Fix hash function in acl_xattr to be SHA256, make
[ira/wip.git] / source3 / modules / vfs_acl_xattr.c
1 /*
2  * Store Windows ACLs in xattrs.
3  *
4  * Copyright (C) Volker Lendecke, 2008
5  * Copyright (C) Jeremy Allison, 2008
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License as published by
9  * the Free Software Foundation; either version 3 of the License, or
10  * (at your option) any later version.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License
18  * along with this program; if not, see <http://www.gnu.org/licenses/>.
19  */
20
21 /* NOTE: This is an experimental module, not yet finished. JRA. */
22
23 #include "includes.h"
24 #include "librpc/gen_ndr/xattr.h"
25 #include "librpc/gen_ndr/ndr_xattr.h"
26 #include "../lib/crypto/crypto.h"
27
28 #undef DBGC_CLASS
29 #define DBGC_CLASS DBGC_VFS
30
31 static NTSTATUS create_acl_blob(const struct security_descriptor *psd,
32                         DATA_BLOB *pblob,
33                         uint16_t hash_type,
34                         uint8_t hash[XATTR_SD_HASH_SIZE]);
35
36 #define HASH_SECURITY_INFO (OWNER_SECURITY_INFORMATION | \
37                                 GROUP_SECURITY_INFORMATION | \
38                                 DACL_SECURITY_INFORMATION | \
39                                 SACL_SECURITY_INFORMATION)
40
41 /*******************************************************************
42  Hash a security descriptor.
43 *******************************************************************/
44
45 static NTSTATUS hash_sd_sha256(struct security_descriptor *psd,
46                         uint8_t hash[XATTR_SD_HASH_SIZE])
47 {
48         DATA_BLOB blob;
49         SHA256_CTX tctx;
50         NTSTATUS status;
51
52         memset(hash, '\0', XATTR_SD_HASH_SIZE);
53         status = create_acl_blob(psd, &blob, XATTR_SD_HASH_TYPE_SHA256, hash);
54         if (!NT_STATUS_IS_OK(status)) {
55                 return status;
56         }
57
58         SHA256_Init(&tctx);
59         SHA256_Update(&tctx, blob.data, blob.length);
60         SHA256_Final(hash, &tctx);
61
62         return NT_STATUS_OK;
63 }
64
65 /*******************************************************************
66  Parse out a struct security_descriptor from a DATA_BLOB.
67 *******************************************************************/
68
69 static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
70                                 struct security_descriptor **ppdesc,
71                                 uint16_t *p_hash_type,
72                                 uint8_t hash[XATTR_SD_HASH_SIZE])
73 {
74         TALLOC_CTX *ctx = talloc_tos();
75         struct xattr_NTACL xacl;
76         enum ndr_err_code ndr_err;
77         size_t sd_size;
78
79         ndr_err = ndr_pull_struct_blob(pblob, ctx, NULL, &xacl,
80                         (ndr_pull_flags_fn_t)ndr_pull_xattr_NTACL);
81
82         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
83                 DEBUG(5, ("parse_acl_blob: ndr_pull_xattr_NTACL failed: %s\n",
84                         ndr_errstr(ndr_err)));
85                 return ndr_map_error2ntstatus(ndr_err);;
86         }
87
88         switch (xacl.version) {
89                 case 2:
90                         *ppdesc = make_sec_desc(ctx, SEC_DESC_REVISION,
91                                         xacl.info.sd_hs2->sd->type | SEC_DESC_SELF_RELATIVE,
92                                         xacl.info.sd_hs2->sd->owner_sid,
93                                         xacl.info.sd_hs2->sd->group_sid,
94                                         xacl.info.sd_hs2->sd->sacl,
95                                         xacl.info.sd_hs2->sd->dacl,
96                                         &sd_size);
97                         /* No hash - null out. */
98                         *p_hash_type = XATTR_SD_HASH_TYPE_NONE;
99                         memset(hash, '\0', XATTR_SD_HASH_SIZE);
100                         break;
101                 case 3:
102                         *ppdesc = make_sec_desc(ctx, SEC_DESC_REVISION,
103                                         xacl.info.sd_hs3->sd->type | SEC_DESC_SELF_RELATIVE,
104                                         xacl.info.sd_hs3->sd->owner_sid,
105                                         xacl.info.sd_hs3->sd->group_sid,
106                                         xacl.info.sd_hs3->sd->sacl,
107                                         xacl.info.sd_hs3->sd->dacl,
108                                         &sd_size);
109                         *p_hash_type = xacl.info.sd_hs3->hash_type;
110                         /* Current version 3. */
111                         memcpy(hash, xacl.info.sd_hs3->hash, XATTR_SD_HASH_SIZE);
112                         break;
113                 default:
114                         return NT_STATUS_REVISION_MISMATCH;
115         }
116
117         TALLOC_FREE(xacl.info.sd);
118
119         return (*ppdesc != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
