source/smbd/posix_acls.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    SMB NT Security Descriptor / Unix permission conversion.
   4    Copyright (C) Jeremy Allison 1994-2000.
   5    Copyright (C) Andreas Gruenbacher 2002.
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23
  24 /****************************************************************************
  25  Data structures representing the internal ACE format.
  26 ****************************************************************************/
  27
  28 enum ace_owner {UID_ACE, GID_ACE, WORLD_ACE};
  29 enum ace_attribute {ALLOW_ACE, DENY_ACE}; /* Used for incoming NT ACLS. */
  30
  31 typedef union posix_id {
  32                 uid_t uid;
  33                 gid_t gid;
  34                 int world;
  35 } posix_id;
  36
  37 typedef struct canon_ace {
  38         struct canon_ace *next, *prev;
  39         SMB_ACL_TAG_T type;
  40         mode_t perms; /* Only use S_I(R|W|X)USR mode bits here. */
  41         DOM_SID trustee;
  42         enum ace_owner owner_type;
  43         enum ace_attribute attr;
  44         posix_id unix_ug;
  45 } canon_ace;
  46
  47 #define ALL_ACE_PERMS (S_IRUSR|S_IWUSR|S_IXUSR)
  48
  49 /****************************************************************************
  50  Functions to manipulate the internal ACE format.
  51 ****************************************************************************/
  52
  53 /****************************************************************************
  54  Count a linked list of canonical ACE entries.
  55 ****************************************************************************/
  56
  57 static size_t count_canon_ace_list( canon_ace *list_head )
  58 {
  59         size_t count = 0;
  60         canon_ace *ace;
  61
  62         for (ace = list_head; ace; ace = ace->next)
  63                 count++;
  64
  65         return count;
  66 }
  67
  68 /****************************************************************************
  69  Free a linked list of canonical ACE entries.
  70 ****************************************************************************/
  71
  72 static void free_canon_ace_list( canon_ace *list_head )
  73 {
  74         while (list_head) {
  75                 canon_ace *old_head = list_head;
  76                 DLIST_REMOVE(list_head, list_head);
  77                 SAFE_FREE(old_head);
  78         }
  79 }
  80
  81 /****************************************************************************
  82  Function to duplicate a canon_ace entry.
  83 ****************************************************************************/
  84
  85 static canon_ace *dup_canon_ace( canon_ace *src_ace)
  86 {
  87         canon_ace *dst_ace = (canon_ace *)malloc(sizeof(canon_ace));
  88
  89         if (dst_ace == NULL)
  90                 return NULL;
  91
  92         *dst_ace = *src_ace;
  93         dst_ace->prev = dst_ace->next = NULL;
  94         return dst_ace;
  95 }
  96
  97 /****************************************************************************
  98  Print out a canon ace.
  99 ****************************************************************************/
 100
 101 static void print_canon_ace(canon_ace *pace, int num)
 102 {
 103         fstring str;
 104
 105         dbgtext( "canon_ace index %d. Type = %s ", num, pace->attr == ALLOW_ACE ? "allow" : "deny" );
 106         dbgtext( "SID = %s ", sid_to_string( str, &pace->trustee));
 107         if (pace->owner_type == UID_ACE) {
 108                 const char *u_name = uidtoname(pace->unix_ug.uid);
 109                 dbgtext( "uid %u (%s) ", (unsigned int)pace->unix_ug.uid, u_name);
 110         } else if (pace->owner_type == GID_ACE) {
 111                 char *g_name = gidtoname(pace->unix_ug.gid);
 112                 dbgtext( "gid %u (%s) ", (unsigned int)pace->unix_ug.gid, g_name);
 113         } else
 114                 dbgtext( "other ");
 115         switch (pace->type) {
 116                 case SMB_ACL_USER:
 117                         dbgtext( "SMB_ACL_USER ");
 118                         break;
 119                 case SMB_ACL_USER_OBJ:
 120                         dbgtext( "SMB_ACL_USER_OBJ ");
 121                         break;
 122                 case SMB_ACL_GROUP:
 123                         dbgtext( "SMB_ACL_GROUP ");
 124                         break;
 125                 case SMB_ACL_GROUP_OBJ:
 126                         dbgtext( "SMB_ACL_GROUP_OBJ ");
 127                         break;
 128                 case SMB_ACL_OTHER:
 129                         dbgtext( "SMB_ACL_OTHER ");
 130                         break;
 131         }
 132         dbgtext( "perms ");
 133         dbgtext( "%c", pace->perms & S_IRUSR ? 'r' : '-');
 134         dbgtext( "%c", pace->perms & S_IWUSR ? 'w' : '-');
 135         dbgtext( "%c\n", pace->perms & S_IXUSR ? 'x' : '-');
 136 }
 137
 138 /****************************************************************************
 139  Print out a canon ace list.
 140 ****************************************************************************/
 141
 142 static void print_canon_ace_list(const char *name, canon_ace *ace_list)
 143 {
 144         int count = 0;
 145
 146         if( DEBUGLVL( 10 )) {
 147                 dbgtext( "print_canon_ace_list: %s\n", name );
 148                 for (;ace_list; ace_list = ace_list->next, count++)
 149                         print_canon_ace(ace_list, count );
 150         }
 151 }
 152
 153 /****************************************************************************
 154  Map POSIX ACL perms to canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits).
 155 ****************************************************************************/
 156
 157 static mode_t convert_permset_to_mode_t(connection_struct *conn, SMB_ACL_PERMSET_T permset)
 158 {
 159         mode_t ret = 0;
 160
 161         ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ) ? S_IRUSR : 0);
 162         ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE) ? S_IWUSR : 0);
 163         ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_EXECUTE) ? S_IXUSR : 0);
 164
 165         return ret;
 166 }
 167
 168 /****************************************************************************
 169  Map generic UNIX permissions to canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits).
 170 ****************************************************************************/
 171
 172 static mode_t unix_perms_to_acl_perms(mode_t mode, int r_mask, int w_mask, int x_mask)
 173 {
 174         mode_t ret = 0;
 175
 176         if (mode & r_mask)
 177                 ret |= S_IRUSR;
 178         if (mode & w_mask)
 179                 ret |= S_IWUSR;
 180         if (mode & x_mask)
 181                 ret |= S_IXUSR;
 182
 183         return ret;
 184 }
 185
 186 /****************************************************************************
 187  Map canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits) to
 188  an SMB_ACL_PERMSET_T.
 189 ****************************************************************************/
 190
 191 static int map_acl_perms_to_permset(connection_struct *conn, mode_t mode, SMB_ACL_PERMSET_T *p_permset)
 192 {
 193         if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn, *p_permset) ==  -1)
 194                 return -1;
 195         if (mode & S_IRUSR) {
 196                 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_READ) == -1)
 197                         return -1;
 198         }
 199         if (mode & S_IWUSR) {
 200                 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_WRITE) == -1)
 201                         return -1;
 202         }
 203         if (mode & S_IXUSR) {
 204                 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_EXECUTE) == -1)
 205                         return -1;
 206         }
 207         return 0;
 208 }
 209 /****************************************************************************
 210  Function to create owner and group SIDs from a SMB_STRUCT_STAT.
 211 ****************************************************************************/
 212
 213 static void create_file_sids(SMB_STRUCT_STAT *psbuf, DOM_SID *powner_sid, DOM_SID *pgroup_sid)
 214 {
 215         uid_to_sid( powner_sid, psbuf->st_uid );
 216         gid_to_sid( pgroup_sid, psbuf->st_gid );
 217 }
 218
 219 /****************************************************************************
 220  Merge aces with a common sid - if both are allow or deny, OR the permissions together and
 221  delete the second one. If the first is deny, mask the permissions off and delete the allow
 222  if the permissions become zero, delete the deny if the permissions are non zero.
 223 ****************************************************************************/
 224
 225 static void merge_aces( canon_ace **pp_list_head )
 226 {
 227         canon_ace *list_head = *pp_list_head;
 228         canon_ace *curr_ace_outer;
 229         canon_ace *curr_ace_outer_next;
 230
 231         /*
 232          * First, merge allow entries with identical SIDs, and deny entries
 233          * with identical SIDs.
 234          */
 235
 236         for (curr_ace_outer = list_head; curr_ace_outer; curr_ace_outer = curr_ace_outer_next) {
 237                 canon_ace *curr_ace;
 238                 canon_ace *curr_ace_next;
 239
 240                 curr_ace_outer_next = curr_ace_outer->next; /* Save the link in case we delete. */
 241
 242                 for (curr_ace = curr_ace_outer->next; curr_ace; curr_ace = curr_ace_next) {
 243
 244                         curr_ace_next = curr_ace->next; /* Save the link in case of delete. */
 245
 246                         if (sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
 247                                 (curr_ace->attr == curr_ace_outer->attr)) {
 248
 249                                 if( DEBUGLVL( 10 )) {
 250                                         dbgtext("merge_aces: Merging ACE's\n");
 251                                         print_canon_ace( curr_ace_outer, 0);
 252                                         print_canon_ace( curr_ace, 0);
 253                                 }
 254
 255                                 /* Merge two allow or two deny ACE's. */
 256
 257                                 curr_ace_outer->perms |= curr_ace->perms;
 258                                 DLIST_REMOVE(list_head, curr_ace);
 259                                 SAFE_FREE(curr_ace);
 260                                 curr_ace_outer_next = curr_ace_outer->next; /* We may have deleted the link. */
 261                         }
 262                 }
 263         }
 264
 265         /*
 266          * Now go through and mask off allow permissions with deny permissions.
 267          * We can delete either the allow or deny here as we know that each SID
 268          * appears only once in the list.
 269          */
 270
 271         for (curr_ace_outer = list_head; curr_ace_outer; curr_ace_outer = curr_ace_outer_next) {
 272                 canon_ace *curr_ace;
 273                 canon_ace *curr_ace_next;
 274
 275                 curr_ace_outer_next = curr_ace_outer->next; /* Save the link in case we delete. */
 276
 277                 for (curr_ace = curr_ace_outer->next; curr_ace; curr_ace = curr_ace_next) {
 278
 279                         curr_ace_next = curr_ace->next; /* Save the link in case of delete. */
 280
 281                         /*
 282                          * Subtract ACE's with different entries. Due to the ordering constraints
 283                          * we've put on the ACL, we know the deny must be the first one.
 284                          */
 285
 286                         if (sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
 287                                 (curr_ace_outer->attr == DENY_ACE) && (curr_ace->attr == ALLOW_ACE)) {
 288
 289                                 if( DEBUGLVL( 10 )) {
 290                                         dbgtext("merge_aces: Masking ACE's\n");
 291                                         print_canon_ace( curr_ace_outer, 0);
 292                                         print_canon_ace( curr_ace, 0);
 293                                 }
 294
 295                                 curr_ace->perms &= ~curr_ace_outer->perms;
 296
 297                                 if (curr_ace->perms == 0) {
 298
 299                                         /*
 300                                          * The deny overrides the allow. Remove the allow.
 301                                          */
 302
 303                                         DLIST_REMOVE(list_head, curr_ace);
 304                                         SAFE_FREE(curr_ace);
 305                                         curr_ace_outer_next = curr_ace_outer->next; /* We may have deleted the link. */
 306
 307                                 } else {
 308
 309                                         /*
 310                                          * Even after removing permissions, there
 311                                          * are still allow permissions - delete the deny.
 312                                          * It is safe to delete the deny here,
 313                                          * as we are guarenteed by the deny first
 314                                          * ordering that all the deny entries for
 315                                          * this SID have already been merged into one
 316                                          * before we can get to an allow ace.
 317                                          */
 318
 319                                         DLIST_REMOVE(list_head, curr_ace_outer);
 320                                         SAFE_FREE(curr_ace_outer);
 321                                         break;
 322                                 }
 323                         }
 324
 325                 } /* end for curr_ace */
 326         } /* end for curr_ace_outer */
 327
 328         /* We may have modified the list. */
 329
 330         *pp_list_head = list_head;
 331 }
 332
 333 /****************************************************************************
 334  Check if we need to return NT4.x compatible ACL entries.
 335 ****************************************************************************/
 336
 337 static BOOL nt4_compatible_acls(void)
 338 {
 339         const char *compat = lp_acl_compatibility();
 340
 341         if (*compat == '\0') {
 342                 enum remote_arch_types ra_type = get_remote_arch();
 343
 344                 /* Automatically adapt to client */
 345                 return (ra_type <= RA_WINNT);
 346         } else
 347                 return (strequal(compat, "winnt"));
 348 }
 349
 350
 351 /****************************************************************************
 352  Map canon_ace perms to permission bits NT.
 353  The attr element is not used here - we only process deny entries on set,
 354  not get. Deny entries are implicit on get with ace->perms = 0.
 355 ****************************************************************************/
 356
 357 static SEC_ACCESS map_canon_ace_perms(int *pacl_type, DOM_SID *powner_sid, canon_ace *ace)
 358 {
 359         SEC_ACCESS sa;
 360         uint32 nt_mask = 0;
 361
 362         *pacl_type = SEC_ACE_TYPE_ACCESS_ALLOWED;
 363
 364         if ((ace->perms & ALL_ACE_PERMS) == ALL_ACE_PERMS) {
 365                         nt_mask = UNIX_ACCESS_RWX;
 366         } else if ((ace->perms & ALL_ACE_PERMS) == (mode_t)0) {
 367                 /*
 368                  * Windows NT refuses to display ACEs with no permissions in them (but
 369                  * they are perfectly legal with Windows 2000). If the ACE has empty
 370                  * permissions we cannot use 0, so we use the otherwise unused
 371                  * WRITE_OWNER permission, which we ignore when we set an ACL.
 372                  * We abstract this into a #define of UNIX_ACCESS_NONE to allow this
 373                  * to be changed in the future.
