2 Unix SMB/CIFS implementation.
4 a pass-thru NTVFS module to setup a security context using unix
7 Copyright (C) Andrew Tridgell 2004
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 #include "auth/auth.h"
26 #include "libcli/security/security.h"
27 #include "smb_server/smb_server.h"
29 struct unixuid_private {
30 struct sidmap_context *sidmap;
31 struct unix_sec_ctx *last_sec_ctx;
32 struct security_token *last_token;
45 pull the current security context into a unix_sec_ctx
47 static struct unix_sec_ctx *save_unix_security(TALLOC_CTX *mem_ctx)
49 struct unix_sec_ctx *sec = talloc(mem_ctx, struct unix_sec_ctx);
55 sec->ngroups = getgroups(0, NULL);
56 if (sec->ngroups == -1) {
60 sec->groups = talloc_array(sec, gid_t, sec->ngroups);
61 if (sec->groups == NULL) {
66 if (getgroups(sec->ngroups, sec->groups) != sec->ngroups) {
75 set the current security context from a unix_sec_ctx
77 static NTSTATUS set_unix_security(struct unix_sec_ctx *sec)
81 if (setgroups(sec->ngroups, sec->groups) != 0) {
82 return NT_STATUS_ACCESS_DENIED;
84 if (setegid(sec->gid) != 0) {
85 return NT_STATUS_ACCESS_DENIED;
87 if (seteuid(sec->uid) != 0) {
88 return NT_STATUS_ACCESS_DENIED;
94 form a unix_sec_ctx from the current security_token
96 static NTSTATUS nt_token_to_unix_security(struct ntvfs_module_context *ntvfs,
97 struct smbsrv_request *req,
98 struct security_token *token,
99 struct unix_sec_ctx **sec)
101 struct unixuid_private *private = ntvfs->private_data;
104 *sec = talloc(req, struct unix_sec_ctx);
106 /* we can't do unix security without a user and group */
107 if (token->num_sids < 2) {
108 return NT_STATUS_ACCESS_DENIED;
111 status = sidmap_sid_to_unixuid(private->sidmap,
112 token->user_sid, &(*sec)->uid);
113 if (!NT_STATUS_IS_OK(status)) {
117 status = sidmap_sid_to_unixgid(private->sidmap,
118 token->group_sid, &(*sec)->gid);
119 if (!NT_STATUS_IS_OK(status)) {
123 (*sec)->ngroups = token->num_sids - 2;
124 (*sec)->groups = talloc_array(*sec, gid_t, (*sec)->ngroups);
125 if ((*sec)->groups == NULL) {
126 return NT_STATUS_NO_MEMORY;
129 for (i=0;i<(*sec)->ngroups;i++) {
130 status = sidmap_sid_to_unixgid(private->sidmap,
131 token->sids[i+2], &(*sec)->groups[i]);
132 if (!NT_STATUS_IS_OK(status)) {
141 setup our unix security context according to the session authentication info
143 static NTSTATUS unixuid_setup_security(struct ntvfs_module_context *ntvfs,
144 struct smbsrv_request *req, struct unix_sec_ctx **sec)
146 struct unixuid_private *private = ntvfs->private_data;
147 struct security_token *token = req->session->session_info->security_token;
148 void *ctx = talloc_new(req);
149 struct unix_sec_ctx *newsec;
152 if (req->session == NULL) {
153 return NT_STATUS_ACCESS_DENIED;
156 *sec = save_unix_security(req);
158 return NT_STATUS_NO_MEMORY;
161 if (req->session->session_info->security_token == private->last_token) {
162 newsec = private->last_sec_ctx;
164 status = nt_token_to_unix_security(ntvfs, req, token, &newsec);
165 if (!NT_STATUS_IS_OK(status)) {
169 if (private->last_sec_ctx) {
170 talloc_free(private->last_sec_ctx);
172 private->last_sec_ctx = newsec;
173 private->last_token = req->session->session_info->security_token;
174 talloc_steal(private, newsec);
177 status = set_unix_security(newsec);
178 if (!NT_STATUS_IS_OK(status)) {
189 this pass through macro operates on request contexts
191 #define PASS_THRU_REQ(ntvfs, req, op, args) do { \
193 struct unix_sec_ctx *sec; \
194 status = unixuid_setup_security(ntvfs, req, &sec); \
195 if (NT_STATUS_IS_OK(status)) status = ntvfs_next_##op args; \
196 status2 = set_unix_security(sec); \
197 if (!NT_STATUS_IS_OK(status2)) smb_panic("Unable to reset security context"); \
203 connect to a share - used when a tree_connect operation comes in.
