7506e4e34fa12ade86af0219bc3def55f328c165
[samba.git] / source3 / modules / vfs_acl_tdb.c
1 /*
2  * Store Windows ACLs in a tdb.
3  *
4  * Copyright (C) Volker Lendecke, 2008
5  * Copyright (C) Jeremy Allison, 2008
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License as published by
9  * the Free Software Foundation; either version 3 of the License, or
10  * (at your option) any later version.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License
18  * along with this program; if not, see <http://www.gnu.org/licenses/>.
19  */
20
21 #include "includes.h"
22 #include "smbd/smbd.h"
23 #include "system/filesys.h"
24 #include "librpc/gen_ndr/xattr.h"
25 #include "../lib/crypto/sha256.h"
26 #include "dbwrap/dbwrap.h"
27 #include "dbwrap/dbwrap_open.h"
28 #include "auth.h"
29 #include "util_tdb.h"
30 #include "vfs_acl_common.h"
31
32 #undef DBGC_CLASS
33 #define DBGC_CLASS DBGC_VFS
34
35 #define ACL_MODULE_NAME "acl_tdb"
36
37 static unsigned int ref_count;
38 static struct db_context *acl_db;
39
40 /*******************************************************************
41  Open acl_db if not already open, increment ref count.
42 *******************************************************************/
43
44 static bool acl_tdb_init(void)
45 {
46         char *dbname;
47
48         if (acl_db) {
49                 ref_count++;
50                 return true;
51         }
52
53         dbname = state_path(talloc_tos(), "file_ntacls.tdb");
54
55         if (dbname == NULL) {
56                 errno = ENOSYS;
57                 return false;
58         }
59
60         become_root();
61         acl_db = db_open(NULL, dbname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600,
62                          DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
63         unbecome_root();
64
65         if (acl_db == NULL) {
66 #if defined(ENOTSUP)
67                 errno = ENOTSUP;
68 #else
69                 errno = ENOSYS;
70 #endif
71                 TALLOC_FREE(dbname);
72                 return false;
73         }
74
75         ref_count++;
76         TALLOC_FREE(dbname);
77         return true;
78 }
79
80 /*******************************************************************
81  Lower ref count and close acl_db if zero.
82 *******************************************************************/
83
84 static void disconnect_acl_tdb(struct vfs_handle_struct *handle)
85 {
86         SMB_VFS_NEXT_DISCONNECT(handle);
87         ref_count--;
88         if (ref_count == 0) {
89                 TALLOC_FREE(acl_db);
90         }
91 }
92
93 /*******************************************************************
94  Fetch_lock the tdb acl record for a file
95 *******************************************************************/
96
97 static struct db_record *acl_tdb_lock(TALLOC_CTX *mem_ctx,
98                                         struct db_context *db,
99                                         const struct file_id *id)
100 {
101         uint8_t id_buf[16];
102
103         /* For backwards compatibility only store the dev/inode. */
104         push_file_id_16((char *)id_buf, id);
105         return dbwrap_fetch_locked(db,
106                                    mem_ctx,
107                                    make_tdb_data(id_buf,
108                                                  sizeof(id_buf)));
109 }
110
111 /*******************************************************************
112  Delete the tdb acl record for a file
113 *******************************************************************/
114
115 static NTSTATUS acl_tdb_delete(vfs_handle_struct *handle,
116                                 struct db_context *db,
117                                 SMB_STRUCT_STAT *psbuf)
118 {
119         NTSTATUS status;
120         struct file_id id = vfs_file_id_from_sbuf(handle->conn, psbuf);
121         struct db_record *rec = acl_tdb_lock(talloc_tos(), db, &id);
122
123         /*
124          * If rec == NULL there's not much we can do about it
125          */
126
127         if (rec == NULL) {
128                 DEBUG(10,("acl_tdb_delete: rec == NULL\n"));
129                 TALLOC_FREE(rec);
130                 return NT_STATUS_OK;
131         }
132
133         status = dbwrap_record_delete(rec);
134         TALLOC_FREE(rec);
135         return status;
136 }
137
138 /*******************************************************************
139  Pull a security descriptor into a DATA_BLOB from a tdb store.
140 *******************************************************************/
141
142 static NTSTATUS get_acl_blob(TALLOC_CTX *ctx,
143                         vfs_handle_struct *handle,
144                         files_struct *fsp,
145                         const struct smb_filename *smb_fname,
146                         DATA_BLOB *pblob)
147 {
148         uint8_t id_buf[16];
149         TDB_DATA data;
150         struct file_id id;
151         struct db_context *db = acl_db;
152         NTSTATUS status = NT_STATUS_OK;
153         SMB_STRUCT_STAT sbuf;
154
155         ZERO_STRUCT(sbuf);
156
157         if (fsp) {
158                 status = vfs_stat_fsp(fsp);
159                 sbuf = fsp->fsp_name->st;
160         } else {
161                 int ret = vfs_stat_smb_basename(handle->conn,
162                                 smb_fname,
163                                 &sbuf);
164                 if (ret == -1) {
165                         status = map_nt_error_from_unix(errno);
166                 }
167         }
168
169         if (!NT_STATUS_IS_OK(status)) {
170                 return status;
171         }
172
173         id = vfs_file_id_from_sbuf(handle->conn, &sbuf);
174
175         /* For backwards compatibility only store the dev/inode. */
176         push_file_id_16((char *)id_buf, &id);
177
178         status = dbwrap_fetch(db,
179                               ctx,
180                               make_tdb_data(id_buf, sizeof(id_buf)),
181                               &data);
182         if (!NT_STATUS_IS_OK(status)) {
183                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
184         }
185
186         pblob->data = data.dptr;
187         pblob->length = data.dsize;
188
189         DEBUG(10,("get_acl_blob: returned %u bytes from file %s\n",
190                 (unsigned int)data.dsize, smb_fname->base_name ));
191
192         if (pblob->length == 0 || pblob->data == NULL) {
193                 return NT_STATUS_NOT_FOUND;
194         }
195         return NT_STATUS_OK;
196 }
197
198 /*******************************************************************
199  Store a DATA_BLOB into a tdb record given an fsp pointer.
200 *******************************************************************/
201
202 static NTSTATUS store_acl_blob_fsp(vfs_handle_struct *handle,
203                                 files_struct *fsp,
204                                 DATA_BLOB *pblob)
205 {
206         uint8_t id_buf[16];
207         struct file_id id;
208         TDB_DATA data;
209         struct db_context *db = acl_db;
210         struct db_record *rec;
211         NTSTATUS status;
212
213         DEBUG(10,("store_acl_blob_fsp: storing blob length %u on file %s\n",
214                   (unsigned int)pblob->length, fsp_str_dbg(fsp)));
215
216         status = vfs_stat_fsp(fsp);
217         if (!NT_STATUS_IS_OK(status)) {
218                 return status;
219         }
220
221         id = vfs_file_id_from_sbuf(handle->conn, &fsp->fsp_name->st);
222
223         /* For backwards compatibility only store the dev/inode. */
224         push_file_id_16((char *)id_buf, &id);
225         rec = dbwrap_fetch_locked(db, talloc_tos(),
226                                   make_tdb_data(id_buf,
227                                                 sizeof(id_buf)));
228         if (rec == NULL) {
229                 DEBUG(0, ("store_acl_blob_fsp_tdb: fetch_lock failed\n"));
230                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
231         }
232         data.dptr = pblob->data;
233         data.dsize = pblob->length;
234         return dbwrap_record_store(rec, data, 0);
235 }
236
237 /*********************************************************************
238  On unlink we need to delete the tdb record (if using tdb).
239 *********************************************************************/
240
241 static int unlink_acl_tdb(vfs_handle_struct *handle,
242                           const struct smb_filename *smb_fname)
243 {
244         struct smb_filename *smb_fname_tmp = NULL;
245         struct db_context *db = acl_db;
246         int ret = -1;
247
248         smb_fname_tmp = cp_smb_filename_nostream(talloc_tos(), smb_fname);
249         if (smb_fname_tmp == NULL) {
250                 errno = ENOMEM;
251                 goto out;
252         }
253
254         if (smb_fname_tmp->flags & SMB_FILENAME_POSIX_PATH) {
255                 ret = SMB_VFS_LSTAT(handle->conn, smb_fname_tmp);
256         } else {
257                 ret = SMB_VFS_STAT(handle->conn, smb_fname_tmp);
258         }
259
260         if (ret == -1) {
261                 goto out;
262         }
263
264         ret = unlink_acl_common(handle, smb_fname_tmp);
265
266         if (ret == -1) {
267                 goto out;
268         }
269
270         acl_tdb_delete(handle, db, &smb_fname_tmp->st);
271  out:
272         return ret;
273 }
274
275 /*********************************************************************
276  On rmdir we need to delete the tdb record (if using tdb).
277 *********************************************************************/
278
279 static int rmdir_acl_tdb(vfs_handle_struct *handle,
280                 const struct smb_filename *smb_fname)
281 {
282
283         SMB_STRUCT_STAT sbuf;
284         struct db_context *db = acl_db;
285         int ret = -1;
286
287         ret = vfs_stat_smb_basename(handle->conn, smb_fname, &sbuf);
288         if (ret == -1) {
289                 return -1;
290         }
291
292         ret = rmdir_acl_common(handle, smb_fname);
293         if (ret == -1) {
294                 return -1;
295         }
296
297         acl_tdb_delete(handle, db, &sbuf);
298         return 0;
299 }
300
301 /*******************************************************************
302  Handle opening the storage tdb if so configured.
303 *******************************************************************/
304
305 static int connect_acl_tdb(struct vfs_handle_struct *handle,
306                                 const char *service,
307                                 const char *user)
308 {
309         int ret = SMB_VFS_NEXT_CONNECT(handle, service, user);
310         bool ok;
311         struct acl_common_config *config = NULL;
312
313         if (ret < 0) {
314                 return ret;
315         }
316
317         if (!acl_tdb_init()) {
318                 SMB_VFS_NEXT_DISCONNECT(handle);
319                 return -1;
320         }
321
322         ok = init_acl_common_config(handle, ACL_MODULE_NAME);
323         if (!ok) {
324                 DBG_ERR("init_acl_common_config failed\n");
325                 return -1;
326         }
327
328         /* Ensure we have the parameters correct if we're
329          * using this module. */
330         DEBUG(2,("connect_acl_tdb: setting 'inherit acls = true' "
331                 "'dos filemode = true' and "
332                 "'force unknown acl user = true' for service %s\n",
333                 service ));
334
335         lp_do_parameter(SNUM(handle->conn), "inherit acls", "true");
336         lp_do_parameter(SNUM(handle->conn), "dos filemode", "true");
337         lp_do_parameter(SNUM(handle->conn), "force unknown acl user", "true");
338
339         SMB_VFS_HANDLE_GET_DATA(handle, config,
340                                 struct acl_common_config,
341                                 return -1);
342
343         if (config->ignore_system_acls) {
344                 mode_t create_mask = lp_create_mask(SNUM(handle->conn));
345                 char *create_mask_str = NULL;
346
347                 if ((create_mask & 0666) != 0666) {
348                         create_mask |= 0666;
349                         create_mask_str = talloc_asprintf(handle, "0%o",
350                                                           create_mask);
351                         if (create_mask_str == NULL) {
352                                 DBG_ERR("talloc_asprintf failed\n");
353                                 return -1;
354                         }
355
356                         DBG_NOTICE("setting 'create mask = %s'\n", create_mask_str);
357
358                         lp_do_parameter (SNUM(handle->conn),
359                                         "create mask", create_mask_str);
360
361                         TALLOC_FREE(create_mask_str);
362                 }
363
364                 DBG_NOTICE("setting 'directory mask = 0777', "
365                            "'store dos attributes = yes' and all "
366                            "'map ...' options to 'no'\n");
367
368                 lp_do_parameter(SNUM(handle->conn), "directory mask", "0777");
369                 lp_do_parameter(SNUM(handle->conn), "map archive", "no");
370                 lp_do_parameter(SNUM(handle->conn), "map hidden", "no");
371                 lp_do_parameter(SNUM(handle->conn), "map readonly", "no");
372                 lp_do_parameter(SNUM(handle->conn), "map system", "no");
373                 lp_do_parameter(SNUM(handle->conn), "store dos attributes",
374                                 "yes");
375         }
376
377         return 0;
378 }
379
380 /*********************************************************************
381  Remove a Windows ACL - we're setting the underlying POSIX ACL.
382 *********************************************************************/
383
384 static int sys_acl_set_file_tdb(vfs_handle_struct *handle,
385                         const struct smb_filename *smb_fname_in,
386                         SMB_ACL_TYPE_T type,
387                         SMB_ACL_T theacl)
388 {
389         struct db_context *db = acl_db;
390         int ret = -1;
391         int saved_errno = 0;
392         struct smb_filename *smb_fname = NULL;
393
394         smb_fname = cp_smb_filename_nostream(talloc_tos(), smb_fname_in);
395         if (smb_fname == NULL) {
396                 return -1;
397         };
398
399         ret = SMB_VFS_STAT(handle->conn, smb_fname);
400         if (ret == -1) {
401                 saved_errno = errno;
402                 goto fail;
403         }
404
405         ret = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle,
406                                                 smb_fname,
407                                                 type,
408                                                 theacl);
409         if (ret == -1) {
410                 saved_errno = errno;
411                 goto fail;
412         }
413
414         acl_tdb_delete(handle, db, &smb_fname->st);
415
416 fail:
417         TALLOC_FREE(smb_fname);
418
419         if (saved_errno != 0) {
420                 errno = saved_errno;
421         }
422         return ret;
423 }
424
425 /*********************************************************************
426  Remove a Windows ACL - we're setting the underlying POSIX ACL.
427 *********************************************************************/
428
429 static int sys_acl_set_fd_tdb(vfs_handle_struct *handle,
430                             files_struct *fsp,
431                             SMB_ACL_T theacl)
432 {
433         struct db_context *db = acl_db;
434         NTSTATUS status;
435         int ret;
436
437         status = vfs_stat_fsp(fsp);
438         if (!NT_STATUS_IS_OK(status)) {
439                 return -1;
440         }
441
442         ret = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle,
443                                                 fsp,
444                                                 theacl);
445         if (ret == -1) {
446                 return -1;
447         }
448
449         acl_tdb_delete(handle, db, &fsp->fsp_name->st);
450         return 0;
451 }
452
453 static NTSTATUS acl_tdb_fget_nt_acl(vfs_handle_struct *handle,
454                                     files_struct *fsp,
455                                     uint32_t security_info,
456                                     TALLOC_CTX *mem_ctx,
457                                     struct security_descriptor **ppdesc)
458 {
459         NTSTATUS status;
460         status = get_nt_acl_common(get_acl_blob, handle, fsp, NULL,
461                                    security_info, mem_ctx, ppdesc);
462         return status;
463 }
464
465 static NTSTATUS acl_tdb_get_nt_acl(vfs_handle_struct *handle,
466                                    const struct smb_filename *smb_fname,
467                                    uint32_t security_info,
468                                    TALLOC_CTX *mem_ctx,
469                                    struct security_descriptor **ppdesc)
470 {
471         NTSTATUS status;
472         status = get_nt_acl_common(get_acl_blob, handle, NULL, smb_fname,
473                                    security_info, mem_ctx, ppdesc);
474         return status;
475 }
476
477 static NTSTATUS acl_tdb_fset_nt_acl(vfs_handle_struct *handle,
478                                     files_struct *fsp,
479                                     uint32_t security_info_sent,
480                                     const struct security_descriptor *psd)
481 {
482         NTSTATUS status;
483         status = fset_nt_acl_common(get_acl_blob, store_acl_blob_fsp,
484                                     ACL_MODULE_NAME,
485                                     handle, fsp, security_info_sent, psd);
486         return status;
487 }
488
489 static struct vfs_fn_pointers vfs_acl_tdb_fns = {
490         .connect_fn = connect_acl_tdb,
491         .disconnect_fn = disconnect_acl_tdb,
492         .rmdir_fn = rmdir_acl_tdb,
493         .unlink_fn = unlink_acl_tdb,
494         .chmod_fn = chmod_acl_module_common,
495         .fchmod_fn = fchmod_acl_module_common,
496         .fget_nt_acl_fn = acl_tdb_fget_nt_acl,
497         .get_nt_acl_fn = acl_tdb_get_nt_acl,
498         .fset_nt_acl_fn = acl_tdb_fset_nt_acl,
499         .sys_acl_set_file_fn = sys_acl_set_file_tdb,
500         .sys_acl_set_fd_fn = sys_acl_set_fd_tdb
501 };
502
503 static_decl_vfs;
504 NTSTATUS vfs_acl_tdb_init(TALLOC_CTX *ctx)
505 {
506         return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "acl_tdb",
507                                 &vfs_acl_tdb_fns);
508 }