1 # Unix SMB/CIFS implementation.
2 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2010
5 # This program is free software; you can redistribute it and/or modify
6 # it under the terms of the GNU General Public License as published by
7 # the Free Software Foundation; either version 3 of the License, or
8 # (at your option) any later version.
10 # This program is distributed in the hope that it will be useful,
11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 # GNU General Public License for more details.
15 # You should have received a copy of the GNU General Public License
16 # along with this program. If not, see <http://www.gnu.org/licenses/>.
19 from __future__ import print_function
24 import samba.xattr_native, samba.xattr_tdb, samba.posix_eadb
25 from samba.dcerpc import security, xattr, idmap
26 from samba.ndr import ndr_pack, ndr_unpack
27 from samba.samba3 import smbd
29 class XattrBackendError(Exception):
30 """A generic xattr backend error."""
33 def checkset_backend(lp, backend, eadbfile):
34 '''return the path to the eadb, or None'''
36 xattr_tdb = lp.get("xattr_tdb:file")
37 if xattr_tdb is not None:
38 return (samba.xattr_tdb, lp.get("xattr_tdb:file"))
39 posix_eadb = lp.get("posix:eadb")
40 if posix_eadb is not None:
41 return (samba.posix_eadb, lp.get("posix:eadb"))
43 elif backend == "native":
45 elif backend == "eadb":
46 if eadbfile is not None:
47 return (samba.posix_eadb, eadbfile)
49 return (samba.posix_eadb, os.path.abspath(os.path.join(lp.get("private dir"), "eadb.tdb")))
50 elif backend == "tdb":
51 if eadbfile is not None:
52 return (samba.xattr_tdb, eadbfile)
54 return (samba.xattr_tdb, os.path.abspath(os.path.join(lp.get("state dir"), "xattr.tdb")))
56 raise XattrBackendError("Invalid xattr backend choice %s"%backend)
58 def getdosinfo(lp, file):
60 attribute = samba.xattr_native.wrap_getxattr(file,
61 xattr.XATTR_DOSATTRIB_NAME_S3)
65 return ndr_unpack(xattr.DOSATTRIB, attribute)
67 def getntacl(lp, file, backend=None, eadbfile=None, direct_db_access=True, service=None):
69 (backend_obj, dbname) = checkset_backend(lp, backend, eadbfile)
70 if dbname is not None:
72 attribute = backend_obj.wrap_getxattr(dbname, file,
73 xattr.XATTR_NTACL_NAME)
75 # FIXME: Don't catch all exceptions, just those related to opening
77 print("Fail to open %s" % dbname)
78 attribute = samba.xattr_native.wrap_getxattr(file,
79 xattr.XATTR_NTACL_NAME)
81 attribute = samba.xattr_native.wrap_getxattr(file,
82 xattr.XATTR_NTACL_NAME)
83 ntacl = ndr_unpack(xattr.NTACL, attribute)
84 if ntacl.version == 1:
86 elif ntacl.version == 2:
88 elif ntacl.version == 3:
90 elif ntacl.version == 4:
93 return smbd.get_nt_acl(file, security.SECINFO_OWNER | security.SECINFO_GROUP | security.SECINFO_DACL | security.SECINFO_SACL, service=service)
96 def setntacl(lp, file, sddl, domsid, backend=None, eadbfile=None, use_ntvfs=True, skip_invalid_chown=False, passdb=None, service=None):
97 assert(isinstance(domsid, str) or isinstance(domsid, security.dom_sid))
98 if isinstance(domsid, str):
99 sid = security.dom_sid(domsid)
100 elif isinstance(domsid, security.dom_sid):
104 assert(isinstance(sddl, str) or isinstance(sddl, security.descriptor))
105 if isinstance(sddl, str):
106 sd = security.descriptor.from_sddl(sddl, sid)
107 elif isinstance(sddl, security.descriptor):
109 sddl = sd.as_sddl(sid)
111 if not use_ntvfs and skip_invalid_chown:
112 # Check if the owner can be resolved as a UID
113 (owner_id, owner_type) = passdb.sid_to_id(sd.owner_sid)
114 if ((owner_type != idmap.ID_TYPE_UID) and (owner_type != idmap.ID_TYPE_BOTH)):
115 # Check if this particular owner SID was domain admins,
116 # because we special-case this as mapping to
117 # 'administrator' instead.
