Context Navigation

← Previous Revision
Next Revision →
Blame
Revision Log

posix_acls.c

Visit:

Last change on this file was 862, checked in by Silvan Scherrer, 11 years ago
Samba Server: update trunk to 3.6.23
File size: 138.3 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3	SMB NT Security Descriptor / Unix permission conversion.
4	Copyright (C) Jeremy Allison 1994-2009.
5	Copyright (C) Andreas Gruenbacher 2002.
6	Copyright (C) Simo Sorce <idra@samba.org> 2009.
7
8	This program is free software; you can redistribute it and/or modify
9	it under the terms of the GNU General Public License as published by
10	the Free Software Foundation; either version 3 of the License, or
11	(at your option) any later version.
12
13	This program is distributed in the hope that it will be useful,
14	but WITHOUT ANY WARRANTY; without even the implied warranty of
15	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16	GNU General Public License for more details.
17
18	You should have received a copy of the GNU General Public License
19	along with this program. If not, see <http://www.gnu.org/licenses/>.
20	*/
21
22	#include "includes.h"
23	#include "smbd/smbd.h"
24	#include "system/filesys.h"
25	#include "../libcli/security/security.h"
26	#include "trans2.h"
27	#include "passdb/lookup_sid.h"
28	#include "auth.h"
29
30	extern const struct generic_mapping file_generic_mapping;
31
32	#undef DBGC_CLASS
33	#define DBGC_CLASS DBGC_ACLS
34
35	/****************************************************************************
36	Data structures representing the internal ACE format.
37	****************************************************************************/
38
39	enum ace_owner {UID_ACE, GID_ACE, WORLD_ACE};
40	enum ace_attribute {ALLOW_ACE, DENY_ACE}; /* Used for incoming NT ACLS. */
41
42	typedef union posix_id {
43	uid_t uid;
44	gid_t gid;
45	int world;
46	} posix_id;
47
48	typedef struct canon_ace {
49	struct canon_ace next, prev;
50	SMB_ACL_TAG_T type;
51	mode_t perms; /* Only use S_I(R\|W\|X)USR mode bits here. */
52	struct dom_sid trustee;
53	enum ace_owner owner_type;
54	enum ace_attribute attr;
55	posix_id unix_ug;
56	uint8_t ace_flags; /* From windows ACE entry. */
57	} canon_ace;
58
59	#define ALL_ACE_PERMS (S_IRUSR\|S_IWUSR\|S_IXUSR)
60
61	/*
62	* EA format of user.SAMBA_PAI (Samba_Posix_Acl_Interitance)
63	* attribute on disk - version 1.
64	* All values are little endian.
65	*
66	* \| 1 \| 1 \| 2 \| 2 \| ....
67	* +------+------+-------------+---------------------+-------------+--------------------+
68	* \| vers \| flag \| num_entries \| num_default_entries \| ..entries.. \| default_entries... \|
69	* +------+------+-------------+---------------------+-------------+--------------------+
70	*
71	* Entry format is :
72	*
73	* \| 1 \| 4 \|
74	* +------+-------------------+
75	* \| value\| uid/gid or world \|
76	* \| type \| value \|
77	* +------+-------------------+
78	*
79	* Version 2 format. Stores extra Windows metadata about an ACL.
80	*
81	* \| 1 \| 2 \| 2 \| 2 \| ....
82	* +------+----------+-------------+---------------------+-------------+--------------------+
83	* \| vers \| ace \| num_entries \| num_default_entries \| ..entries.. \| default_entries... \|
84	* \| 2 \| type \| \| \| \| \|
85	* +------+----------+-------------+---------------------+-------------+--------------------+
86	*
87	* Entry format is :
88	*
89	* \| 1 \| 1 \| 4 \|
90	* +------+------+-------------------+
91	* \| ace \| value\| uid/gid or world \|
92	* \| flag \| type \| value \|
93	* +------+-------------------+------+
94	*
95	*/
96
97	#define PAI_VERSION_OFFSET 0
98
99	#define PAI_V1_FLAG_OFFSET 1
100	#define PAI_V1_NUM_ENTRIES_OFFSET 2
101	#define PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET 4
102	#define PAI_V1_ENTRIES_BASE 6
103	#define PAI_V1_ACL_FLAG_PROTECTED 0x1
104	#define PAI_V1_ENTRY_LENGTH 5
105
106	#define PAI_V1_VERSION 1
107
108	#define PAI_V2_TYPE_OFFSET 1
109	#define PAI_V2_NUM_ENTRIES_OFFSET 3
110	#define PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET 5
111	#define PAI_V2_ENTRIES_BASE 7
112	#define PAI_V2_ENTRY_LENGTH 6
113
114	#define PAI_V2_VERSION 2
115
116	/*
117	* In memory format of user.SAMBA_PAI attribute.
118	*/
119
120	struct pai_entry {
121	struct pai_entry next, prev;
122	uint8_t ace_flags;
123	enum ace_owner owner_type;
124	posix_id unix_ug;
125	};
126
127	struct pai_val {
128	uint16_t sd_type;
129	unsigned int num_entries;
130	struct pai_entry *entry_list;
131	unsigned int num_def_entries;
132	struct pai_entry *def_entry_list;
133	};
134
135	/************************************************************************
136	Return a uint32 of the pai_entry principal.
137	************************************************************************/
138
139	static uint32_t get_pai_entry_val(struct pai_entry *paie)
140	{
141	switch (paie->owner_type) {
142	case UID_ACE:
143	DEBUG(10,("get_pai_entry_val: uid = %u\n", (unsigned int)paie->unix_ug.uid ));
144	return (uint32_t)paie->unix_ug.uid;
145	case GID_ACE:
146	DEBUG(10,("get_pai_entry_val: gid = %u\n", (unsigned int)paie->unix_ug.gid ));
147	return (uint32_t)paie->unix_ug.gid;
148	case WORLD_ACE:
149	default:
150	DEBUG(10,("get_pai_entry_val: world ace\n"));
151	return (uint32_t)-1;
152	}
153	}
154
155	/************************************************************************
156	Return a uint32 of the entry principal.
157	************************************************************************/
158
159	static uint32_t get_entry_val(canon_ace *ace_entry)
160	{
161	switch (ace_entry->owner_type) {
162	case UID_ACE:
163	DEBUG(10,("get_entry_val: uid = %u\n", (unsigned int)ace_entry->unix_ug.uid ));
164	return (uint32_t)ace_entry->unix_ug.uid;
165	case GID_ACE:
166	DEBUG(10,("get_entry_val: gid = %u\n", (unsigned int)ace_entry->unix_ug.gid ));
167	return (uint32_t)ace_entry->unix_ug.gid;
168	case WORLD_ACE:
169	default:
170	DEBUG(10,("get_entry_val: world ace\n"));
171	return (uint32_t)-1;
172	}
173	}
174
175	/************************************************************************
176	Create the on-disk format (always v2 now). Caller must free.
177	************************************************************************/
178
179	static char create_pai_buf_v2(canon_ace file_ace_list,
180	canon_ace *dir_ace_list,
181	uint16_t sd_type,
182	size_t *store_size)
183	{
184	char *pai_buf = NULL;
185	canon_ace *ace_list = NULL;
186	char *entry_offset = NULL;
187	unsigned int num_entries = 0;
188	unsigned int num_def_entries = 0;
189	unsigned int i;
190
191	for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next) {
192	num_entries++;
193	}
194
195	for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next) {
196	num_def_entries++;
197	}
198
199	DEBUG(10,("create_pai_buf_v2: num_entries = %u, num_def_entries = %u\n", num_entries, num_def_entries ));
200
201	*store_size = PAI_V2_ENTRIES_BASE +
202	((num_entries + num_def_entries)*PAI_V2_ENTRY_LENGTH);
203
204	pai_buf = (char )SMB_MALLOC(store_size);
205	if (!pai_buf) {
206	return NULL;
207	}
208
209	/* Set up the header. */
210	memset(pai_buf, '\0', PAI_V2_ENTRIES_BASE);
211	SCVAL(pai_buf,PAI_VERSION_OFFSET,PAI_V2_VERSION);
212	SSVAL(pai_buf,PAI_V2_TYPE_OFFSET, sd_type);
213	SSVAL(pai_buf,PAI_V2_NUM_ENTRIES_OFFSET,num_entries);
214	SSVAL(pai_buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET,num_def_entries);
215
216	DEBUG(10,("create_pai_buf_v2: sd_type = 0x%x\n",
217	(unsigned int)sd_type ));
218
219	entry_offset = pai_buf + PAI_V2_ENTRIES_BASE;
220
221	i = 0;
222	for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next) {
223	uint8_t type_val = (uint8_t)ace_list->owner_type;
224	uint32_t entry_val = get_entry_val(ace_list);
225
226	SCVAL(entry_offset,0,ace_list->ace_flags);
227	SCVAL(entry_offset,1,type_val);
228	SIVAL(entry_offset,2,entry_val);
229	DEBUG(10,("create_pai_buf_v2: entry %u [0x%x] [0x%x] [0x%x]\n",
230	i,
231	(unsigned int)ace_list->ace_flags,
232	(unsigned int)type_val,
233	(unsigned int)entry_val ));
234	i++;
235	entry_offset += PAI_V2_ENTRY_LENGTH;
236	}
237
238	for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next) {
239	uint8_t type_val = (uint8_t)ace_list->owner_type;
240	uint32_t entry_val = get_entry_val(ace_list);
241
242	SCVAL(entry_offset,0,ace_list->ace_flags);
243	SCVAL(entry_offset,1,type_val);
244	SIVAL(entry_offset,2,entry_val);
245	DEBUG(10,("create_pai_buf_v2: entry %u [0x%x] [0x%x] [0x%x]\n",
246	i,
247	(unsigned int)ace_list->ace_flags,
248	(unsigned int)type_val,
249	(unsigned int)entry_val ));
250	i++;
251	entry_offset += PAI_V2_ENTRY_LENGTH;
252	}
253
254	return pai_buf;
255	}
256
257	/************************************************************************
258	Store the user.SAMBA_PAI attribute on disk.
259	************************************************************************/
260
261	static void store_inheritance_attributes(files_struct *fsp,
262	canon_ace *file_ace_list,
263	canon_ace *dir_ace_list,
264	uint16_t sd_type)
265	{
266	int ret;
267	size_t store_size;
268	char *pai_buf;
269
270	if (!lp_map_acl_inherit(SNUM(fsp->conn))) {
271	return;
272	}
273
274	pai_buf = create_pai_buf_v2(file_ace_list, dir_ace_list,
275	sd_type, &store_size);
276
277	if (fsp->fh->fd != -1) {
278	ret = SMB_VFS_FSETXATTR(fsp, SAMBA_POSIX_INHERITANCE_EA_NAME,
279	pai_buf, store_size, 0);
280	} else {
281	ret = SMB_VFS_SETXATTR(fsp->conn, fsp->fsp_name->base_name,
282	SAMBA_POSIX_INHERITANCE_EA_NAME,
283	pai_buf, store_size, 0);
284	}
285
286	SAFE_FREE(pai_buf);
287
288	DEBUG(10,("store_inheritance_attribute: type 0x%x for file %s\n",
289	(unsigned int)sd_type,
290	fsp_str_dbg(fsp)));
291
292	if (ret == -1 && !no_acl_syscall_error(errno)) {
293	DEBUG(1,("store_inheritance_attribute: Error %s\n", strerror(errno) ));
294	}
295	}
296
297	/************************************************************************
298	Delete the in memory inheritance info.
299	************************************************************************/
300
301	static void free_inherited_info(struct pai_val *pal)
302	{
303	if (pal) {
304	struct pai_entry paie, paie_next;
305	for (paie = pal->entry_list; paie; paie = paie_next) {
306	paie_next = paie->next;
307	SAFE_FREE(paie);
308	}
309	for (paie = pal->def_entry_list; paie; paie = paie_next) {
310	paie_next = paie->next;
