s3: smbd: Reformat users of can_write_to_file().
[samba.git] / source3 / smbd / file_access.c
1 /*
2    Unix SMB/CIFS implementation.
3    Check access to files based on security descriptors.
4    Copyright (C) Jeremy Allison 2005-2006.
5    Copyright (C) Michael Adam 2007.
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 3 of the License, or
10    (at your option) any later version.
11
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16
17    You should have received a copy of the GNU General Public License
18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "system/filesys.h"
23 #include "../libcli/security/security.h"
24 #include "../librpc/gen_ndr/ndr_security.h"
25 #include "smbd/smbd.h"
26
27 #undef  DBGC_CLASS
28 #define DBGC_CLASS DBGC_ACLS
29
30 /****************************************************************************
31  Actually emulate the in-kernel access checking for delete access. We need
32  this to successfully return ACCESS_DENIED on a file open for delete access.
33 ****************************************************************************/
34
35 bool can_delete_file_in_directory(connection_struct *conn,
36                         struct files_struct *dirfsp,
37                         const struct smb_filename *smb_fname)
38 {
39         TALLOC_CTX *ctx = talloc_tos();
40         struct smb_filename *smb_fname_parent = NULL;
41         bool ret;
42
43         SMB_ASSERT(dirfsp == conn->cwd_fsp);
44
45         if (!CAN_WRITE(conn)) {
46                 return False;
47         }
48
49         if (!lp_acl_check_permissions(SNUM(conn))) {
50                 /* This option means don't check. */
51                 return true;
52         }
53
54         /* Get the parent directory permission mask and owners. */
55         ret = parent_smb_fname(ctx, smb_fname, &smb_fname_parent, NULL);
56         if (ret != true) {
57                 return false;
58         }
59
60         if(SMB_VFS_STAT(conn, smb_fname_parent) != 0) {
61                 ret = false;
62                 goto out;
63         }
64
65         /* fast paths first */
66
67         if (!S_ISDIR(smb_fname_parent->st.st_ex_mode)) {
68                 ret = false;
69                 goto out;
70         }
71         if (get_current_uid(conn) == (uid_t)0) {
72                 /* I'm sorry sir, I didn't know you were root... */
73                 ret = true;
74                 goto out;
75         }
76
77 #ifdef S_ISVTX
78         /* sticky bit means delete only by owner of file or by root or
79          * by owner of directory. */
80         if (smb_fname_parent->st.st_ex_mode & S_ISVTX) {
81                 if (!VALID_STAT(smb_fname->st)) {
82                         /* If the file doesn't already exist then
83                          * yes we'll be able to delete it. */
84                         ret = true;
85                         goto out;
86                 }
87
88                 /*
89                  * Patch from SATOH Fumiyasu <fumiyas@miraclelinux.com>
90                  * for bug #3348. Don't assume owning sticky bit
91                  * directory means write access allowed.
92                  * Fail to delete if we're not the owner of the file,
93                  * or the owner of the directory as we have no possible
94                  * chance of deleting. Otherwise, go on and check the ACL.
95                  */
96                 if ((get_current_uid(conn) !=
97                         smb_fname_parent->st.st_ex_uid) &&
98                     (get_current_uid(conn) != smb_fname->st.st_ex_uid)) {
99                         DEBUG(10,("can_delete_file_in_directory: not "
100                                   "owner of file %s or directory %s",
101                                   smb_fname_str_dbg(smb_fname),
102                                   smb_fname_str_dbg(smb_fname_parent)));
103                         ret = false;
104                         goto out;
105                 }
106         }
107 #endif
108
109         /* now for ACL checks */
110
111         /*
112          * There's two ways to get the permission to delete a file: First by
113          * having the DELETE bit on the file itself and second if that does
114          * not help, by the DELETE_CHILD bit on the containing directory.
115          *
116          * Here we only check the directory permissions, we will
117          * check the file DELETE permission separately.
118          */
119
120         ret = NT_STATUS_IS_OK(smbd_check_access_rights(conn,
121                                 smb_fname_parent,
122                                 false,
123                                 FILE_DELETE_CHILD));
124  out:
125         TALLOC_FREE(smb_fname_parent);
126         return ret;
127 }
128
129 /****************************************************************************
130  Userspace check for write access.
131 ****************************************************************************/
132
133 bool can_write_to_file(connection_struct *conn,
134                         const struct smb_filename *smb_fname)
135 {
136         return NT_STATUS_IS_OK(smbd_check_access_rights(conn,
137                                 smb_fname,
138                                 false,
139                                 FILE_WRITE_DATA));
140 }
141
142 /****************************************************************************
143  Check for an existing default Windows ACL on a directory.
144 ****************************************************************************/
145
146 bool directory_has_default_acl(connection_struct *conn,
147                 struct files_struct *dirfsp,
148                 struct smb_filename *smb_fname)
149 {
150         struct security_descriptor *secdesc = NULL;
151         unsigned int i;
152         NTSTATUS status;
153
154         status = SMB_VFS_GET_NT_ACL(conn, smb_fname,
155                                              SECINFO_DACL, talloc_tos(),
156                                              &secdesc);
157
158         if (!NT_STATUS_IS_OK(status) ||
159                         secdesc == NULL ||
160                         secdesc->dacl == NULL) {
161                 TALLOC_FREE(secdesc);
162                 return false;
163         }
164
165         for (i = 0; i < secdesc->dacl->num_aces; i++) {
166                 struct security_ace *psa = &secdesc->dacl->aces[i];
167                 if (psa->flags & (SEC_ACE_FLAG_OBJECT_INHERIT|
168                                 SEC_ACE_FLAG_CONTAINER_INHERIT)) {
169                         TALLOC_FREE(secdesc);
170                         return true;
171                 }
172         }
173         TALLOC_FREE(secdesc);
174         return false;
175 }
176
177 /****************************************************************************
178  Check if setting delete on close is allowed on this fsp.
179 ****************************************************************************/
180
181 NTSTATUS can_set_delete_on_close(files_struct *fsp, uint32_t dosmode)
182 {
183         /*
184          * Only allow delete on close for writable files.
185          */
186
187         if ((dosmode & FILE_ATTRIBUTE_READONLY) &&
188             !lp_delete_readonly(SNUM(fsp->conn))) {
189                 DEBUG(10,("can_set_delete_on_close: file %s delete on close "
190                           "flag set but file attribute is readonly.\n",
191                           fsp_str_dbg(fsp)));
192                 return NT_STATUS_CANNOT_DELETE;
193         }
194
195         /*
196          * Only allow delete on close for writable shares.
197          */
198
199         if (!CAN_WRITE(fsp->conn)) {
200                 DEBUG(10,("can_set_delete_on_close: file %s delete on "
201                           "close flag set but write access denied on share.\n",
202                           fsp_str_dbg(fsp)));
203                 return NT_STATUS_ACCESS_DENIED;
204         }
205
206         /*
207          * Only allow delete on close for files/directories opened with delete
208          * intent.
209          */
210
211         if (!(fsp->access_mask & DELETE_ACCESS)) {
212                 DEBUG(10,("can_set_delete_on_close: file %s delete on "
213                           "close flag set but delete access denied.\n",
214                           fsp_str_dbg(fsp)));
215                 return NT_STATUS_ACCESS_DENIED;
216         }
217
218         /* Don't allow delete on close for non-empty directories. */
219         if (fsp->fsp_flags.is_directory) {
220                 SMB_ASSERT(!is_ntfs_stream_smb_fname(fsp->fsp_name));
221
222                 /* Or the root of a share. */
223                 if (ISDOT(fsp->fsp_name->base_name)) {
224                         DEBUG(10,("can_set_delete_on_close: can't set delete on "
225                                   "close for the root of a share.\n"));
226                         return NT_STATUS_ACCESS_DENIED;
227                 }
228
229                 return can_delete_directory_fsp(fsp);
230         }
231
232         return NT_STATUS_OK;
233 }