 374                  */
 375
 376                 if (nt4_compatible_acls())
 377                         nt_mask = UNIX_ACCESS_NONE;
 378                 else
 379                         nt_mask = 0;
 380         } else {
 381                 nt_mask |= ((ace->perms & S_IRUSR) ? UNIX_ACCESS_R : 0 );
 382                 nt_mask |= ((ace->perms & S_IWUSR) ? UNIX_ACCESS_W : 0 );
 383                 nt_mask |= ((ace->perms & S_IXUSR) ? UNIX_ACCESS_X : 0 );
 384         }
 385
 386         DEBUG(10,("map_canon_ace_perms: Mapped (UNIX) %x to (NT) %x\n",
 387                         (unsigned int)ace->perms, (unsigned int)nt_mask ));
 388
 389         init_sec_access(&sa,nt_mask);
 390         return sa;
 391 }
 392
 393 /****************************************************************************
 394  Map NT perms to a UNIX mode_t.
 395 ****************************************************************************/
 396
 397 #define FILE_SPECIFIC_READ_BITS (FILE_READ_DATA|FILE_READ_EA|FILE_READ_ATTRIBUTES)
 398 #define FILE_SPECIFIC_WRITE_BITS (FILE_WRITE_DATA|FILE_APPEND_DATA|FILE_WRITE_EA|FILE_WRITE_ATTRIBUTES)
 399 #define FILE_SPECIFIC_EXECUTE_BITS (FILE_EXECUTE)
 400
 401 static mode_t map_nt_perms( SEC_ACCESS sec_access, int type)
 402 {
 403         mode_t mode = 0;
 404
 405         switch(type) {
 406         case S_IRUSR:
 407                 if(sec_access.mask & GENERIC_ALL_ACCESS)
 408                         mode = S_IRUSR|S_IWUSR|S_IXUSR;
 409                 else {
 410                         mode |= (sec_access.mask & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IRUSR : 0;
 411                         mode |= (sec_access.mask & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWUSR : 0;
 412                         mode |= (sec_access.mask & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXUSR : 0;
 413                 }
 414                 break;
 415         case S_IRGRP:
 416                 if(sec_access.mask & GENERIC_ALL_ACCESS)
 417                         mode = S_IRGRP|S_IWGRP|S_IXGRP;
 418                 else {
 419                         mode |= (sec_access.mask & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IRGRP : 0;
 420                         mode |= (sec_access.mask & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWGRP : 0;
 421                         mode |= (sec_access.mask & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXGRP : 0;
 422                 }
 423                 break;
 424         case S_IROTH:
 425                 if(sec_access.mask & GENERIC_ALL_ACCESS)
 426                         mode = S_IROTH|S_IWOTH|S_IXOTH;
 427                 else {
 428                         mode |= (sec_access.mask & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IROTH : 0;
 429                         mode |= (sec_access.mask & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWOTH : 0;
 430                         mode |= (sec_access.mask & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXOTH : 0;
 431                 }
 432                 break;
 433         }
 434
 435         return mode;
 436 }
 437
 438 /****************************************************************************
 439  Unpack a SEC_DESC into a UNIX owner and group.
 440 ****************************************************************************/
 441
 442 static BOOL unpack_nt_owners(SMB_STRUCT_STAT *psbuf, uid_t *puser, gid_t *pgrp, uint32 security_info_sent, SEC_DESC *psd)
 443 {
 444         DOM_SID owner_sid;
 445         DOM_SID grp_sid;
 446
 447         *puser = (uid_t)-1;
 448         *pgrp = (gid_t)-1;
 449
 450         if(security_info_sent == 0) {
 451                 DEBUG(0,("unpack_nt_owners: no security info sent !\n"));
 452                 return True;
 453         }
 454
 455         /*
 456          * Validate the owner and group SID's.
 457          */
 458
 459         memset(&owner_sid, '\0', sizeof(owner_sid));
 460         memset(&grp_sid, '\0', sizeof(grp_sid));
 461
 462         DEBUG(5,("unpack_nt_owners: validating owner_sids.\n"));
 463
 464         /*
 465          * Don't immediately fail if the owner sid cannot be validated.
 466          * This may be a group chown only set.
 467          */
 468
 469         if (security_info_sent & OWNER_SECURITY_INFORMATION) {
 470                 sid_copy(&owner_sid, psd->owner_sid);
 471                 if (NT_STATUS_IS_ERR(sid_to_uid(&owner_sid, puser))) {
 472 #if ACL_FORCE_UNMAPPABLE
 473                         /* this allows take ownership to work reasonably */
 474                         extern struct current_user current_user;
 475                         *puser = current_user.uid;
 476 #else
 477                         DEBUG(3,("unpack_nt_owners: unable to validate owner sid for %s\n",
 478                                  sid_string_static(&owner_sid)));
 479                         return False;
 480 #endif
 481                 }
 482         }
 483
 484         /*
 485          * Don't immediately fail if the group sid cannot be validated.
 486          * This may be an owner chown only set.
 487          */
 488
 489         if (security_info_sent & GROUP_SECURITY_INFORMATION) {
 490                 sid_copy(&grp_sid, psd->grp_sid);
 491                 if (NT_STATUS_IS_ERR(sid_to_gid( &grp_sid, pgrp))) {
 492 #if ACL_FORCE_UNMAPPABLE
 493                         /* this allows take group ownership to work reasonably */
 494                         extern struct current_user current_user;
 495                         *pgrp = current_user.gid;
 496 #else
 497                         DEBUG(3,("unpack_nt_owners: unable to validate group sid.\n"));
 498                         return False;
 499 #endif
 500                 }
 501         }
 502
 503         DEBUG(5,("unpack_nt_owners: owner_sids validated.\n"));
 504
 505         return True;
 506 }
 507
 508 /****************************************************************************
 509  Ensure the enforced permissions for this share apply.
 510 ****************************************************************************/
 511
 512 static void apply_default_perms(files_struct *fsp, canon_ace *pace, mode_t type)
 513 {
 514         int snum = SNUM(fsp->conn);
 515         mode_t and_bits = (mode_t)0;
 516         mode_t or_bits = (mode_t)0;
 517
 518         /* Get the initial bits to apply. */
 519
 520         if (fsp->is_directory) {
 521                 and_bits = lp_dir_security_mask(snum);
 522                 or_bits = lp_force_dir_security_mode(snum);
 523         } else {
 524                 and_bits = lp_security_mask(snum);
 525                 or_bits = lp_force_security_mode(snum);
 526         }
 527
 528         /* Now bounce them into the S_USR space. */
 529         switch(type) {
 530         case S_IRUSR:
 531                 /* Ensure owner has read access. */
 532                 pace->perms |= S_IRUSR;
 533                 if (fsp->is_directory)
 534                         pace->perms |= (S_IWUSR|S_IXUSR);
 535                 and_bits = unix_perms_to_acl_perms(and_bits, S_IRUSR, S_IWUSR, S_IXUSR);
 536                 or_bits = unix_perms_to_acl_perms(or_bits, S_IRUSR, S_IWUSR, S_IXUSR);
 537                 break;
 538         case S_IRGRP:
 539                 and_bits = unix_perms_to_acl_perms(and_bits, S_IRGRP, S_IWGRP, S_IXGRP);
 540                 or_bits = unix_perms_to_acl_perms(or_bits, S_IRGRP, S_IWGRP, S_IXGRP);
 541                 break;
 542         case S_IROTH:
 543                 and_bits = unix_perms_to_acl_perms(and_bits, S_IROTH, S_IWOTH, S_IXOTH);
 544                 or_bits = unix_perms_to_acl_perms(or_bits, S_IROTH, S_IWOTH, S_IXOTH);
 545                 break;
 546         }
 547
 548         pace->perms = ((pace->perms & and_bits)|or_bits);
 549 }
 550
 551 /****************************************************************************
 552  Check if a given uid/SID is in a group gid/SID. This is probably very
 553  expensive and will need optimisation. A *lot* of optimisation :-). JRA.
 554 ****************************************************************************/
 555
 556 static BOOL uid_entry_in_group( canon_ace *uid_ace, canon_ace *group_ace )
 557 {
 558         extern DOM_SID global_sid_World;
 559         fstring u_name;
 560         fstring g_name;
 561         extern struct current_user current_user;
 562
 563         /* "Everyone" always matches every uid. */
 564
 565         if (sid_equal(&group_ace->trustee, &global_sid_World))
 566                 return True;
 567
 568         /* Assume that the current user is in the current group (force group) */
 569
 570         if (uid_ace->unix_ug.uid == current_user.uid && group_ace->unix_ug.gid == current_user.gid)
 571                 return True;
 572
 573         fstrcpy(u_name, uidtoname(uid_ace->unix_ug.uid));
 574         fstrcpy(g_name, gidtoname(group_ace->unix_ug.gid));
 575
 576         /*
 577          * Due to the winbind interfaces we need to do this via names,
 578          * not uids/gids.
 579          */
 580
 581         return user_in_group_list(u_name, g_name, NULL, 0);
 582 }
 583
 584 /****************************************************************************
 585  A well formed POSIX file or default ACL has at least 3 entries, a
 586  SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ.
 587  In addition, the owner must always have at least read access.
 588  When using this call on get_acl, the pst struct is valid and contains
 589  the mode of the file. When using this call on set_acl, the pst struct has
 590  been modified to have a mode containing the default for this file or directory
 591  type.
 592 ****************************************************************************/
 593
 594 static BOOL ensure_canon_entry_valid(canon_ace **pp_ace,
 595                                                         files_struct *fsp,
 596                                                         DOM_SID *pfile_owner_sid,
 597                                                         DOM_SID *pfile_grp_sid,
 598                                                         SMB_STRUCT_STAT *pst,
 599                                                         BOOL setting_acl)
 600 {
 601         extern DOM_SID global_sid_World;
 602         canon_ace *pace;
 603         BOOL got_user = False;
 604         BOOL got_grp = False;
 605         BOOL got_other = False;
 606         canon_ace *pace_other = NULL;
 607         canon_ace *pace_group = NULL;
 608
 609         for (pace = *pp_ace; pace; pace = pace->next) {
 610                 if (pace->type == SMB_ACL_USER_OBJ) {
 611
 612                         if (setting_acl)
 613                                 apply_default_perms(fsp, pace, S_IRUSR);
 614                         got_user = True;
 615
 616                 } else if (pace->type == SMB_ACL_GROUP_OBJ) {
 617
 618                         /*
 619                          * Ensure create mask/force create mode is respected on set.
 620                          */
 621
 622                         if (setting_acl)
 623                                 apply_default_perms(fsp, pace, S_IRGRP);
 624                         got_grp = True;
 625                         pace_group = pace;
 626
 627                 } else if (pace->type == SMB_ACL_OTHER) {
 628
 629                         /*
 630                          * Ensure create mask/force create mode is respected on set.
 631                          */
 632
 633                         if (setting_acl)
 634                                 apply_default_perms(fsp, pace, S_IROTH);
 635                         got_other = True;
 636                         pace_other = pace;
 637                 }
 638         }
 639
 640         if (!got_user) {
 641                 if ((pace = (canon_ace *)malloc(sizeof(canon_ace))) == NULL) {
 642                         DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
 643                         return False;
 644                 }
 645
 646                 ZERO_STRUCTP(pace);
 647                 pace->type = SMB_ACL_USER_OBJ;
 648                 pace->owner_type = UID_ACE;
 649                 pace->unix_ug.uid = pst->st_uid;
 650                 pace->trustee = *pfile_owner_sid;
 651                 pace->attr = ALLOW_ACE;
 652
 653                 if (setting_acl) {
 654                         /* If we only got an "everyone" perm, just use that. */
 655                         if (!got_grp && got_other)
 656                                 pace->perms = pace_other->perms;
 657                         else if (got_grp && uid_entry_in_group(pace, pace_group))
 658                                 pace->perms = pace_group->perms;
 659                         else
 660                                 pace->perms = 0;
 661
 662                         apply_default_perms(fsp, pace, S_IRUSR);
 663                 } else {
 664                         pace->perms = unix_perms_to_acl_perms(pst->st_mode, S_IRUSR, S_IWUSR, S_IXUSR);
 665                 }
 666
 667                 DLIST_ADD(*pp_ace, pace);
 668         }
 669
 670         if (!got_grp) {
 671                 if ((pace = (canon_ace *)malloc(sizeof(canon_ace))) == NULL) {
 672                         DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
 673                         return False;
 674                 }
 675
 676                 ZERO_STRUCTP(pace);
 677                 pace->type = SMB_ACL_GROUP_OBJ;
 678                 pace->owner_type = GID_ACE;
 679                 pace->unix_ug.uid = pst->st_gid;
 680                 pace->trustee = *pfile_grp_sid;
 681                 pace->attr = ALLOW_ACE;
 682                 if (setting_acl) {
 683                         /* If we only got an "everyone" perm, just use that. */
 684                         if (got_other)
 685                                 pace->perms = pace_other->perms;
 686                         else
 687                                 pace->perms = 0;
 688                         apply_default_perms(fsp, pace, S_IRGRP);
 689                 } else {
 690                         pace->perms = unix_perms_to_acl_perms(pst->st_mode, S_IRGRP, S_IWGRP, S_IXGRP);
 691                 }
 692
 693                 DLIST_ADD(*pp_ace, pace);
 694         }
 695
 696         if (!got_other) {
 697                 if ((pace = (canon_ace *)malloc(sizeof(canon_ace))) == NULL) {
 698                         DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
 699                         return False;
 700                 }
 701
 702                 ZERO_STRUCTP(pace);
 703                 pace->type = SMB_ACL_OTHER;
 704                 pace->owner_type = WORLD_ACE;
 705                 pace->unix_ug.world = -1;
 706                 pace->trustee = global_sid_World;
 707                 pace->attr = ALLOW_ACE;
 708                 if (setting_acl) {
 709                         pace->perms = 0;
 710                         apply_default_perms(fsp, pace, S_IROTH);
 711                 } else
 712                         pace->perms = unix_perms_to_acl_perms(pst->st_mode, S_IROTH, S_IWOTH, S_IXOTH);
 713
 714                 DLIST_ADD(*pp_ace, pace);
 715         }
 716
 717         return True;
 718 }
 719
 720 /****************************************************************************
 721  Check if a POSIX ACL has the required SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries.
 722  If it does not have them, check if there are any entries where the trustee is the
 723  file owner or the owning group, and map these to SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ.
