace list. */
3245 if ((nt_ace_list = SMB_MALLOC_ARRAY(struct security_ace,num_acls + num_profile_acls + num_def_acls)) == NULL) {
3246 DEBUG(0,("get_nt_acl: Unable to malloc space for nt_ace_list.\n"));
3250 memset(nt_ace_list, '\0', (num_acls + num_def_acls) * sizeof(struct security_ace) );
3253 * Create the NT ACE list from the canonical ace lists.
3256 for (ace = file_ace; ace != NULL; ace = ace->next) {
3257 uint32_t acc = map_canon_ace_perms(SNUM(conn),
3260 S_ISDIR(sbuf->st_ex_mode));
3261 init_sec_ace(&nt_ace_list[num_aces++],
3268 /* The User must have access to a profile share - even
3269 * if we can't map the SID. */
3270 if (lp_profile_acls(SNUM(conn))) {
3271 add_or_replace_ace(nt_ace_list, &num_aces,
3272 &global_sid_Builtin_Users,
3273 SEC_ACE_TYPE_ACCESS_ALLOWED,
3274 FILE_GENERIC_ALL, 0);
3277 for (ace = dir_ace; ace != NULL; ace = ace->next) {
3278 uint32_t acc = map_canon_ace_perms(SNUM(conn),
3281 S_ISDIR(sbuf->st_ex_mode));
3282 init_sec_ace(&nt_ace_list[num_aces++],
3287 SEC_ACE_FLAG_OBJECT_INHERIT|
3288 SEC_ACE_FLAG_CONTAINER_INHERIT|
3289 SEC_ACE_FLAG_INHERIT_ONLY);
3292 /* The User must have access to a profile share - even
3293 * if we can't map the SID. */
3294 if (lp_profile_acls(SNUM(conn))) {
3295 add_or_replace_ace(nt_ace_list, &num_aces,
3296 &global_sid_Builtin_Users,
3297 SEC_ACE_TYPE_ACCESS_ALLOWED,
3299 SEC_ACE_FLAG_OBJECT_INHERIT |
3300 SEC_ACE_FLAG_CONTAINER_INHERIT |
3301 SEC_ACE_FLAG_INHERIT_ONLY);
3305 * Merge POSIX default ACLs and normal ACLs into one NT ACE.
3306 * Win2K needs this to get the inheritance correct when replacing ACLs
3307 * on a directory tree. Based on work by Jim @ IBM.
3310 num_aces = merge_default_aces(nt_ace_list, num_aces);
3312 if (lp_profile_acls(SNUM(conn))) {
3313 for (i = 0; i < num_aces; i++) {
3314 if (dom_sid_equal(&nt_ace_list[i].trustee, &owner_sid)) {
3315 add_or_replace_ace(nt_ace_list, &num_aces,
3317 nt_ace_list[i].type,
3318 nt_ace_list[i].access_mask,
3319 nt_ace_list[i].flags);
3327 if((psa = make_sec_acl( talloc_tos(), NT4_ACL_REVISION, num_aces, nt_ace_list)) == NULL) {
3328 DEBUG(0,("get_nt_acl: Unable to malloc space for acl.\n"));
3332 } /* security_info & SECINFO_DACL */
3334 psd = make_standard_sec_desc( talloc_tos(),
3335 (security_info & SECINFO_OWNER) ? &owner_sid : NULL,
3336 (security_info & SECINFO_GROUP) ? &group_sid : NULL,
3341 DEBUG(0,("get_nt_acl: Unable to malloc space for security descriptor.\n"));
3347 * Windows 2000: The DACL_PROTECTED flag in the security
3348 * descriptor marks the ACL as non-inheriting, i.e., no
3349 * ACEs from higher level directories propagate to this
3350 * ACL. In the POSIX ACL model permissions are only
3351 * inherited at file create time, so ACLs never contain
3352 * any ACEs that are inherited dynamically. The DACL_PROTECTED
3353 * flag doesn't seem to bother Windows NT.
3354 * Always set this if map acl inherit is turned off.
3356 if (pal == NULL || !lp_map_acl_inherit(SNUM(conn))) {
3357 psd->type |= SEC_DESC_DACL_PROTECTED;
3359 psd->type |= pal->sd_type;
3363 dacl_sort_into_canonical_order(psd->dacl->aces, (unsigned int)psd->dacl->num_aces);
3371 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
3374 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
3376 free_canon_ace_list(file_ace);
3377 free_canon_ace_list(dir_ace);
3378 free_inherited_info(pal);
3379 SAFE_FREE(nt_ace_list);
3381 return NT_STATUS_OK;
3384 NTSTATUS posix_fget_nt_acl(struct files_struct *fsp, uint32_t security_info,
3385 struct security_descriptor **ppdesc)
3387 SMB_STRUCT_STAT sbuf;
3388 SMB_ACL_T posix_acl = NULL;
3389 struct pai_val *pal;
3393 DEBUG(10,("posix_fget_nt_acl: called for file %s\n",
3396 /* can it happen that fsp_name == NULL ? */
3397 if (fsp->is_directory || fsp->fh->fd == -1) {
3398 return posix_get_nt_acl(fsp->conn, fsp->fsp_name->base_name,
3399 security_info, ppdesc);
3402 /* Get the stat struct for the owner info. */
3403 if(SMB_VFS_FSTAT(fsp, &sbuf) != 0) {
3404 return map_nt_error_from_unix(errno);
3407 /* Get the ACL from the fd. */
3408 posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp);
3410 pal = fload_inherited_info(fsp);
3412 return posix_get_nt_acl_common(fsp->conn, fsp->fsp_name->base_name,
3413 &sbuf, pal, posix_acl, NULL,
3414 security_info, ppdesc);
3417 NTSTATUS posix_get_nt_acl(struct connection_struct *conn, const char *name,
3418 uint32_t security_info, struct security_descriptor **ppdesc)
3420 SMB_ACL_T posix_acl = NULL;
3421 SMB_ACL_T def_acl = NULL;
3422 struct pai_val *pal;
3423 struct smb_filename smb_fname;
3428 DEBUG(10,("posix_get_nt_acl: called for file %s\n", name ));
3430 ZERO_STRUCT(smb_fname);
3431 smb_fname.base_name = discard_const_p(char, name);
3433 /* Get the stat struct for the owner info. */
3434 if (lp_posix_pathnames()) {
3435 ret = SMB_VFS_LSTAT(conn, &smb_fname);
3437 ret = SMB_VFS_STAT(conn, &smb_fname);
3441 return map_nt_error_from_unix(errno);
3444 /* Get the ACL from the path. */
3445 posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name, SMB_ACL_TYPE_ACCESS);
3447 /* If it's a directory get the default POSIX ACL. */
3448 if(S_ISDIR(smb_fname.st.st_ex_mode)) {
3449 def_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name, SMB_ACL_TYPE_DEFAULT);
3450 def_acl = free_empty_sys_acl(conn, def_acl);
3453 pal = load_inherited_info(conn, name);
3455 return posix_get_nt_acl_common(conn, name, &smb_fname.st, pal,
3456 posix_acl, def_acl, security_info,
3460 /****************************************************************************
