source3/smbd/pysmbd.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Set NT and POSIX ACLs and other VFS operations from Python
   4
   5    Copyrigyt (C) Andrew Bartlett 2012
   6    Copyright (C) Jeremy Allison 1994-2009.
   7    Copyright (C) Andreas Gruenbacher 2002.
   8    Copyright (C) Simo Sorce <idra@samba.org> 2009.
   9    Copyright (C) Simo Sorce 2002
  10    Copyright (C) Eric Lorimer 2002
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include <Python.h>
  27 #include "includes.h"
  28 #include "python/py3compat.h"
  29 #include "smbd/smbd.h"
  30 #include "libcli/util/pyerrors.h"
  31 #include "librpc/rpc/pyrpc_util.h"
  32 #include <pytalloc.h>
  33 #include "system/filesys.h"
  34 #include "passdb.h"
  35 #include "secrets.h"
  36 #include "auth.h"
  37
  38 extern const struct generic_mapping file_generic_mapping;
  39
  40 #undef  DBGC_CLASS
  41 #define DBGC_CLASS DBGC_ACLS
  42
  43 #ifdef O_DIRECTORY
  44 #define DIRECTORY_FLAGS O_RDONLY|O_DIRECTORY
  45 #else
  46 /* POSIX allows us to open a directory with O_RDONLY. */
  47 #define DIRECTORY_FLAGS O_RDONLY
  48 #endif
  49
  50
  51 static connection_struct *get_conn_tos(
  52         const char *service,
  53         const struct auth_session_info *session_info)
  54 {
  55         struct conn_struct_tos *c = NULL;
  56         int snum = -1;
  57         NTSTATUS status;
  58
  59         if (!posix_locking_init(false)) {
  60                 PyErr_NoMemory();
  61                 return NULL;
  62         }
  63
  64         if (service) {
  65                 snum = lp_servicenumber(service);
  66                 if (snum == -1) {
  67                         PyErr_SetString(PyExc_RuntimeError, "unknown service");
  68                         return NULL;
  69                 }
  70         }
  71
  72         status = create_conn_struct_tos(NULL,
  73                                         snum,
  74                                         "/",
  75                                         session_info,
  76                                         &c);
  77         PyErr_NTSTATUS_IS_ERR_RAISE(status);
  78
  79         /* Ignore read-only and share restrictions */
  80         c->conn->read_only = false;
  81         c->conn->share_access = SEC_RIGHTS_FILE_ALL;
  82         return c->conn;
  83 }
  84
  85 static int set_sys_acl_conn(const char *fname,
  86                                  SMB_ACL_TYPE_T acltype,
  87                                  SMB_ACL_T theacl, connection_struct *conn)
  88 {
  89         int ret;
  90         struct smb_filename *smb_fname = NULL;
  91
  92         TALLOC_CTX *frame = talloc_stackframe();
  93
  94         smb_fname = synthetic_smb_fname_split(frame,
  95                                         fname,
  96                                         lp_posix_pathnames());
  97         if (smb_fname == NULL) {
  98                 TALLOC_FREE(frame);
  99                 return -1;
 100         }
 101
 102         ret = SMB_VFS_SYS_ACL_SET_FILE( conn, smb_fname, acltype, theacl);
 103
 104         TALLOC_FREE(frame);
 105         return ret;
 106 }
 107
 108
 109 static NTSTATUS init_files_struct(TALLOC_CTX *mem_ctx,
 110                                   const char *fname,
 111                                   struct connection_struct *conn,
 112                                   int flags,
 113                                   struct files_struct **_fsp)
 114 {
 115         struct smb_filename *smb_fname = NULL;
 116         int ret;
 117         mode_t saved_umask;
 118         struct files_struct *fsp;
 119
 120         fsp = talloc_zero(mem_ctx, struct files_struct);
 121         if (fsp == NULL) {
 122                 return NT_STATUS_NO_MEMORY;
 123         }
 124         fsp->fh = talloc(fsp, struct fd_handle);
 125         if (fsp->fh == NULL) {
 126                 return NT_STATUS_NO_MEMORY;
 127         }
 128         fsp->conn = conn;
 129
 130         smb_fname = synthetic_smb_fname_split(fsp,
 131                                               fname,
 132                                               lp_posix_pathnames());
 133         if (smb_fname == NULL) {
 134                 return NT_STATUS_NO_MEMORY;