205 static NTSTATUS unixuid_connect(struct ntvfs_module_context *ntvfs,
206 struct smbsrv_request *req, const char *sharename)
208 struct unixuid_private *private;
211 private = talloc(req->tcon, struct unixuid_private);
213 return NT_STATUS_NO_MEMORY;
216 private->sidmap = sidmap_open(private);
217 if (private->sidmap == NULL) {
218 return NT_STATUS_INTERNAL_DB_CORRUPTION;
221 ntvfs->private_data = private;
222 private->last_sec_ctx = NULL;
223 private->last_token = NULL;
225 /* we don't use PASS_THRU_REQ here, as the connect operation runs with
226 root privileges. This allows the backends to setup any database
227 links they might need during the connect. */
228 status = ntvfs_next_connect(ntvfs, req, sharename);
234 disconnect from a share
236 static NTSTATUS unixuid_disconnect(struct ntvfs_module_context *ntvfs,
237 struct smbsrv_tcon *tcon)
239 struct unixuid_private *private = ntvfs->private_data;
242 talloc_free(private);
244 status = ntvfs_next_disconnect(ntvfs, tcon);
253 static NTSTATUS unixuid_unlink(struct ntvfs_module_context *ntvfs,
254 struct smbsrv_request *req, struct smb_unlink *unl)
258 PASS_THRU_REQ(ntvfs, req, unlink, (ntvfs, req, unl));
266 static NTSTATUS unixuid_ioctl(struct ntvfs_module_context *ntvfs,
267 struct smbsrv_request *req, union smb_ioctl *io)
271 PASS_THRU_REQ(ntvfs, req, ioctl, (ntvfs, req, io));
277 check if a directory exists
279 static NTSTATUS unixuid_chkpath(struct ntvfs_module_context *ntvfs,
280 struct smbsrv_request *req, struct smb_chkpath *cp)
284 PASS_THRU_REQ(ntvfs, req, chkpath, (ntvfs, req, cp));
290 return info on a pathname
292 static NTSTATUS unixuid_qpathinfo(struct ntvfs_module_context *ntvfs,
293 struct smbsrv_request *req, union smb_fileinfo *info)
297 PASS_THRU_REQ(ntvfs, req, qpathinfo, (ntvfs, req, info));
303 query info on a open file
305 static NTSTATUS unixuid_qfileinfo(struct ntvfs_module_context *ntvfs,
306 struct smbsrv_request *req, union smb_fileinfo *info)
310 PASS_THRU_REQ(ntvfs, req, qfileinfo, (ntvfs, req, info));
317 set info on a pathname
319 static NTSTATUS unixuid_setpathinfo(struct ntvfs_module_context *ntvfs,
320 struct smbsrv_request *req, union smb_setfileinfo *st)
324 PASS_THRU_REQ(ntvfs, req, setpathinfo, (ntvfs, req, st));
332 static NTSTATUS unixuid_openfile(struct ntvfs_module_context *ntvfs,
333 struct smbsrv_request *req, union smb_open *io)
337 PASS_THRU_REQ(ntvfs, req, openfile, (ntvfs, req, io));
345 static NTSTATUS unixuid_mkdir(struct ntvfs_module_context *ntvfs,
346 struct smbsrv_request *req, union smb_mkdir *md)
350 PASS_THRU_REQ(ntvfs, req, mkdir, (ntvfs, req, md));
358 static NTSTATUS unixuid_rmdir(struct ntvfs_module_context *ntvfs,
359 struct smbsrv_request *req, struct smb_rmdir *rd)
363 PASS_THRU_REQ(ntvfs, req, rmdir, (ntvfs, req, rd));
369 rename a set of files