3461 Try to chown a file. We will be able to chown it under the following conditions.
3463 1) If we have root privileges, then it will just work.
3464 2) If we have SeRestorePrivilege we can change the user + group to any other user.
3465 3) If we have SeTakeOwnershipPrivilege we can change the user to the current user.
3466 4) If we have write permission to the file and dos_filemodes is set
3467 then allow chown to the currently authenticated user.
3468 ****************************************************************************/
3470 NTSTATUS try_chown(files_struct *fsp, uid_t uid, gid_t gid)
3474 if(!CAN_WRITE(fsp->conn)) {
3475 return NT_STATUS_MEDIA_WRITE_PROTECTED;
3479 status = vfs_chown_fsp(fsp, uid, gid);
3480 if (NT_STATUS_IS_OK(status)) {
3484 /* Case (2) / (3) */
3485 if (lp_enable_privileges()) {
3486 bool has_take_ownership_priv = security_token_has_privilege(
3487 get_current_nttok(fsp->conn),
3488 SEC_PRIV_TAKE_OWNERSHIP);
3489 bool has_restore_priv = security_token_has_privilege(
3490 get_current_nttok(fsp->conn),
3493 if (has_restore_priv) {
3495 } else if (has_take_ownership_priv) {
3497 if (uid == get_current_uid(fsp->conn)) {
3500 has_take_ownership_priv = false;
3504 if (has_take_ownership_priv || has_restore_priv) {
3506 status = vfs_chown_fsp(fsp, uid, gid);
3513 if (!lp_dos_filemode(SNUM(fsp->conn))) {
3514 return NT_STATUS_ACCESS_DENIED;
3517 /* only allow chown to the current user. This is more secure,
3518 and also copes with the case where the SID in a take ownership ACL is
3519 a local SID on the users workstation
3521 if (uid != get_current_uid(fsp->conn)) {
3522 return NT_STATUS_ACCESS_DENIED;
3526 /* Keep the current file gid the same. */
3527 status = vfs_chown_fsp(fsp, uid, (gid_t)-1);
3534 /* Disable this - prevents ACL inheritance from the ACL editor. JRA. */
3536 /****************************************************************************
3537 Take care of parent ACL inheritance.
3538 ****************************************************************************/
3540 NTSTATUS append_parent_acl(files_struct *fsp,
3541 const struct security_descriptor *pcsd,
3542 struct security_descriptor **pp_new_sd)
3544 struct smb_filename *smb_dname = NULL;
3545 struct security_descriptor *parent_sd = NULL;
3546 files_struct *parent_fsp = NULL;
3547 TALLOC_CTX *mem_ctx = talloc_tos();
3548 char *parent_name = NULL;
3549 struct security_ace *new_ace = NULL;
3550 unsigned int num_aces = pcsd->dacl->num_aces;
3554 struct security_descriptor *psd = dup_sec_desc(talloc_tos(), pcsd);
3555 bool is_dacl_protected = (pcsd->type & SEC_DESC_DACL_PROTECTED);
3558 return NT_STATUS_NO_MEMORY;
3561 if (!parent_dirname(mem_ctx, fsp->fsp_name->base_name, &parent_name,
3563 return NT_STATUS_NO_MEMORY;
3566 status = create_synthetic_smb_fname(mem_ctx, parent_name, NULL, NULL,
3568 if (!NT_STATUS_IS_OK(status)) {
3572 status = SMB_VFS_CREATE_FILE(
3573 fsp->conn, /* conn */
3575 0, /* root_dir_fid */
3576 smb_dname, /* fname */
3577 FILE_READ_ATTRIBUTES, /* access_mask */
3578 FILE_SHARE_NONE, /* share_access */
3579 FILE_OPEN, /* create_disposition*/
3580 FILE_DIRECTORY_FILE, /* create_options */
3581 0, /* file_attributes */
3582 INTERNAL_OPEN_ONLY, /* oplock_request */
3583 0, /* allocation_size */
3586 &parent_fsp, /* result */
3589 if (!NT_STATUS_IS_OK(status)) {
3590 TALLOC_FREE(smb_dname);
3594 status = SMB_VFS_GET_NT_ACL(parent_fsp->conn, smb_dname->base_name,
3595 SECINFO_DACL, &parent_sd );
3597 close_file(NULL, parent_fsp, NORMAL_CLOSE);
3598 TALLOC_FREE(smb_dname);
3600 if (!NT_STATUS_IS_OK(status)) {
3605 * Make room for potentially all the ACLs from
3606 * the parent. We used to add the ugw triple here,
3607 * as we knew we were dealing with POSIX ACLs.
