2 Unix SMB/CIFS implementation.
3 Set NT and POSIX ACLs and other VFS operations from Python
5 Copyrigyt (C) Andrew Bartlett 2012
6 Copyright (C) Jeremy Allison 1994-2009.
7 Copyright (C) Andreas Gruenbacher 2002.
8 Copyright (C) Simo Sorce <idra@samba.org> 2009.
9 Copyright (C) Simo Sorce 2002
10 Copyright (C) Eric Lorimer 2002
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #include "smbd/smbd.h"
29 #include "libcli/util/pyerrors.h"
30 #include "librpc/rpc/pyrpc_util.h"
32 #include "system/filesys.h"
34 extern const struct generic_mapping file_generic_mapping;
37 #define DBGC_CLASS DBGC_ACLS
39 static NTSTATUS set_sys_acl_no_snum(const char *fname,
40 SMB_ACL_TYPE_T acltype,
43 connection_struct *conn;
44 NTSTATUS status = NT_STATUS_OK;
47 conn = talloc_zero(NULL, connection_struct);
49 DEBUG(0, ("talloc failed\n"));
50 return NT_STATUS_NO_MEMORY;
53 if (!(conn->params = talloc(conn, struct share_params))) {
54 DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
56 return NT_STATUS_NO_MEMORY;
59 conn->params->service = -1;
61 set_conn_connectpath(conn, "/");
65 ret = SMB_VFS_SYS_ACL_SET_FILE( conn, fname, acltype, theacl);
67 status = map_nt_error_from_unix_common(ret);
68 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned zero.\n"));
76 static NTSTATUS set_nt_acl_no_snum(const char *fname,
77 uint32 security_info_sent, const struct security_descriptor *sd)
79 TALLOC_CTX *frame = talloc_stackframe();
80 connection_struct *conn;
81 NTSTATUS status = NT_STATUS_OK;
83 struct smb_filename *smb_fname = NULL;
86 conn = talloc_zero(frame, connection_struct);
88 DEBUG(0, ("talloc failed\n"));
89 return NT_STATUS_NO_MEMORY;
92 if (!(conn->params = talloc(conn, struct share_params))) {
93 DEBUG(0,("set_nt_acl_no_snum: talloc() failed!\n"));
95 return NT_STATUS_NO_MEMORY;
98 conn->params->service = -1;
100 set_conn_connectpath(conn, "/");
104 fsp = talloc_zero(frame, struct files_struct);
107 return NT_STATUS_NO_MEMORY;
109 fsp->fh = talloc(fsp, struct fd_handle);
110 if (fsp->fh == NULL) {
112 return NT_STATUS_NO_MEMORY;
116 status = create_synthetic_smb_fname_split(fsp, fname, NULL,
118 if (!NT_STATUS_IS_OK(status)) {
123 fsp->fsp_name = smb_fname;
126 flags = O_RDONLY|O_DIRECTORY;
128 /* POSIX allows us to open a directory with O_RDONLY. */
132 fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, O_RDWR, 00400);
133 if (fsp->fh->fd == -1 && errno == EISDIR) {
134 fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, flags, 00400);
136 if (fsp->fh->fd == -1) {
137 printf("open: error=%d (%s)\n", errno, strerror(errno));
139 return NT_STATUS_UNSUCCESSFUL;
142 status = SMB_VFS_FSET_NT_ACL( fsp, security_info_sent, sd);
143 if (!NT_STATUS_IS_OK(status)) {
144 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned %s.\n", nt_errstr(status)));
154 static SMB_ACL_T make_simple_acl(uid_t uid, gid_t gid)
156 mode_t mode = SMB_ACL_READ|SMB_ACL_WRITE;
159 SMB_ACL_ENTRY_T entry;
160 SMB_ACL_T acl = sys_acl_init(4);
166 if (sys_acl_create_entry(&acl, &entry) != 0) {
171 if (sys_acl_set_tag_type(entry, SMB_ACL_USER_OBJ) != 0) {
176 if (sys_acl_set_permset(entry, &mode) != 0) {
181 if (sys_acl_create_entry(&acl, &entry) != 0) {
186 if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP_OBJ) != 0) {
191 if (sys_acl_set_permset(entry, &mode) != 0) {
196 if (sys_acl_create_entry(&acl, &entry) != 0) {
201 if (sys_acl_set_tag_type(entry, SMB_ACL_OTHER) != 0) {
206 if (sys_acl_set_permset(entry, &mode0) != 0) {
211 if (sys_acl_create_entry(&acl, &entry) != 0) {
216 if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP) != 0) {
221 if (sys_acl_set_qualifier(entry, &gid) != 0) {
226 if (sys_acl_set_permset(entry, &mode) != 0) {
231 if (sys_acl_create_entry(&acl, &entry) != 0) {
236 if (sys_acl_set_tag_type(entry, SMB_ACL_MASK) != 0) {
241 if (sys_acl_set_permset(entry, &mode0) != 0) {
249 set a simple ACL on a file, as a test
