source3/smbd/posix_acls.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    SMB NT Security Descriptor / Unix permission conversion.
   4    Copyright (C) Jeremy Allison 1994-2009.
   5    Copyright (C) Andreas Gruenbacher 2002.
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22
  23 extern struct current_user current_user;
  24 extern const struct generic_mapping file_generic_mapping;
  25
  26 #undef  DBGC_CLASS
  27 #define DBGC_CLASS DBGC_ACLS
  28
  29 /****************************************************************************
  30  Data structures representing the internal ACE format.
  31 ****************************************************************************/
  32
  33 enum ace_owner {UID_ACE, GID_ACE, WORLD_ACE};
  34 enum ace_attribute {ALLOW_ACE, DENY_ACE}; /* Used for incoming NT ACLS. */
  35
  36 typedef union posix_id {
  37                 uid_t uid;
  38                 gid_t gid;
  39                 int world;
  40 } posix_id;
  41
  42 typedef struct canon_ace {
  43         struct canon_ace *next, *prev;
  44         SMB_ACL_TAG_T type;
  45         mode_t perms; /* Only use S_I(R|W|X)USR mode bits here. */
  46         DOM_SID trustee;
  47         enum ace_owner owner_type;
  48         enum ace_attribute attr;
  49         posix_id unix_ug;
  50         uint8_t ace_flags; /* From windows ACE entry. */
  51 } canon_ace;
  52
  53 #define ALL_ACE_PERMS (S_IRUSR|S_IWUSR|S_IXUSR)
  54
  55 /*
  56  * EA format of user.SAMBA_PAI (Samba_Posix_Acl_Interitance)
  57  * attribute on disk - version 1.
  58  * All values are little endian.
  59  *
  60  * |  1   |  1   |   2         |         2           |  ....
  61  * +------+------+-------------+---------------------+-------------+--------------------+
  62  * | vers | flag | num_entries | num_default_entries | ..entries.. | default_entries... |
  63  * +------+------+-------------+---------------------+-------------+--------------------+
  64  *
  65  * Entry format is :
  66  *
  67  * |  1   |       4           |
  68  * +------+-------------------+
  69  * | value|  uid/gid or world |
  70  * | type |  value            |
  71  * +------+-------------------+
  72  *
  73  * Version 2 format. Stores extra Windows metadata about an ACL.
  74  *
  75  * |  1   |  2       |   2         |         2           |  ....
  76  * +------+----------+-------------+---------------------+-------------+--------------------+
  77  * | vers | ace      | num_entries | num_default_entries | ..entries.. | default_entries... |
  78  * |   2  |  type    |             |                     |             |                    |
  79  * +------+----------+-------------+---------------------+-------------+--------------------+
  80  *
  81  * Entry format is :
  82  *
  83  * |  1   |  1   |       4           |
  84  * +------+------+-------------------+
  85  * | ace  | value|  uid/gid or world |
  86  * | flag | type |  value            |
  87  * +------+-------------------+------+
  88  *
  89  */
  90
  91 #define PAI_VERSION_OFFSET                      0
  92
  93 #define PAI_V1_FLAG_OFFSET                      1
  94 #define PAI_V1_NUM_ENTRIES_OFFSET               2
  95 #define PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET       4
  96 #define PAI_V1_ENTRIES_BASE                     6
  97 #define PAI_V1_ACL_FLAG_PROTECTED               0x1
  98 #define PAI_V1_ENTRY_LENGTH                     5
  99
 100 #define PAI_V1_VERSION                          1
 101
 102 #define PAI_V2_TYPE_OFFSET                      1
 103 #define PAI_V2_NUM_ENTRIES_OFFSET               3
 104 #define PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET       5
 105 #define PAI_V2_ENTRIES_BASE                     7
 106 #define PAI_V2_ENTRY_LENGTH                     6
 107
 108 #define PAI_V2_VERSION                          2
 109
 110 /*
 111  * In memory format of user.SAMBA_PAI attribute.
 112  */
 113
 114 struct pai_entry {
 115         struct pai_entry *next, *prev;
 116         uint8_t ace_flags;
 117         enum ace_owner owner_type;
 118         posix_id unix_ug;
 119 };
 120
 121 struct pai_val {
 122         uint16_t sd_type;
 123         unsigned int num_entries;
 124         struct pai_entry *entry_list;
 125         unsigned int num_def_entries;
 126         struct pai_entry *def_entry_list;
 127 };
 128
 129 /************************************************************************
 130  Return a uint32 of the pai_entry principal.
 131 ************************************************************************/
 132
 133 static uint32_t get_pai_entry_val(struct pai_entry *paie)
 134 {
 135         switch (paie->owner_type) {
 136                 case UID_ACE:
 137                         DEBUG(10,("get_pai_entry_val: uid = %u\n", (unsigned int)paie->unix_ug.uid ));
 138                         return (uint32_t)paie->unix_ug.uid;
 139                 case GID_ACE:
 140                         DEBUG(10,("get_pai_entry_val: gid = %u\n", (unsigned int)paie->unix_ug.gid ));
 141                         return (uint32_t)paie->unix_ug.gid;
 142                 case WORLD_ACE:
 143                 default:
 144                         DEBUG(10,("get_pai_entry_val: world ace\n"));
 145                         return (uint32_t)-1;
 146         }
 147 }
 148
 149 /************************************************************************
 150  Return a uint32 of the entry principal.
 151 ************************************************************************/
 152
 153 static uint32_t get_entry_val(canon_ace *ace_entry)
 154 {
 155         switch (ace_entry->owner_type) {
 156                 case UID_ACE:
 157                         DEBUG(10,("get_entry_val: uid = %u\n", (unsigned int)ace_entry->unix_ug.uid ));
 158                         return (uint32_t)ace_entry->unix_ug.uid;
 159                 case GID_ACE:
 160                         DEBUG(10,("get_entry_val: gid = %u\n", (unsigned int)ace_entry->unix_ug.gid ));
 161                         return (uint32_t)ace_entry->unix_ug.gid;
 162                 case WORLD_ACE:
 163                 default:
 164                         DEBUG(10,("get_entry_val: world ace\n"));
 165                         return (uint32_t)-1;
 166         }
 167 }
 168
 169 /************************************************************************
 170  Create the on-disk format (always v2 now). Caller must free.
 171 ************************************************************************/
 172
 173 static char *create_pai_buf_v2(canon_ace *file_ace_list,
 174                                 canon_ace *dir_ace_list,
 175                                 uint16_t sd_type,
 176                                 size_t *store_size)
 177 {
 178         char *pai_buf = NULL;
 179         canon_ace *ace_list = NULL;
 180         char *entry_offset = NULL;
 181         unsigned int num_entries = 0;
 182         unsigned int num_def_entries = 0;
 183
 184         for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next) {
 185                 num_entries++;
 186         }
 187
 188         for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next) {
 189                 num_def_entries++;
 190         }
 191
 192         DEBUG(10,("create_pai_buf_v2: num_entries = %u, num_def_entries = %u\n", num_entries, num_def_entries ));
 193
 194         *store_size = PAI_V2_ENTRIES_BASE +
 195                 ((num_entries + num_def_entries)*PAI_V2_ENTRY_LENGTH);
 196
 197         pai_buf = (char *)SMB_MALLOC(*store_size);
 198         if (!pai_buf) {
 199                 return NULL;
 200         }
 201
 202         /* Set up the header. */
 203         memset(pai_buf, '\0', PAI_V2_ENTRIES_BASE);
 204         SCVAL(pai_buf,PAI_VERSION_OFFSET,PAI_V2_VERSION);
 205         SSVAL(pai_buf,PAI_V2_TYPE_OFFSET, sd_type);
 206         SSVAL(pai_buf,PAI_V2_NUM_ENTRIES_OFFSET,num_entries);
 207         SSVAL(pai_buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET,num_def_entries);
 208
 209         entry_offset = pai_buf + PAI_V2_ENTRIES_BASE;
 210
 211         for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next) {
 212                 uint8_t type_val = (uint8_t)ace_list->owner_type;
 213                 uint32_t entry_val = get_entry_val(ace_list);
 214
 215                 SCVAL(entry_offset,0,ace_list->ace_flags);
 216                 SCVAL(entry_offset,1,type_val);
 217                 SIVAL(entry_offset,2,entry_val);
 218                 entry_offset += PAI_V2_ENTRY_LENGTH;
 219         }
 220
 221         for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next) {
 222                 uint8_t type_val = (uint8_t)ace_list->owner_type;
 223                 uint32_t entry_val = get_entry_val(ace_list);
 224
 225                 SCVAL(entry_offset,0,ace_list->ace_flags);
 226                 SCVAL(entry_offset,1,type_val);
 227                 SIVAL(entry_offset,2,entry_val);
 228                 entry_offset += PAI_V2_ENTRY_LENGTH;
 229         }
 230
 231         return pai_buf;
 232 }
 233
 234 /************************************************************************
 235  Store the user.SAMBA_PAI attribute on disk.
 236 ************************************************************************/
 237
 238 static void store_inheritance_attributes(files_struct *fsp,
 239                                         canon_ace *file_ace_list,
 240                                         canon_ace *dir_ace_list,
 241                                         uint16_t sd_type)
 242 {
 243         int ret;
 244         size_t store_size;
 245         char *pai_buf;
 246
 247         if (!lp_map_acl_inherit(SNUM(fsp->conn))) {
 248                 return;
 249         }
 250
 251         pai_buf = create_pai_buf_v2(file_ace_list, dir_ace_list,
 252                                 sd_type, &store_size);
 253
 254         if (fsp->fh->fd != -1) {
 255                 ret = SMB_VFS_FSETXATTR(fsp, SAMBA_POSIX_INHERITANCE_EA_NAME,
 256                                 pai_buf, store_size, 0);
 257         } else {
 258                 ret = SMB_VFS_SETXATTR(fsp->conn,fsp->fsp_name, SAMBA_POSIX_INHERITANCE_EA_NAME,
 259                                 pai_buf, store_size, 0);
 260         }
 261
 262         SAFE_FREE(pai_buf);
 263
 264         DEBUG(10,("store_inheritance_attribute: type 0x%x for file %s\n",
 265                 (unsigned int)sd_type,
 266                 fsp->fsp_name));
 267
 268         if (ret == -1 && !no_acl_syscall_error(errno)) {
 269                 DEBUG(1,("store_inheritance_attribute: Error %s\n", strerror(errno) ));
 270         }
 271 }
 272
 273 /************************************************************************
 274  Delete the in memory inheritance info.
 275 ************************************************************************/
 276
 277 static void free_inherited_info(struct pai_val *pal)
 278 {
 279         if (pal) {
 280                 struct pai_entry *paie, *paie_next;
 281                 for (paie = pal->entry_list; paie; paie = paie_next) {
 282                         paie_next = paie->next;
 283                         SAFE_FREE(paie);
 284                 }
 285                 for (paie = pal->def_entry_list; paie; paie = paie_next) {
 286                         paie_next = paie->next;
 287                         SAFE_FREE(paie);
 288                 }
 289                 SAFE_FREE(pal);
 290         }
 291 }
 292
 293 /************************************************************************
 294  Get any stored ACE flags.
 295 ************************************************************************/
 296
 297 static uint16_t get_pai_flags(struct pai_val *pal, canon_ace *ace_entry, bool default_ace)
 298 {
 299         struct pai_entry *paie;
 300
 301         if (!pal) {
 302                 return 0;
 303         }
 304
 305         /* If the entry exists it is inherited. */
 306         for (paie = (default_ace ? pal->def_entry_list : pal->entry_list); paie; paie = paie->next) {
 307                 if (ace_entry->owner_type == paie->owner_type &&
 308                                 get_entry_val(ace_entry) == get_pai_entry_val(paie))
 309                         return paie->ace_flags;
 310         }
 311         return 0;
 312 }
 313
 314 /************************************************************************
 315  Ensure an attribute just read is valid - v1.
 316 ************************************************************************/
 317
 318 static bool check_pai_ok_v1(const char *pai_buf, size_t pai_buf_data_size)
 319 {
 320         uint16 num_entries;
 321         uint16 num_def_entries;
 322
 323         if (pai_buf_data_size < PAI_V1_ENTRIES_BASE) {
 324                 /* Corrupted - too small. */
 325                 return false;
 326         }
 327
 328         if (CVAL(pai_buf,PAI_VERSION_OFFSET) != PAI_V1_VERSION) {
 329                 return false;
 330         }
 331
 332         num_entries = SVAL(pai_buf,PAI_V1_NUM_ENTRIES_OFFSET);
 333         num_def_entries = SVAL(pai_buf,PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET);
 334
 335         /* Check the entry lists match. */
 336         /* Each entry is 5 bytes (type plus 4 bytes of uid or gid). */
 337
 338         if (((num_entries + num_def_entries)*PAI_V1_ENTRY_LENGTH) +
 339                         PAI_V1_ENTRIES_BASE != pai_buf_data_size) {
 340                 return false;
 341         }
 342
 343         return true;
 344 }
 345
 346 /************************************************************************
 347  Ensure an attribute just read is valid - v2.
 348 ************************************************************************/
 349
 350 static bool check_pai_ok_v2(const char *pai_buf, size_t pai_buf_data_size)
 351 {
 352         uint16 num_entries;
 353         uint16 num_def_entries;
 354
 355         if (pai_buf_data_size < PAI_V2_ENTRIES_BASE) {
 356                 /* Corrupted - too small. */
 357                 return false;
 358         }
 359
 360         if (CVAL(pai_buf,PAI_VERSION_OFFSET) != PAI_V2_VERSION) {
 361                 return false;
 362         }
 363
 364         num_entries = SVAL(pai_buf,PAI_V2_NUM_ENTRIES_OFFSET);
 365         num_def_entries = SVAL(pai_buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET);
 366
 367         /* Check the entry lists match. */
 368         /* Each entry is 6 bytes (flags + type + 4 bytes of uid or gid). */
 369
 370         if (((num_entries + num_def_entries)*PAI_V2_ENTRY_LENGTH) +
 371                         PAI_V2_ENTRIES_BASE != pai_buf_data_size) {
 372                 return false;
 373         }
 374
 375         return true;
 376 }
 377
 378 /************************************************************************
 379  Decode the owner.
 380 ************************************************************************/
 381
 382 static bool get_pai_owner_type(struct pai_entry *paie, const char *entry_offset)
 383 {
 384         paie->owner_type = (enum ace_owner)CVAL(entry_offset,0);
 385         switch( paie->owner_type) {
 386                 case UID_ACE:
 387                         paie->unix_ug.uid = (uid_t)IVAL(entry_offset,1);
 388                         DEBUG(10,("get_pai_owner_type: uid = %u\n",
 389                                 (unsigned int)paie->unix_ug.uid ));
 390                         break;
 391                 case GID_ACE:
 392                         paie->unix_ug.gid = (gid_t)IVAL(entry_offset,1);
 393                         DEBUG(10,("get_pai_owner_type: gid = %u\n",
 394                                 (unsigned int)paie->unix_ug.gid ));
 395                         break;
 396                 case WORLD_ACE:
 397                         paie->unix_ug.world = -1;
 398                         DEBUG(10,("get_pai_owner_type: world ace\n"));
 399                         break;
 400                 default:
 401                         return false;
 402         }
 403         return true;
 404 }
 405
 406 /************************************************************************
 407  Process v2 entries.
 408 ************************************************************************/
 409
 410 static const char *create_pai_v1_entries(struct pai_val *paiv,
 411                                 const char *entry_offset,
 412                                 bool def_entry)
 413 {
 414         int i;
 415
 416         for (i = 0; i < paiv->num_entries; i++) {
 417                 struct pai_entry *paie = SMB_MALLOC_P(struct pai_entry);
 418                 if (!paie) {
 419                         return NULL;
 420                 }
 421
 422                 paie->ace_flags = SEC_ACE_FLAG_INHERITED_ACE;
 423                 if (!get_pai_owner_type(paie, entry_offset)) {
 424                         return NULL;
 425                 }
 426
 427                 if (!def_entry) {
 428                         DLIST_ADD(paiv->entry_list, paie);
 429                 } else {
 430                         DLIST_ADD(paiv->def_entry_list, paie);
 431                 }
 432                 entry_offset += PAI_V1_ENTRY_LENGTH;
 433         }
 434         return entry_offset;
 435 }
 436
 437 /************************************************************************
 438  Convert to in-memory format from version 1.
 439 ************************************************************************/
 440
 441 static struct pai_val *create_pai_val_v1(const char *buf, size_t size)
 442 {
 443         const char *entry_offset;
 444         struct pai_val *paiv = NULL;
 445
 446         if (!check_pai_ok_v1(buf, size)) {
 447                 return NULL;
 448         }
 449
 450         paiv = SMB_MALLOC_P(struct pai_val);
 451         if (!paiv) {
 452                 return NULL;
 453         }
 454
 455         memset(paiv, '\0', sizeof(struct pai_val));
 456
 457         paiv->sd_type = (CVAL(buf,PAI_V1_FLAG_OFFSET) == PAI_V1_ACL_FLAG_PROTECTED) ?
 458                         SE_DESC_DACL_PROTECTED : 0;
 459
 460         paiv->num_entries = SVAL(buf,PAI_V1_NUM_ENTRIES_OFFSET);
 461         paiv->num_def_entries = SVAL(buf,PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET);
 462
 463         entry_offset = buf + PAI_V1_ENTRIES_BASE;
 464
 465         DEBUG(10,("create_pai_val: num_entries = %u, num_def_entries = %u\n",
 466                         paiv->num_entries, paiv->num_def_entries ));
 467
 468         entry_offset = create_pai_v1_entries(paiv, entry_offset, false);
 469         if (entry_offset == NULL) {
 470                 free_inherited_info(paiv);
 471                 return NULL;
 472         }
 473         entry_offset = create_pai_v1_entries(paiv, entry_offset, true);
 474         if (entry_offset == NULL) {
 475                 free_inherited_info(paiv);
 476                 return NULL;
 477         }
 478
 479         return paiv;
 480 }
 481
 482 /************************************************************************
 483  Process v2 entries.
 484 ************************************************************************/
 485
 486 static const char *create_pai_v2_entries(struct pai_val *paiv,
 487                                 const char *entry_offset,
 488                                 bool def_entry)
 489 {
 490         int i;
 491
 492         for (i = 0; i < paiv->num_entries; i++) {
 493                 struct pai_entry *paie = SMB_MALLOC_P(struct pai_entry);
 494                 if (!paie) {
 495                         return NULL;
 496                 }
 497
 498                 paie->ace_flags = CVAL(entry_offset,0);
 499
 500                 entry_offset++;
 501
 502                 if (!get_pai_owner_type(paie, entry_offset)) {
 503                         return NULL;
 504                 }
 505                 if (!def_entry) {
 506                         DLIST_ADD(paiv->entry_list, paie);
 507                 } else {
 508                         DLIST_ADD(paiv->def_entry_list, paie);
 509                 }
 510                 entry_offset += PAI_V2_ENTRY_LENGTH;
 511         }
 512         return entry_offset;
 513 }
 514
 515 /************************************************************************
 516  Convert to in-memory format from version 2.
 517 ************************************************************************/
 518
 519 static struct pai_val *create_pai_val_v2(const char *buf, size_t size)
 520 {
 521         const char *entry_offset;
 522         struct pai_val *paiv = NULL;
 523
 524         if (!check_pai_ok_v2(buf, size)) {
 525                 return NULL;
 526         }
 527
 528         paiv = SMB_MALLOC_P(struct pai_val);
 529         if (!paiv) {
 530                 return NULL;
 531         }
 532
 533         memset(paiv, '\0', sizeof(struct pai_val));
 534
 535         paiv->sd_type = SVAL(buf,PAI_V2_TYPE_OFFSET);
 536
 537         paiv->num_entries = SVAL(buf,PAI_V2_NUM_ENTRIES_OFFSET);
 538         paiv->num_def_entries = SVAL(buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET);
 539
 540         entry_offset = buf + PAI_V2_ENTRIES_BASE;
 541
 542         DEBUG(10,("create_pai_val_v2: num_entries = %u, num_def_entries = %u\n",
 543                         paiv->num_entries, paiv->num_def_entries ));
 544
 545         entry_offset = create_pai_v2_entries(paiv, entry_offset, false);
 546         if (entry_offset == NULL) {
 547                 free_inherited_info(paiv);
 548                 return NULL;
 549         }
 550         entry_offset = create_pai_v2_entries(paiv, entry_offset, true);
 551         if (entry_offset == NULL) {
 552                 free_inherited_info(paiv);
 553                 return NULL;
 554         }
 555
 556         return paiv;
 557 }
 558
 559 /************************************************************************
 560  Convert to in-memory format - from either version 1 or 2.
 561 ************************************************************************/
 562
 563 static struct pai_val *create_pai_val(const char *buf, size_t size)
 564 {
 565         if (size < 1) {
 566                 return NULL;
 567         }
 568         if (CVAL(buf,PAI_VERSION_OFFSET) == PAI_V1_VERSION) {
 569                 return create_pai_val_v1(buf, size);
 570         } else if (CVAL(buf,PAI_VERSION_OFFSET) == PAI_V2_VERSION) {
 571                 return create_pai_val_v2(buf, size);
 572         } else {
 573                 return NULL;
