source: branches/samba-3.3.x/source/modules/vfs_hpuxacl.c@ 206

Last change on this file since 206 was 206, checked in by Herwig Bauernfeind, 17 years ago

Import Samba 3.3 branch at 3.0.0 level (psmedley's port)
File size: 31.1 KB
Line 
1/*
2 * Unix SMB/Netbios implementation.
3 * VFS module to get and set HP-UX ACLs
4 * Copyright (C) Michael Adam 2006,2008
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20/*
21 * This module supports JFS (POSIX) ACLs on VxFS (Veritas * Filesystem).
22 * These are available on HP-UX 11.00 if JFS 3.3 is installed.
23 * On HP-UX 11i (11.11 and above) these ACLs are supported out of
24 * the box.
25 *
26 * There is another form of ACLs on HFS. These ACLs have a
27 * completely different API and their own set of userland tools.
28 * Since HFS seems to be considered deprecated, HFS acls
29 * are not supported. (They could be supported through a separate
30 * vfs-module if there is demand.)
31 */
32
33/* =================================================================
34 * NOTE:
35 *
36 * The original hpux-acl code in lib/sysacls.c was based upon the
37 * solaris acl code in the same file. Now for the new modularized
38 * acl implementation, I have taken the code from vfs_solarisacls.c
39 * and did similar adaptations as were done before, essentially
40 * reusing the original internal aclsort functions.
41 * The check for the presence of the acl() call has been adopted, and
42 * a check for the presence of the aclsort() call has been added.
43 *
44 * Michael Adam <[email protected]>
45 *
46 * ================================================================= */
47
48
49#include "includes.h"
50
51/*
52 * including standard header <sys/aclv.h>
53 *
54 * included here as a quick hack for the special HP-UX-situation:
55 *
56 * The problem is that, on HP-UX, jfs/posix acls are
57 * defined in <sys/aclv.h>, while the deprecated hfs acls
58 * are defined inside <sys/acl.h>.
59 *
60 */
61/* GROUP is defined somewhere else so undef it here... */
62#undef GROUP
63#include <sys/aclv.h>
64/* dl.h: needed to check for acl call via shl_findsym */
65#include <dl.h>
66
67typedef struct acl HPUX_ACE_T;
68typedef struct acl *HPUX_ACL_T;
69typedef int HPUX_ACL_TAG_T; /* the type of an ACL entry */
70typedef ushort HPUX_PERM_T;
71
72/* Structure to capture the count for each type of ACE.
73 * (for hpux_internal_aclsort */
74struct hpux_acl_types {
75 int n_user;
76 int n_def_user;
77 int n_user_obj;
78 int n_def_user_obj;
79
80 int n_group;
81 int n_def_group;
82 int n_group_obj;
83 int n_def_group_obj;
84
85 int n_other;
86 int n_other_obj;
87 int n_def_other_obj;
88
89 int n_class_obj;
90 int n_def_class_obj;
91
92 int n_illegal_obj;
93};
94
95/* for convenience: check if hpux acl entry is a default entry? */
96#define _IS_DEFAULT(ace) ((ace).a_type & ACL_DEFAULT)
97#define _IS_OF_TYPE(ace, type) ( \
98 (((type) == SMB_ACL_TYPE_ACCESS) && !_IS_DEFAULT(ace)) \
99 || \
100 (((type) == SMB_ACL_TYPE_DEFAULT) && _IS_DEFAULT(ace)) \
101)
102
103
104/* prototypes for private functions */
105
106static HPUX_ACL_T hpux_acl_init(int count);
107static bool smb_acl_to_hpux_acl(SMB_ACL_T smb_acl,
108 HPUX_ACL_T *solariacl, int *count,
109 SMB_ACL_TYPE_T type);
110static SMB_ACL_T hpux_acl_to_smb_acl(HPUX_ACL_T hpuxacl, int count,
111 SMB_ACL_TYPE_T type);
112static HPUX_ACL_TAG_T smb_tag_to_hpux_tag(SMB_ACL_TAG_T smb_tag);
113static SMB_ACL_TAG_T hpux_tag_to_smb_tag(HPUX_ACL_TAG_T hpux_tag);