3608 * We no longer need to do so as we can guarentee
3609 * that a default ACL from the parent directory will
3610 * be well formed for POSIX ACLs if it came from a
3611 * POSIX ACL source, and if we're not writing to a
3612 * POSIX ACL sink then we don't care if it's not well
3616 num_aces += parent_sd->dacl->num_aces;
3618 if((new_ace = TALLOC_ZERO_ARRAY(mem_ctx, struct security_ace,
3619 num_aces)) == NULL) {
3620 return NT_STATUS_NO_MEMORY;
3623 /* Start by copying in all the given ACE entries. */
3624 for (i = 0; i < psd->dacl->num_aces; i++) {
3625 sec_ace_copy(&new_ace[i], &psd->dacl->aces[i]);
3629 * Note that we're ignoring "inherit permissions" here
3630 * as that really only applies to newly created files. JRA.
3633 /* Finally append any inherited ACEs. */
3634 for (j = 0; j < parent_sd->dacl->num_aces; j++) {
3635 struct security_ace *se = &parent_sd->dacl->aces[j];
3637 if (fsp->is_directory) {
3638 if (!(se->flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
3639 /* Doesn't apply to a directory - ignore. */
3640 DEBUG(10,("append_parent_acl: directory %s "
3641 "ignoring non container "
3642 "inherit flags %u on ACE with sid %s "
3645 (unsigned int)se->flags,
3646 sid_string_dbg(&se->trustee),
3651 if (!(se->flags & SEC_ACE_FLAG_OBJECT_INHERIT)) {
3652 /* Doesn't apply to a file - ignore. */
3653 DEBUG(10,("append_parent_acl: file %s "
3654 "ignoring non object "
3655 "inherit flags %u on ACE with sid %s "
3658 (unsigned int)se->flags,
3659 sid_string_dbg(&se->trustee),
3665 if (is_dacl_protected) {
3666 /* If the DACL is protected it means we must
3667 * not overwrite an existing ACE entry with the
3668 * same SID. This is order N^2. Ouch :-(. JRA. */
3670 for (k = 0; k < psd->dacl->num_aces; k++) {
3671 if (dom_sid_equal(&psd->dacl->aces[k].trustee,
3676 if (k < psd->dacl->num_aces) {
3677 /* SID matched. Ignore. */
3678 DEBUG(10,("append_parent_acl: path %s "
3679 "ignoring ACE with protected sid %s "
3682 sid_string_dbg(&se->trustee),
3688 sec_ace_copy(&new_ace[i], se);
3689 if (se->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
3690 new_ace[i].flags &= ~(SEC_ACE_FLAG_VALID_INHERIT);
3692 new_ace[i].flags |= SEC_ACE_FLAG_INHERITED_ACE;
3694 if (fsp->is_directory) {
3696 * Strip off any inherit only. It's applied.
3698 new_ace[i].flags &= ~(SEC_ACE_FLAG_INHERIT_ONLY);
3699 if (se->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
3700 /* No further inheritance. */
3702 ~(SEC_ACE_FLAG_CONTAINER_INHERIT|
3703 SEC_ACE_FLAG_OBJECT_INHERIT);
3707 * Strip off any container or inherit
3708 * flags, they can't apply to objects.
3710 new_ace[i].flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|
3711 SEC_ACE_FLAG_INHERIT_ONLY|
3712 SEC_ACE_FLAG_NO_PROPAGATE_INHERIT);
3716 DEBUG(10,("append_parent_acl: path %s "
3717 "inheriting ACE with sid %s "
3720 sid_string_dbg(&se->trustee),
3724 psd->dacl->aces = new_ace;
3725 psd->dacl->num_aces = i;
3726 psd->type &= ~(SEC_DESC_DACL_AUTO_INHERITED|
3727 SEC_DESC_DACL_AUTO_INHERIT_REQ);
3734 /****************************************************************************
3735 Reply to set a security descriptor on an fsp. security_info_sent is the
3736 description of the following NT ACL.
3737 This should be the only external function needed for the UNIX style set ACL.
3738 We make a copy of psd_orig as internal functions modify the elements inside
3739 it, even though it's a const pointer.
3740 ****************************************************************************/
3742 NTSTATUS set_nt_acl(files_struct *fsp, uint32 security_info_sent, const struct security_descriptor *psd_orig)
3744 connection_struct *conn = fsp->conn;
3745 uid_t user = (uid_t)-1;
3746 gid_t grp = (gid_t)-1;
3747 struct dom_sid file_owner_sid;
3748 struct dom_sid file_grp_sid;
3749 canon_ace *file_ace_list = NULL;
3750 canon_ace *dir_ace_list = NULL;
3751 bool acl_perms = False;
3752 mode_t orig_mode = (mode_t)0;
3754 bool set_acl_as_root = false;
3755 bool acl_set_support = false;
3757 struct security_descriptor *psd = NULL;
3759 DEBUG(10,("set_nt_acl: called for file %s\n",
3762 if (!CAN_WRITE(conn)) {
3763 DEBUG(10,("set acl rejected on read-only share\n"));
3764 return NT_STATUS_MEDIA_WRITE_PROTECTED;
3768 return NT_STATUS_INVALID_PARAMETER;
3771 psd = dup_sec_desc(talloc_tos(), psd_orig);
3773 return NT_STATUS_NO_MEMORY;
3777 * Get the current state of the file.
3780 status = vfs_stat_fsp(fsp);
3781 if (!NT_STATUS_IS_OK(status)) {
3785 /* Save the original element we check against. */
3786 orig_mode = fsp->fsp_name->st.st_ex_mode;
3789 * Unpack the user/group/world id's.
