source3/modules/onefs_acl.c

   1 /*
   2  * Unix SMB/CIFS implementation.
   3  *
   4  * Support for OneFS native NTFS ACLs
   5  *
   6  * Copyright (C) Steven Danneman, 2008
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 3 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 #include "onefs.h"
  23
  24 #include <isi_acl/isi_acl_util.h>
  25 #include <ifs/ifs_syscalls.h>
  26
  27 const struct enum_list enum_onefs_acl_wire_format[] = {
  28         {ACL_FORMAT_RAW,  "No Format"},
  29         {ACL_FORMAT_WINDOWS_SD, "Format Windows SD"},
  30         {ACL_FORMAT_ALWAYS, "Always Format SD"},
  31         {-1, NULL}
  32 };
  33
  34 /**
  35  * Turn SID into UID/GID and setup a struct ifs_identity
  36  */
  37 static bool
  38 onefs_sid_to_identity(const DOM_SID *sid, struct ifs_identity *id,
  39     bool is_group)
  40 {
  41         enum ifs_identity_type type = IFS_ID_TYPE_LAST+1;
  42         uid_t uid = 0;
  43         gid_t gid = 0;
  44
  45         if (!sid || sid_equal(sid, &global_sid_NULL))
  46                 type = IFS_ID_TYPE_NULL;
  47         else if (sid_equal(sid, &global_sid_World))
  48                 type = IFS_ID_TYPE_EVERYONE;
  49         else if (sid_equal(sid, &global_sid_Creator_Owner))
  50                 type = IFS_ID_TYPE_CREATOR_OWNER;
  51         else if (sid_equal(sid, &global_sid_Creator_Group))
  52                 type = IFS_ID_TYPE_CREATOR_GROUP;
  53         else if (is_group) {
  54                 if (!sid_to_gid(sid, &gid))
  55                         return false;
  56                 type = IFS_ID_TYPE_GID;
  57         } else {
  58                 if (sid_to_uid(sid, &uid))
  59                         type = IFS_ID_TYPE_UID;
  60                 else if (sid_to_gid(sid, &gid))
  61                         type = IFS_ID_TYPE_GID;
  62                 else
  63                         return false;
  64         }
  65
  66         if (aclu_initialize_identity(id, type, uid, gid, is_group)) {
  67                 DEBUG(3, ("Call to aclu_initialize_identity failed! id=%x, "
  68                     "type=%d, uid=%u, gid=%u, is_group=%d\n",
  69                     (unsigned int)id, type, uid, gid, is_group));
  70                 return false;
  71         }
  72
  73         return true;
  74 }
  75
  76 /**
  77  * Turn struct ifs_identity into SID
  78  */
  79 static bool
  80 onefs_identity_to_sid(struct ifs_identity *id, DOM_SID *sid)
  81 {
  82         if (!id || !sid)
  83                 return false;
  84
  85         if (id->type >= IFS_ID_TYPE_LAST)
  86                 return false;
  87
  88         switch (id->type) {
  89             case IFS_ID_TYPE_UID:
  90                 uid_to_sid(sid, id->id.uid);
  91                 break;
  92             case IFS_ID_TYPE_GID:
  93                 gid_to_sid(sid, id->id.gid);
  94                 break;
  95             case IFS_ID_TYPE_EVERYONE:
  96                 sid_copy(sid, &global_sid_World);
  97                 break;
  98             case IFS_ID_TYPE_NULL:
  99                 sid_copy(sid, &global_sid_NULL);
 100                 break;
 101             case IFS_ID_TYPE_CREATOR_OWNER:
 102                 sid_copy(sid, &global_sid_Creator_Owner);
 103                 break;
 104             case IFS_ID_TYPE_CREATOR_GROUP:
 105                 sid_copy(sid, &global_sid_Creator_Group);
 106                 break;
 107             default:
 108                 DEBUG(0, ("Unknown identity type: %d\n", id->type));
 109                 return false;
 110         }
 111
 112         return true;
 113 }
 114
 115 static bool
 116 onefs_og_to_identity(DOM_SID *sid, struct ifs_identity * ident,
 117     bool is_group, int snum)
 118 {
 119         const DOM_SID *b_admin_sid = &global_sid_Builtin_Administrators;
 120
 121         if (!onefs_sid_to_identity(sid, ident, is_group)) {
 122                 if (!lp_parm_bool(snum, PARM_ONEFS_TYPE,
 123                      PARM_UNMAPPABLE_SIDS_IGNORE,
 124                      PARM_UNMAPPABLE_SIDS_IGNORE_DEFAULT)) {
 125                         DEBUG(3, ("Unresolvable SID (%s) found.\n",
 126                                 sid_string_dbg(sid)));
 127                         return false;
 128                 }
 129                 if (!onefs_sid_to_identity(b_admin_sid, ident, is_group)) {
 130                         return false;
 131                 }
 132                 DEBUG(3, ("Mapping unresolvable owner SID (%s) to Builtin "
 133                         "Administrators group.\n",
 134                         sid_string_dbg(sid)));
 135         }
 136         return true;
 137 }
 138
 139 static bool
 140 sid_in_ignore_list(DOM_SID * sid, int snum)
 141 {
