source3/modules/onefs_acl.c

   1 /*
   2  * Unix SMB/CIFS implementation.
   3  *
   4  * Support for OneFS native NTFS ACLs
   5  *
   6  * Copyright (C) Steven Danneman, 2008
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 3 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 #include "includes.h"
  23
  24 #include <sys/isi_acl.h>
  25 #include <isi_acl/isi_acl_util.h>
  26 #include <sys/isi_oplock.h>
  27 #include <ifs/ifs_syscalls.h>
  28
  29 #include "onefs.h"
  30
  31 /**
  32  * Turn SID into UID/GID and setup a struct ifs_identity
  33  */
  34 static bool
  35 onefs_sid_to_identity(DOM_SID *sid, struct ifs_identity *id, bool is_group)
  36 {
  37         enum ifs_identity_type type = IFS_ID_TYPE_LAST+1;
  38         uid_t uid = 0;
  39         gid_t gid = 0;
  40
  41         if (!sid || sid_equal(sid, &global_sid_NULL))
  42                 type = IFS_ID_TYPE_NULL;
  43         else if (sid_equal(sid, &global_sid_World))
  44                 type = IFS_ID_TYPE_EVERYONE;
  45         else if (sid_equal(sid, &global_sid_Creator_Owner))
  46                 type = IFS_ID_TYPE_CREATOR_OWNER;
  47         else if (sid_equal(sid, &global_sid_Creator_Group))
  48                 type = IFS_ID_TYPE_CREATOR_GROUP;
  49         else if (is_group) {
  50                 if (!sid_to_gid(sid, &gid))
  51                         return false;
  52                 type = IFS_ID_TYPE_GID;
  53         } else {
  54                 if (sid_to_uid(sid, &uid))
  55                         type = IFS_ID_TYPE_UID;
  56                 else if (sid_to_gid(sid, &gid))
  57                         type = IFS_ID_TYPE_GID;
  58                 else
  59                         return false;
  60         }
  61
  62         if (aclu_initialize_identity(id, type, uid, gid, is_group)) {
  63                 DEBUG(3, ("Call to aclu_initialize_identity failed! id=%x, "
  64                     "type=%d, uid=%u, gid=%u, is_group=%d\n",
  65                     (unsigned int)id, type, uid, gid, is_group));
  66                 return false;
  67         }
  68
  69         return true;
  70 }
  71
  72 /**
  73  * Turn struct ifs_identity into SID
  74  */
  75 static bool
  76 onefs_identity_to_sid(struct ifs_identity *id, DOM_SID *sid)
  77 {
  78         if (!id || !sid)
  79                 return false;
  80
  81         if (id->type >= IFS_ID_TYPE_LAST)
  82                 return false;
  83
  84         switch (id->type) {
  85             case IFS_ID_TYPE_UID:
  86                 uid_to_sid(sid, id->id.uid);
  87                 break;
  88             case IFS_ID_TYPE_GID:
  89                 gid_to_sid(sid, id->id.gid);
  90                 break;
  91             case IFS_ID_TYPE_EVERYONE:
  92                 sid_copy(sid, &global_sid_World);
  93                 break;
  94             case IFS_ID_TYPE_NULL:
  95                 sid_copy(sid, &global_sid_NULL);
  96                 break;
  97             case IFS_ID_TYPE_CREATOR_OWNER:
  98                 sid_copy(sid, &global_sid_Creator_Owner);
  99                 break;
 100             case IFS_ID_TYPE_CREATOR_GROUP:
 101                 sid_copy(sid, &global_sid_Creator_Group);
 102                 break;
 103             default:
 104                 DEBUG(0, ("Unknown identity type: %d\n", id->type));
 105                 return false;
 106         }
 107
 108         return true;
 109 }
 110
 111 /**
 112  * Convert a SEC_ACL to a struct ifs_security_acl
 113  */
 114 static bool
 115 onefs_samba_acl_to_acl(SEC_ACL *samba_acl, struct ifs_security_acl **acl)
 116 {
 117         int num_aces = 0;
 118         struct ifs_ace *aces = NULL;
 119         struct ifs_identity temp;
 120         SEC_ACE *samba_aces;
 121         int i, j;
 122
 123         if ((!acl) || (!samba_acl))
 124                 return false;
 125
 126         samba_aces = samba_acl->aces;
 127
 128         if (samba_acl->num_aces > 0 && samba_aces) {
 129                 /* Setup ACES */
 130                 num_aces = samba_acl->num_aces;
 131                 aces = SMB_MALLOC_ARRAY(struct ifs_ace, num_aces);
 132
 133                 for (i = 0, j = 0; j < num_aces; i++, j++) {
 134                         if (!onefs_sid_to_identity(&samba_aces[j].trustee,
 135                             &temp, false))
 136                                 goto err_free;
 137
 138                         /*
 139                          * XXX Act like we did pre-Thai: Silently fail setting
 140                          * ACEs for BUILTIN accounts.
 141                          */
 142                         if (temp.id.uid == -1) {
 143                                 DEBUG(3, ("Silently failing to set ACE "
 144                                     "because our id was == -1.\n"));
 145                                 i--;
 146                                 continue;
 147                         }
 148
 149                         if (aclu_initialize_ace(&aces[i], samba_aces[i].type,
 150                             samba_aces[i].access_mask, samba_aces[i].flags,
 151                             0, &temp))
 152                                 goto err_free;
 153
 154                         if ((aces[i].trustee.type == IFS_ID_TYPE_CREATOR_OWNER ||
 155                             aces[i].trustee.type == IFS_ID_TYPE_CREATOR_GROUP) &&
 156                             nt4_compatible_acls())
 157                                 aces[i].flags |= IFS_ACE_FLAG_INHERIT_ONLY;
 158                 }
 159                 num_aces = i;
 160         }
 161
 162         if (aclu_initialize_acl(acl, aces, num_aces))
 163                 goto err_free;
 164
 165         /* Currently aclu_initialize_acl should copy the aces over, allowing us
 166          * to immediately free */
 167         free(aces);
 168         return true;
 169
 170 err_free:
 171         free(aces);
 172         return false;
 173 }
 174
 175 /**
 176  * Convert a struct ifs_security_acl to a SEC_ACL
 177  */
 178 static bool
 179 onefs_acl_to_samba_acl(struct ifs_security_acl *acl, SEC_ACL **samba_acl)
 180 {
 181         SEC_ACE *samba_aces = NULL;
 182         SEC_ACL *tmp_samba_acl = NULL;
 183         int i, num_aces = 0;
 184
 185         if (!samba_acl)
 186                 return false;
 187
 188         /* NULL ACL */
 189         if (!acl) {
 190                 *samba_acl = NULL;
 191                 return true;
 192         }
 193
 194         /* Determine number of aces in ACL */
 195         if (!acl->aces)
 196                 num_aces = 0;
 197         else
 198                 num_aces = acl->num_aces;
 199
 200         /* Allocate the ace list. */
 201         if (num_aces > 0) {
 202                 if ((samba_aces = SMB_MALLOC_ARRAY(SEC_ACE, num_aces)) == NULL)
 203                 {
 204                         DEBUG(0, ("Unable to malloc space for %d aces.\n",
 205                             num_aces));
 206                         return false;
 207                 }
 208                 memset(samba_aces, '\0', (num_aces) * sizeof(SEC_ACE));
 209         }
 210
 211         for (i = 0; i < num_aces; i++) {
 212                 DOM_SID sid;
 213
 214                 if (!onefs_identity_to_sid(&acl->aces[i].trustee, &sid))
 215                         goto err_free;
 216
 217                 init_sec_ace(&samba_aces[i], &sid, acl->aces[i].type,
 218                     acl->aces[i].access_mask, acl->aces[i].flags);
 219         }
 220
 221         if ((tmp_samba_acl = make_sec_acl(talloc_tos(), acl->revision, num_aces,
 222             samba_aces)) == NULL) {
 223                DEBUG(0, ("Unable to malloc space for acl.\n"));
 224                goto err_free;
 225         }
 226
 227         *samba_acl = tmp_samba_acl;
 228         SAFE_FREE(samba_aces);
 229         return true;
 230 err_free:
 231         SAFE_FREE(samba_aces);
 232         return false;
 233 }
 234
 235 /**
 236  * @brief Reorder ACLs into the "correct" order for Windows Explorer.
