source3/smbd/pysmbd.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Set NT and POSIX ACLs and other VFS operations from Python
   4
   5    Copyrigyt (C) Andrew Bartlett 2012
   6    Copyright (C) Jeremy Allison 1994-2009.
   7    Copyright (C) Andreas Gruenbacher 2002.
   8    Copyright (C) Simo Sorce <idra@samba.org> 2009.
   9    Copyright (C) Simo Sorce 2002
  10    Copyright (C) Eric Lorimer 2002
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include <Python.h>
  27 #include "includes.h"
  28 #include "python/py3compat.h"
  29 #include "python/modules.h"
  30 #include "smbd/smbd.h"
  31 #include "libcli/util/pyerrors.h"
  32 #include "librpc/rpc/pyrpc_util.h"
  33 #include <pytalloc.h>
  34 #include "system/filesys.h"
  35 #include "passdb.h"
  36 #include "secrets.h"
  37 #include "auth.h"
  38
  39 extern const struct generic_mapping file_generic_mapping;
  40
  41 #undef  DBGC_CLASS
  42 #define DBGC_CLASS DBGC_ACLS
  43
  44 #ifdef O_DIRECTORY
  45 #define DIRECTORY_FLAGS O_RDONLY|O_DIRECTORY
  46 #else
  47 /* POSIX allows us to open a directory with O_RDONLY. */
  48 #define DIRECTORY_FLAGS O_RDONLY
  49 #endif
  50
  51
  52 static connection_struct *get_conn_tos(
  53         const char *service,
  54         const struct auth_session_info *session_info)
  55 {
  56         struct conn_struct_tos *c = NULL;
  57         int snum = -1;
  58         NTSTATUS status;
  59
  60         if (!posix_locking_init(false)) {
  61                 PyErr_NoMemory();
  62                 return NULL;
  63         }
  64
  65         if (service) {
  66                 snum = lp_servicenumber(service);
  67                 if (snum == -1) {
  68                         PyErr_SetString(PyExc_RuntimeError, "unknown service");
  69                         return NULL;
  70                 }
  71         }
  72
  73         status = create_conn_struct_tos(NULL,
  74                                         snum,
  75                                         "/",
  76                                         session_info,
  77                                         &c);
  78         PyErr_NTSTATUS_IS_ERR_RAISE(status);
  79
  80         /* Ignore read-only and share restrictions */
  81         c->conn->read_only = false;
  82         c->conn->share_access = SEC_RIGHTS_FILE_ALL;
  83         return c->conn;
  84 }
  85
  86 static int set_sys_acl_conn(const char *fname,
  87                                  SMB_ACL_TYPE_T acltype,
  88                                  SMB_ACL_T theacl, connection_struct *conn)
  89 {
  90         int ret;
  91         struct smb_filename *smb_fname = NULL;
  92
  93         TALLOC_CTX *frame = talloc_stackframe();
  94
  95         smb_fname = synthetic_smb_fname_split(frame,
  96                                         fname,
  97                                         lp_posix_pathnames());
  98         if (smb_fname == NULL) {
  99                 TALLOC_FREE(frame);
 100                 return -1;
 101         }
 102
 103         ret = SMB_VFS_SYS_ACL_SET_FILE( conn, smb_fname, acltype, theacl);
 104
 105         TALLOC_FREE(frame);
 106         return ret;
 107 }
 108
 109
 110 static NTSTATUS init_files_struct(TALLOC_CTX *mem_ctx,
 111                                   const char *fname,
 112                                   struct connection_struct *conn,
 113                                   int flags,
 114                                   struct files_struct **_fsp)
 115 {
 116         struct smb_filename *smb_fname = NULL;
 117         int ret;
 118         mode_t saved_umask;
 119         struct files_struct *fsp;
 120
 121         fsp = talloc_zero(mem_ctx, struct files_struct);
 122         if (fsp == NULL) {
 123                 return NT_STATUS_NO_MEMORY;
 124         }
 125         fsp->fh = talloc(fsp, struct fd_handle);
 126         if (fsp->fh == NULL) {
 127                 return NT_STATUS_NO_MEMORY;
 128         }
 129         fsp->conn = conn;
 130
 131         smb_fname = synthetic_smb_fname_split(fsp,
 132                                               fname,
 133                                               lp_posix_pathnames());
 134         if (smb_fname == NULL) {
 135                 return NT_STATUS_NO_MEMORY;
