#include "../libcli/security/security.h"
#include "../libcli/security/dom_sid.h"
#include "passdb.h"
+#include "lib/afs/afs_settoken.h"
+#include "lib/util/string_wrappers.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_VFS
#include <afs/stds.h>
-#include <afs/afs.h>
-#include <afs/auth.h>
+#include <afs/afs_args.h>
#include <afs/venus.h>
#include <afs/prs_fs.h>
/* Do we expect SIDs as pts names? */
static bool sidpts;
-extern int afs_syscall(int, const char *, int, char *, int);
-
struct afs_ace {
bool positive;
char *name;
struct dom_sid sid;
enum lsa_SidType type;
- uint32 rights;
+ uint32_t rights;
struct afs_ace *next;
};
struct afs_iob {
char *in, *out;
- uint16 in_size, out_size;
+ uint16_t in_size, out_size;
};
ZERO_STRUCT(*acl);
acl->ctx = talloc_init("afs_acl");
if (acl->ctx == NULL) {
- DEBUG(10, ("Could not init afs_acl"));
+ DEBUG(10, ("Could not init afs_acl\n"));
return false;
}
return true;
static struct afs_ace *new_afs_ace(TALLOC_CTX *mem_ctx,
bool positive,
- const char *name, uint32 rights)
+ const char *name, uint32_t rights)
{
struct dom_sid sid;
enum lsa_SidType type;
static void add_afs_ace(struct afs_acl *acl,
bool positive,
- const char *name, uint32 rights)
+ const char *name, uint32_t rights)
{
struct afs_ace *ace;
const char *namep;
fstring name;
- uint32 rights;
+ uint32_t rights;
char *space;
namep = p;
return true;
}
-static uint32 afs_to_nt_file_rights(uint32 rights)
+static uint32_t afs_to_nt_file_rights(uint32_t rights)
{
- uint32 result = 0;
+ uint32_t result = 0;
if (rights & PRSFS_READ)
result |= FILE_READ_DATA | FILE_READ_EA |
return result;
}
-static void afs_to_nt_dir_rights(uint32 afs_rights, uint32 *nt_rights,
- uint8 *flag)
+static void afs_to_nt_dir_rights(uint32_t afs_rights, uint32_t *nt_rights,
+ uint8_t *flag)
{
*nt_rights = 0;
*flag = SEC_ACE_FLAG_OBJECT_INHERIT |
#define PERMS_FULL 0x001f01ff
static struct static_dir_ace_mapping {
- uint8 type;
- uint8 flags;
- uint32 mask;
- uint32 afs_rights;
+ uint8_t type;
+ uint8_t flags;
+ uint32_t mask;
+ uint32_t afs_rights;
} ace_mappings[] = {
/* Full control */
{ 0, 0, 0, 9999 }
};
-static uint32 nt_to_afs_dir_rights(const char *filename, const struct security_ace *ace)
+static uint32_t nt_to_afs_dir_rights(const char *filename, const struct security_ace *ace)
{
- uint32 result = 0;
- uint32 rights = ace->access_mask;
- uint8 flags = ace->flags;
+ uint32_t result = 0;
+ uint32_t rights = ace->access_mask;
+ uint8_t flags = ace->flags;
struct static_dir_ace_mapping *m;
return result;
}
-static uint32 nt_to_afs_file_rights(const char *filename, const struct security_ace *ace)
+static uint32_t nt_to_afs_file_rights(const char *filename, const struct security_ace *ace)
{
- uint32 result = 0;
- uint32 rights = ace->access_mask;
+ uint32_t result = 0;
+ uint32_t rights = ace->access_mask;
if (rights & (GENERIC_READ_ACCESS|FILE_READ_DATA)) {
result |= PRSFS_READ;
static size_t afs_to_nt_acl_common(struct afs_acl *afs_acl,
SMB_STRUCT_STAT *psbuf,
- uint32 security_info,
+ uint32_t security_info,
TALLOC_CTX *mem_ctx,
struct security_descriptor **ppdesc)
{
while (afs_ace != NULL) {
uint32_t nt_rights;
- uint8 flag = SEC_ACE_FLAG_OBJECT_INHERIT |
+ uint8_t flag = SEC_ACE_FLAG_OBJECT_INHERIT |
SEC_ACE_FLAG_CONTAINER_INHERIT;
if (afs_ace->type == SID_NAME_UNKNOWN) {
static size_t afs_to_nt_acl(struct afs_acl *afs_acl,
struct connection_struct *conn,
struct smb_filename *smb_fname,
- uint32 security_info,
+ uint32_t security_info,
TALLOC_CTX *mem_ctx,
struct security_descriptor **ppdesc)
{
int ret;
+ /*
+ * We can directly use SMB_VFS_STAT here, as if this was a
+ * POSIX call on a symlink, we've already refused it.
+ * For a Windows acl mapped call on a symlink, we want to follow
+ * it.