 237  *
 238  * Windows Explorer expects ACLs to be in a standard order (inherited first,
 239  * then deny, then permit.)  When ACLs are composed from POSIX file permissions
 240  * bits, they may not match these expectations, generating an annoying warning
 241  * dialog for the user.  This function will, if configured appropriately,
 242  * reorder the ACLs for these "synthetic" (POSIX-derived) descriptors to prevent
 243  * this.  The list is changed within the security descriptor passed in.
 244  *
 245  * @param fsp files_struct with service configs; must not be NULL
 246  * @param sd security descriptor being normalized;
 247  *           sd->dacl->aces is rewritten in-place, so must not be NULL
 248  * @return true on success, errno will be set on error
 249  *
 250  * @bug Although Windows Explorer likes the reordering, they seem to cause
 251  *  problems with Excel and Word sending back the reordered ACLs to us and
 252  *  changing policy; see Isilon bug 30165.
 253  */
 254 static bool
 255 onefs_canon_acl(files_struct *fsp, struct ifs_security_descriptor *sd)
 256 {
 257         int error = 0;
 258         int cur;
 259         struct ifs_ace *new_aces = NULL;
 260         int new_aces_count = 0;
 261         SMB_STRUCT_STAT sbuf;
 262
 263         if (sd == NULL || sd->dacl == NULL || sd->dacl->num_aces == 0)
 264                 return true;
 265
 266         /*
 267          * Find out if this is a windows bit, and if the smb policy wants us to
 268          * lie about the sd.
 269          */
 270         SMB_ASSERT(fsp != NULL);
 271         switch (lp_parm_enum(SNUM(fsp->conn), PARM_ONEFS_TYPE,
 272                 PARM_ACL_WIRE_FORMAT, enum_onefs_acl_wire_format,
 273                 PARM_ACL_WIRE_FORMAT_DEFAULT))  {
 274         case ACL_FORMAT_RAW:
 275                 return true;
 276
 277         case ACL_FORMAT_WINDOWS_SD:
 278                 error = SMB_VFS_FSTAT(fsp, &sbuf);
 279                 if (error)
 280                         return false;
 281
 282                 if ((sbuf.st_flags & SF_HASNTFSACL) != 0) {
 283                         DEBUG(10, ("Did not canonicalize ACLs because a "
 284                             "Windows ACL set was found for file %s\n",
 285                             fsp->fsp_name));
 286                         return true;
 287                 }
 288                 break;
 289
 290         case ACL_FORMAT_ALWAYS:
 291                 break;
 292
 293         default:
 294                 SMB_ASSERT(false);
 295                 return false;
 296         }
 297
 298         new_aces = SMB_MALLOC_ARRAY(struct ifs_ace, sd->dacl->num_aces);
 299         if (new_aces == NULL)
 300                 return false;
 301
 302         /*
 303          * By walking down the list 3 separate times, we can avoid the need
 304          * to create multiple temp buffers and extra copies.
 305          */
 306         for (cur = 0; cur < sd->dacl->num_aces; cur++)  {
 307                 if (sd->dacl->aces[cur].flags & IFS_ACE_FLAG_INHERITED_ACE)
 308                         new_aces[new_aces_count++] = sd->dacl->aces[cur];
 309         }
 310
 311         for (cur = 0; cur < sd->dacl->num_aces; cur++)  {
 312                 if (!(sd->dacl->aces[cur].flags & IFS_ACE_FLAG_INHERITED_ACE) &&
 313                     (sd->dacl->aces[cur].type == IFS_ACE_TYPE_ACCESS_DENIED))
 314                         new_aces[new_aces_count++] = sd->dacl->aces[cur];
 315         }
 316
 317         for (cur = 0; cur < sd->dacl->num_aces; cur++)  {
 318                 if (!(sd->dacl->aces[cur].flags & IFS_ACE_FLAG_INHERITED_ACE) &&
 319                     !(sd->dacl->aces[cur].type == IFS_ACE_TYPE_ACCESS_DENIED))
 320                         new_aces[new_aces_count++] = sd->dacl->aces[cur];
 321         }
 322
 323         SMB_ASSERT(new_aces_count == sd->dacl->num_aces);
 324         DEBUG(10, ("Performed canonicalization of ACLs for file %s\n",
 325             fsp->fsp_name));
 326
 327         /*
 328          * At this point you would think we could just do this:
 329          *   SAFE_FREE(sd->dacl->aces);
 330          *   sd->dacl->aces = new_aces;
 331          * However, in some cases the existing aces pointer does not point
 332          * to the beginning of an allocated block.  So we have to do a more
 333          * expensive memcpy()
 334          */
 335         memcpy(sd->dacl->aces, new_aces,
 336             sizeof(struct ifs_ace) * new_aces_count);
 337
 338         SAFE_FREE(new_aces);
 339         return true;
 340 }
 341
 342
 343 /**
 344  * This enum is a helper for onefs_fget_nt_acl() to communicate with
 345  * onefs_init_ace().
 346  */
 347 enum mode_ident { USR, GRP, OTH };
 348
 349 /**
 350  * Initializes an ACE for addition to a synthetic ACL.
 351  */
 352 static struct ifs_ace onefs_init_ace(struct connection_struct *conn,
 353                                      mode_t mode,
 354                                      bool isdir,
 355                                      enum mode_ident ident)
 356 {
 357         struct ifs_ace result;
 358         enum ifs_ace_rights r,w,x;
 359
 360         r = isdir ? UNIX_DIRECTORY_ACCESS_R : UNIX_ACCESS_R;
 361         w = isdir ? UNIX_DIRECTORY_ACCESS_W : UNIX_ACCESS_W;
 362         x = isdir ? UNIX_DIRECTORY_ACCESS_X : UNIX_ACCESS_X;
 363
 364         result.type = IFS_ACE_TYPE_ACCESS_ALLOWED;
 365         result.ifs_flags = 0;
 366         result.flags = isdir ? IFS_ACE_FLAG_CONTAINER_INHERIT :
 367             IFS_ACE_FLAG_OBJECT_INHERIT;
 368         result.flags |= IFS_ACE_FLAG_INHERIT_ONLY;
 369
 370         switch (ident) {
 371         case USR:
 372                 result.access_mask =
 373                     ((mode & S_IRUSR) ? r : 0 ) |
 374                     ((mode & S_IWUSR) ? w : 0 ) |
 375                     ((mode & S_IXUSR) ? x : 0 );
 376                 if (lp_parm_bool(SNUM(conn), PARM_ONEFS_TYPE,
 377                     PARM_CREATOR_OWNER_GETS_FULL_CONTROL,
 378                     PARM_CREATOR_OWNER_GETS_FULL_CONTROL_DEFAULT))
 379                         result.access_mask |= GENERIC_ALL_ACCESS;
 380                 result.trustee.type = IFS_ID_TYPE_CREATOR_OWNER;
 381                 break;
 382         case GRP:
 383                 result.access_mask =
 384                     ((mode & S_IRGRP) ? r : 0 ) |
 385                     ((mode & S_IWGRP) ? w : 0 ) |
 386                     ((mode & S_IXGRP) ? x : 0 );
 387                 result.trustee.type = IFS_ID_TYPE_CREATOR_GROUP;
 388                 break;
 389         case OTH:
 390                 result.access_mask =
 391                     ((mode & S_IROTH) ? r : 0 ) |
 392                     ((mode & S_IWOTH) ? w : 0 ) |
 393                     ((mode & S_IXOTH) ? x : 0 );
 394                 result.trustee.type = IFS_ID_TYPE_EVERYONE;
 395                 break;
 396         }
 397
 398         return result;
 399 }
 400
 401 /**
 402  * This adds inheritable ACEs to the end of the DACL, with the ACEs
 403  * being derived from the mode bits.  This is useful for clients that have the
 404  * MoveSecurityAttributes regkey set to 0 or are in Simple File Sharing Mode.
 405  *
 406  * On these clients, when copying files from one folder to another inside the
 407  * same volume/share, the DACL is explicitely cleared.  Without inheritable
 408  * aces on the target folder the mode bits of the copied file are set to 000.
