source3/smbd/pysmbd.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Set NT and POSIX ACLs and other VFS operations from Python
   4
   5    Copyrigyt (C) Andrew Bartlett 2012
   6    Copyright (C) Jeremy Allison 1994-2009.
   7    Copyright (C) Andreas Gruenbacher 2002.
   8    Copyright (C) Simo Sorce <idra@samba.org> 2009.
   9    Copyright (C) Simo Sorce 2002
  10    Copyright (C) Eric Lorimer 2002
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include <Python.h>
  27 #include "includes.h"
  28 #include "python/py3compat.h"
  29 #include "smbd/smbd.h"
  30 #include "libcli/util/pyerrors.h"
  31 #include "librpc/rpc/pyrpc_util.h"
  32 #include <pytalloc.h>
  33 #include "system/filesys.h"
  34 #include "passdb.h"
  35 #include "secrets.h"
  36 #include "auth.h"
  37
  38 extern const struct generic_mapping file_generic_mapping;
  39
  40 #undef  DBGC_CLASS
  41 #define DBGC_CLASS DBGC_ACLS
  42
  43 #ifdef O_DIRECTORY
  44 #define DIRECTORY_FLAGS O_RDONLY|O_DIRECTORY
  45 #else
  46 /* POSIX allows us to open a directory with O_RDONLY. */
  47 #define DIRECTORY_FLAGS O_RDONLY
  48 #endif
  49
  50
  51 static connection_struct *get_conn_tos(
  52         const char *service,
  53         const struct auth_session_info *session_info)
  54 {
  55         struct conn_struct_tos *c = NULL;
  56         int snum = -1;
  57         NTSTATUS status;
  58
  59         if (!posix_locking_init(false)) {
  60                 PyErr_NoMemory();
  61                 return NULL;
  62         }
  63
  64         if (service) {
  65                 snum = lp_servicenumber(service);
  66                 if (snum == -1) {
  67                         PyErr_SetString(PyExc_RuntimeError, "unknown service");
  68                         return NULL;
  69                 }
  70         }
  71
  72         status = create_conn_struct_tos(NULL,
  73                                         snum,
  74                                         "/",
  75                                         session_info,
  76                                         &c);
  77         PyErr_NTSTATUS_IS_ERR_RAISE(status);
  78
  79         /* Ignore read-only and share restrictions */
  80         c->conn->read_only = false;
  81         c->conn->share_access = SEC_RIGHTS_FILE_ALL;
  82         return c->conn;
  83 }
  84
  85 static int set_sys_acl_conn(const char *fname,
  86                                  SMB_ACL_TYPE_T acltype,
  87                                  SMB_ACL_T theacl, connection_struct *conn)
  88 {
  89         int ret;
  90         struct smb_filename *smb_fname = NULL;
  91         mode_t saved_umask;
  92
  93         TALLOC_CTX *frame = talloc_stackframe();
  94
  95         /* we want total control over the permissions on created files,
  96            so set our umask to 0 */
  97         saved_umask = umask(0);
  98
  99         smb_fname = synthetic_smb_fname_split(frame,
 100                                         fname,
 101                                         lp_posix_pathnames());
 102         if (smb_fname == NULL) {
 103                 TALLOC_FREE(frame);
 104                 umask(saved_umask);
 105                 return -1;
 106         }
 107
 108         ret = SMB_VFS_SYS_ACL_SET_FILE( conn, smb_fname, acltype, theacl);
 109
 110         umask(saved_umask);
 111
 112         TALLOC_FREE(frame);
 113         return ret;
 114 }
 115
 116
 117 static NTSTATUS init_files_struct(TALLOC_CTX *mem_ctx,
 118                                   const char *fname,
 119                                   struct connection_struct *conn,
 120                                   int flags,
 121                                   struct files_struct **_fsp)
 122 {
 123         struct smb_filename *smb_fname = NULL;
 124         int ret;
 125         mode_t saved_umask;
 126         struct files_struct *fsp;
 127
 128         fsp = talloc_zero(mem_ctx, struct files_struct);
 129         if (fsp == NULL) {
 130                 return NT_STATUS_NO_MEMORY;
 131         }
 132         fsp->fh = talloc(fsp, struct fd_handle);
 133         if (fsp->fh == NULL) {
 134                 return NT_STATUS_NO_MEMORY;
 135         }
 136         fsp->conn = conn;
 137
 138         /* we want total control over the permissions on created files,
 139            so set our umask to 0 */
