87d45c5e7f6aabc900cb417e7006ca1ad7fd863f
[ira/wip.git] / source3 / smbd / file_access.c
1 /*
2    Unix SMB/CIFS implementation.
3    Check access to files based on security descriptors.
4    Copyright (C) Jeremy Allison 2005-2006.
5    Copyright (C) Michael Adam 2007.
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 3 of the License, or
10    (at your option) any later version.
11
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16
17    You should have received a copy of the GNU General Public License
18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22
23 #undef  DBGC_CLASS
24 #define DBGC_CLASS DBGC_ACLS
25
26 /**
27  * Security descriptor / NT Token level access check function.
28  */
29 bool can_access_file_acl(struct connection_struct *conn,
30                          const struct smb_filename *smb_fname,
31                          uint32_t access_mask)
32 {
33         NTSTATUS status;
34         uint32_t access_granted;
35         struct security_descriptor *secdesc = NULL;
36         char *fname = NULL;
37         bool ret;
38
39         if (conn->server_info->utok.uid == 0 || conn->admin_user) {
40                 /* I'm sorry sir, I didn't know you were root... */
41                 return true;
42         }
43
44         status = get_full_smb_filename(talloc_tos(), smb_fname, &fname);
45         if (!NT_STATUS_IS_OK(status)) {
46                 ret = false;
47                 goto out;
48         }
49
50         status = SMB_VFS_GET_NT_ACL(conn, fname,
51                                     (OWNER_SECURITY_INFORMATION |
52                                      GROUP_SECURITY_INFORMATION |
53                                      DACL_SECURITY_INFORMATION),
54                                     &secdesc);
55         if (!NT_STATUS_IS_OK(status)) {
56                 DEBUG(5, ("Could not get acl: %s\n", nt_errstr(status)));
57                 ret = false;
58                 goto out;
59         }
60
61         status = se_access_check(secdesc, conn->server_info->ptok,
62                                  access_mask, &access_granted);
63         ret = NT_STATUS_IS_OK(status);
64  out:
65         TALLOC_FREE(fname);
66         TALLOC_FREE(secdesc);
67         return ret;
68 }
69
70 /****************************************************************************
71  Actually emulate the in-kernel access checking for delete access. We need
72  this to successfully return ACCESS_DENIED on a file open for delete access.
73 ****************************************************************************/
74
75 bool can_delete_file_in_directory(connection_struct *conn,
76                                   struct smb_filename *smb_fname)
77 {
78         TALLOC_CTX *ctx = talloc_tos();
79         char *dname = NULL;
80         struct smb_filename *smb_fname_parent = NULL;
81         NTSTATUS status;
82         bool ret;
83
84         if (!CAN_WRITE(conn)) {
85                 return False;
86         }
87
88         /* Get the parent directory permission mask and owners. */
89         if (!parent_dirname(ctx, smb_fname->base_name, &dname, NULL)) {
90                 return False;
91         }
92
93         status = create_synthetic_smb_fname(ctx, dname, NULL, NULL,
94                                             &smb_fname_parent);
95         if (!NT_STATUS_IS_OK(status)) {
96                 ret = false;
97                 goto out;
98         }
99
100         if(SMB_VFS_STAT(conn, smb_fname_parent) != 0) {
101                 ret = false;
102                 goto out;
103         }
104
105         /* fast paths first */
106
107         if (!S_ISDIR(smb_fname_parent->st.st_ex_mode)) {
108                 ret = false;
109                 goto out;
110         }
111         if (conn->server_info->utok.uid == 0 || conn->admin_user) {
112                 /* I'm sorry sir, I didn't know you were root... */
113                 ret = true;
114                 goto out;
115         }
116
117 #ifdef S_ISVTX
118         /* sticky bit means delete only by owner of file or by root or
119          * by owner of directory. */
120         if (smb_fname_parent->st.st_ex_mode & S_ISVTX) {
121                 if(SMB_VFS_STAT(conn, smb_fname) != 0) {
122                         if (errno == ENOENT) {
123                                 /* If the file doesn't already exist then
124                                  * yes we'll be able to delete it. */
125                                 ret = true;
126                                 goto out;
127                         }
128                         DEBUG(10,("can_delete_file_in_directory: can't "
129                                   "stat file %s (%s)",
130                                   smb_fname_str_dbg(smb_fname),
131                                   strerror(errno) ));
132                         ret = false;
133                         goto out;
134                 }
135
136                 /*
137                  * Patch from SATOH Fumiyasu <fumiyas@miraclelinux.com>
138                  * for bug #3348. Don't assume owning sticky bit
139                  * directory means write access allowed.
140                  * Fail to delete if we're not the owner of the file,
141                  * or the owner of the directory as we have no possible
142                  * chance of deleting. Otherwise, go on and check the ACL.
