WHATSNEW: document the removal of 'auth methods', 'map untrusted to domain' and ...
[samba.git] / source3 / modules / vfs_acl_tdb.c
index 202c1a8..c5ffa5e 100644 (file)
@@ -1,5 +1,5 @@
 /*
- * Store Windows ACLs in xattrs, or a tdb if configured that way.
+ * Store Windows ACLs in a tdb.
  *
  * Copyright (C) Volker Lendecke, 2008
  * Copyright (C) Jeremy Allison, 2008
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
-/* NOTE: This is an experimental module, not yet finished. JRA. */
-
 #include "includes.h"
+#include "smbd/smbd.h"
+#include "system/filesys.h"
 #include "librpc/gen_ndr/xattr.h"
-#include "librpc/gen_ndr/ndr_xattr.h"
+#include "../lib/crypto/sha256.h"
+#include "dbwrap/dbwrap.h"
+#include "dbwrap/dbwrap_open.h"
+#include "auth.h"
+#include "util_tdb.h"
+#include "vfs_acl_common.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_VFS
 
+#define ACL_MODULE_NAME "acl_tdb"
+
 static unsigned int ref_count;
 static struct db_context *acl_db;
 
@@ -34,17 +41,16 @@ static struct db_context *acl_db;
  Open acl_db if not already open, increment ref count.
 *******************************************************************/
 
-static bool acl_tdb_init(struct db_context **pp_db)
+static bool acl_tdb_init(void)
 {
-       const char *dbname;
+       char *dbname;
 
        if (acl_db) {
-               *pp_db = acl_db;
                ref_count++;
                return true;
        }
 
-       dbname = lock_path("file_ntacls.tdb");
+       dbname = state_path("file_ntacls.tdb");
 
        if (dbname == NULL) {
                errno = ENOSYS;
@@ -52,19 +58,22 @@ static bool acl_tdb_init(struct db_context **pp_db)
        }
 
        become_root();
-       *pp_db = db_open(NULL, dbname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
+       acl_db = db_open(NULL, dbname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600,
+                        DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
        unbecome_root();
 
-       if (*pp_db == NULL) {
+       if (acl_db == NULL) {
 #if defined(ENOTSUP)
                errno = ENOTSUP;
 #else
                errno = ENOSYS;
 #endif
+               TALLOC_FREE(dbname);
                return false;
        }
 
        ref_count++;
+       TALLOC_FREE(dbname);
        return true;
 }
 
@@ -72,14 +81,12 @@ static bool acl_tdb_init(struct db_context **pp_db)
  Lower ref count and close acl_db if zero.
 *******************************************************************/
 
-static void free_acl_xattr_data(void **pptr)
+static void disconnect_acl_tdb(struct vfs_handle_struct *handle)
 {
-       struct db_context **pp_db = (struct db_context **)pptr;
-
+       SMB_VFS_NEXT_DISCONNECT(handle);
        ref_count--;
        if (ref_count == 0) {
-               TALLOC_FREE(*pp_db);
-               acl_db = NULL;
+               TALLOC_FREE(acl_db);
        }
 }
 
@@ -87,58 +94,45 @@ static void free_acl_xattr_data(void **pptr)
  Fetch_lock the tdb acl record for a file
 *******************************************************************/
 
-static struct db_record *acl_xattr_tdb_lock(TALLOC_CTX *mem_ctx,
+static struct db_record *acl_tdb_lock(TALLOC_CTX *mem_ctx,
                                        struct db_context *db,
                                        const struct file_id *id)
 {
-       uint8 id_buf[16];
+       uint8_t id_buf[16];
+
+       /* For backwards compatibility only store the dev/inode. */
        push_file_id_16((char *)id_buf, id);
-       return db->fetch_locked(db,
-                               mem_ctx,
-                               make_tdb_data(id_buf,
-                                       sizeof(id_buf)));
+       return dbwrap_fetch_locked(db,
+                                  mem_ctx,
+                                  make_tdb_data(id_buf,
+                                                sizeof(id_buf)));
 }
 
 /*******************************************************************
- Parse out a struct security_descriptor from a DATA_BLOB.
+ Delete the tdb acl record for a file
 *******************************************************************/
 
-static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
-                               uint32 security_info,
-                               struct security_descriptor **ppdesc)
+static NTSTATUS acl_tdb_delete(vfs_handle_struct *handle,
+                               struct db_context *db,
+                               SMB_STRUCT_STAT *psbuf)
 {
-       TALLOC_CTX *ctx = talloc_tos();
-       struct xattr_NTACL xacl;
-       enum ndr_err_code ndr_err;
-       size_t sd_size;
-
-       ndr_err = ndr_pull_struct_blob(pblob, ctx, NULL, &xacl,
-                       (ndr_pull_flags_fn_t)ndr_pull_xattr_NTACL);
-
-       if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-               DEBUG(5, ("parse_acl_blob: ndr_pull_xattr_NTACL failed: %s\n",
-                       ndr_errstr(ndr_err)));
-               return ndr_map_error2ntstatus(ndr_err);;
-       }
-
-       if (xacl.version != 2) {
-               return NT_STATUS_REVISION_MISMATCH;
-       }
+       NTSTATUS status;
+       struct file_id id = vfs_file_id_from_sbuf(handle->conn, psbuf);
+       struct db_record *rec = acl_tdb_lock(talloc_tos(), db, &id);
 
