2 Unix SMB/CIFS implementation.
4 POSIX NTVFS backend - ACL support
6 Copyright (C) Andrew Tridgell 2004
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "auth/auth.h"
24 #include "vfs_posix.h"
25 #include "librpc/gen_ndr/xattr.h"
26 #include "libcli/security/security.h"
27 #include "param/param.h"
30 /* the list of currently registered ACL backends */
31 static struct pvfs_acl_backend {
32 const struct pvfs_acl_ops *ops;
34 static int num_backends;
37 register a pvfs acl backend.
39 The 'name' can be later used by other backends to find the operations
40 structure for this backend.
42 NTSTATUS pvfs_acl_register(const struct pvfs_acl_ops *ops)
44 struct pvfs_acl_ops *new_ops;
46 if (pvfs_acl_backend_byname(ops->name) != NULL) {
47 DEBUG(0,("pvfs acl backend '%s' already registered\n", ops->name));
48 return NT_STATUS_OBJECT_NAME_COLLISION;
51 backends = talloc_realloc(talloc_autofree_context(), backends, struct pvfs_acl_backend, num_backends+1);
52 NT_STATUS_HAVE_NO_MEMORY(backends);
54 new_ops = talloc_memdup(backends, ops, sizeof(*ops));
55 new_ops->name = talloc_strdup(new_ops, ops->name);
57 backends[num_backends].ops = new_ops;
61 DEBUG(3,("NTVFS backend '%s' registered\n", ops->name));
68 return the operations structure for a named backend
70 const struct pvfs_acl_ops *pvfs_acl_backend_byname(const char *name)
74 for (i=0;i<num_backends;i++) {
75 if (strcmp(backends[i].ops->name, name) == 0) {
76 return backends[i].ops;
83 NTSTATUS pvfs_acl_init(struct loadparm_context *lp_ctx)
85 static bool initialized = false;
86 extern NTSTATUS pvfs_acl_nfs4_init(void);
87 extern NTSTATUS pvfs_acl_xattr_init(void);
88 init_module_fn static_init[] = { STATIC_pvfs_acl_MODULES };
89 init_module_fn *shared_init;
91 if (initialized) return NT_STATUS_OK;
94 shared_init = load_samba_modules(NULL, lp_ctx, "pvfs_acl");
96 run_init_functions(static_init);
97 run_init_functions(shared_init);
99 talloc_free(shared_init);
106 map a single access_mask from generic to specific bits for files/dirs
108 static uint32_t pvfs_translate_mask(uint32_t access_mask)
110 if (access_mask & SEC_MASK_GENERIC) {
111 if (access_mask & SEC_GENERIC_READ) access_mask |= SEC_RIGHTS_FILE_READ;
112 if (access_mask & SEC_GENERIC_WRITE) access_mask |= SEC_RIGHTS_FILE_WRITE;
113 if (access_mask & SEC_GENERIC_EXECUTE) access_mask |= SEC_RIGHTS_FILE_EXECUTE;
114 if (access_mask & SEC_GENERIC_ALL) access_mask |= SEC_RIGHTS_FILE_ALL;
115 access_mask &= ~SEC_MASK_GENERIC;
122 map any generic access bits in the given acl
123 this relies on the fact that the mappings for files and directories
126 static void pvfs_translate_generic_bits(struct security_acl *acl)
132 for (i=0;i<acl->num_aces;i++) {
133 struct security_ace *ace = &acl->aces[i];
134 ace->access_mask = pvfs_translate_mask(ace->access_mask);
140 setup a default ACL for a file
142 static NTSTATUS pvfs_default_acl(struct pvfs_state *pvfs,
143 struct ntvfs_request *req,
144 struct pvfs_filename *name, int fd,
145 struct security_descriptor **psd)
147 struct security_descriptor *sd;
149 struct security_ace ace;