120 }
121
122 /*******************************************************************
123  Pull a security descriptor into a DATA_BLOB from a xattr.
124 *******************************************************************/
125
126 static NTSTATUS get_acl_blob(TALLOC_CTX *ctx,
127                         vfs_handle_struct *handle,
128                         files_struct *fsp,
129                         const char *name,
130                         DATA_BLOB *pblob)
131 {
132         size_t size = 1024;
133         uint8_t *val = NULL;
134         uint8_t *tmp;
135         ssize_t sizeret;
136         int saved_errno = 0;
137
138         ZERO_STRUCTP(pblob);
139
140   again:
141
142         tmp = TALLOC_REALLOC_ARRAY(ctx, val, uint8_t, size);
143         if (tmp == NULL) {
144                 TALLOC_FREE(val);
145                 return NT_STATUS_NO_MEMORY;
146         }
147         val = tmp;
148
149         become_root();
150         if (fsp && fsp->fh->fd != -1) {
151                 sizeret = SMB_VFS_FGETXATTR(fsp, XATTR_NTACL_NAME, val, size);
152         } else {
153                 sizeret = SMB_VFS_GETXATTR(handle->conn, name,
154                                         XATTR_NTACL_NAME, val, size);
155         }
156         if (sizeret == -1) {
157                 saved_errno = errno;
158         }
159         unbecome_root();
160
161         /* Max ACL size is 65536 bytes. */
162         if (sizeret == -1) {
163                 errno = saved_errno;
164                 if ((errno == ERANGE) && (size != 65536)) {
165                         /* Too small, try again. */
166                         size = 65536;
167                         goto again;
168                 }
169
170                 /* Real error - exit here. */
171                 TALLOC_FREE(val);
172                 return map_nt_error_from_unix(errno);
173         }
174
175         pblob->data = val;
176         pblob->length = sizeret;
177         return NT_STATUS_OK;
178 }
179
180 /*******************************************************************
181  Create a DATA_BLOB from a security descriptor.
182 *******************************************************************/
183
184 static NTSTATUS create_acl_blob(const struct security_descriptor *psd,
185                         DATA_BLOB *pblob,
186                         uint16_t hash_type,
187                         uint8_t hash[XATTR_SD_HASH_SIZE])
188 {
189         struct xattr_NTACL xacl;
190         struct security_descriptor_hash_v3 sd_hs3;
191         enum ndr_err_code ndr_err;
192         TALLOC_CTX *ctx = talloc_tos();
193
194         ZERO_STRUCT(xacl);
195         ZERO_STRUCT(sd_hs3);
196
197         xacl.version = 3;
198         xacl.info.sd_hs3 = &sd_hs3;
199         xacl.info.sd_hs3->sd = CONST_DISCARD(struct security_descriptor *, psd);
200         xacl.info.sd_hs3->hash_type = hash_type;
201         memcpy(&xacl.info.sd_hs3->hash[0], hash, XATTR_SD_HASH_SIZE);
202
203         ndr_err = ndr_push_struct_blob(
204                         pblob, ctx, NULL, &xacl,
205                         (ndr_push_flags_fn_t)ndr_push_xattr_NTACL);
206
207         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
208                 DEBUG(5, ("create_acl_blob: ndr_push_xattr_NTACL failed: %s\n",
209                         ndr_errstr(ndr_err)));
210                 return ndr_map_error2ntstatus(ndr_err);;
211         }
212
213         return NT_STATUS_OK;
214 }
215
216 /*******************************************************************
217  Store a DATA_BLOB into an xattr given an fsp pointer.
218 *******************************************************************/
219
220 static NTSTATUS store_acl_blob_fsp(vfs_handle_struct *handle,
221                                 files_struct *fsp,
222                                 DATA_BLOB *pblob)
223 {
224         int ret;
225         int saved_errno = 0;
226
227         DEBUG(10,("store_acl_blob_fsp: storing blob length %u on file %s\n",
228                   (unsigned int)pblob->length, fsp_str_dbg(fsp)));
229
230         become_root();
231         if (fsp->fh->fd != -1) {
232                 ret = SMB_VFS_FSETXATTR(fsp, XATTR_NTACL_NAME,
233                         pblob->data, pblob->length, 0);
234         } else {
235                 ret = SMB_VFS_SETXATTR(fsp->conn, fsp->fsp_name->base_name,
236                                 XATTR_NTACL_NAME,
237                                 pblob->data, pblob->length, 0);
238         }
239         if (ret) {
240                 saved_errno = errno;
241         }
242         unbecome_root();
243         if (ret) {
244                 errno = saved_errno;
245                 DEBUG(5, ("store_acl_blob_fsp: setting attr failed for file %s"
246                         "with error %s\n",
247                         fsp_str_dbg(fsp),
248                         strerror(errno) ));
249                 return map_nt_error_from_unix(errno);
250         }
251         return NT_STATUS_OK;
252 }
253
254 /*******************************************************************
255  Store a DATA_BLOB into an xattr given a pathname.
256 *******************************************************************/
257
258 static NTSTATUS store_acl_blob_pathname(vfs_handle_struct *handle,
259                                         const char *fname,
260                                         DATA_BLOB *pblob)
261 {
262         connection_struct *conn = handle->conn;
263         int ret;
264         int saved_errno = 0;
265
266         DEBUG(10,("store_acl_blob_pathname: storing blob "
267                         "length %u on file %s\n",
268                         (unsigned int)pblob->length, fname));
269
270         become_root();
271         ret = SMB_VFS_SETXATTR(conn, fname,
272                                 XATTR_NTACL_NAME,
273                                 pblob->data, pblob->length, 0);
274         if (ret) {
275                 saved_errno = errno;
276         }
277         unbecome_root();
278         if (ret) {
279                 errno = saved_errno;
280                 DEBUG(5, ("store_acl_blob_pathname: setting attr failed "
281                         "for file %s with error %s\n",
282                         fname,
283                         strerror(errno) ));
284                 return map_nt_error_from_unix(errno);
285         }
286         return NT_STATUS_OK;
