source3/smbd/pysmbd.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Set NT and POSIX ACLs and other VFS operations from Python
   4
   5    Copyrigyt (C) Andrew Bartlett 2012
   6    Copyright (C) Jeremy Allison 1994-2009.
   7    Copyright (C) Andreas Gruenbacher 2002.
   8    Copyright (C) Simo Sorce <idra@samba.org> 2009.
   9    Copyright (C) Simo Sorce 2002
  10    Copyright (C) Eric Lorimer 2002
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include <Python.h>
  27 #include "includes.h"
  28 #include "python/py3compat.h"
  29 #include "python/modules.h"
  30 #include "smbd/smbd.h"
  31 #include "libcli/util/pyerrors.h"
  32 #include "librpc/rpc/pyrpc_util.h"
  33 #include <pytalloc.h>
  34 #include "system/filesys.h"
  35 #include "passdb.h"
  36 #include "secrets.h"
  37 #include "auth.h"
  38
  39 extern const struct generic_mapping file_generic_mapping;
  40
  41 #undef  DBGC_CLASS
  42 #define DBGC_CLASS DBGC_ACLS
  43
  44 #ifdef O_DIRECTORY
  45 #define DIRECTORY_FLAGS O_RDONLY|O_DIRECTORY
  46 #else
  47 /* POSIX allows us to open a directory with O_RDONLY. */
  48 #define DIRECTORY_FLAGS O_RDONLY
  49 #endif
  50
  51
  52 static connection_struct *get_conn_tos(
  53         const char *service,
  54         const struct auth_session_info *session_info)
  55 {
  56         struct conn_struct_tos *c = NULL;
  57         int snum = -1;
  58         NTSTATUS status;
  59         char *cwd = NULL;
  60         struct smb_filename cwd_fname = {0};
  61         int ret;
  62
  63         if (!posix_locking_init(false)) {
  64                 PyErr_NoMemory();
  65                 return NULL;
  66         }
  67
  68         if (service) {
  69                 snum = lp_servicenumber(service);
  70                 if (snum == -1) {
  71                         PyErr_SetString(PyExc_RuntimeError, "unknown service");
  72                         return NULL;
  73                 }
  74         }
  75
  76         status = create_conn_struct_tos(NULL,
  77                                         snum,
  78                                         "/",
  79                                         session_info,
  80                                         &c);
  81         PyErr_NTSTATUS_IS_ERR_RAISE(status);
  82
  83         /* Ignore read-only and share restrictions */
  84         c->conn->read_only = false;
  85         c->conn->share_access = SEC_RIGHTS_FILE_ALL;
  86
  87         /* Provided by libreplace if not present. Always mallocs. */
  88         cwd = get_current_dir_name();
  89         if (cwd == NULL) {
  90                 PyErr_NoMemory();
  91                 return NULL;
  92         }
  93
  94         cwd_fname.base_name = cwd;
  95         /*
  96          * We need to call vfs_ChDir() to initialize
  97          * conn->cwd_fsp correctly. Change directory
  98          * to current directory (so no change for process).
  99          */
 100         ret = vfs_ChDir(c->conn, &cwd_fname);
 101         if (ret != 0) {
 102                 status = map_nt_error_from_unix(errno);
 103                 SAFE_FREE(cwd);
 104                 PyErr_NTSTATUS_IS_ERR_RAISE(status);
 105         }
 106
 107         SAFE_FREE(cwd);
 108
 109         return c->conn;
 110 }
 111
 112 static int set_sys_acl_conn(const char *fname,
 113                                  SMB_ACL_TYPE_T acltype,
 114                                  SMB_ACL_T theacl, connection_struct *conn)
 115 {
 116         int ret;
 117         struct smb_filename *smb_fname = NULL;
 118
 119         TALLOC_CTX *frame = talloc_stackframe();
 120
 121         smb_fname = synthetic_smb_fname_split(frame,
 122                                         fname,
 123                                         lp_posix_pathnames());
 124         if (smb_fname == NULL) {
 125                 TALLOC_FREE(frame);
 126                 return -1;
 127         }
 128
 129         ret = SMB_VFS_SYS_ACL_SET_FILE( conn, smb_fname, acltype, theacl);
 130
 131         TALLOC_FREE(frame);
 132         return ret;
 133 }
 134
 135
 136 static NTSTATUS init_files_struct(TALLOC_CTX *mem_ctx,
 137                                   const char *fname,
 138                                   struct connection_struct *conn,
 139                                   int flags,
 140                                   struct files_struct **_fsp)
 141 {
 142         struct smb_filename *smb_fname = NULL;
 143         int ret;
 144         mode_t saved_umask;
 145         struct files_struct *fsp;
 146
 147         fsp = talloc_zero(mem_ctx, struct files_struct);
 148         if (fsp == NULL) {
 149                 return NT_STATUS_NO_MEMORY;
 150         }
