2 Unix SMB/CIFS implementation.
3 Set NT and POSIX ACLs and other VFS operations from Python
5 Copyrigyt (C) Andrew Bartlett 2012
6 Copyright (C) Jeremy Allison 1994-2009.
7 Copyright (C) Andreas Gruenbacher 2002.
8 Copyright (C) Simo Sorce <idra@samba.org> 2009.
9 Copyright (C) Simo Sorce 2002
10 Copyright (C) Eric Lorimer 2002
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #include "smbd/smbd.h"
29 #include "libcli/util/pyerrors.h"
30 #include "librpc/rpc/pyrpc_util.h"
32 #include "system/filesys.h"
34 extern const struct generic_mapping file_generic_mapping;
37 #define DBGC_CLASS DBGC_ACLS
39 static NTSTATUS set_sys_acl_no_snum(const char *fname,
40 SMB_ACL_TYPE_T acltype,
43 connection_struct *conn;
44 NTSTATUS status = NT_STATUS_OK;
48 conn = talloc_zero(NULL, connection_struct);
50 DEBUG(0, ("talloc failed\n"));
51 return NT_STATUS_NO_MEMORY;
54 if (!(conn->params = talloc(conn, struct share_params))) {
55 DEBUG(0,("set_sys_acl_no_snum: talloc() failed!\n"));
57 return NT_STATUS_NO_MEMORY;
60 /* we want total control over the permissions on created files,
61 so set our umask to 0 */
62 saved_umask = umask(0);
64 conn->params->service = -1;
66 set_conn_connectpath(conn, "/");
70 ret = SMB_VFS_SYS_ACL_SET_FILE( conn, fname, acltype, theacl);
72 status = map_nt_error_from_unix_common(ret);
73 DEBUG(0,("set_sys_acl_no_snum: SMB_VFS_SYS_ACL_SET_FILE "
84 static NTSTATUS set_nt_acl_no_snum(const char *fname,
85 uint32 security_info_sent, const struct security_descriptor *sd)
87 TALLOC_CTX *frame = talloc_stackframe();
88 connection_struct *conn;
89 NTSTATUS status = NT_STATUS_OK;
91 struct smb_filename *smb_fname = NULL;
95 if (!posix_locking_init(false)) {
97 return NT_STATUS_NO_MEMORY;
100 conn = talloc_zero(frame, connection_struct);
103 DEBUG(0, ("talloc failed\n"));
104 return NT_STATUS_NO_MEMORY;
107 if (!(conn->params = talloc(conn, struct share_params))) {
108 DEBUG(0,("set_nt_acl_no_snum: talloc() failed!\n"));
110 return NT_STATUS_NO_MEMORY;
113 fsp = talloc_zero(frame, struct files_struct);
116 return NT_STATUS_NO_MEMORY;
118 fsp->fh = talloc(fsp, struct fd_handle);
119 if (fsp->fh == NULL) {
121 return NT_STATUS_NO_MEMORY;
125 /* we want total control over the permissions on created files,
126 so set our umask to 0 */
127 saved_umask = umask(0);
129 conn->params->service = -1;
131 set_conn_connectpath(conn, "/");
135 status = create_synthetic_smb_fname_split(fsp, fname, NULL,
137 if (!NT_STATUS_IS_OK(status)) {
143 fsp->fsp_name = smb_fname;
146 flags = O_RDONLY|O_DIRECTORY;
148 /* POSIX allows us to open a directory with O_RDONLY. */
152 fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, O_RDWR, 00400);
153 if (fsp->fh->fd == -1 && errno == EISDIR) {
154 fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, flags, 00400);
156 if (fsp->fh->fd == -1) {
157 printf("open: error=%d (%s)\n", errno, strerror(errno));
160 return NT_STATUS_UNSUCCESSFUL;
163 ret = SMB_VFS_FSTAT(fsp, &smb_fname->st);
165 /* If we have an fd, this stat should succeed. */
166 DEBUG(0,("Error doing fstat on open file %s "
168 smb_fname_str_dbg(smb_fname),
172 return map_nt_error_from_unix(errno);
175 fsp->file_id = vfs_file_id_from_sbuf(conn, &smb_fname->st);
176 fsp->vuid = UID_FIELD_INVALID;
178 fsp->can_lock = True;
179 fsp->can_read = True;
180 fsp->can_write = True;
