2009-07-25 04:06:41 +04:00
/*
* Store Windows ACLs in data store - common functions .
2009-07-27 23:09:40 +04:00
* # included into modules / vfs_acl_xattr . c and modules / vfs_acl_tdb . c
2009-07-25 04:06:41 +04:00
*
* Copyright ( C ) Volker Lendecke , 2008
* Copyright ( C ) Jeremy Allison , 2009
*
* This program is free software ; you can redistribute it and / or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation ; either version 3 of the License , or
* ( at your option ) any later version .
*
* This program is distributed in the hope that it will be useful ,
* but WITHOUT ANY WARRANTY ; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
* GNU General Public License for more details .
*
* You should have received a copy of the GNU General Public License
* along with this program ; if not , see < http : //www.gnu.org/licenses/>.
*/
2011-03-23 00:34:22 +03:00
# include "smbd/smbd.h"
2011-02-26 01:20:06 +03:00
# include "system/filesys.h"
2010-10-12 08:27:50 +04:00
# include "../libcli/security/security.h"
2010-05-28 04:19:32 +04:00
# include "../librpc/gen_ndr/ndr_security.h"
2011-07-07 15:04:31 +04:00
# include "../lib/util/bitmap.h"
2010-05-28 04:19:32 +04:00
2009-07-25 04:06:41 +04:00
static NTSTATUS create_acl_blob ( const struct security_descriptor * psd ,
DATA_BLOB * pblob ,
uint16_t hash_type ,
uint8_t hash [ XATTR_SD_HASH_SIZE ] ) ;
2009-07-27 23:09:40 +04:00
static NTSTATUS get_acl_blob ( TALLOC_CTX * ctx ,
vfs_handle_struct * handle ,
files_struct * fsp ,
const char * name ,
DATA_BLOB * pblob ) ;
static NTSTATUS store_acl_blob_fsp ( vfs_handle_struct * handle ,
files_struct * fsp ,
DATA_BLOB * pblob ) ;
2010-06-03 01:22:12 +04:00
# define HASH_SECURITY_INFO (SECINFO_OWNER | \
2010-06-03 01:25:18 +04:00
SECINFO_GROUP | \
2010-06-03 01:35:44 +04:00
SECINFO_DACL | \
2010-06-03 01:29:16 +04:00
SECINFO_SACL )
2009-07-25 04:06:41 +04:00
/*******************************************************************
Hash a security descriptor .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2013-01-21 05:43:00 +04:00
static NTSTATUS hash_blob_sha256 ( DATA_BLOB blob ,
uint8_t * hash )
{
SHA256_CTX tctx ;
memset ( hash , ' \0 ' , XATTR_SD_HASH_SIZE ) ;
samba_SHA256_Init ( & tctx ) ;
samba_SHA256_Update ( & tctx , blob . data , blob . length ) ;
samba_SHA256_Final ( hash , & tctx ) ;
return NT_STATUS_OK ;
}
/*******************************************************************
Hash a security descriptor .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2009-07-25 04:06:41 +04:00
static NTSTATUS hash_sd_sha256 ( struct security_descriptor * psd ,
uint8_t * hash )
{
DATA_BLOB blob ;
NTSTATUS status ;
memset ( hash , ' \0 ' , XATTR_SD_HASH_SIZE ) ;
status = create_acl_blob ( psd , & blob , XATTR_SD_HASH_TYPE_SHA256 , hash ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
return status ;
}
2013-01-21 05:43:00 +04:00
return hash_blob_sha256 ( blob , hash ) ;
2009-07-25 04:06:41 +04:00
}
/*******************************************************************
Parse out a struct security_descriptor from a DATA_BLOB .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static NTSTATUS parse_acl_blob ( const DATA_BLOB * pblob ,
2012-10-10 04:50:27 +04:00
TALLOC_CTX * mem_ctx ,
2012-10-10 09:36:47 +04:00
struct security_descriptor * * ppdesc ,
uint16_t * p_hash_type ,
uint16_t * p_version ,
uint8_t hash [ XATTR_SD_HASH_SIZE ] ,
uint8_t sys_acl_hash [ XATTR_SD_HASH_SIZE ] )
2009-07-25 04:06:41 +04:00
{
struct xattr_NTACL xacl ;
enum ndr_err_code ndr_err ;
size_t sd_size ;
2012-10-10 04:50:27 +04:00
TALLOC_CTX * frame = talloc_stackframe ( ) ;
2009-07-25 04:06:41 +04:00
2012-10-10 04:50:27 +04:00
ndr_err = ndr_pull_struct_blob ( pblob , frame , & xacl ,
2009-07-25 04:06:41 +04:00
( ndr_pull_flags_fn_t ) ndr_pull_xattr_NTACL ) ;
if ( ! NDR_ERR_CODE_IS_SUCCESS ( ndr_err ) ) {
DEBUG ( 5 , ( " parse_acl_blob: ndr_pull_xattr_NTACL failed: %s \n " ,
ndr_errstr ( ndr_err ) ) ) ;
2012-10-10 04:50:27 +04:00
TALLOC_FREE ( frame ) ;
2011-02-02 14:50:42 +03:00
return ndr_map_error2ntstatus ( ndr_err ) ;
2009-07-25 04:06:41 +04:00
}
2012-10-10 09:36:47 +04:00
* p_version = xacl . version ;
2009-07-25 04:06:41 +04:00
switch ( xacl . version ) {
2011-10-11 14:37:56 +04:00
case 1 :
2012-10-10 04:50:27 +04:00
* ppdesc = make_sec_desc ( mem_ctx , SD_REVISION ,
2011-10-11 14:37:56 +04:00
xacl . info . sd - > type | SEC_DESC_SELF_RELATIVE ,
xacl . info . sd - > owner_sid ,
xacl . info . sd - > group_sid ,
xacl . info . sd - > sacl ,
xacl . info . sd - > dacl ,
& sd_size ) ;
/* No hash - null out. */
* p_hash_type = XATTR_SD_HASH_TYPE_NONE ;
memset ( hash , ' \0 ' , XATTR_SD_HASH_SIZE ) ;
break ;
2009-07-25 04:06:41 +04:00
case 2 :
2012-10-10 04:50:27 +04:00
* ppdesc = make_sec_desc ( mem_ctx , SD_REVISION ,
2009-07-25 04:06:41 +04:00
xacl . info . sd_hs2 - > sd - > type | SEC_DESC_SELF_RELATIVE ,
xacl . info . sd_hs2 - > sd - > owner_sid ,
xacl . info . sd_hs2 - > sd - > group_sid ,
xacl . info . sd_hs2 - > sd - > sacl ,
xacl . info . sd_hs2 - > sd - > dacl ,
& sd_size ) ;
/* No hash - null out. */
* p_hash_type = XATTR_SD_HASH_TYPE_NONE ;
memset ( hash , ' \0 ' , XATTR_SD_HASH_SIZE ) ;
break ;
case 3 :
2012-10-10 04:50:27 +04:00
* ppdesc = make_sec_desc ( mem_ctx , SD_REVISION ,
2009-07-25 04:06:41 +04:00
xacl . info . sd_hs3 - > sd - > type | SEC_DESC_SELF_RELATIVE ,
xacl . info . sd_hs3 - > sd - > owner_sid ,
xacl . info . sd_hs3 - > sd - > group_sid ,
xacl . info . sd_hs3 - > sd - > sacl ,
xacl . info . sd_hs3 - > sd - > dacl ,
& sd_size ) ;
* p_hash_type = xacl . info . sd_hs3 - > hash_type ;
2012-10-10 09:36:47 +04:00
/* Current version 3 (if no sys acl hash available). */
2009-07-25 04:06:41 +04:00
memcpy ( hash , xacl . info . sd_hs3 - > hash , XATTR_SD_HASH_SIZE ) ;
break ;
2012-10-10 09:36:47 +04:00
case 4 :
* ppdesc = make_sec_desc ( mem_ctx , SD_REVISION ,
xacl . info . sd_hs4 - > sd - > type | SEC_DESC_SELF_RELATIVE ,
xacl . info . sd_hs4 - > sd - > owner_sid ,
xacl . info . sd_hs4 - > sd - > group_sid ,
xacl . info . sd_hs4 - > sd - > sacl ,
xacl . info . sd_hs4 - > sd - > dacl ,
& sd_size ) ;
* p_hash_type = xacl . info . sd_hs4 - > hash_type ;
/* Current version 4. */
memcpy ( hash , xacl . info . sd_hs4 - > hash , XATTR_SD_HASH_SIZE ) ;
memcpy ( sys_acl_hash , xacl . info . sd_hs4 - > sys_acl_hash , XATTR_SD_HASH_SIZE ) ;
break ;
2009-07-25 04:06:41 +04:00
default :
2012-10-10 04:50:27 +04:00
TALLOC_FREE ( frame ) ;
2009-07-25 04:06:41 +04:00
return NT_STATUS_REVISION_MISMATCH ;
}
2012-10-10 04:50:27 +04:00
TALLOC_FREE ( frame ) ;
2009-07-25 04:06:41 +04:00
return ( * ppdesc ! = NULL ) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY ;
}
/*******************************************************************
2012-10-10 09:36:47 +04:00
Create a DATA_BLOB from a hash of the security descriptor storead at
the system layer and the NT ACL we wish to preserve
2009-07-25 04:06:41 +04:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static NTSTATUS create_acl_blob ( const struct security_descriptor * psd ,
DATA_BLOB * pblob ,
uint16_t hash_type ,
uint8_t hash [ XATTR_SD_HASH_SIZE ] )
{
struct xattr_NTACL xacl ;
struct security_descriptor_hash_v3 sd_hs3 ;
enum ndr_err_code ndr_err ;
TALLOC_CTX * ctx = talloc_tos ( ) ;
ZERO_STRUCT ( xacl ) ;
ZERO_STRUCT ( sd_hs3 ) ;
xacl . version = 3 ;
xacl . info . sd_hs3 = & sd_hs3 ;
2011-05-06 03:19:49 +04:00
xacl . info . sd_hs3 - > sd = discard_const_p ( struct security_descriptor , psd ) ;
2009-07-25 04:06:41 +04:00
xacl . info . sd_hs3 - > hash_type = hash_type ;
memcpy ( & xacl . info . sd_hs3 - > hash [ 0 ] , hash , XATTR_SD_HASH_SIZE ) ;
ndr_err = ndr_push_struct_blob (
2010-05-10 02:42:06 +04:00
pblob , ctx , & xacl ,
2009-07-25 04:06:41 +04:00
( ndr_push_flags_fn_t ) ndr_push_xattr_NTACL ) ;
if ( ! NDR_ERR_CODE_IS_SUCCESS ( ndr_err ) ) {
DEBUG ( 5 , ( " create_acl_blob: ndr_push_xattr_NTACL failed: %s \n " ,
ndr_errstr ( ndr_err ) ) ) ;
2011-02-02 14:50:42 +03:00
return ndr_map_error2ntstatus ( ndr_err ) ;
2009-07-25 04:06:41 +04:00
}
return NT_STATUS_OK ;
}
2012-10-10 09:36:47 +04:00
/*******************************************************************
Create a DATA_BLOB from a hash of the security descriptors
( system and NT ) stored at the system layer and the NT ACL we wish
to preserve .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static NTSTATUS create_sys_acl_blob ( const struct security_descriptor * psd ,
DATA_BLOB * pblob ,
uint16_t hash_type ,
uint8_t hash [ XATTR_SD_HASH_SIZE ] ,
const char * description ,
uint8_t sys_acl_hash [ XATTR_SD_HASH_SIZE ] )
{
struct xattr_NTACL xacl ;
struct security_descriptor_hash_v4 sd_hs4 ;
enum ndr_err_code ndr_err ;
TALLOC_CTX * ctx = talloc_tos ( ) ;
NTTIME nttime_now ;
struct timeval now = timeval_current ( ) ;
nttime_now = timeval_to_nttime ( & now ) ;
ZERO_STRUCT ( xacl ) ;
ZERO_STRUCT ( sd_hs4 ) ;
xacl . version = 4 ;
xacl . info . sd_hs4 = & sd_hs4 ;
xacl . info . sd_hs4 - > sd = discard_const_p ( struct security_descriptor , psd ) ;
xacl . info . sd_hs4 - > hash_type = hash_type ;
memcpy ( & xacl . info . sd_hs4 - > hash [ 0 ] , hash , XATTR_SD_HASH_SIZE ) ;
xacl . info . sd_hs4 - > description = description ;
xacl . info . sd_hs4 - > time = nttime_now ;
memcpy ( & xacl . info . sd_hs4 - > sys_acl_hash [ 0 ] , sys_acl_hash , XATTR_SD_HASH_SIZE ) ;
ndr_err = ndr_push_struct_blob (
pblob , ctx , & xacl ,
( ndr_push_flags_fn_t ) ndr_push_xattr_NTACL ) ;
if ( ! NDR_ERR_CODE_IS_SUCCESS ( ndr_err ) ) {
DEBUG ( 5 , ( " create_acl_blob: ndr_push_xattr_NTACL failed: %s \n " ,
ndr_errstr ( ndr_err ) ) ) ;
return ndr_map_error2ntstatus ( ndr_err ) ;
}
return NT_STATUS_OK ;
}
2009-12-24 04:19:22 +03:00
/*******************************************************************
Add in 3 inheritable components for a non - inheritable directory ACL .
