Merge branch 'master' of ssh://jra@git.samba.org/data/git/samba
[samba.git] / source3 / modules / vfs_acl_tdb.c
1 /*
2  * Store Windows ACLs in a tdb.
3  *
4  * Copyright (C) Volker Lendecke, 2008
5  * Copyright (C) Jeremy Allison, 2008
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License as published by
9  * the Free Software Foundation; either version 3 of the License, or
10  * (at your option) any later version.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License
18  * along with this program; if not, see <http://www.gnu.org/licenses/>.
19  */
20
21 /* NOTE: This is an experimental module, not yet finished. JRA. */
22
23 #include "includes.h"
24 #include "librpc/gen_ndr/xattr.h"
25 #include "librpc/gen_ndr/ndr_xattr.h"
26
27 #undef DBGC_CLASS
28 #define DBGC_CLASS DBGC_VFS
29
30 static unsigned int ref_count;
31 static struct db_context *acl_db;
32
33 /*******************************************************************
34  Open acl_db if not already open, increment ref count.
35 *******************************************************************/
36
37 static bool acl_tdb_init(struct db_context **pp_db)
38 {
39         const char *dbname;
40
41         if (acl_db) {
42                 *pp_db = acl_db;
43                 ref_count++;
44                 return true;
45         }
46
47         dbname = lock_path("file_ntacls.tdb");
48
49         if (dbname == NULL) {
50                 errno = ENOSYS;
51                 return false;
52         }
53
54         become_root();
55         *pp_db = db_open(NULL, dbname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
56         unbecome_root();
57
58         if (*pp_db == NULL) {
59 #if defined(ENOTSUP)
60                 errno = ENOTSUP;
61 #else
62                 errno = ENOSYS;
63 #endif
64                 return false;
65         }
66
67         ref_count++;
68         return true;
69 }
70
71 /*******************************************************************
72  Lower ref count and close acl_db if zero.
73 *******************************************************************/
74
75 static void free_acl_tdb_data(void **pptr)
76 {
77         struct db_context **pp_db = (struct db_context **)pptr;
78
79         ref_count--;
80         if (ref_count == 0) {
81                 TALLOC_FREE(*pp_db);
82                 acl_db = NULL;
83         }
84 }
85
86 /*******************************************************************
87  Fetch_lock the tdb acl record for a file
88 *******************************************************************/
89
90 static struct db_record *acl_tdb_lock(TALLOC_CTX *mem_ctx,
91                                         struct db_context *db,
92                                         const struct file_id *id)
93 {
94         uint8 id_buf[16];
95         push_file_id_16((char *)id_buf, id);
96         return db->fetch_locked(db,
97                                 mem_ctx,
98                                 make_tdb_data(id_buf,
99                                         sizeof(id_buf)));
100 }
101
102 /*******************************************************************
103  Delete the tdb acl record for a file
104 *******************************************************************/
105
106 static NTSTATUS acl_tdb_delete(vfs_handle_struct *handle,
107                                 struct db_context *db,
108                                 SMB_STRUCT_STAT *psbuf)
109 {
110         NTSTATUS status;
111         struct file_id id = vfs_file_id_from_sbuf(handle->conn, psbuf);
112         struct db_record *rec = acl_tdb_lock(talloc_tos(), db, &id);
113
114         /*
115          * If rec == NULL there's not much we can do about it
116          */
117
118         if (rec == NULL) {
119                 DEBUG(10,("acl_tdb_delete: rec == NULL\n"));
120                 TALLOC_FREE(rec);
121                 return NT_STATUS_OK;
122         }
123
124         status = rec->delete_rec(rec);
125         TALLOC_FREE(rec);
126         return status;