 140         saved_umask = umask(0);
 141
 142         smb_fname = synthetic_smb_fname_split(fsp,
 143                                               fname,
 144                                               lp_posix_pathnames());
 145         if (smb_fname == NULL) {
 146                 umask(saved_umask);
 147                 return NT_STATUS_NO_MEMORY;
 148         }
 149
 150         fsp->fsp_name = smb_fname;
 151         fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, flags, 00644);
 152         if (fsp->fh->fd == -1) {
 153                 int err = errno;
 154                 umask(saved_umask);
 155                 if (err == ENOENT) {
 156                         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 157                 }
 158                 return NT_STATUS_INVALID_PARAMETER;
 159         }
 160
 161         ret = SMB_VFS_FSTAT(fsp, &smb_fname->st);
 162         if (ret == -1) {
 163                 /* If we have an fd, this stat should succeed. */
 164                 DEBUG(0,("Error doing fstat on open file %s (%s)\n",
 165                          smb_fname_str_dbg(smb_fname),
 166                          strerror(errno) ));
 167                 umask(saved_umask);
 168                 return map_nt_error_from_unix(errno);
 169         }
 170
 171         fsp->file_id = vfs_file_id_from_sbuf(conn, &smb_fname->st);
 172         fsp->vuid = UID_FIELD_INVALID;
 173         fsp->file_pid = 0;
 174         fsp->can_lock = True;
 175         fsp->can_read = True;
 176         fsp->can_write = True;
 177         fsp->print_file = NULL;
 178         fsp->modified = False;
 179         fsp->sent_oplock_break = NO_BREAK_SENT;
 180         fsp->is_directory = S_ISDIR(smb_fname->st.st_ex_mode);
 181
 182         *_fsp = fsp;
 183
 184         return NT_STATUS_OK;
 185 }
 186
 187 static NTSTATUS set_nt_acl_conn(const char *fname,
 188                                 uint32_t security_info_sent, const struct security_descriptor *sd,
 189                                 connection_struct *conn)
 190 {
 191         TALLOC_CTX *frame = talloc_stackframe();
 192         struct files_struct *fsp = NULL;
 193         NTSTATUS status = NT_STATUS_OK;
 194
 195         /* first, try to open it as a file with flag O_RDWR */
 196         status = init_files_struct(frame,
 197                                    fname,
 198                                    conn,
 199                                    O_RDWR,
 200                                    &fsp);
 201         if (!NT_STATUS_IS_OK(status) && errno == EISDIR) {
 202                 /* if fail, try to open as dir */
 203                 status = init_files_struct(frame,
 204                                            fname,
 205                                            conn,
 206                                            DIRECTORY_FLAGS,
 207                                            &fsp);
 208         }
 209
 210         if (!NT_STATUS_IS_OK(status)) {
 211                 DBG_ERR("init_files_struct failed: %s\n",
 212                         nt_errstr(status));
 213                 if (fsp != NULL) {
 214                         SMB_VFS_CLOSE(fsp);
 215                 }
 216                 TALLOC_FREE(frame);
 217                 return status;
 218         }
 219
 220         status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, sd);
 221         if (!NT_STATUS_IS_OK(status)) {
 222                 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned %s.\n", nt_errstr(status)));
 223         }
 224
 225         SMB_VFS_CLOSE(fsp);
 226
 227         TALLOC_FREE(frame);
 228         return status;
 229 }
 230
 231 static NTSTATUS get_nt_acl_conn(TALLOC_CTX *mem_ctx,
 232                                 const char *fname,
 233                                 connection_struct *conn,
 234                                 uint32_t security_info_wanted,
 235                                 struct security_descriptor **sd)
 236 {
 237         TALLOC_CTX *frame = talloc_stackframe();
 238         NTSTATUS status;
 239         struct smb_filename *smb_fname = synthetic_smb_fname(talloc_tos(),
 240                                         fname,
 241                                         NULL,
 242                                         NULL,
 243                                         lp_posix_pathnames() ?
