2 Unix SMB/CIFS implementation.
3 Check access to files based on security descriptors.
4 Copyright (C) Jeremy Allison 2005-2006.
5 Copyright (C) Michael Adam 2007.
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #define DBGC_CLASS DBGC_ACLS
27 * Security descriptor / NT Token level access check function.
29 bool can_access_file_acl(struct connection_struct *conn,
30 const struct smb_filename *smb_fname,
34 uint32_t access_granted;
35 struct security_descriptor *secdesc = NULL;
39 if (conn->server_info->utok.uid == 0 || conn->admin_user) {
40 /* I'm sorry sir, I didn't know you were root... */
44 status = get_full_smb_filename(talloc_tos(), smb_fname, &fname);
45 if (!NT_STATUS_IS_OK(status)) {
50 status = SMB_VFS_GET_NT_ACL(conn, fname,
51 (OWNER_SECURITY_INFORMATION |
52 GROUP_SECURITY_INFORMATION |
53 DACL_SECURITY_INFORMATION),
55 if (!NT_STATUS_IS_OK(status)) {
56 DEBUG(5, ("Could not get acl: %s\n", nt_errstr(status)));
61 status = se_access_check(secdesc, conn->server_info->ptok,
62 access_mask, &access_granted);
63 ret = NT_STATUS_IS_OK(status);
70 /****************************************************************************
71 Actually emulate the in-kernel access checking for delete access. We need
72 this to successfully return ACCESS_DENIED on a file open for delete access.
73 ****************************************************************************/
75 bool can_delete_file_in_directory(connection_struct *conn,
76 struct smb_filename *smb_fname)
78 TALLOC_CTX *ctx = talloc_tos();
80 struct smb_filename *smb_fname_parent = NULL;
84 if (!CAN_WRITE(conn)) {
88 /* Get the parent directory permission mask and owners. */
89 if (!parent_dirname(ctx, smb_fname->base_name, &dname, NULL)) {
93 status = create_synthetic_smb_fname(ctx, dname, NULL, NULL,
95 if (!NT_STATUS_IS_OK(status)) {
100 if(SMB_VFS_STAT(conn, smb_fname_parent) != 0) {
105 /* fast paths first */
107 if (!S_ISDIR(smb_fname_parent->st.st_ex_mode)) {
111 if (conn->server_info->utok.uid == 0 || conn->admin_user) {
112 /* I'm sorry sir, I didn't know you were root... */
118 /* sticky bit means delete only by owner of file or by root or
119 * by owner of directory. */
120 if (smb_fname_parent->st.st_ex_mode & S_ISVTX) {
121 if(SMB_VFS_STAT(conn, smb_fname) != 0) {
122 if (errno == ENOENT) {
123 /* If the file doesn't already exist then
124 * yes we'll be able to delete it. */
128 DEBUG(10,("can_delete_file_in_directory: can't "
130 smb_fname_str_dbg(smb_fname),
137 * Patch from SATOH Fumiyasu <fumiyas@miraclelinux.com>
138 * for bug #3348. Don't assume owning sticky bit
139 * directory means write access allowed.
140 * Fail to delete if we're not the owner of the file,
141 * or the owner of the directory as we have no possible
142 * chance of deleting. Otherwise, go on and check the ACL.
144 if ((conn->server_info->utok.uid !=
145 smb_fname_parent->st.st_ex_uid) &&
146 (conn->server_info->utok.uid != smb_fname->st.st_ex_uid)) {
147 DEBUG(10,("can_delete_file_in_directory: not "
148 "owner of file %s or directory %s",
149 smb_fname_str_dbg(smb_fname),
150 smb_fname_str_dbg(smb_fname_parent)));
157 /* now for ACL checks */
160 * There's two ways to get the permission to delete a file: First by
161 * having the DELETE bit on the file itself and second if that does
162 * not help, by the DELETE_CHILD bit on the containing directory.
164 * Here we only check the directory permissions, we will
165 * check the file DELETE permission separately.
168 ret = can_access_file_acl(conn, smb_fname_parent, FILE_DELETE_CHILD);
171 TALLOC_FREE(smb_fname_parent);
175 /****************************************************************************
176 Actually emulate the in-kernel access checking for read/write access. We need
177 this to successfully check for ability to write for dos filetimes.
178 Note this doesn't take into account share write permissions.
179 ****************************************************************************/
181 bool can_access_file_data(connection_struct *conn,
182 const struct smb_filename *smb_fname,
185 if (!(access_mask & (FILE_READ_DATA|FILE_WRITE_DATA))) {
188 access_mask &= (FILE_READ_DATA|FILE_WRITE_DATA);
190 /* some fast paths first */
192 DEBUG(10,("can_access_file_data: requesting 0x%x on file %s\n",
193 (unsigned int)access_mask, smb_fname_str_dbg(smb_fname)));
195 if (conn->server_info->utok.uid == 0 || conn->admin_user) {
196 /* I'm sorry sir, I didn't know you were root... */
200 SMB_ASSERT(VALID_STAT(smb_fname->st));
202 /* Check primary owner access. */
203 if (conn->server_info->utok.uid == smb_fname->st.st_ex_uid) {
204 switch (access_mask) {
206 return (smb_fname->st.st_ex_mode & S_IRUSR) ?
209 case FILE_WRITE_DATA:
210 return (smb_fname->st.st_ex_mode & S_IWUSR) ?
213 default: /* FILE_READ_DATA|FILE_WRITE_DATA */
215 if ((smb_fname->st.st_ex_mode &
216 (S_IWUSR|S_IRUSR)) ==
225 /* now for ACL checks */
227 return can_access_file_acl(conn, smb_fname, access_mask);
230 /****************************************************************************
231 Userspace check for write access.
232 Note this doesn't take into account share write permissions.
233 ****************************************************************************/
235 bool can_write_to_file(connection_struct *conn, const char *fname, const SMB_STRUCT_STAT *psbuf)
237 struct smb_filename *smb_fname;
241 status = create_synthetic_smb_fname_split(talloc_tos(), fname, psbuf,
243 if (!NT_STATUS_IS_OK(status)) {
247 ret = can_access_file_data(conn, smb_fname, FILE_WRITE_DATA);
249 TALLOC_FREE(smb_fname);
254 /****************************************************************************
255 Check for an existing default Windows ACL on a directory.
256 ****************************************************************************/
258 bool directory_has_default_acl(connection_struct *conn, const char *fname)
260 /* returns talloced off tos. */
261 struct security_descriptor *secdesc = NULL;
263 NTSTATUS status = SMB_VFS_GET_NT_ACL(conn, fname,
264 DACL_SECURITY_INFORMATION, &secdesc);
266 if (!NT_STATUS_IS_OK(status) || secdesc == NULL) {
270 for (i = 0; i < secdesc->dacl->num_aces; i++) {
271 struct security_ace *psa = &secdesc->dacl->aces[i];
272 if (psa->flags & (SEC_ACE_FLAG_OBJECT_INHERIT|
273 SEC_ACE_FLAG_CONTAINER_INHERIT)) {
274 TALLOC_FREE(secdesc);
278 TALLOC_FREE(secdesc);