311	SAFE_FREE(paie);
312	}
313	SAFE_FREE(pal);
314	}
315	}
316
317	/************************************************************************
318	Get any stored ACE flags.
319	************************************************************************/
320
321	static uint16_t get_pai_flags(struct pai_val pal, canon_ace ace_entry, bool default_ace)
322	{
323	struct pai_entry *paie;
324
325	if (!pal) {
326	return 0;
327	}
328
329	/* If the entry exists it is inherited. */
330	for (paie = (default_ace ? pal->def_entry_list : pal->entry_list); paie; paie = paie->next) {
331	if (ace_entry->owner_type == paie->owner_type &&
332	get_entry_val(ace_entry) == get_pai_entry_val(paie))
333	return paie->ace_flags;
334	}
335	return 0;
336	}
337
338	/************************************************************************
339	Ensure an attribute just read is valid - v1.
340	************************************************************************/
341
342	static bool check_pai_ok_v1(const char *pai_buf, size_t pai_buf_data_size)
343	{
344	uint16 num_entries;
345	uint16 num_def_entries;
346
347	if (pai_buf_data_size < PAI_V1_ENTRIES_BASE) {
348	/* Corrupted - too small. */
349	return false;
350	}
351
352	if (CVAL(pai_buf,PAI_VERSION_OFFSET) != PAI_V1_VERSION) {
353	return false;
354	}
355
356	num_entries = SVAL(pai_buf,PAI_V1_NUM_ENTRIES_OFFSET);
357	num_def_entries = SVAL(pai_buf,PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET);
358
359	/* Check the entry lists match. */
360	/* Each entry is 5 bytes (type plus 4 bytes of uid or gid). */
361
362	if (((num_entries + num_def_entries)*PAI_V1_ENTRY_LENGTH) +
363	PAI_V1_ENTRIES_BASE != pai_buf_data_size) {
364	return false;
365	}
366
367	return true;
368	}
369
370	/************************************************************************
371	Ensure an attribute just read is valid - v2.
372	************************************************************************/
373
374	static bool check_pai_ok_v2(const char *pai_buf, size_t pai_buf_data_size)
375	{
376	uint16 num_entries;
377	uint16 num_def_entries;
378
379	if (pai_buf_data_size < PAI_V2_ENTRIES_BASE) {
380	/* Corrupted - too small. */
381	return false;
382	}
383
384	if (CVAL(pai_buf,PAI_VERSION_OFFSET) != PAI_V2_VERSION) {
385	return false;
386	}
387
388	num_entries = SVAL(pai_buf,PAI_V2_NUM_ENTRIES_OFFSET);
389	num_def_entries = SVAL(pai_buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET);
390
391	/* Check the entry lists match. */
392	/* Each entry is 6 bytes (flags + type + 4 bytes of uid or gid). */
393
394	if (((num_entries + num_def_entries)*PAI_V2_ENTRY_LENGTH) +
395	PAI_V2_ENTRIES_BASE != pai_buf_data_size) {
396	return false;
397	}
398
399	return true;
400	}
401
402	/************************************************************************
403	Decode the owner.
404	************************************************************************/
405
406	static bool get_pai_owner_type(struct pai_entry paie, const char entry_offset)
407	{
408	paie->owner_type = (enum ace_owner)CVAL(entry_offset,0);
409	switch( paie->owner_type) {
410	case UID_ACE:
411	paie->unix_ug.uid = (uid_t)IVAL(entry_offset,1);
412	DEBUG(10,("get_pai_owner_type: uid = %u\n",
413	(unsigned int)paie->unix_ug.uid ));
414	break;
415	case GID_ACE:
416	paie->unix_ug.gid = (gid_t)IVAL(entry_offset,1);
417	DEBUG(10,("get_pai_owner_type: gid = %u\n",
418	(unsigned int)paie->unix_ug.gid ));
419	break;
420	case WORLD_ACE:
421	paie->unix_ug.world = -1;
422	DEBUG(10,("get_pai_owner_type: world ace\n"));
423	break;
424	default:
425	DEBUG(10,("get_pai_owner_type: unknown type %u\n",
426	(unsigned int)paie->owner_type ));
427	return false;
428	}
429	return true;
430	}
431
432	/************************************************************************
433	Process v2 entries.
434	************************************************************************/
435
436	static const char create_pai_v1_entries(struct pai_val paiv,
437	const char *entry_offset,
438	bool def_entry)
439	{
440	int i;
441
442	for (i = 0; i < paiv->num_entries; i++) {
443	struct pai_entry *paie = SMB_MALLOC_P(struct pai_entry);
444	if (!paie) {
445	return NULL;
446	}
447
448	paie->ace_flags = SEC_ACE_FLAG_INHERITED_ACE;
449	if (!get_pai_owner_type(paie, entry_offset)) {
450	SAFE_FREE(paie);
451	return NULL;
452	}
453
454	if (!def_entry) {
455	DLIST_ADD(paiv->entry_list, paie);
456	} else {
457	DLIST_ADD(paiv->def_entry_list, paie);
458	}
459	entry_offset += PAI_V1_ENTRY_LENGTH;
460	}
461	return entry_offset;
462	}
463
464	/************************************************************************
465	Convert to in-memory format from version 1.
466	************************************************************************/
467
468	static struct pai_val create_pai_val_v1(const char buf, size_t size)
469	{
470	const char *entry_offset;
471	struct pai_val *paiv = NULL;
472
473	if (!check_pai_ok_v1(buf, size)) {
474	return NULL;
475	}
476
477	paiv = SMB_MALLOC_P(struct pai_val);
478	if (!paiv) {
479	return NULL;
480	}
481
482	memset(paiv, '\0', sizeof(struct pai_val));
483
484	paiv->sd_type = (CVAL(buf,PAI_V1_FLAG_OFFSET) == PAI_V1_ACL_FLAG_PROTECTED) ?
485	SEC_DESC_DACL_PROTECTED : 0;
486
487	paiv->num_entries = SVAL(buf,PAI_V1_NUM_ENTRIES_OFFSET);
488	paiv->num_def_entries = SVAL(buf,PAI_V1_NUM_DEFAULT_ENTRIES_OFFSET);
489
490	entry_offset = buf + PAI_V1_ENTRIES_BASE;
491
492	DEBUG(10,("create_pai_val: num_entries = %u, num_def_entries = %u\n",
493	paiv->num_entries, paiv->num_def_entries ));
494
495	entry_offset = create_pai_v1_entries(paiv, entry_offset, false);
496	if (entry_offset == NULL) {
497	free_inherited_info(paiv);
498	return NULL;
499	}
500	entry_offset = create_pai_v1_entries(paiv, entry_offset, true);
501	if (entry_offset == NULL) {
502	free_inherited_info(paiv);
503	return NULL;
504	}
505
506	return paiv;
507	}
508
509	/************************************************************************
510	Process v2 entries.
511	************************************************************************/
512
513	static const char create_pai_v2_entries(struct pai_val paiv,
514	unsigned int num_entries,
515	const char *entry_offset,
516	bool def_entry)
517	{
518	unsigned int i;
519
520	for (i = 0; i < num_entries; i++) {
521	struct pai_entry *paie = SMB_MALLOC_P(struct pai_entry);
522	if (!paie) {
523	return NULL;
524	}
525
526	paie->ace_flags = CVAL(entry_offset,0);
527
528	if (!get_pai_owner_type(paie, entry_offset+1)) {
529	SAFE_FREE(paie);
530	return NULL;
531	}
532	if (!def_entry) {
533	DLIST_ADD(paiv->entry_list, paie);
534	} else {
535	DLIST_ADD(paiv->def_entry_list, paie);
536	}
537	entry_offset += PAI_V2_ENTRY_LENGTH;
538	}
539	return entry_offset;
540	}
541
542	/************************************************************************
543	Convert to in-memory format from version 2.
544	************************************************************************/
545
546	static struct pai_val create_pai_val_v2(const char buf, size_t size)
547	{
548	const char *entry_offset;
549	struct pai_val *paiv = NULL;
550
551	if (!check_pai_ok_v2(buf, size)) {
552	return NULL;
553	}
554
555	paiv = SMB_MALLOC_P(struct pai_val);
556	if (!paiv) {
557	return NULL;
558	}
559
560	memset(paiv, '\0', sizeof(struct pai_val));
561
562	paiv->sd_type = SVAL(buf,PAI_V2_TYPE_OFFSET);
563
564	paiv->num_entries = SVAL(buf,PAI_V2_NUM_ENTRIES_OFFSET);
565	paiv->num_def_entries = SVAL(buf,PAI_V2_NUM_DEFAULT_ENTRIES_OFFSET);
566
567	entry_offset = buf + PAI_V2_ENTRIES_BASE;
568
569	DEBUG(10,("create_pai_val_v2: sd_type = 0x%x num_entries = %u, num_def_entries = %u\n",
570	(unsigned int)paiv->sd_type,
571	paiv->num_entries, paiv->num_def_entries ));
572
573	entry_offset = create_pai_v2_entries(paiv, paiv->num_entries,
574	entry_offset, false);
575	if (entry_offset == NULL) {
576	free_inherited_info(paiv);
577	return NULL;
578	}
579	entry_offset = create_pai_v2_entries(paiv, paiv->num_def_entries,
580	entry_offset, true);
581	if (entry_offset == NULL) {
582	free_inherited_info(paiv);
583	return NULL;
584	}
585
586	return paiv;
587	}
588
589	/************************************************************************
590	Convert to in-memory format - from either version 1 or 2.
591	************************************************************************/
592
593	static struct pai_val create_pai_val(const char buf, size_t size)
594	{
595	if (size < 1) {
596	return NULL;
597	}
598	if (CVAL(buf,PAI_VERSION_OFFSET) == PAI_V1_VERSION) {
599	return create_pai_val_v1(buf, size);
600	} else if (CVAL(buf,PAI_VERSION_OFFSET) == PAI_V2_VERSION) {
601	return create_pai_val_v2(buf, size);
602	} else {
603	return NULL;
604	}
605	}
606
607	/************************************************************************
608	Load the user.SAMBA_PAI attribute.
609	************************************************************************/
610
611	static struct pai_val fload_inherited_info(files_struct fsp)
612	{
613	char *pai_buf;
614	size_t pai_buf_size = 1024;
615	struct pai_val *paiv = NULL;
616	ssize_t ret;
617
618	if (!lp_map_acl_inherit(SNUM(fsp->conn))) {
619	return NULL;
620	}
621
622	if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL) {
623	return NULL;
624	}
625
626	do {
627	if (fsp->fh->fd != -1) {
628	ret = SMB_VFS_FGETXATTR(fsp, SAMBA_POSIX_INHERITANCE_EA_NAME,
629	pai_buf, pai_buf_size);
630	} else {
631	ret = SMB_VFS_GETXATTR(fsp->conn,
632	fsp->fsp_name->base_name,
633	SAMBA_POSIX_INHERITANCE_EA_NAME,
634	pai_buf, pai_buf_size);
635	}
636
637	if (ret == -1) {
638	if (errno != ERANGE) {
639	break;
640	}
641	/* Buffer too small - enlarge it. */
642	pai_buf_size *= 2;
643	SAFE_FREE(pai_buf);
644	if (pai_buf_size > 1024*1024) {
645	return NULL; /* Limit malloc to 1mb. */
646	}
647	if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL)
648	return NULL;
649	}
650	} while (ret == -1);
651
652	DEBUG(10,("load_inherited_info: ret = %lu for file %s\n",
653	(unsigned long)ret, fsp_str_dbg(fsp)));
654
655	if (ret == -1) {
656	/* No attribute or not supported. */
657	#if defined(ENOATTR)
658	if (errno != ENOATTR)
659	DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
660	#else
661	if (errno != ENOSYS)
662	DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
663	#endif
664	SAFE_FREE(pai_buf);
665	return NULL;
666	}
667
668	paiv = create_pai_val(pai_buf, ret);
669
670	if (paiv) {
671	DEBUG(10,("load_inherited_info: ACL type is 0x%x for file %s\n",
672	(unsigned int)paiv->sd_type, fsp_str_dbg(fsp)));
673	}
674
675	SAFE_FREE(pai_buf);
676	return paiv;