+ */
/* Get the stat struct for the owner info. */
- if (lp_posix_pathnames()) {
- ret = SMB_VFS_LSTAT(conn, smb_fname);
- } else {
- ret = SMB_VFS_STAT(conn, smb_fname);
- }
+ ret = SMB_VFS_STAT(conn, smb_fname);
if (ret == -1) {
return 0;
}
static size_t afs_fto_nt_acl(struct afs_acl *afs_acl,
struct files_struct *fsp,
- uint32 security_info,
+ uint32_t security_info,
TALLOC_CTX *mem_ctx,
struct security_descriptor **ppdesc)
{
SMB_STRUCT_STAT sbuf;
- if (fsp->fh->fd == -1) {
+ if (fsp_get_pathref_fd(fsp) == -1) {
/* Get the stat struct for the owner info. */
return afs_to_nt_acl(afs_acl, fsp->conn, fsp->fsp_name,
security_info, mem_ctx, ppdesc);
string_to_sid(&domain_sid, "S-1-5-21");
- if (sid_compare_domain(sid, &domain_sid) == 0)
+ if (dom_sid_compare_domain(sid, &domain_sid) == 0)
return true;
return false;
}
static bool nt_to_afs_acl(const char *filename,
- uint32 security_info_sent,
+ uint32_t security_info_sent,
const struct security_descriptor *psd,
- uint32 (*nt_to_afs_rights)(const char *filename,
+ uint32_t (*nt_to_afs_rights)(const char *filename,
const struct security_ace *ace),
struct afs_acl *afs_acl)
{
}
if (!mappable_sid(&ace->trustee)) {
+ struct dom_sid_buf buf;
DEBUG(10, ("Ignoring unmappable SID %s\n",
- sid_string_dbg(&ace->trustee)));
+ dom_sid_str_buf(&ace->trustee, &buf)));
continue;
}
if (!lookup_sid(talloc_tos(), &ace->trustee,
&dom_name, &name, &name_type)) {
+ struct dom_sid_buf buf;
DEBUG(1, ("AFSACL: Could not lookup SID %s on file %s\n",
- sid_string_dbg(&ace->trustee),
+ dom_sid_str_buf(&ace->trustee, &buf),
filename));
continue;
}
}
if (sidpts) {
+ struct dom_sid_buf buf;
/* Expect all users/groups in pts as SIDs */
name = talloc_strdup(
talloc_tos(),
- sid_string_tos(&ace->trustee));
+ dom_sid_str_buf(&ace->trustee, &buf));
if (name == NULL) {
return false;
}
}
static NTSTATUS afs_set_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
- uint32 security_info_sent,
+ uint32_t security_info_sent,
const struct security_descriptor *psd)
{
struct afs_acl old_afs_acl, new_afs_acl;
return NT_STATUS_NO_MEMORY;
}
- if (!fsp->is_directory) {
+ if (!fsp->fsp_flags.is_directory) {
/* We need to get the name of the directory containing the
* file, this is where the AFS acls live */
char *p = strrchr(name, '/');
split_afs_acl(&old_afs_acl, &dir_acl, &file_acl);
- if (fsp->is_directory) {
+ if (fsp->fsp_flags.is_directory) {
if (!strequal(fileacls, "yes")) {
/* Throw away file acls, we depend on the
static NTSTATUS afsacl_fget_nt_acl(struct vfs_handle_struct *handle,
struct files_struct *fsp,
- uint32 security_info,
+ uint32_t security_info,
TALLOC_CTX *mem_ctx,
struct security_descriptor **ppdesc)
{
return (sd_size != 0) ? NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
}
-static NTSTATUS afsacl_get_nt_acl(struct vfs_handle_struct *handle,
- const char *name, uint32 security_info,
- TALLOC_CTX *mem_ctx,
- struct security_descriptor **ppdesc)
-{
- struct afs_acl acl;
- size_t sd_size;
- struct smb_filename *smb_fname = NULL;
- NTSTATUS status;
-
- DEBUG(5, ("afsacl_get_nt_acl: %s\n", name));
-
- sidpts = lp_parm_bool(SNUM(handle->conn), "afsacl", "sidpts", false);
-
- if (!afs_get_afs_acl(name, &acl)) {
- return NT_STATUS_ACCESS_DENIED;
- }
-
- status = create_synthetic_smb_fname(talloc_tos(), name, NULL, NULL,
- &smb_fname);
- if (!NT_STATUS_IS_OK(status)) {
- free_afs_acl(&acl);
- return status;
- }
-
- sd_size = afs_to_nt_acl(&acl, handle->conn, smb_fname, security_info,
- mem_ctx, ppdesc);
- TALLOC_FREE(smb_fname);
-
- free_afs_acl(&acl);
-
- return (sd_size != 0) ? NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
-}
-
-NTSTATUS afsacl_fset_nt_acl(vfs_handle_struct *handle,
+static NTSTATUS afsacl_fset_nt_acl(vfs_handle_struct *handle,
files_struct *fsp,
- uint32 security_info_sent,
+ uint32_t security_info_sent,
const struct security_descriptor *psd)
{
return afs_set_nt_acl(handle, fsp, security_info_sent, psd);
return 0;
}
-/* We don't have a linear form of the AFS ACL yet */
-static int afsacl_sys_acl_blob_get_file(vfs_handle_struct *handle, const char *path_p, TALLOC_CTX *mem_ctx, char **blob_description, DATA_BLOB *blob)
-{
- errno = ENOSYS;
- return -1;
-}
-
/* We don't have a linear form of the AFS ACL yet */
static int afsacl_sys_acl_blob_get_fd(vfs_handle_struct *handle, files_struct *fsp, TALLOC_CTX *mem_ctx, char **blob_description, DATA_BLOB *blob)
{
static struct vfs_fn_pointers vfs_afsacl_fns = {
.connect_fn = afsacl_connect,
.fget_nt_acl_fn = afsacl_fget_nt_acl,
- .get_nt_acl_fn = afsacl_get_nt_acl,
.fset_nt_acl_fn = afsacl_fset_nt_acl,
- .sys_acl_blob_get_file_fn = afsacl_sys_acl_blob_get_file,
.sys_acl_blob_get_fd_fn = afsacl_sys_acl_blob_get_fd
};
-NTSTATUS vfs_afsacl_init(void);
-NTSTATUS vfs_afsacl_init(void)
+static_decl_vfs;
+NTSTATUS vfs_afsacl_init(TALLOC_CTX *ctx)
{
return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "afsacl",
&vfs_afsacl_fns);
git.samba.org / samba.git / blobdiff