 135         }
 136
 137         fsp->fsp_name = smb_fname;
 138
 139         /*
 140          * we want total control over the permissions on created files,
 141          * so set our umask to 0 (this matters if flags contains O_CREAT)
 142          */
 143         saved_umask = umask(0);
 144
 145         fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, flags, 00644);
 146
 147         umask(saved_umask);
 148
 149         if (fsp->fh->fd == -1) {
 150                 int err = errno;
 151                 if (err == ENOENT) {
 152                         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 153                 }
 154                 return NT_STATUS_INVALID_PARAMETER;
 155         }
 156
 157         ret = SMB_VFS_FSTAT(fsp, &smb_fname->st);
 158         if (ret == -1) {
 159                 /* If we have an fd, this stat should succeed. */
 160                 DEBUG(0,("Error doing fstat on open file %s (%s)\n",
 161                          smb_fname_str_dbg(smb_fname),
 162                          strerror(errno) ));
 163                 return map_nt_error_from_unix(errno);
 164         }
 165
 166         fsp->file_id = vfs_file_id_from_sbuf(conn, &smb_fname->st);
 167         fsp->vuid = UID_FIELD_INVALID;
 168         fsp->file_pid = 0;
 169         fsp->can_lock = True;
 170         fsp->can_read = True;
 171         fsp->can_write = True;
 172         fsp->print_file = NULL;
 173         fsp->modified = False;
 174         fsp->sent_oplock_break = NO_BREAK_SENT;
 175         fsp->is_directory = S_ISDIR(smb_fname->st.st_ex_mode);
 176
 177         *_fsp = fsp;
 178
 179         return NT_STATUS_OK;
 180 }
 181
 182 static NTSTATUS set_nt_acl_conn(const char *fname,
 183                                 uint32_t security_info_sent, const struct security_descriptor *sd,
 184                                 connection_struct *conn)
 185 {
 186         TALLOC_CTX *frame = talloc_stackframe();
 187         struct files_struct *fsp = NULL;
 188         NTSTATUS status = NT_STATUS_OK;
 189
 190         /* first, try to open it as a file with flag O_RDWR */
 191         status = init_files_struct(frame,
 192                                    fname,
 193                                    conn,
 194                                    O_RDWR,
 195                                    &fsp);
 196         if (!NT_STATUS_IS_OK(status) && errno == EISDIR) {
 197                 /* if fail, try to open as dir */
 198                 status = init_files_struct(frame,
 199                                            fname,
 200                                            conn,
 201                                            DIRECTORY_FLAGS,
 202                                            &fsp);
 203         }
 204
 205         if (!NT_STATUS_IS_OK(status)) {
 206                 DBG_ERR("init_files_struct failed: %s\n",
 207                         nt_errstr(status));
 208                 if (fsp != NULL) {
 209                         SMB_VFS_CLOSE(fsp);
 210                 }
 211                 TALLOC_FREE(frame);
 212                 return status;
 213         }
 214
 215         status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, sd);
 216         if (!NT_STATUS_IS_OK(status)) {
 217                 DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned %s.\n", nt_errstr(status)));
 218         }
 219
 220         SMB_VFS_CLOSE(fsp);
 221
 222         TALLOC_FREE(frame);
 223         return status;
 224 }
 225
 226 static NTSTATUS get_nt_acl_conn(TALLOC_CTX *mem_ctx,
 227                                 const char *fname,
 228                                 connection_struct *conn,
 229                                 uint32_t security_info_wanted,
 230                                 struct security_descriptor **sd)
 231 {
 232         TALLOC_CTX *frame = talloc_stackframe();
 233         NTSTATUS status;
 234         struct smb_filename *smb_fname = synthetic_smb_fname(talloc_tos(),
 235                                         fname,
 236                                         NULL,
 237                                         NULL,
 238                                         lp_posix_pathnames() ?
 239                                                 SMB_FILENAME_POSIX_PATH : 0);
 240
 241         if (smb_fname == NULL) {
 242                 TALLOC_FREE(frame);
 243                 return NT_STATUS_NO_MEMORY;
 244         }
 245
 246         status = SMB_VFS_GET_NT_ACL(conn,
 247                                 smb_fname,
 248                                 security_info_wanted,
 249                                 mem_ctx,
 250                                 sd);
 251         if (!NT_STATUS_IS_OK(status)) {
 252                 DEBUG(0,("get_nt_acl_conn: get_nt_acl returned %s.\n", nt_errstr(status)));
 253         }
 254
 255         TALLOC_FREE(frame);
 256
 257         return status;
 258 }
 259
 260 static int set_acl_entry_perms(SMB_ACL_ENTRY_T entry, mode_t perm_mask)
 261 {
 262         SMB_ACL_PERMSET_T perms = NULL;
 263
 264         if (sys_acl_get_permset(entry, &perms) != 0) {
 265                 return -1;
 266         }
 267
 268         if (sys_acl_clear_perms(perms) != 0) {
 269                 return -1;
 270         }
 271
 272         if ((perm_mask & SMB_ACL_READ) != 0 &&
 273             sys_acl_add_perm(perms, SMB_ACL_READ) != 0) {
 274                 return -1;
 275         }
 276
 277         if ((perm_mask & SMB_ACL_WRITE) != 0 &&
 278             sys_acl_add_perm(perms, SMB_ACL_WRITE) != 0) {
 279                 return -1;
 280         }
 281
 282         if ((perm_mask & SMB_ACL_EXECUTE) != 0 &&
 283             sys_acl_add_perm(perms, SMB_ACL_EXECUTE) != 0) {
 284                 return -1;
 285         }
 286
 287         if (sys_acl_set_permset(entry, perms) != 0) {
 288                 return -1;
 289         }
 290
 291         return 0;
 292 }
 293
 294 static SMB_ACL_T make_simple_acl(TALLOC_CTX *mem_ctx,
 295                         gid_t gid,
 296                         mode_t chmod_mode)
 297 {
 298         mode_t mode = SMB_ACL_READ|SMB_ACL_WRITE|SMB_ACL_EXECUTE;
 299
 300         mode_t mode_user = (chmod_mode & 0700) >> 6;
 301         mode_t mode_group = (chmod_mode & 070) >> 3;
 302         mode_t mode_other = chmod_mode &  07;
 303         SMB_ACL_ENTRY_T entry;
 304         SMB_ACL_T acl = sys_acl_init(mem_ctx);
 305
 306         if (!acl) {
 307                 return NULL;
 308         }
 309
 310         if (sys_acl_create_entry(&acl, &entry) != 0) {
 311                 TALLOC_FREE(acl);
 312                 return NULL;
 313         }
 314
 315         if (sys_acl_set_tag_type(entry, SMB_ACL_USER_OBJ) != 0) {
 316                 TALLOC_FREE(acl);
 317                 return NULL;
 318         }
 319
 320         if (set_acl_entry_perms(entry, mode_user) != 0) {
 321                 TALLOC_FREE(acl);
 322                 return NULL;
 323         }
 324
 325         if (sys_acl_create_entry(&acl, &entry) != 0) {
 326                 TALLOC_FREE(acl);
 327                 return NULL;
 328         }
 329
 330         if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP_OBJ) != 0) {
 331                 TALLOC_FREE(acl);
 332                 return NULL;
 333         }
 334
 335         if (set_acl_entry_perms(entry, mode_group) != 0) {
 336                 TALLOC_FREE(acl);
 337                 return NULL;
 338         }
 339
 340         if (sys_acl_create_entry(&acl, &entry) != 0) {
 341                 TALLOC_FREE(acl);
 342                 return NULL;
 343         }
 344
 345         if (sys_acl_set_tag_type(entry, SMB_ACL_OTHER) != 0) {
 346                 TALLOC_FREE(acl);
 347                 return NULL;
 348         }
 349
 350         if (set_acl_entry_perms(entry, mode_other) != 0) {
 351                 TALLOC_FREE(acl);
 352                 return NULL;
 353         }
 354
 355         if (gid != -1) {
 356                 if (sys_acl_create_entry(&acl, &entry) != 0) {
 357                         TALLOC_FREE(acl);