 142         const char ** sid_list = NULL;
 143         DOM_SID match;
 144
 145         sid_list = lp_parm_string_list(snum, PARM_ONEFS_TYPE,
 146             PARM_UNMAPPABLE_SIDS_IGNORE_LIST,
 147             PARM_UNMAPPABLE_SIDS_IGNORE_LIST_DEFAULT);
 148
 149         /* Fast path a NULL list */
 150         if (!sid_list || *sid_list == NULL)
 151                 return false;
 152
 153         while (*sid_list) {
 154                 if (string_to_sid(&match, *sid_list))
 155                         if (sid_equal(sid, &match))
 156                                 return true;
 157                 sid_list++;
 158         }
 159
 160         return false;
 161 }
 162
 163 /**
 164  * Convert a trustee to a struct identity
 165  */
 166 static bool
 167 onefs_samba_ace_to_ace(SEC_ACE * samba_ace, struct ifs_ace * ace,
 168     bool *mapped, int snum)
 169 {
 170         struct ifs_identity ident = {.type=IFS_ID_TYPE_LAST, .id.uid=0};
 171
 172         SMB_ASSERT(ace);
 173         SMB_ASSERT(mapped);
 174         SMB_ASSERT(samba_ace);
 175
 176         if (onefs_sid_to_identity(&samba_ace->trustee, &ident, false)) {
 177                 *mapped = true;
 178         } else {
 179
 180                 SMB_ASSERT(ident.id.uid >= 0);
 181
 182                 /* Ignore the sid if it's in the list */
 183                 if (sid_in_ignore_list(&samba_ace->trustee, snum)) {
 184                         DEBUG(3, ("Silently failing to set ACE for SID (%s) "
 185                                 "because it is in the ignore sids list\n",
 186                                 sid_string_dbg(&samba_ace->trustee)));
 187                         *mapped = false;
 188                 } else if ((samba_ace->type == SEC_ACE_TYPE_ACCESS_DENIED) &&
 189                     lp_parm_bool(snum, PARM_ONEFS_TYPE,
 190                     PARM_UNMAPPABLE_SIDS_DENY_EVERYONE,
 191                     PARM_UNMAPPABLE_SIDS_DENY_EVERYONE_DEFAULT)) {
 192                         /* If the ace is deny translated to Everyone */
 193                         DEBUG(3, ("Mapping unresolvable deny ACE SID (%s) "
 194                                 "to Everyone.\n",
 195                                 sid_string_dbg(&samba_ace->trustee)));
 196                         if (aclu_initialize_identity(&ident,
 197                                 IFS_ID_TYPE_EVERYONE, 0, 0, False) != 0) {
 198                                 DEBUG(2, ("aclu_initialize_identity() "
 199                                         "failed making Everyone\n"));
 200                                 return false;
 201                         }
 202                         *mapped = true;
 203                 } else if (lp_parm_bool(snum, PARM_ONEFS_TYPE,
 204                            PARM_UNMAPPABLE_SIDS_IGNORE,
 205                            PARM_UNMAPPABLE_SIDS_IGNORE_DEFAULT)) {
 206                         DEBUG(3, ("Silently failing to set ACE for SID (%s) "
 207                                 "because it is unresolvable\n",
 208                                 sid_string_dbg(&samba_ace->trustee)));
 209                         *mapped = false;
 210                 } else {
 211                         /* Fail for lack of a better option */
 212                         return false;
 213                 }
 214         }
 215
 216         if (*mapped) {
 217                 if (aclu_initialize_ace(ace, samba_ace->type,
 218                         samba_ace->access_mask, samba_ace->flags, 0,
 219                         &ident))
 220                         return false;
 221
 222                 if ((ace->trustee.type == IFS_ID_TYPE_CREATOR_OWNER ||
 223                         ace->trustee.type == IFS_ID_TYPE_CREATOR_GROUP) &&
 224                     nt4_compatible_acls())
 225                         ace->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
 226         }
 227
 228         return true;
 229 }
 230
 231 /**
 232  * Convert a SEC_ACL to a struct ifs_security_acl
 233  */
 234 static bool
 235 onefs_samba_acl_to_acl(SEC_ACL *samba_acl, struct ifs_security_acl **acl,
 236     bool * ignore_aces, int snum)
 237 {
 238         int num_aces = 0;
 239         struct ifs_ace *aces = NULL;
 240         SEC_ACE *samba_aces;
 241         bool mapped;
 242         int i, j;
 243
 244         SMB_ASSERT(ignore_aces);
 245
 246         if ((!acl) || (!samba_acl))
 247                 return false;
 248
 249         samba_aces = samba_acl->aces;
 250
 251         if (samba_acl->num_aces > 0 && samba_aces) {
 252                 /* Setup ACES */
 253                 num_aces = samba_acl->num_aces;
 254                 aces = SMB_MALLOC_ARRAY(struct ifs_ace, num_aces);
 255