371 static NTSTATUS unixuid_rename(struct ntvfs_module_context *ntvfs,
372 struct smbsrv_request *req, union smb_rename *ren)
376 PASS_THRU_REQ(ntvfs, req, rename, (ntvfs, req, ren));
384 static NTSTATUS unixuid_copy(struct ntvfs_module_context *ntvfs,
385 struct smbsrv_request *req, struct smb_copy *cp)
389 PASS_THRU_REQ(ntvfs, req, copy, (ntvfs, req, cp));
397 static NTSTATUS unixuid_read(struct ntvfs_module_context *ntvfs,
398 struct smbsrv_request *req, union smb_read *rd)
402 PASS_THRU_REQ(ntvfs, req, read, (ntvfs, req, rd));
410 static NTSTATUS unixuid_write(struct ntvfs_module_context *ntvfs,
411 struct smbsrv_request *req, union smb_write *wr)
415 PASS_THRU_REQ(ntvfs, req, write, (ntvfs, req, wr));
423 static NTSTATUS unixuid_seek(struct ntvfs_module_context *ntvfs,
424 struct smbsrv_request *req, struct smb_seek *io)
428 PASS_THRU_REQ(ntvfs, req, seek, (ntvfs, req, io));
436 static NTSTATUS unixuid_flush(struct ntvfs_module_context *ntvfs,
437 struct smbsrv_request *req, struct smb_flush *io)
441 PASS_THRU_REQ(ntvfs, req, flush, (ntvfs, req, io));
449 static NTSTATUS unixuid_close(struct ntvfs_module_context *ntvfs,
450 struct smbsrv_request *req, union smb_close *io)
454 PASS_THRU_REQ(ntvfs, req, close, (ntvfs, req, io));
462 static NTSTATUS unixuid_exit(struct ntvfs_module_context *ntvfs,
463 struct smbsrv_request *req)
467 PASS_THRU_REQ(ntvfs, req, exit, (ntvfs, req));
473 logoff - closing files
475 static NTSTATUS unixuid_logoff(struct ntvfs_module_context *ntvfs,
476 struct smbsrv_request *req)
478 struct unixuid_private *private = ntvfs->private_data;
481 PASS_THRU_REQ(ntvfs, req, logoff, (ntvfs, req));
483 private->last_token = NULL;
491 static NTSTATUS unixuid_async_setup(struct ntvfs_module_context *ntvfs,
492 struct smbsrv_request *req,
497 PASS_THRU_REQ(ntvfs, req, async_setup, (ntvfs, req, private));
503 cancel an async request
505 static NTSTATUS unixuid_cancel(struct ntvfs_module_context *ntvfs,
506 struct smbsrv_request *req)
510 PASS_THRU_REQ(ntvfs, req, cancel, (ntvfs, req));
518 static NTSTATUS unixuid_lock(struct ntvfs_module_context *ntvfs,
519 struct smbsrv_request *req, union smb_lock *lck)
523 PASS_THRU_REQ(ntvfs, req, lock, (ntvfs, req, lck));
529 set info on a open file
531 static NTSTATUS unixuid_setfileinfo(struct ntvfs_module_context *ntvfs,
532 struct smbsrv_request *req,
533 union smb_setfileinfo *info)
537 PASS_THRU_REQ(ntvfs, req, setfileinfo, (ntvfs, req, info));
544 return filesystem space info
546 static NTSTATUS unixuid_fsinfo(struct ntvfs_module_context *ntvfs,
547 struct smbsrv_request *req, union smb_fsinfo *fs)
551 PASS_THRU_REQ(ntvfs, req, fsinfo, (ntvfs, req, fs));
557 return print queue info
559 static NTSTATUS unixuid_lpq(struct ntvfs_module_context *ntvfs,
560 struct smbsrv_request *req, union smb_lpq *lpq)