 136         }
 137
 138         fsp->fsp_name = smb_fname;
 139
 140         /*
 141          * we want total control over the permissions on created files,
 142          * so set our umask to 0 (this matters if flags contains O_CREAT)
 143          */
 144         saved_umask = umask(0);
 145
 146         fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, flags, 00644);
 147
 148         umask(saved_umask);
 149
 150         if (fsp->fh->fd == -1) {
 151                 int err = errno;
 152                 if (err == ENOENT) {
 153                         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 154                 }
 155                 return NT_STATUS_INVALID_PARAMETER;
 156         }
 157
 158         ret = SMB_VFS_FSTAT(fsp, &smb_fname->st);
 159         if (ret == -1) {
 160                 /* If we have an fd, this stat should succeed. */
 161                 DEBUG(0,("Error doing fstat on open file %s (%s)\n",
 162                          smb_fname_str_dbg(smb_fname),
 163                          strerror(errno) ));
 164                 return map_nt_error_from_unix(errno);
 165         }
 166
 167         fsp->file_id = vfs_file_id_from_sbuf(conn, &smb_fname->st);
 168         fsp->vuid = UID_FIELD_INVALID;
 169         fsp->file_pid = 0;
 170         fsp->can_lock = True;
 171         fsp->can_read = True;
 172         fsp->can_write = True;
 173         fsp->print_file = NULL;
 174         fsp->modified = False;
 175         fsp->sent_oplock_break = NO_BREAK_SENT;
 176         fsp->is_directory = S_ISDIR(smb_fname->st.st_ex_mode);
 177
 178         *_fsp = fsp;
 179
 180         return NT_STATUS_OK;
 181 }
 182
 183 static NTSTATUS set_nt_acl_conn(const char *fname,
 184                                 uint32_t security_info_sent, const struct security_descriptor *sd,
 185                                 connection_struct *conn)
 186 {
 187         TALLOC_CTX *frame = talloc_stackframe();
 188         struct files_struct *fsp = NULL;
 189         NTSTATUS status = NT_STATUS_OK;
 190
 191         /* first, try to open it as a file with flag O_RDWR */
 192         status = init_files_struct(frame,
 193                                    fname,
 194                                    conn,
 195                                    O_RDWR,
 196                                    &fsp);
 197         if (!NT_STATUS_IS_OK(status) && errno == EISDIR) {
 198                 /* if fail, try to open as dir */
 199                 status = init_files_struct(frame,
 200                                            fname,
 201                                            conn,
 202                                            DIRECTORY_FLAGS,
 203                                            &fsp);
 204         }
 205
 206         if (!NT_STATUS_IS_OK(status)) {
 207                 DBG_ERR("init_files_struct failed: %s\n",
 208                         nt_errstr(status));
 209                 if (fsp != NULL) {
 210                         SMB_VFS_CLOSE(fsp);
 211                 }
 212                 TALLOC_FREE(frame);
 213                 return status;
 214         }
 215
 216         status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, sd);
 217         if (!NT_STATUS_IS_OK(status)) {
 218                 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned %s.\n", nt_errstr(status)));
 219         }
 220
 221         SMB_VFS_CLOSE(fsp);
 222
 223         TALLOC_FREE(frame);
 224         return status;
 225 }
 226
 227 static NTSTATUS get_nt_acl_conn(TALLOC_CTX *mem_ctx,
 228                                 const char *fname,
 229                                 connection_struct *conn,
 230                                 uint32_t security_info_wanted,
 231                                 struct security_descriptor **sd)
 232 {
 233         TALLOC_CTX *frame = talloc_stackframe();
 234         NTSTATUS status;
 235         struct smb_filename *smb_fname = synthetic_smb_fname(talloc_tos(),
 236                                         fname,
 237                                         NULL,
 238                                         NULL,
 239                                         lp_posix_pathnames() ?
 240                                                 SMB_FILENAME_POSIX_PATH : 0);
 241
 242         if (smb_fname == NULL) {
 243                 TALLOC_FREE(frame);
 244                 return NT_STATUS_NO_MEMORY;
 245         }
 246
 247         status = SMB_VFS_GET_NT_ACL(conn,
 248                                 smb_fname,
 249                                 security_info_wanted,
 250                                 mem_ctx,
 251                                 sd);
 252         if (!NT_STATUS_IS_OK(status)) {
 253                 DEBUG(0,("get_nt_acl_conn: get_nt_acl returned %s.\n", nt_errstr(status)));
 254         }
 255
 256         TALLOC_FREE(frame);
 257
 258         return status;
 259 }
 260
 261 static int set_acl_entry_perms(SMB_ACL_ENTRY_T entry, mode_t perm_mask)
 262 {
 263         SMB_ACL_PERMSET_T perms = NULL;
 264
 265         if (sys_acl_get_permset(entry, &perms) != 0) {
 266                 return -1;
 267         }
 268
 269         if (sys_acl_clear_perms(perms) != 0) {
 270                 return -1;
 271         }
 272
 273         if ((perm_mask & SMB_ACL_READ) != 0 &&
 274             sys_acl_add_perm(perms, SMB_ACL_READ) != 0) {
 275                 return -1;
 276         }
 277
 278         if ((perm_mask & SMB_ACL_WRITE) != 0 &&
 279             sys_acl_add_perm(perms, SMB_ACL_WRITE) != 0) {
 280                 return -1;
 281         }
 282
 283         if ((perm_mask & SMB_ACL_EXECUTE) != 0 &&
 284             sys_acl_add_perm(perms, SMB_ACL_EXECUTE) != 0) {
 285                 return -1;
 286         }
 287
 288         if (sys_acl_set_permset(entry, perms) != 0) {
 289                 return -1;
 290         }
 291
 292         return 0;
 293 }
 294
 295 static SMB_ACL_T make_simple_acl(TALLOC_CTX *mem_ctx,
 296                         gid_t gid,
 297                         mode_t chmod_mode)
 298 {
 299         mode_t mode = SMB_ACL_READ|SMB_ACL_WRITE|SMB_ACL_EXECUTE;
 300
 301         mode_t mode_user = (chmod_mode & 0700) >> 6;
 302         mode_t mode_group = (chmod_mode & 070) >> 3;
 303         mode_t mode_other = chmod_mode &  07;
 304         SMB_ACL_ENTRY_T entry;
 305         SMB_ACL_T acl = sys_acl_init(mem_ctx);
 306
 307         if (!acl) {
 308                 return NULL;
 309         }
 310
 311         if (sys_acl_create_entry(&acl, &entry) != 0) {
 312                 TALLOC_FREE(acl);
 313                 return NULL;
 314         }
 315
 316         if (sys_acl_set_tag_type(entry, SMB_ACL_USER_OBJ) != 0) {
 317                 TALLOC_FREE(acl);
 318                 return NULL;
 319         }
 320
 321         if (set_acl_entry_perms(entry, mode_user) != 0) {
 322                 TALLOC_FREE(acl);
 323                 return NULL;
 324         }
 325
 326         if (sys_acl_create_entry(&acl, &entry) != 0) {
 327                 TALLOC_FREE(acl);
 328                 return NULL;
 329         }
 330
 331         if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP_OBJ) != 0) {
 332                 TALLOC_FREE(acl);
 333                 return NULL;
 334         }
 335
 336         if (set_acl_entry_perms(entry, mode_group) != 0) {
 337                 TALLOC_FREE(acl);
 338                 return NULL;
 339         }
 340
 341         if (sys_acl_create_entry(&acl, &entry) != 0) {
 342                 TALLOC_FREE(acl);
 343                 return NULL;
 344         }
 345
 346         if (sys_acl_set_tag_type(entry, SMB_ACL_OTHER) != 0) {
 347                 TALLOC_FREE(acl);
 348                 return NULL;
 349         }
 350
 351         if (set_acl_entry_perms(entry, mode_other) != 0) {
 352                 TALLOC_FREE(acl);
 353                 return NULL;
 354         }
 355
 356         if (gid != -1) {
 357                 if (sys_acl_create_entry(&acl, &entry) != 0) {
 358                         TALLOC_FREE(acl);
 359                         return NULL;
 360                 }
 361
 362                 if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP) != 0) {
 363                         TALLOC_FREE(acl);
 364                         return NULL;
 365                 }
 366
 367                 if (sys_acl_set_qualifier(entry, &gid) != 0) {
 368                         TALLOC_FREE(acl);
 369                         return NULL;
 370                 }
 371
 372                 if (set_acl_entry_perms(entry, mode_group) != 0) {
 373                         TALLOC_FREE(acl);
 374                         return NULL;
 375                 }
 376         }
 377
 378         if (sys_acl_create_entry(&acl, &entry) != 0) {
 379                 TALLOC_FREE(acl);
 380                 return NULL;
 381         }
 382
 383         if (sys_acl_set_tag_type(entry, SMB_ACL_MASK) != 0) {
 384                 TALLOC_FREE(acl);
 385                 return NULL;
 386         }
 387
 388         if (set_acl_entry_perms(entry, mode) != 0) {
 389                 TALLOC_FREE(acl);
 390                 return NULL;
 391         }
 392
 393         return acl;
 394 }
 395
 396 /*
 397   set a simple ACL on a file, as a test
 398  */
 399 static PyObject *py_smbd_set_simple_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 400 {
 401         const char * const kwnames[] = { "fname", "mode", "gid", "service", NULL };
 402         char *fname, *service = NULL;
 403         int ret;
 404         int mode, gid = -1;
 405         SMB_ACL_T acl;
 406         TALLOC_CTX *frame;
 407         connection_struct *conn;
 408
 409         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "si|iz",
 410                                          discard_const_p(char *, kwnames),
 411                                          &fname, &mode, &gid, &service))
 412                 return NULL;
 413
 414         frame = talloc_stackframe();
 415
 416         acl = make_simple_acl(frame, gid, mode);
 417         if (acl == NULL) {
 418                 TALLOC_FREE(frame);
 419                 return NULL;
 420         }
 421
 422         conn = get_conn_tos(service, NULL);
 423         if (!conn) {
 424                 TALLOC_FREE(frame);
 425                 return NULL;
 426         }
 427
 428         ret = set_sys_acl_conn(fname, SMB_ACL_TYPE_ACCESS, acl, conn);
 429
 430         if (ret != 0) {
 431                 TALLOC_FREE(frame);
 432                 errno = ret;
 433                 return PyErr_SetFromErrno(PyExc_OSError);
 434         }
 435
 436         TALLOC_FREE(frame);
 437
 438         Py_RETURN_NONE;
 439 }
 440
 441 /*
 442   chown a file
 443  */
 444 static PyObject *py_smbd_chown(PyObject *self, PyObject *args, PyObject *kwargs)
 445 {
 446         const char * const kwnames[] = { "fname", "uid", "gid", "service", NULL };
 447         connection_struct *conn;
 448         int ret;
 449
 450         char *fname, *service = NULL;
 451         int uid, gid;
 452         TALLOC_CTX *frame;
 453         struct smb_filename *smb_fname = NULL;
 454
 455         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "sii|z",
 456                                          discard_const_p(char *, kwnames),
 457                                          &fname, &uid, &gid, &service))
 458                 return NULL;
 459
 460         frame = talloc_stackframe();
 461
 462         conn = get_conn_tos(service, NULL);
 463         if (!conn) {
 464                 TALLOC_FREE(frame);
 465                 return NULL;
 466         }
 467
 468         smb_fname = synthetic_smb_fname(talloc_tos(),
 469                                         fname,
 470                                         NULL,
 471                                         NULL,
 472                                         lp_posix_pathnames() ?
 473                                                 SMB_FILENAME_POSIX_PATH : 0);
 474         if (smb_fname == NULL) {
 475                 TALLOC_FREE(frame);
 476                 errno = ENOMEM;
 477                 return PyErr_SetFromErrno(PyExc_OSError);
 478         }
 479
 480         ret = SMB_VFS_CHOWN(conn, smb_fname, uid, gid);
 481         if (ret != 0) {
 482                 TALLOC_FREE(frame);
 483                 errno = ret;
 484                 return PyErr_SetFromErrno(PyExc_OSError);
 485         }
 486
 487         TALLOC_FREE(frame);
 488
 489         Py_RETURN_NONE;
 490 }
 491
 492 /*
 493   unlink a file
 494  */
 495 static PyObject *py_smbd_unlink(PyObject *self, PyObject *args, PyObject *kwargs)
 496 {
 497         const char * const kwnames[] = { "fname", "service", NULL };
 498         connection_struct *conn;
 499         int ret;
 500         struct smb_filename *smb_fname = NULL;
 501         char *fname, *service = NULL;
 502         TALLOC_CTX *frame;
 503
 504         frame = talloc_stackframe();
 505
 506         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "s|z",
 507                                          discard_const_p(char *, kwnames),
 508                                          &fname, &service)) {
 509                 TALLOC_FREE(frame);
 510                 return NULL;
 511         }
 512
 513         conn = get_conn_tos(service, NULL);
 514         if (!conn) {
 515                 TALLOC_FREE(frame);
 516                 return NULL;
 517         }
 518
 519         smb_fname = synthetic_smb_fname_split(frame,
 520                                         fname,
 521                                         lp_posix_pathnames());
 522         if (smb_fname == NULL) {
 523                 TALLOC_FREE(frame);
 524                 return PyErr_NoMemory();
 525         }
 526
 527         ret = SMB_VFS_UNLINK(conn, smb_fname);
 528         if (ret != 0) {
 529                 TALLOC_FREE(frame);
 530                 errno = ret;
 531                 return PyErr_SetFromErrno(PyExc_OSError);
 532         }
 533
 534         TALLOC_FREE(frame);
 535
 536         Py_RETURN_NONE;
 537 }
 538
 539 /*
 540   check if we have ACL support
 541  */
 542 static PyObject *py_smbd_have_posix_acls(PyObject *self,
 543                 PyObject *Py_UNUSED(ignored))
 544 {
 545 #ifdef HAVE_POSIX_ACLS
 546         return PyBool_FromLong(true);
 547 #else
 548         return PyBool_FromLong(false);
 549 #endif
 550 }
 551
 552 /*
 553   set the NT ACL on a file
 554  */
 555 static PyObject *py_smbd_set_nt_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 556 {
 557         const char * const kwnames[] = {
 558                 "fname", "security_info_sent", "sd",
 559                 "service", "session_info", NULL };
 560
 561         NTSTATUS status;
 562         char *fname, *service = NULL;
 563         int security_info_sent;
 564         PyObject *py_sd;
 565         struct security_descriptor *sd;
 566         PyObject *py_session = Py_None;
 567         struct auth_session_info *session_info = NULL;
 568         connection_struct *conn;
 569         TALLOC_CTX *frame;
 570
 571         frame = talloc_stackframe();
 572
 573         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "siO|zO",
 574                                          discard_const_p(char *, kwnames),
 575                                          &fname, &security_info_sent, &py_sd,
 576                                          &service, &py_session)) {
 577                 TALLOC_FREE(frame);
 578                 return NULL;
 579         }
 580
 581         if (!py_check_dcerpc_type(py_sd, "samba.dcerpc.security", "descriptor")) {
 582                 TALLOC_FREE(frame);
 583                 return NULL;
 584         }
 585
 586         if (py_session != Py_None) {
 587                 if (!py_check_dcerpc_type(py_session,
 588                                           "samba.dcerpc.auth",
 589                                           "session_info")) {
 590                         TALLOC_FREE(frame);
 591                         return NULL;
 592                 }
 593                 session_info = pytalloc_get_type(py_session,
 594                                                  struct auth_session_info);
 595                 if (!session_info) {
 596                         PyErr_Format(PyExc_TypeError,
 597                                      "Expected auth_session_info for session_info argument got %s",
 598                                      talloc_get_name(pytalloc_get_ptr(py_session)));
 599                         return NULL;
 600                 }
 601         }
 602
 603         conn = get_conn_tos(service, session_info);
 604         if (!conn) {
 605                 TALLOC_FREE(frame);
 606                 return NULL;
 607         }
 608
 609         sd = pytalloc_get_type(py_sd, struct security_descriptor);
 610
 611         status = set_nt_acl_conn(fname, security_info_sent, sd, conn);
 612         TALLOC_FREE(frame);
 613         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 614
 615         Py_RETURN_NONE;
 616 }
 617
 618 /*
 619   Return the NT ACL on a file
 620  */
 621 static PyObject *py_smbd_get_nt_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 622 {
 623         const char * const kwnames[] = { "fname",
 624                                          "security_info_wanted",
 625                                          "service",
 626                                          "session_info",
 627                                          NULL };
 628         char *fname, *service = NULL;
 629         int security_info_wanted;
 630         PyObject *py_sd;
 631         struct security_descriptor *sd;
 632         TALLOC_CTX *frame = talloc_stackframe();
 633         PyObject *py_session = Py_None;
 634         struct auth_session_info *session_info = NULL;
 635         connection_struct *conn;
 636         NTSTATUS status;
 637         int ret = 1;
 638
 639         ret = PyArg_ParseTupleAndKeywords(args,
 640                                           kwargs,
 641                                           "si|zO",
 642                                           discard_const_p(char *, kwnames),
 643                                           &fname,
 644                                           &security_info_wanted,
 645                                           &service,
 646                                           &py_session);
 647         if (!ret) {
 648                 TALLOC_FREE(frame);
 649                 return NULL;
 650         }
 651
 652         if (py_session != Py_None) {
 653                 if (!py_check_dcerpc_type(py_session,
 654                                           "samba.dcerpc.auth",
 655                                           "session_info")) {
 656                         TALLOC_FREE(frame);
 657                         return NULL;
 658                 }
 659                 session_info = pytalloc_get_type(py_session,
 660                                                  struct auth_session_info);
 661                 if (!session_info) {
 662                         PyErr_Format(
 663                                 PyExc_TypeError,
 664                                 "Expected auth_session_info for "
 665                                 "session_info argument got %s",
 666                                 talloc_get_name(pytalloc_get_ptr(py_session)));
 667                         return NULL;
 668                 }
 669         }
 670
 671         conn = get_conn_tos(service, session_info);
 672         if (!conn) {
 673                 TALLOC_FREE(frame);
 674                 return NULL;
 675         }
 676
 677         status = get_nt_acl_conn(frame, fname, conn, security_info_wanted, &sd);
 678         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 679
 680         py_sd = py_return_ndr_struct("samba.dcerpc.security", "descriptor", sd, sd);
 681
 682         TALLOC_FREE(frame);
 683
 684         return py_sd;
 685 }
 686
 687 /*
 688   set the posix (or similar) ACL on a file
 689  */
 690 static PyObject *py_smbd_set_sys_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 691 {
 692         const char * const kwnames[] = { "fname", "acl_type", "acl", "service", NULL };
 693         TALLOC_CTX *frame = talloc_stackframe();
 694         int ret;
 695         char *fname, *service = NULL;
 696         PyObject *py_acl;
 697         struct smb_acl_t *acl;
 698         int acl_type;
