2 Unix SMB/CIFS implementation.
3 SMB NT Security Descriptor / Unix permission conversion.
4 Copyright (C) Jeremy Allison 1994-2000.
5 Copyright (C) Andreas Gruenbacher 2002.
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 #define DBGC_CLASS DBGC_ACLS
27 /****************************************************************************
28 Data structures representing the internal ACE format.
29 ****************************************************************************/
31 enum ace_owner {UID_ACE, GID_ACE, WORLD_ACE};
32 enum ace_attribute {ALLOW_ACE, DENY_ACE}; /* Used for incoming NT ACLS. */
34 typedef union posix_id {
40 typedef struct canon_ace {
41 struct canon_ace *next, *prev;
43 mode_t perms; /* Only use S_I(R|W|X)USR mode bits here. */
45 enum ace_owner owner_type;
46 enum ace_attribute attr;
51 #define ALL_ACE_PERMS (S_IRUSR|S_IWUSR|S_IXUSR)
54 * EA format of user.SAMBA_PAI (Samba_Posix_Acl_Interitance)
57 * | 1 | 1 | 2 | 2 | ....
58 * +------+------+-------------+---------------------+-------------+--------------------+
59 * | vers | flag | num_entries | num_default_entries | ..entries.. | default_entries... |
60 * +------+------+-------------+---------------------+-------------+--------------------+
63 #define PAI_VERSION_OFFSET 0
64 #define PAI_FLAG_OFFSET 1
65 #define PAI_NUM_ENTRIES_OFFSET 2
66 #define PAI_NUM_DEFAULT_ENTRIES_OFFSET 4
67 #define PAI_ENTRIES_BASE 6
70 #define PAI_ACL_FLAG_PROTECTED 0x1
71 #define PAI_ENTRY_LENGTH 5
74 * In memory format of user.SAMBA_PAI attribute.
78 struct pai_entry *next, *prev;
79 enum ace_owner owner_type;
85 unsigned int num_entries;
86 struct pai_entry *entry_list;
87 unsigned int num_def_entries;
88 struct pai_entry *def_entry_list;
91 /************************************************************************
92 Return a uint32 of the pai_entry principal.
93 ************************************************************************/
95 static uint32 get_pai_entry_val(struct pai_entry *paie)
97 switch (paie->owner_type) {
99 DEBUG(10,("get_pai_entry_val: uid = %u\n", (unsigned int)paie->unix_ug.uid ));
100 return (uint32)paie->unix_ug.uid;
102 DEBUG(10,("get_pai_entry_val: gid = %u\n", (unsigned int)paie->unix_ug.gid ));
103 return (uint32)paie->unix_ug.gid;
106 DEBUG(10,("get_pai_entry_val: world ace\n"));
111 /************************************************************************
112 Return a uint32 of the entry principal.
113 ************************************************************************/
115 static uint32 get_entry_val(canon_ace *ace_entry)
117 switch (ace_entry->owner_type) {
119 DEBUG(10,("get_entry_val: uid = %u\n", (unsigned int)ace_entry->unix_ug.uid ));
120 return (uint32)ace_entry->unix_ug.uid;
122 DEBUG(10,("get_entry_val: gid = %u\n", (unsigned int)ace_entry->unix_ug.gid ));
123 return (uint32)ace_entry->unix_ug.gid;
126 DEBUG(10,("get_entry_val: world ace\n"));
131 /************************************************************************
132 Count the inherited entries.
133 ************************************************************************/
135 static unsigned int num_inherited_entries(canon_ace *ace_list)
137 unsigned int num_entries = 0;
139 for (; ace_list; ace_list = ace_list->next)
140 if (ace_list->inherited)
145 /************************************************************************
146 Create the on-disk format. Caller must free.
147 ************************************************************************/
149 static char *create_pai_buf(canon_ace *file_ace_list, canon_ace *dir_ace_list, BOOL protected, size_t *store_size)
151 char *pai_buf = NULL;
152 canon_ace *ace_list = NULL;
153 char *entry_offset = NULL;
154 unsigned int num_entries = 0;
155 unsigned int num_def_entries = 0;
157 for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next)
158 if (ace_list->inherited)
161 for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next)
162 if (ace_list->inherited)
165 DEBUG(10,("create_pai_buf: num_entries = %u, num_def_entries = %u\n", num_entries, num_def_entries ));
167 *store_size = PAI_ENTRIES_BASE + ((num_entries + num_def_entries)*PAI_ENTRY_LENGTH);
169 pai_buf = malloc(*store_size);
174 /* Set up the header. */
175 memset(pai_buf, '\0', PAI_ENTRIES_BASE);
176 SCVAL(pai_buf,PAI_VERSION_OFFSET,PAI_VERSION);
177 SCVAL(pai_buf,PAI_FLAG_OFFSET,(protected ? PAI_ACL_FLAG_PROTECTED : 0));
178 SSVAL(pai_buf,PAI_NUM_ENTRIES_OFFSET,num_entries);
179 SSVAL(pai_buf,PAI_NUM_DEFAULT_ENTRIES_OFFSET,num_def_entries);
181 entry_offset = pai_buf + PAI_ENTRIES_BASE;
183 for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next) {
184 if (ace_list->inherited) {
185 uint8 type_val = (unsigned char)ace_list->owner_type;
186 uint32 entry_val = get_entry_val(ace_list);
188 SCVAL(entry_offset,0,type_val);
189 SIVAL(entry_offset,1,entry_val);
190 entry_offset += PAI_ENTRY_LENGTH;
194 for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next) {
195 if (ace_list->inherited) {
196 uint8 type_val = (unsigned char)ace_list->owner_type;
197 uint32 entry_val = get_entry_val(ace_list);
199 SCVAL(entry_offset,0,type_val);
200 SIVAL(entry_offset,1,entry_val);
201 entry_offset += PAI_ENTRY_LENGTH;
208 /************************************************************************
209 Store the user.SAMBA_PAI attribute on disk.
210 ************************************************************************/
212 static void store_inheritance_attributes(files_struct *fsp, canon_ace *file_ace_list,
213 canon_ace *dir_ace_list, BOOL protected)
219 if (!lp_map_acl_inherit(SNUM(fsp->conn)))
223 * Don't store if this ACL isn't protected and
224 * none of the entries in it are marked as inherited.
227 if (!protected && num_inherited_entries(file_ace_list) == 0 && num_inherited_entries(dir_ace_list) == 0) {
228 /* Instead just remove the attribute if it exists. */
230 SMB_VFS_FREMOVEXATTR(fsp, fsp->fd, SAMBA_POSIX_INHERITANCE_EA_NAME);
232 SMB_VFS_REMOVEXATTR(fsp->conn, fsp->fsp_name, SAMBA_POSIX_INHERITANCE_EA_NAME);
236 pai_buf = create_pai_buf(file_ace_list, dir_ace_list, protected, &store_size);
239 ret = SMB_VFS_FSETXATTR(fsp, fsp->fd, SAMBA_POSIX_INHERITANCE_EA_NAME,
240 pai_buf, store_size, 0);
242 ret = SMB_VFS_SETXATTR(fsp->conn,fsp->fsp_name, SAMBA_POSIX_INHERITANCE_EA_NAME,
243 pai_buf, store_size, 0);
247 DEBUG(10,("store_inheritance_attribute:%s for file %s\n", protected ? " (protected)" : "", fsp->fsp_name));
248 if (ret == -1 && !no_acl_syscall_error(errno))
249 DEBUG(1,("store_inheritance_attribute: Error %s\n", strerror(errno) ));
252 /************************************************************************
253 Delete the in memory inheritance info.
254 ************************************************************************/
256 static void free_inherited_info(struct pai_val *pal)
259 struct pai_entry *paie, *paie_next;
260 for (paie = pal->entry_list; paie; paie = paie_next) {
261 paie_next = paie->next;
264 for (paie = pal->def_entry_list; paie; paie = paie_next) {
265 paie_next = paie->next;
272 /************************************************************************
273 Was this ACL protected ?
274 ************************************************************************/
276 static BOOL get_protected_flag(struct pai_val *pal)
280 return pal->protected;
283 /************************************************************************
284 Was this ACE inherited ?
285 ************************************************************************/
287 static BOOL get_inherited_flag(struct pai_val *pal, canon_ace *ace_entry, BOOL default_ace)
289 struct pai_entry *paie;
294 /* If the entry exists it is inherited. */
295 for (paie = (default_ace ? pal->def_entry_list : pal->entry_list); paie; paie = paie->next) {
296 if (ace_entry->owner_type == paie->owner_type &&
297 get_entry_val(ace_entry) == get_pai_entry_val(paie))
303 /************************************************************************
304 Ensure an attribute just read is valid.
305 ************************************************************************/
307 static BOOL check_pai_ok(char *pai_buf, size_t pai_buf_data_size)
310 uint16 num_def_entries;
312 if (pai_buf_data_size < PAI_ENTRIES_BASE) {
313 /* Corrupted - too small. */
317 if (CVAL(pai_buf,PAI_VERSION_OFFSET) != PAI_VERSION)
320 num_entries = SVAL(pai_buf,PAI_NUM_ENTRIES_OFFSET);
321 num_def_entries = SVAL(pai_buf,PAI_NUM_DEFAULT_ENTRIES_OFFSET);
323 /* Check the entry lists match. */
324 /* Each entry is 5 bytes (type plus 4 bytes of uid or gid). */
326 if (((num_entries + num_def_entries)*PAI_ENTRY_LENGTH) + PAI_ENTRIES_BASE != pai_buf_data_size)
333 /************************************************************************
334 Convert to in-memory format.
335 ************************************************************************/
337 static struct pai_val *create_pai_val(char *buf, size_t size)
340 struct pai_val *paiv = NULL;
343 if (!check_pai_ok(buf, size))
346 paiv = malloc(sizeof(struct pai_val));
350 memset(paiv, '\0', sizeof(struct pai_val));
352 paiv->protected = (CVAL(buf,PAI_FLAG_OFFSET) == PAI_ACL_FLAG_PROTECTED);
354 paiv->num_entries = SVAL(buf,PAI_NUM_ENTRIES_OFFSET);
355 paiv->num_def_entries = SVAL(buf,PAI_NUM_DEFAULT_ENTRIES_OFFSET);
357 entry_offset = buf + PAI_ENTRIES_BASE;
359 DEBUG(10,("create_pai_val:%s num_entries = %u, num_def_entries = %u\n",
360 paiv->protected ? " (protected)" : "", paiv->num_entries, paiv->num_def_entries ));
362 for (i = 0; i < paiv->num_entries; i++) {
363 struct pai_entry *paie;
365 paie = malloc(sizeof(struct pai_entry));
367 free_inherited_info(paiv);
371 paie->owner_type = (enum ace_owner)CVAL(entry_offset,0);
372 switch( paie->owner_type) {
374 paie->unix_ug.uid = (uid_t)IVAL(entry_offset,1);
375 DEBUG(10,("create_pai_val: uid = %u\n", (unsigned int)paie->unix_ug.uid ));
378 paie->unix_ug.gid = (gid_t)IVAL(entry_offset,1);
379 DEBUG(10,("create_pai_val: gid = %u\n", (unsigned int)paie->unix_ug.gid ));
382 paie->unix_ug.world = -1;
383 DEBUG(10,("create_pai_val: world ace\n"));
386 free_inherited_info(paiv);
389 entry_offset += PAI_ENTRY_LENGTH;
390 DLIST_ADD(paiv->entry_list, paie);
393 for (i = 0; i < paiv->num_def_entries; i++) {
394 struct pai_entry *paie;
396 paie = malloc(sizeof(struct pai_entry));
398 free_inherited_info(paiv);
402 paie->owner_type = (enum ace_owner)CVAL(entry_offset,0);
403 switch( paie->owner_type) {
405 paie->unix_ug.uid = (uid_t)IVAL(entry_offset,1);
406 DEBUG(10,("create_pai_val: (def) uid = %u\n", (unsigned int)paie->unix_ug.uid ));
409 paie->unix_ug.gid = (gid_t)IVAL(entry_offset,1);
410 DEBUG(10,("create_pai_val: (def) gid = %u\n", (unsigned int)paie->unix_ug.gid ));
413 paie->unix_ug.world = -1;
414 DEBUG(10,("create_pai_val: (def) world ace\n"));
417 free_inherited_info(paiv);
420 entry_offset += PAI_ENTRY_LENGTH;
421 DLIST_ADD(paiv->def_entry_list, paie);
427 /************************************************************************
428 Load the user.SAMBA_PAI attribute.
429 ************************************************************************/
431 static struct pai_val *load_inherited_info(files_struct *fsp)
434 size_t pai_buf_size = 1024;
435 struct pai_val *paiv = NULL;
438 if (!lp_map_acl_inherit(SNUM(fsp->conn)))
441 if ((pai_buf = malloc(pai_buf_size)) == NULL)
446 ret = SMB_VFS_FGETXATTR(fsp, fsp->fd, SAMBA_POSIX_INHERITANCE_EA_NAME,
447 pai_buf, pai_buf_size);
449 ret = SMB_VFS_GETXATTR(fsp->conn,fsp->fsp_name,SAMBA_POSIX_INHERITANCE_EA_NAME,
450 pai_buf, pai_buf_size);
453 if (errno != ERANGE) {
456 /* Buffer too small - enlarge it. */
459 if ((pai_buf = malloc(pai_buf_size)) == NULL)
464 DEBUG(10,("load_inherited_info: ret = %lu for file %s\n", (unsigned long)ret, fsp->fsp_name));
467 /* No attribute or not supported. */
469 if (errno != ENOATTR)
470 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
473 DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
479 paiv = create_pai_val(pai_buf, ret);
481 if (paiv && paiv->protected)
482 DEBUG(10,("load_inherited_info: ACL is protected for file %s\n", fsp->fsp_name));
488 /****************************************************************************
489 Functions to manipulate the internal ACE format.
490 ****************************************************************************/
492 /****************************************************************************
493 Count a linked list of canonical ACE entries.
494 ****************************************************************************/
496 static size_t count_canon_ace_list( canon_ace *list_head )
501 for (ace = list_head; ace; ace = ace->next)
507 /****************************************************************************
508 Free a linked list of canonical ACE entries.
509 ****************************************************************************/
511 static void free_canon_ace_list( canon_ace *list_head )
514 canon_ace *old_head = list_head;
515 DLIST_REMOVE(list_head, list_head);
520 /****************************************************************************
521 Function to duplicate a canon_ace entry.
522 ****************************************************************************/
524 static canon_ace *dup_canon_ace( canon_ace *src_ace)
526 canon_ace *dst_ace = (canon_ace *)malloc(sizeof(canon_ace));
532 dst_ace->prev = dst_ace->next = NULL;
536 /****************************************************************************
537 Print out a canon ace.
538 ****************************************************************************/
540 static void print_canon_ace(canon_ace *pace, int num)
544 dbgtext( "canon_ace index %d. Type = %s ", num, pace->attr == ALLOW_ACE ? "allow" : "deny" );
545 dbgtext( "SID = %s ", sid_to_string( str, &pace->trustee));
546 if (pace->owner_type == UID_ACE) {
547 const char *u_name = uidtoname(pace->unix_ug.uid);
548 dbgtext( "uid %u (%s) ", (unsigned int)pace->unix_ug.uid, u_name );
549 } else if (pace->owner_type == GID_ACE) {
550 char *g_name = gidtoname(pace->unix_ug.gid);
551 dbgtext( "gid %u (%s) ", (unsigned int)pace->unix_ug.gid, g_name );
554 switch (pace->type) {
556 dbgtext( "SMB_ACL_USER ");
558 case SMB_ACL_USER_OBJ:
559 dbgtext( "SMB_ACL_USER_OBJ ");
562 dbgtext( "SMB_ACL_GROUP ");
564 case SMB_ACL_GROUP_OBJ:
565 dbgtext( "SMB_ACL_GROUP_OBJ ");
568 dbgtext( "SMB_ACL_OTHER ");
572 dbgtext( "(inherited) ");
574 dbgtext( "%c", pace->perms & S_IRUSR ? 'r' : '-');
575 dbgtext( "%c", pace->perms & S_IWUSR ? 'w' : '-');
576 dbgtext( "%c\n", pace->perms & S_IXUSR ? 'x' : '-');
579 /****************************************************************************
580 Print out a canon ace list.
581 ****************************************************************************/
583 static void print_canon_ace_list(const char *name, canon_ace *ace_list)
587 if( DEBUGLVL( 10 )) {
588 dbgtext( "print_canon_ace_list: %s\n", name );
589 for (;ace_list; ace_list = ace_list->next, count++)
590 print_canon_ace(ace_list, count );
594 /****************************************************************************
595 Map POSIX ACL perms to canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits).
596 ****************************************************************************/
598 static mode_t convert_permset_to_mode_t(connection_struct *conn, SMB_ACL_PERMSET_T permset)
602 ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ) ? S_IRUSR : 0);
603 ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE) ? S_IWUSR : 0);
604 ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_EXECUTE) ? S_IXUSR : 0);
609 /****************************************************************************
610 Map generic UNIX permissions to canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits).
611 ****************************************************************************/
613 static mode_t unix_perms_to_acl_perms(mode_t mode, int r_mask, int w_mask, int x_mask)
627 /****************************************************************************
628 Map canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits) to
629 an SMB_ACL_PERMSET_T.
630 ****************************************************************************/
632 static int map_acl_perms_to_permset(connection_struct *conn, mode_t mode, SMB_ACL_PERMSET_T *p_permset)
634 if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn, *p_permset) == -1)
636 if (mode & S_IRUSR) {
637 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_READ) == -1)
640 if (mode & S_IWUSR) {
641 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_WRITE) == -1)
644 if (mode & S_IXUSR) {
645 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_EXECUTE) == -1)
650 /****************************************************************************
651 Function to create owner and group SIDs from a SMB_STRUCT_STAT.
652 ****************************************************************************/
654 static void create_file_sids(SMB_STRUCT_STAT *psbuf, DOM_SID *powner_sid, DOM_SID *pgroup_sid)
656 uid_to_sid( powner_sid, psbuf->st_uid );
657 gid_to_sid( pgroup_sid, psbuf->st_gid );
660 /****************************************************************************
661 Merge aces with a common sid - if both are allow or deny, OR the permissions together and
662 delete the second one. If the first is deny, mask the permissions off and delete the allow
663 if the permissions become zero, delete the deny if the permissions are non zero.
664 ****************************************************************************/
666 static void merge_aces( canon_ace **pp_list_head )
668 canon_ace *list_head = *pp_list_head;
669 canon_ace *curr_ace_outer;
670 canon_ace *curr_ace_outer_next;
673 * First, merge allow entries with identical SIDs, and deny entries
674 * with identical SIDs.
677 for (curr_ace_outer = list_head; curr_ace_outer; curr_ace_outer = curr_ace_outer_next) {
679 canon_ace *curr_ace_next;
681 curr_ace_outer_next = curr_ace_outer->next; /* Save the link in case we delete. */
683 for (curr_ace = curr_ace_outer->next; curr_ace; curr_ace = curr_ace_next) {
685 curr_ace_next = curr_ace->next; /* Save the link in case of delete. */
687 if (sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
688 (curr_ace->attr == curr_ace_outer->attr)) {
690 if( DEBUGLVL( 10 )) {
691 dbgtext("merge_aces: Merging ACE's\n");
692 print_canon_ace( curr_ace_outer, 0);
693 print_canon_ace( curr_ace, 0);
696 /* Merge two allow or two deny ACE's. */
698 curr_ace_outer->perms |= curr_ace->perms;
699 DLIST_REMOVE(list_head, curr_ace);
701 curr_ace_outer_next = curr_ace_outer->next; /* We may have deleted the link. */
707 * Now go through and mask off allow permissions with deny permissions.
708 * We can delete either the allow or deny here as we know that each SID
709 * appears only once in the list.
712 for (curr_ace_outer = list_head; curr_ace_outer; curr_ace_outer = curr_ace_outer_next) {
714 canon_ace *curr_ace_next;
716 curr_ace_outer_next = curr_ace_outer->next; /* Save the link in case we delete. */
718 for (curr_ace = curr_ace_outer->next; curr_ace; curr_ace = curr_ace_next) {
720 curr_ace_next = curr_ace->next; /* Save the link in case of delete. */
723 * Subtract ACE's with different entries. Due to the ordering constraints
724 * we've put on the ACL, we know the deny must be the first one.
727 if (sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
728 (curr_ace_outer->attr == DENY_ACE) && (curr_ace->attr == ALLOW_ACE)) {
730 if( DEBUGLVL( 10 )) {
731 dbgtext("merge_aces: Masking ACE's\n");
732 print_canon_ace( curr_ace_outer, 0);
733 print_canon_ace( curr_ace, 0);
736 curr_ace->perms &= ~curr_ace_outer->perms;
738 if (curr_ace->perms == 0) {
741 * The deny overrides the allow. Remove the allow.
744 DLIST_REMOVE(list_head, curr_ace);
746 curr_ace_outer_next = curr_ace_outer->next; /* We may have deleted the link. */
751 * Even after removing permissions, there
752 * are still allow permissions - delete the deny.
753 * It is safe to delete the deny here,
754 * as we are guarenteed by the deny first
755 * ordering that all the deny entries for
756 * this SID have already been merged into one
757 * before we can get to an allow ace.
760 DLIST_REMOVE(list_head, curr_ace_outer);
761 SAFE_FREE(curr_ace_outer);
766 } /* end for curr_ace */
767 } /* end for curr_ace_outer */
769 /* We may have modified the list. */
771 *pp_list_head = list_head;
774 /****************************************************************************
775 Check if we need to return NT4.x compatible ACL entries.
776 ****************************************************************************/
778 static BOOL nt4_compatible_acls(void)
780 const char *compat = lp_acl_compatibility();
782 if (*compat == '\0') {
783 enum remote_arch_types ra_type = get_remote_arch();
785 /* Automatically adapt to client */
786 return (ra_type <= RA_WINNT);
788 return (strequal(compat, "winnt"));
792 /****************************************************************************
793 Map canon_ace perms to permission bits NT.
794 The attr element is not used here - we only process deny entries on set,
795 not get. Deny entries are implicit on get with ace->perms = 0.
796 ****************************************************************************/
798 static SEC_ACCESS map_canon_ace_perms(int *pacl_type, DOM_SID *powner_sid, canon_ace *ace)
803 *pacl_type = SEC_ACE_TYPE_ACCESS_ALLOWED;
805 if ((ace->perms & ALL_ACE_PERMS) == ALL_ACE_PERMS) {
806 nt_mask = UNIX_ACCESS_RWX;
807 } else if ((ace->perms & ALL_ACE_PERMS) == (mode_t)0) {
809 * Windows NT refuses to display ACEs with no permissions in them (but
810 * they are perfectly legal with Windows 2000). If the ACE has empty
811 * permissions we cannot use 0, so we use the otherwise unused
812 * WRITE_OWNER permission, which we ignore when we set an ACL.
813 * We abstract this into a #define of UNIX_ACCESS_NONE to allow this
814 * to be changed in the future.
817 if (nt4_compatible_acls())
818 nt_mask = UNIX_ACCESS_NONE;
822 nt_mask |= ((ace->perms & S_IRUSR) ? UNIX_ACCESS_R : 0 );
823 nt_mask |= ((ace->perms & S_IWUSR) ? UNIX_ACCESS_W : 0 );
824 nt_mask |= ((ace->perms & S_IXUSR) ? UNIX_ACCESS_X : 0 );
827 DEBUG(10,("map_canon_ace_perms: Mapped (UNIX) %x to (NT) %x\n",
828 (unsigned int)ace->perms, (unsigned int)nt_mask ));
830 init_sec_access(&sa,nt_mask);
834 /****************************************************************************
835 Map NT perms to a UNIX mode_t.
836 ****************************************************************************/
838 #define FILE_SPECIFIC_READ_BITS (FILE_READ_DATA|FILE_READ_EA|FILE_READ_ATTRIBUTES)
839 #define FILE_SPECIFIC_WRITE_BITS (FILE_WRITE_DATA|FILE_APPEND_DATA|FILE_WRITE_EA|FILE_WRITE_ATTRIBUTES)
840 #define FILE_SPECIFIC_EXECUTE_BITS (FILE_EXECUTE)
842 static mode_t map_nt_perms( SEC_ACCESS sec_access, int type)
848 if(sec_access.mask & GENERIC_ALL_ACCESS)
849 mode = S_IRUSR|S_IWUSR|S_IXUSR;
851 mode |= (sec_access.mask & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IRUSR : 0;
852 mode |= (sec_access.mask & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWUSR : 0;
853 mode |= (sec_access.mask & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXUSR : 0;
857 if(sec_access.mask & GENERIC_ALL_ACCESS)
858 mode = S_IRGRP|S_IWGRP|S_IXGRP;
860 mode |= (sec_access.mask & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IRGRP : 0;
861 mode |= (sec_access.mask & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWGRP : 0;
862 mode |= (sec_access.mask & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXGRP : 0;
866 if(sec_access.mask & GENERIC_ALL_ACCESS)
867 mode = S_IROTH|S_IWOTH|S_IXOTH;
869 mode |= (sec_access.mask & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IROTH : 0;
870 mode |= (sec_access.mask & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWOTH : 0;
871 mode |= (sec_access.mask & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXOTH : 0;
879 /****************************************************************************
880 Unpack a SEC_DESC into a UNIX owner and group.
881 ****************************************************************************/
883 static BOOL unpack_nt_owners(int snum, SMB_STRUCT_STAT *psbuf, uid_t *puser, gid_t *pgrp, uint32 security_info_sent, SEC_DESC *psd)
891 if(security_info_sent == 0) {
892 DEBUG(0,("unpack_nt_owners: no security info sent !\n"));
897 * Validate the owner and group SID's.
900 memset(&owner_sid, '\0', sizeof(owner_sid));
901 memset(&grp_sid, '\0', sizeof(grp_sid));
903 DEBUG(5,("unpack_nt_owners: validating owner_sids.\n"));
906 * Don't immediately fail if the owner sid cannot be validated.
907 * This may be a group chown only set.
910 if (security_info_sent & OWNER_SECURITY_INFORMATION) {
911 sid_copy(&owner_sid, psd->owner_sid);
912 if (!NT_STATUS_IS_OK(sid_to_uid(&owner_sid, puser))) {
913 if (lp_force_unknown_acl_user(snum)) {
914 /* this allows take ownership to work
916 extern struct current_user current_user;
917 *puser = current_user.uid;
919 DEBUG(3,("unpack_nt_owners: unable to validate"
920 " owner sid for %s\n",
921 sid_string_static(&owner_sid)));
928 * Don't immediately fail if the group sid cannot be validated.
929 * This may be an owner chown only set.
932 if (security_info_sent & GROUP_SECURITY_INFORMATION) {
933 sid_copy(&grp_sid, psd->grp_sid);
934 if (!NT_STATUS_IS_OK(sid_to_gid( &grp_sid, pgrp))) {
935 if (lp_force_unknown_acl_user(snum)) {
936 /* this allows take group ownership to work
938 extern struct current_user current_user;
939 *pgrp = current_user.gid;
941 DEBUG(3,("unpack_nt_owners: unable to validate"
948 DEBUG(5,("unpack_nt_owners: owner_sids validated.\n"));
953 /****************************************************************************
954 Ensure the enforced permissions for this share apply.
955 ****************************************************************************/
957 static void apply_default_perms(files_struct *fsp, canon_ace *pace, mode_t type)
959 int snum = SNUM(fsp->conn);
960 mode_t and_bits = (mode_t)0;
961 mode_t or_bits = (mode_t)0;
963 /* Get the initial bits to apply. */
965 if (fsp->is_directory) {
966 and_bits = lp_dir_security_mask(snum);
967 or_bits = lp_force_dir_security_mode(snum);
969 and_bits = lp_security_mask(snum);
970 or_bits = lp_force_security_mode(snum);
973 /* Now bounce them into the S_USR space. */
976 /* Ensure owner has read access. */
977 pace->perms |= S_IRUSR;
978 if (fsp->is_directory)
979 pace->perms |= (S_IWUSR|S_IXUSR);
980 and_bits = unix_perms_to_acl_perms(and_bits, S_IRUSR, S_IWUSR, S_IXUSR);
981 or_bits = unix_perms_to_acl_perms(or_bits, S_IRUSR, S_IWUSR, S_IXUSR);
984 and_bits = unix_perms_to_acl_perms(and_bits, S_IRGRP, S_IWGRP, S_IXGRP);
985 or_bits = unix_perms_to_acl_perms(or_bits, S_IRGRP, S_IWGRP, S_IXGRP);
988 and_bits = unix_perms_to_acl_perms(and_bits, S_IROTH, S_IWOTH, S_IXOTH);
989 or_bits = unix_perms_to_acl_perms(or_bits, S_IROTH, S_IWOTH, S_IXOTH);
993 pace->perms = ((pace->perms & and_bits)|or_bits);
996 /****************************************************************************
997 Check if a given uid/SID is in a group gid/SID. This is probably very
998 expensive and will need optimisation. A *lot* of optimisation :-). JRA.
999 ****************************************************************************/
1001 static BOOL uid_entry_in_group( canon_ace *uid_ace, canon_ace *group_ace )
1003 extern DOM_SID global_sid_World;
1006 extern struct current_user current_user;
1008 /* "Everyone" always matches every uid. */
1010 if (sid_equal(&group_ace->trustee, &global_sid_World))
1013 /* Assume that the current user is in the current group (force group) */
1015 if (uid_ace->unix_ug.uid == current_user.uid && group_ace->unix_ug.gid == current_user.gid)
1018 fstrcpy(u_name, uidtoname(uid_ace->unix_ug.uid));
1019 fstrcpy(g_name, gidtoname(group_ace->unix_ug.gid));
1022 * Due to the winbind interfaces we need to do this via names,
1026 return user_in_group_list(u_name, g_name, NULL, 0);
1029 /****************************************************************************
1030 A well formed POSIX file or default ACL has at least 3 entries, a
1031 SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ.
1032 In addition, the owner must always have at least read access.
1033 When using this call on get_acl, the pst struct is valid and contains
1034 the mode of the file. When using this call on set_acl, the pst struct has
1035 been modified to have a mode containing the default for this file or directory
1037 ****************************************************************************/
1039 static BOOL ensure_canon_entry_valid(canon_ace **pp_ace,
1041 DOM_SID *pfile_owner_sid,
1042 DOM_SID *pfile_grp_sid,
1043 SMB_STRUCT_STAT *pst,
1046 extern DOM_SID global_sid_World;
1048 BOOL got_user = False;
1049 BOOL got_grp = False;
1050 BOOL got_other = False;
1051 canon_ace *pace_other = NULL;
1052 canon_ace *pace_group = NULL;
1054 for (pace = *pp_ace; pace; pace = pace->next) {
1055 if (pace->type == SMB_ACL_USER_OBJ) {
1058 apply_default_perms(fsp, pace, S_IRUSR);
1061 } else if (pace->type == SMB_ACL_GROUP_OBJ) {
1064 * Ensure create mask/force create mode is respected on set.
1068 apply_default_perms(fsp, pace, S_IRGRP);
1072 } else if (pace->type == SMB_ACL_OTHER) {
1075 * Ensure create mask/force create mode is respected on set.
1079 apply_default_perms(fsp, pace, S_IROTH);
1086 if ((pace = (canon_ace *)malloc(sizeof(canon_ace))) == NULL) {
1087 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1092 pace->type = SMB_ACL_USER_OBJ;
1093 pace->owner_type = UID_ACE;
1094 pace->unix_ug.uid = pst->st_uid;
1095 pace->trustee = *pfile_owner_sid;
1096 pace->attr = ALLOW_ACE;
1099 /* If we only got an "everyone" perm, just use that. */
1100 if (!got_grp && got_other)
1101 pace->perms = pace_other->perms;
1102 else if (got_grp && uid_entry_in_group(pace, pace_group))
1103 pace->perms = pace_group->perms;
1107 apply_default_perms(fsp, pace, S_IRUSR);
1109 pace->perms = unix_perms_to_acl_perms(pst->st_mode, S_IRUSR, S_IWUSR, S_IXUSR);
1112 DLIST_ADD(*pp_ace, pace);
1116 if ((pace = (canon_ace *)malloc(sizeof(canon_ace))) == NULL) {
1117 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1122 pace->type = SMB_ACL_GROUP_OBJ;
1123 pace->owner_type = GID_ACE;
1124 pace->unix_ug.uid = pst->st_gid;
1125 pace->trustee = *pfile_grp_sid;
1126 pace->attr = ALLOW_ACE;
1128 /* If we only got an "everyone" perm, just use that. */
1130 pace->perms = pace_other->perms;
1133 apply_default_perms(fsp, pace, S_IRGRP);
1135 pace->perms = unix_perms_to_acl_perms(pst->st_mode, S_IRGRP, S_IWGRP, S_IXGRP);
1138 DLIST_ADD(*pp_ace, pace);
1142 if ((pace = (canon_ace *)malloc(sizeof(canon_ace))) == NULL) {
1143 DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1148 pace->type = SMB_ACL_OTHER;
1149 pace->owner_type = WORLD_ACE;
1150 pace->unix_ug.world = -1;
1151 pace->trustee = global_sid_World;
1152 pace->attr = ALLOW_ACE;
1155 apply_default_perms(fsp, pace, S_IROTH);
1157 pace->perms = unix_perms_to_acl_perms(pst->st_mode, S_IROTH, S_IWOTH, S_IXOTH);
1159 DLIST_ADD(*pp_ace, pace);
1165 /****************************************************************************
1166 Check if a POSIX ACL has the required SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries.
1167 If it does not have them, check if there are any entries where the trustee is the
1168 file owner or the owning group, and map these to SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ.
1169 ****************************************************************************/
1171 static void check_owning_objs(canon_ace *ace, DOM_SID *pfile_owner_sid, DOM_SID *pfile_grp_sid)
1173 BOOL got_user_obj, got_group_obj;
1174 canon_ace *current_ace;
1177 entries = count_canon_ace_list(ace);
1178 got_user_obj = False;
1179 got_group_obj = False;
1181 for (i=0, current_ace = ace; i < entries; i++, current_ace = current_ace->next) {
1182 if (current_ace->type == SMB_ACL_USER_OBJ)
1183 got_user_obj = True;
1184 else if (current_ace->type == SMB_ACL_GROUP_OBJ)
1185 got_group_obj = True;
1187 if (got_user_obj && got_group_obj) {
1188 DEBUG(10,("check_owning_objs: ACL had owning user/group entries.\n"));
1192 for (i=0, current_ace = ace; i < entries; i++, current_ace = current_ace->next) {
1193 if (!got_user_obj && current_ace->owner_type == UID_ACE &&
1194 sid_equal(¤t_ace->trustee, pfile_owner_sid)) {
1195 current_ace->type = SMB_ACL_USER_OBJ;
1196 got_user_obj = True;
1198 if (!got_group_obj && current_ace->owner_type == GID_ACE &&
1199 sid_equal(¤t_ace->trustee, pfile_grp_sid)) {
1200 current_ace->type = SMB_ACL_GROUP_OBJ;
1201 got_group_obj = True;
1205 DEBUG(10,("check_owning_objs: ACL is missing an owner entry.\n"));
1207 DEBUG(10,("check_owning_objs: ACL is missing an owning group entry.\n"));
1210 /****************************************************************************
1211 Unpack a SEC_DESC into two canonical ace lists.
1212 ****************************************************************************/
1214 static BOOL create_canon_ace_lists(files_struct *fsp, SMB_STRUCT_STAT *pst,
1215 DOM_SID *pfile_owner_sid,
1216 DOM_SID *pfile_grp_sid,
1217 canon_ace **ppfile_ace, canon_ace **ppdir_ace,
1220 extern DOM_SID global_sid_Creator_Owner;
1221 extern DOM_SID global_sid_Creator_Group;
1222 extern DOM_SID global_sid_World;
1223 extern struct generic_mapping file_generic_mapping;
1224 BOOL all_aces_are_inherit_only = (fsp->is_directory ? True : False);
1225 canon_ace *file_ace = NULL;
1226 canon_ace *dir_ace = NULL;
1227 canon_ace *tmp_ace = NULL;
1228 canon_ace *current_ace = NULL;
1229 BOOL got_dir_allow = False;
1230 BOOL got_file_allow = False;
1237 * Convert the incoming ACL into a more regular form.
1240 for(i = 0; i < dacl->num_aces; i++) {
1241 SEC_ACE *psa = &dacl->ace[i];
1243 if((psa->type != SEC_ACE_TYPE_ACCESS_ALLOWED) && (psa->type != SEC_ACE_TYPE_ACCESS_DENIED)) {
1244 DEBUG(3,("create_canon_ace_lists: unable to set anything but an ALLOW or DENY ACE.\n"));
1248 if (nt4_compatible_acls()) {
1250 * The security mask may be UNIX_ACCESS_NONE which should map into
1251 * no permissions (we overload the WRITE_OWNER bit for this) or it
1252 * should be one of the ALL/EXECUTE/READ/WRITE bits. Arrange for this
1253 * to be so. Any other bits override the UNIX_ACCESS_NONE bit.
1257 * Convert GENERIC bits to specific bits.
1260 se_map_generic(&psa->info.mask, &file_generic_mapping);
1262 psa->info.mask &= (UNIX_ACCESS_NONE|FILE_ALL_ACCESS);
1264 if(psa->info.mask != UNIX_ACCESS_NONE)
1265 psa->info.mask &= ~UNIX_ACCESS_NONE;
1270 * Deal with the fact that NT 4.x re-writes the canonical format
1271 * that we return for default ACLs. If a directory ACE is identical
1272 * to a inherited directory ACE then NT changes the bits so that the
1273 * first ACE is set to OI|IO and the second ACE for this SID is set
1274 * to CI. We need to repair this. JRA.
1277 for(i = 0; i < dacl->num_aces; i++) {
1278 SEC_ACE *psa1 = &dacl->ace[i];
1280 for (j = i + 1; j < dacl->num_aces; j++) {
1281 SEC_ACE *psa2 = &dacl->ace[j];
1283 if (psa1->info.mask != psa2->info.mask)
1286 if (!sid_equal(&psa1->trustee, &psa2->trustee))
1290 * Ok - permission bits and SIDs are equal.
1291 * Check if flags were re-written.
1294 if (psa1->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
1296 psa1->flags |= (psa2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT));
1297 psa2->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT);
1299 } else if (psa2->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
1301 psa2->flags |= (psa1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT));
1302 psa1->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT);
1308 for(i = 0; i < dacl->num_aces; i++) {
1309 SEC_ACE *psa = &dacl->ace[i];
1312 * Ignore non-mappable SIDs (NT Authority, BUILTIN etc).
1315 if (non_mappable_sid(&psa->trustee)) {
1317 DEBUG(10,("create_canon_ace_lists: ignoring non-mappable SID %s\n",
1318 sid_to_string(str, &psa->trustee) ));
1323 * Create a cannon_ace entry representing this NT DACL ACE.
1326 if ((current_ace = (canon_ace *)malloc(sizeof(canon_ace))) == NULL) {
1327 free_canon_ace_list(file_ace);
1328 free_canon_ace_list(dir_ace);
1329 DEBUG(0,("create_canon_ace_lists: malloc fail.\n"));
1333 ZERO_STRUCTP(current_ace);
1335 sid_copy(¤t_ace->trustee, &psa->trustee);
1338 * Try and work out if the SID is a user or group
1339 * as we need to flag these differently for POSIX.
1340 * Note what kind of a POSIX ACL this should map to.
1343 if( sid_equal(¤t_ace->trustee, &global_sid_World)) {
1344 current_ace->owner_type = WORLD_ACE;
1345 current_ace->unix_ug.world = -1;
1346 current_ace->type = SMB_ACL_OTHER;
1347 } else if (sid_equal(¤t_ace->trustee, &global_sid_Creator_Owner)) {
1348 current_ace->owner_type = UID_ACE;
1349 current_ace->unix_ug.uid = pst->st_uid;
1350 current_ace->type = SMB_ACL_USER_OBJ;
1353 * The Creator Owner entry only specifies inheritable permissions,
1354 * never access permissions. WinNT doesn't always set the ACE to
1355 *INHERIT_ONLY, though.
1358 if (nt4_compatible_acls())
1359 psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
1360 } else if (sid_equal(¤t_ace->trustee, &global_sid_Creator_Group)) {
1361 current_ace->owner_type = GID_ACE;
1362 current_ace->unix_ug.gid = pst->st_gid;
1363 current_ace->type = SMB_ACL_GROUP_OBJ;
1366 * The Creator Group entry only specifies inheritable permissions,
1367 * never access permissions. WinNT doesn't always set the ACE to
1368 *INHERIT_ONLY, though.
1370 if (nt4_compatible_acls())
1371 psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
1373 } else if (NT_STATUS_IS_OK(sid_to_uid( ¤t_ace->trustee, ¤t_ace->unix_ug.uid))) {
1374 current_ace->owner_type = UID_ACE;
1375 current_ace->type = SMB_ACL_USER;
1376 } else if (NT_STATUS_IS_OK(sid_to_gid( ¤t_ace->trustee, ¤t_ace->unix_ug.gid))) {
1377 current_ace->owner_type = GID_ACE;
1378 current_ace->type = SMB_ACL_GROUP;
1382 free_canon_ace_list(file_ace);
1383 free_canon_ace_list(dir_ace);
1384 DEBUG(0,("create_canon_ace_lists: unable to map SID %s to uid or gid.\n",
1385 sid_to_string(str, ¤t_ace->trustee) ));
1386 SAFE_FREE(current_ace);
1391 * Map the given NT permissions into a UNIX mode_t containing only
1392 * S_I(R|W|X)USR bits.
1395 current_ace->perms |= map_nt_perms( psa->info, S_IRUSR);
1396 current_ace->attr = (psa->type == SEC_ACE_TYPE_ACCESS_ALLOWED) ? ALLOW_ACE : DENY_ACE;
1397 current_ace->inherited = ((psa->flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False);
1400 * Now add the created ace to either the file list, the directory
1401 * list, or both. We *MUST* preserve the order here (hence we use
1402 * DLIST_ADD_END) as NT ACLs are order dependent.
1405 if (fsp->is_directory) {
1408 * We can only add to the default POSIX ACE list if the ACE is
1409 * designed to be inherited by both files and directories.
1412 if ((psa->flags & (SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT)) ==
1413 (SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT)) {
1415 DLIST_ADD_END(dir_ace, current_ace, tmp_ace);
1418 * Note if this was an allow ace. We can't process
1419 * any further deny ace's after this.
