source3/smbd/pysmbd.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Set NT and POSIX ACLs and other VFS operations from Python
   4
   5    Copyrigyt (C) Andrew Bartlett 2012
   6    Copyright (C) Jeremy Allison 1994-2009.
   7    Copyright (C) Andreas Gruenbacher 2002.
   8    Copyright (C) Simo Sorce <idra@samba.org> 2009.
   9    Copyright (C) Simo Sorce 2002
  10    Copyright (C) Eric Lorimer 2002
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include <Python.h>
  27 #include "includes.h"
  28 #include "python/py3compat.h"
  29 #include "python/modules.h"
  30 #include "smbd/smbd.h"
  31 #include "libcli/util/pyerrors.h"
  32 #include "librpc/rpc/pyrpc_util.h"
  33 #include <pytalloc.h>
  34 #include "system/filesys.h"
  35 #include "passdb.h"
  36 #include "secrets.h"
  37 #include "auth.h"
  38
  39 extern const struct generic_mapping file_generic_mapping;
  40
  41 #undef  DBGC_CLASS
  42 #define DBGC_CLASS DBGC_ACLS
  43
  44 #ifdef O_DIRECTORY
  45 #define DIRECTORY_FLAGS O_RDONLY|O_DIRECTORY
  46 #else
  47 /* POSIX allows us to open a directory with O_RDONLY. */
  48 #define DIRECTORY_FLAGS O_RDONLY
  49 #endif
  50
  51
  52 static connection_struct *get_conn_tos(
  53         const char *service,
  54         const struct auth_session_info *session_info)
  55 {
  56         struct conn_struct_tos *c = NULL;
  57         int snum = -1;
  58         NTSTATUS status;
  59         char *cwd = NULL;
  60         struct smb_filename cwd_fname = {0};
  61         int ret;
  62
  63         if (!posix_locking_init(false)) {
  64                 PyErr_NoMemory();
  65                 return NULL;
  66         }
  67
  68         if (service) {
  69                 snum = lp_servicenumber(service);
  70                 if (snum == -1) {
  71                         PyErr_SetString(PyExc_RuntimeError, "unknown service");
  72                         return NULL;
  73                 }
  74         }
  75
  76         /*
  77          * Make sure that session unix info is filled,
  78          * which is required by vfs operations.
  79          */
  80         if (session_info->unix_info == NULL) {
  81                 PyErr_SetString(PyExc_RuntimeError,
  82                                 "Session unix info not initialized");
  83                 return NULL;
  84         }
  85         if (session_info->unix_info->unix_name == NULL) {
  86                 PyErr_SetString(PyExc_RuntimeError,
  87                                 "Session unix info not available");
  88                 return NULL;
  89         }
  90
  91         status = create_conn_struct_tos(NULL,
  92                                         snum,
  93                                         "/",
  94                                         session_info,
  95                                         &c);
  96         PyErr_NTSTATUS_IS_ERR_RAISE(status);
  97
  98         /* Ignore read-only and share restrictions */
  99         c->conn->read_only = false;
 100         c->conn->share_access = SEC_RIGHTS_FILE_ALL;
 101
 102         /* Provided by libreplace if not present. Always mallocs. */
 103         cwd = get_current_dir_name();
 104         if (cwd == NULL) {
 105                 PyErr_NoMemory();
 106                 return NULL;
 107         }
 108
 109         cwd_fname.base_name = cwd;
 110         /*
 111          * We need to call vfs_ChDir() to initialize
 112          * conn->cwd_fsp correctly. Change directory
 113          * to current directory (so no change for process).
 114          */
 115         ret = vfs_ChDir(c->conn, &cwd_fname);
 116         if (ret != 0) {
 117                 status = map_nt_error_from_unix(errno);
 118                 SAFE_FREE(cwd);
 119                 PyErr_NTSTATUS_IS_ERR_RAISE(status);
 120         }
 121
 122         SAFE_FREE(cwd);
 123
 124         return c->conn;
 125 }
 126
 127 static int set_sys_acl_conn(const char *fname,
 128                                  SMB_ACL_TYPE_T acltype,
 129                                  SMB_ACL_T theacl, connection_struct *conn)
 130 {
 131         int ret;
 132         struct smb_filename *smb_fname = NULL;
 133         TALLOC_CTX *frame = talloc_stackframe();
 134         NTSTATUS status;
 135
 136         smb_fname = synthetic_smb_fname_split(frame,
 137                                         fname,
 138                                         lp_posix_pathnames());
 139         if (smb_fname == NULL) {
 140                 TALLOC_FREE(frame);
 141                 return -1;
 142         }
 143
 144         ret = vfs_stat(conn, smb_fname);
 145         if (ret == -1) {
 146                 TALLOC_FREE(frame);
 147                 return -1;
 148         }
 149
 150         status = openat_pathref_fsp(conn->cwd_fsp, smb_fname);
 151         if (!NT_STATUS_IS_OK(status)) {
 152                 TALLOC_FREE(frame);
 153                 errno = map_errno_from_nt_status(status);
 154                 return -1;
 155         }
 156
 157         ret = SMB_VFS_SYS_ACL_SET_FD(smb_fname->fsp, acltype, theacl);
 158
 159         TALLOC_FREE(frame);
 160         return ret;
 161 }
 162
 163
 164 static NTSTATUS init_files_struct(TALLOC_CTX *mem_ctx,
 165                                   const char *fname,
 166                                   struct connection_struct *conn,
 167                                   int flags,
 168                                   struct files_struct **_fsp)
 169 {
 170         struct smb_filename *smb_fname = NULL;
 171         int fd;
 172         int ret;
 173         mode_t saved_umask;
 174         struct files_struct *fsp;
 175         struct files_struct *fspcwd = NULL;
 176         NTSTATUS status;
 177
 178         fsp = talloc_zero(mem_ctx, struct files_struct);
 179         if (fsp == NULL) {
 180                 return NT_STATUS_NO_MEMORY;
 181         }
 182         fsp->fh = fd_handle_create(fsp);
 183         if (fsp->fh == NULL) {
 184                 return NT_STATUS_NO_MEMORY;
 185         }
 186         fsp->conn = conn;
 187
 188         smb_fname = synthetic_smb_fname_split(fsp,
 189                                               fname,
 190                                               lp_posix_pathnames());
 191         if (smb_fname == NULL) {
 192                 return NT_STATUS_NO_MEMORY;
 193         }
 194
 195         fsp->fsp_name = smb_fname;
 196
 197         status = vfs_at_fspcwd(fsp, conn, &fspcwd);
 198         if (!NT_STATUS_IS_OK(status)) {
 199                 return status;
 200         }
 201
 202         /*
 203          * we want total control over the permissions on created files,
 204          * so set our umask to 0 (this matters if flags contains O_CREAT)
 205          */
 206         saved_umask = umask(0);
 207
 208         fd = SMB_VFS_OPENAT(conn,
 209                             fspcwd,
 210                             smb_fname,
 211                             fsp,
 212                             flags,
 213                             00644);
 214
 215         umask(saved_umask);
 216
 217         if (fd == -1) {
 218                 int err = errno;
 219                 if (err == ENOENT) {
 220                         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 221                 }
 222                 return NT_STATUS_INVALID_PARAMETER;
 223         }
 224         fsp_set_fd(fsp, fd);
 225
 226         ret = SMB_VFS_FSTAT(fsp, &smb_fname->st);
 227         if (ret == -1) {
 228                 /* If we have an fd, this stat should succeed. */
 229                 DEBUG(0,("Error doing fstat on open file %s (%s)\n",
 230                          smb_fname_str_dbg(smb_fname),
 231                          strerror(errno) ));
 232                 return map_nt_error_from_unix(errno);
 233         }
 234
 235         fsp->file_id = vfs_file_id_from_sbuf(conn, &smb_fname->st);
 236         fsp->vuid = UID_FIELD_INVALID;
 237         fsp->file_pid = 0;
 238         fsp->fsp_flags.can_lock = true;
 239         fsp->fsp_flags.can_read = true;
 240         fsp->fsp_flags.can_write = true;
 241         fsp->print_file = NULL;
 242         fsp->fsp_flags.modified = false;
 243         fsp->sent_oplock_break = NO_BREAK_SENT;
 244         fsp->fsp_flags.is_directory = S_ISDIR(smb_fname->st.st_ex_mode);
 245
 246         *_fsp = fsp;
 247
 248         return NT_STATUS_OK;
 249 }
 250
 251 static NTSTATUS set_nt_acl_conn(const char *fname,
 252                                 uint32_t security_info_sent, const struct security_descriptor *sd,
 253                                 connection_struct *conn)
 254 {
 255         TALLOC_CTX *frame = talloc_stackframe();
 256         struct files_struct *fsp = NULL;
 257         NTSTATUS status = NT_STATUS_OK;
 258
 259         /* first, try to open it as a file with flag O_RDWR */
 260         status = init_files_struct(frame,
 261                                    fname,
 262                                    conn,
 263                                    O_RDWR,
 264                                    &fsp);
 265         if (!NT_STATUS_IS_OK(status) && errno == EISDIR) {
 266                 /* if fail, try to open as dir */
 267                 status = init_files_struct(frame,
 268                                            fname,
 269                                            conn,
 270                                            DIRECTORY_FLAGS,
 271                                            &fsp);
 272         }
 273
 274         if (!NT_STATUS_IS_OK(status)) {
 275                 DBG_ERR("init_files_struct failed: %s\n",
 276                         nt_errstr(status));
 277                 if (fsp != NULL) {
 278                         SMB_VFS_CLOSE(fsp);
 279                 }
 280                 TALLOC_FREE(frame);
 281                 return status;
 282         }
 283
 284         status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, sd);
 285         if (!NT_STATUS_IS_OK(status)) {
 286                 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned %s.\n", nt_errstr(status)));
 287         }
 288
 289         SMB_VFS_CLOSE(fsp);
 290
 291         TALLOC_FREE(frame);
 292         return status;
 293 }
 294
 295 static NTSTATUS get_nt_acl_conn(TALLOC_CTX *mem_ctx,
 296                                 const char *fname,
 297                                 connection_struct *conn,
 298                                 uint32_t security_info_wanted,
 299                                 struct security_descriptor **sd)
 300 {
 301         TALLOC_CTX *frame = talloc_stackframe();
 302         NTSTATUS status;
 303         struct smb_filename *smb_fname = synthetic_smb_fname(talloc_tos(),
 304                                         fname,
 305                                         NULL,
 306                                         NULL,
 307                                         0,
 308                                         lp_posix_pathnames() ?