 256                 for (i = 0, j = 0; j < num_aces; i++, j++) {
 257                         if (!onefs_samba_ace_to_ace(&samba_aces[j],
 258                                 &aces[i], &mapped, snum))
 259                                 goto err_free;
 260
 261                         if (!mapped)
 262                                 i--;
 263                 }
 264                 num_aces = i;
 265         }
 266
 267         /* If aces are given but we cannot apply them due to the reasons
 268          * above we do not change the SD.  However, if we are told to
 269          * explicitly set an SD with 0 aces we honor this operation */
 270         *ignore_aces = samba_acl->num_aces > 0 && num_aces < 1;
 271
 272         if (*ignore_aces == false)
 273                 if (aclu_initialize_acl(acl, aces, num_aces))
 274                         goto err_free;
 275
 276         /* Currently aclu_initialize_acl should copy the aces over, allowing
 277          * us to immediately free */
 278         free(aces);
 279         return true;
 280
 281 err_free:
 282         free(aces);
 283         return false;
 284 }
 285
 286 /**
 287  * Convert a struct ifs_security_acl to a SEC_ACL
 288  */
 289 static bool
 290 onefs_acl_to_samba_acl(struct ifs_security_acl *acl, SEC_ACL **samba_acl)
 291 {
 292         SEC_ACE *samba_aces = NULL;
 293         SEC_ACL *tmp_samba_acl = NULL;
 294         int i, num_aces = 0;
 295
 296         if (!samba_acl)
 297                 return false;
 298
 299         /* NULL ACL */
 300         if (!acl) {
 301                 *samba_acl = NULL;
 302                 return true;
 303         }
 304
 305         /* Determine number of aces in ACL */
 306         if (!acl->aces)
 307                 num_aces = 0;
 308         else
 309                 num_aces = acl->num_aces;
 310
 311         /* Allocate the ace list. */
 312         if (num_aces > 0) {
 313                 if ((samba_aces = SMB_MALLOC_ARRAY(SEC_ACE, num_aces)) == NULL)
 314                 {
 315                         DEBUG(0, ("Unable to malloc space for %d aces.\n",
 316                             num_aces));
 317                         return false;
 318                 }
 319                 memset(samba_aces, '\0', (num_aces) * sizeof(SEC_ACE));
 320         }
 321
 322         for (i = 0; i < num_aces; i++) {
 323                 DOM_SID sid;
 324
 325                 if (!onefs_identity_to_sid(&acl->aces[i].trustee, &sid))
 326                         goto err_free;
 327
 328                 init_sec_ace(&samba_aces[i], &sid, acl->aces[i].type,
 329                     acl->aces[i].access_mask, acl->aces[i].flags);
 330         }
 331
 332         if ((tmp_samba_acl = make_sec_acl(talloc_tos(), acl->revision, num_aces,
 333             samba_aces)) == NULL) {
 334                DEBUG(0, ("Unable to malloc space for acl.\n"));
 335                goto err_free;
 336         }
 337
 338         *samba_acl = tmp_samba_acl;
 339         SAFE_FREE(samba_aces);
 340         return true;
 341 err_free:
 342         SAFE_FREE(samba_aces);
 343         return false;
 344 }
 345
 346 /**
 347  * @brief Reorder ACLs into the "correct" order for Windows Explorer.
 348  *
 349  * Windows Explorer expects ACLs to be in a standard order (inherited first,
 350  * then deny, then permit.)  When ACLs are composed from POSIX file permissions
 351  * bits, they may not match these expectations, generating an annoying warning
 352  * dialog for the user.  This function will, if configured appropriately,
 353  * reorder the ACLs for these "synthetic" (POSIX-derived) descriptors to prevent
 354  * this.  The list is changed within the security descriptor passed in.
 355  *
 356  * @param fsp files_struct with service configs; must not be NULL
 357  * @param sd security descriptor being normalized;
 358  *           sd->dacl->aces is rewritten in-place, so must not be NULL
 359  * @return true on success, errno will be set on error
 360  *
 361  * @bug Although Windows Explorer likes the reordering, they seem to cause
 362  *  problems with Excel and Word sending back the reordered ACLs to us and
 363  *  changing policy; see Isilon bug 30165.
 364  */
 365 static bool
 366 onefs_canon_acl(files_struct *fsp, struct ifs_security_descriptor *sd)
 367 {
 368         int error = 0;
 369         int cur;
 370         struct ifs_ace *new_aces = NULL;
 371         int new_aces_count = 0;
 372         SMB_STRUCT_STAT sbuf;
 373
 374         if (sd == NULL || sd->dacl == NULL || sd->dacl->num_aces == 0)
 375                 return true;
 376
 377         /*
 378          * Find out if this is a windows bit, and if the smb policy wants us to
 379          * lie about the sd.