-       *ppdesc = make_sec_desc(ctx, SEC_DESC_REVISION, xacl.info.sd_ts->sd->type | SEC_DESC_SELF_RELATIVE,
-                       (security_info & OWNER_SECURITY_INFORMATION)
-                       ? xacl.info.sd_ts->sd->owner_sid : NULL,
-                       (security_info & GROUP_SECURITY_INFORMATION)
-                       ? xacl.info.sd_ts->sd->group_sid : NULL,
-                       (security_info & SACL_SECURITY_INFORMATION)
-                       ? xacl.info.sd_ts->sd->sacl : NULL,
-                       (security_info & DACL_SECURITY_INFORMATION)
-                       ? xacl.info.sd_ts->sd->dacl : NULL,
-                       &sd_size);
+       /*
+        * If rec == NULL there's not much we can do about it
+        */
 
-       TALLOC_FREE(xacl.info.sd);
+       if (rec == NULL) {
+               DEBUG(10,("acl_tdb_delete: rec == NULL\n"));
+               TALLOC_FREE(rec);
+               return NT_STATUS_OK;
+       }
 
-       return (*ppdesc != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
+       status = dbwrap_record_delete(rec);
+       TALLOC_FREE(rec);
+       return status;
 }
 
 /*******************************************************************
@@ -148,35 +142,44 @@ static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
 static NTSTATUS get_acl_blob(TALLOC_CTX *ctx,
                        vfs_handle_struct *handle,
                        files_struct *fsp,
-                       const char *name,
+                       const struct smb_filename *smb_fname,
                        DATA_BLOB *pblob)
 {
-       uint8 id_buf[16];
+       uint8_t id_buf[16];
        TDB_DATA data;
        struct file_id id;
-       struct db_context *db;
+       struct db_context *db = acl_db;
+       NTSTATUS status = NT_STATUS_OK;
        SMB_STRUCT_STAT sbuf;
 
-       SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context,
-               return NT_STATUS_INTERNAL_DB_CORRUPTION);
+       ZERO_STRUCT(sbuf);
 
-       if (fsp && fsp->fh->fd != -1) {
-               if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
-                       return map_nt_error_from_unix(errno);
-               }
+       if (fsp) {
+               status = vfs_stat_fsp(fsp);
+               sbuf = fsp->fsp_name->st;
        } else {
-               if (SMB_VFS_STAT(handle->conn, name, &sbuf) == -1) {
-                       return map_nt_error_from_unix(errno);
+               int ret = vfs_stat_smb_basename(handle->conn,
+                               smb_fname,
+                               &sbuf);
+               if (ret == -1) {
+                       status = map_nt_error_from_unix(errno);
                }
        }
+
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
+       }
+
        id = vfs_file_id_from_sbuf(handle->conn, &sbuf);
 
+       /* For backwards compatibility only store the dev/inode. */
        push_file_id_16((char *)id_buf, &id);
 
-       if (db->fetch(db,
-                       ctx,
-                       make_tdb_data(id_buf, sizeof(id_buf)),
-                       &data) == -1) {
+       status = dbwrap_fetch(db,
+                             ctx,
+                             make_tdb_data(id_buf, sizeof(id_buf)),
+                             &data);
+       if (!NT_STATUS_IS_OK(status)) {
                return NT_STATUS_INTERNAL_DB_CORRUPTION;
        }
 
@@ -184,53 +187,11 @@ static NTSTATUS get_acl_blob(TALLOC_CTX *ctx,
        pblob->length = data.dsize;
 
        DEBUG(10,("get_acl_blob: returned %u bytes from file %s\n",
-               (unsigned int)data.dsize, name ));
+               (unsigned int)data.dsize, smb_fname->base_name ));
 
        if (pblob->length == 0 || pblob->data == NULL) {
-               return NT_STATUS_OBJECT_NAME_NOT_FOUND;
-       }
-       return NT_STATUS_OK;
-}
-
-/*******************************************************************
- Create a DATA_BLOB from a security descriptor.
-*******************************************************************/
-
-static NTSTATUS create_acl_blob(const struct security_descriptor *psd, DATA_BLOB *pblob)
-{
-       struct xattr_NTACL xacl;
-       struct security_descriptor_timestamp sd_ts;
-       enum ndr_err_code ndr_err;
-       TALLOC_CTX *ctx = talloc_tos();
-       struct timespec curr = timespec_current();
-
-       ZERO_STRUCT(xacl);
-       ZERO_STRUCT(sd_ts);
-
-       /* Horrid hack as setting an xattr changes the ctime
-        * on Linux. This gives a race of 1 second during
-        * which we would not see a POSIX ACL set.
-        */
-       curr.tv_sec += 1;
-
-       xacl.version = 2;
-       xacl.info.sd_ts = &sd_ts;
-       xacl.info.sd_ts->sd = CONST_DISCARD(struct security_descriptor *, psd);
-       unix_timespec_to_nt_time(&xacl.info.sd_ts->last_changed, curr);
-
-       DEBUG(10, ("create_acl_blob: timestamp stored as %s\n",
-               timestring(ctx, curr.tv_sec) ));
-
-       ndr_err = ndr_push_struct_blob(
-                       pblob, ctx, NULL, &xacl,
-                       (ndr_push_flags_fn_t)ndr_push_xattr_NTACL);
-
-       if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-               DEBUG(5, ("create_acl_blob: ndr_push_xattr_NTACL failed: %s\n",
-                       ndr_errstr(ndr_err)));
-               return ndr_map_error2ntstatus(ndr_err);;
+               return NT_STATUS_NOT_FOUND;
        }
-
        return NT_STATUS_OK;
 }
 