 358                         return NULL;
 359                 }
 360
 361                 if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP) != 0) {
 362                         TALLOC_FREE(acl);
 363                         return NULL;
 364                 }
 365
 366                 if (sys_acl_set_qualifier(entry, &gid) != 0) {
 367                         TALLOC_FREE(acl);
 368                         return NULL;
 369                 }
 370
 371                 if (set_acl_entry_perms(entry, mode_group) != 0) {
 372                         TALLOC_FREE(acl);
 373                         return NULL;
 374                 }
 375         }
 376
 377         if (sys_acl_create_entry(&acl, &entry) != 0) {
 378                 TALLOC_FREE(acl);
 379                 return NULL;
 380         }
 381
 382         if (sys_acl_set_tag_type(entry, SMB_ACL_MASK) != 0) {
 383                 TALLOC_FREE(acl);
 384                 return NULL;
 385         }
 386
 387         if (set_acl_entry_perms(entry, mode) != 0) {
 388                 TALLOC_FREE(acl);
 389                 return NULL;
 390         }
 391
 392         return acl;
 393 }
 394
 395 /*
 396   set a simple ACL on a file, as a test
 397  */
 398 static PyObject *py_smbd_set_simple_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 399 {
 400         const char * const kwnames[] = { "fname", "mode", "gid", "service", NULL };
 401         char *fname, *service = NULL;
 402         int ret;
 403         int mode, gid = -1;
 404         SMB_ACL_T acl;
 405         TALLOC_CTX *frame;
 406         connection_struct *conn;
 407
 408         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "si|iz",
 409                                          discard_const_p(char *, kwnames),
 410                                          &fname, &mode, &gid, &service))
 411                 return NULL;
 412
 413         frame = talloc_stackframe();
 414
 415         acl = make_simple_acl(frame, gid, mode);
 416         if (acl == NULL) {
 417                 TALLOC_FREE(frame);
 418                 return NULL;
 419         }
 420
 421         conn = get_conn_tos(service, NULL);
 422         if (!conn) {
 423                 TALLOC_FREE(frame);
 424                 return NULL;
 425         }
 426
 427         ret = set_sys_acl_conn(fname, SMB_ACL_TYPE_ACCESS, acl, conn);
 428
 429         if (ret != 0) {
 430                 TALLOC_FREE(frame);
 431                 errno = ret;
 432                 return PyErr_SetFromErrno(PyExc_OSError);
 433         }
 434
 435         TALLOC_FREE(frame);
 436
 437         Py_RETURN_NONE;
 438 }
 439
 440 /*
 441   chown a file
 442  */
 443 static PyObject *py_smbd_chown(PyObject *self, PyObject *args, PyObject *kwargs)
 444 {
 445         const char * const kwnames[] = { "fname", "uid", "gid", "service", NULL };
 446         connection_struct *conn;
 447         int ret;
 448
 449         char *fname, *service = NULL;
 450         int uid, gid;
 451         TALLOC_CTX *frame;
 452         struct smb_filename *smb_fname = NULL;
 453
 454         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "sii|z",
 455                                          discard_const_p(char *, kwnames),
 456                                          &fname, &uid, &gid, &service))
 457                 return NULL;
 458
 459         frame = talloc_stackframe();
 460
 461         conn = get_conn_tos(service, NULL);
 462         if (!conn) {
 463                 TALLOC_FREE(frame);
 464                 return NULL;
 465         }
 466
 467         smb_fname = synthetic_smb_fname(talloc_tos(),
 468                                         fname,
 469                                         NULL,
 470                                         NULL,
 471                                         lp_posix_pathnames() ?
 472                                                 SMB_FILENAME_POSIX_PATH : 0);
 473         if (smb_fname == NULL) {
 474                 TALLOC_FREE(frame);
 475                 errno = ENOMEM;
 476                 return PyErr_SetFromErrno(PyExc_OSError);
 477         }
 478
 479         ret = SMB_VFS_CHOWN(conn, smb_fname, uid, gid);
 480         if (ret != 0) {
 481                 TALLOC_FREE(frame);
 482                 errno = ret;
 483                 return PyErr_SetFromErrno(PyExc_OSError);
 484         }
 485
 486         TALLOC_FREE(frame);
 487
 488         Py_RETURN_NONE;
 489 }
 490
 491 /*
 492   unlink a file
 493  */
 494 static PyObject *py_smbd_unlink(PyObject *self, PyObject *args, PyObject *kwargs)
 495 {
 496         const char * const kwnames[] = { "fname", "service", NULL };
 497         connection_struct *conn;
 498         int ret;
 499         struct smb_filename *smb_fname = NULL;
 500         char *fname, *service = NULL;
 501         TALLOC_CTX *frame;
 502
 503         frame = talloc_stackframe();
 504
 505         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "s|z",
 506                                          discard_const_p(char *, kwnames),
 507                                          &fname, &service)) {
 508                 TALLOC_FREE(frame);
 509                 return NULL;
 510         }
 511
 512         conn = get_conn_tos(service, NULL);
 513         if (!conn) {
 514                 TALLOC_FREE(frame);
 515                 return NULL;
 516         }
 517
 518         smb_fname = synthetic_smb_fname_split(frame,
 519                                         fname,
 520                                         lp_posix_pathnames());
 521         if (smb_fname == NULL) {
 522                 TALLOC_FREE(frame);
 523                 return PyErr_NoMemory();
 524         }
 525
 526         ret = SMB_VFS_UNLINK(conn, smb_fname);
 527         if (ret != 0) {
 528                 TALLOC_FREE(frame);
 529                 errno = ret;
 530                 return PyErr_SetFromErrno(PyExc_OSError);
 531         }
 532
 533         TALLOC_FREE(frame);
 534
 535         Py_RETURN_NONE;
 536 }
 537
 538 /*
 539   check if we have ACL support
 540  */
 541 static PyObject *py_smbd_have_posix_acls(PyObject *self)
 542 {
 543 #ifdef HAVE_POSIX_ACLS
 544         return PyBool_FromLong(true);
 545 #else
 546         return PyBool_FromLong(false);
 547 #endif
 548 }
 549
 550 /*
 551   set the NT ACL on a file
 552  */
 553 static PyObject *py_smbd_set_nt_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 554 {
 555         const char * const kwnames[] = {
 556                 "fname", "security_info_sent", "sd",
 557                 "service", "session_info", NULL };
 558
 559         NTSTATUS status;
 560         char *fname, *service = NULL;
 561         int security_info_sent;
 562         PyObject *py_sd;
 563         struct security_descriptor *sd;
 564         PyObject *py_session = Py_None;
 565         struct auth_session_info *session_info = NULL;
 566         connection_struct *conn;
 567         TALLOC_CTX *frame;
 568
 569         frame = talloc_stackframe();
 570
 571         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "siO|zO",
 572                                          discard_const_p(char *, kwnames),
 573                                          &fname, &security_info_sent, &py_sd,
 574                                          &service, &py_session)) {
 575                 TALLOC_FREE(frame);
 576                 return NULL;
 577         }
 578
 579         if (!py_check_dcerpc_type(py_sd, "samba.dcerpc.security", "descriptor")) {
 580                 TALLOC_FREE(frame);
 581                 return NULL;
 582         }
 583
 584         if (py_session != Py_None) {
 585                 if (!py_check_dcerpc_type(py_session,
 586                                           "samba.dcerpc.auth",
 587                                           "session_info")) {
 588                         TALLOC_FREE(frame);
 589                         return NULL;
 590                 }
 591                 session_info = pytalloc_get_type(py_session,
 592                                                  struct auth_session_info);