 409  *
 410  * See Isilon Bug 27990
 411  *
 412  * Note: This function allocates additional memory onto sd->dacl->aces, that
 413  * must be freed by the caller.
 414  */
 415 static bool add_sfs_aces(files_struct *fsp, struct ifs_security_descriptor *sd)
 416 {
 417         int error;
 418         SMB_STRUCT_STAT sbuf;
 419
 420         error = SMB_VFS_FSTAT(fsp, &sbuf);
 421         if (error) {
 422                 DEBUG(0, ("Failed to stat %s in simple files sharing "
 423                           "compatibility mode. errno=%d\n",
 424                           fsp->fsp_name, errno));
 425                 return false;
 426         }
 427
 428         /* Only continue if this is a synthetic ACL and a directory. */
 429         if (S_ISDIR(sbuf.st_mode) && (sbuf.st_flags & SF_HASNTFSACL) == 0) {
 430                 struct ifs_ace new_aces[6];
 431                 struct ifs_ace *old_aces;
 432                 int i, num_aces_to_add = 0;
 433                 mode_t file_mode = 0, dir_mode = 0;
 434
 435                 /* Use existing samba logic to derive the mode bits. */
 436                 file_mode = unix_mode(fsp->conn, 0, fsp->fsp_name, false);
 437                 dir_mode = unix_mode(fsp->conn, aDIR, fsp->fsp_name, false);
 438
 439                 /* Initialize ACEs. */
 440                 new_aces[0] = onefs_init_ace(fsp->conn, file_mode, false, USR);
 441                 new_aces[1] = onefs_init_ace(fsp->conn, file_mode, false, GRP);
 442                 new_aces[2] = onefs_init_ace(fsp->conn, file_mode, false, OTH);
 443                 new_aces[3] = onefs_init_ace(fsp->conn, dir_mode, true, USR);
 444                 new_aces[4] = onefs_init_ace(fsp->conn, dir_mode, true, GRP);
 445                 new_aces[5] = onefs_init_ace(fsp->conn, dir_mode, true, OTH);
 446
 447                 for (i = 0; i < 6; i++)
 448                         if (new_aces[i].access_mask != 0)
 449                                 num_aces_to_add++;
 450
 451                 /* Expand the ACEs array */
 452                 if (num_aces_to_add != 0) {
 453                         old_aces = sd->dacl->aces;
 454
 455                         sd->dacl->aces = SMB_MALLOC_ARRAY(struct ifs_ace,
 456                             sd->dacl->num_aces + num_aces_to_add);
 457                         if (!sd->dacl->aces) {
 458                                 DEBUG(0, ("Unable to malloc space for "
 459                                     "new_aces: %d.\n",
 460                                      sd->dacl->num_aces + num_aces_to_add));
 461                                 return false;
 462                         }
 463                         memcpy(sd->dacl->aces, old_aces,
 464                             sizeof(struct ifs_ace) * sd->dacl->num_aces);
 465
 466                         /* Add the new ACEs to the DACL. */
 467                         for (i = 0; i < 6; i++) {
 468                                 if (new_aces[i].access_mask != 0) {
 469                                         sd->dacl->aces[sd->dacl->num_aces] =
 470                                             new_aces[i];
 471                                         sd->dacl->num_aces++;
 472                                 }
 473                         }
 474                 }
 475         }
 476         return true;
 477 }
 478
 479 /**
 480  * Isilon-specific function for getting an NTFS ACL from an open file.
