source: branches/samba-3.0/source/modules/vfs_hpuxacl.c

Last change on this file was 124, checked in by Paul Smedley, 17 years ago

Update source to 3.0.28a
File size: 32.3 KB
Line 
1/*
2 * Unix SMB/Netbios implementation.
3 * VFS module to get and set HP-UX ACLs
4 * Copyright (C) Michael Adam 2006
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
19 */
20
21/*
22 * This module supports JFS (POSIX) ACLs on VxFS (Veritas * Filesystem).
23 * These are available on HP-UX 11.00 if JFS 3.3 is installed.
24 * On HP-UX 11i (11.11 and above) these ACLs are supported out of
25 * the box.
26 *
27 * There is another form of ACLs on HFS. These ACLs have a
28 * completely different API and their own set of userland tools.
29 * Since HFS seems to be considered deprecated, HFS acls
30 * are not supported. (They could be supported through a separate
31 * vfs-module if there is demand.)
32 */
33
34/* =================================================================
35 * NOTE:
36 *
37 * The original hpux-acl code in lib/sysacls.c was based upon the
38 * solaris acl code in the same file. Now for the new modularized
39 * acl implementation, I have taken the code from vfs_solarisacls.c
40 * and did similar adaptations as were done before, essentially
41 * reusing the original internal aclsort functions.
42 * The check for the presence of the acl() call has been adopted, and
43 * a check for the presence of the aclsort() call has been added.
44 *
45 * Michael Adam <obnox@samba.org>
46 *
47 * ================================================================= */
48
49
50#include "includes.h"
51
52/*
53 * including standard header <sys/aclv.h>
54 *
55 * included here as a quick hack for the special HP-UX-situation:
56 *
57 * The problem is that, on HP-UX, jfs/posix acls are
58 * defined in <sys/aclv.h>, while the deprecated hfs acls
59 * are defined inside <sys/acl.h>.
60 *
61 */
62/* GROUP is defined somewhere else so undef it here... */
63#undef GROUP
64#include <sys/aclv.h>
65/* dl.h: needed to check for acl call via shl_findsym */
66#include <dl.h>
67
68typedef struct acl HPUX_ACE_T;
69typedef struct acl *HPUX_ACL_T;
70typedef int HPUX_ACL_TAG_T; /* the type of an ACL entry */
71typedef ushort HPUX_PERM_T;
72
73/* Structure to capture the count for each type of ACE.
74 * (for hpux_internal_aclsort */
75struct hpux_acl_types {
76 int n_user;
77 int n_def_user;
78 int n_user_obj;
79 int n_def_user_obj;
80
81 int n_group;
82 int n_def_group;
83 int n_group_obj;
84 int n_def_group_obj;
85
86 int n_other;
87 int n_other_obj;
88 int n_def_other_obj;
89
90 int n_class_obj;
91 int n_def_class_obj;
92
93 int n_illegal_obj;
94};
95
96/* for convenience: check if hpux acl entry is a default entry? */
97#define _IS_DEFAULT(ace) ((ace).a_type & ACL_DEFAULT)
98#define _IS_OF_TYPE(ace, type) ( \
99 (((type) == SMB_ACL_TYPE_ACCESS) && !_IS_DEFAULT(ace)) \
100 || \
101 (((type) == SMB_ACL_TYPE_DEFAULT) && _IS_DEFAULT(ace)) \
102)
103
104
105/* prototypes for private functions */
106
107static HPUX_ACL_T hpux_acl_init(int count);
108static BOOL smb_acl_to_hpux_acl(SMB_ACL_T smb_acl,
109 HPUX_ACL_T *solariacl, int *count,
110 SMB_ACL_TYPE_T type);
111static SMB_ACL_T hpux_acl_to_smb_acl(HPUX_ACL_T hpuxacl, int count,
112 SMB_ACL_TYPE_T type);
113static HPUX_ACL_TAG_T smb_tag_to_hpux_tag(SMB_ACL_TAG_T smb_tag);
114static SMB_ACL_TAG_T hpux_tag_to_smb_tag(HPUX_ACL_TAG_T hpux_tag);
115static BOOL hpux_add_to_acl(HPUX_ACL_T *hpux_acl, int *count,
116 HPUX_ACL_T add_acl, int add_count, SMB_ACL_TYPE_T type);
117static BOOL hpux_acl_get_file(const char *name, HPUX_ACL_T *hpuxacl,
118 int *count);
119static SMB_ACL_PERM_T hpux_perm_to_smb_perm(const HPUX_PERM_T perm);
120static HPUX_PERM_T smb_perm_to_hpux_perm(const SMB_ACL_PERM_T perm);
121#if 0
122static BOOL hpux_acl_check(HPUX_ACL_T hpux_acl, int count);
123#endif
124/* aclsort (internal) and helpers: */
125static BOOL hpux_acl_sort(HPUX_ACL_T acl, int count);
126static int hpux_internal_aclsort(int acl_count, int calclass, HPUX_ACL_T aclp);
127static void hpux_count_obj(int acl_count, HPUX_ACL_T aclp,
128 struct hpux_acl_types *acl_type_count);
129static void hpux_swap_acl_entries(HPUX_ACE_T *aclp0, HPUX_ACE_T *aclp1);
130static BOOL hpux_prohibited_duplicate_type(int acl_type);
131
132static BOOL hpux_acl_call_present(void);
133static BOOL hpux_aclsort_call_present(void);
134
135
136/* public functions - the api */
137
138SMB_ACL_T hpuxacl_sys_acl_get_file(vfs_handle_struct *handle,
139 const char *path_p,
140 SMB_ACL_TYPE_T type)
141{
142 SMB_ACL_T result = NULL;
143 int count;
144 HPUX_ACL_T hpux_acl = NULL;
145
146 DEBUG(10, ("hpuxacl_sys_acl_get_file called for file '%s'.\n",
147 path_p));
148
149 if(hpux_acl_call_present() == False) {
150 /* Looks like we don't have the acl() system call on HPUX.