287 }
288
289 /*******************************************************************
290  Store a DATA_BLOB into an xattr given a pathname.
291 *******************************************************************/
292
293 static NTSTATUS get_nt_acl_xattr_internal(vfs_handle_struct *handle,
294                                         files_struct *fsp,
295                                         const char *name,
296                                         uint32_t security_info,
297                                         struct security_descriptor **ppdesc)
298 {
299         DATA_BLOB blob;
300         NTSTATUS status;
301         uint16_t hash_type;
302         uint8_t hash[XATTR_SD_HASH_SIZE];
303         uint8_t hash_tmp[XATTR_SD_HASH_SIZE];
304         struct security_descriptor *pdesc_next = NULL;
305
306         if (fsp && name == NULL) {
307                 name = fsp->fsp_name->base_name;
308         }
309
310         DEBUG(10, ("get_nt_acl_xattr_internal: name=%s\n", name));
311
312         status = get_acl_blob(talloc_tos(), handle, fsp, name, &blob);
313         if (!NT_STATUS_IS_OK(status)) {
314                 DEBUG(10, ("get_acl_blob returned %s\n", nt_errstr(status)));
315                 return status;
316         }
317
318         status = parse_acl_blob(&blob, ppdesc,
319                                 &hash_type, &hash[0]);
320         if (!NT_STATUS_IS_OK(status)) {
321                 DEBUG(10, ("parse_acl_blob returned %s\n",
322                                 nt_errstr(status)));
323                 return status;
324         }
325
326         /* Ensure the hash type is one we know. */
327         switch (hash_type) {
328                 case XATTR_SD_HASH_TYPE_NONE:
329                         /* No hash, goto return blob sd. */
330                         goto out;
331                 case XATTR_SD_HASH_TYPE_SHA256:
332                         break;
333                 default:
334                         return NT_STATUS_REVISION_MISMATCH;
335         }
336
337         /* Get the full underlying sd, then hash. */
338         if (fsp) {
339                 status = SMB_VFS_NEXT_FGET_NT_ACL(handle,
340                                 fsp,
341                                 HASH_SECURITY_INFO,
342                                 &pdesc_next);
343         } else {
344                 status = SMB_VFS_NEXT_GET_NT_ACL(handle,
345                                 name,
346                                 HASH_SECURITY_INFO,
347                                 &pdesc_next);
348         }
349
350         if (!NT_STATUS_IS_OK(status)) {
351                 goto out;
352         }
353
354         status = hash_sd_sha256(pdesc_next, hash_tmp);
355         if (!NT_STATUS_IS_OK(status)) {
356                 goto out;
357         }
358
359         if (memcmp(&hash[0], &hash_tmp[0], XATTR_SD_HASH_SIZE) == 0) {
360                 TALLOC_FREE(pdesc_next);
361                 /* Hash matches, return blob sd. */
362                 goto out;
363         }
364
365         /* Hash doesn't match, return underlying sd. */
366
367         if (!(security_info & OWNER_SECURITY_INFORMATION)) {
368                 pdesc_next->owner_sid = NULL;
369         }
370         if (!(security_info & GROUP_SECURITY_INFORMATION)) {
371                 pdesc_next->group_sid = NULL;
372         }
373         if (!(security_info & DACL_SECURITY_INFORMATION)) {
374                 pdesc_next->dacl = NULL;
375         }
376         if (!(security_info & SACL_SECURITY_INFORMATION)) {
377                 pdesc_next->sacl = NULL;
378         }
379
380         TALLOC_FREE(*ppdesc);
381         *ppdesc = pdesc_next;
382
383   out:
384
385         if (!(security_info & OWNER_SECURITY_INFORMATION)) {
386                 (*ppdesc)->owner_sid = NULL;
387         }
388         if (!(security_info & GROUP_SECURITY_INFORMATION)) {
389                 (*ppdesc)->group_sid = NULL;
390         }
391         if (!(security_info & DACL_SECURITY_INFORMATION)) {
392                 (*ppdesc)->dacl = NULL;
393         }
394         if (!(security_info & SACL_SECURITY_INFORMATION)) {
395                 (*ppdesc)->sacl = NULL;
396         }
397
398         TALLOC_FREE(blob.data);
399         return status;
400 }
401
402 /*********************************************************************
403  Create a default security descriptor for a file in case no inheritance
404  exists. All permissions to the owner and SYSTEM.