151 struct id_mapping *ids;
152 struct composite_context *ctx;
154 *psd = security_descriptor_initialise(req);
156 return NT_STATUS_NO_MEMORY;
160 ids = talloc_zero_array(sd, struct id_mapping, 2);
161 NT_STATUS_HAVE_NO_MEMORY(ids);
163 ids[0].unixid = talloc(ids, struct unixid);
164 NT_STATUS_HAVE_NO_MEMORY(ids[0].unixid);
166 ids[0].unixid->id = name->st.st_uid;
167 ids[0].unixid->type = ID_TYPE_UID;
170 ids[1].unixid = talloc(ids, struct unixid);
171 NT_STATUS_HAVE_NO_MEMORY(ids[1].unixid);
173 ids[1].unixid->id = name->st.st_gid;
174 ids[1].unixid->type = ID_TYPE_GID;
177 ctx = wbc_xids_to_sids_send(pvfs->wbc_ctx, ids, 2, ids);
178 NT_STATUS_HAVE_NO_MEMORY(ctx);
180 status = wbc_xids_to_sids_recv(ctx, &ids);
181 NT_STATUS_NOT_OK_RETURN(status);
183 sd->owner_sid = talloc_steal(sd, ids[0].sid);
184 sd->group_sid = talloc_steal(sd, ids[1].sid);
187 sd->type |= SEC_DESC_DACL_PRESENT;
189 mode = name->st.st_mode;
192 we provide up to 4 ACEs
200 /* setup owner ACE */
201 ace.type = SEC_ACE_TYPE_ACCESS_ALLOWED;
203 ace.trustee = *sd->owner_sid;
206 if (mode & S_IRUSR) {
207 if (mode & S_IWUSR) {
208 ace.access_mask |= SEC_RIGHTS_FILE_ALL;
210 ace.access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
213 if (mode & S_IWUSR) {
214 ace.access_mask |= SEC_RIGHTS_FILE_WRITE | SEC_STD_DELETE;
216 if (ace.access_mask) {
217 security_descriptor_dacl_add(sd, &ace);
221 /* setup group ACE */
222 ace.trustee = *sd->group_sid;
224 if (mode & S_IRGRP) {
225 ace.access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
227 if (mode & S_IWGRP) {
228 /* note that delete is not granted - this matches posix behaviour */
229 ace.access_mask |= SEC_RIGHTS_FILE_WRITE;
231 if (ace.access_mask) {
232 security_descriptor_dacl_add(sd, &ace);
235 /* setup other ACE */
236 ace.trustee = *dom_sid_parse_talloc(req, SID_WORLD);
238 if (mode & S_IROTH) {
239 ace.access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
241 if (mode & S_IWOTH) {
242 ace.access_mask |= SEC_RIGHTS_FILE_WRITE;
244 if (ace.access_mask) {
245 security_descriptor_dacl_add(sd, &ace);
248 /* setup system ACE */
249 ace.trustee = *dom_sid_parse_talloc(req, SID_NT_SYSTEM);
250 ace.access_mask = SEC_RIGHTS_FILE_ALL;
251 security_descriptor_dacl_add(sd, &ace);
258 omit any security_descriptor elements not specified in the given
261 static void normalise_sd_flags(struct security_descriptor *sd, uint32_t secinfo_flags)
263 if (!(secinfo_flags & SECINFO_OWNER)) {
264 sd->owner_sid = NULL;
266 if (!(secinfo_flags & SECINFO_GROUP)) {
267 sd->group_sid = NULL;
269 if (!(secinfo_flags & SECINFO_DACL)) {
272 if (!(secinfo_flags & SECINFO_SACL)) {
278 answer a setfileinfo for an ACL
280 NTSTATUS pvfs_acl_set(struct pvfs_state *pvfs,
281 struct ntvfs_request *req,
282 struct pvfs_filename *name, int fd,
283 uint32_t access_mask,
284 union smb_setfileinfo *info)
286 uint32_t secinfo_flags = info->set_secdesc.in.secinfo_flags;
287 struct security_descriptor *new_sd, *sd, orig_sd;
288 NTSTATUS status = NT_STATUS_NOT_FOUND;
293 struct id_mapping *ids;
294 struct composite_context *ctx;