251 static PyObject *py_smbd_set_simple_acl(PyObject *self, PyObject *args)
259 if (!PyArg_ParseTuple(args, "sii", &fname, &uid, &gid))
262 acl = make_simple_acl(uid, gid);
264 frame = talloc_stackframe();
266 status = set_sys_acl_no_snum(fname, SMB_ACL_TYPE_ACCESS, acl);
271 PyErr_NTSTATUS_IS_ERR_RAISE(status);
279 static PyObject *py_smbd_chown(PyObject *self, PyObject *args)
281 connection_struct *conn;
282 NTSTATUS status = NT_STATUS_OK;
289 if (!PyArg_ParseTuple(args, "sii", &fname, &uid, &gid))
292 frame = talloc_stackframe();
294 conn = talloc_zero(frame, connection_struct);
300 if (!(conn->params = talloc(conn, struct share_params))) {
305 conn->params->service = -1;
307 set_conn_connectpath(conn, "/");
311 ret = SMB_VFS_CHOWN( conn, fname, uid, gid);
313 status = map_nt_error_from_unix_common(ret);
314 DEBUG(0,("chwon returned failure: %s\n", strerror(ret)));
321 PyErr_NTSTATUS_IS_ERR_RAISE(status);
327 check if we have ACL support
329 static PyObject *py_smbd_have_posix_acls(PyObject *self, PyObject *args)
331 #ifdef HAVE_POSIX_ACLS
332 return PyBool_FromLong(true);
334 return PyBool_FromLong(false);
339 set the NT ACL on a file
341 static PyObject *py_smbd_set_nt_acl(PyObject *self, PyObject *args)
345 int security_info_sent;
347 struct security_descriptor *sd;
349 if (!PyArg_ParseTuple(args, "siO", &fname, &security_info_sent, &py_sd))
352 if (!py_check_dcerpc_type(py_sd, "samba.dcerpc.security", "descriptor")) {
356 sd = pytalloc_get_type(py_sd, struct security_descriptor);
358 status = set_nt_acl_no_snum(fname, security_info_sent, sd);
359 PyErr_NTSTATUS_IS_ERR_RAISE(status);
365 Return the NT ACL on a file
367 static PyObject *py_smbd_get_nt_acl(PyObject *self, PyObject *args)
370 int security_info_sent;
372 struct security_descriptor *sd;
373 TALLOC_CTX *tmp_ctx = talloc_new(NULL);
375 if (!PyArg_ParseTuple(args, "si", &fname, &security_info_sent))
378 sd = get_nt_acl_no_snum(tmp_ctx, fname);
380 py_sd = py_return_ndr_struct("samba.dcerpc.security", "security_descriptor", sd, sd);
382 talloc_free(tmp_ctx);
388 set the posix (or similar) ACL on a file
390 static PyObject *py_smbd_set_sys_acl(PyObject *self, PyObject *args)
395 struct smb_acl_t *acl;
398 if (!PyArg_ParseTuple(args, "siO", &fname, &acl_type, &py_acl))
401 if (!py_check_dcerpc_type(py_acl, "samba.dcerpc.smb_acl", "sys_acl_t")) {
405 acl = pytalloc_get_type(py_acl, struct smb_acl_t);
407 status = set_sys_acl_no_snum(fname, acl_type, acl);
408 PyErr_NTSTATUS_IS_ERR_RAISE(status);
414 Return the posix (or similar) ACL on a file
416 static PyObject *py_smbd_get_sys_acl(PyObject *self, PyObject *args)
420 struct smb_acl_t *acl;
422 TALLOC_CTX *frame = talloc_stackframe();
423 connection_struct *conn;
424 NTSTATUS status = NT_STATUS_OK;
426 if (!PyArg_ParseTuple(args, "si", &fname, &acl_type)) {
431 conn = talloc_zero(frame, connection_struct);
433 DEBUG(0, ("talloc failed\n"));
439 if (!(conn->params = talloc(conn, struct share_params))) {
440 DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
446 conn->params->service = -1;
448 set_conn_connectpath(conn, "/");
452 acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, acl_type);
455 status = map_nt_error_from_unix_common(errno);
456 DEBUG(0,("sys_acl_get_file returned NULL: %s\n", strerror(errno)));
457 PyErr_NTSTATUS_IS_ERR_RAISE(status);
460 talloc_steal(frame, acl);
463 py_acl = py_return_ndr_struct("samba.dcerpc.smb_acl", "sys_acl_t", acl, acl);
470 static PyMethodDef py_smbd_methods[] = {
472 (PyCFunction)py_smbd_have_posix_acls, METH_VARARGS,
475 (PyCFunction)py_smbd_set_simple_acl, METH_VARARGS,
478 (PyCFunction)py_smbd_set_nt_acl, METH_VARARGS,
481 (PyCFunction)py_smbd_get_nt_acl, METH_VARARGS,
484 (PyCFunction)py_smbd_get_sys_acl, METH_VARARGS,
487 (PyCFunction)py_smbd_set_sys_acl, METH_VARARGS,
490 (PyCFunction)py_smbd_chown, METH_VARARGS,
500 m = Py_InitModule3("smbd", py_smbd_methods,
501 "Python bindings for the smbd file server.");