@@ -242,602 +203,308 @@ static NTSTATUS store_acl_blob_fsp(vfs_handle_struct *handle,
                                files_struct *fsp,
                                DATA_BLOB *pblob)
 {
-       uint8 id_buf[16];
+       uint8_t id_buf[16];
        struct file_id id;
-       SMB_STRUCT_STAT sbuf;
        TDB_DATA data;
-       struct db_context *db;
+       struct db_context *db = acl_db;
        struct db_record *rec;
+       NTSTATUS status;
 
        DEBUG(10,("store_acl_blob_fsp: storing blob length %u on file %s\n",
-                       (unsigned int)pblob->length, fsp->fsp_name));
+                 (unsigned int)pblob->length, fsp_str_dbg(fsp)));
 
-       SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context,
-               return NT_STATUS_INTERNAL_DB_CORRUPTION);
-
-       if (fsp->fh->fd != -1) {
-               if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
-                       return map_nt_error_from_unix(errno);
-               }
-       } else {
-               if (SMB_VFS_STAT(handle->conn, fsp->fsp_name, &sbuf) == -1) {
-                       return map_nt_error_from_unix(errno);
-               }
+       status = vfs_stat_fsp(fsp);
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
        }
-       id = vfs_file_id_from_sbuf(handle->conn, &sbuf);
 
+       id = vfs_file_id_from_sbuf(handle->conn, &fsp->fsp_name->st);
+
+       /* For backwards compatibility only store the dev/inode. */
        push_file_id_16((char *)id_buf, &id);
-       rec = db->fetch_locked(db, talloc_tos(),
-                               make_tdb_data(id_buf,
-                                       sizeof(id_buf)));
+       rec = dbwrap_fetch_locked(db, talloc_tos(),
+                                 make_tdb_data(id_buf,
+                                               sizeof(id_buf)));
        if (rec == NULL) {
                DEBUG(0, ("store_acl_blob_fsp_tdb: fetch_lock failed\n"));
                return NT_STATUS_INTERNAL_DB_CORRUPTION;
        }
        data.dptr = pblob->data;
        data.dsize = pblob->length;
-       return rec->store(rec, data, 0);
+       return dbwrap_record_store(rec, data, 0);
 }
 
-/*******************************************************************
Store a DATA_BLOB into a tdb record given a pathname.
-*******************************************************************/
+/*********************************************************************
On unlink we need to delete the tdb record (if using tdb).
+*********************************************************************/
 
-static NTSTATUS store_acl_blob_pathname(vfs_handle_struct *handle,
-                                       const char *fname,
-                                       DATA_BLOB *pblob)
+static int unlink_acl_tdb(vfs_handle_struct *handle,
+                         const struct smb_filename *smb_fname)
 {
-       uint8 id_buf[16];
-       struct file_id id;
-       TDB_DATA data;
-       SMB_STRUCT_STAT sbuf;
-       struct db_context *db;
-       struct db_record *rec;
-
-       DEBUG(10,("store_acl_blob_pathname: storing blob "
-                       "length %u on file %s\n",
-                       (unsigned int)pblob->length, fname));
+       struct smb_filename *smb_fname_tmp = NULL;
+       struct db_context *db = acl_db;
+       int ret = -1;
 
-       SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context,
-               return NT_STATUS_INTERNAL_DB_CORRUPTION);
-
-       if (SMB_VFS_STAT(handle->conn, fname, &sbuf) == -1) {
-               return map_nt_error_from_unix(errno);
+       smb_fname_tmp = cp_smb_filename_nostream(talloc_tos(), smb_fname);
+       if (smb_fname_tmp == NULL) {
+               errno = ENOMEM;
+               goto out;
        }
 
-       id = vfs_file_id_from_sbuf(handle->conn, &sbuf);
-       push_file_id_16((char *)id_buf, &id);
-
-       rec = db->fetch_locked(db, talloc_tos(),
-                               make_tdb_data(id_buf,
-                                       sizeof(id_buf)));
-       if (rec == NULL) {
-               DEBUG(0, ("store_acl_blob_pathname_tdb: fetch_lock failed\n"));
-               return NT_STATUS_INTERNAL_DB_CORRUPTION;
+       if (smb_fname_tmp->flags & SMB_FILENAME_POSIX_PATH) {
+               ret = SMB_VFS_LSTAT(handle->conn, smb_fname_tmp);
+       } else {
+               ret = SMB_VFS_STAT(handle->conn, smb_fname_tmp);
        }
-       data.dptr = pblob->data;
-       data.dsize = pblob->length;
-       return rec->store(rec, data, 0);
-}
-
-/*******************************************************************
- Store a DATA_BLOB into an xattr given a pathname.
-*******************************************************************/
-
-static NTSTATUS get_nt_acl_xattr_internal(vfs_handle_struct *handle,
-                                       files_struct *fsp,
-                                       const char *name,
-                                       uint32 security_info,
-                                       struct security_descriptor **ppdesc)
-{
-       TALLOC_CTX *ctx = talloc_tos();
-       DATA_BLOB blob;
-       NTSTATUS status;
 