 699         connection_struct *conn;
 700
 701         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "siO|z",
 702                                          discard_const_p(char *, kwnames),
 703                                          &fname, &acl_type, &py_acl, &service)) {
 704                 TALLOC_FREE(frame);
 705                 return NULL;
 706         }
 707
 708         if (!py_check_dcerpc_type(py_acl, "samba.dcerpc.smb_acl", "t")) {
 709                 TALLOC_FREE(frame);
 710                 return NULL;
 711         }
 712
 713         conn = get_conn_tos(service, NULL);
 714         if (!conn) {
 715                 TALLOC_FREE(frame);
 716                 return NULL;
 717         }
 718
 719         acl = pytalloc_get_type(py_acl, struct smb_acl_t);
 720
 721         ret = set_sys_acl_conn(fname, acl_type, acl, conn);
 722         if (ret != 0) {
 723                 TALLOC_FREE(frame);
 724                 errno = ret;
 725                 return PyErr_SetFromErrno(PyExc_OSError);
 726         }
 727
 728         TALLOC_FREE(frame);
 729         Py_RETURN_NONE;
 730 }
 731
 732 /*
 733   Return the posix (or similar) ACL on a file
 734  */
 735 static PyObject *py_smbd_get_sys_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 736 {
 737         const char * const kwnames[] = { "fname", "acl_type", "service", NULL };
 738         char *fname;
 739         PyObject *py_acl;
 740         struct smb_acl_t *acl;
 741         int acl_type;
 742         TALLOC_CTX *frame = talloc_stackframe();
 743         connection_struct *conn;
 744         char *service = NULL;
 745         struct smb_filename *smb_fname = NULL;
 746
 747         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "si|z",
 748                                          discard_const_p(char *, kwnames),
 749                                          &fname, &acl_type, &service)) {
 750                 TALLOC_FREE(frame);
 751                 return NULL;
 752         }
 753
 754         conn = get_conn_tos(service, NULL);
 755         if (!conn) {
 756                 TALLOC_FREE(frame);
 757                 return NULL;
 758         }
 759
 760         smb_fname = synthetic_smb_fname_split(frame,
 761                                         fname,
 762                                         lp_posix_pathnames());
 763         if (smb_fname == NULL) {
 764                 TALLOC_FREE(frame);
 765                 return NULL;
 766         }
 767         acl = SMB_VFS_SYS_ACL_GET_FILE( conn, smb_fname, acl_type, frame);
 768         if (!acl) {
 769                 TALLOC_FREE(frame);
 770                 return PyErr_SetFromErrno(PyExc_OSError);
 771         }
 772
 773         py_acl = py_return_ndr_struct("samba.dcerpc.smb_acl", "t", acl, acl);
 774
 775         TALLOC_FREE(frame);
 776
 777         return py_acl;
 778 }
 779
 780 static PyObject *py_smbd_mkdir(PyObject *self, PyObject *args, PyObject *kwargs)
 781 {
 782         const char * const kwnames[] = { "fname", "service", NULL };
 783         char *fname, *service = NULL;
 784         TALLOC_CTX *frame = talloc_stackframe();
 785         struct connection_struct *conn = NULL;
 786         struct smb_filename *smb_fname = NULL;
 787         int ret;
 788         mode_t saved_umask;
 789
 790         if (!PyArg_ParseTupleAndKeywords(args,
 791                                          kwargs,
 792                                          "s|z",
 793                                          discard_const_p(char *,
 794                                                          kwnames),
 795                                          &fname,
 796                                          &service)) {
 797                 TALLOC_FREE(frame);
 798                 return NULL;
 799         }
 800
 801         conn = get_conn_tos(service, NULL);
 802         if (!conn) {
 803                 TALLOC_FREE(frame);
 804                 return NULL;
 805         }
 806
 807         smb_fname = synthetic_smb_fname(talloc_tos(),
 808                                         fname,
 809                                         NULL,
 810                                         NULL,
 811                                         lp_posix_pathnames() ?
 812                                         SMB_FILENAME_POSIX_PATH : 0);
 813
 814         if (smb_fname == NULL) {
 815                 TALLOC_FREE(frame);
 816                 return NULL;
 817         }
 818
 819         /* we want total control over the permissions on created files,
 820            so set our umask to 0 */
 821         saved_umask = umask(0);
 822
 823         ret = SMB_VFS_MKDIR(conn, smb_fname, 00755);
 824
 825         umask(saved_umask);
 826
 827         if (ret == -1) {
 828                 DBG_ERR("mkdir error=%d (%s)\n", errno, strerror(errno));
 829                 TALLOC_FREE(frame);
 830                 return NULL;
 831         }
 832
 833         TALLOC_FREE(frame);
 834         Py_RETURN_NONE;
 835 }
 836
 837
 838 /*
 839   Create an empty file
 840  */
 841 static PyObject *py_smbd_create_file(PyObject *self, PyObject *args, PyObject *kwargs)
 842 {
 843         const char * const kwnames[] = { "fname", "service", NULL };
 844         char *fname, *service = NULL;
 845         TALLOC_CTX *frame = talloc_stackframe();
 846         struct connection_struct *conn = NULL;
 847         struct files_struct *fsp = NULL;
 848         NTSTATUS status;
 849
 850         if (!PyArg_ParseTupleAndKeywords(args,
 851                                          kwargs,
 852                                          "s|z",
 853                                          discard_const_p(char *,
 854                                                          kwnames),
 855                                          &fname,
 856                                          &service)) {
 857                 TALLOC_FREE(frame);
 858                 return NULL;
 859         }
 860
 861         conn = get_conn_tos(service, NULL);
 862         if (!conn) {
 863                 TALLOC_FREE(frame);
 864                 return NULL;
 865         }
 866
 867         status = init_files_struct(frame,
 868                                    fname,
 869                                    conn,
 870                                    O_CREAT|O_EXCL|O_RDWR,
 871                                    &fsp);
 872         if (!NT_STATUS_IS_OK(status)) {
 873                 DBG_ERR("init_files_struct failed: %s\n",
 874                         nt_errstr(status));
 875         }
 876
 877         TALLOC_FREE(frame);
 878         Py_RETURN_NONE;
 879 }
 880
 881
 882 static PyMethodDef py_smbd_methods[] = {
 883         { "have_posix_acls",
 884                 (PyCFunction)py_smbd_have_posix_acls, METH_NOARGS,
 885                 NULL },
 886         { "set_simple_acl",
 887                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_set_simple_acl),
 888                 METH_VARARGS|METH_KEYWORDS,
 889                 NULL },
 890         { "set_nt_acl",
 891                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_set_nt_acl),
 892                 METH_VARARGS|METH_KEYWORDS,
 893                 NULL },
 894         { "get_nt_acl",
 895                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_get_nt_acl),
 896                 METH_VARARGS|METH_KEYWORDS,
 897                 NULL },
 898         { "get_sys_acl",
 899                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_get_sys_acl),
 900                 METH_VARARGS|METH_KEYWORDS,
 901                 NULL },
 902         { "set_sys_acl",
 903                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_set_sys_acl),
 904                 METH_VARARGS|METH_KEYWORDS,
 905                 NULL },
 906         { "chown",
 907                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_chown),
 908                 METH_VARARGS|METH_KEYWORDS,
 909                 NULL },
 910         { "unlink",
 911                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_unlink),
 912                 METH_VARARGS|METH_KEYWORDS,
 913                 NULL },
 914         { "mkdir",
 915                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_mkdir),
 916                 METH_VARARGS|METH_KEYWORDS,
 917                 NULL },
 918         { "create_file",
 919                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_create_file),
 920                 METH_VARARGS|METH_KEYWORDS,
 921                 NULL },
 922         { NULL }
 923 };
 924
 925 void initsmbd(void);
 926
 927 static struct PyModuleDef moduledef = {
 928     PyModuleDef_HEAD_INIT,
 929     .m_name = "smbd",
 930     .m_doc = "Python bindings for the smbd file server.",
 931     .m_size = -1,
 932     .m_methods = py_smbd_methods,
 933 };
 934
 935 MODULE_INIT_FUNC(smbd)
 936 {
 937         PyObject *m = NULL;
 938
 939         m = PyModule_Create(&moduledef);
 940         return m;
 941 }