181 fsp->print_file = NULL;
182 fsp->modified = False;
183 fsp->sent_oplock_break = NO_BREAK_SENT;
184 fsp->is_directory = S_ISDIR(smb_fname->st.st_ex_mode);
186 status = SMB_VFS_FSET_NT_ACL( fsp, security_info_sent, sd);
187 if (!NT_STATUS_IS_OK(status)) {
188 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned %s.\n", nt_errstr(status)));
201 static SMB_ACL_T make_simple_acl(gid_t gid, mode_t chmod_mode)
203 TALLOC_CTX *frame = talloc_stackframe();
205 mode_t mode = SMB_ACL_READ|SMB_ACL_WRITE|SMB_ACL_EXECUTE;
207 mode_t mode_user = (chmod_mode & 0700) >> 6;
208 mode_t mode_group = (chmod_mode & 070) >> 3;
209 mode_t mode_other = chmod_mode & 07;
210 SMB_ACL_ENTRY_T entry;
211 SMB_ACL_T acl = sys_acl_init(frame);
217 if (sys_acl_create_entry(&acl, &entry) != 0) {
222 if (sys_acl_set_tag_type(entry, SMB_ACL_USER_OBJ) != 0) {
227 if (sys_acl_set_permset(entry, &mode_user) != 0) {
232 if (sys_acl_create_entry(&acl, &entry) != 0) {
237 if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP_OBJ) != 0) {
242 if (sys_acl_set_permset(entry, &mode_group) != 0) {
247 if (sys_acl_create_entry(&acl, &entry) != 0) {
252 if (sys_acl_set_tag_type(entry, SMB_ACL_OTHER) != 0) {
257 if (sys_acl_set_permset(entry, &mode_other) != 0) {
263 if (sys_acl_create_entry(&acl, &entry) != 0) {
268 if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP) != 0) {
273 if (sys_acl_set_qualifier(entry, &gid) != 0) {
278 if (sys_acl_set_permset(entry, &mode_group) != 0) {
284 if (sys_acl_create_entry(&acl, &entry) != 0) {
289 if (sys_acl_set_tag_type(entry, SMB_ACL_MASK) != 0) {
294 if (sys_acl_set_permset(entry, &mode) != 0) {
302 set a simple ACL on a file, as a test
304 static PyObject *py_smbd_set_simple_acl(PyObject *self, PyObject *args)
312 if (!PyArg_ParseTuple(args, "si|i", &fname, &mode, &gid))
315 acl = make_simple_acl(gid, mode);
317 frame = talloc_stackframe();
319 status = set_sys_acl_no_snum(fname, SMB_ACL_TYPE_ACCESS, acl);
324 PyErr_NTSTATUS_IS_ERR_RAISE(status);
332 static PyObject *py_smbd_chown(PyObject *self, PyObject *args)
334 connection_struct *conn;
335 NTSTATUS status = NT_STATUS_OK;
343 if (!PyArg_ParseTuple(args, "sii", &fname, &uid, &gid))
346 frame = talloc_stackframe();
348 conn = talloc_zero(frame, connection_struct);
354 if (!(conn->params = talloc(conn, struct share_params))) {
359 /* we want total control over the permissions on created files,
360 so set our umask to 0 */
361 saved_umask = umask(0);
363 conn->params->service = -1;
365 set_conn_connectpath(conn, "/");
369 ret = SMB_VFS_CHOWN( conn, fname, uid, gid);
371 status = map_nt_error_from_unix_common(errno);
372 DEBUG(0,("chown returned failure: %s\n", strerror(errno)));
381 PyErr_NTSTATUS_IS_ERR_RAISE(status);
389 static PyObject *py_smbd_unlink(PyObject *self, PyObject *args)
391 connection_struct *conn;
392 NTSTATUS status = NT_STATUS_OK;
394 struct smb_filename *smb_fname = NULL;
399 if (!PyArg_ParseTuple(args, "s", &fname))
402 frame = talloc_stackframe();
404 conn = talloc_zero(frame, connection_struct);
410 if (!(conn->params = talloc(conn, struct share_params))) {
415 /* we want total control over the permissions on created files,
416 so set our umask to 0 */
417 saved_umask = umask(0);
419 conn->params->service = -1;
421 set_conn_connectpath(conn, "/");
425 status = create_synthetic_smb_fname_split(frame, fname, NULL,