 724 ****************************************************************************/
 725
 726 static void check_owning_objs(canon_ace *ace, DOM_SID *pfile_owner_sid, DOM_SID *pfile_grp_sid)
 727 {
 728         BOOL got_user_obj, got_group_obj;
 729         canon_ace *current_ace;
 730         int i, entries;
 731
 732         entries = count_canon_ace_list(ace);
 733         got_user_obj = False;
 734         got_group_obj = False;
 735
 736         for (i=0, current_ace = ace; i < entries; i++, current_ace = current_ace->next) {
 737                 if (current_ace->type == SMB_ACL_USER_OBJ)
 738                         got_user_obj = True;
 739                 else if (current_ace->type == SMB_ACL_GROUP_OBJ)
 740                         got_group_obj = True;
 741         }
 742         if (got_user_obj && got_group_obj) {
 743                 DEBUG(10,("check_owning_objs: ACL had owning user/group entries.\n"));
 744                 return;
 745         }
 746
 747         for (i=0, current_ace = ace; i < entries; i++, current_ace = current_ace->next) {
 748                 if (!got_user_obj && current_ace->owner_type == UID_ACE &&
 749                                 sid_equal(&current_ace->trustee, pfile_owner_sid)) {
 750                         current_ace->type = SMB_ACL_USER_OBJ;
 751                         got_user_obj = True;
 752                 }
 753                 if (!got_group_obj && current_ace->owner_type == GID_ACE &&
 754                                 sid_equal(&current_ace->trustee, pfile_grp_sid)) {
 755                         current_ace->type = SMB_ACL_GROUP_OBJ;
 756                         got_group_obj = True;
 757                 }
 758         }
 759         if (!got_user_obj)
 760                 DEBUG(10,("check_owning_objs: ACL is missing an owner entry.\n"));
 761         if (!got_group_obj)
 762                 DEBUG(10,("check_owning_objs: ACL is missing an owning group entry.\n"));
 763 }
 764
 765 /****************************************************************************
 766  Unpack a SEC_DESC into two canonical ace lists.
 767 ****************************************************************************/
 768
 769 static BOOL create_canon_ace_lists(files_struct *fsp,
 770                                                         DOM_SID *pfile_owner_sid,
 771                                                         DOM_SID *pfile_grp_sid,
 772                                                         canon_ace **ppfile_ace, canon_ace **ppdir_ace,
 773                                                         SEC_ACL *dacl)
 774 {
 775         extern DOM_SID global_sid_Creator_Owner;
 776         extern DOM_SID global_sid_Creator_Group;
 777         extern DOM_SID global_sid_World;
 778         extern struct generic_mapping file_generic_mapping;
 779         BOOL all_aces_are_inherit_only = (fsp->is_directory ? True : False);
 780         canon_ace *file_ace = NULL;
 781         canon_ace *dir_ace = NULL;
 782         canon_ace *tmp_ace = NULL;
 783         canon_ace *current_ace = NULL;
 784         BOOL got_dir_allow = False;
 785         BOOL got_file_allow = False;
 786         int i, j;
 787
 788         *ppfile_ace = NULL;
 789         *ppdir_ace = NULL;
 790
 791         /*
 792          * Convert the incoming ACL into a more regular form.
 793          */
 794
 795         for(i = 0; i < dacl->num_aces; i++) {
 796                 SEC_ACE *psa = &dacl->ace[i];
 797
 798                 if((psa->type != SEC_ACE_TYPE_ACCESS_ALLOWED) && (psa->type != SEC_ACE_TYPE_ACCESS_DENIED)) {
 799                         DEBUG(3,("create_canon_ace_lists: unable to set anything but an ALLOW or DENY ACE.\n"));
 800                         return False;
 801                 }
 802
 803                 if (nt4_compatible_acls()) {
 804                         /*
 805                          * The security mask may be UNIX_ACCESS_NONE which should map into
 806                          * no permissions (we overload the WRITE_OWNER bit for this) or it
 807                          * should be one of the ALL/EXECUTE/READ/WRITE bits. Arrange for this
 808                          * to be so. Any other bits override the UNIX_ACCESS_NONE bit.
 809                          */
 810
 811                         /*
 812                          * Convert GENERIC bits to specific bits.
 813                          */
 814
 815                         se_map_generic(&psa->info.mask, &file_generic_mapping);
 816
 817                         psa->info.mask &= (UNIX_ACCESS_NONE|FILE_ALL_ACCESS);
 818
 819                         if(psa->info.mask != UNIX_ACCESS_NONE)
 820                                 psa->info.mask &= ~UNIX_ACCESS_NONE;
 821                 }
 822         }
 823
 824         /*
 825          * Deal with the fact that NT 4.x re-writes the canonical format
 826          * that we return for default ACLs. If a directory ACE is identical
 827          * to a inherited directory ACE then NT changes the bits so that the
 828          * first ACE is set to OI|IO and the second ACE for this SID is set
 829          * to CI. We need to repair this. JRA.
 830          */
 831
 832         for(i = 0; i < dacl->num_aces; i++) {
 833                 SEC_ACE *psa1 = &dacl->ace[i];
 834
 835                 for (j = i + 1; j < dacl->num_aces; j++) {
 836                         SEC_ACE *psa2 = &dacl->ace[j];
 837
 838                         if (psa1->info.mask != psa2->info.mask)
 839                                 continue;
 840
 841                         if (!sid_equal(&psa1->trustee, &psa2->trustee))
 842                                 continue;
 843
 844                         /*
 845                          * Ok - permission bits and SIDs are equal.
 846                          * Check if flags were re-written.
 847                          */
 848
 849                         if (psa1->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
 850
 851                                 psa1->flags |= (psa2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT));
 852                                 psa2->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT);
 853
 854                         } else if (psa2->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
 855
 856                                 psa2->flags |= (psa1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT));
 857                                 psa1->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT);
 858
 859                         }
 860                 }
 861         }
 862
 863         for(i = 0; i < dacl->num_aces; i++) {
 864                 SEC_ACE *psa = &dacl->ace[i];
 865
 866                 /*
 867                  * Ignore non-mappable SIDs (NT Authority, BUILTIN etc).
 868                  */
 869
 870                 if (non_mappable_sid(&psa->trustee)) {
 871                         fstring str;
 872                         DEBUG(10,("create_canon_ace_lists: ignoring non-mappable SID %s\n",
 873                                 sid_to_string(str, &psa->trustee) ));
 874                         continue;
 875                 }
 876
 877                 /*
 878                  * Create a cannon_ace entry representing this NT DACL ACE.
 879                  */
 880
 881                 if ((current_ace = (canon_ace *)malloc(sizeof(canon_ace))) == NULL) {
 882                         free_canon_ace_list(file_ace);
 883                         free_canon_ace_list(dir_ace);
 884                         DEBUG(0,("create_canon_ace_lists: malloc fail.\n"));
 885                         return False;
 886                 }
 887
 888                 ZERO_STRUCTP(current_ace);
 889
 890                 sid_copy(&current_ace->trustee, &psa->trustee);
 891
 892                 /*
 893                  * Try and work out if the SID is a user or group
 894                  * as we need to flag these differently for POSIX.
 895                  * Note what kind of a POSIX ACL this should map to.
 896                  */
 897
 898                 if( sid_equal(&current_ace->trustee, &global_sid_World)) {
 899                         current_ace->owner_type = WORLD_ACE;
 900                         current_ace->unix_ug.world = -1;
 901                         current_ace->type = SMB_ACL_OTHER;
 902                 } else if (sid_equal(&current_ace->trustee, &global_sid_Creator_Owner)) {
 903                         current_ace->owner_type = UID_ACE;
 904                         current_ace->unix_ug.world = -1;
 905                         current_ace->type = SMB_ACL_USER_OBJ;
 906
 907                         /*
 908                          * The Creator Owner entry only specifies inheritable permissions,
 909                          * never access permissions. WinNT doesn't always set the ACE to
 910                          *INHERIT_ONLY, though.
 911                          */
 912
 913                         if (nt4_compatible_acls())
 914                                 psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
 915                 } else if (sid_equal(&current_ace->trustee, &global_sid_Creator_Group)) {
 916                         current_ace->owner_type = GID_ACE;
 917                         current_ace->unix_ug.world = -1;
 918                         current_ace->type = SMB_ACL_GROUP_OBJ;
 919
 920                         /*
 921                          * The Creator Group entry only specifies inheritable permissions,
 922                          * never access permissions. WinNT doesn't always set the ACE to
 923                          *INHERIT_ONLY, though.
 924                          */
 925                         if (nt4_compatible_acls())
 926                                 psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
 927
 928                 } else if (NT_STATUS_IS_OK(sid_to_gid( &current_ace->trustee, &current_ace->unix_ug.gid))) {
 929                         current_ace->owner_type = GID_ACE;
 930                         current_ace->type = SMB_ACL_GROUP;
 931                 } else if (NT_STATUS_IS_OK(sid_to_uid( &current_ace->trustee, &current_ace->unix_ug.uid))) {
 932                         current_ace->owner_type = UID_ACE;
 933                         current_ace->type = SMB_ACL_USER;
 934                 } else {
 935                         fstring str;
 936
 937                         free_canon_ace_list(file_ace);
 938                         free_canon_ace_list(dir_ace);
 939                         DEBUG(0,("create_canon_ace_lists: unable to map SID %s to uid or gid.\n",
 940                                 sid_to_string(str, &current_ace->trustee) ));
 941                         SAFE_FREE(current_ace);
 942                         return False;
 943                 }
 944
 945                 /*
 946                  * Map the given NT permissions into a UNIX mode_t containing only
 947                  * S_I(R|W|X)USR bits.
 948                  */
 949
 950                 current_ace->perms |= map_nt_perms( psa->info, S_IRUSR);
 951                 current_ace->attr = (psa->type == SEC_ACE_TYPE_ACCESS_ALLOWED) ? ALLOW_ACE : DENY_ACE;
 952
 953                 /*
 954                  * Now add the created ace to either the file list, the directory
 955                  * list, or both. We *MUST* preserve the order here (hence we use
 956                  * DLIST_ADD_END) as NT ACLs are order dependent.
 957                  */
 958
 959                 if (fsp->is_directory) {
 960
 961                         /*
 962                          * We can only add to the default POSIX ACE list if the ACE is
 963                          * designed to be inherited by both files and directories.
 964                          */
 965
 966                         if ((psa->flags & (SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT)) ==
 967                                 (SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT)) {
 968
 969                                 DLIST_ADD_END(dir_ace, current_ace, tmp_ace);
 970
 971                                 /*
 972                                  * Note if this was an allow ace. We can't process
 973                                  * any further deny ace's after this.
 974                                  */
 975
 976                                 if (current_ace->attr == ALLOW_ACE)
 977                                         got_dir_allow = True;
 978
 979                                 if ((current_ace->attr == DENY_ACE) && got_dir_allow) {
 980                                         DEBUG(0,("create_canon_ace_lists: malformed ACL in inheritable ACL ! \
 981 Deny entry after Allow entry. Failing to set on file %s.\n", fsp->fsp_name ));
 982                                         free_canon_ace_list(file_ace);
 983                                         free_canon_ace_list(dir_ace);
 984                                         SAFE_FREE(current_ace);
 985                                         return False;
 986                                 }
 987
 988                                 if( DEBUGLVL( 10 )) {
 989                                         dbgtext("create_canon_ace_lists: adding dir ACL:\n");
 990                                         print_canon_ace( current_ace, 0);
 991                                 }
 992
 993                                 /*
 994                                  * If this is not an inherit only ACE we need to add a duplicate
 995                                  * to the file acl.
 996                                  */
 997
 998                                 if (!(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
 999                                         canon_ace *dup_ace = dup_canon_ace(current_ace);
1000
1001                                         if (!dup_ace) {
1002                                                 DEBUG(0,("create_canon_ace_lists: malloc fail !\n"));
1003                                                 free_canon_ace_list(file_ace);
1004                                                 free_canon_ace_list(dir_ace);
1005                                                 return False;
1006                                         }
1007
1008                                         /*
1009                                          * We must not free current_ace here as its
1010                                          * pointer is now owned by the dir_ace list.
1011                                          */
1012                                         current_ace = dup_ace;
1013                                 } else {
1014                                         /*
1015                                          * We must not free current_ace here as its
1016                                          * pointer is now owned by the dir_ace list.
1017                                          */
1018                                         current_ace = NULL;
1019                                 }
1020                         }
1021                 }
1022
1023                 /*
1024                  * Only add to the file ACL if not inherit only.
1025                  */
1026
1027                 if (!(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
1028                         DLIST_ADD_END(file_ace, current_ace, tmp_ace);
1029
1030                         /*
1031                          * Note if this was an allow ace. We can't process
1032                          * any further deny ace's after this.
1033                          */
1034
1035                         if (current_ace->attr == ALLOW_ACE)
1036                                 got_file_allow = True;
1037
1038                         if ((current_ace->attr == DENY_ACE) && got_file_allow) {
1039                                 DEBUG(0,("create_canon_ace_lists: malformed ACL in file ACL ! \
1040 Deny entry after Allow entry. Failing to set on file %s.\n", fsp->fsp_name ));
1041                                 free_canon_ace_list(file_ace);
1042                                 free_canon_ace_list(dir_ace);
1043                                 SAFE_FREE(current_ace);
1044                                 return False;
1045                         }
1046
1047                         if( DEBUGLVL( 10 )) {
1048                                 dbgtext("create_canon_ace_lists: adding file ACL:\n");
1049                                 print_canon_ace( current_ace, 0);
1050                         }
1051                         all_aces_are_inherit_only = False;
1052                         /*
1053                          * We must not free current_ace here as its
1054                          * pointer is now owned by the file_ace list.
1055                          */
1056                         current_ace = NULL;
1057                 }
1058
1059                 /*
1060                  * Free if ACE was not added.
1061                  */
1062
1063                 SAFE_FREE(current_ace);
1064         }
1065
1066         if (fsp->is_directory && all_aces_are_inherit_only) {
1067                 /*
1068                  * Windows 2000 is doing one of these weird 'inherit acl'
1069                  * traverses to conserve NTFS ACL resources. Just pretend
1070                  * there was no DACL sent. JRA.
1071                  */
1072
1073                 DEBUG(10,("create_canon_ace_lists: Win2k inherit acl traverse. Ignoring DACL.\n"));
1074                 free_canon_ace_list(file_ace);
1075                 free_canon_ace_list(dir_ace);
1076                 file_ace = NULL;
1077                 dir_ace = NULL;
1078         } else {
1079                 /*
1080                  * Check if we have SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries in each
1081                  * ACL. If we don't have them, check if any SMB_ACL_USER/SMB_ACL_GROUP
1082                  * entries can be converted to *_OBJ. Usually we will already have these
1083                  * entries in the Default ACL, and the Access ACL will not have them.
1084                  */
1085                 check_owning_objs(file_ace, pfile_owner_sid, pfile_grp_sid);
1086                 check_owning_objs(dir_ace, pfile_owner_sid, pfile_grp_sid);
1087         }
1088
1089         *ppfile_ace = file_ace;
1090         *ppdir_ace = dir_ace;
1091
1092         return True;
1093 }
1094
1095 /****************************************************************************
1096  ASCII art time again... JRA :-).
1097
1098  We have 4 cases to process when moving from an NT ACL to a POSIX ACL. Firstly,
1099  we insist the ACL is in canonical form (ie. all DENY entries preceede ALLOW
1100  entries). Secondly, the merge code has ensured that all duplicate SID entries for
1101  allow or deny have been merged, so the same SID can only appear once in the deny
1102  list or once in the allow list.
1103
1104  We then process as follows :
1105
1106  ---------------------------------------------------------------------------
1107  First pass - look for a Everyone DENY entry.
1108
1109  If it is deny all (rwx) trunate the list at this point.
1110  Else, walk the list from this point and use the deny permissions of this
1111  entry as a mask on all following allow entries. Finally, delete
1112  the Everyone DENY entry (we have applied it to everything possible).
1113
1114  In addition, in this pass we remove any DENY entries that have
1115  no permissions (ie. they are a DENY nothing).
1116  ---------------------------------------------------------------------------
1117  Second pass - only deal with deny user entries.
1118
1119  DENY user1 (perms XXX)
1120
1121  new_perms = 0
1122  for all following allow group entries where user1 is in group
1123         new_perms |= group_perms;
1124
1125  user1 entry perms = new_perms & ~ XXX;
1126
1127  Convert the deny entry to an allow entry with the new perms and
1128  push to the end of the list. Note if the user was in no groups
1129  this maps to a specific allow nothing entry for this user.
1130
1131  The common case from the NT ACL choser (userX deny all) is
1132  optimised so we don't do the group lookup - we just map to
1133  an allow nothing entry.
1134
1135  What we're doing here is inferring the allow permissions the
1136  person setting the ACE on user1 wanted by looking at the allow
1137  permissions on the groups the user is currently in. This will
1138  be a snapshot, depending on group membership but is the best
1139  we can do and has the advantage of failing closed rather than
1140  open.
1141  ---------------------------------------------------------------------------
1142  Third pass - only deal with deny group entries.
1143
1144  DENY group1 (perms XXX)
1145
1146  for all following allow user entries where user is in group1
1147    user entry perms = user entry perms & ~ XXX;
1148
1149  If there is a group Everyone allow entry with permissions YYY,
1150  convert the group1 entry to an allow entry and modify its
1151  permissions to be :
1152
1153  new_perms = YYY & ~ XXX
1154
1155  and push to the end of the list.
1156
1157  If there is no group Everyone allow entry then convert the
1158  group1 entry to a allow nothing entry and push to the end of the list.
1159
1160  Note that the common case from the NT ACL choser (groupX deny all)
1161  cannot be optimised here as we need to modify user entries who are
1162  in the group to change them to a deny all also.
1163
1164  What we're doing here is modifying the allow permissions of
1165  user entries (which are more specific in POSIX ACLs) to mask
1166  out the explicit deny set on the group they are in. This will
1167  be a snapshot depending on current group membership but is the
1168  best we can do and has the advantage of failing closed rather
1169  than open.
1170  ---------------------------------------------------------------------------
1171  Fourth pass - cope with cumulative permissions.
1172
1173  for all allow user entries, if there exists an allow group entry with
1174  more permissive permissions, and the user is in that group, rewrite the
1175  allow user permissions to contain both sets of permissions.
1176
1177  Currently the code for this is #ifdef'ed out as these semantics make
1178  no sense to me. JRA.
1179  ---------------------------------------------------------------------------
1180
1181  Note we *MUST* do the deny user pass first as this will convert deny user
1182  entries into allow user entries which can then be processed by the deny
1183  group pass.
1184
1185  The above algorithm took a *lot* of thinking about - hence this
1186  explaination :-). JRA.
1187 ****************************************************************************/
1188
1189 /****************************************************************************
1190  Process a canon_ace list entries. This is very complex code. We need
1191  to go through and remove the "deny" permissions from any allow entry that matches
1192  the id of this entry. We have already refused any NT ACL that wasn't in correct
1193  order (DENY followed by ALLOW). If any allow entry ends up with zero permissions,
1194  we just remove it (to fail safe). We have already removed any duplicate ace
1195  entries. Treat an "Everyone" DENY_ACE as a special case - use it to mask all
1196  allow entries.
1197 ****************************************************************************/
1198
1199 static void process_deny_list( canon_ace **pp_ace_list )
1200 {
1201         extern DOM_SID global_sid_World;
1202         canon_ace *ace_list = *pp_ace_list;
1203         canon_ace *curr_ace = NULL;
1204         canon_ace *curr_ace_next = NULL;
1205
1206         /* Pass 1 above - look for an Everyone, deny entry. */
1207
1208         for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
1209                 canon_ace *allow_ace_p;
1210
1211                 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
1212
1213                 if (curr_ace->attr != DENY_ACE)
1214                         continue;
1215
1216                 if (curr_ace->perms == (mode_t)0) {
1217
1218                         /* Deny nothing entry - delete. */
1219
1220                         DLIST_REMOVE(ace_list, curr_ace);
1221                         continue;
1222                 }
1223
1224                 if (!sid_equal(&curr_ace->trustee, &global_sid_World))
1225                         continue;
1226
1227                 /* JRATEST - assert. */
1228                 SMB_ASSERT(curr_ace->owner_type == WORLD_ACE);
1229
1230                 if (curr_ace->perms == ALL_ACE_PERMS) {
1231
1232                         /*
1233                          * Optimisation. This is a DENY_ALL to Everyone. Truncate the
1234                          * list at this point including this entry.
1235                          */
1236
1237                         canon_ace *prev_entry = curr_ace->prev;
1238
1239                         free_canon_ace_list( curr_ace );
1240                         if (prev_entry)
1241                                 prev_entry->next = NULL;
1242                         else {
1243                                 /* We deleted the entire list. */
1244                                 ace_list = NULL;
1245                         }
1246                         break;
1247                 }
1248
1249                 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
1250
1251                         /*
1252                          * Only mask off allow entries.
1253                          */
1254
1255                         if (allow_ace_p->attr != ALLOW_ACE)
1256                                 continue;
1257
1258                         allow_ace_p->perms &= ~curr_ace->perms;
1259                 }
1260
1261                 /*
1262                  * Now it's been applied, remove it.
1263                  */
1264
1265                 DLIST_REMOVE(ace_list, curr_ace);
1266         }
1267
1268         /* Pass 2 above - deal with deny user entries. */
1269
1270         for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
1271                 mode_t new_perms = (mode_t)0;
1272                 canon_ace *allow_ace_p;
1273                 canon_ace *tmp_ace;
1274
1275                 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
1276
1277                 if (curr_ace->attr != DENY_ACE)
1278                         continue;
1279
1280                 if (curr_ace->owner_type != UID_ACE)
1281                         continue;
1282
1283                 if (curr_ace->perms == ALL_ACE_PERMS) {
1284
1285                         /*
1286                          * Optimisation - this is a deny everything to this user.
1287                          * Convert to an allow nothing and push to the end of the list.
1288                          */
1289
1290                         curr_ace->attr = ALLOW_ACE;
1291                         curr_ace->perms = (mode_t)0;
1292                         DLIST_DEMOTE(ace_list, curr_ace, tmp_ace);
1293                         continue;
1294                 }
1295
1296                 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
1297
1298                         if (allow_ace_p->attr != ALLOW_ACE)
1299                                 continue;
1300
1301                         /* We process GID_ACE and WORLD_ACE entries only. */
1302
1303                         if (allow_ace_p->owner_type == UID_ACE)
1304                                 continue;
1305
1306                         if (uid_entry_in_group( curr_ace, allow_ace_p))
1307                                 new_perms |= allow_ace_p->perms;
1308                 }
1309
1310                 /*
1311                  * Convert to a allow entry, modify the perms and push to the end
1312                  * of the list.
1313                  */
1314
1315                 curr_ace->attr = ALLOW_ACE;
1316                 curr_ace->perms = (new_perms & ~curr_ace->perms);
1317                 DLIST_DEMOTE(ace_list, curr_ace, tmp_ace);
1318         }
1319
1320         /* Pass 3 above - deal with deny group entries. */
1321
1322         for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
1323                 canon_ace *tmp_ace;
1324                 canon_ace *allow_ace_p;
1325                 canon_ace *allow_everyone_p = NULL;
1326
1327                 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
1328
1329                 if (curr_ace->attr != DENY_ACE)
1330                         continue;
1331
1332                 if (curr_ace->owner_type != GID_ACE)
1333                         continue;
1334
1335                 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
1336
1337                         if (allow_ace_p->attr != ALLOW_ACE)
1338                                 continue;
1339
1340                         /* Store a pointer to the Everyone allow, if it exists. */
1341                         if (allow_ace_p->owner_type == WORLD_ACE)
1342                                 allow_everyone_p = allow_ace_p;
1343
1344                         /* We process UID_ACE entries only. */
1345
1346                         if (allow_ace_p->owner_type != UID_ACE)
1347                                 continue;
1348
1349                         /* Mask off the deny group perms. */
1350
1351                         if (uid_entry_in_group( allow_ace_p, curr_ace))
1352                                 allow_ace_p->perms &= ~curr_ace->perms;
1353                 }
1354
1355                 /*
1356                  * Convert the deny to an allow with the correct perms and
1357                  * push to the end of the list.
1358                  */
1359
1360                 curr_ace->attr = ALLOW_ACE;
1361                 if (allow_everyone_p)
1362                         curr_ace->perms = allow_everyone_p->perms & ~curr_ace->perms;
1363                 else
1364                         curr_ace->perms = (mode_t)0;
1365                 DLIST_DEMOTE(ace_list, curr_ace, tmp_ace);
1366
1367         }
1368
1369         /* Doing this fourth pass allows Windows semantics to be layered
1370          * on top of POSIX semantics. I'm not sure if this is desirable.
1371          * For example, in W2K ACLs there is no way to say, "Group X no
1372          * access, user Y full access" if user Y is a member of group X.
1373          * This seems completely broken semantics to me.... JRA.
1374          */
1375
1376 #if 0
1377         /* Pass 4 above - deal with allow entries. */
1378
1379         for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
1380                 canon_ace *allow_ace_p;
1381
1382                 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
1383
1384                 if (curr_ace->attr != ALLOW_ACE)
1385                         continue;
1386
1387                 if (curr_ace->owner_type != UID_ACE)
1388                         continue;
1389
1390                 for (allow_ace_p = ace_list; allow_ace_p; allow_ace_p = allow_ace_p->next) {
1391
1392                         if (allow_ace_p->attr != ALLOW_ACE)
1393                                 continue;
1394
1395                         /* We process GID_ACE entries only. */
1396
1397                         if (allow_ace_p->owner_type != GID_ACE)
1398                                 continue;
1399
1400                         /* OR in the group perms. */
1401
1402                         if (uid_entry_in_group( curr_ace, allow_ace_p))
1403                                 curr_ace->perms |= allow_ace_p->perms;
1404                 }
1405         }
1406 #endif
1407
1408         *pp_ace_list = ace_list;
1409 }
1410
1411 /****************************************************************************
1412  Create a default mode that will be used if a security descriptor entry has
1413  no user/group/world entries.
1414 ****************************************************************************/
1415
1416 static mode_t create_default_mode(files_struct *fsp, BOOL interitable_mode)
1417 {
1418         int snum = SNUM(fsp->conn);
1419         mode_t and_bits = (mode_t)0;
1420         mode_t or_bits = (mode_t)0;
1421         mode_t mode = interitable_mode ? unix_mode( fsp->conn, FILE_ATTRIBUTE_ARCHIVE, fsp->fsp_name) : S_IRUSR;
1422
1423         if (fsp->is_directory)
1424                 mode |= (S_IWUSR|S_IXUSR);
1425
1426         /*
1427          * Now AND with the create mode/directory mode bits then OR with the
1428          * force create mode/force directory mode bits.
1429          */
1430
1431         if (fsp->is_directory) {
1432                 and_bits = lp_dir_security_mask(snum);
1433                 or_bits = lp_force_dir_security_mode(snum);
1434         } else {
1435                 and_bits = lp_security_mask(snum);
1436                 or_bits = lp_force_security_mode(snum);
1437         }
1438
1439         return ((mode & and_bits)|or_bits);
1440 }
1441
1442 /****************************************************************************
1443  Unpack a SEC_DESC into two canonical ace lists. We don't depend on this
1444  succeeding.
1445 ****************************************************************************/
1446
1447 static BOOL unpack_canon_ace(files_struct *fsp,
1448                                                         SMB_STRUCT_STAT *pst,
1449                                                         DOM_SID *pfile_owner_sid,
1450                                                         DOM_SID *pfile_grp_sid,
1451                                                         canon_ace **ppfile_ace, canon_ace **ppdir_ace,
1452                                                         uint32 security_info_sent, SEC_DESC *psd)
1453 {
1454         canon_ace *file_ace = NULL;
1455         canon_ace *dir_ace = NULL;
1456
1457         *ppfile_ace = NULL;
1458         *ppdir_ace = NULL;
1459
1460         if(security_info_sent == 0) {
1461                 DEBUG(0,("unpack_canon_ace: no security info sent !\n"));
1462                 return False;
1463         }
1464
1465         /*
1466          * If no DACL then this is a chown only security descriptor.
1467          */
1468
1469         if(!(security_info_sent & DACL_SECURITY_INFORMATION) || !psd->dacl)
1470                 return True;
1471
1472         /*
1473          * Now go through the DACL and create the canon_ace lists.
1474          */
1475
1476         if (!create_canon_ace_lists( fsp, pfile_owner_sid, pfile_grp_sid,
1477                                                                 &file_ace, &dir_ace, psd->dacl))
1478                 return False;
1479
1480         if ((file_ace == NULL) && (dir_ace == NULL)) {
1481                 /* W2K traverse DACL set - ignore. */
1482                 return True;
1483         }
1484
1485         /*
1486          * Go through the canon_ace list and merge entries
1487          * belonging to identical users of identical allow or deny type.
1488          * We can do this as all deny entries come first, followed by
1489          * all allow entries (we have mandated this before accepting this acl).
1490          */
1491
1492         print_canon_ace_list( "file ace - before merge", file_ace);
1493         merge_aces( &file_ace );
1494
1495         print_canon_ace_list( "dir ace - before merge", dir_ace);
1496         merge_aces( &dir_ace );
1497
1498         /*
1499          * NT ACLs are order dependent. Go through the acl lists and
1500          * process DENY entries by masking the allow entries.
1501          */
1502
1503         print_canon_ace_list( "file ace - before deny", file_ace);
1504         process_deny_list( &file_ace);
1505
1506         print_canon_ace_list( "dir ace - before deny", dir_ace);
1507         process_deny_list( &dir_ace);
1508
1509         /*
1510          * A well formed POSIX file or default ACL has at least 3 entries, a
1511          * SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ
1512          * and optionally a mask entry. Ensure this is the case.
1513          */
1514
1515         print_canon_ace_list( "file ace - before valid", file_ace);
1516
1517         /*
1518          * A default 3 element mode entry for a file should be r-- --- ---.
1519          * A default 3 element mode entry for a directory should be rwx --- ---.
1520          */
1521
1522         pst->st_mode = create_default_mode(fsp, False);
1523
1524         if (!ensure_canon_entry_valid(&file_ace, fsp, pfile_owner_sid, pfile_grp_sid, pst, True)) {
1525                 free_canon_ace_list(file_ace);
1526                 free_canon_ace_list(dir_ace);
1527                 return False;
1528         }
1529
1530         print_canon_ace_list( "dir ace - before valid", dir_ace);
1531
1532         /*
1533          * A default inheritable 3 element mode entry for a directory should be the
1534          * mode Samba will use to create a file within. Ensure user rwx bits are set if
1535          * it's a directory.
1536          */
1537
1538         pst->st_mode = create_default_mode(fsp, True);
1539
1540         if (dir_ace && !ensure_canon_entry_valid(&dir_ace, fsp, pfile_owner_sid, pfile_grp_sid, pst, True)) {
1541                 free_canon_ace_list(file_ace);
1542                 free_canon_ace_list(dir_ace);
1543                 return False;
1544         }
1545
1546         print_canon_ace_list( "file ace - return", file_ace);
1547         print_canon_ace_list( "dir ace - return", dir_ace);
1548
1549         *ppfile_ace = file_ace;
1550         *ppdir_ace = dir_ace;
1551         return True;
1552
1553 }
1554
1555 /******************************************************************************
1556  When returning permissions, try and fit NT display
1557  semantics if possible. Note the the canon_entries here must have been malloced.
1558  The list format should be - first entry = owner, followed by group and other user
1559  entries, last entry = other.
1560
1561  Note that this doesn't exactly match the NT semantics for an ACL. As POSIX entries
1562  are not ordered, and match on the most specific entry rather than walking a list,
1563  then a simple POSIX permission of rw-r--r-- should really map to 5 entries,
1564
1565  Entry 0: owner : deny all except read and write.
1566  Entry 1: group : deny all except read.
1567  Entry 2: owner : allow read and write.
1568  Entry 3: group : allow read.
1569  Entry 4: Everyone : allow read.
1570
1571  But NT cannot display this in their ACL editor !
1572 ********************************************************************************/
1573
1574 static void arrange_posix_perms( char *filename, canon_ace **pp_list_head)
1575 {
1576         canon_ace *list_head = *pp_list_head;
1577         canon_ace *owner_ace = NULL;
1578         canon_ace *other_ace = NULL;
1579         canon_ace *ace = NULL;
1580
1581         for (ace = list_head; ace; ace = ace->next) {
1582                 if (ace->type == SMB_ACL_USER_OBJ)
1583                         owner_ace = ace;
1584                 else if (ace->type == SMB_ACL_OTHER) {
1585                         /* Last ace - this is "other" */
1586                         other_ace = ace;
1587                 }
1588         }
1589
1590         if (!owner_ace || !other_ace) {
1591                 DEBUG(0,("arrange_posix_perms: Invalid POSIX permissions for file %s, missing owner or other.\n",
1592                         filename ));
1593                 return;
1594         }
1595
1596         /*
1597          * The POSIX algorithm applies to owner first, and other last,
1598          * so ensure they are arranged in this order.
1599          */
1600
1601         if (owner_ace) {
1602                 DLIST_PROMOTE(list_head, owner_ace);
1603         }
1604
1605         if (other_ace) {
1606                 DLIST_DEMOTE(list_head, other_ace, ace);
1607         }
1608
1609         /* We have probably changed the head of the list. */
1610
1611         *pp_list_head = list_head;
1612 }
1613
1614 /****************************************************************************
1615  Create a linked list of canonical ACE entries.
1616 ****************************************************************************/
1617
1618 static canon_ace *canonicalise_acl( files_struct *fsp, SMB_ACL_T posix_acl, SMB_STRUCT_STAT *psbuf,
1619                                         DOM_SID *powner, DOM_SID *pgroup, SMB_ACL_TYPE_T the_acl_type)
1620 {
1621         extern DOM_SID global_sid_World;
1622         connection_struct *conn = fsp->conn;
1623         mode_t acl_mask = (S_IRUSR|S_IWUSR|S_IXUSR);
1624         canon_ace *list_head = NULL;
1625         canon_ace *ace = NULL;
1626         canon_ace *next_ace = NULL;
1627         int entry_id = SMB_ACL_FIRST_ENTRY;
1628         SMB_ACL_ENTRY_T entry;
1629         size_t ace_count;
1630
1631         while ( posix_acl && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1)) {
1632                 SMB_ACL_TAG_T tagtype;
1633                 SMB_ACL_PERMSET_T permset;
1634                 DOM_SID sid;
1635                 posix_id unix_ug;
1636                 enum ace_owner owner_type;
1637
1638                 /* get_next... */
1639                 if (entry_id == SMB_ACL_FIRST_ENTRY)
1640                         entry_id = SMB_ACL_NEXT_ENTRY;
1641
1642                 /* Is this a MASK entry ? */
1643                 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1)
1644                         continue;
1645
1646                 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1)
1647                         continue;
1648
1649                 /* Decide which SID to use based on the ACL type. */
1650                 switch(tagtype) {
1651                         case SMB_ACL_USER_OBJ:
1652                                 /* Get the SID from the owner. */
1653                                 sid_copy(&sid, powner);
1654                                 unix_ug.uid = psbuf->st_uid;
1655                                 owner_type = UID_ACE;
1656                                 break;
1657                         case SMB_ACL_USER:
1658                                 {
1659                                         uid_t *puid = (uid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
1660                                         if (puid == NULL) {
1661                                                 DEBUG(0,("canonicalise_acl: Failed to get uid.\n"));
1662                                                 continue;
1663                                         }
1664                                         /*
1665                                          * A SMB_ACL_USER entry for the owner is shadowed by the
1666                                          * SMB_ACL_USER_OBJ entry and Windows also cannot represent
1667                                          * that entry, so we ignore it. We also don't create such
1668                                          * entries out of the blue when setting ACLs, so a get/set
1669                                          * cycle will drop them.
1670                                          */
1671                                         if (the_acl_type == SMB_ACL_TYPE_ACCESS && *puid == psbuf->st_uid)
1672                                                 continue;
1673                                         uid_to_sid( &sid, *puid);
1674                                         unix_ug.uid = *puid;
1675                                         owner_type = UID_ACE;
1676                                         SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)puid,tagtype);
1677                                         break;
1678                                 }
1679                         case SMB_ACL_GROUP_OBJ:
1680                                 /* Get the SID from the owning group. */
1681                                 sid_copy(&sid, pgroup);
1682                                 unix_ug.gid = psbuf->st_gid;
1683                                 owner_type = GID_ACE;
1684                                 break;
1685                         case SMB_ACL_GROUP:
1686                                 {
1687                                         gid_t *pgid = (gid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
1688                                         if (pgid == NULL) {
1689                                                 DEBUG(0,("canonicalise_acl: Failed to get gid.\n"));
1690                                                 continue;
1691                                         }
1692                                         gid_to_sid( &sid, *pgid);
1693                                         unix_ug.gid = *pgid;
1694                                         owner_type = GID_ACE;
1695                                         SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)pgid,tagtype);
1696                                         break;
1697                                 }
1698                         case SMB_ACL_MASK:
1699                                 acl_mask = convert_permset_to_mode_t(conn, permset);
1700                                 continue; /* Don't count the mask as an entry. */
1701                         case SMB_ACL_OTHER:
1702                                 /* Use the Everyone SID */
1703                                 sid = global_sid_World;
1704                                 unix_ug.world = -1;
1705                                 owner_type = WORLD_ACE;
1706                                 break;
1707                         default:
1708                                 DEBUG(0,("canonicalise_acl: Unknown tagtype %u\n", (unsigned int)tagtype));
1709                                 continue;
1710                 }
1711
1712                 /*
1713                  * Add this entry to the list.
1714                  */
1715
1716                 if ((ace = (canon_ace *)malloc(sizeof(canon_ace))) == NULL)
1717                         goto fail;
1718
1719                 ZERO_STRUCTP(ace);
1720                 ace->type = tagtype;
1721                 ace->perms = convert_permset_to_mode_t(conn, permset);
1722                 ace->attr = ALLOW_ACE;
1723                 ace->trustee = sid;
1724                 ace->unix_ug = unix_ug;
1725                 ace->owner_type = owner_type;
1726
1727                 DLIST_ADD(list_head, ace);
1728         }
1729
1730         /*
1731          * This next call will ensure we have at least a user/group/world set.
1732          */
1733
1734         if (!ensure_canon_entry_valid(&list_head, fsp, powner, pgroup, psbuf, False))
1735                 goto fail;
1736
1737         arrange_posix_perms(fsp->fsp_name,&list_head );
1738
1739         /*
1740          * Now go through the list, masking the permissions with the
1741          * acl_mask. Ensure all DENY Entries are at the start of the list.
1742          */
1743
1744         DEBUG(10,("canonicalise_acl: ace entries before arrange :\n"));
1745
1746         for ( ace_count = 0, ace = list_head; ace; ace = next_ace, ace_count++) {
1747                 next_ace = ace->next;
1748
1749                 /* Masks are only applied to entries other than USER_OBJ and OTHER. */
1750                 if (ace->type != SMB_ACL_OTHER && ace->type != SMB_ACL_USER_OBJ)
1751                         ace->perms &= acl_mask;
1752
1753                 if (ace->perms == 0) {
1754                         DLIST_PROMOTE(list_head, ace);
1755                 }
1756
1757                 if( DEBUGLVL( 10 ) ) {
1758                         print_canon_ace(ace, ace_count);
1759                 }
1760         }
1761
1762         print_canon_ace_list( "canonicalise_acl: ace entries after arrange", list_head );
1763
1764         return list_head;
1765
1766   fail:
1767
1768         free_canon_ace_list(list_head);
1769         return NULL;
1770 }
1771
1772 /****************************************************************************
1773  Attempt to apply an ACL to a file or directory.
1774 ****************************************************************************/
1775
1776 static BOOL set_canon_ace_list(files_struct *fsp, canon_ace *the_ace, BOOL default_ace, BOOL *pacl_set_support)
1777 {
1778         connection_struct *conn = fsp->conn;
1779         BOOL ret = False;
1780         SMB_ACL_T the_acl = SMB_VFS_SYS_ACL_INIT(conn, (int)count_canon_ace_list(the_ace) + 1);
1781         canon_ace *p_ace;
1782         int i;
1783         SMB_ACL_ENTRY_T mask_entry;
1784         BOOL got_mask_entry = False;
1785         SMB_ACL_PERMSET_T mask_permset;
1786         SMB_ACL_TYPE_T the_acl_type = (default_ace ? SMB_ACL_TYPE_DEFAULT : SMB_ACL_TYPE_ACCESS);
1787         BOOL needs_mask = False;
1788         mode_t mask_perms = 0;
1789
1790 #if defined(POSIX_ACL_NEEDS_MASK)
1791         /* HP-UX always wants to have a mask (called "class" there). */
1792         needs_mask = True;
1793 #endif
1794
1795         if (the_acl == NULL) {
1796
1797                 if (errno != ENOSYS) {
1798                         /*
1799                          * Only print this error message if we have some kind of ACL
1800                          * support that's not working. Otherwise we would always get this.
1801                          */
1802                         DEBUG(0,("set_canon_ace_list: Unable to init %s ACL. (%s)\n",
1803                                 default_ace ? "default" : "file", strerror(errno) ));
1804                 }
1805                 *pacl_set_support = False;
1806                 return False;
1807         }
1808
1809         if( DEBUGLVL( 10 )) {
1810                 dbgtext("set_canon_ace_list: setting ACL:\n");
1811                 for (i = 0, p_ace = the_ace; p_ace; p_ace = p_ace->next, i++ ) {
1812                         print_canon_ace( p_ace, i);
1813                 }
1814         }
1815
1816         for (i = 0, p_ace = the_ace; p_ace; p_ace = p_ace->next, i++ ) {
1817                 SMB_ACL_ENTRY_T the_entry;
1818                 SMB_ACL_PERMSET_T the_permset;
1819
1820                 /*
1821                  * ACLs only "need" an ACL_MASK entry if there are any named user or
1822                  * named group entries. But if there is an ACL_MASK entry, it applies
1823                  * to ACL_USER, ACL_GROUP, and ACL_GROUP_OBJ entries. Set the mask
1824                  * so that it doesn't deny (i.e., mask off) any permissions.
1825                  */
1826
1827                 if (p_ace->type == SMB_ACL_USER || p_ace->type == SMB_ACL_GROUP) {
1828                         needs_mask = True;
1829                         mask_perms |= p_ace->perms;
1830                 } else if (p_ace->type == SMB_ACL_GROUP_OBJ) {
1831                         mask_perms |= p_ace->perms;
1832                 }
1833
1834                 /*
1835                  * Get the entry for this ACE.