 151         fsp->fh = talloc(fsp, struct fd_handle);
 152         if (fsp->fh == NULL) {
 153                 return NT_STATUS_NO_MEMORY;
 154         }
 155         fsp->conn = conn;
 156
 157         smb_fname = synthetic_smb_fname_split(fsp,
 158                                               fname,
 159                                               lp_posix_pathnames());
 160         if (smb_fname == NULL) {
 161                 return NT_STATUS_NO_MEMORY;
 162         }
 163
 164         fsp->fsp_name = smb_fname;
 165
 166         /*
 167          * we want total control over the permissions on created files,
 168          * so set our umask to 0 (this matters if flags contains O_CREAT)
 169          */
 170         saved_umask = umask(0);
 171
 172         fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, flags, 00644);
 173
 174         umask(saved_umask);
 175
 176         if (fsp->fh->fd == -1) {
 177                 int err = errno;
 178                 if (err == ENOENT) {
 179                         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 180                 }
 181                 return NT_STATUS_INVALID_PARAMETER;
 182         }
 183
 184         ret = SMB_VFS_FSTAT(fsp, &smb_fname->st);
 185         if (ret == -1) {
 186                 /* If we have an fd, this stat should succeed. */
 187                 DEBUG(0,("Error doing fstat on open file %s (%s)\n",
 188                          smb_fname_str_dbg(smb_fname),
 189                          strerror(errno) ));
 190                 return map_nt_error_from_unix(errno);
 191         }
 192
 193         fsp->file_id = vfs_file_id_from_sbuf(conn, &smb_fname->st);
 194         fsp->vuid = UID_FIELD_INVALID;
 195         fsp->file_pid = 0;
 196         fsp->fsp_flags.can_lock = true;
 197         fsp->fsp_flags.can_read = true;
 198         fsp->fsp_flags.can_write = true;
 199         fsp->print_file = NULL;
 200         fsp->fsp_flags.modified = false;
 201         fsp->sent_oplock_break = NO_BREAK_SENT;
 202         fsp->fsp_flags.is_directory = S_ISDIR(smb_fname->st.st_ex_mode);
 203
 204         *_fsp = fsp;
 205
 206         return NT_STATUS_OK;
 207 }
 208
 209 static NTSTATUS set_nt_acl_conn(const char *fname,
 210                                 uint32_t security_info_sent, const struct security_descriptor *sd,
 211                                 connection_struct *conn)
 212 {
 213         TALLOC_CTX *frame = talloc_stackframe();
 214         struct files_struct *fsp = NULL;
 215         NTSTATUS status = NT_STATUS_OK;
 216
 217         /* first, try to open it as a file with flag O_RDWR */
 218         status = init_files_struct(frame,
 219                                    fname,
 220                                    conn,
 221                                    O_RDWR,
 222                                    &fsp);
 223         if (!NT_STATUS_IS_OK(status) && errno == EISDIR) {
 224                 /* if fail, try to open as dir */
 225                 status = init_files_struct(frame,
 226                                            fname,
 227                                            conn,
 228                                            DIRECTORY_FLAGS,
 229                                            &fsp);
 230         }
 231
 232         if (!NT_STATUS_IS_OK(status)) {
 233                 DBG_ERR("init_files_struct failed: %s\n",
 234                         nt_errstr(status));
 235                 if (fsp != NULL) {
 236                         SMB_VFS_CLOSE(fsp);
 237                 }
 238                 TALLOC_FREE(frame);
 239                 return status;
 240         }
 241
 242         status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, sd);
 243         if (!NT_STATUS_IS_OK(status)) {
 244                 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned %s.\n", nt_errstr(status)));
 245         }
 246
 247         SMB_VFS_CLOSE(fsp);
 248
 249         TALLOC_FREE(frame);
 250         return status;
 251 }
 252
 253 static NTSTATUS get_nt_acl_conn(TALLOC_CTX *mem_ctx,
 254                                 const char *fname,
 255                                 connection_struct *conn,
 256                                 uint32_t security_info_wanted,
 257                                 struct security_descriptor **sd)
 258 {
 259         TALLOC_CTX *frame = talloc_stackframe();
 260         NTSTATUS status;
 261         struct smb_filename *smb_fname = synthetic_smb_fname(talloc_tos(),
 262                                         fname,
 263                                         NULL,
 264                                         NULL,
 265                                         lp_posix_pathnames() ?
 266                                                 SMB_FILENAME_POSIX_PATH : 0);
 267
 268         if (smb_fname == NULL) {
 269                 TALLOC_FREE(frame);
 270                 return NT_STATUS_NO_MEMORY;
 271         }
 272
 273         status = SMB_VFS_GET_NT_ACL(conn,
 274                                 smb_fname,
 275                                 security_info_wanted,
 276                                 mem_ctx,
 277                                 sd);
 278         if (!NT_STATUS_IS_OK(status)) {
 279                 DEBUG(0,("get_nt_acl_conn: get_nt_acl returned %s.\n", nt_errstr(status)));
 280         }
 281
 282         TALLOC_FREE(frame);
 283
 284         return status;
 285 }
 286
 287 static int set_acl_entry_perms(SMB_ACL_ENTRY_T entry, mode_t perm_mask)
 288 {
 289         SMB_ACL_PERMSET_T perms = NULL;
 290
 291         if (sys_acl_get_permset(entry, &perms) != 0) {
 292                 return -1;
 293         }
 294
 295         if (sys_acl_clear_perms(perms) != 0) {
 296                 return -1;
 297         }
 298
 299         if ((perm_mask & SMB_ACL_READ) != 0 &&
 300             sys_acl_add_perm(perms, SMB_ACL_READ) != 0) {
 301                 return -1;
 302         }
 303
 304         if ((perm_mask & SMB_ACL_WRITE) != 0 &&
 305             sys_acl_add_perm(perms, SMB_ACL_WRITE) != 0) {
 306                 return -1;
 307         }
 308
 309         if ((perm_mask & SMB_ACL_EXECUTE) != 0 &&
 310             sys_acl_add_perm(perms, SMB_ACL_EXECUTE) != 0) {
 311                 return -1;
 312         }
 313
 314         if (sys_acl_set_permset(entry, perms) != 0) {
 315                 return -1;
 316         }
 317
 318         return 0;
 319 }
 320
 321 static SMB_ACL_T make_simple_acl(TALLOC_CTX *mem_ctx,
 322                         gid_t gid,
 323                         mode_t chmod_mode)
 324 {
 325         mode_t mode = SMB_ACL_READ|SMB_ACL_WRITE|SMB_ACL_EXECUTE;
 326
 327         mode_t mode_user = (chmod_mode & 0700) >> 6;
 328         mode_t mode_group = (chmod_mode & 070) >> 3;
 329         mode_t mode_other = chmod_mode &  07;
 330         SMB_ACL_ENTRY_T entry;
 331         SMB_ACL_T acl = sys_acl_init(mem_ctx);
 332
 333         if (!acl) {
 334                 return NULL;
 335         }
 336
 337         if (sys_acl_create_entry(&acl, &entry) != 0) {
 338                 TALLOC_FREE(acl);
 339                 return NULL;
 340         }
 341
 342         if (sys_acl_set_tag_type(entry, SMB_ACL_USER_OBJ) != 0) {
 343                 TALLOC_FREE(acl);
 344                 return NULL;
 345         }
 346
 347         if (set_acl_entry_perms(entry, mode_user) != 0) {
 348                 TALLOC_FREE(acl);
 349                 return NULL;
 350         }
 351
 352         if (sys_acl_create_entry(&acl, &entry) != 0) {
 353                 TALLOC_FREE(acl);
 354                 return NULL;
 355         }
 356
 357         if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP_OBJ) != 0) {
 358                 TALLOC_FREE(acl);
 359                 return NULL;
 360         }
 361
 362         if (set_acl_entry_perms(entry, mode_group) != 0) {
 363                 TALLOC_FREE(acl);
 364                 return NULL;
 365         }
 366
 367         if (sys_acl_create_entry(&acl, &entry) != 0) {
 368                 TALLOC_FREE(acl);
 369                 return NULL;
 370         }
 371
 372         if (sys_acl_set_tag_type(entry, SMB_ACL_OTHER) != 0) {
 373                 TALLOC_FREE(acl);
 374                 return NULL;
 375         }
 376
 377         if (set_acl_entry_perms(entry, mode_other) != 0) {
 378                 TALLOC_FREE(acl);
 379                 return NULL;
 380         }
 381
 382         if (gid != -1) {
 383                 if (sys_acl_create_entry(&acl, &entry) != 0) {
 384                         TALLOC_FREE(acl);
 385                         return NULL;
 386                 }
 387
 388                 if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP) != 0) {
 389                         TALLOC_FREE(acl);
 390                         return NULL;
 391                 }
 392
 393                 if (sys_acl_set_qualifier(entry, &gid) != 0) {
 394                         TALLOC_FREE(acl);
 395                         return NULL;
 396                 }
 397
 398                 if (set_acl_entry_perms(entry, mode_group) != 0) {
 399                         TALLOC_FREE(acl);
 400                         return NULL;
 401                 }
 402         }
 403
 404         if (sys_acl_create_entry(&acl, &entry) != 0) {
 405                 TALLOC_FREE(acl);
 406                 return NULL;
 407         }
 408
 409         if (sys_acl_set_tag_type(entry, SMB_ACL_MASK) != 0) {
 410                 TALLOC_FREE(acl);
 411                 return NULL;
 412         }
 413
 414         if (set_acl_entry_perms(entry, mode) != 0) {
 415                 TALLOC_FREE(acl);
 416                 return NULL;
 417         }
 418
 419         return acl;
 420 }
 421
 422 /*
 423   set a simple ACL on a file, as a test
 424  */
 425 static PyObject *py_smbd_set_simple_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 426 {
 427         const char * const kwnames[] = {
 428                 "fname",
 429                 "mode",
 430                 "session_info",
 431                 "gid",
 432                 "service",
 433                 NULL
 434         };