677	}
678
679	/************************************************************************
680	Load the user.SAMBA_PAI attribute.
681	************************************************************************/
682
683	static struct pai_val load_inherited_info(const struct connection_struct conn,
684	const char *fname)
685	{
686	char *pai_buf;
687	size_t pai_buf_size = 1024;
688	struct pai_val *paiv = NULL;
689	ssize_t ret;
690
691	if (!lp_map_acl_inherit(SNUM(conn))) {
692	return NULL;
693	}
694
695	if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL) {
696	return NULL;
697	}
698
699	do {
700	ret = SMB_VFS_GETXATTR(conn, fname,
701	SAMBA_POSIX_INHERITANCE_EA_NAME,
702	pai_buf, pai_buf_size);
703
704	if (ret == -1) {
705	if (errno != ERANGE) {
706	break;
707	}
708	/* Buffer too small - enlarge it. */
709	pai_buf_size *= 2;
710	SAFE_FREE(pai_buf);
711	if (pai_buf_size > 1024*1024) {
712	return NULL; /* Limit malloc to 1mb. */
713	}
714	if ((pai_buf = (char *)SMB_MALLOC(pai_buf_size)) == NULL)
715	return NULL;
716	}
717	} while (ret == -1);
718
719	DEBUG(10,("load_inherited_info: ret = %lu for file %s\n", (unsigned long)ret, fname));
720
721	if (ret == -1) {
722	/* No attribute or not supported. */
723	#if defined(ENOATTR)
724	if (errno != ENOATTR)
725	DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
726	#else
727	if (errno != ENOSYS)
728	DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
729	#endif
730	SAFE_FREE(pai_buf);
731	return NULL;
732	}
733
734	paiv = create_pai_val(pai_buf, ret);
735
736	if (paiv) {
737	DEBUG(10,("load_inherited_info: ACL type 0x%x for file %s\n",
738	(unsigned int)paiv->sd_type,
739	fname));
740	}
741
742	SAFE_FREE(pai_buf);
743	return paiv;
744	}
745
746	/****************************************************************************
747	Functions to manipulate the internal ACE format.
748	****************************************************************************/
749
750	/****************************************************************************
751	Count a linked list of canonical ACE entries.
752	****************************************************************************/
753
754	static size_t count_canon_ace_list( canon_ace *l_head )
755	{
756	size_t count = 0;
757	canon_ace *ace;
758
759	for (ace = l_head; ace; ace = ace->next)
760	count++;
761
762	return count;
763	}
764
765	/****************************************************************************
766	Free a linked list of canonical ACE entries.
767	****************************************************************************/
768
769	static void free_canon_ace_list( canon_ace *l_head )
770	{
771	canon_ace list, next;
772
773	for (list = l_head; list; list = next) {
774	next = list->next;
775	DLIST_REMOVE(l_head, list);
776	SAFE_FREE(list);
777	}
778	}
779
780	/****************************************************************************
781	Function to duplicate a canon_ace entry.
782	****************************************************************************/
783
784	static canon_ace dup_canon_ace( canon_ace src_ace)
785	{
786	canon_ace *dst_ace = SMB_MALLOC_P(canon_ace);
787
788	if (dst_ace == NULL)
789	return NULL;
790
791	dst_ace = src_ace;
792	dst_ace->prev = dst_ace->next = NULL;
793	return dst_ace;
794	}
795
796	/****************************************************************************
797	Print out a canon ace.
798	****************************************************************************/
799
800	static void print_canon_ace(canon_ace *pace, int num)
801	{
802	dbgtext( "canon_ace index %d. Type = %s ", num, pace->attr == ALLOW_ACE ? "allow" : "deny" );
803	dbgtext( "SID = %s ", sid_string_dbg(&pace->trustee));
804	if (pace->owner_type == UID_ACE) {
805	const char *u_name = uidtoname(pace->unix_ug.uid);
806	dbgtext( "uid %u (%s) ", (unsigned int)pace->unix_ug.uid, u_name );
807	} else if (pace->owner_type == GID_ACE) {
808	char *g_name = gidtoname(pace->unix_ug.gid);
809	dbgtext( "gid %u (%s) ", (unsigned int)pace->unix_ug.gid, g_name );
810	} else
811	dbgtext( "other ");
812	switch (pace->type) {
813	case SMB_ACL_USER:
814	dbgtext( "SMB_ACL_USER ");
815	break;
816	case SMB_ACL_USER_OBJ:
817	dbgtext( "SMB_ACL_USER_OBJ ");
818	break;
819	case SMB_ACL_GROUP:
820	dbgtext( "SMB_ACL_GROUP ");
821	break;
822	case SMB_ACL_GROUP_OBJ:
823	dbgtext( "SMB_ACL_GROUP_OBJ ");
824	break;
825	case SMB_ACL_OTHER:
826	dbgtext( "SMB_ACL_OTHER ");
827	break;
828	default:
829	dbgtext( "MASK " );
830	break;
831	}
832
833	dbgtext( "ace_flags = 0x%x ", (unsigned int)pace->ace_flags);
834	dbgtext( "perms ");
835	dbgtext( "%c", pace->perms & S_IRUSR ? 'r' : '-');
836	dbgtext( "%c", pace->perms & S_IWUSR ? 'w' : '-');
837	dbgtext( "%c\n", pace->perms & S_IXUSR ? 'x' : '-');
838	}
839
840	/****************************************************************************
841	Print out a canon ace list.
842	****************************************************************************/
843
844	static void print_canon_ace_list(const char name, canon_ace ace_list)
845	{
846	int count = 0;
847
848	if( DEBUGLVL( 10 )) {
849	dbgtext( "print_canon_ace_list: %s\n", name );
850	for (;ace_list; ace_list = ace_list->next, count++)
851	print_canon_ace(ace_list, count );
852	}
853	}
854
855	/****************************************************************************
856	Map POSIX ACL perms to canon_ace permissions (a mode_t containing only S_(R\|W\|X)USR bits).
857	****************************************************************************/
858
859	static mode_t convert_permset_to_mode_t(connection_struct *conn, SMB_ACL_PERMSET_T permset)
860	{
861	mode_t ret = 0;
862
863	ret \|= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ) ? S_IRUSR : 0);
864	ret \|= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE) ? S_IWUSR : 0);
865	ret \|= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_EXECUTE) ? S_IXUSR : 0);
866
867	return ret;
868	}
869
870	/****************************************************************************
871	Map generic UNIX permissions to canon_ace permissions (a mode_t containing only S_(R\|W\|X)USR bits).
872	****************************************************************************/
873
874	static mode_t unix_perms_to_acl_perms(mode_t mode, int r_mask, int w_mask, int x_mask)
875	{
876	mode_t ret = 0;
877
878	if (mode & r_mask)
879	ret \|= S_IRUSR;
880	if (mode & w_mask)
881	ret \|= S_IWUSR;
882	if (mode & x_mask)
883	ret \|= S_IXUSR;
884
885	return ret;
886	}
887
888	/****************************************************************************
889	Map canon_ace permissions (a mode_t containing only S_(R\|W\|X)USR bits) to
890	an SMB_ACL_PERMSET_T.
891	****************************************************************************/
892
893	static int map_acl_perms_to_permset(connection_struct conn, mode_t mode, SMB_ACL_PERMSET_T p_permset)
894	{
895	if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn, *p_permset) == -1)
896	return -1;
897	if (mode & S_IRUSR) {
898	if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_READ) == -1)
899	return -1;
900	}
901	if (mode & S_IWUSR) {
902	if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_WRITE) == -1)
903	return -1;
904	}
905	if (mode & S_IXUSR) {
906	if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_EXECUTE) == -1)
907	return -1;
908	}
909	return 0;
910	}
911
912	/****************************************************************************
913	Function to create owner and group SIDs from a SMB_STRUCT_STAT.
914	****************************************************************************/
915
916	void create_file_sids(const SMB_STRUCT_STAT psbuf, struct dom_sid powner_sid, struct dom_sid *pgroup_sid)
917	{
918	uid_to_sid( powner_sid, psbuf->st_ex_uid );
919	gid_to_sid( pgroup_sid, psbuf->st_ex_gid );
920	}
921
922	/****************************************************************************
923	Merge aces with a common sid - if both are allow or deny, OR the permissions together and
924	delete the second one. If the first is deny, mask the permissions off and delete the allow
925	if the permissions become zero, delete the deny if the permissions are non zero.
926	****************************************************************************/
927
928	static void merge_aces( canon_ace **pp_list_head, bool dir_acl)
929	{
930	canon_ace l_head = pp_list_head;
931	canon_ace *curr_ace_outer;
932	canon_ace *curr_ace_outer_next;
933
934	/*
935	* First, merge allow entries with identical SIDs, and deny entries
936	* with identical SIDs.
937	*/
938
939	for (curr_ace_outer = l_head; curr_ace_outer; curr_ace_outer = curr_ace_outer_next) {
940	canon_ace *curr_ace;
941	canon_ace *curr_ace_next;
942
943	curr_ace_outer_next = curr_ace_outer->next; /* Save the link in case we delete. */
944
945	for (curr_ace = curr_ace_outer->next; curr_ace; curr_ace = curr_ace_next) {
946	bool can_merge = false;
947
948	curr_ace_next = curr_ace->next; /* Save the link in case of delete. */
949
950	/* For file ACLs we can merge if the SIDs and ALLOW/DENY
951	* types are the same. For directory acls we must also
952	* ensure the POSIX ACL types are the same. */
953
954	if (!dir_acl) {
955	can_merge = (dom_sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
956	(curr_ace->attr == curr_ace_outer->attr));
957	} else {
958	can_merge = (dom_sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
959	(curr_ace->type == curr_ace_outer->type) &&
960	(curr_ace->attr == curr_ace_outer->attr));
961	}
962
963	if (can_merge) {
964	if( DEBUGLVL( 10 )) {
965	dbgtext("merge_aces: Merging ACE's\n");
966	print_canon_ace( curr_ace_outer, 0);
967	print_canon_ace( curr_ace, 0);
968	}
969
970	/* Merge two allow or two deny ACE's. */
971
972	/* Theoretically we shouldn't merge a dir ACE if
973	* one ACE has the CI flag set, and the other
974	* ACE has the OI flag set, but this is rare
975	* enough we can ignore it. */
976
977	curr_ace_outer->perms \|= curr_ace->perms;
978	curr_ace_outer->ace_flags \|= curr_ace->ace_flags;
979	DLIST_REMOVE(l_head, curr_ace);
980	SAFE_FREE(curr_ace);
981	curr_ace_outer_next = curr_ace_outer->next; /* We may have deleted the link. */
982	}
983	}
984	}
985
986	/*
987	* Now go through and mask off allow permissions with deny permissions.
988	* We can delete either the allow or deny here as we know that each SID
989	* appears only once in the list.
990	*/
991
992	for (curr_ace_outer = l_head; curr_ace_outer; curr_ace_outer = curr_ace_outer_next) {
993	canon_ace *curr_ace;
994	canon_ace *curr_ace_next;
995
996	curr_ace_outer_next = curr_ace_outer->next; /* Save the link in case we delete. */
997
998	for (curr_ace = curr_ace_outer->next; curr_ace; curr_ace = curr_ace_next) {
999
1000	curr_ace_next = curr_ace->next; /* Save the link in case of delete. */
1001
1002	/*
1003	* Subtract ACE's with different entries. Due to the ordering constraints
1004	* we've put on the ACL, we know the deny must be the first one.
1005	*/
1006
1007	if (dom_sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
1008	(curr_ace_outer->attr == DENY_ACE) && (curr_ace->attr == ALLOW_ACE)) {
1009
1010	if( DEBUGLVL( 10 )) {
1011	dbgtext("merge_aces: Masking ACE's\n");
1012	print_canon_ace( curr_ace_outer, 0);
1013	print_canon_ace( curr_ace, 0);
1014	}
1015
1016	curr_ace->perms &= ~curr_ace_outer->perms;
1017
1018	if (curr_ace->perms == 0) {
1019
1020	/*
1021	* The deny overrides the allow. Remove the allow.
1022	*/
1023
1024	DLIST_REMOVE(l_head, curr_ace);
1025	SAFE_FREE(curr_ace);
1026	curr_ace_outer_next = curr_ace_outer->next; /* We may have deleted the link. */
1027
1028	} else {
1029
1030	/*
1031	* Even after removing permissions, there
1032	* are still allow permissions - delete the deny.
1033	* It is safe to delete the deny here,
1034	* as we are guarenteed by the deny first
1035	* ordering that all the deny entries for
1036	* this SID have already been merged into one
1037	* before we can get to an allow ace.
1038	*/
1039
1040	DLIST_REMOVE(l_head, curr_ace_outer);
1041	SAFE_FREE(curr_ace_outer);
1042	break;
1043	}
1044	}
1045
1046	} /* end for curr_ace */
1047	} /* end for curr_ace_outer */
1048
1049	/* We may have modified the list. */
1050
1051	*pp_list_head = l_head;
1052	}
1053
1054	/****************************************************************************
1055	Check if we need to return NT4.x compatible ACL entries.
1056	****************************************************************************/
1057
1058	bool nt4_compatible_acls(void)
1059	{
1060	int compat = lp_acl_compatibility();
1061
1062	if (compat == ACL_COMPAT_AUTO) {
1063	enum remote_arch_types ra_type = get_remote_arch();
1064
1065	/* Automatically adapt to client */
1066	return (ra_type <= RA_WINNT);
1067	} else
1068	return (compat == ACL_COMPAT_WINNT);
1069	}
1070
1071
1072	/****************************************************************************
1073	Map canon_ace perms to permission bits NT.
1074	The attr element is not used here - we only process deny entries on set,
1075	not get. Deny entries are implicit on get with ace->perms = 0.
1076	****************************************************************************/
1077
1078	uint32_t map_canon_ace_perms(int snum,
1079	enum security_ace_type *pacl_type,
1080	mode_t perms,
1081	bool directory_ace)
1082	{
1083	uint32_t nt_mask = 0;
1084
1085	*pacl_type = SEC_ACE_TYPE_ACCESS_ALLOWED;
1086
1087	if (lp_acl_map_full_control(snum) && ((perms & ALL_ACE_PERMS) == ALL_ACE_PERMS)) {
1088	if (directory_ace) {
1089	nt_mask = UNIX_DIRECTORY_ACCESS_RWX;
1090	} else {
1091	nt_mask = (UNIX_ACCESS_RWX & ~DELETE_ACCESS);
1092	}
1093	} else if ((perms & ALL_ACE_PERMS) == (mode_t)0) {
1094	/*
1095	* Windows NT refuses to display ACEs with no permissions in them (but
1096	* they are perfectly legal with Windows 2000). If the ACE has empty
1097	* permissions we cannot use 0, so we use the otherwise unused
1098	* WRITE_OWNER permission, which we ignore when we set an ACL.
1099	* We abstract this into a #define of UNIX_ACCESS_NONE to allow this
1100	* to be changed in the future.
1101	*/
1102
1103	if (nt4_compatible_acls())
1104	nt_mask = UNIX_ACCESS_NONE;
1105	else
1106	nt_mask = 0;
1107	} else {
1108	if (directory_ace) {
1109	nt_mask \|= ((perms & S_IRUSR) ? UNIX_DIRECTORY_ACCESS_R : 0 );
1110	nt_mask \|= ((perms & S_IWUSR) ? UNIX_DIRECTORY_ACCESS_W : 0 );
1111	nt_mask \|= ((perms & S_IXUSR) ? UNIX_DIRECTORY_ACCESS_X : 0 );
1112	} else {
1113	nt_mask \|= ((perms & S_IRUSR) ? UNIX_ACCESS_R : 0 );
1114	nt_mask \|= ((perms & S_IWUSR) ? UNIX_ACCESS_W : 0 );
1115	nt_mask \|= ((perms & S_IXUSR) ? UNIX_ACCESS_X : 0 );
1116	}
1117	}
1118
1119	if ((perms & S_IWUSR) && lp_dos_filemode(snum)) {
1120	nt_mask \|= (SEC_STD_WRITE_DAC\|SEC_STD_WRITE_OWNER\|DELETE_ACCESS);
1121	}
1122
1123	DEBUG(10,("map_canon_ace_perms: Mapped (UNIX) %x to (NT) %x\n",
1124	(unsigned int)perms, (unsigned int)nt_mask ));
1125
1126	return nt_mask;
1127	}
1128
1129	/****************************************************************************
1130	Map NT perms to a UNIX mode_t.
1131	****************************************************************************/
1132
1133	#define FILE_SPECIFIC_READ_BITS (FILE_READ_DATA\|FILE_READ_EA)
1134	#define FILE_SPECIFIC_WRITE_BITS (FILE_WRITE_DATA\|FILE_APPEND_DATA\|FILE_WRITE_EA)
1135	#define FILE_SPECIFIC_EXECUTE_BITS (FILE_EXECUTE)
1136
1137	static mode_t map_nt_perms( uint32 *mask, int type)
1138	{
1139	mode_t mode = 0;
1140
1141	switch(type) {
1142	case S_IRUSR:
1143	if((*mask) & GENERIC_ALL_ACCESS)
1144	mode = S_IRUSR\|S_IWUSR\|S_IXUSR;
1145	else {
1146	mode \|= ((*mask) & (GENERIC_READ_ACCESS\|FILE_SPECIFIC_READ_BITS)) ? S_IRUSR : 0;
1147	mode \|= ((*mask) & (GENERIC_WRITE_ACCESS\|FILE_SPECIFIC_WRITE_BITS)) ? S_IWUSR : 0;
1148	mode \|= ((*mask) & (GENERIC_EXECUTE_ACCESS\|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXUSR : 0;
1149	}
1150	break;
1151	case S_IRGRP:
1152	if((*mask) & GENERIC_ALL_ACCESS)
1153	mode = S_IRGRP\|S_IWGRP\|S_IXGRP;
1154	else {
1155	mode \|= ((*mask) & (GENERIC_READ_ACCESS\|FILE_SPECIFIC_READ_BITS)) ? S_IRGRP : 0;
1156	mode \|= ((*mask) & (GENERIC_WRITE_ACCESS\|FILE_SPECIFIC_WRITE_BITS)) ? S_IWGRP : 0;
1157	mode \|= ((*mask) & (GENERIC_EXECUTE_ACCESS\|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXGRP : 0;
1158	}
1159	break;
1160	case S_IROTH:
1161	if((*mask) & GENERIC_ALL_ACCESS)
1162	mode = S_IROTH\|S_IWOTH\|S_IXOTH;
1163	else {
1164	mode \|= ((*mask) & (GENERIC_READ_ACCESS\|FILE_SPECIFIC_READ_BITS)) ? S_IROTH : 0;
1165	mode \|= ((*mask) & (GENERIC_WRITE_ACCESS\|FILE_SPECIFIC_WRITE_BITS)) ? S_IWOTH : 0;
1166	mode \|= ((*mask) & (GENERIC_EXECUTE_ACCESS\|FILE_SPECIFIC_EXECUTE_BITS)) ? S_IXOTH : 0;
1167	}
1168	break;
1169	}
1170
1171	return mode;
1172	}
1173
1174	/****************************************************************************
1175	Unpack a struct security_descriptor into a UNIX owner and group.
1176	****************************************************************************/
1177
1178	NTSTATUS unpack_nt_owners(struct connection_struct *conn,
1179	uid_t puser, gid_t pgrp,
1180	uint32 security_info_sent, const struct
1181	security_descriptor *psd)
1182	{
1183	struct dom_sid owner_sid;
1184	struct dom_sid grp_sid;
1185
1186	*puser = (uid_t)-1;
1187	*pgrp = (gid_t)-1;
1188
1189	if(security_info_sent == 0) {
1190	DEBUG(0,("unpack_nt_owners: no security info sent !\n"));
1191	return NT_STATUS_OK;
1192	}
1193
1194	/*
1195	* Validate the owner and group SID's.
1196	*/
1197
1198	memset(&owner_sid, '\0', sizeof(owner_sid));
1199	memset(&grp_sid, '\0', sizeof(grp_sid));
1200
1201	DEBUG(5,("unpack_nt_owners: validating owner_sids.\n"));
1202
1203	/*
1204	* Don't immediately fail if the owner sid cannot be validated.
1205	* This may be a group chown only set.
1206	*/
1207
1208	if (security_info_sent & SECINFO_OWNER) {
1209	sid_copy(&owner_sid, psd->owner_sid);
1210	if (!sid_to_uid(&owner_sid, puser)) {
1211	if (lp_force_unknown_acl_user(SNUM(conn))) {
1212	/* this allows take ownership to work
1213	* reasonably */
1214	*puser = get_current_uid(conn);
1215	} else {
1216	DEBUG(3,("unpack_nt_owners: unable to validate"
1217	" owner sid for %s\n",
1218	sid_string_dbg(&owner_sid)));
1219	return NT_STATUS_INVALID_OWNER;
1220	}
1221	}
1222	DEBUG(3,("unpack_nt_owners: owner sid mapped to uid %u\n",
1223	(unsigned int)*puser ));
1224	}
1225
1226	/*
1227	* Don't immediately fail if the group sid cannot be validated.
1228	* This may be an owner chown only set.
1229	*/
1230
1231	if (security_info_sent & SECINFO_GROUP) {
1232	sid_copy(&grp_sid, psd->group_sid);
1233	if (!sid_to_gid( &grp_sid, pgrp)) {
1234	if (lp_force_unknown_acl_user(SNUM(conn))) {
1235	/* this allows take group ownership to work
1236	* reasonably */
1237	*pgrp = get_current_gid(conn);
1238	} else {
1239	DEBUG(3,("unpack_nt_owners: unable to validate"
1240	" group sid.\n"));
1241	return NT_STATUS_INVALID_OWNER;
1242	}
1243	}
1244	DEBUG(3,("unpack_nt_owners: group sid mapped to gid %u\n",
1245	(unsigned int)*pgrp));
1246	}
1247
1248	DEBUG(5,("unpack_nt_owners: owner_sids validated.\n"));
1249
1250	return NT_STATUS_OK;
1251	}
1252
1253	/****************************************************************************
1254	Ensure the enforced permissions for this share apply.
1255	****************************************************************************/
1256
1257	static void apply_default_perms(const struct share_params *params,
1258	const bool is_directory, canon_ace *pace,
1259	mode_t type)
1260	{
1261	mode_t and_bits = (mode_t)0;
1262	mode_t or_bits = (mode_t)0;
1263
1264	/* Get the initial bits to apply. */
1265
1266	if (is_directory) {
1267	and_bits = lp_dir_security_mask(params->service);
1268	or_bits = lp_force_dir_security_mode(params->service);
1269	} else {
1270	and_bits = lp_security_mask(params->service);
1271	or_bits = lp_force_security_mode(params->service);
1272	}
1273
1274	/* Now bounce them into the S_USR space. */
1275	switch(type) {
1276	case S_IRUSR:
1277	/* Ensure owner has read access. */
1278	pace->perms \|= S_IRUSR;
1279	if (is_directory)
1280	pace->perms \|= (S_IWUSR\|S_IXUSR);
1281	and_bits = unix_perms_to_acl_perms(and_bits, S_IRUSR, S_IWUSR, S_IXUSR);
1282	or_bits = unix_perms_to_acl_perms(or_bits, S_IRUSR, S_IWUSR, S_IXUSR);
1283	break;
1284	case S_IRGRP:
1285	and_bits = unix_perms_to_acl_perms(and_bits, S_IRGRP, S_IWGRP, S_IXGRP);
1286	or_bits = unix_perms_to_acl_perms(or_bits, S_IRGRP, S_IWGRP, S_IXGRP);
1287	break;
1288	case S_IROTH:
1289	and_bits = unix_perms_to_acl_perms(and_bits, S_IROTH, S_IWOTH, S_IXOTH);
1290	or_bits = unix_perms_to_acl_perms(or_bits, S_IROTH, S_IWOTH, S_IXOTH);
1291	break;
1292	}
1293
1294	pace->perms = ((pace->perms & and_bits)\|or_bits);
1295	}
1296
1297	/****************************************************************************
1298	Check if a given uid/SID is in a group gid/SID. This is probably very
1299	expensive and will need optimisation. A lot of optimisation :-). JRA.
1300	****************************************************************************/
1301
1302	static bool uid_entry_in_group(connection_struct conn, canon_ace uid_ace, canon_ace *group_ace )
1303	{
1304	const char *u_name = NULL;
1305
1306	/* "Everyone" always matches every uid. */
1307
1308	if (dom_sid_equal(&group_ace->trustee, &global_sid_World))
1309	return True;
1310
1311	/*
1312	* if it's the current user, we already have the unix token
1313	* and don't need to do the complex user_in_group_sid() call
1314	*/
1315	if (uid_ace->unix_ug.uid == get_current_uid(conn)) {
1316	const struct security_unix_token *curr_utok = NULL;
1317	size_t i;
1318
1319	if (group_ace->unix_ug.gid == get_current_gid(conn)) {
1320	return True;
1321	}
1322
1323	curr_utok = get_current_utok(conn);
1324	for (i=0; i < curr_utok->ngroups; i++) {
1325	if (group_ace->unix_ug.gid == curr_utok->groups[i]) {
1326	return True;
1327	}
1328	}
1329	}
1330
1331	/* u_name talloc'ed off tos. */
1332	u_name = uidtoname(uid_ace->unix_ug.uid);
1333	if (!u_name) {
1334	return False;
1335	}
1336
1337	/*
1338	* user_in_group_sid() uses create_token_from_username()
1339	* which creates an artificial NT token given just a username,
1340	* so this is not reliable for users from foreign domains
1341	* exported by winbindd!
