source: branches/samba-3.3.x/source/smbd/file_access.c

Last change on this file was 274, checked in by Herwig Bauernfeind, 16 years ago

Update 3.3 branch to 3.3.5
File size: 7.0 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 Check access to files based on security descriptors.
4 Copyright (C) Jeremy Allison 2005-2006.
5 Copyright (C) Michael Adam 2007.
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19*/
20
21#include "includes.h"
22
23#undef DBGC_CLASS
24#define DBGC_CLASS DBGC_ACLS
25
26/**
27 * Security descriptor / NT Token level access check function.
28 */
29bool can_access_file_acl(struct connection_struct *conn,
30 const char * fname,
31 uint32_t access_mask)
32{
33 NTSTATUS status;
34 uint32_t access_granted;
35 struct security_descriptor *secdesc = NULL;
36
37 if (conn->server_info->utok.uid == 0 || conn->admin_user) {
38 /* I'm sorry sir, I didn't know you were root... */
39 return true;
40 }
41
42 status = SMB_VFS_GET_NT_ACL(conn, fname,
43 (OWNER_SECURITY_INFORMATION |
44 GROUP_SECURITY_INFORMATION |
45 DACL_SECURITY_INFORMATION),
46 &secdesc);
47 if (!NT_STATUS_IS_OK(status)) {
48 DEBUG(5, ("Could not get acl: %s\n", nt_errstr(status)));
49 return false;
50 }
51
52 status = se_access_check(secdesc, conn->server_info->ptok,
53 access_mask, &access_granted);
54 TALLOC_FREE(secdesc);
55 return NT_STATUS_IS_OK(status);
56}
57
58/****************************************************************************
59 Actually emulate the in-kernel access checking for delete access. We need
60 this to successfully return ACCESS_DENIED on a file open for delete access.
61****************************************************************************/
62
63bool can_delete_file_in_directory(connection_struct *conn, const char *fname)
64{
65 SMB_STRUCT_STAT sbuf;
66 TALLOC_CTX *ctx = talloc_tos();
67 char *dname = NULL;
68
69 if (!CAN_WRITE(conn)) {
70 return False;
71 }
72
73 /* Get the parent directory permission mask and owners. */
74 if (!parent_dirname_talloc(ctx,
75 fname,
76 &dname,
77 NULL)) {
78 return False;
79 }
80 if(SMB_VFS_STAT(conn, dname, &sbuf) != 0) {
81 return False;
82 }
83
84 /* fast paths first */
85
86 if (!S_ISDIR(sbuf.st_mode)) {
87 return False;
88 }
89 if (conn->server_info->utok.uid == 0 || conn->admin_user) {
90 /* I'm sorry sir, I didn't know you were root... */
91 return True;
92 }
93
94#ifdef S_ISVTX
95 /* sticky bit means delete only by owner of file or by root or
96 * by owner of directory. */
97 if (sbuf.st_mode & S_ISVTX) {
98 SMB_STRUCT_STAT sbuf_file;
99 if(SMB_VFS_STAT(conn, fname, &sbuf_file) != 0) {
100 if (errno == ENOENT) {
101 /* If the file doesn't already exist then
102 * yes we'll be able to delete it. */
103 return True;
104 }
105 DEBUG(10,("can_delete_file_in_directory: can't "
106 "stat file %s (%s)",
107 fname, strerror(errno) ));
108 return False;
109 }
110 /*
111 * Patch from SATOH Fumiyasu <fumiyas@miraclelinux.com>
112 * for bug #3348. Don't assume owning sticky bit
113 * directory means write access allowed.
114 * Fail to delete if we're not the owner of the file,
115 * or the owner of the directory as we have no possible
116 * chance of deleting. Otherwise, go on and check the ACL.
