s4: ntvfs/posix: to set a DACL at open time SEC_DESC_DACL_PRESENT must be set

[kai/samba.git] / source4 / ntvfs / posix / pvfs_open.c

diff --git a/source4/ntvfs/posix/pvfs_open.c b/source4/ntvfs/posix/pvfs_open.c
index 43203086f8711de7859cad828aa2388c6f81e7eb..fe3c915576f9ef3051441f2b9a0db83571b8bfc7 100644 (file)
--- a/source4/ntvfs/posix/pvfs_open.c
+++ b/source4/ntvfs/posix/pvfs_open.c
@@ -23,7 +23,7 @@
 #include "vfs_posix.h"
 #include "system/dir.h"
 #include "system/time.h"
-#include "lib/util/dlinklist.h"
+#include "../lib/util/dlinklist.h"
 #include "messaging/messaging.h"
 #include "librpc/gen_ndr/xattr.h"
 
@@ -106,6 +106,7 @@ static NTSTATUS pvfs_open_setup_eas_acl(struct pvfs_state *pvfs,
                                        union smb_open *io)
 {
        NTSTATUS status;
+       struct security_descriptor *sd;
 
        /* setup any EAs that were asked for */
        if (io->ntcreatex.in.ea_list) {
@@ -117,8 +118,9 @@ static NTSTATUS pvfs_open_setup_eas_acl(struct pvfs_state *pvfs,
                }
        }
 
+       sd = io->ntcreatex.in.sec_desc;
        /* setup an initial sec_desc if requested */
-       if (io->ntcreatex.in.sec_desc) {
+       if (sd && (sd->type & SEC_DESC_DACL_PRESENT)) {
                union smb_setfileinfo set;
 /* 
  * TODO: set the full ACL! 
@@ -129,7 +131,7 @@ static NTSTATUS pvfs_open_setup_eas_acl(struct pvfs_state *pvfs,
  */
                set.set_secdesc.in.file.ntvfs = f->ntvfs;
                set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
-               set.set_secdesc.in.sd = io->ntcreatex.in.sec_desc;
+               set.set_secdesc.in.sd = sd;
 
                status = pvfs_acl_set(pvfs, req, name, fd, SEC_STD_WRITE_DAC, &set);
        } else {
@@ -631,12 +633,6 @@ static NTSTATUS pvfs_create_file(struct pvfs_state *pvfs,
        status = pvfs_access_check_create(pvfs, req, name, &access_mask);
        NT_STATUS_NOT_OK_RETURN(status);
 
-       if (io->generic.in.query_maximal_access) {
-               status = pvfs_access_maximal_allowed(pvfs, req, name, 
-                                                    &io->generic.out.maximal_access);
-               NT_STATUS_NOT_OK_RETURN(status);
-       }
-
        /* check that the parent isn't opened with delete on close set */
        status = pvfs_resolve_parent(pvfs, req, name, &parent);
        if (NT_STATUS_IS_OK(status)) {
@@ -707,6 +703,12 @@ static NTSTATUS pvfs_create_file(struct pvfs_state *pvfs,
                goto cleanup_delete;
        }
 
+       if (io->generic.in.query_maximal_access) {
+               status = pvfs_access_maximal_allowed(pvfs, req, name, 
+                                                    &io->generic.out.maximal_access);
+               NT_STATUS_NOT_OK_RETURN(status);
+       }
+
        /* form the lock context used for byte range locking and
           opendb locking */
        status = pvfs_locking_key(name, f->handle, &f->handle->odb_locking_key);
@@ -1173,7 +1175,7 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
                   struct ntvfs_request *req, union smb_open *io)
 {
        struct pvfs_state *pvfs = ntvfs->private_data;
-       int flags;
+       int flags = 0;
        struct pvfs_filename *name;
        struct pvfs_file *f;
        struct ntvfs_handle *h;
@@ -1181,6 +1183,7 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
        int fd;
        struct odb_lock *lck;
        uint32_t create_options;
+       uint32_t create_options_must_ignore_mask;
        uint32_t share_access;
        uint32_t access_mask;
        uint32_t create_action = NTCREATEX_ACTION_EXISTED;
@@ -1206,11 +1209,48 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
                return NT_STATUS_INVALID_PARAMETER;
        }
 
-       /* some create options are not supported */
+       /*
+        * These options are ignored,
+        * but we reuse some of them as private values for the generic mapping
+        */
+       create_options_must_ignore_mask = NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
+       create_options_must_ignore_mask &= ~NTCREATEX_OPTIONS_PRIVATE_MASK;
+       create_options &= ~create_options_must_ignore_mask;
+
        if (create_options & NTCREATEX_OPTIONS_NOT_SUPPORTED_MASK) {
+               DEBUG(2,(__location__ " create_options 0x%x not supported\n", 
+                        create_options));
                return NT_STATUS_NOT_SUPPORTED;
        }
 
+       if (create_options & NTCREATEX_OPTIONS_INVALID_PARAM_MASK) {
+               return NT_STATUS_INVALID_PARAMETER;
+       }
+
+       /* TODO: When we implement HSM, add a hook here not to pull
+        * the actual file off tape, when this option is passed from
+        * the client */
+       if (create_options & NTCREATEX_OPTIONS_NO_RECALL) {
+               /* no-op */
+       }
+
+       /* TODO: If (unlikely) Linux does a good compressed
+        * filesystem, we might need an ioctl call for this */
+       if (create_options & NTCREATEX_OPTIONS_NO_COMPRESSION) {
+               /* no-op */
+       }
+
+       if (create_options & NTCREATEX_OPTIONS_NO_INTERMEDIATE_BUFFERING) {
+               create_options |= NTCREATEX_OPTIONS_WRITE_THROUGH;
+       }
+
+       /* Open the file with sync, if they asked for it, but
+          'strict sync = no' turns this client request into a no-op */
+       if (create_options & (NTCREATEX_OPTIONS_WRITE_THROUGH) && !(pvfs->flags | PVFS_FLAG_STRICT_SYNC)) {
+               flags |= O_SYNC;
+       }
+
+
        /* other create options are not allowed */
        if ((create_options & NTCREATEX_OPTIONS_DELETE_ON_CLOSE) &&
            !(access_mask & SEC_STD_DELETE)) {
@@ -1271,8 +1311,6 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
           open doesn't match */
        io->generic.in.file_attr &= ~FILE_ATTRIBUTE_DIRECTORY;
 
-       flags = 0;
-
        switch (io->generic.in.open_disposition) {
        case NTCREATEX_DISP_SUPERSEDE:
        case NTCREATEX_DISP_OVERWRITE_IF: