2 Unix SMB/CIFS implementation.
3 Check access to files based on security descriptors.
4 Copyright (C) Jeremy Allison 2005-2006.
5 Copyright (C) Michael Adam 2007.
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #define DBGC_CLASS DBGC_ACLS
27 * Security descriptor / NT Token level access check function.
29 bool can_access_file_acl(struct connection_struct *conn,
34 uint32_t access_granted;
35 struct security_descriptor *secdesc = NULL;
37 status = SMB_VFS_GET_NT_ACL(conn, fname,
38 (OWNER_SECURITY_INFORMATION |
39 GROUP_SECURITY_INFORMATION |
40 DACL_SECURITY_INFORMATION),
42 if (!NT_STATUS_IS_OK(status)) {
43 DEBUG(5, ("Could not get acl: %s\n", nt_errstr(status)));
47 status = se_access_check(secdesc, conn->server_info->ptok,
48 access_mask, &access_granted);
50 return NT_STATUS_IS_OK(status);
53 /****************************************************************************
54 Actually emulate the in-kernel access checking for delete access. We need
55 this to successfully return ACCESS_DENIED on a file open for delete access.
56 ****************************************************************************/
58 bool can_delete_file_in_directory(connection_struct *conn, const char *fname)
61 TALLOC_CTX *ctx = talloc_tos();
64 if (!CAN_WRITE(conn)) {
68 /* Get the parent directory permission mask and owners. */
69 if (!parent_dirname(ctx, fname, &dname, NULL)) {
72 if(SMB_VFS_STAT(conn, dname, &sbuf) != 0) {
76 /* fast paths first */
78 if (!S_ISDIR(sbuf.st_mode)) {
81 if (conn->server_info->utok.uid == 0 || conn->admin_user) {
82 /* I'm sorry sir, I didn't know you were root... */
87 /* sticky bit means delete only by owner or root. */
88 if (sbuf.st_mode & S_ISVTX) {
89 SMB_STRUCT_STAT sbuf_file;
90 if(SMB_VFS_STAT(conn, fname, &sbuf_file) != 0) {
91 if (errno == ENOENT) {
92 /* If the file doesn't already exist then
93 * yes we'll be able to delete it. */
99 * Patch from SATOH Fumiyasu <fumiyas@miraclelinux.com>
100 * for bug #3348. Don't assume owning sticky bit
101 * directory means write access allowed.
103 if (conn->server_info->utok.uid != sbuf_file.st_uid) {
109 /* now for ACL checks */
112 * There's two ways to get the permission to delete a file: First by
113 * having the DELETE bit on the file itself and second if that does
114 * not help, by the DELETE_CHILD bit on the containing directory.
116 * Here we check the other way round because with just posix
117 * permissions looking at the file itself will never grant DELETE, so
118 * by looking at the directory first we save one get_acl call.
121 if (can_access_file_acl(conn, dname, FILE_DELETE_CHILD)) {
125 return can_access_file_acl(conn, fname, DELETE_ACCESS);
128 /****************************************************************************
129 Actually emulate the in-kernel access checking for read/write access. We need
130 this to successfully check for ability to write for dos filetimes.
131 Note this doesn't take into account share write permissions.
132 ****************************************************************************/
134 bool can_access_file_data(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *psbuf, uint32 access_mask)
136 if (!(access_mask & (FILE_READ_DATA|FILE_WRITE_DATA))) {
139 access_mask &= (FILE_READ_DATA|FILE_WRITE_DATA);
141 /* some fast paths first */
143 DEBUG(10,("can_access_file_data: requesting 0x%x on file %s\n",
144 (unsigned int)access_mask, fname ));
146 if (conn->server_info->utok.uid == 0 || conn->admin_user) {
147 /* I'm sorry sir, I didn't know you were root... */
151 if (!VALID_STAT(*psbuf)) {
152 /* Get the file permission mask and owners. */
153 if(SMB_VFS_STAT(conn, fname, psbuf) != 0) {
158 /* Check primary owner access. */
159 if (conn->server_info->utok.uid == psbuf->st_uid) {
160 switch (access_mask) {
162 return (psbuf->st_mode & S_IRUSR) ? True : False;
164 case FILE_WRITE_DATA:
165 return (psbuf->st_mode & S_IWUSR) ? True : False;
167 default: /* FILE_READ_DATA|FILE_WRITE_DATA */
169 if ((psbuf->st_mode & (S_IWUSR|S_IRUSR)) == (S_IWUSR|S_IRUSR)) {
177 /* now for ACL checks */
179 return can_access_file_acl(conn, fname, access_mask);
182 /****************************************************************************
183 Userspace check for write access.
184 Note this doesn't take into account share write permissions.
185 ****************************************************************************/
187 bool can_write_to_file(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *psbuf)
189 return can_access_file_data(conn, fname, psbuf, FILE_WRITE_DATA);
192 /****************************************************************************
193 Check for an existing default Windows ACL on a directory.
194 ****************************************************************************/
196 bool directory_has_default_acl(connection_struct *conn, const char *fname)
198 /* returns talloced off tos. */
199 struct security_descriptor *secdesc = NULL;
201 NTSTATUS status = SMB_VFS_GET_NT_ACL(conn, fname,
202 DACL_SECURITY_INFORMATION, &secdesc);
204 if (!NT_STATUS_IS_OK(status) || secdesc == NULL) {
208 for (i = 0; i < secdesc->dacl->num_aces; i++) {
209 struct security_ace *psa = &secdesc->dacl->aces[i];
210 if (psa->flags & (SEC_ACE_FLAG_OBJECT_INHERIT|
211 SEC_ACE_FLAG_CONTAINER_INHERIT)) {
212 TALLOC_FREE(secdesc);
216 TALLOC_FREE(secdesc);