 574         }
 575 }
 576
 577 /************************************************************************
 578  Load the user.SAMBA_PAI attribute.
 579 ************************************************************************/
 580
 581 static struct pai_val *fload_inherited_info(files_struct *fsp)
 582 {
 583         char *pai_buf;
 584         size_t pai_buf_size = 1024;
 585         struct pai_val *paiv = NULL;
 586         ssize_t ret;
 587
 588         if (!lp_map_acl_inherit(SNUM(fsp->conn))) {
 589                 return NULL;
 590         }
 591
 592         if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL) {
 593                 return NULL;
 594         }
 595
 596         do {
 597                 if (fsp->fh->fd != -1) {
 598                         ret = SMB_VFS_FGETXATTR(fsp, SAMBA_POSIX_INHERITANCE_EA_NAME,
 599                                         pai_buf, pai_buf_size);
 600                 } else {
 601                         ret = SMB_VFS_GETXATTR(fsp->conn,fsp->fsp_name,SAMBA_POSIX_INHERITANCE_EA_NAME,
 602                                         pai_buf, pai_buf_size);
 603                 }
 604
 605                 if (ret == -1) {
 606                         if (errno != ERANGE) {
 607                                 break;
 608                         }
 609                         /* Buffer too small - enlarge it. */
 610                         pai_buf_size *= 2;
 611                         SAFE_FREE(pai_buf);
 612                         if (pai_buf_size > 1024*1024) {
 613                                 return NULL; /* Limit malloc to 1mb. */
 614                         }
 615                         if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL)
 616                                 return NULL;
 617                 }
 618         } while (ret == -1);
 619
 620         DEBUG(10,("load_inherited_info: ret = %lu for file %s\n", (unsigned long)ret, fsp->fsp_name));
 621
 622         if (ret == -1) {
 623                 /* No attribute or not supported. */
 624 #if defined(ENOATTR)
 625                 if (errno != ENOATTR)
 626                         DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
 627 #else
 628                 if (errno != ENOSYS)
 629                         DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
 630 #endif
 631                 SAFE_FREE(pai_buf);
 632                 return NULL;
 633         }
 634
 635         paiv = create_pai_val(pai_buf, ret);
 636
 637         if (paiv) {
 638                 DEBUG(10,("load_inherited_info: ACL type is 0x%x for file %s\n",
 639                         (unsigned int)paiv->sd_type,
 640                         fsp->fsp_name));
 641         }
 642
 643         SAFE_FREE(pai_buf);
 644         return paiv;
 645 }
 646
 647 /************************************************************************
 648  Load the user.SAMBA_PAI attribute.
 649 ************************************************************************/
 650
 651 static struct pai_val *load_inherited_info(const struct connection_struct *conn,
 652                                            const char *fname)
 653 {
 654         char *pai_buf;
 655         size_t pai_buf_size = 1024;
 656         struct pai_val *paiv = NULL;
 657         ssize_t ret;
 658
 659         if (!lp_map_acl_inherit(SNUM(conn))) {
 660                 return NULL;
 661         }
 662
 663         if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL) {
 664                 return NULL;
 665         }
 666
 667         do {
 668                 ret = SMB_VFS_GETXATTR(conn, fname,
 669                                        SAMBA_POSIX_INHERITANCE_EA_NAME,
 670                                        pai_buf, pai_buf_size);
 671
 672                 if (ret == -1) {
 673                         if (errno != ERANGE) {
 674                                 break;
 675                         }
 676                         /* Buffer too small - enlarge it. */
 677                         pai_buf_size *= 2;
 678                         SAFE_FREE(pai_buf);
 679                         if (pai_buf_size > 1024*1024) {
 680                                 return NULL; /* Limit malloc to 1mb. */
 681                         }
 682                         if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL)
 683                                 return NULL;
 684                 }
 685         } while (ret == -1);
 686
 687         DEBUG(10,("load_inherited_info: ret = %lu for file %s\n", (unsigned long)ret, fname));
 688
 689         if (ret == -1) {
 690                 /* No attribute or not supported. */
 691 #if defined(ENOATTR)
 692                 if (errno != ENOATTR)
 693                         DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
 694 #else
 695                 if (errno != ENOSYS)
 696                         DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
 697 #endif
 698                 SAFE_FREE(pai_buf);
 699                 return NULL;
 700         }
 701
 702         paiv = create_pai_val(pai_buf, ret);
 703
 704         if (paiv) {
 705                 DEBUG(10,("load_inherited_info: ACL type 0x%x for file %s\n",
 706                         (unsigned int)paiv->sd_type,
 707                         fname));
 708         }
 709
 710         SAFE_FREE(pai_buf);
 711         return paiv;
 712 }
 713
 714 /****************************************************************************
 715  Functions to manipulate the internal ACE format.
 716 ****************************************************************************/
 717
 718 /****************************************************************************
 719  Count a linked list of canonical ACE entries.
 720 ****************************************************************************/
 721
 722 static size_t count_canon_ace_list( canon_ace *l_head )
 723 {
 724         size_t count = 0;
 725         canon_ace *ace;
 726
 727         for (ace = l_head; ace; ace = ace->next)
 728                 count++;
 729
 730         return count;
 731 }
 732
 733 /****************************************************************************
 734  Free a linked list of canonical ACE entries.
 735 ****************************************************************************/
 736
 737 static void free_canon_ace_list( canon_ace *l_head )
 738 {
 739         canon_ace *list, *next;
 740
 741         for (list = l_head; list; list = next) {
 742                 next = list->next;
 743                 DLIST_REMOVE(l_head, list);
 744                 SAFE_FREE(list);
 745         }
 746 }
 747
 748 /****************************************************************************
 749  Function to duplicate a canon_ace entry.
 750 ****************************************************************************/
 751
 752 static canon_ace *dup_canon_ace( canon_ace *src_ace)
 753 {
 754         canon_ace *dst_ace = SMB_MALLOC_P(canon_ace);
 755
 756         if (dst_ace == NULL)
 757                 return NULL;
 758
 759         *dst_ace = *src_ace;
 760         dst_ace->prev = dst_ace->next = NULL;
 761         return dst_ace;
 762 }
 763
 764 /****************************************************************************
 765  Print out a canon ace.
 766 ****************************************************************************/
 767
 768 static void print_canon_ace(canon_ace *pace, int num)
 769 {
 770         dbgtext( "canon_ace index %d. Type = %s ", num, pace->attr == ALLOW_ACE ? "allow" : "deny" );
 771         dbgtext( "SID = %s ", sid_string_dbg(&pace->trustee));
 772         if (pace->owner_type == UID_ACE) {
 773                 const char *u_name = uidtoname(pace->unix_ug.uid);
 774                 dbgtext( "uid %u (%s) ", (unsigned int)pace->unix_ug.uid, u_name );
 775         } else if (pace->owner_type == GID_ACE) {
 776                 char *g_name = gidtoname(pace->unix_ug.gid);
 777                 dbgtext( "gid %u (%s) ", (unsigned int)pace->unix_ug.gid, g_name );
 778         } else
 779                 dbgtext( "other ");
 780         switch (pace->type) {
 781                 case SMB_ACL_USER:
 782                         dbgtext( "SMB_ACL_USER ");
 783                         break;
 784                 case SMB_ACL_USER_OBJ:
 785                         dbgtext( "SMB_ACL_USER_OBJ ");
 786                         break;
 787                 case SMB_ACL_GROUP:
 788                         dbgtext( "SMB_ACL_GROUP ");
 789                         break;
 790                 case SMB_ACL_GROUP_OBJ:
 791                         dbgtext( "SMB_ACL_GROUP_OBJ ");
 792                         break;
 793                 case SMB_ACL_OTHER:
 794                         dbgtext( "SMB_ACL_OTHER ");
 795                         break;
 796                 default:
 797                         dbgtext( "MASK " );
 798                         break;
 799         }
 800
 801         dbgtext( "ace_flags = 0x%x ", (unsigned int)pace->ace_flags);
 802         dbgtext( "perms ");
 803         dbgtext( "%c", pace->perms & S_IRUSR ? 'r' : '-');
 804         dbgtext( "%c", pace->perms & S_IWUSR ? 'w' : '-');
 805         dbgtext( "%c\n", pace->perms & S_IXUSR ? 'x' : '-');
 806 }
 807
 808 /****************************************************************************
 809  Print out a canon ace list.
 810 ****************************************************************************/
 811
 812 static void print_canon_ace_list(const char *name, canon_ace *ace_list)
 813 {
 814         int count = 0;
 815
 816         if( DEBUGLVL( 10 )) {
 817                 dbgtext( "print_canon_ace_list: %s\n", name );
 818                 for (;ace_list; ace_list = ace_list->next, count++)
 819                         print_canon_ace(ace_list, count );
 820         }
 821 }
 822
 823 /****************************************************************************
 824  Map POSIX ACL perms to canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits).
 825 ****************************************************************************/
 826
 827 static mode_t convert_permset_to_mode_t(connection_struct *conn, SMB_ACL_PERMSET_T permset)
 828 {
 829         mode_t ret = 0;
 830
 831         ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ) ? S_IRUSR : 0);
 832         ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE) ? S_IWUSR : 0);
 833         ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_EXECUTE) ? S_IXUSR : 0);
 834
 835         return ret;
 836 }
 837
 838 /****************************************************************************
 839  Map generic UNIX permissions to canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits).
 840 ****************************************************************************/
 841
 842 static mode_t unix_perms_to_acl_perms(mode_t mode, int r_mask, int w_mask, int x_mask)
 843 {
 844         mode_t ret = 0;
 845
 846         if (mode & r_mask)
 847                 ret |= S_IRUSR;
 848         if (mode & w_mask)
 849                 ret |= S_IWUSR;
 850         if (mode & x_mask)
 851                 ret |= S_IXUSR;
 852
 853         return ret;
 854 }
 855
 856 /****************************************************************************
 857  Map canon_ace permissions (a mode_t containing only S_(R|W|X)USR bits) to
 858  an SMB_ACL_PERMSET_T.
 859 ****************************************************************************/
 860
 861 static int map_acl_perms_to_permset(connection_struct *conn, mode_t mode, SMB_ACL_PERMSET_T *p_permset)
 862 {
 863         if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn, *p_permset) ==  -1)
 864                 return -1;
 865         if (mode & S_IRUSR) {
 866                 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_READ) == -1)
 867                         return -1;
 868         }
 869         if (mode & S_IWUSR) {
 870                 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_WRITE) == -1)
 871                         return -1;
 872         }
 873         if (mode & S_IXUSR) {
 874                 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_EXECUTE) == -1)
 875                         return -1;
 876         }
 877         return 0;
 878 }
 879
 880 /****************************************************************************
 881  Function to create owner and group SIDs from a SMB_STRUCT_STAT.
 882 ****************************************************************************/
 883
 884 void create_file_sids(const SMB_STRUCT_STAT *psbuf, DOM_SID *powner_sid, DOM_SID *pgroup_sid)
 885 {
 886         uid_to_sid( powner_sid, psbuf->st_uid );
 887         gid_to_sid( pgroup_sid, psbuf->st_gid );
 888 }
 889
 890 /****************************************************************************
 891  Is the identity in two ACEs equal ? Check both SID and uid/gid.
 892 ****************************************************************************/
 893
 894 static bool identity_in_ace_equal(canon_ace *ace1, canon_ace *ace2)
 895 {
 896         if (sid_equal(&ace1->trustee, &ace2->trustee)) {
 897                 return True;
 898         }
 899         if (ace1->owner_type == ace2->owner_type) {
 900                 if (ace1->owner_type == UID_ACE &&
 901                                 ace1->unix_ug.uid == ace2->unix_ug.uid) {
 902                         return True;
 903                 } else if (ace1->owner_type == GID_ACE &&
 904                                 ace1->unix_ug.gid == ace2->unix_ug.gid) {
 905                         return True;
 906                 }
 907         }
 908         return False;
 909 }
 910
 911 /****************************************************************************
 912  Merge aces with a common sid - if both are allow or deny, OR the permissions together and
 913  delete the second one. If the first is deny, mask the permissions off and delete the allow
 914  if the permissions become zero, delete the deny if the permissions are non zero.
 915 ****************************************************************************/
 916
 917 static void merge_aces( canon_ace **pp_list_head )
 918 {
 919         canon_ace *l_head = *pp_list_head;
 920         canon_ace *curr_ace_outer;
 921         canon_ace *curr_ace_outer_next;
 922
 923         /*
 924          * First, merge allow entries with identical SIDs, and deny entries
 925          * with identical SIDs.
 926          */
 927
 928         for (curr_ace_outer = l_head; curr_ace_outer; curr_ace_outer = curr_ace_outer_next) {
 929                 canon_ace *curr_ace;
 930                 canon_ace *curr_ace_next;
 931
 932                 curr_ace_outer_next = curr_ace_outer->next; /* Save the link in case we delete. */
 933
 934                 for (curr_ace = curr_ace_outer->next; curr_ace; curr_ace = curr_ace_next) {
 935
 936                         curr_ace_next = curr_ace->next; /* Save the link in case of delete. */
 937
 938                         if (identity_in_ace_equal(curr_ace, curr_ace_outer) &&
 939                                 (curr_ace->attr == curr_ace_outer->attr)) {
 940
 941                                 if( DEBUGLVL( 10 )) {
 942                                         dbgtext("merge_aces: Merging ACE's\n");
 943                                         print_canon_ace( curr_ace_outer, 0);
 944                                         print_canon_ace( curr_ace, 0);
 945                                 }
 946
 947                                 /* Merge two allow or two deny ACE's. */
 948
 949                                 curr_ace_outer->perms |= curr_ace->perms;
 950                                 DLIST_REMOVE(l_head, curr_ace);
 951                                 SAFE_FREE(curr_ace);
 952                                 curr_ace_outer_next = curr_ace_outer->next; /* We may have deleted the link. */
 953                         }
 954                 }
 955         }
 956
 957         /*
 958          * Now go through and mask off allow permissions with deny permissions.
 959          * We can delete either the allow or deny here as we know that each SID
 960          * appears only once in the list.
 961          */
 962
 963         for (curr_ace_outer = l_head; curr_ace_outer; curr_ace_outer = curr_ace_outer_next) {
 964                 canon_ace *curr_ace;
 965                 canon_ace *curr_ace_next;
 966
 967                 curr_ace_outer_next = curr_ace_outer->next; /* Save the link in case we delete. */
 968
 969                 for (curr_ace = curr_ace_outer->next; curr_ace; curr_ace = curr_ace_next) {
 970
 971                         curr_ace_next = curr_ace->next; /* Save the link in case of delete. */
 972
 973                         /*
 974                          * Subtract ACE's with different entries. Due to the ordering constraints
 975                          * we've put on the ACL, we know the deny must be the first one.
 976                          */
 977
 978                         if (identity_in_ace_equal(curr_ace, curr_ace_outer) &&
 979                                 (curr_ace_outer->attr == DENY_ACE) && (curr_ace->attr == ALLOW_ACE)) {
 980
 981                                 if( DEBUGLVL( 10 )) {
 982                                         dbgtext("merge_aces: Masking ACE's\n");
 983                                         print_canon_ace( curr_ace_outer, 0);
 984                                         print_canon_ace( curr_ace, 0);
 985                                 }
 986
 987                                 curr_ace->perms &= ~curr_ace_outer->perms;
 988
 989                                 if (curr_ace->perms == 0) {
 990
 991                                         /*
 992                                          * The deny overrides the allow. Remove the allow.
 993                                          */
 994
 995                                         DLIST_REMOVE(l_head, curr_ace);
 996                                         SAFE_FREE(curr_ace);
 997                                         curr_ace_outer_next = curr_ace_outer->next; /* We may have deleted the link. */
 998
 999                                 } else {
1000
1001                                         /*
1002                                          * Even after removing permissions, there
1003                                          * are still allow permissions - delete the deny.
1004                                          * It is safe to delete the deny here,
1005                                          * as we are guarenteed by the deny first
1006                                          * ordering that all the deny entries for
1007                                          * this SID have already been merged into one
1008                                          * before we can get to an allow ace.
1009                                          */
1010
1011                                         DLIST_REMOVE(l_head, curr_ace_outer);
1012                                         SAFE_FREE(curr_ace_outer);
1013                                         break;
1014                                 }
1015                         }
1016
1017                 } /* end for curr_ace */
1018         } /* end for curr_ace_outer */
1019
1020         /* We may have modified the list. */
1021
1022         *pp_list_head = l_head;
1023 }
1024
1025 /****************************************************************************
1026  Check if we need to return NT4.x compatible ACL entries.
1027 ****************************************************************************/
1028
1029 bool nt4_compatible_acls(void)
1030 {
1031         int compat = lp_acl_compatibility();
1032
1033         if (compat == ACL_COMPAT_AUTO) {
1034                 enum remote_arch_types ra_type = get_remote_arch();
1035
1036                 /* Automatically adapt to client */
1037                 return (ra_type <= RA_WINNT);
1038         } else
1039                 return (compat == ACL_COMPAT_WINNT);
1040 }
1041
1042
1043 /****************************************************************************
1044  Map canon_ace perms to permission bits NT.
1045  The attr element is not used here - we only process deny entries on set,
1046  not get. Deny entries are implicit on get with ace->perms = 0.
1047 ****************************************************************************/
1048
1049 static uint32_t map_canon_ace_perms(int snum,
1050                                 enum security_ace_type *pacl_type,
1051                                 mode_t perms,
1052                                 bool directory_ace)
1053 {
1054         uint32_t nt_mask = 0;
1055
1056         *pacl_type = SEC_ACE_TYPE_ACCESS_ALLOWED;
1057
1058         if (lp_acl_map_full_control(snum) && ((perms & ALL_ACE_PERMS) == ALL_ACE_PERMS)) {
1059                 if (directory_ace) {
1060                         nt_mask = UNIX_DIRECTORY_ACCESS_RWX;
1061                 } else {
1062                         nt_mask = (UNIX_ACCESS_RWX & ~DELETE_ACCESS);
1063                 }
1064         } else if ((perms & ALL_ACE_PERMS) == (mode_t)0) {
1065                 /*
1066                  * Windows NT refuses to display ACEs with no permissions in them (but
1067                  * they are perfectly legal with Windows 2000). If the ACE has empty
1068                  * permissions we cannot use 0, so we use the otherwise unused
1069                  * WRITE_OWNER permission, which we ignore when we set an ACL.
1070                  * We abstract this into a #define of UNIX_ACCESS_NONE to allow this
1071                  * to be changed in the future.
1072                  */
1073
1074                 if (nt4_compatible_acls())
1075                         nt_mask = UNIX_ACCESS_NONE;
1076                 else
1077                         nt_mask = 0;
1078         } else {
1079                 if (directory_ace) {
1080                         nt_mask |= ((perms & S_IRUSR) ? UNIX_DIRECTORY_ACCESS_R : 0 );
1081                         nt_mask |= ((perms & S_IWUSR) ? UNIX_DIRECTORY_ACCESS_W : 0 );
1082                         nt_mask |= ((perms & S_IXUSR) ? UNIX_DIRECTORY_ACCESS_X : 0 );
1083                 } else {
1084                         nt_mask |= ((perms & S_IRUSR) ? UNIX_ACCESS_R : 0 );
1085                         nt_mask |= ((perms & S_IWUSR) ? UNIX_ACCESS_W : 0 );
1086                         nt_mask |= ((perms & S_IXUSR) ? UNIX_ACCESS_X : 0 );
1087                 }
1088         }
1089
1090         DEBUG(10,("map_canon_ace_perms: Mapped (UNIX) %x to (NT) %x\n",
1091                         (unsigned int)perms, (unsigned int)nt_mask ));
1092
1093         return nt_mask;
1094 }
1095
1096 /****************************************************************************
1097  Map NT perms to a UNIX mode_t.
1098 ****************************************************************************/
1099
1100 #define FILE_SPECIFIC_READ_BITS (FILE_READ_DATA|FILE_READ_EA|FILE_READ_ATTRIBUTES)
1101 #define FILE_SPECIFIC_WRITE_BITS (FILE_WRITE_DATA|FILE_APPEND_DATA|FILE_WRITE_EA|FILE_WRITE_ATTRIBUTES)
1102 #define FILE_SPECIFIC_EXECUTE_BITS (FILE_EXECUTE)
1103
1104 static mode_t map_nt_perms( uint32 *mask, int type)
1105 {
1106         mode_t mode = 0;
1107
1108         switch(type) {
1109         case S_IRUSR:
1110                 if((*mask) & GENERIC_ALL_ACCESS)
1111                         mode = S_IRUSR|S_IWUSR|S_IXUSR;
1112                 else {
1113                         mode |= ((*mask) & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IRUSR : 0;
1114                         mode |= ((*mask) & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWUSR : 0;
1115                         mode |= ((*mask) & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXUSR : 0;
1116                 }
1117                 break;
1118         case S_IRGRP:
1119                 if((*mask) & GENERIC_ALL_ACCESS)
1120                         mode = S_IRGRP|S_IWGRP|S_IXGRP;
1121                 else {
1122                         mode |= ((*mask) & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IRGRP : 0;
1123                         mode |= ((*mask) & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWGRP : 0;
1124                         mode |= ((*mask) & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXGRP : 0;
1125                 }
1126                 break;
1127         case S_IROTH:
1128                 if((*mask) & GENERIC_ALL_ACCESS)
1129                         mode = S_IROTH|S_IWOTH|S_IXOTH;
1130                 else {
1131                         mode |= ((*mask) & (GENERIC_READ_ACCESS|FILE_SPECIFIC_READ_BITS)) ? S_IROTH : 0;
1132                         mode |= ((*mask) & (GENERIC_WRITE_ACCESS|FILE_SPECIFIC_WRITE_BITS)) ? S_IWOTH : 0;
1133                         mode |= ((*mask) & (GENERIC_EXECUTE_ACCESS|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXOTH : 0;
1134                 }
1135                 break;
1136         }
1137
1138         return mode;
1139 }
1140
1141 /****************************************************************************
1142  Unpack a SEC_DESC into a UNIX owner and group.
1143 ****************************************************************************/
1144
1145 NTSTATUS unpack_nt_owners(int snum, uid_t *puser, gid_t *pgrp, uint32 security_info_sent, const SEC_DESC *psd)
1146 {
1147         DOM_SID owner_sid;
1148         DOM_SID grp_sid;
1149
1150         *puser = (uid_t)-1;
1151         *pgrp = (gid_t)-1;
1152
1153         if(security_info_sent == 0) {
1154                 DEBUG(0,("unpack_nt_owners: no security info sent !\n"));
1155                 return NT_STATUS_OK;
1156         }
1157
1158         /*
1159          * Validate the owner and group SID's.