405 *********************************************************************/
406
407 static struct security_descriptor *default_file_sd(TALLOC_CTX *mem_ctx,
408                                                 SMB_STRUCT_STAT *psbuf)
409 {
410         struct dom_sid owner_sid, group_sid;
411         size_t sd_size;
412         struct security_ace *pace = NULL;
413         struct security_acl *pacl = NULL;
414
415         uid_to_sid(&owner_sid, psbuf->st_ex_uid);
416         gid_to_sid(&group_sid, psbuf->st_ex_gid);
417
418         pace = TALLOC_ARRAY(mem_ctx, struct security_ace, 2);
419         if (!pace) {
420                 return NULL;
421         }
422
423         init_sec_ace(&pace[0], &owner_sid, SEC_ACE_TYPE_ACCESS_ALLOWED,
424                         SEC_RIGHTS_FILE_ALL, 0);
425         init_sec_ace(&pace[1], &global_sid_System, SEC_ACE_TYPE_ACCESS_ALLOWED,
426                         SEC_RIGHTS_FILE_ALL, 0);
427
428         pacl = make_sec_acl(mem_ctx,
429                                 NT4_ACL_REVISION,
430                                 2,
431                                 pace);
432         if (!pacl) {
433                 return NULL;
434         }
435         return make_sec_desc(mem_ctx,
436                         SECURITY_DESCRIPTOR_REVISION_1,
437                         SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT,
438                         &owner_sid,
439                         &group_sid,
440                         NULL,
441                         pacl,
442                         &sd_size);
443 }
444
445 /*********************************************************************
446 *********************************************************************/
447
448 static NTSTATUS inherit_new_acl(vfs_handle_struct *handle,
449                                         struct smb_filename *smb_fname,
450                                         files_struct *fsp,
451                                         bool container)
452 {
453         TALLOC_CTX *ctx = talloc_tos();
454         NTSTATUS status;
455         struct security_descriptor *parent_desc = NULL;
456         struct security_descriptor *psd = NULL;
457         struct security_descriptor *pdesc_next = NULL;
458         DATA_BLOB blob;
459         size_t size;
460         char *parent_name;
461         uint8_t hash[XATTR_SD_HASH_SIZE];
462
463         if (!parent_dirname(ctx, smb_fname->base_name, &parent_name, NULL)) {
464                 return NT_STATUS_NO_MEMORY;
465         }
466
467         DEBUG(10,("inherit_new_acl: check directory %s\n",
468                         parent_name));
469
470         status = get_nt_acl_xattr_internal(handle,
471                                         NULL,
472                                         parent_name,
473                                         (OWNER_SECURITY_INFORMATION |
474                                          GROUP_SECURITY_INFORMATION |
475                                          DACL_SECURITY_INFORMATION),
476                                         &parent_desc);
477         if (NT_STATUS_IS_OK(status)) {
478                 /* Create an inherited descriptor from the parent. */
479
480                 if (DEBUGLEVEL >= 10) {
481                         DEBUG(10,("inherit_new_acl: parent acl is:\n"));
482                         NDR_PRINT_DEBUG(security_descriptor, parent_desc);
483                 }
484
485                 status = se_create_child_secdesc(ctx,
486                                 &psd,
487                                 &size,
488                                 parent_desc,
489                                 &handle->conn->server_info->ptok->user_sids[PRIMARY_USER_SID_INDEX],
490                                 &handle->conn->server_info->ptok->user_sids[PRIMARY_GROUP_SID_INDEX],
491                                 container);
492                 if (!NT_STATUS_IS_OK(status)) {
493                         return status;
494                 }
495
496                 if (DEBUGLEVEL >= 10) {
497                         DEBUG(10,("inherit_new_acl: child acl is:\n"));
498                         NDR_PRINT_DEBUG(security_descriptor, psd);
499                 }
500
501         } else {
502                 DEBUG(10,("inherit_new_acl: directory %s failed "
503                         "to get acl %s\n",
504                         parent_name,
505                         nt_errstr(status) ));
506         }
507
508         if (!psd || psd->dacl == NULL) {
509                 int ret;
510
511                 TALLOC_FREE(psd);
512                 if (fsp && !fsp->is_directory && fsp->fh->fd != -1) {
513                         ret = SMB_VFS_FSTAT(fsp, &smb_fname->st);
514                 } else {
515                         if (fsp && fsp->posix_open) {
516                                 ret = SMB_VFS_LSTAT(handle->conn, smb_fname);
517                         } else {
518                                 ret = SMB_VFS_STAT(handle->conn, smb_fname);
519                         }
520                 }
521                 if (ret == -1) {
522                         return map_nt_error_from_unix(errno);
523                 }
524                 psd = default_file_sd(ctx, &smb_fname->st);
525                 if (!psd) {
526                         return NT_STATUS_NO_MEMORY;
527                 }
528
529                 if (DEBUGLEVEL >= 10) {
530                         DEBUG(10,("inherit_new_acl: default acl is:\n"));
531                         NDR_PRINT_DEBUG(security_descriptor, psd);
532                 }
533         }
534
535         /* Object exists. Read the current SD to get the hash. */
536         if (fsp) {
537                 status = SMB_VFS_NEXT_FGET_NT_ACL(handle,
538                                 fsp,
539                                 HASH_SECURITY_INFO,
540                                 &pdesc_next);
541         } else {
542                 status = SMB_VFS_NEXT_GET_NT_ACL(handle,
543                                 smb_fname->base_name,
544                                 HASH_SECURITY_INFO,
545                                 &pdesc_next);
546         }
547
548         if (!NT_STATUS_IS_OK(status)) {
549                 return status;
550         }
551
552         status = hash_sd_sha256(pdesc_next, hash);
553         if (!NT_STATUS_IS_OK(status)) {
554                 return status;
555         }
556         status = create_acl_blob(psd, &blob, XATTR_SD_HASH_TYPE_SHA256, hash);
557         if (!NT_STATUS_IS_OK(status)) {
558                 return status;
559         }
560         if (fsp) {
561                 return store_acl_blob_fsp(handle, fsp, &blob);
562         } else {
563                 return store_acl_blob_pathname(handle, smb_fname->base_name,
564                                                &blob);
565         }
566 }
567
568 /*********************************************************************
569  Check ACL on open. For new files inherit from parent directory.
570 *********************************************************************/
571
572 static int open_acl_xattr(vfs_handle_struct *handle,
573                                         struct smb_filename *smb_fname,
574                                         files_struct *fsp,
575                                         int flags,
576                                         mode_t mode)
577 {
578         uint32_t access_granted = 0;
579         struct security_descriptor *pdesc = NULL;
580         bool file_existed = true;
581         char *fname = NULL;
582         NTSTATUS status;
583
584         if (fsp->base_fsp) {
585                 /* Stream open. Base filename open already did the ACL check. */
586                 DEBUG(10,("open_acl_xattr: stream open on %s\n",
587                         smb_fname_str_dbg(smb_fname) ));
588                 return SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
589         }
590
591         status = get_full_smb_filename(talloc_tos(), smb_fname,
592                                        &fname);
593         if (!NT_STATUS_IS_OK(status)) {
594                 errno = map_errno_from_nt_status(status);
595                 return -1;
596         }
597
598         status = get_nt_acl_xattr_internal(handle,
599                                         NULL,
600                                         fname,
601                                         (OWNER_SECURITY_INFORMATION |
602                                          GROUP_SECURITY_INFORMATION |
603                                          DACL_SECURITY_INFORMATION),
604                                         &pdesc);
605         if (NT_STATUS_IS_OK(status)) {
606                 /* See if we can access it. */
607                 status = smb1_file_se_access_check(pdesc,
608                                         handle->conn->server_info->ptok,
609                                         fsp->access_mask,
610                                         &access_granted);
611                 if (!NT_STATUS_IS_OK(status)) {
612                         DEBUG(10,("open_acl_xattr: file %s open "
613                                 "refused with error %s\n",
614                                 smb_fname_str_dbg(smb_fname),
615                                 nt_errstr(status) ));
616                         errno = map_errno_from_nt_status(status);
617                         return -1;
618                 }
619         } else if (NT_STATUS_EQUAL(status,NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
620                 file_existed = false;
621         }
622
623         DEBUG(10,("open_acl_xattr: get_nt_acl_attr_internal for "
624                 "file %s returned %s\n",
625                 smb_fname_str_dbg(smb_fname),
626                 nt_errstr(status) ));
627
628         fsp->fh->fd = SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
629
630         if (!file_existed && fsp->fh->fd != -1) {
631                 /* File was created. Inherit from parent directory. */
632                 status = fsp_set_smb_fname(fsp, smb_fname);
633                 if (!NT_STATUS_IS_OK(status)) {
634                         errno = map_errno_from_nt_status(status);
635                         return -1;
636                 }
637                 inherit_new_acl(handle, smb_fname, fsp, false);
638         }
639
640         return fsp->fh->fd;
641 }
642
643 static int mkdir_acl_xattr(vfs_handle_struct *handle, const char *path, mode_t mode)
644 {
645         struct smb_filename *smb_fname = NULL;
646         int ret = SMB_VFS_NEXT_MKDIR(handle, path, mode);
647         NTSTATUS status;
648
649         if (ret == -1) {
650                 return ret;
651         }
652
653         status = create_synthetic_smb_fname(talloc_tos(), path, NULL, NULL,
654                                             &smb_fname);
655         if (!NT_STATUS_IS_OK(status)) {
656                 errno = map_errno_from_nt_status(status);
657                 return -1;
658         }
659
660         /* New directory - inherit from parent. */
661         inherit_new_acl(handle, smb_fname, NULL, true);
662         TALLOC_FREE(smb_fname);
663         return ret;