CREATOR_OWNER / CREATOR_GROUP / WORLD .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2012-03-17 02:26:57 +04:00
static NTSTATUS add_directory_inheritable_components ( vfs_handle_struct * handle ,
2009-12-24 04:19:22 +03:00
const char * name ,
SMB_STRUCT_STAT * psbuf ,
struct security_descriptor * psd )
{
struct connection_struct * conn = handle - > conn ;
int num_aces = ( psd - > dacl ? psd - > dacl - > num_aces : 0 ) ;
struct smb_filename smb_fname ;
2010-02-07 22:10:57 +03:00
enum security_ace_type acltype ;
2009-12-24 04:19:22 +03:00
uint32_t access_mask ;
mode_t dir_mode ;
mode_t file_mode ;
mode_t mode ;
2012-11-01 02:51:28 +04:00
struct security_ace * new_ace_list ;
if ( psd - > dacl ) {
new_ace_list = talloc_zero_array ( psd - > dacl ,
struct security_ace ,
num_aces + 3 ) ;
} else {
/*
* make_sec_acl ( ) at the bottom of this function
* dupliates new_ace_list
*/
new_ace_list = talloc_zero_array ( talloc_tos ( ) ,
struct security_ace ,
num_aces + 3 ) ;
}
2009-12-24 04:19:22 +03:00
if ( new_ace_list = = NULL ) {
2012-03-17 02:26:57 +04:00
return NT_STATUS_NO_MEMORY ;
2009-12-24 04:19:22 +03:00
}
/* Fake a quick smb_filename. */
ZERO_STRUCT ( smb_fname ) ;
smb_fname . st = * psbuf ;
2011-05-06 03:19:49 +04:00
smb_fname . base_name = discard_const_p ( char , name ) ;
2009-12-24 04:19:22 +03:00
dir_mode = unix_mode ( conn ,
FILE_ATTRIBUTE_DIRECTORY , & smb_fname , NULL ) ;
file_mode = unix_mode ( conn ,
FILE_ATTRIBUTE_ARCHIVE , & smb_fname , NULL ) ;
mode = dir_mode | file_mode ;
DEBUG ( 10 , ( " add_directory_inheritable_components: directory %s, "
" mode = 0%o \n " ,
name ,
( unsigned int ) mode ) ) ;
if ( num_aces ) {
memcpy ( new_ace_list , psd - > dacl - > aces ,
num_aces * sizeof ( struct security_ace ) ) ;
}
2010-02-07 22:10:57 +03:00
access_mask = map_canon_ace_perms ( SNUM ( conn ) , & acltype ,
2009-12-24 04:19:22 +03:00
mode & 0700 , false ) ;
init_sec_ace ( & new_ace_list [ num_aces ] ,
& global_sid_Creator_Owner ,
2010-02-07 22:10:57 +03:00
acltype ,
2009-12-24 04:19:22 +03:00
access_mask ,
SEC_ACE_FLAG_CONTAINER_INHERIT |
SEC_ACE_FLAG_OBJECT_INHERIT |
SEC_ACE_FLAG_INHERIT_ONLY ) ;
2010-02-07 22:10:57 +03:00
access_mask = map_canon_ace_perms ( SNUM ( conn ) , & acltype ,
2009-12-24 04:19:22 +03:00
( mode < < 3 ) & 0700 , false ) ;
init_sec_ace ( & new_ace_list [ num_aces + 1 ] ,
& global_sid_Creator_Group ,
2010-02-07 22:10:57 +03:00
acltype ,
2009-12-24 04:19:22 +03:00
access_mask ,
SEC_ACE_FLAG_CONTAINER_INHERIT |
SEC_ACE_FLAG_OBJECT_INHERIT |
SEC_ACE_FLAG_INHERIT_ONLY ) ;
2010-02-07 22:10:57 +03:00
access_mask = map_canon_ace_perms ( SNUM ( conn ) , & acltype ,
2009-12-24 04:19:22 +03:00
( mode < < 6 ) & 0700 , false ) ;
init_sec_ace ( & new_ace_list [ num_aces + 2 ] ,
& global_sid_World ,
2010-02-07 22:10:57 +03:00
acltype ,
2009-12-24 04:19:22 +03:00
access_mask ,
SEC_ACE_FLAG_CONTAINER_INHERIT |
SEC_ACE_FLAG_OBJECT_INHERIT |
SEC_ACE_FLAG_INHERIT_ONLY ) ;
2012-03-17 02:26:57 +04:00
if ( psd - > dacl ) {
psd - > dacl - > aces = new_ace_list ;
psd - > dacl - > num_aces + = 3 ;
} else {
2012-11-01 02:51:28 +04:00
psd - > dacl = make_sec_acl ( psd ,
2012-03-17 02:26:57 +04:00
NT4_ACL_REVISION ,
3 ,
new_ace_list ) ;
if ( psd - > dacl = = NULL ) {
return NT_STATUS_NO_MEMORY ;
}
}
return NT_STATUS_OK ;
2009-12-24 04:19:22 +03:00
}
2009-07-25 04:06:41 +04:00
/*******************************************************************
2009-12-02 23:09:48 +03:00
Pull a DATA_BLOB from an xattr given a pathname .
2009-12-03 02:02:28 +03:00
If the hash doesn ' t match , or doesn ' t exist - return the underlying
filesystem sd .
2009-07-25 04:06:41 +04:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static NTSTATUS get_nt_acl_internal ( vfs_handle_struct * handle ,
2013-01-21 05:45:14 +04:00
files_struct * fsp ,
const char * name ,
uint32_t security_info ,
TALLOC_CTX * mem_ctx ,
2012-10-10 04:50:27 +04:00
struct security_descriptor * * ppdesc )
2009-07-25 04:06:41 +04:00
{
2011-09-23 22:46:06 +04:00
DATA_BLOB blob = data_blob_null ;
2009-07-25 04:06:41 +04:00
NTSTATUS status ;
2010-08-01 22:15:57 +04:00
uint16_t hash_type = XATTR_SD_HASH_TYPE_NONE ;
2012-10-10 09:36:47 +04:00
uint16_t xattr_version = 0 ;
2009-07-25 04:06:41 +04:00
uint8_t hash [ XATTR_SD_HASH_SIZE ] ;
2012-10-10 09:36:47 +04:00
uint8_t sys_acl_hash [ XATTR_SD_HASH_SIZE ] ;
2009-07-25 04:06:41 +04:00
uint8_t hash_tmp [ XATTR_SD_HASH_SIZE ] ;
2012-10-10 09:36:47 +04:00
uint8_t sys_acl_hash_tmp [ XATTR_SD_HASH_SIZE ] ;
2009-12-03 02:02:28 +03:00
struct security_descriptor * psd = NULL ;
2009-07-25 04:06:41 +04:00
struct security_descriptor * pdesc_next = NULL ;
2010-10-16 02:56:09 +04:00
bool ignore_file_system_acl = lp_parm_bool ( SNUM ( handle - > conn ) ,
ACL_MODULE_NAME ,
" ignore system acls " ,
false ) ;
2012-10-10 09:36:47 +04:00
TALLOC_CTX * frame = talloc_stackframe ( ) ;
2009-07-25 04:06:41 +04:00
if ( fsp & & name = = NULL ) {
name = fsp - > fsp_name - > base_name ;
}
DEBUG ( 10 , ( " get_nt_acl_internal: name=%s \n " , name ) ) ;
2012-10-10 09:36:47 +04:00
status = get_acl_blob ( frame , handle , fsp , name , & blob ) ;
2009-07-25 04:06:41 +04:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2009-12-02 23:09:48 +03:00
DEBUG ( 10 , ( " get_nt_acl_internal: get_acl_blob returned %s \n " ,
nt_errstr ( status ) ) ) ;
2012-10-24 10:03:41 +04:00
psd = NULL ;
2009-12-03 02:02:28 +03:00
goto out ;
2012-10-24 10:03:41 +04:00
} else {
status = parse_acl_blob ( & blob , mem_ctx , & psd ,
& hash_type , & xattr_version , & hash [ 0 ] , & sys_acl_hash [ 0 ] ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
DEBUG ( 10 , ( " parse_acl_blob returned %s \n " ,
nt_errstr ( status ) ) ) ;
psd = NULL ;
goto out ;
}
2009-07-25 04:06:41 +04:00
}
2012-10-10 09:36:47 +04:00
/* Ensure we don't leak psd if we don't choose it.
*
* We don ' t allocate it onto frame as it is preferred not to
* steal from a talloc pool .
*/
talloc_steal ( frame , psd ) ;
/* determine which type of xattr we got */
switch ( xattr_version ) {
case 1 :
case 2 :
/* These xattr types are unilatteral, they do not
* require confirmation of the hash . In particular ,
* the NTVFS file server uses version 1 , but
* ' samba - tool ntacl ' can set these as well */
goto out ;
case 3 :
case 4 :
if ( ignore_file_system_acl ) {
2009-12-03 02:02:28 +03:00
goto out ;
2012-10-10 09:36:47 +04:00
}
2009-07-25 04:06:41 +04:00
2012-10-10 09:36:47 +04:00
break ;
default :
DEBUG ( 10 , ( " get_nt_acl_internal: ACL blob revision "
" mismatch (%u) for file %s \n " ,
( unsigned int ) hash_type ,
name ) ) ;
TALLOC_FREE ( psd ) ;
2012-10-24 10:03:41 +04:00
psd = NULL ;
2010-10-16 02:56:09 +04:00
goto out ;
}
2009-07-25 04:06:41 +04:00
2012-10-10 09:36:47 +04:00
/* determine which type of xattr we got */
if ( hash_type ! = XATTR_SD_HASH_TYPE_SHA256 ) {
DEBUG ( 10 , ( " get_nt_acl_internal: ACL blob hash type "
" (%u) unexpected for file %s \n " ,
( unsigned int ) hash_type ,
name ) ) ;
2009-12-03 02:02:28 +03:00
TALLOC_FREE ( psd ) ;
2012-10-24 10:03:41 +04:00
psd = NULL ;
2009-07-25 04:06:41 +04:00
goto out ;
}
2012-10-10 09:36:47 +04:00
/* determine which type of xattr we got */
switch ( xattr_version ) {
case 4 :
{
int ret ;
char * sys_acl_blob_description ;
DATA_BLOB sys_acl_blob ;
if ( fsp ) {
/* Get the full underlying sd, then hash. */
ret = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD ( handle ,
fsp ,
frame ,
& sys_acl_blob_description ,
& sys_acl_blob ) ;
} else {
/* Get the full underlying sd, then hash. */
ret = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FILE ( handle ,
name ,
frame ,
& sys_acl_blob_description ,
& sys_acl_blob ) ;
}
/* If we fail to get the ACL blob (for some reason) then this
* is not fatal , we just work based on the NT ACL only */
if ( ret = = 0 ) {
status = hash_blob_sha256 ( sys_acl_blob , sys_acl_hash_tmp ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
TALLOC_FREE ( frame ) ;
return status ;
}
2009-07-25 04:06:41 +04:00
2012-10-10 09:36:47 +04:00
if ( memcmp ( & sys_acl_hash [ 0 ] , & sys_acl_hash_tmp [ 0 ] ,
XATTR_SD_HASH_SIZE ) = = 0 ) {
/* Hash matches, return blob sd. */
DEBUG ( 10 , ( " get_nt_acl_internal: blob hash "
" matches for file %s \n " ,
name ) ) ;
goto out ;
}
}
2012-07-17 21:04:03 +04:00
2012-10-10 09:36:47 +04:00
/* Otherwise, fall though and see if the NT ACL hash matches */
2012-09-10 02:43:09 +04:00
}
2012-10-10 09:36:47 +04:00
case 3 :
2012-10-24 10:03:41 +04:00
/* Get the full underlying sd for the hash
or to return as backup . */
if ( fsp ) {
status = SMB_VFS_NEXT_FGET_NT_ACL ( handle ,
fsp ,
HASH_SECURITY_INFO ,
mem_ctx ,
& pdesc_next ) ;
} else {
status = SMB_VFS_NEXT_GET_NT_ACL ( handle ,
name ,
HASH_SECURITY_INFO ,
mem_ctx ,
& pdesc_next ) ;
}
if ( ! NT_STATUS_IS_OK ( status ) ) {
DEBUG ( 10 , ( " get_nt_acl_internal: get_next_acl for file %s "
" returned %s \n " ,
name ,
nt_errstr ( status ) ) ) ;
TALLOC_FREE ( frame ) ;
return status ;
}
/* Ensure we don't leak psd_next if we don't choose it.
*
* We don ' t allocate it onto frame as it is preferred not to
* steal from a talloc pool .
*/
talloc_steal ( frame , pdesc_next ) ;
2012-10-10 09:36:47 +04:00
status = hash_sd_sha256 ( pdesc_next , hash_tmp ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
TALLOC_FREE ( psd ) ;
psd = pdesc_next ;
goto out ;
}
2012-09-10 02:43:09 +04:00
2012-10-10 09:36:47 +04:00
if ( memcmp ( & hash [ 0 ] , & hash_tmp [ 0 ] , XATTR_SD_HASH_SIZE ) = = 0 ) {
/* Hash matches, return blob sd. */
DEBUG ( 10 , ( " get_nt_acl_internal: blob hash "
" matches for file %s \n " ,
name ) ) ;
goto out ;
}
2009-07-25 04:06:41 +04:00
2012-10-10 09:36:47 +04:00
/* Hash doesn't match, return underlying sd. */
DEBUG ( 10 , ( " get_nt_acl_internal: blob hash "
" does not match for file %s - returning "
" file system SD mapping. \n " ,
name ) ) ;
if ( DEBUGLEVEL > = 10 ) {
DEBUG ( 10 , ( " get_nt_acl_internal: acl for blob hash for %s is: \n " ,
name ) ) ;
NDR_PRINT_DEBUG ( security_descriptor , pdesc_next ) ;
}
TALLOC_FREE ( psd ) ;
psd = pdesc_next ;
}
2009-07-25 04:06:41 +04:00
out :
2012-10-24 10:03:41 +04:00
if ( psd = = NULL ) {
/* Get the full underlying sd, as we failed to get the
* blob for the hash , or the revision / hash type wasn ' t
* known */
if ( fsp ) {
status = SMB_VFS_NEXT_FGET_NT_ACL ( handle ,
fsp ,
security_info ,
mem_ctx ,
& pdesc_next ) ;
} else {
status = SMB_VFS_NEXT_GET_NT_ACL ( handle ,
name ,
security_info ,
mem_ctx ,
& pdesc_next ) ;
}
if ( ! NT_STATUS_IS_OK ( status ) ) {
DEBUG ( 10 , ( " get_nt_acl_internal: get_next_acl for file %s "
" returned %s \n " ,
name ,
nt_errstr ( status ) ) ) ;
TALLOC_FREE ( frame ) ;
return status ;
}
/* Ensure we don't leak psd_next if we don't choose it.
*
* We don ' t allocate it onto frame as it is preferred not to
* steal from a talloc pool .
*/
talloc_steal ( frame , pdesc_next ) ;
psd = pdesc_next ;
}
2009-12-03 02:02:28 +03:00
if ( psd ! = pdesc_next ) {
/* We're returning the blob, throw
* away the filesystem SD . */
TALLOC_FREE ( pdesc_next ) ;
2009-12-24 04:19:22 +03:00
} else {
SMB_STRUCT_STAT sbuf ;
SMB_STRUCT_STAT * psbuf = & sbuf ;
bool is_directory = false ;
/*
* We ' re returning the underlying ACL from the
* filesystem . If it ' s a directory , and has no
* inheritable ACE entries we have to fake them .
*/
if ( fsp ) {
2010-10-16 02:56:09 +04:00
status = vfs_stat_fsp ( fsp ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
2012-10-10 09:36:47 +04:00
TALLOC_FREE ( frame ) ;
2010-10-16 02:56:09 +04:00
return status ;
}
2009-12-24 04:19:22 +03:00
psbuf = & fsp - > fsp_name - > st ;
} else {
2010-10-16 02:56:09 +04:00
int ret = vfs_stat_smb_fname ( handle - > conn ,
2009-12-24 04:19:22 +03:00
name ,
2010-10-16 02:56:09 +04:00
& sbuf ) ;
if ( ret = = - 1 ) {
2012-10-10 09:36:47 +04:00
TALLOC_FREE ( frame ) ;
2010-10-16 02:56:09 +04:00
return map_nt_error_from_unix ( errno ) ;
2009-12-24 04:19:22 +03:00
}
}
2011-12-02 22:55:40 +04:00
is_directory = S_ISDIR ( psbuf - > st_ex_mode ) ;
2010-10-16 02:56:09 +04:00
if ( ignore_file_system_acl ) {
TALLOC_FREE ( pdesc_next ) ;
2012-10-10 04:50:27 +04:00
status = make_default_filesystem_acl ( mem_ctx ,
2010-10-16 02:56:09 +04:00
name ,
psbuf ,
& psd ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
2012-10-10 09:36:47 +04:00
TALLOC_FREE ( frame ) ;
2010-10-16 02:56:09 +04:00
return status ;
}
} else {
if ( is_directory & &
2009-12-24 04:19:22 +03:00
! sd_has_inheritable_components ( psd ,
true ) ) {
2012-03-17 02:26:57 +04:00
status = add_directory_inheritable_components (
handle ,
2009-12-24 04:19:22 +03:00
name ,
psbuf ,
psd ) ;
2012-03-17 02:26:57 +04:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2012-10-10 09:36:47 +04:00
TALLOC_FREE ( frame ) ;
2012-03-17 02:26:57 +04:00
return status ;
}
2010-10-16 02:56:09 +04:00
}
/* The underlying POSIX module always sets
the ~ SEC_DESC_DACL_PROTECTED bit , as ACLs
can ' t be inherited in this way under POSIX .
