source: branches/samba-3.3.x/source/modules/vfs_acl_tdb.c@ 206

Last change on this file since 206 was 206, checked in by Herwig Bauernfeind, 17 years ago

Import Samba 3.3 branch at 3.0.0 level (psmedley's port)
File size: 23.7 KB
Line 
1/*
2 * Store Windows ACLs in a tdb.
3 *
4 * Copyright (C) Volker Lendecke, 2008
5 * Copyright (C) Jeremy Allison, 2008
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 */
20
21/* NOTE: This is an experimental module, not yet finished. JRA. */
22
23#include "includes.h"
24#include "librpc/gen_ndr/xattr.h"
25#include "librpc/gen_ndr/ndr_xattr.h"
26
27#undef DBGC_CLASS
28#define DBGC_CLASS DBGC_VFS
29
30static unsigned int ref_count;
31static struct db_context *acl_db;
32
33/*******************************************************************
34 Open acl_db if not already open, increment ref count.
35*******************************************************************/
36
37static bool acl_tdb_init(struct db_context **pp_db)
38{
39 const char *dbname;
40
41 if (acl_db) {
42 *pp_db = acl_db;
43 ref_count++;
44 return true;
45 }
46
47 dbname = lock_path("file_ntacls.tdb");
48
49 if (dbname == NULL) {
50 errno = ENOSYS;
51 return false;
52 }
53
54 become_root();
55 *pp_db = db_open(NULL, dbname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
56 unbecome_root();
57
58 if (*pp_db == NULL) {
59#if defined(ENOTSUP)
60 errno = ENOTSUP;
61#else
62 errno = ENOSYS;
63#endif
64 return false;
65 }
66
67 ref_count++;
68 return true;
69}
70
71/*******************************************************************
72 Lower ref count and close acl_db if zero.
73*******************************************************************/
74
75static void free_acl_tdb_data(void **pptr)
76{
77 struct db_context **pp_db = (struct db_context **)pptr;
78
79 ref_count--;
80 if (ref_count == 0) {
81 TALLOC_FREE(*pp_db);
82 acl_db = NULL;
83 }
84}
85
86/*******************************************************************
87 Fetch_lock the tdb acl record for a file
88*******************************************************************/
89
90static struct db_record *acl_tdb_lock(TALLOC_CTX *mem_ctx,
91 struct db_context *db,
92 const struct file_id *id)
93{
94 uint8 id_buf[16];
95 push_file_id_16((char *)id_buf, id);
96 return db->fetch_locked(db,
97 mem_ctx,
98 make_tdb_data(id_buf,
99 sizeof(id_buf)));
100}
101
102/*******************************************************************
103 Delete the tdb acl record for a file
104*******************************************************************/
105
106static NTSTATUS acl_tdb_delete(vfs_handle_struct *handle,
107 struct db_context *db,
108 SMB_STRUCT_STAT *psbuf)
109{
110 NTSTATUS status;
111 struct file_id id = vfs_file_id_from_sbuf(handle->conn, psbuf);
112 struct db_record *rec = acl_tdb_lock(talloc_tos(), db, &id);
113
114 /*
115 * If rec == NULL there's not much we can do about it
116 */
117
118 if (rec == NULL) {
119 DEBUG(10,("acl_tdb_delete: rec == NULL\n"));
120 TALLOC_FREE(rec);
121 return NT_STATUS_OK;
122 }
123
124 status = rec->delete_rec(rec);
125 TALLOC_FREE(rec);
126 return status;
