WHATSNEW: document the removal of 'auth methods', 'map untrusted to domain' and ...
[samba.git] / source3 / modules / vfs_acl_tdb.c
index 647d133..c5ffa5e 100644 (file)
 #include "smbd/smbd.h"
 #include "system/filesys.h"
 #include "librpc/gen_ndr/xattr.h"
-#include "librpc/gen_ndr/ndr_xattr.h"
-#include "../lib/crypto/crypto.h"
+#include "../lib/crypto/sha256.h"
 #include "dbwrap/dbwrap.h"
 #include "dbwrap/dbwrap_open.h"
 #include "auth.h"
 #include "util_tdb.h"
+#include "vfs_acl_common.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_VFS
 
 #define ACL_MODULE_NAME "acl_tdb"
-#include "modules/vfs_acl_common.c"
 
 static unsigned int ref_count;
 static struct db_context *acl_db;
@@ -59,7 +58,8 @@ static bool acl_tdb_init(void)
        }
 
        become_root();
-       acl_db = db_open(NULL, dbname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
+       acl_db = db_open(NULL, dbname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600,
+                        DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
        unbecome_root();
 
        if (acl_db == NULL) {
@@ -98,7 +98,7 @@ static struct db_record *acl_tdb_lock(TALLOC_CTX *mem_ctx,
                                        struct db_context *db,
                                        const struct file_id *id)
 {
-       uint8 id_buf[16];
+       uint8_t id_buf[16];
 
        /* For backwards compatibility only store the dev/inode. */
        push_file_id_16((char *)id_buf, id);
@@ -142,10 +142,10 @@ static NTSTATUS acl_tdb_delete(vfs_handle_struct *handle,
 static NTSTATUS get_acl_blob(TALLOC_CTX *ctx,
                        vfs_handle_struct *handle,
                        files_struct *fsp,
-                       const char *name,
+                       const struct smb_filename *smb_fname,
                        DATA_BLOB *pblob)
 {
-       uint8 id_buf[16];
+       uint8_t id_buf[16];
        TDB_DATA data;
        struct file_id id;
        struct db_context *db = acl_db;
@@ -158,7 +158,9 @@ static NTSTATUS get_acl_blob(TALLOC_CTX *ctx,
                status = vfs_stat_fsp(fsp);
                sbuf = fsp->fsp_name->st;
        } else {
-               int ret = vfs_stat_smb_fname(handle->conn, name, &sbuf);
+               int ret = vfs_stat_smb_basename(handle->conn,
+                               smb_fname,
+                               &sbuf);
                if (ret == -1) {
                        status = map_nt_error_from_unix(errno);
                }
@@ -185,7 +187,7 @@ static NTSTATUS get_acl_blob(TALLOC_CTX *ctx,
        pblob->length = data.dsize;
 
        DEBUG(10,("get_acl_blob: returned %u bytes from file %s\n",
-               (unsigned int)data.dsize, name ));
+               (unsigned int)data.dsize, smb_fname->base_name ));
 
        if (pblob->length == 0 || pblob->data == NULL) {
                return NT_STATUS_NOT_FOUND;
@@ -201,7 +203,7 @@ static NTSTATUS store_acl_blob_fsp(vfs_handle_struct *handle,
                                files_struct *fsp,
                                DATA_BLOB *pblob)
 {
-       uint8 id_buf[16];
+       uint8_t id_buf[16];
        struct file_id id;
        TDB_DATA data;
        struct db_context *db = acl_db;
@@ -241,16 +243,15 @@ static int unlink_acl_tdb(vfs_handle_struct *handle,
 {
        struct smb_filename *smb_fname_tmp = NULL;
        struct db_context *db = acl_db;
-       NTSTATUS status;
        int ret = -1;
 
-       status = copy_smb_filename(talloc_tos(), smb_fname, &smb_fname_tmp);
-       if (!NT_STATUS_IS_OK(status)) {
-               errno = map_errno_from_nt_status(status);
+       smb_fname_tmp = cp_smb_filename_nostream(talloc_tos(), smb_fname);
+       if (smb_fname_tmp == NULL) {
+               errno = ENOMEM;
                goto out;
        }
 
-       if (lp_posix_pathnames()) {
+       if (smb_fname_tmp->flags & SMB_FILENAME_POSIX_PATH) {
                ret = SMB_VFS_LSTAT(handle->conn, smb_fname_tmp);
        } else {
                ret = SMB_VFS_STAT(handle->conn, smb_fname_tmp);
@@ -275,24 +276,20 @@ static int unlink_acl_tdb(vfs_handle_struct *handle,
  On rmdir we need to delete the tdb record (if using tdb).
 *********************************************************************/
 
-static int rmdir_acl_tdb(vfs_handle_struct *handle, const char *path)
+static int rmdir_acl_tdb(vfs_handle_struct *handle,
+               const struct smb_filename *smb_fname)
 {
 
        SMB_STRUCT_STAT sbuf;
        struct db_context *db = acl_db;
        int ret = -1;
 
-       if (lp_posix_pathnames()) {
-               ret = vfs_lstat_smb_fname(handle->conn, path, &sbuf);
-       } else {
-               ret = vfs_stat_smb_fname(handle->conn, path, &sbuf);
-       }
-
+       ret = vfs_stat_smb_basename(handle->conn, smb_fname, &sbuf);
        if (ret == -1) {
                return -1;
        }
 
-       ret = rmdir_acl_common(handle, path);
+       ret = rmdir_acl_common(handle, smb_fname);
        if (ret == -1) {
                return -1;
        }
@@ -310,6 +307,8 @@ static int connect_acl_tdb(struct vfs_handle_struct *handle,
                                const char *user)
 {
        int ret = SMB_VFS_NEXT_CONNECT(handle, service, user);
+       bool ok;
+       struct acl_common_config *config = NULL;
 
        if (ret < 0) {
                return ret;
@@ -320,6 +319,12 @@ static int connect_acl_tdb(struct vfs_handle_struct *handle,
                return -1;
        }
 
+       ok = init_acl_common_config(handle, ACL_MODULE_NAME);
+       if (!ok) {
+               DBG_ERR("init_acl_common_config failed\n");
+               return -1;
+       }
+
        /* Ensure we have the parameters correct if we're
         * using this module. */
        DEBUG(2,("connect_acl_tdb: setting 'inherit acls = true' "
@@ -331,6 +336,44 @@ static int connect_acl_tdb(struct vfs_handle_struct *handle,
        lp_do_parameter(SNUM(handle->conn), "dos filemode", "true");
        lp_do_parameter(SNUM(handle->conn), "force unknown acl user", "true");
 
+       SMB_VFS_HANDLE_GET_DATA(handle, config,
+                               struct acl_common_config,
+                               return -1);
+
+       if (config->ignore_system_acls) {
+               mode_t create_mask = lp_create_mask(SNUM(handle->conn));
+               char *create_mask_str = NULL;
+
+               if ((create_mask & 0666) != 0666) {
+                       create_mask |= 0666;
+                       create_mask_str = talloc_asprintf(handle, "0%o",
+                                                         create_mask);
+                       if (create_mask_str == NULL) {
+                               DBG_ERR("talloc_asprintf failed\n");
+                               return -1;
+                       }
+
+                       DBG_NOTICE("setting 'create mask = %s'\n", create_mask_str);
+
+                       lp_do_parameter (SNUM(handle->conn),
+                                       "create mask", create_mask_str);
+
+                       TALLOC_FREE(create_mask_str);
+               }
+
+               DBG_NOTICE("setting 'directory mask = 0777', "
+                          "'store dos attributes = yes' and all "
+                          "'map ...' options to 'no'\n");
+
+               lp_do_parameter(SNUM(handle->conn), "directory mask", "0777");
+               lp_do_parameter(SNUM(handle->conn), "map archive", "no");
+               lp_do_parameter(SNUM(handle->conn), "map hidden", "no");
+               lp_do_parameter(SNUM(handle->conn), "map readonly", "no");
+               lp_do_parameter(SNUM(handle->conn), "map system", "no");
+               lp_do_parameter(SNUM(handle->conn), "store dos attributes",
+                               "yes");
+       }
+
        return 0;
 }
 
@@ -339,34 +382,44 @@ static int connect_acl_tdb(struct vfs_handle_struct *handle,
 *********************************************************************/
 
 static int sys_acl_set_file_tdb(vfs_handle_struct *handle,
-                              const char *path,
-                              SMB_ACL_TYPE_T type,
-                              SMB_ACL_T theacl)
+                       const struct smb_filename *smb_fname_in,
+                       SMB_ACL_TYPE_T type,
+                       SMB_ACL_T theacl)
 {
-       SMB_STRUCT_STAT sbuf;
        struct db_context *db = acl_db;
        int ret = -1;
+       int saved_errno = 0;
+       struct smb_filename *smb_fname = NULL;
 
-       if (lp_posix_pathnames()) {
-               ret = vfs_lstat_smb_fname(handle->conn, path, &sbuf);
-       } else {
-               ret = vfs_stat_smb_fname(handle->conn, path, &sbuf);
-       }
+       smb_fname = cp_smb_filename_nostream(talloc_tos(), smb_fname_in);
+       if (smb_fname == NULL) {
+               return -1;
+       };
 
+       ret = SMB_VFS_STAT(handle->conn, smb_fname);
        if (ret == -1) {
-               return -1;
+               saved_errno = errno;
+               goto fail;
        }
 
        ret = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle,
-                                               path,
+                                               smb_fname,
                                                type,
                                                theacl);
        if (ret == -1) {
-               return -1;
+               saved_errno = errno;
+               goto fail;
        }
 
-       acl_tdb_delete(handle, db, &sbuf);
-       return 0;
+       acl_tdb_delete(handle, db, &smb_fname->st);
+
+fail:
+       TALLOC_FREE(smb_fname);
+
+       if (saved_errno != 0) {
+               errno = saved_errno;
+       }
+       return ret;
 }
 
 /*********************************************************************
@@ -397,24 +450,60 @@ static int sys_acl_set_fd_tdb(vfs_handle_struct *handle,
        return 0;
 }
 
+static NTSTATUS acl_tdb_fget_nt_acl(vfs_handle_struct *handle,
+                                   files_struct *fsp,
+                                   uint32_t security_info,
+                                   TALLOC_CTX *mem_ctx,
+                                   struct security_descriptor **ppdesc)
+{
+       NTSTATUS status;
+       status = get_nt_acl_common(get_acl_blob, handle, fsp, NULL,
+                                  security_info, mem_ctx, ppdesc);
+       return status;
+}
+
+static NTSTATUS acl_tdb_get_nt_acl(vfs_handle_struct *handle,
+                                  const struct smb_filename *smb_fname,
+                                  uint32_t security_info,
+                                  TALLOC_CTX *mem_ctx,
+                                  struct security_descriptor **ppdesc)
+{
+       NTSTATUS status;
+       status = get_nt_acl_common(get_acl_blob, handle, NULL, smb_fname,
+                                  security_info, mem_ctx, ppdesc);
+       return status;
+}
+
+static NTSTATUS acl_tdb_fset_nt_acl(vfs_handle_struct *handle,
+                                   files_struct *fsp,
+                                   uint32_t security_info_sent,
+                                   const struct security_descriptor *psd)
+{
+       NTSTATUS status;
+       status = fset_nt_acl_common(get_acl_blob, store_acl_blob_fsp,
+                                   ACL_MODULE_NAME,
+                                   handle, fsp, security_info_sent, psd);
+       return status;
+}
+
 static struct vfs_fn_pointers vfs_acl_tdb_fns = {
        .connect_fn = connect_acl_tdb,
-       .disconnect = disconnect_acl_tdb,
-       .rmdir = rmdir_acl_tdb,
-       .create_file = create_file_acl_common,
-       .unlink = unlink_acl_tdb,
-       .chmod = chmod_acl_module_common,
-       .fchmod = fchmod_acl_module_common,
-       .fget_nt_acl = fget_nt_acl_common,
-       .get_nt_acl = get_nt_acl_common,
-       .fset_nt_acl = fset_nt_acl_common,
-       .chmod_acl = chmod_acl_acl_module_common,
-       .fchmod_acl = fchmod_acl_acl_module_common,
-       .sys_acl_set_file = sys_acl_set_file_tdb,
-       .sys_acl_set_fd = sys_acl_set_fd_tdb
+       .disconnect_fn = disconnect_acl_tdb,
+       .rmdir_fn = rmdir_acl_tdb,
+       .unlink_fn = unlink_acl_tdb,
+       .chmod_fn = chmod_acl_module_common,
+       .fchmod_fn = fchmod_acl_module_common,
+       .fget_nt_acl_fn = acl_tdb_fget_nt_acl,
+       .get_nt_acl_fn = acl_tdb_get_nt_acl,
+       .fset_nt_acl_fn = acl_tdb_fset_nt_acl,
+       .chmod_acl_fn = chmod_acl_acl_module_common,
+       .fchmod_acl_fn = fchmod_acl_acl_module_common,
+       .sys_acl_set_file_fn = sys_acl_set_file_tdb,
+       .sys_acl_set_fd_fn = sys_acl_set_fd_tdb
 };
 
-NTSTATUS vfs_acl_tdb_init(void)
+static_decl_vfs;
+NTSTATUS vfs_acl_tdb_init(TALLOC_CTX *ctx)
 {
        return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "acl_tdb",
                                &vfs_acl_tdb_fns);