source: vendor/current/source3/modules/vfs_acl_tdb.c

Last change on this file was 989, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.7
File size: 11.1 KB
Line 
1/*
2 * Store Windows ACLs in a tdb.
3 *
4 * Copyright (C) Volker Lendecke, 2008
5 * Copyright (C) Jeremy Allison, 2008
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 */
20
21#include "includes.h"
22#include "smbd/smbd.h"
23#include "system/filesys.h"
24#include "librpc/gen_ndr/xattr.h"
25#include "librpc/gen_ndr/ndr_xattr.h"
26#include "../lib/crypto/sha256.h"
27#include "dbwrap/dbwrap.h"
28#include "dbwrap/dbwrap_open.h"
29#include "auth.h"
30#include "util_tdb.h"
31
32#undef DBGC_CLASS
33#define DBGC_CLASS DBGC_VFS
34
35#define ACL_MODULE_NAME "acl_tdb"
36#include "modules/vfs_acl_common.c"
37
38static unsigned int ref_count;
39static struct db_context *acl_db;
40
41/*******************************************************************
42 Open acl_db if not already open, increment ref count.
43*******************************************************************/
44
45static bool acl_tdb_init(void)
46{
47 char *dbname;
48
49 if (acl_db) {
50 ref_count++;
51 return true;
52 }
53
54 dbname = state_path("file_ntacls.tdb");
55
56 if (dbname == NULL) {
57 errno = ENOSYS;
58 return false;
59 }
60
61 become_root();
62 acl_db = db_open(NULL, dbname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600,
63 DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
64 unbecome_root();
65
66 if (acl_db == NULL) {
67#if defined(ENOTSUP)
68 errno = ENOTSUP;
69#else
70 errno = ENOSYS;
71#endif
72 TALLOC_FREE(dbname);
73 return false;
74 }
75
76 ref_count++;
77 TALLOC_FREE(dbname);
78 return true;
79}
80
81/*******************************************************************
82 Lower ref count and close acl_db if zero.
83*******************************************************************/
84
85static void disconnect_acl_tdb(struct vfs_handle_struct *handle)
86{
87 SMB_VFS_NEXT_DISCONNECT(handle);
88 ref_count--;
89 if (ref_count == 0) {
90 TALLOC_FREE(acl_db);
91 }
92}
93
94/*******************************************************************
95 Fetch_lock the tdb acl record for a file
96*******************************************************************/
97
98static struct db_record *acl_tdb_lock(TALLOC_CTX *mem_ctx,
99 struct db_context *db,
100 const struct file_id *id)
101{
102 uint8_t id_buf[16];
103
104 /* For backwards compatibility only store the dev/inode. */
105 push_file_id_16((char *)id_buf, id);
106 return dbwrap_fetch_locked(db,
107 mem_ctx,
108 make_tdb_data(id_buf,
109 sizeof(id_buf)));
110}
111
112/*******************************************************************
113 Delete the tdb acl record for a file
114*******************************************************************/
115
116static NTSTATUS acl_tdb_delete(vfs_handle_struct *handle,
117 struct db_context *db,
118 SMB_STRUCT_STAT *psbuf)
119{
120 NTSTATUS status;
121 struct file_id id = vfs_file_id_from_sbuf(handle->conn, psbuf);
122 struct db_record *rec = acl_tdb_lock(talloc_tos(), db, &id);
123
124 /*
125 * If rec == NULL there's not much we can do about it
126 */
127
128 if (rec == NULL) {
129 DEBUG(10,("acl_tdb_delete: rec == NULL\n"));
130 TALLOC_FREE(rec);
131 return NT_STATUS_OK;
132 }
133
134 status = dbwrap_record_delete(rec);
135 TALLOC_FREE(rec);
136 return status;
137}
138
139/*******************************************************************
140 Pull a security descriptor into a DATA_BLOB from a tdb store.
141*******************************************************************/
142
143static NTSTATUS get_acl_blob(TALLOC_CTX *ctx,
144 vfs_handle_struct *handle,
145 files_struct *fsp,
146 const char *name,
147 DATA_BLOB *pblob)
148{
149 uint8_t id_buf[16];
150 TDB_DATA data;
151 struct file_id id;
152 struct db_context *db = acl_db;
153 NTSTATUS status = NT_STATUS_OK;
154 SMB_STRUCT_STAT sbuf;
155
156 ZERO_STRUCT(sbuf);
157
158 if (fsp) {
159 status = vfs_stat_fsp(fsp);
160 sbuf = fsp->fsp_name->st;
161 } else {
162 int ret = vfs_stat_smb_basename(handle->conn, name, &sbuf);
163 if (ret == -1) {
164 status = map_nt_error_from_unix(errno);
165 }
166 }
167
168 if (!NT_STATUS_IS_OK(status)) {
169 return status;
170 }
171
172 id = vfs_file_id_from_sbuf(handle->conn, &sbuf);
173
174 /* For backwards compatibility only store the dev/inode. */
175 push_file_id_16((char *)id_buf, &id);
176
177 status = dbwrap_fetch(db,
178 ctx,
179 make_tdb_data(id_buf, sizeof(id_buf)),
180 &data);
181 if (!NT_STATUS_IS_OK(status)) {
182 return NT_STATUS_INTERNAL_DB_CORRUPTION;
183 }
184
185 pblob->data = data.dptr;
186 pblob->length = data.dsize;
187
188 DEBUG(10,("get_acl_blob: returned %u bytes from file %s\n",
189 (unsigned int)data.dsize, name ));
190
191 if (pblob->length == 0 || pblob->data == NULL) {
192 return NT_STATUS_NOT_FOUND;
193 }
194 return NT_STATUS_OK;
195}
196
197/*******************************************************************
198 Store a DATA_BLOB into a tdb record given an fsp pointer.
199*******************************************************************/
200
201static NTSTATUS store_acl_blob_fsp(vfs_handle_struct *handle,
202 files_struct *fsp,
203 DATA_BLOB *pblob)
204{
205 uint8_t id_buf[16];
206 struct file_id id;
207 TDB_DATA data;
208 struct db_context *db = acl_db;
209 struct db_record *rec;
210 NTSTATUS status;
211
212 DEBUG(10,("store_acl_blob_fsp: storing blob length %u on file %s\n",
213 (unsigned int)pblob->length, fsp_str_dbg(fsp)));
214
215 status = vfs_stat_fsp(fsp);
216 if (!NT_STATUS_IS_OK(status)) {
217 return status;
218 }
219
220 id = vfs_file_id_from_sbuf(handle->conn, &fsp->fsp_name->st);
221
222 /* For backwards compatibility only store the dev/inode. */
223 push_file_id_16((char *)id_buf, &id);
224 rec = dbwrap_fetch_locked(db, talloc_tos(),
225 make_tdb_data(id_buf,
226 sizeof(id_buf)));
227 if (rec == NULL) {
228 DEBUG(0, ("store_acl_blob_fsp_tdb: fetch_lock failed\n"));
229 return NT_STATUS_INTERNAL_DB_CORRUPTION;
230 }
231 data.dptr = pblob->data;
232 data.dsize = pblob->length;
233 return dbwrap_record_store(rec, data, 0);
234}
235
236/*********************************************************************
237 On unlink we need to delete the tdb record (if using tdb).
238*********************************************************************/
239
240static int unlink_acl_tdb(vfs_handle_struct *handle,
241 const struct smb_filename *smb_fname)
242{
243 struct smb_filename *smb_fname_tmp = NULL;
244 struct db_context *db = acl_db;
245 int ret = -1;
246
247 smb_fname_tmp = cp_smb_filename(talloc_tos(), smb_fname);
248 if (smb_fname_tmp == NULL) {
249 errno = ENOMEM;
250 goto out;
251 }
252
253 if (lp_posix_pathnames()) {
254 ret = SMB_VFS_LSTAT(handle->conn, smb_fname_tmp);
255 } else {
256 ret = SMB_VFS_STAT(handle->conn, smb_fname_tmp);
257 }
258
259 if (ret == -1) {
260 goto out;
261 }
262
263 ret = unlink_acl_common(handle, smb_fname_tmp);
264
265 if (ret == -1) {
266 goto out;
267 }
268
269 acl_tdb_delete(handle, db, &smb_fname_tmp->st);
270 out:
271 return ret;
272}
273
274/*********************************************************************
275 On rmdir we need to delete the tdb record (if using tdb).
276*********************************************************************/
277
278static int rmdir_acl_tdb(vfs_handle_struct *handle, const char *path)
279{
280
281 SMB_STRUCT_STAT sbuf;
282 struct db_context *db = acl_db;
283 int ret = -1;
284
285 ret = vfs_stat_smb_basename(handle->conn, path, &sbuf);
286 if (ret == -1) {
287 return -1;
288 }
289
290 ret = rmdir_acl_common(handle, path);
291 if (ret == -1) {
292 return -1;
293 }
294
295 acl_tdb_delete(handle, db, &sbuf);
296 return 0;
297}
298
299/*******************************************************************
300 Handle opening the storage tdb if so configured.
301*******************************************************************/
302
303static int connect_acl_tdb(struct vfs_handle_struct *handle,
304 const char *service,
305 const char *user)
306{
307 int ret = SMB_VFS_NEXT_CONNECT(handle, service, user);
308 bool ok;
309 struct acl_common_config *config = NULL;
310
311 if (ret < 0) {
312 return ret;
313 }
314
315 if (!acl_tdb_init()) {
316 SMB_VFS_NEXT_DISCONNECT(handle);
317 return -1;
318 }
319
320 ok = init_acl_common_config(handle);
321 if (!ok) {
322 DBG_ERR("init_acl_common_config failed\n");
323 return -1;
324 }
325
326 /* Ensure we have the parameters correct if we're
327 * using this module. */
328 DEBUG(2,("connect_acl_tdb: setting 'inherit acls = true' "
329 "'dos filemode = true' and "
330 "'force unknown acl user = true' for service %s\n",
331 service ));
332
333 lp_do_parameter(SNUM(handle->conn), "inherit acls", "true");
334 lp_do_parameter(SNUM(handle->conn), "dos filemode", "true");
335 lp_do_parameter(SNUM(handle->conn), "force unknown acl user", "true");
336
337 SMB_VFS_HANDLE_GET_DATA(handle, config,
338 struct acl_common_config,
339 return -1);
340
341 if (config->ignore_system_acls) {
342 DBG_NOTICE("setting 'create mask = 0666', "
343 "'directory mask = 0777', "
344 "'store dos attributes = yes' and all "
345 "'map ...' options to 'no'\n");
346
347 lp_do_parameter(SNUM(handle->conn), "create mask", "0666");
348 lp_do_parameter(SNUM(handle->conn), "directory mask", "0777");
349 lp_do_parameter(SNUM(handle->conn), "map archive", "no");
350 lp_do_parameter(SNUM(handle->conn), "map hidden", "no");
351 lp_do_parameter(SNUM(handle->conn), "map readonly", "no");
352 lp_do_parameter(SNUM(handle->conn), "map system", "no");
353 lp_do_parameter(SNUM(handle->conn), "store dos attributes",
354 "yes");
355 }
356
357 return 0;
358}
359
360/*********************************************************************
361 Remove a Windows ACL - we're setting the underlying POSIX ACL.
362*********************************************************************/
363
364static int sys_acl_set_file_tdb(vfs_handle_struct *handle,
365 const char *path,
366 SMB_ACL_TYPE_T type,
367 SMB_ACL_T theacl)
368{
369 SMB_STRUCT_STAT sbuf;
370 struct db_context *db = acl_db;
371 int ret = -1;
372
373 ret = vfs_stat_smb_basename(handle->conn, path, &sbuf);
374 if (ret == -1) {
375 return -1;
376 }
377
378 ret = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle,
379 path,
380 type,
381 theacl);
382 if (ret == -1) {
383 return -1;
384 }
385
386 acl_tdb_delete(handle, db, &sbuf);
387 return 0;
388}
389
390/*********************************************************************
391 Remove a Windows ACL - we're setting the underlying POSIX ACL.
392*********************************************************************/
393
394static int sys_acl_set_fd_tdb(vfs_handle_struct *handle,
395 files_struct *fsp,
396 SMB_ACL_T theacl)
397{
398 struct db_context *db = acl_db;
399 NTSTATUS status;
400 int ret;
401
402 status = vfs_stat_fsp(fsp);
403 if (!NT_STATUS_IS_OK(status)) {
404 return -1;
405 }
406
407 ret = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle,
408 fsp,
409 theacl);
410 if (ret == -1) {
411 return -1;
412 }
413
414 acl_tdb_delete(handle, db, &fsp->fsp_name->st);
415 return 0;
416}
417
418static struct vfs_fn_pointers vfs_acl_tdb_fns = {
419 .connect_fn = connect_acl_tdb,
420 .disconnect_fn = disconnect_acl_tdb,
421 .rmdir_fn = rmdir_acl_tdb,
422 .unlink_fn = unlink_acl_tdb,
423 .chmod_fn = chmod_acl_module_common,
424 .fchmod_fn = fchmod_acl_module_common,
425 .fget_nt_acl_fn = fget_nt_acl_common,
426 .get_nt_acl_fn = get_nt_acl_common,
427 .fset_nt_acl_fn = fset_nt_acl_common,
428 .chmod_acl_fn = chmod_acl_acl_module_common,
429 .fchmod_acl_fn = fchmod_acl_acl_module_common,
430 .sys_acl_set_file_fn = sys_acl_set_file_tdb,
431 .sys_acl_set_fd_fn = sys_acl_set_fd_tdb
432};
433
434static_decl_vfs;
435NTSTATUS vfs_acl_tdb_init(void)
436{
437 return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "acl_tdb",
438 &vfs_acl_tdb_fns);
439}
Note: See TracBrowser for help on using the repository browser.