1342	*/
1343	return user_in_group_sid(u_name, &group_ace->trustee);
1344	}
1345
1346	/****************************************************************************
1347	A well formed POSIX file or default ACL has at least 3 entries, a
1348	SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ.
1349	In addition, the owner must always have at least read access.
1350	When using this call on get_acl, the pst struct is valid and contains
1351	the mode of the file. When using this call on set_acl, the pst struct has
1352	been modified to have a mode containing the default for this file or directory
1353	type.
1354	****************************************************************************/
1355
1356	static bool ensure_canon_entry_valid(connection_struct *conn,
1357	canon_ace **pp_ace,
1358	bool is_default_acl,
1359	const struct share_params *params,
1360	const bool is_directory,
1361	const struct dom_sid *pfile_owner_sid,
1362	const struct dom_sid *pfile_grp_sid,
1363	const SMB_STRUCT_STAT *pst,
1364	bool setting_acl)
1365	{
1366	canon_ace *pace;
1367	bool got_user = False;
1368	bool got_grp = False;
1369	bool got_other = False;
1370	canon_ace *pace_other = NULL;
1371
1372	for (pace = *pp_ace; pace; pace = pace->next) {
1373	if (pace->type == SMB_ACL_USER_OBJ) {
1374
1375	if (setting_acl) {
1376	/*
1377	* Ensure we have default parameters for the
1378	* user (owner) even on default ACLs.
1379	*/
1380	apply_default_perms(params, is_directory, pace, S_IRUSR);
1381	}
1382	got_user = True;
1383
1384	} else if (pace->type == SMB_ACL_GROUP_OBJ) {
1385
1386	/*
1387	* Ensure create mask/force create mode is respected on set.
1388	*/
1389
1390	if (setting_acl && !is_default_acl) {
1391	apply_default_perms(params, is_directory, pace, S_IRGRP);
1392	}
1393	got_grp = True;
1394
1395	} else if (pace->type == SMB_ACL_OTHER) {
1396
1397	/*
1398	* Ensure create mask/force create mode is respected on set.
1399	*/
1400
1401	if (setting_acl && !is_default_acl) {
1402	apply_default_perms(params, is_directory, pace, S_IROTH);
1403	}
1404	got_other = True;
1405	pace_other = pace;
1406
1407	} else if (pace->type == SMB_ACL_USER \|\| pace->type == SMB_ACL_GROUP) {
1408
1409	/*
1410	* Ensure create mask/force create mode is respected on set.
1411	*/
1412
1413	if (setting_acl && !is_default_acl) {
1414	apply_default_perms(params, is_directory, pace, S_IRGRP);
1415	}
1416	}
1417	}
1418
1419	if (!got_user) {
1420	if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1421	DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1422	return False;
1423	}
1424
1425	ZERO_STRUCTP(pace);
1426	pace->type = SMB_ACL_USER_OBJ;
1427	pace->owner_type = UID_ACE;
1428	pace->unix_ug.uid = pst->st_ex_uid;
1429	pace->trustee = *pfile_owner_sid;
1430	pace->attr = ALLOW_ACE;
1431	/* Start with existing permissions, principle of least
1432	surprises for the user. */
1433	pace->perms = pst->st_ex_mode;
1434
1435	if (setting_acl) {
1436	/* See if the owning user is in any of the other groups in
1437	the ACE, or if there's a matching user entry.
1438	If so, OR in the permissions from that entry. */
1439
1440	canon_ace *pace_iter;
1441
1442	for (pace_iter = *pp_ace; pace_iter; pace_iter = pace_iter->next) {
1443	if (pace_iter->type == SMB_ACL_USER &&
1444	pace_iter->unix_ug.uid == pace->unix_ug.uid) {
1445	pace->perms \|= pace_iter->perms;
1446	} else if (pace_iter->type == SMB_ACL_GROUP_OBJ \|\| pace_iter->type == SMB_ACL_GROUP) {
1447	if (uid_entry_in_group(conn, pace, pace_iter)) {
1448	pace->perms \|= pace_iter->perms;
1449	}
1450	}
1451	}
1452
1453	if (pace->perms == 0) {
1454	/* If we only got an "everyone" perm, just use that. */
1455	if (got_other)
1456	pace->perms = pace_other->perms;
1457	}
1458
1459	/*
1460	* Ensure we have default parameters for the
1461	* user (owner) even on default ACLs.
1462	*/
1463	apply_default_perms(params, is_directory, pace, S_IRUSR);
1464	} else {
1465	pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRUSR, S_IWUSR, S_IXUSR);
1466	}
1467
1468	DLIST_ADD(*pp_ace, pace);
1469	}
1470
1471	if (!got_grp) {
1472	if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1473	DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1474	return False;
1475	}
1476
1477	ZERO_STRUCTP(pace);
1478	pace->type = SMB_ACL_GROUP_OBJ;
1479	pace->owner_type = GID_ACE;
1480	pace->unix_ug.uid = pst->st_ex_gid;
1481	pace->trustee = *pfile_grp_sid;
1482	pace->attr = ALLOW_ACE;
1483	if (setting_acl) {
1484	/* If we only got an "everyone" perm, just use that. */
1485	if (got_other)
1486	pace->perms = pace_other->perms;
1487	else
1488	pace->perms = 0;
1489	if (!is_default_acl) {
1490	apply_default_perms(params, is_directory, pace, S_IRGRP);
1491	}
1492	} else {
1493	pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRGRP, S_IWGRP, S_IXGRP);
1494	}
1495
1496	DLIST_ADD(*pp_ace, pace);
1497	}
1498
1499	if (!got_other) {
1500	if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
1501	DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
1502	return False;
1503	}
1504
1505	ZERO_STRUCTP(pace);
1506	pace->type = SMB_ACL_OTHER;
1507	pace->owner_type = WORLD_ACE;
1508	pace->unix_ug.world = -1;
1509	pace->trustee = global_sid_World;
1510	pace->attr = ALLOW_ACE;
1511	if (setting_acl) {
1512	pace->perms = 0;
1513	if (!is_default_acl) {
1514	apply_default_perms(params, is_directory, pace, S_IROTH);
1515	}
1516	} else
1517	pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IROTH, S_IWOTH, S_IXOTH);
1518
1519	DLIST_ADD(*pp_ace, pace);
1520	}
1521
1522	return True;
1523	}
1524
1525	/****************************************************************************
1526	Check if a POSIX ACL has the required SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries.
1527	If it does not have them, check if there are any entries where the trustee is the
1528	file owner or the owning group, and map these to SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ.
1529	Note we must not do this to default directory ACLs.
1530	****************************************************************************/
1531
1532	static void check_owning_objs(canon_ace ace, struct dom_sid pfile_owner_sid, struct dom_sid *pfile_grp_sid)
1533	{
1534	bool got_user_obj, got_group_obj;
1535	canon_ace *current_ace;
1536	int i, entries;
1537
1538	entries = count_canon_ace_list(ace);
1539	got_user_obj = False;
1540	got_group_obj = False;
1541
1542	for (i=0, current_ace = ace; i < entries; i++, current_ace = current_ace->next) {
1543	if (current_ace->type == SMB_ACL_USER_OBJ)
1544	got_user_obj = True;
1545	else if (current_ace->type == SMB_ACL_GROUP_OBJ)
1546	got_group_obj = True;
1547	}
1548	if (got_user_obj && got_group_obj) {
1549	DEBUG(10,("check_owning_objs: ACL had owning user/group entries.\n"));
1550	return;
1551	}
1552
1553	for (i=0, current_ace = ace; i < entries; i++, current_ace = current_ace->next) {
1554	if (!got_user_obj && current_ace->owner_type == UID_ACE &&
1555	dom_sid_equal(&current_ace->trustee, pfile_owner_sid)) {
1556	current_ace->type = SMB_ACL_USER_OBJ;
1557	got_user_obj = True;
1558	}
1559	if (!got_group_obj && current_ace->owner_type == GID_ACE &&
1560	dom_sid_equal(&current_ace->trustee, pfile_grp_sid)) {
1561	current_ace->type = SMB_ACL_GROUP_OBJ;
1562	got_group_obj = True;
1563	}
1564	}
1565	if (!got_user_obj)
1566	DEBUG(10,("check_owning_objs: ACL is missing an owner entry.\n"));
1567	if (!got_group_obj)
1568	DEBUG(10,("check_owning_objs: ACL is missing an owning group entry.\n"));
1569	}
1570
1571	/****************************************************************************
1572	Unpack a struct security_descriptor into two canonical ace lists.
1573	****************************************************************************/
1574
1575	static bool create_canon_ace_lists(files_struct *fsp,
1576	const SMB_STRUCT_STAT *pst,
1577	struct dom_sid *pfile_owner_sid,
1578	struct dom_sid *pfile_grp_sid,
1579	canon_ace **ppfile_ace,
1580	canon_ace **ppdir_ace,
1581	const struct security_acl *dacl)
1582	{
1583	bool all_aces_are_inherit_only = (fsp->is_directory ? True : False);
1584	canon_ace *file_ace = NULL;
1585	canon_ace *dir_ace = NULL;
1586	canon_ace *current_ace = NULL;
1587	bool got_dir_allow = False;
1588	bool got_file_allow = False;
1589	int i, j;
1590
1591	*ppfile_ace = NULL;
1592	*ppdir_ace = NULL;
1593
1594	/*
1595	* Convert the incoming ACL into a more regular form.
1596	*/
1597
1598	for(i = 0; i < dacl->num_aces; i++) {
1599	struct security_ace *psa = &dacl->aces[i];
1600
1601	if((psa->type != SEC_ACE_TYPE_ACCESS_ALLOWED) && (psa->type != SEC_ACE_TYPE_ACCESS_DENIED)) {
1602	DEBUG(3,("create_canon_ace_lists: unable to set anything but an ALLOW or DENY ACE.\n"));
1603	return False;
1604	}
1605
1606	if (nt4_compatible_acls()) {
1607	/*
1608	* The security mask may be UNIX_ACCESS_NONE which should map into
1609	* no permissions (we overload the WRITE_OWNER bit for this) or it
1610	* should be one of the ALL/EXECUTE/READ/WRITE bits. Arrange for this
1611	* to be so. Any other bits override the UNIX_ACCESS_NONE bit.
1612	*/
1613
1614	/*
1615	* Convert GENERIC bits to specific bits.
1616	*/
1617
1618	se_map_generic(&psa->access_mask, &file_generic_mapping);
1619
1620	psa->access_mask &= (UNIX_ACCESS_NONE\|FILE_ALL_ACCESS);
1621
1622	if(psa->access_mask != UNIX_ACCESS_NONE)
1623	psa->access_mask &= ~UNIX_ACCESS_NONE;
1624	}
1625	}
1626
1627	/*
1628	* Deal with the fact that NT 4.x re-writes the canonical format
1629	* that we return for default ACLs. If a directory ACE is identical
1630	* to a inherited directory ACE then NT changes the bits so that the
1631	* first ACE is set to OI\|IO and the second ACE for this SID is set
1632	* to CI. We need to repair this. JRA.
1633	*/
1634
1635	for(i = 0; i < dacl->num_aces; i++) {
1636	struct security_ace *psa1 = &dacl->aces[i];
1637
1638	for (j = i + 1; j < dacl->num_aces; j++) {
1639	struct security_ace *psa2 = &dacl->aces[j];
1640
1641	if (psa1->access_mask != psa2->access_mask)
1642	continue;
1643
1644	if (!dom_sid_equal(&psa1->trustee, &psa2->trustee))
1645	continue;
1646
1647	/*
1648	* Ok - permission bits and SIDs are equal.
1649	* Check if flags were re-written.
1650	*/
1651
1652	if (psa1->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
1653
1654	psa1->flags \|= (psa2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT\|SEC_ACE_FLAG_OBJECT_INHERIT));
1655	psa2->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT\|SEC_ACE_FLAG_OBJECT_INHERIT);
1656
1657	} else if (psa2->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
1658
1659	psa2->flags \|= (psa1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT\|SEC_ACE_FLAG_OBJECT_INHERIT));
1660	psa1->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT\|SEC_ACE_FLAG_OBJECT_INHERIT);
1661
1662	}
1663	}
1664	}
1665
1666	for(i = 0; i < dacl->num_aces; i++) {
1667	struct security_ace *psa = &dacl->aces[i];
1668
1669	/*
1670	* Create a canon_ace entry representing this NT DACL ACE.
