2 Unix SMB/CIFS implementation.
3 Set NT and POSIX ACLs and other VFS operations from Python
5 Copyrigyt (C) Andrew Bartlett 2012
6 Copyright (C) Jeremy Allison 1994-2009.
7 Copyright (C) Andreas Gruenbacher 2002.
8 Copyright (C) Simo Sorce <idra@samba.org> 2009.
9 Copyright (C) Simo Sorce 2002
10 Copyright (C) Eric Lorimer 2002
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
28 #include "python/py3compat.h"
29 #include "python/modules.h"
30 #include "smbd/smbd.h"
31 #include "libcli/util/pyerrors.h"
32 #include "librpc/rpc/pyrpc_util.h"
34 #include "system/filesys.h"
39 extern const struct generic_mapping file_generic_mapping;
42 #define DBGC_CLASS DBGC_ACLS
45 #define DIRECTORY_FLAGS O_RDONLY|O_DIRECTORY
47 /* POSIX allows us to open a directory with O_RDONLY. */
48 #define DIRECTORY_FLAGS O_RDONLY
52 static connection_struct *get_conn_tos(
54 const struct auth_session_info *session_info)
56 struct conn_struct_tos *c = NULL;
60 if (!posix_locking_init(false)) {
66 snum = lp_servicenumber(service);
68 PyErr_SetString(PyExc_RuntimeError, "unknown service");
73 status = create_conn_struct_tos(NULL,
78 PyErr_NTSTATUS_IS_ERR_RAISE(status);
80 /* Ignore read-only and share restrictions */
81 c->conn->read_only = false;
82 c->conn->share_access = SEC_RIGHTS_FILE_ALL;
86 static int set_sys_acl_conn(const char *fname,
87 SMB_ACL_TYPE_T acltype,
88 SMB_ACL_T theacl, connection_struct *conn)
91 struct smb_filename *smb_fname = NULL;
93 TALLOC_CTX *frame = talloc_stackframe();
95 smb_fname = synthetic_smb_fname_split(frame,
97 lp_posix_pathnames());
98 if (smb_fname == NULL) {
103 ret = SMB_VFS_SYS_ACL_SET_FILE( conn, smb_fname, acltype, theacl);
110 static NTSTATUS init_files_struct(TALLOC_CTX *mem_ctx,
112 struct connection_struct *conn,
114 struct files_struct **_fsp)
116 struct smb_filename *smb_fname = NULL;
119 struct files_struct *fsp;
121 fsp = talloc_zero(mem_ctx, struct files_struct);
123 return NT_STATUS_NO_MEMORY;
125 fsp->fh = talloc(fsp, struct fd_handle);
126 if (fsp->fh == NULL) {
127 return NT_STATUS_NO_MEMORY;
131 smb_fname = synthetic_smb_fname_split(fsp,
133 lp_posix_pathnames());
134 if (smb_fname == NULL) {
135 return NT_STATUS_NO_MEMORY;
138 fsp->fsp_name = smb_fname;
141 * we want total control over the permissions on created files,
142 * so set our umask to 0 (this matters if flags contains O_CREAT)
144 saved_umask = umask(0);
146 fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, flags, 00644);
150 if (fsp->fh->fd == -1) {
153 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
155 return NT_STATUS_INVALID_PARAMETER;
158 ret = SMB_VFS_FSTAT(fsp, &smb_fname->st);
160 /* If we have an fd, this stat should succeed. */
161 DEBUG(0,("Error doing fstat on open file %s (%s)\n",
162 smb_fname_str_dbg(smb_fname),
164 return map_nt_error_from_unix(errno);
167 fsp->file_id = vfs_file_id_from_sbuf(conn, &smb_fname->st);
168 fsp->vuid = UID_FIELD_INVALID;
170 fsp->can_lock = True;
171 fsp->can_read = True;
172 fsp->can_write = True;
173 fsp->print_file = NULL;
174 fsp->modified = False;
175 fsp->sent_oplock_break = NO_BREAK_SENT;
176 fsp->is_directory = S_ISDIR(smb_fname->st.st_ex_mode);
183 static NTSTATUS set_nt_acl_conn(const char *fname,
184 uint32_t security_info_sent, const struct security_descriptor *sd,
185 connection_struct *conn)
187 TALLOC_CTX *frame = talloc_stackframe();
188 struct files_struct *fsp = NULL;
189 NTSTATUS status = NT_STATUS_OK;
191 /* first, try to open it as a file with flag O_RDWR */
192 status = init_files_struct(frame,
197 if (!NT_STATUS_IS_OK(status) && errno == EISDIR) {
198 /* if fail, try to open as dir */
199 status = init_files_struct(frame,
206 if (!NT_STATUS_IS_OK(status)) {
207 DBG_ERR("init_files_struct failed: %s\n",
216 status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, sd);
217 if (!NT_STATUS_IS_OK(status)) {
218 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned %s.\n", nt_errstr(status)));
227 static NTSTATUS get_nt_acl_conn(TALLOC_CTX *mem_ctx,
229 connection_struct *conn,
230 uint32_t security_info_wanted,
231 struct security_descriptor **sd)
233 TALLOC_CTX *frame = talloc_stackframe();
235 struct smb_filename *smb_fname = synthetic_smb_fname(talloc_tos(),
239 lp_posix_pathnames() ?
