sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-26 10:04:02 +03:00
Code

r3832: added NT ACL query/set to the posix NTVFS backend. The default ACL is

Browse Source 
based on the current nttoken, which is completely wrong, but works as a start.

The ACL is stored in the xattr system.DosAcl, using a NDR encoded IDL
union with a version number to allow for future expansion.

pvfs does not yet check the ACL for file access. At the moment the ACL
is just query/set.

We also need to do some RPC work to allow the windows ACL editor to be
used. At the moment is queries the ACL fine, but displays an error
when it fails to map the SIDs via rpc.
This commit is contained in:
Andrew Tridgell 2004-11-18 03:31:35 +00:00 committed by Gerald (Jerry) Carter
parent f49c636e10
commit 3a1f20d874
11 changed files with 281 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
source/include/rpc_secdes.h
View File

@ -54,11 +54,12 @@ typedef struct security_descriptor SEC_DESC;
/* Don't know what this means. */
/* security information */
/* security information flags used in query_secdesc and set_secdesc */
#define OWNER_SECURITY_INFORMATION 0x00000001
#define GROUP_SECURITY_INFORMATION 0x00000002
#define DACL_SECURITY_INFORMATION 0x00000004
#define SACL_SECURITY_INFORMATION 0x00000008
/* Extra W2K flags. */
#define UNPROTECTED_SACL_SECURITY_INFORMATION 0x10000000
#define UNPROTECTED_DACL_SECURITY_INFORMATION 0x20000000

1
source/include/structs.h
View File

@ -112,6 +112,7 @@ struct file_info;
struct xattr_DosEAs;
struct xattr_DosStreams;
struct xattr_DosAcl;
struct test_join;

2
source/libcli/security/security_descriptor.c
View File

@ -108,7 +108,7 @@ NTSTATUS security_check_dacl(struct security_token *st,
add an ACE to the DACL of a security_descriptor
*/
NTSTATUS security_descriptor_dacl_add(struct security_descriptor *sd,
struct security_ace *ace)
const struct security_ace *ace)
{
if (sd->dacl == NULL) {
sd->dacl = talloc_p(sd, struct security_acl);

23
source/librpc/idl/xattr.idl
View File

@ -8,6 +8,9 @@
about a file in a architecture independent manner
*/
[
depends(security)
]
interface xattr
{
const string XATTR_DOSATTRIB_NAME = "user.DosAttrib";
@ -72,4 +75,24 @@ interface xattr
uint32 num_streams;
[size_is(num_streams)] xattr_DosStream *streams;
} xattr_DosStreams;
/* we store the NT ACL a DosAcl xattr. It is versioned so we
can later add other acl attribs (such as posix acl
mapping)
we put this xattr in the security namespace to ensure that
only trusted users can write to the ACL
*/
const string XATTR_DOSACL_NAME = "security.DosAcl";
typedef union {
[case(1)] security_descriptor *sd;
} xattr_DosAclInfo;
typedef [public] struct {
uint16 version;
[switch_is(version)] xattr_DosAclInfo info;
} xattr_DosAcl;
}

1
source/ntvfs/posix/config.mk
View File

@ -28,6 +28,7 @@ ADD_OBJ_FILES = \
ntvfs/posix/pvfs_ioctl.o \
ntvfs/posix/pvfs_xattr.o \
ntvfs/posix/pvfs_streams.o \
ntvfs/posix/pvfs_acl.o \
ntvfs/common/opendb.o \
ntvfs/common/brlock.o
# End MODULE ntvfs_posix

193
source/ntvfs/posix/pvfs_acl.c Normal file
View File

@ -0,0 +1,193 @@
/*
Unix SMB/CIFS implementation.
POSIX NTVFS backend - ACL support
Copyright (C) Andrew Tridgell 2004
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "includes.h"
#include "auth/auth.h"
#include "system/filesys.h"
#include "vfs_posix.h"
#include "librpc/gen_ndr/ndr_xattr.h"
/*
setup a default ACL for a file
*/
static NTSTATUS pvfs_default_acl(struct pvfs_state *pvfs,
struct smbsrv_request *req,
struct pvfs_filename *name, int fd,
struct xattr_DosAcl *acl)
{
struct security_descriptor *sd;
struct nt_user_token *token = req->session->session_info->nt_user_token;
int i;
sd = security_descriptor_initialise(req);
if (sd == NULL) {
return NT_STATUS_NO_MEMORY;
}
/* nasty hack to get a reasonable sec desc - should be based on posix uid/gid
and perms */
if (token->num_sids > 0) {
sd->owner_sid = token->user_sids[0];
}
if (token->num_sids > 1) {
sd->group_sid = token->user_sids[1];
}
for (i=0;i<token->num_sids;i++) {
struct security_ace ace;
NTSTATUS status;
ace.type = SEC_ACE_TYPE_ACCESS_ALLOWED;
ace.flags = 0;
ace.access_mask = SEC_RIGHTS_FULL_CTRL | STD_RIGHT_ALL_ACCESS;
ace.trustee = *token->user_sids[i];
status = security_descriptor_dacl_add(sd, &ace);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
}
acl->version = 1;
acl->info.sd = sd;
return NT_STATUS_OK;
}
/*
omit any security_descriptor elements not specified in the given
secinfo flags
*/
static void normalise_sd_flags(struct security_descriptor *sd, uint32_t secinfo_flags)
{
if (!(secinfo_flags & OWNER_SECURITY_INFORMATION)) {
sd->owner_sid = NULL;
}
if (!(secinfo_flags & GROUP_SECURITY_INFORMATION)) {
sd->group_sid = NULL;
}
if (!(secinfo_flags & DACL_SECURITY_INFORMATION)) {
sd->dacl = NULL;
}
if (!(secinfo_flags & SACL_SECURITY_INFORMATION)) {
sd->sacl = NULL;
}
}
/*
answer a setfileinfo for an ACL
*/
NTSTATUS pvfs_acl_set(struct pvfs_state *pvfs,
struct smbsrv_request *req,
struct pvfs_filename *name, int fd,
union smb_setfileinfo *info)
{
struct xattr_DosAcl *acl;
uint32_t secinfo_flags = info->set_secdesc.in.secinfo_flags;
struct security_descriptor *new_sd, *sd;
NTSTATUS status;
acl = talloc_p(req, struct xattr_DosAcl);
if (acl == NULL) {
return NT_STATUS_NO_MEMORY;
}
status = pvfs_acl_load(pvfs, name, fd, acl);
if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
status = pvfs_default_acl(pvfs, req, name, fd, acl);
}
if (!NT_STATUS_IS_OK(status)) {
return status;
}
switch (acl->version) {
case 1:
sd = acl->info.sd;
break;
default:
return NT_STATUS_INVALID_LEVEL;
}
new_sd = info->set_secdesc.in.sd;
/* only set the elements that have been specified */
if (secinfo_flags & OWNER_SECURITY_INFORMATION) {
sd->owner_sid = new_sd->owner_sid;
}
if (secinfo_flags & GROUP_SECURITY_INFORMATION) {
sd->group_sid = new_sd->group_sid;
}
if (secinfo_flags & DACL_SECURITY_INFORMATION) {
sd->dacl = new_sd->dacl;
}
if (secinfo_flags & SACL_SECURITY_INFORMATION) {
sd->sacl = new_sd->sacl;
}
status = pvfs_acl_save(pvfs, name, fd, acl);
return status;
}
/*
answer a fileinfo query for the ACL
*/
NTSTATUS pvfs_acl_query(struct pvfs_state *pvfs,
struct smbsrv_request *req,
struct pvfs_filename *name, int fd,
union smb_fileinfo *info)
{
struct xattr_DosAcl *acl;
NTSTATUS status;
struct security_descriptor *sd;
acl = talloc_p(req, struct xattr_DosAcl);
if (acl == NULL) {
return NT_STATUS_NO_MEMORY;
}
status = pvfs_acl_load(pvfs, name, fd, acl);
if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
status = pvfs_default_acl(pvfs, req, name, fd, acl);
}
if (!NT_STATUS_IS_OK(status)) {
return status;
}
switch (acl->version) {
case 1:
sd = acl->info.sd;
break;
default:
return NT_STATUS_INVALID_LEVEL;
}
normalise_sd_flags(sd, info->query_secdesc.in.secinfo_flags);
info->query_secdesc.out.sd = sd;
return NT_STATUS_OK;
}

10
source/ntvfs/posix/pvfs_qfileinfo.c
View File

@ -56,7 +56,8 @@ static NTSTATUS pvfs_query_all_eas(struct pvfs_state *pvfs, TALLOC_CTX *mem_ctx,
/*
approximately map a struct pvfs_filename to a generic fileinfo struct
*/
static NTSTATUS pvfs_map_fileinfo(struct pvfs_state *pvfs, TALLOC_CTX *mem_ctx,
static NTSTATUS pvfs_map_fileinfo(struct pvfs_state *pvfs,
struct smbsrv_request *req,
struct pvfs_filename *name, union smb_fileinfo *info,
int fd)
{
@ -91,7 +92,7 @@ static NTSTATUS pvfs_map_fileinfo(struct pvfs_state *pvfs, TALLOC_CTX *mem_ctx,
return NT_STATUS_OK;
case RAW_FILEINFO_ALL_EAS:
return pvfs_query_all_eas(pvfs, mem_ctx, name, fd, &info->all_eas.out);
return pvfs_query_all_eas(pvfs, req, name, fd, &info->all_eas.out);
case RAW_FILEINFO_IS_NAME_VALID:
return NT_STATUS_OK;
@ -149,7 +150,7 @@ static NTSTATUS pvfs_map_fileinfo(struct pvfs_state *pvfs, TALLOC_CTX *mem_ctx,
case RAW_FILEINFO_STREAM_INFO:
case RAW_FILEINFO_STREAM_INFORMATION:
return pvfs_stream_information(pvfs, mem_ctx, name, fd, &info->stream_info.out);
return pvfs_stream_information(pvfs, req, name, fd, &info->stream_info.out);
case RAW_FILEINFO_COMPRESSION_INFO:
case RAW_FILEINFO_COMPRESSION_INFORMATION:
@ -194,6 +195,9 @@ static NTSTATUS pvfs_map_fileinfo(struct pvfs_state *pvfs, TALLOC_CTX *mem_ctx,
info->attribute_tag_information.out.attrib = name->dos.attrib;
info->attribute_tag_information.out.reparse_tag = 0;
return NT_STATUS_OK;
case RAW_FILEINFO_SEC_DESC:
return pvfs_acl_query(pvfs, req, name, fd, info);
}
return NT_STATUS_INVALID_LEVEL;

3
source/ntvfs/posix/pvfs_setfileinfo.c
View File

@ -301,6 +301,9 @@ NTSTATUS pvfs_setfileinfo(struct ntvfs_module_context *ntvfs,
return pvfs_setfileinfo_rename(pvfs, req, h->name,
&info->rename_information.in);
case RAW_SFILEINFO_SEC_DESC:
return pvfs_acl_set(pvfs, req, h->name, h->fd, info);
default:
return NT_STATUS_INVALID_LEVEL;
}

43
source/ntvfs/posix/pvfs_xattr.c
View File

@ -348,6 +348,49 @@ NTSTATUS pvfs_streams_save(struct pvfs_state *pvfs, struct pvfs_filename *name,
(ndr_push_flags_fn_t)ndr_push_xattr_DosStreams);
}
/*
load the current ACL from extended attributes
*/
NTSTATUS pvfs_acl_load(struct pvfs_state *pvfs, struct pvfs_filename *name, int fd,
struct xattr_DosAcl *acl)
{
NTSTATUS status;
ZERO_STRUCTP(acl);
if (!(pvfs->flags & PVFS_FLAG_XATTR_ENABLE)) {
return NT_STATUS_OK;
}
status = pvfs_xattr_ndr_load(pvfs, acl, name->full_name, fd,
XATTR_DOSACL_NAME,
acl,
(ndr_pull_flags_fn_t)ndr_pull_xattr_DosAcl);
return status;
}
/*
save the acl for a file into filesystem xattr
*/
NTSTATUS pvfs_acl_save(struct pvfs_state *pvfs, struct pvfs_filename *name, int fd,
struct xattr_DosAcl *acl)
{
NTSTATUS status;
void *privs;
if (!(pvfs->flags & PVFS_FLAG_XATTR_ENABLE)) {
return NT_STATUS_OK;
}
/* this xattr is in the "system" namespace, so we need
admin privileges to set it */
privs = root_privileges();
status = pvfs_xattr_ndr_save(pvfs, name->full_name, fd,
XATTR_DOSACL_NAME,
acl,
(ndr_push_flags_fn_t)ndr_push_xattr_DosAcl);
talloc_free(privs);
return status;
}
/*
create a zero length xattr with the given name
*/

3
source/ntvfs/posix/vfs_posix.c
View File

@ -65,6 +65,9 @@ static void pvfs_setup_options(struct pvfs_state *pvfs)
if (pvfs->flags & PVFS_FLAG_XATTR_ENABLE) {
pvfs->fs_attribs |= FS_ATTR_NAMED_STREAMS;
}
if (pvfs->flags & PVFS_FLAG_XATTR_ENABLE) {
pvfs->fs_attribs |= FS_ATTR_PERSISTANT_ACLS;
}
}

4
source/ntvfs/unixuid/vfs_unixuid.c
View File

@ -294,6 +294,10 @@ static NTSTATUS unixuid_setup_security(struct ntvfs_module_context *ntvfs,
struct unix_sec_ctx *newsec;
NTSTATUS status;
if (req->session == NULL) {
return NT_STATUS_ACCESS_DENIED;
}
*sec = save_unix_security(req);
if (*sec == NULL) {
return NT_STATUS_NO_MEMORY;