1160          */
1161
1162         memset(&owner_sid, '\0', sizeof(owner_sid));
1163         memset(&grp_sid, '\0', sizeof(grp_sid));
1164
1165         DEBUG(5,("unpack_nt_owners: validating owner_sids.\n"));
1166
1167         /*
1168          * Don't immediately fail if the owner sid cannot be validated.
1169          * This may be a group chown only set.
1170          */
1171
1172         if (security_info_sent & OWNER_SECURITY_INFORMATION) {
1173                 sid_copy(&owner_sid, psd->owner_sid);
1174                 if (!sid_to_uid(&owner_sid, puser)) {
1175                         if (lp_force_unknown_acl_user(snum)) {
1176                                 /* this allows take ownership to work
1177                                  * reasonably */
1178                                 *puser = current_user.ut.uid;
1179                         } else {
1180                                 DEBUG(3,("unpack_nt_owners: unable to validate"
1181                                          " owner sid for %s\n",
1182                                          sid_string_dbg(&owner_sid)));
1183                                 return NT_STATUS_INVALID_OWNER;
1184                         }
1185                 }
1186                 DEBUG(3,("unpack_nt_owners: owner sid mapped to uid %u\n",
1187                          (unsigned int)*puser ));
1188         }
1189
1190         /*
1191          * Don't immediately fail if the group sid cannot be validated.
1192          * This may be an owner chown only set.
1193          */
1194
1195         if (security_info_sent & GROUP_SECURITY_INFORMATION) {
1196                 sid_copy(&grp_sid, psd->group_sid);
1197                 if (!sid_to_gid( &grp_sid, pgrp)) {
1198                         if (lp_force_unknown_acl_user(snum)) {
1199                                 /* this allows take group ownership to work
1200                                  * reasonably */
1201                                 *pgrp = current_user.ut.gid;
1202                         } else {
1203                                 DEBUG(3,("unpack_nt_owners: unable to validate"
1204                                          " group sid.\n"));
1205                                 return NT_STATUS_INVALID_OWNER;
1206                         }
1207                 }
1208                 DEBUG(3,("unpack_nt_owners: group sid mapped to gid %u\n",
1209                          (unsigned int)*pgrp));
1210         }
1211
1212         DEBUG(5,("unpack_nt_owners: owner_sids validated.\n"));
1213
1214         return NT_STATUS_OK;
1215 }
1216
1217 /****************************************************************************
1218  Ensure the enforced permissions for this share apply.
1219 ****************************************************************************/
1220
1221 static void apply_default_perms(const struct share_params *params,
1222                                 const bool is_directory, canon_ace *pace,
1223                                 mode_t type)
1224 {
1225         mode_t and_bits = (mode_t)0;
1226         mode_t or_bits = (mode_t)0;
1227
1228         /* Get the initial bits to apply. */
1229
1230         if (is_directory) {
1231                 and_bits = lp_dir_security_mask(params->service);
1232                 or_bits = lp_force_dir_security_mode(params->service);
1233         } else {
1234                 and_bits = lp_security_mask(params->service);
1235                 or_bits = lp_force_security_mode(params->service);
1236         }
1237
1238         /* Now bounce them into the S_USR space. */
1239         switch(type) {
1240         case S_IRUSR:
1241                 /* Ensure owner has read access. */
1242                 pace->perms |= S_IRUSR;
1243                 if (is_directory)
1244                         pace->perms |= (S_IWUSR|S_IXUSR);
1245                 and_bits = unix_perms_to_acl_perms(and_bits, S_IRUSR, S_IWUSR, S_IXUSR);
1246                 or_bits = unix_perms_to_acl_perms(or_bits, S_IRUSR, S_IWUSR, S_IXUSR);
1247                 break;
1248         case S_IRGRP:
1249                 and_bits = unix_perms_to_acl_perms(and_bits, S_IRGRP, S_IWGRP, S_IXGRP);
1250                 or_bits = unix_perms_to_acl_perms(or_bits, S_IRGRP, S_IWGRP, S_IXGRP);
1251                 break;
1252         case S_IROTH:
1253                 and_bits = unix_perms_to_acl_perms(and_bits, S_IROTH, S_IWOTH, S_IXOTH);
1254                 or_bits = unix_perms_to_acl_perms(or_bits, S_IROTH, S_IWOTH, S_IXOTH);
1255                 break;
1256         }
1257
1258         pace->perms = ((pace->perms & and_bits)|or_bits);
1259 }
1260
1261 /****************************************************************************
1262  Check if a given uid/SID is in a group gid/SID. This is probably very
1263  expensive and will need optimisation. A *lot* of optimisation :-). JRA.
1264 ****************************************************************************/
1265
1266 static bool uid_entry_in_group( canon_ace *uid_ace, canon_ace *group_ace )
1267 {
1268         const char *u_name = NULL;
1269
1270         /* "Everyone" always matches every uid. */
1271
1272         if (sid_equal(&group_ace->trustee, &global_sid_World))
1273                 return True;
1274
1275         /* Assume that the current user is in the current group (force group) */
1276
1277         if (uid_ace->unix_ug.uid == current_user.ut.uid && group_ace->unix_ug.gid == current_user.ut.gid)
1278                 return True;
1279
1280         /* u_name talloc'ed off tos. */
1281         u_name = uidtoname(uid_ace->unix_ug.uid);
1282         if (!u_name) {
1283                 return False;
1284         }
1285         return user_in_group_sid(u_name, &group_ace->trustee);
1286 }
1287
1288 /****************************************************************************
1289  A well formed POSIX file or default ACL has at least 3 entries, a
1290  SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ.
1291  In addition, the owner must always have at least read access.
1292  When using this call on get_acl, the pst struct is valid and contains
1293  the mode of the file. When using this call on set_acl, the pst struct has
1294  been modified to have a mode containing the default for this file or directory
1295  type.
1296 ****************************************************************************/
1297
1298 static bool ensure_canon_entry_valid(canon_ace **pp_ace,
1299                                      const struct share_params *params,
1300                                      const bool is_directory,
1301                                                         const DOM_SID *pfile_owner_sid,
1302                                                         const DOM_SID *pfile_grp_sid,
1303                                                         const SMB_STRUCT_STAT *pst,
1304                                                         bool setting_acl)
1305 {
1306         canon_ace *pace;
1307         bool got_user = False;
1308         bool got_grp = False;
1309         bool got_other = False;
1310         canon_ace *pace_other = NULL;
1311
1312         for (pace = *pp_ace; pace; pace = pace->next) {
1313                 if (pace->type == SMB_ACL_USER_OBJ) {
1314
1315                         if (setting_acl)
1316                                 apply_default_perms(params, is_directory, pace, S_IRUSR);
1317                         got_user = True;
1318
1319                 } else if (pace->type == SMB_ACL_GROUP_OBJ) {
1320
1321                         /*
1322                          * Ensure create mask/force create mode is respected on set.
1323                          */
1324
1325                         if (setting_acl)
1326                                 apply_default_perms(params, is_directory, pace, S_IRGRP);
1327                         got_grp = True;
1328
1329                 } else if (pace->type == SMB_ACL_OTHER) {
1330
1331                         /*
1332                          * Ensure create mask/force create mode is respected on set.
1333                          */
1334
1335                         if (setting_acl)
1336                                 apply_default_perms(params, is_directory, pace, S_IROTH);
1337                         got_other = True;
1338                         pace_other = pace;
1339                 }
1340         }
1341
1342         if (!got_user) {
1343                 if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1344                         DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1345                         return False;
1346                 }
1347
1348                 ZERO_STRUCTP(pace);
1349                 pace->type = SMB_ACL_USER_OBJ;
1350                 pace->owner_type = UID_ACE;
1351                 pace->unix_ug.uid = pst->st_uid;
1352                 pace->trustee = *pfile_owner_sid;
1353                 pace->attr = ALLOW_ACE;
1354
1355                 if (setting_acl) {
1356                         /* See if the owning user is in any of the other groups in
1357                            the ACE. If so, OR in the permissions from that group. */
1358
1359                         bool group_matched = False;
1360                         canon_ace *pace_iter;
1361
1362                         for (pace_iter = *pp_ace; pace_iter; pace_iter = pace_iter->next) {
1363                                 if (pace_iter->type == SMB_ACL_GROUP_OBJ || pace_iter->type == SMB_ACL_GROUP) {
1364                                         if (uid_entry_in_group(pace, pace_iter)) {
1365                                                 pace->perms |= pace_iter->perms;
1366                                                 group_matched = True;
1367                                         }
1368                                 }
1369                         }
1370
1371                         /* If we only got an "everyone" perm, just use that. */
1372                         if (!group_matched) {
1373                                 if (got_other)
1374                                         pace->perms = pace_other->perms;
1375                                 else
1376                                         pace->perms = 0;
1377                         }
1378
1379                         apply_default_perms(params, is_directory, pace, S_IRUSR);
1380                 } else {
1381                         pace->perms = unix_perms_to_acl_perms(pst->st_mode, S_IRUSR, S_IWUSR, S_IXUSR);
1382                 }
1383
1384                 DLIST_ADD(*pp_ace, pace);
1385         }
1386
1387         if (!got_grp) {
1388                 if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1389                         DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1390                         return False;
1391                 }
1392
1393                 ZERO_STRUCTP(pace);
1394                 pace->type = SMB_ACL_GROUP_OBJ;
1395                 pace->owner_type = GID_ACE;
1396                 pace->unix_ug.uid = pst->st_gid;
1397                 pace->trustee = *pfile_grp_sid;
1398                 pace->attr = ALLOW_ACE;
1399                 if (setting_acl) {
1400                         /* If we only got an "everyone" perm, just use that. */
1401                         if (got_other)
1402                                 pace->perms = pace_other->perms;
1403                         else
1404                                 pace->perms = 0;
1405                         apply_default_perms(params, is_directory, pace, S_IRGRP);
1406                 } else {
1407                         pace->perms = unix_perms_to_acl_perms(pst->st_mode, S_IRGRP, S_IWGRP, S_IXGRP);
1408                 }
1409
1410                 DLIST_ADD(*pp_ace, pace);
1411         }
1412
1413         if (!got_other) {
1414                 if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1415                         DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1416                         return False;
1417                 }
1418
1419                 ZERO_STRUCTP(pace);
1420                 pace->type = SMB_ACL_OTHER;
1421                 pace->owner_type = WORLD_ACE;
1422                 pace->unix_ug.world = -1;
1423                 pace->trustee = global_sid_World;
1424                 pace->attr = ALLOW_ACE;
1425                 if (setting_acl) {
1426                         pace->perms = 0;
1427                         apply_default_perms(params, is_directory, pace, S_IROTH);
1428                 } else
1429                         pace->perms = unix_perms_to_acl_perms(pst->st_mode, S_IROTH, S_IWOTH, S_IXOTH);
1430
1431                 DLIST_ADD(*pp_ace, pace);
1432         }
1433
1434         return True;
1435 }
1436
1437 /****************************************************************************
1438  Check if a POSIX ACL has the required SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries.
1439  If it does not have them, check if there are any entries where the trustee is the
1440  file owner or the owning group, and map these to SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ.
1441 ****************************************************************************/
1442
1443 static void check_owning_objs(canon_ace *ace, DOM_SID *pfile_owner_sid, DOM_SID *pfile_grp_sid)
1444 {
1445         bool got_user_obj, got_group_obj;
1446         canon_ace *current_ace;
1447         int i, entries;
1448
1449         entries = count_canon_ace_list(ace);
1450         got_user_obj = False;
1451         got_group_obj = False;
1452
1453         for (i=0, current_ace = ace; i < entries; i++, current_ace = current_ace->next) {
1454                 if (current_ace->type == SMB_ACL_USER_OBJ)
1455                         got_user_obj = True;
1456                 else if (current_ace->type == SMB_ACL_GROUP_OBJ)
1457                         got_group_obj = True;
1458         }
1459         if (got_user_obj && got_group_obj) {
1460                 DEBUG(10,("check_owning_objs: ACL had owning user/group entries.\n"));
1461                 return;
1462         }
1463
1464         for (i=0, current_ace = ace; i < entries; i++, current_ace = current_ace->next) {
1465                 if (!got_user_obj && current_ace->owner_type == UID_ACE &&
1466                                 sid_equal(&current_ace->trustee, pfile_owner_sid)) {
1467                         current_ace->type = SMB_ACL_USER_OBJ;
1468                         got_user_obj = True;
1469                 }
1470                 if (!got_group_obj && current_ace->owner_type == GID_ACE &&
1471                                 sid_equal(&current_ace->trustee, pfile_grp_sid)) {
1472                         current_ace->type = SMB_ACL_GROUP_OBJ;
1473                         got_group_obj = True;
1474                 }
1475         }
1476         if (!got_user_obj)
1477                 DEBUG(10,("check_owning_objs: ACL is missing an owner entry.\n"));
1478         if (!got_group_obj)
1479                 DEBUG(10,("check_owning_objs: ACL is missing an owning group entry.\n"));
1480 }
1481
1482 /****************************************************************************
1483  Unpack a SEC_DESC into two canonical ace lists.
1484 ****************************************************************************/
1485
1486 static bool create_canon_ace_lists(files_struct *fsp,
1487                                         SMB_STRUCT_STAT *pst,
1488                                         DOM_SID *pfile_owner_sid,
1489                                         DOM_SID *pfile_grp_sid,
1490                                         canon_ace **ppfile_ace,
1491                                         canon_ace **ppdir_ace,
1492                                         const SEC_ACL *dacl)
1493 {
1494         bool all_aces_are_inherit_only = (fsp->is_directory ? True : False);
1495         canon_ace *file_ace = NULL;
1496         canon_ace *dir_ace = NULL;
1497         canon_ace *current_ace = NULL;
1498         bool got_dir_allow = False;
1499         bool got_file_allow = False;
1500         int i, j;
1501
1502         *ppfile_ace = NULL;
1503         *ppdir_ace = NULL;
1504
1505         /*
1506          * Convert the incoming ACL into a more regular form.
1507          */
1508
1509         for(i = 0; i < dacl->num_aces; i++) {
1510                 SEC_ACE *psa = &dacl->aces[i];
1511
1512                 if((psa->type != SEC_ACE_TYPE_ACCESS_ALLOWED) && (psa->type != SEC_ACE_TYPE_ACCESS_DENIED)) {
1513                         DEBUG(3,("create_canon_ace_lists: unable to set anything but an ALLOW or DENY ACE.\n"));
1514                         return False;
1515                 }
1516
1517                 if (nt4_compatible_acls()) {
1518                         /*
1519                          * The security mask may be UNIX_ACCESS_NONE which should map into
1520                          * no permissions (we overload the WRITE_OWNER bit for this) or it
1521                          * should be one of the ALL/EXECUTE/READ/WRITE bits. Arrange for this
1522                          * to be so. Any other bits override the UNIX_ACCESS_NONE bit.
1523                          */
1524
1525                         /*
1526                          * Convert GENERIC bits to specific bits.
1527                          */
1528
1529                         se_map_generic(&psa->access_mask, &file_generic_mapping);
1530
1531                         psa->access_mask &= (UNIX_ACCESS_NONE|FILE_ALL_ACCESS);
1532
1533                         if(psa->access_mask != UNIX_ACCESS_NONE)
1534                                 psa->access_mask &= ~UNIX_ACCESS_NONE;
1535                 }
1536         }
1537
1538         /*
1539          * Deal with the fact that NT 4.x re-writes the canonical format
1540          * that we return for default ACLs. If a directory ACE is identical
1541          * to a inherited directory ACE then NT changes the bits so that the
1542          * first ACE is set to OI|IO and the second ACE for this SID is set
1543          * to CI. We need to repair this. JRA.
1544          */
1545
1546         for(i = 0; i < dacl->num_aces; i++) {
1547                 SEC_ACE *psa1 = &dacl->aces[i];
1548
1549                 for (j = i + 1; j < dacl->num_aces; j++) {
1550                         SEC_ACE *psa2 = &dacl->aces[j];
1551
1552                         if (psa1->access_mask != psa2->access_mask)
1553                                 continue;
1554
1555                         if (!sid_equal(&psa1->trustee, &psa2->trustee))
1556                                 continue;
1557
1558                         /*
1559                          * Ok - permission bits and SIDs are equal.
1560                          * Check if flags were re-written.
1561                          */
1562
1563                         if (psa1->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
1564
1565                                 psa1->flags |= (psa2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT));
1566                                 psa2->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT);
1567
1568                         } else if (psa2->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
1569
1570                                 psa2->flags |= (psa1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT));
1571                                 psa1->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT);
1572
1573                         }
1574                 }
1575         }
1576
1577         for(i = 0; i < dacl->num_aces; i++) {
1578                 SEC_ACE *psa = &dacl->aces[i];
1579
1580                 /*
1581                  * Create a cannon_ace entry representing this NT DACL ACE.
1582                  */
1583
1584                 if ((current_ace = SMB_MALLOC_P(canon_ace)) == NULL) {
1585                         free_canon_ace_list(file_ace);
1586                         free_canon_ace_list(dir_ace);
1587                         DEBUG(0,("create_canon_ace_lists: malloc fail.\n"));
1588                         return False;
1589                 }
1590
1591                 ZERO_STRUCTP(current_ace);
1592
1593                 sid_copy(&current_ace->trustee, &psa->trustee);
1594
1595                 /*
1596                  * Try and work out if the SID is a user or group
1597                  * as we need to flag these differently for POSIX.
1598                  * Note what kind of a POSIX ACL this should map to.
1599                  */
1600
1601                 if( sid_equal(&current_ace->trustee, &global_sid_World)) {
1602                         current_ace->owner_type = WORLD_ACE;
1603                         current_ace->unix_ug.world = -1;
1604                         current_ace->type = SMB_ACL_OTHER;
1605                 } else if (sid_equal(&current_ace->trustee, &global_sid_Creator_Owner)) {
1606                         current_ace->owner_type = UID_ACE;
1607                         current_ace->unix_ug.uid = pst->st_uid;
1608                         current_ace->type = SMB_ACL_USER_OBJ;
1609
1610                         /*
1611                          * The Creator Owner entry only specifies inheritable permissions,
1612                          * never access permissions. WinNT doesn't always set the ACE to
1613                          *INHERIT_ONLY, though.
1614                          */
1615
1616                         if (nt4_compatible_acls())
1617                                 psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
1618                 } else if (sid_equal(&current_ace->trustee, &global_sid_Creator_Group)) {
1619                         current_ace->owner_type = GID_ACE;
1620                         current_ace->unix_ug.gid = pst->st_gid;
1621                         current_ace->type = SMB_ACL_GROUP_OBJ;
1622
1623                         /*
1624                          * The Creator Group entry only specifies inheritable permissions,
1625                          * never access permissions. WinNT doesn't always set the ACE to
1626                          *INHERIT_ONLY, though.
1627                          */
1628                         if (nt4_compatible_acls())
1629                                 psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
1630
1631                 } else if (sid_to_uid( &current_ace->trustee, &current_ace->unix_ug.uid)) {
1632                         current_ace->owner_type = UID_ACE;
1633                         /* If it's the owning user, this is a user_obj, not
1634                          * a user. */
1635                         if (current_ace->unix_ug.uid == pst->st_uid) {
1636                                 current_ace->type = SMB_ACL_USER_OBJ;
1637                         } else {
1638                                 current_ace->type = SMB_ACL_USER;
1639                         }
1640                 } else if (sid_to_gid( &current_ace->trustee, &current_ace->unix_ug.gid)) {
1641                         current_ace->owner_type = GID_ACE;
1642                         /* If it's the primary group, this is a group_obj, not
1643                          * a group. */
1644                         if (current_ace->unix_ug.gid == pst->st_gid) {
1645                                 current_ace->type = SMB_ACL_GROUP_OBJ;
1646                         } else {
1647                                 current_ace->type = SMB_ACL_GROUP;
1648                         }
1649                 } else {
1650                         /*
1651                          * Silently ignore map failures in non-mappable SIDs (NT Authority, BUILTIN etc).
1652                          */
1653
1654                         if (non_mappable_sid(&psa->trustee)) {
1655                                 DEBUG(10, ("create_canon_ace_lists: ignoring "
1656                                            "non-mappable SID %s\n",
1657                                            sid_string_dbg(&psa->trustee)));
1658                                 SAFE_FREE(current_ace);
1659                                 continue;
1660                         }
1661
1662                         free_canon_ace_list(file_ace);
1663                         free_canon_ace_list(dir_ace);
1664                         DEBUG(0, ("create_canon_ace_lists: unable to map SID "
1665                                   "%s to uid or gid.\n",
1666                                   sid_string_dbg(&current_ace->trustee)));
1667                         SAFE_FREE(current_ace);
1668                         return False;
1669                 }
1670
1671                 /*
1672                  * Map the given NT permissions into a UNIX mode_t containing only
1673                  * S_I(R|W|X)USR bits.
1674                  */
1675
1676                 current_ace->perms |= map_nt_perms( &psa->access_mask, S_IRUSR);
1677                 current_ace->attr = (psa->type == SEC_ACE_TYPE_ACCESS_ALLOWED) ? ALLOW_ACE : DENY_ACE;
1678
1679                 /* Store the ace_flag. */
1680                 current_ace->ace_flags = psa->flags;
1681
1682                 /*
1683                  * Now add the created ace to either the file list, the directory
1684                  * list, or both. We *MUST* preserve the order here (hence we use
1685                  * DLIST_ADD_END) as NT ACLs are order dependent.