427 if (!NT_STATUS_IS_OK(status)) {
430 PyErr_NTSTATUS_IS_ERR_RAISE(status);
433 ret = SMB_VFS_UNLINK(conn, smb_fname);
435 status = map_nt_error_from_unix_common(errno);
436 DEBUG(0,("unlink returned failure: %s\n", strerror(errno)));
445 PyErr_NTSTATUS_IS_ERR_RAISE(status);
451 check if we have ACL support
453 static PyObject *py_smbd_have_posix_acls(PyObject *self, PyObject *args)
455 #ifdef HAVE_POSIX_ACLS
456 return PyBool_FromLong(true);
458 return PyBool_FromLong(false);
463 set the NT ACL on a file
465 static PyObject *py_smbd_set_nt_acl(PyObject *self, PyObject *args)
469 int security_info_sent;
471 struct security_descriptor *sd;
473 if (!PyArg_ParseTuple(args, "siO", &fname, &security_info_sent, &py_sd))
476 if (!py_check_dcerpc_type(py_sd, "samba.dcerpc.security", "descriptor")) {
480 sd = pytalloc_get_type(py_sd, struct security_descriptor);
482 status = set_nt_acl_no_snum(fname, security_info_sent, sd);
483 PyErr_NTSTATUS_IS_ERR_RAISE(status);
489 Return the NT ACL on a file
491 static PyObject *py_smbd_get_nt_acl(PyObject *self, PyObject *args)
494 int security_info_wanted;
496 struct security_descriptor *sd;
497 TALLOC_CTX *tmp_ctx = talloc_new(NULL);
499 if (!PyArg_ParseTuple(args, "si", &fname, &security_info_wanted))
502 sd = get_nt_acl_no_snum(tmp_ctx, fname, security_info_wanted);
504 py_sd = py_return_ndr_struct("samba.dcerpc.security", "descriptor", sd, sd);
506 talloc_free(tmp_ctx);
512 set the posix (or similar) ACL on a file
514 static PyObject *py_smbd_set_sys_acl(PyObject *self, PyObject *args)
519 struct smb_acl_t *acl;
522 if (!PyArg_ParseTuple(args, "siO", &fname, &acl_type, &py_acl))
525 if (!py_check_dcerpc_type(py_acl, "samba.dcerpc.smb_acl", "t")) {
529 acl = pytalloc_get_type(py_acl, struct smb_acl_t);
531 status = set_sys_acl_no_snum(fname, acl_type, acl);
532 PyErr_NTSTATUS_IS_ERR_RAISE(status);
538 Return the posix (or similar) ACL on a file
540 static PyObject *py_smbd_get_sys_acl(PyObject *self, PyObject *args)
544 struct smb_acl_t *acl;
546 TALLOC_CTX *frame = talloc_stackframe();
547 connection_struct *conn;
548 NTSTATUS status = NT_STATUS_OK;
550 if (!PyArg_ParseTuple(args, "si", &fname, &acl_type)) {
555 conn = talloc_zero(frame, connection_struct);
557 DEBUG(0, ("talloc failed\n"));
563 if (!(conn->params = talloc(conn, struct share_params))) {
564 DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
570 conn->params->service = -1;
572 set_conn_connectpath(conn, "/");
576 acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, acl_type, frame);
579 status = map_nt_error_from_unix_common(errno);
580 DEBUG(0,("sys_acl_get_file returned NULL: %s\n", strerror(errno)));
581 PyErr_NTSTATUS_IS_ERR_RAISE(status);
586 py_acl = py_return_ndr_struct("samba.dcerpc.smb_acl", "t", acl, acl);
593 static PyMethodDef py_smbd_methods[] = {
595 (PyCFunction)py_smbd_have_posix_acls, METH_VARARGS,
598 (PyCFunction)py_smbd_set_simple_acl, METH_VARARGS,
601 (PyCFunction)py_smbd_set_nt_acl, METH_VARARGS,
604 (PyCFunction)py_smbd_get_nt_acl, METH_VARARGS,
607 (PyCFunction)py_smbd_get_sys_acl, METH_VARARGS,
610 (PyCFunction)py_smbd_set_sys_acl, METH_VARARGS,
613 (PyCFunction)py_smbd_chown, METH_VARARGS,
616 (PyCFunction)py_smbd_unlink, METH_VARARGS,
626 m = Py_InitModule3("smbd", py_smbd_methods,
627 "Python bindings for the smbd file server.");