ctdb-daemon: Modernise debug during record deletion for vacuuming
[samba.git] / source3 / modules / vfs_acl_tdb.c
1 /*
2  * Store Windows ACLs in a tdb.
3  *
4  * Copyright (C) Volker Lendecke, 2008
5  * Copyright (C) Jeremy Allison, 2008
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License as published by
9  * the Free Software Foundation; either version 3 of the License, or
10  * (at your option) any later version.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License
18  * along with this program; if not, see <http://www.gnu.org/licenses/>.
19  */
20
21 #include "includes.h"
22 #include "smbd/smbd.h"
23 #include "system/filesys.h"
24 #include "librpc/gen_ndr/xattr.h"
25 #include "dbwrap/dbwrap.h"
26 #include "dbwrap/dbwrap_open.h"
27 #include "auth.h"
28 #include "util_tdb.h"
29 #include "vfs_acl_common.h"
30
31 #undef DBGC_CLASS
32 #define DBGC_CLASS DBGC_VFS
33
34 #define ACL_MODULE_NAME "acl_tdb"
35
36 static unsigned int ref_count;
37 static struct db_context *acl_db;
38
39 /*******************************************************************
40  Open acl_db if not already open, increment ref count.
41 *******************************************************************/
42
43 static bool acl_tdb_init(void)
44 {
45         char *dbname;
46
47         if (acl_db) {
48                 ref_count++;
49                 return true;
50         }
51
52         dbname = state_path(talloc_tos(), "file_ntacls.tdb");
53
54         if (dbname == NULL) {
55                 errno = ENOSYS;
56                 return false;
57         }
58
59         become_root();
60         acl_db = db_open(NULL, dbname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600,
61                          DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
62         unbecome_root();
63
64         if (acl_db == NULL) {
65 #if defined(ENOTSUP)
66                 errno = ENOTSUP;
67 #else
68                 errno = ENOSYS;
69 #endif
70                 TALLOC_FREE(dbname);
71                 return false;
72         }
73
74         ref_count++;
75         TALLOC_FREE(dbname);
76         return true;
77 }
78
79 /*******************************************************************
80  Lower ref count and close acl_db if zero.
81 *******************************************************************/
82
83 static void disconnect_acl_tdb(struct vfs_handle_struct *handle)
84 {
85         SMB_VFS_NEXT_DISCONNECT(handle);
86         ref_count--;
87         if (ref_count == 0) {
88                 TALLOC_FREE(acl_db);
89         }
90 }
91
92 /*******************************************************************
93  Fetch_lock the tdb acl record for a file
94 *******************************************************************/
95
96 static struct db_record *acl_tdb_lock(TALLOC_CTX *mem_ctx,
97                                         struct db_context *db,
98                                         const struct file_id *id)
99 {
100         uint8_t id_buf[16];
101
102         /* For backwards compatibility only store the dev/inode. */
103         push_file_id_16((char *)id_buf, id);
104         return dbwrap_fetch_locked(db,
105                                    mem_ctx,
106                                    make_tdb_data(id_buf,
107                                                  sizeof(id_buf)));
108 }
109
110 /*******************************************************************
111  Delete the tdb acl record for a file
112 *******************************************************************/
113
114 static NTSTATUS acl_tdb_delete(vfs_handle_struct *handle,
115                                 struct db_context *db,
116                                 SMB_STRUCT_STAT *psbuf)
117 {
118         NTSTATUS status;
119         struct file_id id = vfs_file_id_from_sbuf(handle->conn, psbuf);
120         struct db_record *rec = acl_tdb_lock(talloc_tos(), db, &id);
121
122         /*
123          * If rec == NULL there's not much we can do about it
124          */
125
126         if (rec == NULL) {
127                 DEBUG(10,("acl_tdb_delete: rec == NULL\n"));
128                 TALLOC_FREE(rec);
129                 return NT_STATUS_OK;
130         }
131
132         status = dbwrap_record_delete(rec);
133         TALLOC_FREE(rec);
134         return status;
135 }
136
137 /*******************************************************************
138  Pull a security descriptor into a DATA_BLOB from a tdb store.
139 *******************************************************************/
140
141 static NTSTATUS get_acl_blob(TALLOC_CTX *ctx,
142                         vfs_handle_struct *handle,
143                         files_struct *fsp,
144                         const struct smb_filename *smb_fname,
145                         DATA_BLOB *pblob)
146 {
147         uint8_t id_buf[16];
148         TDB_DATA data;
149         struct file_id id;
150         struct db_context *db = acl_db;
151         NTSTATUS status = NT_STATUS_OK;
152         SMB_STRUCT_STAT sbuf;
153
154         ZERO_STRUCT(sbuf);
155
156         if (fsp) {
157                 status = vfs_stat_fsp(fsp);
158                 sbuf = fsp->fsp_name->st;
159         } else {
160                 int ret = vfs_stat_smb_basename(handle->conn,
161                                 smb_fname,
162                                 &sbuf);
163                 if (ret == -1) {
164                         status = map_nt_error_from_unix(errno);
165                 }
166         }
167
168         if (!NT_STATUS_IS_OK(status)) {
169                 return status;
170         }
171
172         id = vfs_file_id_from_sbuf(handle->conn, &sbuf);
173
174         /* For backwards compatibility only store the dev/inode. */
175         push_file_id_16((char *)id_buf, &id);
176
177         status = dbwrap_fetch(db,
178                               ctx,
179                               make_tdb_data(id_buf, sizeof(id_buf)),
180                               &data);
181         if (!NT_STATUS_IS_OK(status)) {
182                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
183         }
184
185         pblob->data = data.dptr;
186         pblob->length = data.dsize;
187
188         DEBUG(10,("get_acl_blob: returned %u bytes from file %s\n",
189                 (unsigned int)data.dsize, smb_fname->base_name ));
190
191         if (pblob->length == 0 || pblob->data == NULL) {
192                 return NT_STATUS_NOT_FOUND;
193         }
194         return NT_STATUS_OK;
195 }
196
197 /*******************************************************************
198  Store a DATA_BLOB into a tdb record given an fsp pointer.
199 *******************************************************************/
200
201 static NTSTATUS store_acl_blob_fsp(vfs_handle_struct *handle,
202                                 files_struct *fsp,
203                                 DATA_BLOB *pblob)
204 {
205         uint8_t id_buf[16];
206         struct file_id id;
207         TDB_DATA data;
208         struct db_context *db = acl_db;
209         struct db_record *rec;
210         NTSTATUS status;
211
212         DEBUG(10,("store_acl_blob_fsp: storing blob length %u on file %s\n",
213                   (unsigned int)pblob->length, fsp_str_dbg(fsp)));
214
215         status = vfs_stat_fsp(fsp);
216         if (!NT_STATUS_IS_OK(status)) {
217                 return status;
218         }
219
220         id = vfs_file_id_from_sbuf(handle->conn, &fsp->fsp_name->st);
221
222         /* For backwards compatibility only store the dev/inode. */
223         push_file_id_16((char *)id_buf, &id);
224         rec = dbwrap_fetch_locked(db, talloc_tos(),
225                                   make_tdb_data(id_buf,
226                                                 sizeof(id_buf)));
227         if (rec == NULL) {
228                 DEBUG(0, ("store_acl_blob_fsp_tdb: fetch_lock failed\n"));
229                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
230         }
231         data.dptr = pblob->data;
232         data.dsize = pblob->length;
233         return dbwrap_record_store(rec, data, 0);
234 }
235
236 /*********************************************************************
237  On unlink we need to delete the tdb record (if using tdb).
238 *********************************************************************/
239
240 static int unlink_acl_tdb(vfs_handle_struct *handle,
241                           const struct smb_filename *smb_fname)
242 {
243         struct smb_filename *smb_fname_tmp = NULL;
244         struct db_context *db = acl_db;
245         int ret = -1;
246
247         smb_fname_tmp = cp_smb_filename_nostream(talloc_tos(), smb_fname);
248         if (smb_fname_tmp == NULL) {
249                 errno = ENOMEM;
250                 goto out;
251         }
252
253         if (smb_fname_tmp->flags & SMB_FILENAME_POSIX_PATH) {
254                 ret = SMB_VFS_LSTAT(handle->conn, smb_fname_tmp);
255         } else {
256                 ret = SMB_VFS_STAT(handle->conn, smb_fname_tmp);
257         }
258
259         if (ret == -1) {
260                 goto out;
261         }
262
263         ret = unlink_acl_common(handle, smb_fname_tmp);
264
265         if (ret == -1) {
266                 goto out;
267         }
268
269         acl_tdb_delete(handle, db, &smb_fname_tmp->st);
270  out:
271         return ret;
272 }
273
274 /*********************************************************************
275  On rmdir we need to delete the tdb record (if using tdb).
276 *********************************************************************/
277
278 static int rmdir_acl_tdb(vfs_handle_struct *handle,
279                 const struct smb_filename *smb_fname)
280 {
281
282         SMB_STRUCT_STAT sbuf;
283         struct db_context *db = acl_db;
284         int ret = -1;
285
286         ret = vfs_stat_smb_basename(handle->conn, smb_fname, &sbuf);
287         if (ret == -1) {
288                 return -1;
289         }
290
291         ret = rmdir_acl_common(handle, smb_fname);
292         if (ret == -1) {
293                 return -1;
294         }
295
296         acl_tdb_delete(handle, db, &sbuf);
297         return 0;
298 }
299
300 /*******************************************************************
301  Handle opening the storage tdb if so configured.
302 *******************************************************************/
303
304 static int connect_acl_tdb(struct vfs_handle_struct *handle,
305                                 const char *service,
306                                 const char *user)
307 {
308         int ret = SMB_VFS_NEXT_CONNECT(handle, service, user);
309         bool ok;
310         struct acl_common_config *config = NULL;
311
312         if (ret < 0) {
313                 return ret;
314         }
315
316         if (!acl_tdb_init()) {
317                 SMB_VFS_NEXT_DISCONNECT(handle);
318                 return -1;
319         }
320
321         ok = init_acl_common_config(handle, ACL_MODULE_NAME);
322         if (!ok) {
323                 DBG_ERR("init_acl_common_config failed\n");
324                 return -1;
325         }
326
327         /* Ensure we have the parameters correct if we're
328          * using this module. */
329         DEBUG(2,("connect_acl_tdb: setting 'inherit acls = true' "
330                 "'dos filemode = true' and "
331                 "'force unknown acl user = true' for service %s\n",
332                 service ));
333
334         lp_do_parameter(SNUM(handle->conn), "inherit acls", "true");
335         lp_do_parameter(SNUM(handle->conn), "dos filemode", "true");
336         lp_do_parameter(SNUM(handle->conn), "force unknown acl user", "true");
337
338         SMB_VFS_HANDLE_GET_DATA(handle, config,
339                                 struct acl_common_config,
340                                 return -1);
341
342         if (config->ignore_system_acls) {
343                 mode_t create_mask = lp_create_mask(SNUM(handle->conn));
344                 char *create_mask_str = NULL;
345
346                 if ((create_mask & 0666) != 0666) {
347                         create_mask |= 0666;
348                         create_mask_str = talloc_asprintf(handle, "0%o",
349                                                           create_mask);
350                         if (create_mask_str == NULL) {
351                                 DBG_ERR("talloc_asprintf failed\n");
352                                 return -1;
353                         }
354
355                         DBG_NOTICE("setting 'create mask = %s'\n", create_mask_str);
356
357                         lp_do_parameter (SNUM(handle->conn),
358                                         "create mask", create_mask_str);
359
360                         TALLOC_FREE(create_mask_str);
361                 }
362
363                 DBG_NOTICE("setting 'directory mask = 0777', "
364                            "'store dos attributes = yes' and all "
365                            "'map ...' options to 'no'\n");
366
367                 lp_do_parameter(SNUM(handle->conn), "directory mask", "0777");
368                 lp_do_parameter(SNUM(handle->conn), "map archive", "no");
369                 lp_do_parameter(SNUM(handle->conn), "map hidden", "no");
370                 lp_do_parameter(SNUM(handle->conn), "map readonly", "no");
371                 lp_do_parameter(SNUM(handle->conn), "map system", "no");
372                 lp_do_parameter(SNUM(handle->conn), "store dos attributes",
373                                 "yes");
374         }
375
376         return 0;
377 }
378
379 /*********************************************************************
380  Remove a Windows ACL - we're setting the underlying POSIX ACL.
381 *********************************************************************/
382
383 static int sys_acl_set_file_tdb(vfs_handle_struct *handle,
384                         const struct smb_filename *smb_fname_in,
385                         SMB_ACL_TYPE_T type,
386                         SMB_ACL_T theacl)
387 {
388         struct db_context *db = acl_db;
389         int ret = -1;
390         int saved_errno = 0;
391         struct smb_filename *smb_fname = NULL;
392
393         smb_fname = cp_smb_filename_nostream(talloc_tos(), smb_fname_in);
394         if (smb_fname == NULL) {
395                 return -1;
396         };
397
398         ret = SMB_VFS_STAT(handle->conn, smb_fname);
399         if (ret == -1) {
400                 saved_errno = errno;
401                 goto fail;
402         }
403
404         ret = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle,
405                                                 smb_fname,
406                                                 type,
407                                                 theacl);
408         if (ret == -1) {
409                 saved_errno = errno;
410                 goto fail;
411         }
412
413         acl_tdb_delete(handle, db, &smb_fname->st);
414
415 fail:
416         TALLOC_FREE(smb_fname);
417
418         if (saved_errno != 0) {
419                 errno = saved_errno;
420         }
421         return ret;
422 }
423
424 /*********************************************************************
425  Remove a Windows ACL - we're setting the underlying POSIX ACL.
426 *********************************************************************/
427
428 static int sys_acl_set_fd_tdb(vfs_handle_struct *handle,
429                             files_struct *fsp,
430                             SMB_ACL_T theacl)
431 {
432         struct db_context *db = acl_db;
433         NTSTATUS status;
434         int ret;
435
436         status = vfs_stat_fsp(fsp);
437         if (!NT_STATUS_IS_OK(status)) {
438                 return -1;
439         }
440
441         ret = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle,
442                                                 fsp,
443                                                 theacl);
444         if (ret == -1) {
445                 return -1;
446         }
447
448         acl_tdb_delete(handle, db, &fsp->fsp_name->st);
449         return 0;
450 }
451
452 static NTSTATUS acl_tdb_fget_nt_acl(vfs_handle_struct *handle,
453                                     files_struct *fsp,
454                                     uint32_t security_info,
455                                     TALLOC_CTX *mem_ctx,
456                                     struct security_descriptor **ppdesc)
457 {
458         NTSTATUS status;
459         status = get_nt_acl_common(get_acl_blob, handle, fsp, NULL,
460                                    security_info, mem_ctx, ppdesc);
461         return status;
462 }
463
464 static NTSTATUS acl_tdb_get_nt_acl(vfs_handle_struct *handle,
465                                    const struct smb_filename *smb_fname,
466                                    uint32_t security_info,
467                                    TALLOC_CTX *mem_ctx,
468                                    struct security_descriptor **ppdesc)
469 {
470         NTSTATUS status;
471         status = get_nt_acl_common(get_acl_blob, handle, NULL, smb_fname,
472                                    security_info, mem_ctx, ppdesc);
473         return status;
474 }
475
476 static NTSTATUS acl_tdb_fset_nt_acl(vfs_handle_struct *handle,
477                                     files_struct *fsp,
478                                     uint32_t security_info_sent,
479                                     const struct security_descriptor *psd)
480 {
481         NTSTATUS status;
482         status = fset_nt_acl_common(get_acl_blob, store_acl_blob_fsp,
483                                     ACL_MODULE_NAME,
484                                     handle, fsp, security_info_sent, psd);
485         return status;
486 }
487
488 static struct vfs_fn_pointers vfs_acl_tdb_fns = {
489         .connect_fn = connect_acl_tdb,
490         .disconnect_fn = disconnect_acl_tdb,
491         .rmdir_fn = rmdir_acl_tdb,
492         .unlink_fn = unlink_acl_tdb,
493         .chmod_fn = chmod_acl_module_common,
494         .fchmod_fn = fchmod_acl_module_common,
495         .fget_nt_acl_fn = acl_tdb_fget_nt_acl,
496         .get_nt_acl_fn = acl_tdb_get_nt_acl,
497         .fset_nt_acl_fn = acl_tdb_fset_nt_acl,
498         .sys_acl_set_file_fn = sys_acl_set_file_tdb,
499         .sys_acl_set_fd_fn = sys_acl_set_fd_tdb
500 };
501
502 static_decl_vfs;
503 NTSTATUS vfs_acl_tdb_init(TALLOC_CTX *ctx)
504 {
505         return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "acl_tdb",
506                                 &vfs_acl_tdb_fns);
507 }