3792 /* POSIX can't cope with missing owner/group. */
3793 if ((security_info_sent & SECINFO_OWNER) && (psd->owner_sid == NULL)) {
3794 security_info_sent &= ~SECINFO_OWNER;
3796 if ((security_info_sent & SECINFO_GROUP) && (psd->group_sid == NULL)) {
3797 security_info_sent &= ~SECINFO_GROUP;
3800 status = unpack_nt_owners( conn, &user, &grp, security_info_sent, psd);
3801 if (!NT_STATUS_IS_OK(status)) {
3806 * Do we need to chown ? If so this must be done first as the incoming
3807 * CREATOR_OWNER acl will be relative to the *new* owner, not the old.
3811 if (((user != (uid_t)-1) && (fsp->fsp_name->st.st_ex_uid != user)) ||
3812 (( grp != (gid_t)-1) && (fsp->fsp_name->st.st_ex_gid != grp))) {
3814 DEBUG(3,("set_nt_acl: chown %s. uid = %u, gid = %u.\n",
3815 fsp_str_dbg(fsp), (unsigned int)user,
3816 (unsigned int)grp));
3818 status = try_chown(fsp, user, grp);
3819 if(!NT_STATUS_IS_OK(status)) {
3820 DEBUG(3,("set_nt_acl: chown %s, %u, %u failed. Error "
3821 "= %s.\n", fsp_str_dbg(fsp),
3824 nt_errstr(status)));
3829 * Recheck the current state of the file, which may have changed.
3830 * (suid/sgid bits, for instance)
3833 status = vfs_stat_fsp(fsp);
3834 if (!NT_STATUS_IS_OK(status)) {
3838 /* Save the original element we check against. */
3839 orig_mode = fsp->fsp_name->st.st_ex_mode;
3841 /* If we successfully chowned, we know we must
3842 * be able to set the acl, so do it as root.
3844 set_acl_as_root = true;
3847 create_file_sids(&fsp->fsp_name->st, &file_owner_sid, &file_grp_sid);
3849 if((security_info_sent & SECINFO_DACL) &&
3850 (psd->type & SEC_DESC_DACL_PRESENT) &&
3851 (psd->dacl == NULL)) {
3852 struct security_ace ace[3];
3854 /* We can't have NULL DACL in POSIX.
3855 Use owner/group/Everyone -> full access. */
3857 init_sec_ace(&ace[0],
3859 SEC_ACE_TYPE_ACCESS_ALLOWED,
3862 init_sec_ace(&ace[1],
3864 SEC_ACE_TYPE_ACCESS_ALLOWED,
3867 init_sec_ace(&ace[2],
3869 SEC_ACE_TYPE_ACCESS_ALLOWED,
3872 psd->dacl = make_sec_acl(talloc_tos(),
3876 if (psd->dacl == NULL) {
3877 return NT_STATUS_NO_MEMORY;
3879 security_acl_map_generic(psd->dacl, &file_generic_mapping);
3882 acl_perms = unpack_canon_ace(fsp, &fsp->fsp_name->st, &file_owner_sid,
3883 &file_grp_sid, &file_ace_list,
3884 &dir_ace_list, security_info_sent, psd);
3886 /* Ignore W2K traverse DACL set. */
3887 if (!file_ace_list && !dir_ace_list) {
3888 return NT_STATUS_OK;
3892 DEBUG(3,("set_nt_acl: cannot set permissions\n"));
3893 free_canon_ace_list(file_ace_list);
3894 free_canon_ace_list(dir_ace_list);
3895 return NT_STATUS_ACCESS_DENIED;
3899 * Only change security if we got a DACL.
3902 if(!(security_info_sent & SECINFO_DACL) || (psd->dacl == NULL)) {
3903 free_canon_ace_list(file_ace_list);
3904 free_canon_ace_list(dir_ace_list);
3905 return NT_STATUS_OK;
3909 * Try using the POSIX ACL set first. Fall back to chmod if
3910 * we have no ACL support on this filesystem.
3913 if (acl_perms && file_ace_list) {
3914 if (set_acl_as_root) {
3917 ret = set_canon_ace_list(fsp, file_ace_list, false,
3918 &fsp->fsp_name->st, &acl_set_support);
3919 if (set_acl_as_root) {
3922 if (acl_set_support && ret == false) {
3923 DEBUG(3,("set_nt_acl: failed to set file acl on file "
3924 "%s (%s).\n", fsp_str_dbg(fsp),
3926 free_canon_ace_list(file_ace_list);
3927 free_canon_ace_list(dir_ace_list);
3928 return map_nt_error_from_unix(errno);
3932 if (acl_perms && acl_set_support && fsp->is_directory) {
3934 if (set_acl_as_root) {
3937 ret = set_canon_ace_list(fsp, dir_ace_list, true,
3940 if (set_acl_as_root) {
3944 DEBUG(3,("set_nt_acl: failed to set default "
3945 "acl on directory %s (%s).\n",
3946 fsp_str_dbg(fsp), strerror(errno)));
3947 free_canon_ace_list(file_ace_list);
3948 free_canon_ace_list(dir_ace_list);
3949 return map_nt_error_from_unix(errno);
3955 * No default ACL - delete one if it exists.
3958 if (set_acl_as_root) {
3961 sret = SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn,
3962 fsp->fsp_name->base_name);
3963 if (set_acl_as_root) {
3967 if (acl_group_override(conn, fsp->fsp_name)) {
3968 DEBUG(5,("set_nt_acl: acl group "
3969 "control on and current user "
3970 "in file %s primary group. "
3971 "Override delete_def_acl\n",
3976 SMB_VFS_SYS_ACL_DELETE_DEF_FILE(
3978 fsp->fsp_name->base_name);
3983 DEBUG(3,("set_nt_acl: sys_acl_delete_def_file failed (%s)\n", strerror(errno)));
3984 free_canon_ace_list(file_ace_list);
3985 free_canon_ace_list(dir_ace_list);
3986 return map_nt_error_from_unix(errno);
3992 if (acl_set_support) {
3993 if (set_acl_as_root) {
3996 store_inheritance_attributes(fsp,
4000 if (set_acl_as_root) {
4006 * If we cannot set using POSIX ACLs we fall back to checking if we need to chmod.