 481  *
 482  * @param[out] ppdesc SecDesc to allocate and fill in
 483  *
 484  * @return NTSTATUS based off errno on error
 485  */
 486 NTSTATUS
 487 onefs_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
 488                   uint32 security_info, SEC_DESC **ppdesc)
 489 {
 490         int error;
 491         uint32_t sd_size = 0;
 492         size_t size = 0;
 493         struct ifs_security_descriptor *sd = NULL;
 494         DOM_SID owner_sid, group_sid;
 495         DOM_SID *ownerp, *groupp;
 496         SEC_ACL *dacl, *sacl;
 497         SEC_DESC *pdesc;
 498         bool alloced = false;
 499         bool new_aces_alloced = false;
 500         bool fopened = false;
 501         NTSTATUS status = NT_STATUS_OK;
 502
 503         *ppdesc = NULL;
 504
 505         DEBUG(5, ("Getting sd for file %s. security_info=%u\n",
 506             fsp->fsp_name, security_info));
 507
 508         if (fsp->fh->fd == -1) {
 509                 enum ifs_ace_rights desired_access = 0;
 510
 511                 if (security_info & (OWNER_SECURITY_INFORMATION |
 512                      GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION))
 513                         desired_access |= IFS_RTS_STD_READ_CONTROL;
 514                 if (security_info & SACL_SECURITY_INFORMATION)
 515                         desired_access |= IFS_RTS_SACL_ACCESS;
 516
 517                 if ((fsp->fh->fd = ifs_createfile(-1,
 518                                                   fsp->fsp_name,
 519                                                   desired_access,
 520                                                   0, 0,
 521                                                   OPLOCK_NONE,
 522                                                   0, NULL, 0,
 523                                                   NULL, 0, NULL)) == -1) {
 524                         DEBUG(0, ("Error opening file %s. errno=%d\n",
 525                             fsp->fsp_name, errno));
 526                         status = map_nt_error_from_unix(errno);
 527                         goto out;
 528                 }
 529                 fopened = true;
 530         }
 531
 532         /* Get security descriptor */
 533         sd_size = 0;
 534         do {
 535                 /* Allocate memory for get_security_descriptor */
 536                 if (sd_size > 0) {
 537                         sd = SMB_REALLOC(sd, sd_size);
 538                         if (!sd) {
 539                                 DEBUG(0, ("Unable to malloc %u bytes of space "
 540                                     "for security descriptor.\n", sd_size));
 541                                 status = map_nt_error_from_unix(errno);
 542                                 goto out;
 543                         }
 544
 545                         alloced = true;
 546                 }
 547
 548                 error = ifs_get_security_descriptor(fsp->fh->fd, security_info,
 549                     &sd_size, sd);
 550                 if (error && (errno != EMSGSIZE)) {
 551                         DEBUG(0, ("Failed getting size of security descriptor! "
 552                             "errno=%d\n", errno));
 553                         status = map_nt_error_from_unix(errno);
 554                         goto out;
 555                 }
 556         } while (error);
 557
 558         DEBUG(5, ("Got sd, size=%u:\n", sd_size));
 559
 560         if (lp_parm_bool(SNUM(fsp->conn),
 561             PARM_ONEFS_TYPE,
 562             PARM_SIMPLE_FILE_SHARING_COMPATIBILITY_MODE,
 563             PARM_SIMPLE_FILE_SHARING_COMPATIBILITY_MODE_DEFAULT) &&
 564             sd->dacl) {
 565                 if(!(new_aces_alloced = add_sfs_aces(fsp, sd)))
 566                         goto out;
 567         }
 568
 569         if (!(onefs_canon_acl(fsp, sd))) {
 570                 status = map_nt_error_from_unix(errno);
 571                 goto out;
 572         }
 573
 574         DEBUG(5, ("Finished canonicalizing ACL\n"));
 575
 576         ownerp = NULL;
 577         groupp = NULL;
 578         dacl = NULL;
 579         sacl = NULL;
 580
 581         /* Copy owner into ppdesc */
 582         if (security_info & OWNER_SECURITY_INFORMATION) {
 583                 if (!onefs_identity_to_sid(sd->owner, &owner_sid)) {
 584                         status = NT_STATUS_INVALID_PARAMETER;
 585                         goto out;
 586                 }
 587
