s3: smbd: Add dirfsp parameter to can_write_to_file().
[amitay/samba.git] / source3 / smbd / file_access.c
1 /*
2    Unix SMB/CIFS implementation.
3    Check access to files based on security descriptors.
4    Copyright (C) Jeremy Allison 2005-2006.
5    Copyright (C) Michael Adam 2007.
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 3 of the License, or
10    (at your option) any later version.
11
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16
17    You should have received a copy of the GNU General Public License
18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "system/filesys.h"
23 #include "../libcli/security/security.h"
24 #include "../librpc/gen_ndr/ndr_security.h"
25 #include "smbd/smbd.h"
26
27 #undef  DBGC_CLASS
28 #define DBGC_CLASS DBGC_ACLS
29
30 /****************************************************************************
31  Actually emulate the in-kernel access checking for delete access. We need
32  this to successfully return ACCESS_DENIED on a file open for delete access.
33 ****************************************************************************/
34
35 bool can_delete_file_in_directory(connection_struct *conn,
36                         struct files_struct *dirfsp,
37                         const struct smb_filename *smb_fname)
38 {
39         TALLOC_CTX *ctx = talloc_tos();
40         struct smb_filename *smb_fname_parent = NULL;
41         bool ret;
42
43         SMB_ASSERT(dirfsp == conn->cwd_fsp);
44
45         if (!CAN_WRITE(conn)) {
46                 return False;
47         }
48
49         if (!lp_acl_check_permissions(SNUM(conn))) {
50                 /* This option means don't check. */
51                 return true;
52         }
53
54         /* Get the parent directory permission mask and owners. */
55         ret = parent_smb_fname(ctx, smb_fname, &smb_fname_parent, NULL);
56         if (ret != true) {
57                 return false;
58         }
59
60         if(SMB_VFS_STAT(conn, smb_fname_parent) != 0) {
61                 ret = false;
62                 goto out;
63         }
64
65         /* fast paths first */
66
67         if (!S_ISDIR(smb_fname_parent->st.st_ex_mode)) {
68                 ret = false;
69                 goto out;
70         }
71         if (get_current_uid(conn) == (uid_t)0) {
72                 /* I'm sorry sir, I didn't know you were root... */
73                 ret = true;
74                 goto out;
75         }
76
77 #ifdef S_ISVTX
78         /* sticky bit means delete only by owner of file or by root or
79          * by owner of directory. */
80         if (smb_fname_parent->st.st_ex_mode & S_ISVTX) {
81                 if (!VALID_STAT(smb_fname->st)) {
82                         /* If the file doesn't already exist then
83                          * yes we'll be able to delete it. */
84                         ret = true;
85                         goto out;
86                 }
87
88                 /*
89                  * Patch from SATOH Fumiyasu <fumiyas@miraclelinux.com>
90                  * for bug #3348. Don't assume owning sticky bit
91                  * directory means write access allowed.
92                  * Fail to delete if we're not the owner of the file,
93                  * or the owner of the directory as we have no possible
94                  * chance of deleting. Otherwise, go on and check the ACL.
95                  */
96                 if ((get_current_uid(conn) !=
97                         smb_fname_parent->st.st_ex_uid) &&
98                     (get_current_uid(conn) != smb_fname->st.st_ex_uid)) {
99                         DEBUG(10,("can_delete_file_in_directory: not "
100                                   "owner of file %s or directory %s",
101                                   smb_fname_str_dbg(smb_fname),
102                                   smb_fname_str_dbg(smb_fname_parent)));
103                         ret = false;
104                         goto out;
105                 }
106         }
107 #endif
108
109         /* now for ACL checks */
110
111         /*
112          * There's two ways to get the permission to delete a file: First by
113          * having the DELETE bit on the file itself and second if that does
114          * not help, by the DELETE_CHILD bit on the containing directory.
115          *
116          * Here we only check the directory permissions, we will
117          * check the file DELETE permission separately.
118          */
119
120         ret = NT_STATUS_IS_OK(smbd_check_access_rights(conn,
121                                 smb_fname_parent,
122                                 false,
123                                 FILE_DELETE_CHILD));
124  out:
125         TALLOC_FREE(smb_fname_parent);
126         return ret;
127 }
128
129 /****************************************************************************
130  Userspace check for write access.
131 ****************************************************************************/
132
133 bool can_write_to_file(connection_struct *conn,
134                         struct files_struct *dirfsp,
135                         const struct smb_filename *smb_fname)
136 {
137         SMB_ASSERT(dirfsp == conn->cwd_fsp);
138         return NT_STATUS_IS_OK(smbd_check_access_rights(conn,
139                                 smb_fname,
140                                 false,
141                                 FILE_WRITE_DATA));
142 }
143
144 /****************************************************************************
145  Check for an existing default Windows ACL on a directory.
146 ****************************************************************************/
147
148 bool directory_has_default_acl(connection_struct *conn,
149                 struct files_struct *dirfsp,
150                 struct smb_filename *smb_fname)
151 {
152         struct security_descriptor *secdesc = NULL;
153         unsigned int i;
154         NTSTATUS status;
155
156         status = SMB_VFS_GET_NT_ACL(conn, smb_fname,
157                                              SECINFO_DACL, talloc_tos(),
158                                              &secdesc);
159
160         if (!NT_STATUS_IS_OK(status) ||
161                         secdesc == NULL ||
162                         secdesc->dacl == NULL) {
163                 TALLOC_FREE(secdesc);
164                 return false;
165         }
166
167         for (i = 0; i < secdesc->dacl->num_aces; i++) {
168                 struct security_ace *psa = &secdesc->dacl->aces[i];
169                 if (psa->flags & (SEC_ACE_FLAG_OBJECT_INHERIT|
170                                 SEC_ACE_FLAG_CONTAINER_INHERIT)) {
171                         TALLOC_FREE(secdesc);
172                         return true;
173                 }
174         }
175         TALLOC_FREE(secdesc);
176         return false;
177 }
178
179 /****************************************************************************
180  Check if setting delete on close is allowed on this fsp.
181 ****************************************************************************/
182
183 NTSTATUS can_set_delete_on_close(files_struct *fsp, uint32_t dosmode)
184 {
185         /*
186          * Only allow delete on close for writable files.
187          */
188
189         if ((dosmode & FILE_ATTRIBUTE_READONLY) &&
190             !lp_delete_readonly(SNUM(fsp->conn))) {
191                 DEBUG(10,("can_set_delete_on_close: file %s delete on close "
192                           "flag set but file attribute is readonly.\n",
193                           fsp_str_dbg(fsp)));
194                 return NT_STATUS_CANNOT_DELETE;
195         }
196
197         /*
198          * Only allow delete on close for writable shares.
199          */
200
201         if (!CAN_WRITE(fsp->conn)) {
202                 DEBUG(10,("can_set_delete_on_close: file %s delete on "
203                           "close flag set but write access denied on share.\n",
204                           fsp_str_dbg(fsp)));
205                 return NT_STATUS_ACCESS_DENIED;
206         }
207
208         /*
209          * Only allow delete on close for files/directories opened with delete
210          * intent.
211          */
212
213         if (!(fsp->access_mask & DELETE_ACCESS)) {
214                 DEBUG(10,("can_set_delete_on_close: file %s delete on "
215                           "close flag set but delete access denied.\n",
216                           fsp_str_dbg(fsp)));
217                 return NT_STATUS_ACCESS_DENIED;
218         }
219
220         /* Don't allow delete on close for non-empty directories. */
221         if (fsp->fsp_flags.is_directory) {
222                 SMB_ASSERT(!is_ntfs_stream_smb_fname(fsp->fsp_name));
223
224                 /* Or the root of a share. */
225                 if (ISDOT(fsp->fsp_name->base_name)) {
226                         DEBUG(10,("can_set_delete_on_close: can't set delete on "
227                                   "close for the root of a share.\n"));
228                         return NT_STATUS_ACCESS_DENIED;
229                 }
230
231                 return can_delete_directory_fsp(fsp);
232         }
233
234         return NT_STATUS_OK;
235 }