296 if (pvfs->acl_ops != NULL) {
297 status = pvfs->acl_ops->acl_load(pvfs, name, fd, req, &sd);
299 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
300 status = pvfs_default_acl(pvfs, req, name, fd, &sd);
302 if (!NT_STATUS_IS_OK(status)) {
306 ids = talloc(req, struct id_mapping);
307 NT_STATUS_HAVE_NO_MEMORY(ids);
310 ids->status = NT_STATUS_NONE_MAPPED;
312 new_sd = info->set_secdesc.in.sd;
315 old_uid = name->st.st_uid;
316 old_gid = name->st.st_gid;
318 /* only set the elements that have been specified */
319 if (secinfo_flags & SECINFO_OWNER) {
320 if (!(access_mask & SEC_STD_WRITE_OWNER)) {
321 return NT_STATUS_ACCESS_DENIED;
323 if (!dom_sid_equal(sd->owner_sid, new_sd->owner_sid)) {
324 ids->sid = new_sd->owner_sid;
325 ctx = wbc_sids_to_xids_send(pvfs->wbc_ctx, ids, 1, ids);
326 NT_STATUS_HAVE_NO_MEMORY(ctx);
327 status = wbc_sids_to_xids_recv(ctx, &ids);
328 NT_STATUS_NOT_OK_RETURN(status);
330 if (ids->unixid->type == ID_TYPE_BOTH ||
331 ids->unixid->type == ID_TYPE_UID) {
332 new_uid = ids->unixid->id;
335 sd->owner_sid = new_sd->owner_sid;
337 if (secinfo_flags & SECINFO_GROUP) {
338 if (!(access_mask & SEC_STD_WRITE_OWNER)) {
339 return NT_STATUS_ACCESS_DENIED;
341 if (!dom_sid_equal(sd->group_sid, new_sd->group_sid)) {
342 ids->sid = new_sd->group_sid;
343 ctx = wbc_sids_to_xids_send(pvfs->wbc_ctx, ids, 1, ids);
344 NT_STATUS_HAVE_NO_MEMORY(ctx);
345 status = wbc_sids_to_xids_recv(ctx, &ids);
346 NT_STATUS_NOT_OK_RETURN(status);
348 if (ids->unixid->type == ID_TYPE_BOTH ||
349 ids->unixid->type == ID_TYPE_GID) {
350 new_gid = ids->unixid->id;
354 sd->group_sid = new_sd->group_sid;
356 if (secinfo_flags & SECINFO_DACL) {
357 if (!(access_mask & SEC_STD_WRITE_DAC)) {
358 return NT_STATUS_ACCESS_DENIED;
360 sd->dacl = new_sd->dacl;
361 pvfs_translate_generic_bits(sd->dacl);
363 if (secinfo_flags & SECINFO_SACL) {
364 if (!(access_mask & SEC_FLAG_SYSTEM_SECURITY)) {
365 return NT_STATUS_ACCESS_DENIED;
367 sd->sacl = new_sd->sacl;
368 pvfs_translate_generic_bits(sd->sacl);
371 if (new_uid == old_uid) {
375 if (new_gid == old_gid) {
379 /* if there's something to change try it */
380 if (new_uid != -1 || new_gid != -1) {
383 ret = chown(name->full_name, new_uid, new_gid);
385 ret = fchown(fd, new_uid, new_gid);
388 return pvfs_map_errno(pvfs, errno);
392 /* we avoid saving if the sd is the same. This means when clients
393 copy files and end up copying the default sd that we don't
394 needlessly use xattrs */
395 if (!security_descriptor_equal(sd, &orig_sd) && pvfs->acl_ops) {
396 status = pvfs->acl_ops->acl_save(pvfs, name, fd, sd);
404 answer a fileinfo query for the ACL
406 NTSTATUS pvfs_acl_query(struct pvfs_state *pvfs,
407 struct ntvfs_request *req,
408 struct pvfs_filename *name, int fd,
409 union smb_fileinfo *info)
411 NTSTATUS status = NT_STATUS_NOT_FOUND;
412 struct security_descriptor *sd;
415 status = pvfs->acl_ops->acl_load(pvfs, name, fd, req, &sd);
417 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
418 status = pvfs_default_acl(pvfs, req, name, fd, &sd);
420 if (!NT_STATUS_IS_OK(status)) {
424 normalise_sd_flags(sd, info->query_secdesc.in.secinfo_flags);
426 info->query_secdesc.out.sd = sd;
433 check the read only bit against any of the write access bits
435 static bool pvfs_read_only(struct pvfs_state *pvfs, uint32_t access_mask)
437 if ((pvfs->flags & PVFS_FLAG_READONLY) &&
438 (access_mask & (SEC_FILE_WRITE_DATA |
439 SEC_FILE_APPEND_DATA |
441 SEC_FILE_WRITE_ATTRIBUTE |
444 SEC_STD_WRITE_OWNER |
445 SEC_DIR_DELETE_CHILD))) {
452 default access check function based on unix permissions
453 doing this saves on building a full security descriptor
454 for the common case of access check on files with no
457 NTSTATUS pvfs_access_check_unix(struct pvfs_state *pvfs,
458 struct ntvfs_request *req,
459 struct pvfs_filename *name,
460 uint32_t *access_mask)
462 uid_t uid = geteuid();
463 uint32_t max_bits = SEC_RIGHTS_FILE_READ | SEC_FILE_ALL;
465 if (pvfs_read_only(pvfs, *access_mask)) {
466 return NT_STATUS_ACCESS_DENIED;
469 /* owner and root get extra permissions */
471 max_bits |= SEC_STD_ALL | SEC_FLAG_SYSTEM_SECURITY;
472 } else if (uid == name->st.st_uid) {
473 max_bits |= SEC_STD_ALL;
476 if (*access_mask == SEC_FLAG_MAXIMUM_ALLOWED) {
477 *access_mask = max_bits;
481 if (uid != 0 && (*access_mask & SEC_FLAG_SYSTEM_SECURITY)) {
482 return NT_STATUS_ACCESS_DENIED;
485 if (*access_mask & ~max_bits) {
486 return NT_STATUS_ACCESS_DENIED;
489 if (pvfs->ntvfs->ctx->protocol != PROTOCOL_SMB2) {
490 /* on SMB, this bit is always granted, even if not
492 *access_mask |= SEC_FILE_READ_ATTRIBUTE;
500 check the security descriptor on a file, if any
502 *access_mask is modified with the access actually granted
504 NTSTATUS pvfs_access_check(struct pvfs_state *pvfs,
505 struct ntvfs_request *req,
506 struct pvfs_filename *name,
507 uint32_t *access_mask)
509 struct security_token *token = req->session_info->security_token;
510 struct xattr_NTACL *acl;
512 struct security_descriptor *sd;
514 if (pvfs_read_only(pvfs, *access_mask)) {
515 return NT_STATUS_ACCESS_DENIED;
518 acl = talloc(req, struct xattr_NTACL);
520 return NT_STATUS_NO_MEMORY;
523 /* expand the generic access bits to file specific bits */
524 *access_mask = pvfs_translate_mask(*access_mask);
525 if (pvfs->ntvfs->ctx->protocol != PROTOCOL_SMB2) {
526 *access_mask &= ~SEC_FILE_READ_ATTRIBUTE;
529 status = pvfs_acl_load(pvfs, name, -1, acl);
530 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
532 return pvfs_access_check_unix(pvfs, req, name, access_mask);
534 if (!NT_STATUS_IS_OK(status)) {
538 switch (acl->version) {
543 return NT_STATUS_INVALID_ACL;
546 /* check the acl against the required access mask */
547 status = sec_access_check(sd, token, *access_mask, access_mask);
549 if (pvfs->ntvfs->ctx->protocol != PROTOCOL_SMB2) {
550 /* on SMB, this bit is always granted, even if not
552 *access_mask |= SEC_FILE_READ_ATTRIBUTE;
562 a simplified interface to access check, designed for calls that
563 do not take or return an access check mask
565 NTSTATUS pvfs_access_check_simple(struct pvfs_state *pvfs,
566 struct ntvfs_request *req,
567 struct pvfs_filename *name,
568 uint32_t access_needed)
570 if (access_needed == 0) {
573 return pvfs_access_check(pvfs, req, name, &access_needed);
577 access check for creating a new file/directory
579 NTSTATUS pvfs_access_check_create(struct pvfs_state *pvfs,
580 struct ntvfs_request *req,
581 struct pvfs_filename *name,
582 uint32_t *access_mask)
584 struct pvfs_filename *parent;
587 status = pvfs_resolve_parent(pvfs, req, name, &parent);
588 if (!NT_STATUS_IS_OK(status)) {
592 status = pvfs_access_check(pvfs, req, parent, access_mask);
593 if (!NT_STATUS_IS_OK(status)) {
597 if (! ((*access_mask) & SEC_DIR_ADD_FILE)) {
598 return pvfs_access_check_simple(pvfs, req, parent, SEC_DIR_ADD_FILE);
605 access check for creating a new file/directory - no access mask supplied
607 NTSTATUS pvfs_access_check_parent(struct pvfs_state *pvfs,
608 struct ntvfs_request *req,
609 struct pvfs_filename *name,
610 uint32_t access_mask)
612 struct pvfs_filename *parent;
615 status = pvfs_resolve_parent(pvfs, req, name, &parent);
616 if (!NT_STATUS_IS_OK(status)) {
620 return pvfs_access_check_simple(pvfs, req, parent, access_mask);
625 determine if an ACE is inheritable
627 static bool pvfs_inheritable_ace(struct pvfs_state *pvfs,
628 const struct security_ace *ace,
632 return (ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT) != 0;
635 if (ace->flags & SEC_ACE_FLAG_CONTAINER_INHERIT) {
639 if ((ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT) &&
640 !(ace->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT)) {
648 this is the core of ACL inheritance. It copies any inheritable
649 aces from the parent SD to the child SD. Note that the algorithm
650 depends on whether the child is a container or not
652 static NTSTATUS pvfs_acl_inherit_aces(struct pvfs_state *pvfs,
653 struct security_descriptor *parent_sd,
654 struct security_descriptor *sd,
659 for (i=0;i<parent_sd->dacl->num_aces;i++) {
660 struct security_ace ace = parent_sd->dacl->aces[i];
662 const struct dom_sid *creator = NULL, *new_id = NULL;
665 if (!pvfs_inheritable_ace(pvfs, &ace, container)) {
669 orig_flags = ace.flags;
671 /* see the RAW-ACLS inheritance test for details on these rules */
675 ace.flags &= ~SEC_ACE_FLAG_INHERIT_ONLY;
677 if (!(ace.flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
678 ace.flags |= SEC_ACE_FLAG_INHERIT_ONLY;
680 if (ace.flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
685 /* the CREATOR sids are special when inherited */
686 if (dom_sid_equal(&ace.trustee, pvfs->sid_cache.creator_owner)) {
687 creator = pvfs->sid_cache.creator_owner;
688 new_id = sd->owner_sid;
689 } else if (dom_sid_equal(&ace.trustee, pvfs->sid_cache.creator_group)) {
690 creator = pvfs->sid_cache.creator_group;
691 new_id = sd->group_sid;
693 new_id = &ace.trustee;
696 if (creator && container &&
697 (ace.flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
698 uint32_t flags = ace.flags;
700 ace.trustee = *new_id;
702 status = security_descriptor_dacl_add(sd, &ace);
703 if (!NT_STATUS_IS_OK(status)) {
707 ace.trustee = *creator;