240 SMB_FILENAME_POSIX_PATH : 0);
242 if (smb_fname == NULL) {
244 return NT_STATUS_NO_MEMORY;
247 status = SMB_VFS_GET_NT_ACL(conn,
249 security_info_wanted,
252 if (!NT_STATUS_IS_OK(status)) {
253 DEBUG(0,("get_nt_acl_conn: get_nt_acl returned %s.\n", nt_errstr(status)));
261 static int set_acl_entry_perms(SMB_ACL_ENTRY_T entry, mode_t perm_mask)
263 SMB_ACL_PERMSET_T perms = NULL;
265 if (sys_acl_get_permset(entry, &perms) != 0) {
269 if (sys_acl_clear_perms(perms) != 0) {
273 if ((perm_mask & SMB_ACL_READ) != 0 &&
274 sys_acl_add_perm(perms, SMB_ACL_READ) != 0) {
278 if ((perm_mask & SMB_ACL_WRITE) != 0 &&
279 sys_acl_add_perm(perms, SMB_ACL_WRITE) != 0) {
283 if ((perm_mask & SMB_ACL_EXECUTE) != 0 &&
284 sys_acl_add_perm(perms, SMB_ACL_EXECUTE) != 0) {
288 if (sys_acl_set_permset(entry, perms) != 0) {
295 static SMB_ACL_T make_simple_acl(TALLOC_CTX *mem_ctx,
299 mode_t mode = SMB_ACL_READ|SMB_ACL_WRITE|SMB_ACL_EXECUTE;
301 mode_t mode_user = (chmod_mode & 0700) >> 6;
302 mode_t mode_group = (chmod_mode & 070) >> 3;
303 mode_t mode_other = chmod_mode & 07;
304 SMB_ACL_ENTRY_T entry;
305 SMB_ACL_T acl = sys_acl_init(mem_ctx);
311 if (sys_acl_create_entry(&acl, &entry) != 0) {
316 if (sys_acl_set_tag_type(entry, SMB_ACL_USER_OBJ) != 0) {
321 if (set_acl_entry_perms(entry, mode_user) != 0) {
326 if (sys_acl_create_entry(&acl, &entry) != 0) {
331 if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP_OBJ) != 0) {
336 if (set_acl_entry_perms(entry, mode_group) != 0) {
341 if (sys_acl_create_entry(&acl, &entry) != 0) {
346 if (sys_acl_set_tag_type(entry, SMB_ACL_OTHER) != 0) {
351 if (set_acl_entry_perms(entry, mode_other) != 0) {
357 if (sys_acl_create_entry(&acl, &entry) != 0) {
362 if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP) != 0) {
367 if (sys_acl_set_qualifier(entry, &gid) != 0) {
372 if (set_acl_entry_perms(entry, mode_group) != 0) {
378 if (sys_acl_create_entry(&acl, &entry) != 0) {
383 if (sys_acl_set_tag_type(entry, SMB_ACL_MASK) != 0) {
388 if (set_acl_entry_perms(entry, mode) != 0) {
397 set a simple ACL on a file, as a test
399 static PyObject *py_smbd_set_simple_acl(PyObject *self, PyObject *args, PyObject *kwargs)
401 const char * const kwnames[] = { "fname", "mode", "gid", "service", NULL };
402 char *fname, *service = NULL;
407 connection_struct *conn;
409 if (!PyArg_ParseTupleAndKeywords(args, kwargs, "si|iz",
410 discard_const_p(char *, kwnames),
411 &fname, &mode, &gid, &service))
414 frame = talloc_stackframe();
416 acl = make_simple_acl(frame, gid, mode);
422 conn = get_conn_tos(service, NULL);
428 ret = set_sys_acl_conn(fname, SMB_ACL_TYPE_ACCESS, acl, conn);
433 return PyErr_SetFromErrno(PyExc_OSError);
444 static PyObject *py_smbd_chown(PyObject *self, PyObject *args, PyObject *kwargs)
446 const char * const kwnames[] = { "fname", "uid", "gid", "service", NULL };
447 connection_struct *conn;
450 char *fname, *service = NULL;
453 struct smb_filename *smb_fname = NULL;
455 if (!PyArg_ParseTupleAndKeywords(args, kwargs, "sii|z",
456 discard_const_p(char *, kwnames),
457 &fname, &uid, &gid, &service))
460 frame = talloc_stackframe();
462 conn = get_conn_tos(service, NULL);
468 smb_fname = synthetic_smb_fname(talloc_tos(),
472 lp_posix_pathnames() ?
