Fix bug #6154 - zfs does not honor admin users.
[ira/wip.git] / source3 / smbd / file_access.c
1 /*
2    Unix SMB/CIFS implementation.
3    Check access to files based on security descriptors.
4    Copyright (C) Jeremy Allison 2005-2006.
5    Copyright (C) Michael Adam 2007.
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 3 of the License, or
10    (at your option) any later version.
11
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16
17    You should have received a copy of the GNU General Public License
18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22
23 #undef  DBGC_CLASS
24 #define DBGC_CLASS DBGC_ACLS
25
26 /**
27  * Security descriptor / NT Token level access check function.
28  */
29 bool can_access_file_acl(struct connection_struct *conn,
30                                 const char * fname,
31                                 uint32_t access_mask)
32 {
33         NTSTATUS status;
34         uint32_t access_granted;
35         struct security_descriptor *secdesc = NULL;
36
37         if (conn->server_info->utok.uid == 0 || conn->admin_user) {
38                 /* I'm sorry sir, I didn't know you were root... */
39                 return true;
40         }
41
42         status = SMB_VFS_GET_NT_ACL(conn, fname,
43                                     (OWNER_SECURITY_INFORMATION |
44                                      GROUP_SECURITY_INFORMATION |
45                                      DACL_SECURITY_INFORMATION),
46                                     &secdesc);
47         if (!NT_STATUS_IS_OK(status)) {
48                 DEBUG(5, ("Could not get acl: %s\n", nt_errstr(status)));
49                 return false;
50         }
51
52         status = se_access_check(secdesc, conn->server_info->ptok,
53                                  access_mask, &access_granted);
54         TALLOC_FREE(secdesc);
55         return NT_STATUS_IS_OK(status);
56 }
57
58 /****************************************************************************
59  Actually emulate the in-kernel access checking for delete access. We need
60  this to successfully return ACCESS_DENIED on a file open for delete access.
61 ****************************************************************************/
62
63 bool can_delete_file_in_directory(connection_struct *conn, const char *fname)
64 {
65         SMB_STRUCT_STAT sbuf;
66         TALLOC_CTX *ctx = talloc_tos();
67         char *dname = NULL;
68
69         if (!CAN_WRITE(conn)) {
70                 return False;
71         }
72
73         /* Get the parent directory permission mask and owners. */
74         if (!parent_dirname(ctx, fname, &dname, NULL)) {
75                 return False;
76         }
77         if(SMB_VFS_STAT(conn, dname, &sbuf) != 0) {
78                 return False;
79         }
80
81         /* fast paths first */
82
83         if (!S_ISDIR(sbuf.st_mode)) {
84                 return False;
85         }
86         if (conn->server_info->utok.uid == 0 || conn->admin_user) {
87                 /* I'm sorry sir, I didn't know you were root... */
88                 return True;
89         }
90
91 #ifdef S_ISVTX
92         /* sticky bit means delete only by owner or root. */
93         if (sbuf.st_mode & S_ISVTX) {
94                 SMB_STRUCT_STAT sbuf_file;
95                 if(SMB_VFS_STAT(conn, fname, &sbuf_file) != 0) {
96                         if (errno == ENOENT) {
97                                 /* If the file doesn't already exist then
98                                  * yes we'll be able to delete it. */
99                                 return True;
100                         }
101                         return False;
102                 }
103                 /*
104                  * Patch from SATOH Fumiyasu <fumiyas@miraclelinux.com>
105                  * for bug #3348. Don't assume owning sticky bit
106                  * directory means write access allowed.
107                  */
108                 if (conn->server_info->utok.uid != sbuf_file.st_uid) {
109                         return False;
110                 }
111         }
112 #endif
113
114         /* now for ACL checks */
115
116         /*
117          * There's two ways to get the permission to delete a file: First by
118          * having the DELETE bit on the file itself and second if that does
119          * not help, by the DELETE_CHILD bit on the containing directory.
120          *
121          * Here we only check the directory permissions, we will
122          * check the file DELETE permission separately.
123          */
124
125         return can_access_file_acl(conn, dname, FILE_DELETE_CHILD);
126 }
127
128 /****************************************************************************
129  Actually emulate the in-kernel access checking for read/write access. We need
130  this to successfully check for ability to write for dos filetimes.
131  Note this doesn't take into account share write permissions.
132 ****************************************************************************/
133
134 bool can_access_file_data(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *psbuf, uint32 access_mask)
135 {
136         if (!(access_mask & (FILE_READ_DATA|FILE_WRITE_DATA))) {
137                 return False;
138         }
139         access_mask &= (FILE_READ_DATA|FILE_WRITE_DATA);
140
141         /* some fast paths first */
142
143         DEBUG(10,("can_access_file_data: requesting 0x%x on file %s\n",
144                 (unsigned int)access_mask, fname ));
145
146         if (conn->server_info->utok.uid == 0 || conn->admin_user) {
147                 /* I'm sorry sir, I didn't know you were root... */
148                 return True;
149         }
150
151         if (!VALID_STAT(*psbuf)) {
152                 /* Get the file permission mask and owners. */
153                 if(SMB_VFS_STAT(conn, fname, psbuf) != 0) {
154                         return False;
155                 }
156         }
157
158         /* Check primary owner access. */
159         if (conn->server_info->utok.uid == psbuf->st_uid) {
160                 switch (access_mask) {
161                         case FILE_READ_DATA:
162                                 return (psbuf->st_mode & S_IRUSR) ? True : False;
163
164                         case FILE_WRITE_DATA:
165                                 return (psbuf->st_mode & S_IWUSR) ? True : False;
166
167                         default: /* FILE_READ_DATA|FILE_WRITE_DATA */
168
169                                 if ((psbuf->st_mode & (S_IWUSR|S_IRUSR)) == (S_IWUSR|S_IRUSR)) {
170                                         return True;
171                                 } else {
172                                         return False;
173                                 }
174                 }
175         }
176
177         /* now for ACL checks */
178
179         return can_access_file_acl(conn, fname, access_mask);
180 }
181
182 /****************************************************************************
183  Userspace check for write access.
184  Note this doesn't take into account share write permissions.
185 ****************************************************************************/
186
187 bool can_write_to_file(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *psbuf)
188 {
189         return can_access_file_data(conn, fname, psbuf, FILE_WRITE_DATA);
190 }
191
192 /****************************************************************************
193  Check for an existing default Windows ACL on a directory.
194 ****************************************************************************/
195
196 bool directory_has_default_acl(connection_struct *conn, const char *fname)
197 {
198         /* returns talloced off tos. */
199         struct security_descriptor *secdesc = NULL;
200         unsigned int i;
201         NTSTATUS status = SMB_VFS_GET_NT_ACL(conn, fname,
202                                 DACL_SECURITY_INFORMATION, &secdesc);
203
204         if (!NT_STATUS_IS_OK(status) || secdesc == NULL) {
205                 return false;
206         }
207
208         for (i = 0; i < secdesc->dacl->num_aces; i++) {
209                 struct security_ace *psa = &secdesc->dacl->aces[i];
210                 if (psa->flags & (SEC_ACE_FLAG_OBJECT_INHERIT|
211                                 SEC_ACE_FLAG_CONTAINER_INHERIT)) {
212                         TALLOC_FREE(secdesc);
213                         return true;
214                 }
215         }
216         TALLOC_FREE(secdesc);
217         return false;
218 }