2 * Store Windows ACLs in a tdb.
4 * Copyright (C) Volker Lendecke, 2008
5 * Copyright (C) Jeremy Allison, 2008
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 #include "smbd/smbd.h"
23 #include "system/filesys.h"
24 #include "librpc/gen_ndr/xattr.h"
25 #include "../lib/crypto/sha256.h"
26 #include "dbwrap/dbwrap.h"
27 #include "dbwrap/dbwrap_open.h"
30 #include "vfs_acl_common.h"
33 #define DBGC_CLASS DBGC_VFS
35 #define ACL_MODULE_NAME "acl_tdb"
37 static unsigned int ref_count;
38 static struct db_context *acl_db;
40 /*******************************************************************
41 Open acl_db if not already open, increment ref count.
42 *******************************************************************/
44 static bool acl_tdb_init(void)
53 dbname = state_path("file_ntacls.tdb");
61 acl_db = db_open(NULL, dbname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600,
62 DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
80 /*******************************************************************
81 Lower ref count and close acl_db if zero.
82 *******************************************************************/
84 static void disconnect_acl_tdb(struct vfs_handle_struct *handle)
86 SMB_VFS_NEXT_DISCONNECT(handle);
93 /*******************************************************************
94 Fetch_lock the tdb acl record for a file
95 *******************************************************************/
97 static struct db_record *acl_tdb_lock(TALLOC_CTX *mem_ctx,
98 struct db_context *db,
99 const struct file_id *id)
103 /* For backwards compatibility only store the dev/inode. */
104 push_file_id_16((char *)id_buf, id);
105 return dbwrap_fetch_locked(db,
107 make_tdb_data(id_buf,
111 /*******************************************************************
112 Delete the tdb acl record for a file
113 *******************************************************************/
115 static NTSTATUS acl_tdb_delete(vfs_handle_struct *handle,
116 struct db_context *db,
117 SMB_STRUCT_STAT *psbuf)
120 struct file_id id = vfs_file_id_from_sbuf(handle->conn, psbuf);
121 struct db_record *rec = acl_tdb_lock(talloc_tos(), db, &id);
124 * If rec == NULL there's not much we can do about it
128 DEBUG(10,("acl_tdb_delete: rec == NULL\n"));
133 status = dbwrap_record_delete(rec);
138 /*******************************************************************
139 Pull a security descriptor into a DATA_BLOB from a tdb store.
140 *******************************************************************/
142 static NTSTATUS get_acl_blob(TALLOC_CTX *ctx,
143 vfs_handle_struct *handle,
145 const struct smb_filename *smb_fname,
151 struct db_context *db = acl_db;
152 NTSTATUS status = NT_STATUS_OK;
153 SMB_STRUCT_STAT sbuf;
158 status = vfs_stat_fsp(fsp);
159 sbuf = fsp->fsp_name->st;
161 int ret = vfs_stat_smb_basename(handle->conn,
165 status = map_nt_error_from_unix(errno);
169 if (!NT_STATUS_IS_OK(status)) {
173 id = vfs_file_id_from_sbuf(handle->conn, &sbuf);
175 /* For backwards compatibility only store the dev/inode. */
176 push_file_id_16((char *)id_buf, &id);
178 status = dbwrap_fetch(db,
180 make_tdb_data(id_buf, sizeof(id_buf)),
182 if (!NT_STATUS_IS_OK(status)) {
183 return NT_STATUS_INTERNAL_DB_CORRUPTION;
186 pblob->data = data.dptr;
187 pblob->length = data.dsize;
189 DEBUG(10,("get_acl_blob: returned %u bytes from file %s\n",
190 (unsigned int)data.dsize, smb_fname->base_name ));
192 if (pblob->length == 0 || pblob->data == NULL) {
193 return NT_STATUS_NOT_FOUND;
198 /*******************************************************************
199 Store a DATA_BLOB into a tdb record given an fsp pointer.
200 *******************************************************************/
202 static NTSTATUS store_acl_blob_fsp(vfs_handle_struct *handle,
209 struct db_context *db = acl_db;
210 struct db_record *rec;
213 DEBUG(10,("store_acl_blob_fsp: storing blob length %u on file %s\n",
214 (unsigned int)pblob->length, fsp_str_dbg(fsp)));
216 status = vfs_stat_fsp(fsp);
217 if (!NT_STATUS_IS_OK(status)) {
221 id = vfs_file_id_from_sbuf(handle->conn, &fsp->fsp_name->st);
223 /* For backwards compatibility only store the dev/inode. */
224 push_file_id_16((char *)id_buf, &id);
225 rec = dbwrap_fetch_locked(db, talloc_tos(),
226 make_tdb_data(id_buf,
229 DEBUG(0, ("store_acl_blob_fsp_tdb: fetch_lock failed\n"));
230 return NT_STATUS_INTERNAL_DB_CORRUPTION;
232 data.dptr = pblob->data;
233 data.dsize = pblob->length;
234 return dbwrap_record_store(rec, data, 0);
237 /*********************************************************************
238 On unlink we need to delete the tdb record (if using tdb).
239 *********************************************************************/
241 static int unlink_acl_tdb(vfs_handle_struct *handle,
242 const struct smb_filename *smb_fname)
244 struct smb_filename *smb_fname_tmp = NULL;
245 struct db_context *db = acl_db;
248 smb_fname_tmp = cp_smb_filename_nostream(talloc_tos(), smb_fname);
249 if (smb_fname_tmp == NULL) {
254 if (smb_fname_tmp->flags & SMB_FILENAME_POSIX_PATH) {
255 ret = SMB_VFS_LSTAT(handle->conn, smb_fname_tmp);
257 ret = SMB_VFS_STAT(handle->conn, smb_fname_tmp);
264 ret = unlink_acl_common(handle, smb_fname_tmp);
270 acl_tdb_delete(handle, db, &smb_fname_tmp->st);
275 /*********************************************************************
276 On rmdir we need to delete the tdb record (if using tdb).
277 *********************************************************************/
279 static int rmdir_acl_tdb(vfs_handle_struct *handle,
280 const struct smb_filename *smb_fname)
283 SMB_STRUCT_STAT sbuf;
284 struct db_context *db = acl_db;
287 ret = vfs_stat_smb_basename(handle->conn, smb_fname, &sbuf);
292 ret = rmdir_acl_common(handle, smb_fname);
297 acl_tdb_delete(handle, db, &sbuf);
301 /*******************************************************************
302 Handle opening the storage tdb if so configured.
303 *******************************************************************/
305 static int connect_acl_tdb(struct vfs_handle_struct *handle,
309 int ret = SMB_VFS_NEXT_CONNECT(handle, service, user);
311 struct acl_common_config *config = NULL;
317 if (!acl_tdb_init()) {
318 SMB_VFS_NEXT_DISCONNECT(handle);
322 ok = init_acl_common_config(handle, ACL_MODULE_NAME);
324 DBG_ERR("init_acl_common_config failed\n");
328 /* Ensure we have the parameters correct if we're
329 * using this module. */
330 DEBUG(2,("connect_acl_tdb: setting 'inherit acls = true' "
331 "'dos filemode = true' and "
332 "'force unknown acl user = true' for service %s\n",
335 lp_do_parameter(SNUM(handle->conn), "inherit acls", "true");
336 lp_do_parameter(SNUM(handle->conn), "dos filemode", "true");
337 lp_do_parameter(SNUM(handle->conn), "force unknown acl user", "true");
339 SMB_VFS_HANDLE_GET_DATA(handle, config,
340 struct acl_common_config,
343 if (config->ignore_system_acls) {
344 mode_t create_mask = lp_create_mask(SNUM(handle->conn));
345 char *create_mask_str = NULL;
347 if ((create_mask & 0666) != 0666) {
349 create_mask_str = talloc_asprintf(handle, "0%o",
351 if (create_mask_str == NULL) {
352 DBG_ERR("talloc_asprintf failed\n");
356 DBG_NOTICE("setting 'create mask = %s'\n", create_mask_str);
358 lp_do_parameter (SNUM(handle->conn),
359 "create mask", create_mask_str);
361 TALLOC_FREE(create_mask_str);
364 DBG_NOTICE("setting 'directory mask = 0777', "
365 "'store dos attributes = yes' and all "
366 "'map ...' options to 'no'\n");
368 lp_do_parameter(SNUM(handle->conn), "directory mask", "0777");
369 lp_do_parameter(SNUM(handle->conn), "map archive", "no");
370 lp_do_parameter(SNUM(handle->conn), "map hidden", "no");
371 lp_do_parameter(SNUM(handle->conn), "map readonly", "no");
372 lp_do_parameter(SNUM(handle->conn), "map system", "no");