151 * May be the system doesn't have the latest version of JFS.
152 */
153 goto done;
154 }
155
156 if (type != SMB_ACL_TYPE_ACCESS && type != SMB_ACL_TYPE_DEFAULT) {
157 DEBUG(10, ("invalid SMB_ACL_TYPE given (%d)\n", type));
158 errno = EINVAL;
159 goto done;
160 }
161
162 DEBUGADD(10, ("getting %s acl\n",
163 ((type == SMB_ACL_TYPE_ACCESS) ? "access" : "default")));
164
165 if (!hpux_acl_get_file(path_p, &hpux_acl, &count)) {
166 goto done;
167 }
168 result = hpux_acl_to_smb_acl(hpux_acl, count, type);
169 if (result == NULL) {
170 DEBUG(10, ("conversion hpux_acl -> smb_acl failed (%s).\n",
171 strerror(errno)));
172 }
173
174 done:
175 DEBUG(10, ("hpuxacl_sys_acl_get_file %s.\n",
176 ((result == NULL) ? "failed" : "succeeded" )));
177 SAFE_FREE(hpux_acl);
178 return result;
179}
180
181
182/*
183 * get the access ACL of a file referred to by a fd
184 */
185SMB_ACL_T hpuxacl_sys_acl_get_fd(vfs_handle_struct *handle,
186 files_struct *fsp,
187 int fd)
188{
189 /*
190 * HPUX doesn't have the facl call. Fake it using the path.... JRA.
191 */
192 /* For all I see, the info should already be in the fsp
193 * parameter, but get it again to be safe --- necessary? */
194 files_struct *file_struct_p = file_find_fd(fd);
195 if (file_struct_p == NULL) {
196 errno = EBADF;
197 return NULL;
198 }
199 /*
200 * We know we're in the same conn context. So we
201 * can use the relative path.
202 */
203 DEBUG(10, ("redirecting call of hpuxacl_sys_acl_get_fd to "
204 "hpuxacl_sys_acl_get_file (no facl syscall on HPUX).\n"));
205
206 return hpuxacl_sys_acl_get_file(handle, file_struct_p->fsp_name,
207 SMB_ACL_TYPE_ACCESS);
208}
209
210
211int hpuxacl_sys_acl_set_file(vfs_handle_struct *handle,
212 const char *name,
213 SMB_ACL_TYPE_T type,
214 SMB_ACL_T theacl)
215{
216 int ret = -1;
217 SMB_STRUCT_STAT s;
218 HPUX_ACL_T hpux_acl = NULL;
219 int count;
220
221 DEBUG(10, ("hpuxacl_sys_acl_set_file called for file '%s'\n",
222 name));
223
224
225 if(hpux_acl_call_present() == False) {
226 /* Looks like we don't have the acl() system call on HPUX.
227 * May be the system doesn't have the latest version of JFS.
228 */
229 goto done;
230 }
231
232 if ((type != SMB_ACL_TYPE_ACCESS) && (type != SMB_ACL_TYPE_DEFAULT)) {
233 errno = EINVAL;
234 DEBUG(10, ("invalid smb acl type given (%d).\n", type));
235 goto done;
236 }
237 DEBUGADD(10, ("setting %s acl\n",
238 ((type == SMB_ACL_TYPE_ACCESS) ? "access" : "default")));
239
240 if(!smb_acl_to_hpux_acl(theacl, &hpux_acl, &count, type)) {
241 DEBUG(10, ("conversion smb_acl -> hpux_acl failed (%s).\n",
242 strerror(errno)));
243 goto done;
244 }
245
246 /*
247 * if the file is a directory, there is extra work to do:
248 * since the hpux acl call stores both the access acl and
249 * the default acl as provided, we have to get the acl part
250 * that has _not_ been specified in "type" from the file first
251 * and concatenate it with the acl provided.
252 */
253 if (SMB_VFS_STAT(handle->conn, name, &s) != 0) {
254 DEBUG(10, ("Error in stat call: %s\n", strerror(errno)));
255 goto done;
256 }
257 if (S_ISDIR(s.st_mode)) {
258 HPUX_ACL_T other_acl;
259 int other_count;
260 SMB_ACL_TYPE_T other_type;
261
262 other_type = (type == SMB_ACL_TYPE_ACCESS)
263 ? SMB_ACL_TYPE_DEFAULT
264 : SMB_ACL_TYPE_ACCESS;
265 DEBUGADD(10, ("getting acl from filesystem\n"));
266 if (!hpux_acl_get_file(name, &other_acl, &other_count)) {
267 DEBUG(10, ("error getting acl from directory\n"));
268 goto done;
269 }
270 DEBUG(10, ("adding %s part of fs acl to given acl\n",
271 ((other_type == SMB_ACL_TYPE_ACCESS)
272 ? "access"
273 : "default")));
274 if (!hpux_add_to_acl(&hpux_acl, &count, other_acl,
275 other_count, other_type))
276 {
277 DEBUG(10, ("error adding other acl.\n"));
278 SAFE_FREE(other_acl);
279 goto done;
280 }
281 SAFE_FREE(other_acl);
282 }
283 else if (type != SMB_ACL_TYPE_ACCESS) {
284 errno = EINVAL;
285 goto done;
286 }
287
288 if (!hpux_acl_sort(hpux_acl, count)) {
289 DEBUG(10, ("resulting acl is not valid!\n"));
290 goto done;
291 }
292 DEBUG(10, ("resulting acl is valid.\n"));
293
294 ret = acl(CONST_DISCARD(char *, name), ACL_SET, count, hpux_acl);
295 if (ret != 0) {
296 DEBUG(0, ("ERROR calling acl: %s\n", strerror(errno)));
297 }
298
299 done:
300 DEBUG(10, ("hpuxacl_sys_acl_set_file %s.\n",
301 ((ret != 0) ? "failed" : "succeeded")));
302 SAFE_FREE(hpux_acl);
303 return ret;
304}
305
306/*
307 * set the access ACL on the file referred to by a fd
308 */
309int hpuxacl_sys_acl_set_fd(vfs_handle_struct *handle,
310 files_struct *fsp,
311 int fd, SMB_ACL_T theacl)
312{
313 /*
314 * HPUX doesn't have the facl call. Fake it using the path.... JRA.
315 */
316 /* For all I see, the info should already be in the fsp
317 * parameter, but get it again to be safe --- necessary? */
318 files_struct *file_struct_p = file_find_fd(fd);
319 if (file_struct_p == NULL) {
320 errno = EBADF;
321 return -1;
322 }
323 /*
324 * We know we're in the same conn context. So we
325 * can use the relative path.
326 */
327 DEBUG(10, ("redirecting call of hpuxacl_sys_acl_set_fd to "
328 "hpuxacl_sys_acl_set_file (no facl syscall on HPUX)\n"));
329
330 return hpuxacl_sys_acl_set_file(handle, file_struct_p->fsp_name,
331 SMB_ACL_TYPE_ACCESS, theacl);
332}
333
334
335/*
336 * delete the default ACL of a directory
337 *
338 * This is achieved by fetching the access ACL and rewriting it
339 * directly, via the hpux system call: the ACL_SET call on
340 * directories writes both the access and the default ACL as provided.
341 *
342 * XXX: posix acl_delete_def_file returns an error if
343 * the file referred to by path is not a directory.
344 * this function does not complain but the actions
345 * have no effect on a file other than a directory.
346 * But sys_acl_delete_default_file is only called in
347 * smbd/posixacls.c after having checked that the file
348 * is a directory, anyways. So implementing the extra
349 * check is considered unnecessary. --- Agreed? XXX
350 */
351int hpuxacl_sys_acl_delete_def_file(vfs_handle_struct *handle,
352 const char *path)
353{
354 SMB_ACL_T smb_acl;
355 int ret = -1;
356 HPUX_ACL_T hpux_acl;
357 int count;
358
359 DEBUG(10, ("entering hpuxacl_sys_acl_delete_def_file.\n"));
360
361 smb_acl = hpuxacl_sys_acl_get_file(handle, path,
362 SMB_ACL_TYPE_ACCESS);
363 if (smb_acl == NULL) {
364 DEBUG(10, ("getting file acl failed!\n"));
365 goto done;
366 }
367 if (!smb_acl_to_hpux_acl(smb_acl, &hpux_acl, &count,
368 SMB_ACL_TYPE_ACCESS))
369 {
370 DEBUG(10, ("conversion smb_acl -> hpux_acl failed.\n"));
371 goto done;
372 }
373 if (!hpux_acl_sort(hpux_acl, count)) {
374 DEBUG(10, ("resulting acl is not valid!\n"));
375 goto done;
376 }
377 ret = acl(CONST_DISCARD(char *, path), ACL_SET, count, hpux_acl);
378 if (ret != 0) {
379 DEBUG(10, ("settinge file acl failed!\n"));
380 }
381
382 done:
383 DEBUG(10, ("hpuxacl_sys_acl_delete_def_file %s.\n",
384 ((ret != 0) ? "failed" : "succeeded" )));
385 SAFE_FREE(smb_acl);
386 return ret;
387}
388
389
390/*
391 * private functions
392 */
393
394static HPUX_ACL_T hpux_acl_init(int count)
395{
396 HPUX_ACL_T hpux_acl =
397 (HPUX_ACL_T)SMB_MALLOC(sizeof(HPUX_ACE_T) * count);
398 if (hpux_acl == NULL) {
399 errno = ENOMEM;
400 }
401 return hpux_acl;
402}
403
404/*
405 * Convert the SMB acl to the ACCESS or DEFAULT part of a
406 * hpux ACL, as desired.