 380          */
 381         SMB_ASSERT(fsp != NULL);
 382         switch (lp_parm_enum(SNUM(fsp->conn), PARM_ONEFS_TYPE,
 383                 PARM_ACL_WIRE_FORMAT, enum_onefs_acl_wire_format,
 384                 PARM_ACL_WIRE_FORMAT_DEFAULT))  {
 385         case ACL_FORMAT_RAW:
 386                 return true;
 387
 388         case ACL_FORMAT_WINDOWS_SD:
 389                 error = SMB_VFS_FSTAT(fsp, &sbuf);
 390                 if (error)
 391                         return false;
 392
 393                 if ((sbuf.st_flags & SF_HASNTFSACL) != 0) {
 394                         DEBUG(10, ("Did not canonicalize ACLs because a "
 395                             "Windows ACL set was found for file %s\n",
 396                             fsp->fsp_name));
 397                         return true;
 398                 }
 399                 break;
 400
 401         case ACL_FORMAT_ALWAYS:
 402                 break;
 403
 404         default:
 405                 SMB_ASSERT(false);
 406                 return false;
 407         }
 408
 409         new_aces = SMB_MALLOC_ARRAY(struct ifs_ace, sd->dacl->num_aces);
 410         if (new_aces == NULL)
 411                 return false;
 412
 413         /*
 414          * By walking down the list 3 separate times, we can avoid the need
 415          * to create multiple temp buffers and extra copies.
 416          */
 417         for (cur = 0; cur < sd->dacl->num_aces; cur++)  {
 418                 if (sd->dacl->aces[cur].flags & IFS_ACE_FLAG_INHERITED_ACE)
 419                         new_aces[new_aces_count++] = sd->dacl->aces[cur];
 420         }
 421
 422         for (cur = 0; cur < sd->dacl->num_aces; cur++)  {
 423                 if (!(sd->dacl->aces[cur].flags & IFS_ACE_FLAG_INHERITED_ACE) &&
 424                     (sd->dacl->aces[cur].type == IFS_ACE_TYPE_ACCESS_DENIED))
 425                         new_aces[new_aces_count++] = sd->dacl->aces[cur];
 426         }
 427
 428         for (cur = 0; cur < sd->dacl->num_aces; cur++)  {
 429                 if (!(sd->dacl->aces[cur].flags & IFS_ACE_FLAG_INHERITED_ACE) &&
 430                     !(sd->dacl->aces[cur].type == IFS_ACE_TYPE_ACCESS_DENIED))
 431                         new_aces[new_aces_count++] = sd->dacl->aces[cur];
 432         }
 433
 434         SMB_ASSERT(new_aces_count == sd->dacl->num_aces);
 435         DEBUG(10, ("Performed canonicalization of ACLs for file %s\n",
 436             fsp->fsp_name));
 437
 438         /*
 439          * At this point you would think we could just do this:
 440          *   SAFE_FREE(sd->dacl->aces);
 441          *   sd->dacl->aces = new_aces;
 442          * However, in some cases the existing aces pointer does not point
 443          * to the beginning of an allocated block.  So we have to do a more
 444          * expensive memcpy()
 445          */
 446         memcpy(sd->dacl->aces, new_aces,
 447             sizeof(struct ifs_ace) * new_aces_count);
 448
 449         SAFE_FREE(new_aces);
 450         return true;
 451 }
 452
 453
 454 /**
 455  * This enum is a helper for onefs_fget_nt_acl() to communicate with
 456  * onefs_init_ace().
 457  */
 458 enum mode_ident { USR, GRP, OTH };
 459
 460 /**
 461  * Initializes an ACE for addition to a synthetic ACL.