373 lp_do_parameter(SNUM(handle->conn), "store dos attributes",
380 /*********************************************************************
381 Remove a Windows ACL - we're setting the underlying POSIX ACL.
382 *********************************************************************/
384 static int sys_acl_set_file_tdb(vfs_handle_struct *handle,
385 const struct smb_filename *smb_fname_in,
389 struct db_context *db = acl_db;
392 struct smb_filename *smb_fname = NULL;
394 smb_fname = cp_smb_filename_nostream(talloc_tos(), smb_fname_in);
395 if (smb_fname == NULL) {
399 ret = SMB_VFS_STAT(handle->conn, smb_fname);
405 ret = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle,
414 acl_tdb_delete(handle, db, &smb_fname->st);
417 TALLOC_FREE(smb_fname);
419 if (saved_errno != 0) {
425 /*********************************************************************
426 Remove a Windows ACL - we're setting the underlying POSIX ACL.
427 *********************************************************************/
429 static int sys_acl_set_fd_tdb(vfs_handle_struct *handle,
433 struct db_context *db = acl_db;
437 status = vfs_stat_fsp(fsp);
438 if (!NT_STATUS_IS_OK(status)) {
442 ret = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle,
449 acl_tdb_delete(handle, db, &fsp->fsp_name->st);
453 static NTSTATUS acl_tdb_fget_nt_acl(vfs_handle_struct *handle,
455 uint32_t security_info,
457 struct security_descriptor **ppdesc)
460 status = get_nt_acl_common(get_acl_blob, handle, fsp, NULL,
461 security_info, mem_ctx, ppdesc);
465 static NTSTATUS acl_tdb_get_nt_acl(vfs_handle_struct *handle,
466 const struct smb_filename *smb_fname,
467 uint32_t security_info,
469 struct security_descriptor **ppdesc)
472 status = get_nt_acl_common(get_acl_blob, handle, NULL, smb_fname,
473 security_info, mem_ctx, ppdesc);
477 static NTSTATUS acl_tdb_fset_nt_acl(vfs_handle_struct *handle,
479 uint32_t security_info_sent,
480 const struct security_descriptor *psd)
483 status = fset_nt_acl_common(get_acl_blob, store_acl_blob_fsp,
485 handle, fsp, security_info_sent, psd);
489 static struct vfs_fn_pointers vfs_acl_tdb_fns = {
490 .connect_fn = connect_acl_tdb,
491 .disconnect_fn = disconnect_acl_tdb,
492 .rmdir_fn = rmdir_acl_tdb,
493 .unlink_fn = unlink_acl_tdb,
494 .chmod_fn = chmod_acl_module_common,
495 .fchmod_fn = fchmod_acl_module_common,
496 .fget_nt_acl_fn = acl_tdb_fget_nt_acl,
497 .get_nt_acl_fn = acl_tdb_get_nt_acl,
498 .fset_nt_acl_fn = acl_tdb_fset_nt_acl,
499 .sys_acl_set_file_fn = sys_acl_set_file_tdb,
500 .sys_acl_set_fd_fn = sys_acl_set_fd_tdb
504 NTSTATUS vfs_acl_tdb_init(TALLOC_CTX *ctx)
506 return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "acl_tdb",