1422 if (current_ace->attr == ALLOW_ACE)
1423 got_dir_allow = True;
1425 if ((current_ace->attr == DENY_ACE) && got_dir_allow) {
1426 DEBUG(0,("create_canon_ace_lists: malformed ACL in inheritable ACL ! \
1427 Deny entry after Allow entry. Failing to set on file %s.\n", fsp->fsp_name ));
1428 free_canon_ace_list(file_ace);
1429 free_canon_ace_list(dir_ace);
1430 SAFE_FREE(current_ace);
1434 if( DEBUGLVL( 10 )) {
1435 dbgtext("create_canon_ace_lists: adding dir ACL:\n");
1436 print_canon_ace( current_ace, 0);
1440 * If this is not an inherit only ACE we need to add a duplicate
1444 if (!(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
1445 canon_ace *dup_ace = dup_canon_ace(current_ace);
1448 DEBUG(0,("create_canon_ace_lists: malloc fail !\n"));
1449 free_canon_ace_list(file_ace);
1450 free_canon_ace_list(dir_ace);
1455 * We must not free current_ace here as its
1456 * pointer is now owned by the dir_ace list.
1458 current_ace = dup_ace;
1461 * We must not free current_ace here as its
1462 * pointer is now owned by the dir_ace list.
1470 * Only add to the file ACL if not inherit only.
1473 if (!(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
1474 DLIST_ADD_END(file_ace, current_ace, tmp_ace);
1477 * Note if this was an allow ace. We can't process
1478 * any further deny ace's after this.
1481 if (current_ace->attr == ALLOW_ACE)
1482 got_file_allow = True;
1484 if ((current_ace->attr == DENY_ACE) && got_file_allow) {
1485 DEBUG(0,("create_canon_ace_lists: malformed ACL in file ACL ! \
1486 Deny entry after Allow entry. Failing to set on file %s.\n", fsp->fsp_name ));
1487 free_canon_ace_list(file_ace);
1488 free_canon_ace_list(dir_ace);
1489 SAFE_FREE(current_ace);
1493 if( DEBUGLVL( 10 )) {
1494 dbgtext("create_canon_ace_lists: adding file ACL:\n");
1495 print_canon_ace( current_ace, 0);
1497 all_aces_are_inherit_only = False;
1499 * We must not free current_ace here as its
1500 * pointer is now owned by the file_ace list.
1506 * Free if ACE was not added.
1509 SAFE_FREE(current_ace);
1512 if (fsp->is_directory && all_aces_are_inherit_only) {
1514 * Windows 2000 is doing one of these weird 'inherit acl'
1515 * traverses to conserve NTFS ACL resources. Just pretend
1516 * there was no DACL sent. JRA.
1519 DEBUG(10,("create_canon_ace_lists: Win2k inherit acl traverse. Ignoring DACL.\n"));
1520 free_canon_ace_list(file_ace);
1521 free_canon_ace_list(dir_ace);
1526 * Check if we have SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries in each
1527 * ACL. If we don't have them, check if any SMB_ACL_USER/SMB_ACL_GROUP
1528 * entries can be converted to *_OBJ. Usually we will already have these
1529 * entries in the Default ACL, and the Access ACL will not have them.
1531 check_owning_objs(file_ace, pfile_owner_sid, pfile_grp_sid);
1532 check_owning_objs(dir_ace, pfile_owner_sid, pfile_grp_sid);
1535 *ppfile_ace = file_ace;
1536 *ppdir_ace = dir_ace;
1541 /****************************************************************************
1542 ASCII art time again... JRA :-).
1544 We have 4 cases to process when moving from an NT ACL to a POSIX ACL. Firstly,
1545 we insist the ACL is in canonical form (ie. all DENY entries preceede ALLOW
1546 entries). Secondly, the merge code has ensured that all duplicate SID entries for
1547 allow or deny have been merged, so the same SID can only appear once in the deny
1548 list or once in the allow list.
1550 We then process as follows :
1552 ---------------------------------------------------------------------------
1553 First pass - look for a Everyone DENY entry.
1555 If it is deny all (rwx) trunate the list at this point.
1556 Else, walk the list from this point and use the deny permissions of this
1557 entry as a mask on all following allow entries. Finally, delete
1558 the Everyone DENY entry (we have applied it to everything possible).
1560 In addition, in this pass we remove any DENY entries that have
1561 no permissions (ie. they are a DENY nothing).
1562 ---------------------------------------------------------------------------
1563 Second pass - only deal with deny user entries.
1565 DENY user1 (perms XXX)
1568 for all following allow group entries where user1 is in group
1569 new_perms |= group_perms;
1571 user1 entry perms = new_perms & ~ XXX;
1573 Convert the deny entry to an allow entry with the new perms and
1574 push to the end of the list. Note if the user was in no groups
1575 this maps to a specific allow nothing entry for this user.
1577 The common case from the NT ACL choser (userX deny all) is
1578 optimised so we don't do the group lookup - we just map to
1579 an allow nothing entry.
1581 What we're doing here is inferring the allow permissions the
1582 person setting the ACE on user1 wanted by looking at the allow
1583 permissions on the groups the user is currently in. This will
1584 be a snapshot, depending on group membership but is the best
1585 we can do and has the advantage of failing closed rather than
1587 ---------------------------------------------------------------------------
1588 Third pass - only deal with deny group entries.
1590 DENY group1 (perms XXX)
1592 for all following allow user entries where user is in group1
1593 user entry perms = user entry perms & ~ XXX;
1595 If there is a group Everyone allow entry with permissions YYY,
1596 convert the group1 entry to an allow entry and modify its
1599 new_perms = YYY & ~ XXX
1601 and push to the end of the list.
1603 If there is no group Everyone allow entry then convert the
1604 group1 entry to a allow nothing entry and push to the end of the list.
1606 Note that the common case from the NT ACL choser (groupX deny all)
1607 cannot be optimised here as we need to modify user entries who are
1608 in the group to change them to a deny all also.
1610 What we're doing here is modifying the allow permissions of
1611 user entries (which are more specific in POSIX ACLs) to mask
1612 out the explicit deny set on the group they are in. This will
1613 be a snapshot depending on current group membership but is the
1614 best we can do and has the advantage of failing closed rather
1616 ---------------------------------------------------------------------------
1617 Fourth pass - cope with cumulative permissions.
1619 for all allow user entries, if there exists an allow group entry with
1620 more permissive permissions, and the user is in that group, rewrite the
1621 allow user permissions to contain both sets of permissions.
1623 Currently the code for this is #ifdef'ed out as these semantics make
1624 no sense to me. JRA.
1625 ---------------------------------------------------------------------------
1627 Note we *MUST* do the deny user pass first as this will convert deny user
1628 entries into allow user entries which can then be processed by the deny
1631 The above algorithm took a *lot* of thinking about - hence this
1632 explaination :-). JRA.
1633 ****************************************************************************/
1635 /****************************************************************************
1636 Process a canon_ace list entries. This is very complex code. We need
1637 to go through and remove the "deny" permissions from any allow entry that matches
1638 the id of this entry. We have already refused any NT ACL that wasn't in correct
1639 order (DENY followed by ALLOW). If any allow entry ends up with zero permissions,
1640 we just remove it (to fail safe). We have already removed any duplicate ace
1641 entries. Treat an "Everyone" DENY_ACE as a special case - use it to mask all
1643 ****************************************************************************/
1645 static void process_deny_list( canon_ace **pp_ace_list )
1647 extern DOM_SID global_sid_World;
1648 canon_ace *ace_list = *pp_ace_list;
1649 canon_ace *curr_ace = NULL;
1650 canon_ace *curr_ace_next = NULL;
1652 /* Pass 1 above - look for an Everyone, deny entry. */
1654 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
1655 canon_ace *allow_ace_p;
1657 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
1659 if (curr_ace->attr != DENY_ACE)
1662 if (curr_ace->perms == (mode_t)0) {
1664 /* Deny nothing entry - delete. */
1666 DLIST_REMOVE(ace_list, curr_ace);
1670 if (!sid_equal(&curr_ace->trustee, &global_sid_World))
1673 /* JRATEST - assert. */
1674 SMB_ASSERT(curr_ace->owner_type == WORLD_ACE);
1676 if (curr_ace->perms == ALL_ACE_PERMS) {
1679 * Optimisation. This is a DENY_ALL to Everyone. Truncate the
1680 * list at this point including this entry.
1683 canon_ace *prev_entry = curr_ace->prev;
1685 free_canon_ace_list( curr_ace );
1687 prev_entry->next = NULL;
1689 /* We deleted the entire list. */
1695 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
1698 * Only mask off allow entries.
1701 if (allow_ace_p->attr != ALLOW_ACE)
1704 allow_ace_p->perms &= ~curr_ace->perms;
1708 * Now it's been applied, remove it.
1711 DLIST_REMOVE(ace_list, curr_ace);
1714 /* Pass 2 above - deal with deny user entries. */
1716 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
1717 mode_t new_perms = (mode_t)0;
1718 canon_ace *allow_ace_p;
1721 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
1723 if (curr_ace->attr != DENY_ACE)
1726 if (curr_ace->owner_type != UID_ACE)
1729 if (curr_ace->perms == ALL_ACE_PERMS) {
1732 * Optimisation - this is a deny everything to this user.
1733 * Convert to an allow nothing and push to the end of the list.
1736 curr_ace->attr = ALLOW_ACE;
1737 curr_ace->perms = (mode_t)0;
1738 DLIST_DEMOTE(ace_list, curr_ace, tmp_ace);
1742 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
1744 if (allow_ace_p->attr != ALLOW_ACE)
1747 /* We process GID_ACE and WORLD_ACE entries only. */
1749 if (allow_ace_p->owner_type == UID_ACE)
1752 if (uid_entry_in_group( curr_ace, allow_ace_p))
1753 new_perms |= allow_ace_p->perms;
1757 * Convert to a allow entry, modify the perms and push to the end
1761 curr_ace->attr = ALLOW_ACE;
1762 curr_ace->perms = (new_perms & ~curr_ace->perms);
1763 DLIST_DEMOTE(ace_list, curr_ace, tmp_ace);
1766 /* Pass 3 above - deal with deny group entries. */
1768 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
1770 canon_ace *allow_ace_p;
1771 canon_ace *allow_everyone_p = NULL;
1773 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
1775 if (curr_ace->attr != DENY_ACE)
1778 if (curr_ace->owner_type != GID_ACE)
1781 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
1783 if (allow_ace_p->attr != ALLOW_ACE)
1786 /* Store a pointer to the Everyone allow, if it exists. */
1787 if (allow_ace_p->owner_type == WORLD_ACE)
1788 allow_everyone_p = allow_ace_p;
1790 /* We process UID_ACE entries only. */
1792 if (allow_ace_p->owner_type != UID_ACE)
1795 /* Mask off the deny group perms. */
1797 if (uid_entry_in_group( allow_ace_p, curr_ace))
1798 allow_ace_p->perms &= ~curr_ace->perms;
1802 * Convert the deny to an allow with the correct perms and
1803 * push to the end of the list.
1806 curr_ace->attr = ALLOW_ACE;
1807 if (allow_everyone_p)
1808 curr_ace->perms = allow_everyone_p->perms & ~curr_ace->perms;
1810 curr_ace->perms = (mode_t)0;
1811 DLIST_DEMOTE(ace_list, curr_ace, tmp_ace);
1815 /* Doing this fourth pass allows Windows semantics to be layered
1816 * on top of POSIX semantics. I'm not sure if this is desirable.
1817 * For example, in W2K ACLs there is no way to say, "Group X no
1818 * access, user Y full access" if user Y is a member of group X.
1819 * This seems completely broken semantics to me.... JRA.
1823 /* Pass 4 above - deal with allow entries. */
1825 for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
1826 canon_ace *allow_ace_p;
1828 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
1830 if (curr_ace->attr != ALLOW_ACE)
1833 if (curr_ace->owner_type != UID_ACE)
1836 for (allow_ace_p = ace_list; allow_ace_p; allow_ace_p = allow_ace_p->next) {
1838 if (allow_ace_p->attr != ALLOW_ACE)
1841 /* We process GID_ACE entries only. */
1843 if (allow_ace_p->owner_type != GID_ACE)
1846 /* OR in the group perms. */
1848 if (uid_entry_in_group( curr_ace, allow_ace_p))
1849 curr_ace->perms |= allow_ace_p->perms;
1854 *pp_ace_list = ace_list;
1857 /****************************************************************************
1858 Create a default mode that will be used if a security descriptor entry has
1859 no user/group/world entries.
1860 ****************************************************************************/
1862 static mode_t create_default_mode(files_struct *fsp, BOOL interitable_mode)
1864 int snum = SNUM(fsp->conn);
1865 mode_t and_bits = (mode_t)0;
1866 mode_t or_bits = (mode_t)0;
1867 mode_t mode = interitable_mode ? unix_mode( fsp->conn, FILE_ATTRIBUTE_ARCHIVE, fsp->fsp_name, False) : S_IRUSR;
1869 if (fsp->is_directory)
1870 mode |= (S_IWUSR|S_IXUSR);
1873 * Now AND with the create mode/directory mode bits then OR with the
1874 * force create mode/force directory mode bits.
1877 if (fsp->is_directory) {
1878 and_bits = lp_dir_security_mask(snum);
1879 or_bits = lp_force_dir_security_mode(snum);
1881 and_bits = lp_security_mask(snum);
1882 or_bits = lp_force_security_mode(snum);
1885 return ((mode & and_bits)|or_bits);
1888 /****************************************************************************
1889 Unpack a SEC_DESC into two canonical ace lists. We don't depend on this
1891 ****************************************************************************/
1893 static BOOL unpack_canon_ace(files_struct *fsp,
1894 SMB_STRUCT_STAT *pst,
1895 DOM_SID *pfile_owner_sid,
1896 DOM_SID *pfile_grp_sid,
1897 canon_ace **ppfile_ace, canon_ace **ppdir_ace,
1898 uint32 security_info_sent, SEC_DESC *psd)
1900 canon_ace *file_ace = NULL;
1901 canon_ace *dir_ace = NULL;
1906 if(security_info_sent == 0) {
1907 DEBUG(0,("unpack_canon_ace: no security info sent !\n"));
1912 * If no DACL then this is a chown only security descriptor.
1915 if(!(security_info_sent & DACL_SECURITY_INFORMATION) || !psd->dacl)
1919 * Now go through the DACL and create the canon_ace lists.
1922 if (!create_canon_ace_lists( fsp, pst, pfile_owner_sid, pfile_grp_sid,
1923 &file_ace, &dir_ace, psd->dacl))
1926 if ((file_ace == NULL) && (dir_ace == NULL)) {
1927 /* W2K traverse DACL set - ignore. */
1932 * Go through the canon_ace list and merge entries
1933 * belonging to identical users of identical allow or deny type.
1934 * We can do this as all deny entries come first, followed by
1935 * all allow entries (we have mandated this before accepting this acl).
1938 print_canon_ace_list( "file ace - before merge", file_ace);
1939 merge_aces( &file_ace );
1941 print_canon_ace_list( "dir ace - before merge", dir_ace);
1942 merge_aces( &dir_ace );
1945 * NT ACLs are order dependent. Go through the acl lists and
1946 * process DENY entries by masking the allow entries.
1949 print_canon_ace_list( "file ace - before deny", file_ace);
1950 process_deny_list( &file_ace);
1952 print_canon_ace_list( "dir ace - before deny", dir_ace);
1953 process_deny_list( &dir_ace);
1956 * A well formed POSIX file or default ACL has at least 3 entries, a
1957 * SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ
1958 * and optionally a mask entry. Ensure this is the case.
1961 print_canon_ace_list( "file ace - before valid", file_ace);
1964 * A default 3 element mode entry for a file should be r-- --- ---.
1965 * A default 3 element mode entry for a directory should be rwx --- ---.
1968 pst->st_mode = create_default_mode(fsp, False);
1970 if (!ensure_canon_entry_valid(&file_ace, fsp, pfile_owner_sid, pfile_grp_sid, pst, True)) {
1971 free_canon_ace_list(file_ace);
1972 free_canon_ace_list(dir_ace);
1976 print_canon_ace_list( "dir ace - before valid", dir_ace);
1979 * A default inheritable 3 element mode entry for a directory should be the
1980 * mode Samba will use to create a file within. Ensure user rwx bits are set if
1984 pst->st_mode = create_default_mode(fsp, True);
1986 if (dir_ace && !ensure_canon_entry_valid(&dir_ace, fsp, pfile_owner_sid, pfile_grp_sid, pst, True)) {
1987 free_canon_ace_list(file_ace);
1988 free_canon_ace_list(dir_ace);
1992 print_canon_ace_list( "file ace - return", file_ace);
1993 print_canon_ace_list( "dir ace - return", dir_ace);
1995 *ppfile_ace = file_ace;
1996 *ppdir_ace = dir_ace;
2001 /******************************************************************************
2002 When returning permissions, try and fit NT display
2003 semantics if possible. Note the the canon_entries here must have been malloced.
2004 The list format should be - first entry = owner, followed by group and other user
2005 entries, last entry = other.
2007 Note that this doesn't exactly match the NT semantics for an ACL. As POSIX entries
2008 are not ordered, and match on the most specific entry rather than walking a list,
2009 then a simple POSIX permission of rw-r--r-- should really map to 5 entries,
2011 Entry 0: owner : deny all except read and write.
2012 Entry 1: group : deny all except read.
2013 Entry 2: owner : allow read and write.
2014 Entry 3: group : allow read.
2015 Entry 4: Everyone : allow read.
2017 But NT cannot display this in their ACL editor !
2018 ********************************************************************************/
2020 static void arrange_posix_perms( char *filename, canon_ace **pp_list_head)
2022 canon_ace *list_head = *pp_list_head;
2023 canon_ace *owner_ace = NULL;
2024 canon_ace *other_ace = NULL;
2025 canon_ace *ace = NULL;
2027 for (ace = list_head; ace; ace = ace->next) {
2028 if (ace->type == SMB_ACL_USER_OBJ)
2030 else if (ace->type == SMB_ACL_OTHER) {
2031 /* Last ace - this is "other" */
2036 if (!owner_ace || !other_ace) {
2037 DEBUG(0,("arrange_posix_perms: Invalid POSIX permissions for file %s, missing owner or other.\n",
2043 * The POSIX algorithm applies to owner first, and other last,
2044 * so ensure they are arranged in this order.
2048 DLIST_PROMOTE(list_head, owner_ace);
2052 DLIST_DEMOTE(list_head, other_ace, ace);
2055 /* We have probably changed the head of the list. */
2057 *pp_list_head = list_head;
2060 /****************************************************************************
2061 Create a linked list of canonical ACE entries.
2062 ****************************************************************************/
2064 static canon_ace *canonicalise_acl( files_struct *fsp, SMB_ACL_T posix_acl, SMB_STRUCT_STAT *psbuf,
2065 DOM_SID *powner, DOM_SID *pgroup, struct pai_val *pal, SMB_ACL_TYPE_T the_acl_type)
2067 extern DOM_SID global_sid_World;
2068 connection_struct *conn = fsp->conn;
2069 mode_t acl_mask = (S_IRUSR|S_IWUSR|S_IXUSR);
2070 canon_ace *list_head = NULL;
2071 canon_ace *ace = NULL;
2072 canon_ace *next_ace = NULL;
2073 int entry_id = SMB_ACL_FIRST_ENTRY;
2074 SMB_ACL_ENTRY_T entry;
2077 while ( posix_acl && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1)) {
2078 SMB_ACL_TAG_T tagtype;
2079 SMB_ACL_PERMSET_T permset;
2082 enum ace_owner owner_type;
2085 if (entry_id == SMB_ACL_FIRST_ENTRY)
2086 entry_id = SMB_ACL_NEXT_ENTRY;
2088 /* Is this a MASK entry ? */
2089 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1)
2092 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1)
2095 /* Decide which SID to use based on the ACL type. */
2097 case SMB_ACL_USER_OBJ:
2098 /* Get the SID from the owner. */
2099 sid_copy(&sid, powner);
2100 unix_ug.uid = psbuf->st_uid;
2101 owner_type = UID_ACE;
2105 uid_t *puid = (uid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
2107 DEBUG(0,("canonicalise_acl: Failed to get uid.\n"));
2111 * A SMB_ACL_USER entry for the owner is shadowed by the
2112 * SMB_ACL_USER_OBJ entry and Windows also cannot represent
2113 * that entry, so we ignore it. We also don't create such
2114 * entries out of the blue when setting ACLs, so a get/set
2115 * cycle will drop them.
2117 if (the_acl_type == SMB_ACL_TYPE_ACCESS && *puid == psbuf->st_uid) {
2118 SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)puid,tagtype);
2121 uid_to_sid( &sid, *puid);
2122 unix_ug.uid = *puid;
2123 owner_type = UID_ACE;
2124 SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)puid,tagtype);
2127 case SMB_ACL_GROUP_OBJ:
2128 /* Get the SID from the owning group. */
2129 sid_copy(&sid, pgroup);
2130 unix_ug.gid = psbuf->st_gid;
2131 owner_type = GID_ACE;
2135 gid_t *pgid = (gid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
2137 DEBUG(0,("canonicalise_acl: Failed to get gid.\n"));
2140 gid_to_sid( &sid, *pgid);
2141 unix_ug.gid = *pgid;
2142 owner_type = GID_ACE;
2143 SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)pgid,tagtype);
2147 acl_mask = convert_permset_to_mode_t(conn, permset);
2148 continue; /* Don't count the mask as an entry. */
2150 /* Use the Everyone SID */
2151 sid = global_sid_World;
2153 owner_type = WORLD_ACE;
2156 DEBUG(0,("canonicalise_acl: Unknown tagtype %u\n", (unsigned int)tagtype));
2161 * Add this entry to the list.
2164 if ((ace = (canon_ace *)malloc(sizeof(canon_ace))) == NULL)
2168 ace->type = tagtype;
2169 ace->perms = convert_permset_to_mode_t(conn, permset);
2170 ace->attr = ALLOW_ACE;
2172 ace->unix_ug = unix_ug;
2173 ace->owner_type = owner_type;
2174 ace->inherited = get_inherited_flag(pal, ace, (the_acl_type == SMB_ACL_TYPE_DEFAULT));
2176 DLIST_ADD(list_head, ace);
2180 * This next call will ensure we have at least a user/group/world set.
2183 if (!ensure_canon_entry_valid(&list_head, fsp, powner, pgroup, psbuf, False))
2187 * Now go through the list, masking the permissions with the
2188 * acl_mask. Ensure all DENY Entries are at the start of the list.
2191 DEBUG(10,("canonicalise_acl: %s ace entries before arrange :\n", the_acl_type == SMB_ACL_TYPE_ACCESS ? "Access" : "Default" ));
2193 for ( ace_count = 0, ace = list_head; ace; ace = next_ace, ace_count++) {
2194 next_ace = ace->next;
2196 /* Masks are only applied to entries other than USER_OBJ and OTHER. */
2197 if (ace->type != SMB_ACL_OTHER && ace->type != SMB_ACL_USER_OBJ)
2198 ace->perms &= acl_mask;
2200 if (ace->perms == 0) {
2201 DLIST_PROMOTE(list_head, ace);
2204 if( DEBUGLVL( 10 ) ) {
2205 print_canon_ace(ace, ace_count);
2209 arrange_posix_perms(fsp->fsp_name,&list_head );
2211 print_canon_ace_list( "canonicalise_acl: ace entries after arrange", list_head );
2217 free_canon_ace_list(list_head);
2221 /****************************************************************************
2222 Attempt to apply an ACL to a file or directory.
2223 ****************************************************************************/
2225 static BOOL set_canon_ace_list(files_struct *fsp, canon_ace *the_ace, BOOL default_ace, BOOL *pacl_set_support)
2227 connection_struct *conn = fsp->conn;
2229 SMB_ACL_T the_acl = SMB_VFS_SYS_ACL_INIT(conn, (int)count_canon_ace_list(the_ace) + 1);
2232 SMB_ACL_ENTRY_T mask_entry;
2233 BOOL got_mask_entry = False;
2234 SMB_ACL_PERMSET_T mask_permset;
2235 SMB_ACL_TYPE_T the_acl_type = (default_ace ? SMB_ACL_TYPE_DEFAULT : SMB_ACL_TYPE_ACCESS);
2236 BOOL needs_mask = False;
2237 mode_t mask_perms = 0;
2239 #if defined(POSIX_ACL_NEEDS_MASK)
2240 /* HP-UX always wants to have a mask (called "class" there). */
2244 if (the_acl == NULL) {
2246 if (!no_acl_syscall_error(errno)) {
2248 * Only print this error message if we have some kind of ACL
2249 * support that's not working. Otherwise we would always get this.
2251 DEBUG(0,("set_canon_ace_list: Unable to init %s ACL. (%s)\n",
2252 default_ace ? "default" : "file", strerror(errno) ));
2254 *pacl_set_support = False;
2258 if( DEBUGLVL( 10 )) {
2259 dbgtext("set_canon_ace_list: setting ACL:\n");
2260 for (i = 0, p_ace = the_ace; p_ace; p_ace = p_ace->next, i++ ) {
2261 print_canon_ace( p_ace, i);
2265 for (i = 0, p_ace = the_ace; p_ace; p_ace = p_ace->next, i++ ) {
2266 SMB_ACL_ENTRY_T the_entry;
2267 SMB_ACL_PERMSET_T the_permset;
2270 * ACLs only "need" an ACL_MASK entry if there are any named user or
2271 * named group entries. But if there is an ACL_MASK entry, it applies
2272 * to ACL_USER, ACL_GROUP, and ACL_GROUP_OBJ entries. Set the mask
2273 * so that it doesn't deny (i.e., mask off) any permissions.
2276 if (p_ace->type == SMB_ACL_USER || p_ace->type == SMB_ACL_GROUP) {
2278 mask_perms |= p_ace->perms;
2279 } else if (p_ace->type == SMB_ACL_GROUP_OBJ) {
2280 mask_perms |= p_ace->perms;
2284 * Get the entry for this ACE.
2287 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &the_entry) == -1) {
2288 DEBUG(0,("set_canon_ace_list: Failed to create entry %d. (%s)\n",
2289 i, strerror(errno) ));
2293 if (p_ace->type == SMB_ACL_MASK) {
2294 mask_entry = the_entry;
2295 got_mask_entry = True;
2299 * Ok - we now know the ACL calls should be working, don't
2300 * allow fallback to chmod.
2303 *pacl_set_support = True;
2306 * Initialise the entry from the canon_ace.
2310 * First tell the entry what type of ACE this is.
2313 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, the_entry, p_ace->type) == -1) {
2314 DEBUG(0,("set_canon_ace_list: Failed to set tag type on entry %d. (%s)\n",
2315 i, strerror(errno) ));
2320 * Only set the qualifier (user or group id) if the entry is a user
2324 if ((p_ace->type == SMB_ACL_USER) || (p_ace->type == SMB_ACL_GROUP)) {
2325 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&p_ace->unix_ug.uid) == -1) {
2326 DEBUG(0,("set_canon_ace_list: Failed to set qualifier on entry %d. (%s)\n",
2327 i, strerror(errno) ));
2333 * Convert the mode_t perms in the canon_ace to a POSIX permset.
2336 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, the_entry, &the_permset) == -1) {
2337 DEBUG(0,("set_canon_ace_list: Failed to get permset on entry %d. (%s)\n",
2338 i, strerror(errno) ));
2342 if (map_acl_perms_to_permset(conn, p_ace->perms, &the_permset) == -1) {
2343 DEBUG(0,("set_canon_ace_list: Failed to create permset for mode (%u) on entry %d. (%s)\n",
2344 (unsigned int)p_ace->perms, i, strerror(errno) ));
2349 * ..and apply them to the entry.
2352 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, the_entry, the_permset) == -1) {
2353 DEBUG(0,("set_canon_ace_list: Failed to add permset on entry %d. (%s)\n",
2354 i, strerror(errno) ));
2359 print_canon_ace( p_ace, i);
2363 if (needs_mask && !got_mask_entry) {
2364 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &mask_entry) == -1) {
2365 DEBUG(0,("set_canon_ace_list: Failed to create mask entry. (%s)\n", strerror(errno) ));
2369 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, mask_entry, SMB_ACL_MASK) == -1) {
2370 DEBUG(0,("set_canon_ace_list: Failed to set tag type on mask entry. (%s)\n",strerror(errno) ));
2374 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, mask_entry, &mask_permset) == -1) {
2375 DEBUG(0,("set_canon_ace_list: Failed to get mask permset. (%s)\n", strerror(errno) ));
2379 if (map_acl_perms_to_permset(conn, S_IRUSR|S_IWUSR|S_IXUSR, &mask_permset) == -1) {
2380 DEBUG(0,("set_canon_ace_list: Failed to create mask permset. (%s)\n", strerror(errno) ));
2384 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, mask_entry, mask_permset) == -1) {
2385 DEBUG(0,("set_canon_ace_list: Failed to add mask permset. (%s)\n", strerror(errno) ));
2391 * Check if the ACL is valid.