118 if sd.owner_sid == security.dom_sid("%s-%d" % (domsid, security.DOMAIN_RID_ADMINS)):
119 administrator = security.dom_sid("%s-%d" % (domsid, security.DOMAIN_RID_ADMINISTRATOR))
120 (admin_id, admin_type) = passdb.sid_to_id(administrator)
122 # Confirm we have a UID for administrator
123 if ((admin_type == idmap.ID_TYPE_UID) or (admin_type == idmap.ID_TYPE_BOTH)):
125 # Set it, changing the owner to 'administrator' rather than domain admins
127 sd2.owner_sid = administrator
129 smbd.set_nt_acl(file, security.SECINFO_OWNER |security.SECINFO_GROUP | security.SECINFO_DACL | security.SECINFO_SACL, sd2, service=service)
131 # and then set an NTVFS ACL (which does not set the posix ACL) to pretend the owner really was set
134 raise XattrBackendError("Unable to find UID for domain administrator %s, got id %d of type %d" % (administrator, admin_id, admin_type))
136 # For all other owning users, reset the owner to root
137 # and then set the ACL without changing the owner
139 # This won't work in test environments, as it tries a real (rather than xattr-based fake) chown
142 smbd.set_nt_acl(file, security.SECINFO_GROUP | security.SECINFO_DACL | security.SECINFO_SACL, sd, service=service)
145 (backend_obj, dbname) = checkset_backend(lp, backend, eadbfile)
146 ntacl = xattr.NTACL()
149 if dbname is not None:
151 backend_obj.wrap_setxattr(dbname,
152 file, xattr.XATTR_NTACL_NAME, ndr_pack(ntacl))
154 # FIXME: Don't catch all exceptions, just those related to opening
156 print("Fail to open %s" % dbname)
157 samba.xattr_native.wrap_setxattr(file, xattr.XATTR_NTACL_NAME,
160 samba.xattr_native.wrap_setxattr(file, xattr.XATTR_NTACL_NAME,
163 smbd.set_nt_acl(file, security.SECINFO_OWNER | security.SECINFO_GROUP | security.SECINFO_DACL | security.SECINFO_SACL, sd, service=service)
166 def ldapmask2filemask(ldm):
167 """Takes the access mask of a DS ACE and transform them in a File ACE mask.
169 RIGHT_DS_CREATE_CHILD = 0x00000001
170 RIGHT_DS_DELETE_CHILD = 0x00000002
171 RIGHT_DS_LIST_CONTENTS = 0x00000004
172 ACTRL_DS_SELF = 0x00000008
173 RIGHT_DS_READ_PROPERTY = 0x00000010
174 RIGHT_DS_WRITE_PROPERTY = 0x00000020
175 RIGHT_DS_DELETE_TREE = 0x00000040
176 RIGHT_DS_LIST_OBJECT = 0x00000080
177 RIGHT_DS_CONTROL_ACCESS = 0x00000100
178 FILE_READ_DATA = 0x0001
179 FILE_LIST_DIRECTORY = 0x0001
180 FILE_WRITE_DATA = 0x0002
181 FILE_ADD_FILE = 0x0002
182 FILE_APPEND_DATA = 0x0004
183 FILE_ADD_SUBDIRECTORY = 0x0004
184 FILE_CREATE_PIPE_INSTANCE = 0x0004
185 FILE_READ_EA = 0x0008
186 FILE_WRITE_EA = 0x0010
187 FILE_EXECUTE = 0x0020
188 FILE_TRAVERSE = 0x0020
189 FILE_DELETE_CHILD = 0x0040
190 FILE_READ_ATTRIBUTES = 0x0080
191 FILE_WRITE_ATTRIBUTES = 0x0100
193 READ_CONTROL = 0x00020000
194 WRITE_DAC = 0x00040000
195 WRITE_OWNER = 0x00080000
196 SYNCHRONIZE = 0x00100000
197 STANDARD_RIGHTS_ALL = 0x001F0000
199 filemask = ldm & STANDARD_RIGHTS_ALL
201 if (ldm & RIGHT_DS_READ_PROPERTY) and (ldm & RIGHT_DS_LIST_CONTENTS):
202 filemask = filemask | (SYNCHRONIZE | FILE_LIST_DIRECTORY |
203 FILE_READ_ATTRIBUTES | FILE_READ_EA |
204 FILE_READ_DATA | FILE_EXECUTE)
206 if ldm & RIGHT_DS_WRITE_PROPERTY:
207 filemask = filemask | (SYNCHRONIZE | FILE_WRITE_DATA |
208 FILE_APPEND_DATA | FILE_WRITE_EA |
209 FILE_WRITE_ATTRIBUTES | FILE_ADD_FILE |
210 FILE_ADD_SUBDIRECTORY)
212 if ldm & RIGHT_DS_CREATE_CHILD:
213 filemask = filemask | (FILE_ADD_SUBDIRECTORY | FILE_ADD_FILE)
215 if ldm & RIGHT_DS_DELETE_CHILD:
216 filemask = filemask | FILE_DELETE_CHILD
221 def dsacl2fsacl(dssddl, sid, as_sddl=True):
224 This function takes an the SDDL representation of a DS
225 ACL and return the SDDL representation of this ACL adapted
226 for files. It's used for Policy object provision
228 ref = security.descriptor.from_sddl(dssddl, sid)
229 fdescr = security.descriptor()
230 fdescr.owner_sid = ref.owner_sid
231 fdescr.group_sid = ref.group_sid
232 fdescr.type = ref.type
233 fdescr.revision = ref.revision
235 for i in range(0, len(aces)):
237 if not ace.type & security.SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT and str(ace.trustee) != security.SID_BUILTIN_PREW2K:
238 # if fdescr.type & security.SEC_DESC_DACL_AUTO_INHERITED:
239 ace.flags = ace.flags | security.SEC_ACE_FLAG_OBJECT_INHERIT | security.SEC_ACE_FLAG_CONTAINER_INHERIT
240 if str(ace.trustee) == security.SID_CREATOR_OWNER:
241 # For Creator/Owner the IO flag is set as this ACE has only a sense for child objects
242 ace.flags = ace.flags | security.SEC_ACE_FLAG_INHERIT_ONLY
243 ace.access_mask = ldapmask2filemask(ace.access_mask)
249 return fdescr.as_sddl(sid)