1671	*/
1672
1673	if ((current_ace = SMB_MALLOC_P(canon_ace)) == NULL) {
1674	free_canon_ace_list(file_ace);
1675	free_canon_ace_list(dir_ace);
1676	DEBUG(0,("create_canon_ace_lists: malloc fail.\n"));
1677	return False;
1678	}
1679
1680	ZERO_STRUCTP(current_ace);
1681
1682	sid_copy(&current_ace->trustee, &psa->trustee);
1683
1684	/*
1685	* Try and work out if the SID is a user or group
1686	* as we need to flag these differently for POSIX.
1687	* Note what kind of a POSIX ACL this should map to.
1688	*/
1689
1690	if( dom_sid_equal(&current_ace->trustee, &global_sid_World)) {
1691	current_ace->owner_type = WORLD_ACE;
1692	current_ace->unix_ug.world = -1;
1693	current_ace->type = SMB_ACL_OTHER;
1694	} else if (dom_sid_equal(&current_ace->trustee, &global_sid_Creator_Owner)) {
1695	current_ace->owner_type = UID_ACE;
1696	current_ace->unix_ug.uid = pst->st_ex_uid;
1697	current_ace->type = SMB_ACL_USER_OBJ;
1698
1699	/*
1700	* The Creator Owner entry only specifies inheritable permissions,
1701	* never access permissions. WinNT doesn't always set the ACE to
1702	* INHERIT_ONLY, though.
1703	*/
1704
1705	psa->flags \|= SEC_ACE_FLAG_INHERIT_ONLY;
1706
1707	} else if (dom_sid_equal(&current_ace->trustee, &global_sid_Creator_Group)) {
1708	current_ace->owner_type = GID_ACE;
1709	current_ace->unix_ug.gid = pst->st_ex_gid;
1710	current_ace->type = SMB_ACL_GROUP_OBJ;
1711
1712	/*
1713	* The Creator Group entry only specifies inheritable permissions,
1714	* never access permissions. WinNT doesn't always set the ACE to
1715	* INHERIT_ONLY, though.
1716	*/
1717	psa->flags \|= SEC_ACE_FLAG_INHERIT_ONLY;
1718
1719	} else if (sid_to_uid( &current_ace->trustee, &current_ace->unix_ug.uid)) {
1720	current_ace->owner_type = UID_ACE;
1721	/* If it's the owning user, this is a user_obj, not
1722	* a user. */
1723	if (current_ace->unix_ug.uid == pst->st_ex_uid) {
1724	current_ace->type = SMB_ACL_USER_OBJ;
1725	} else {
1726	current_ace->type = SMB_ACL_USER;
1727	}
1728	} else if (sid_to_gid( &current_ace->trustee, &current_ace->unix_ug.gid)) {
1729	current_ace->owner_type = GID_ACE;
1730	/* If it's the primary group, this is a group_obj, not
1731	* a group. */
1732	if (current_ace->unix_ug.gid == pst->st_ex_gid) {
1733	current_ace->type = SMB_ACL_GROUP_OBJ;
1734	} else {
1735	current_ace->type = SMB_ACL_GROUP;
1736	}
1737	} else {
1738	/*
1739	* Silently ignore map failures in non-mappable SIDs (NT Authority, BUILTIN etc).
1740	*/
1741
1742	if (non_mappable_sid(&psa->trustee)) {
1743	DEBUG(10, ("create_canon_ace_lists: ignoring "
1744	"non-mappable SID %s\n",
1745	sid_string_dbg(&psa->trustee)));
1746	SAFE_FREE(current_ace);
1747	continue;
1748	}
1749
1750	if (lp_force_unknown_acl_user(SNUM(fsp->conn))) {
1751	DEBUG(10, ("create_canon_ace_lists: ignoring "
1752	"unknown or foreign SID %s\n",
1753	sid_string_dbg(&psa->trustee)));
1754	SAFE_FREE(current_ace);
1755	continue;
1756	}
1757
1758	free_canon_ace_list(file_ace);
1759	free_canon_ace_list(dir_ace);
1760	DEBUG(0, ("create_canon_ace_lists: unable to map SID "
1761	"%s to uid or gid.\n",
1762	sid_string_dbg(&current_ace->trustee)));
1763	SAFE_FREE(current_ace);
1764	return False;
1765	}
1766
1767	/*
1768	* Map the given NT permissions into a UNIX mode_t containing only
1769	* S_I(R\|W\|X)USR bits.
1770	*/
1771
1772	current_ace->perms \|= map_nt_perms( &psa->access_mask, S_IRUSR);
1773	current_ace->attr = (psa->type == SEC_ACE_TYPE_ACCESS_ALLOWED) ? ALLOW_ACE : DENY_ACE;
1774
1775	/* Store the ace_flag. */
1776	current_ace->ace_flags = psa->flags;
1777
1778	/*
1779	* Now add the created ace to either the file list, the directory
1780	* list, or both. We MUST preserve the order here (hence we use
1781	* DLIST_ADD_END) as NT ACLs are order dependent.
1782	*/
1783
1784	if (fsp->is_directory) {
1785
1786	/*
1787	* We can only add to the default POSIX ACE list if the ACE is
1788	* designed to be inherited by both files and directories.
1789	*/
1790
1791	if ((psa->flags & (SEC_ACE_FLAG_OBJECT_INHERIT\|SEC_ACE_FLAG_CONTAINER_INHERIT)) ==
1792	(SEC_ACE_FLAG_OBJECT_INHERIT\|SEC_ACE_FLAG_CONTAINER_INHERIT)) {
1793
1794	canon_ace *current_dir_ace = current_ace;
1795	DLIST_ADD_END(dir_ace, current_ace, canon_ace *);
1796
1797	/*
1798	* Note if this was an allow ace. We can't process
1799	* any further deny ace's after this.
1800	*/
1801
1802	if (current_ace->attr == ALLOW_ACE)
1803	got_dir_allow = True;
1804
1805	if ((current_ace->attr == DENY_ACE) && got_dir_allow) {
1806	DEBUG(0,("create_canon_ace_lists: "
1807	"malformed ACL in "
1808	"inheritable ACL! Deny entry "
1809	"after Allow entry. Failing "
1810	"to set on file %s.\n",
1811	fsp_str_dbg(fsp)));
1812	free_canon_ace_list(file_ace);
1813	free_canon_ace_list(dir_ace);
1814	return False;
1815	}
1816
1817	if( DEBUGLVL( 10 )) {
1818	dbgtext("create_canon_ace_lists: adding dir ACL:\n");
1819	print_canon_ace( current_ace, 0);
1820	}
1821
1822	/*
1823	* If this is not an inherit only ACE we need to add a duplicate
1824	* to the file acl.
1825	*/
1826
1827	if (!(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
1828	canon_ace *dup_ace = dup_canon_ace(current_ace);
1829
1830	if (!dup_ace) {
1831	DEBUG(0,("create_canon_ace_lists: malloc fail !\n"));
1832	free_canon_ace_list(file_ace);
1833	free_canon_ace_list(dir_ace);
1834	return False;
1835	}
1836
1837	/*
1838	* We must not free current_ace here as its
1839	* pointer is now owned by the dir_ace list.
1840	*/
1841	current_ace = dup_ace;
1842	/* We've essentially split this ace into two,
1843	* and added the ace with inheritance request
1844	* bits to the directory ACL. Drop those bits for
1845	* the ACE we're adding to the file list. */
1846	current_ace->ace_flags &= ~(SEC_ACE_FLAG_OBJECT_INHERIT\|
1847	SEC_ACE_FLAG_CONTAINER_INHERIT\|
1848	SEC_ACE_FLAG_INHERIT_ONLY);
1849	} else {
1850	/*
1851	* We must not free current_ace here as its
1852	* pointer is now owned by the dir_ace list.
1853	*/
1854	current_ace = NULL;
1855	}
1856
1857	/*
1858	* current_ace is now either owned by file_ace
1859	* or is NULL. We can safely operate on current_dir_ace
1860	* to treat mapping for default acl entries differently
1861	* than access acl entries.
1862	*/
1863
1864	if (current_dir_ace->owner_type == UID_ACE) {
1865	/*
1866	* We already decided above this is a uid,
1867	* for default acls ace's only CREATOR_OWNER
1868	* maps to ACL_USER_OBJ. All other uid
1869	* ace's are ACL_USER.
1870	*/
1871	if (dom_sid_equal(&current_dir_ace->trustee,
1872	&global_sid_Creator_Owner)) {
1873	current_dir_ace->type = SMB_ACL_USER_OBJ;
1874	} else {
1875	current_dir_ace->type = SMB_ACL_USER;
1876	}
1877	}
1878
1879	if (current_dir_ace->owner_type == GID_ACE) {
1880	/*
1881	* We already decided above this is a gid,
1882	* for default acls ace's only CREATOR_GROUP
1883	* maps to ACL_GROUP_OBJ. All other uid
1884	* ace's are ACL_GROUP.
1885	*/
1886	if (dom_sid_equal(&current_dir_ace->trustee,
1887	&global_sid_Creator_Group)) {
1888	current_dir_ace->type = SMB_ACL_GROUP_OBJ;
1889	} else {
1890	current_dir_ace->type = SMB_ACL_GROUP;
1891	}
1892	}
1893	}
1894	}
1895
1896	/*
1897	* Only add to the file ACL if not inherit only.
1898	*/
1899
1900	if (current_ace && !(psa->flags & SEC_ACE_FLAG_INHERIT_ONLY)) {
1901	DLIST_ADD_END(file_ace, current_ace, canon_ace *);
1902
1903	/*
1904	* Note if this was an allow ace. We can't process
1905	* any further deny ace's after this.
1906	*/
1907
1908	if (current_ace->attr == ALLOW_ACE)
1909	got_file_allow = True;
1910
1911	if ((current_ace->attr == DENY_ACE) && got_file_allow) {
1912	DEBUG(0,("create_canon_ace_lists: malformed "
1913	"ACL in file ACL ! Deny entry after "
1914	"Allow entry. Failing to set on file "
1915	"%s.\n", fsp_str_dbg(fsp)));
1916	free_canon_ace_list(file_ace);
1917	free_canon_ace_list(dir_ace);
1918	return False;
1919	}
1920
1921	if( DEBUGLVL( 10 )) {
1922	dbgtext("create_canon_ace_lists: adding file ACL:\n");
1923	print_canon_ace( current_ace, 0);
1924	}
1925	all_aces_are_inherit_only = False;
1926	/*
1927	* We must not free current_ace here as its
1928	* pointer is now owned by the file_ace list.
1929	*/
1930	current_ace = NULL;
1931	}
1932
1933	/*
1934	* Free if ACE was not added.
1935	*/
1936
1937	SAFE_FREE(current_ace);
1938	}
1939
1940	if (fsp->is_directory && all_aces_are_inherit_only) {
1941	/*
1942	* Windows 2000 is doing one of these weird 'inherit acl'
1943	* traverses to conserve NTFS ACL resources. Just pretend
1944	* there was no DACL sent. JRA.
1945	*/
1946
1947	DEBUG(10,("create_canon_ace_lists: Win2k inherit acl traverse. Ignoring DACL.\n"));
1948	free_canon_ace_list(file_ace);
1949	free_canon_ace_list(dir_ace);
1950	file_ace = NULL;
1951	dir_ace = NULL;
1952	} else {
1953	/*
1954	* Check if we have SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries in
1955	* the file ACL. If we don't have them, check if any SMB_ACL_USER/SMB_ACL_GROUP
1956	* entries can be converted to *_OBJ. Don't do this for the default
1957	* ACL, we will create them separately for this if needed inside
1958	* ensure_canon_entry_valid().