-       if (fsp && name == NULL) {
-               name = fsp->fsp_name;
+       if (ret == -1) {
+               goto out;
        }
 
-       DEBUG(10, ("get_nt_acl_xattr_internal: name=%s\n", name));
-
-       status = get_acl_blob(ctx, handle, fsp, name, &blob);
-       if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(10, ("get_acl_blob returned %s\n", nt_errstr(status)));
-               return status;
-       }
+       ret = unlink_acl_common(handle, smb_fname_tmp);
 
-       status = parse_acl_blob(&blob, security_info, ppdesc);
-       if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(10, ("parse_acl_blob returned %s\n",
-                               nt_errstr(status)));
-               return status;
+       if (ret == -1) {
+               goto out;
        }
 
-       TALLOC_FREE(blob.data);
-       return status;
+       acl_tdb_delete(handle, db, &smb_fname_tmp->st);
+ out:
+       return ret;
 }
 
 /*********************************************************************
- Create a default security descriptor for a file in case no inheritance
- exists. All permissions to the owner and SYSTEM.
+ On rmdir we need to delete the tdb record (if using tdb).
 *********************************************************************/
 
-static struct security_descriptor *default_file_sd(TALLOC_CTX *mem_ctx,
-                                               SMB_STRUCT_STAT *psbuf)
+static int rmdir_acl_tdb(vfs_handle_struct *handle,
+               const struct smb_filename *smb_fname)
 {
-       struct dom_sid owner_sid, group_sid;
-       size_t sd_size;
-       struct security_ace *pace = NULL;
-       struct security_acl *pacl = NULL;
 
-       uid_to_sid(&owner_sid, psbuf->st_uid);
-       gid_to_sid(&group_sid, psbuf->st_gid);
+       SMB_STRUCT_STAT sbuf;
+       struct db_context *db = acl_db;
+       int ret = -1;
 
-       pace = TALLOC_ARRAY(mem_ctx, struct security_ace, 2);
-       if (!pace) {
-               return NULL;
+       ret = vfs_stat_smb_basename(handle->conn, smb_fname, &sbuf);
+       if (ret == -1) {
+               return -1;
        }
 
-       init_sec_ace(&pace[0], &owner_sid, SEC_ACE_TYPE_ACCESS_ALLOWED,
-                       SEC_RIGHTS_FILE_ALL, 0);
-       init_sec_ace(&pace[1], &global_sid_System, SEC_ACE_TYPE_ACCESS_ALLOWED,
-                       SEC_RIGHTS_FILE_ALL, 0);
-
-       pacl = make_sec_acl(mem_ctx,
-                               NT4_ACL_REVISION,
-                               2,
-                               pace);
-       if (!pacl) {
-               return NULL;
+       ret = rmdir_acl_common(handle, smb_fname);
+       if (ret == -1) {
+               return -1;
        }
-       return make_sec_desc(mem_ctx,
-                       SECURITY_DESCRIPTOR_REVISION_1,
-                       SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT,
-                       &owner_sid,
-                       &group_sid,
-                       NULL,
-                        pacl,
-                       &sd_size);
+
+       acl_tdb_delete(handle, db, &sbuf);
+       return 0;
 }
 
-/*********************************************************************
-*********************************************************************/
+/*******************************************************************
+ Handle opening the storage tdb if so configured.
+*******************************************************************/
 
-static NTSTATUS inherit_new_acl(vfs_handle_struct *handle,
-                                       const char *fname,
-                                       files_struct *fsp,
-                                       bool container)
+static int connect_acl_tdb(struct vfs_handle_struct *handle,
+                               const char *service,
+                               const char *user)
 {
-       TALLOC_CTX *ctx = talloc_tos();
-       NTSTATUS status;
-       struct security_descriptor *parent_desc = NULL;
-       struct security_descriptor *psd = NULL;
-       DATA_BLOB blob;
-       size_t size;
-       char *parent_name;
-
-       if (!parent_dirname_talloc(ctx,
-                               fname,
-                               &parent_name,
-                               NULL)) {
-               return NT_STATUS_NO_MEMORY;
+       int ret = SMB_VFS_NEXT_CONNECT(handle, service, user);
+       bool ok;
+       struct acl_common_config *config = NULL;
+
+       if (ret < 0) {
+               return ret;
        }
 
-       DEBUG(10,("inherit_new_acl: check directory %s\n",
-                       parent_name));
-
-       status = get_nt_acl_xattr_internal(handle,
-                                       NULL,
-                                       parent_name,
-                                       (OWNER_SECURITY_INFORMATION |
-                                        GROUP_SECURITY_INFORMATION |
-                                        DACL_SECURITY_INFORMATION),
-                                       &parent_desc);
-        if (NT_STATUS_IS_OK(status)) {
-               /* Create an inherited descriptor from the parent. */
-
-               if (DEBUGLEVEL >= 10) {
-                       DEBUG(10,("inherit_new_acl: parent acl is:\n"));
-                       NDR_PRINT_DEBUG(security_descriptor, parent_desc);
-               }
+       if (!acl_tdb_init()) {
+               SMB_VFS_NEXT_DISCONNECT(handle);
+               return -1;
+       }
 
