2 Unix SMB/CIFS implementation.
3 Check access to files based on security descriptors.
4 Copyright (C) Jeremy Allison 2005-2006.
5 Copyright (C) Michael Adam 2007.
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "system/filesys.h"
23 #include "../libcli/security/security.h"
24 #include "../librpc/gen_ndr/ndr_security.h"
25 #include "smbd/smbd.h"
28 #define DBGC_CLASS DBGC_ACLS
30 /****************************************************************************
31 Actually emulate the in-kernel access checking for delete access. We need
32 this to successfully return ACCESS_DENIED on a file open for delete access.
33 ****************************************************************************/
35 bool can_delete_file_in_directory(connection_struct *conn,
36 struct files_struct *dirfsp,
37 const struct smb_filename *smb_fname)
39 struct smb_filename *smb_fname_parent = NULL;
43 if (!CAN_WRITE(conn)) {
47 if (!lp_acl_check_permissions(SNUM(conn))) {
48 /* This option means don't check. */
52 if (get_current_uid(conn) == (uid_t)0) {
53 /* I'm sorry sir, I didn't know you were root... */
57 if (dirfsp != conn->cwd_fsp) {
58 smb_fname_parent = dirfsp->fsp_name;
60 struct smb_filename *atname = NULL;
62 * Get a pathref on the parent.
64 status = parent_pathref(talloc_tos(),
69 if (!NT_STATUS_IS_OK(status)) {
74 SMB_ASSERT(VALID_STAT(smb_fname_parent->st));
76 /* fast paths first */
78 if (!S_ISDIR(smb_fname_parent->st.st_ex_mode)) {
84 /* sticky bit means delete only by owner of file or by root or
85 * by owner of directory. */
86 if (smb_fname_parent->st.st_ex_mode & S_ISVTX) {
87 if (!VALID_STAT(smb_fname->st)) {
88 /* If the file doesn't already exist then
89 * yes we'll be able to delete it. */
95 * Patch from SATOH Fumiyasu <fumiyas@miraclelinux.com>
96 * for bug #3348. Don't assume owning sticky bit
97 * directory means write access allowed.
98 * Fail to delete if we're not the owner of the file,
99 * or the owner of the directory as we have no possible
100 * chance of deleting. Otherwise, go on and check the ACL.
102 if ((get_current_uid(conn) !=
103 smb_fname_parent->st.st_ex_uid) &&
104 (get_current_uid(conn) != smb_fname->st.st_ex_uid)) {
105 DEBUG(10,("can_delete_file_in_directory: not "
106 "owner of file %s or directory %s",
107 smb_fname_str_dbg(smb_fname),
108 smb_fname_str_dbg(smb_fname_parent)));
115 /* now for ACL checks */
118 * There's two ways to get the permission to delete a file: First by
119 * having the DELETE bit on the file itself and second if that does
120 * not help, by the DELETE_CHILD bit on the containing directory.
122 * Here we only check the directory permissions, we will
123 * check the file DELETE permission separately.
126 ret = NT_STATUS_IS_OK(smbd_check_access_rights_fsp(
128 smb_fname_parent->fsp,
132 if (smb_fname_parent != dirfsp->fsp_name) {
133 TALLOC_FREE(smb_fname_parent);
138 /****************************************************************************
139 Userspace check for write access to fsp.
140 ****************************************************************************/
142 bool can_write_to_fsp(struct files_struct *fsp)
144 return NT_STATUS_IS_OK(smbd_check_access_rights_fsp(
151 /****************************************************************************
152 Check for an existing default Windows ACL on a directory fsp.
153 ****************************************************************************/
155 bool directory_has_default_acl_fsp(struct files_struct *fsp)
157 struct security_descriptor *secdesc = NULL;
161 status = SMB_VFS_FGET_NT_ACL(fsp,
166 if (!NT_STATUS_IS_OK(status) ||
168 secdesc->dacl == NULL)
170 TALLOC_FREE(secdesc);
174 for (i = 0; i < secdesc->dacl->num_aces; i++) {
175 struct security_ace *psa = &secdesc->dacl->aces[i];
177 if (psa->flags & (SEC_ACE_FLAG_OBJECT_INHERIT|
178 SEC_ACE_FLAG_CONTAINER_INHERIT))
180 TALLOC_FREE(secdesc);
184 TALLOC_FREE(secdesc);
188 /****************************************************************************
189 Check if setting delete on close is allowed on this fsp.
190 ****************************************************************************/
192 NTSTATUS can_set_delete_on_close(files_struct *fsp, uint32_t dosmode)
195 * Only allow delete on close for writable files.
198 if ((dosmode & FILE_ATTRIBUTE_READONLY) &&
199 !lp_delete_readonly(SNUM(fsp->conn))) {
200 DEBUG(10,("can_set_delete_on_close: file %s delete on close "
201 "flag set but file attribute is readonly.\n",
203 return NT_STATUS_CANNOT_DELETE;
207 * Only allow delete on close for writable shares.
210 if (!CAN_WRITE(fsp->conn)) {
211 DEBUG(10,("can_set_delete_on_close: file %s delete on "
212 "close flag set but write access denied on share.\n",
214 return NT_STATUS_ACCESS_DENIED;
218 * Only allow delete on close for files/directories opened with delete
222 if (!(fsp->access_mask & DELETE_ACCESS)) {
223 DEBUG(10,("can_set_delete_on_close: file %s delete on "
224 "close flag set but delete access denied.\n",
226 return NT_STATUS_ACCESS_DENIED;
229 /* Don't allow delete on close for non-empty directories. */
230 if (fsp->fsp_flags.is_directory) {
231 SMB_ASSERT(!fsp_is_alternate_stream(fsp));
233 /* Or the root of a share. */
234 if (ISDOT(fsp->fsp_name->base_name)) {
235 DEBUG(10,("can_set_delete_on_close: can't set delete on "
236 "close for the root of a share.\n"));
237 return NT_STATUS_ACCESS_DENIED;
240 return can_delete_directory_fsp(fsp);