407 */
408static BOOL smb_acl_to_hpux_acl(SMB_ACL_T smb_acl,
409 HPUX_ACL_T *hpux_acl, int *count,
410 SMB_ACL_TYPE_T type)
411{
412 BOOL ret = False;
413 int i;
414 int check_which, check_rc;
415
416 DEBUG(10, ("entering smb_acl_to_hpux_acl\n"));
417
418 *hpux_acl = NULL;
419 *count = 0;
420
421 for (i = 0; i < smb_acl->count; i++) {
422 const struct smb_acl_entry *smb_entry = &(smb_acl->acl[i]);
423 HPUX_ACE_T hpux_entry;
424
425 ZERO_STRUCT(hpux_entry);
426
427 hpux_entry.a_type = smb_tag_to_hpux_tag(smb_entry->a_type);
428 if (hpux_entry.a_type == 0) {
429 DEBUG(10, ("smb_tag to hpux_tag failed\n"));
430 goto fail;
431 }
432 switch(hpux_entry.a_type) {
433 case USER:
434 DEBUG(10, ("got tag type USER with uid %d\n",
435 smb_entry->uid));
436 hpux_entry.a_id = (uid_t)smb_entry->uid;
437 break;
438 case GROUP:
439 DEBUG(10, ("got tag type GROUP with gid %d\n",
440 smb_entry->gid));
441 hpux_entry.a_id = (uid_t)smb_entry->gid;
442 break;
443 default:
444 break;
445 }
446 if (type == SMB_ACL_TYPE_DEFAULT) {
447 DEBUG(10, ("adding default bit to hpux ace\n"));
448 hpux_entry.a_type |= ACL_DEFAULT;
449 }
450
451 hpux_entry.a_perm =
452 smb_perm_to_hpux_perm(smb_entry->a_perm);
453 DEBUG(10, ("assembled the following hpux ace:\n"));
454 DEBUGADD(10, (" - type: 0x%04x\n", hpux_entry.a_type));
455 DEBUGADD(10, (" - id: %d\n", hpux_entry.a_id));
456 DEBUGADD(10, (" - perm: o%o\n", hpux_entry.a_perm));
457 if (!hpux_add_to_acl(hpux_acl, count, &hpux_entry,
458 1, type))
459 {
460 DEBUG(10, ("error adding acl entry\n"));
461 goto fail;
462 }
463 DEBUG(10, ("count after adding: %d (i: %d)\n", *count, i));
464 DEBUG(10, ("test, if entry has been copied into acl:\n"));
465 DEBUGADD(10, (" - type: 0x%04x\n",
466 (*hpux_acl)[(*count)-1].a_type));
467 DEBUGADD(10, (" - id: %d\n",
468 (*hpux_acl)[(*count)-1].a_id));
469 DEBUGADD(10, (" - perm: o%o\n",
470 (*hpux_acl)[(*count)-1].a_perm));
471 }
472
473 ret = True;
474 goto done;
475
476 fail:
477 SAFE_FREE(*hpux_acl);
478 done:
479 DEBUG(10, ("smb_acl_to_hpux_acl %s\n",
480 ((ret == True) ? "succeeded" : "failed")));
481 return ret;
482}
483
484/*
485 * convert either the access or the default part of a
486 * soaris acl to the SMB_ACL format.
487 */
488static SMB_ACL_T hpux_acl_to_smb_acl(HPUX_ACL_T hpux_acl, int count,
489 SMB_ACL_TYPE_T type)
490{
491 SMB_ACL_T result;
492 int i;
493
494 if ((result = sys_acl_init(0)) == NULL) {
495 DEBUG(10, ("error allocating memory for SMB_ACL\n"));
496 goto fail;
497 }
498 for (i = 0; i < count; i++) {
499 SMB_ACL_ENTRY_T smb_entry;
500 SMB_ACL_PERM_T smb_perm;
501
502 if (!_IS_OF_TYPE(hpux_acl[i], type)) {
503 continue;
504 }
505 result = SMB_REALLOC(result,
506 sizeof(struct smb_acl_t) +
507 (sizeof(struct smb_acl_entry) *
508 (result->count + 1)));
509 if (result == NULL) {
510 DEBUG(10, ("error reallocating memory for SMB_ACL\n"));
511 goto fail;
512 }
513 smb_entry = &result->acl[result->count];
514 if (sys_acl_set_tag_type(smb_entry,
515 hpux_tag_to_smb_tag(hpux_acl[i].a_type)) != 0)
516 {
517 DEBUG(10, ("invalid tag type given: 0x%04x\n",
518 hpux_acl[i].a_type));
519 goto fail;
520 }
521 /* intentionally not checking return code here: */
522 sys_acl_set_qualifier(smb_entry, (void *)&hpux_acl[i].a_id);
523 smb_perm = hpux_perm_to_smb_perm(hpux_acl[i].a_perm);
524 if (sys_acl_set_permset(smb_entry, &smb_perm) != 0) {
525 DEBUG(10, ("invalid permset given: %d\n",
526 hpux_acl[i].a_perm));
527 goto fail;
528 }
529 result->count += 1;
530 }
531 goto done;
532
533 fail:
534 SAFE_FREE(result);
535 done:
536 DEBUG(10, ("hpux_acl_to_smb_acl %s\n",
537 ((result == NULL) ? "failed" : "succeeded")));
538 return result;
539}
540
541
542
543static HPUX_ACL_TAG_T smb_tag_to_hpux_tag(SMB_ACL_TAG_T smb_tag)
544{
545 HPUX_ACL_TAG_T hpux_tag = 0;
546
547 DEBUG(10, ("smb_tag_to_hpux_tag\n"));
548 DEBUGADD(10, (" --> got smb tag 0x%04x\n", smb_tag));
549
550 switch (smb_tag) {
551 case SMB_ACL_USER:
552 hpux_tag = USER;
553 break;
554 case SMB_ACL_USER_OBJ:
555 hpux_tag = USER_OBJ;
556 break;
557 case SMB_ACL_GROUP:
558 hpux_tag = GROUP;
559 break;
560 case SMB_ACL_GROUP_OBJ:
561 hpux_tag = GROUP_OBJ;
562 break;
563 case SMB_ACL_OTHER:
564 hpux_tag = OTHER_OBJ;
565 break;
566 case SMB_ACL_MASK:
567 hpux_tag = CLASS_OBJ;
568 break;
569 default:
570 DEBUGADD(10, (" !!! unknown smb tag type 0x%04x\n", smb_tag));
571 break;
572 }
573
574 DEBUGADD(10, (" --> determined hpux tag 0x%04x\n", hpux_tag));
575
576 return hpux_tag;
577}
578
579static SMB_ACL_TAG_T hpux_tag_to_smb_tag(HPUX_ACL_TAG_T hpux_tag)
580{
581 SMB_ACL_TAG_T smb_tag = 0;
582
583 DEBUG(10, ("hpux_tag_to_smb_tag:\n"));
584 DEBUGADD(10, (" --> got hpux tag 0x%04x\n", hpux_tag));
585
586 hpux_tag &= ~ACL_DEFAULT;
587
588 switch (hpux_tag) {
589 case USER:
590 smb_tag = SMB_ACL_USER;
591 break;
592 case USER_OBJ:
593 smb_tag = SMB_ACL_USER_OBJ;
594 break;
595 case GROUP:
596 smb_tag = SMB_ACL_GROUP;
597 break;
598 case GROUP_OBJ:
599 smb_tag = SMB_ACL_GROUP_OBJ;
600 break;
601 case OTHER_OBJ:
602 smb_tag = SMB_ACL_OTHER;
603 break;
604 case CLASS_OBJ:
605 smb_tag = SMB_ACL_MASK;
606 break;
607 default:
608 DEBUGADD(10, (" !!! unknown hpux tag type: 0x%04x\n",
609 hpux_tag));
610 break;
611 }
612
613 DEBUGADD(10, (" --> determined smb tag 0x%04x\n", smb_tag));
614
615 return smb_tag;
616}
617
618
619/*
620 * The permission bits used in the following two permission conversion
621 * functions are same, but the functions make us independent of the concrete
622 * permission data types.