473 SMB_FILENAME_POSIX_PATH : 0);
474 if (smb_fname == NULL) {
477 return PyErr_SetFromErrno(PyExc_OSError);
480 ret = SMB_VFS_CHOWN(conn, smb_fname, uid, gid);
484 return PyErr_SetFromErrno(PyExc_OSError);
495 static PyObject *py_smbd_unlink(PyObject *self, PyObject *args, PyObject *kwargs)
497 const char * const kwnames[] = { "fname", "service", NULL };
498 connection_struct *conn;
500 struct smb_filename *smb_fname = NULL;
501 char *fname, *service = NULL;
504 frame = talloc_stackframe();
506 if (!PyArg_ParseTupleAndKeywords(args, kwargs, "s|z",
507 discard_const_p(char *, kwnames),
513 conn = get_conn_tos(service, NULL);
519 smb_fname = synthetic_smb_fname_split(frame,
521 lp_posix_pathnames());
522 if (smb_fname == NULL) {
524 return PyErr_NoMemory();
527 ret = SMB_VFS_UNLINK(conn, smb_fname);
531 return PyErr_SetFromErrno(PyExc_OSError);
540 check if we have ACL support
542 static PyObject *py_smbd_have_posix_acls(PyObject *self,
543 PyObject *Py_UNUSED(ignored))
545 #ifdef HAVE_POSIX_ACLS
546 return PyBool_FromLong(true);
548 return PyBool_FromLong(false);
553 set the NT ACL on a file
555 static PyObject *py_smbd_set_nt_acl(PyObject *self, PyObject *args, PyObject *kwargs)
557 const char * const kwnames[] = {
558 "fname", "security_info_sent", "sd",
559 "service", "session_info", NULL };
562 char *fname, *service = NULL;
563 int security_info_sent;
565 struct security_descriptor *sd;
566 PyObject *py_session = Py_None;
567 struct auth_session_info *session_info = NULL;
568 connection_struct *conn;
571 frame = talloc_stackframe();
573 if (!PyArg_ParseTupleAndKeywords(args, kwargs, "siO|zO",
574 discard_const_p(char *, kwnames),
575 &fname, &security_info_sent, &py_sd,
576 &service, &py_session)) {
581 if (!py_check_dcerpc_type(py_sd, "samba.dcerpc.security", "descriptor")) {
586 if (py_session != Py_None) {
587 if (!py_check_dcerpc_type(py_session,
593 session_info = pytalloc_get_type(py_session,
594 struct auth_session_info);
596 PyErr_Format(PyExc_TypeError,
597 "Expected auth_session_info for session_info argument got %s",
598 pytalloc_get_name(py_session));
603 conn = get_conn_tos(service, session_info);
609 sd = pytalloc_get_type(py_sd, struct security_descriptor);
611 status = set_nt_acl_conn(fname, security_info_sent, sd, conn);
613 PyErr_NTSTATUS_IS_ERR_RAISE(status);
619 Return the NT ACL on a file
621 static PyObject *py_smbd_get_nt_acl(PyObject *self, PyObject *args, PyObject *kwargs)
623 const char * const kwnames[] = { "fname",
624 "security_info_wanted",
628 char *fname, *service = NULL;
629 int security_info_wanted;
631 struct security_descriptor *sd;
632 TALLOC_CTX *frame = talloc_stackframe();
633 PyObject *py_session = Py_None;
634 struct auth_session_info *session_info = NULL;
635 connection_struct *conn;
639 ret = PyArg_ParseTupleAndKeywords(args,
642 discard_const_p(char *, kwnames),
644 &security_info_wanted,
652 if (py_session != Py_None) {
653 if (!py_check_dcerpc_type(py_session,
659 session_info = pytalloc_get_type(py_session,
660 struct auth_session_info);
664 "Expected auth_session_info for "
665 "session_info argument got %s",
666 pytalloc_get_name(py_session));
671 conn = get_conn_tos(service, session_info);
677 status = get_nt_acl_conn(frame, fname, conn, security_info_wanted, &sd);
678 PyErr_NTSTATUS_IS_ERR_RAISE(status);
680 py_sd = py_return_ndr_struct("samba.dcerpc.security", "descriptor", sd, sd);
688 set the posix (or similar) ACL on a file
690 static PyObject *py_smbd_set_sys_acl(PyObject *self, PyObject *args, PyObject *kwargs)
692 const char * const kwnames[] = { "fname", "acl_type", "acl", "service", NULL };
693 TALLOC_CTX *frame = talloc_stackframe();
695 char *fname, *service = NULL;
697 struct smb_acl_t *acl;
699 connection_struct *conn;
701 if (!PyArg_ParseTupleAndKeywords(args, kwargs, "siO|z",