 588                 ownerp = &owner_sid;
 589         }
 590
 591         /* Copy group into ppdesc */
 592         if (security_info & GROUP_SECURITY_INFORMATION) {
 593                 if (!onefs_identity_to_sid(sd->group, &group_sid)) {
 594                         status = NT_STATUS_INVALID_PARAMETER;
 595                         goto out;
 596                 }
 597
 598                 groupp = &group_sid;
 599         }
 600
 601         /* Copy DACL into ppdesc */
 602         if (security_info & DACL_SECURITY_INFORMATION) {
 603                 if (!onefs_acl_to_samba_acl(sd->dacl, &dacl)) {
 604                         status = NT_STATUS_INVALID_PARAMETER;
 605                         goto out;
 606                 }
 607         }
 608
 609         /* Copy SACL into ppdesc */
 610         if (security_info & SACL_SECURITY_INFORMATION) {
 611                 if (!onefs_acl_to_samba_acl(sd->sacl, &sacl)) {
 612                         status = NT_STATUS_INVALID_PARAMETER;
 613                         goto out;
 614                 }
 615         }
 616
 617         /* AUTO_INHERIT_REQ bits are not returned over the wire so strip them
 618          * off.  Eventually we should stop storing these in the kernel
 619          * all together. See Isilon bug 40364 */
 620         sd->control &= ~(IFS_SD_CTRL_DACL_AUTO_INHERIT_REQ |
 621                          IFS_SD_CTRL_SACL_AUTO_INHERIT_REQ);
 622
 623         pdesc = make_sec_desc(talloc_tos(), sd->revision, sd->control,
 624             ownerp, groupp, sacl, dacl, &size);
 625
 626         if (!pdesc) {
 627                 DEBUG(0, ("Problem with make_sec_desc. Memory?\n"));
 628                 status = map_nt_error_from_unix(errno);
 629                 goto out;
 630         }
 631
 632         *ppdesc = pdesc;
 633
 634         DEBUG(5, ("Finished retrieving/canonicalizing SD!\n"));
 635         /* FALLTHROUGH */
 636 out:
 637         if (alloced && sd) {
 638                 if (new_aces_alloced && sd->dacl->aces)
 639                         SAFE_FREE(sd->dacl->aces);
 640
 641                 SAFE_FREE(sd);
 642         }
 643
 644         if (fopened) {
 645                 close(fsp->fh->fd);
 646                 fsp->fh->fd = -1;
 647         }
 648
 649         return status;
 650 }
 651
 652 /**
 653  * Isilon-specific function for getting an NTFS ACL from a file path.
 654  *
 655  * Since onefs_fget_nt_acl() needs to open a filepath if the fd is invalid,
 656  * we just mock up a files_struct with the path and bad fd and call into it.
 657  *
 658  * @param[out] ppdesc SecDesc to allocate and fill in
 659  *
 660  * @return NTSTATUS based off errno on error
 661  */
 662 NTSTATUS
 663 onefs_get_nt_acl(vfs_handle_struct *handle, const char* name,
 664                  uint32 security_info, SEC_DESC **ppdesc)
 665 {
 666         files_struct finfo;
 667         struct fd_handle fh;
 668
 669         ZERO_STRUCT(finfo);
 670         ZERO_STRUCT(fh);
 671
 672         finfo.fnum = -1;
 673         finfo.conn = handle->conn;
 674         finfo.fh = &fh;
 675         finfo.fh->fd = -1;
 676         finfo.fsp_name = CONST_DISCARD(char *, name);
 677
 678         return onefs_fget_nt_acl(handle, &finfo, security_info, ppdesc);
 679 }
 680
 681 /**
 682  * Isilon-specific function for setting an NTFS ACL on an open file.
 683  *
 684  * @return NT_STATUS_UNSUCCESSFUL for userspace errors, NTSTATUS based off
 685  * errno on syscall errors
 686  */
 687 NTSTATUS
 688 onefs_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
 689                   uint32 security_info_sent, SEC_DESC *psd)
 690 {
 691         struct ifs_security_descriptor sd = {};
 692         struct ifs_security_acl dacl, sacl, *daclp, *saclp;
 693         struct ifs_identity owner, group, *ownerp, *groupp;
 694         int fd;
 695         bool fopened = false;
 696
 697         DEBUG(5,("Setting SD on file %s.\n", fsp->fsp_name ));
 698
 699         ownerp = NULL;
 700         groupp = NULL;
 701         daclp = NULL;
 702         saclp = NULL;
 703
 704         /* Setup owner */
 705         if (security_info_sent & OWNER_SECURITY_INFORMATION) {
 706                 if (!onefs_sid_to_identity(psd->owner_sid, &owner, false))
 707                         return NT_STATUS_UNSUCCESSFUL;
 708
 709                 /*
 710                  * XXX Act like we did pre-Thai: Silently fail setting the
 711                  * owner to a BUILTIN account.