1836                  */
1837
1838                 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &the_entry) == -1) {
1839                         DEBUG(0,("set_canon_ace_list: Failed to create entry %d. (%s)\n",
1840                                 i, strerror(errno) ));
1841                         goto done;
1842                 }
1843
1844                 if (p_ace->type == SMB_ACL_MASK) {
1845                         mask_entry = the_entry;
1846                         got_mask_entry = True;
1847                 }
1848
1849                 /*
1850                  * Ok - we now know the ACL calls should be working, don't
1851                  * allow fallback to chmod.
1852                  */
1853
1854                 *pacl_set_support = True;
1855
1856                 /*
1857                  * Initialise the entry from the canon_ace.
1858                  */
1859
1860                 /*
1861                  * First tell the entry what type of ACE this is.
1862                  */
1863
1864                 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, the_entry, p_ace->type) == -1) {
1865                         DEBUG(0,("set_canon_ace_list: Failed to set tag type on entry %d. (%s)\n",
1866                                 i, strerror(errno) ));
1867                         goto done;
1868                 }
1869
1870                 /*
1871                  * Only set the qualifier (user or group id) if the entry is a user
1872                  * or group id ACE.
1873                  */
1874
1875                 if ((p_ace->type == SMB_ACL_USER) || (p_ace->type == SMB_ACL_GROUP)) {
1876                         if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&p_ace->unix_ug.uid) == -1) {
1877                                 DEBUG(0,("set_canon_ace_list: Failed to set qualifier on entry %d. (%s)\n",
1878                                         i, strerror(errno) ));
1879                                 goto done;
1880                         }
1881                 }
1882
1883                 /*
1884                  * Convert the mode_t perms in the canon_ace to a POSIX permset.
1885                  */
1886
1887                 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, the_entry, &the_permset) == -1) {
1888                         DEBUG(0,("set_canon_ace_list: Failed to get permset on entry %d. (%s)\n",
1889                                 i, strerror(errno) ));
1890                         goto done;
1891                 }
1892
1893                 if (map_acl_perms_to_permset(conn, p_ace->perms, &the_permset) == -1) {
1894                         DEBUG(0,("set_canon_ace_list: Failed to create permset for mode (%u) on entry %d. (%s)\n",
1895                                 (unsigned int)p_ace->perms, i, strerror(errno) ));
1896                         goto done;
1897                 }
1898
1899                 /*
1900                  * ..and apply them to the entry.
1901                  */
1902
1903                 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, the_entry, the_permset) == -1) {
1904                         DEBUG(0,("set_canon_ace_list: Failed to add permset on entry %d. (%s)\n",
1905                                 i, strerror(errno) ));
1906                         goto done;
1907                 }
1908
1909                 if( DEBUGLVL( 10 ))
1910                         print_canon_ace( p_ace, i);
1911         }
1912
1913         if (needs_mask && !got_mask_entry) {
1914                 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &mask_entry) == -1) {
1915                         DEBUG(0,("set_canon_ace_list: Failed to create mask entry. (%s)\n", strerror(errno) ));
1916                         goto done;
1917                 }
1918
1919                 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, mask_entry, SMB_ACL_MASK) == -1) {
1920                         DEBUG(0,("set_canon_ace_list: Failed to set tag type on mask entry. (%s)\n",strerror(errno) ));
1921                         goto done;
1922                 }
1923
1924                 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, mask_entry, &mask_permset) == -1) {
1925                         DEBUG(0,("set_canon_ace_list: Failed to get mask permset. (%s)\n", strerror(errno) ));
1926                         goto done;
1927                 }
1928
1929                 if (map_acl_perms_to_permset(conn, S_IRUSR|S_IWUSR|S_IXUSR, &mask_permset) == -1) {
1930                         DEBUG(0,("set_canon_ace_list: Failed to create mask permset. (%s)\n", strerror(errno) ));
1931                         goto done;
1932                 }
1933
1934                 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, mask_entry, mask_permset) == -1) {
1935                         DEBUG(0,("set_canon_ace_list: Failed to add mask permset. (%s)\n", strerror(errno) ));
1936                         goto done;
1937                 }
1938         }
1939
1940         /*
1941          * Check if the ACL is valid.
1942          */
1943
1944         if (SMB_VFS_SYS_ACL_VALID(conn, the_acl) == -1) {
1945                 DEBUG(0,("set_canon_ace_list: ACL type (%s) is invalid for set (%s).\n",
1946                                 the_acl_type == SMB_ACL_TYPE_DEFAULT ? "directory default" : "file",
1947                                 strerror(errno) ));
1948                 goto done;
1949         }
1950
1951         /*
1952          * Finally apply it to the file or directory.
1953          */
1954
1955         if(default_ace || fsp->is_directory || fsp->fd == -1) {
1956                 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fsp->fsp_name, the_acl_type, the_acl) == -1) {
1957                         /*
1958                          * Some systems allow all the above calls and only fail with no ACL support
1959                          * when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
1960                          */
1961                         if (errno == ENOSYS)
1962                                 *pacl_set_support = False;
1963
1964 #ifdef ENOTSUP
1965                         if (errno == ENOTSUP)
1966                                 *pacl_set_support = False;
1967 #endif
1968
1969                         DEBUG(2,("set_canon_ace_list: sys_acl_set_file type %s failed for file %s (%s).\n",
1970                                         the_acl_type == SMB_ACL_TYPE_DEFAULT ? "directory default" : "file",
1971                                         fsp->fsp_name, strerror(errno) ));
1972                         goto done;
1973                 }
1974         } else {
1975                 if (SMB_VFS_SYS_ACL_SET_FD(fsp, fsp->fd, the_acl) == -1) {
1976                         /*
1977                          * Some systems allow all the above calls and only fail with no ACL support
1978                          * when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
1979                          */
1980                         if (errno == ENOSYS)
1981                                 *pacl_set_support = False;
1982
1983 #ifdef ENOTSUP
1984                         if (errno == ENOTSUP)
1985                                 *pacl_set_support = False;
1986 #endif
1987
1988                         DEBUG(2,("set_canon_ace_list: sys_acl_set_file failed for file %s (%s).\n",
1989                                         fsp->fsp_name, strerror(errno) ));
1990                         goto done;
1991                 }
1992         }
1993
1994         ret = True;
1995
1996   done:
1997
1998         if (the_acl != NULL)
1999             SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
2000
2001         return ret;
2002 }
2003
2004 /****************************************************************************
2005  Find a particular canon_ace entry.
2006 ****************************************************************************/
2007
2008 static struct canon_ace *canon_ace_entry_for(struct canon_ace *list, SMB_ACL_TAG_T type, posix_id *id)
2009 {
2010         while (list) {
2011                 if (list->type == type && ((type != SMB_ACL_USER && type != SMB_ACL_GROUP) ||
2012                                 (type == SMB_ACL_USER  && id && id->uid == list->unix_ug.uid) ||
2013                                 (type == SMB_ACL_GROUP && id && id->gid == list->unix_ug.gid)))
2014                         break;
2015                 list = list->next;
2016         }
2017         return list;
2018 }
2019
2020 /****************************************************************************
2021
2022 ****************************************************************************/
2023
2024 SMB_ACL_T free_empty_sys_acl(connection_struct *conn, SMB_ACL_T the_acl)
2025 {
2026         SMB_ACL_ENTRY_T entry;
2027
2028         if (!the_acl)
2029                 return NULL;
2030         if (SMB_VFS_SYS_ACL_GET_ENTRY(conn, the_acl, SMB_ACL_FIRST_ENTRY, &entry) != 1) {
2031                 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
2032                 return NULL;
2033         }
2034         return the_acl;
2035 }
2036
2037 /****************************************************************************
2038  Convert a canon_ace to a generic 3 element permission - if possible.
2039 ****************************************************************************/
2040
2041 #define MAP_PERM(p,mask,result) (((p) & (mask)) ? (result) : 0 )
2042
2043 static BOOL convert_canon_ace_to_posix_perms( files_struct *fsp, canon_ace *file_ace_list, mode_t *posix_perms)
2044 {
2045         int snum = SNUM(fsp->conn);
2046         size_t ace_count = count_canon_ace_list(file_ace_list);
2047         canon_ace *ace_p;
2048         canon_ace *owner_ace = NULL;
2049         canon_ace *group_ace = NULL;
2050         canon_ace *other_ace = NULL;
2051         mode_t and_bits;
2052         mode_t or_bits;
2053
2054         if (ace_count != 3) {
2055                 DEBUG(3,("convert_canon_ace_to_posix_perms: Too many ACE entries for file %s to convert to \
2056 posix perms.\n", fsp->fsp_name ));
2057                 return False;
2058         }
2059
2060         for (ace_p = file_ace_list; ace_p; ace_p = ace_p->next) {
2061                 if (ace_p->owner_type == UID_ACE)
2062                         owner_ace = ace_p;
2063                 else if (ace_p->owner_type == GID_ACE)
2064                         group_ace = ace_p;
2065                 else if (ace_p->owner_type == WORLD_ACE)
2066                         other_ace = ace_p;
2067         }
2068
2069         if (!owner_ace || !group_ace || !other_ace) {
2070                 DEBUG(3,("convert_canon_ace_to_posix_perms: Can't get standard entries for file %s.\n",
2071                                 fsp->fsp_name ));
2072                 return False;
2073         }
2074
2075         *posix_perms = (mode_t)0;
2076
2077         *posix_perms |= owner_ace->perms;
2078         *posix_perms |= MAP_PERM(group_ace->perms, S_IRUSR, S_IRGRP);
2079         *posix_perms |= MAP_PERM(group_ace->perms, S_IWUSR, S_IWGRP);
2080         *posix_perms |= MAP_PERM(group_ace->perms, S_IXUSR, S_IXGRP);
2081         *posix_perms |= MAP_PERM(other_ace->perms, S_IRUSR, S_IROTH);
2082         *posix_perms |= MAP_PERM(other_ace->perms, S_IWUSR, S_IWOTH);
2083         *posix_perms |= MAP_PERM(other_ace->perms, S_IXUSR, S_IXOTH);
2084
2085         /* The owner must have at least read access. */
2086
2087         *posix_perms |= S_IRUSR;
2088         if (fsp->is_directory)
2089                 *posix_perms |= (S_IWUSR|S_IXUSR);
2090
2091         /* If requested apply the masks. */
2092
2093         /* Get the initial bits to apply. */
2094
2095         if (fsp->is_directory) {
2096                 and_bits = lp_dir_security_mask(snum);
2097                 or_bits = lp_force_dir_security_mode(snum);
2098         } else {
2099                 and_bits = lp_security_mask(snum);
2100                 or_bits = lp_force_security_mode(snum);
2101         }
2102
2103         *posix_perms = (((*posix_perms) & and_bits)|or_bits);
2104
2105         DEBUG(10,("convert_canon_ace_to_posix_perms: converted u=%o,g=%o,w=%o to perm=0%o for file %s.\n",
2106                 (int)owner_ace->perms, (int)group_ace->perms, (int)other_ace->perms, (int)*posix_perms,
2107                 fsp->fsp_name ));
2108
2109         return True;
2110 }
2111
2112 static int nt_ace_comp( SEC_ACE *a1, SEC_ACE *a2)
2113 {
2114         if (a1->type == a2->type)
2115                 return 0;
2116
2117         if (a1->type == SEC_ACE_TYPE_ACCESS_DENIED && a2->type == SEC_ACE_TYPE_ACCESS_ALLOWED)
2118                 return -1;
2119         return 1;
2120 }
2121
2122 /****************************************************************************
2123   Incoming NT ACLs on a directory can be split into a default POSIX acl (CI|OI|IO) and
2124   a normal POSIX acl. Win2k needs these split acls re-merging into one ACL
2125   with CI|OI set so it is inherited and also applies to the directory.
2126   Based on code from "Jim McDonough" <jmcd@us.ibm.com>.
2127 ****************************************************************************/
2128
2129 static size_t merge_default_aces( SEC_ACE *nt_ace_list, size_t num_aces)
2130 {
2131         size_t i, j;
2132
2133         for (i = 0; i < num_aces; i++) {
2134                 for (j = i+1; j < num_aces; j++) {
2135                         /* We know the lower number ACE's are file entries. */
2136                         if ((nt_ace_list[i].type == nt_ace_list[j].type) &&
2137                                 (nt_ace_list[i].size == nt_ace_list[j].size) &&
2138                                 (nt_ace_list[i].info.mask == nt_ace_list[j].info.mask) &&
2139                                 sid_equal(&nt_ace_list[i].trustee, &nt_ace_list[j].trustee) &&
2140                                 (nt_ace_list[i].flags == 0) &&
2141                                 (nt_ace_list[j].flags == (SEC_ACE_FLAG_OBJECT_INHERIT|
2142                                                           SEC_ACE_FLAG_CONTAINER_INHERIT|
2143                                                           SEC_ACE_FLAG_INHERIT_ONLY))) {
2144                                 /*
2145                                  * These are identical except for the flags.
2146                                  * Merge the inherited ACE onto the non-inherited ACE.
2147                                  */
2148
2149                                 nt_ace_list[i].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT;
2150                                 if (num_aces - j - 1 > 0)
2151                                         memmove(&nt_ace_list[j], &nt_ace_list[j+1], (num_aces-j-1) *
2152                                                         sizeof(SEC_ACE));
2153                                 num_aces--;
2154                                 break;
2155                         }
2156                 }
2157         }
2158
2159         return num_aces;
2160 }
2161 /****************************************************************************
2162  Reply to query a security descriptor from an fsp. If it succeeds it allocates
2163  the space for the return elements and returns the size needed to return the
2164  security descriptor. This should be the only external function needed for
2165  the UNIX style get ACL.