702 discard_const_p(char *, kwnames),
703 &fname, &acl_type, &py_acl, &service)) {
708 if (!py_check_dcerpc_type(py_acl, "samba.dcerpc.smb_acl", "t")) {
713 conn = get_conn_tos(service, NULL);
719 acl = pytalloc_get_type(py_acl, struct smb_acl_t);
721 ret = set_sys_acl_conn(fname, acl_type, acl, conn);
725 return PyErr_SetFromErrno(PyExc_OSError);
733 Return the posix (or similar) ACL on a file
735 static PyObject *py_smbd_get_sys_acl(PyObject *self, PyObject *args, PyObject *kwargs)
737 const char * const kwnames[] = { "fname", "acl_type", "service", NULL };
740 struct smb_acl_t *acl;
742 TALLOC_CTX *frame = talloc_stackframe();
743 connection_struct *conn;
744 char *service = NULL;
745 struct smb_filename *smb_fname = NULL;
747 if (!PyArg_ParseTupleAndKeywords(args, kwargs, "si|z",
748 discard_const_p(char *, kwnames),
749 &fname, &acl_type, &service)) {
754 conn = get_conn_tos(service, NULL);
760 smb_fname = synthetic_smb_fname_split(frame,
762 lp_posix_pathnames());
763 if (smb_fname == NULL) {
767 acl = SMB_VFS_SYS_ACL_GET_FILE( conn, smb_fname, acl_type, frame);
770 return PyErr_SetFromErrno(PyExc_OSError);
773 py_acl = py_return_ndr_struct("samba.dcerpc.smb_acl", "t", acl, acl);
780 static PyObject *py_smbd_mkdir(PyObject *self, PyObject *args, PyObject *kwargs)
782 const char * const kwnames[] = { "fname", "service", NULL };
783 char *fname, *service = NULL;
784 TALLOC_CTX *frame = talloc_stackframe();
785 struct connection_struct *conn = NULL;
786 struct smb_filename *smb_fname = NULL;
790 if (!PyArg_ParseTupleAndKeywords(args,
793 discard_const_p(char *,
801 conn = get_conn_tos(service, NULL);
807 smb_fname = synthetic_smb_fname(talloc_tos(),
811 lp_posix_pathnames() ?
812 SMB_FILENAME_POSIX_PATH : 0);
814 if (smb_fname == NULL) {
819 /* we want total control over the permissions on created files,
820 so set our umask to 0 */
821 saved_umask = umask(0);
823 ret = SMB_VFS_MKDIR(conn, smb_fname, 00755);
828 DBG_ERR("mkdir error=%d (%s)\n", errno, strerror(errno));
841 static PyObject *py_smbd_create_file(PyObject *self, PyObject *args, PyObject *kwargs)
843 const char * const kwnames[] = { "fname", "service", NULL };
844 char *fname, *service = NULL;
845 TALLOC_CTX *frame = talloc_stackframe();
846 struct connection_struct *conn = NULL;
847 struct files_struct *fsp = NULL;
850 if (!PyArg_ParseTupleAndKeywords(args,
853 discard_const_p(char *,
861 conn = get_conn_tos(service, NULL);
867 status = init_files_struct(frame,
870 O_CREAT|O_EXCL|O_RDWR,
872 if (!NT_STATUS_IS_OK(status)) {
873 DBG_ERR("init_files_struct failed: %s\n",
882 static PyMethodDef py_smbd_methods[] = {
884 (PyCFunction)py_smbd_have_posix_acls, METH_NOARGS,
887 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_set_simple_acl),
888 METH_VARARGS|METH_KEYWORDS,
891 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_set_nt_acl),
892 METH_VARARGS|METH_KEYWORDS,
895 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_get_nt_acl),
896 METH_VARARGS|METH_KEYWORDS,
899 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_get_sys_acl),
900 METH_VARARGS|METH_KEYWORDS,
903 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_set_sys_acl),
904 METH_VARARGS|METH_KEYWORDS,
907 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_chown),
908 METH_VARARGS|METH_KEYWORDS,
911 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_unlink),
912 METH_VARARGS|METH_KEYWORDS,
915 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_mkdir),
916 METH_VARARGS|METH_KEYWORDS,
919 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_create_file),
920 METH_VARARGS|METH_KEYWORDS,
927 static struct PyModuleDef moduledef = {
928 PyModuleDef_HEAD_INIT,
930 .m_doc = "Python bindings for the smbd file server.",
932 .m_methods = py_smbd_methods,
935 MODULE_INIT_FUNC(smbd)
939 m = PyModule_Create(&moduledef);