127 }
128
129 /*******************************************************************
130  Parse out a struct security_descriptor from a DATA_BLOB.
131 *******************************************************************/
132
133 static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
134                                 uint32 security_info,
135                                 struct security_descriptor **ppdesc)
136 {
137         TALLOC_CTX *ctx = talloc_tos();
138         struct xattr_NTACL xacl;
139         enum ndr_err_code ndr_err;
140         size_t sd_size;
141
142         ndr_err = ndr_pull_struct_blob(pblob, ctx, NULL, &xacl,
143                         (ndr_pull_flags_fn_t)ndr_pull_xattr_NTACL);
144
145         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
146                 DEBUG(5, ("parse_acl_blob: ndr_pull_xattr_NTACL failed: %s\n",
147                         ndr_errstr(ndr_err)));
148                 return ndr_map_error2ntstatus(ndr_err);;
149         }
150
151         if (xacl.version != 2) {
152                 return NT_STATUS_REVISION_MISMATCH;
153         }
154
155         *ppdesc = make_sec_desc(ctx, SEC_DESC_REVISION, xacl.info.sd_hs->sd->type | SEC_DESC_SELF_RELATIVE,
156                         (security_info & OWNER_SECURITY_INFORMATION)
157                         ? xacl.info.sd_hs->sd->owner_sid : NULL,
158                         (security_info & GROUP_SECURITY_INFORMATION)
159                         ? xacl.info.sd_hs->sd->group_sid : NULL,
160                         (security_info & SACL_SECURITY_INFORMATION)
161                         ? xacl.info.sd_hs->sd->sacl : NULL,
162                         (security_info & DACL_SECURITY_INFORMATION)
163                         ? xacl.info.sd_hs->sd->dacl : NULL,
164                         &sd_size);
165
166         TALLOC_FREE(xacl.info.sd);
167
168         return (*ppdesc != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
169 }
170
171 /*******************************************************************
172  Pull a security descriptor into a DATA_BLOB from a tdb store.
173 *******************************************************************/
174
175 static NTSTATUS get_acl_blob(TALLOC_CTX *ctx,
176                         vfs_handle_struct *handle,
177                         files_struct *fsp,
178                         const char *name,
179                         DATA_BLOB *pblob)
180 {
181         uint8 id_buf[16];
182         TDB_DATA data;
183         struct file_id id;
184         struct db_context *db;
185         SMB_STRUCT_STAT sbuf;
186
187         SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context,
188                 return NT_STATUS_INTERNAL_DB_CORRUPTION);
189
190         if (fsp && fsp->fh->fd != -1) {
191                 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
192                         return map_nt_error_from_unix(errno);
193                 }
194         } else {
195                 if (SMB_VFS_STAT(handle->conn, name, &sbuf) == -1) {
196                         return map_nt_error_from_unix(errno);
197                 }
198         }
199         id = vfs_file_id_from_sbuf(handle->conn, &sbuf);
200
201         push_file_id_16((char *)id_buf, &id);
202
203         if (db->fetch(db,
204                         ctx,
205                         make_tdb_data(id_buf, sizeof(id_buf)),
206                         &data) == -1) {
207                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
208         }
209
210         pblob->data = data.dptr;
211         pblob->length = data.dsize;
212
213         DEBUG(10,("get_acl_blob: returned %u bytes from file %s\n",
214                 (unsigned int)data.dsize, name ));
215
216         if (pblob->length == 0 || pblob->data == NULL) {
217                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
218         }
219         return NT_STATUS_OK;
220 }
221
222 /*******************************************************************
223  Create a DATA_BLOB from a security descriptor.
224 *******************************************************************/
225
226 static NTSTATUS create_acl_blob(const struct security_descriptor *psd, DATA_BLOB *pblob)
227 {
228         struct xattr_NTACL xacl;
229         struct security_descriptor_hash sd_hs;
230         enum ndr_err_code ndr_err;
231         TALLOC_CTX *ctx = talloc_tos();
232
233         ZERO_STRUCT(xacl);
234         ZERO_STRUCT(sd_hs);
235
236         xacl.version = 2;
237         xacl.info.sd_hs = &sd_hs;
238         xacl.info.sd_hs->sd = CONST_DISCARD(struct security_descriptor *, psd);
239         memset(&xacl.info.sd_hs->hash[0], '\0', 16);
240
241         ndr_err = ndr_push_struct_blob(
242                         pblob, ctx, NULL, &xacl,
243                         (ndr_push_flags_fn_t)ndr_push_xattr_NTACL);
244
245         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
246                 DEBUG(5, ("create_acl_blob: ndr_push_xattr_NTACL failed: %s\n",
247                         ndr_errstr(ndr_err)));
248                 return ndr_map_error2ntstatus(ndr_err);;
249         }
250
251         return NT_STATUS_OK;
252 }
253
254 /*******************************************************************
255  Store a DATA_BLOB into a tdb record given an fsp pointer.
256 *******************************************************************/
257
258 static NTSTATUS store_acl_blob_fsp(vfs_handle_struct *handle,
259                                 files_struct *fsp,
260                                 DATA_BLOB *pblob)
261 {
262         uint8 id_buf[16];
263         struct file_id id;
264         SMB_STRUCT_STAT sbuf;
265         TDB_DATA data;
266         struct db_context *db;
267         struct db_record *rec;
268
269         DEBUG(10,("store_acl_blob_fsp: storing blob length %u on file %s\n",
270                         (unsigned int)pblob->length, fsp->fsp_name));
271
272         SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context,
273                 return NT_STATUS_INTERNAL_DB_CORRUPTION);
274
275         if (fsp->fh->fd != -1) {
276                 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
277                         return map_nt_error_from_unix(errno);
278                 }
279         } else {
280                 if (SMB_VFS_STAT(handle->conn, fsp->fsp_name, &sbuf) == -1) {
281                         return map_nt_error_from_unix(errno);
282                 }
283         }
284         id = vfs_file_id_from_sbuf(handle->conn, &sbuf);
285
286         push_file_id_16((char *)id_buf, &id);
287         rec = db->fetch_locked(db, talloc_tos(),
288                                 make_tdb_data(id_buf,
289                                         sizeof(id_buf)));
290         if (rec == NULL) {
291                 DEBUG(0, ("store_acl_blob_fsp_tdb: fetch_lock failed\n"));
292                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
293         }
294         data.dptr = pblob->data;
295         data.dsize = pblob->length;
296         return rec->store(rec, data, 0);
297 }
298
299 /*******************************************************************
300  Store a DATA_BLOB into a tdb record given a pathname.
301 *******************************************************************/
302
303 static NTSTATUS store_acl_blob_pathname(vfs_handle_struct *handle,
304                                         const char *fname,
305                                         DATA_BLOB *pblob)
306 {
307         uint8 id_buf[16];
308         struct file_id id;
309         TDB_DATA data;
310         SMB_STRUCT_STAT sbuf;
311         struct db_context *db;
312         struct db_record *rec;
313
314         DEBUG(10,("store_acl_blob_pathname: storing blob "
315                         "length %u on file %s\n",
316                         (unsigned int)pblob->length, fname));
317
318         SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context,
319                 return NT_STATUS_INTERNAL_DB_CORRUPTION);
320
321         if (SMB_VFS_STAT(handle->conn, fname, &sbuf) == -1) {
322                 return map_nt_error_from_unix(errno);
323         }
324
325         id = vfs_file_id_from_sbuf(handle->conn, &sbuf);
326         push_file_id_16((char *)id_buf, &id);
327
328         rec = db->fetch_locked(db, talloc_tos(),
329                                 make_tdb_data(id_buf,
330                                         sizeof(id_buf)));
331         if (rec == NULL) {
332                 DEBUG(0, ("store_acl_blob_pathname_tdb: fetch_lock failed\n"));
333                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
334         }
335         data.dptr = pblob->data;
336         data.dsize = pblob->length;
337         return rec->store(rec, data, 0);
338 }
339
340 /*******************************************************************
341  Store a DATA_BLOB into an tdb given a pathname.
342 *******************************************************************/
343
344 static NTSTATUS get_nt_acl_tdb_internal(vfs_handle_struct *handle,
345                                         files_struct *fsp,
346                                         const char *name,
347                                         uint32 security_info,
348                                         struct security_descriptor **ppdesc)
349 {
350         TALLOC_CTX *ctx = talloc_tos();
351         DATA_BLOB blob;
352         NTSTATUS status;
353
354         if (fsp && name == NULL) {
355                 name = fsp->fsp_name;
356         }
357
358         DEBUG(10, ("get_nt_acl_tdb_internal: name=%s\n", name));
359
360         status = get_acl_blob(ctx, handle, fsp, name, &blob);
361         if (!NT_STATUS_IS_OK(status)) {
362                 DEBUG(10, ("get_acl_blob returned %s\n", nt_errstr(status)));
363                 return status;
364         }
365
366         status = parse_acl_blob(&blob, security_info, ppdesc);
367         if (!NT_STATUS_IS_OK(status)) {
368                 DEBUG(10, ("parse_acl_blob returned %s\n",
369                                 nt_errstr(status)));
370                 return status;
371         }
372
373         TALLOC_FREE(blob.data);
374         return status;
375 }
376
377 /*********************************************************************
378  Create a default security descriptor for a file in case no inheritance
379  exists. All permissions to the owner and SYSTEM.
380 *********************************************************************/
381
382 static struct security_descriptor *default_file_sd(TALLOC_CTX *mem_ctx,
383                                                 SMB_STRUCT_STAT *psbuf)
384 {
385         struct dom_sid owner_sid, group_sid;
386         size_t sd_size;
387         struct security_ace *pace = NULL;
388         struct security_acl *pacl = NULL;
389
390         uid_to_sid(&owner_sid, psbuf->st_uid);
391         gid_to_sid(&group_sid, psbuf->st_gid);
392
393         pace = TALLOC_ARRAY(mem_ctx, struct security_ace, 2);
394         if (!pace) {
395                 return NULL;
396         }
397
398         init_sec_ace(&pace[0], &owner_sid, SEC_ACE_TYPE_ACCESS_ALLOWED,
399                         SEC_RIGHTS_FILE_ALL, 0);
400         init_sec_ace(&pace[1], &global_sid_System, SEC_ACE_TYPE_ACCESS_ALLOWED,
401                         SEC_RIGHTS_FILE_ALL, 0);
402
403         pacl = make_sec_acl(mem_ctx,
404                                 NT4_ACL_REVISION,
405                                 2,
406                                 pace);
407         if (!pacl) {
408                 return NULL;
409         }
410         return make_sec_desc(mem_ctx,
411                         SECURITY_DESCRIPTOR_REVISION_1,
412                         SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT,
413                         &owner_sid,
414                         &group_sid,
415                         NULL,
416                         pacl,
417                         &sd_size);
418 }
419
420 /*********************************************************************
421 *********************************************************************/
422
423 static NTSTATUS inherit_new_acl(vfs_handle_struct *handle,
424                                         const char *fname,
425                                         files_struct *fsp,
426                                         bool container)
427 {
428         TALLOC_CTX *ctx = talloc_tos();
429         NTSTATUS status;
430         struct security_descriptor *parent_desc = NULL;
431         struct security_descriptor *psd = NULL;
432         DATA_BLOB blob;
433         size_t size;
434         char *parent_name;
435
436         if (!parent_dirname_talloc(ctx,
437                                 fname,
438                                 &parent_name,
439                                 NULL)) {
440                 return NT_STATUS_NO_MEMORY;
441         }
442
443         DEBUG(10,("inherit_new_acl: check directory %s\n",
444                         parent_name));
445
446         status = get_nt_acl_tdb_internal(handle,
447                                         NULL,
448                                         parent_name,
449                                         (OWNER_SECURITY_INFORMATION |
450                                          GROUP_SECURITY_INFORMATION |
451                                          DACL_SECURITY_INFORMATION),
452                                         &parent_desc);
453         if (NT_STATUS_IS_OK(status)) {
454                 /* Create an inherited descriptor from the parent. */
455
456                 if (DEBUGLEVEL >= 10) {
457                         DEBUG(10,("inherit_new_acl: parent acl is:\n"));
458                         NDR_PRINT_DEBUG(security_descriptor, parent_desc);
459                 }
460
461                 status = se_create_child_secdesc(ctx,
462                                 &psd,
463                                 &size,
464                                 parent_desc,
465                                 &handle->conn->server_info->ptok->user_sids[PRIMARY_USER_SID_INDEX],
466                                 &handle->conn->server_info->ptok->user_sids[PRIMARY_GROUP_SID_INDEX],
467                                 container);
468                 if (!NT_STATUS_IS_OK(status)) {
469                         return status;
470                 }
471
472                 if (DEBUGLEVEL >= 10) {
473                         DEBUG(10,("inherit_new_acl: child acl is:\n"));
474                         NDR_PRINT_DEBUG(security_descriptor, psd);
475                 }
476
477         } else {
478                 DEBUG(10,("inherit_new_acl: directory %s failed "
479                         "to get acl %s\n",
480                         parent_name,
481                         nt_errstr(status) ));
482         }
483
484         if (!psd || psd->dacl == NULL) {
485                 SMB_STRUCT_STAT sbuf;
486                 int ret;
487
488                 TALLOC_FREE(psd);
489                 if (fsp && !fsp->is_directory && fsp->fh->fd != -1) {
490                         ret = SMB_VFS_FSTAT(fsp, &sbuf);
491                 } else {
492                         ret = SMB_VFS_STAT(handle->conn,fname, &sbuf);
493                 }
494                 if (ret == -1) {
495                         return map_nt_error_from_unix(errno);
496                 }
497                 psd = default_file_sd(ctx, &sbuf);
498                 if (!psd) {
499                         return NT_STATUS_NO_MEMORY;
500                 }
501
502                 if (DEBUGLEVEL >= 10) {
503                         DEBUG(10,("inherit_new_acl: default acl is:\n"));
504                         NDR_PRINT_DEBUG(security_descriptor, psd);
505                 }
506         }
507
508         status = create_acl_blob(psd, &blob);
509         if (!NT_STATUS_IS_OK(status)) {
510                 return status;
511         }
512         if (fsp) {
513                 return store_acl_blob_fsp(handle, fsp, &blob);
514         } else {
515                 return store_acl_blob_pathname(handle, fname, &blob);
516         }
517 }
518
519 /*********************************************************************
520  Check ACL on open. For new files inherit from parent directory.
521 *********************************************************************/
522
523 static int open_acl_tdb(vfs_handle_struct *handle,
524                                         const char *fname,
525                                         files_struct *fsp,
526                                         int flags,
527                                         mode_t mode)
528 {
529         uint32_t access_granted = 0;
530         struct security_descriptor *pdesc = NULL;
531         bool file_existed = true;
532         NTSTATUS status = get_nt_acl_tdb_internal(handle,
533                                         NULL,
534                                         fname,
535                                         (OWNER_SECURITY_INFORMATION |
536                                          GROUP_SECURITY_INFORMATION |
537                                          DACL_SECURITY_INFORMATION),
538                                         &pdesc);
539         if (NT_STATUS_IS_OK(status)) {
540                 /* See if we can access it. */
541                 status = smb1_file_se_access_check(pdesc,
542                                         handle->conn->server_info->ptok,
543                                         fsp->access_mask,
544                                         &access_granted);
545                 if (!NT_STATUS_IS_OK(status)) {
546                         DEBUG(10,("open_acl_tdb: file %s open "
547                                 "refused with error %s\n",
548                                 fname,
549                                 nt_errstr(status) ));
550                         errno = map_errno_from_nt_status(status);
551                         return -1;
552                 }
553         } else if (NT_STATUS_EQUAL(status,NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
554                 file_existed = false;
555         }
556
557         DEBUG(10,("open_acl_tdb: get_nt_acl_attr_internal for "
558                 "file %s returned %s\n",
559                 fname,
560                 nt_errstr(status) ));
561
562         fsp->fh->fd = SMB_VFS_NEXT_OPEN(handle, fname, fsp, flags, mode);
563
564         if (!file_existed && fsp->fh->fd != -1) {
565                 /* File was created. Inherit from parent directory. */
566                 string_set(&fsp->fsp_name, fname);
567                 inherit_new_acl(handle, fname, fsp, false);
568         }
569
570         return fsp->fh->fd;
571 }
572
573 /*********************************************************************
574  On unlink we need to delete the tdb record (if using tdb).
575 *********************************************************************/
576
577 static int unlink_acl_tdb(vfs_handle_struct *handle, const char *path)
578 {
579         SMB_STRUCT_STAT sbuf;
580         struct db_context *db;
581         int ret;
582
583         SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context, return -1);
584
585         if (SMB_VFS_STAT(handle->conn, path, &sbuf) == -1) {
586                 return -1;
587         }
588
589         ret = SMB_VFS_NEXT_UNLINK(handle, path);
590
591         if (ret == -1) {
592                 return -1;
593         }
594
595         acl_tdb_delete(handle, db, &sbuf);
596         return 0;
597 }
598
599 /*********************************************************************
600  Store an inherited SD on mkdir.
601 *********************************************************************/
602
603 static int mkdir_acl_tdb(vfs_handle_struct *handle, const char *path, mode_t mode)
604 {
605         int ret = SMB_VFS_NEXT_MKDIR(handle, path, mode);
606
607         if (ret == -1) {
608                 return ret;
609         }
610         /* New directory - inherit from parent. */
611         inherit_new_acl(handle, path, NULL, true);
612         return ret;
613 }
614
615 /*********************************************************************
616  On rmdir we need to delete the tdb record (if using tdb).
617 *********************************************************************/
618
619 static int rmdir_acl_tdb(vfs_handle_struct *handle, const char *path)
620 {
621
622         SMB_STRUCT_STAT sbuf;
623         struct db_context *db;
624         int ret;
625
626         SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context, return -1);
627
628         if (SMB_VFS_STAT(handle->conn, path, &sbuf) == -1) {
629                 return -1;
630         }
631
632         ret = SMB_VFS_NEXT_RMDIR(handle, path);
633         if (ret == -1) {
634                 return -1;
635         }
636
637         acl_tdb_delete(handle, db, &sbuf);
638         return 0;
639 }
640
641 /*********************************************************************
642  Fetch a security descriptor given an fsp.
643 *********************************************************************/
644
645 static NTSTATUS fget_nt_acl_tdb(vfs_handle_struct *handle, files_struct *fsp,
646         uint32 security_info, struct security_descriptor **ppdesc)
647 {
648         NTSTATUS status = get_nt_acl_tdb_internal(handle, fsp,
649                                 NULL, security_info, ppdesc);
650         if (NT_STATUS_IS_OK(status)) {
651                 if (DEBUGLEVEL >= 10) {
652                         DEBUG(10,("fget_nt_acl_tdb: returning tdb sd for file %s\n",
653                                 fsp->fsp_name));
654                         NDR_PRINT_DEBUG(security_descriptor, *ppdesc);
655                 }
656                 return NT_STATUS_OK;
657         }
658
659         DEBUG(10,("fget_nt_acl_tdb: failed to get tdb sd for file %s, Error %s\n",
660                         fsp->fsp_name,
661                         nt_errstr(status) ));
662
663         return SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp,
664                         security_info, ppdesc);
665 }
666
667 /*********************************************************************
668  Fetch a security descriptor given a pathname.
669 *********************************************************************/
670
671 static NTSTATUS get_nt_acl_tdb(vfs_handle_struct *handle,
672         const char *name, uint32 security_info, struct security_descriptor **ppdesc)
673 {
674         NTSTATUS status = get_nt_acl_tdb_internal(handle, NULL,
675                                 name, security_info, ppdesc);
676         if (NT_STATUS_IS_OK(status)) {
677                 if (DEBUGLEVEL >= 10) {
678                         DEBUG(10,("get_nt_acl_tdb: returning tdb sd for file %s\n",
679                                 name));
680                         NDR_PRINT_DEBUG(security_descriptor, *ppdesc);
681                 }
682                 return NT_STATUS_OK;
683         }
684
685         DEBUG(10,("get_nt_acl_tdb: failed to get tdb sd for file %s, Error %s\n",
686                         name,
687                         nt_errstr(status) ));
688
689         return SMB_VFS_NEXT_GET_NT_ACL(handle, name,
690                         security_info, ppdesc);
691 }
692
693 /*********************************************************************
694  Store a security descriptor given an fsp.
695 *********************************************************************/
696
697 static NTSTATUS fset_nt_acl_tdb(vfs_handle_struct *handle, files_struct *fsp,
698         uint32 security_info_sent, const struct security_descriptor *psd)
699 {
700         NTSTATUS status;
701         DATA_BLOB blob;
702
703         if (DEBUGLEVEL >= 10) {
704                 DEBUG(10,("fset_nt_acl_tdb: incoming sd for file %s\n",
705                         fsp->fsp_name));
706                 NDR_PRINT_DEBUG(security_descriptor,
707                         CONST_DISCARD(struct security_descriptor *,psd));
708         }
709
710         status = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
711         if (!NT_STATUS_IS_OK(status)) {
712                 return status;
713         }
714
715         /* Ensure owner and group are set. */
716         if (!psd->owner_sid || !psd->group_sid) {
717                 int ret;
718                 SMB_STRUCT_STAT sbuf;
719                 DOM_SID owner_sid, group_sid;
720                 struct security_descriptor *nc_psd = dup_sec_desc(talloc_tos(), psd);
721
722                 if (!nc_psd) {
723                         return NT_STATUS_OK;
724                 }
725                 if (fsp->is_directory || fsp->fh->fd == -1) {
726                         ret = SMB_VFS_STAT(fsp->conn,fsp->fsp_name, &sbuf);
727                 } else {
728                         ret = SMB_VFS_FSTAT(fsp, &sbuf);
729                 }
730                 if (ret == -1) {
731                         /* Lower level acl set succeeded,
732                          * so still return OK. */
733                         return NT_STATUS_OK;
734                 }
735                 create_file_sids(&sbuf, &owner_sid, &group_sid);
736                 /* This is safe as nc_psd is discarded at fn exit. */
737                 nc_psd->owner_sid = &owner_sid;
738                 nc_psd->group_sid = &group_sid;
739                 security_info_sent |= (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION);
740                 psd = nc_psd;
741         }
742
743 #if 0
744         if ((security_info_sent & DACL_SECURITY_INFORMATION) &&
745                         psd->dacl != NULL &&
746                         (psd->type & (SE_DESC_DACL_AUTO_INHERITED|
747                                 SE_DESC_DACL_AUTO_INHERIT_REQ))==
748                                 (SE_DESC_DACL_AUTO_INHERITED|
749                                 SE_DESC_DACL_AUTO_INHERIT_REQ) ) {
750                 struct security_descriptor *new_psd = NULL;
751                 status = append_parent_acl(fsp, psd, &new_psd);
752                 if (!NT_STATUS_IS_OK(status)) {
753                         /* Lower level acl set succeeded,
754                          * so still return OK. */
755                         return NT_STATUS_OK;
756                 }
757                 psd = new_psd;
758         }
759 #endif
760
761         if (DEBUGLEVEL >= 10) {
762                 DEBUG(10,("fset_nt_acl_tdb: storing tdb sd for file %s\n",
763                         fsp->fsp_name));
764                 NDR_PRINT_DEBUG(security_descriptor,
765                         CONST_DISCARD(struct security_descriptor *,psd));
766         }
767         create_acl_blob(psd, &blob);
768         store_acl_blob_fsp(handle, fsp, &blob);
769
770         return NT_STATUS_OK;
771 }
772
773 /*******************************************************************
774  Handle opening the storage tdb if so configured.
775 *******************************************************************/
776
777 static int connect_acl_tdb(struct vfs_handle_struct *handle,
778                                 const char *service,
779                                 const char *user)
780 {
781         struct db_context *db;
782         int res;
783
784         res = SMB_VFS_NEXT_CONNECT(handle, service, user);
785         if (res < 0) {
786                 return res;
787         }
788
789         if (!acl_tdb_init(&db)) {
790                 SMB_VFS_NEXT_DISCONNECT(handle);
791                 return -1;
792         }
793
794         SMB_VFS_HANDLE_SET_DATA(handle, db, free_acl_tdb_data,
795                                 struct db_context, return -1);
796
797         return 0;
798 }
799
800 /*********************************************************************
801  Remove a Windows ACL - we're setting the underlying POSIX ACL.
802 *********************************************************************/
803
804 static int sys_acl_set_file_tdb(vfs_handle_struct *handle,
805                               const char *path,
806                               SMB_ACL_TYPE_T type,
807                               SMB_ACL_T theacl)
808 {
809         SMB_STRUCT_STAT sbuf;
810         struct db_context *db;
811         int ret;
812
813         SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context, return -1);
814
815         if (SMB_VFS_STAT(handle->conn, path, &sbuf) == -1) {
816                 return -1;
817         }
818
819         ret = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle,
820                                                 path,
821                                                 type,
822                                                 theacl);
823         if (ret == -1) {
824                 return -1;
825         }
826
827         acl_tdb_delete(handle, db, &sbuf);
828         return 0;
829 }
830
831 /*********************************************************************
832  Remove a Windows ACL - we're setting the underlying POSIX ACL.
833 *********************************************************************/
834
835 static int sys_acl_set_fd_tdb(vfs_handle_struct *handle,
836                             files_struct *fsp,
837                             SMB_ACL_T theacl)
838 {
839         SMB_STRUCT_STAT sbuf;
840         struct db_context *db;
841         int ret;
842
843         SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context, return -1);
844
845         if (fsp->is_directory || fsp->fh->fd == -1) {
846                 ret = SMB_VFS_STAT(fsp->conn,fsp->fsp_name, &sbuf);
847         } else {
848                 ret = SMB_VFS_FSTAT(fsp, &sbuf);
849         }
850         if (ret == -1) {
851                 return -1;
852         }
853
854         ret = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle,
855                                                 fsp,
856                                                 theacl);
857         if (ret == -1) {
858                 return -1;
859         }
860
861         acl_tdb_delete(handle, db, &sbuf);
862         return 0;
863 }
864
865 /* VFS operations structure */
866
867 static vfs_op_tuple skel_op_tuples[] =
868 {
869         {SMB_VFS_OP(connect_acl_tdb), SMB_VFS_OP_CONNECT,  SMB_VFS_LAYER_TRANSPARENT},
870
871         {SMB_VFS_OP(mkdir_acl_tdb), SMB_VFS_OP_MKDIR, SMB_VFS_LAYER_TRANSPARENT},
872         {SMB_VFS_OP(rmdir_acl_tdb), SMB_VFS_OP_RMDIR, SMB_VFS_LAYER_TRANSPARENT},
873
874         {SMB_VFS_OP(open_acl_tdb),  SMB_VFS_OP_OPEN,  SMB_VFS_LAYER_TRANSPARENT},
875         {SMB_VFS_OP(unlink_acl_tdb), SMB_VFS_OP_UNLINK, SMB_VFS_LAYER_TRANSPARENT},
876
877         /* NT File ACL operations */
878
879         {SMB_VFS_OP(fget_nt_acl_tdb),SMB_VFS_OP_FGET_NT_ACL,SMB_VFS_LAYER_TRANSPARENT},
880         {SMB_VFS_OP(get_nt_acl_tdb), SMB_VFS_OP_GET_NT_ACL, SMB_VFS_LAYER_TRANSPARENT},
881         {SMB_VFS_OP(fset_nt_acl_tdb),SMB_VFS_OP_FSET_NT_ACL,SMB_VFS_LAYER_TRANSPARENT},
882
883         /* POSIX ACL operations. */
884         {SMB_VFS_OP(sys_acl_set_file_tdb), SMB_VFS_OP_SYS_ACL_SET_FILE, SMB_VFS_LAYER_TRANSPARENT},
885         {SMB_VFS_OP(sys_acl_set_fd_tdb), SMB_VFS_OP_SYS_ACL_SET_FD, SMB_VFS_LAYER_TRANSPARENT},
886
887         {SMB_VFS_OP(NULL), SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP}
888 };
889
890 NTSTATUS vfs_acl_tdb_init(void)
891 {
892         return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "acl_tdb", skel_op_tuples);
893 }