 244                                                 SMB_FILENAME_POSIX_PATH : 0);
 245
 246         if (smb_fname == NULL) {
 247                 TALLOC_FREE(frame);
 248                 return NT_STATUS_NO_MEMORY;
 249         }
 250
 251         status = SMB_VFS_GET_NT_ACL(conn,
 252                                 smb_fname,
 253                                 security_info_wanted,
 254                                 mem_ctx,
 255                                 sd);
 256         if (!NT_STATUS_IS_OK(status)) {
 257                 DEBUG(0,("get_nt_acl_conn: get_nt_acl returned %s.\n", nt_errstr(status)));
 258         }
 259
 260         TALLOC_FREE(frame);
 261
 262         return status;
 263 }
 264
 265 static int set_acl_entry_perms(SMB_ACL_ENTRY_T entry, mode_t perm_mask)
 266 {
 267         SMB_ACL_PERMSET_T perms = NULL;
 268
 269         if (sys_acl_get_permset(entry, &perms) != 0) {
 270                 return -1;
 271         }
 272
 273         if (sys_acl_clear_perms(perms) != 0) {
 274                 return -1;
 275         }
 276
 277         if ((perm_mask & SMB_ACL_READ) != 0 &&
 278             sys_acl_add_perm(perms, SMB_ACL_READ) != 0) {
 279                 return -1;
 280         }
 281
 282         if ((perm_mask & SMB_ACL_WRITE) != 0 &&
 283             sys_acl_add_perm(perms, SMB_ACL_WRITE) != 0) {
 284                 return -1;
 285         }
 286
 287         if ((perm_mask & SMB_ACL_EXECUTE) != 0 &&
 288             sys_acl_add_perm(perms, SMB_ACL_EXECUTE) != 0) {
 289                 return -1;
 290         }
 291
 292         if (sys_acl_set_permset(entry, perms) != 0) {
 293                 return -1;
 294         }
 295
 296         return 0;
 297 }
 298
 299 static SMB_ACL_T make_simple_acl(TALLOC_CTX *mem_ctx,
 300                         gid_t gid,
 301                         mode_t chmod_mode)
 302 {
 303         mode_t mode = SMB_ACL_READ|SMB_ACL_WRITE|SMB_ACL_EXECUTE;
 304
 305         mode_t mode_user = (chmod_mode & 0700) >> 6;
 306         mode_t mode_group = (chmod_mode & 070) >> 3;
 307         mode_t mode_other = chmod_mode &  07;
 308         SMB_ACL_ENTRY_T entry;
 309         SMB_ACL_T acl = sys_acl_init(mem_ctx);
 310
 311         if (!acl) {
 312                 return NULL;
 313         }
 314
 315         if (sys_acl_create_entry(&acl, &entry) != 0) {
 316                 TALLOC_FREE(acl);
 317                 return NULL;
 318         }
 319
 320         if (sys_acl_set_tag_type(entry, SMB_ACL_USER_OBJ) != 0) {
 321                 TALLOC_FREE(acl);
 322                 return NULL;
 323         }
 324
 325         if (set_acl_entry_perms(entry, mode_user) != 0) {
 326                 TALLOC_FREE(acl);
 327                 return NULL;
 328         }
 329
 330         if (sys_acl_create_entry(&acl, &entry) != 0) {
 331                 TALLOC_FREE(acl);
 332                 return NULL;
 333         }
 334
 335         if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP_OBJ) != 0) {
 336                 TALLOC_FREE(acl);
 337                 return NULL;
 338         }
 339
 340         if (set_acl_entry_perms(entry, mode_group) != 0) {
 341                 TALLOC_FREE(acl);
 342                 return NULL;
 343         }
 344
 345         if (sys_acl_create_entry(&acl, &entry) != 0) {
 346                 TALLOC_FREE(acl);
 347                 return NULL;
 348         }
 349
 350         if (sys_acl_set_tag_type(entry, SMB_ACL_OTHER) != 0) {
 351                 TALLOC_FREE(acl);
 352                 return NULL;
 353         }
 354
 355         if (set_acl_entry_perms(entry, mode_other) != 0) {
 356                 TALLOC_FREE(acl);
 357                 return NULL;
 358         }
 359
 360         if (gid != -1) {
 361                 if (sys_acl_create_entry(&acl, &entry) != 0) {
 362                         TALLOC_FREE(acl);
 363                         return NULL;
 364                 }
 365