 712                  */
 713                 if (owner.id.uid == -1) {
 714                         DEBUG(3, ("Silently failing to set owner because our "
 715                             "id was == -1.\n"));
 716                         security_info_sent &= ~OWNER_SECURITY_INFORMATION;
 717                         if (!security_info_sent)
 718                                 return NT_STATUS_OK;
 719                 }
 720                 else
 721                         ownerp = &owner;
 722         }
 723
 724         /* Setup group */
 725         if (security_info_sent & GROUP_SECURITY_INFORMATION) {
 726                 if (!onefs_sid_to_identity(psd->group_sid, &group, true))
 727                         return NT_STATUS_UNSUCCESSFUL;
 728
 729                 /*
 730                  * XXX Act like we did pre-Thai: Silently fail setting the
 731                  * group to a BUILTIN account.
 732                  */
 733                 if (group.id.gid == -1) {
 734                         DEBUG(3, ("Silently failing to set group because our "
 735                             "id was == -1.\n"));
 736                         security_info_sent &= ~GROUP_SECURITY_INFORMATION;
 737                         if (!security_info_sent)
 738                                 return NT_STATUS_OK;
 739                 }
 740                 else
 741                         groupp = &group;
 742         }
 743
 744         /* Setup DACL */
 745         if ((security_info_sent & DACL_SECURITY_INFORMATION) && (psd->dacl)) {
 746                 daclp = &dacl;
 747
 748                 if (!onefs_samba_acl_to_acl(psd->dacl, &daclp))
 749                         return NT_STATUS_UNSUCCESSFUL;
 750         }
 751
 752         /* Setup SACL */
 753         if ((security_info_sent & SACL_SECURITY_INFORMATION) && (psd->sacl)) {
 754                 saclp = &sacl;
 755
 756                 if (!onefs_samba_acl_to_acl(psd->sacl, &saclp))
 757                         return NT_STATUS_UNSUCCESSFUL;
 758         }
 759
 760         /* Setup ifs_security_descriptor */
 761         DEBUG(5,("Setting up SD\n"));
 762         if (aclu_initialize_sd(&sd, psd->type, ownerp, groupp,
 763             (daclp ? &daclp : NULL), (saclp ? &saclp : NULL), false))
 764                 return NT_STATUS_UNSUCCESSFUL;
 765
 766         fd = fsp->fh->fd;
 767         if (fd == -1) {
 768                 enum ifs_ace_rights desired_access = 0;
 769
 770                 if (security_info_sent &
 771                     (OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION))
 772                         desired_access |= IFS_RTS_STD_WRITE_OWNER;
 773                 if (security_info_sent & DACL_SECURITY_INFORMATION)
 774                         desired_access |= IFS_RTS_STD_WRITE_DAC;
 775                 if (security_info_sent & SACL_SECURITY_INFORMATION)
 776                         desired_access |= IFS_RTS_SACL_ACCESS;
 777
 778                 if ((fd = ifs_createfile(-1,
 779                                          fsp->fsp_name,
 780                                          desired_access,
 781                                          0, 0,
 782                                          OPLOCK_NONE,
 783                                          0, NULL, 0,
 784                                          NULL, 0, NULL)) == -1) {
 785                         DEBUG(0, ("Error opening file %s. errno=%d\n",
 786                             fsp->fsp_name, errno));
 787                         return map_nt_error_from_unix(errno);
 788                 }
 789                 fopened = true;
 790         }
 791
 792         errno = 0;
 793         if (ifs_set_security_descriptor(fd, security_info_sent, &sd)) {
 794                 DEBUG(0, ("Error setting security descriptor = %d\n", errno));
 795                 goto out;
 796         }
 797
 798         DEBUG(5, ("Security descriptor set correctly!\n"));
 799
 800         /* FALLTHROUGH */
 801 out:
 802         if (fopened)
 803                 close(fd);
 804
 805         aclu_free_sd(&sd, false);
 806         return errno ? map_nt_error_from_unix(errno) : NT_STATUS_OK;
 807 }