4009 if(!acl_set_support && acl_perms) {
4012 if (!convert_canon_ace_to_posix_perms( fsp, file_ace_list, &posix_perms)) {
4013 free_canon_ace_list(file_ace_list);
4014 free_canon_ace_list(dir_ace_list);
4015 DEBUG(3,("set_nt_acl: failed to convert file acl to "
4016 "posix permissions for file %s.\n",
4018 return NT_STATUS_ACCESS_DENIED;
4021 if (orig_mode != posix_perms) {
4024 DEBUG(3,("set_nt_acl: chmod %s. perms = 0%o.\n",
4025 fsp_str_dbg(fsp), (unsigned int)posix_perms));
4027 if (set_acl_as_root) {
4030 sret = SMB_VFS_CHMOD(conn, fsp->fsp_name->base_name,
4032 if (set_acl_as_root) {
4036 if (acl_group_override(conn, fsp->fsp_name)) {
4037 DEBUG(5,("set_nt_acl: acl group "
4038 "control on and current user "
4039 "in file %s primary group. "
4044 sret = SMB_VFS_CHMOD(conn,
4045 fsp->fsp_name->base_name,
4051 DEBUG(3,("set_nt_acl: chmod %s, 0%o "
4052 "failed. Error = %s.\n",
4054 (unsigned int)posix_perms,
4056 free_canon_ace_list(file_ace_list);
4057 free_canon_ace_list(dir_ace_list);
4058 return map_nt_error_from_unix(errno);
4064 free_canon_ace_list(file_ace_list);
4065 free_canon_ace_list(dir_ace_list);
4067 /* Ensure the stat struct in the fsp is correct. */
4068 status = vfs_stat_fsp(fsp);
4070 return NT_STATUS_OK;
4073 /****************************************************************************
4074 Get the actual group bits stored on a file with an ACL. Has no effect if
4075 the file has no ACL. Needed in dosmode code where the stat() will return
4076 the mask bits, not the real group bits, for a file with an ACL.
4077 ****************************************************************************/
4079 int get_acl_group_bits( connection_struct *conn, const char *fname, mode_t *mode )
4081 int entry_id = SMB_ACL_FIRST_ENTRY;
4082 SMB_ACL_ENTRY_T entry;
4083 SMB_ACL_T posix_acl;
4086 posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS);
4087 if (posix_acl == (SMB_ACL_T)NULL)
4090 while (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) {
4091 SMB_ACL_TAG_T tagtype;
4092 SMB_ACL_PERMSET_T permset;
4094 entry_id = SMB_ACL_NEXT_ENTRY;
4096 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) ==-1)
4099 if (tagtype == SMB_ACL_GROUP_OBJ) {
4100 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1) {
4103 *mode &= ~(S_IRGRP|S_IWGRP|S_IXGRP);
4104 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ) ? S_IRGRP : 0);
4105 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE) ? S_IWGRP : 0);
4106 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_EXECUTE) ? S_IXGRP : 0);
4112 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
4116 /****************************************************************************
4117 Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4118 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4119 ****************************************************************************/
4121 static int chmod_acl_internals( connection_struct *conn, SMB_ACL_T posix_acl, mode_t mode)
4123 int entry_id = SMB_ACL_FIRST_ENTRY;
4124 SMB_ACL_ENTRY_T entry;
4125 int num_entries = 0;
4127 while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) {
4128 SMB_ACL_TAG_T tagtype;
4129 SMB_ACL_PERMSET_T permset;
4132 entry_id = SMB_ACL_NEXT_ENTRY;
4134 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1)
4137 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1)
4143 case SMB_ACL_USER_OBJ:
4144 perms = unix_perms_to_acl_perms(mode, S_IRUSR, S_IWUSR, S_IXUSR);
4146 case SMB_ACL_GROUP_OBJ:
4147 perms = unix_perms_to_acl_perms(mode, S_IRGRP, S_IWGRP, S_IXGRP);
4151 * FIXME: The ACL_MASK entry permissions should really be set to
4152 * the union of the permissions of all ACL_USER,
4153 * ACL_GROUP_OBJ, and ACL_GROUP entries. That's what
4154 * acl_calc_mask() does, but Samba ACLs doesn't provide it.
4156 perms = S_IRUSR|S_IWUSR|S_IXUSR;
4159 perms = unix_perms_to_acl_perms(mode, S_IROTH, S_IWOTH, S_IXOTH);
4165 if (map_acl_perms_to_permset(conn, perms, &permset) == -1)
4168 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, entry, permset) == -1)
4173 * If this is a simple 3 element ACL or no elements then it's a standard
4174 * UNIX permission set. Just use chmod...
4177 if ((num_entries == 3) || (num_entries == 0))
4183 /****************************************************************************
4184 Get the access ACL of FROM, do a chmod by setting the ACL USER_OBJ,
4185 GROUP_OBJ and OTHER bits in an ACL and set the mask to rwx. Set the
4186 resulting ACL on TO. Note that name is in UNIX character set.
4187 ****************************************************************************/
4189 static int copy_access_posix_acl(connection_struct *conn, const char *from, const char *to, mode_t mode)
4191 SMB_ACL_T posix_acl = NULL;
4194 if ((posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, from, SMB_ACL_TYPE_ACCESS)) == NULL)
4197 if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
4200 ret = SMB_VFS_SYS_ACL_SET_FILE(conn, to, SMB_ACL_TYPE_ACCESS, posix_acl);
4204 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
4208 /****************************************************************************
4209 Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4210 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4211 Note that name is in UNIX character set.