127}
128
129/*******************************************************************
130 Parse out a struct security_descriptor from a DATA_BLOB.
131*******************************************************************/
132
133static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
134 uint32 security_info,
135 struct security_descriptor **ppdesc)
136{
137 TALLOC_CTX *ctx = talloc_tos();
138 struct xattr_NTACL xacl;
139 enum ndr_err_code ndr_err;
140 size_t sd_size;
141
142 ndr_err = ndr_pull_struct_blob(pblob, ctx, &xacl,
143 (ndr_pull_flags_fn_t)ndr_pull_xattr_NTACL);
144
145 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
146 DEBUG(5, ("parse_acl_blob: ndr_pull_xattr_NTACL failed: %s\n",
147 ndr_errstr(ndr_err)));
148 return ndr_map_error2ntstatus(ndr_err);;
149 }
150
151 if (xacl.version != 2) {
152 return NT_STATUS_REVISION_MISMATCH;
153 }
154
155 *ppdesc = make_sec_desc(ctx, SEC_DESC_REVISION, xacl.info.sd_hs->sd->type | SEC_DESC_SELF_RELATIVE,
156 (security_info & OWNER_SECURITY_INFORMATION)
157 ? xacl.info.sd_hs->sd->owner_sid : NULL,
158 (security_info & GROUP_SECURITY_INFORMATION)
159 ? xacl.info.sd_hs->sd->group_sid : NULL,
160 (security_info & SACL_SECURITY_INFORMATION)
161 ? xacl.info.sd_hs->sd->sacl : NULL,
162 (security_info & DACL_SECURITY_INFORMATION)
163 ? xacl.info.sd_hs->sd->dacl : NULL,
164 &sd_size);
165
166 TALLOC_FREE(xacl.info.sd);
167
168 return (*ppdesc != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
169}
170
171/*******************************************************************
172 Pull a security descriptor into a DATA_BLOB from a tdb store.
173*******************************************************************/
174
175static NTSTATUS get_acl_blob(TALLOC_CTX *ctx,
176 vfs_handle_struct *handle,
177 files_struct *fsp,
178 const char *name,
179 DATA_BLOB *pblob)
180{
181 uint8 id_buf[16];
182 TDB_DATA data;
183 struct file_id id;
184 struct db_context *db;
185 SMB_STRUCT_STAT sbuf;
186
187 SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context,
188 return NT_STATUS_INTERNAL_DB_CORRUPTION);
189
190 if (fsp && fsp->fh->fd != -1) {
191 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
192 return map_nt_error_from_unix(errno);
193 }
194 } else {
195 if (SMB_VFS_STAT(handle->conn, name, &sbuf) == -1) {
196 return map_nt_error_from_unix(errno);
197 }
198 }
199 id = vfs_file_id_from_sbuf(handle->conn, &sbuf);
200
201 push_file_id_16((char *)id_buf, &id);
202
203 if (db->fetch(db,
204 ctx,
205 make_tdb_data(id_buf, sizeof(id_buf)),
206 &data) == -1) {
207 return NT_STATUS_INTERNAL_DB_CORRUPTION;
208 }
209
210 pblob->data = data.dptr;
211 pblob->length = data.dsize;
212
213 DEBUG(10,("get_acl_blob: returned %u bytes from file %s\n",
214 (unsigned int)data.dsize, name ));
215
216 if (pblob->length == 0 || pblob->data == NULL) {
217 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
218 }
219 return NT_STATUS_OK;
220}
221
222/*******************************************************************
223 Create a DATA_BLOB from a security descriptor.
224*******************************************************************/
225
226static NTSTATUS create_acl_blob(const struct security_descriptor *psd, DATA_BLOB *pblob)
227{
228 struct xattr_NTACL xacl;
229 struct security_descriptor_hash sd_hs;
230 enum ndr_err_code ndr_err;
231 TALLOC_CTX *ctx = talloc_tos();
232
233 ZERO_STRUCT(xacl);
234 ZERO_STRUCT(sd_hs);
235
236 xacl.version = 2;
237 xacl.info.sd_hs = &sd_hs;
238 xacl.info.sd_hs->sd = CONST_DISCARD(struct security_descriptor *, psd);
239 memset(&xacl.info.sd_hs->hash[0], '\0', 16);
240
241 ndr_err = ndr_push_struct_blob(
242 pblob, ctx, &xacl,
243 (ndr_push_flags_fn_t)ndr_push_xattr_NTACL);
244
245 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
246 DEBUG(5, ("create_acl_blob: ndr_push_xattr_NTACL failed: %s\n",
247 ndr_errstr(ndr_err)));
248 return ndr_map_error2ntstatus(ndr_err);;
249 }
250
251 return NT_STATUS_OK;