 462  */
 463 static struct ifs_ace onefs_init_ace(struct connection_struct *conn,
 464                                      mode_t mode,
 465                                      bool isdir,
 466                                      enum mode_ident ident)
 467 {
 468         struct ifs_ace result;
 469         enum ifs_ace_rights r,w,x;
 470
 471         r = isdir ? UNIX_DIRECTORY_ACCESS_R : UNIX_ACCESS_R;
 472         w = isdir ? UNIX_DIRECTORY_ACCESS_W : UNIX_ACCESS_W;
 473         x = isdir ? UNIX_DIRECTORY_ACCESS_X : UNIX_ACCESS_X;
 474
 475         result.type = IFS_ACE_TYPE_ACCESS_ALLOWED;
 476         result.ifs_flags = 0;
 477         result.flags = isdir ? IFS_ACE_FLAG_CONTAINER_INHERIT :
 478             IFS_ACE_FLAG_OBJECT_INHERIT;
 479         result.flags |= IFS_ACE_FLAG_INHERIT_ONLY;
 480
 481         switch (ident) {
 482         case USR:
 483                 result.access_mask =
 484                     ((mode & S_IRUSR) ? r : 0 ) |
 485                     ((mode & S_IWUSR) ? w : 0 ) |
 486                     ((mode & S_IXUSR) ? x : 0 );
 487                 if (lp_parm_bool(SNUM(conn), PARM_ONEFS_TYPE,
 488                     PARM_CREATOR_OWNER_GETS_FULL_CONTROL,
 489                     PARM_CREATOR_OWNER_GETS_FULL_CONTROL_DEFAULT))
 490                         result.access_mask |= GENERIC_ALL_ACCESS;
 491                 result.trustee.type = IFS_ID_TYPE_CREATOR_OWNER;
 492                 break;
 493         case GRP:
 494                 result.access_mask =
 495                     ((mode & S_IRGRP) ? r : 0 ) |
 496                     ((mode & S_IWGRP) ? w : 0 ) |
 497                     ((mode & S_IXGRP) ? x : 0 );
 498                 result.trustee.type = IFS_ID_TYPE_CREATOR_GROUP;
 499                 break;
 500         case OTH:
 501                 result.access_mask =
 502                     ((mode & S_IROTH) ? r : 0 ) |
 503                     ((mode & S_IWOTH) ? w : 0 ) |
 504                     ((mode & S_IXOTH) ? x : 0 );
 505                 result.trustee.type = IFS_ID_TYPE_EVERYONE;
 506                 break;
 507         }
 508
 509         return result;
 510 }
 511
 512 /**
 513  * This adds inheritable ACEs to the end of the DACL, with the ACEs
 514  * being derived from the mode bits.  This is useful for clients that have the
 515  * MoveSecurityAttributes regkey set to 0 or are in Simple File Sharing Mode.
 516  *
 517  * On these clients, when copying files from one folder to another inside the
 518  * same volume/share, the DACL is explicitely cleared.  Without inheritable
 519  * aces on the target folder the mode bits of the copied file are set to 000.
 520  *
 521  * See Isilon Bug 27990
 522  *
 523  * Note: This function allocates additional memory onto sd->dacl->aces, that
 524  * must be freed by the caller.
 525  */
 526 static bool add_sfs_aces(files_struct *fsp, struct ifs_security_descriptor *sd)
 527 {
 528         int error;
 529         SMB_STRUCT_STAT sbuf;
 530
 531         error = SMB_VFS_FSTAT(fsp, &sbuf);
 532         if (error) {
 533                 DEBUG(0, ("Failed to stat %s in simple files sharing "
 534                           "compatibility mode. errno=%d\n",
 535                           fsp->fsp_name, errno));
 536                 return false;
 537         }
 538
 539         /* Only continue if this is a synthetic ACL and a directory. */
 540         if (S_ISDIR(sbuf.st_mode) && (sbuf.st_flags & SF_HASNTFSACL) == 0) {
 541                 struct ifs_ace new_aces[6];
 542                 struct ifs_ace *old_aces;
 543                 int i, num_aces_to_add = 0;
 544                 mode_t file_mode = 0, dir_mode = 0;
 545
 546                 /* Use existing samba logic to derive the mode bits. */
 547                 file_mode = unix_mode(fsp->conn, 0, fsp->fsp_name, false);
 548                 dir_mode = unix_mode(fsp->conn, aDIR, fsp->fsp_name, false);
 549
 550                 /* Initialize ACEs. */
 551                 new_aces[0] = onefs_init_ace(fsp->conn, file_mode, false, USR);
 552                 new_aces[1] = onefs_init_ace(fsp->conn, file_mode, false, GRP);
 553                 new_aces[2] = onefs_init_ace(fsp->conn, file_mode, false, OTH);
 554                 new_aces[3] = onefs_init_ace(fsp->conn, dir_mode, true, USR);
 555                 new_aces[4] = onefs_init_ace(fsp->conn, dir_mode, true, GRP);
 556                 new_aces[5] = onefs_init_ace(fsp->conn, dir_mode, true, OTH);
 557
 558                 for (i = 0; i < 6; i++)
 559                         if (new_aces[i].access_mask != 0)
 560                                 num_aces_to_add++;
 561
 562                 /* Expand the ACEs array */
 563                 if (num_aces_to_add != 0) {
 564                         old_aces = sd->dacl->aces;
 565
 566                         sd->dacl->aces = SMB_MALLOC_ARRAY(struct ifs_ace,
 567                             sd->dacl->num_aces + num_aces_to_add);
 568                         if (!sd->dacl->aces) {
 569                                 DEBUG(0, ("Unable to malloc space for "
 570                                     "new_aces: %d.\n",
 571                                      sd->dacl->num_aces + num_aces_to_add));
 572                                 return false;
 573                         }
 574                         memcpy(sd->dacl->aces, old_aces,
 575                             sizeof(struct ifs_ace) * sd->dacl->num_aces);
 576
 577                         /* Add the new ACEs to the DACL. */
 578                         for (i = 0; i < 6; i++) {
 579                                 if (new_aces[i].access_mask != 0) {
 580                                         sd->dacl->aces[sd->dacl->num_aces] =
 581                                             new_aces[i];
 582                                         sd->dacl->num_aces++;
 583                                 }
 584                         }
 585                 }
 586         }
 587         return true;
 588 }
 589
 590 /**
 591  * Isilon-specific function for getting an NTFS ACL from an open file.