1686                  */
1687
1688                 if (fsp->is_directory) {
1689
1690                         /*
1691                          * We can only add to the default POSIX ACE list if the ACE is
1692                          * designed to be inherited by both files and directories.
1693                          */
1694
1695                         if ((psa->flags & (SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT)) ==
1696                                 (SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT)) {
1697
1698                                 DLIST_ADD_END(dir_ace, current_ace, canon_ace *);
1699
1700                                 /*
1701                                  * Note if this was an allow ace. We can't process
1702                                  * any further deny ace's after this.
1703                                  */
1704
1705                                 if (current_ace->attr == ALLOW_ACE)
1706                                         got_dir_allow = True;
1707
1708                                 if ((current_ace->attr == DENY_ACE) && got_dir_allow) {
1709                                         DEBUG(0,("create_canon_ace_lists: malformed ACL in inheritable ACL ! \
1710 Deny entry after Allow entry. Failing to set on file %s.\n", fsp->fsp_name ));
1711                                         free_canon_ace_list(file_ace);
1712                                         free_canon_ace_list(dir_ace);
1713                                         return False;
1714                                 }
1715
1716                                 if( DEBUGLVL( 10 )) {
1717                                         dbgtext("create_canon_ace_lists: adding dir ACL:\n");
1718                                         print_canon_ace( current_ace, 0);
1719                                 }
1720
1721                                 /*
1722                                  * If this is not an inherit only ACE we need to add a duplicate
1723                                  * to the file acl.
1724                                  */
1725
1726                                 if (!(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
1727                                         canon_ace *dup_ace = dup_canon_ace(current_ace);
1728
1729                                         if (!dup_ace) {
1730                                                 DEBUG(0,("create_canon_ace_lists: malloc fail !\n"));
1731                                                 free_canon_ace_list(file_ace);
1732                                                 free_canon_ace_list(dir_ace);
1733                                                 return False;
1734                                         }
1735
1736                                         /*
1737                                          * We must not free current_ace here as its
1738                                          * pointer is now owned by the dir_ace list.
1739                                          */
1740                                         current_ace = dup_ace;
1741                                 } else {
1742                                         /*
1743                                          * We must not free current_ace here as its
1744                                          * pointer is now owned by the dir_ace list.
1745                                          */
1746                                         current_ace = NULL;
1747                                 }
1748                         }
1749                 }
1750
1751                 /*
1752                  * Only add to the file ACL if not inherit only.
1753                  */
1754
1755                 if (current_ace && !(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
1756                         DLIST_ADD_END(file_ace, current_ace, canon_ace *);
1757
1758                         /*
1759                          * Note if this was an allow ace. We can't process
1760                          * any further deny ace's after this.
1761                          */
1762
1763                         if (current_ace->attr == ALLOW_ACE)
1764                                 got_file_allow = True;
1765
1766                         if ((current_ace->attr == DENY_ACE) && got_file_allow) {
1767                                 DEBUG(0,("create_canon_ace_lists: malformed ACL in file ACL ! \
1768 Deny entry after Allow entry. Failing to set on file %s.\n", fsp->fsp_name ));
1769                                 free_canon_ace_list(file_ace);
1770                                 free_canon_ace_list(dir_ace);
1771                                 return False;
1772                         }
1773
1774                         if( DEBUGLVL( 10 )) {
1775                                 dbgtext("create_canon_ace_lists: adding file ACL:\n");
1776                                 print_canon_ace( current_ace, 0);
1777                         }
1778                         all_aces_are_inherit_only = False;
1779                         /*
1780                          * We must not free current_ace here as its
1781                          * pointer is now owned by the file_ace list.
1782                          */
1783                         current_ace = NULL;
1784                 }
1785
1786                 /*
1787                  * Free if ACE was not added.
1788                  */
1789
1790                 SAFE_FREE(current_ace);
1791         }
1792
1793         if (fsp->is_directory && all_aces_are_inherit_only) {
1794                 /*
1795                  * Windows 2000 is doing one of these weird 'inherit acl'
1796                  * traverses to conserve NTFS ACL resources. Just pretend
1797                  * there was no DACL sent. JRA.
1798                  */
1799
1800                 DEBUG(10,("create_canon_ace_lists: Win2k inherit acl traverse. Ignoring DACL.\n"));
1801                 free_canon_ace_list(file_ace);
1802                 free_canon_ace_list(dir_ace);
1803                 file_ace = NULL;
1804                 dir_ace = NULL;
1805         } else {
1806                 /*
1807                  * Check if we have SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries in each
1808                  * ACL. If we don't have them, check if any SMB_ACL_USER/SMB_ACL_GROUP
1809                  * entries can be converted to *_OBJ. Usually we will already have these
1810                  * entries in the Default ACL, and the Access ACL will not have them.
1811                  */
1812                 if (file_ace) {
1813                         check_owning_objs(file_ace, pfile_owner_sid, pfile_grp_sid);
1814                 }
1815                 if (dir_ace) {
1816                         check_owning_objs(dir_ace, pfile_owner_sid, pfile_grp_sid);
1817                 }
1818         }
1819
1820         *ppfile_ace = file_ace;
1821         *ppdir_ace = dir_ace;
1822
1823         return True;
1824 }
1825
1826 /****************************************************************************
1827  ASCII art time again... JRA :-).
1828
1829  We have 4 cases to process when moving from an NT ACL to a POSIX ACL. Firstly,
1830  we insist the ACL is in canonical form (ie. all DENY entries preceede ALLOW
1831  entries). Secondly, the merge code has ensured that all duplicate SID entries for
1832  allow or deny have been merged, so the same SID can only appear once in the deny
1833  list or once in the allow list.
1834
1835  We then process as follows :
1836
1837  ---------------------------------------------------------------------------
1838  First pass - look for a Everyone DENY entry.
1839
1840  If it is deny all (rwx) trunate the list at this point.
1841  Else, walk the list from this point and use the deny permissions of this
1842  entry as a mask on all following allow entries. Finally, delete
1843  the Everyone DENY entry (we have applied it to everything possible).
1844
1845  In addition, in this pass we remove any DENY entries that have
1846  no permissions (ie. they are a DENY nothing).
1847  ---------------------------------------------------------------------------
1848  Second pass - only deal with deny user entries.
1849
1850  DENY user1 (perms XXX)
1851
1852  new_perms = 0
1853  for all following allow group entries where user1 is in group
1854         new_perms |= group_perms;
1855
1856  user1 entry perms = new_perms & ~ XXX;
1857
1858  Convert the deny entry to an allow entry with the new perms and
1859  push to the end of the list. Note if the user was in no groups
1860  this maps to a specific allow nothing entry for this user.
1861
1862  The common case from the NT ACL choser (userX deny all) is
1863  optimised so we don't do the group lookup - we just map to
1864  an allow nothing entry.
1865
1866  What we're doing here is inferring the allow permissions the
1867  person setting the ACE on user1 wanted by looking at the allow
1868  permissions on the groups the user is currently in. This will
1869  be a snapshot, depending on group membership but is the best
1870  we can do and has the advantage of failing closed rather than
1871  open.
1872  ---------------------------------------------------------------------------
1873  Third pass - only deal with deny group entries.
1874
1875  DENY group1 (perms XXX)
1876
1877  for all following allow user entries where user is in group1
1878    user entry perms = user entry perms & ~ XXX;
1879
1880  If there is a group Everyone allow entry with permissions YYY,
1881  convert the group1 entry to an allow entry and modify its
1882  permissions to be :
1883
1884  new_perms = YYY & ~ XXX
1885
1886  and push to the end of the list.
1887
1888  If there is no group Everyone allow entry then convert the
1889  group1 entry to a allow nothing entry and push to the end of the list.
1890
1891  Note that the common case from the NT ACL choser (groupX deny all)
1892  cannot be optimised here as we need to modify user entries who are
1893  in the group to change them to a deny all also.
1894
1895  What we're doing here is modifying the allow permissions of
1896  user entries (which are more specific in POSIX ACLs) to mask
1897  out the explicit deny set on the group they are in. This will
1898  be a snapshot depending on current group membership but is the
1899  best we can do and has the advantage of failing closed rather
1900  than open.
1901  ---------------------------------------------------------------------------
1902  Fourth pass - cope with cumulative permissions.
1903
1904  for all allow user entries, if there exists an allow group entry with
1905  more permissive permissions, and the user is in that group, rewrite the
1906  allow user permissions to contain both sets of permissions.
1907
1908  Currently the code for this is #ifdef'ed out as these semantics make
1909  no sense to me. JRA.
1910  ---------------------------------------------------------------------------
1911
1912  Note we *MUST* do the deny user pass first as this will convert deny user
1913  entries into allow user entries which can then be processed by the deny
1914  group pass.
1915
1916  The above algorithm took a *lot* of thinking about - hence this
1917  explaination :-). JRA.
1918 ****************************************************************************/
1919
1920 /****************************************************************************
1921  Process a canon_ace list entries. This is very complex code. We need
1922  to go through and remove the "deny" permissions from any allow entry that matches
1923  the id of this entry. We have already refused any NT ACL that wasn't in correct
1924  order (DENY followed by ALLOW). If any allow entry ends up with zero permissions,
1925  we just remove it (to fail safe). We have already removed any duplicate ace
1926  entries. Treat an "Everyone" DENY_ACE as a special case - use it to mask all
1927  allow entries.
1928 ****************************************************************************/
1929
1930 static void process_deny_list( canon_ace **pp_ace_list )
1931 {
1932         canon_ace *ace_list = *pp_ace_list;
1933         canon_ace *curr_ace = NULL;
1934         canon_ace *curr_ace_next = NULL;
1935
1936         /* Pass 1 above - look for an Everyone, deny entry. */
1937
1938         for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
1939                 canon_ace *allow_ace_p;
1940
1941                 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
1942
1943                 if (curr_ace->attr != DENY_ACE)
1944                         continue;
1945
1946                 if (curr_ace->perms == (mode_t)0) {
1947
1948                         /* Deny nothing entry - delete. */
1949
1950                         DLIST_REMOVE(ace_list, curr_ace);
1951                         continue;
1952                 }
1953
1954                 if (!sid_equal(&curr_ace->trustee, &global_sid_World))
1955                         continue;
1956
1957                 /* JRATEST - assert. */
1958                 SMB_ASSERT(curr_ace->owner_type == WORLD_ACE);
1959
1960                 if (curr_ace->perms == ALL_ACE_PERMS) {
1961
1962                         /*
1963                          * Optimisation. This is a DENY_ALL to Everyone. Truncate the
1964                          * list at this point including this entry.
1965                          */
1966
1967                         canon_ace *prev_entry = curr_ace->prev;
1968
1969                         free_canon_ace_list( curr_ace );
1970                         if (prev_entry)
1971                                 prev_entry->next = NULL;
1972                         else {
1973                                 /* We deleted the entire list. */
1974                                 ace_list = NULL;
1975                         }
1976                         break;
1977                 }
1978
1979                 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
1980
1981                         /*
1982                          * Only mask off allow entries.
1983                          */
1984
1985                         if (allow_ace_p->attr != ALLOW_ACE)
1986                                 continue;
1987
1988                         allow_ace_p->perms &= ~curr_ace->perms;
1989                 }
1990
1991                 /*
1992                  * Now it's been applied, remove it.
1993                  */
1994
1995                 DLIST_REMOVE(ace_list, curr_ace);
1996         }
1997
1998         /* Pass 2 above - deal with deny user entries. */
1999
2000         for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2001                 mode_t new_perms = (mode_t)0;
2002                 canon_ace *allow_ace_p;
2003
2004                 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2005
2006                 if (curr_ace->attr != DENY_ACE)
2007                         continue;
2008
2009                 if (curr_ace->owner_type != UID_ACE)
2010                         continue;
2011
2012                 if (curr_ace->perms == ALL_ACE_PERMS) {
2013
2014                         /*
2015                          * Optimisation - this is a deny everything to this user.
2016                          * Convert to an allow nothing and push to the end of the list.
2017                          */
2018
2019                         curr_ace->attr = ALLOW_ACE;
2020                         curr_ace->perms = (mode_t)0;
2021                         DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2022                         continue;
2023                 }
2024
2025                 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2026
2027                         if (allow_ace_p->attr != ALLOW_ACE)
2028                                 continue;
2029
2030                         /* We process GID_ACE and WORLD_ACE entries only. */
2031
2032                         if (allow_ace_p->owner_type == UID_ACE)
2033                                 continue;
2034
2035                         if (uid_entry_in_group( curr_ace, allow_ace_p))
2036                                 new_perms |= allow_ace_p->perms;
2037                 }
2038
2039                 /*
2040                  * Convert to a allow entry, modify the perms and push to the end
2041                  * of the list.
2042                  */
2043
2044                 curr_ace->attr = ALLOW_ACE;
2045                 curr_ace->perms = (new_perms & ~curr_ace->perms);
2046                 DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2047         }
2048
2049         /* Pass 3 above - deal with deny group entries. */
2050
2051         for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2052                 canon_ace *allow_ace_p;
2053                 canon_ace *allow_everyone_p = NULL;
2054
2055                 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2056
2057                 if (curr_ace->attr != DENY_ACE)
2058                         continue;
2059
2060                 if (curr_ace->owner_type != GID_ACE)
2061                         continue;
2062
2063                 for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2064
2065                         if (allow_ace_p->attr != ALLOW_ACE)
2066                                 continue;
2067
2068                         /* Store a pointer to the Everyone allow, if it exists. */
2069                         if (allow_ace_p->owner_type == WORLD_ACE)
2070                                 allow_everyone_p = allow_ace_p;
2071
2072                         /* We process UID_ACE entries only. */
2073
2074                         if (allow_ace_p->owner_type != UID_ACE)
2075                                 continue;
2076
2077                         /* Mask off the deny group perms. */
2078
2079                         if (uid_entry_in_group( allow_ace_p, curr_ace))
2080                                 allow_ace_p->perms &= ~curr_ace->perms;
2081                 }
2082
2083                 /*
2084                  * Convert the deny to an allow with the correct perms and
2085                  * push to the end of the list.
2086                  */
2087
2088                 curr_ace->attr = ALLOW_ACE;
2089                 if (allow_everyone_p)
2090                         curr_ace->perms = allow_everyone_p->perms & ~curr_ace->perms;
2091                 else
2092                         curr_ace->perms = (mode_t)0;
2093                 DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2094         }
2095
2096         /* Doing this fourth pass allows Windows semantics to be layered
2097          * on top of POSIX semantics. I'm not sure if this is desirable.
2098          * For example, in W2K ACLs there is no way to say, "Group X no
2099          * access, user Y full access" if user Y is a member of group X.
2100          * This seems completely broken semantics to me.... JRA.
2101          */
2102
2103 #if 0
2104         /* Pass 4 above - deal with allow entries. */
2105
2106         for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2107                 canon_ace *allow_ace_p;
2108
2109                 curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2110
2111                 if (curr_ace->attr != ALLOW_ACE)
2112                         continue;
2113
2114                 if (curr_ace->owner_type != UID_ACE)
2115                         continue;
2116
2117                 for (allow_ace_p = ace_list; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2118
2119                         if (allow_ace_p->attr != ALLOW_ACE)
2120                                 continue;
2121
2122                         /* We process GID_ACE entries only. */
2123
2124                         if (allow_ace_p->owner_type != GID_ACE)
2125                                 continue;
2126
2127                         /* OR in the group perms. */
2128
2129                         if (uid_entry_in_group( curr_ace, allow_ace_p))
2130                                 curr_ace->perms |= allow_ace_p->perms;
2131                 }
2132         }
2133 #endif
2134
2135         *pp_ace_list = ace_list;
2136 }
2137
2138 /****************************************************************************
2139  Create a default mode that will be used if a security descriptor entry has
2140  no user/group/world entries.
2141 ****************************************************************************/
2142
2143 static mode_t create_default_mode(files_struct *fsp, bool interitable_mode)
2144 {
2145         int snum = SNUM(fsp->conn);
2146         mode_t and_bits = (mode_t)0;
2147         mode_t or_bits = (mode_t)0;
2148         mode_t mode = interitable_mode
2149                 ? unix_mode( fsp->conn, FILE_ATTRIBUTE_ARCHIVE, fsp->fsp_name,
2150                              NULL )
2151                 : S_IRUSR;
2152
2153         if (fsp->is_directory)
2154                 mode |= (S_IWUSR|S_IXUSR);
2155
2156         /*
2157          * Now AND with the create mode/directory mode bits then OR with the
2158          * force create mode/force directory mode bits.
2159          */
2160
2161         if (fsp->is_directory) {
2162                 and_bits = lp_dir_security_mask(snum);
2163                 or_bits = lp_force_dir_security_mode(snum);
2164         } else {
2165                 and_bits = lp_security_mask(snum);
2166                 or_bits = lp_force_security_mode(snum);
2167         }
2168
2169         return ((mode & and_bits)|or_bits);
2170 }
2171
2172 /****************************************************************************
2173  Unpack a SEC_DESC into two canonical ace lists. We don't depend on this
2174  succeeding.
2175 ****************************************************************************/
2176
2177 static bool unpack_canon_ace(files_struct *fsp,
2178                                 SMB_STRUCT_STAT *pst,
2179                                 DOM_SID *pfile_owner_sid,
2180                                 DOM_SID *pfile_grp_sid,
2181                                 canon_ace **ppfile_ace,
2182                                 canon_ace **ppdir_ace,
2183                                 uint32 security_info_sent,
2184                                 const SEC_DESC *psd)
2185 {
2186         canon_ace *file_ace = NULL;
2187         canon_ace *dir_ace = NULL;
2188
2189         *ppfile_ace = NULL;
2190         *ppdir_ace = NULL;
2191
2192         if(security_info_sent == 0) {
2193                 DEBUG(0,("unpack_canon_ace: no security info sent !\n"));
2194                 return False;
2195         }
2196
2197         /*
2198          * If no DACL then this is a chown only security descriptor.
2199          */
2200
2201         if(!(security_info_sent & DACL_SECURITY_INFORMATION) || !psd->dacl)
2202                 return True;
2203
2204         /*
2205          * Now go through the DACL and create the canon_ace lists.
2206          */
2207
2208         if (!create_canon_ace_lists( fsp, pst, pfile_owner_sid, pfile_grp_sid,
2209                                                                 &file_ace, &dir_ace, psd->dacl))
2210                 return False;
2211
2212         if ((file_ace == NULL) && (dir_ace == NULL)) {
2213                 /* W2K traverse DACL set - ignore. */
2214                 return True;
2215         }
2216
2217         /*
2218          * Go through the canon_ace list and merge entries
2219          * belonging to identical users of identical allow or deny type.
2220          * We can do this as all deny entries come first, followed by
2221          * all allow entries (we have mandated this before accepting this acl).
2222          */
2223
2224         print_canon_ace_list( "file ace - before merge", file_ace);
2225         merge_aces( &file_ace );
2226
2227         print_canon_ace_list( "dir ace - before merge", dir_ace);
2228         merge_aces( &dir_ace );
2229
2230         /*
2231          * NT ACLs are order dependent. Go through the acl lists and
2232          * process DENY entries by masking the allow entries.
2233          */
2234
2235         print_canon_ace_list( "file ace - before deny", file_ace);
2236         process_deny_list( &file_ace);
2237
2238         print_canon_ace_list( "dir ace - before deny", dir_ace);
2239         process_deny_list( &dir_ace);
2240
2241         /*
2242          * A well formed POSIX file or default ACL has at least 3 entries, a
2243          * SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ
2244          * and optionally a mask entry. Ensure this is the case.
2245          */
2246
2247         print_canon_ace_list( "file ace - before valid", file_ace);
2248
2249         /*
2250          * A default 3 element mode entry for a file should be r-- --- ---.
2251          * A default 3 element mode entry for a directory should be rwx --- ---.
2252          */
2253
2254         pst->st_mode = create_default_mode(fsp, False);
2255
2256         if (!ensure_canon_entry_valid(&file_ace, fsp->conn->params, fsp->is_directory, pfile_owner_sid, pfile_grp_sid, pst, True)) {
2257                 free_canon_ace_list(file_ace);
2258                 free_canon_ace_list(dir_ace);
2259                 return False;
2260         }
2261
2262         print_canon_ace_list( "dir ace - before valid", dir_ace);
2263
2264         /*
2265          * A default inheritable 3 element mode entry for a directory should be the
2266          * mode Samba will use to create a file within. Ensure user rwx bits are set if
2267          * it's a directory.
2268          */
2269
2270         pst->st_mode = create_default_mode(fsp, True);
2271
2272         if (dir_ace && !ensure_canon_entry_valid(&dir_ace, fsp->conn->params, fsp->is_directory, pfile_owner_sid, pfile_grp_sid, pst, True)) {
2273                 free_canon_ace_list(file_ace);
2274                 free_canon_ace_list(dir_ace);
2275                 return False;
2276         }
2277
2278         print_canon_ace_list( "file ace - return", file_ace);
2279         print_canon_ace_list( "dir ace - return", dir_ace);
2280
2281         *ppfile_ace = file_ace;
2282         *ppdir_ace = dir_ace;
2283         return True;
2284
2285 }
2286
2287 /******************************************************************************
2288  When returning permissions, try and fit NT display
2289  semantics if possible. Note the the canon_entries here must have been malloced.
2290  The list format should be - first entry = owner, followed by group and other user
2291  entries, last entry = other.