4212 ****************************************************************************/
4214 int chmod_acl(connection_struct *conn, const char *name, mode_t mode)
4216 return copy_access_posix_acl(conn, name, name, mode);
4219 /****************************************************************************
4220 Check for an existing default POSIX ACL on a directory.
4221 ****************************************************************************/
4223 static bool directory_has_default_posix_acl(connection_struct *conn, const char *fname)
4225 SMB_ACL_T def_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_DEFAULT);
4226 bool has_acl = False;
4227 SMB_ACL_ENTRY_T entry;
4229 if (def_acl != NULL && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, def_acl, SMB_ACL_FIRST_ENTRY, &entry) == 1)) {
4234 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4239 /****************************************************************************
4240 If the parent directory has no default ACL but it does have an Access ACL,
4241 inherit this Access ACL to file name.
4242 ****************************************************************************/
4244 int inherit_access_posix_acl(connection_struct *conn, const char *inherit_from_dir,
4245 const char *name, mode_t mode)
4247 if (directory_has_default_posix_acl(conn, inherit_from_dir))
4250 return copy_access_posix_acl(conn, inherit_from_dir, name, mode);
4253 /****************************************************************************
4254 Do an fchmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4255 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4256 ****************************************************************************/
4258 int fchmod_acl(files_struct *fsp, mode_t mode)
4260 connection_struct *conn = fsp->conn;
4261 SMB_ACL_T posix_acl = NULL;
4264 if ((posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp)) == NULL)
4267 if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
4270 ret = SMB_VFS_SYS_ACL_SET_FD(fsp, posix_acl);
4274 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
4278 /****************************************************************************
4279 Map from wire type to permset.
4280 ****************************************************************************/
4282 static bool unix_ex_wire_to_permset(connection_struct *conn, unsigned char wire_perm, SMB_ACL_PERMSET_T *p_permset)
4284 if (wire_perm & ~(SMB_POSIX_ACL_READ|SMB_POSIX_ACL_WRITE|SMB_POSIX_ACL_EXECUTE)) {
4288 if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn, *p_permset) == -1) {
4292 if (wire_perm & SMB_POSIX_ACL_READ) {
4293 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_READ) == -1) {
4297 if (wire_perm & SMB_POSIX_ACL_WRITE) {
4298 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_WRITE) == -1) {
4302 if (wire_perm & SMB_POSIX_ACL_EXECUTE) {
4303 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_EXECUTE) == -1) {
4310 /****************************************************************************
4311 Map from wire type to tagtype.
4312 ****************************************************************************/
4314 static bool unix_ex_wire_to_tagtype(unsigned char wire_tt, SMB_ACL_TAG_T *p_tt)
4317 case SMB_POSIX_ACL_USER_OBJ:
4318 *p_tt = SMB_ACL_USER_OBJ;
4320 case SMB_POSIX_ACL_USER:
4321 *p_tt = SMB_ACL_USER;
4323 case SMB_POSIX_ACL_GROUP_OBJ:
4324 *p_tt = SMB_ACL_GROUP_OBJ;
4326 case SMB_POSIX_ACL_GROUP:
4327 *p_tt = SMB_ACL_GROUP;
4329 case SMB_POSIX_ACL_MASK:
4330 *p_tt = SMB_ACL_MASK;
4332 case SMB_POSIX_ACL_OTHER:
4333 *p_tt = SMB_ACL_OTHER;
4341 /****************************************************************************
4342 Create a new POSIX acl from wire permissions.
4343 FIXME ! How does the share mask/mode fit into this.... ?
4344 ****************************************************************************/
4346 static SMB_ACL_T create_posix_acl_from_wire(connection_struct *conn, uint16 num_acls, const char *pdata)
4349 SMB_ACL_T the_acl = SMB_VFS_SYS_ACL_INIT(conn, num_acls);
4351 if (the_acl == NULL) {
4355 for (i = 0; i < num_acls; i++) {
4356 SMB_ACL_ENTRY_T the_entry;
4357 SMB_ACL_PERMSET_T the_permset;
4358 SMB_ACL_TAG_T tag_type;
4360 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &the_entry) == -1) {
4361 DEBUG(0,("create_posix_acl_from_wire: Failed to create entry %u. (%s)\n",
4362 i, strerror(errno) ));
4366 if (!unix_ex_wire_to_tagtype(CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)), &tag_type)) {
4367 DEBUG(0,("create_posix_acl_from_wire: invalid wire tagtype %u on entry %u.\n",
4368 CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)), i ));
4372 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, the_entry, tag_type) == -1) {
4373 DEBUG(0,("create_posix_acl_from_wire: Failed to set tagtype on entry %u. (%s)\n",
4374 i, strerror(errno) ));
4378 /* Get the permset pointer from the new ACL entry. */
4379 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, the_entry, &the_permset) == -1) {
4380 DEBUG(0,("create_posix_acl_from_wire: Failed to get permset on entry %u. (%s)\n",
4381 i, strerror(errno) ));
4385 /* Map from wire to permissions. */
4386 if (!unix_ex_wire_to_permset(conn, CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+1), &the_permset)) {
4387 DEBUG(0,("create_posix_acl_from_wire: invalid permset %u on entry %u.\n",
4388 CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE) + 1), i ));
4392 /* Now apply to the new ACL entry. */
4393 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, the_entry, the_permset) == -1) {
4394 DEBUG(0,("create_posix_acl_from_wire: Failed to add permset on entry %u. (%s)\n",
4395 i, strerror(errno) ));
4399 if (tag_type == SMB_ACL_USER) {
4400 uint32 uidval = IVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+2);
4401 uid_t uid = (uid_t)uidval;
4402 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&uid) == -1) {
4403 DEBUG(0,("create_posix_acl_from_wire: Failed to set uid %u on entry %u. (%s)\n",
4404 (unsigned int)uid, i, strerror(errno) ));
4409 if (tag_type == SMB_ACL_GROUP) {
4410 uint32 gidval = IVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+2);
4411 gid_t gid = (uid_t)gidval;
4412 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&gid) == -1) {
4413 DEBUG(0,("create_posix_acl_from_wire: Failed to set gid %u on entry %u. (%s)\n",
4414 (unsigned int)gid, i, strerror(errno) ));
4424 if (the_acl != NULL) {
4425 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
4430 /****************************************************************************