252}
253
254/*******************************************************************
255 Store a DATA_BLOB into a tdb record given an fsp pointer.
256*******************************************************************/
257
258static NTSTATUS store_acl_blob_fsp(vfs_handle_struct *handle,
259 files_struct *fsp,
260 DATA_BLOB *pblob)
261{
262 uint8 id_buf[16];
263 struct file_id id;
264 SMB_STRUCT_STAT sbuf;
265 TDB_DATA data;
266 struct db_context *db;
267 struct db_record *rec;
268
269 DEBUG(10,("store_acl_blob_fsp: storing blob length %u on file %s\n",
270 (unsigned int)pblob->length, fsp->fsp_name));
271
272 SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context,
273 return NT_STATUS_INTERNAL_DB_CORRUPTION);
274
275 if (fsp->fh->fd != -1) {
276 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
277 return map_nt_error_from_unix(errno);
278 }
279 } else {
280 if (SMB_VFS_STAT(handle->conn, fsp->fsp_name, &sbuf) == -1) {
281 return map_nt_error_from_unix(errno);
282 }
283 }
284 id = vfs_file_id_from_sbuf(handle->conn, &sbuf);
285
286 push_file_id_16((char *)id_buf, &id);
287 rec = db->fetch_locked(db, talloc_tos(),
288 make_tdb_data(id_buf,
289 sizeof(id_buf)));
290 if (rec == NULL) {
291 DEBUG(0, ("store_acl_blob_fsp_tdb: fetch_lock failed\n"));
292 return NT_STATUS_INTERNAL_DB_CORRUPTION;
293 }
294 data.dptr = pblob->data;
295 data.dsize = pblob->length;
296 return rec->store(rec, data, 0);
297}
298
299/*******************************************************************
300 Store a DATA_BLOB into a tdb record given a pathname.
301*******************************************************************/
302
303static NTSTATUS store_acl_blob_pathname(vfs_handle_struct *handle,
304 const char *fname,
305 DATA_BLOB *pblob)
306{
307 uint8 id_buf[16];
308 struct file_id id;
309 TDB_DATA data;
310 SMB_STRUCT_STAT sbuf;
311 struct db_context *db;
312 struct db_record *rec;
313
314 DEBUG(10,("store_acl_blob_pathname: storing blob "
315 "length %u on file %s\n",
316 (unsigned int)pblob->length, fname));
317
318 SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context,
319 return NT_STATUS_INTERNAL_DB_CORRUPTION);
320
321 if (SMB_VFS_STAT(handle->conn, fname, &sbuf) == -1) {
322 return map_nt_error_from_unix(errno);
323 }
324
325 id = vfs_file_id_from_sbuf(handle->conn, &sbuf);
326 push_file_id_16((char *)id_buf, &id);
327
328 rec = db->fetch_locked(db, talloc_tos(),
329 make_tdb_data(id_buf,
330 sizeof(id_buf)));
331 if (rec == NULL) {
332 DEBUG(0, ("store_acl_blob_pathname_tdb: fetch_lock failed\n"));
333 return NT_STATUS_INTERNAL_DB_CORRUPTION;
334 }
335 data.dptr = pblob->data;
336 data.dsize = pblob->length;
337 return rec->store(rec, data, 0);