2394 if (SMB_VFS_SYS_ACL_VALID(conn, the_acl) == -1) {
2395 DEBUG(0,("set_canon_ace_list: ACL type (%s) is invalid for set (%s).\n",
2396 the_acl_type == SMB_ACL_TYPE_DEFAULT ? "directory default" : "file",
2402 * Finally apply it to the file or directory.
2405 if(default_ace || fsp->is_directory || fsp->fd == -1) {
2406 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fsp->fsp_name, the_acl_type, the_acl) == -1) {
2408 * Some systems allow all the above calls and only fail with no ACL support
2409 * when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
2411 if (no_acl_syscall_error(errno)) {
2412 *pacl_set_support = False;
2415 DEBUG(2,("set_canon_ace_list: sys_acl_set_file type %s failed for file %s (%s).\n",
2416 the_acl_type == SMB_ACL_TYPE_DEFAULT ? "directory default" : "file",
2417 fsp->fsp_name, strerror(errno) ));
2421 if (SMB_VFS_SYS_ACL_SET_FD(fsp, fsp->fd, the_acl) == -1) {
2423 * Some systems allow all the above calls and only fail with no ACL support
2424 * when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
2426 if (no_acl_syscall_error(errno)) {
2427 *pacl_set_support = False;
2430 DEBUG(2,("set_canon_ace_list: sys_acl_set_file failed for file %s (%s).\n",
2431 fsp->fsp_name, strerror(errno) ));
2440 if (the_acl != NULL)
2441 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
2446 /****************************************************************************
2447 Find a particular canon_ace entry.
2448 ****************************************************************************/
2450 static struct canon_ace *canon_ace_entry_for(struct canon_ace *list, SMB_ACL_TAG_T type, posix_id *id)
2453 if (list->type == type && ((type != SMB_ACL_USER && type != SMB_ACL_GROUP) ||
2454 (type == SMB_ACL_USER && id && id->uid == list->unix_ug.uid) ||
2455 (type == SMB_ACL_GROUP && id && id->gid == list->unix_ug.gid)))
2462 /****************************************************************************
2464 ****************************************************************************/
2466 SMB_ACL_T free_empty_sys_acl(connection_struct *conn, SMB_ACL_T the_acl)
2468 SMB_ACL_ENTRY_T entry;
2472 if (SMB_VFS_SYS_ACL_GET_ENTRY(conn, the_acl, SMB_ACL_FIRST_ENTRY, &entry) != 1) {
2473 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
2479 /****************************************************************************
2480 Convert a canon_ace to a generic 3 element permission - if possible.
2481 ****************************************************************************/
2483 #define MAP_PERM(p,mask,result) (((p) & (mask)) ? (result) : 0 )
2485 static BOOL convert_canon_ace_to_posix_perms( files_struct *fsp, canon_ace *file_ace_list, mode_t *posix_perms)
2487 int snum = SNUM(fsp->conn);
2488 size_t ace_count = count_canon_ace_list(file_ace_list);
2490 canon_ace *owner_ace = NULL;
2491 canon_ace *group_ace = NULL;
2492 canon_ace *other_ace = NULL;
2496 if (ace_count != 3) {
2497 DEBUG(3,("convert_canon_ace_to_posix_perms: Too many ACE entries for file %s to convert to \
2498 posix perms.\n", fsp->fsp_name ));
2502 for (ace_p = file_ace_list; ace_p; ace_p = ace_p->next) {
2503 if (ace_p->owner_type == UID_ACE)
2505 else if (ace_p->owner_type == GID_ACE)
2507 else if (ace_p->owner_type == WORLD_ACE)
2511 if (!owner_ace || !group_ace || !other_ace) {
2512 DEBUG(3,("convert_canon_ace_to_posix_perms: Can't get standard entries for file %s.\n",
2517 *posix_perms = (mode_t)0;
2519 *posix_perms |= owner_ace->perms;
2520 *posix_perms |= MAP_PERM(group_ace->perms, S_IRUSR, S_IRGRP);
2521 *posix_perms |= MAP_PERM(group_ace->perms, S_IWUSR, S_IWGRP);
2522 *posix_perms |= MAP_PERM(group_ace->perms, S_IXUSR, S_IXGRP);
2523 *posix_perms |= MAP_PERM(other_ace->perms, S_IRUSR, S_IROTH);
2524 *posix_perms |= MAP_PERM(other_ace->perms, S_IWUSR, S_IWOTH);
2525 *posix_perms |= MAP_PERM(other_ace->perms, S_IXUSR, S_IXOTH);
2527 /* The owner must have at least read access. */
2529 *posix_perms |= S_IRUSR;
2530 if (fsp->is_directory)
2531 *posix_perms |= (S_IWUSR|S_IXUSR);
2533 /* If requested apply the masks. */
2535 /* Get the initial bits to apply. */
2537 if (fsp->is_directory) {
2538 and_bits = lp_dir_security_mask(snum);
2539 or_bits = lp_force_dir_security_mode(snum);
2541 and_bits = lp_security_mask(snum);
2542 or_bits = lp_force_security_mode(snum);
2545 *posix_perms = (((*posix_perms) & and_bits)|or_bits);
2547 DEBUG(10,("convert_canon_ace_to_posix_perms: converted u=%o,g=%o,w=%o to perm=0%o for file %s.\n",
2548 (int)owner_ace->perms, (int)group_ace->perms, (int)other_ace->perms, (int)*posix_perms,
2554 /****************************************************************************
2555 Incoming NT ACLs on a directory can be split into a default POSIX acl (CI|OI|IO) and
2556 a normal POSIX acl. Win2k needs these split acls re-merging into one ACL
2557 with CI|OI set so it is inherited and also applies to the directory.
2558 Based on code from "Jim McDonough" <jmcd@us.ibm.com>.
2559 ****************************************************************************/
2561 static size_t merge_default_aces( SEC_ACE *nt_ace_list, size_t num_aces)
2565 for (i = 0; i < num_aces; i++) {
2566 for (j = i+1; j < num_aces; j++) {
2567 uint32 i_flags_ni = (nt_ace_list[i].flags & ~SEC_ACE_FLAG_INHERITED_ACE);
2568 uint32 j_flags_ni = (nt_ace_list[j].flags & ~SEC_ACE_FLAG_INHERITED_ACE);
2569 BOOL i_inh = (nt_ace_list[i].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False;
2570 BOOL j_inh = (nt_ace_list[j].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False;
2572 /* We know the lower number ACE's are file entries. */
2573 if ((nt_ace_list[i].type == nt_ace_list[j].type) &&
2574 (nt_ace_list[i].size == nt_ace_list[j].size) &&
2575 (nt_ace_list[i].info.mask == nt_ace_list[j].info.mask) &&
2576 sid_equal(&nt_ace_list[i].trustee, &nt_ace_list[j].trustee) &&
2578 (i_flags_ni == 0) &&
2579 (j_flags_ni == (SEC_ACE_FLAG_OBJECT_INHERIT|
2580 SEC_ACE_FLAG_CONTAINER_INHERIT|
2581 SEC_ACE_FLAG_INHERIT_ONLY))) {
2583 * W2K wants to have access allowed zero access ACE's
2584 * at the end of the list. If the mask is zero, merge
2585 * the non-inherited ACE onto the inherited ACE.
2588 if (nt_ace_list[i].info.mask == 0) {
2589 nt_ace_list[j].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
2590 (i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0);
2591 if (num_aces - i - 1 > 0)
2592 memmove(&nt_ace_list[i], &nt_ace_list[i+1], (num_aces-i-1) *
2595 DEBUG(10,("merge_default_aces: Merging zero access ACE %u onto ACE %u.\n",
2596 (unsigned int)i, (unsigned int)j ));
2599 * These are identical except for the flags.
2600 * Merge the inherited ACE onto the non-inherited ACE.
2603 nt_ace_list[i].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
2604 (i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0);
2605 if (num_aces - j - 1 > 0)
2606 memmove(&nt_ace_list[j], &nt_ace_list[j+1], (num_aces-j-1) *
2609 DEBUG(10,("merge_default_aces: Merging ACE %u onto ACE %u.\n",
2610 (unsigned int)j, (unsigned int)i ));
2620 /****************************************************************************
2621 Reply to query a security descriptor from an fsp. If it succeeds it allocates
2622 the space for the return elements and returns the size needed to return the
2623 security descriptor. This should be the only external function needed for
2624 the UNIX style get ACL.
2625 ****************************************************************************/
2627 size_t get_nt_acl(files_struct *fsp, uint32 security_info, SEC_DESC **ppdesc)
2629 extern DOM_SID global_sid_Builtin_Administrators;
2630 extern DOM_SID global_sid_Builtin_Users;
2631 extern DOM_SID global_sid_Creator_Owner;
2632 extern DOM_SID global_sid_Creator_Group;
2633 connection_struct *conn = fsp->conn;
2634 SMB_STRUCT_STAT sbuf;
2635 SEC_ACE *nt_ace_list = NULL;
2639 SEC_ACL *psa = NULL;
2640 size_t num_acls = 0;
2641 size_t num_def_acls = 0;
2642 size_t num_aces = 0;
2643 SMB_ACL_T posix_acl = NULL;
2644 SMB_ACL_T def_acl = NULL;
2645 canon_ace *file_ace = NULL;
2646 canon_ace *dir_ace = NULL;
2647 size_t num_profile_acls = 0;
2648 struct pai_val *pal = NULL;
2649 SEC_DESC *psd = NULL;
2653 DEBUG(10,("get_nt_acl: called for file %s\n", fsp->fsp_name ));
2655 if(fsp->is_directory || fsp->fd == -1) {
2657 /* Get the stat struct for the owner info. */
2658 if(SMB_VFS_STAT(fsp->conn,fsp->fsp_name, &sbuf) != 0) {
2662 * Get the ACL from the path.
2665 posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fsp->fsp_name, SMB_ACL_TYPE_ACCESS);
2668 * If it's a directory get the default POSIX ACL.
2671 if(fsp->is_directory) {
2672 def_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fsp->fsp_name, SMB_ACL_TYPE_DEFAULT);
2673 def_acl = free_empty_sys_acl(conn, def_acl);
2678 /* Get the stat struct for the owner info. */
2679 if(SMB_VFS_FSTAT(fsp,fsp->fd,&sbuf) != 0) {
2683 * Get the ACL from the fd.
2685 posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp, fsp->fd);
2688 DEBUG(5,("get_nt_acl : file ACL %s, directory ACL %s\n",
2689 posix_acl ? "present" : "absent",
2690 def_acl ? "present" : "absent" ));
2692 pal = load_inherited_info(fsp);
2695 * Get the owner, group and world SIDs.
2698 if (lp_profile_acls(SNUM(fsp->conn))) {
2699 /* For WXP SP1 the owner must be administrators. */
2700 sid_copy(&owner_sid, &global_sid_Builtin_Administrators);
2701 sid_copy(&group_sid, &global_sid_Builtin_Users);
2702 num_profile_acls = 2;
2704 create_file_sids(&sbuf, &owner_sid, &group_sid);
2707 if ((security_info & DACL_SECURITY_INFORMATION) && !(security_info & PROTECTED_DACL_SECURITY_INFORMATION)) {
2710 * In the optimum case Creator Owner and Creator Group would be used for
2711 * the ACL_USER_OBJ and ACL_GROUP_OBJ entries, respectively, but this
2712 * would lead to usability problems under Windows: The Creator entries
2713 * are only available in browse lists of directories and not for files;
2714 * additionally the identity of the owning group couldn't be determined.
2715 * We therefore use those identities only for Default ACLs.
2718 /* Create the canon_ace lists. */
2719 file_ace = canonicalise_acl( fsp, posix_acl, &sbuf, &owner_sid, &group_sid, pal, SMB_ACL_TYPE_ACCESS );
2721 /* We must have *some* ACLS. */
2723 if (count_canon_ace_list(file_ace) == 0) {
2724 DEBUG(0,("get_nt_acl : No ACLs on file (%s) !\n", fsp->fsp_name ));
2728 if (fsp->is_directory && def_acl) {
2729 dir_ace = canonicalise_acl(fsp, def_acl, &sbuf,
2730 &global_sid_Creator_Owner,
2731 &global_sid_Creator_Group, pal, SMB_ACL_TYPE_DEFAULT );
2735 * Create the NT ACE list from the canonical ace lists.
2743 if (nt4_compatible_acls() && dir_ace) {
2745 * NT 4 chokes if an ACL contains an INHERIT_ONLY entry
2746 * but no non-INHERIT_ONLY entry for one SID. So we only
2747 * remove entries from the Access ACL if the
2748 * corresponding Default ACL entries have also been
2749 * removed. ACEs for CREATOR-OWNER and CREATOR-GROUP
2750 * are exceptions. We can do nothing
2751 * intelligent if the Default ACL contains entries that
2752 * are not also contained in the Access ACL, so this
2753 * case will still fail under NT 4.
2756 ace = canon_ace_entry_for(dir_ace, SMB_ACL_OTHER, NULL);
2757 if (ace && !ace->perms) {
2758 DLIST_REMOVE(dir_ace, ace);
2761 ace = canon_ace_entry_for(file_ace, SMB_ACL_OTHER, NULL);
2762 if (ace && !ace->perms) {
2763 DLIST_REMOVE(file_ace, ace);
2769 * WinNT doesn't usually have Creator Group
2770 * in browse lists, so we send this entry to
2771 * WinNT even if it contains no relevant
2772 * permissions. Once we can add
2773 * Creator Group to browse lists we can
2778 ace = canon_ace_entry_for(dir_ace, SMB_ACL_GROUP_OBJ, NULL);
2779 if (ace && !ace->perms) {
2780 DLIST_REMOVE(dir_ace, ace);
2785 ace = canon_ace_entry_for(file_ace, SMB_ACL_GROUP_OBJ, NULL);
2786 if (ace && !ace->perms) {
2787 DLIST_REMOVE(file_ace, ace);
2792 num_acls = count_canon_ace_list(file_ace);
2793 num_def_acls = count_canon_ace_list(dir_ace);
2795 /* Allocate the ace list. */
2796 if ((nt_ace_list = (SEC_ACE *)malloc((num_acls + num_profile_acls + num_def_acls)* sizeof(SEC_ACE))) == NULL) {
2797 DEBUG(0,("get_nt_acl: Unable to malloc space for nt_ace_list.\n"));
2801 memset(nt_ace_list, '\0', (num_acls + num_def_acls) * sizeof(SEC_ACE) );
2804 * Create the NT ACE list from the canonical ace lists.