4431 Calls from UNIX extensions - Default POSIX ACL set.
4432 If num_def_acls == 0 and not a directory just return. If it is a directory
4433 and num_def_acls == 0 then remove the default acl. Else set the default acl
4435 ****************************************************************************/
4437 bool set_unix_posix_default_acl(connection_struct *conn, const char *fname, const SMB_STRUCT_STAT *psbuf,
4438 uint16 num_def_acls, const char *pdata)
4440 SMB_ACL_T def_acl = NULL;
4442 if (!S_ISDIR(psbuf->st_ex_mode)) {
4444 DEBUG(5,("set_unix_posix_default_acl: Can't set default ACL on non-directory file %s\n", fname ));
4452 if (!num_def_acls) {
4453 /* Remove the default ACL. */
4454 if (SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn, fname) == -1) {
4455 DEBUG(5,("set_unix_posix_default_acl: acl_delete_def_file failed on directory %s (%s)\n",
4456 fname, strerror(errno) ));
4462 if ((def_acl = create_posix_acl_from_wire(conn, num_def_acls, pdata)) == NULL) {
4466 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_DEFAULT, def_acl) == -1) {
4467 DEBUG(5,("set_unix_posix_default_acl: acl_set_file failed on directory %s (%s)\n",
4468 fname, strerror(errno) ));
4469 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4473 DEBUG(10,("set_unix_posix_default_acl: set default acl for file %s\n", fname ));
4474 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4478 /****************************************************************************
4479 Remove an ACL from a file. As we don't have acl_delete_entry() available
4480 we must read the current acl and copy all entries except MASK, USER and GROUP
4481 to a new acl, then set that. This (at least on Linux) causes any ACL to be
4483 FIXME ! How does the share mask/mode fit into this.... ?
4484 ****************************************************************************/
4486 static bool remove_posix_acl(connection_struct *conn, files_struct *fsp, const char *fname)
4488 SMB_ACL_T file_acl = NULL;
4489 int entry_id = SMB_ACL_FIRST_ENTRY;
4490 SMB_ACL_ENTRY_T entry;
4492 /* Create a new ACL with only 3 entries, u/g/w. */
4493 SMB_ACL_T new_file_acl = SMB_VFS_SYS_ACL_INIT(conn, 3);
4494 SMB_ACL_ENTRY_T user_ent = NULL;
4495 SMB_ACL_ENTRY_T group_ent = NULL;
4496 SMB_ACL_ENTRY_T other_ent = NULL;
4498 if (new_file_acl == NULL) {
4499 DEBUG(5,("remove_posix_acl: failed to init new ACL with 3 entries for file %s.\n", fname));
4503 /* Now create the u/g/w entries. */
4504 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &user_ent) == -1) {
4505 DEBUG(5,("remove_posix_acl: Failed to create user entry for file %s. (%s)\n",
4506 fname, strerror(errno) ));
4509 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, user_ent, SMB_ACL_USER_OBJ) == -1) {
4510 DEBUG(5,("remove_posix_acl: Failed to set user entry for file %s. (%s)\n",
4511 fname, strerror(errno) ));
4515 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &group_ent) == -1) {
4516 DEBUG(5,("remove_posix_acl: Failed to create group entry for file %s. (%s)\n",
4517 fname, strerror(errno) ));
4520 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, group_ent, SMB_ACL_GROUP_OBJ) == -1) {
4521 DEBUG(5,("remove_posix_acl: Failed to set group entry for file %s. (%s)\n",
4522 fname, strerror(errno) ));
4526 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &other_ent) == -1) {
4527 DEBUG(5,("remove_posix_acl: Failed to create other entry for file %s. (%s)\n",
4528 fname, strerror(errno) ));
4531 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, other_ent, SMB_ACL_OTHER) == -1) {
4532 DEBUG(5,("remove_posix_acl: Failed to set other entry for file %s. (%s)\n",
4533 fname, strerror(errno) ));
4537 /* Get the current file ACL. */
4538 if (fsp && fsp->fh->fd != -1) {
4539 file_acl = SMB_VFS_SYS_ACL_GET_FD(fsp);
4541 file_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_ACCESS);
4544 if (file_acl == NULL) {
4545 /* This is only returned if an error occurred. Even for a file with
4546 no acl a u/g/w acl should be returned. */
4547 DEBUG(5,("remove_posix_acl: failed to get ACL from file %s (%s).\n",
4548 fname, strerror(errno) ));
4552 while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, file_acl, entry_id, &entry) == 1) {
4553 SMB_ACL_TAG_T tagtype;
4554 SMB_ACL_PERMSET_T permset;
4556 entry_id = SMB_ACL_NEXT_ENTRY;
4558 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1) {
4559 DEBUG(5,("remove_posix_acl: failed to get tagtype from ACL on file %s (%s).\n",
4560 fname, strerror(errno) ));
4564 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1) {
4565 DEBUG(5,("remove_posix_acl: failed to get permset from ACL on file %s (%s).\n",
4566 fname, strerror(errno) ));
4570 if (tagtype == SMB_ACL_USER_OBJ) {
4571 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, user_ent, permset) == -1) {
4572 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4573 fname, strerror(errno) ));
4575 } else if (tagtype == SMB_ACL_GROUP_OBJ) {
4576 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, group_ent, permset) == -1) {
4577 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4578 fname, strerror(errno) ));
4580 } else if (tagtype == SMB_ACL_OTHER) {
4581 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, other_ent, permset) == -1) {
4582 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4583 fname, strerror(errno) ));
4588 /* Set the new empty file ACL. */
4589 if (fsp && fsp->fh->fd != -1) {
4590 if (SMB_VFS_SYS_ACL_SET_FD(fsp, new_file_acl) == -1) {
4591 DEBUG(5,("remove_posix_acl: acl_set_file failed on %s (%s)\n",
4592 fname, strerror(errno) ));
4596 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS, new_file_acl) == -1) {
4597 DEBUG(5,("remove_posix_acl: acl_set_file failed on %s (%s)\n",
4598 fname, strerror(errno) ));
4608 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4611 SMB_VFS_SYS_ACL_FREE_ACL(conn, new_file_acl);
4616 /****************************************************************************
4617 Calls from UNIX extensions - POSIX ACL set.
4618 If num_def_acls == 0 then read/modify/write acl after removing all entries
4619 except SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER.