 593                 if (!session_info) {
 594                         PyErr_Format(PyExc_TypeError,
 595                                      "Expected auth_session_info for session_info argument got %s",
 596                                      talloc_get_name(pytalloc_get_ptr(py_session)));
 597                         return NULL;
 598                 }
 599         }
 600
 601         conn = get_conn_tos(service, session_info);
 602         if (!conn) {
 603                 TALLOC_FREE(frame);
 604                 return NULL;
 605         }
 606
 607         sd = pytalloc_get_type(py_sd, struct security_descriptor);
 608
 609         status = set_nt_acl_conn(fname, security_info_sent, sd, conn);
 610         TALLOC_FREE(frame);
 611         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 612
 613         Py_RETURN_NONE;
 614 }
 615
 616 /*
 617   Return the NT ACL on a file
 618  */
 619 static PyObject *py_smbd_get_nt_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 620 {
 621         const char * const kwnames[] = { "fname",
 622                                          "security_info_wanted",
 623                                          "service",
 624                                          "session_info",
 625                                          NULL };
 626         char *fname, *service = NULL;
 627         int security_info_wanted;
 628         PyObject *py_sd;
 629         struct security_descriptor *sd;
 630         TALLOC_CTX *frame = talloc_stackframe();
 631         PyObject *py_session = Py_None;
 632         struct auth_session_info *session_info = NULL;
 633         connection_struct *conn;
 634         NTSTATUS status;
 635         int ret = 1;
 636
 637         ret = PyArg_ParseTupleAndKeywords(args,
 638                                           kwargs,
 639                                           "si|zO",
 640                                           discard_const_p(char *, kwnames),
 641                                           &fname,
 642                                           &security_info_wanted,
 643                                           &service,
 644                                           &py_session);
 645         if (!ret) {
 646                 TALLOC_FREE(frame);
 647                 return NULL;
 648         }
 649
 650         if (py_session != Py_None) {
 651                 if (!py_check_dcerpc_type(py_session,
 652                                           "samba.dcerpc.auth",
 653                                           "session_info")) {
 654                         TALLOC_FREE(frame);
 655                         return NULL;
 656                 }
 657                 session_info = pytalloc_get_type(py_session,
 658                                                  struct auth_session_info);
 659                 if (!session_info) {
 660                         PyErr_Format(
 661                                 PyExc_TypeError,
 662                                 "Expected auth_session_info for "
 663                                 "session_info argument got %s",
 664                                 talloc_get_name(pytalloc_get_ptr(py_session)));
 665                         return NULL;
 666                 }
 667         }
 668
 669         conn = get_conn_tos(service, session_info);
 670         if (!conn) {
 671                 TALLOC_FREE(frame);
 672                 return NULL;
 673         }
 674
 675         status = get_nt_acl_conn(frame, fname, conn, security_info_wanted, &sd);
 676         PyErr_NTSTATUS_IS_ERR_RAISE(status);
 677
 678         py_sd = py_return_ndr_struct("samba.dcerpc.security", "descriptor", sd, sd);
 679
 680         TALLOC_FREE(frame);
 681
 682         return py_sd;
 683 }
 684
 685 /*
 686   set the posix (or similar) ACL on a file
 687  */
 688 static PyObject *py_smbd_set_sys_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 689 {
 690         const char * const kwnames[] = { "fname", "acl_type", "acl", "service", NULL };
 691         TALLOC_CTX *frame = talloc_stackframe();
 692         int ret;
 693         char *fname, *service = NULL;
 694         PyObject *py_acl;
 695         struct smb_acl_t *acl;