623 */
624static SMB_ACL_PERM_T hpux_perm_to_smb_perm(const HPUX_PERM_T perm)
625{
626 SMB_ACL_PERM_T smb_perm = 0;
627 smb_perm |= ((perm & SMB_ACL_READ) ? SMB_ACL_READ : 0);
628 smb_perm |= ((perm & SMB_ACL_WRITE) ? SMB_ACL_WRITE : 0);
629 smb_perm |= ((perm & SMB_ACL_EXECUTE) ? SMB_ACL_EXECUTE : 0);
630 return smb_perm;
631}
632
633
634static HPUX_PERM_T smb_perm_to_hpux_perm(const SMB_ACL_PERM_T perm)
635{
636 HPUX_PERM_T hpux_perm = 0;
637 hpux_perm |= ((perm & SMB_ACL_READ) ? SMB_ACL_READ : 0);
638 hpux_perm |= ((perm & SMB_ACL_WRITE) ? SMB_ACL_WRITE : 0);
639 hpux_perm |= ((perm & SMB_ACL_EXECUTE) ? SMB_ACL_EXECUTE : 0);
640 return hpux_perm;
641}
642
643
644static BOOL hpux_acl_get_file(const char *name, HPUX_ACL_T *hpux_acl,
645 int *count)
646{
647 BOOL result = False;
648 static HPUX_ACE_T dummy_ace;
649
650 DEBUG(10, ("hpux_acl_get_file called for file '%s'\n", name));
651
652 /*
653 * The original code tries some INITIAL_ACL_SIZE
654 * and only did the ACL_CNT call upon failure
655 * (for performance reasons).
656 * For the sake of simplicity, I skip this for now.
657 *
658 * NOTE: There is a catch here on HP-UX: acl with cmd parameter
659 * ACL_CNT fails with errno EINVAL when called with a NULL
660 * pointer as last argument. So we need to use a dummy acl
661 * struct here (we make it static so it does not need to be
662 * instantiated or malloced each time this function is
663 * called). Btw: the count parameter does not seem to matter...
664 */
665 *count = acl(CONST_DISCARD(char *, name), ACL_CNT, 0, &dummy_ace);
666 if (*count < 0) {
667 DEBUG(10, ("acl ACL_CNT failed: %s\n", strerror(errno)));
668 goto done;
669 }
670 *hpux_acl = hpux_acl_init(*count);
671 if (*hpux_acl == NULL) {
672 DEBUG(10, ("error allocating memory for hpux acl...\n"));
673 goto done;
674 }
675 *count = acl(CONST_DISCARD(char *, name), ACL_GET, *count, *hpux_acl);
676 if (*count < 0) {
677 DEBUG(10, ("acl ACL_GET failed: %s\n", strerror(errno)));
678 goto done;
679 }
680 result = True;
681
682 done:
683 DEBUG(10, ("hpux_acl_get_file %s.\n",
684 ((result == True) ? "succeeded" : "failed" )));
685 return result;
686}
687
688
689
690
691/*
692 * Add entries to a hpux ACL.
693 *
694 * Entries are directly added to the hpuxacl parameter.
695 * if memory allocation fails, this may result in hpuxacl
696 * being NULL. if the resulting acl is to be checked and is
697 * not valid, it is kept in hpuxacl but False is returned.
698 *
699 * The type of ACEs (access/default) to be added to the ACL can
700 * be selected via the type parameter.
701 * I use the SMB_ACL_TYPE_T type here. Since SMB_ACL_TYPE_ACCESS
702 * is defined as "0", this means that one can only add either
703 * access or default ACEs from the given ACL, not both at the same
704 * time. If it should become necessary to add all of an ACL, one
705 * would have to replace this parameter by another type.
