*/
#include "includes.h"
+#include "system/filesys.h"
+#include "smbd/smbd.h"
#include "nfs4_acls.h"
+#if HAVE_FREEBSD_SUNACL_H
+#include "sunacl.h"
+#endif
+
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_VFS
* read the local file's acls and return it in NT form
* using the NFSv4 format conversion
*/
-static NTSTATUS zfs_get_nt_acl_common(const char *name,
- uint32 security_info,
- SMB4ACL_T **ppacl)
+static NTSTATUS zfs_get_nt_acl_common(TALLOC_CTX *mem_ctx,
+ const char *name,
+ struct SMB4ACL_T **ppacl)
{
int naces, i;
ace_t *acebuf;
- SMB4ACL_T *pacl;
- TALLOC_CTX *mem_ctx;
+ struct SMB4ACL_T *pacl;
/* read the number of file aces */
if((naces = acl(name, ACE_GETACLCNT, 0, NULL)) == -1) {
if(errno == ENOSYS) {
DEBUG(9, ("acl(ACE_GETACLCNT, %s): Operation is not "
"supported on the filesystem where the file "
- "reside", name));
+ "reside\n", name));
} else {
DEBUG(9, ("acl(ACE_GETACLCNT, %s): %s ", name,
strerror(errno)));
return map_nt_error_from_unix(errno);
}
/* create SMB4ACL data */
- if((pacl = smb_create_smb4acl()) == NULL) {
+ if((pacl = smb_create_smb4acl(mem_ctx)) == NULL) {
return NT_STATUS_NO_MEMORY;
}
for(i=0; i<naces; i++) {
SMB_ACE4PROP_T aceprop;
- aceprop.aceType = (uint32) acebuf[i].a_type;
- aceprop.aceFlags = (uint32) acebuf[i].a_flags;
- aceprop.aceMask = (uint32) acebuf[i].a_access_mask;
- aceprop.who.id = (uint32) acebuf[i].a_who;
+ aceprop.aceType = (uint32_t) acebuf[i].a_type;
+ aceprop.aceFlags = (uint32_t) acebuf[i].a_flags;
+ aceprop.aceMask = (uint32_t) acebuf[i].a_access_mask;
+ aceprop.who.id = (uint32_t) acebuf[i].a_who;
if(aceprop.aceFlags & ACE_OWNER) {
aceprop.flags = SMB_ACE4_ID_SPECIAL;
}
/* call-back function processing the NT acl -> ZFS acl using NFSv4 conv. */
-static bool zfs_process_smbacl(files_struct *fsp, SMB4ACL_T *smbacl)
+static bool zfs_process_smbacl(vfs_handle_struct *handle, files_struct *fsp,
+ struct SMB4ACL_T *smbacl)
{
int naces = smb_get_naces(smbacl), i;
ace_t *acebuf;
- SMB4ACE_T *smbace;
+ struct SMB4ACE_T *smbace;
TALLOC_CTX *mem_ctx;
+ bool have_special_id = false;
/* allocate the field of ZFS aces */
mem_ctx = talloc_tos();
acebuf[i].a_type = aceprop->aceType;
acebuf[i].a_flags = aceprop->aceFlags;
acebuf[i].a_access_mask = aceprop->aceMask;
+ /* SYNC on acls is a no-op on ZFS.
+ See bug #7909. */
+ acebuf[i].a_access_mask &= ~SMB_ACE4_SYNCHRONIZE;
acebuf[i].a_who = aceprop->who.id;
if(aceprop->flags & SMB_ACE4_ID_SPECIAL) {
switch(aceprop->who.special_id) {
acebuf[i].a_flags |= ACE_OWNER;
break;
case SMB_ACE4_WHO_GROUP:
- acebuf[i].a_flags |= ACE_GROUP;
+ acebuf[i].a_flags |= ACE_GROUP|ACE_IDENTIFIER_GROUP;
break;
default:
DEBUG(8, ("unsupported special_id %d\n", \
aceprop->who.special_id));
continue; /* don't add it !!! */
}
+ have_special_id = true;
}
}
+
+ if (!have_special_id
+ && lp_parm_bool(fsp->conn->params->service, "zfsacl",
+ "denymissingspecial", false)) {
+ errno = EACCES;
+ return false;
+ }
+
SMB_ASSERT(i == naces);
/* store acl */
- if(acl(fsp->fsp_name, ACE_SETACL, naces, acebuf)) {
+ if(acl(fsp->fsp_name->base_name, ACE_SETACL, naces, acebuf)) {
if(errno == ENOSYS) {
DEBUG(9, ("acl(ACE_SETACL, %s): Operation is not "
"supported on the filesystem where the file "
- "reside", fsp->fsp_name));
+ "reside", fsp_str_dbg(fsp)));
} else {
- DEBUG(9, ("acl(ACE_SETACL, %s): %s ", fsp->fsp_name,
- strerror(errno)));
+ DEBUG(9, ("acl(ACE_SETACL, %s): %s ", fsp_str_dbg(fsp),
+ strerror(errno)));
}
return 0;
}
* using the NFSv4 format conversion
*/
static NTSTATUS zfs_set_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
- uint32 security_info_sent,
+ uint32_t security_info_sent,
const struct security_descriptor *psd)
{
- return smb_set_nt_acl_nfs4(fsp, security_info_sent, psd,
- zfs_process_smbacl);
+ return smb_set_nt_acl_nfs4(handle, fsp, NULL, security_info_sent, psd,
+ zfs_process_smbacl);
}
static NTSTATUS zfsacl_fget_nt_acl(struct vfs_handle_struct *handle,
- struct files_struct *fsp,
- uint32 security_info,
- struct security_descriptor **ppdesc)
+ struct files_struct *fsp,
+ uint32_t security_info,
+ TALLOC_CTX *mem_ctx,
+ struct security_descriptor **ppdesc)
{
- SMB4ACL_T *pacl;
+ struct SMB4ACL_T *pacl;
NTSTATUS status;
+ TALLOC_CTX *frame = talloc_stackframe();
- status = zfs_get_nt_acl_common(fsp->fsp_name, security_info, &pacl);
+ status = zfs_get_nt_acl_common(frame,
+ fsp->fsp_name->base_name,
+ &pacl);
if (!NT_STATUS_IS_OK(status)) {
+ TALLOC_FREE(frame);
return status;
}
- return smb_fget_nt_acl_nfs4(fsp, security_info, ppdesc, pacl);
+ status = smb_fget_nt_acl_nfs4(fsp, NULL, security_info, mem_ctx,
+ ppdesc, pacl);
+ TALLOC_FREE(frame);
+ return status;
}
static NTSTATUS zfsacl_get_nt_acl(struct vfs_handle_struct *handle,
- const char *name, uint32 security_info,
+ const struct smb_filename *smb_fname,
+ uint32_t security_info,
+ TALLOC_CTX *mem_ctx,
struct security_descriptor **ppdesc)
{
- SMB4ACL_T *pacl;
+ struct SMB4ACL_T *pacl;
NTSTATUS status;
+ TALLOC_CTX *frame = talloc_stackframe();
- status = zfs_get_nt_acl_common(name, security_info, &pacl);
+ status = zfs_get_nt_acl_common(frame,
+ smb_fname->base_name,
+ &pacl);
if (!NT_STATUS_IS_OK(status)) {
+ TALLOC_FREE(frame);
return status;
}
- return smb_get_nt_acl_nfs4(handle->conn, name, security_info, ppdesc,
- pacl);
+ status = smb_get_nt_acl_nfs4(handle->conn,
+ smb_fname,
+ NULL,
+ security_info,
+ mem_ctx,
+ ppdesc,
+ pacl);
+ TALLOC_FREE(frame);
+ return status;
}
static NTSTATUS zfsacl_fset_nt_acl(vfs_handle_struct *handle,
files_struct *fsp,
- uint32 security_info_sent,
- const SEC_DESC *psd)
+ uint32_t security_info_sent,
+ const struct security_descriptor *psd)
{
return zfs_set_nt_acl(handle, fsp, security_info_sent, psd);
}
Function declarations taken from vfs_solarisacl