 592  *
 593  * @param[out] ppdesc SecDesc to allocate and fill in
 594  *
 595  * @return NTSTATUS based off errno on error
 596  */
 597 NTSTATUS
 598 onefs_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
 599                   uint32 security_info, SEC_DESC **ppdesc)
 600 {
 601         int error;
 602         uint32_t sd_size = 0;
 603         size_t size = 0;
 604         struct ifs_security_descriptor *sd = NULL;
 605         DOM_SID owner_sid, group_sid;
 606         DOM_SID *ownerp, *groupp;
 607         SEC_ACL *dacl, *sacl;
 608         SEC_DESC *pdesc;
 609         bool alloced = false;
 610         bool new_aces_alloced = false;
 611         bool fopened = false;
 612         NTSTATUS status = NT_STATUS_OK;
 613
 614         START_PROFILE(syscall_get_sd);
 615
 616         *ppdesc = NULL;
 617
 618         DEBUG(5, ("Getting sd for file %s. security_info=%u\n",
 619             fsp->fsp_name, security_info));
 620
 621         if (lp_parm_bool(SNUM(fsp->conn), PARM_ONEFS_TYPE,
 622                 PARM_IGNORE_SACLS, PARM_IGNORE_SACLS_DEFAULT)) {
 623                 DEBUG(5, ("Ignoring SACL on %s.\n", fsp->fsp_name));
 624                 security_info &= ~SACL_SECURITY_INFORMATION;
 625         }
 626
 627         if (fsp->fh->fd == -1) {
 628                 if ((fsp->fh->fd = onefs_sys_create_file(handle->conn,
 629                                                          -1,
 630                                                          fsp->fsp_name,
 631                                                          0,
 632                                                          0,
 633                                                          0,
 634                                                          0,
 635                                                          0,
 636                                                          0,
 637                                                          INTERNAL_OPEN_ONLY,
 638                                                          0,
 639                                                          NULL,
 640                                                          0,
 641                                                          NULL)) == -1) {
 642                         DEBUG(0, ("Error opening file %s. errno=%d (%s)\n",
 643                                   fsp->fsp_name, errno, strerror(errno)));
 644                         status = map_nt_error_from_unix(errno);
 645                         goto out;
 646                 }
 647                 fopened = true;
 648         }
 649
 650         /* Get security descriptor */
 651         sd_size = 0;
 652         do {
 653                 /* Allocate memory for get_security_descriptor */
 654                 if (sd_size > 0) {
 655                         sd = SMB_REALLOC(sd, sd_size);
 656                         if (!sd) {
 657                                 DEBUG(0, ("Unable to malloc %u bytes of space "
 658                                     "for security descriptor.\n", sd_size));
 659                                 status = map_nt_error_from_unix(errno);
 660                                 goto out;
 661                         }
 662
 663                         alloced = true;
 664                 }
 665
 666                 error = ifs_get_security_descriptor(fsp->fh->fd, security_info,
 667                     sd_size, &sd_size, sd);
 668                 if (error && (errno != EMSGSIZE)) {
 669                         DEBUG(0, ("Failed getting size of security descriptor! "
 670                             "errno=%d\n", errno));
 671                         status = map_nt_error_from_unix(errno);
 672                         goto out;
 673                 }
 674         } while (error);
 675
 676         DEBUG(5, ("Got sd, size=%u:\n", sd_size));
 677
 678         if (lp_parm_bool(SNUM(fsp->conn),
 679             PARM_ONEFS_TYPE,
 680             PARM_SIMPLE_FILE_SHARING_COMPATIBILITY_MODE,
 681             PARM_SIMPLE_FILE_SHARING_COMPATIBILITY_MODE_DEFAULT) &&
 682             sd->dacl) {
 683                 if(!(new_aces_alloced = add_sfs_aces(fsp, sd)))