706 */
707static BOOL hpux_add_to_acl(HPUX_ACL_T *hpux_acl, int *count,
708 HPUX_ACL_T add_acl, int add_count,
709 SMB_ACL_TYPE_T type)
710{
711 int i;
712
713 if ((type != SMB_ACL_TYPE_ACCESS) && (type != SMB_ACL_TYPE_DEFAULT))
714 {
715 DEBUG(10, ("invalid acl type given: %d\n", type));
716 errno = EINVAL;
717 return False;
718 }
719 for (i = 0; i < add_count; i++) {
720 if (!_IS_OF_TYPE(add_acl[i], type)) {
721 continue;
722 }
723 ADD_TO_ARRAY(NULL, HPUX_ACE_T, add_acl[i],
724 hpux_acl, count);
725 if (hpux_acl == NULL) {
726 DEBUG(10, ("error enlarging acl.\n"));
727 errno = ENOMEM;
728 return False;
729 }
730 }
731 return True;
732}
733
734
735/*
736 * sort the ACL and check it for validity
737 *
738 * [original comment from lib/sysacls.c:]
739 *
740 * if it's a minimal ACL with only 4 entries then we
741 * need to recalculate the mask permissions to make
742 * sure that they are the same as the GROUP_OBJ
743 * permissions as required by the UnixWare acl() system call.
744 *
745 * (note: since POSIX allows minimal ACLs which only contain
746 * 3 entries - ie there is no mask entry - we should, in theory,
747 * check for this and add a mask entry if necessary - however
748 * we "know" that the caller of this interface always specifies
749 * a mask, so in practice "this never happens" (tm) - if it *does*
750 * happen aclsort() will fail and return an error and someone will
751 * have to fix it...)
752 */
753static BOOL hpux_acl_sort(HPUX_ACL_T hpux_acl, int count)
754{
755 int fixmask = (count <= 4);
756
757 if (hpux_internal_aclsort(count, fixmask, hpux_acl) != 0) {
758 errno = EINVAL;
759 return False;
760 }
761 return True;
762}
763
764
765/*
766 * Helpers for hpux_internal_aclsort:
767 * - hpux_count_obj
768 * - hpux_swap_acl_entries
769 * - hpux_prohibited_duplicate_type
770 * - hpux_get_needed_class_perm
771 */
772
773/* hpux_count_obj:
774 * Counts the different number of objects in a given array of ACL
775 * structures.
776 * Inputs:
777 *
778 * acl_count - Count of ACLs in the array of ACL strucutres.
779 * aclp - Array of ACL structures.
780 * acl_type_count - Pointer to acl_types structure. Should already be
781 * allocated.
782 * Output:
783 *
784 * acl_type_count - This structure is filled up with counts of various
785 * acl types.
786 */
787
788static void hpux_count_obj(int acl_count, HPUX_ACL_T aclp, struct hpux_acl_types *acl_type_count)
789{
790 int i;
791
792 memset(acl_type_count, 0, sizeof(struct hpux_acl_types));
793
794 for(i=0;i<acl_count;i++) {
795 switch(aclp[i].a_type) {
796 case USER:
797 acl_type_count->n_user++;
798 break;
799 case USER_OBJ:
800 acl_type_count->n_user_obj++;
801 break;
802 case DEF_USER_OBJ:
803 acl_type_count->n_def_user_obj++;
804 break;
805 case GROUP:
806 acl_type_count->n_group++;
807 break;
808 case GROUP_OBJ:
809 acl_type_count->n_group_obj++;
810 break;
811 case DEF_GROUP_OBJ:
812 acl_type_count->n_def_group_obj++;
813 break;
814 case OTHER_OBJ:
815 acl_type_count->n_other_obj++;
816 break;
817 case DEF_OTHER_OBJ:
818 acl_type_count->n_def_other_obj++;
819 break;
820 case CLASS_OBJ:
821 acl_type_count->n_class_obj++;
822 break;
823 case DEF_CLASS_OBJ:
824 acl_type_count->n_def_class_obj++;
825 break;
826 case DEF_USER:
827 acl_type_count->n_def_user++;
828 break;
829 case DEF_GROUP:
830 acl_type_count->n_def_group++;
831 break;
832 default:
833 acl_type_count->n_illegal_obj++;
834 break;
835 }
836 }
837}
838
839/* hpux_swap_acl_entries: Swaps two ACL entries.
840 *
841 * Inputs: aclp0, aclp1 - ACL entries to be swapped.
842 */
843
844static void hpux_swap_acl_entries(HPUX_ACE_T *aclp0, HPUX_ACE_T *aclp1)
845{
846 HPUX_ACE_T temp_acl;
847
848 temp_acl.a_type = aclp0->a_type;
849 temp_acl.a_id = aclp0->a_id;
850 temp_acl.a_perm = aclp0->a_perm;
851
852 aclp0->a_type = aclp1->a_type;
853 aclp0->a_id = aclp1->a_id;
854 aclp0->a_perm = aclp1->a_perm;
855
856 aclp1->a_type = temp_acl.a_type;
857 aclp1->a_id = temp_acl.a_id;
858 aclp1->a_perm = temp_acl.a_perm;
859}
860
861/* hpux_prohibited_duplicate_type
862 * Identifies if given ACL type can have duplicate entries or
863 * not.
864 *
865 * Inputs: acl_type - ACL Type.
866 *
867 * Outputs:
868 *
869 * Return..
870 *
871 * True - If the ACL type matches any of the prohibited types.
872 * False - If the ACL type doesn't match any of the prohibited types.
873 */
874
875static BOOL hpux_prohibited_duplicate_type(int acl_type)
876{
877 switch(acl_type) {
878 case USER:
879 case GROUP:
880 case DEF_USER:
881 case DEF_GROUP:
882 return True;
883 default:
884 return False;
885 }
886}
887
888/* hpux_get_needed_class_perm
889 * Returns the permissions of a ACL structure only if the ACL
890 * type matches one of the pre-determined types for computing
891 * CLASS_OBJ permissions.