114static bool hpux_add_to_acl(HPUX_ACL_T *hpux_acl, int *count,
115 HPUX_ACL_T add_acl, int add_count, SMB_ACL_TYPE_T type);
116static bool hpux_acl_get_file(const char *name, HPUX_ACL_T *hpuxacl,
117 int *count);
118static SMB_ACL_PERM_T hpux_perm_to_smb_perm(const HPUX_PERM_T perm);
119static HPUX_PERM_T smb_perm_to_hpux_perm(const SMB_ACL_PERM_T perm);
120#if 0
121static bool hpux_acl_check(HPUX_ACL_T hpux_acl, int count);
122#endif
123/* aclsort (internal) and helpers: */
124static bool hpux_acl_sort(HPUX_ACL_T acl, int count);
125static int hpux_internal_aclsort(int acl_count, int calclass, HPUX_ACL_T aclp);
126static void hpux_count_obj(int acl_count, HPUX_ACL_T aclp,
127 struct hpux_acl_types *acl_type_count);
128static void hpux_swap_acl_entries(HPUX_ACE_T *aclp0, HPUX_ACE_T *aclp1);
129static bool hpux_prohibited_duplicate_type(int acl_type);
130
131static bool hpux_acl_call_present(void);
132static bool hpux_aclsort_call_present(void);
133
134
135/* public functions - the api */
136
137SMB_ACL_T hpuxacl_sys_acl_get_file(vfs_handle_struct *handle,
138 const char *path_p,
139 SMB_ACL_TYPE_T type)
140{
141 SMB_ACL_T result = NULL;
142 int count;
143 HPUX_ACL_T hpux_acl = NULL;
144
145 DEBUG(10, ("hpuxacl_sys_acl_get_file called for file '%s'.\n",
146 path_p));
147
148 if(hpux_acl_call_present() == False) {
149 /* Looks like we don't have the acl() system call on HPUX.
150 * May be the system doesn't have the latest version of JFS.
151 */
152 goto done;
153 }
154
155 if (type != SMB_ACL_TYPE_ACCESS && type != SMB_ACL_TYPE_DEFAULT) {
156 DEBUG(10, ("invalid SMB_ACL_TYPE given (%d)\n", type));
157 errno = EINVAL;
158 goto done;
159 }
160
161 DEBUGADD(10, ("getting %s acl\n",
162 ((type == SMB_ACL_TYPE_ACCESS) ? "access" : "default")));
163
164 if (!hpux_acl_get_file(path_p, &hpux_acl, &count)) {
165 goto done;
166 }
167 result = hpux_acl_to_smb_acl(hpux_acl, count, type);
168 if (result == NULL) {
169 DEBUG(10, ("conversion hpux_acl -> smb_acl failed (%s).\n",
170 strerror(errno)));
171 }
172
173 done:
174 DEBUG(10, ("hpuxacl_sys_acl_get_file %s.\n",
175 ((result == NULL) ? "failed" : "succeeded" )));
176 SAFE_FREE(hpux_acl);
177 return result;
178}
179
180
181/*
182 * get the access ACL of a file referred to by a fd
183 */
184SMB_ACL_T hpuxacl_sys_acl_get_fd(vfs_handle_struct *handle,
185 files_struct *fsp)
186{
187 /*
188 * HPUX doesn't have the facl call. Fake it using the path.... JRA.
189 */
190 /* For all I see, the info should already be in the fsp
191 * parameter, but get it again to be safe --- necessary? */
192 files_struct *file_struct_p = file_find_fd(fsp->fh->fd);
193 if (file_struct_p == NULL) {
194 errno = EBADF;
195 return NULL;
196 }
197 /*
198 * We know we're in the same conn context. So we
199 * can use the relative path.
200 */
201 DEBUG(10, ("redirecting call of hpuxacl_sys_acl_get_fd to "
202 "hpuxacl_sys_acl_get_file (no facl syscall on HPUX).\n"));
203
204 return hpuxacl_sys_acl_get_file(handle, file_struct_p->fsp_name,
205 SMB_ACL_TYPE_ACCESS);
206}
207
208
209int hpuxacl_sys_acl_set_file(vfs_handle_struct *handle,
210 const char *name,
211 SMB_ACL_TYPE_T type,
212 SMB_ACL_T theacl)
213{
214 int ret = -1;
215 SMB_STRUCT_STAT s;
216 HPUX_ACL_T hpux_acl = NULL;
217 int count;
218
219 DEBUG(10, ("hpuxacl_sys_acl_set_file called for file '%s'\n",
220 name));
221
222
223 if(hpux_acl_call_present() == False) {
224 /* Looks like we don't have the acl() system call on HPUX.