*/
-SMB_ACL_T zfsacl_fail__sys_acl_get_file(vfs_handle_struct *handle,
- const char *path_p,
- SMB_ACL_TYPE_T type)
+static SMB_ACL_T zfsacl_fail__sys_acl_get_file(vfs_handle_struct *handle,
+ const char *path_p,
+ SMB_ACL_TYPE_T type,
+ TALLOC_CTX *mem_ctx)
{
return (SMB_ACL_T)NULL;
}
-SMB_ACL_T zfsacl_fail__sys_acl_get_fd(vfs_handle_struct *handle,
- files_struct *fsp,
- int fd)
+
+static SMB_ACL_T zfsacl_fail__sys_acl_get_fd(vfs_handle_struct *handle,
+ files_struct *fsp,
+ TALLOC_CTX *mem_ctx)
{
return (SMB_ACL_T)NULL;
}
-int zfsacl_fail__sys_acl_set_file(vfs_handle_struct *handle,
- const char *name,
- SMB_ACL_TYPE_T type,
- SMB_ACL_T theacl)
+static int zfsacl_fail__sys_acl_set_file(vfs_handle_struct *handle,
+ const char *name,
+ SMB_ACL_TYPE_T type,
+ SMB_ACL_T theacl)
+{
+ return -1;
+}
+
+static int zfsacl_fail__sys_acl_set_fd(vfs_handle_struct *handle,
+ files_struct *fsp,
+ SMB_ACL_T theacl)
+{
+ return -1;
+}
+
+static int zfsacl_fail__sys_acl_delete_def_file(vfs_handle_struct *handle,
+ const struct smb_filename *smb_fname)
{
return -1;
}
-int zfsacl_fail__sys_acl_set_fd(vfs_handle_struct *handle,
- files_struct *fsp,
- int fd, SMB_ACL_T theacl)
+static int zfsacl_fail__sys_acl_blob_get_file(vfs_handle_struct *handle, const char *path_p, TALLOC_CTX *mem_ctx, char **blob_description, DATA_BLOB *blob)
{
return -1;
}
-int zfsacl_fail__sys_acl_delete_def_file(vfs_handle_struct *handle,
- const char *path)
+static int zfsacl_fail__sys_acl_blob_get_fd(vfs_handle_struct *handle, files_struct *fsp, TALLOC_CTX *mem_ctx, char **blob_description, DATA_BLOB *blob)
{
return -1;
}
/* VFS operations structure */
-static vfs_op_tuple zfsacl_ops[] = {
- /* invalidate conflicting VFS methods */
- {SMB_VFS_OP(zfsacl_fail__sys_acl_get_file),
- SMB_VFS_OP_SYS_ACL_GET_FILE,
- SMB_VFS_LAYER_OPAQUE},
- {SMB_VFS_OP(zfsacl_fail__sys_acl_get_fd),
- SMB_VFS_OP_SYS_ACL_GET_FD,
- SMB_VFS_LAYER_OPAQUE},
- {SMB_VFS_OP(zfsacl_fail__sys_acl_set_file),
- SMB_VFS_OP_SYS_ACL_SET_FILE,
- SMB_VFS_LAYER_OPAQUE},
- {SMB_VFS_OP(zfsacl_fail__sys_acl_set_fd),
- SMB_VFS_OP_SYS_ACL_SET_FD,
- SMB_VFS_LAYER_OPAQUE},
- {SMB_VFS_OP(zfsacl_fail__sys_acl_delete_def_file),
- SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE,
- SMB_VFS_LAYER_OPAQUE},
-
- /* actual methods */
- {SMB_VFS_OP(zfsacl_fget_nt_acl), SMB_VFS_OP_FGET_NT_ACL,
- SMB_VFS_LAYER_OPAQUE},
- {SMB_VFS_OP(zfsacl_get_nt_acl), SMB_VFS_OP_GET_NT_ACL,
- SMB_VFS_LAYER_OPAQUE},
- {SMB_VFS_OP(zfsacl_fset_nt_acl), SMB_VFS_OP_FSET_NT_ACL,
- SMB_VFS_LAYER_OPAQUE},
- {SMB_VFS_OP(NULL), SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP}
+static struct vfs_fn_pointers zfsacl_fns = {
+ .sys_acl_get_file_fn = zfsacl_fail__sys_acl_get_file,
+ .sys_acl_get_fd_fn = zfsacl_fail__sys_acl_get_fd,
+ .sys_acl_blob_get_file_fn = zfsacl_fail__sys_acl_blob_get_file,
+ .sys_acl_blob_get_fd_fn = zfsacl_fail__sys_acl_blob_get_fd,
+ .sys_acl_set_file_fn = zfsacl_fail__sys_acl_set_file,
+ .sys_acl_set_fd_fn = zfsacl_fail__sys_acl_set_fd,
+ .sys_acl_delete_def_file_fn = zfsacl_fail__sys_acl_delete_def_file,
+ .fget_nt_acl_fn = zfsacl_fget_nt_acl,
+ .get_nt_acl_fn = zfsacl_get_nt_acl,
+ .fset_nt_acl_fn = zfsacl_fset_nt_acl,
};
-NTSTATUS vfs_zfsacl_init(void);
-NTSTATUS vfs_zfsacl_init(void)
+NTSTATUS vfs_zfsacl_init(TALLOC_CTX *);
+NTSTATUS vfs_zfsacl_init(TALLOC_CTX *ctx)
{
return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "zfsacl",
- zfsacl_ops);
+ &zfsacl_fns);
}