-               status = se_create_child_secdesc(ctx,
-                               &psd,
-                               &size,
-                               parent_desc,
-                               &handle->conn->server_info->ptok->user_sids[PRIMARY_USER_SID_INDEX],
-                               &handle->conn->server_info->ptok->user_sids[PRIMARY_GROUP_SID_INDEX],
-                               container);
-               if (!NT_STATUS_IS_OK(status)) {
-                       return status;
-               }
+       ok = init_acl_common_config(handle, ACL_MODULE_NAME);
+       if (!ok) {
+               DBG_ERR("init_acl_common_config failed\n");
+               return -1;
+       }
 
-               if (DEBUGLEVEL >= 10) {
-                       DEBUG(10,("inherit_new_acl: child acl is:\n"));
-                       NDR_PRINT_DEBUG(security_descriptor, psd);
-               }
+       /* Ensure we have the parameters correct if we're
+        * using this module. */
+       DEBUG(2,("connect_acl_tdb: setting 'inherit acls = true' "
+               "'dos filemode = true' and "
+               "'force unknown acl user = true' for service %s\n",
+               service ));
 
-       } else {
-               DEBUG(10,("inherit_new_acl: directory %s failed "
-                       "to get acl %s\n",
-                       parent_name,
-                       nt_errstr(status) ));
-       }
+       lp_do_parameter(SNUM(handle->conn), "inherit acls", "true");
+       lp_do_parameter(SNUM(handle->conn), "dos filemode", "true");
+       lp_do_parameter(SNUM(handle->conn), "force unknown acl user", "true");
 
-       if (!psd || psd->dacl == NULL) {
-               SMB_STRUCT_STAT sbuf;
-               int ret;
+       SMB_VFS_HANDLE_GET_DATA(handle, config,
+                               struct acl_common_config,
+                               return -1);
 
-               TALLOC_FREE(psd);
-               if (fsp && !fsp->is_directory && fsp->fh->fd != -1) {
-                       ret = SMB_VFS_FSTAT(fsp, &sbuf);
-               } else {
-                       ret = SMB_VFS_STAT(handle->conn,fname, &sbuf);
-               }
-               if (ret == -1) {
-                       return map_nt_error_from_unix(errno);
-               }
-               psd = default_file_sd(ctx, &sbuf);
-               if (!psd) {
-                       return NT_STATUS_NO_MEMORY;
-               }
+       if (config->ignore_system_acls) {
+               mode_t create_mask = lp_create_mask(SNUM(handle->conn));
+               char *create_mask_str = NULL;
 
-               if (DEBUGLEVEL >= 10) {
-                       DEBUG(10,("inherit_new_acl: default acl is:\n"));
-                       NDR_PRINT_DEBUG(security_descriptor, psd);
-               }
-       }
+               if ((create_mask & 0666) != 0666) {
+                       create_mask |= 0666;
+                       create_mask_str = talloc_asprintf(handle, "0%o",
+                                                         create_mask);
+                       if (create_mask_str == NULL) {
+                               DBG_ERR("talloc_asprintf failed\n");
+                               return -1;
+                       }
 
-       status = create_acl_blob(psd, &blob);
-       if (!NT_STATUS_IS_OK(status)) {
-               return status;
-       }
-       if (fsp) {
-               return store_acl_blob_fsp(handle, fsp, &blob);
-       } else {
-               return store_acl_blob_pathname(handle, fname, &blob);
-       }
-}
+                       DBG_NOTICE("setting 'create mask = %s'\n", create_mask_str);
 
-/*********************************************************************
- Check ACL on open. For new files inherit from parent directory.
-*********************************************************************/
+                       lp_do_parameter (SNUM(handle->conn),
+                                       "create mask", create_mask_str);
 
-static int open_acl_xattr(vfs_handle_struct *handle,
-                                       const char *fname,
-                                       files_struct *fsp,
-                                       int flags,
-                                       mode_t mode)
-{
-       uint32_t access_granted = 0;
-       struct security_descriptor *pdesc = NULL;
-       bool file_existed = true;
-       NTSTATUS status = get_nt_acl_xattr_internal(handle,
-                                       NULL,
-                                       fname,
-                                       (OWNER_SECURITY_INFORMATION |
-                                        GROUP_SECURITY_INFORMATION |
-                                        DACL_SECURITY_INFORMATION),
-                                       &pdesc);
-        if (NT_STATUS_IS_OK(status)) {
-               /* See if we can access it. */
-               status = smb1_file_se_access_check(pdesc,
-                                       handle->conn->server_info->ptok,
-                                       fsp->access_mask,
-                                       &access_granted);
-               if (!NT_STATUS_IS_OK(status)) {
-                       DEBUG(10,("open_acl_xattr: file %s open "
-                               "refused with error %s\n",
-                               fname,
-                               nt_errstr(status) ));
-                       errno = map_errno_from_nt_status(status);
-                       return -1;
+                       TALLOC_FREE(create_mask_str);
                }
-        } else if (NT_STATUS_EQUAL(status,NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
-               file_existed = false;
-       }
-
-       DEBUG(10,("open_acl_xattr: get_nt_acl_attr_internal for "
-               "file %s returned %s\n",
-               fname,
-               nt_errstr(status) ));
 