225 * May be the system doesn't have the latest version of JFS.
226 */
227 goto done;
228 }
229
230 if ((type != SMB_ACL_TYPE_ACCESS) && (type != SMB_ACL_TYPE_DEFAULT)) {
231 errno = EINVAL;
232 DEBUG(10, ("invalid smb acl type given (%d).\n", type));
233 goto done;
234 }
235 DEBUGADD(10, ("setting %s acl\n",
236 ((type == SMB_ACL_TYPE_ACCESS) ? "access" : "default")));
237
238 if(!smb_acl_to_hpux_acl(theacl, &hpux_acl, &count, type)) {
239 DEBUG(10, ("conversion smb_acl -> hpux_acl failed (%s).\n",
240 strerror(errno)));
241 goto done;
242 }
243
244 /*
245 * if the file is a directory, there is extra work to do:
246 * since the hpux acl call stores both the access acl and
247 * the default acl as provided, we have to get the acl part
248 * that has _not_ been specified in "type" from the file first
249 * and concatenate it with the acl provided.
250 */
251 if (SMB_VFS_STAT(handle->conn, name, &s) != 0) {
252 DEBUG(10, ("Error in stat call: %s\n", strerror(errno)));
253 goto done;
254 }
255 if (S_ISDIR(s.st_mode)) {
256 HPUX_ACL_T other_acl;
257 int other_count;
258 SMB_ACL_TYPE_T other_type;
259
260 other_type = (type == SMB_ACL_TYPE_ACCESS)
261 ? SMB_ACL_TYPE_DEFAULT
262 : SMB_ACL_TYPE_ACCESS;
263 DEBUGADD(10, ("getting acl from filesystem\n"));
264 if (!hpux_acl_get_file(name, &other_acl, &other_count)) {
265 DEBUG(10, ("error getting acl from directory\n"));
266 goto done;
267 }
268 DEBUG(10, ("adding %s part of fs acl to given acl\n",
269 ((other_type == SMB_ACL_TYPE_ACCESS)
270 ? "access"
271 : "default")));
272 if (!hpux_add_to_acl(&hpux_acl, &count, other_acl,
273 other_count, other_type))
274 {
275 DEBUG(10, ("error adding other acl.\n"));
276 SAFE_FREE(other_acl);
277 goto done;
278 }
279 SAFE_FREE(other_acl);
280 }
281 else if (type != SMB_ACL_TYPE_ACCESS) {
282 errno = EINVAL;
283 goto done;
284 }
285
286 if (!hpux_acl_sort(hpux_acl, count)) {
287 DEBUG(10, ("resulting acl is not valid!\n"));
288 goto done;
289 }
290 DEBUG(10, ("resulting acl is valid.\n"));
291
292 ret = acl(CONST_DISCARD(char *, name), ACL_SET, count, hpux_acl);
293 if (ret != 0) {
294 DEBUG(0, ("ERROR calling acl: %s\n", strerror(errno)));
295 }
296
297 done:
298 DEBUG(10, ("hpuxacl_sys_acl_set_file %s.\n",
299 ((ret != 0) ? "failed" : "succeeded")));
300 SAFE_FREE(hpux_acl);
301 return ret;
302}
303
304/*
305 * set the access ACL on the file referred to by a fd
306 */
307int hpuxacl_sys_acl_set_fd(vfs_handle_struct *handle,
308 files_struct *fsp,
309 SMB_ACL_T theacl)
310{
311 /*
312 * HPUX doesn't have the facl call. Fake it using the path.... JRA.
313 */
314 /* For all I see, the info should already be in the fsp
315 * parameter, but get it again to be safe --- necessary? */
316 files_struct *file_struct_p = file_find_fd(fsp->fh->fd);
317 if (file_struct_p == NULL) {
318 errno = EBADF;
319 return -1;
320 }
321 /*
322 * We know we're in the same conn context. So we
323 * can use the relative path.
324 */
325 DEBUG(10, ("redirecting call of hpuxacl_sys_acl_set_fd to "
326 "hpuxacl_sys_acl_set_file (no facl syscall on HPUX)\n"));
327
328 return hpuxacl_sys_acl_set_file(handle, file_struct_p->fsp_name,
329 SMB_ACL_TYPE_ACCESS, theacl);
330}
331
332
333/*
334 * delete the default ACL of a directory
335 *
336 * This is achieved by fetching the access ACL and rewriting it
337 * directly, via the hpux system call: the ACL_SET call on
338 * directories writes both the access and the default ACL as provided.