338}
339
340/*******************************************************************
341 Store a DATA_BLOB into an tdb given a pathname.
342*******************************************************************/
343
344static NTSTATUS get_nt_acl_tdb_internal(vfs_handle_struct *handle,
345 files_struct *fsp,
346 const char *name,
347 uint32 security_info,
348 struct security_descriptor **ppdesc)
349{
350 TALLOC_CTX *ctx = talloc_tos();
351 DATA_BLOB blob;
352 NTSTATUS status;
353
354 if (fsp && name == NULL) {
355 name = fsp->fsp_name;
356 }
357
358 DEBUG(10, ("get_nt_acl_tdb_internal: name=%s\n", name));
359
360 status = get_acl_blob(ctx, handle, fsp, name, &blob);
361 if (!NT_STATUS_IS_OK(status)) {
362 DEBUG(10, ("get_acl_blob returned %s\n", nt_errstr(status)));
363 return status;
364 }
365
366 status = parse_acl_blob(&blob, security_info, ppdesc);
367 if (!NT_STATUS_IS_OK(status)) {
368 DEBUG(10, ("parse_acl_blob returned %s\n",
369 nt_errstr(status)));
370 return status;
371 }
372
373 TALLOC_FREE(blob.data);
374 return status;
375}
376
377/*********************************************************************
378 Create a default security descriptor for a file in case no inheritance
379 exists. All permissions to the owner and SYSTEM.
380*********************************************************************/
381
382static struct security_descriptor *default_file_sd(TALLOC_CTX *mem_ctx,
383 SMB_STRUCT_STAT *psbuf)
384{
385 struct dom_sid owner_sid, group_sid;
386 size_t sd_size;
387 struct security_ace *pace = NULL;
388 struct security_acl *pacl = NULL;
389
390 uid_to_sid(&owner_sid, psbuf->st_uid);
391 gid_to_sid(&group_sid, psbuf->st_gid);
392
393 pace = TALLOC_ARRAY(mem_ctx, struct security_ace, 2);
394 if (!pace) {
395 return NULL;
396 }
397
398 init_sec_ace(&pace[0], &owner_sid, SEC_ACE_TYPE_ACCESS_ALLOWED,
399 SEC_RIGHTS_FILE_ALL, 0);
400 init_sec_ace(&pace[1], &global_sid_System, SEC_ACE_TYPE_ACCESS_ALLOWED,
401 SEC_RIGHTS_FILE_ALL, 0);
402
403 pacl = make_sec_acl(mem_ctx,
404 NT4_ACL_REVISION,
405 2,
406 pace);
407 if (!pacl) {
408 return NULL;
409 }
410 return make_sec_desc(mem_ctx,
411 SECURITY_DESCRIPTOR_REVISION_1,
412 SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT,
413 &owner_sid,
414 &group_sid,
415 NULL,
416 pacl,
417 &sd_size);
418}
419
420/*********************************************************************
421*********************************************************************/
422
423static NTSTATUS inherit_new_acl(vfs_handle_struct *handle,
424 const char *fname,
425 files_struct *fsp,
426 bool container)
427{
428 TALLOC_CTX *ctx = talloc_tos();
429 NTSTATUS status;
430 struct security_descriptor *parent_desc = NULL;
431 struct security_descriptor *psd = NULL;
432 DATA_BLOB blob;
433 size_t size;
434 char *parent_name;
435
436 if (!parent_dirname_talloc(ctx,
437 fname,
438 &parent_name,
439 NULL)) {
440 return NT_STATUS_NO_MEMORY;
441 }
442
443 DEBUG(10,("inherit_new_acl: check directory %s\n",
444 parent_name));
445
446 status = get_nt_acl_tdb_internal(handle,
447 NULL,
448 parent_name,
449 (OWNER_SECURITY_INFORMATION |
450 GROUP_SECURITY_INFORMATION |
451 DACL_SECURITY_INFORMATION),
452 &parent_desc);
453 if (NT_STATUS_IS_OK(status)) {
