ce84bd0e3af122edac2682a59ce6448f4ae0ca27
[samba.git] / source3 / modules / vfs_acl_tdb.c
1 /*
2  * Store Windows ACLs in a tdb.
3  *
4  * Copyright (C) Volker Lendecke, 2008
5  * Copyright (C) Jeremy Allison, 2008
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License as published by
9  * the Free Software Foundation; either version 3 of the License, or
10  * (at your option) any later version.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License
18  * along with this program; if not, see <http://www.gnu.org/licenses/>.
19  */
20
21 /* NOTE: This is an experimental module, not yet finished. JRA. */
22
23 #include "includes.h"
24 #include "librpc/gen_ndr/xattr.h"
25 #include "librpc/gen_ndr/ndr_xattr.h"
26
27 #undef DBGC_CLASS
28 #define DBGC_CLASS DBGC_VFS
29
30 static unsigned int ref_count;
31 static struct db_context *acl_db;
32
33 /*******************************************************************
34  Open acl_db if not already open, increment ref count.
35 *******************************************************************/
36
37 static bool acl_tdb_init(struct db_context **pp_db)
38 {
39         char *dbname;
40
41         if (acl_db) {
42                 *pp_db = acl_db;
43                 ref_count++;
44                 return true;
45         }
46
47         dbname = state_path("file_ntacls.tdb");
48
49         if (dbname == NULL) {
50                 errno = ENOSYS;
51                 return false;
52         }
53
54         become_root();
55         *pp_db = db_open(NULL, dbname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
56         unbecome_root();
57
58         if (*pp_db == NULL) {
59 #if defined(ENOTSUP)
60                 errno = ENOTSUP;
61 #else
62                 errno = ENOSYS;
63 #endif
64                 TALLOC_FREE(dbname);
65                 return false;
66         }
67
68         ref_count++;
69         TALLOC_FREE(dbname);
70         return true;
71 }
72
73 /*******************************************************************
74  Lower ref count and close acl_db if zero.
75 *******************************************************************/
76
77 static void free_acl_tdb_data(void **pptr)
78 {
79         struct db_context **pp_db = (struct db_context **)pptr;
80
81         ref_count--;
82         if (ref_count == 0) {
83                 TALLOC_FREE(*pp_db);
84                 acl_db = NULL;
85         }
86 }
87
88 /*******************************************************************
89  Fetch_lock the tdb acl record for a file
90 *******************************************************************/
91
92 static struct db_record *acl_tdb_lock(TALLOC_CTX *mem_ctx,
93                                         struct db_context *db,
94                                         const struct file_id *id)
95 {
96         uint8 id_buf[16];
97
98         /* For backwards compatibility only store the dev/inode. */
99         push_file_id_16((char *)id_buf, id);
100         return db->fetch_locked(db,
101                                 mem_ctx,
102                                 make_tdb_data(id_buf,
103                                         sizeof(id_buf)));
104 }
105
106 /*******************************************************************
107  Delete the tdb acl record for a file
108 *******************************************************************/
109
110 static NTSTATUS acl_tdb_delete(vfs_handle_struct *handle,
111                                 struct db_context *db,
112                                 SMB_STRUCT_STAT *psbuf)
113 {
114         NTSTATUS status;
115         struct file_id id = vfs_file_id_from_sbuf(handle->conn, psbuf);
116         struct db_record *rec = acl_tdb_lock(talloc_tos(), db, &id);
117
118         /*
119          * If rec == NULL there's not much we can do about it
120          */
121
122         if (rec == NULL) {
123                 DEBUG(10,("acl_tdb_delete: rec == NULL\n"));
124                 TALLOC_FREE(rec);
125                 return NT_STATUS_OK;
126         }
127
128         status = rec->delete_rec(rec);
129         TALLOC_FREE(rec);
130         return status;