 366                 if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP) != 0) {
 367                         TALLOC_FREE(acl);
 368                         return NULL;
 369                 }
 370
 371                 if (sys_acl_set_qualifier(entry, &gid) != 0) {
 372                         TALLOC_FREE(acl);
 373                         return NULL;
 374                 }
 375
 376                 if (set_acl_entry_perms(entry, mode_group) != 0) {
 377                         TALLOC_FREE(acl);
 378                         return NULL;
 379                 }
 380         }
 381
 382         if (sys_acl_create_entry(&acl, &entry) != 0) {
 383                 TALLOC_FREE(acl);
 384                 return NULL;
 385         }
 386
 387         if (sys_acl_set_tag_type(entry, SMB_ACL_MASK) != 0) {
 388                 TALLOC_FREE(acl);
 389                 return NULL;
 390         }
 391
 392         if (set_acl_entry_perms(entry, mode) != 0) {
 393                 TALLOC_FREE(acl);
 394                 return NULL;
 395         }
 396
 397         return acl;
 398 }
 399
 400 /*
 401   set a simple ACL on a file, as a test
 402  */
 403 static PyObject *py_smbd_set_simple_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 404 {
 405         const char * const kwnames[] = { "fname", "mode", "gid", "service", NULL };
 406         char *fname, *service = NULL;
 407         int ret;
 408         int mode, gid = -1;
 409         SMB_ACL_T acl;
 410         TALLOC_CTX *frame;
 411         connection_struct *conn;
 412
 413         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "si|iz",
 414                                          discard_const_p(char *, kwnames),
 415                                          &fname, &mode, &gid, &service))
 416                 return NULL;
 417
 418         frame = talloc_stackframe();
 419
 420         acl = make_simple_acl(frame, gid, mode);
 421         if (acl == NULL) {
 422                 TALLOC_FREE(frame);
 423                 return NULL;
 424         }
 425
 426         conn = get_conn_tos(service, NULL);
 427         if (!conn) {
 428                 TALLOC_FREE(frame);
 429                 return NULL;
 430         }
 431
 432         ret = set_sys_acl_conn(fname, SMB_ACL_TYPE_ACCESS, acl, conn);
 433
 434         if (ret != 0) {
 435                 TALLOC_FREE(frame);
 436                 errno = ret;
 437                 return PyErr_SetFromErrno(PyExc_OSError);
 438         }
 439
 440         TALLOC_FREE(frame);
 441
 442         Py_RETURN_NONE;
 443 }
 444
 445 /*
 446   chown a file
 447  */
 448 static PyObject *py_smbd_chown(PyObject *self, PyObject *args, PyObject *kwargs)
 449 {
 450         const char * const kwnames[] = { "fname", "uid", "gid", "service", NULL };
 451         connection_struct *conn;
 452         int ret;
 453
 454         char *fname, *service = NULL;
 455         int uid, gid;
 456         TALLOC_CTX *frame;
 457         mode_t saved_umask;
 458         struct smb_filename *smb_fname = NULL;
 459
 460         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "sii|z",
 461                                          discard_const_p(char *, kwnames),
 462                                          &fname, &uid, &gid, &service))
 463                 return NULL;
 464
 465         frame = talloc_stackframe();
 466
 467         conn = get_conn_tos(service, NULL);
 468         if (!conn) {
 469                 TALLOC_FREE(frame);
 470                 return NULL;
 471         }
 472
 473         /* we want total control over the permissions on created files,
 474            so set our umask to 0 */
 475         saved_umask = umask(0);
 476
 477         smb_fname = synthetic_smb_fname(talloc_tos(),
 478                                         fname,
 479                                         NULL,
 480                                         NULL,
 481                                         lp_posix_pathnames() ?