2809 for (i = 0; i < num_acls; i++, ace = ace->next) {
2812 acc = map_canon_ace_perms(&nt_acl_type, &owner_sid, ace );
2813 init_sec_ace(&nt_ace_list[num_aces++], &ace->trustee, nt_acl_type, acc, ace->inherited ? SEC_ACE_FLAG_INHERITED_ACE : 0);
2816 /* The User must have access to a profile share - even if we can't map the SID. */
2817 if (lp_profile_acls(SNUM(fsp->conn))) {
2820 init_sec_access(&acc,FILE_GENERIC_ALL);
2821 init_sec_ace(&nt_ace_list[num_aces++], &global_sid_Builtin_Users, SEC_ACE_TYPE_ACCESS_ALLOWED,
2827 for (i = 0; i < num_def_acls; i++, ace = ace->next) {
2830 acc = map_canon_ace_perms(&nt_acl_type, &owner_sid, ace );
2831 init_sec_ace(&nt_ace_list[num_aces++], &ace->trustee, nt_acl_type, acc,
2832 SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
2833 SEC_ACE_FLAG_INHERIT_ONLY|
2834 (ace->inherited ? SEC_ACE_FLAG_INHERITED_ACE : 0));
2837 /* The User must have access to a profile share - even if we can't map the SID. */
2838 if (lp_profile_acls(SNUM(fsp->conn))) {
2841 init_sec_access(&acc,FILE_GENERIC_ALL);
2842 init_sec_ace(&nt_ace_list[num_aces++], &global_sid_Builtin_Users, SEC_ACE_TYPE_ACCESS_ALLOWED, acc,
2843 SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
2844 SEC_ACE_FLAG_INHERIT_ONLY|0);
2848 * Merge POSIX default ACLs and normal ACLs into one NT ACE.
2849 * Win2K needs this to get the inheritance correct when replacing ACLs
2850 * on a directory tree. Based on work by Jim @ IBM.
2853 num_aces = merge_default_aces(nt_ace_list, num_aces);
2858 if((psa = make_sec_acl( main_loop_talloc_get(), NT4_ACL_REVISION, num_aces, nt_ace_list)) == NULL) {
2859 DEBUG(0,("get_nt_acl: Unable to malloc space for acl.\n"));
2863 } /* security_info & DACL_SECURITY_INFORMATION */
2865 psd = make_standard_sec_desc( main_loop_talloc_get(),
2866 (security_info & OWNER_SECURITY_INFORMATION) ? &owner_sid : NULL,
2867 (security_info & GROUP_SECURITY_INFORMATION) ? &group_sid : NULL,
2872 DEBUG(0,("get_nt_acl: Unable to malloc space for security descriptor.\n"));
2876 * Windows 2000: The DACL_PROTECTED flag in the security
2877 * descriptor marks the ACL as non-inheriting, i.e., no
2878 * ACEs from higher level directories propagate to this
2879 * ACL. In the POSIX ACL model permissions are only
2880 * inherited at file create time, so ACLs never contain
2881 * any ACEs that are inherited dynamically. The DACL_PROTECTED
2882 * flag doesn't seem to bother Windows NT.
2883 * Always set this if map acl inherit is turned off.
2885 if (get_protected_flag(pal) || !lp_map_acl_inherit(SNUM(conn))) {
2886 psd->type |= SE_DESC_DACL_PROTECTED;
2891 dacl_sort_into_canonical_order(psd->dacl->ace, (unsigned int)psd->dacl->num_aces);
2898 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
2900 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
2901 free_canon_ace_list(file_ace);
2902 free_canon_ace_list(dir_ace);
2903 free_inherited_info(pal);
2904 SAFE_FREE(nt_ace_list);
2909 /****************************************************************************
2910 Try to chown a file. We will be able to chown it under the following conditions.
2912 1) If we have root privileges, then it will just work.
2913 2) If we have write permission to the file and dos_filemodes is set
2914 then allow chown to the currently authenticated user.
2915 ****************************************************************************/
2917 static int try_chown(connection_struct *conn, const char *fname, uid_t uid, gid_t gid)
2920 extern struct current_user current_user;
2924 /* try the direct way first */
2925 ret = SMB_VFS_CHOWN(conn, fname, uid, gid);
2929 if(!CAN_WRITE(conn) || !lp_dos_filemode(SNUM(conn)))
2932 if (SMB_VFS_STAT(conn,fname,&st))
2935 fsp = open_file_fchmod(conn,fname,&st);
2939 /* only allow chown to the current user. This is more secure,
2940 and also copes with the case where the SID in a take ownership ACL is
2941 a local SID on the users workstation
2943 uid = current_user.uid;
2946 /* Keep the current file gid the same. */
2947 ret = SMB_VFS_FCHOWN(fsp, fsp->fd, uid, (gid_t)-1);
2950 close_file_fchmod(fsp);
2955 /****************************************************************************
2956 Reply to set a security descriptor on an fsp. security_info_sent is the
2957 description of the following NT ACL.
2958 This should be the only external function needed for the UNIX style set ACL.
2959 ****************************************************************************/
2961 BOOL set_nt_acl(files_struct *fsp, uint32 security_info_sent, SEC_DESC *psd)
2963 connection_struct *conn = fsp->conn;
2964 uid_t user = (uid_t)-1;
2965 gid_t grp = (gid_t)-1;
2966 SMB_STRUCT_STAT sbuf;
2967 DOM_SID file_owner_sid;
2968 DOM_SID file_grp_sid;
2969 canon_ace *file_ace_list = NULL;
2970 canon_ace *dir_ace_list = NULL;
2971 BOOL acl_perms = False;
2972 mode_t orig_mode = (mode_t)0;
2975 BOOL need_chown = False;
2976 extern struct current_user current_user;
2978 DEBUG(10,("set_nt_acl: called for file %s\n", fsp->fsp_name ));
2980 if (!CAN_WRITE(conn)) {
2981 DEBUG(10,("set acl rejected on read-only share\n"));
2986 * Get the current state of the file.
2989 if(fsp->is_directory || fsp->fd == -1) {
2990 if(SMB_VFS_STAT(fsp->conn,fsp->fsp_name, &sbuf) != 0)
2993 if(SMB_VFS_FSTAT(fsp,fsp->fd,&sbuf) != 0)
2997 /* Save the original elements we check against. */
2998 orig_mode = sbuf.st_mode;
2999 orig_uid = sbuf.st_uid;
3000 orig_gid = sbuf.st_gid;
3003 * Unpack the user/group/world id's.
3006 if (!unpack_nt_owners( SNUM(conn), &sbuf, &user, &grp, security_info_sent, psd))
3010 * Do we need to chown ?
3013 if (((user != (uid_t)-1) && (orig_uid != user)) || (( grp != (gid_t)-1) && (orig_gid != grp)))
3017 * Chown before setting ACL only if we don't change the user, or
3018 * if we change to the current user, but not if we want to give away
3022 if (need_chown && (user == (uid_t)-1 || user == current_user.uid)) {
3024 DEBUG(3,("set_nt_acl: chown %s. uid = %u, gid = %u.\n",
3025 fsp->fsp_name, (unsigned int)user, (unsigned int)grp ));
3027 if(try_chown( fsp->conn, fsp->fsp_name, user, grp) == -1) {
3028 DEBUG(3,("set_nt_acl: chown %s, %u, %u failed. Error = %s.\n",
3029 fsp->fsp_name, (unsigned int)user, (unsigned int)grp, strerror(errno) ));
3034 * Recheck the current state of the file, which may have changed.
3035 * (suid/sgid bits, for instance)
3038 if(fsp->is_directory) {
3039 if(SMB_VFS_STAT(fsp->conn, fsp->fsp_name, &sbuf) != 0) {
3047 ret = SMB_VFS_STAT(fsp->conn, fsp->fsp_name, &sbuf);
3049 ret = SMB_VFS_FSTAT(fsp,fsp->fd,&sbuf);
3055 /* Save the original elements we check against. */
3056 orig_mode = sbuf.st_mode;
3057 orig_uid = sbuf.st_uid;
3058 orig_gid = sbuf.st_gid;
3060 /* We did it, don't try again */
3064 create_file_sids(&sbuf, &file_owner_sid, &file_grp_sid);
3066 acl_perms = unpack_canon_ace( fsp, &sbuf, &file_owner_sid, &file_grp_sid,
3067 &file_ace_list, &dir_ace_list, security_info_sent, psd);
3069 /* Ignore W2K traverse DACL set. */
3070 if (file_ace_list || dir_ace_list) {
3073 DEBUG(3,("set_nt_acl: cannot set permissions\n"));
3074 free_canon_ace_list(file_ace_list);
3075 free_canon_ace_list(dir_ace_list);
3080 * Only change security if we got a DACL.
3083 if((security_info_sent & DACL_SECURITY_INFORMATION) && (psd->dacl != NULL)) {
3085 BOOL acl_set_support = False;
3089 * Try using the POSIX ACL set first. Fall back to chmod if
3090 * we have no ACL support on this filesystem.
3093 if (acl_perms && file_ace_list) {
3094 ret = set_canon_ace_list(fsp, file_ace_list, False, &acl_set_support);
3095 if (acl_set_support && ret == False) {
3096 DEBUG(3,("set_nt_acl: failed to set file acl on file %s (%s).\n", fsp->fsp_name, strerror(errno) ));
3097 free_canon_ace_list(file_ace_list);
3098 free_canon_ace_list(dir_ace_list);
3103 if (acl_perms && acl_set_support && fsp->is_directory) {
3105 if (!set_canon_ace_list(fsp, dir_ace_list, True, &acl_set_support)) {
3106 DEBUG(3,("set_nt_acl: failed to set default acl on directory %s (%s).\n", fsp->fsp_name, strerror(errno) ));
3107 free_canon_ace_list(file_ace_list);
3108 free_canon_ace_list(dir_ace_list);
3114 * No default ACL - delete one if it exists.
3117 if (SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn, fsp->fsp_name) == -1) {
3118 DEBUG(3,("set_nt_acl: sys_acl_delete_def_file failed (%s)\n", strerror(errno)));
3119 free_canon_ace_list(file_ace_list);
3120 free_canon_ace_list(dir_ace_list);
3126 if (acl_set_support)
3127 store_inheritance_attributes(fsp, file_ace_list, dir_ace_list,
3128 (psd->type & SE_DESC_DACL_PROTECTED) ? True : False);
3131 * If we cannot set using POSIX ACLs we fall back to checking if we need to chmod.
3134 if(!acl_set_support && acl_perms) {
3137 if (!convert_canon_ace_to_posix_perms( fsp, file_ace_list, &posix_perms)) {
3138 free_canon_ace_list(file_ace_list);
3139 free_canon_ace_list(dir_ace_list);
3140 DEBUG(3,("set_nt_acl: failed to convert file acl to posix permissions for file %s.\n",
3145 if (orig_mode != posix_perms) {
3147 DEBUG(3,("set_nt_acl: chmod %s. perms = 0%o.\n",
3148 fsp->fsp_name, (unsigned int)posix_perms ));
3150 if(SMB_VFS_CHMOD(conn,fsp->fsp_name, posix_perms) == -1) {
3151 DEBUG(3,("set_nt_acl: chmod %s, 0%o failed. Error = %s.\n",
3152 fsp->fsp_name, (unsigned int)posix_perms, strerror(errno) ));
3153 free_canon_ace_list(file_ace_list);
3154 free_canon_ace_list(dir_ace_list);
3161 free_canon_ace_list(file_ace_list);
3162 free_canon_ace_list(dir_ace_list);
3165 /* Any chown pending? */
3168 DEBUG(3,("set_nt_acl: chown %s. uid = %u, gid = %u.\n",
3169 fsp->fsp_name, (unsigned int)user, (unsigned int)grp ));
3171 if(try_chown( fsp->conn, fsp->fsp_name, user, grp) == -1) {
3172 DEBUG(3,("set_nt_acl: chown %s, %u, %u failed. Error = %s.\n",
3173 fsp->fsp_name, (unsigned int)user, (unsigned int)grp, strerror(errno) ));
3181 /****************************************************************************
3182 Get the actual group bits stored on a file with an ACL. Has no effect if
3183 the file has no ACL. Needed in dosmode code where the stat() will return
3184 the mask bits, not the real group bits, for a file with an ACL.
3185 ****************************************************************************/
3187 int get_acl_group_bits( connection_struct *conn, const char *fname, mode_t *mode )
3189 int entry_id = SMB_ACL_FIRST_ENTRY;
3190 SMB_ACL_ENTRY_T entry;
3191 SMB_ACL_T posix_acl;
3194 posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS);
3195 if (posix_acl == (SMB_ACL_T)NULL)
3198 while (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) {
3199 SMB_ACL_TAG_T tagtype;
3200 SMB_ACL_PERMSET_T permset;
3203 if (entry_id == SMB_ACL_FIRST_ENTRY)
3204 entry_id = SMB_ACL_NEXT_ENTRY;
3206 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) ==-1)
3209 if (tagtype == SMB_ACL_GROUP_OBJ) {
3210 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1) {
3213 *mode &= ~(S_IRGRP|S_IWGRP|S_IXGRP);
3214 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ) ? S_IRGRP : 0);
3215 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE) ? S_IWGRP : 0);
3216 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_EXECUTE) ? S_IXGRP : 0);
3222 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
3226 /****************************************************************************
3227 Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
3228 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
3229 ****************************************************************************/
3231 static int chmod_acl_internals( connection_struct *conn, SMB_ACL_T posix_acl, mode_t mode)
3233 int entry_id = SMB_ACL_FIRST_ENTRY;
3234 SMB_ACL_ENTRY_T entry;
3235 int num_entries = 0;
3237 while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) {
3238 SMB_ACL_TAG_T tagtype;
3239 SMB_ACL_PERMSET_T permset;
3243 if (entry_id == SMB_ACL_FIRST_ENTRY)
3244 entry_id = SMB_ACL_NEXT_ENTRY;
3246 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1)
3249 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1)
3255 case SMB_ACL_USER_OBJ:
3256 perms = unix_perms_to_acl_perms(mode, S_IRUSR, S_IWUSR, S_IXUSR);
3258 case SMB_ACL_GROUP_OBJ:
3259 perms = unix_perms_to_acl_perms(mode, S_IRGRP, S_IWGRP, S_IXGRP);
3263 * FIXME: The ACL_MASK entry permissions should really be set to
3264 * the union of the permissions of all ACL_USER,
3265 * ACL_GROUP_OBJ, and ACL_GROUP entries. That's what
3266 * acl_calc_mask() does, but Samba ACLs doesn't provide it.