131 }
132
133 /*******************************************************************
134  Parse out a struct security_descriptor from a DATA_BLOB.
135 *******************************************************************/
136
137 static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
138                                 uint32 security_info,
139                                 struct security_descriptor **ppdesc)
140 {
141         TALLOC_CTX *ctx = talloc_tos();
142         struct xattr_NTACL xacl;
143         enum ndr_err_code ndr_err;
144         size_t sd_size;
145
146         ndr_err = ndr_pull_struct_blob(pblob, ctx, NULL, &xacl,
147                         (ndr_pull_flags_fn_t)ndr_pull_xattr_NTACL);
148
149         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
150                 DEBUG(5, ("parse_acl_blob: ndr_pull_xattr_NTACL failed: %s\n",
151                         ndr_errstr(ndr_err)));
152                 return ndr_map_error2ntstatus(ndr_err);;
153         }
154
155         if (xacl.version != 2) {
156                 return NT_STATUS_REVISION_MISMATCH;
157         }
158
159         *ppdesc = make_sec_desc(ctx, SEC_DESC_REVISION, xacl.info.sd_hs->sd->type | SEC_DESC_SELF_RELATIVE,
160                         (security_info & OWNER_SECURITY_INFORMATION)
161                         ? xacl.info.sd_hs->sd->owner_sid : NULL,
162                         (security_info & GROUP_SECURITY_INFORMATION)
163                         ? xacl.info.sd_hs->sd->group_sid : NULL,
164                         (security_info & SACL_SECURITY_INFORMATION)
165                         ? xacl.info.sd_hs->sd->sacl : NULL,
166                         (security_info & DACL_SECURITY_INFORMATION)
167                         ? xacl.info.sd_hs->sd->dacl : NULL,
168                         &sd_size);
169
170         TALLOC_FREE(xacl.info.sd);
171
172         return (*ppdesc != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
173 }
174
175 /*******************************************************************
176  Pull a security descriptor into a DATA_BLOB from a tdb store.
177 *******************************************************************/
178
179 static NTSTATUS get_acl_blob(TALLOC_CTX *ctx,
180                         vfs_handle_struct *handle,
181                         files_struct *fsp,
182                         const char *name,
183                         DATA_BLOB *pblob)
184 {
185         uint8 id_buf[16];
186         TDB_DATA data;
187         struct file_id id;
188         struct db_context *db;
189         int ret = -1;
190         SMB_STRUCT_STAT sbuf;
191
192         SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context,
193                 return NT_STATUS_INTERNAL_DB_CORRUPTION);
194
195         if (fsp && fsp->fh->fd != -1) {
196                 ret = SMB_VFS_FSTAT(fsp, &sbuf);
197         } else {
198                 if (fsp && fsp->posix_open) {
199                         ret = vfs_lstat_smb_fname(handle->conn, name, &sbuf);
200                 } else {
201                         ret = vfs_stat_smb_fname(handle->conn, name, &sbuf);
202                 }
203         }
204
205         if (ret == -1) {
206                 return map_nt_error_from_unix(errno);
207         }
208
209         id = vfs_file_id_from_sbuf(handle->conn, &sbuf);
210
211         /* For backwards compatibility only store the dev/inode. */
212         push_file_id_16((char *)id_buf, &id);
213
214         if (db->fetch(db,
215                         ctx,
216                         make_tdb_data(id_buf, sizeof(id_buf)),
217                         &data) == -1) {
218                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
219         }
220
221         pblob->data = data.dptr;
222         pblob->length = data.dsize;
223
224         DEBUG(10,("get_acl_blob: returned %u bytes from file %s\n",
225                 (unsigned int)data.dsize, name ));
226
227         if (pblob->length == 0 || pblob->data == NULL) {
228                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
229         }
230         return NT_STATUS_OK;
231 }
232
233 /*******************************************************************
234  Create a DATA_BLOB from a security descriptor.
235 *******************************************************************/
236
237 static NTSTATUS create_acl_blob(const struct security_descriptor *psd, DATA_BLOB *pblob)
238 {
239         struct xattr_NTACL xacl;
240         struct security_descriptor_hash sd_hs;
241         enum ndr_err_code ndr_err;
242         TALLOC_CTX *ctx = talloc_tos();
243
244         ZERO_STRUCT(xacl);
245         ZERO_STRUCT(sd_hs);
246
247         xacl.version = 2;
248         xacl.info.sd_hs = &sd_hs;
249         xacl.info.sd_hs->sd = CONST_DISCARD(struct security_descriptor *, psd);
250         memset(&xacl.info.sd_hs->hash[0], '\0', 16);
251
252         ndr_err = ndr_push_struct_blob(
253                         pblob, ctx, NULL, &xacl,
254                         (ndr_push_flags_fn_t)ndr_push_xattr_NTACL);
255
256         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
257                 DEBUG(5, ("create_acl_blob: ndr_push_xattr_NTACL failed: %s\n",
258                         ndr_errstr(ndr_err)));
259                 return ndr_map_error2ntstatus(ndr_err);;
260         }
261
262         return NT_STATUS_OK;
263 }
264
265 /*******************************************************************
266  Store a DATA_BLOB into a tdb record given an fsp pointer.
267 *******************************************************************/
268
269 static NTSTATUS store_acl_blob_fsp(vfs_handle_struct *handle,
270                                 files_struct *fsp,
271                                 DATA_BLOB *pblob)
272 {
273         uint8 id_buf[16];
274         struct file_id id;
275         TDB_DATA data;
276         struct db_context *db;
277         struct db_record *rec;
278         int ret = -1;
279
280         DEBUG(10,("store_acl_blob_fsp: storing blob length %u on file %s\n",
281                   (unsigned int)pblob->length, fsp_str_dbg(fsp)));
282
283         SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context,
284                 return NT_STATUS_INTERNAL_DB_CORRUPTION);
285
286         if (fsp->fh->fd != -1) {
287                 ret = SMB_VFS_FSTAT(fsp, &fsp->fsp_name->st);
288         } else {
289                 if (fsp->posix_open) {
290                         ret = SMB_VFS_LSTAT(handle->conn, fsp->fsp_name);
291                 } else {
292                         ret = SMB_VFS_STAT(handle->conn, fsp->fsp_name);
293                 }
294         }
295
296         if (ret == -1) {
297                 return map_nt_error_from_unix(errno);
298         }
299
300         id = vfs_file_id_from_sbuf(handle->conn, &fsp->fsp_name->st);
301
302         /* For backwards compatibility only store the dev/inode. */
303         push_file_id_16((char *)id_buf, &id);
304         rec = db->fetch_locked(db, talloc_tos(),
305                                 make_tdb_data(id_buf,
306                                         sizeof(id_buf)));
307         if (rec == NULL) {
308                 DEBUG(0, ("store_acl_blob_fsp_tdb: fetch_lock failed\n"));
309                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
310         }
311         data.dptr = pblob->data;
312         data.dsize = pblob->length;
313         return rec->store(rec, data, 0);
314 }
315
316 /*******************************************************************
317  Store a DATA_BLOB into a tdb record given a pathname.
318 *******************************************************************/
319
320 static NTSTATUS store_acl_blob_pathname(vfs_handle_struct *handle,
321                                         const char *fname,
322                                         DATA_BLOB *pblob)
323 {
324         uint8 id_buf[16];
325         struct file_id id;
326         TDB_DATA data;
327         SMB_STRUCT_STAT sbuf;
328         struct db_context *db;
329         struct db_record *rec;
330         int ret = -1;
331
332         DEBUG(10,("store_acl_blob_pathname: storing blob "
333                         "length %u on file %s\n",
334                         (unsigned int)pblob->length, fname));
335
336         SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context,
337                 return NT_STATUS_INTERNAL_DB_CORRUPTION);
338
339         if (lp_posix_pathnames()) {
340                 ret = vfs_lstat_smb_fname(handle->conn, fname, &sbuf);
341         } else {
342                 ret = vfs_stat_smb_fname(handle->conn, fname, &sbuf);
343         }
344
345         if (ret == -1) {
346                 return map_nt_error_from_unix(errno);
347         }
348
349         id = vfs_file_id_from_sbuf(handle->conn, &sbuf);
350
351         /* For backwards compatibility only store the dev/inode. */
352         push_file_id_16((char *)id_buf, &id);
353
354         rec = db->fetch_locked(db, talloc_tos(),
355                                 make_tdb_data(id_buf,
356                                         sizeof(id_buf)));
357         if (rec == NULL) {
358                 DEBUG(0, ("store_acl_blob_pathname_tdb: fetch_lock failed\n"));
359                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
360         }
361         data.dptr = pblob->data;
362         data.dsize = pblob->length;
363         return rec->store(rec, data, 0);
364 }
365
366 /*******************************************************************
367  Store a DATA_BLOB into an tdb given a pathname.
368 *******************************************************************/
369
370 static NTSTATUS get_nt_acl_tdb_internal(vfs_handle_struct *handle,
371                                         files_struct *fsp,
372                                         const char *name,
373                                         uint32 security_info,
374                                         struct security_descriptor **ppdesc)
375 {
376         TALLOC_CTX *ctx = talloc_tos();
377         DATA_BLOB blob;
378         NTSTATUS status;
379
380         if (fsp && name == NULL) {
381                 name = fsp->fsp_name->base_name;
382         }
383
384         DEBUG(10, ("get_nt_acl_tdb_internal: name=%s\n", name));
385
386         status = get_acl_blob(ctx, handle, fsp, name, &blob);
387         if (!NT_STATUS_IS_OK(status)) {
388                 DEBUG(10, ("get_acl_blob returned %s\n", nt_errstr(status)));
389                 return status;
390         }
391
392         status = parse_acl_blob(&blob, security_info, ppdesc);
393         if (!NT_STATUS_IS_OK(status)) {
394                 DEBUG(10, ("parse_acl_blob returned %s\n",
395                                 nt_errstr(status)));
396                 return status;
397         }
398
399         TALLOC_FREE(blob.data);
400         return status;
401 }
402
403 /*********************************************************************
404  Create a default security descriptor for a file in case no inheritance
405  exists. All permissions to the owner and SYSTEM.
406 *********************************************************************/
407
408 static struct security_descriptor *default_file_sd(TALLOC_CTX *mem_ctx,
409                                                 SMB_STRUCT_STAT *psbuf)
410 {
411         struct dom_sid owner_sid, group_sid;
412         size_t sd_size;
413         struct security_ace *pace = NULL;
414         struct security_acl *pacl = NULL;
415
416         uid_to_sid(&owner_sid, psbuf->st_ex_uid);
417         gid_to_sid(&group_sid, psbuf->st_ex_gid);
418
419         pace = TALLOC_ARRAY(mem_ctx, struct security_ace, 2);
420         if (!pace) {
421                 return NULL;
422         }
423
424         init_sec_ace(&pace[0], &owner_sid, SEC_ACE_TYPE_ACCESS_ALLOWED,
425                         SEC_RIGHTS_FILE_ALL, 0);
426         init_sec_ace(&pace[1], &global_sid_System, SEC_ACE_TYPE_ACCESS_ALLOWED,
427                         SEC_RIGHTS_FILE_ALL, 0);
428
429         pacl = make_sec_acl(mem_ctx,
430                                 NT4_ACL_REVISION,
431                                 2,
432                                 pace);
433         if (!pacl) {
434                 return NULL;
435         }
436         return make_sec_desc(mem_ctx,
437                         SECURITY_DESCRIPTOR_REVISION_1,
438                         SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT,
439                         &owner_sid,
440                         &group_sid,
441                         NULL,
442                         pacl,
443                         &sd_size);
444 }
445
446 /*********************************************************************
447 *********************************************************************/
448
449 static NTSTATUS inherit_new_acl(vfs_handle_struct *handle,
450                                         struct smb_filename *smb_fname,
451                                         files_struct *fsp,
452                                         bool container)
453 {
454         TALLOC_CTX *ctx = talloc_tos();
455         NTSTATUS status;
456         struct security_descriptor *parent_desc = NULL;
457         struct security_descriptor *psd = NULL;
458         DATA_BLOB blob;
459         size_t size;
460         char *parent_name;
461
462         if (!parent_dirname(ctx, smb_fname->base_name, &parent_name, NULL)) {
463                 return NT_STATUS_NO_MEMORY;
464         }
465
466         DEBUG(10,("inherit_new_acl: check directory %s\n",
467                         parent_name));
468
469         status = get_nt_acl_tdb_internal(handle,
470                                         NULL,
471                                         parent_name,
472                                         (OWNER_SECURITY_INFORMATION |
473                                          GROUP_SECURITY_INFORMATION |
474                                          DACL_SECURITY_INFORMATION),
475                                         &parent_desc);
476         if (NT_STATUS_IS_OK(status)) {
477                 /* Create an inherited descriptor from the parent. */
478
479                 if (DEBUGLEVEL >= 10) {
480                         DEBUG(10,("inherit_new_acl: parent acl is:\n"));
481                         NDR_PRINT_DEBUG(security_descriptor, parent_desc);
482                 }
483
484                 status = se_create_child_secdesc(ctx,
485                                 &psd,
486                                 &size,
487                                 parent_desc,
488                                 &handle->conn->server_info->ptok->user_sids[PRIMARY_USER_SID_INDEX],
489                                 &handle->conn->server_info->ptok->user_sids[PRIMARY_GROUP_SID_INDEX],
490                                 container);
491                 if (!NT_STATUS_IS_OK(status)) {
492                         return status;
493                 }
494
495                 if (DEBUGLEVEL >= 10) {
496                         DEBUG(10,("inherit_new_acl: child acl is:\n"));
497                         NDR_PRINT_DEBUG(security_descriptor, psd);
498                 }
499
500         } else {
501                 DEBUG(10,("inherit_new_acl: directory %s failed "
502                         "to get acl %s\n",
503                         parent_name,
504                         nt_errstr(status) ));
505         }
506
507         if (!psd || psd->dacl == NULL) {
508                 int ret;
509
510                 TALLOC_FREE(psd);
511                 if (fsp && !fsp->is_directory && fsp->fh->fd != -1) {
512                         ret = SMB_VFS_FSTAT(fsp, &smb_fname->st);
513                 } else {
514                         if (fsp && fsp->posix_open) {
515                                 ret = SMB_VFS_LSTAT(handle->conn, smb_fname);
516                         } else {
517                                 ret = SMB_VFS_STAT(handle->conn, smb_fname);
518                         }
519                 }
520                 if (ret == -1) {
521                         return map_nt_error_from_unix(errno);
522                 }
523                 psd = default_file_sd(ctx, &smb_fname->st);
524                 if (!psd) {
525                         return NT_STATUS_NO_MEMORY;
526                 }
527
528                 if (DEBUGLEVEL >= 10) {
529                         DEBUG(10,("inherit_new_acl: default acl is:\n"));
530                         NDR_PRINT_DEBUG(security_descriptor, psd);
531                 }
532         }
533
534         status = create_acl_blob(psd, &blob);
535         if (!NT_STATUS_IS_OK(status)) {
536                 return status;
537         }
538         if (fsp) {
539                 return store_acl_blob_fsp(handle, fsp, &blob);
540         } else {
541                 return store_acl_blob_pathname(handle, smb_fname->base_name,
542                                                &blob);
543         }
544 }
545
546 /*********************************************************************
547  Check ACL on open. For new files inherit from parent directory.
548 *********************************************************************/
549
550 static int open_acl_tdb(vfs_handle_struct *handle,
551                                         struct smb_filename *smb_fname,
552                                         files_struct *fsp,
553                                         int flags,
554                                         mode_t mode)
555 {
556         uint32_t access_granted = 0;
557         struct security_descriptor *pdesc = NULL;
558         bool file_existed = true;
559         NTSTATUS status;
560
561         status = get_nt_acl_tdb_internal(handle,
562                                         NULL,
563                                         smb_fname->base_name,
564                                         (OWNER_SECURITY_INFORMATION |
565                                          GROUP_SECURITY_INFORMATION |
566                                          DACL_SECURITY_INFORMATION),
567                                         &pdesc);
568         if (NT_STATUS_IS_OK(status)) {
569                 /* See if we can access it. */
570                 status = smb1_file_se_access_check(pdesc,
571                                         handle->conn->server_info->ptok,
572                                         fsp->access_mask,
573                                         &access_granted);
574                 if (!NT_STATUS_IS_OK(status)) {
575                         DEBUG(10,("open_acl_tdb: file %s open "
576                                 "refused with error %s\n",
577                                 smb_fname_str_dbg(smb_fname),
578                                 nt_errstr(status) ));
579                         errno = map_errno_from_nt_status(status);
580                         return -1;
581                 }
582         } else if (NT_STATUS_EQUAL(status,NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
583                 file_existed = false;
584         }
585
586         DEBUG(10,("open_acl_tdb: get_nt_acl_attr_internal for "
587                 "file %s returned %s\n",
588                 smb_fname_str_dbg(smb_fname),
589                 nt_errstr(status) ));
590
591         fsp->fh->fd = SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
592
593         if (!file_existed && fsp->fh->fd != -1) {
594                 /* File was created. Inherit from parent directory. */
595                 status = fsp_set_smb_fname(fsp, smb_fname);
596                 if (!NT_STATUS_IS_OK(status)) {
597                         errno = map_errno_from_nt_status(status);
598                         return -1;
599                 }
600                 inherit_new_acl(handle, smb_fname, fsp, false);
601         }
602         return fsp->fh->fd;
603 }
604
605 /*********************************************************************
606  On unlink we need to delete the tdb record (if using tdb).
607 *********************************************************************/
608
609 static int unlink_acl_tdb(vfs_handle_struct *handle,
610                           const struct smb_filename *smb_fname)
611 {
612         struct smb_filename *smb_fname_tmp = NULL;
613         struct db_context *db;
614         NTSTATUS status;
615         int ret = -1;
616
617         SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context, return -1);
618
619         status = copy_smb_filename(talloc_tos(), smb_fname, &smb_fname_tmp);
620         if (!NT_STATUS_IS_OK(status)) {
621                 errno = map_errno_from_nt_status(status);
622                 goto out;
623         }
624
625         if (lp_posix_pathnames()) {
626                 ret = SMB_VFS_LSTAT(handle->conn, smb_fname_tmp);
627         } else {
628                 ret = SMB_VFS_STAT(handle->conn, smb_fname_tmp);
629         }
630
631         if (ret == -1) {
632                 goto out;
633         }
634
635         ret = SMB_VFS_NEXT_UNLINK(handle, smb_fname_tmp);
636
637         if (ret == -1) {
638                 goto out;
639         }
640
641         acl_tdb_delete(handle, db, &smb_fname_tmp->st);
642  out:
643         return ret;
644 }
645
646 /*********************************************************************
647  Store an inherited SD on mkdir.
648 *********************************************************************/
649
650 static int mkdir_acl_tdb(vfs_handle_struct *handle, const char *path, mode_t mode)
651 {
652         struct smb_filename *smb_fname = NULL;
653         int ret = SMB_VFS_NEXT_MKDIR(handle, path, mode);
654         NTSTATUS status;
655
656         if (ret == -1) {
657                 return ret;
658         }
659
660         status = create_synthetic_smb_fname(talloc_tos(), path, NULL, NULL,
661                                             &smb_fname);
662         if (!NT_STATUS_IS_OK(status)) {
663                 errno = map_errno_from_nt_status(status);
664                 return -1;
665         }
666
667         /* New directory - inherit from parent. */
668         inherit_new_acl(handle, smb_fname, NULL, true);
669         TALLOC_FREE(smb_fname);
670         return ret;
671 }
672
673 /*********************************************************************
674  On rmdir we need to delete the tdb record (if using tdb).
675 *********************************************************************/
676
677 static int rmdir_acl_tdb(vfs_handle_struct *handle, const char *path)
678 {
679
680         SMB_STRUCT_STAT sbuf;
681         struct db_context *db;
682         int ret = -1;
683
684         SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context, return -1);
685
686         if (lp_posix_pathnames()) {
687                 ret = vfs_lstat_smb_fname(handle->conn, path, &sbuf);
688         } else {
689                 ret = vfs_stat_smb_fname(handle->conn, path, &sbuf);
690         }
691
692         if (ret == -1) {
693                 return -1;
694         }
695
696         ret = SMB_VFS_NEXT_RMDIR(handle, path);
697         if (ret == -1) {
698                 return -1;
699         }
700
701         acl_tdb_delete(handle, db, &sbuf);
702         return 0;
703 }
704
705 /*********************************************************************
706  Fetch a security descriptor given an fsp.
707 *********************************************************************/
708
709 static NTSTATUS fget_nt_acl_tdb(vfs_handle_struct *handle, files_struct *fsp,
710         uint32 security_info, struct security_descriptor **ppdesc)
711 {
712         NTSTATUS status = get_nt_acl_tdb_internal(handle, fsp,
713                                 NULL, security_info, ppdesc);
714         if (NT_STATUS_IS_OK(status)) {
715                 if (DEBUGLEVEL >= 10) {
716                         DEBUG(10,("fget_nt_acl_tdb: returning tdb sd for file %s\n",
717                                   fsp_str_dbg(fsp)));
718                         NDR_PRINT_DEBUG(security_descriptor, *ppdesc);
719                 }
720                 return NT_STATUS_OK;
721         }
722
723         DEBUG(10,("fget_nt_acl_tdb: failed to get tdb sd for file %s, Error %s\n",
724                   fsp_str_dbg(fsp), nt_errstr(status)));
725
726         return SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp,
727                         security_info, ppdesc);
728 }
729
730 /*********************************************************************
731  Fetch a security descriptor given a pathname.
732 *********************************************************************/
733
734 static NTSTATUS get_nt_acl_tdb(vfs_handle_struct *handle,
735         const char *name, uint32 security_info, struct security_descriptor **ppdesc)
736 {
737         NTSTATUS status = get_nt_acl_tdb_internal(handle, NULL,
738                                 name, security_info, ppdesc);
739         if (NT_STATUS_IS_OK(status)) {
740                 if (DEBUGLEVEL >= 10) {
741                         DEBUG(10,("get_nt_acl_tdb: returning tdb sd for file %s\n",
742                                 name));
743                         NDR_PRINT_DEBUG(security_descriptor, *ppdesc);
744                 }
745                 return NT_STATUS_OK;
746         }
747
748         DEBUG(10,("get_nt_acl_tdb: failed to get tdb sd for file %s, Error %s\n",
749                         name,
750                         nt_errstr(status) ));
751
752         return SMB_VFS_NEXT_GET_NT_ACL(handle, name,
753                         security_info, ppdesc);
754 }
755
756 /*********************************************************************
757  Store a security descriptor given an fsp.
758 *********************************************************************/
759
760 static NTSTATUS fset_nt_acl_tdb(vfs_handle_struct *handle, files_struct *fsp,
761         uint32 security_info_sent, const struct security_descriptor *psd)
762 {
763         NTSTATUS status;
764         DATA_BLOB blob;
765
766         if (DEBUGLEVEL >= 10) {
767                 DEBUG(10,("fset_nt_acl_tdb: incoming sd for file %s\n",
768                           fsp_str_dbg(fsp)));
769                 NDR_PRINT_DEBUG(security_descriptor,
770                         CONST_DISCARD(struct security_descriptor *,psd));
771         }
772
773         status = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
774         if (!NT_STATUS_IS_OK(status)) {
775                 return status;
776         }
777
778         /* Ensure owner and group are set. */
779         if (!psd->owner_sid || !psd->group_sid) {
780                 int ret;
781                 DOM_SID owner_sid, group_sid;
782                 struct security_descriptor *nc_psd = dup_sec_desc(talloc_tos(), psd);
783
784                 if (!nc_psd) {
785                         return NT_STATUS_OK;
786                 }
787                 if (fsp->is_directory || fsp->fh->fd == -1) {
788                         if (fsp->posix_open) {
789                                 ret = SMB_VFS_LSTAT(fsp->conn, fsp->fsp_name);
790                         } else {
791                                 ret = SMB_VFS_STAT(fsp->conn, fsp->fsp_name);
792                         }
793                 } else {
794                         ret = SMB_VFS_FSTAT(fsp, &fsp->fsp_name->st);
795                 }
796                 if (ret == -1) {
797                         /* Lower level acl set succeeded,
798                          * so still return OK. */
799                         return NT_STATUS_OK;
800                 }
801                 create_file_sids(&fsp->fsp_name->st, &owner_sid, &group_sid);
802                 /* This is safe as nc_psd is discarded at fn exit. */
803                 nc_psd->owner_sid = &owner_sid;
804                 nc_psd->group_sid = &group_sid;
805                 security_info_sent |= (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION);
806                 psd = nc_psd;
807         }
808
809 #if 0
810         if ((security_info_sent & DACL_SECURITY_INFORMATION) &&
811                         psd->dacl != NULL &&
812                         (psd->type & (SE_DESC_DACL_AUTO_INHERITED|
813                                 SE_DESC_DACL_AUTO_INHERIT_REQ))==
814                                 (SE_DESC_DACL_AUTO_INHERITED|
815                                 SE_DESC_DACL_AUTO_INHERIT_REQ) ) {
816                 struct security_descriptor *new_psd = NULL;
817                 status = append_parent_acl(fsp, psd, &new_psd);
818                 if (!NT_STATUS_IS_OK(status)) {
819                         /* Lower level acl set succeeded,
820                          * so still return OK. */
821                         return NT_STATUS_OK;
822                 }
823                 psd = new_psd;
824         }
825 #endif
826
827         if (DEBUGLEVEL >= 10) {
828                 DEBUG(10,("fset_nt_acl_tdb: storing tdb sd for file %s\n",
829                           fsp_str_dbg(fsp)));
830                 NDR_PRINT_DEBUG(security_descriptor,
831                         CONST_DISCARD(struct security_descriptor *,psd));
832         }
833         create_acl_blob(psd, &blob);
834         store_acl_blob_fsp(handle, fsp, &blob);
835
836         return NT_STATUS_OK;
837 }
838
839 /*******************************************************************
840  Handle opening the storage tdb if so configured.
841 *******************************************************************/
842
843 static int connect_acl_tdb(struct vfs_handle_struct *handle,
844                                 const char *service,
845                                 const char *user)
846 {
847         struct db_context *db;
848         int res;
849
850         res = SMB_VFS_NEXT_CONNECT(handle, service, user);
851         if (res < 0) {
852                 return res;
853         }
854
855         if (!acl_tdb_init(&db)) {
856                 SMB_VFS_NEXT_DISCONNECT(handle);
857                 return -1;
858         }
859
860         SMB_VFS_HANDLE_SET_DATA(handle, db, free_acl_tdb_data,
861                                 struct db_context, return -1);
862
863         return 0;
864 }
865
866 /*********************************************************************
867  Remove a Windows ACL - we're setting the underlying POSIX ACL.
868 *********************************************************************/
869
870 static int sys_acl_set_file_tdb(vfs_handle_struct *handle,
871                               const char *path,
872                               SMB_ACL_TYPE_T type,
873                               SMB_ACL_T theacl)
874 {
875         SMB_STRUCT_STAT sbuf;
876         struct db_context *db;
877         int ret = -1;
878
879         SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context, return -1);
880
881         if (lp_posix_pathnames()) {
882                 ret = vfs_lstat_smb_fname(handle->conn, path, &sbuf);
883         } else {
884                 ret = vfs_stat_smb_fname(handle->conn, path, &sbuf);
885         }
886
887         if (ret == -1) {
888                 return -1;
889         }
890
891         ret = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle,
892                                                 path,
893                                                 type,
894                                                 theacl);
895         if (ret == -1) {
896                 return -1;
897         }
898
899         acl_tdb_delete(handle, db, &sbuf);
900         return 0;
901 }
902
903 /*********************************************************************
904  Remove a Windows ACL - we're setting the underlying POSIX ACL.
905 *********************************************************************/
906
907 static int sys_acl_set_fd_tdb(vfs_handle_struct *handle,
908                             files_struct *fsp,
909                             SMB_ACL_T theacl)
910 {
911         struct db_context *db;
912         int ret;
913
914         SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context, return -1);
915
916         if (fsp->is_directory || fsp->fh->fd == -1) {
917                 if (fsp->posix_open) {
918                         ret = SMB_VFS_LSTAT(fsp->conn, fsp->fsp_name);
919                 } else {
920                         ret = SMB_VFS_STAT(fsp->conn, fsp->fsp_name);
921                 }
922         } else {
923                 ret = SMB_VFS_FSTAT(fsp, &fsp->fsp_name->st);
924         }
925         if (ret == -1) {
926                 return -1;
927         }
928
929         ret = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle,
930                                                 fsp,
931                                                 theacl);
932         if (ret == -1) {
933                 return -1;
934         }
935
936         acl_tdb_delete(handle, db, &fsp->fsp_name->st);
937         return 0;
938 }
939
940 /* VFS operations structure */
941
942 static vfs_op_tuple skel_op_tuples[] =
943 {
944         {SMB_VFS_OP(connect_acl_tdb), SMB_VFS_OP_CONNECT,  SMB_VFS_LAYER_TRANSPARENT},
945
946         {SMB_VFS_OP(mkdir_acl_tdb), SMB_VFS_OP_MKDIR, SMB_VFS_LAYER_TRANSPARENT},
947         {SMB_VFS_OP(rmdir_acl_tdb), SMB_VFS_OP_RMDIR, SMB_VFS_LAYER_TRANSPARENT},
948
949         {SMB_VFS_OP(open_acl_tdb),  SMB_VFS_OP_OPEN,  SMB_VFS_LAYER_TRANSPARENT},
950         {SMB_VFS_OP(unlink_acl_tdb), SMB_VFS_OP_UNLINK, SMB_VFS_LAYER_TRANSPARENT},
951
952         /* NT File ACL operations */
953
954         {SMB_VFS_OP(fget_nt_acl_tdb),SMB_VFS_OP_FGET_NT_ACL,SMB_VFS_LAYER_TRANSPARENT},
955         {SMB_VFS_OP(get_nt_acl_tdb), SMB_VFS_OP_GET_NT_ACL, SMB_VFS_LAYER_TRANSPARENT},
956         {SMB_VFS_OP(fset_nt_acl_tdb),SMB_VFS_OP_FSET_NT_ACL,SMB_VFS_LAYER_TRANSPARENT},
957
958         /* POSIX ACL operations. */
959         {SMB_VFS_OP(sys_acl_set_file_tdb), SMB_VFS_OP_SYS_ACL_SET_FILE, SMB_VFS_LAYER_TRANSPARENT},
960         {SMB_VFS_OP(sys_acl_set_fd_tdb), SMB_VFS_OP_SYS_ACL_SET_FD, SMB_VFS_LAYER_TRANSPARENT},
961
962         {SMB_VFS_OP(NULL), SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP}
963 };
964
965 NTSTATUS vfs_acl_tdb_init(void)
966 {
967         return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "acl_tdb", skel_op_tuples);
968 }