454 /* Create an inherited descriptor from the parent. */
455
456 if (DEBUGLEVEL >= 10) {
457 DEBUG(10,("inherit_new_acl: parent acl is:\n"));
458 NDR_PRINT_DEBUG(security_descriptor, parent_desc);
459 }
460
461 status = se_create_child_secdesc(ctx,
462 &psd,
463 &size,
464 parent_desc,
465 &handle->conn->server_info->ptok->user_sids[PRIMARY_USER_SID_INDEX],
466 &handle->conn->server_info->ptok->user_sids[PRIMARY_GROUP_SID_INDEX],
467 container);
468 if (!NT_STATUS_IS_OK(status)) {
469 return status;
470 }
471
472 if (DEBUGLEVEL >= 10) {
473 DEBUG(10,("inherit_new_acl: child acl is:\n"));
474 NDR_PRINT_DEBUG(security_descriptor, psd);
475 }
476
477 } else {
478 DEBUG(10,("inherit_new_acl: directory %s failed "
479 "to get acl %s\n",
480 parent_name,
481 nt_errstr(status) ));
482 }
483
484 if (!psd || psd->dacl == NULL) {
485 SMB_STRUCT_STAT sbuf;
486 int ret;
487
488 TALLOC_FREE(psd);
489 if (fsp && !fsp->is_directory && fsp->fh->fd != -1) {
490 ret = SMB_VFS_FSTAT(fsp, &sbuf);
491 } else {
492 ret = SMB_VFS_STAT(handle->conn,fname, &sbuf);
493 }
494 if (ret == -1) {
495 return map_nt_error_from_unix(errno);
496 }
497 psd = default_file_sd(ctx, &sbuf);
498 if (!psd) {
499 return NT_STATUS_NO_MEMORY;
500 }
501
502 if (DEBUGLEVEL >= 10) {
503 DEBUG(10,("inherit_new_acl: default acl is:\n"));
504 NDR_PRINT_DEBUG(security_descriptor, psd);
505 }
506 }
507
508 status = create_acl_blob(psd, &blob);
509 if (!NT_STATUS_IS_OK(status)) {
510 return status;
511 }
512 if (fsp) {
513 return store_acl_blob_fsp(handle, fsp, &blob);
514 } else {
515 return store_acl_blob_pathname(handle, fname, &blob);
516 }
517}
518
519/*********************************************************************
520 Check ACL on open. For new files inherit from parent directory.
521*********************************************************************/
522
523static int open_acl_tdb(vfs_handle_struct *handle,
524 const char *fname,
525 files_struct *fsp,
526 int flags,
527 mode_t mode)
528{
529 uint32_t access_granted = 0;
530 struct security_descriptor *pdesc = NULL;
531 bool file_existed = true;
532 NTSTATUS status = get_nt_acl_tdb_internal(handle,
533 NULL,
534 fname,
535 (OWNER_SECURITY_INFORMATION |
536 GROUP_SECURITY_INFORMATION |
537 DACL_SECURITY_INFORMATION),
538 &pdesc);
539 if (NT_STATUS_IS_OK(status)) {
540 /* See if we can access it. */
541 status = smb1_file_se_access_check(pdesc,
542 handle->conn->server_info->ptok,
543 fsp->access_mask,
544 &access_granted);
545 if (!NT_STATUS_IS_OK(status)) {
546 DEBUG(10,("open_acl_tdb: file %s open "
547 "refused with error %s\n",
548 fname,
549 nt_errstr(status) ));
550 errno = map_errno_from_nt_status(status);
551 return -1;
552 }
553 } else if (NT_STATUS_EQUAL(status,NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
554 file_existed = false;
555 }
556
557 DEBUG(10,("open_acl_tdb: get_nt_acl_attr_internal for "
558 "file %s returned %s\n",
559 fname,
560 nt_errstr(status) ));
561
562 fsp->fh->fd = SMB_VFS_NEXT_OPEN(handle, fname, fsp, flags, mode);
563
564 if (!file_existed && fsp->fh->fd != -1) {
565 /* File was created. Inherit from parent directory. */
566 string_set(&fsp->fsp_name, fname);
567 inherit_new_acl(handle, fname, fsp, false);
568 }
569
570 return fsp->fh->fd;