339 *
340 * XXX: posix acl_delete_def_file returns an error if
341 * the file referred to by path is not a directory.
342 * this function does not complain but the actions
343 * have no effect on a file other than a directory.
344 * But sys_acl_delete_default_file is only called in
345 * smbd/posixacls.c after having checked that the file
346 * is a directory, anyways. So implementing the extra
347 * check is considered unnecessary. --- Agreed? XXX
348 */
349int hpuxacl_sys_acl_delete_def_file(vfs_handle_struct *handle,
350 const char *path)
351{
352 SMB_ACL_T smb_acl;
353 int ret = -1;
354 HPUX_ACL_T hpux_acl;
355 int count;
356
357 DEBUG(10, ("entering hpuxacl_sys_acl_delete_def_file.\n"));
358
359 smb_acl = hpuxacl_sys_acl_get_file(handle, path,
360 SMB_ACL_TYPE_ACCESS);
361 if (smb_acl == NULL) {
362 DEBUG(10, ("getting file acl failed!\n"));
363 goto done;
364 }
365 if (!smb_acl_to_hpux_acl(smb_acl, &hpux_acl, &count,
366 SMB_ACL_TYPE_ACCESS))
367 {
368 DEBUG(10, ("conversion smb_acl -> hpux_acl failed.\n"));
369 goto done;
370 }
371 if (!hpux_acl_sort(hpux_acl, count)) {
372 DEBUG(10, ("resulting acl is not valid!\n"));
373 goto done;
374 }
375 ret = acl(CONST_DISCARD(char *, path), ACL_SET, count, hpux_acl);
376 if (ret != 0) {
377 DEBUG(10, ("settinge file acl failed!\n"));
378 }
379
380 done:
381 DEBUG(10, ("hpuxacl_sys_acl_delete_def_file %s.\n",
382 ((ret != 0) ? "failed" : "succeeded" )));
383 SAFE_FREE(smb_acl);
384 return ret;
385}
386
387
388/*
389 * private functions
390 */
391
392static HPUX_ACL_T hpux_acl_init(int count)
393{
394 HPUX_ACL_T hpux_acl =
395 (HPUX_ACL_T)SMB_MALLOC(sizeof(HPUX_ACE_T) * count);
396 if (hpux_acl == NULL) {
397 errno = ENOMEM;
398 }
399 return hpux_acl;
400}
401
402/*
403 * Convert the SMB acl to the ACCESS or DEFAULT part of a
404 * hpux ACL, as desired.
405 */
406static bool smb_acl_to_hpux_acl(SMB_ACL_T smb_acl,
407 HPUX_ACL_T *hpux_acl, int *count,
408 SMB_ACL_TYPE_T type)
409{
410 bool ret = False;
411 int i;
412 int check_which, check_rc;
413
414 DEBUG(10, ("entering smb_acl_to_hpux_acl\n"));
415
416 *hpux_acl = NULL;
417 *count = 0;
418
419 for (i = 0; i < smb_acl->count; i++) {
420 const struct smb_acl_entry *smb_entry = &(smb_acl->acl[i]);
421 HPUX_ACE_T hpux_entry;
422
423 ZERO_STRUCT(hpux_entry);
424
425 hpux_entry.a_type = smb_tag_to_hpux_tag(smb_entry->a_type);
426 if (hpux_entry.a_type == 0) {
427 DEBUG(10, ("smb_tag to hpux_tag failed\n"));
428 goto fail;
429 }
430 switch(hpux_entry.a_type) {
431 case USER:
432 DEBUG(10, ("got tag type USER with uid %d\n",
433 smb_entry->uid));
434 hpux_entry.a_id = (uid_t)smb_entry->uid;
435 break;
436 case GROUP:
437 DEBUG(10, ("got tag type GROUP with gid %d\n",
438 smb_entry->gid));
439 hpux_entry.a_id = (uid_t)smb_entry->gid;
440 break;
441 default:
442 break;
443 }
444 if (type == SMB_ACL_TYPE_DEFAULT) {
445 DEBUG(10, ("adding default bit to hpux ace\n"));
446 hpux_entry.a_type |= ACL_DEFAULT;