4620 ****************************************************************************/
4622 bool set_unix_posix_acl(connection_struct *conn, files_struct *fsp, const char *fname, uint16 num_acls, const char *pdata)
4624 SMB_ACL_T file_acl = NULL;
4627 /* Remove the ACL from the file. */
4628 return remove_posix_acl(conn, fsp, fname);
4631 if ((file_acl = create_posix_acl_from_wire(conn, num_acls, pdata)) == NULL) {
4635 if (fsp && fsp->fh->fd != -1) {
4636 /* The preferred way - use an open fd. */
4637 if (SMB_VFS_SYS_ACL_SET_FD(fsp, file_acl) == -1) {
4638 DEBUG(5,("set_unix_posix_acl: acl_set_file failed on %s (%s)\n",
4639 fname, strerror(errno) ));
4640 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4644 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS, file_acl) == -1) {
4645 DEBUG(5,("set_unix_posix_acl: acl_set_file failed on %s (%s)\n",
4646 fname, strerror(errno) ));
4647 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4652 DEBUG(10,("set_unix_posix_acl: set acl for file %s\n", fname ));
4653 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4657 /********************************************************************
4658 Pull the NT ACL from a file on disk or the OpenEventlog() access
4659 check. Caller is responsible for freeing the returned security
4660 descriptor via TALLOC_FREE(). This is designed for dealing with
4661 user space access checks in smbd outside of the VFS. For example,
4662 checking access rights in OpenEventlog().
4664 Assume we are dealing with files (for now)
4665 ********************************************************************/
4667 struct security_descriptor *get_nt_acl_no_snum( TALLOC_CTX *ctx, const char *fname)
4669 struct security_descriptor *psd, *ret_sd;
4670 connection_struct *conn;
4672 struct fd_handle fh;
4675 conn = TALLOC_ZERO_P(ctx, connection_struct);
4677 DEBUG(0, ("talloc failed\n"));
4681 if (!(conn->params = TALLOC_P(conn, struct share_params))) {
4682 DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
4687 conn->params->service = -1;
4689 set_conn_connectpath(conn, "/");
4691 if (!smbd_vfs_init(conn)) {
4692 DEBUG(0,("get_nt_acl_no_snum: Unable to create a fake connection struct!\n"));
4697 ZERO_STRUCT( finfo );
4705 status = create_synthetic_smb_fname(talloc_tos(), fname, NULL, NULL,
4707 if (!NT_STATUS_IS_OK(status)) {
4712 if (!NT_STATUS_IS_OK(SMB_VFS_FGET_NT_ACL( &finfo, SECINFO_DACL, &psd))) {
4713 DEBUG(0,("get_nt_acl_no_snum: get_nt_acl returned zero.\n"));
4714 TALLOC_FREE(finfo.fsp_name);
4719 ret_sd = dup_sec_desc( ctx, psd );
4721 TALLOC_FREE(finfo.fsp_name);
4727 /* Stolen shamelessly from pvfs_default_acl() in source4 :-). */
4729 NTSTATUS make_default_filesystem_acl(TALLOC_CTX *ctx,
4731 SMB_STRUCT_STAT *psbuf,
4732 struct security_descriptor **ppdesc)
4734 struct dom_sid owner_sid, group_sid;
4736 struct security_ace aces[4];
4737 uint32_t access_mask = 0;
4738 mode_t mode = psbuf->st_ex_mode;
4739 struct security_acl *new_dacl = NULL;
4742 DEBUG(10,("make_default_filesystem_acl: file %s mode = 0%o\n",
4745 uid_to_sid(&owner_sid, psbuf->st_ex_uid);
4746 gid_to_sid(&group_sid, psbuf->st_ex_gid);
4749 We provide up to 4 ACEs
4756 if (mode & S_IRUSR) {
4757 if (mode & S_IWUSR) {
4758 access_mask |= SEC_RIGHTS_FILE_ALL;
4760 access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
4763 if (mode & S_IWUSR) {
4764 access_mask |= SEC_RIGHTS_FILE_WRITE | SEC_STD_DELETE;
4767 init_sec_ace(&aces[idx],
4769 SEC_ACE_TYPE_ACCESS_ALLOWED,
4775 if (mode & S_IRGRP) {
4776 access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
4778 if (mode & S_IWGRP) {
4779 /* note that delete is not granted - this matches posix behaviour */
4780 access_mask |= SEC_RIGHTS_FILE_WRITE;
4783 init_sec_ace(&aces[idx],
4785 SEC_ACE_TYPE_ACCESS_ALLOWED,
4792 if (mode & S_IROTH) {
4793 access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
4795 if (mode & S_IWOTH) {
4796 access_mask |= SEC_RIGHTS_FILE_WRITE;
4799 init_sec_ace(&aces[idx],
4801 SEC_ACE_TYPE_ACCESS_ALLOWED,
4807 init_sec_ace(&aces[idx],
4809 SEC_ACE_TYPE_ACCESS_ALLOWED,
4810 SEC_RIGHTS_FILE_ALL,
4814 new_dacl = make_sec_acl(ctx,
4820 return NT_STATUS_NO_MEMORY;
4823 *ppdesc = make_sec_desc(ctx,
4824 SECURITY_DESCRIPTOR_REVISION_1,
4825 SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT,
4832 return NT_STATUS_NO_MEMORY;
4834 return NT_STATUS_OK;