664 }
665
666 /*********************************************************************
667  Fetch a security descriptor given an fsp.
668 *********************************************************************/
669
670 static NTSTATUS fget_nt_acl_xattr(vfs_handle_struct *handle, files_struct *fsp,
671         uint32_t security_info, struct security_descriptor **ppdesc)
672 {
673         return get_nt_acl_xattr_internal(handle, fsp,
674                                 NULL, security_info, ppdesc);
675 }
676
677 /*********************************************************************
678  Fetch a security descriptor given a pathname.
679 *********************************************************************/
680
681 static NTSTATUS get_nt_acl_xattr(vfs_handle_struct *handle,
682         const char *name, uint32_t security_info, struct security_descriptor **ppdesc)
683 {
684         return get_nt_acl_xattr_internal(handle, NULL,
685                                 name, security_info, ppdesc);
686 }
687
688 /*********************************************************************
689  Store a security descriptor given an fsp.
690 *********************************************************************/
691
692 static NTSTATUS fset_nt_acl_xattr(vfs_handle_struct *handle, files_struct *fsp,
693         uint32_t security_info_sent, const struct security_descriptor *psd)
694 {
695         NTSTATUS status;
696         DATA_BLOB blob;
697         struct security_descriptor *pdesc_next = NULL;
698         uint8_t hash[XATTR_SD_HASH_SIZE];
699
700         if (DEBUGLEVEL >= 10) {
701                 DEBUG(10,("fset_nt_acl_xattr: incoming sd for file %s\n",
702                           fsp_str_dbg(fsp)));
703                 NDR_PRINT_DEBUG(security_descriptor,
704                         CONST_DISCARD(struct security_descriptor *,psd));
705         }
706
707         /* Ensure owner and group are set. */
708         if (!psd->owner_sid || !psd->group_sid) {
709                 int ret;
710                 DOM_SID owner_sid, group_sid;
711                 struct security_descriptor *nc_psd = dup_sec_desc(talloc_tos(), psd);
712
713                 if (!nc_psd) {
714                         return NT_STATUS_OK;
715                 }
716                 if (fsp->is_directory || fsp->fh->fd == -1) {
717                         if (fsp->posix_open) {
718                                 ret = SMB_VFS_LSTAT(fsp->conn, fsp->fsp_name);
719                         } else {
720                                 ret = SMB_VFS_STAT(fsp->conn, fsp->fsp_name);
721                         }
722                 } else {
723                         ret = SMB_VFS_FSTAT(fsp, &fsp->fsp_name->st);
724                 }
725                 if (ret == -1) {
726                         /* Lower level acl set succeeded,
727                          * so still return OK. */
728                         return NT_STATUS_OK;
729                 }
730                 create_file_sids(&fsp->fsp_name->st, &owner_sid, &group_sid);
731                 /* This is safe as nc_psd is discarded at fn exit. */
732                 nc_psd->owner_sid = &owner_sid;
733                 nc_psd->group_sid = &group_sid;
734                 security_info_sent |= (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION);
735                 psd = nc_psd;
736         }
737
738         status = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
739         if (!NT_STATUS_IS_OK(status)) {
740                 return status;
741         }
742
743         /* Get the full underlying sd, then hash. */
744         status = SMB_VFS_NEXT_FGET_NT_ACL(handle,
745                                 fsp,
746                                 HASH_SECURITY_INFO,
747                                 &pdesc_next);
748
749         if (!NT_STATUS_IS_OK(status)) {
750                 return status;