 482                                                 SMB_FILENAME_POSIX_PATH : 0);
 483         if (smb_fname == NULL) {
 484                 umask(saved_umask);
 485                 TALLOC_FREE(frame);
 486                 errno = ENOMEM;
 487                 return PyErr_SetFromErrno(PyExc_OSError);
 488         }
 489
 490         ret = SMB_VFS_CHOWN(conn, smb_fname, uid, gid);
 491         if (ret != 0) {
 492                 umask(saved_umask);
 493                 TALLOC_FREE(frame);
 494                 errno = ret;
 495                 return PyErr_SetFromErrno(PyExc_OSError);
 496         }
 497
 498         umask(saved_umask);
 499
 500         TALLOC_FREE(frame);
 501
 502         Py_RETURN_NONE;
 503 }
 504
 505 /*
 506   unlink a file
 507  */
 508 static PyObject *py_smbd_unlink(PyObject *self, PyObject *args, PyObject *kwargs)
 509 {
 510         const char * const kwnames[] = { "fname", "service", NULL };
 511         connection_struct *conn;
 512         int ret;
 513         struct smb_filename *smb_fname = NULL;
 514         char *fname, *service = NULL;
 515         TALLOC_CTX *frame;
 516
 517         frame = talloc_stackframe();
 518
 519         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "s|z",
 520                                          discard_const_p(char *, kwnames),
 521                                          &fname, &service)) {
 522                 TALLOC_FREE(frame);
 523                 return NULL;
 524         }
 525
 526         conn = get_conn_tos(service, NULL);
 527         if (!conn) {
 528                 TALLOC_FREE(frame);
 529                 return NULL;
 530         }
 531
 532         smb_fname = synthetic_smb_fname_split(frame,
 533                                         fname,
 534                                         lp_posix_pathnames());
 535         if (smb_fname == NULL) {
 536                 TALLOC_FREE(frame);
 537                 return PyErr_NoMemory();
 538         }
 539
 540         ret = SMB_VFS_UNLINK(conn, smb_fname);
 541         if (ret != 0) {
 542                 TALLOC_FREE(frame);
 543                 errno = ret;
 544                 return PyErr_SetFromErrno(PyExc_OSError);
 545         }
 546
 547         TALLOC_FREE(frame);
 548
 549         Py_RETURN_NONE;
 550 }
 551
 552 /*
 553   check if we have ACL support
 554  */
 555 static PyObject *py_smbd_have_posix_acls(PyObject *self)
 556 {
 557 #ifdef HAVE_POSIX_ACLS
 558         return PyBool_FromLong(true);
 559 #else
 560         return PyBool_FromLong(false);
 561 #endif
 562 }
 563
 564 /*
 565   set the NT ACL on a file
 566  */
 567 static PyObject *py_smbd_set_nt_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 568 {
 569         const char * const kwnames[] = {
 570                 "fname", "security_info_sent", "sd",
 571                 "service", "session_info", NULL };
 572
 573         NTSTATUS status;
 574         char *fname, *service = NULL;
 575         int security_info_sent;
 576         PyObject *py_sd;
 577         struct security_descriptor *sd;
 578         PyObject *py_session = Py_None;
 579         struct auth_session_info *session_info = NULL;
 580         connection_struct *conn;
 581         TALLOC_CTX *frame;
 582
 583         frame = talloc_stackframe();
 584
 585         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "siO|zO",
 586                                          discard_const_p(char *, kwnames),
 587                                          &fname, &security_info_sent, &py_sd,
 588                                          &service, &py_session)) {
 589                 TALLOC_FREE(frame);
 590                 return NULL;
 591         }
 592
 593         if (!py_check_dcerpc_type(py_sd, "samba.dcerpc.security", "descriptor")) {
 594                 TALLOC_FREE(frame);
 595                 return NULL;
 596         }
 597
 598         if (py_session != Py_None) {
 599                 if (!py_check_dcerpc_type(py_session,
 600                                           "samba.dcerpc.auth",
 601                                           "session_info")) {
 602                         TALLOC_FREE(frame);
 603                         return NULL;
 604                 }
 605                 session_info = pytalloc_get_type(py_session,