1959	*/
1960	if (file_ace) {
1961	check_owning_objs(file_ace, pfile_owner_sid, pfile_grp_sid);
1962	}
1963	}
1964
1965	*ppfile_ace = file_ace;
1966	*ppdir_ace = dir_ace;
1967
1968	return True;
1969	}
1970
1971	/****************************************************************************
1972	ASCII art time again... JRA :-).
1973
1974	We have 4 cases to process when moving from an NT ACL to a POSIX ACL. Firstly,
1975	we insist the ACL is in canonical form (ie. all DENY entries preceede ALLOW
1976	entries). Secondly, the merge code has ensured that all duplicate SID entries for
1977	allow or deny have been merged, so the same SID can only appear once in the deny
1978	list or once in the allow list.
1979
1980	We then process as follows :
1981
1982	---------------------------------------------------------------------------
1983	First pass - look for a Everyone DENY entry.
1984
1985	If it is deny all (rwx) trunate the list at this point.
1986	Else, walk the list from this point and use the deny permissions of this
1987	entry as a mask on all following allow entries. Finally, delete
1988	the Everyone DENY entry (we have applied it to everything possible).
1989
1990	In addition, in this pass we remove any DENY entries that have
1991	no permissions (ie. they are a DENY nothing).
1992	---------------------------------------------------------------------------
1993	Second pass - only deal with deny user entries.
1994
1995	DENY user1 (perms XXX)
1996
1997	new_perms = 0
1998	for all following allow group entries where user1 is in group
1999	new_perms \|= group_perms;
2000
2001	user1 entry perms = new_perms & ~ XXX;
2002
2003	Convert the deny entry to an allow entry with the new perms and
2004	push to the end of the list. Note if the user was in no groups
2005	this maps to a specific allow nothing entry for this user.
2006
2007	The common case from the NT ACL choser (userX deny all) is
2008	optimised so we don't do the group lookup - we just map to
2009	an allow nothing entry.
2010
2011	What we're doing here is inferring the allow permissions the
2012	person setting the ACE on user1 wanted by looking at the allow
2013	permissions on the groups the user is currently in. This will
2014	be a snapshot, depending on group membership but is the best
2015	we can do and has the advantage of failing closed rather than
2016	open.
2017	---------------------------------------------------------------------------
2018	Third pass - only deal with deny group entries.
2019
2020	DENY group1 (perms XXX)
2021
2022	for all following allow user entries where user is in group1
2023	user entry perms = user entry perms & ~ XXX;
2024
2025	If there is a group Everyone allow entry with permissions YYY,
2026	convert the group1 entry to an allow entry and modify its
2027	permissions to be :
2028
2029	new_perms = YYY & ~ XXX
2030
2031	and push to the end of the list.
2032
2033	If there is no group Everyone allow entry then convert the
2034	group1 entry to a allow nothing entry and push to the end of the list.
2035
2036	Note that the common case from the NT ACL choser (groupX deny all)
2037	cannot be optimised here as we need to modify user entries who are
2038	in the group to change them to a deny all also.
2039
2040	What we're doing here is modifying the allow permissions of
2041	user entries (which are more specific in POSIX ACLs) to mask
2042	out the explicit deny set on the group they are in. This will
2043	be a snapshot depending on current group membership but is the
2044	best we can do and has the advantage of failing closed rather
2045	than open.
2046	---------------------------------------------------------------------------
2047	Fourth pass - cope with cumulative permissions.
2048
2049	for all allow user entries, if there exists an allow group entry with
2050	more permissive permissions, and the user is in that group, rewrite the
2051	allow user permissions to contain both sets of permissions.
2052
2053	Currently the code for this is #ifdef'ed out as these semantics make
2054	no sense to me. JRA.
2055	---------------------------------------------------------------------------
2056
2057	Note we MUST do the deny user pass first as this will convert deny user
2058	entries into allow user entries which can then be processed by the deny
2059	group pass.
2060
2061	The above algorithm took a lot of thinking about - hence this
2062	explaination :-). JRA.
2063	****************************************************************************/
2064
2065	/****************************************************************************
2066	Process a canon_ace list entries. This is very complex code. We need
2067	to go through and remove the "deny" permissions from any allow entry that matches
2068	the id of this entry. We have already refused any NT ACL that wasn't in correct
2069	order (DENY followed by ALLOW). If any allow entry ends up with zero permissions,
2070	we just remove it (to fail safe). We have already removed any duplicate ace
2071	entries. Treat an "Everyone" DENY_ACE as a special case - use it to mask all
2072	allow entries.
2073	****************************************************************************/
2074
2075	static void process_deny_list(connection_struct conn, canon_ace *pp_ace_list )
2076	{
2077	canon_ace ace_list = pp_ace_list;
2078	canon_ace *curr_ace = NULL;
2079	canon_ace *curr_ace_next = NULL;
2080
2081	/* Pass 1 above - look for an Everyone, deny entry. */
2082
2083	for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2084	canon_ace *allow_ace_p;
2085
2086	curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2087
2088	if (curr_ace->attr != DENY_ACE)
2089	continue;
2090
2091	if (curr_ace->perms == (mode_t)0) {
2092
2093	/* Deny nothing entry - delete. */
2094
2095	DLIST_REMOVE(ace_list, curr_ace);
2096	continue;
2097	}
2098
2099	if (!dom_sid_equal(&curr_ace->trustee, &global_sid_World))
2100	continue;
2101
2102	/* JRATEST - assert. */
2103	SMB_ASSERT(curr_ace->owner_type == WORLD_ACE);
2104
2105	if (curr_ace->perms == ALL_ACE_PERMS) {
2106
2107	/*
2108	* Optimisation. This is a DENY_ALL to Everyone. Truncate the
2109	* list at this point including this entry.
2110	*/
2111
2112	canon_ace *prev_entry = DLIST_PREV(curr_ace);
2113
2114	free_canon_ace_list( curr_ace );
2115	if (prev_entry)
2116	DLIST_REMOVE(ace_list, prev_entry);
2117	else {
2118	/* We deleted the entire list. */
2119	ace_list = NULL;
2120	}
2121	break;
2122	}
2123
2124	for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2125
2126	/*
2127	* Only mask off allow entries.
2128	*/
2129
2130	if (allow_ace_p->attr != ALLOW_ACE)
2131	continue;
2132
2133	allow_ace_p->perms &= ~curr_ace->perms;
2134	}
2135
2136	/*
2137	* Now it's been applied, remove it.
2138	*/
2139
2140	DLIST_REMOVE(ace_list, curr_ace);
2141	}
2142
2143	/* Pass 2 above - deal with deny user entries. */
2144
2145	for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2146	mode_t new_perms = (mode_t)0;
2147	canon_ace *allow_ace_p;
2148
2149	curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2150
2151	if (curr_ace->attr != DENY_ACE)
2152	continue;
2153
2154	if (curr_ace->owner_type != UID_ACE)
2155	continue;
2156
2157	if (curr_ace->perms == ALL_ACE_PERMS) {
2158
2159	/*
2160	* Optimisation - this is a deny everything to this user.
2161	* Convert to an allow nothing and push to the end of the list.
2162	*/
2163
2164	curr_ace->attr = ALLOW_ACE;
2165	curr_ace->perms = (mode_t)0;
2166	DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2167	continue;
2168	}
2169
2170	for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2171
2172	if (allow_ace_p->attr != ALLOW_ACE)
2173	continue;
2174
2175	/* We process GID_ACE and WORLD_ACE entries only. */
2176
2177	if (allow_ace_p->owner_type == UID_ACE)
2178	continue;
2179
2180	if (uid_entry_in_group(conn, curr_ace, allow_ace_p))
2181	new_perms \|= allow_ace_p->perms;
2182	}
2183
2184	/*
2185	* Convert to a allow entry, modify the perms and push to the end
2186	* of the list.
2187	*/
2188
2189	curr_ace->attr = ALLOW_ACE;
2190	curr_ace->perms = (new_perms & ~curr_ace->perms);
2191	DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2192	}
2193
2194	/* Pass 3 above - deal with deny group entries. */
2195
2196	for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2197	canon_ace *allow_ace_p;
2198	canon_ace *allow_everyone_p = NULL;
2199
2200	curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2201
2202	if (curr_ace->attr != DENY_ACE)
2203	continue;
2204
2205	if (curr_ace->owner_type != GID_ACE)
2206	continue;
2207
2208	for (allow_ace_p = curr_ace->next; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2209
2210	if (allow_ace_p->attr != ALLOW_ACE)
2211	continue;
2212
2213	/* Store a pointer to the Everyone allow, if it exists. */
2214	if (allow_ace_p->owner_type == WORLD_ACE)
2215	allow_everyone_p = allow_ace_p;
2216
2217	/* We process UID_ACE entries only. */
2218
2219	if (allow_ace_p->owner_type != UID_ACE)
2220	continue;
2221
2222	/* Mask off the deny group perms. */
2223
2224	if (uid_entry_in_group(conn, allow_ace_p, curr_ace))
2225	allow_ace_p->perms &= ~curr_ace->perms;
2226	}
2227
2228	/*
2229	* Convert the deny to an allow with the correct perms and
2230	* push to the end of the list.
2231	*/
2232
2233	curr_ace->attr = ALLOW_ACE;
2234	if (allow_everyone_p)
2235	curr_ace->perms = allow_everyone_p->perms & ~curr_ace->perms;
2236	else
2237	curr_ace->perms = (mode_t)0;
2238	DLIST_DEMOTE(ace_list, curr_ace, canon_ace *);
2239	}
2240
2241	/* Doing this fourth pass allows Windows semantics to be layered
2242	* on top of POSIX semantics. I'm not sure if this is desirable.
2243	* For example, in W2K ACLs there is no way to say, "Group X no
2244	* access, user Y full access" if user Y is a member of group X.
2245	* This seems completely broken semantics to me.... JRA.
2246	*/
2247
2248	#if 0
2249	/* Pass 4 above - deal with allow entries. */
2250
2251	for (curr_ace = ace_list; curr_ace; curr_ace = curr_ace_next) {
2252	canon_ace *allow_ace_p;
2253
2254	curr_ace_next = curr_ace->next; /* So we can't lose the link. */
2255
2256	if (curr_ace->attr != ALLOW_ACE)
2257	continue;
2258
2259	if (curr_ace->owner_type != UID_ACE)
2260	continue;
2261
2262	for (allow_ace_p = ace_list; allow_ace_p; allow_ace_p = allow_ace_p->next) {
2263
2264	if (allow_ace_p->attr != ALLOW_ACE)
2265	continue;
2266
2267	/* We process GID_ACE entries only. */
2268
2269	if (allow_ace_p->owner_type != GID_ACE)
2270	continue;
2271
2272	/* OR in the group perms. */
2273
2274	if (uid_entry_in_group(conn, curr_ace, allow_ace_p))
2275	curr_ace->perms \|= allow_ace_p->perms;
2276	}
2277	}
2278	#endif
2279
2280	*pp_ace_list = ace_list;
2281	}
2282
2283	/****************************************************************************
2284	Unpack a struct security_descriptor into two canonical ace lists. We don't depend on this
2285	succeeding.
2286	****************************************************************************/
2287
2288	static bool unpack_canon_ace(files_struct *fsp,
2289	const SMB_STRUCT_STAT *pst,
2290	struct dom_sid *pfile_owner_sid,
2291	struct dom_sid *pfile_grp_sid,
2292	canon_ace **ppfile_ace,
2293	canon_ace **ppdir_ace,
2294	uint32 security_info_sent,
2295	const struct security_descriptor *psd)
2296	{
2297	canon_ace *file_ace = NULL;
2298	canon_ace *dir_ace = NULL;
2299
2300	*ppfile_ace = NULL;
2301	*ppdir_ace = NULL;
2302
2303	if(security_info_sent == 0) {
2304	DEBUG(0,("unpack_canon_ace: no security info sent !\n"));
2305	return False;
2306	}
2307
2308	/*
2309	* If no DACL then this is a chown only security descriptor.
2310	*/
2311
2312	if(!(security_info_sent & SECINFO_DACL) \|\| !psd->dacl)
2313	return True;
2314
2315	/*
2316	* Now go through the DACL and create the canon_ace lists.
2317	*/
2318
2319	if (!create_canon_ace_lists( fsp, pst, pfile_owner_sid, pfile_grp_sid,
2320	&file_ace, &dir_ace, psd->dacl))
2321	return False;
2322
2323	if ((file_ace == NULL) && (dir_ace == NULL)) {
2324	/* W2K traverse DACL set - ignore. */
2325	return True;
2326	}
2327
2328	/*
2329	* Go through the canon_ace list and merge entries
2330	* belonging to identical users of identical allow or deny type.
2331	* We can do this as all deny entries come first, followed by
2332	* all allow entries (we have mandated this before accepting this acl).