-       fsp->fh->fd = SMB_VFS_NEXT_OPEN(handle, fname, fsp, flags, mode);
+               DBG_NOTICE("setting 'directory mask = 0777', "
+                          "'store dos attributes = yes' and all "
+                          "'map ...' options to 'no'\n");
 
-       if (!file_existed && fsp->fh->fd != -1) {
-               /* File was created. Inherit from parent directory. */
-               string_set(&fsp->fsp_name, fname);
-               inherit_new_acl(handle, fname, fsp, false);
+               lp_do_parameter(SNUM(handle->conn), "directory mask", "0777");
+               lp_do_parameter(SNUM(handle->conn), "map archive", "no");
+               lp_do_parameter(SNUM(handle->conn), "map hidden", "no");
+               lp_do_parameter(SNUM(handle->conn), "map readonly", "no");
+               lp_do_parameter(SNUM(handle->conn), "map system", "no");
+               lp_do_parameter(SNUM(handle->conn), "store dos attributes",
+                               "yes");
        }
 
-       return fsp->fh->fd;
+       return 0;
 }
 
 /*********************************************************************
On unlink we need to delete the tdb record (if using tdb).
Remove a Windows ACL - we're setting the underlying POSIX ACL.
 *********************************************************************/
 
-static int unlink_acl_xattr(vfs_handle_struct *handle, const char *path)
+static int sys_acl_set_file_tdb(vfs_handle_struct *handle,
+                       const struct smb_filename *smb_fname_in,
+                       SMB_ACL_TYPE_T type,
+                       SMB_ACL_T theacl)
 {
-       SMB_STRUCT_STAT sbuf;
-       struct file_id id;
-       struct db_context *db;
-       struct db_record *rec;
-       int ret;
+       struct db_context *db = acl_db;
+       int ret = -1;
+       int saved_errno = 0;
+       struct smb_filename *smb_fname = NULL;
 
-       SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context, return -1);
-
-       if (SMB_VFS_STAT(handle->conn, path, &sbuf) == -1) {
+       smb_fname = cp_smb_filename_nostream(talloc_tos(), smb_fname_in);
+       if (smb_fname == NULL) {
                return -1;
-       }
-
-       ret = SMB_VFS_NEXT_UNLINK(handle, path);
+       };
 
+       ret = SMB_VFS_STAT(handle->conn, smb_fname);
        if (ret == -1) {
-               return -1;
+               saved_errno = errno;
+               goto fail;
        }
 
-       id = vfs_file_id_from_sbuf(handle->conn, &sbuf);
-
-       rec = acl_xattr_tdb_lock(talloc_tos(), db, &id);
-
-       /*
-        * If rec == NULL there's not much we can do about it
-        */
-
-       if (rec == NULL) {
-               DEBUG(10,("unlink_acl_xattr: path %s rec == NULL\n",
-                       path ));
-               TALLOC_FREE(rec);
-               return 0;
+       ret = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle,
+                                               smb_fname,
+                                               type,
+                                               theacl);
+       if (ret == -1) {
+               saved_errno = errno;
+               goto fail;
        }
 
-       rec->delete_rec(rec);
-       TALLOC_FREE(rec);
-
-       return 0;
-}
-
-/*********************************************************************
- Store an inherited SD on mkdir.
-*********************************************************************/
+       acl_tdb_delete(handle, db, &smb_fname->st);
 
-static int mkdir_acl_xattr(vfs_handle_struct *handle, const char *path, mode_t mode)
-{
-       int ret = SMB_VFS_NEXT_MKDIR(handle, path, mode);
+fail:
+       TALLOC_FREE(smb_fname);
 
-       if (ret == -1) {
-               return ret;
+       if (saved_errno != 0) {
+               errno = saved_errno;
        }
-       /* New directory - inherit from parent. */
-       inherit_new_acl(handle, path, NULL, true);
        return ret;
 }
 
 /*********************************************************************
On rmdir we need to delete the tdb record (if using tdb).
Remove a Windows ACL - we're setting the underlying POSIX ACL.
 *********************************************************************/
 
-static int rmdir_acl_xattr(vfs_handle_struct *handle, const char *path)
+static int sys_acl_set_fd_tdb(vfs_handle_struct *handle,
+                            files_struct *fsp,
+                            SMB_ACL_T theacl)
 {
-       SMB_STRUCT_STAT sbuf;
-       struct file_id id;
-       struct db_context *db;
-       struct db_record *rec;
+       struct db_context *db = acl_db;
+       NTSTATUS status;
        int ret;
 
-       SMB_VFS_HANDLE_GET_DATA(handle, db, struct db_context, return -1);
-
-       if (SMB_VFS_STAT(handle->conn, path, &sbuf) == -1) {
+       status = vfs_stat_fsp(fsp);
+       if (!NT_STATUS_IS_OK(status)) {
                return -1;
        }
 
-       ret = SMB_VFS_NEXT_RMDIR(handle, path);
-
+       ret = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle,
+                                               fsp,
+                                               theacl);
        if (ret == -1) {
                return -1;
        }
 
-       id = vfs_file_id_from_sbuf(handle->conn, &sbuf);
-
-       rec = acl_xattr_tdb_lock(talloc_tos(), db, &id);
-
-       /*
-        * If rec == NULL there's not much we can do about it
-        */
-
-       if (rec == NULL) {
-               DEBUG(10,("rmdir_acl_xattr: path %s rec == NULL\n",
-                       path ));
-               TALLOC_FREE(rec);
-               return 0;
-       }
-
-       rec->delete_rec(rec);
-       TALLOC_FREE(rec);
-
+       acl_tdb_delete(handle, db, &fsp->fsp_name->st);
        return 0;
 }
 
-/*********************************************************************
- Fetch a security descriptor given an fsp.
-*********************************************************************/
-
-static NTSTATUS fget_nt_acl_xattr(vfs_handle_struct *handle, files_struct *fsp,
-        uint32 security_info, struct security_descriptor **ppdesc)
+static NTSTATUS acl_tdb_fget_nt_acl(vfs_handle_struct *handle,
+                                   files_struct *fsp,
+                                   uint32_t security_info,
+                                   TALLOC_CTX *mem_ctx,
+                                   struct security_descriptor **ppdesc)
 {
-       NTSTATUS status = get_nt_acl_xattr_internal(handle, fsp,
-                               NULL, security_info, ppdesc);
-       if (NT_STATUS_IS_OK(status)) {
-               if (DEBUGLEVEL >= 10) {
-                       DEBUG(10,("fget_nt_acl_xattr: returning xattr sd for file %s\n",
-                               fsp->fsp_name));
-                       NDR_PRINT_DEBUG(security_descriptor, *ppdesc);
-               }
-               return NT_STATUS_OK;
-       }
-
-       DEBUG(10,("fget_nt_acl_xattr: failed to get xattr sd for file %s, Error %s\n",
-                       fsp->fsp_name,
-                       nt_errstr(status) ));
-
-       return SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp,
-                       security_info, ppdesc);
+       NTSTATUS status;
+       status = get_nt_acl_common(get_acl_blob, handle, fsp, NULL,
+                                  security_info, mem_ctx, ppdesc);
+       return status;
 }
 
-/*********************************************************************
- Fetch a security descriptor given a pathname.
-*********************************************************************/
-
-static NTSTATUS get_nt_acl_xattr(vfs_handle_struct *handle,
-        const char *name, uint32 security_info, struct security_descriptor **ppdesc)
-{
-       NTSTATUS status = get_nt_acl_xattr_internal(handle, NULL,
-                               name, security_info, ppdesc);
-       if (NT_STATUS_IS_OK(status)) {
-               if (DEBUGLEVEL >= 10) {
-                       DEBUG(10,("get_nt_acl_xattr: returning xattr sd for file %s\n",
-                               name));
-                       NDR_PRINT_DEBUG(security_descriptor, *ppdesc);
-               }
-               return NT_STATUS_OK;
-       }
-
-       DEBUG(10,("get_nt_acl_xattr: failed to get xattr sd for file %s, Error %s\n",
-                       name,
-                       nt_errstr(status) ));
-
-       return SMB_VFS_NEXT_GET_NT_ACL(handle, name,
-                       security_info, ppdesc);
-}
-
-/*********************************************************************
- Store a security descriptor given an fsp.
-*********************************************************************/
-
-static NTSTATUS fset_nt_acl_xattr(vfs_handle_struct *handle, files_struct *fsp,
-        uint32 security_info_sent, const struct security_descriptor *psd)
+static NTSTATUS acl_tdb_get_nt_acl(vfs_handle_struct *handle,
+                                  const struct smb_filename *smb_fname,
+                                  uint32_t security_info,
+                                  TALLOC_CTX *mem_ctx,
+                                  struct security_descriptor **ppdesc)
 {
        NTSTATUS status;
-       DATA_BLOB blob;
-
-       if (DEBUGLEVEL >= 10) {
-               DEBUG(10,("fset_nt_acl_xattr: incoming sd for file %s\n",
-                       fsp->fsp_name));
-               NDR_PRINT_DEBUG(security_descriptor,
-                       CONST_DISCARD(struct security_descriptor *,psd));
-       }
-
-       status = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
-       if (!NT_STATUS_IS_OK(status)) {
-               return status;
-       }
-
-       /* Ensure owner and group are set. */
-       if (!psd->owner_sid || !psd->group_sid) {
-               int ret;
-               SMB_STRUCT_STAT sbuf;
-               DOM_SID owner_sid, group_sid;
-               struct security_descriptor *nc_psd = dup_sec_desc(talloc_tos(), psd);
-
-               if (!nc_psd) {
-                       return NT_STATUS_OK;
-               }
-               if (fsp->is_directory || fsp->fh->fd == -1) {
-                       ret = SMB_VFS_STAT(fsp->conn,fsp->fsp_name, &sbuf);
-               } else {
-                       ret = SMB_VFS_FSTAT(fsp, &sbuf);
-               }
-               if (ret == -1) {
-                       /* Lower level acl set succeeded,
-                        * so still return OK. */
-                       return NT_STATUS_OK;
-               }
-               create_file_sids(&sbuf, &owner_sid, &group_sid);
-               /* This is safe as nc_psd is discarded at fn exit. */
-               nc_psd->owner_sid = &owner_sid;
-               nc_psd->group_sid = &group_sid;
-               security_info_sent |= (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION);
-               psd = nc_psd;
-       }
-
-       if ((security_info_sent & DACL_SECURITY_INFORMATION) &&
-                       psd->dacl != NULL &&
-                       (psd->type & (SE_DESC_DACL_AUTO_INHERITED|
-                               SE_DESC_DACL_AUTO_INHERIT_REQ))==
-                               (SE_DESC_DACL_AUTO_INHERITED|
-                               SE_DESC_DACL_AUTO_INHERIT_REQ) ) {
-               struct security_descriptor *new_psd = NULL;
-               status = append_parent_acl(fsp, psd, &new_psd);
-               if (!NT_STATUS_IS_OK(status)) {
-                       /* Lower level acl set succeeded,
-                        * so still return OK. */
-                       return NT_STATUS_OK;
-               }
-               psd = new_psd;
-       }
-
-       if (DEBUGLEVEL >= 10) {
-               DEBUG(10,("fset_nt_acl_xattr: storing xattr sd for file %s\n",
-                       fsp->fsp_name));
-               NDR_PRINT_DEBUG(security_descriptor,
-                       CONST_DISCARD(struct security_descriptor *,psd));
-       }
-       create_acl_blob(psd, &blob);
-       store_acl_blob_fsp(handle, fsp, &blob);
-
-       return NT_STATUS_OK;
+       status = get_nt_acl_common(get_acl_blob, handle, NULL, smb_fname,
+                                  security_info, mem_ctx, ppdesc);
+       return status;
 }
 