2292
2293  Note that this doesn't exactly match the NT semantics for an ACL. As POSIX entries
2294  are not ordered, and match on the most specific entry rather than walking a list,
2295  then a simple POSIX permission of rw-r--r-- should really map to 5 entries,
2296
2297  Entry 0: owner : deny all except read and write.
2298  Entry 1: owner : allow read and write.
2299  Entry 2: group : deny all except read.
2300  Entry 3: group : allow read.
2301  Entry 4: Everyone : allow read.
2302
2303  But NT cannot display this in their ACL editor !
2304 ********************************************************************************/
2305
2306 static void arrange_posix_perms(const char *filename, canon_ace **pp_list_head)
2307 {
2308         canon_ace *l_head = *pp_list_head;
2309         canon_ace *owner_ace = NULL;
2310         canon_ace *other_ace = NULL;
2311         canon_ace *ace = NULL;
2312
2313         for (ace = l_head; ace; ace = ace->next) {
2314                 if (ace->type == SMB_ACL_USER_OBJ)
2315                         owner_ace = ace;
2316                 else if (ace->type == SMB_ACL_OTHER) {
2317                         /* Last ace - this is "other" */
2318                         other_ace = ace;
2319                 }
2320         }
2321
2322         if (!owner_ace || !other_ace) {
2323                 DEBUG(0,("arrange_posix_perms: Invalid POSIX permissions for file %s, missing owner or other.\n",
2324                         filename ));
2325                 return;
2326         }
2327
2328         /*
2329          * The POSIX algorithm applies to owner first, and other last,
2330          * so ensure they are arranged in this order.
2331          */
2332
2333         if (owner_ace) {
2334                 DLIST_PROMOTE(l_head, owner_ace);
2335         }
2336
2337         if (other_ace) {
2338                 DLIST_DEMOTE(l_head, other_ace, canon_ace *);
2339         }
2340
2341         /* We have probably changed the head of the list. */
2342
2343         *pp_list_head = l_head;
2344 }
2345
2346 /****************************************************************************
2347  Create a linked list of canonical ACE entries.
2348 ****************************************************************************/
2349
2350 static canon_ace *canonicalise_acl(struct connection_struct *conn,
2351                                    const char *fname, SMB_ACL_T posix_acl,
2352                                    const SMB_STRUCT_STAT *psbuf,
2353                                    const DOM_SID *powner, const DOM_SID *pgroup, struct pai_val *pal, SMB_ACL_TYPE_T the_acl_type)
2354 {
2355         mode_t acl_mask = (S_IRUSR|S_IWUSR|S_IXUSR);
2356         canon_ace *l_head = NULL;
2357         canon_ace *ace = NULL;
2358         canon_ace *next_ace = NULL;
2359         int entry_id = SMB_ACL_FIRST_ENTRY;
2360         SMB_ACL_ENTRY_T entry;
2361         size_t ace_count;
2362
2363         while ( posix_acl && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1)) {
2364                 SMB_ACL_TAG_T tagtype;
2365                 SMB_ACL_PERMSET_T permset;
2366                 DOM_SID sid;
2367                 posix_id unix_ug;
2368                 enum ace_owner owner_type;
2369
2370                 entry_id = SMB_ACL_NEXT_ENTRY;
2371
2372                 /* Is this a MASK entry ? */
2373                 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1)
2374                         continue;
2375
2376                 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1)
2377                         continue;
2378
2379                 /* Decide which SID to use based on the ACL type. */
2380                 switch(tagtype) {
2381                         case SMB_ACL_USER_OBJ:
2382                                 /* Get the SID from the owner. */
2383                                 sid_copy(&sid, powner);
2384                                 unix_ug.uid = psbuf->st_uid;
2385                                 owner_type = UID_ACE;
2386                                 break;
2387                         case SMB_ACL_USER:
2388                                 {
2389                                         uid_t *puid = (uid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
2390                                         if (puid == NULL) {
2391                                                 DEBUG(0,("canonicalise_acl: Failed to get uid.\n"));
2392                                                 continue;
2393                                         }
2394                                         /*
2395                                          * A SMB_ACL_USER entry for the owner is shadowed by the
2396                                          * SMB_ACL_USER_OBJ entry and Windows also cannot represent
2397                                          * that entry, so we ignore it. We also don't create such
2398                                          * entries out of the blue when setting ACLs, so a get/set
2399                                          * cycle will drop them.
2400                                          */
2401                                         if (the_acl_type == SMB_ACL_TYPE_ACCESS && *puid == psbuf->st_uid) {
2402                                                 SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)puid,tagtype);
2403                                                 continue;
2404                                         }
2405                                         uid_to_sid( &sid, *puid);
2406                                         unix_ug.uid = *puid;
2407                                         owner_type = UID_ACE;
2408                                         SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)puid,tagtype);
2409                                         break;
2410                                 }
2411                         case SMB_ACL_GROUP_OBJ:
2412                                 /* Get the SID from the owning group. */
2413                                 sid_copy(&sid, pgroup);
2414                                 unix_ug.gid = psbuf->st_gid;
2415                                 owner_type = GID_ACE;
2416                                 break;
2417                         case SMB_ACL_GROUP:
2418                                 {
2419                                         gid_t *pgid = (gid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
2420                                         if (pgid == NULL) {
2421                                                 DEBUG(0,("canonicalise_acl: Failed to get gid.\n"));
2422                                                 continue;
2423                                         }
2424                                         gid_to_sid( &sid, *pgid);
2425                                         unix_ug.gid = *pgid;
2426                                         owner_type = GID_ACE;
2427                                         SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)pgid,tagtype);
2428                                         break;
2429                                 }
2430                         case SMB_ACL_MASK:
2431                                 acl_mask = convert_permset_to_mode_t(conn, permset);
2432                                 continue; /* Don't count the mask as an entry. */
2433                         case SMB_ACL_OTHER:
2434                                 /* Use the Everyone SID */
2435                                 sid = global_sid_World;
2436                                 unix_ug.world = -1;
2437                                 owner_type = WORLD_ACE;
2438                                 break;
2439                         default:
2440                                 DEBUG(0,("canonicalise_acl: Unknown tagtype %u\n", (unsigned int)tagtype));
2441                                 continue;
2442                 }
2443
2444                 /*
2445                  * Add this entry to the list.
2446                  */
2447
2448                 if ((ace = SMB_MALLOC_P(canon_ace)) == NULL)
2449                         goto fail;
2450
2451                 ZERO_STRUCTP(ace);
2452                 ace->type = tagtype;
2453                 ace->perms = convert_permset_to_mode_t(conn, permset);
2454                 ace->attr = ALLOW_ACE;
2455                 ace->trustee = sid;
2456                 ace->unix_ug = unix_ug;
2457                 ace->owner_type = owner_type;
2458                 ace->ace_flags = get_pai_flags(pal, ace, (the_acl_type == SMB_ACL_TYPE_DEFAULT));
2459
2460                 DLIST_ADD(l_head, ace);
2461         }
2462
2463         /*
2464          * This next call will ensure we have at least a user/group/world set.
2465          */
2466
2467         if (!ensure_canon_entry_valid(&l_head, conn->params,
2468                                       S_ISDIR(psbuf->st_mode), powner, pgroup,
2469                                       psbuf, False))
2470                 goto fail;
2471
2472         /*
2473          * Now go through the list, masking the permissions with the
2474          * acl_mask. Ensure all DENY Entries are at the start of the list.
2475          */
2476
2477         DEBUG(10,("canonicalise_acl: %s ace entries before arrange :\n", the_acl_type == SMB_ACL_TYPE_ACCESS ? "Access" : "Default" ));
2478
2479         for ( ace_count = 0, ace = l_head; ace; ace = next_ace, ace_count++) {
2480                 next_ace = ace->next;
2481
2482                 /* Masks are only applied to entries other than USER_OBJ and OTHER. */
2483                 if (ace->type != SMB_ACL_OTHER && ace->type != SMB_ACL_USER_OBJ)
2484                         ace->perms &= acl_mask;
2485
2486                 if (ace->perms == 0) {
2487                         DLIST_PROMOTE(l_head, ace);
2488                 }
2489
2490                 if( DEBUGLVL( 10 ) ) {
2491                         print_canon_ace(ace, ace_count);
2492                 }
2493         }
2494
2495         arrange_posix_perms(fname,&l_head );
2496
2497         print_canon_ace_list( "canonicalise_acl: ace entries after arrange", l_head );
2498
2499         return l_head;
2500
2501   fail:
2502
2503         free_canon_ace_list(l_head);
2504         return NULL;
2505 }
2506
2507 /****************************************************************************
2508  Check if the current user group list contains a given group.
2509 ****************************************************************************/
2510
2511 static bool current_user_in_group(gid_t gid)
2512 {
2513         int i;
2514
2515         for (i = 0; i < current_user.ut.ngroups; i++) {
2516                 if (current_user.ut.groups[i] == gid) {
2517                         return True;
2518                 }
2519         }
2520
2521         return False;
2522 }
2523
2524 /****************************************************************************
2525  Should we override a deny ? Check 'acl group control' and 'dos filemode'.
2526 ****************************************************************************/
2527
2528 static bool acl_group_override(connection_struct *conn,
2529                                 gid_t prim_gid,
2530                                 const char *fname)
2531 {
2532         SMB_STRUCT_STAT sbuf;
2533
2534         if ((errno != EPERM) && (errno != EACCES)) {
2535                 return false;
2536         }
2537
2538         /* file primary group == user primary or supplementary group */
2539         if (lp_acl_group_control(SNUM(conn)) &&
2540                         current_user_in_group(prim_gid)) {
2541                 return true;
2542         }
2543
2544         /* user has writeable permission */
2545         if (lp_dos_filemode(SNUM(conn)) &&
2546                         can_write_to_file(conn, fname, &sbuf)) {
2547                 return true;
2548         }
2549
2550         return false;
2551 }
2552
2553 /****************************************************************************
2554  Attempt to apply an ACL to a file or directory.
2555 ****************************************************************************/
2556
2557 static bool set_canon_ace_list(files_struct *fsp, canon_ace *the_ace, bool default_ace, gid_t prim_gid, bool *pacl_set_support)
2558 {
2559         connection_struct *conn = fsp->conn;
2560         bool ret = False;
2561         SMB_ACL_T the_acl = SMB_VFS_SYS_ACL_INIT(conn, (int)count_canon_ace_list(the_ace) + 1);
2562         canon_ace *p_ace;
2563         int i;
2564         SMB_ACL_ENTRY_T mask_entry;
2565         bool got_mask_entry = False;
2566         SMB_ACL_PERMSET_T mask_permset;
2567         SMB_ACL_TYPE_T the_acl_type = (default_ace ? SMB_ACL_TYPE_DEFAULT : SMB_ACL_TYPE_ACCESS);
2568         bool needs_mask = False;
2569         mode_t mask_perms = 0;
2570
2571 #if defined(POSIX_ACL_NEEDS_MASK)
2572         /* HP-UX always wants to have a mask (called "class" there). */
2573         needs_mask = True;
2574 #endif
2575
2576         if (the_acl == NULL) {
2577
2578                 if (!no_acl_syscall_error(errno)) {
2579                         /*
2580                          * Only print this error message if we have some kind of ACL
2581                          * support that's not working. Otherwise we would always get this.
2582                          */
2583                         DEBUG(0,("set_canon_ace_list: Unable to init %s ACL. (%s)\n",
2584                                 default_ace ? "default" : "file", strerror(errno) ));
2585                 }
2586                 *pacl_set_support = False;
2587                 return False;
2588         }
2589
2590         if( DEBUGLVL( 10 )) {
2591                 dbgtext("set_canon_ace_list: setting ACL:\n");
2592                 for (i = 0, p_ace = the_ace; p_ace; p_ace = p_ace->next, i++ ) {
2593                         print_canon_ace( p_ace, i);
2594                 }
2595         }
2596
2597         for (i = 0, p_ace = the_ace; p_ace; p_ace = p_ace->next, i++ ) {
2598                 SMB_ACL_ENTRY_T the_entry;
2599                 SMB_ACL_PERMSET_T the_permset;
2600
2601                 /*
2602                  * ACLs only "need" an ACL_MASK entry if there are any named user or
2603                  * named group entries. But if there is an ACL_MASK entry, it applies
2604                  * to ACL_USER, ACL_GROUP, and ACL_GROUP_OBJ entries. Set the mask
2605                  * so that it doesn't deny (i.e., mask off) any permissions.
2606                  */
2607
2608                 if (p_ace->type == SMB_ACL_USER || p_ace->type == SMB_ACL_GROUP) {
2609                         needs_mask = True;
2610                         mask_perms |= p_ace->perms;
2611                 } else if (p_ace->type == SMB_ACL_GROUP_OBJ) {
2612                         mask_perms |= p_ace->perms;
2613                 }
2614
2615                 /*
2616                  * Get the entry for this ACE.
2617                  */
2618
2619                 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &the_entry) == -1) {
2620                         DEBUG(0,("set_canon_ace_list: Failed to create entry %d. (%s)\n",
2621                                 i, strerror(errno) ));
2622                         goto fail;
2623                 }
2624
2625                 if (p_ace->type == SMB_ACL_MASK) {
2626                         mask_entry = the_entry;
2627                         got_mask_entry = True;
2628                 }
2629
2630                 /*
2631                  * Ok - we now know the ACL calls should be working, don't
2632                  * allow fallback to chmod.
2633                  */
2634
2635                 *pacl_set_support = True;
2636
2637                 /*
2638                  * Initialise the entry from the canon_ace.
2639                  */
2640
2641                 /*
2642                  * First tell the entry what type of ACE this is.
2643                  */
2644
2645                 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, the_entry, p_ace->type) == -1) {
2646                         DEBUG(0,("set_canon_ace_list: Failed to set tag type on entry %d. (%s)\n",
2647                                 i, strerror(errno) ));
2648                         goto fail;
2649                 }
2650
2651                 /*
2652                  * Only set the qualifier (user or group id) if the entry is a user
2653                  * or group id ACE.
2654                  */
2655
2656                 if ((p_ace->type == SMB_ACL_USER) || (p_ace->type == SMB_ACL_GROUP)) {
2657                         if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&p_ace->unix_ug.uid) == -1) {
2658                                 DEBUG(0,("set_canon_ace_list: Failed to set qualifier on entry %d. (%s)\n",
2659                                         i, strerror(errno) ));
2660                                 goto fail;
2661                         }
2662                 }
2663
2664                 /*
2665                  * Convert the mode_t perms in the canon_ace to a POSIX permset.
2666                  */
2667
2668                 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, the_entry, &the_permset) == -1) {
2669                         DEBUG(0,("set_canon_ace_list: Failed to get permset on entry %d. (%s)\n",
2670                                 i, strerror(errno) ));
2671                         goto fail;
2672                 }
2673
2674                 if (map_acl_perms_to_permset(conn, p_ace->perms, &the_permset) == -1) {
2675                         DEBUG(0,("set_canon_ace_list: Failed to create permset for mode (%u) on entry %d. (%s)\n",
2676                                 (unsigned int)p_ace->perms, i, strerror(errno) ));
2677                         goto fail;
2678                 }
2679
2680                 /*
2681                  * ..and apply them to the entry.
2682                  */
2683
2684                 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, the_entry, the_permset) == -1) {
2685                         DEBUG(0,("set_canon_ace_list: Failed to add permset on entry %d. (%s)\n",
2686                                 i, strerror(errno) ));
2687                         goto fail;
2688                 }
2689
2690                 if( DEBUGLVL( 10 ))
2691                         print_canon_ace( p_ace, i);
2692
2693         }
2694
2695         if (needs_mask && !got_mask_entry) {
2696                 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &mask_entry) == -1) {
2697                         DEBUG(0,("set_canon_ace_list: Failed to create mask entry. (%s)\n", strerror(errno) ));
2698                         goto fail;
2699                 }
2700
2701                 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, mask_entry, SMB_ACL_MASK) == -1) {
2702                         DEBUG(0,("set_canon_ace_list: Failed to set tag type on mask entry. (%s)\n",strerror(errno) ));
2703                         goto fail;
2704                 }
2705
2706                 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, mask_entry, &mask_permset) == -1) {
2707                         DEBUG(0,("set_canon_ace_list: Failed to get mask permset. (%s)\n", strerror(errno) ));
2708                         goto fail;
2709                 }
2710
2711                 if (map_acl_perms_to_permset(conn, S_IRUSR|S_IWUSR|S_IXUSR, &mask_permset) == -1) {
2712                         DEBUG(0,("set_canon_ace_list: Failed to create mask permset. (%s)\n", strerror(errno) ));
2713                         goto fail;
2714                 }
2715
2716                 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, mask_entry, mask_permset) == -1) {
2717                         DEBUG(0,("set_canon_ace_list: Failed to add mask permset. (%s)\n", strerror(errno) ));
2718                         goto fail;
2719                 }
2720         }
2721
2722         /*
2723          * Finally apply it to the file or directory.
2724          */
2725
2726         if(default_ace || fsp->is_directory || fsp->fh->fd == -1) {
2727                 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fsp->fsp_name, the_acl_type, the_acl) == -1) {
2728                         /*
2729                          * Some systems allow all the above calls and only fail with no ACL support
2730                          * when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
2731                          */
2732                         if (no_acl_syscall_error(errno)) {
2733                                 *pacl_set_support = False;
2734                         }
2735
2736                         if (acl_group_override(conn, prim_gid, fsp->fsp_name)) {
2737                                 int sret;
2738
2739                                 DEBUG(5,("set_canon_ace_list: acl group control on and current user in file %s primary group.\n",
2740                                         fsp->fsp_name ));
2741
2742                                 become_root();
2743                                 sret = SMB_VFS_SYS_ACL_SET_FILE(conn, fsp->fsp_name, the_acl_type, the_acl);
2744                                 unbecome_root();
2745                                 if (sret == 0) {
2746                                         ret = True;
2747                                 }
2748                         }
2749
2750                         if (ret == False) {
2751                                 DEBUG(2,("set_canon_ace_list: sys_acl_set_file type %s failed for file %s (%s).\n",
2752                                                 the_acl_type == SMB_ACL_TYPE_DEFAULT ? "directory default" : "file",
2753                                                 fsp->fsp_name, strerror(errno) ));
2754                                 goto fail;
2755                         }
2756                 }
2757         } else {
2758                 if (SMB_VFS_SYS_ACL_SET_FD(fsp, the_acl) == -1) {
2759                         /*
2760                          * Some systems allow all the above calls and only fail with no ACL support
2761                          * when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
2762                          */
2763                         if (no_acl_syscall_error(errno)) {
2764                                 *pacl_set_support = False;
2765                         }
2766
2767                         if (acl_group_override(conn, prim_gid, fsp->fsp_name)) {
2768                                 int sret;
2769
2770                                 DEBUG(5,("set_canon_ace_list: acl group control on and current user in file %s primary group.\n",
2771                                         fsp->fsp_name ));
2772
2773                                 become_root();
2774                                 sret = SMB_VFS_SYS_ACL_SET_FD(fsp, the_acl);
2775                                 unbecome_root();
2776                                 if (sret == 0) {
2777                                         ret = True;
2778                                 }
2779                         }
2780
2781                         if (ret == False) {
2782                                 DEBUG(2,("set_canon_ace_list: sys_acl_set_file failed for file %s (%s).\n",
2783                                                 fsp->fsp_name, strerror(errno) ));
2784                                 goto fail;
2785                         }
2786                 }
2787         }
2788
2789         ret = True;
2790
2791   fail:
2792
2793         if (the_acl != NULL) {
2794                 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
2795         }
2796
2797         return ret;
2798 }
2799
2800 /****************************************************************************
2801  Find a particular canon_ace entry.
2802 ****************************************************************************/
2803
2804 static struct canon_ace *canon_ace_entry_for(struct canon_ace *list, SMB_ACL_TAG_T type, posix_id *id)
2805 {
2806         while (list) {
2807                 if (list->type == type && ((type != SMB_ACL_USER && type != SMB_ACL_GROUP) ||
2808                                 (type == SMB_ACL_USER  && id && id->uid == list->unix_ug.uid) ||
2809                                 (type == SMB_ACL_GROUP && id && id->gid == list->unix_ug.gid)))
2810                         break;
2811                 list = list->next;
2812         }
2813         return list;
2814 }
2815
2816 /****************************************************************************
2817
2818 ****************************************************************************/
2819
2820 SMB_ACL_T free_empty_sys_acl(connection_struct *conn, SMB_ACL_T the_acl)
2821 {
2822         SMB_ACL_ENTRY_T entry;
2823
2824         if (!the_acl)
2825                 return NULL;
2826         if (SMB_VFS_SYS_ACL_GET_ENTRY(conn, the_acl, SMB_ACL_FIRST_ENTRY, &entry) != 1) {
2827                 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
2828                 return NULL;
2829         }
2830         return the_acl;
2831 }
2832
2833 /****************************************************************************
2834  Convert a canon_ace to a generic 3 element permission - if possible.
2835 ****************************************************************************/
2836
2837 #define MAP_PERM(p,mask,result) (((p) & (mask)) ? (result) : 0 )
2838
2839 static bool convert_canon_ace_to_posix_perms( files_struct *fsp, canon_ace *file_ace_list, mode_t *posix_perms)
2840 {
2841         int snum = SNUM(fsp->conn);
2842         size_t ace_count = count_canon_ace_list(file_ace_list);
2843         canon_ace *ace_p;
2844         canon_ace *owner_ace = NULL;
2845         canon_ace *group_ace = NULL;
2846         canon_ace *other_ace = NULL;
2847         mode_t and_bits;
2848         mode_t or_bits;
2849
2850         if (ace_count != 3) {
2851                 DEBUG(3,("convert_canon_ace_to_posix_perms: Too many ACE entries for file %s to convert to \
2852 posix perms.\n", fsp->fsp_name ));
2853                 return False;
2854         }
2855
2856         for (ace_p = file_ace_list; ace_p; ace_p = ace_p->next) {
2857                 if (ace_p->owner_type == UID_ACE)
2858                         owner_ace = ace_p;
2859                 else if (ace_p->owner_type == GID_ACE)
2860                         group_ace = ace_p;
2861                 else if (ace_p->owner_type == WORLD_ACE)
2862                         other_ace = ace_p;
2863         }
2864
2865         if (!owner_ace || !group_ace || !other_ace) {
2866                 DEBUG(3,("convert_canon_ace_to_posix_perms: Can't get standard entries for file %s.\n",
2867                                 fsp->fsp_name ));
2868                 return False;
2869         }
2870
2871         *posix_perms = (mode_t)0;
2872
2873         *posix_perms |= owner_ace->perms;
2874         *posix_perms |= MAP_PERM(group_ace->perms, S_IRUSR, S_IRGRP);
2875         *posix_perms |= MAP_PERM(group_ace->perms, S_IWUSR, S_IWGRP);
2876         *posix_perms |= MAP_PERM(group_ace->perms, S_IXUSR, S_IXGRP);
2877         *posix_perms |= MAP_PERM(other_ace->perms, S_IRUSR, S_IROTH);
2878         *posix_perms |= MAP_PERM(other_ace->perms, S_IWUSR, S_IWOTH);
2879         *posix_perms |= MAP_PERM(other_ace->perms, S_IXUSR, S_IXOTH);
2880
2881         /* The owner must have at least read access. */
2882
2883         *posix_perms |= S_IRUSR;
2884         if (fsp->is_directory)
2885                 *posix_perms |= (S_IWUSR|S_IXUSR);
2886
2887         /* If requested apply the masks. */
2888
2889         /* Get the initial bits to apply. */
2890
2891         if (fsp->is_directory) {
2892                 and_bits = lp_dir_security_mask(snum);
2893                 or_bits = lp_force_dir_security_mode(snum);
2894         } else {
2895                 and_bits = lp_security_mask(snum);
2896                 or_bits = lp_force_security_mode(snum);
2897         }
2898
2899         *posix_perms = (((*posix_perms) & and_bits)|or_bits);
2900
2901         DEBUG(10,("convert_canon_ace_to_posix_perms: converted u=%o,g=%o,w=%o to perm=0%o for file %s.\n",
2902                 (int)owner_ace->perms, (int)group_ace->perms, (int)other_ace->perms, (int)*posix_perms,
2903                 fsp->fsp_name ));
2904
2905         return True;
2906 }
2907
2908 /****************************************************************************
2909   Incoming NT ACLs on a directory can be split into a default POSIX acl (CI|OI|IO) and
2910   a normal POSIX acl. Win2k needs these split acls re-merging into one ACL
2911   with CI|OI set so it is inherited and also applies to the directory.