447 }
448
449 hpux_entry.a_perm =
450 smb_perm_to_hpux_perm(smb_entry->a_perm);
451 DEBUG(10, ("assembled the following hpux ace:\n"));
452 DEBUGADD(10, (" - type: 0x%04x\n", hpux_entry.a_type));
453 DEBUGADD(10, (" - id: %d\n", hpux_entry.a_id));
454 DEBUGADD(10, (" - perm: o%o\n", hpux_entry.a_perm));
455 if (!hpux_add_to_acl(hpux_acl, count, &hpux_entry,
456 1, type))
457 {
458 DEBUG(10, ("error adding acl entry\n"));
459 goto fail;
460 }
461 DEBUG(10, ("count after adding: %d (i: %d)\n", *count, i));
462 DEBUG(10, ("test, if entry has been copied into acl:\n"));
463 DEBUGADD(10, (" - type: 0x%04x\n",
464 (*hpux_acl)[(*count)-1].a_type));
465 DEBUGADD(10, (" - id: %d\n",
466 (*hpux_acl)[(*count)-1].a_id));
467 DEBUGADD(10, (" - perm: o%o\n",
468 (*hpux_acl)[(*count)-1].a_perm));
469 }
470
471 ret = True;
472 goto done;
473
474 fail:
475 SAFE_FREE(*hpux_acl);
476 done:
477 DEBUG(10, ("smb_acl_to_hpux_acl %s\n",
478 ((ret == True) ? "succeeded" : "failed")));
479 return ret;
480}
481
482/*
483 * convert either the access or the default part of a
484 * soaris acl to the SMB_ACL format.
485 */
486static SMB_ACL_T hpux_acl_to_smb_acl(HPUX_ACL_T hpux_acl, int count,
487 SMB_ACL_TYPE_T type)
488{
489 SMB_ACL_T result;
490 int i;
491
492 if ((result = sys_acl_init(0)) == NULL) {
493 DEBUG(10, ("error allocating memory for SMB_ACL\n"));
494 goto fail;
495 }
496 for (i = 0; i < count; i++) {
497 SMB_ACL_ENTRY_T smb_entry;
498 SMB_ACL_PERM_T smb_perm;
499
500 if (!_IS_OF_TYPE(hpux_acl[i], type)) {
501 continue;
502 }
503 result = SMB_REALLOC(result,
504 sizeof(struct smb_acl_t) +
505 (sizeof(struct smb_acl_entry) *
506 (result->count + 1)));
507 if (result == NULL) {
508 DEBUG(10, ("error reallocating memory for SMB_ACL\n"));
509 goto fail;
510 }
511 smb_entry = &result->acl[result->count];
512 if (sys_acl_set_tag_type(smb_entry,
513 hpux_tag_to_smb_tag(hpux_acl[i].a_type)) != 0)
514 {
515 DEBUG(10, ("invalid tag type given: 0x%04x\n",
516 hpux_acl[i].a_type));
517 goto fail;
518 }
519 /* intentionally not checking return code here: */
520 sys_acl_set_qualifier(smb_entry, (void *)&hpux_acl[i].a_id);
521 smb_perm = hpux_perm_to_smb_perm(hpux_acl[i].a_perm);
522 if (sys_acl_set_permset(smb_entry, &smb_perm) != 0) {
523 DEBUG(10, ("invalid permset given: %d\n",
524 hpux_acl[i].a_perm));
525 goto fail;
526 }
527 result->count += 1;
528 }
529 goto done;
530
531 fail:
532 SAFE_FREE(result);
533 done:
534 DEBUG(10, ("hpux_acl_to_smb_acl %s\n",
535 ((result == NULL) ? "failed" : "succeeded")));
536 return result;
537}
538
539
540
541static HPUX_ACL_TAG_T smb_tag_to_hpux_tag(SMB_ACL_TAG_T smb_tag)
542{
543 HPUX_ACL_TAG_T hpux_tag = 0;
544
545 DEBUG(10, ("smb_tag_to_hpux_tag\n"));
546 DEBUGADD(10, (" --> got smb tag 0x%04x\n", smb_tag));
547
548 switch (smb_tag) {
549 case SMB_ACL_USER:
550 hpux_tag = USER;
551 break;
552 case SMB_ACL_USER_OBJ:
553 hpux_tag = USER_OBJ;
554 break;
555 case SMB_ACL_GROUP:
556 hpux_tag = GROUP;
557 break;
558 case SMB_ACL_GROUP_OBJ:
559 hpux_tag = GROUP_OBJ;
560 break;
561 case SMB_ACL_OTHER:
562 hpux_tag = OTHER_OBJ;
563 break;
564 case SMB_ACL_MASK:
565 hpux_tag = CLASS_OBJ;
566 break;
567 default:
568 DEBUGADD(10, (" !!! unknown smb tag type 0x%04x\n", smb_tag));
569 break;
570 }
571
572 DEBUGADD(10, (" --> determined hpux tag 0x%04x\n", hpux_tag));
573
574 return hpux_tag;
575}
576
577static SMB_ACL_TAG_T hpux_tag_to_smb_tag(HPUX_ACL_TAG_T hpux_tag)
578{
579 SMB_ACL_TAG_T smb_tag = 0;
580
581 DEBUG(10, ("hpux_tag_to_smb_tag:\n"));
582 DEBUGADD(10, (" --> got hpux tag 0x%04x\n", hpux_tag));
583
584 hpux_tag &= ~ACL_DEFAULT;
585
586 switch (hpux_tag) {
587 case USER:
588 smb_tag = SMB_ACL_USER;
589 break;
590 case USER_OBJ:
591 smb_tag = SMB_ACL_USER_OBJ;
592 break;
593 case GROUP:
594 smb_tag = SMB_ACL_GROUP;
595 break;
596 case GROUP_OBJ:
597 smb_tag = SMB_ACL_GROUP_OBJ;
598 break;
599 case OTHER_OBJ:
600 smb_tag = SMB_ACL_OTHER;
601 break;
602 case CLASS_OBJ:
603 smb_tag = SMB_ACL_MASK;
604 break;
605 default:
606 DEBUGADD(10, (" !!! unknown hpux tag type: 0x%04x\n",
607 hpux_tag));
608 break;
609 }
610
611 DEBUGADD(10, (" --> determined smb tag 0x%04x\n", smb_tag));
612
613 return smb_tag;
614}
615
616
617/*
618 * The permission bits used in the following two permission conversion
619 * functions are same, but the functions make us independent of the concrete
620 * permission data types.
621 */
622static SMB_ACL_PERM_T hpux_perm_to_smb_perm(const HPUX_PERM_T perm)
623{
624 SMB_ACL_PERM_T smb_perm = 0;
625 smb_perm |= ((perm & SMB_ACL_READ) ? SMB_ACL_READ : 0);
626 smb_perm |= ((perm & SMB_ACL_WRITE) ? SMB_ACL_WRITE : 0);
627 smb_perm |= ((perm & SMB_ACL_EXECUTE) ? SMB_ACL_EXECUTE : 0);
628 return smb_perm;
629}
630
631
632static HPUX_PERM_T smb_perm_to_hpux_perm(const SMB_ACL_PERM_T perm)
633{
634 HPUX_PERM_T hpux_perm = 0;
635 hpux_perm |= ((perm & SMB_ACL_READ) ? SMB_ACL_READ : 0);
636 hpux_perm |= ((perm & SMB_ACL_WRITE) ? SMB_ACL_WRITE : 0);
637 hpux_perm |= ((perm & SMB_ACL_EXECUTE) ? SMB_ACL_EXECUTE : 0);
638 return hpux_perm;
639}
640
641
642static bool hpux_acl_get_file(const char *name, HPUX_ACL_T *hpux_acl,
643 int *count)
644{
645 bool result = False;
646 static HPUX_ACE_T dummy_ace;
647
648 DEBUG(10, ("hpux_acl_get_file called for file '%s'\n", name));
649
650 /*
651 * The original code tries some INITIAL_ACL_SIZE
652 * and only did the ACL_CNT call upon failure
653 * (for performance reasons).
654 * For the sake of simplicity, I skip this for now.
655 *
656 * NOTE: There is a catch here on HP-UX: acl with cmd parameter
657 * ACL_CNT fails with errno EINVAL when called with a NULL
658 * pointer as last argument. So we need to use a dummy acl
659 * struct here (we make it static so it does not need to be
660 * instantiated or malloced each time this function is
661 * called). Btw: the count parameter does not seem to matter...