Remove it for Windows - style ACLs . */
psd - > type & = ~ SEC_DESC_DACL_PROTECTED ;
2009-12-24 04:19:22 +03:00
}
2009-12-03 02:02:28 +03:00
}
2010-06-03 01:22:12 +04:00
if ( ! ( security_info & SECINFO_OWNER ) ) {
2009-12-03 02:02:28 +03:00
psd - > owner_sid = NULL ;
2009-07-25 04:06:41 +04:00
}
2010-06-03 01:25:18 +04:00
if ( ! ( security_info & SECINFO_GROUP ) ) {
2009-12-03 02:02:28 +03:00
psd - > group_sid = NULL ;
2009-07-25 04:06:41 +04:00
}
2010-06-03 01:35:44 +04:00
if ( ! ( security_info & SECINFO_DACL ) ) {
2011-11-30 04:31:18 +04:00
psd - > type & = ~ SEC_DESC_DACL_PRESENT ;
2009-12-03 02:02:28 +03:00
psd - > dacl = NULL ;
2009-07-25 04:06:41 +04:00
}
2010-06-03 01:29:16 +04:00
if ( ! ( security_info & SECINFO_SACL ) ) {
2011-11-30 04:31:18 +04:00
psd - > type & = ~ SEC_DESC_SACL_PRESENT ;
2009-12-03 02:02:28 +03:00
psd - > sacl = NULL ;
2009-07-25 04:06:41 +04:00
}
TALLOC_FREE ( blob . data ) ;
2010-10-16 01:18:22 +04:00
if ( DEBUGLEVEL > = 10 ) {
DEBUG ( 10 , ( " get_nt_acl_internal: returning acl for %s is: \n " ,
name ) ) ;
NDR_PRINT_DEBUG ( security_descriptor , psd ) ;
}
2012-10-10 09:36:47 +04:00
/* The VFS API is that the ACL is expected to be on mem_ctx */
* ppdesc = talloc_move ( mem_ctx , & psd ) ;
TALLOC_FREE ( frame ) ;
2009-12-03 02:02:28 +03:00
return NT_STATUS_OK ;
2009-07-25 04:06:41 +04:00
}
/*********************************************************************
Fetch a security descriptor given an fsp .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2012-10-10 04:50:27 +04:00
static NTSTATUS fget_nt_acl_common ( vfs_handle_struct * handle ,
files_struct * fsp ,
uint32_t security_info ,
TALLOC_CTX * mem_ctx ,
struct security_descriptor * * ppdesc )
2009-07-25 04:06:41 +04:00
{
2009-12-03 02:02:28 +03:00
return get_nt_acl_internal ( handle , fsp ,
2012-10-10 04:50:27 +04:00
NULL , security_info , mem_ctx , ppdesc ) ;
2009-07-25 04:06:41 +04:00
}
/*********************************************************************
Fetch a security descriptor given a pathname .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2009-07-27 23:09:40 +04:00
static NTSTATUS get_nt_acl_common ( vfs_handle_struct * handle ,
2012-10-10 04:50:27 +04:00
const char * name ,
uint32_t security_info ,
TALLOC_CTX * mem_ctx ,
struct security_descriptor * * ppdesc )
2009-07-25 04:06:41 +04:00
{
2009-12-03 02:02:28 +03:00
return get_nt_acl_internal ( handle , NULL ,
2012-10-10 04:50:27 +04:00
name , security_info , mem_ctx , ppdesc ) ;
2009-07-25 04:06:41 +04:00
}
/*********************************************************************
Store a security descriptor given an fsp .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2009-07-27 23:09:40 +04:00
static NTSTATUS fset_nt_acl_common ( vfs_handle_struct * handle , files_struct * fsp ,
2010-10-12 04:15:39 +04:00
uint32_t security_info_sent , const struct security_descriptor * orig_psd )
2009-07-25 04:06:41 +04:00
{
NTSTATUS status ;
2012-10-10 09:36:47 +04:00
int ret ;
DATA_BLOB blob , sys_acl_blob ;
2009-07-25 04:06:41 +04:00
struct security_descriptor * pdesc_next = NULL ;
2010-10-12 04:15:39 +04:00
struct security_descriptor * psd = NULL ;
2009-07-25 04:06:41 +04:00
uint8_t hash [ XATTR_SD_HASH_SIZE ] ;
2012-10-10 09:36:47 +04:00
uint8_t sys_acl_hash [ XATTR_SD_HASH_SIZE ] ;
2012-02-04 02:55:34 +04:00
bool chown_needed = false ;
2012-10-10 09:36:47 +04:00
char * sys_acl_description ;
2012-10-10 04:50:27 +04:00
TALLOC_CTX * frame = talloc_stackframe ( ) ;
2009-07-25 04:06:41 +04:00
if ( DEBUGLEVEL > = 10 ) {
DEBUG ( 10 , ( " fset_nt_acl_xattr: incoming sd for file %s \n " ,
fsp_str_dbg ( fsp ) ) ) ;
NDR_PRINT_DEBUG ( security_descriptor ,
2011-05-06 03:19:49 +04:00
discard_const_p ( struct security_descriptor , orig_psd ) ) ;
2009-07-25 04:06:41 +04:00
}
2010-10-12 04:15:39 +04:00
status = get_nt_acl_internal ( handle , fsp ,
NULL ,
SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL | SECINFO_SACL ,
2012-10-10 04:50:27 +04:00
frame ,
2010-10-12 04:15:39 +04:00
& psd ) ;
2009-11-25 21:20:38 +03:00
2010-10-12 04:15:39 +04:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2012-10-10 04:50:27 +04:00
TALLOC_FREE ( frame ) ;
2010-10-12 04:15:39 +04:00
return status ;
}
2009-11-25 21:20:38 +03:00
2010-11-24 01:31:43 +03:00
psd - > revision = orig_psd - > revision ;
/* All our SD's are self relative. */
psd - > type = orig_psd - > type | SEC_DESC_SELF_RELATIVE ;
2010-10-12 04:15:39 +04:00
if ( ( security_info_sent & SECINFO_OWNER ) & & ( orig_psd - > owner_sid ! = NULL ) ) {
2012-02-04 02:55:34 +04:00
if ( ! dom_sid_equal ( orig_psd - > owner_sid , psd - > owner_sid ) ) {
/* We're changing the owner. */
chown_needed = true ;
}
2010-10-12 04:15:39 +04:00
psd - > owner_sid = orig_psd - > owner_sid ;
}
if ( ( security_info_sent & SECINFO_GROUP ) & & ( orig_psd - > group_sid ! = NULL ) ) {
2012-02-04 02:55:34 +04:00
if ( ! dom_sid_equal ( orig_psd - > group_sid , psd - > group_sid ) ) {
/* We're changing the group. */
chown_needed = true ;
}
2010-10-12 04:15:39 +04:00
psd - > group_sid = orig_psd - > group_sid ;
}
if ( security_info_sent & SECINFO_DACL ) {
psd - > dacl = orig_psd - > dacl ;
2010-11-24 01:31:43 +03:00
psd - > type | = SEC_DESC_DACL_PRESENT ;
2010-10-12 04:15:39 +04:00
}
if ( security_info_sent & SECINFO_SACL ) {
psd - > sacl = orig_psd - > sacl ;
2010-11-24 01:31:43 +03:00
psd - > type | = SEC_DESC_SACL_PRESENT ;
2009-07-25 04:06:41 +04:00
}
status = SMB_VFS_NEXT_FSET_NT_ACL ( handle , fsp , security_info_sent , psd ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
2012-02-04 02:55:34 +04:00
if ( ! NT_STATUS_EQUAL ( status , NT_STATUS_ACCESS_DENIED ) ) {
2012-10-10 04:50:27 +04:00
TALLOC_FREE ( frame ) ;
2012-02-04 02:55:34 +04:00
return status ;
}
/* We got access denied here. If we're already root,
or we didn ' t need to do a chown , or the fsp isn ' t
