2 Unix SMB/CIFS implementation.
3 Samba system utilities for ACL support.
4 Copyright (C) Jeremy Allison 2000.
5 Copyright (C) Volker Lendecke 2006
6 Copyright (C) Michael Adam 2006,2008
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "system/passwd.h"
25 #if defined(HAVE_POSIX_ACLS)
26 #include "modules/vfs_posixacl.h"
29 #if defined(HAVE_TRU64_ACLS)
30 #include "modules/vfs_tru64acl.h"
33 #if defined(HAVE_SOLARIS_UNIXWARE_ACLS)
34 #include "modules/vfs_solarisacl.h"
37 #if defined(HAVE_HPUX_ACLS)
38 #include "modules/vfs_hpuxacl.h"
42 #define DBGC_CLASS DBGC_ACLS
45 * Note that while this code implements sufficient functionality
46 * to support the sys_acl_* interfaces it does not provide all
47 * of the semantics of the POSIX ACL interfaces.
49 * In particular, an ACL entry descriptor (SMB_ACL_ENTRY_T) returned
50 * from a call to sys_acl_get_entry() should not be assumed to be
51 * valid after calling any of the following functions, which may
52 * reorder the entries in the ACL.
59 int sys_acl_get_entry(SMB_ACL_T acl_d, int entry_id, SMB_ACL_ENTRY_T *entry_p)
61 if (entry_id != SMB_ACL_FIRST_ENTRY && entry_id != SMB_ACL_NEXT_ENTRY) {
66 if (entry_p == NULL) {
71 if (entry_id == SMB_ACL_FIRST_ENTRY) {
75 if (acl_d->next < 0) {
80 if (acl_d->next >= acl_d->count) {
84 *entry_p = &acl_d->acl[acl_d->next++];
89 int sys_acl_get_tag_type(SMB_ACL_ENTRY_T entry_d, SMB_ACL_TAG_T *type_p)
91 *type_p = entry_d->a_type;
96 int sys_acl_get_permset(SMB_ACL_ENTRY_T entry_d, SMB_ACL_PERMSET_T *permset_p)
98 *permset_p = &entry_d->a_perm;
103 void *sys_acl_get_qualifier(SMB_ACL_ENTRY_T entry_d)
105 if (entry_d->a_type == SMB_ACL_USER) {
106 return &entry_d->info.user.uid;
109 if (entry_d->a_type == SMB_ACL_GROUP) {
110 return &entry_d->info.group.gid;
117 int sys_acl_clear_perms(SMB_ACL_PERMSET_T permset_d)
124 int sys_acl_add_perm(SMB_ACL_PERMSET_T permset_d, SMB_ACL_PERM_T perm)
126 if (perm != SMB_ACL_READ && perm != SMB_ACL_WRITE
127 && perm != SMB_ACL_EXECUTE) {
132 if (permset_d == NULL) {
142 int sys_acl_get_perm(SMB_ACL_PERMSET_T permset_d, SMB_ACL_PERM_T perm)
144 return *permset_d & perm;
147 char *sys_acl_to_text(const struct smb_acl_t *acl_d, ssize_t *len_p)
154 * use an initial estimate of 20 bytes per ACL entry
155 * when allocating memory for the text representation
159 maxlen = 20 * acl_d->count;
160 if ((text = (char *)SMB_MALLOC(maxlen)) == NULL) {
165 for (i = 0; i < acl_d->count; i++) {
166 struct smb_acl_entry *ap = &acl_d->acl[i];
175 switch (ap->a_type) {
177 * for debugging purposes it's probably more
178 * useful to dump unknown tag types rather
179 * than just returning an error
182 slprintf(tagbuf, sizeof(tagbuf)-1, "0x%x",
188 id = uidtoname(ap->info.user.uid);
190 case SMB_ACL_USER_OBJ:
195 if ((gr = getgrgid(ap->info.group.gid)) == NULL) {
196 slprintf(idbuf, sizeof(idbuf)-1, "%ld",
197 (long)ap->info.group.gid);
203 case SMB_ACL_GROUP_OBJ:
217 perms[0] = (ap->a_perm & SMB_ACL_READ) ? 'r' : '-';
218 perms[1] = (ap->a_perm & SMB_ACL_WRITE) ? 'w' : '-';
219 perms[2] = (ap->a_perm & SMB_ACL_EXECUTE) ? 'x' : '-';
222 /* <tag> : <qualifier> : rwx \n \0 */
223 nbytes = strlen(tag) + 1 + strlen(id) + 1 + 3 + 1 + 1;
226 * If this entry would overflow the buffer
227 * allocate enough additional memory for this
228 * entry and an estimate of another 20 bytes
229 * for each entry still to be processed
231 if ((len + nbytes) > maxlen) {
232 maxlen += nbytes + 20 * (acl_d->count - i);
233 if ((text = (char *)SMB_REALLOC(text, maxlen)) == NULL) {
240 slprintf(&text[len], nbytes, "%s:%s:%s\n", tag, id, perms);
250 SMB_ACL_T sys_acl_init(TALLOC_CTX *mem_ctx)
254 if ((a = talloc(mem_ctx, struct smb_acl_t)) == NULL) {
262 a->acl = talloc_array(a, struct smb_acl_entry, 0);
272 int sys_acl_create_entry(SMB_ACL_T *acl_p, SMB_ACL_ENTRY_T *entry_p)
275 SMB_ACL_ENTRY_T entry_d;
276 struct smb_acl_entry *acl;
278 if (acl_p == NULL || entry_p == NULL || (acl_d = *acl_p) == NULL) {
283 acl = talloc_realloc(acl_d, acl_d->acl, struct smb_acl_entry, acl_d->count+1);
289 entry_d = &acl_d->acl[acl_d->count];
290 entry_d->a_type = SMB_ACL_TAG_INVALID;
298 int sys_acl_set_tag_type(SMB_ACL_ENTRY_T entry_d, SMB_ACL_TAG_T tag_type)
302 case SMB_ACL_USER_OBJ:
304 case SMB_ACL_GROUP_OBJ:
307 entry_d->a_type = tag_type;
317 int sys_acl_set_qualifier(SMB_ACL_ENTRY_T entry_d, void *qual_p)
319 if (entry_d->a_type == SMB_ACL_USER) {
320 entry_d->info.user.uid = *((uid_t *)qual_p);
323 if (entry_d->a_type == SMB_ACL_GROUP) {
324 entry_d->info.group.gid = *((gid_t *)qual_p);
332 int sys_acl_set_permset(SMB_ACL_ENTRY_T entry_d, SMB_ACL_PERMSET_T permset_d)
334 if (*permset_d & ~(SMB_ACL_READ|SMB_ACL_WRITE|SMB_ACL_EXECUTE)) {
339 entry_d->a_perm = *permset_d;
344 int sys_acl_free_text(char *text)
350 int sys_acl_valid(SMB_ACL_T acl_d)
357 * acl_get_file, acl_get_fd, acl_set_file, acl_set_fd and
358 * sys_acl_delete_def_file are to be redirected to the default
359 * statically-bound acl vfs module, but they are replacable.
362 #if defined(HAVE_POSIX_ACLS)
364 SMB_ACL_T sys_acl_get_file(vfs_handle_struct *handle,
365 const char *path_p, SMB_ACL_TYPE_T type, TALLOC_CTX *mem_ctx)
367 return posixacl_sys_acl_get_file(handle, path_p, type, mem_ctx);
370 SMB_ACL_T sys_acl_get_fd(vfs_handle_struct *handle, files_struct *fsp, TALLOC_CTX *mem_ctx)
372 return posixacl_sys_acl_get_fd(handle, fsp, mem_ctx);
375 int sys_acl_set_file(vfs_handle_struct *handle,
376 const char *name, SMB_ACL_TYPE_T type, SMB_ACL_T acl_d)
378 return posixacl_sys_acl_set_file(handle, name, type, acl_d);
381 int sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
384 return posixacl_sys_acl_set_fd(handle, fsp, acl_d);
387 int sys_acl_delete_def_file(vfs_handle_struct *handle,
390 return posixacl_sys_acl_delete_def_file(handle, path);
393 #elif defined(HAVE_AIX_ACLS)
395 SMB_ACL_T sys_acl_get_file(vfs_handle_struct *handle,
396 const char *path_p, SMB_ACL_TYPE_T type,
399 return aixacl_sys_acl_get_file(handle, path_p, type, mem_ctx);
402 SMB_ACL_T sys_acl_get_fd(vfs_handle_struct *handle, files_struct *fsp,
405 return aixacl_sys_acl_get_fd(handle, fsp, mem_ctx);
408 int sys_acl_set_file(vfs_handle_struct *handle,
409 const char *name, SMB_ACL_TYPE_T type, SMB_ACL_T acl_d)
411 return aixacl_sys_acl_set_file(handle, name, type, acl_d);
414 int sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
417 return aixacl_sys_acl_set_fd(handle, fsp, acl_d);
420 int sys_acl_delete_def_file(vfs_handle_struct *handle,
423 return aixacl_sys_acl_delete_def_file(handle, path);
426 #elif defined(HAVE_TRU64_ACLS)
428 SMB_ACL_T sys_acl_get_file(vfs_handle_struct *handle,
429 const char *path_p, SMB_ACL_TYPE_T type,
432 return tru64acl_sys_acl_get_file(handle, path_p, type,
436 SMB_ACL_T sys_acl_get_fd(vfs_handle_struct *handle, files_struct *fsp,
439 return tru64acl_sys_acl_get_fd(handle, fsp, mem_ctx);
442 int sys_acl_set_file(vfs_handle_struct *handle,
443 const char *name, SMB_ACL_TYPE_T type, SMB_ACL_T acl_d)
445 return tru64acl_sys_acl_set_file(handle, name, type, acl_d);
448 int sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
451 return tru64acl_sys_acl_set_fd(handle, fsp, acl_d);
454 int sys_acl_delete_def_file(vfs_handle_struct *handle,
457 return tru64acl_sys_acl_delete_def_file(handle, path);
460 #elif defined(HAVE_SOLARIS_UNIXWARE_ACLS)
462 SMB_ACL_T sys_acl_get_file(vfs_handle_struct *handle,
463 const char *path_p, SMB_ACL_TYPE_T type,
466 return solarisacl_sys_acl_get_file(handle, path_p, type,
470 SMB_ACL_T sys_acl_get_fd(vfs_handle_struct *handle, files_struct *fsp,
473 return solarisacl_sys_acl_get_fd(handle, fsp,
477 int sys_acl_set_file(vfs_handle_struct *handle,
478 const char *name, SMB_ACL_TYPE_T type, SMB_ACL_T acl_d)
480 return solarisacl_sys_acl_set_file(handle, name, type, acl_d);
483 int sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
486 return solarisacl_sys_acl_set_fd(handle, fsp, acl_d);
489 int sys_acl_delete_def_file(vfs_handle_struct *handle,
492 return solarisacl_sys_acl_delete_def_file(handle, path);
495 #elif defined(HAVE_HPUX_ACLS)
497 SMB_ACL_T sys_acl_get_file(vfs_handle_struct *handle,
498 const char *path_p, SMB_ACL_TYPE_T type,
501 return hpuxacl_sys_acl_get_file(handle, path_p, type, mem_ctx);
504 SMB_ACL_T sys_acl_get_fd(vfs_handle_struct *handle, files_struct *fsp,
507 return hpuxacl_sys_acl_get_fd(handle, fsp, mem_ctx);
510 int sys_acl_set_file(vfs_handle_struct *handle,
511 const char *name, SMB_ACL_TYPE_T type, SMB_ACL_T acl_d)
513 return hpuxacl_sys_acl_set_file(handle, name, type, acl_d);
516 int sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
519 return hpuxacl_sys_acl_set_fd(handle, fsp, acl_d);
522 int sys_acl_delete_def_file(vfs_handle_struct *handle,
525 return hpuxacl_sys_acl_delete_def_file(handle, path);
530 SMB_ACL_T sys_acl_get_file(vfs_handle_struct *handle,
531 const char *path_p, SMB_ACL_TYPE_T type,
542 SMB_ACL_T sys_acl_get_fd(vfs_handle_struct *handle, files_struct *fsp,
553 int sys_acl_set_file(vfs_handle_struct *handle,
554 const char *name, SMB_ACL_TYPE_T type, SMB_ACL_T acl_d)
564 int sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
575 int sys_acl_delete_def_file(vfs_handle_struct *handle,
588 /************************************************************************
589 Deliberately outside the ACL defines. Return 1 if this is a "no acls"
591 ************************************************************************/
593 int no_acl_syscall_error(int err)
601 if (err == ENOTSUP) {