662 */
663 *count = acl(CONST_DISCARD(char *, name), ACL_CNT, 0, &dummy_ace);
664 if (*count < 0) {
665 DEBUG(10, ("acl ACL_CNT failed: %s\n", strerror(errno)));
666 goto done;
667 }
668 *hpux_acl = hpux_acl_init(*count);
669 if (*hpux_acl == NULL) {
670 DEBUG(10, ("error allocating memory for hpux acl...\n"));
671 goto done;
672 }
673 *count = acl(CONST_DISCARD(char *, name), ACL_GET, *count, *hpux_acl);
674 if (*count < 0) {
675 DEBUG(10, ("acl ACL_GET failed: %s\n", strerror(errno)));
676 goto done;
677 }
678 result = True;
679
680 done:
681 DEBUG(10, ("hpux_acl_get_file %s.\n",
682 ((result == True) ? "succeeded" : "failed" )));
683 return result;
684}
685
686
687
688
689/*
690 * Add entries to a hpux ACL.
691 *
692 * Entries are directly added to the hpuxacl parameter.
693 * if memory allocation fails, this may result in hpuxacl
694 * being NULL. if the resulting acl is to be checked and is
695 * not valid, it is kept in hpuxacl but False is returned.
696 *
697 * The type of ACEs (access/default) to be added to the ACL can
698 * be selected via the type parameter.
699 * I use the SMB_ACL_TYPE_T type here. Since SMB_ACL_TYPE_ACCESS
700 * is defined as "0", this means that one can only add either
701 * access or default ACEs from the given ACL, not both at the same
702 * time. If it should become necessary to add all of an ACL, one
703 * would have to replace this parameter by another type.
704 */
705static bool hpux_add_to_acl(HPUX_ACL_T *hpux_acl, int *count,
706 HPUX_ACL_T add_acl, int add_count,
707 SMB_ACL_TYPE_T type)
708{
709 int i;
710
711 if ((type != SMB_ACL_TYPE_ACCESS) && (type != SMB_ACL_TYPE_DEFAULT))
712 {
713 DEBUG(10, ("invalid acl type given: %d\n", type));
714 errno = EINVAL;
715 return False;
716 }
717 for (i = 0; i < add_count; i++) {
718 if (!_IS_OF_TYPE(add_acl[i], type)) {
719 continue;
720 }
721 ADD_TO_ARRAY(NULL, HPUX_ACE_T, add_acl[i],
722 hpux_acl, count);
723 if (hpux_acl == NULL) {
724 DEBUG(10, ("error enlarging acl.\n"));
725 errno = ENOMEM;
726 return False;
727 }
728 }
729 return True;
730}
731
732
733/*
734 * sort the ACL and check it for validity
735 *
736 * [original comment from lib/sysacls.c:]
737 *
738 * if it's a minimal ACL with only 4 entries then we
739 * need to recalculate the mask permissions to make
740 * sure that they are the same as the GROUP_OBJ
741 * permissions as required by the UnixWare acl() system call.
742 *
743 * (note: since POSIX allows minimal ACLs which only contain
744 * 3 entries - ie there is no mask entry - we should, in theory,
745 * check for this and add a mask entry if necessary - however
746 * we "know" that the caller of this interface always specifies
747 * a mask, so in practice "this never happens" (tm) - if it *does*
748 * happen aclsort() will fail and return an error and someone will
749 * have to fix it...)
750 */
751static bool hpux_acl_sort(HPUX_ACL_T hpux_acl, int count)
752{
753 int fixmask = (count <= 4);
754
755 if (hpux_internal_aclsort(count, fixmask, hpux_acl) != 0) {
756 errno = EINVAL;
757 return False;
758 }
759 return True;
760}
761
762
763/*
764 * Helpers for hpux_internal_aclsort:
765 * - hpux_count_obj
766 * - hpux_swap_acl_entries
767 * - hpux_prohibited_duplicate_type
768 * - hpux_get_needed_class_perm
769 */
770
771/* hpux_count_obj:
772 * Counts the different number of objects in a given array of ACL
773 * structures.
774 * Inputs:
775 *
776 * acl_count - Count of ACLs in the array of ACL strucutres.
777 * aclp - Array of ACL structures.
778 * acl_type_count - Pointer to acl_types structure. Should already be
779 * allocated.
780 * Output:
781 *
782 * acl_type_count - This structure is filled up with counts of various
783 * acl types.