143                  */
144                 if ((conn->server_info->utok.uid !=
145                         smb_fname_parent->st.st_ex_uid) &&
146                     (conn->server_info->utok.uid != smb_fname->st.st_ex_uid)) {
147                         DEBUG(10,("can_delete_file_in_directory: not "
148                                   "owner of file %s or directory %s",
149                                   smb_fname_str_dbg(smb_fname),
150                                   smb_fname_str_dbg(smb_fname_parent)));
151                         ret = false;
152                         goto out;
153                 }
154         }
155 #endif
156
157         /* now for ACL checks */
158
159         /*
160          * There's two ways to get the permission to delete a file: First by
161          * having the DELETE bit on the file itself and second if that does
162          * not help, by the DELETE_CHILD bit on the containing directory.
163          *
164          * Here we only check the directory permissions, we will
165          * check the file DELETE permission separately.
166          */
167
168         ret = can_access_file_acl(conn, smb_fname_parent, FILE_DELETE_CHILD);
169  out:
170         TALLOC_FREE(dname);
171         TALLOC_FREE(smb_fname_parent);
172         return ret;
173 }
174
175 /****************************************************************************
176  Actually emulate the in-kernel access checking for read/write access. We need
177  this to successfully check for ability to write for dos filetimes.
178  Note this doesn't take into account share write permissions.
179 ****************************************************************************/
180
181 bool can_access_file_data(connection_struct *conn,
182                           const struct smb_filename *smb_fname,
183                           uint32 access_mask)
184 {
185         if (!(access_mask & (FILE_READ_DATA|FILE_WRITE_DATA))) {
186                 return False;
187         }
188         access_mask &= (FILE_READ_DATA|FILE_WRITE_DATA);
189
190         /* some fast paths first */
191
192         DEBUG(10,("can_access_file_data: requesting 0x%x on file %s\n",
193                   (unsigned int)access_mask, smb_fname_str_dbg(smb_fname)));
194
195         if (conn->server_info->utok.uid == 0 || conn->admin_user) {
196                 /* I'm sorry sir, I didn't know you were root... */
197                 return True;
198         }
199
200         SMB_ASSERT(VALID_STAT(smb_fname->st));
201
202         /* Check primary owner access. */
203         if (conn->server_info->utok.uid == smb_fname->st.st_ex_uid) {
204                 switch (access_mask) {
205                         case FILE_READ_DATA:
206                                 return (smb_fname->st.st_ex_mode & S_IRUSR) ?
207                                     True : False;
208
209                         case FILE_WRITE_DATA:
210                                 return (smb_fname->st.st_ex_mode & S_IWUSR) ?
211                                     True : False;
212
213                         default: /* FILE_READ_DATA|FILE_WRITE_DATA */
214
215                                 if ((smb_fname->st.st_ex_mode &
216                                         (S_IWUSR|S_IRUSR)) ==
217                                     (S_IWUSR|S_IRUSR)) {
218                                         return True;
219                                 } else {
220                                         return False;
221                                 }
222                 }
223         }
224
225         /* now for ACL checks */
226
227         return can_access_file_acl(conn, smb_fname, access_mask);
228 }
229
230 /****************************************************************************
231  Userspace check for write access.
232  Note this doesn't take into account share write permissions.
233 ****************************************************************************/
234
235 bool can_write_to_file(connection_struct *conn, const char *fname, const SMB_STRUCT_STAT *psbuf)
236 {
237         struct smb_filename *smb_fname;
238         NTSTATUS status;
239         bool ret;
240
241         status = create_synthetic_smb_fname_split(talloc_tos(), fname, psbuf,
242                                                   &smb_fname);
243         if (!NT_STATUS_IS_OK(status)) {
244                 return false;
245         }
246
247         ret = can_access_file_data(conn, smb_fname, FILE_WRITE_DATA);
248
249         TALLOC_FREE(smb_fname);
250
251         return ret;
252 }
253
254 /****************************************************************************
255  Check for an existing default Windows ACL on a directory.
256 ****************************************************************************/
257
258 bool directory_has_default_acl(connection_struct *conn, const char *fname)
259 {
260         /* returns talloced off tos. */
261         struct security_descriptor *secdesc = NULL;
262         unsigned int i;
263         NTSTATUS status = SMB_VFS_GET_NT_ACL(conn, fname,
264                                 DACL_SECURITY_INFORMATION, &secdesc);
265
266         if (!NT_STATUS_IS_OK(status) || secdesc == NULL) {
267                 return false;
268         }
269
270         for (i = 0; i < secdesc->dacl->num_aces; i++) {
271                 struct security_ace *psa = &secdesc->dacl->aces[i];
272                 if (psa->flags & (SEC_ACE_FLAG_OBJECT_INHERIT|
273                                 SEC_ACE_FLAG_CONTAINER_INHERIT)) {
274                         TALLOC_FREE(secdesc);
275                         return true;
276                 }
277         }
278         TALLOC_FREE(secdesc);
279         return false;
280 }