2166 ****************************************************************************/
2167
2168 size_t get_nt_acl(files_struct *fsp, uint32 security_info, SEC_DESC **ppdesc)
2169 {
2170         extern DOM_SID global_sid_Builtin_Administrators;
2171         extern DOM_SID global_sid_Builtin_Users;
2172         extern DOM_SID global_sid_Creator_Owner;
2173         extern DOM_SID global_sid_Creator_Group;
2174         connection_struct *conn = fsp->conn;
2175         SMB_STRUCT_STAT sbuf;
2176         SEC_ACE *nt_ace_list = NULL;
2177         DOM_SID owner_sid;
2178         DOM_SID group_sid;
2179         size_t sd_size = 0;
2180         SEC_ACL *psa = NULL;
2181         size_t num_acls = 0;
2182         size_t num_dir_acls = 0;
2183         size_t num_aces = 0;
2184         SMB_ACL_T posix_acl = NULL;
2185         SMB_ACL_T dir_acl = NULL;
2186         canon_ace *file_ace = NULL;
2187         canon_ace *dir_ace = NULL;
2188         size_t num_profile_acls = 0;
2189
2190         *ppdesc = NULL;
2191
2192         DEBUG(10,("get_nt_acl: called for file %s\n", fsp->fsp_name ));
2193
2194         if(fsp->is_directory || fsp->fd == -1) {
2195
2196                 /* Get the stat struct for the owner info. */
2197                 if(SMB_VFS_STAT(fsp->conn,fsp->fsp_name, &sbuf) != 0) {
2198                         return 0;
2199                 }
2200                 /*
2201                  * Get the ACL from the path.
2202                  */
2203
2204                 posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fsp->fsp_name, SMB_ACL_TYPE_ACCESS);
2205
2206                 /*
2207                  * If it's a directory get the default POSIX ACL.
2208                  */
2209
2210                 if(fsp->is_directory) {
2211                         dir_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fsp->fsp_name, SMB_ACL_TYPE_DEFAULT);
2212                         dir_acl = free_empty_sys_acl(conn, dir_acl);
2213                 }
2214
2215         } else {
2216
2217                 /* Get the stat struct for the owner info. */
2218                 if(SMB_VFS_FSTAT(fsp,fsp->fd,&sbuf) != 0) {
2219                         return 0;
2220                 }
2221                 /*
2222                  * Get the ACL from the fd.
2223                  */
2224                 posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp, fsp->fd);
2225         }
2226
2227         DEBUG(5,("get_nt_acl : file ACL %s, directory ACL %s\n",
2228                         posix_acl ? "present" :  "absent",
2229                         dir_acl ? "present" :  "absent" ));
2230
2231         /*
2232          * Get the owner, group and world SIDs.
2233          */
2234
2235         if (lp_profile_acls(SNUM(fsp->conn))) {
2236                 /* For WXP SP1 the owner must be administrators. */
2237                 sid_copy(&owner_sid, &global_sid_Builtin_Administrators);
2238                 sid_copy(&group_sid, &global_sid_Builtin_Users);
2239                 num_profile_acls = 2;
2240         } else {
2241                 create_file_sids(&sbuf, &owner_sid, &group_sid);
2242         }
2243
2244         if (security_info & DACL_SECURITY_INFORMATION) {
2245
2246                 /*
2247                  * In the optimum case Creator Owner and Creator Group would be used for
2248                  * the ACL_USER_OBJ and ACL_GROUP_OBJ entries, respectively, but this
2249                  * would lead to usability problems under Windows: The Creator entries
2250                  * are only available in browse lists of directories and not for files;
2251                  * additionally the identity of the owning group couldn't be determined.
2252                  * We therefore use those identities only for Default ACLs.
2253                  */
2254
2255                 /* Create the canon_ace lists. */
2256                 file_ace = canonicalise_acl( fsp, posix_acl, &sbuf, &owner_sid, &group_sid, SMB_ACL_TYPE_ACCESS );
2257
2258                 /* We must have *some* ACLS. */
2259
2260                 if (count_canon_ace_list(file_ace) == 0) {
2261                         DEBUG(0,("get_nt_acl : No ACLs on file (%s) !\n", fsp->fsp_name ));
2262                         return 0;
2263                 }
2264
2265                 if (fsp->is_directory && dir_acl) {
2266                         dir_ace = canonicalise_acl(fsp, dir_acl, &sbuf,
2267                                         &global_sid_Creator_Owner,
2268                                         &global_sid_Creator_Group, SMB_ACL_TYPE_DEFAULT );
2269                 }
2270
2271                 /*
2272                  * Create the NT ACE list from the canonical ace lists.
2273                  */
2274
2275                 {
2276                         canon_ace *ace;
2277                         int nt_acl_type;
2278                         int i;
2279
2280                         if (nt4_compatible_acls() && dir_ace) {
2281                                 /*
2282                                  * NT 4 chokes if an ACL contains an INHERIT_ONLY entry
2283                                  * but no non-INHERIT_ONLY entry for one SID. So we only
2284                                  * remove entries from the Access ACL if the
2285                                  * corresponding Default ACL entries have also been
2286                                  * removed. ACEs for CREATOR-OWNER and CREATOR-GROUP
2287                                  * are exceptions. We can do nothing
2288                                  * intelligent if the Default ACL contains entries that
2289                                  * are not also contained in the Access ACL, so this
2290                                  * case will still fail under NT 4.
2291                                  */
2292
2293                                 ace = canon_ace_entry_for(dir_ace, SMB_ACL_OTHER, NULL);
2294                                 if (ace && !ace->perms) {
2295                                         DLIST_REMOVE(dir_ace, ace);
2296                                         SAFE_FREE(ace);
2297
2298                                         ace = canon_ace_entry_for(file_ace, SMB_ACL_OTHER, NULL);
2299                                         if (ace && !ace->perms) {
2300                                                 DLIST_REMOVE(file_ace, ace);
2301                                                 SAFE_FREE(ace);
2302                                         }
2303                                 }
2304
2305                                 /*
2306                                  * WinNT doesn't usually have Creator Group
2307                                  * in browse lists, so we send this entry to
2308                                  * WinNT even if it contains no relevant
2309                                  * permissions. Once we can add
2310                                  * Creator Group to browse lists we can
2311                                  * re-enable this.
2312                                  */
2313
2314 #if 0
2315                                 ace = canon_ace_entry_for(dir_ace, SMB_ACL_GROUP_OBJ, NULL);
2316                                 if (ace && !ace->perms) {
2317                                         DLIST_REMOVE(dir_ace, ace);
2318                                         SAFE_FREE(ace);
2319                                 }
2320 #endif
2321
2322                                 ace = canon_ace_entry_for(file_ace, SMB_ACL_GROUP_OBJ, NULL);
2323                                 if (ace && !ace->perms) {
2324                                         DLIST_REMOVE(file_ace, ace);
2325                                         SAFE_FREE(ace);
2326                                 }
2327                         }
2328
2329                         num_acls = count_canon_ace_list(file_ace);
2330                         num_dir_acls = count_canon_ace_list(dir_ace);
2331
2332                         /* Allocate the ace list. */
2333                         if ((nt_ace_list = (SEC_ACE *)malloc((num_acls + num_profile_acls + num_dir_acls)* sizeof(SEC_ACE))) == NULL) {
2334                                 DEBUG(0,("get_nt_acl: Unable to malloc space for nt_ace_list.\n"));
2335                                 goto done;
2336                         }
2337
2338                         memset(nt_ace_list, '\0', (num_acls + num_dir_acls) * sizeof(SEC_ACE) );
2339
2340                         /*
2341                          * Create the NT ACE list from the canonical ace lists.
2342                          */
2343
2344                         ace = file_ace;
2345
2346                         for (i = 0; i < num_acls; i++, ace = ace->next) {
2347                                 SEC_ACCESS acc;
2348
2349                                 acc = map_canon_ace_perms(&nt_acl_type, &owner_sid, ace );
2350                                 init_sec_ace(&nt_ace_list[num_aces++], &ace->trustee, nt_acl_type, acc, 0);
2351                         }
2352
2353                         /* The User must have access to a profile share - even if we can't map the SID. */
2354                         if (lp_profile_acls(SNUM(fsp->conn))) {
2355                                 SEC_ACCESS acc;
2356
2357                                 init_sec_access(&acc,FILE_GENERIC_ALL);
2358                                 init_sec_ace(&nt_ace_list[num_aces++], &global_sid_Builtin_Users, SEC_ACE_TYPE_ACCESS_ALLOWED, acc, 0);
2359                         }
2360
2361                         ace = dir_ace;
2362
2363                         for (i = 0; i < num_dir_acls; i++, ace = ace->next) {
2364                                 SEC_ACCESS acc;
2365
2366                                 acc = map_canon_ace_perms(&nt_acl_type, &owner_sid, ace );
2367                                 init_sec_ace(&nt_ace_list[num_aces++], &ace->trustee, nt_acl_type, acc,
2368                                                 SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_INHERIT_ONLY);
2369                         }
2370
2371                         /* The User must have access to a profile share - even if we can't map the SID. */
2372                         if (lp_profile_acls(SNUM(fsp->conn))) {
2373                                 SEC_ACCESS acc;
2374
2375                                 init_sec_access(&acc,FILE_GENERIC_ALL);
2376                                 init_sec_ace(&nt_ace_list[num_aces++], &global_sid_Builtin_Users, SEC_ACE_TYPE_ACCESS_ALLOWED, acc,
2377                                                 SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
2378                                                 SEC_ACE_FLAG_INHERIT_ONLY);
2379                         }
2380
2381                         /*
2382                          * Merge POSIX default ACLs and normal ACLs into one NT ACE.
2383                          * Win2K needs this to get the inheritance correct when replacing ACLs
2384                          * on a directory tree. Based on work by Jim @ IBM.
2385                          */
2386
2387                         num_aces = merge_default_aces(nt_ace_list, num_aces);
2388
2389                         /*
2390                          * Sort to force deny entries to the front.
2391                          */
2392
2393                         if (num_aces)
2394                                 qsort( nt_ace_list, num_aces, sizeof(nt_ace_list[0]), QSORT_CAST nt_ace_comp);
2395                 }
2396
2397                 if (num_aces) {
2398                         if((psa = make_sec_acl( main_loop_talloc_get(), ACL_REVISION, num_aces, nt_ace_list)) == NULL) {
2399                                 DEBUG(0,("get_nt_acl: Unable to malloc space for acl.\n"));
2400                                 goto done;
2401                         }
2402                 }
2403         } /* security_info & DACL_SECURITY_INFORMATION */
2404
2405         *ppdesc = make_standard_sec_desc( main_loop_talloc_get(),
2406                         (security_info & OWNER_SECURITY_INFORMATION) ? &owner_sid : NULL,
2407                         (security_info & GROUP_SECURITY_INFORMATION) ? &group_sid : NULL,
2408                         psa,
2409                         &sd_size);
2410
2411         if(!*ppdesc) {
2412                 DEBUG(0,("get_nt_acl: Unable to malloc space for security descriptor.\n"));
2413                 sd_size = 0;
2414         } else {
2415 #if 1
2416                 /*
2417                  * JRA. Setting this flag causes W2K clients not to
2418                  * propagate ACL sets down a directory tree correctly.
2419                  */
2420                 /*
2421                  * Windows 2000: The DACL_PROTECTED flag in the security
2422                  * descriptor marks the ACL as non-inheriting, i.e., no
2423                  * ACEs from higher level directories propagate to this
2424                  * ACL. In the POSIX ACL model permissions are only
2425                  * inherited at file create time, so ACLs never contain
2426                  * any ACEs that are inherited dynamically. The DACL_PROTECTED
2427                  * flag doesn't seem to bother Windows NT.
2428                  */
2429                 (*ppdesc)->type |= SE_DESC_DACL_PROTECTED;
2430 #endif
2431         }
2432
2433  done:
2434
2435         if (posix_acl)
2436                 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
2437         if (dir_acl)
2438                 SMB_VFS_SYS_ACL_FREE_ACL(conn, dir_acl);
2439         free_canon_ace_list(file_ace);
2440         free_canon_ace_list(dir_ace);
2441         SAFE_FREE(nt_ace_list);
2442
2443         return sd_size;
2444 }
2445
2446 /****************************************************************************
2447  Try to chown a file. We will be able to chown it under the following conditions.
2448
2449   1) If we have root privileges, then it will just work.
2450   2) If we have write permission to the file and dos_filemodes is set
2451      then allow chown to the currently authenticated user.
2452 ****************************************************************************/
2453
2454 static int try_chown(connection_struct *conn, const char *fname, uid_t uid, gid_t gid)
2455 {
2456         int ret;
2457         extern struct current_user current_user;
2458         files_struct *fsp;
2459         SMB_STRUCT_STAT st;
2460
2461         /* try the direct way first */
2462         ret = SMB_VFS_CHOWN(conn, fname, uid, gid);
2463         if (ret == 0)
2464                 return 0;
2465
2466         if(!CAN_WRITE(conn) || !lp_dos_filemode(SNUM(conn)))
2467                 return -1;
2468
2469         if (SMB_VFS_STAT(conn,fname,&st))
2470                 return -1;
2471
2472         fsp = open_file_fchmod(conn,fname,&st);
2473         if (!fsp)
2474                 return -1;
2475
2476         /* only allow chown to the current user. This is more secure,
2477            and also copes with the case where the SID in a take ownership ACL is
2478            a local SID on the users workstation
2479         */
2480         uid = current_user.uid;
2481
2482         become_root();
2483         /* Keep the current file gid the same. */
2484         ret = SMB_VFS_FCHOWN(fsp, fsp->fd, uid, (gid_t)-1);
2485         unbecome_root();
2486
2487         close_file_fchmod(fsp);
2488
2489         return ret;
2490 }
2491
2492 /****************************************************************************
2493  Reply to set a security descriptor on an fsp. security_info_sent is the
2494  description of the following NT ACL.
2495  This should be the only external function needed for the UNIX style set ACL.
2496 ****************************************************************************/
2497
2498 BOOL set_nt_acl(files_struct *fsp, uint32 security_info_sent, SEC_DESC *psd)
2499 {
2500         connection_struct *conn = fsp->conn;
2501         uid_t user = (uid_t)-1;
2502         gid_t grp = (gid_t)-1;
2503         SMB_STRUCT_STAT sbuf;
2504         DOM_SID file_owner_sid;
2505         DOM_SID file_grp_sid;
2506         canon_ace *file_ace_list = NULL;
2507         canon_ace *dir_ace_list = NULL;
2508         BOOL acl_perms = False;
2509         mode_t orig_mode = (mode_t)0;
2510         uid_t orig_uid;
2511         gid_t orig_gid;
2512         BOOL need_chown = False;
2513         extern struct current_user current_user;
2514
2515         DEBUG(10,("set_nt_acl: called for file %s\n", fsp->fsp_name ));
2516
2517         if (!CAN_WRITE(conn)) {
2518                 DEBUG(10,("set acl rejected on read-only share\n"));
2519                 return False;
2520         }
2521
2522         /*
2523          * Get the current state of the file.