 435         char *fname, *service = NULL;
 436         PyObject *py_session = Py_None;
 437         struct auth_session_info *session_info = NULL;
 438         int ret;
 439         int mode, gid = -1;
 440         SMB_ACL_T acl;
 441         TALLOC_CTX *frame;
 442         connection_struct *conn;
 443
 444         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "siO|iz",
 445                                          discard_const_p(char *, kwnames),
 446                                          &fname,
 447                                          &mode,
 448                                          &py_session,
 449                                          &gid,
 450                                          &service))
 451                 return NULL;
 452
 453         if (!py_check_dcerpc_type(py_session,
 454                                   "samba.dcerpc.auth",
 455                                   "session_info")) {
 456                 return NULL;
 457         }
 458         session_info = pytalloc_get_type(py_session,
 459                                          struct auth_session_info);
 460         if (session_info == NULL) {
 461                 PyErr_Format(PyExc_TypeError,
 462                              "Expected auth_session_info for session_info argument got %s",
 463                              pytalloc_get_name(py_session));
 464                 return NULL;
 465         }
 466
 467         frame = talloc_stackframe();
 468
 469         acl = make_simple_acl(frame, gid, mode);
 470         if (acl == NULL) {
 471                 TALLOC_FREE(frame);
 472                 return NULL;
 473         }
 474
 475         conn = get_conn_tos(service, session_info);
 476         if (!conn) {
 477                 TALLOC_FREE(frame);
 478                 return NULL;
 479         }
 480
 481         ret = set_sys_acl_conn(fname, SMB_ACL_TYPE_ACCESS, acl, conn);
 482
 483         if (ret != 0) {
 484                 TALLOC_FREE(frame);
 485                 errno = ret;
 486                 return PyErr_SetFromErrno(PyExc_OSError);
 487         }
 488
 489         TALLOC_FREE(frame);
 490
 491         Py_RETURN_NONE;
 492 }
 493
 494 /*
 495   chown a file
 496  */
 497 static PyObject *py_smbd_chown(PyObject *self, PyObject *args, PyObject *kwargs)
 498 {
 499         const char * const kwnames[] = {
 500                 "fname",
 501                 "uid",
 502                 "gid",
 503                 "session_info",
 504                 "service",
 505                 NULL
 506         };
 507         connection_struct *conn;
 508         int ret;
 509         NTSTATUS status;
 510         char *fname, *service = NULL;
 511         PyObject *py_session = Py_None;
 512         struct auth_session_info *session_info = NULL;
 513         int uid, gid;
 514         TALLOC_CTX *frame;
 515         struct files_struct *fsp = NULL;
 516
 517         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "siiO|z",
 518                                          discard_const_p(char *, kwnames),
 519                                          &fname,
 520                                          &uid,
 521                                          &gid,
 522                                          &py_session,
 523                                          &service))
 524                 return NULL;
 525
 526         if (!py_check_dcerpc_type(py_session,
 527                                   "samba.dcerpc.auth",
 528                                   "session_info")) {
 529                 return NULL;
 530         }
 531         session_info = pytalloc_get_type(py_session,
 532                                          struct auth_session_info);
 533         if (session_info == NULL) {
 534                 PyErr_Format(PyExc_TypeError,
 535                              "Expected auth_session_info for session_info argument got %s",
 536                              pytalloc_get_name(py_session));
 537                 return NULL;
 538         }
 539
 540         frame = talloc_stackframe();
 541
 542         conn = get_conn_tos(service, session_info);
 543         if (!conn) {
 544                 TALLOC_FREE(frame);
 545                 return NULL;
 546         }
 547
 548         /* first, try to open it as a file with flag O_RDWR */
 549         status = init_files_struct(frame,
 550                                    fname,
 551                                    conn,
 552                                    O_RDWR,
 553                                    &fsp);
 554         if (!NT_STATUS_IS_OK(status) && errno == EISDIR) {
 555                 /* if fail, try to open as dir */
 556                 status = init_files_struct(frame,
 557                                            fname,
 558                                            conn,
 559                                            DIRECTORY_FLAGS,
 560                                            &fsp);
 561         }
 562
 563         if (!NT_STATUS_IS_OK(status)) {
 564                 DBG_ERR("init_files_struct failed: %s\n",
 565                         nt_errstr(status));
 566                 if (fsp != NULL) {
 567                         SMB_VFS_CLOSE(fsp);
 568                 }
 569                 TALLOC_FREE(frame);
 570                 /*
 571                  * The following macro raises a python
 572                  * error then returns NULL.
 573                  */
 574                 PyErr_NTSTATUS_IS_ERR_RAISE(status);
 575         }
 576
 577         ret = SMB_VFS_FCHOWN(fsp, uid, gid);
 578         if (ret != 0) {
 579                 int saved_errno = errno;
 580                 SMB_VFS_CLOSE(fsp);
 581                 TALLOC_FREE(frame);
 582                 errno = saved_errno;
 583                 return PyErr_SetFromErrno(PyExc_OSError);
 584         }
 585
 586         SMB_VFS_CLOSE(fsp);
 587         TALLOC_FREE(frame);
 588
 589         Py_RETURN_NONE;
 590 }
 591
 592 /*
 593   unlink a file
 594  */
 595 static PyObject *py_smbd_unlink(PyObject *self, PyObject *args, PyObject *kwargs)
 596 {
 597         const char * const kwnames[] = {
 598                 "fname",
 599                 "session_info",
 600                 "service",
 601                 NULL
 602         };
 603         connection_struct *conn;
 604         int ret;
 605         struct smb_filename *smb_fname = NULL;
 606         PyObject *py_session = Py_None;
 607         struct auth_session_info *session_info = NULL;
 608         char *fname, *service = NULL;
 609         TALLOC_CTX *frame;
 610
 611         frame = talloc_stackframe();
 612
 613         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "sO|z",
 614                                          discard_const_p(char *, kwnames),
 615                                          &fname,
 616                                          &py_session ,
 617                                          &service)) {
 618                 TALLOC_FREE(frame);
 619                 return NULL;
 620         }
 621
 622         if (!py_check_dcerpc_type(py_session,
 623                                   "samba.dcerpc.auth",
 624                                   "session_info")) {
 625                 TALLOC_FREE(frame);
 626                 return NULL;
 627         }
 628         session_info = pytalloc_get_type(py_session,
 629                                          struct auth_session_info);
 630         if (session_info == NULL) {
 631                 PyErr_Format(PyExc_TypeError,
 632                              "Expected auth_session_info for session_info argument got %s",
 633                              pytalloc_get_name(py_session));
 634                 TALLOC_FREE(frame);
 635                 return NULL;
 636         }
 637
 638         conn = get_conn_tos(service, session_info);
 639         if (!conn) {
 640                 TALLOC_FREE(frame);
 641                 return NULL;
 642         }
 643
 644         smb_fname = synthetic_smb_fname_split(frame,
 645                                         fname,
 646                                         lp_posix_pathnames());
 647         if (smb_fname == NULL) {
 648                 TALLOC_FREE(frame);
 649                 return PyErr_NoMemory();
 650         }
 651
 652         ret = SMB_VFS_UNLINKAT(conn,
 653                         conn->cwd_fsp,
 654                         smb_fname,
 655                         0);
 656         if (ret != 0) {
 657                 TALLOC_FREE(frame);
 658                 errno = ret;
 659                 return PyErr_SetFromErrno(PyExc_OSError);
 660         }
 661
 662         TALLOC_FREE(frame);
 663
 664         Py_RETURN_NONE;
 665 }
 666
 667 /*
 668   check if we have ACL support
 669  */
 670 static PyObject *py_smbd_have_posix_acls(PyObject *self,
 671                 PyObject *Py_UNUSED(ignored))
 672 {
 673 #ifdef HAVE_POSIX_ACLS
 674         return PyBool_FromLong(true);
 675 #else
 676         return PyBool_FromLong(false);
 677 #endif
 678 }
 679
 680 /*
 681   set the NT ACL on a file
 682  */
 683 static PyObject *py_smbd_set_nt_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 684 {
 685         const char * const kwnames[] = {
 686                 "fname",
 687                 "security_info_sent",
 688                 "sd",
 689                 "session_info",
 690                 "service",
 691                 NULL
 692         };
 693
 694         NTSTATUS status;
 695         char *fname, *service = NULL;
 696         int security_info_sent;
 697         PyObject *py_sd;
 698         struct security_descriptor *sd;
 699         PyObject *py_session = Py_None;
 700         struct auth_session_info *session_info = NULL;
 701         connection_struct *conn;
 702         TALLOC_CTX *frame;
 703
 704         frame = talloc_stackframe();
 705
 706         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "siOO|z",
 707                                          discard_const_p(char *, kwnames),
 708                                          &fname,
 709                                          &security_info_sent,
 710                                          &py_sd,
 711                                          &py_session,
 712                                          &service)) {
 713                 TALLOC_FREE(frame);
 714                 return NULL;
 715         }
 716
 717         if (!py_check_dcerpc_type(py_sd, "samba.dcerpc.security", "descriptor")) {
 718                 TALLOC_FREE(frame);
 719                 return NULL;
 720         }
 721
 722         if (!py_check_dcerpc_type(py_session,
 723                                   "samba.dcerpc.auth",
 724                                   "session_info")) {
 725                 TALLOC_FREE(frame);
 726                 return NULL;
 727         }
 728         session_info = pytalloc_get_type(py_session,
 729                                          struct auth_session_info);
 730         if (session_info == NULL) {
 731                 PyErr_Format(PyExc_TypeError,
 732                              "Expected auth_session_info for session_info argument got %s",
 733                              pytalloc_get_name(py_session));
 734                 return NULL;
 735         }
 736
 737         conn = get_conn_tos(service, session_info);
 738         if (!conn) {
 739                 TALLOC_FREE(frame);
 740                 return NULL;
 741         }
 742
 743         sd = pytalloc_get_type(py_sd, struct security_descriptor);
 744
 745         status = set_nt_acl_conn(fname, security_info_sent, sd, conn);
 746         TALLOC_FREE(frame);
 747         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 748
 749         Py_RETURN_NONE;
 750 }
 751
 752 /*
 753   Return the NT ACL on a file
 754  */
 755 static PyObject *py_smbd_get_nt_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 756 {
 757         const char * const kwnames[] = {
 758                 "fname",
 759                 "security_info_wanted",
 760                 "session_info",
 761                 "service",
 762                 NULL
 763         };
 764         char *fname, *service = NULL;
 765         int security_info_wanted;
 766         PyObject *py_sd;
 767         struct security_descriptor *sd;
 768         TALLOC_CTX *frame = talloc_stackframe();
 769         PyObject *py_session = Py_None;
 770         struct auth_session_info *session_info = NULL;
 771         connection_struct *conn;
 772         NTSTATUS status;
 773         int ret = 1;
 774
 775         ret = PyArg_ParseTupleAndKeywords(args,
 776                                           kwargs,
 777                                           "siO|z",
 778                                           discard_const_p(char *, kwnames),
 779                                           &fname,
 780                                           &security_info_wanted,
 781                                           &py_session,
 782                                           &service);
 783         if (!ret) {
 784                 TALLOC_FREE(frame);
 785                 return NULL;
 786         }
 787
 788         if (!py_check_dcerpc_type(py_session,
 789                                   "samba.dcerpc.auth",
 790                                   "session_info")) {
 791                 TALLOC_FREE(frame);
 792                 return NULL;
 793         }
 794         session_info = pytalloc_get_type(py_session,
 795                                          struct auth_session_info);
 796         if (session_info == NULL) {
 797                 PyErr_Format(
 798                         PyExc_TypeError,
 799                         "Expected auth_session_info for "
 800                         "session_info argument got %s",
 801                         pytalloc_get_name(py_session));
 802                 return NULL;
 803         }
 804
 805         conn = get_conn_tos(service, session_info);
 806         if (!conn) {
 807                 TALLOC_FREE(frame);
 808                 return NULL;
 809         }
 810
 811         status = get_nt_acl_conn(frame, fname, conn, security_info_wanted, &sd);
 812         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 813
 814         py_sd = py_return_ndr_struct("samba.dcerpc.security", "descriptor", sd, sd);
 815
 816         TALLOC_FREE(frame);
 817
 818         return py_sd;
 819 }
 820
 821 /*
 822   set the posix (or similar) ACL on a file
 823  */
 824 static PyObject *py_smbd_set_sys_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 825 {
 826         const char * const kwnames[] = {
 827                 "fname",
 828                 "acl_type",
 829                 "acl",
 830                 "session_info",
 831                 "service",
 832                 NULL
 833         };
 834         TALLOC_CTX *frame = talloc_stackframe();
 835         int ret;
 836         char *fname, *service = NULL;
 837         PyObject *py_acl;
 838         PyObject *py_session = Py_None;
 839         struct auth_session_info *session_info = NULL;
 840         struct smb_acl_t *acl;
 841         int acl_type;
 842         connection_struct *conn;
 843
 844         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "siOO|z",
 845                                          discard_const_p(char *, kwnames),
 846                                          &fname,
 847                                          &acl_type,
 848                                          &py_acl,
 849                                          &py_session,
 850                                          &service)) {
 851                 TALLOC_FREE(frame);
 852                 return NULL;
 853         }
 854
 855         if (!py_check_dcerpc_type(py_acl, "samba.dcerpc.smb_acl", "t")) {
 856                 TALLOC_FREE(frame);
 857                 return NULL;
 858         }
 859
 860         if (!py_check_dcerpc_type(py_session,
 861                                   "samba.dcerpc.auth",
 862                                   "session_info")) {
 863                 TALLOC_FREE(frame);
 864                 return NULL;
 865         }
 866         session_info = pytalloc_get_type(py_session,
 867                                          struct auth_session_info);
 868         if (session_info == NULL) {
 869                 PyErr_Format(PyExc_TypeError,
 870                              "Expected auth_session_info for session_info argument got %s",
 871                              pytalloc_get_name(py_session));
 872                 TALLOC_FREE(frame);
 873                 return NULL;
 874         }
 875
 876         conn = get_conn_tos(service, session_info);
 877         if (!conn) {
 878                 TALLOC_FREE(frame);
 879                 return NULL;
 880         }
 881