3268 perms = S_IRUSR|S_IWUSR|S_IXUSR;
3271 perms = unix_perms_to_acl_perms(mode, S_IROTH, S_IWOTH, S_IXOTH);
3277 if (map_acl_perms_to_permset(conn, perms, &permset) == -1)
3280 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, entry, permset) == -1)
3285 * If this is a simple 3 element ACL or no elements then it's a standard
3286 * UNIX permission set. Just use chmod...
3289 if ((num_entries == 3) || (num_entries == 0))
3295 /****************************************************************************
3296 Get the access ACL of FROM, do a chmod by setting the ACL USER_OBJ,
3297 GROUP_OBJ and OTHER bits in an ACL and set the mask to rwx. Set the
3298 resulting ACL on TO. Note that name is in UNIX character set.
3299 ****************************************************************************/
3301 static int copy_access_acl(connection_struct *conn, const char *from, const char *to, mode_t mode)
3303 SMB_ACL_T posix_acl = NULL;
3306 if ((posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, from, SMB_ACL_TYPE_ACCESS)) == NULL)
3309 if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
3312 ret = SMB_VFS_SYS_ACL_SET_FILE(conn, to, SMB_ACL_TYPE_ACCESS, posix_acl);
3316 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
3320 /****************************************************************************
3321 Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
3322 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
3323 Note that name is in UNIX character set.
3324 ****************************************************************************/
3326 int chmod_acl(connection_struct *conn, const char *name, mode_t mode)
3328 return copy_access_acl(conn, name, name, mode);
3331 /****************************************************************************
3332 If "inherit permissions" is set and the parent directory has no default
3333 ACL but it does have an Access ACL, inherit this Access ACL to file name.
3334 ****************************************************************************/
3336 int inherit_access_acl(connection_struct *conn, const char *name, mode_t mode)
3339 pstrcpy(dirname, parent_dirname(name));
3341 if (!lp_inherit_perms(SNUM(conn)) || directory_has_default_acl(conn, dirname))
3344 return copy_access_acl(conn, dirname, name, mode);
3347 /****************************************************************************
3348 Do an fchmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
3349 and set the mask to rwx. Needed to preserve complex ACLs set by NT.
3350 ****************************************************************************/
3352 int fchmod_acl(files_struct *fsp, int fd, mode_t mode)
3354 connection_struct *conn = fsp->conn;
3355 SMB_ACL_T posix_acl = NULL;
3358 if ((posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp, fd)) == NULL)
3361 if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
3364 ret = SMB_VFS_SYS_ACL_SET_FD(fsp, fd, posix_acl);
3368 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
3372 /****************************************************************************
3373 Check for an existing default POSIX ACL on a directory.
3374 ****************************************************************************/
3376 BOOL directory_has_default_acl(connection_struct *conn, const char *fname)
3378 SMB_ACL_T def_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_DEFAULT);
3379 BOOL has_acl = False;
3380 SMB_ACL_ENTRY_T entry;
3382 if (def_acl != NULL && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, def_acl, SMB_ACL_FIRST_ENTRY, &entry) == 1)) {
3387 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
3392 /****************************************************************************
3393 Map from wire type to permset.
3394 ****************************************************************************/
3396 static BOOL unix_ex_wire_to_permset(connection_struct *conn, unsigned char wire_perm, SMB_ACL_PERMSET_T *p_permset)
3398 if (wire_perm & ~(SMB_POSIX_ACL_READ|SMB_POSIX_ACL_WRITE|SMB_POSIX_ACL_EXECUTE)) {
3402 if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn, *p_permset) == -1) {
3406 if (wire_perm & SMB_POSIX_ACL_READ) {
3407 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_READ) == -1) {
3411 if (wire_perm & SMB_POSIX_ACL_WRITE) {
3412 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_WRITE) == -1) {
3416 if (wire_perm & SMB_POSIX_ACL_EXECUTE) {
3417 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_EXECUTE) == -1) {
3424 /****************************************************************************
3425 Map from wire type to tagtype.
3426 ****************************************************************************/
3428 static BOOL unix_ex_wire_to_tagtype(unsigned char wire_tt, SMB_ACL_TAG_T *p_tt)
3431 case SMB_POSIX_ACL_USER_OBJ:
3432 *p_tt = SMB_ACL_USER_OBJ;
3434 case SMB_POSIX_ACL_USER:
3435 *p_tt = SMB_ACL_USER;
3437 case SMB_POSIX_ACL_GROUP_OBJ:
3438 *p_tt = SMB_ACL_GROUP_OBJ;
3440 case SMB_POSIX_ACL_GROUP:
3441 *p_tt = SMB_ACL_GROUP;
3443 case SMB_POSIX_ACL_MASK:
3444 *p_tt = SMB_ACL_MASK;
3446 case SMB_POSIX_ACL_OTHER:
3447 *p_tt = SMB_ACL_OTHER;
3455 /****************************************************************************
3456 Create a new POSIX acl from wire permissions.
3457 FIXME ! How does the share mask/mode fit into this.... ?
3458 ****************************************************************************/
3460 static SMB_ACL_T create_posix_acl_from_wire(connection_struct *conn, uint16 num_acls, const char *pdata)
3463 SMB_ACL_T the_acl = SMB_VFS_SYS_ACL_INIT(conn, num_acls);
3465 if (the_acl == NULL) {
3469 for (i = 0; i < num_acls; i++) {
3470 SMB_ACL_ENTRY_T the_entry;
3471 SMB_ACL_PERMSET_T the_permset;
3472 SMB_ACL_TAG_T tag_type;
3474 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &the_entry) == -1) {
3475 DEBUG(0,("create_posix_acl_from_wire: Failed to create entry %u. (%s)\n",
3476 i, strerror(errno) ));
3480 if (!unix_ex_wire_to_tagtype(CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)), &tag_type)) {
3481 DEBUG(0,("create_posix_acl_from_wire: invalid wire tagtype %u on entry %u.\n",
3482 CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)), i ));
3486 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, the_entry, tag_type) == -1) {
3487 DEBUG(0,("create_posix_acl_from_wire: Failed to set tagtype on entry %u. (%s)\n",
3488 i, strerror(errno) ));
3492 /* Get the permset pointer from the new ACL entry. */
3493 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, the_entry, &the_permset) == -1) {
3494 DEBUG(0,("create_posix_acl_from_wire: Failed to get permset on entry %u. (%s)\n",
3495 i, strerror(errno) ));
3499 /* Map from wire to permissions. */
3500 if (!unix_ex_wire_to_permset(conn, CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+1), &the_permset)) {
3501 DEBUG(0,("create_posix_acl_from_wire: invalid permset %u on entry %u.\n",
3502 CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE) + 1), i ));
3506 /* Now apply to the new ACL entry. */
3507 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, the_entry, the_permset) == -1) {
3508 DEBUG(0,("create_posix_acl_from_wire: Failed to add permset on entry %u. (%s)\n",
3509 i, strerror(errno) ));
3513 if (tag_type == SMB_ACL_USER) {
3514 uint32 uidval = IVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+2);
3515 uid_t uid = (uid_t)uidval;
3516 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&uid) == -1) {
3517 DEBUG(0,("create_posix_acl_from_wire: Failed to set uid %u on entry %u. (%s)\n",
3518 (unsigned int)uid, i, strerror(errno) ));
3523 if (tag_type == SMB_ACL_GROUP) {
3524 uint32 gidval = IVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+2);
3525 gid_t gid = (uid_t)gidval;
3526 if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&gid) == -1) {
3527 DEBUG(0,("create_posix_acl_from_wire: Failed to set gid %u on entry %u. (%s)\n",
3528 (unsigned int)gid, i, strerror(errno) ));
3538 if (the_acl != NULL) {
3539 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
3544 /****************************************************************************
3545 Calls from UNIX extensions - Default POSIX ACL set.
3546 If num_def_acls == 0 and not a directory just return. If it is a directory
3547 and num_def_acls == 0 then remove the default acl. Else set the default acl
3549 ****************************************************************************/
3551 BOOL set_unix_posix_default_acl(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *psbuf,
3552 uint16 num_def_acls, const char *pdata)
3554 SMB_ACL_T def_acl = NULL;
3556 if (num_def_acls && !S_ISDIR(psbuf->st_mode)) {
3557 DEBUG(5,("set_unix_posix_default_acl: Can't set default ACL on non-directory file %s\n", fname ));
3562 if (!num_def_acls) {
3563 /* Remove the default ACL. */
3564 if (SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn, fname) == -1) {
3565 DEBUG(5,("set_unix_posix_default_acl: acl_delete_def_file failed on directory %s (%s)\n",
3566 fname, strerror(errno) ));
3572 if ((def_acl = create_posix_acl_from_wire(conn, num_def_acls, pdata)) == NULL) {
3576 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_DEFAULT, def_acl) == -1) {
3577 DEBUG(5,("set_unix_posix_default_acl: acl_set_file failed on directory %s (%s)\n",
3578 fname, strerror(errno) ));
3579 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
3583 DEBUG(10,("set_unix_posix_default_acl: set default acl for file %s\n", fname ));
3584 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
3588 /****************************************************************************
3589 Remove an ACL from a file. As we don't have acl_delete_entry() available
3590 we must read the current acl and copy all entries except MASK, USER and GROUP
3591 to a new acl, then set that. This (at least on Linux) causes any ACL to be
3593 FIXME ! How does the share mask/mode fit into this.... ?
3594 ****************************************************************************/
3596 static BOOL remove_posix_acl(connection_struct *conn, files_struct *fsp, const char *fname)
3598 SMB_ACL_T file_acl = NULL;
3599 int entry_id = SMB_ACL_FIRST_ENTRY;
3600 SMB_ACL_ENTRY_T entry;
3602 /* Create a new ACL with only 3 entries, u/g/w. */
3603 SMB_ACL_T new_file_acl = SMB_VFS_SYS_ACL_INIT(conn, 3);
3604 SMB_ACL_ENTRY_T user_ent = NULL;
3605 SMB_ACL_ENTRY_T group_ent = NULL;
3606 SMB_ACL_ENTRY_T other_ent = NULL;
3608 if (new_file_acl == NULL) {
3609 DEBUG(5,("remove_posix_acl: failed to init new ACL with 3 entries for file %s.\n", fname));
3613 /* Now create the u/g/w entries. */
3614 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &user_ent) == -1) {
3615 DEBUG(5,("remove_posix_acl: Failed to create user entry for file %s. (%s)\n",
3616 fname, strerror(errno) ));
3619 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, user_ent, SMB_ACL_USER_OBJ) == -1) {
3620 DEBUG(5,("remove_posix_acl: Failed to set user entry for file %s. (%s)\n",
3621 fname, strerror(errno) ));
3625 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &group_ent) == -1) {
3626 DEBUG(5,("remove_posix_acl: Failed to create group entry for file %s. (%s)\n",
3627 fname, strerror(errno) ));
3630 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, group_ent, SMB_ACL_GROUP_OBJ) == -1) {
3631 DEBUG(5,("remove_posix_acl: Failed to set group entry for file %s. (%s)\n",
3632 fname, strerror(errno) ));
3636 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &other_ent) == -1) {
3637 DEBUG(5,("remove_posix_acl: Failed to create other entry for file %s. (%s)\n",
3638 fname, strerror(errno) ));
3641 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, other_ent, SMB_ACL_OTHER) == -1) {
3642 DEBUG(5,("remove_posix_acl: Failed to set other entry for file %s. (%s)\n",
3643 fname, strerror(errno) ));
3647 /* Get the current file ACL. */
3648 if (fsp && fsp->fd != -1) {
3649 file_acl = SMB_VFS_SYS_ACL_GET_FD(fsp, fsp->fd);
3651 file_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_ACCESS);
3654 if (file_acl == NULL) {
3655 /* This is only returned if an error occurred. Even for a file with
3656 no acl a u/g/w acl should be returned. */
3657 DEBUG(5,("remove_posix_acl: failed to get ACL from file %s (%s).\n",
3658 fname, strerror(errno) ));
3662 while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, file_acl, entry_id, &entry) == 1) {
3663 SMB_ACL_TAG_T tagtype;
3664 SMB_ACL_PERMSET_T permset;
3667 if (entry_id == SMB_ACL_FIRST_ENTRY)
3668 entry_id = SMB_ACL_NEXT_ENTRY;
3670 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1) {
3671 DEBUG(5,("remove_posix_acl: failed to get tagtype from ACL on file %s (%s).\n",
3672 fname, strerror(errno) ));
3676 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1) {
3677 DEBUG(5,("remove_posix_acl: failed to get permset from ACL on file %s (%s).\n",
3678 fname, strerror(errno) ));
3682 if (tagtype == SMB_ACL_USER_OBJ) {
3683 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, user_ent, permset) == -1) {
3684 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
3685 fname, strerror(errno) ));
3687 } else if (tagtype == SMB_ACL_GROUP_OBJ) {
3688 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, group_ent, permset) == -1) {
3689 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
3690 fname, strerror(errno) ));
3692 } else if (tagtype == SMB_ACL_OTHER) {
3693 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, other_ent, permset) == -1) {
3694 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
3695 fname, strerror(errno) ));
3705 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
3708 SMB_VFS_SYS_ACL_FREE_ACL(conn, new_file_acl);
3713 /****************************************************************************
3714 Calls from UNIX extensions - POSIX ACL set.
3715 If num_def_acls == 0 then read/modify/write acl after removing all entries
3716 except SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER.
3717 ****************************************************************************/
3719 BOOL set_unix_posix_acl(connection_struct *conn, files_struct *fsp, const char *fname, uint16 num_acls, const char *pdata)
3721 SMB_ACL_T file_acl = NULL;
3724 /* Remove the ACL from the file. */
3725 return remove_posix_acl(conn, fsp, fname);
3728 if ((file_acl = create_posix_acl_from_wire(conn, num_acls, pdata)) == NULL) {
3732 if (fsp && fsp->fd != -1) {
3733 /* The preferred way - use an open fd. */
3734 if (SMB_VFS_SYS_ACL_SET_FD(fsp, fsp->fd, file_acl) == -1) {
3735 DEBUG(5,("set_unix_posix_acl: acl_set_file failed on %s (%s)\n",
3736 fname, strerror(errno) ));
3737 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
3741 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS, file_acl) == -1) {
3742 DEBUG(5,("set_unix_posix_acl: acl_set_file failed on %s (%s)\n",
3743 fname, strerror(errno) ));
3744 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
3749 DEBUG(10,("set_unix_posix_acl: set acl for file %s\n", fname ));
3750 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);