751         }
752
753         status = hash_sd_sha256(pdesc_next, hash);
754         if (!NT_STATUS_IS_OK(status)) {
755                 return status;
756         }
757
758 #if 0
759         if ((security_info_sent & DACL_SECURITY_INFORMATION) &&
760                         psd->dacl != NULL &&
761                         (psd->type & (SE_DESC_DACL_AUTO_INHERITED|
762                                 SE_DESC_DACL_AUTO_INHERIT_REQ))==
763                                 (SE_DESC_DACL_AUTO_INHERITED|
764                                 SE_DESC_DACL_AUTO_INHERIT_REQ) ) {
765                 struct security_descriptor *new_psd = NULL;
766                 status = append_parent_acl(fsp, psd, &new_psd);
767                 if (!NT_STATUS_IS_OK(status)) {
768                         /* Lower level acl set succeeded,
769                          * so still return OK. */
770                         return NT_STATUS_OK;
771                 }
772                 psd = new_psd;
773         }
774 #endif
775
776         if (DEBUGLEVEL >= 10) {
777                 DEBUG(10,("fset_nt_acl_xattr: storing xattr sd for file %s\n",
778                           fsp_str_dbg(fsp)));
779                 NDR_PRINT_DEBUG(security_descriptor,
780                         CONST_DISCARD(struct security_descriptor *,psd));
781         }
782         create_acl_blob(psd, &blob, XATTR_SD_HASH_TYPE_SHA256, hash);
783         store_acl_blob_fsp(handle, fsp, &blob);
784
785         return NT_STATUS_OK;
786 }
787
788 /*********************************************************************
789  Remove a Windows ACL - we're setting the underlying POSIX ACL.
790 *********************************************************************/
791
792 static int sys_acl_set_file_xattr(vfs_handle_struct *handle,
793                               const char *name,
794                               SMB_ACL_TYPE_T type,
795                               SMB_ACL_T theacl)
796 {
797         int ret = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle,
798                                                 name,
799                                                 type,
800                                                 theacl);
801         if (ret == -1) {
802                 return -1;
803         }
804
805         become_root();
806         SMB_VFS_REMOVEXATTR(handle->conn, name, XATTR_NTACL_NAME);
807         unbecome_root();
808
809         return ret;
810 }
811
812 /*********************************************************************
813  Remove a Windows ACL - we're setting the underlying POSIX ACL.
814 *********************************************************************/
815
816 static int sys_acl_set_fd_xattr(vfs_handle_struct *handle,
817                             files_struct *fsp,
818                             SMB_ACL_T theacl)
819 {
820         int ret = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle,
821                                                 fsp,
822                                                 theacl);
823         if (ret == -1) {
824                 return -1;
825         }
826
827         become_root();
828         SMB_VFS_FREMOVEXATTR(fsp, XATTR_NTACL_NAME);
829         unbecome_root();
830
831         return ret;
832 }
833
834
835 static struct vfs_fn_pointers vfs_acl_xattr_fns = {
836         .mkdir = mkdir_acl_xattr,
837         .open = open_acl_xattr,
838         .fget_nt_acl = fget_nt_acl_xattr,
839         .get_nt_acl = get_nt_acl_xattr,
840         .fset_nt_acl = fset_nt_acl_xattr,
841         .sys_acl_set_file = sys_acl_set_file_xattr,
842         .sys_acl_set_fd = sys_acl_set_fd_xattr
843 };
844
845 NTSTATUS vfs_acl_xattr_init(void)
846 {
847         return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "acl_xattr",
848                                 &vfs_acl_xattr_fns);
849 }