892 *
893 * Inputs: aclp - Pointer to ACL structure.
894 */
895
896static int hpux_get_needed_class_perm(struct acl *aclp)
897{
898 switch(aclp->a_type) {
899 case USER:
900 case GROUP_OBJ:
901 case GROUP:
902 case DEF_USER_OBJ:
903 case DEF_USER:
904 case DEF_GROUP_OBJ:
905 case DEF_GROUP:
906 case DEF_CLASS_OBJ:
907 case DEF_OTHER_OBJ:
908 return aclp->a_perm;
909 default:
910 return 0;
911 }
912}
913
914/* hpux_internal_aclsort: aclsort for HPUX.
915 *
916 * -> The aclsort() system call is availabe on the latest HPUX General
917 * -> Patch Bundles. So for HPUX, we developed our version of aclsort
918 * -> function. Because, we don't want to update to a new
919 * -> HPUX GR bundle just for aclsort() call.
920 *
921 * aclsort sorts the array of ACL structures as per the description in
922 * aclsort man page. Refer to aclsort man page for more details
923 *
924 * Inputs:
925 *
926 * acl_count - Count of ACLs in the array of ACL structures.
927 * calclass - If this is not zero, then we compute the CLASS_OBJ
928 * permissions.
929 * aclp - Array of ACL structures.
930 *
931 * Outputs:
932 *
933 * aclp - Sorted array of ACL structures.
934 *
935 * Outputs:
936 *
937 * Returns 0 for success -1 for failure. Prints a message to the Samba
938 * debug log in case of failure.
939 */
940
941static int hpux_internal_aclsort(int acl_count, int calclass, HPUX_ACL_T aclp)
942{
943 struct hpux_acl_types acl_obj_count;
944 int n_class_obj_perm = 0;
945 int i, j;
946
947 DEBUG(10,("Entering hpux_internal_aclsort. (calclass = %d)\n", calclass));
948
949 if (hpux_aclsort_call_present()) {
950 DEBUG(10, ("calling hpux aclsort\n"));
951 return aclsort(acl_count, calclass, aclp);
952 }
953
954 DEBUG(10, ("using internal aclsort\n"));
955
956 if(!acl_count) {
957 DEBUG(10,("Zero acl count passed. Returning Success\n"));
958 return 0;
959 }
960
961 if(aclp == NULL) {
962 DEBUG(0,("Null ACL pointer in hpux_acl_sort. Returning Failure. \n"));
963 return -1;
964 }
965
966 /* Count different types of ACLs in the ACLs array */
967
968 hpux_count_obj(acl_count, aclp, &acl_obj_count);
969
970 /* There should be only one entry each of type USER_OBJ, GROUP_OBJ,
971 * CLASS_OBJ and OTHER_OBJ
972 */
973
974 if ( (acl_obj_count.n_user_obj != 1) ||
975 (acl_obj_count.n_group_obj != 1) ||
976 (acl_obj_count.n_class_obj != 1) ||
977 (acl_obj_count.n_other_obj != 1) )
978 {
979 DEBUG(0,("hpux_internal_aclsort: More than one entry or no entries for \
980USER OBJ or GROUP_OBJ or OTHER_OBJ or CLASS_OBJ\n"));
981 return -1;
982 }
983
984 /* If any of the default objects are present, there should be only
985 * one of them each.
986 */
987
988 if ( (acl_obj_count.n_def_user_obj > 1) ||
989 (acl_obj_count.n_def_group_obj > 1) ||
990 (acl_obj_count.n_def_other_obj > 1) ||
991 (acl_obj_count.n_def_class_obj > 1) )
992 {
993 DEBUG(0,("hpux_internal_aclsort: More than one entry for DEF_CLASS_OBJ \
994or DEF_USER_OBJ or DEF_GROUP_OBJ or DEF_OTHER_OBJ\n"));
995 return -1;
996 }
997
998 /* We now have proper number of OBJ and DEF_OBJ entries. Now sort the acl
999 * structures.
1000 *
1001 * Sorting crieteria - First sort by ACL type. If there are multiple entries of
1002 * same ACL type, sort by ACL id.
1003 *
1004 * I am using the trival kind of sorting method here because, performance isn't
1005 * really effected by the ACLs feature. More over there aren't going to be more
1006 * than 17 entries on HPUX.
1007 */
1008
1009 for(i=0; i<acl_count;i++) {
1010 for (j=i+1; j<acl_count; j++) {
1011 if( aclp[i].a_type > aclp[j].a_type ) {
1012 /* ACL entries out of order, swap them */
1013 hpux_swap_acl_entries((aclp+i), (aclp+j));
1014 } else if ( aclp[i].a_type == aclp[j].a_type ) {
1015 /* ACL entries of same type, sort by id */
1016 if(aclp[i].a_id > aclp[j].a_id) {
1017 hpux_swap_acl_entries((aclp+i), (aclp+j));
1018 } else if (aclp[i].a_id == aclp[j].a_id) {
1019 /* We have a duplicate entry. */
1020 if(hpux_prohibited_duplicate_type(aclp[i].a_type)) {
1021 DEBUG(0, ("hpux_internal_aclsort: Duplicate entry: Type(hex): %x Id: %d\n",
1022 aclp[i].a_type, aclp[i].a_id));
1023 return -1;
1024 }
1025 }
1026 }
1027 }
1028 }
1029
1030 /* set the class obj permissions to the computed one. */
1031 if(calclass) {
1032 int n_class_obj_index = -1;
1033
1034 for(i=0;i<acl_count;i++) {
1035 n_class_obj_perm |= hpux_get_needed_class_perm((aclp+i));
1036
1037 if(aclp[i].a_type == CLASS_OBJ)
1038 n_class_obj_index = i;
1039 }
1040 aclp[n_class_obj_index].a_perm = n_class_obj_perm;
1041 }
1042
1043 return 0;
1044}
1045
1046
1047/*
1048 * hpux_acl_call_present:
1049 *
1050 * This checks if the POSIX ACL system call is defined
1051 * which basically corresponds to whether JFS 3.3 or
1052 * higher is installed. If acl() was called when it
1053 * isn't defined, it causes the process to core dump
1054 * so it is important to check this and avoid acl()
1055 * calls if it isn't there.