708 ace.flags = flags | SEC_ACE_FLAG_INHERIT_ONLY;
709 status = security_descriptor_dacl_add(sd, &ace);
710 } else if (container &&
711 !(orig_flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT)) {
712 status = security_descriptor_dacl_add(sd, &ace);
714 ace.trustee = *new_id;
715 status = security_descriptor_dacl_add(sd, &ace);
718 if (!NT_STATUS_IS_OK(status)) {
729 setup an ACL on a new file/directory based on the inherited ACL from
730 the parent. If there is no inherited ACL then we don't set anything,
731 as the default ACL applies anyway
733 NTSTATUS pvfs_acl_inherit(struct pvfs_state *pvfs,
734 struct ntvfs_request *req,
735 struct pvfs_filename *name,
738 struct xattr_NTACL *acl;
740 struct pvfs_filename *parent;
741 struct security_descriptor *parent_sd, *sd;
743 struct id_mapping *ids;
744 struct composite_context *ctx;
746 /* form the parents path */
747 status = pvfs_resolve_parent(pvfs, req, name, &parent);
748 if (!NT_STATUS_IS_OK(status)) {
752 acl = talloc(req, struct xattr_NTACL);
754 return NT_STATUS_NO_MEMORY;
757 status = pvfs_acl_load(pvfs, parent, -1, acl);
758 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
761 if (!NT_STATUS_IS_OK(status)) {
765 switch (acl->version) {
767 parent_sd = acl->info.sd;
770 return NT_STATUS_INVALID_ACL;
773 if (parent_sd == NULL ||
774 parent_sd->dacl == NULL ||
775 parent_sd->dacl->num_aces == 0) {
776 /* go with the default ACL */
780 /* create the new sd */
781 sd = security_descriptor_initialise(req);
783 return NT_STATUS_NO_MEMORY;
786 ids = talloc_array(sd, struct id_mapping, 2);
787 NT_STATUS_HAVE_NO_MEMORY(ids);
789 ids[0].unixid = talloc(ids, struct unixid);
790 NT_STATUS_HAVE_NO_MEMORY(ids[0].unixid);
791 ids[0].unixid->id = name->st.st_uid;
792 ids[0].unixid->type = ID_TYPE_UID;
794 ids[0].status = NT_STATUS_NONE_MAPPED;
796 ids[1].unixid = talloc(ids, struct unixid);
797 NT_STATUS_HAVE_NO_MEMORY(ids[1].unixid);
798 ids[1].unixid->id = name->st.st_gid;
799 ids[1].unixid->type = ID_TYPE_GID;
801 ids[1].status = NT_STATUS_NONE_MAPPED;
803 ctx = wbc_xids_to_sids_send(pvfs->wbc_ctx, ids, 2, ids);
804 NT_STATUS_HAVE_NO_MEMORY(ctx);
806 status = wbc_xids_to_sids_recv(ctx, &ids);
807 NT_STATUS_NOT_OK_RETURN(status);
809 sd->owner_sid = talloc_steal(sd, ids[0].sid);
810 sd->group_sid = talloc_steal(sd, ids[1].sid);
812 sd->type |= SEC_DESC_DACL_PRESENT;
814 container = (name->dos.attrib & FILE_ATTRIBUTE_DIRECTORY) ? true:false;
816 /* fill in the aces from the parent */
817 status = pvfs_acl_inherit_aces(pvfs, parent_sd, sd, container);
818 if (!NT_STATUS_IS_OK(status)) {
822 /* if there is nothing to inherit then we fallback to the
824 if (sd->dacl == NULL || sd->dacl->num_aces == 0) {
830 status = pvfs_acl_save(pvfs, name, fd, acl);
836 return the maximum allowed access mask
838 NTSTATUS pvfs_access_maximal_allowed(struct pvfs_state *pvfs,
839 struct ntvfs_request *req,
840 struct pvfs_filename *name,
841 uint32_t *maximal_access)
843 *maximal_access = SEC_FLAG_MAXIMUM_ALLOWED;
844 return pvfs_access_check(pvfs, req, name, maximal_access);