 606                                                  struct auth_session_info);
 607                 if (!session_info) {
 608                         PyErr_Format(PyExc_TypeError,
 609                                      "Expected auth_session_info for session_info argument got %s",
 610                                      talloc_get_name(pytalloc_get_ptr(py_session)));
 611                         return NULL;
 612                 }
 613         }
 614
 615         conn = get_conn_tos(service, session_info);
 616         if (!conn) {
 617                 TALLOC_FREE(frame);
 618                 return NULL;
 619         }
 620
 621         sd = pytalloc_get_type(py_sd, struct security_descriptor);
 622
 623         status = set_nt_acl_conn(fname, security_info_sent, sd, conn);
 624         TALLOC_FREE(frame);
 625         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 626
 627         Py_RETURN_NONE;
 628 }
 629
 630 /*
 631   Return the NT ACL on a file
 632  */
 633 static PyObject *py_smbd_get_nt_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 634 {
 635         const char * const kwnames[] = { "fname",
 636                                          "security_info_wanted",
 637                                          "service",
 638                                          "session_info",
 639                                          NULL };
 640         char *fname, *service = NULL;
 641         int security_info_wanted;
 642         PyObject *py_sd;
 643         struct security_descriptor *sd;
 644         TALLOC_CTX *frame = talloc_stackframe();
 645         PyObject *py_session = Py_None;
 646         struct auth_session_info *session_info = NULL;
 647         connection_struct *conn;
 648         NTSTATUS status;
 649         int ret = 1;
 650
 651         ret = PyArg_ParseTupleAndKeywords(args,
 652                                           kwargs,
 653                                           "si|zO",
 654                                           discard_const_p(char *, kwnames),
 655                                           &fname,
 656                                           &security_info_wanted,
 657                                           &service,
 658                                           &py_session);
 659         if (!ret) {
 660                 TALLOC_FREE(frame);
 661                 return NULL;
 662         }
 663
 664         if (py_session != Py_None) {
 665                 if (!py_check_dcerpc_type(py_session,
 666                                           "samba.dcerpc.auth",
 667                                           "session_info")) {
 668                         TALLOC_FREE(frame);
 669                         return NULL;
 670                 }
 671                 session_info = pytalloc_get_type(py_session,
 672                                                  struct auth_session_info);
 673                 if (!session_info) {
 674                         PyErr_Format(
 675                                 PyExc_TypeError,
 676                                 "Expected auth_session_info for "
 677                                 "session_info argument got %s",
 678                                 talloc_get_name(pytalloc_get_ptr(py_session)));
 679                         return NULL;
 680                 }
 681         }
 682
 683         conn = get_conn_tos(service, session_info);
 684         if (!conn) {
 685                 TALLOC_FREE(frame);
 686                 return NULL;
 687         }
 688
 689         status = get_nt_acl_conn(frame, fname, conn, security_info_wanted, &sd);
 690         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 691
 692         py_sd = py_return_ndr_struct("samba.dcerpc.security", "descriptor", sd, sd);
 693
 694         TALLOC_FREE(frame);
 695
 696         return py_sd;
 697 }
 698
 699 /*
 700   set the posix (or similar) ACL on a file
 701  */
 702 static PyObject *py_smbd_set_sys_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 703 {
 704         const char * const kwnames[] = { "fname", "acl_type", "acl", "service", NULL };
 705         TALLOC_CTX *frame = talloc_stackframe();
 706         int ret;
 707         char *fname, *service = NULL;
 708         PyObject *py_acl;
 709         struct smb_acl_t *acl;
 710         int acl_type;
 711         connection_struct *conn;
 712
 713         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "siO|z",
 714                                          discard_const_p(char *, kwnames),
 715                                          &fname, &acl_type, &py_acl, &service)) {
 716                 TALLOC_FREE(frame);
 717                 return NULL;
 718         }
 719
 720         if (!py_check_dcerpc_type(py_acl, "samba.dcerpc.smb_acl", "t")) {
 721                 TALLOC_FREE(frame);
 722                 return NULL;
 723         }
 724
 725         conn = get_conn_tos(service, NULL);
 726         if (!conn) {
 727                 TALLOC_FREE(frame);
 728                 return NULL;
 729         }
 730
 731         acl = pytalloc_get_type(py_acl, struct smb_acl_t);
 732
 733         ret = set_sys_acl_conn(fname, acl_type, acl, conn);
 734         if (ret != 0) {
 735                 TALLOC_FREE(frame);
 736                 errno = ret;
 737                 return PyErr_SetFromErrno(PyExc_OSError);
 738         }
 739
 740         TALLOC_FREE(frame);
 741         Py_RETURN_NONE;
 742 }
 743
 744 /*
 745   Return the posix (or similar) ACL on a file
 746  */
 747 static PyObject *py_smbd_get_sys_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 748 {
 749         const char * const kwnames[] = { "fname", "acl_type", "service", NULL };
 750         char *fname;
 751         PyObject *py_acl;
 752         struct smb_acl_t *acl;
 753         int acl_type;
 754         TALLOC_CTX *frame = talloc_stackframe();
 755         connection_struct *conn;
 756         char *service = NULL;
 757         struct smb_filename *smb_fname = NULL;
 758
 759         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "si|z",
 760                                          discard_const_p(char *, kwnames),
 761                                          &fname, &acl_type, &service)) {
 762                 TALLOC_FREE(frame);
 763                 return NULL;
 764         }
 765
 766         conn = get_conn_tos(service, NULL);
 767         if (!conn) {
 768                 TALLOC_FREE(frame);
 769                 return NULL;
 770         }
 771
 772         smb_fname = synthetic_smb_fname_split(frame,
 773                                         fname,
 774                                         lp_posix_pathnames());
 775         if (smb_fname == NULL) {
 776                 TALLOC_FREE(frame);
 777                 return NULL;
 778         }
 779         acl = SMB_VFS_SYS_ACL_GET_FILE( conn, smb_fname, acl_type, frame);
 780         if (!acl) {
 781                 TALLOC_FREE(frame);
 782                 return PyErr_SetFromErrno(PyExc_OSError);
 783         }
 784
 785         py_acl = py_return_ndr_struct("samba.dcerpc.smb_acl", "t", acl, acl);
 786
 787         TALLOC_FREE(frame);
 788
 789         return py_acl;
 790 }
 791
 792 static PyObject *py_smbd_mkdir(PyObject *self, PyObject *args, PyObject *kwargs)
 793 {
 794         const char * const kwnames[] = { "fname", "service", NULL };
 795         char *fname, *service = NULL;
 796         TALLOC_CTX *frame = talloc_stackframe();
 797         struct connection_struct *conn = NULL;
 798         struct smb_filename *smb_fname = NULL;
 799
 800         if (!PyArg_ParseTupleAndKeywords(args,
 801                                          kwargs,
 802                                          "s|z",
 803                                          discard_const_p(char *,
 804                                                          kwnames),
 805                                          &fname,
 806                                          &service)) {
 807                 TALLOC_FREE(frame);
 808                 return NULL;
 809         }
 810
 811         conn = get_conn_tos(service, NULL);
 812         if (!conn) {
 813                 TALLOC_FREE(frame);
 814                 return NULL;
 815         }
 816
 817         smb_fname = synthetic_smb_fname(talloc_tos(),
 818                                         fname,
 819                                         NULL,
 820                                         NULL,
 821                                         lp_posix_pathnames() ?
