summaryrefslogtreecommitdiff
path: root/source3/smbd/posix_acls.c
diff options
context:
space:
mode:
Diffstat (limited to 'source3/smbd/posix_acls.c')
-rw-r--r--source3/smbd/posix_acls.c220
1 files changed, 198 insertions, 22 deletions
diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index 54b45529d0..73f7326e6a 100644
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -23,6 +23,13 @@
#include "includes.h"
+typedef struct canon_ace {
+ struct canon_ace *next, *prev;
+ acl_tag_t type;
+ acl_perm_t perms;
+ DOM_SID sid;
+} canon_ace;
+
/****************************************************************************
Function to create owner and group SIDs from a SMB_STRUCT_STAT.
****************************************************************************/
@@ -323,29 +330,167 @@ static BOOL unpack_nt_permissions(SMB_STRUCT_STAT *psbuf, uid_t *puser, gid_t *p
}
/****************************************************************************
+ Create a linked list of canonical ACE entries. This is sorted so that DENY
+ entries are at the front of the list, as NT requires.
+****************************************************************************/
+
+canon_ace *canonicalise_acl( acl_t posix_acl, SMB_STRUCT_STAT *psbuf)
+{
+ extern DOM_SID global_sid_World;
+ acl_permset_t acl_mask = (ACL_READ|ACL_WRITE|ACL_EXECUTE);
+ canon_ace *list_head = NULL;
+ canon_ace *ace = NULL;
+ canon_ace *next_ace = NULL;
+ int entry_id = ACL_FIRST_ENTRY;
+
+ if (posix_acl == NULL)
+ return default_canonicalise_acl(psbuf);
+
+ while ( acl_get_entry(posix_acl, entry_id, &entry) == 1) {
+ acl_tag_t tagtype;
+ acl_permset_t permset;
+ DOM_SID sid;
+
+ /* get_next... */
+ if (entry_id == ACL_FIRST_ENTRY)
+ entry_id = ACL_NEXT_ENTRY;
+
+ /* Is this a MASK entry ? */
+ if (acl_get_tag_type(entry, &tagtype) == -1)
+ continue;
+
+ if (acl_get_permset(entry, &permset) == -1)
+ continue;
+
+ /* Decide which SID to use based on the ACL type. */
+ switch(tagtype) {
+ ACL_USER_OBJ:
+ /* Get the SID from the owner. */
+ uid_to_sid( &sid, psbuf->st_uid );
+ break;
+ ACL_USER:
+ {
+ uid_t *puid = (uid_t *)acl_get_qualifier(entry);
+ if (puid == NULL) {
+ DEBUG(0,("canonicalise_acl: Failed to get uid.\n"));
+ continue;
+ }
+ uid_to_sid( &sid, *puid);
+ break;
+ }
+ ACL_GROUP_OBJ:
+ /* Get the SID from the owning group. */
+ gid_to_sid( &sid, psbuf->st_gid );
+ break;
+ ACL_GROUP:
+ {
+ gid_t *pgid = (gid_t *)acl_get_qualifier(entry);
+ if (pgid == NULL) {
+ DEBUG(0,("canonicalise_acl: Failed to get gid.\n"));
+ continue;
+ }
+ gid_to_sid( &sid, *pgid);
+ break;
+ }
+ ACL_MASK:
+ acl_mask = permset;
+ continue; /* Don't count the mask as an entry. */
+ ACL_OTHER_OBJ:
+ /* Use the Everyone SID */
+ sid = global_sid_World;
+ break;
+ default:
+ DEBUG(0,("canonicalise_acl: Unknown tagtype %u\n", (unsigned int)tagtype));
+ continue;
+ }
+
+ /*
+ * Add this entry to the list.
+ */
+
+ if ((ace = (canon_ace *)malloc(sizeof(canon_ace))) == NULL)
+ goto fail;
+
+ ZERO_STRUCTP(ace);
+ ace->type = tagtype;
+ ace->perms = permset;
+ ace->sid = sid;
+
+ DLIST_ADD(list_head, ace);
+ }
+
+ /*
+ * Now go through the list, masking the permissions with the
+ * acl_mask. If the permissions are 0 and the type is ACL_USER
+ * or ACL_GROUP then it's a DENY entry and should be listed
+ * first. If the permissions are 0 and the type is ACL_USER_OBJ,
+ * ACL_GROUP_OBJ or ACL_OTHER_OBJ then remove the entry as they
+ * can never apply.
+ */
+
+ for ( ace = list_head; ace; ace = next_ace) {
+ next_ace = ace_next;
+ ace->perms &= acl_mask;
+
+ if (ace->perms == 0) {
+ switch (ace->type) {
+ ACL_USER_OBJ:
+ ACL_GROUP_OBJ:
+ ACL_OTHER_OBJ:
+ DLIST_REMOVE(list_head, ace);
+ break;
+ ACL_USER:
+ ACL_GROUP:
+ DLIST_PROMOTE(list_head, ace);
+ break;
+ }
+ }
+ }
+
+ return list_head;
+}
+
+/****************************************************************************
Go through the ACL entries one by one, count them and extract the permset
of the mask entry as we scan the acl.
****************************************************************************/
-static size_t get_num_posix_entries(acl_t posix_acl, acl_permset_t *posix_mask)
+static size_t get_num_entries(acl_t posix_acl, acl_permset_t *file_mask)
{
size_t num_entries;
acl_entry_t entry;
int entry_id = ACL_FIRST_ENTRY;
- *posix_mask = (ACL_READ|ACL_WRITE|ACL_EXECUTE);
+ *file_mask = (ACL_READ|ACL_WRITE|ACL_EXECUTE);
+
+ /*
+ * If the acl is NULL, then return 3 as we will fake this using UNIX
+ * permissions.
+ */
- for( num_entries = 0; acl_get_entry(posix_acl, entry_id, &entry) != -1; num_entries++) {
+ if (posix_acl == NULL)
+ return 3;
+
+ num_entries = 0;
+ while ( acl_get_entry(posix_acl, entry_id, &entry) == 1) {
acl_tag_t tagtype;
acl_permset_t permset;
- entry_id = ACL_NEXT_ENTRY;
+ /* get_next... */
+ if (entry_id == ACL_FIRST_ENTRY)
+ entry_id = ACL_NEXT_ENTRY;
+
+ /* Is this a MASK entry ? */
if (acl_get_tag_type(entry, &tagtype) == -1)
continue;
- if (tagtype == ACL_MASK)
+ if (tagtype == ACL_MASK) {
if (acl_get_permset(entry, &permset) == 0)
- *posix_mask = permset;
+ *file_mask = permset;
+ continue; /* Don't count the mask as an entry. */
+ }
+
+ num_entries++;
}
return num_entries;
@@ -375,12 +520,17 @@ size_t get_nt_acl(files_struct *fsp, SEC_DESC **ppdesc)
int other_acl_type;
size_t num_acls = 0;
size_t num_dir_acls = 0;
+ size _t i;
acl_t posix_acl = NULL;
acl_t directory_acl = NULL;
+ acl_permset_t file_mask = 0;
+ acl_permset_t directory_mask = 0;
*ppdesc = NULL;
if(fsp->is_directory || fsp->fd == -1) {
+
+ /* Get the stat struct for the owner info. */
if(vfs_stat(fsp,fsp->fsp_name, &sbuf) != 0) {
return 0;
}
@@ -388,25 +538,25 @@ size_t get_nt_acl(files_struct *fsp, SEC_DESC **ppdesc)
* Get the ACL from the path.
*/
- if ((posix_acl = acl_get_file( dos_to_unix(fsp->fsp_name, False), ACL_TYPE_ACCESS)) == NULL)
- return 0;
+ posix_acl = acl_get_file( dos_to_unix(fsp->fsp_name, False), ACL_TYPE_ACCESS);
/*
* If it's a directory get the default POSIX ACL.
*/
- if(fsp->is_directory) {
- }
+ if(fsp->is_directory)
+ directory_acl = acl_get_file( dos_to_unix(fsp->fsp_name, False), ACL_TYPE_DEFAULT);
} else {
+
+ /* Get the stat struct for the owner info. */
if(fsp->conn->vfs_ops.fstat(fsp->fd,&sbuf) != 0) {
return 0;
}
/*
* Get the ACL from the fd.
*/
- if ((posix_acl = acl_get_fd( fsp->fd)) == NULL)
- return 0;
+ posix_acl = acl_get_fd(fsp->fd);
}
/*
@@ -420,18 +570,44 @@ size_t get_nt_acl(files_struct *fsp, SEC_DESC **ppdesc)
* the mask.
*/
- num_posix_entries = get_num_posix_entries(posix_acl, &posix_mask);
+ num_acls = get_num_entries(posix_acl, &file_mask);
+ if (fsp->is_directory)
+ num_dir_acls = get_num_entries(directory_acl, &directory_mask);
- /*
- * Create the generic 3 element UNIX acl.
- */
+ /* Allocate the ace list. */
+ if ((ace_list = (SEC_ACE *)malloc((num_acls + num_dir_acls)* sizeof(SEC_ACE))) == NULL) {
+ goto fail:
+ }
+
+ memset(ace_list, '\0', (num_acls + num_dir_acls) * sizeof(SEC_ACE) );
+
+ for (i = 0; i < num_acls; i++) {
+ SEC_ACCESS acc = map_unix_perms();
+ }
+
+ for (i = 0; i < num_dir_acls; i++) {
+ SEC_ACCESS acc = map_unix_perms();
+ }
+
+ done:
+
+ if (posix_acl)
+ acl_free(posix_acl);
+ if (directory_acl)
+ acl_free(directory_acl);
+
+ } else {
+
+ /*
+ * Fall back to the generic 3 element UNIX permissions.
+ */
- owner_access = map_unix_perms(&owner_acl_type, sbuf.st_mode,
- S_IRUSR, S_IWUSR, S_IXUSR, fsp->is_directory);
- group_access = map_unix_perms(&grp_acl_type, sbuf.st_mode,
- S_IRGRP, S_IWGRP, S_IXGRP, fsp->is_directory);
- other_access = map_unix_perms(&other_acl_type, sbuf.st_mode,
- S_IROTH, S_IWOTH, S_IXOTH, fsp->is_directory);
+ owner_access = map_unix_perms(&owner_acl_type, sbuf.st_mode,
+ S_IRUSR, S_IWUSR, S_IXUSR, fsp->is_directory);
+ group_access = map_unix_perms(&grp_acl_type, sbuf.st_mode,
+ S_IRGRP, S_IWGRP, S_IXGRP, fsp->is_directory);
+ other_access = map_unix_perms(&other_acl_type, sbuf.st_mode,
+ S_IROTH, S_IWOTH, S_IXOTH, fsp->is_directory);
if(owner_access.mask)
init_sec_ace(&ace_list[num_acls++], &owner_sid, owner_acl_type, owner_access, 0);
generated by cgit (git 2.34.1) at 2024-11-10 16:39:09 +0000