 684                         goto out;
 685         }
 686
 687         if (!(onefs_canon_acl(fsp, sd))) {
 688                 status = map_nt_error_from_unix(errno);
 689                 goto out;
 690         }
 691
 692         DEBUG(5, ("Finished canonicalizing ACL\n"));
 693
 694         ownerp = NULL;
 695         groupp = NULL;
 696         dacl = NULL;
 697         sacl = NULL;
 698
 699         /* Copy owner into ppdesc */
 700         if (security_info & OWNER_SECURITY_INFORMATION) {
 701                 if (!onefs_identity_to_sid(sd->owner, &owner_sid)) {
 702                         status = NT_STATUS_INVALID_PARAMETER;
 703                         goto out;
 704                 }
 705
 706                 ownerp = &owner_sid;
 707         }
 708
 709         /* Copy group into ppdesc */
 710         if (security_info & GROUP_SECURITY_INFORMATION) {
 711                 if (!onefs_identity_to_sid(sd->group, &group_sid)) {
 712                         status = NT_STATUS_INVALID_PARAMETER;
 713                         goto out;
 714                 }
 715
 716                 groupp = &group_sid;
 717         }
 718
 719         /* Copy DACL into ppdesc */
 720         if (security_info & DACL_SECURITY_INFORMATION) {
 721                 if (!onefs_acl_to_samba_acl(sd->dacl, &dacl)) {
 722                         status = NT_STATUS_INVALID_PARAMETER;
 723                         goto out;
 724                 }
 725         }
 726
 727         /* Copy SACL into ppdesc */
 728         if (security_info & SACL_SECURITY_INFORMATION) {
 729                 if (!onefs_acl_to_samba_acl(sd->sacl, &sacl)) {
 730                         status = NT_STATUS_INVALID_PARAMETER;
 731                         goto out;
 732                 }
 733         }
 734
 735         /* AUTO_INHERIT_REQ bits are not returned over the wire so strip them
 736          * off.  Eventually we should stop storing these in the kernel
 737          * all together. See Isilon bug 40364 */
 738         sd->control &= ~(IFS_SD_CTRL_DACL_AUTO_INHERIT_REQ |
 739                          IFS_SD_CTRL_SACL_AUTO_INHERIT_REQ);
 740
 741         pdesc = make_sec_desc(talloc_tos(), sd->revision, sd->control,
 742             ownerp, groupp, sacl, dacl, &size);
 743
 744         if (!pdesc) {
 745                 DEBUG(0, ("Problem with make_sec_desc. Memory?\n"));
 746                 status = map_nt_error_from_unix(errno);
 747                 goto out;
 748         }
 749
 750         *ppdesc = pdesc;
 751
 752         DEBUG(5, ("Finished retrieving/canonicalizing SD!\n"));
 753         /* FALLTHROUGH */
 754 out:
 755
 756         END_PROFILE(syscall_get_sd);
 757
 758         if (alloced && sd) {
 759                 if (new_aces_alloced && sd->dacl->aces)
 760                         SAFE_FREE(sd->dacl->aces);
 761
 762                 SAFE_FREE(sd);
 763         }
 764
 765         if (fopened) {
 766                 close(fsp->fh->fd);
 767                 fsp->fh->fd = -1;
 768         }
 769
 770         return status;
 771 }
 772
 773 /**
 774  * Isilon-specific function for getting an NTFS ACL from a file path.
 775  *
 776  * Since onefs_fget_nt_acl() needs to open a filepath if the fd is invalid,
 777  * we just mock up a files_struct with the path and bad fd and call into it.
 778  *
 779  * @param[out] ppdesc SecDesc to allocate and fill in
 780  *
 781  * @return NTSTATUS based off errno on error
 782  */
 783 NTSTATUS
 784 onefs_get_nt_acl(vfs_handle_struct *handle, const char* name,
 785                  uint32 security_info, SEC_DESC **ppdesc)
 786 {
 787         files_struct finfo;
 788         struct fd_handle fh;
 789
 790         ZERO_STRUCT(finfo);
 791         ZERO_STRUCT(fh);
 792
 793         finfo.fnum = -1;
 794         finfo.conn = handle->conn;
 795         finfo.fh = &fh;
 796         finfo.fh->fd = -1;
 797         finfo.fsp_name = CONST_DISCARD(char *, name);
 798
 799         return onefs_fget_nt_acl(handle, &finfo, security_info, ppdesc);
 800 }
 801
 802 /**
 803  * Isilon-specific function for setting up an ifs_security_descriptor, given a
 804  * samba SEC_DESC.
 805  *
 806  * @param[out] sd ifs_security_descriptor to fill in
 807  *
 808  * @return NTSTATUS_OK if successful
 809  */
 810 NTSTATUS onefs_samba_sd_to_sd(uint32 security_info_sent, SEC_DESC *psd,
 811                               struct ifs_security_descriptor *sd, int snum)
 812 {
 813         struct ifs_security_acl *daclp, *saclp;
 814         struct ifs_identity owner, group, *ownerp, *groupp;
 815         bool ignore_aces;
 816
 817         ownerp = NULL;
 818         groupp = NULL;
 819         daclp = NULL;
 820         saclp = NULL;
 821
 822         /* Setup owner */
 823         if (security_info_sent & OWNER_SECURITY_INFORMATION) {
 824                 if (!onefs_og_to_identity(psd->owner_sid, &owner, false, snum))
 825                         return NT_STATUS_UNSUCCESSFUL;
 826
 827                 SMB_ASSERT(owner.id.uid >= 0);
 828
 829                 ownerp = &owner;
 830         }
 831
 832         /* Setup group */
 833         if (security_info_sent & GROUP_SECURITY_INFORMATION) {
 834                 if (!onefs_og_to_identity(psd->group_sid, &group, true, snum))
 835                         return NT_STATUS_UNSUCCESSFUL;
 836
 837                 SMB_ASSERT(group.id.gid >= 0);
 838
 839                 groupp = &group;
 840         }
 841
 842         /* Setup DACL */
 843         if ((security_info_sent & DACL_SECURITY_INFORMATION) && (psd->dacl)) {
 844                 if (!onefs_samba_acl_to_acl(psd->dacl, &daclp, &ignore_aces,
 845                         snum))
 846                         return NT_STATUS_UNSUCCESSFUL;
 847
 848                 if (ignore_aces == true)
 849                         security_info_sent &= ~DACL_SECURITY_INFORMATION;
 850         }
 851
 852         /* Setup SACL */
 853         if (security_info_sent & SACL_SECURITY_INFORMATION) {
 854
 855                 if (lp_parm_bool(snum, PARM_ONEFS_TYPE,
 856                             PARM_IGNORE_SACLS, PARM_IGNORE_SACLS_DEFAULT)) {
 857                         DEBUG(5, ("Ignoring SACLs.\n"));
 858                         security_info_sent &= ~SACL_SECURITY_INFORMATION;
 859                 } else {
 860                         if (psd->sacl) {
 861                                 if (!onefs_samba_acl_to_acl(psd->sacl,
 862                                         &saclp, &ignore_aces, snum))
 863                                         return NT_STATUS_UNSUCCESSFUL;
 864
 865                                 if (ignore_aces == true) {
 866                                         security_info_sent &=
 867                                             ~SACL_SECURITY_INFORMATION;
 868                                 }
 869                         }
 870                 }
 871         }
 872
 873         /* Setup ifs_security_descriptor */
 874         DEBUG(5,("Setting up SD\n"));
 875         if (aclu_initialize_sd(sd, psd->type, ownerp, groupp,
 876                 (daclp ? &daclp : NULL), (saclp ? &saclp : NULL), false))
 877                 return NT_STATUS_UNSUCCESSFUL;
 878
 879         return NT_STATUS_OK;
 880 }
 881
 882 /**
 883  * Isilon-specific function for setting an NTFS ACL on an open file.
 884  *
 885  * @return NT_STATUS_UNSUCCESSFUL for userspace errors, NTSTATUS based off
 886  * errno on syscall errors
 887  */
 888 NTSTATUS
 889 onefs_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
 890                   uint32 security_info_sent, SEC_DESC *psd)
 891 {
 892         struct ifs_security_descriptor sd = {};
 893         int fd;
 894         bool fopened = false;
 895         NTSTATUS status;
 896
 897         START_PROFILE(syscall_set_sd);
 898
 899         DEBUG(5,("Setting SD on file %s.\n", fsp->fsp_name ));
 900
 901         status = onefs_samba_sd_to_sd(security_info_sent, psd, &sd,
 902                                       SNUM(handle->conn));
 903
 904         if (!NT_STATUS_IS_OK(status)) {
 905                 DEBUG(3, ("SD initialization failure: %s\n", nt_errstr(status)));
 906                 goto out;
 907         }
 908
 909         fd = fsp->fh->fd;
 910         if (fd == -1) {
 911                 if ((fd = onefs_sys_create_file(handle->conn,
 912                                                 -1,
 913                                                 fsp->fsp_name,
 914                                                 0,
 915                                                 0,
 916                                                 0,
 917                                                 0,
 918                                                 0,
 919                                                 0,
 920                                                 INTERNAL_OPEN_ONLY,
 921                                                 0,
 922                                                 NULL,
 923                                                 0,
 924                                                 NULL)) == -1) {
 925                         DEBUG(0, ("Error opening file %s. errno=%d (%s)\n",
 926                                   fsp->fsp_name, errno, strerror(errno)));
 927                         status = map_nt_error_from_unix(errno);
 928                         goto out;
 929                 }
 930                 fopened = true;
 931         }
 932
 933         errno = 0;
 934         if (ifs_set_security_descriptor(fd, security_info_sent, &sd)) {
 935                 DEBUG(0, ("Error setting security descriptor = %d\n", errno));
 936                 status = map_nt_error_from_unix(errno);
 937                 goto out;
 938         }
 939
 940         DEBUG(5, ("Security descriptor set correctly!\n"));
 941         status = NT_STATUS_OK;
 942
 943         /* FALLTHROUGH */
 944 out:
 945         END_PROFILE(syscall_set_sd);
 946
 947         if (fopened)
 948                 close(fd);
 949
 950         aclu_free_sd(&sd, false);
 951         return status;
 952 }