784 */
785
786static void hpux_count_obj(int acl_count, HPUX_ACL_T aclp, struct hpux_acl_types *acl_type_count)
787{
788 int i;
789
790 memset(acl_type_count, 0, sizeof(struct hpux_acl_types));
791
792 for(i=0;i<acl_count;i++) {
793 switch(aclp[i].a_type) {
794 case USER:
795 acl_type_count->n_user++;
796 break;
797 case USER_OBJ:
798 acl_type_count->n_user_obj++;
799 break;
800 case DEF_USER_OBJ:
801 acl_type_count->n_def_user_obj++;
802 break;
803 case GROUP:
804 acl_type_count->n_group++;
805 break;
806 case GROUP_OBJ:
807 acl_type_count->n_group_obj++;
808 break;
809 case DEF_GROUP_OBJ:
810 acl_type_count->n_def_group_obj++;
811 break;
812 case OTHER_OBJ:
813 acl_type_count->n_other_obj++;
814 break;
815 case DEF_OTHER_OBJ:
816 acl_type_count->n_def_other_obj++;
817 break;
818 case CLASS_OBJ:
819 acl_type_count->n_class_obj++;
820 break;
821 case DEF_CLASS_OBJ:
822 acl_type_count->n_def_class_obj++;
823 break;
824 case DEF_USER:
825 acl_type_count->n_def_user++;
826 break;
827 case DEF_GROUP:
828 acl_type_count->n_def_group++;
829 break;
830 default:
831 acl_type_count->n_illegal_obj++;
832 break;
833 }
834 }
835}
836
837/* hpux_swap_acl_entries: Swaps two ACL entries.
838 *
839 * Inputs: aclp0, aclp1 - ACL entries to be swapped.
840 */
841
842static void hpux_swap_acl_entries(HPUX_ACE_T *aclp0, HPUX_ACE_T *aclp1)
843{
844 HPUX_ACE_T temp_acl;
845
846 temp_acl.a_type = aclp0->a_type;
847 temp_acl.a_id = aclp0->a_id;
848 temp_acl.a_perm = aclp0->a_perm;
849
850 aclp0->a_type = aclp1->a_type;
851 aclp0->a_id = aclp1->a_id;
852 aclp0->a_perm = aclp1->a_perm;
853
854 aclp1->a_type = temp_acl.a_type;
855 aclp1->a_id = temp_acl.a_id;
856 aclp1->a_perm = temp_acl.a_perm;
857}
858
859/* hpux_prohibited_duplicate_type
860 * Identifies if given ACL type can have duplicate entries or
861 * not.
862 *
863 * Inputs: acl_type - ACL Type.
864 *
865 * Outputs:
866 *
867 * Return..
868 *
869 * True - If the ACL type matches any of the prohibited types.
870 * False - If the ACL type doesn't match any of the prohibited types.
871 */
872
873static bool hpux_prohibited_duplicate_type(int acl_type)
874{
875 switch(acl_type) {
876 case USER:
877 case GROUP:
878 case DEF_USER:
879 case DEF_GROUP:
880 return True;
881 default:
882 return False;
883 }
884}
885
886/* hpux_get_needed_class_perm
887 * Returns the permissions of a ACL structure only if the ACL
888 * type matches one of the pre-determined types for computing
889 * CLASS_OBJ permissions.
890 *
891 * Inputs: aclp - Pointer to ACL structure.
892 */
893
894static int hpux_get_needed_class_perm(struct acl *aclp)
895{
896 switch(aclp->a_type) {
897 case USER:
898 case GROUP_OBJ:
899 case GROUP:
900 case DEF_USER_OBJ:
901 case DEF_USER:
902 case DEF_GROUP_OBJ:
903 case DEF_GROUP:
904 case DEF_CLASS_OBJ:
905 case DEF_OTHER_OBJ:
906 return aclp->a_perm;
907 default:
908 return 0;
909 }
910}
911
912/* hpux_internal_aclsort: aclsort for HPUX.
913 *
914 * -> The aclsort() system call is availabe on the latest HPUX General
915 * -> Patch Bundles. So for HPUX, we developed our version of aclsort
916 * -> function. Because, we don't want to update to a new
917 * -> HPUX GR bundle just for aclsort() call.
918 *
919 * aclsort sorts the array of ACL structures as per the description in
920 * aclsort man page. Refer to aclsort man page for more details
921 *
922 * Inputs:
923 *
924 * acl_count - Count of ACLs in the array of ACL structures.
925 * calclass - If this is not zero, then we compute the CLASS_OBJ
926 * permissions.
927 * aclp - Array of ACL structures.
928 *
929 * Outputs: