WHATSNEW: document the removal of 'auth methods', 'map untrusted to domain' and ...
[samba.git] / source3 / modules / vfs_acl_tdb.c
index e2d0cb8..c5ffa5e 100644 (file)
 #include "smbd/smbd.h"
 #include "system/filesys.h"
 #include "librpc/gen_ndr/xattr.h"
-#include "librpc/gen_ndr/ndr_xattr.h"
 #include "../lib/crypto/sha256.h"
 #include "dbwrap/dbwrap.h"
 #include "dbwrap/dbwrap_open.h"
 #include "auth.h"
 #include "util_tdb.h"
+#include "vfs_acl_common.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_VFS
 
 #define ACL_MODULE_NAME "acl_tdb"
-#include "modules/vfs_acl_common.c"
 
 static unsigned int ref_count;
 static struct db_context *acl_db;
@@ -160,7 +159,7 @@ static NTSTATUS get_acl_blob(TALLOC_CTX *ctx,
                sbuf = fsp->fsp_name->st;
        } else {
                int ret = vfs_stat_smb_basename(handle->conn,
-                               smb_fname->base_name,
+                               smb_fname,
                                &sbuf);
                if (ret == -1) {
                        status = map_nt_error_from_unix(errno);
@@ -246,7 +245,7 @@ static int unlink_acl_tdb(vfs_handle_struct *handle,
        struct db_context *db = acl_db;
        int ret = -1;
 
-       smb_fname_tmp = cp_smb_filename(talloc_tos(), smb_fname);
+       smb_fname_tmp = cp_smb_filename_nostream(talloc_tos(), smb_fname);
        if (smb_fname_tmp == NULL) {
                errno = ENOMEM;
                goto out;
@@ -285,7 +284,7 @@ static int rmdir_acl_tdb(vfs_handle_struct *handle,
        struct db_context *db = acl_db;
        int ret = -1;
 
-       ret = vfs_stat_smb_basename(handle->conn, smb_fname->base_name, &sbuf);
+       ret = vfs_stat_smb_basename(handle->conn, smb_fname, &sbuf);
        if (ret == -1) {
                return -1;
        }
@@ -308,6 +307,8 @@ static int connect_acl_tdb(struct vfs_handle_struct *handle,
                                const char *user)
 {
        int ret = SMB_VFS_NEXT_CONNECT(handle, service, user);
+       bool ok;
+       struct acl_common_config *config = NULL;
 
        if (ret < 0) {
                return ret;
@@ -318,6 +319,12 @@ static int connect_acl_tdb(struct vfs_handle_struct *handle,
                return -1;
        }
 
+       ok = init_acl_common_config(handle, ACL_MODULE_NAME);
+       if (!ok) {
+               DBG_ERR("init_acl_common_config failed\n");
+               return -1;
+       }
+
        /* Ensure we have the parameters correct if we're
         * using this module. */
        DEBUG(2,("connect_acl_tdb: setting 'inherit acls = true' "
@@ -329,6 +336,44 @@ static int connect_acl_tdb(struct vfs_handle_struct *handle,
        lp_do_parameter(SNUM(handle->conn), "dos filemode", "true");
        lp_do_parameter(SNUM(handle->conn), "force unknown acl user", "true");
 
+       SMB_VFS_HANDLE_GET_DATA(handle, config,
+                               struct acl_common_config,
+                               return -1);
+
+       if (config->ignore_system_acls) {
+               mode_t create_mask = lp_create_mask(SNUM(handle->conn));
+               char *create_mask_str = NULL;
+
+               if ((create_mask & 0666) != 0666) {
+                       create_mask |= 0666;
+                       create_mask_str = talloc_asprintf(handle, "0%o",
+                                                         create_mask);
+                       if (create_mask_str == NULL) {
+                               DBG_ERR("talloc_asprintf failed\n");
+                               return -1;
+                       }
+
+                       DBG_NOTICE("setting 'create mask = %s'\n", create_mask_str);
+
+                       lp_do_parameter (SNUM(handle->conn),
+                                       "create mask", create_mask_str);
+
+                       TALLOC_FREE(create_mask_str);
+               }
+
+               DBG_NOTICE("setting 'directory mask = 0777', "
+                          "'store dos attributes = yes' and all "
+                          "'map ...' options to 'no'\n");
+
+               lp_do_parameter(SNUM(handle->conn), "directory mask", "0777");
+               lp_do_parameter(SNUM(handle->conn), "map archive", "no");
+               lp_do_parameter(SNUM(handle->conn), "map hidden", "no");
+               lp_do_parameter(SNUM(handle->conn), "map readonly", "no");
+               lp_do_parameter(SNUM(handle->conn), "map system", "no");
+               lp_do_parameter(SNUM(handle->conn), "store dos attributes",
+                               "yes");
+       }
+
        return 0;
 }
 
@@ -337,31 +382,44 @@ static int connect_acl_tdb(struct vfs_handle_struct *handle,
 *********************************************************************/
 
 static int sys_acl_set_file_tdb(vfs_handle_struct *handle,
-                              const char *path,
-                              SMB_ACL_TYPE_T type,
-                              SMB_ACL_T theacl)
+                       const struct smb_filename *smb_fname_in,
+                       SMB_ACL_TYPE_T type,
+                       SMB_ACL_T theacl)
 {
        struct db_context *db = acl_db;
        int ret = -1;
-       struct smb_filename smb_fname = {
-               .base_name = discard_const_p(char, path)
+       int saved_errno = 0;
+       struct smb_filename *smb_fname = NULL;
+
+       smb_fname = cp_smb_filename_nostream(talloc_tos(), smb_fname_in);
+       if (smb_fname == NULL) {
+               return -1;
        };
 
-       ret = SMB_VFS_STAT(handle->conn, &smb_fname);
+       ret = SMB_VFS_STAT(handle->conn, smb_fname);
        if (ret == -1) {
-               return -1;
+               saved_errno = errno;
+               goto fail;
        }
 
        ret = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle,
-                                               path,
+                                               smb_fname,
                                                type,
                                                theacl);
        if (ret == -1) {
-               return -1;
+               saved_errno = errno;
+               goto fail;
        }
 
-       acl_tdb_delete(handle, db, &smb_fname.st);
-       return 0;
+       acl_tdb_delete(handle, db, &smb_fname->st);
+
+fail:
+       TALLOC_FREE(smb_fname);
+
+       if (saved_errno != 0) {
+               errno = saved_errno;
+       }
+       return ret;
 }
 
 /*********************************************************************
@@ -392,6 +450,42 @@ static int sys_acl_set_fd_tdb(vfs_handle_struct *handle,
        return 0;
 }
 
+static NTSTATUS acl_tdb_fget_nt_acl(vfs_handle_struct *handle,
+                                   files_struct *fsp,
+                                   uint32_t security_info,
+                                   TALLOC_CTX *mem_ctx,
+                                   struct security_descriptor **ppdesc)
+{
+       NTSTATUS status;
+       status = get_nt_acl_common(get_acl_blob, handle, fsp, NULL,
+                                  security_info, mem_ctx, ppdesc);
+       return status;
+}
+
+static NTSTATUS acl_tdb_get_nt_acl(vfs_handle_struct *handle,
+                                  const struct smb_filename *smb_fname,
+                                  uint32_t security_info,
+                                  TALLOC_CTX *mem_ctx,
+                                  struct security_descriptor **ppdesc)
+{
+       NTSTATUS status;
+       status = get_nt_acl_common(get_acl_blob, handle, NULL, smb_fname,
+                                  security_info, mem_ctx, ppdesc);
+       return status;
+}
+
+static NTSTATUS acl_tdb_fset_nt_acl(vfs_handle_struct *handle,
+                                   files_struct *fsp,
+                                   uint32_t security_info_sent,
+                                   const struct security_descriptor *psd)
+{
+       NTSTATUS status;
+       status = fset_nt_acl_common(get_acl_blob, store_acl_blob_fsp,
+                                   ACL_MODULE_NAME,
+                                   handle, fsp, security_info_sent, psd);
+       return status;
+}
+
 static struct vfs_fn_pointers vfs_acl_tdb_fns = {
        .connect_fn = connect_acl_tdb,
        .disconnect_fn = disconnect_acl_tdb,
@@ -399,9 +493,9 @@ static struct vfs_fn_pointers vfs_acl_tdb_fns = {
        .unlink_fn = unlink_acl_tdb,
        .chmod_fn = chmod_acl_module_common,
        .fchmod_fn = fchmod_acl_module_common,
-       .fget_nt_acl_fn = fget_nt_acl_common,
-       .get_nt_acl_fn = get_nt_acl_common,
-       .fset_nt_acl_fn = fset_nt_acl_common,
+       .fget_nt_acl_fn = acl_tdb_fget_nt_acl,
+       .get_nt_acl_fn = acl_tdb_get_nt_acl,
+       .fset_nt_acl_fn = acl_tdb_fset_nt_acl,
        .chmod_acl_fn = chmod_acl_acl_module_common,
        .fchmod_acl_fn = fchmod_acl_acl_module_common,
        .sys_acl_set_file_fn = sys_acl_set_file_tdb,
@@ -409,7 +503,7 @@ static struct vfs_fn_pointers vfs_acl_tdb_fns = {
 };
 
 static_decl_vfs;
-NTSTATUS vfs_acl_tdb_init(void)
+NTSTATUS vfs_acl_tdb_init(TALLOC_CTX *ctx)
 {
        return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "acl_tdb",
                                &vfs_acl_tdb_fns);