571}
572
573/*********************************************************************
574 On unlink we need to delete the tdb record (if using tdb).
575*********************************************************************/
576
577static int unlink_acl_tdb(vfs_handle_struct *handle, const char *path)
578{
579 SMB_STRUCT_STAT sbuf;
580 struct db_context *db;
581 int ret;
582
583 SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context, return -1);
584
585 if (SMB_VFS_STAT(handle->conn, path, &sbuf) == -1) {
586 return -1;
587 }
588
589 ret = SMB_VFS_NEXT_UNLINK(handle, path);
590
591 if (ret == -1) {
592 return -1;
593 }
594
595 acl_tdb_delete(handle, db, &sbuf);
596 return 0;
597}
598
599/*********************************************************************
600 Store an inherited SD on mkdir.
601*********************************************************************/
602
603static int mkdir_acl_tdb(vfs_handle_struct *handle, const char *path, mode_t mode)
604{
605 int ret = SMB_VFS_NEXT_MKDIR(handle, path, mode);
606
607 if (ret == -1) {
608 return ret;
609 }
610 /* New directory - inherit from parent. */
611 inherit_new_acl(handle, path, NULL, true);
612 return ret;
613}
614
615/*********************************************************************
616 On rmdir we need to delete the tdb record (if using tdb).
617*********************************************************************/
618
619static int rmdir_acl_tdb(vfs_handle_struct *handle, const char *path)
620{
621
622 SMB_STRUCT_STAT sbuf;
623 struct db_context *db;
624 int ret;
625
626 SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context, return -1);
627
628 if (SMB_VFS_STAT(handle->conn, path, &sbuf) == -1) {
629 return -1;
630 }
631
632 ret = SMB_VFS_NEXT_RMDIR(handle, path);
633 if (ret == -1) {
634 return -1;
635 }
636
637 acl_tdb_delete(handle, db, &sbuf);
638 return 0;
639}
640
641/*********************************************************************
642 Fetch a security descriptor given an fsp.
643*********************************************************************/
644
645static NTSTATUS fget_nt_acl_tdb(vfs_handle_struct *handle, files_struct *fsp,
646 uint32 security_info, struct security_descriptor **ppdesc)
647{
648 NTSTATUS status = get_nt_acl_tdb_internal(handle, fsp,
649 NULL, security_info, ppdesc);
650 if (NT_STATUS_IS_OK(status)) {
651 if (DEBUGLEVEL >= 10) {
652 DEBUG(10,("fget_nt_acl_tdb: returning tdb sd for file %s\n",
653 fsp->fsp_name));
654 NDR_PRINT_DEBUG(security_descriptor, *ppdesc);
655 }
656 return NT_STATUS_OK;
657 }
658
659 DEBUG(10,("fget_nt_acl_tdb: failed to get tdb sd for file %s, Error %s\n",
660 fsp->fsp_name,
661 nt_errstr(status) ));
662
663 return SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp,
664 security_info, ppdesc);
665}
666
667/*********************************************************************
668 Fetch a security descriptor given a pathname.
669*********************************************************************/
670
671static NTSTATUS get_nt_acl_tdb(vfs_handle_struct *handle,
672 const char *name, uint32 security_info, struct security_descriptor **ppdesc)
673{
674 NTSTATUS status = get_nt_acl_tdb_internal(handle, NULL,
675 name, security_info, ppdesc);
676 if (NT_STATUS_IS_OK(status)) {
677 if (DEBUGLEVEL >= 10) {
678 DEBUG(10,("get_nt_acl_tdb: returning tdb sd for file %s\n",
679 name));
680 NDR_PRINT_DEBUG(security_descriptor, *ppdesc);
681 }
682 return NT_STATUS_OK;
683 }
684
685 DEBUG(10,("get_nt_acl_tdb: failed to get tdb sd for file %s, Error %s\n",
686 name,
687 nt_errstr(status) ));
688
689 return SMB_VFS_NEXT_GET_NT_ACL(handle, name,
690 security_info, ppdesc);
691}
692
693/*********************************************************************
694 Store a security descriptor given an fsp.
695*********************************************************************/
696
697static NTSTATUS fset_nt_acl_tdb(vfs_handle_struct *handle, files_struct *fsp,
698 uint32 security_info_sent, const struct security_descriptor *psd)
699{
700 NTSTATUS status;
701 DATA_BLOB blob;
702
703 if (DEBUGLEVEL >= 10) {
704 DEBUG(10,("fset_nt_acl_tdb: incoming sd for file %s\n",
705 fsp->fsp_name));
706 NDR_PRINT_DEBUG(security_descriptor,
707 CONST_DISCARD(struct security_descriptor *,psd));
708 }
709
710 status = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
711 if (!NT_STATUS_IS_OK(status)) {
712 return status;
713 }
714
715 /* Ensure owner and group are set. */
716 if (!psd->owner_sid || !psd->group_sid) {
717 int ret;
718 SMB_STRUCT_STAT sbuf;
719 DOM_SID owner_sid, group_sid;
720 struct security_descriptor *nc_psd = dup_sec_desc(talloc_tos(), psd);
721
722 if (!nc_psd) {
723 return NT_STATUS_OK;
724 }
725 if (fsp->is_directory || fsp->fh->fd == -1) {
726 ret = SMB_VFS_STAT(fsp->conn,fsp->fsp_name, &sbuf);
727 } else {
728 ret = SMB_VFS_FSTAT(fsp, &sbuf);
729 }
730 if (ret == -1) {
731 /* Lower level acl set succeeded,
732 * so still return OK. */
733 return NT_STATUS_OK;
734 }
735 create_file_sids(&sbuf, &owner_sid, &group_sid);
736 /* This is safe as nc_psd is discarded at fn exit. */
737 nc_psd->owner_sid = &owner_sid;
738 nc_psd->group_sid = &group_sid;
739 security_info_sent |= (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION);
740 psd = nc_psd;
741 }
742
743#if 0
744 if ((security_info_sent & DACL_SECURITY_INFORMATION) &&
745 psd->dacl != NULL &&
746 (psd->type & (SE_DESC_DACL_AUTO_INHERITED|
747 SE_DESC_DACL_AUTO_INHERIT_REQ))==
748 (SE_DESC_DACL_AUTO_INHERITED|
749 SE_DESC_DACL_AUTO_INHERIT_REQ) ) {
750 struct security_descriptor *new_psd = NULL;
751 status = append_parent_acl(fsp, psd, &new_psd);
752 if (!NT_STATUS_IS_OK(status)) {
753 /* Lower level acl set succeeded,
754 * so still return OK. */
755 return NT_STATUS_OK;
756 }
757 psd = new_psd;
758 }
759#endif
760
761 if (DEBUGLEVEL >= 10) {
762 DEBUG(10,("fset_nt_acl_tdb: storing tdb sd for file %s\n",
763 fsp->fsp_name));
764 NDR_PRINT_DEBUG(security_descriptor,
765 CONST_DISCARD(struct security_descriptor *,psd));
766 }
767 create_acl_blob(psd, &blob);
768 store_acl_blob_fsp(handle, fsp, &blob);
769
770 return NT_STATUS_OK;
771}
772
773/*******************************************************************
774 Handle opening the storage tdb if so configured.
775*******************************************************************/
776
777static int connect_acl_tdb(struct vfs_handle_struct *handle,
778 const char *service,
779 const char *user)
780{
781 struct db_context *db;
782 int res;
783
784 res = SMB_VFS_NEXT_CONNECT(handle, service, user);
785 if (res < 0) {
786 return res;
787 }
788
789 if (!acl_tdb_init(&db)) {
790 SMB_VFS_NEXT_DISCONNECT(handle);
791 return -1;
792 }
793
794 SMB_VFS_HANDLE_SET_DATA(handle, db, free_acl_tdb_data,
795 struct db_context, return -1);
796
797 return 0;
798}
799
800/*********************************************************************
801 Remove a Windows ACL - we're setting the underlying POSIX ACL.
802*********************************************************************/
803
804static int sys_acl_set_file_tdb(vfs_handle_struct *handle,
805 const char *path,
806 SMB_ACL_TYPE_T type,
807 SMB_ACL_T theacl)
808{
809 SMB_STRUCT_STAT sbuf;
810 struct db_context *db;
811 int ret;
812
813 SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context, return -1);
814
815 if (SMB_VFS_STAT(handle->conn, path, &sbuf) == -1) {
816 return -1;
817 }
818
819 ret = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle,
820 path,
821 type,
822 theacl);
823 if (ret == -1) {
824 return -1;
825 }
826
827 acl_tdb_delete(handle, db, &sbuf);
828 return 0;
829}
830
831/*********************************************************************
832 Remove a Windows ACL - we're setting the underlying POSIX ACL.
833*********************************************************************/
834
835static int sys_acl_set_fd_tdb(vfs_handle_struct *handle,
836 files_struct *fsp,
837 SMB_ACL_T theacl)
838{
839 SMB_STRUCT_STAT sbuf;
840 struct db_context *db;
841 int ret;
842
843 SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context, return -1);
844
845 if (fsp->is_directory || fsp->fh->fd == -1) {
846 ret = SMB_VFS_STAT(fsp->conn,fsp->fsp_name, &sbuf);
847 } else {
848 ret = SMB_VFS_FSTAT(fsp, &sbuf);
849 }
850 if (ret == -1) {
851 return -1;
852 }
853
854 ret = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle,
855 fsp,
856 theacl);
857 if (ret == -1) {
858 return -1;
859 }
860
861 acl_tdb_delete(handle, db, &sbuf);
862 return 0;
863}
864
865/* VFS operations structure */
866
867static vfs_op_tuple skel_op_tuples[] =
868{
869 {SMB_VFS_OP(connect_acl_tdb), SMB_VFS_OP_CONNECT, SMB_VFS_LAYER_TRANSPARENT},
870
871 {SMB_VFS_OP(mkdir_acl_tdb), SMB_VFS_OP_MKDIR, SMB_VFS_LAYER_TRANSPARENT},
872 {SMB_VFS_OP(rmdir_acl_tdb), SMB_VFS_OP_RMDIR, SMB_VFS_LAYER_TRANSPARENT},
873
874 {SMB_VFS_OP(open_acl_tdb), SMB_VFS_OP_OPEN, SMB_VFS_LAYER_TRANSPARENT},
875 {SMB_VFS_OP(unlink_acl_tdb), SMB_VFS_OP_UNLINK, SMB_VFS_LAYER_TRANSPARENT},
876
877 /* NT File ACL operations */
878
879 {SMB_VFS_OP(fget_nt_acl_tdb),SMB_VFS_OP_FGET_NT_ACL,SMB_VFS_LAYER_TRANSPARENT},
880 {SMB_VFS_OP(get_nt_acl_tdb), SMB_VFS_OP_GET_NT_ACL, SMB_VFS_LAYER_TRANSPARENT},
881 {SMB_VFS_OP(fset_nt_acl_tdb),SMB_VFS_OP_FSET_NT_ACL,SMB_VFS_LAYER_TRANSPARENT},
882
883 /* POSIX ACL operations. */
884 {SMB_VFS_OP(sys_acl_set_file_tdb), SMB_VFS_OP_SYS_ACL_SET_FILE, SMB_VFS_LAYER_TRANSPARENT},
885 {SMB_VFS_OP(sys_acl_set_fd_tdb), SMB_VFS_OP_SYS_ACL_SET_FD, SMB_VFS_LAYER_TRANSPARENT},
886
887 {SMB_VFS_OP(NULL), SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP}
888};
889
890NTSTATUS vfs_acl_tdb_init(void)
891{
892 return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "acl_tdb", skel_op_tuples);
893}
Note: See TracBrowser for help on using the repository browser.