2912   Based on code from "Jim McDonough" <jmcd@us.ibm.com>.
2913 ****************************************************************************/
2914
2915 static size_t merge_default_aces( SEC_ACE *nt_ace_list, size_t num_aces)
2916 {
2917         size_t i, j;
2918
2919         for (i = 0; i < num_aces; i++) {
2920                 for (j = i+1; j < num_aces; j++) {
2921                         uint32 i_flags_ni = (nt_ace_list[i].flags & ~SEC_ACE_FLAG_INHERITED_ACE);
2922                         uint32 j_flags_ni = (nt_ace_list[j].flags & ~SEC_ACE_FLAG_INHERITED_ACE);
2923                         bool i_inh = (nt_ace_list[i].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False;
2924                         bool j_inh = (nt_ace_list[j].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False;
2925
2926                         /* We know the lower number ACE's are file entries. */
2927                         if ((nt_ace_list[i].type == nt_ace_list[j].type) &&
2928                                 (nt_ace_list[i].size == nt_ace_list[j].size) &&
2929                                 (nt_ace_list[i].access_mask == nt_ace_list[j].access_mask) &&
2930                                 sid_equal(&nt_ace_list[i].trustee, &nt_ace_list[j].trustee) &&
2931                                 (i_inh == j_inh) &&
2932                                 (i_flags_ni == 0) &&
2933                                 (j_flags_ni == (SEC_ACE_FLAG_OBJECT_INHERIT|
2934                                                   SEC_ACE_FLAG_CONTAINER_INHERIT|
2935                                                   SEC_ACE_FLAG_INHERIT_ONLY))) {
2936                                 /*
2937                                  * W2K wants to have access allowed zero access ACE's
2938                                  * at the end of the list. If the mask is zero, merge
2939                                  * the non-inherited ACE onto the inherited ACE.
2940                                  */
2941
2942                                 if (nt_ace_list[i].access_mask == 0) {
2943                                         nt_ace_list[j].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
2944                                                                 (i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0);
2945                                         if (num_aces - i - 1 > 0)
2946                                                 memmove(&nt_ace_list[i], &nt_ace_list[i+1], (num_aces-i-1) *
2947                                                                 sizeof(SEC_ACE));
2948
2949                                         DEBUG(10,("merge_default_aces: Merging zero access ACE %u onto ACE %u.\n",
2950                                                 (unsigned int)i, (unsigned int)j ));
2951                                 } else {
2952                                         /*
2953                                          * These are identical except for the flags.
2954                                          * Merge the inherited ACE onto the non-inherited ACE.
2955                                          */
2956
2957                                         nt_ace_list[i].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
2958                                                                 (i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0);
2959                                         if (num_aces - j - 1 > 0)
2960                                                 memmove(&nt_ace_list[j], &nt_ace_list[j+1], (num_aces-j-1) *
2961                                                                 sizeof(SEC_ACE));
2962
2963                                         DEBUG(10,("merge_default_aces: Merging ACE %u onto ACE %u.\n",
2964                                                 (unsigned int)j, (unsigned int)i ));
2965                                 }
2966                                 num_aces--;
2967                                 break;
2968                         }
2969                 }
2970         }
2971
2972         return num_aces;
2973 }
2974
2975 /****************************************************************************
2976  Reply to query a security descriptor from an fsp. If it succeeds it allocates
2977  the space for the return elements and returns the size needed to return the
2978  security descriptor. This should be the only external function needed for
2979  the UNIX style get ACL.
2980 ****************************************************************************/
2981
2982 static NTSTATUS posix_get_nt_acl_common(struct connection_struct *conn,
2983                                       const char *name,
2984                                       const SMB_STRUCT_STAT *sbuf,
2985                                       struct pai_val *pal,
2986                                       SMB_ACL_T posix_acl,
2987                                       SMB_ACL_T def_acl,
2988                                       uint32_t security_info,
2989                                       SEC_DESC **ppdesc)
2990 {
2991         DOM_SID owner_sid;
2992         DOM_SID group_sid;
2993         size_t sd_size = 0;
2994         SEC_ACL *psa = NULL;
2995         size_t num_acls = 0;
2996         size_t num_def_acls = 0;
2997         size_t num_aces = 0;
2998         canon_ace *file_ace = NULL;
2999         canon_ace *dir_ace = NULL;
3000         SEC_ACE *nt_ace_list = NULL;
3001         size_t num_profile_acls = 0;
3002         SEC_DESC *psd = NULL;
3003
3004         /*
3005          * Get the owner, group and world SIDs.
3006          */
3007
3008         if (lp_profile_acls(SNUM(conn))) {
3009                 /* For WXP SP1 the owner must be administrators. */
3010                 sid_copy(&owner_sid, &global_sid_Builtin_Administrators);
3011                 sid_copy(&group_sid, &global_sid_Builtin_Users);
3012                 num_profile_acls = 2;
3013         } else {
3014                 create_file_sids(sbuf, &owner_sid, &group_sid);
3015         }
3016
3017         if ((security_info & DACL_SECURITY_INFORMATION) && !(security_info & PROTECTED_DACL_SECURITY_INFORMATION)) {
3018
3019                 /*
3020                  * In the optimum case Creator Owner and Creator Group would be used for
3021                  * the ACL_USER_OBJ and ACL_GROUP_OBJ entries, respectively, but this
3022                  * would lead to usability problems under Windows: The Creator entries
3023                  * are only available in browse lists of directories and not for files;
3024                  * additionally the identity of the owning group couldn't be determined.
3025                  * We therefore use those identities only for Default ACLs.
3026                  */
3027
3028                 /* Create the canon_ace lists. */
3029                 file_ace = canonicalise_acl(conn, name, posix_acl, sbuf,
3030                                             &owner_sid, &group_sid, pal,
3031                                             SMB_ACL_TYPE_ACCESS);
3032
3033                 /* We must have *some* ACLS. */
3034
3035                 if (count_canon_ace_list(file_ace) == 0) {
3036                         DEBUG(0,("get_nt_acl : No ACLs on file (%s) !\n", name));
3037                         goto done;
3038                 }
3039
3040                 if (S_ISDIR(sbuf->st_mode) && def_acl) {
3041                         dir_ace = canonicalise_acl(conn, name, def_acl,
3042                                                    sbuf,
3043                                                    &global_sid_Creator_Owner,
3044                                                    &global_sid_Creator_Group,
3045                                                    pal, SMB_ACL_TYPE_DEFAULT);
3046                 }
3047
3048                 /*
3049                  * Create the NT ACE list from the canonical ace lists.
3050                  */
3051
3052                 {
3053                         canon_ace *ace;
3054                         enum security_ace_type nt_acl_type;
3055
3056                         if (nt4_compatible_acls() && dir_ace) {
3057                                 /*
3058                                  * NT 4 chokes if an ACL contains an INHERIT_ONLY entry
3059                                  * but no non-INHERIT_ONLY entry for one SID. So we only
3060                                  * remove entries from the Access ACL if the
3061                                  * corresponding Default ACL entries have also been
3062                                  * removed. ACEs for CREATOR-OWNER and CREATOR-GROUP
3063                                  * are exceptions. We can do nothing
3064                                  * intelligent if the Default ACL contains entries that
3065                                  * are not also contained in the Access ACL, so this
3066                                  * case will still fail under NT 4.
3067                                  */
3068
3069                                 ace = canon_ace_entry_for(dir_ace, SMB_ACL_OTHER, NULL);
3070                                 if (ace && !ace->perms) {
3071                                         DLIST_REMOVE(dir_ace, ace);
3072                                         SAFE_FREE(ace);
3073
3074                                         ace = canon_ace_entry_for(file_ace, SMB_ACL_OTHER, NULL);
3075                                         if (ace && !ace->perms) {
3076                                                 DLIST_REMOVE(file_ace, ace);
3077                                                 SAFE_FREE(ace);
3078                                         }
3079                                 }
3080
3081                                 /*
3082                                  * WinNT doesn't usually have Creator Group
3083                                  * in browse lists, so we send this entry to
3084                                  * WinNT even if it contains no relevant
3085                                  * permissions. Once we can add
3086                                  * Creator Group to browse lists we can
3087                                  * re-enable this.
3088                                  */
3089
3090 #if 0
3091                                 ace = canon_ace_entry_for(dir_ace, SMB_ACL_GROUP_OBJ, NULL);
3092                                 if (ace && !ace->perms) {
3093                                         DLIST_REMOVE(dir_ace, ace);
3094                                         SAFE_FREE(ace);
3095                                 }
3096 #endif
3097
3098                                 ace = canon_ace_entry_for(file_ace, SMB_ACL_GROUP_OBJ, NULL);
3099                                 if (ace && !ace->perms) {
3100                                         DLIST_REMOVE(file_ace, ace);
3101                                         SAFE_FREE(ace);
3102                                 }
3103                         }
3104
3105                         num_acls = count_canon_ace_list(file_ace);
3106                         num_def_acls = count_canon_ace_list(dir_ace);
3107
3108                         /* Allocate the ace list. */
3109                         if ((nt_ace_list = SMB_MALLOC_ARRAY(SEC_ACE,num_acls + num_profile_acls + num_def_acls)) == NULL) {
3110                                 DEBUG(0,("get_nt_acl: Unable to malloc space for nt_ace_list.\n"));
3111                                 goto done;
3112                         }
3113
3114                         memset(nt_ace_list, '\0', (num_acls + num_def_acls) * sizeof(SEC_ACE) );
3115
3116                         /*
3117                          * Create the NT ACE list from the canonical ace lists.
3118                          */
3119
3120                         for (ace = file_ace; ace != NULL; ace = ace->next) {
3121                                 uint32_t acc = map_canon_ace_perms(SNUM(conn),
3122                                                 &nt_acl_type,
3123                                                 ace->perms,
3124                                                 S_ISDIR(sbuf->st_mode));
3125                                 init_sec_ace(&nt_ace_list[num_aces++],
3126                                         &ace->trustee,
3127                                         nt_acl_type,
3128                                         acc,
3129                                         ace->ace_flags);
3130                         }
3131
3132                         /* The User must have access to a profile share - even
3133                          * if we can't map the SID. */
3134                         if (lp_profile_acls(SNUM(conn))) {
3135                                 init_sec_ace(&nt_ace_list[num_aces++],
3136                                                 &global_sid_Builtin_Users,
3137                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
3138                                                 FILE_GENERIC_ALL, 0);
3139                         }
3140
3141                         for (ace = dir_ace; ace != NULL; ace = ace->next) {
3142                                 uint32_t acc = map_canon_ace_perms(SNUM(conn),
3143                                                 &nt_acl_type,
3144                                                 ace->perms,
3145                                                 S_ISDIR(sbuf->st_mode));
3146                                 init_sec_ace(&nt_ace_list[num_aces++],
3147                                         &ace->trustee,
3148                                         nt_acl_type,
3149                                         acc,
3150                                         ace->ace_flags |
3151                                         SEC_ACE_FLAG_OBJECT_INHERIT|
3152                                         SEC_ACE_FLAG_CONTAINER_INHERIT|
3153                                         SEC_ACE_FLAG_INHERIT_ONLY);
3154                         }
3155
3156                         /* The User must have access to a profile share - even
3157                          * if we can't map the SID. */
3158                         if (lp_profile_acls(SNUM(conn))) {
3159                                 init_sec_ace(&nt_ace_list[num_aces++], &global_sid_Builtin_Users, SEC_ACE_TYPE_ACCESS_ALLOWED, FILE_GENERIC_ALL,
3160                                                 SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
3161                                                 SEC_ACE_FLAG_INHERIT_ONLY|0);
3162                         }
3163
3164                         /*
3165                          * Merge POSIX default ACLs and normal ACLs into one NT ACE.
3166                          * Win2K needs this to get the inheritance correct when replacing ACLs
3167                          * on a directory tree. Based on work by Jim @ IBM.
3168                          */
3169
3170                         num_aces = merge_default_aces(nt_ace_list, num_aces);
3171
3172                 }
3173
3174                 if (num_aces) {
3175                         if((psa = make_sec_acl( talloc_tos(), NT4_ACL_REVISION, num_aces, nt_ace_list)) == NULL) {
3176                                 DEBUG(0,("get_nt_acl: Unable to malloc space for acl.\n"));
3177                                 goto done;
3178                         }
3179                 }
3180         } /* security_info & DACL_SECURITY_INFORMATION */
3181
3182         psd = make_standard_sec_desc( talloc_tos(),
3183                         (security_info & OWNER_SECURITY_INFORMATION) ? &owner_sid : NULL,
3184                         (security_info & GROUP_SECURITY_INFORMATION) ? &group_sid : NULL,
3185                         psa,
3186                         &sd_size);
3187
3188         if(!psd) {
3189                 DEBUG(0,("get_nt_acl: Unable to malloc space for security descriptor.\n"));
3190                 sd_size = 0;
3191                 goto done;
3192         }
3193
3194         /*
3195          * Windows 2000: The DACL_PROTECTED flag in the security
3196          * descriptor marks the ACL as non-inheriting, i.e., no
3197          * ACEs from higher level directories propagate to this
3198          * ACL. In the POSIX ACL model permissions are only
3199          * inherited at file create time, so ACLs never contain
3200          * any ACEs that are inherited dynamically. The DACL_PROTECTED
3201          * flag doesn't seem to bother Windows NT.
3202          * Always set this if map acl inherit is turned off.
3203          */
3204         if (pal == NULL || !lp_map_acl_inherit(SNUM(conn))) {
3205                 psd->type |= SEC_DESC_DACL_PROTECTED;
3206         } else {
3207                 psd->type |= pal->sd_type;
3208         }
3209
3210         if (psd->dacl) {
3211                 dacl_sort_into_canonical_order(psd->dacl->aces, (unsigned int)psd->dacl->num_aces);
3212         }
3213
3214         *ppdesc = psd;
3215
3216  done:
3217
3218         if (posix_acl) {
3219                 SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
3220         }
3221         if (def_acl) {
3222                 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
3223         }
3224         free_canon_ace_list(file_ace);
3225         free_canon_ace_list(dir_ace);
3226         free_inherited_info(pal);
3227         SAFE_FREE(nt_ace_list);
3228
3229         return NT_STATUS_OK;
3230 }
3231
3232 NTSTATUS posix_fget_nt_acl(struct files_struct *fsp, uint32_t security_info,
3233                            SEC_DESC **ppdesc)
3234 {
3235         SMB_STRUCT_STAT sbuf;
3236         SMB_ACL_T posix_acl = NULL;
3237         struct pai_val *pal;
3238
3239         *ppdesc = NULL;
3240
3241         DEBUG(10,("posix_fget_nt_acl: called for file %s\n", fsp->fsp_name ));
3242
3243         /* can it happen that fsp_name == NULL ? */
3244         if (fsp->is_directory ||  fsp->fh->fd == -1) {
3245                 return posix_get_nt_acl(fsp->conn, fsp->fsp_name,
3246                                         security_info, ppdesc);
3247         }
3248
3249         /* Get the stat struct for the owner info. */
3250         if(SMB_VFS_FSTAT(fsp, &sbuf) != 0) {
3251                 return map_nt_error_from_unix(errno);
3252         }
3253
3254         /* Get the ACL from the fd. */
3255         posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp);
3256
3257         pal = fload_inherited_info(fsp);
3258
3259         return posix_get_nt_acl_common(fsp->conn, fsp->fsp_name, &sbuf, pal,
3260                                        posix_acl, NULL, security_info, ppdesc);
3261 }
3262
3263 NTSTATUS posix_get_nt_acl(struct connection_struct *conn, const char *name,
3264                           uint32_t security_info, SEC_DESC **ppdesc)
3265 {
3266         SMB_STRUCT_STAT sbuf;
3267         SMB_ACL_T posix_acl = NULL;
3268         SMB_ACL_T def_acl = NULL;
3269         struct pai_val *pal;
3270
3271         *ppdesc = NULL;
3272
3273         DEBUG(10,("posix_get_nt_acl: called for file %s\n", name ));
3274
3275         /* Get the stat struct for the owner info. */
3276         if(SMB_VFS_STAT(conn, name, &sbuf) != 0) {
3277                 return map_nt_error_from_unix(errno);
3278         }
3279
3280         /* Get the ACL from the path. */
3281         posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name, SMB_ACL_TYPE_ACCESS);
3282
3283         /* If it's a directory get the default POSIX ACL. */
3284         if(S_ISDIR(sbuf.st_mode)) {
3285                 def_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name, SMB_ACL_TYPE_DEFAULT);
3286                 def_acl = free_empty_sys_acl(conn, def_acl);
3287         }
3288
3289         pal = load_inherited_info(conn, name);
3290
3291         return posix_get_nt_acl_common(conn, name, &sbuf, pal, posix_acl,
3292                                        def_acl, security_info, ppdesc);
3293 }
3294
3295 /****************************************************************************
3296  Try to chown a file. We will be able to chown it under the following conditions.
3297
3298   1) If we have root privileges, then it will just work.
3299   2) If we have SeTakeOwnershipPrivilege we can change the user to the current user.
3300   3) If we have SeRestorePrivilege we can change the user to any other user.
3301   4) If we have write permission to the file and dos_filemodes is set
3302      then allow chown to the currently authenticated user.