 822                                         SMB_FILENAME_POSIX_PATH : 0);
 823
 824         if (smb_fname == NULL) {
 825                 TALLOC_FREE(frame);
 826                 return NULL;
 827         }
 828
 829
 830         if (SMB_VFS_MKDIR(conn, smb_fname, 00755) == -1) {
 831                 DBG_ERR("mkdir error=%d (%s)\n", errno, strerror(errno));
 832                 TALLOC_FREE(frame);
 833                 return NULL;
 834         }
 835
 836         TALLOC_FREE(frame);
 837         Py_RETURN_NONE;
 838 }
 839
 840
 841 /*
 842   Create an empty file
 843  */
 844 static PyObject *py_smbd_create_file(PyObject *self, PyObject *args, PyObject *kwargs)
 845 {
 846         const char * const kwnames[] = { "fname", "service", NULL };
 847         char *fname, *service = NULL;
 848         TALLOC_CTX *frame = talloc_stackframe();
 849         struct connection_struct *conn = NULL;
 850         struct files_struct *fsp = NULL;
 851         NTSTATUS status;
 852
 853         if (!PyArg_ParseTupleAndKeywords(args,
 854                                          kwargs,
 855                                          "s|z",
 856                                          discard_const_p(char *,
 857                                                          kwnames),
 858                                          &fname,
 859                                          &service)) {
 860                 TALLOC_FREE(frame);
 861                 return NULL;
 862         }
 863
 864         conn = get_conn_tos(service, NULL);
 865         if (!conn) {
 866                 TALLOC_FREE(frame);
 867                 return NULL;
 868         }
 869
 870         status = init_files_struct(frame,
 871                                    fname,
 872                                    conn,
 873                                    O_CREAT|O_EXCL|O_RDWR,
 874                                    &fsp);
 875         if (!NT_STATUS_IS_OK(status)) {
 876                 DBG_ERR("init_files_struct failed: %s\n",
 877                         nt_errstr(status));
 878         }
 879
 880         TALLOC_FREE(frame);
 881         Py_RETURN_NONE;
 882 }
 883
 884
 885 static PyMethodDef py_smbd_methods[] = {
 886         { "have_posix_acls",
 887                 (PyCFunction)py_smbd_have_posix_acls, METH_NOARGS,
 888                 NULL },
 889         { "set_simple_acl",
 890                 (PyCFunction)py_smbd_set_simple_acl, METH_VARARGS|METH_KEYWORDS,
 891                 NULL },
 892         { "set_nt_acl",
 893                 (PyCFunction)py_smbd_set_nt_acl, METH_VARARGS|METH_KEYWORDS,
 894                 NULL },
 895         { "get_nt_acl",
 896                 (PyCFunction)py_smbd_get_nt_acl, METH_VARARGS|METH_KEYWORDS,
 897                 NULL },
 898         { "get_sys_acl",
 899                 (PyCFunction)py_smbd_get_sys_acl, METH_VARARGS|METH_KEYWORDS,
 900                 NULL },
 901         { "set_sys_acl",
 902                 (PyCFunction)py_smbd_set_sys_acl, METH_VARARGS|METH_KEYWORDS,
 903                 NULL },
 904         { "chown",
 905                 (PyCFunction)py_smbd_chown, METH_VARARGS|METH_KEYWORDS,
 906                 NULL },
 907         { "unlink",
 908                 (PyCFunction)py_smbd_unlink, METH_VARARGS|METH_KEYWORDS,
 909                 NULL },
 910         { "mkdir",
 911                 (PyCFunction)py_smbd_mkdir, METH_VARARGS|METH_KEYWORDS,
 912                 NULL },
 913         { "create_file",
 914                 (PyCFunction)py_smbd_create_file, METH_VARARGS|METH_KEYWORDS,
 915                 NULL },
 916         { NULL }
 917 };
 918
 919 void initsmbd(void);
 920
 921 static struct PyModuleDef moduledef = {
 922     PyModuleDef_HEAD_INIT,
 923     .m_name = "smbd",
 924     .m_doc = "Python bindings for the smbd file server.",
 925     .m_size = -1,
 926     .m_methods = py_smbd_methods,
 927 };
 928
 929 MODULE_INIT_FUNC(smbd)
 930 {
 931         PyObject *m = NULL;
 932
 933         m = PyModule_Create(&moduledef);
 934         return m;
 935 }