-/*******************************************************************
- Handle opening the storage tdb if so configured.
-*******************************************************************/
-
-static int connect_acl_xattr(struct vfs_handle_struct *handle,
-                               const char *service,
-                               const char *user)
+static NTSTATUS acl_tdb_fset_nt_acl(vfs_handle_struct *handle,
+                                   files_struct *fsp,
+                                   uint32_t security_info_sent,
+                                   const struct security_descriptor *psd)
 {
-       struct db_context *db;
-       int res;
-
-        res = SMB_VFS_NEXT_CONNECT(handle, service, user);
-        if (res < 0) {
-                return res;
-        }
-
-       if (!acl_tdb_init(&db)) {
-               SMB_VFS_NEXT_DISCONNECT(handle);
-               return -1;
-       }
-
-       SMB_VFS_HANDLE_SET_DATA(handle, db, free_acl_xattr_data,
-                               struct db_context, return -1);
-
-       return 0;
+       NTSTATUS status;
+       status = fset_nt_acl_common(get_acl_blob, store_acl_blob_fsp,
+                                   ACL_MODULE_NAME,
+                                   handle, fsp, security_info_sent, psd);
+       return status;
 }
 
-/* VFS operations structure */
-
-static vfs_op_tuple skel_op_tuples[] =
-{
-       {SMB_VFS_OP(connect_acl_xattr), SMB_VFS_OP_CONNECT,  SMB_VFS_LAYER_TRANSPARENT},
-
-       {SMB_VFS_OP(mkdir_acl_xattr), SMB_VFS_OP_MKDIR, SMB_VFS_LAYER_TRANSPARENT},
-       {SMB_VFS_OP(rmdir_acl_xattr), SMB_VFS_OP_RMDIR, SMB_VFS_LAYER_TRANSPARENT},
-
-       {SMB_VFS_OP(open_acl_xattr),  SMB_VFS_OP_OPEN,  SMB_VFS_LAYER_TRANSPARENT},
-       {SMB_VFS_OP(unlink_acl_xattr), SMB_VFS_OP_UNLINK, SMB_VFS_LAYER_TRANSPARENT},
-
-        /* NT File ACL operations */
-
-       {SMB_VFS_OP(fget_nt_acl_xattr),SMB_VFS_OP_FGET_NT_ACL,SMB_VFS_LAYER_TRANSPARENT},
-       {SMB_VFS_OP(get_nt_acl_xattr), SMB_VFS_OP_GET_NT_ACL, SMB_VFS_LAYER_TRANSPARENT},
-       {SMB_VFS_OP(fset_nt_acl_xattr),SMB_VFS_OP_FSET_NT_ACL,SMB_VFS_LAYER_TRANSPARENT},
-
-       {SMB_VFS_OP(NULL), SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP}
+static struct vfs_fn_pointers vfs_acl_tdb_fns = {
+       .connect_fn = connect_acl_tdb,
+       .disconnect_fn = disconnect_acl_tdb,
+       .rmdir_fn = rmdir_acl_tdb,
+       .unlink_fn = unlink_acl_tdb,
+       .chmod_fn = chmod_acl_module_common,
+       .fchmod_fn = fchmod_acl_module_common,
+       .fget_nt_acl_fn = acl_tdb_fget_nt_acl,
+       .get_nt_acl_fn = acl_tdb_get_nt_acl,
+       .fset_nt_acl_fn = acl_tdb_fset_nt_acl,
+       .chmod_acl_fn = chmod_acl_acl_module_common,
+       .fchmod_acl_fn = fchmod_acl_acl_module_common,
+       .sys_acl_set_file_fn = sys_acl_set_file_tdb,
+       .sys_acl_set_fd_fn = sys_acl_set_fd_tdb
 };
 
-NTSTATUS vfs_acl_xattr_init(void)
+static_decl_vfs;
+NTSTATUS vfs_acl_tdb_init(TALLOC_CTX *ctx)
 {
-       return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "acl_tdb", skel_op_tuples);
+       return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "acl_tdb",
+                               &vfs_acl_tdb_fns);
 }