117 */
118 if ((conn->server_info->utok.uid != sbuf.st_uid) &&
119 (conn->server_info->utok.uid != sbuf_file.st_uid)) {
120 DEBUG(10,("can_delete_file_in_directory: not "
121 "owner of file %s or directory %s",
122 fname, dname));
123 return False;
124 }
125 }
126#endif
127
128 /* now for ACL checks */
129
130 /*
131 * There's two ways to get the permission to delete a file: First by
132 * having the DELETE bit on the file itself and second if that does
133 * not help, by the DELETE_CHILD bit on the containing directory.
134 *
135 * Here we only check the directory permissions, we will
136 * check the file DELETE permission separately.
137 */
138
139 return can_access_file_acl(conn, dname, FILE_DELETE_CHILD);
140}
141
142/****************************************************************************
143 Actually emulate the in-kernel access checking for read/write access. We need
144 this to successfully check for ability to write for dos filetimes.
145 Note this doesn't take into account share write permissions.
146****************************************************************************/
147
148bool can_access_file_data(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *psbuf, uint32 access_mask)
149{
150 if (!(access_mask & (FILE_READ_DATA|FILE_WRITE_DATA))) {
151 return False;
152 }
153 access_mask &= (FILE_READ_DATA|FILE_WRITE_DATA);
154
155 /* some fast paths first */
156
157 DEBUG(10,("can_access_file_data: requesting 0x%x on file %s\n",
158 (unsigned int)access_mask, fname ));
159
160 if (conn->server_info->utok.uid == 0 || conn->admin_user) {
161 /* I'm sorry sir, I didn't know you were root... */
162 return True;
163 }
164
165 if (!VALID_STAT(*psbuf)) {
166 /* Get the file permission mask and owners. */
167 if(SMB_VFS_STAT(conn, fname, psbuf) != 0) {
168 return False;
169 }
170 }
171
172 /* Check primary owner access. */
173 if (conn->server_info->utok.uid == psbuf->st_uid) {
174 switch (access_mask) {
175 case FILE_READ_DATA:
176 return (psbuf->st_mode & S_IRUSR) ? True : False;
177
178 case FILE_WRITE_DATA:
179 return (psbuf->st_mode & S_IWUSR) ? True : False;
180
181 default: /* FILE_READ_DATA|FILE_WRITE_DATA */
182
183 if ((psbuf->st_mode & (S_IWUSR|S_IRUSR)) == (S_IWUSR|S_IRUSR)) {
184 return True;
185 } else {
186 return False;
187 }
188 }
189 }
190
191 /* now for ACL checks */
192
193 return can_access_file_acl(conn, fname, access_mask);
194}
195
196/****************************************************************************
197 Userspace check for write access.
198 Note this doesn't take into account share write permissions.
199****************************************************************************/
200
201bool can_write_to_file(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *psbuf)
202{
203 return can_access_file_data(conn, fname, psbuf, FILE_WRITE_DATA);
204}
205
206/****************************************************************************
207 Check for an existing default Windows ACL on a directory.
208****************************************************************************/
209
210bool directory_has_default_acl(connection_struct *conn, const char *fname)
211{
212 /* returns talloced off tos. */
213 struct security_descriptor *secdesc = NULL;
214 unsigned int i;
215 NTSTATUS status = SMB_VFS_GET_NT_ACL(conn, fname,
216 DACL_SECURITY_INFORMATION, &secdesc);
217
218 if (!NT_STATUS_IS_OK(status) || secdesc == NULL) {
219 return false;
220 }
221
222 for (i = 0; i < secdesc->dacl->num_aces; i++) {
223 struct security_ace *psa = &secdesc->dacl->aces[i];
224 if (psa->flags & (SEC_ACE_FLAG_OBJECT_INHERIT|
225 SEC_ACE_FLAG_CONTAINER_INHERIT)) {
226 TALLOC_FREE(secdesc);
227 return true;
228 }
229 }
230 TALLOC_FREE(secdesc);
231 return false;
232}
Note: See TracBrowser for help on using the repository browser.