564 PASS_THRU_REQ(ntvfs, req, lpq, (ntvfs, req, lpq));
570 list files in a directory matching a wildcard pattern
572 static NTSTATUS unixuid_search_first(struct ntvfs_module_context *ntvfs,
573 struct smbsrv_request *req, union smb_search_first *io,
574 void *search_private,
575 BOOL (*callback)(void *, union smb_search_data *))
579 PASS_THRU_REQ(ntvfs, req, search_first, (ntvfs, req, io, search_private, callback));
584 /* continue a search */
585 static NTSTATUS unixuid_search_next(struct ntvfs_module_context *ntvfs,
586 struct smbsrv_request *req, union smb_search_next *io,
587 void *search_private,
588 BOOL (*callback)(void *, union smb_search_data *))
592 PASS_THRU_REQ(ntvfs, req, search_next, (ntvfs, req, io, search_private, callback));
598 static NTSTATUS unixuid_search_close(struct ntvfs_module_context *ntvfs,
599 struct smbsrv_request *req, union smb_search_close *io)
603 PASS_THRU_REQ(ntvfs, req, search_close, (ntvfs, req, io));
608 /* SMBtrans - not used on file shares */
609 static NTSTATUS unixuid_trans(struct ntvfs_module_context *ntvfs,
610 struct smbsrv_request *req, struct smb_trans2 *trans2)
614 PASS_THRU_REQ(ntvfs, req, trans, (ntvfs, req, trans2));
620 initialise the unixuid backend, registering ourselves with the ntvfs subsystem
622 NTSTATUS ntvfs_unixuid_init(void)
625 struct ntvfs_ops ops;
629 /* fill in all the operations */
630 ops.connect = unixuid_connect;
631 ops.disconnect = unixuid_disconnect;
632 ops.unlink = unixuid_unlink;
633 ops.chkpath = unixuid_chkpath;
634 ops.qpathinfo = unixuid_qpathinfo;
635 ops.setpathinfo = unixuid_setpathinfo;
636 ops.openfile = unixuid_openfile;
637 ops.mkdir = unixuid_mkdir;
638 ops.rmdir = unixuid_rmdir;
639 ops.rename = unixuid_rename;
640 ops.copy = unixuid_copy;
641 ops.ioctl = unixuid_ioctl;
642 ops.read = unixuid_read;
643 ops.write = unixuid_write;
644 ops.seek = unixuid_seek;
645 ops.flush = unixuid_flush;
646 ops.close = unixuid_close;
647 ops.exit = unixuid_exit;
648 ops.lock = unixuid_lock;
649 ops.setfileinfo = unixuid_setfileinfo;
650 ops.qfileinfo = unixuid_qfileinfo;
651 ops.fsinfo = unixuid_fsinfo;
652 ops.lpq = unixuid_lpq;
653 ops.search_first = unixuid_search_first;
654 ops.search_next = unixuid_search_next;
655 ops.search_close = unixuid_search_close;
656 ops.trans = unixuid_trans;
657 ops.logoff = unixuid_logoff;
658 ops.async_setup = unixuid_async_setup;
659 ops.cancel = unixuid_cancel;
661 ops.name = "unixuid";
663 /* we register under all 3 backend types, as we are not type specific */
664 ops.type = NTVFS_DISK;
665 ret = ntvfs_register(&ops);
666 if (!NT_STATUS_IS_OK(ret)) goto failed;
668 ops.type = NTVFS_PRINT;
669 ret = ntvfs_register(&ops);
670 if (!NT_STATUS_IS_OK(ret)) goto failed;
672 ops.type = NTVFS_IPC;
673 ret = ntvfs_register(&ops);
674 if (!NT_STATUS_IS_OK(ret)) goto failed;