2524          */
2525
2526         if(fsp->is_directory || fsp->fd == -1) {
2527                 if(SMB_VFS_STAT(fsp->conn,fsp->fsp_name, &sbuf) != 0)
2528                         return False;
2529         } else {
2530                 if(SMB_VFS_FSTAT(fsp,fsp->fd,&sbuf) != 0)
2531                         return False;
2532         }
2533
2534         /* Save the original elements we check against. */
2535         orig_mode = sbuf.st_mode;
2536         orig_uid = sbuf.st_uid;
2537         orig_gid = sbuf.st_gid;
2538
2539         /*
2540          * Unpack the user/group/world id's.
2541          */
2542
2543         if (!unpack_nt_owners( &sbuf, &user, &grp, security_info_sent, psd))
2544                 return False;
2545
2546         /*
2547          * Do we need to chown ?
2548          */
2549
2550         if (((user != (uid_t)-1) && (orig_uid != user)) || (( grp != (gid_t)-1) && (orig_gid != grp)))
2551                 need_chown = True;
2552
2553         /*
2554          * Chown before setting ACL only if we don't change the user, or
2555          * if we change to the current user, but not if we want to give away
2556          * the file.
2557          */
2558
2559         if (need_chown && (user == (uid_t)-1 || user == current_user.uid)) {
2560
2561                 DEBUG(3,("set_nt_acl: chown %s. uid = %u, gid = %u.\n",
2562                                 fsp->fsp_name, (unsigned int)user, (unsigned int)grp ));
2563
2564                 if(try_chown( fsp->conn, fsp->fsp_name, user, grp) == -1) {
2565                         DEBUG(3,("set_nt_acl: chown %s, %u, %u failed. Error = %s.\n",
2566                                 fsp->fsp_name, (unsigned int)user, (unsigned int)grp, strerror(errno) ));
2567                         return False;
2568                 }
2569
2570                 /*
2571                  * Recheck the current state of the file, which may have changed.
2572                  * (suid/sgid bits, for instance)
2573                  */
2574
2575                 if(fsp->is_directory) {
2576                         if(SMB_VFS_STAT(fsp->conn, fsp->fsp_name, &sbuf) != 0) {
2577                                 return False;
2578                         }
2579                 } else {
2580
2581                         int ret;
2582
2583                         if(fsp->fd == -1)
2584                                 ret = SMB_VFS_STAT(fsp->conn, fsp->fsp_name, &sbuf);
2585                         else
2586                                 ret = SMB_VFS_FSTAT(fsp,fsp->fd,&sbuf);
2587
2588                         if(ret != 0)
2589                                 return False;
2590                 }
2591
2592                 /* Save the original elements we check against. */
2593                 orig_mode = sbuf.st_mode;
2594                 orig_uid = sbuf.st_uid;
2595                 orig_gid = sbuf.st_gid;
2596
2597                 /* We did it, don't try again */
2598                 need_chown = False;
2599         }
2600
2601         create_file_sids(&sbuf, &file_owner_sid, &file_grp_sid);
2602
2603         acl_perms = unpack_canon_ace( fsp, &sbuf, &file_owner_sid, &file_grp_sid,
2604                                                                         &file_ace_list, &dir_ace_list, security_info_sent, psd);
2605
2606         /* Ignore W2K traverse DACL set. */
2607         if (file_ace_list || dir_ace_list) {
2608
2609                 if (!acl_perms) {
2610                         DEBUG(3,("set_nt_acl: cannot set permissions\n"));
2611                         free_canon_ace_list(file_ace_list);
2612                         free_canon_ace_list(dir_ace_list);
2613                         return False;
2614                 }
2615
2616                 /*
2617                  * Only change security if we got a DACL.
2618                  */
2619
2620                 if((security_info_sent & DACL_SECURITY_INFORMATION) && (psd->dacl != NULL)) {
2621
2622                         BOOL acl_set_support = False;
2623                         BOOL ret = False;
2624
2625                         /*
2626                          * Try using the POSIX ACL set first. Fall back to chmod if
2627                          * we have no ACL support on this filesystem.
2628                          */
2629
2630                         if (acl_perms && file_ace_list) {
2631                                 ret = set_canon_ace_list(fsp, file_ace_list, False, &acl_set_support);
2632                                 if (acl_set_support && ret == False) {
2633                                         DEBUG(3,("set_nt_acl: failed to set file acl on file %s (%s).\n", fsp->fsp_name, strerror(errno) ));
2634                                         free_canon_ace_list(file_ace_list);
2635                                         free_canon_ace_list(dir_ace_list);
2636                                         return False;
2637                                 }
2638                         }
2639
2640                         if (acl_perms && acl_set_support && fsp->is_directory) {
2641                                 if (dir_ace_list) {
2642                                         if (!set_canon_ace_list(fsp, dir_ace_list, True, &acl_set_support)) {
2643                                                 DEBUG(3,("set_nt_acl: failed to set default acl on directory %s (%s).\n", fsp->fsp_name, strerror(errno) ));
2644                                                 free_canon_ace_list(file_ace_list);
2645                                                 free_canon_ace_list(dir_ace_list);
2646                                                 return False;
2647                                         }
2648                                 } else {
2649
2650                                         /*
2651                                          * No default ACL - delete one if it exists.
2652                                          */
2653
2654                                         if (SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn, fsp->fsp_name) == -1) {
2655                                                 DEBUG(3,("set_nt_acl: sys_acl_delete_def_file failed (%s)\n", strerror(errno)));
2656                                                 free_canon_ace_list(file_ace_list);
2657                                                 free_canon_ace_list(dir_ace_list);
2658                                                 return False;
2659                                         }
2660                                 }
2661                         }
2662
2663                         /*
2664                          * If we cannot set using POSIX ACLs we fall back to checking if we need to chmod.
2665                          */
2666
2667                         if(!acl_set_support && acl_perms) {
2668                                 mode_t posix_perms;
2669
2670                                 if (!convert_canon_ace_to_posix_perms( fsp, file_ace_list, &posix_perms)) {
2671                                         free_canon_ace_list(file_ace_list);
2672                                         free_canon_ace_list(dir_ace_list);
2673                                         DEBUG(3,("set_nt_acl: failed to convert file acl to posix permissions for file %s.\n",
2674                                                 fsp->fsp_name ));
2675                                         return False;
2676                                 }
2677
2678                                 if (orig_mode != posix_perms) {
2679
2680                                         DEBUG(3,("set_nt_acl: chmod %s. perms = 0%o.\n",
2681                                                 fsp->fsp_name, (unsigned int)posix_perms ));
2682
2683                                         if(SMB_VFS_CHMOD(conn,fsp->fsp_name, posix_perms) == -1) {
2684                                                 DEBUG(3,("set_nt_acl: chmod %s, 0%o failed. Error = %s.\n",
2685                                                                 fsp->fsp_name, (unsigned int)posix_perms, strerror(errno) ));
2686                                                 free_canon_ace_list(file_ace_list);
2687                                                 free_canon_ace_list(dir_ace_list);
2688                                                 return False;
2689                                         }
2690                                 }
2691                         }
2692                 }
2693
2694                 free_canon_ace_list(file_ace_list);
2695                 free_canon_ace_list(dir_ace_list);
2696         }
2697
2698         /* Any chown pending? */
2699         if (need_chown) {
2700
2701                 DEBUG(3,("set_nt_acl: chown %s. uid = %u, gid = %u.\n",
2702                         fsp->fsp_name, (unsigned int)user, (unsigned int)grp ));
2703
2704                 if(try_chown( fsp->conn, fsp->fsp_name, user, grp) == -1) {
2705                         DEBUG(3,("set_nt_acl: chown %s, %u, %u failed. Error = %s.\n",
2706                                 fsp->fsp_name, (unsigned int)user, (unsigned int)grp, strerror(errno) ));
2707                         return False;
2708                 }
2709         }
2710
2711         return True;
2712 }
2713
2714 /****************************************************************************
2715  Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
2716  and set the mask to rwx. Needed to preserve complex ACLs set by NT.
2717 ****************************************************************************/
2718
2719 static int chmod_acl_internals( connection_struct *conn, SMB_ACL_T posix_acl, mode_t mode)
2720 {
2721         int entry_id = SMB_ACL_FIRST_ENTRY;
2722         SMB_ACL_ENTRY_T entry;
2723         int num_entries = 0;
2724
2725         while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) {
2726                 SMB_ACL_TAG_T tagtype;
2727                 SMB_ACL_PERMSET_T permset;
2728                 mode_t perms;
2729
2730                 /* get_next... */
2731                 if (entry_id == SMB_ACL_FIRST_ENTRY)
2732                         entry_id = SMB_ACL_NEXT_ENTRY;
2733
2734                 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1)
2735                         return -1;
2736
2737                 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1)
2738                         return -1;
2739
2740                 num_entries++;
2741
2742                 switch(tagtype) {
2743                         case SMB_ACL_USER_OBJ:
2744                                 perms = unix_perms_to_acl_perms(mode, S_IRUSR, S_IWUSR, S_IXUSR);
2745                                 break;
2746                         case SMB_ACL_GROUP_OBJ:
2747                                 perms = unix_perms_to_acl_perms(mode, S_IRGRP, S_IWGRP, S_IXGRP);
2748                                 break;
2749                         case SMB_ACL_MASK:
2750                                 /*
2751                                  * FIXME: The ACL_MASK entry permissions should really be set to
2752                                  * the union of the permissions of all ACL_USER,
2753                                  * ACL_GROUP_OBJ, and ACL_GROUP entries. That's what
2754                                  * acl_calc_mask() does, but Samba ACLs doesn't provide it.
2755                                  */
2756                                 perms = S_IRUSR|S_IWUSR|S_IXUSR;
2757                                 break;
2758                         case SMB_ACL_OTHER:
2759                                 perms = unix_perms_to_acl_perms(mode, S_IROTH, S_IWOTH, S_IXOTH);
2760                                 break;
2761                         default:
2762                                 continue;
2763                 }
2764
2765                 if (map_acl_perms_to_permset(conn, perms, &permset) == -1)
2766                         return -1;
2767
2768                 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, entry, permset) == -1)
2769                         return -1;
2770         }
2771
2772         /*
2773          * If this is a simple 3 element ACL or no elements then it's a standard
2774          * UNIX permission set. Just use chmod...
2775          */
2776
2777         if ((num_entries == 3) || (num_entries == 0))
2778                 return -1;
2779
2780         return 0;
2781 }
2782
2783 /****************************************************************************
2784  Get the access ACL of FROM, do a chmod by setting the ACL USER_OBJ,
2785  GROUP_OBJ and OTHER bits in an ACL and set the mask to rwx. Set the
2786  resulting ACL on TO.  Note that name is in UNIX character set.
2787 ****************************************************************************/
2788
2789 static int copy_access_acl(connection_struct *conn, const char *from, const char *to, mode_t mode)
2790 {
2791         SMB_ACL_T posix_acl = NULL;
2792         int ret = -1;
2793
2794         if ((posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, from, SMB_ACL_TYPE_ACCESS)) == NULL)
2795                 return -1;
2796
2797         if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
2798                 goto done;
2799
2800         ret = SMB_VFS_SYS_ACL_SET_FILE(conn, to, SMB_ACL_TYPE_ACCESS, posix_acl);
2801
2802  done:
2803
2804         SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
2805         return ret;
2806 }
2807
2808 /****************************************************************************
2809  Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
2810  and set the mask to rwx. Needed to preserve complex ACLs set by NT.
2811  Note that name is in UNIX character set.
2812 ****************************************************************************/
2813
2814 int chmod_acl(connection_struct *conn, const char *name, mode_t mode)
2815 {
2816         return copy_access_acl(conn, name, name, mode);
2817 }
2818
2819 /****************************************************************************
2820  If "inherit permissions" is set and the parent directory has no default
2821  ACL but it does have an Access ACL, inherit this Access ACL to file name.
2822 ****************************************************************************/
2823
2824 int inherit_access_acl(connection_struct *conn, const char *name, mode_t mode)
2825 {
2826         pstring dirname;
2827         pstrcpy(dirname, parent_dirname(name));
2828
2829         if (!lp_inherit_perms(SNUM(conn)) || directory_has_default_acl(conn, dirname))
2830                 return 0;
2831
2832         return copy_access_acl(conn, dirname, name, mode);
2833 }
2834
2835 /****************************************************************************
2836  Do an fchmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
2837  and set the mask to rwx. Needed to preserve complex ACLs set by NT.
2838 ****************************************************************************/
2839
2840 int fchmod_acl(files_struct *fsp, int fd, mode_t mode)
2841 {
2842         connection_struct *conn = fsp->conn;
2843         SMB_ACL_T posix_acl = NULL;
2844         int ret = -1;
2845
2846         if ((posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp, fd)) == NULL)
2847                 return -1;
2848
2849         if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
2850                 goto done;
2851
2852         ret = SMB_VFS_SYS_ACL_SET_FD(fsp, fd, posix_acl);
2853
2854   done:
2855
2856         SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
2857         return ret;
2858 }
2859
2860 /****************************************************************************
2861  Check for an existing default POSIX ACL on a directory.
2862 ****************************************************************************/
2863
2864 BOOL directory_has_default_acl(connection_struct *conn, const char *fname)
2865 {
2866         SMB_ACL_T dir_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_DEFAULT);
2867         BOOL has_acl = False;
2868         SMB_ACL_ENTRY_T entry;
2869
2870         if (dir_acl != NULL && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, dir_acl, SMB_ACL_FIRST_ENTRY, &entry) == 1))
2871                 has_acl = True;
2872
2873         if (dir_acl)
2874                 SMB_VFS_SYS_ACL_FREE_ACL(conn, dir_acl);
2875         return has_acl;
2876 }