1056 */
1057
1058static BOOL hpux_acl_call_present(void)
1059{
1060
1061 shl_t handle = NULL;
1062 void *value;
1063 int ret_val=0;
1064 static BOOL already_checked = False;
1065
1066 if(already_checked)
1067 return True;
1068
1069 errno = 0;
1070
1071 ret_val = shl_findsym(&handle, "acl", TYPE_PROCEDURE, &value);
1072
1073 if(ret_val != 0) {
1074 DEBUG(5, ("hpux_acl_call_present: shl_findsym() returned %d, errno = %d, error %s\n",
1075 ret_val, errno, strerror(errno)));
1076 DEBUG(5,("hpux_acl_call_present: acl() system call is not present. Check if you have JFS 3.3 and above?\n"));
1077 errno = ENOSYS;
1078 return False;
1079 }
1080
1081 DEBUG(10,("hpux_acl_call_present: acl() system call is present. We have JFS 3.3 or above \n"));
1082
1083 already_checked = True;
1084 return True;
1085}
1086
1087/*
1088 * runtime check for presence of aclsort library call.
1089 * same code as for acl call. if there are more of these,
1090 * a dispatcher function could be handy...
1091 */
1092
1093static BOOL hpux_aclsort_call_present(void)
1094{
1095 shl_t handle = NULL;
1096 void *value;
1097 int ret_val = 0;
1098 static BOOL already_checked = False;
1099
1100 if (already_checked) {
1101 return True;
1102 }
1103
1104 errno = 0;
1105 ret_val = shl_findsym(&handle, "aclsort", TYPE_PROCEDURE, &value);
1106 if (ret_val != 0) {
1107 DEBUG(5, ("hpux_aclsort_call_present: shl_findsym "
1108 "returned %d, errno = %d, error %s",
1109 ret_val, errno, strerror(errno)));
1110 DEBUG(5, ("hpux_aclsort_call_present: "
1111 "aclsort() function not available.\n"));
1112 return False;
1113 }
1114 DEBUG(10,("hpux_aclsort_call_present: aclsort() function present.\n"));
1115 already_checked = True;
1116 return True;
1117}
1118
1119#if 0
1120/*
1121 * acl check function:
1122 * unused at the moment but could be used to get more
1123 * concrete error messages for debugging...
1124 * (acl sort just says that the acl is invalid...)
1125 */
1126static BOOL hpux_acl_check(HPUX_ACL_T hpux_acl, int count)
1127{
1128 int check_rc;
1129 int check_which;
1130
1131 check_rc = aclcheck(hpux_acl, count, &check_which);
1132 if (check_rc != 0) {
1133 DEBUG(10, ("acl is not valid:\n"));
1134 DEBUGADD(10, (" - return code: %d\n", check_rc));
1135 DEBUGADD(10, (" - which: %d\n", check_which));
1136 if (check_which != -1) {
1137 DEBUGADD(10, (" - invalid entry:\n"));
1138 DEBUGADD(10, (" * type: %d:\n",
1139 hpux_acl[check_which].a_type));
1140 DEBUGADD(10, (" * id: %d\n",
1141 hpux_acl[check_which].a_id));
1142 DEBUGADD(10, (" * perm: 0o%o\n",
1143 hpux_acl[check_which].a_perm));
1144 }
1145 return False;
1146 }
1147 return True;
1148}
1149#endif
1150
1151/* VFS operations structure */
1152
1153static vfs_op_tuple hpuxacl_op_tuples[] = {
1154 /* Disk operations */
1155 {SMB_VFS_OP(hpuxacl_sys_acl_get_file),
1156 SMB_VFS_OP_SYS_ACL_GET_FILE,
1157 SMB_VFS_LAYER_TRANSPARENT},
1158
1159 {SMB_VFS_OP(hpuxacl_sys_acl_get_fd),
1160 SMB_VFS_OP_SYS_ACL_GET_FD,
1161 SMB_VFS_LAYER_TRANSPARENT},
1162
1163 {SMB_VFS_OP(hpuxacl_sys_acl_set_file),
1164 SMB_VFS_OP_SYS_ACL_SET_FILE,
1165 SMB_VFS_LAYER_TRANSPARENT},
1166
1167 {SMB_VFS_OP(hpuxacl_sys_acl_set_fd),
1168 SMB_VFS_OP_SYS_ACL_SET_FD,
1169 SMB_VFS_LAYER_TRANSPARENT},
1170
1171 {SMB_VFS_OP(hpuxacl_sys_acl_delete_def_file),
1172 SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE,
1173 SMB_VFS_LAYER_TRANSPARENT},
1174
1175 {SMB_VFS_OP(NULL),
1176 SMB_VFS_OP_NOOP,
1177 SMB_VFS_LAYER_NOOP}
1178};
1179
1180NTSTATUS vfs_hpuxacl_init(void)
1181{
1182 return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "hpuxacl",
1183 hpuxacl_op_tuples);
1184}
1185
1186/* ENTE */
Note: See TracBrowser for help on using the repository browser.