 696         int acl_type;
 697         connection_struct *conn;
 698
 699         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "siO|z",
 700                                          discard_const_p(char *, kwnames),
 701                                          &fname, &acl_type, &py_acl, &service)) {
 702                 TALLOC_FREE(frame);
 703                 return NULL;
 704         }
 705
 706         if (!py_check_dcerpc_type(py_acl, "samba.dcerpc.smb_acl", "t")) {
 707                 TALLOC_FREE(frame);
 708                 return NULL;
 709         }
 710
 711         conn = get_conn_tos(service, NULL);
 712         if (!conn) {
 713                 TALLOC_FREE(frame);
 714                 return NULL;
 715         }
 716
 717         acl = pytalloc_get_type(py_acl, struct smb_acl_t);
 718
 719         ret = set_sys_acl_conn(fname, acl_type, acl, conn);
 720         if (ret != 0) {
 721                 TALLOC_FREE(frame);
 722                 errno = ret;
 723                 return PyErr_SetFromErrno(PyExc_OSError);
 724         }
 725
 726         TALLOC_FREE(frame);
 727         Py_RETURN_NONE;
 728 }
 729
 730 /*
 731   Return the posix (or similar) ACL on a file
 732  */
 733 static PyObject *py_smbd_get_sys_acl(PyObject *self, PyObject *args, PyObject *kwargs)
 734 {
 735         const char * const kwnames[] = { "fname", "acl_type", "service", NULL };
 736         char *fname;
 737         PyObject *py_acl;
 738         struct smb_acl_t *acl;
 739         int acl_type;
 740         TALLOC_CTX *frame = talloc_stackframe();
 741         connection_struct *conn;
 742         char *service = NULL;
 743         struct smb_filename *smb_fname = NULL;
 744
 745         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "si|z",
 746                                          discard_const_p(char *, kwnames),
 747                                          &fname, &acl_type, &service)) {
 748                 TALLOC_FREE(frame);
 749                 return NULL;
 750         }
 751
 752         conn = get_conn_tos(service, NULL);
 753         if (!conn) {
 754                 TALLOC_FREE(frame);
 755                 return NULL;
 756         }
 757
 758         smb_fname = synthetic_smb_fname_split(frame,
 759                                         fname,
 760                                         lp_posix_pathnames());
 761         if (smb_fname == NULL) {
 762                 TALLOC_FREE(frame);
 763                 return NULL;
 764         }
 765         acl = SMB_VFS_SYS_ACL_GET_FILE( conn, smb_fname, acl_type, frame);
 766         if (!acl) {
 767                 TALLOC_FREE(frame);
 768                 return PyErr_SetFromErrno(PyExc_OSError);
 769         }
 770
 771         py_acl = py_return_ndr_struct("samba.dcerpc.smb_acl", "t", acl, acl);
 772
 773         TALLOC_FREE(frame);
 774
 775         return py_acl;
 776 }
 777
 778 static PyObject *py_smbd_mkdir(PyObject *self, PyObject *args, PyObject *kwargs)
 779 {
 780         const char * const kwnames[] = { "fname", "service", NULL };
 781         char *fname, *service = NULL;
 782         TALLOC_CTX *frame = talloc_stackframe();
 783         struct connection_struct *conn = NULL;
 784         struct smb_filename *smb_fname = NULL;
 785
 786         if (!PyArg_ParseTupleAndKeywords(args,
 787                                          kwargs,
 788                                          "s|z",
 789                                          discard_const_p(char *,
 790                                                          kwnames),
 791                                          &fname,
 792                                          &service)) {
 793                 TALLOC_FREE(frame);
 794                 return NULL;
 795         }
 796
 797         conn = get_conn_tos(service, NULL);
 798         if (!conn) {
 799                 TALLOC_FREE(frame);
 800                 return NULL;
 801         }
 802
 803         smb_fname = synthetic_smb_fname(talloc_tos(),
 804                                         fname,
 805                                         NULL,
 806                                         NULL,
 807                                         lp_posix_pathnames() ?
 808                                         SMB_FILENAME_POSIX_PATH : 0);
 809
 810         if (smb_fname == NULL) {
 811                 TALLOC_FREE(frame);
 812                 return NULL;
 813         }
 814
 815
 816         if (SMB_VFS_MKDIR(conn, smb_fname, 00755) == -1) {
 817                 DBG_ERR("mkdir error=%d (%s)\n", errno, strerror(errno));
 818                 TALLOC_FREE(frame);
 819                 return NULL;
 820         }
 821
 822         TALLOC_FREE(frame);
 823         Py_RETURN_NONE;
 824 }
 825
 826
 827 /*
 828   Create an empty file
 829  */
 830 static PyObject *py_smbd_create_file(PyObject *self, PyObject *args, PyObject *kwargs)
 831 {
 832         const char * const kwnames[] = { "fname", "service", NULL };
 833         char *fname, *service = NULL;
 834         TALLOC_CTX *frame = talloc_stackframe();
 835         struct connection_struct *conn = NULL;
 836         struct files_struct *fsp = NULL;
 837         NTSTATUS status;
 838
 839         if (!PyArg_ParseTupleAndKeywords(args,
 840                                          kwargs,
 841                                          "s|z",
 842                                          discard_const_p(char *,
 843                                                          kwnames),
 844                                          &fname,
 845                                          &service)) {
 846                 TALLOC_FREE(frame);
 847                 return NULL;
 848         }
 849
 850         conn = get_conn_tos(service, NULL);
 851         if (!conn) {
 852                 TALLOC_FREE(frame);
 853                 return NULL;
 854         }
 855
 856         status = init_files_struct(frame,
 857                                    fname,
 858                                    conn,
 859                                    O_CREAT|O_EXCL|O_RDWR,
 860                                    &fsp);
 861         if (!NT_STATUS_IS_OK(status)) {
 862                 DBG_ERR("init_files_struct failed: %s\n",
 863                         nt_errstr(status));
 864         }
 865
 866         TALLOC_FREE(frame);
 867         Py_RETURN_NONE;
 868 }
 869
 870
 871 static PyMethodDef py_smbd_methods[] = {
 872         { "have_posix_acls",
 873                 (PyCFunction)py_smbd_have_posix_acls, METH_NOARGS,
 874                 NULL },
 875         { "set_simple_acl",
 876                 (PyCFunction)py_smbd_set_simple_acl, METH_VARARGS|METH_KEYWORDS,
 877                 NULL },
 878         { "set_nt_acl",
 879                 (PyCFunction)py_smbd_set_nt_acl, METH_VARARGS|METH_KEYWORDS,
 880                 NULL },
 881         { "get_nt_acl",
 882                 (PyCFunction)py_smbd_get_nt_acl, METH_VARARGS|METH_KEYWORDS,
 883                 NULL },
 884         { "get_sys_acl",
 885                 (PyCFunction)py_smbd_get_sys_acl, METH_VARARGS|METH_KEYWORDS,
 886                 NULL },
 887         { "set_sys_acl",
 888                 (PyCFunction)py_smbd_set_sys_acl, METH_VARARGS|METH_KEYWORDS,
 889                 NULL },
 890         { "chown",
 891                 (PyCFunction)py_smbd_chown, METH_VARARGS|METH_KEYWORDS,
 892                 NULL },
 893         { "unlink",
 894                 (PyCFunction)py_smbd_unlink, METH_VARARGS|METH_KEYWORDS,
 895                 NULL },
 896         { "mkdir",
 897                 (PyCFunction)py_smbd_mkdir, METH_VARARGS|METH_KEYWORDS,
 898                 NULL },
 899         { "create_file",
 900                 (PyCFunction)py_smbd_create_file, METH_VARARGS|METH_KEYWORDS,
 901                 NULL },
 902         { NULL }
 903 };
 904
 905 void initsmbd(void);
 906
 907 static struct PyModuleDef moduledef = {
 908     PyModuleDef_HEAD_INIT,
 909     .m_name = "smbd",
 910     .m_doc = "Python bindings for the smbd file server.",
 911     .m_size = -1,
 912     .m_methods = py_smbd_methods,
 913 };
 914
 915 MODULE_INIT_FUNC(smbd)
 916 {
 917         PyObject *m = NULL;
 918
 919         m = PyModule_Create(&moduledef);
 920         return m;
 921 }