 882         acl = pytalloc_get_type(py_acl, struct smb_acl_t);
 883
 884         ret = set_sys_acl_conn(fname, acl_type, acl, conn);
 885         if (ret != 0) {
 886                 TALLOC_FREE(frame);
 887                 errno = ret;
 888                 return PyErr_SetFromErrno(PyExc_OSError);
 889         }
 890
 891         TALLOC_FREE(frame);
 892         Py_RETURN_NONE;
 893 }
 894
 895 /*
 896   Return the posix (or similar) ACL on a file
 897  */
 898 static PyObject *py_smbd_get_sys_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 899 {
 900         const char * const kwnames[] = {
 901                 "fname",
 902                 "acl_type",
 903                 "session_info",
 904                 "service",
 905                 NULL
 906         };
 907         char *fname;
 908         PyObject *py_acl;
 909         PyObject *py_session = Py_None;
 910         struct auth_session_info *session_info = NULL;
 911         struct smb_acl_t *acl;
 912         int acl_type;
 913         TALLOC_CTX *frame = talloc_stackframe();
 914         connection_struct *conn;
 915         char *service = NULL;
 916         struct smb_filename *smb_fname = NULL;
 917
 918         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "siO|z",
 919                                          discard_const_p(char *, kwnames),
 920                                          &fname,
 921                                          &acl_type,
 922                                          &py_session,
 923                                          &service)) {
 924                 TALLOC_FREE(frame);
 925                 return NULL;
 926         }
 927
 928         if (!py_check_dcerpc_type(py_session,
 929                                   "samba.dcerpc.auth",
 930                                   "session_info")) {
 931                 TALLOC_FREE(frame);
 932                 return NULL;
 933         }
 934         session_info = pytalloc_get_type(py_session,
 935                                          struct auth_session_info);
 936         if (session_info == NULL) {
 937                 PyErr_Format(PyExc_TypeError,
 938                              "Expected auth_session_info for session_info argument got %s",
 939                              pytalloc_get_name(py_session));
 940                 TALLOC_FREE(frame);
 941                 return NULL;
 942         }
 943
 944         conn = get_conn_tos(service, session_info);
 945         if (!conn) {
 946                 TALLOC_FREE(frame);
 947                 return NULL;
 948         }
 949
 950         smb_fname = synthetic_smb_fname_split(frame,
 951                                         fname,
 952                                         lp_posix_pathnames());
 953         if (smb_fname == NULL) {
 954                 TALLOC_FREE(frame);
 955                 return NULL;
 956         }
 957         acl = SMB_VFS_SYS_ACL_GET_FILE( conn, smb_fname, acl_type, frame);
 958         if (!acl) {
 959                 TALLOC_FREE(frame);
 960                 return PyErr_SetFromErrno(PyExc_OSError);
 961         }
 962
 963         py_acl = py_return_ndr_struct("samba.dcerpc.smb_acl", "t", acl, acl);
 964
 965         TALLOC_FREE(frame);
 966
 967         return py_acl;
 968 }
 969
 970 static PyObject *py_smbd_mkdir(PyObject *self, PyObject *args, PyObject *kwargs)
 971 {
 972         const char * const kwnames[] = {
 973                 "fname",
 974                 "session_info",
 975                 "service",
 976                 NULL
 977         };
 978         char *fname, *service = NULL;
 979         PyObject *py_session = Py_None;
 980         struct auth_session_info *session_info = NULL;
 981         TALLOC_CTX *frame = talloc_stackframe();
 982         struct connection_struct *conn = NULL;
 983         struct smb_filename *smb_fname = NULL;
 984         int ret;
 985         mode_t saved_umask;
 986
 987         if (!PyArg_ParseTupleAndKeywords(args,
 988                                          kwargs,
 989                                          "sO|z",
 990                                          discard_const_p(char *,
 991                                                          kwnames),
 992                                          &fname,
 993                                          &py_session,
 994                                          &service)) {
 995                 TALLOC_FREE(frame);
 996                 return NULL;
 997         }
 998
 999         if (!py_check_dcerpc_type(py_session,
1000                                   "samba.dcerpc.auth",
1001                                   "session_info")) {
1002                 TALLOC_FREE(frame);
1003                 return NULL;
1004         }
1005         session_info = pytalloc_get_type(py_session,
1006                                          struct auth_session_info);
1007         if (session_info == NULL) {
1008                 PyErr_Format(PyExc_TypeError,
1009                              "Expected auth_session_info for session_info argument got %s",
1010                              pytalloc_get_name(py_session));
1011                 TALLOC_FREE(frame);
1012                 return NULL;
1013         }
1014
1015         conn = get_conn_tos(service, session_info);
1016         if (!conn) {
1017                 TALLOC_FREE(frame);
1018                 return NULL;
1019         }
1020
1021         smb_fname = synthetic_smb_fname(talloc_tos(),
1022                                         fname,
1023                                         NULL,
1024                                         NULL,
1025                                         lp_posix_pathnames() ?
1026                                         SMB_FILENAME_POSIX_PATH : 0);
1027
1028         if (smb_fname == NULL) {
1029                 TALLOC_FREE(frame);
1030                 return NULL;
1031         }
1032
1033         /* we want total control over the permissions on created files,
1034            so set our umask to 0 */
1035         saved_umask = umask(0);
1036
1037         ret = SMB_VFS_MKDIRAT(conn,
1038                         conn->cwd_fsp,
1039                         smb_fname,
1040                         00755);
1041
1042         umask(saved_umask);
1043
1044         if (ret == -1) {
1045                 DBG_ERR("mkdirat error=%d (%s)\n", errno, strerror(errno));
1046                 TALLOC_FREE(frame);
1047                 return NULL;
1048         }
1049
1050         TALLOC_FREE(frame);
1051         Py_RETURN_NONE;
1052 }
1053
1054
1055 /*
1056   Create an empty file
1057  */
1058 static PyObject *py_smbd_create_file(PyObject *self, PyObject *args, PyObject *kwargs)
1059 {
1060         const char * const kwnames[] = {
1061                 "fname",
1062                 "session_info",
1063                 "service",
1064                 NULL
1065         };
1066         char *fname, *service = NULL;
1067         PyObject *py_session = Py_None;
1068         struct auth_session_info *session_info = NULL;
1069         TALLOC_CTX *frame = talloc_stackframe();
1070         struct connection_struct *conn = NULL;
1071         struct files_struct *fsp = NULL;
1072         NTSTATUS status;
1073
1074         if (!PyArg_ParseTupleAndKeywords(args,
1075                                          kwargs,
1076                                          "sO|z",
1077                                          discard_const_p(char *,
1078                                                          kwnames),
1079                                          &fname,
1080                                          &py_session,
1081                                          &service)) {
1082                 TALLOC_FREE(frame);
1083                 return NULL;
1084         }
1085
1086         if (!py_check_dcerpc_type(py_session,
1087                                   "samba.dcerpc.auth",
1088                                   "session_info")) {
1089                 TALLOC_FREE(frame);
1090                 return NULL;
1091         }
1092         session_info = pytalloc_get_type(py_session,
1093                                          struct auth_session_info);
1094         if (session_info == NULL) {
1095                 PyErr_Format(PyExc_TypeError,
1096                              "Expected auth_session_info for session_info argument got %s",
1097                              pytalloc_get_name(py_session));
1098                 TALLOC_FREE(frame);
1099                 return NULL;
1100         }
1101
1102         conn = get_conn_tos(service, session_info);
1103         if (!conn) {
1104                 TALLOC_FREE(frame);
1105                 return NULL;
1106         }
1107
1108         status = init_files_struct(frame,
1109                                    fname,
1110                                    conn,
1111                                    O_CREAT|O_EXCL|O_RDWR,
1112                                    &fsp);
1113         if (!NT_STATUS_IS_OK(status)) {
1114                 DBG_ERR("init_files_struct failed: %s\n",
1115                         nt_errstr(status));
1116         }
1117
1118         TALLOC_FREE(frame);
1119         Py_RETURN_NONE;
1120 }
1121
1122
1123 static PyMethodDef py_smbd_methods[] = {
1124         { "have_posix_acls",
1125                 (PyCFunction)py_smbd_have_posix_acls, METH_NOARGS,
1126                 NULL },
1127         { "set_simple_acl",
1128                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_set_simple_acl),
1129                 METH_VARARGS|METH_KEYWORDS,
1130                 NULL },
1131         { "set_nt_acl",
1132                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_set_nt_acl),
1133                 METH_VARARGS|METH_KEYWORDS,
1134                 NULL },
1135         { "get_nt_acl",
1136                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_get_nt_acl),
1137                 METH_VARARGS|METH_KEYWORDS,
1138                 NULL },
1139         { "get_sys_acl",
1140                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_get_sys_acl),
1141                 METH_VARARGS|METH_KEYWORDS,
1142                 NULL },
1143         { "set_sys_acl",
1144                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_set_sys_acl),
1145                 METH_VARARGS|METH_KEYWORDS,
1146                 NULL },
1147         { "chown",
1148                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_chown),
1149                 METH_VARARGS|METH_KEYWORDS,
1150                 NULL },
1151         { "unlink",
1152                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_unlink),
1153                 METH_VARARGS|METH_KEYWORDS,
1154                 NULL },
1155         { "mkdir",
1156                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_mkdir),
1157                 METH_VARARGS|METH_KEYWORDS,
1158                 NULL },
1159         { "create_file",
1160                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_create_file),
1161                 METH_VARARGS|METH_KEYWORDS,
1162                 NULL },
1163         { NULL }
1164 };
1165
1166 void initsmbd(void);
1167
1168 static struct PyModuleDef moduledef = {
1169     PyModuleDef_HEAD_INIT,
1170     .m_name = "smbd",
1171     .m_doc = "Python bindings for the smbd file server.",
1172     .m_size = -1,
1173     .m_methods = py_smbd_methods,
1174 };
1175
1176 MODULE_INIT_FUNC(smbd)
1177 {
1178         PyObject *m = NULL;
1179
1180         m = PyModule_Create(&moduledef);
1181         return m;
1182 }