open with WRITE_OWNER access , just return . */
if ( get_current_uid ( handle - > conn ) = = 0 | |
chown_needed = = false | |
! ( fsp - > access_mask & SEC_STD_WRITE_OWNER ) ) {
2012-12-04 05:02:07 +04:00
TALLOC_FREE ( frame ) ;
2012-02-04 02:55:34 +04:00
return NT_STATUS_ACCESS_DENIED ;
}
DEBUG ( 10 , ( " fset_nt_acl_common: overriding chown on file %s "
" for sid %s \n " ,
fsp_str_dbg ( fsp ) ,
sid_string_tos ( psd - > owner_sid )
) ) ;
/* Ok, we failed to chown and we have
SEC_STD_WRITE_OWNER access - override . */
become_root ( ) ;
status = SMB_VFS_NEXT_FSET_NT_ACL ( handle , fsp ,
security_info_sent , psd ) ;
unbecome_root ( ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
2012-10-10 04:50:27 +04:00
TALLOC_FREE ( frame ) ;
2012-02-04 02:55:34 +04:00
return status ;
}
2009-07-25 04:06:41 +04:00
}
/* Get the full underlying sd, then hash. */
status = SMB_VFS_NEXT_FGET_NT_ACL ( handle ,
2012-10-10 04:50:27 +04:00
fsp ,
HASH_SECURITY_INFO ,
frame ,
& pdesc_next ) ;
2009-07-25 04:06:41 +04:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2012-10-10 04:50:27 +04:00
TALLOC_FREE ( frame ) ;
2009-07-25 04:06:41 +04:00
return status ;
}
status = hash_sd_sha256 ( pdesc_next , hash ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
2012-10-10 04:50:27 +04:00
TALLOC_FREE ( frame ) ;
2009-07-25 04:06:41 +04:00
return status ;
}
2012-10-10 09:36:47 +04:00
/* Get the full underlying sd, then hash. */
ret = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD ( handle ,
fsp ,
frame ,
& sys_acl_description ,
& sys_acl_blob ) ;
/* If we fail to get the ACL blob (for some reason) then this
* is not fatal , we just work based on the NT ACL only */
if ( ret ! = 0 ) {
if ( DEBUGLEVEL > = 10 ) {
DEBUG ( 10 , ( " fset_nt_acl_xattr: storing xattr sd for file %s \n " ,
fsp_str_dbg ( fsp ) ) ) ;
NDR_PRINT_DEBUG ( security_descriptor ,
discard_const_p ( struct security_descriptor , psd ) ) ;
DEBUG ( 10 , ( " fset_nt_acl_xattr: storing has in xattr sd based on \n " ) ) ;
NDR_PRINT_DEBUG ( security_descriptor ,
discard_const_p ( struct security_descriptor , pdesc_next ) ) ;
}
status = create_acl_blob ( psd , & blob , XATTR_SD_HASH_TYPE_SHA256 , hash ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
DEBUG ( 10 , ( " fset_nt_acl_xattr: create_acl_blob failed \n " ) ) ;
TALLOC_FREE ( frame ) ;
return status ;
}
status = store_acl_blob_fsp ( handle , fsp , & blob ) ;
TALLOC_FREE ( frame ) ;
return status ;
}
status = hash_blob_sha256 ( sys_acl_blob , sys_acl_hash ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
TALLOC_FREE ( frame ) ;
return status ;
}
2009-07-25 04:06:41 +04:00
if ( DEBUGLEVEL > = 10 ) {
2012-10-10 09:36:47 +04:00
DEBUG ( 10 , ( " fset_nt_acl_xattr: storing xattr sd for file %s based on system ACL \n " ,
2009-07-25 04:06:41 +04:00
fsp_str_dbg ( fsp ) ) ) ;
NDR_PRINT_DEBUG ( security_descriptor ,
2012-10-10 09:36:47 +04:00
discard_const_p ( struct security_descriptor , psd ) ) ;
2012-09-10 02:43:09 +04:00
2012-10-10 09:36:47 +04:00
DEBUG ( 10 , ( " fset_nt_acl_xattr: storing hash in xattr sd based on system ACL and: \n " ) ) ;
2012-09-10 02:43:09 +04:00
NDR_PRINT_DEBUG ( security_descriptor ,
2012-10-10 09:36:47 +04:00
discard_const_p ( struct security_descriptor , pdesc_next ) ) ;
2009-07-25 04:06:41 +04:00
}
2012-10-10 09:36:47 +04:00
/* We store hashes of both the sys ACL blob and the NT
* security desciptor mapped from that ACL so as to improve
* our chances against some inadvertant change breaking the
* hash used */
status = create_sys_acl_blob ( psd , & blob , XATTR_SD_HASH_TYPE_SHA256 , hash ,
sys_acl_description , sys_acl_hash ) ;
2012-05-17 07:21:34 +04:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2012-10-10 09:36:47 +04:00
DEBUG ( 10 , ( " fset_nt_acl_xattr: create_sys_acl_blob failed \n " ) ) ;
2012-10-10 04:50:27 +04:00
TALLOC_FREE ( frame ) ;
2012-05-17 07:21:34 +04:00
return status ;
}
2012-05-15 18:47:14 +04:00
status = store_acl_blob_fsp ( handle , fsp , & blob ) ;
2009-07-25 04:06:41 +04:00
2012-10-10 04:50:27 +04:00
TALLOC_FREE ( frame ) ;
2012-05-15 18:47:14 +04:00
return status ;
2009-07-25 04:06:41 +04:00
}
2009-12-01 03:50:34 +03:00
2010-01-13 03:04:44 +03:00
static int acl_common_remove_object ( vfs_handle_struct * handle ,
const char * path ,
bool is_directory )
{
connection_struct * conn = handle - > conn ;
struct file_id id ;
files_struct * fsp = NULL ;
int ret = 0 ;
char * parent_dir = NULL ;
const char * final_component = NULL ;
struct smb_filename local_fname ;
int saved_errno = 0 ;
2011-08-19 01:11:45 +04:00
char * saved_dir = NULL ;
saved_dir = vfs_GetWd ( talloc_tos ( ) , conn ) ;
if ( ! saved_dir ) {
saved_errno = errno ;
goto out ;
}
2010-01-13 03:04:44 +03:00
if ( ! parent_dirname ( talloc_tos ( ) , path ,
& parent_dir , & final_component ) ) {
saved_errno = ENOMEM ;
goto out ;
}
DEBUG ( 10 , ( " acl_common_remove_object: removing %s %s/%s \n " ,
is_directory ? " directory " : " file " ,
parent_dir , final_component ) ) ;
/* cd into the parent dir to pin it. */
2011-08-19 01:11:45 +04:00
ret = vfs_ChDir ( conn , parent_dir ) ;
2010-01-13 03:04:44 +03:00
if ( ret = = - 1 ) {
saved_errno = errno ;
goto out ;
}
ZERO_STRUCT ( local_fname ) ;
2011-05-06 03:19:49 +04:00
local_fname . base_name = discard_const_p ( char , final_component ) ;
2010-01-13 03:04:44 +03:00
/* Must use lstat here. */
ret = SMB_VFS_LSTAT ( conn , & local_fname ) ;
if ( ret = = - 1 ) {
saved_errno = errno ;
goto out ;
}
/* Ensure we have this file open with DELETE access. */
id = vfs_file_id_from_sbuf ( conn , & local_fname . st ) ;
2010-09-27 06:05:25 +04:00
for ( fsp = file_find_di_first ( conn - > sconn , id ) ; fsp ;
2011-08-30 03:46:15 +04:00
fsp = file_find_di_next ( fsp ) ) {
2010-01-13 03:04:44 +03:00
if ( fsp - > access_mask & DELETE_ACCESS & &
fsp - > delete_on_close ) {
/* We did open this for delete,
* allow the delete as root .
*/
break ;
}
}
if ( ! fsp ) {
DEBUG ( 10 , ( " acl_common_remove_object: %s %s/%s "
" not an open file \n " ,
is_directory ? " directory " : " file " ,
parent_dir , final_component ) ) ;
saved_errno = EACCES ;
goto out ;
}
2010-01-17 04:03:06 +03:00
become_root ( ) ;
2010-01-13 03:04:44 +03:00
if ( is_directory ) {
ret = SMB_VFS_NEXT_RMDIR ( handle , final_component ) ;
} else {
ret = SMB_VFS_NEXT_UNLINK ( handle , & local_fname ) ;
}
2010-01-17 04:03:06 +03:00
unbecome_root ( ) ;
2010-01-13 03:04:44 +03:00
if ( ret = = - 1 ) {
saved_errno = errno ;
}
out :
TALLOC_FREE ( parent_dir ) ;
2011-08-19 01:11:45 +04:00
if ( saved_dir ) {
vfs_ChDir ( conn , saved_dir ) ;
}
2010-01-13 03:04:44 +03:00
if ( saved_errno ) {
errno = saved_errno ;
}
return ret ;
}
static int rmdir_acl_common ( struct vfs_handle_struct * handle ,
const char * path )
{
int ret ;
2012-01-11 00:52:01 +04:00
/* Try the normal rmdir first. */
2010-01-13 03:04:44 +03:00
ret = SMB_VFS_NEXT_RMDIR ( handle , path ) ;
2012-01-11 00:52:01 +04:00
if ( ret = = 0 ) {
return 0 ;
}
if ( errno = = EACCES | | errno = = EPERM ) {
/* Failed due to access denied,
see if we need to root override . */
return acl_common_remove_object ( handle ,
path ,
true ) ;
2010-01-13 03:04:44 +03:00
}
2012-01-11 00:52:01 +04:00
DEBUG ( 10 , ( " rmdir_acl_common: unlink of %s failed %s \n " ,
path ,
strerror ( errno ) ) ) ;
return - 1 ;
2010-01-13 03:04:44 +03:00
}
static int unlink_acl_common ( struct vfs_handle_struct * handle ,
const struct smb_filename * smb_fname )
{
int ret ;
2012-01-11 00:52:01 +04:00
/* Try the normal unlink first. */
2010-01-13 03:04:44 +03:00
ret = SMB_VFS_NEXT_UNLINK ( handle , smb_fname ) ;
2012-01-11 00:52:01 +04:00
if ( ret = = 0 ) {
return 0 ;
2010-01-13 03:04:44 +03:00
}
2012-01-11 00:52:01 +04:00
if ( errno = = EACCES | | errno = = EPERM ) {
/* Failed due to access denied,
see if we need to root override . */
2010-01-13 03:04:44 +03:00
2012-01-11 00:52:01 +04:00
/* Don't do anything fancy for streams. */
if ( smb_fname - > stream_name ) {
return - 1 ;
}
return acl_common_remove_object ( handle ,
2010-01-13 03:04:44 +03:00
smb_fname - > base_name ,
false ) ;
2012-01-11 00:52:01 +04:00
}
DEBUG ( 10 , ( " unlink_acl_common: unlink of %s failed %s \n " ,
smb_fname - > base_name ,
strerror ( errno ) ) ) ;
return - 1 ;
2010-01-13 03:04:44 +03:00
}
2011-04-02 03:50:28 +04:00
static int chmod_acl_module_common ( struct vfs_handle_struct * handle ,
const char * path , mode_t mode )
{
if ( lp_posix_pathnames ( ) ) {
/* Only allow this on POSIX pathnames. */
return SMB_VFS_NEXT_CHMOD ( handle , path , mode ) ;
}
return 0 ;
}
static int fchmod_acl_module_common ( struct vfs_handle_struct * handle ,
struct files_struct * fsp , mode_t mode )
{
if ( fsp - > posix_open ) {
/* Only allow this on POSIX opens. */
return SMB_VFS_NEXT_FCHMOD ( handle , fsp , mode ) ;
}
return 0 ;
}
static int chmod_acl_acl_module_common ( struct vfs_handle_struct * handle ,
const char * name , mode_t mode )
{
if ( lp_posix_pathnames ( ) ) {
/* Only allow this on POSIX pathnames. */
return SMB_VFS_NEXT_CHMOD_ACL ( handle , name , mode ) ;
}
return 0 ;
}
static int fchmod_acl_acl_module_common ( struct vfs_handle_struct * handle ,
struct files_struct * fsp , mode_t mode )
{
if ( fsp - > posix_open ) {
/* Only allow this on POSIX opens. */
return SMB_VFS_NEXT_FCHMOD_ACL ( handle , fsp , mode ) ;
}
return 0 ;
}