 309                                                 SMB_FILENAME_POSIX_PATH : 0);
 310
 311         if (smb_fname == NULL) {
 312                 TALLOC_FREE(frame);
 313                 return NT_STATUS_NO_MEMORY;
 314         }
 315
 316         status = SMB_VFS_GET_NT_ACL_AT(conn,
 317                                 conn->cwd_fsp,
 318                                 smb_fname,
 319                                 security_info_wanted,
 320                                 mem_ctx,
 321                                 sd);
 322         if (!NT_STATUS_IS_OK(status)) {
 323                 DBG_ERR("get_nt_acl_at returned %s.\n",
 324                         nt_errstr(status));
 325         }
 326
 327         TALLOC_FREE(frame);
 328
 329         return status;
 330 }
 331
 332 static int set_acl_entry_perms(SMB_ACL_ENTRY_T entry, mode_t perm_mask)
 333 {
 334         SMB_ACL_PERMSET_T perms = NULL;
 335
 336         if (sys_acl_get_permset(entry, &perms) != 0) {
 337                 return -1;
 338         }
 339
 340         if (sys_acl_clear_perms(perms) != 0) {
 341                 return -1;
 342         }
 343
 344         if ((perm_mask & SMB_ACL_READ) != 0 &&
 345             sys_acl_add_perm(perms, SMB_ACL_READ) != 0) {
 346                 return -1;
 347         }
 348
 349         if ((perm_mask & SMB_ACL_WRITE) != 0 &&
 350             sys_acl_add_perm(perms, SMB_ACL_WRITE) != 0) {
 351                 return -1;
 352         }
 353
 354         if ((perm_mask & SMB_ACL_EXECUTE) != 0 &&
 355             sys_acl_add_perm(perms, SMB_ACL_EXECUTE) != 0) {
 356                 return -1;
 357         }
 358
 359         if (sys_acl_set_permset(entry, perms) != 0) {
 360                 return -1;
 361         }
 362
 363         return 0;
 364 }
 365
 366 static SMB_ACL_T make_simple_acl(TALLOC_CTX *mem_ctx,
 367                         gid_t gid,
 368                         mode_t chmod_mode)
 369 {
 370         mode_t mode = SMB_ACL_READ|SMB_ACL_WRITE|SMB_ACL_EXECUTE;
 371
 372         mode_t mode_user = (chmod_mode & 0700) >> 6;
 373         mode_t mode_group = (chmod_mode & 070) >> 3;
 374         mode_t mode_other = chmod_mode &  07;
 375         SMB_ACL_ENTRY_T entry;
 376         SMB_ACL_T acl = sys_acl_init(mem_ctx);
 377
 378         if (!acl) {
 379                 return NULL;
 380         }
 381
 382         if (sys_acl_create_entry(&acl, &entry) != 0) {
 383                 TALLOC_FREE(acl);
 384                 return NULL;
 385         }
 386
 387         if (sys_acl_set_tag_type(entry, SMB_ACL_USER_OBJ) != 0) {
 388                 TALLOC_FREE(acl);
 389                 return NULL;
 390         }
 391
 392         if (set_acl_entry_perms(entry, mode_user) != 0) {
 393                 TALLOC_FREE(acl);
 394                 return NULL;
 395         }
 396
 397         if (sys_acl_create_entry(&acl, &entry) != 0) {
 398                 TALLOC_FREE(acl);
 399                 return NULL;
 400         }
 401
 402         if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP_OBJ) != 0) {
 403                 TALLOC_FREE(acl);
 404                 return NULL;
 405         }
 406
 407         if (set_acl_entry_perms(entry, mode_group) != 0) {
 408                 TALLOC_FREE(acl);
 409                 return NULL;
 410         }
 411
 412         if (sys_acl_create_entry(&acl, &entry) != 0) {
 413                 TALLOC_FREE(acl);
 414                 return NULL;
 415         }
 416
 417         if (sys_acl_set_tag_type(entry, SMB_ACL_OTHER) != 0) {
 418                 TALLOC_FREE(acl);
 419                 return NULL;
 420         }
 421
 422         if (set_acl_entry_perms(entry, mode_other) != 0) {
 423                 TALLOC_FREE(acl);
 424                 return NULL;
 425         }
 426
 427         if (gid != -1) {
 428                 if (sys_acl_create_entry(&acl, &entry) != 0) {
 429                         TALLOC_FREE(acl);
 430                         return NULL;
 431                 }
 432
 433                 if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP) != 0) {
 434                         TALLOC_FREE(acl);
 435                         return NULL;
 436                 }
 437
 438                 if (sys_acl_set_qualifier(entry, &gid) != 0) {
 439                         TALLOC_FREE(acl);
 440                         return NULL;
 441                 }
 442
 443                 if (set_acl_entry_perms(entry, mode_group) != 0) {
 444                         TALLOC_FREE(acl);
 445                         return NULL;
 446                 }
 447         }
 448
 449         if (sys_acl_create_entry(&acl, &entry) != 0) {
 450                 TALLOC_FREE(acl);
 451                 return NULL;
 452         }
 453
 454         if (sys_acl_set_tag_type(entry, SMB_ACL_MASK) != 0) {
 455                 TALLOC_FREE(acl);
 456                 return NULL;
 457         }
 458
 459         if (set_acl_entry_perms(entry, mode) != 0) {
 460                 TALLOC_FREE(acl);
 461                 return NULL;
 462         }
 463
 464         return acl;
 465 }
 466
 467 /*
 468   set a simple ACL on a file, as a test
 469  */
 470 static PyObject *py_smbd_set_simple_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 471 {
 472         const char * const kwnames[] = {
 473                 "fname",
 474                 "mode",
 475                 "session_info",
 476                 "gid",
 477                 "service",
 478                 NULL
 479         };
 480         char *fname, *service = NULL;
 481         PyObject *py_session = Py_None;
 482         struct auth_session_info *session_info = NULL;
 483         int ret;
 484         int mode, gid = -1;
 485         SMB_ACL_T acl;
 486         TALLOC_CTX *frame;
 487         connection_struct *conn;
 488
 489         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "siO|iz",
 490                                          discard_const_p(char *, kwnames),
 491                                          &fname,
 492                                          &mode,
 493                                          &py_session,
 494                                          &gid,
 495                                          &service))
 496                 return NULL;
 497
 498         if (!py_check_dcerpc_type(py_session,
 499                                   "samba.dcerpc.auth",
 500                                   "session_info")) {
 501                 return NULL;
 502         }
 503         session_info = pytalloc_get_type(py_session,
 504                                          struct auth_session_info);
 505         if (session_info == NULL) {
 506                 PyErr_Format(PyExc_TypeError,
 507                              "Expected auth_session_info for session_info argument got %s",
 508                              pytalloc_get_name(py_session));
 509                 return NULL;
 510         }
 511
 512         frame = talloc_stackframe();
 513
 514         acl = make_simple_acl(frame, gid, mode);
 515         if (acl == NULL) {
 516                 TALLOC_FREE(frame);
 517                 return NULL;
 518         }
 519
 520         conn = get_conn_tos(service, session_info);
 521         if (!conn) {
 522                 TALLOC_FREE(frame);
 523                 return NULL;
 524         }
 525
 526         ret = set_sys_acl_conn(fname, SMB_ACL_TYPE_ACCESS, acl, conn);
 527
 528         if (ret != 0) {
 529                 TALLOC_FREE(frame);
 530                 errno = ret;
 531                 return PyErr_SetFromErrno(PyExc_OSError);
 532         }
 533
 534         TALLOC_FREE(frame);
 535
 536         Py_RETURN_NONE;
 537 }
 538
 539 /*
 540   chown a file
 541  */
 542 static PyObject *py_smbd_chown(PyObject *self, PyObject *args, PyObject *kwargs)
 543 {
 544         const char * const kwnames[] = {
 545                 "fname",
 546                 "uid",
 547                 "gid",
 548                 "session_info",
 549                 "service",
 550                 NULL
 551         };
 552         connection_struct *conn;
 553         int ret;
 554         NTSTATUS status;
 555         char *fname, *service = NULL;
 556         PyObject *py_session = Py_None;
 557         struct auth_session_info *session_info = NULL;
 558         int uid, gid;
 559         TALLOC_CTX *frame;
 560         struct files_struct *fsp = NULL;
 561
 562         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "siiO|z",
 563                                          discard_const_p(char *, kwnames),
 564                                          &fname,
 565                                          &uid,
 566                                          &gid,
 567                                          &py_session,
 568                                          &service))
 569                 return NULL;
 570
 571         if (!py_check_dcerpc_type(py_session,
 572                                   "samba.dcerpc.auth",
 573                                   "session_info")) {
 574                 return NULL;
 575         }
 576         session_info = pytalloc_get_type(py_session,
 577                                          struct auth_session_info);
 578         if (session_info == NULL) {
 579                 PyErr_Format(PyExc_TypeError,
 580                              "Expected auth_session_info for session_info argument got %s",
 581                              pytalloc_get_name(py_session));
 582                 return NULL;
 583         }
 584
 585         frame = talloc_stackframe();
 586
 587         conn = get_conn_tos(service, session_info);
 588         if (!conn) {
 589                 TALLOC_FREE(frame);
 590                 return NULL;
 591         }
 592
 593         /* first, try to open it as a file with flag O_RDWR */
 594         status = init_files_struct(frame,
 595                                    fname,
 596                                    conn,
 597                                    O_RDWR,
 598                                    &fsp);
 599         if (!NT_STATUS_IS_OK(status) && errno == EISDIR) {
 600                 /* if fail, try to open as dir */
 601                 status = init_files_struct(frame,
 602                                            fname,
 603                                            conn,
 604                                            DIRECTORY_FLAGS,
 605                                            &fsp);
 606         }
 607
 608         if (!NT_STATUS_IS_OK(status)) {
 609                 DBG_ERR("init_files_struct failed: %s\n",
 610                         nt_errstr(status));
 611                 if (fsp != NULL) {
 612                         SMB_VFS_CLOSE(fsp);
 613                 }
 614                 TALLOC_FREE(frame);
 615                 /*
 616                  * The following macro raises a python
 617                  * error then returns NULL.
 618                  */
 619                 PyErr_NTSTATUS_IS_ERR_RAISE(status);
 620         }
 621
 622         ret = SMB_VFS_FCHOWN(fsp, uid, gid);
 623         if (ret != 0) {
 624                 int saved_errno = errno;
 625                 SMB_VFS_CLOSE(fsp);
 626                 TALLOC_FREE(frame);
 627                 errno = saved_errno;
 628                 return PyErr_SetFromErrno(PyExc_OSError);
 629         }
 630
 631         SMB_VFS_CLOSE(fsp);
 632         TALLOC_FREE(frame);
 633
 634         Py_RETURN_NONE;
 635 }
 636
 637 /*
 638   unlink a file
 639  */
 640 static PyObject *py_smbd_unlink(PyObject *self, PyObject *args, PyObject *kwargs)
 641 {
 642         const char * const kwnames[] = {
 643                 "fname",
 644                 "session_info",
 645                 "service",
 646                 NULL
 647         };
 648         connection_struct *conn;
 649         int ret;
 650         struct smb_filename *smb_fname = NULL;
 651         struct smb_filename *parent_fname = NULL;
 652         struct smb_filename *at_fname = NULL;
 653         PyObject *py_session = Py_None;
 654         struct auth_session_info *session_info = NULL;
 655         char *fname, *service = NULL;
 656         TALLOC_CTX *frame;
 657         NTSTATUS status;
 658
 659         frame = talloc_stackframe();
 660
 661         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "sO|z",
 662                                          discard_const_p(char *, kwnames),
 663                                          &fname,
 664                                          &py_session ,
 665                                          &service)) {
 666                 TALLOC_FREE(frame);
 667                 return NULL;
 668         }
 669
 670         if (!py_check_dcerpc_type(py_session,
 671                                   "samba.dcerpc.auth",
 672                                   "session_info")) {
 673                 TALLOC_FREE(frame);
 674                 return NULL;
 675         }
 676         session_info = pytalloc_get_type(py_session,
 677                                          struct auth_session_info);
 678         if (session_info == NULL) {
 679                 PyErr_Format(PyExc_TypeError,
 680                              "Expected auth_session_info for session_info argument got %s",
 681                              pytalloc_get_name(py_session));
 682                 TALLOC_FREE(frame);
 683                 return NULL;
 684         }
 685
 686         conn = get_conn_tos(service, session_info);
 687         if (!conn) {
 688                 TALLOC_FREE(frame);
 689                 return NULL;
 690         }
 691
 692         smb_fname = synthetic_smb_fname_split(frame,
 693                                         fname,
 694                                         lp_posix_pathnames());
 695         if (smb_fname == NULL) {
 696                 TALLOC_FREE(frame);
 697                 return PyErr_NoMemory();
 698         }
 699
 700         status = parent_pathref(frame,
 701                                 conn->cwd_fsp,
 702                                 smb_fname,
 703                                 &parent_fname,
 704                                 &at_fname);
 705         if (!NT_STATUS_IS_OK(status)) {
 706                 TALLOC_FREE(frame);
 707                 return PyErr_NoMemory();
 708         }
 709
 710         ret = SMB_VFS_UNLINKAT(conn,
 711                         parent_fname->fsp,
 712                         at_fname,
 713                         0);
 714         if (ret != 0) {
 715                 TALLOC_FREE(frame);
 716                 errno = ret;
 717                 return PyErr_SetFromErrno(PyExc_OSError);
 718         }
 719
 720         TALLOC_FREE(frame);
 721
 722         Py_RETURN_NONE;
 723 }
 724
 725 /*
 726   check if we have ACL support
 727  */
 728 static PyObject *py_smbd_have_posix_acls(PyObject *self,
 729                 PyObject *Py_UNUSED(ignored))
 730 {
 731 #ifdef HAVE_POSIX_ACLS
 732         return PyBool_FromLong(true);
 733 #else
 734         return PyBool_FromLong(false);
 735 #endif
 736 }
 737
 738 /*
 739   set the NT ACL on a file
 740  */
 741 static PyObject *py_smbd_set_nt_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 742 {
 743         const char * const kwnames[] = {
 744                 "fname",
 745                 "security_info_sent",
 746                 "sd",
 747                 "session_info",
 748                 "service",
 749                 NULL
 750         };
 751
 752         NTSTATUS status;
 753         char *fname, *service = NULL;
 754         int security_info_sent;
 755         PyObject *py_sd;
 756         struct security_descriptor *sd;
 757         PyObject *py_session = Py_None;
 758         struct auth_session_info *session_info = NULL;
 759         connection_struct *conn;
 760         TALLOC_CTX *frame;
 761
 762         frame = talloc_stackframe();
 763
 764         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "siOO|z",
 765                                          discard_const_p(char *, kwnames),
 766                                          &fname,
 767                                          &security_info_sent,
 768                                          &py_sd,
 769                                          &py_session,
 770                                          &service)) {
 771                 TALLOC_FREE(frame);
 772                 return NULL;
 773         }
 774
 775         if (!py_check_dcerpc_type(py_sd, "samba.dcerpc.security", "descriptor")) {
 776                 TALLOC_FREE(frame);
 777                 return NULL;
 778         }
 779
 780         if (!py_check_dcerpc_type(py_session,
 781                                   "samba.dcerpc.auth",
 782                                   "session_info")) {
 783                 TALLOC_FREE(frame);
 784                 return NULL;
 785         }
 786         session_info = pytalloc_get_type(py_session,
 787                                          struct auth_session_info);
 788         if (session_info == NULL) {
 789                 PyErr_Format(PyExc_TypeError,
 790                              "Expected auth_session_info for session_info argument got %s",
 791                              pytalloc_get_name(py_session));
 792                 return NULL;
 793         }
 794
 795         conn = get_conn_tos(service, session_info);
 796         if (!conn) {
 797                 TALLOC_FREE(frame);
 798                 return NULL;
 799         }
 800
 801         sd = pytalloc_get_type(py_sd, struct security_descriptor);
 802
 803         status = set_nt_acl_conn(fname, security_info_sent, sd, conn);
 804         TALLOC_FREE(frame);
 805         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 806
 807         Py_RETURN_NONE;
 808 }
 809
 810 /*
 811   Return the NT ACL on a file
 812  */
 813 static PyObject *py_smbd_get_nt_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 814 {
 815         const char * const kwnames[] = {
 816                 "fname",
 817                 "security_info_wanted",
 818                 "session_info",
 819                 "service",
 820                 NULL
 821         };
 822         char *fname, *service = NULL;
 823         int security_info_wanted;
 824         PyObject *py_sd;
 825         struct security_descriptor *sd;
 826         TALLOC_CTX *frame = talloc_stackframe();
 827         PyObject *py_session = Py_None;
 828         struct auth_session_info *session_info = NULL;
 829         connection_struct *conn;
 830         NTSTATUS status;
 831         int ret = 1;
 832
 833         ret = PyArg_ParseTupleAndKeywords(args,
 834                                           kwargs,
 835                                           "siO|z",
 836                                           discard_const_p(char *, kwnames),
 837                                           &fname,
 838                                           &security_info_wanted,
 839                                           &py_session,
 840                                           &service);
 841         if (!ret) {
 842                 TALLOC_FREE(frame);
 843                 return NULL;
 844         }
 845
 846         if (!py_check_dcerpc_type(py_session,
 847                                   "samba.dcerpc.auth",
 848                                   "session_info")) {
 849                 TALLOC_FREE(frame);
 850                 return NULL;
 851         }
 852         session_info = pytalloc_get_type(py_session,
 853                                          struct auth_session_info);
 854         if (session_info == NULL) {
 855                 PyErr_Format(
 856                         PyExc_TypeError,
 857                         "Expected auth_session_info for "
 858                         "session_info argument got %s",
 859                         pytalloc_get_name(py_session));
 860                 return NULL;
 861         }
 862
 863         conn = get_conn_tos(service, session_info);
 864         if (!conn) {
 865                 TALLOC_FREE(frame);
 866                 return NULL;
 867         }
 868
 869         status = get_nt_acl_conn(frame, fname, conn, security_info_wanted, &sd);
 870         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 871
 872         py_sd = py_return_ndr_struct("samba.dcerpc.security", "descriptor", sd, sd);
 873
 874         TALLOC_FREE(frame);
 875
 876         return py_sd;
 877 }
 878
 879 /*
 880   set the posix (or similar) ACL on a file
 881  */
 882 static PyObject *py_smbd_set_sys_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 883 {
 884         const char * const kwnames[] = {
 885                 "fname",
 886                 "acl_type",
 887                 "acl",
 888                 "session_info",
 889                 "service",
 890                 NULL
 891         };
 892         TALLOC_CTX *frame = talloc_stackframe();
 893         int ret;
 894         char *fname, *service = NULL;
 895         PyObject *py_acl;
 896         PyObject *py_session = Py_None;
 897         struct auth_session_info *session_info = NULL;
 898         struct smb_acl_t *acl;
 899         int acl_type;
 900         connection_struct *conn;
 901
 902         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "siOO|z",
 903                                          discard_const_p(char *, kwnames),
 904                                          &fname,
 905                                          &acl_type,
 906                                          &py_acl,
 907                                          &py_session,
 908                                          &service)) {
 909                 TALLOC_FREE(frame);
 910                 return NULL;
 911         }
 912
 913         if (!py_check_dcerpc_type(py_acl, "samba.dcerpc.smb_acl", "t")) {
 914                 TALLOC_FREE(frame);
 915                 return NULL;
 916         }
 917
 918         if (!py_check_dcerpc_type(py_session,
 919                                   "samba.dcerpc.auth",
 920                                   "session_info")) {
 921                 TALLOC_FREE(frame);
 922                 return NULL;
 923         }
 924         session_info = pytalloc_get_type(py_session,
 925                                          struct auth_session_info);
 926         if (session_info == NULL) {
 927                 PyErr_Format(PyExc_TypeError,
 928                              "Expected auth_session_info for session_info argument got %s",
 929                              pytalloc_get_name(py_session));
 930                 TALLOC_FREE(frame);
 931                 return NULL;
 932         }
 933
 934         conn = get_conn_tos(service, session_info);
 935         if (!conn) {
 936                 TALLOC_FREE(frame);
 937                 return NULL;
 938         }
 939
 940         acl = pytalloc_get_type(py_acl, struct smb_acl_t);
 941
 942         ret = set_sys_acl_conn(fname, acl_type, acl, conn);
 943         if (ret != 0) {
 944                 TALLOC_FREE(frame);
 945                 errno = ret;
 946                 return PyErr_SetFromErrno(PyExc_OSError);
 947         }
 948
 949         TALLOC_FREE(frame);
 950         Py_RETURN_NONE;
 951 }
 952
 953 /*
 954   Return the posix (or similar) ACL on a file
 955  */
 956 static PyObject *py_smbd_get_sys_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 957 {
 958         const char * const kwnames[] = {
 959                 "fname",
 960                 "acl_type",
 961                 "session_info",
 962                 "service",
 963                 NULL
 964         };
 965         char *fname;
 966         PyObject *py_acl;
 967         PyObject *py_session = Py_None;
 968         struct auth_session_info *session_info = NULL;
 969         struct smb_acl_t *acl;
 970         int acl_type;
 971         TALLOC_CTX *frame = talloc_stackframe();
 972         connection_struct *conn;
 973         char *service = NULL;
 974         struct smb_filename *smb_fname = NULL;
 975
 976         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "siO|z",
 977                                          discard_const_p(char *, kwnames),
 978                                          &fname,
 979                                          &acl_type,
 980                                          &py_session,
 981                                          &service)) {
 982                 TALLOC_FREE(frame);
 983                 return NULL;
 984         }
 985
 986         if (!py_check_dcerpc_type(py_session,
 987                                   "samba.dcerpc.auth",
 988                                   "session_info")) {
 989                 TALLOC_FREE(frame);
 990                 return NULL;
 991         }
 992         session_info = pytalloc_get_type(py_session,
 993                                          struct auth_session_info);
 994         if (session_info == NULL) {
 995                 PyErr_Format(PyExc_TypeError,
 996                              "Expected auth_session_info for session_info argument got %s",
 997                              pytalloc_get_name(py_session));
 998                 TALLOC_FREE(frame);
 999                 return NULL;
1000         }
1001
1002         conn = get_conn_tos(service, session_info);
1003         if (!conn) {
1004                 TALLOC_FREE(frame);
1005                 return NULL;
1006         }
1007
1008         smb_fname = synthetic_smb_fname_split(frame,
1009                                         fname,
1010                                         lp_posix_pathnames());
1011         if (smb_fname == NULL) {
1012                 TALLOC_FREE(frame);
1013                 return NULL;
1014         }
1015         acl = SMB_VFS_SYS_ACL_GET_FILE( conn, smb_fname, acl_type, frame);
1016         if (!acl) {
1017                 TALLOC_FREE(frame);
1018                 return PyErr_SetFromErrno(PyExc_OSError);
1019         }
1020
1021         py_acl = py_return_ndr_struct("samba.dcerpc.smb_acl", "t", acl, acl);
1022
1023         TALLOC_FREE(frame);
1024
1025         return py_acl;
1026 }
1027
1028 static PyObject *py_smbd_mkdir(PyObject *self, PyObject *args, PyObject *kwargs)
1029 {
1030         const char * const kwnames[] = {
1031                 "fname",
1032                 "session_info",
1033                 "service",
1034                 NULL
1035         };
1036         char *fname, *service = NULL;
1037         PyObject *py_session = Py_None;
1038         struct auth_session_info *session_info = NULL;
1039         TALLOC_CTX *frame = talloc_stackframe();
1040         struct connection_struct *conn = NULL;
1041         struct smb_filename *smb_fname = NULL;
1042         struct smb_filename *parent_fname = NULL;
1043         struct smb_filename *base_name = NULL;
1044         NTSTATUS status;
1045         int ret;
1046         mode_t saved_umask;
1047
1048         if (!PyArg_ParseTupleAndKeywords(args,
1049                                          kwargs,
1050                                          "sO|z",
1051                                          discard_const_p(char *,
1052                                                          kwnames),
1053                                          &fname,
1054                                          &py_session,
1055                                          &service)) {
1056                 TALLOC_FREE(frame);
1057                 return NULL;
1058         }
1059
1060         if (!py_check_dcerpc_type(py_session,
1061                                   "samba.dcerpc.auth",
1062                                   "session_info")) {
1063                 TALLOC_FREE(frame);
1064                 return NULL;
1065         }
1066         session_info = pytalloc_get_type(py_session,
1067                                          struct auth_session_info);
1068         if (session_info == NULL) {
1069                 PyErr_Format(PyExc_TypeError,
1070                              "Expected auth_session_info for session_info argument got %s",
1071                              pytalloc_get_name(py_session));
1072                 TALLOC_FREE(frame);
1073                 return NULL;
1074         }
1075
1076         conn = get_conn_tos(service, session_info);
1077         if (!conn) {
1078                 TALLOC_FREE(frame);
1079                 return NULL;
1080         }
1081
1082         smb_fname = synthetic_smb_fname(talloc_tos(),
1083                                         fname,
1084                                         NULL,
1085                                         NULL,
1086                                         0,
1087                                         lp_posix_pathnames() ?
1088                                         SMB_FILENAME_POSIX_PATH : 0);
1089
1090         if (smb_fname == NULL) {
1091                 TALLOC_FREE(frame);
1092                 return NULL;
1093         }
1094
1095         status = parent_pathref(talloc_tos(),
1096                                 conn->cwd_fsp,
1097                                 smb_fname,
1098                                 &parent_fname,
1099                                 &base_name);
1100         if (!NT_STATUS_IS_OK(status)) {
1101                 TALLOC_FREE(frame);
1102                 return NULL;
1103         }
1104
1105         /* we want total control over the permissions on created files,
1106            so set our umask to 0 */
1107         saved_umask = umask(0);
1108
1109         ret = SMB_VFS_MKDIRAT(conn,
1110                         parent_fname->fsp,
1111                         base_name,
1112                         00755);
1113
1114         umask(saved_umask);
1115
1116         if (ret == -1) {
1117                 DBG_ERR("mkdirat error=%d (%s)\n", errno, strerror(errno));
1118                 TALLOC_FREE(frame);
1119                 return NULL;
1120         }
1121
1122         TALLOC_FREE(frame);
1123         Py_RETURN_NONE;
1124 }
1125
1126
1127 /*
1128   Create an empty file
1129  */
1130 static PyObject *py_smbd_create_file(PyObject *self, PyObject *args, PyObject *kwargs)
1131 {
1132         const char * const kwnames[] = {
1133                 "fname",
1134                 "session_info",
1135                 "service",
1136                 NULL
1137         };
1138         char *fname, *service = NULL;
1139         PyObject *py_session = Py_None;
1140         struct auth_session_info *session_info = NULL;
1141         TALLOC_CTX *frame = talloc_stackframe();
1142         struct connection_struct *conn = NULL;
1143         struct files_struct *fsp = NULL;
1144         NTSTATUS status;
1145
1146         if (!PyArg_ParseTupleAndKeywords(args,
1147                                          kwargs,
1148                                          "sO|z",
1149                                          discard_const_p(char *,
1150                                                          kwnames),
1151                                          &fname,
1152                                          &py_session,
1153                                          &service)) {
1154                 TALLOC_FREE(frame);
1155                 return NULL;
1156         }
1157
1158         if (!py_check_dcerpc_type(py_session,
1159                                   "samba.dcerpc.auth",
1160                                   "session_info")) {
1161                 TALLOC_FREE(frame);
1162                 return NULL;
1163         }
1164         session_info = pytalloc_get_type(py_session,
1165                                          struct auth_session_info);
1166         if (session_info == NULL) {
1167                 PyErr_Format(PyExc_TypeError,
1168                              "Expected auth_session_info for session_info argument got %s",
1169                              pytalloc_get_name(py_session));
1170                 TALLOC_FREE(frame);
1171                 return NULL;
1172         }
1173
1174         conn = get_conn_tos(service, session_info);
1175         if (!conn) {
1176                 TALLOC_FREE(frame);
1177                 return NULL;
1178         }
1179
1180         status = init_files_struct(frame,
1181                                    fname,
1182                                    conn,
1183                                    O_CREAT|O_EXCL|O_RDWR,
1184                                    &fsp);
1185         if (!NT_STATUS_IS_OK(status)) {
1186                 DBG_ERR("init_files_struct failed: %s\n",
1187                         nt_errstr(status));
1188         }
1189
1190         TALLOC_FREE(frame);
1191         Py_RETURN_NONE;
1192 }
1193
1194
1195 static PyMethodDef py_smbd_methods[] = {
1196         { "have_posix_acls",
1197                 (PyCFunction)py_smbd_have_posix_acls, METH_NOARGS,
1198                 NULL },
1199         { "set_simple_acl",
1200                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_set_simple_acl),
1201                 METH_VARARGS|METH_KEYWORDS,
1202                 NULL },
1203         { "set_nt_acl",
1204                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_set_nt_acl),
1205                 METH_VARARGS|METH_KEYWORDS,
1206                 NULL },
1207         { "get_nt_acl",
1208                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_get_nt_acl),
1209                 METH_VARARGS|METH_KEYWORDS,
1210                 NULL },
1211         { "get_sys_acl",
1212                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_get_sys_acl),
1213                 METH_VARARGS|METH_KEYWORDS,
1214                 NULL },
1215         { "set_sys_acl",
1216                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_set_sys_acl),
1217                 METH_VARARGS|METH_KEYWORDS,
1218                 NULL },
1219         { "chown",
1220                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_chown),
1221                 METH_VARARGS|METH_KEYWORDS,
1222                 NULL },
1223         { "unlink",
1224                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_unlink),
1225                 METH_VARARGS|METH_KEYWORDS,
1226                 NULL },
1227         { "mkdir",
1228                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_mkdir),
1229                 METH_VARARGS|METH_KEYWORDS,
1230                 NULL },
1231         { "create_file",
1232                 PY_DISCARD_FUNC_SIG(PyCFunction, py_smbd_create_file),
1233                 METH_VARARGS|METH_KEYWORDS,
1234                 NULL },
1235         {0}
1236 };
1237
1238 void initsmbd(void);
1239
1240 static struct PyModuleDef moduledef = {
1241     PyModuleDef_HEAD_INIT,
1242     .m_name = "smbd",
1243     .m_doc = "Python bindings for the smbd file server.",
1244     .m_size = -1,
1245     .m_methods = py_smbd_methods,
1246 };
1247
1248 MODULE_INIT_FUNC(smbd)
1249 {
1250         PyObject *m = NULL;
1251
1252         m = PyModule_Create(&moduledef);
1253         return m;
1254 }