3303 ****************************************************************************/
3304
3305 int try_chown(connection_struct *conn, const char *fname, uid_t uid, gid_t gid)
3306 {
3307         int ret;
3308         files_struct *fsp;
3309         SMB_STRUCT_STAT st;
3310
3311         if(!CAN_WRITE(conn)) {
3312                 return -1;
3313         }
3314
3315         /* Case (1). */
3316         /* try the direct way first */
3317         ret = SMB_VFS_CHOWN(conn, fname, uid, gid);
3318         if (ret == 0)
3319                 return 0;
3320
3321         /* Case (2) / (3) */
3322         if (lp_enable_privileges()) {
3323
3324                 bool has_take_ownership_priv = user_has_privileges(current_user.nt_user_token,
3325                                                               &se_take_ownership);
3326                 bool has_restore_priv = user_has_privileges(current_user.nt_user_token,
3327                                                        &se_restore);
3328
3329                 /* Case (2) */
3330                 if ( ( has_take_ownership_priv && ( uid == current_user.ut.uid ) ) ||
3331                 /* Case (3) */
3332                      ( has_restore_priv ) ) {
3333
3334                         become_root();
3335                         /* Keep the current file gid the same - take ownership doesn't imply group change. */
3336                         ret = SMB_VFS_CHOWN(conn, fname, uid, (gid_t)-1);
3337                         unbecome_root();
3338                         return ret;
3339                 }
3340         }
3341
3342         /* Case (4). */
3343         if (!lp_dos_filemode(SNUM(conn))) {
3344                 errno = EPERM;
3345                 return -1;
3346         }
3347
3348         /* only allow chown to the current user. This is more secure,
3349            and also copes with the case where the SID in a take ownership ACL is
3350            a local SID on the users workstation
3351         */
3352         if (uid != current_user.ut.uid) {
3353                 errno = EPERM;
3354                 return -1;
3355         }
3356
3357         if (SMB_VFS_STAT(conn,fname,&st)) {
3358                 return -1;
3359         }
3360
3361         if (!NT_STATUS_IS_OK(open_file_fchmod(NULL, conn, fname, &st, &fsp))) {
3362                 return -1;
3363         }
3364
3365         become_root();
3366         /* Keep the current file gid the same. */
3367         ret = SMB_VFS_FCHOWN(fsp, uid, (gid_t)-1);
3368         unbecome_root();
3369
3370         close_file_fchmod(NULL, fsp);
3371
3372         return ret;
3373 }
3374
3375 #if 0
3376 /* Disable this - prevents ACL inheritance from the ACL editor. JRA. */
3377
3378 /****************************************************************************
3379  Take care of parent ACL inheritance.
3380 ****************************************************************************/
3381
3382 NTSTATUS append_parent_acl(files_struct *fsp,
3383                                 const SEC_DESC *pcsd,
3384                                 SEC_DESC **pp_new_sd)
3385 {
3386         SEC_DESC *parent_sd = NULL;
3387         files_struct *parent_fsp = NULL;
3388         TALLOC_CTX *mem_ctx = talloc_tos();
3389         char *parent_name = NULL;
3390         SEC_ACE *new_ace = NULL;
3391         unsigned int num_aces = pcsd->dacl->num_aces;
3392         SMB_STRUCT_STAT sbuf;
3393         NTSTATUS status;
3394         int info;
3395         unsigned int i, j;
3396         SEC_DESC *psd = dup_sec_desc(talloc_tos(), pcsd);
3397         bool is_dacl_protected = (pcsd->type & SEC_DESC_DACL_PROTECTED);
3398
3399         ZERO_STRUCT(sbuf);
3400
3401         if (psd == NULL) {
3402                 return NT_STATUS_NO_MEMORY;
3403         }
3404
3405         if (!parent_dirname(mem_ctx, fsp->fsp_name, &parent_name, NULL)) {
3406                 return NT_STATUS_NO_MEMORY;
3407         }
3408
3409         status = SMB_VFS_CREATE_FILE(
3410                 fsp->conn,                              /* conn */
3411                 NULL,                                   /* req */
3412                 0,                                      /* root_dir_fid */
3413                 parent_name,                            /* fname */
3414                 0,                                      /* create_file_flags */
3415                 FILE_READ_ATTRIBUTES,                   /* access_mask */
3416                 FILE_SHARE_NONE,                        /* share_access */
3417                 FILE_OPEN,                              /* create_disposition*/
3418                 FILE_DIRECTORY_FILE,                    /* create_options */
3419                 0,                                      /* file_attributes */
3420                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
3421                 0,                                      /* allocation_size */
3422                 NULL,                                   /* sd */
3423                 NULL,                                   /* ea_list */
3424                 &parent_fsp,                            /* result */
3425                 &info,                                  /* pinfo */
3426                 &sbuf);                                 /* psbuf */
3427
3428         if (!NT_STATUS_IS_OK(status)) {
3429                 return status;
3430         }
3431
3432         status = SMB_VFS_GET_NT_ACL(parent_fsp->conn, parent_fsp->fsp_name,
3433                                     DACL_SECURITY_INFORMATION, &parent_sd );
3434
3435         close_file(NULL, parent_fsp, NORMAL_CLOSE);
3436
3437         if (!NT_STATUS_IS_OK(status)) {
3438                 return status;
3439         }
3440
3441         /*
3442          * Make room for potentially all the ACLs from
3443          * the parent. We used to add the ugw triple here,
3444          * as we knew we were dealing with POSIX ACLs.
3445          * We no longer need to do so as we can guarentee
3446          * that a default ACL from the parent directory will
3447          * be well formed for POSIX ACLs if it came from a
3448          * POSIX ACL source, and if we're not writing to a
3449          * POSIX ACL sink then we don't care if it's not well
3450          * formed. JRA.
3451          */
3452
3453         num_aces += parent_sd->dacl->num_aces;
3454
3455         if((new_ace = TALLOC_ZERO_ARRAY(mem_ctx, SEC_ACE,
3456                                         num_aces)) == NULL) {
3457                 return NT_STATUS_NO_MEMORY;
3458         }
3459
3460         /* Start by copying in all the given ACE entries. */
3461         for (i = 0; i < psd->dacl->num_aces; i++) {
3462                 sec_ace_copy(&new_ace[i], &psd->dacl->aces[i]);
3463         }
3464
3465         /*
3466          * Note that we're ignoring "inherit permissions" here
3467          * as that really only applies to newly created files. JRA.
3468          */
3469
3470         /* Finally append any inherited ACEs. */
3471         for (j = 0; j < parent_sd->dacl->num_aces; j++) {
3472                 SEC_ACE *se = &parent_sd->dacl->aces[j];
3473
3474                 if (fsp->is_directory) {
3475                         if (!(se->flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
3476                                 /* Doesn't apply to a directory - ignore. */
3477                                 DEBUG(10,("append_parent_acl: directory %s "
3478                                         "ignoring non container "
3479                                         "inherit flags %u on ACE with sid %s "
3480                                         "from parent %s\n",
3481                                         fsp->fsp_name,
3482                                         (unsigned int)se->flags,
3483                                         sid_string_dbg(&se->trustee),
3484                                         parent_name));
3485                                 continue;
3486                         }
3487                 } else {
3488                         if (!(se->flags & SEC_ACE_FLAG_OBJECT_INHERIT)) {
3489                                 /* Doesn't apply to a file - ignore. */
3490                                 DEBUG(10,("append_parent_acl: file %s "
3491                                         "ignoring non object "
3492                                         "inherit flags %u on ACE with sid %s "
3493                                         "from parent %s\n",
3494                                         fsp->fsp_name,
3495                                         (unsigned int)se->flags,
3496                                         sid_string_dbg(&se->trustee),
3497                                         parent_name));
3498                                 continue;
3499                         }
3500                 }
3501
3502                 if (is_dacl_protected) {
3503                         /* If the DACL is protected it means we must
3504                          * not overwrite an existing ACE entry with the
3505                          * same SID. This is order N^2. Ouch :-(. JRA. */
3506                         unsigned int k;
3507                         for (k = 0; k < psd->dacl->num_aces; k++) {
3508                                 if (sid_equal(&psd->dacl->aces[k].trustee,
3509                                                 &se->trustee)) {
3510                                         break;
3511                                 }
3512                         }
3513                         if (k < psd->dacl->num_aces) {
3514                                 /* SID matched. Ignore. */
3515                                 DEBUG(10,("append_parent_acl: path %s "
3516                                         "ignoring ACE with protected sid %s "
3517                                         "from parent %s\n",
3518                                         fsp->fsp_name,
3519                                         sid_string_dbg(&se->trustee),
3520                                         parent_name));
3521                                 continue;
3522                         }
3523                 }
3524
3525                 sec_ace_copy(&new_ace[i], se);
3526                 if (se->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
3527                         new_ace[i].flags &= ~(SEC_ACE_FLAG_VALID_INHERIT);
3528                 }
3529                 new_ace[i].flags |= SEC_ACE_FLAG_INHERITED_ACE;
3530
3531                 if (fsp->is_directory) {
3532                         /*
3533                          * Strip off any inherit only. It's applied.
3534                          */
3535                         new_ace[i].flags &= ~(SEC_ACE_FLAG_INHERIT_ONLY);
3536                         if (se->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
3537                                 /* No further inheritance. */
3538                                 new_ace[i].flags &=
3539                                         ~(SEC_ACE_FLAG_CONTAINER_INHERIT|
3540                                         SEC_ACE_FLAG_OBJECT_INHERIT);
3541                         }
3542                 } else {
3543                         /*
3544                          * Strip off any container or inherit
3545                          * flags, they can't apply to objects.
3546                          */
3547                         new_ace[i].flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|
3548                                                 SEC_ACE_FLAG_INHERIT_ONLY|
3549                                                 SEC_ACE_FLAG_NO_PROPAGATE_INHERIT);
3550                 }
3551                 i++;
3552
3553                 DEBUG(10,("append_parent_acl: path %s "
3554                         "inheriting ACE with sid %s "
3555                         "from parent %s\n",
3556                         fsp->fsp_name,
3557                         sid_string_dbg(&se->trustee),
3558                         parent_name));
3559         }
3560
3561         psd->dacl->aces = new_ace;
3562         psd->dacl->num_aces = i;
3563         psd->type &= ~(SE_DESC_DACL_AUTO_INHERITED|
3564                          SE_DESC_DACL_AUTO_INHERIT_REQ);
3565
3566         *pp_new_sd = psd;
3567         return status;
3568 }
3569 #endif
3570
3571 /****************************************************************************
3572  Reply to set a security descriptor on an fsp. security_info_sent is the
3573  description of the following NT ACL.
3574  This should be the only external function needed for the UNIX style set ACL.
3575 ****************************************************************************/
3576
3577 NTSTATUS set_nt_acl(files_struct *fsp, uint32 security_info_sent, const SEC_DESC *psd)
3578 {
3579         connection_struct *conn = fsp->conn;
3580         uid_t user = (uid_t)-1;
3581         gid_t grp = (gid_t)-1;
3582         SMB_STRUCT_STAT sbuf;
3583         DOM_SID file_owner_sid;
3584         DOM_SID file_grp_sid;
3585         canon_ace *file_ace_list = NULL;
3586         canon_ace *dir_ace_list = NULL;
3587         bool acl_perms = False;
3588         mode_t orig_mode = (mode_t)0;
3589         NTSTATUS status;
3590         bool set_acl_as_root = false;
3591         bool acl_set_support = false;
3592         bool ret = false;
3593
3594         DEBUG(10,("set_nt_acl: called for file %s\n", fsp->fsp_name ));
3595
3596         if (!CAN_WRITE(conn)) {
3597                 DEBUG(10,("set acl rejected on read-only share\n"));
3598                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
3599         }
3600
3601         /*
3602          * Get the current state of the file.
3603          */
3604
3605         if(fsp->is_directory || fsp->fh->fd == -1) {
3606                 if(SMB_VFS_STAT(fsp->conn,fsp->fsp_name, &sbuf) != 0)
3607                         return map_nt_error_from_unix(errno);
3608         } else {
3609                 if(SMB_VFS_FSTAT(fsp, &sbuf) != 0)
3610                         return map_nt_error_from_unix(errno);
3611         }
3612
3613         /* Save the original element we check against. */
3614         orig_mode = sbuf.st_mode;
3615
3616         /*
3617          * Unpack the user/group/world id's.
3618          */
3619
3620         status = unpack_nt_owners( SNUM(conn), &user, &grp, security_info_sent, psd);
3621         if (!NT_STATUS_IS_OK(status)) {
3622                 return status;
3623         }
3624
3625         /*
3626          * Do we need to chown ? If so this must be done first as the incoming
3627          * CREATOR_OWNER acl will be relative to the *new* owner, not the old.
3628          * Noticed by Simo.
3629          */
3630
3631         if (((user != (uid_t)-1) && (sbuf.st_uid != user)) || (( grp != (gid_t)-1) && (sbuf.st_gid != grp))) {
3632
3633                 DEBUG(3,("set_nt_acl: chown %s. uid = %u, gid = %u.\n",
3634                                 fsp->fsp_name, (unsigned int)user, (unsigned int)grp ));
3635
3636                 if(try_chown( fsp->conn, fsp->fsp_name, user, grp) == -1) {
3637                         DEBUG(3,("set_nt_acl: chown %s, %u, %u failed. Error = %s.\n",
3638                                 fsp->fsp_name, (unsigned int)user, (unsigned int)grp, strerror(errno) ));
3639                         if (errno == EPERM) {
3640                                 return NT_STATUS_INVALID_OWNER;
3641                         }
3642                         return map_nt_error_from_unix(errno);
3643                 }
3644
3645                 /*
3646                  * Recheck the current state of the file, which may have changed.
3647                  * (suid/sgid bits, for instance)
3648                  */
3649
3650                 if(fsp->is_directory) {
3651                         if(SMB_VFS_STAT(fsp->conn, fsp->fsp_name, &sbuf) != 0) {
3652                                 return map_nt_error_from_unix(errno);
3653                         }
3654                 } else {
3655
3656                         int sret;
3657
3658                         if(fsp->fh->fd == -1)
3659                                 sret = SMB_VFS_STAT(fsp->conn, fsp->fsp_name, &sbuf);
3660                         else
3661                                 sret = SMB_VFS_FSTAT(fsp, &sbuf);
3662
3663                         if(sret != 0)
3664                                 return map_nt_error_from_unix(errno);
3665                 }
3666
3667                 /* Save the original element we check against. */
3668                 orig_mode = sbuf.st_mode;
3669
3670                 /* If we successfully chowned, we know we must
3671                  * be able to set the acl, so do it as root.
3672                  */
3673                 set_acl_as_root = true;
3674         }
3675
3676         create_file_sids(&sbuf, &file_owner_sid, &file_grp_sid);
3677
3678         acl_perms = unpack_canon_ace( fsp, &sbuf, &file_owner_sid, &file_grp_sid,
3679                                         &file_ace_list, &dir_ace_list, security_info_sent, psd);
3680
3681         /* Ignore W2K traverse DACL set. */
3682         if (!file_ace_list && !dir_ace_list) {
3683                 return NT_STATUS_OK;
3684         }
3685
3686         if (!acl_perms) {
3687                 DEBUG(3,("set_nt_acl: cannot set permissions\n"));
3688                 free_canon_ace_list(file_ace_list);
3689                 free_canon_ace_list(dir_ace_list);
3690                 return NT_STATUS_ACCESS_DENIED;
3691         }
3692
3693         /*
3694          * Only change security if we got a DACL.
3695          */
3696
3697         if(!(security_info_sent & DACL_SECURITY_INFORMATION) || (psd->dacl == NULL)) {
3698                 free_canon_ace_list(file_ace_list);
3699                 free_canon_ace_list(dir_ace_list);
3700                 return NT_STATUS_OK;
3701         }
3702
3703         /*
3704          * Try using the POSIX ACL set first. Fall back to chmod if
3705          * we have no ACL support on this filesystem.
3706          */
3707
3708         if (acl_perms && file_ace_list) {
3709                 if (set_acl_as_root) {
3710                         become_root();
3711                 }
3712                 ret = set_canon_ace_list(fsp, file_ace_list, False, sbuf.st_gid, &acl_set_support);
3713                 if (set_acl_as_root) {
3714                         unbecome_root();
3715                 }
3716                 if (acl_set_support && ret == false) {
3717                         DEBUG(3,("set_nt_acl: failed to set file acl on file %s (%s).\n", fsp->fsp_name, strerror(errno) ));
3718                         free_canon_ace_list(file_ace_list);
3719                         free_canon_ace_list(dir_ace_list);
3720                         return map_nt_error_from_unix(errno);
3721                 }
3722         }
3723
3724         if (acl_perms && acl_set_support && fsp->is_directory) {
3725                 if (dir_ace_list) {
3726                         if (set_acl_as_root) {
3727                                 become_root();
3728                         }
3729                         ret = set_canon_ace_list(fsp, dir_ace_list, True, sbuf.st_gid, &acl_set_support);
3730                         if (set_acl_as_root) {
3731                                 unbecome_root();
3732                         }
3733                         if (ret == false) {
3734                                 DEBUG(3,("set_nt_acl: failed to set default acl on directory %s (%s).\n", fsp->fsp_name, strerror(errno) ));
3735                                 free_canon_ace_list(file_ace_list);
3736                                 free_canon_ace_list(dir_ace_list);
3737                                 return map_nt_error_from_unix(errno);
3738                         }
3739                 } else {
3740                         int sret = -1;
3741
3742                         /*
3743                          * No default ACL - delete one if it exists.
3744                          */
3745
3746                         if (set_acl_as_root) {
3747                                 become_root();
3748                         }
3749                         sret = SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn, fsp->fsp_name);
3750                         if (set_acl_as_root) {
3751                                 unbecome_root();
3752                         }
3753                         if (sret == -1) {
3754                                 if (acl_group_override(conn, sbuf.st_gid, fsp->fsp_name)) {
3755                                         DEBUG(5,("set_nt_acl: acl group control on and "
3756                                                 "current user in file %s primary group. Override delete_def_acl\n",
3757                                                 fsp->fsp_name ));
3758
3759                                         become_root();
3760                                         sret = SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn, fsp->fsp_name);
3761                                         unbecome_root();
3762                                 }
3763
3764                                 if (sret == -1) {
3765                                         DEBUG(3,("set_nt_acl: sys_acl_delete_def_file failed (%s)\n", strerror(errno)));
3766                                         free_canon_ace_list(file_ace_list);
3767                                         free_canon_ace_list(dir_ace_list);
3768                                         return map_nt_error_from_unix(errno);
3769                                 }
3770                         }
3771                 }
3772         }
3773
3774         if (acl_set_support) {
3775                 if (set_acl_as_root) {
3776                         become_root();
3777                 }
3778                 store_inheritance_attributes(fsp,
3779                                 file_ace_list,
3780                                 dir_ace_list,
3781                                 psd->type);
3782                 if (set_acl_as_root) {
3783                         unbecome_root();
3784                 }
3785         }
3786
3787         /*
3788          * If we cannot set using POSIX ACLs we fall back to checking if we need to chmod.
3789          */
3790
3791         if(!acl_set_support && acl_perms) {
3792                 mode_t posix_perms;
3793
3794                 if (!convert_canon_ace_to_posix_perms( fsp, file_ace_list, &posix_perms)) {
3795                         free_canon_ace_list(file_ace_list);
3796                         free_canon_ace_list(dir_ace_list);
3797                         DEBUG(3,("set_nt_acl: failed to convert file acl to posix permissions for file %s.\n",
3798                                 fsp->fsp_name ));
3799                         return NT_STATUS_ACCESS_DENIED;
3800                 }
3801
3802                 if (orig_mode != posix_perms) {
3803                         int sret = -1;
3804
3805                         DEBUG(3,("set_nt_acl: chmod %s. perms = 0%o.\n",
3806                                 fsp->fsp_name, (unsigned int)posix_perms ));
3807
3808                         if (set_acl_as_root) {
3809                                 become_root();
3810                         }
3811                         sret = SMB_VFS_CHMOD(conn,fsp->fsp_name, posix_perms);
3812                         if (set_acl_as_root) {
3813                                 unbecome_root();
3814                         }
3815                         if(sret == -1) {
3816                                 if (acl_group_override(conn, sbuf.st_gid, fsp->fsp_name)) {
3817                                         DEBUG(5,("set_nt_acl: acl group control on and "
3818                                                 "current user in file %s primary group. Override chmod\n",
3819                                                 fsp->fsp_name ));
3820
3821                                         become_root();
3822                                         sret = SMB_VFS_CHMOD(conn,fsp->fsp_name, posix_perms);
3823                                         unbecome_root();
3824                                 }
3825
3826                                 if (sret == -1) {
3827                                         DEBUG(3,("set_nt_acl: chmod %s, 0%o failed. Error = %s.\n",
3828                                                 fsp->fsp_name, (unsigned int)posix_perms, strerror(errno) ));
3829                                         free_canon_ace_list(file_ace_list);
3830                                         free_canon_ace_list(dir_ace_list);
3831                                         return map_nt_error_from_unix(errno);
3832                                 }
3833                         }
3834                 }
3835         }
3836
3837         free_canon_ace_list(file_ace_list);
3838         free_canon_ace_list(dir_ace_list);
3839
3840         return NT_STATUS_OK;
3841 }
3842
3843 /****************************************************************************
3844  Get the actual group bits stored on a file with an ACL. Has no effect if
3845  the file has no ACL. Needed in dosmode code where the stat() will return
3846  the mask bits, not the real group bits, for a file with an ACL.
3847 ****************************************************************************/
3848
3849 int get_acl_group_bits( connection_struct *conn, const char *fname, mode_t *mode )
3850 {
3851         int entry_id = SMB_ACL_FIRST_ENTRY;
3852         SMB_ACL_ENTRY_T entry;
3853         SMB_ACL_T posix_acl;
3854         int result = -1;
3855
3856         posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS);
3857         if (posix_acl == (SMB_ACL_T)NULL)
3858                 return -1;
3859
3860         while (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) {
3861                 SMB_ACL_TAG_T tagtype;
3862                 SMB_ACL_PERMSET_T permset;
3863
3864                 entry_id = SMB_ACL_NEXT_ENTRY;
3865
3866                 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) ==-1)
3867                         break;
3868
3869                 if (tagtype == SMB_ACL_GROUP_OBJ) {
3870                         if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1) {
3871                                 break;
3872                         } else {
3873                                 *mode &= ~(S_IRGRP|S_IWGRP|S_IXGRP);
3874                                 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ) ? S_IRGRP : 0);
3875                                 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE) ? S_IWGRP : 0);
3876                                 *mode |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_EXECUTE) ? S_IXGRP : 0);
3877                                 result = 0;
3878                                 break;
3879                         }
3880                 }
3881         }
3882         SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
3883         return result;
3884 }
3885
3886 /****************************************************************************
3887  Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
3888  and set the mask to rwx. Needed to preserve complex ACLs set by NT.
3889 ****************************************************************************/
3890
3891 static int chmod_acl_internals( connection_struct *conn, SMB_ACL_T posix_acl, mode_t mode)
3892 {
3893         int entry_id = SMB_ACL_FIRST_ENTRY;
3894         SMB_ACL_ENTRY_T entry;
3895         int num_entries = 0;
3896
3897         while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) {
3898                 SMB_ACL_TAG_T tagtype;
3899                 SMB_ACL_PERMSET_T permset;
3900                 mode_t perms;
3901
3902                 entry_id = SMB_ACL_NEXT_ENTRY;
3903
3904                 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1)
3905                         return -1;
3906
3907                 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1)
3908                         return -1;
3909
3910                 num_entries++;
3911
3912                 switch(tagtype) {
3913                         case SMB_ACL_USER_OBJ:
3914                                 perms = unix_perms_to_acl_perms(mode, S_IRUSR, S_IWUSR, S_IXUSR);
3915                                 break;
3916                         case SMB_ACL_GROUP_OBJ:
3917                                 perms = unix_perms_to_acl_perms(mode, S_IRGRP, S_IWGRP, S_IXGRP);
3918                                 break;
3919                         case SMB_ACL_MASK:
3920                                 /*
3921                                  * FIXME: The ACL_MASK entry permissions should really be set to
3922                                  * the union of the permissions of all ACL_USER,
3923                                  * ACL_GROUP_OBJ, and ACL_GROUP entries. That's what
3924                                  * acl_calc_mask() does, but Samba ACLs doesn't provide it.
3925                                  */
3926                                 perms = S_IRUSR|S_IWUSR|S_IXUSR;
3927                                 break;
3928                         case SMB_ACL_OTHER:
3929                                 perms = unix_perms_to_acl_perms(mode, S_IROTH, S_IWOTH, S_IXOTH);
3930                                 break;
3931                         default:
3932                                 continue;
3933                 }
3934
3935                 if (map_acl_perms_to_permset(conn, perms, &permset) == -1)
3936                         return -1;
3937
3938                 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, entry, permset) == -1)
3939                         return -1;
3940         }
3941
3942         /*
3943          * If this is a simple 3 element ACL or no elements then it's a standard
3944          * UNIX permission set. Just use chmod...
3945          */
3946
3947         if ((num_entries == 3) || (num_entries == 0))
3948                 return -1;
3949
3950         return 0;
3951 }
3952
3953 /****************************************************************************
3954  Get the access ACL of FROM, do a chmod by setting the ACL USER_OBJ,
3955  GROUP_OBJ and OTHER bits in an ACL and set the mask to rwx. Set the
3956  resulting ACL on TO.  Note that name is in UNIX character set.
3957 ****************************************************************************/
3958
3959 static int copy_access_posix_acl(connection_struct *conn, const char *from, const char *to, mode_t mode)
3960 {
3961         SMB_ACL_T posix_acl = NULL;
3962         int ret = -1;
3963
3964         if ((posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, from, SMB_ACL_TYPE_ACCESS)) == NULL)
3965                 return -1;
3966
3967         if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
3968                 goto done;
3969
3970         ret = SMB_VFS_SYS_ACL_SET_FILE(conn, to, SMB_ACL_TYPE_ACCESS, posix_acl);
3971
3972  done:
3973
3974         SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
3975         return ret;
3976 }
3977
3978 /****************************************************************************
3979  Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
3980  and set the mask to rwx. Needed to preserve complex ACLs set by NT.
3981  Note that name is in UNIX character set.
3982 ****************************************************************************/
3983
3984 int chmod_acl(connection_struct *conn, const char *name, mode_t mode)
3985 {
3986         return copy_access_posix_acl(conn, name, name, mode);
3987 }
3988
3989 /****************************************************************************
3990  Check for an existing default POSIX ACL on a directory.
3991 ****************************************************************************/
3992
3993 static bool directory_has_default_posix_acl(connection_struct *conn, const char *fname)
3994 {
3995         SMB_ACL_T def_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_DEFAULT);
3996         bool has_acl = False;
3997         SMB_ACL_ENTRY_T entry;
3998
3999         if (def_acl != NULL && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, def_acl, SMB_ACL_FIRST_ENTRY, &entry) == 1)) {
4000                 has_acl = True;
4001         }
4002
4003         if (def_acl) {
4004                 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4005         }
4006         return has_acl;
4007 }
4008
4009 /****************************************************************************
4010  If the parent directory has no default ACL but it does have an Access ACL,
4011  inherit this Access ACL to file name.
4012 ****************************************************************************/
4013
4014 int inherit_access_posix_acl(connection_struct *conn, const char *inherit_from_dir,
4015                        const char *name, mode_t mode)
4016 {
4017         if (directory_has_default_posix_acl(conn, inherit_from_dir))
4018                 return 0;
4019
4020         return copy_access_posix_acl(conn, inherit_from_dir, name, mode);
4021 }
4022
4023 /****************************************************************************
4024  Do an fchmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4025  and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4026 ****************************************************************************/
4027
4028 int fchmod_acl(files_struct *fsp, mode_t mode)
4029 {
4030         connection_struct *conn = fsp->conn;
4031         SMB_ACL_T posix_acl = NULL;
4032         int ret = -1;
4033
4034         if ((posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp)) == NULL)
4035                 return -1;
4036
4037         if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
4038                 goto done;
4039
4040         ret = SMB_VFS_SYS_ACL_SET_FD(fsp, posix_acl);
4041
4042   done:
4043
4044         SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
4045         return ret;
4046 }
4047
4048 /****************************************************************************
4049  Map from wire type to permset.
4050 ****************************************************************************/
4051
4052 static bool unix_ex_wire_to_permset(connection_struct *conn, unsigned char wire_perm, SMB_ACL_PERMSET_T *p_permset)
4053 {
4054         if (wire_perm & ~(SMB_POSIX_ACL_READ|SMB_POSIX_ACL_WRITE|SMB_POSIX_ACL_EXECUTE)) {
4055                 return False;
4056         }
4057
4058         if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn, *p_permset) ==  -1) {
4059                 return False;
4060         }
4061
4062         if (wire_perm & SMB_POSIX_ACL_READ) {
4063                 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_READ) == -1) {
4064                         return False;
4065                 }
4066         }
4067         if (wire_perm & SMB_POSIX_ACL_WRITE) {
4068                 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_WRITE) == -1) {
4069                         return False;
4070                 }
4071         }
4072         if (wire_perm & SMB_POSIX_ACL_EXECUTE) {
4073                 if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_EXECUTE) == -1) {
4074                         return False;
4075                 }
4076         }
4077         return True;
4078 }
4079
4080 /****************************************************************************
4081  Map from wire type to tagtype.
4082 ****************************************************************************/
4083
4084 static bool unix_ex_wire_to_tagtype(unsigned char wire_tt, SMB_ACL_TAG_T *p_tt)
4085 {
4086         switch (wire_tt) {
4087                 case SMB_POSIX_ACL_USER_OBJ:
4088                         *p_tt = SMB_ACL_USER_OBJ;
4089                         break;
4090                 case SMB_POSIX_ACL_USER:
4091                         *p_tt = SMB_ACL_USER;
4092                         break;
4093                 case SMB_POSIX_ACL_GROUP_OBJ:
4094                         *p_tt = SMB_ACL_GROUP_OBJ;
4095                         break;
4096                 case SMB_POSIX_ACL_GROUP:
4097                         *p_tt = SMB_ACL_GROUP;
4098                         break;
4099                 case SMB_POSIX_ACL_MASK:
4100                         *p_tt = SMB_ACL_MASK;
4101                         break;
4102                 case SMB_POSIX_ACL_OTHER:
4103                         *p_tt = SMB_ACL_OTHER;
4104                         break;
4105                 default:
4106                         return False;
4107         }
4108         return True;
4109 }
4110
4111 /****************************************************************************
4112  Create a new POSIX acl from wire permissions.
4113  FIXME ! How does the share mask/mode fit into this.... ?
4114 ****************************************************************************/
4115
4116 static SMB_ACL_T create_posix_acl_from_wire(connection_struct *conn, uint16 num_acls, const char *pdata)
4117 {
4118         unsigned int i;
4119         SMB_ACL_T the_acl = SMB_VFS_SYS_ACL_INIT(conn, num_acls);
4120
4121         if (the_acl == NULL) {
4122                 return NULL;
4123         }
4124
4125         for (i = 0; i < num_acls; i++) {
4126                 SMB_ACL_ENTRY_T the_entry;
4127                 SMB_ACL_PERMSET_T the_permset;
4128                 SMB_ACL_TAG_T tag_type;
4129
4130                 if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &the_entry) == -1) {
4131                         DEBUG(0,("create_posix_acl_from_wire: Failed to create entry %u. (%s)\n",
4132                                 i, strerror(errno) ));
4133                         goto fail;
4134                 }
4135
4136                 if (!unix_ex_wire_to_tagtype(CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)), &tag_type)) {
4137                         DEBUG(0,("create_posix_acl_from_wire: invalid wire tagtype %u on entry %u.\n",
4138                                 CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)), i ));
4139                         goto fail;
4140                 }
4141
4142                 if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, the_entry, tag_type) == -1) {
4143                         DEBUG(0,("create_posix_acl_from_wire: Failed to set tagtype on entry %u. (%s)\n",
4144                                 i, strerror(errno) ));
4145                         goto fail;
4146                 }
4147
4148                 /* Get the permset pointer from the new ACL entry. */
4149                 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, the_entry, &the_permset) == -1) {
4150                         DEBUG(0,("create_posix_acl_from_wire: Failed to get permset on entry %u. (%s)\n",
4151                                 i, strerror(errno) ));
4152                         goto fail;
4153                 }
4154
4155                 /* Map from wire to permissions. */
4156                 if (!unix_ex_wire_to_permset(conn, CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+1), &the_permset)) {
4157                         DEBUG(0,("create_posix_acl_from_wire: invalid permset %u on entry %u.\n",
4158                                 CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE) + 1), i ));
4159                         goto fail;
4160                 }
4161
4162                 /* Now apply to the new ACL entry. */
4163                 if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, the_entry, the_permset) == -1) {
4164                         DEBUG(0,("create_posix_acl_from_wire: Failed to add permset on entry %u. (%s)\n",
4165                                 i, strerror(errno) ));
4166                         goto fail;
4167                 }
4168
4169                 if (tag_type == SMB_ACL_USER) {
4170                         uint32 uidval = IVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+2);
4171                         uid_t uid = (uid_t)uidval;
4172                         if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&uid) == -1) {
4173                                 DEBUG(0,("create_posix_acl_from_wire: Failed to set uid %u on entry %u. (%s)\n",
4174                                         (unsigned int)uid, i, strerror(errno) ));
4175                                 goto fail;
4176                         }
4177                 }
4178
4179                 if (tag_type == SMB_ACL_GROUP) {
4180                         uint32 gidval = IVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+2);
4181                         gid_t gid = (uid_t)gidval;
4182                         if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&gid) == -1) {
4183                                 DEBUG(0,("create_posix_acl_from_wire: Failed to set gid %u on entry %u. (%s)\n",
4184                                         (unsigned int)gid, i, strerror(errno) ));
4185                                 goto fail;
4186                         }
4187                 }
4188         }
4189
4190         return the_acl;
4191
4192  fail:
4193
4194         if (the_acl != NULL) {
4195                 SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
4196         }
4197         return NULL;
4198 }
4199
4200 /****************************************************************************
4201  Calls from UNIX extensions - Default POSIX ACL set.
4202  If num_def_acls == 0 and not a directory just return. If it is a directory
4203  and num_def_acls == 0 then remove the default acl. Else set the default acl
4204  on the directory.
4205 ****************************************************************************/
4206
4207 bool set_unix_posix_default_acl(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *psbuf,
4208                                 uint16 num_def_acls, const char *pdata)
4209 {
4210         SMB_ACL_T def_acl = NULL;
4211
4212         if (!S_ISDIR(psbuf->st_mode)) {
4213                 if (num_def_acls) {
4214                         DEBUG(5,("set_unix_posix_default_acl: Can't set default ACL on non-directory file %s\n", fname ));
4215                         errno = EISDIR;
4216                         return False;
4217                 } else {
4218                         return True;
4219                 }
4220         }
4221
4222         if (!num_def_acls) {
4223                 /* Remove the default ACL. */
4224                 if (SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn, fname) == -1) {
4225                         DEBUG(5,("set_unix_posix_default_acl: acl_delete_def_file failed on directory %s (%s)\n",
4226                                 fname, strerror(errno) ));
4227                         return False;
4228                 }
4229                 return True;
4230         }
4231
4232         if ((def_acl = create_posix_acl_from_wire(conn, num_def_acls, pdata)) == NULL) {
4233                 return False;
4234         }
4235
4236         if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_DEFAULT, def_acl) == -1) {
4237                 DEBUG(5,("set_unix_posix_default_acl: acl_set_file failed on directory %s (%s)\n",
4238                         fname, strerror(errno) ));
4239                 SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4240                 return False;
4241         }
4242
4243         DEBUG(10,("set_unix_posix_default_acl: set default acl for file %s\n", fname ));
4244         SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4245         return True;
4246 }
4247
4248 /****************************************************************************
4249  Remove an ACL from a file. As we don't have acl_delete_entry() available
4250  we must read the current acl and copy all entries except MASK, USER and GROUP
4251  to a new acl, then set that. This (at least on Linux) causes any ACL to be
4252  removed.
4253  FIXME ! How does the share mask/mode fit into this.... ?
4254 ****************************************************************************/
4255
4256 static bool remove_posix_acl(connection_struct *conn, files_struct *fsp, const char *fname)
4257 {
4258         SMB_ACL_T file_acl = NULL;
4259         int entry_id = SMB_ACL_FIRST_ENTRY;
4260         SMB_ACL_ENTRY_T entry;
4261         bool ret = False;
4262         /* Create a new ACL with only 3 entries, u/g/w. */
4263         SMB_ACL_T new_file_acl = SMB_VFS_SYS_ACL_INIT(conn, 3);
4264         SMB_ACL_ENTRY_T user_ent = NULL;
4265         SMB_ACL_ENTRY_T group_ent = NULL;
4266         SMB_ACL_ENTRY_T other_ent = NULL;
4267
4268         if (new_file_acl == NULL) {
4269                 DEBUG(5,("remove_posix_acl: failed to init new ACL with 3 entries for file %s.\n", fname));
4270                 return False;
4271         }
4272
4273         /* Now create the u/g/w entries. */
4274         if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &user_ent) == -1) {
4275                 DEBUG(5,("remove_posix_acl: Failed to create user entry for file %s. (%s)\n",
4276                         fname, strerror(errno) ));
4277                 goto done;
4278         }
4279         if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, user_ent, SMB_ACL_USER_OBJ) == -1) {
4280                 DEBUG(5,("remove_posix_acl: Failed to set user entry for file %s. (%s)\n",
4281                         fname, strerror(errno) ));
4282                 goto done;
4283         }
4284
4285         if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &group_ent) == -1) {
4286                 DEBUG(5,("remove_posix_acl: Failed to create group entry for file %s. (%s)\n",
4287                         fname, strerror(errno) ));
4288                 goto done;
4289         }
4290         if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, group_ent, SMB_ACL_GROUP_OBJ) == -1) {
4291                 DEBUG(5,("remove_posix_acl: Failed to set group entry for file %s. (%s)\n",
4292                         fname, strerror(errno) ));
4293                 goto done;
4294         }
4295
4296         if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &other_ent) == -1) {
4297                 DEBUG(5,("remove_posix_acl: Failed to create other entry for file %s. (%s)\n",
4298                         fname, strerror(errno) ));
4299                 goto done;
4300         }
4301         if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, other_ent, SMB_ACL_OTHER) == -1) {
4302                 DEBUG(5,("remove_posix_acl: Failed to set other entry for file %s. (%s)\n",
4303                         fname, strerror(errno) ));
4304                 goto done;
4305         }
4306
4307         /* Get the current file ACL. */
4308         if (fsp && fsp->fh->fd != -1) {
4309                 file_acl = SMB_VFS_SYS_ACL_GET_FD(fsp);
4310         } else {
4311                 file_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_ACCESS);
4312         }
4313
4314         if (file_acl == NULL) {
4315                 /* This is only returned if an error occurred. Even for a file with
4316                    no acl a u/g/w acl should be returned. */
4317                 DEBUG(5,("remove_posix_acl: failed to get ACL from file %s (%s).\n",
4318                         fname, strerror(errno) ));
4319                 goto done;
4320         }
4321
4322         while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, file_acl, entry_id, &entry) == 1) {
4323                 SMB_ACL_TAG_T tagtype;
4324                 SMB_ACL_PERMSET_T permset;
4325
4326                 entry_id = SMB_ACL_NEXT_ENTRY;
4327
4328                 if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1) {
4329                         DEBUG(5,("remove_posix_acl: failed to get tagtype from ACL on file %s (%s).\n",
4330                                 fname, strerror(errno) ));
4331                         goto done;
4332                 }
4333
4334                 if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1) {
4335                         DEBUG(5,("remove_posix_acl: failed to get permset from ACL on file %s (%s).\n",
4336                                 fname, strerror(errno) ));
4337                         goto done;
4338                 }
4339
4340                 if (tagtype == SMB_ACL_USER_OBJ) {
4341                         if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, user_ent, permset) == -1) {
4342                                 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4343                                         fname, strerror(errno) ));
4344                         }
4345                 } else if (tagtype == SMB_ACL_GROUP_OBJ) {
4346                         if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, group_ent, permset) == -1) {
4347                                 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4348                                         fname, strerror(errno) ));
4349                         }
4350                 } else if (tagtype == SMB_ACL_OTHER) {
4351                         if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, other_ent, permset) == -1) {
4352                                 DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4353                                         fname, strerror(errno) ));
4354                         }
4355                 }
4356         }
4357
4358         /* Set the new empty file ACL. */
4359         if (fsp && fsp->fh->fd != -1) {
4360                 if (SMB_VFS_SYS_ACL_SET_FD(fsp, new_file_acl) == -1) {
4361                         DEBUG(5,("remove_posix_acl: acl_set_file failed on %s (%s)\n",
4362                                 fname, strerror(errno) ));
4363                         goto done;
4364                 }
4365         } else {
4366                 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS, new_file_acl) == -1) {
4367                         DEBUG(5,("remove_posix_acl: acl_set_file failed on %s (%s)\n",
4368                                 fname, strerror(errno) ));
4369                         goto done;
4370                 }
4371         }
4372
4373         ret = True;
4374
4375  done:
4376
4377         if (file_acl) {
4378                 SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4379         }
4380         if (new_file_acl) {
4381                 SMB_VFS_SYS_ACL_FREE_ACL(conn, new_file_acl);
4382         }
4383         return ret;
4384 }
4385
4386 /****************************************************************************
4387  Calls from UNIX extensions - POSIX ACL set.
4388  If num_def_acls == 0 then read/modify/write acl after removing all entries
4389  except SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER.
4390 ****************************************************************************/
4391
4392 bool set_unix_posix_acl(connection_struct *conn, files_struct *fsp, const char *fname, uint16 num_acls, const char *pdata)
4393 {
4394         SMB_ACL_T file_acl = NULL;
4395
4396         if (!num_acls) {
4397                 /* Remove the ACL from the file. */
4398                 return remove_posix_acl(conn, fsp, fname);
4399         }
4400
4401         if ((file_acl = create_posix_acl_from_wire(conn, num_acls, pdata)) == NULL) {
4402                 return False;
4403         }
4404
4405         if (fsp && fsp->fh->fd != -1) {
4406                 /* The preferred way - use an open fd. */
4407                 if (SMB_VFS_SYS_ACL_SET_FD(fsp, file_acl) == -1) {
4408                         DEBUG(5,("set_unix_posix_acl: acl_set_file failed on %s (%s)\n",
4409                                 fname, strerror(errno) ));
4410                         SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4411                         return False;
4412                 }
4413         } else {
4414                 if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS, file_acl) == -1) {
4415                         DEBUG(5,("set_unix_posix_acl: acl_set_file failed on %s (%s)\n",
4416                                 fname, strerror(errno) ));
4417                         SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4418                         return False;
4419                 }
4420         }
4421
4422         DEBUG(10,("set_unix_posix_acl: set acl for file %s\n", fname ));
4423         SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4424         return True;
4425 }
4426
4427 /********************************************************************
4428  Pull the NT ACL from a file on disk or the OpenEventlog() access
4429  check.  Caller is responsible for freeing the returned security
4430  descriptor via TALLOC_FREE().  This is designed for dealing with
4431  user space access checks in smbd outside of the VFS.  For example,
4432  checking access rights in OpenEventlog().
4433
4434  Assume we are dealing with files (for now)
4435 ********************************************************************/
4436
4437 SEC_DESC *get_nt_acl_no_snum( TALLOC_CTX *ctx, const char *fname)
4438 {
4439         SEC_DESC *psd, *ret_sd;
4440         connection_struct *conn;
4441         files_struct finfo;
4442         struct fd_handle fh;
4443
4444         conn = TALLOC_ZERO_P(ctx, connection_struct);
4445         if (conn == NULL) {
4446                 DEBUG(0, ("talloc failed\n"));
4447                 return NULL;
4448         }
4449
4450         if (!(conn->params = TALLOC_P(conn, struct share_params))) {
4451                 DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
4452                 TALLOC_FREE(conn);
4453                 return NULL;
4454         }
4455
4456         conn->params->service = -1;
4457
4458         set_conn_connectpath(conn, "/");
4459
4460         if (!smbd_vfs_init(conn)) {
4461                 DEBUG(0,("get_nt_acl_no_snum: Unable to create a fake connection struct!\n"));
4462                 conn_free_internal( conn );
4463                 return NULL;
4464         }
4465
4466         ZERO_STRUCT( finfo );
4467         ZERO_STRUCT( fh );
4468
4469         finfo.fnum = -1;
4470         finfo.conn = conn;
4471         finfo.fh = &fh;
4472         finfo.fh->fd = -1;
4473         finfo.fsp_name = CONST_DISCARD(char *,fname);
4474
4475         if (!NT_STATUS_IS_OK(SMB_VFS_FGET_NT_ACL( &finfo, DACL_SECURITY_INFORMATION, &psd))) {
4476                 DEBUG(0,("get_nt_acl_no_snum: get_nt_acl returned zero.\n"));
4477                 conn_free_internal( conn );
4478                 return NULL;
4479         }
4480
4481         ret_sd = dup_sec_desc( ctx, psd );
4482
4483         conn_free_internal( conn );
4484
4485         return ret_sd;
4486 }