2333	*/
2334
2335	print_canon_ace_list( "file ace - before merge", file_ace);
2336	merge_aces( &file_ace, false);
2337
2338	print_canon_ace_list( "dir ace - before merge", dir_ace);
2339	merge_aces( &dir_ace, true);
2340
2341	/*
2342	* NT ACLs are order dependent. Go through the acl lists and
2343	* process DENY entries by masking the allow entries.
2344	*/
2345
2346	print_canon_ace_list( "file ace - before deny", file_ace);
2347	process_deny_list(fsp->conn, &file_ace);
2348
2349	print_canon_ace_list( "dir ace - before deny", dir_ace);
2350	process_deny_list(fsp->conn, &dir_ace);
2351
2352	/*
2353	* A well formed POSIX file or default ACL has at least 3 entries, a
2354	* SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ
2355	* and optionally a mask entry. Ensure this is the case.
2356	*/
2357
2358	print_canon_ace_list( "file ace - before valid", file_ace);
2359
2360	if (!ensure_canon_entry_valid(fsp->conn, &file_ace, false, fsp->conn->params,
2361	fsp->is_directory, pfile_owner_sid, pfile_grp_sid, pst, True)) {
2362	free_canon_ace_list(file_ace);
2363	free_canon_ace_list(dir_ace);
2364	return False;
2365	}
2366
2367	print_canon_ace_list( "dir ace - before valid", dir_ace);
2368
2369	if (dir_ace && !ensure_canon_entry_valid(fsp->conn, &dir_ace, true, fsp->conn->params,
2370	fsp->is_directory, pfile_owner_sid, pfile_grp_sid, pst, True)) {
2371	free_canon_ace_list(file_ace);
2372	free_canon_ace_list(dir_ace);
2373	return False;
2374	}
2375
2376	print_canon_ace_list( "file ace - return", file_ace);
2377	print_canon_ace_list( "dir ace - return", dir_ace);
2378
2379	*ppfile_ace = file_ace;
2380	*ppdir_ace = dir_ace;
2381	return True;
2382
2383	}
2384
2385	/******************************************************************************
2386	When returning permissions, try and fit NT display
2387	semantics if possible. Note the the canon_entries here must have been malloced.
2388	The list format should be - first entry = owner, followed by group and other user
2389	entries, last entry = other.
2390
2391	Note that this doesn't exactly match the NT semantics for an ACL. As POSIX entries
2392	are not ordered, and match on the most specific entry rather than walking a list,
2393	then a simple POSIX permission of rw-r--r-- should really map to 5 entries,
2394
2395	Entry 0: owner : deny all except read and write.
2396	Entry 1: owner : allow read and write.
2397	Entry 2: group : deny all except read.
2398	Entry 3: group : allow read.
2399	Entry 4: Everyone : allow read.
2400
2401	But NT cannot display this in their ACL editor !
2402	********************************************************************************/
2403
2404	static void arrange_posix_perms(const char filename, canon_ace *pp_list_head)
2405	{
2406	canon_ace l_head = pp_list_head;
2407	canon_ace *owner_ace = NULL;
2408	canon_ace *other_ace = NULL;
2409	canon_ace *ace = NULL;
2410
2411	for (ace = l_head; ace; ace = ace->next) {
2412	if (ace->type == SMB_ACL_USER_OBJ)
2413	owner_ace = ace;
2414	else if (ace->type == SMB_ACL_OTHER) {
2415	/* Last ace - this is "other" */
2416	other_ace = ace;
2417	}
2418	}
2419
2420	if (!owner_ace \|\| !other_ace) {
2421	DEBUG(0,("arrange_posix_perms: Invalid POSIX permissions for file %s, missing owner or other.\n",
2422	filename ));
2423	return;
2424	}
2425
2426	/*
2427	* The POSIX algorithm applies to owner first, and other last,
2428	* so ensure they are arranged in this order.
2429	*/
2430
2431	if (owner_ace) {
2432	DLIST_PROMOTE(l_head, owner_ace);
2433	}
2434
2435	if (other_ace) {
2436	DLIST_DEMOTE(l_head, other_ace, canon_ace *);
2437	}
2438
2439	/* We have probably changed the head of the list. */
2440
2441	*pp_list_head = l_head;
2442	}
2443
2444	/****************************************************************************
2445	Create a linked list of canonical ACE entries.
2446	****************************************************************************/
2447
2448	static canon_ace canonicalise_acl(struct connection_struct conn,
2449	const char *fname, SMB_ACL_T posix_acl,
2450	const SMB_STRUCT_STAT *psbuf,
2451	const struct dom_sid powner, const struct dom_sid pgroup, struct pai_val *pal, SMB_ACL_TYPE_T the_acl_type)
2452	{
2453	mode_t acl_mask = (S_IRUSR\|S_IWUSR\|S_IXUSR);
2454	canon_ace *l_head = NULL;
2455	canon_ace *ace = NULL;
2456	canon_ace *next_ace = NULL;
2457	int entry_id = SMB_ACL_FIRST_ENTRY;
2458	bool is_default_acl = (the_acl_type == SMB_ACL_TYPE_DEFAULT);
2459	SMB_ACL_ENTRY_T entry;
2460	size_t ace_count;
2461
2462	while ( posix_acl && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1)) {
2463	SMB_ACL_TAG_T tagtype;
2464	SMB_ACL_PERMSET_T permset;
2465	struct dom_sid sid;
2466	posix_id unix_ug;
2467	enum ace_owner owner_type;
2468
2469	entry_id = SMB_ACL_NEXT_ENTRY;
2470
2471	/* Is this a MASK entry ? */
2472	if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1)
2473	continue;
2474
2475	if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1)
2476	continue;
2477
2478	/* Decide which SID to use based on the ACL type. */
2479	switch(tagtype) {
2480	case SMB_ACL_USER_OBJ:
2481	/* Get the SID from the owner. */
2482	sid_copy(&sid, powner);
2483	unix_ug.uid = psbuf->st_ex_uid;
2484	owner_type = UID_ACE;
2485	break;
2486	case SMB_ACL_USER:
2487	{
2488	uid_t puid = (uid_t )SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
2489	if (puid == NULL) {
2490	DEBUG(0,("canonicalise_acl: Failed to get uid.\n"));
2491	continue;
2492	}
2493	uid_to_sid( &sid, *puid);
2494	unix_ug.uid = *puid;
2495	owner_type = UID_ACE;
2496	SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)puid,tagtype);
2497	break;
2498	}
2499	case SMB_ACL_GROUP_OBJ:
2500	/* Get the SID from the owning group. */
2501	sid_copy(&sid, pgroup);
2502	unix_ug.gid = psbuf->st_ex_gid;
2503	owner_type = GID_ACE;
2504	break;
2505	case SMB_ACL_GROUP:
2506	{
2507	gid_t pgid = (gid_t )SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
2508	if (pgid == NULL) {
2509	DEBUG(0,("canonicalise_acl: Failed to get gid.\n"));
2510	continue;
2511	}
2512	gid_to_sid( &sid, *pgid);
2513	unix_ug.gid = *pgid;
2514	owner_type = GID_ACE;
2515	SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)pgid,tagtype);
2516	break;
2517	}
2518	case SMB_ACL_MASK:
2519	acl_mask = convert_permset_to_mode_t(conn, permset);
2520	continue; /* Don't count the mask as an entry. */
2521	case SMB_ACL_OTHER:
2522	/* Use the Everyone SID */
2523	sid = global_sid_World;
2524	unix_ug.world = -1;
2525	owner_type = WORLD_ACE;
2526	break;
2527	default:
2528	DEBUG(0,("canonicalise_acl: Unknown tagtype %u\n", (unsigned int)tagtype));
2529	continue;
2530	}
2531
2532	/*
2533	* Add this entry to the list.
2534	*/
2535
2536	if ((ace = SMB_MALLOC_P(canon_ace)) == NULL)
2537	goto fail;
2538
2539	ZERO_STRUCTP(ace);
2540	ace->type = tagtype;
2541	ace->perms = convert_permset_to_mode_t(conn, permset);
2542	ace->attr = ALLOW_ACE;
2543	ace->trustee = sid;
2544	ace->unix_ug = unix_ug;
2545	ace->owner_type = owner_type;
2546	ace->ace_flags = get_pai_flags(pal, ace, is_default_acl);
2547
2548	DLIST_ADD(l_head, ace);
2549	}
2550
2551	/*
2552	* This next call will ensure we have at least a user/group/world set.
2553	*/
2554
2555	if (!ensure_canon_entry_valid(conn, &l_head, is_default_acl, conn->params,
2556	S_ISDIR(psbuf->st_ex_mode), powner, pgroup,
2557	psbuf, False))
2558	goto fail;
2559
2560	/*
2561	* Now go through the list, masking the permissions with the
2562	* acl_mask. Ensure all DENY Entries are at the start of the list.
2563	*/
2564
2565	DEBUG(10,("canonicalise_acl: %s ace entries before arrange :\n", is_default_acl ? "Default" : "Access"));
2566
2567	for ( ace_count = 0, ace = l_head; ace; ace = next_ace, ace_count++) {
2568	next_ace = ace->next;
2569
2570	/* Masks are only applied to entries other than USER_OBJ and OTHER. */
2571	if (ace->type != SMB_ACL_OTHER && ace->type != SMB_ACL_USER_OBJ)
2572	ace->perms &= acl_mask;
2573
2574	if (ace->perms == 0) {
2575	DLIST_PROMOTE(l_head, ace);
2576	}
2577
2578	if( DEBUGLVL( 10 ) ) {
2579	print_canon_ace(ace, ace_count);
2580	}
2581	}
2582
2583	arrange_posix_perms(fname,&l_head );
2584
2585	print_canon_ace_list( "canonicalise_acl: ace entries after arrange", l_head );
2586
2587	return l_head;
2588
2589	fail:
2590
2591	free_canon_ace_list(l_head);
2592	return NULL;
2593	}
2594
2595	/****************************************************************************
2596	Check if the current user group list contains a given group.
2597	****************************************************************************/
2598
2599	bool current_user_in_group(connection_struct *conn, gid_t gid)
2600	{
2601	int i;
2602	const struct security_unix_token *utok = get_current_utok(conn);
2603
2604	for (i = 0; i < utok->ngroups; i++) {
2605	if (utok->groups[i] == gid) {
2606	return True;
2607	}
2608	}
2609
2610	return False;
2611	}
2612
2613	/****************************************************************************
2614	Should we override a deny ? Check 'acl group control' and 'dos filemode'.
2615	****************************************************************************/
2616
2617	static bool acl_group_override(connection_struct *conn,
2618	const struct smb_filename *smb_fname)
2619	{
2620	if ((errno != EPERM) && (errno != EACCES)) {
2621	return false;
2622	}
2623
2624	/* file primary group == user primary or supplementary group */
2625	if (lp_acl_group_control(SNUM(conn)) &&
2626	current_user_in_group(conn, smb_fname->st.st_ex_gid)) {
2627	return true;
2628	}
2629
2630	/* user has writeable permission */
2631	if (lp_dos_filemode(SNUM(conn)) &&
2632	can_write_to_file(conn, smb_fname)) {
2633	return true;
2634	}
2635
2636	return false;
2637	}
2638
2639	/****************************************************************************
2640	Attempt to apply an ACL to a file or directory.
2641	****************************************************************************/
2642
2643	static bool set_canon_ace_list(files_struct *fsp,
2644	canon_ace *the_ace,
2645	bool default_ace,
2646	const SMB_STRUCT_STAT *psbuf,
2647	bool *pacl_set_support)
2648	{
2649	connection_struct *conn = fsp->conn;
2650	bool ret = False;
2651	SMB_ACL_T the_acl = SMB_VFS_SYS_ACL_INIT(conn, (int)count_canon_ace_list(the_ace) + 1);
2652	canon_ace *p_ace;
2653	int i;
2654	SMB_ACL_ENTRY_T mask_entry;
2655	bool got_mask_entry = False;
2656	SMB_ACL_PERMSET_T mask_permset;
2657	SMB_ACL_TYPE_T the_acl_type = (default_ace ? SMB_ACL_TYPE_DEFAULT : SMB_ACL_TYPE_ACCESS);
2658	bool needs_mask = False;
2659	mode_t mask_perms = 0;
2660
2661	/* Use the psbuf that was passed in. */
2662	if (psbuf != &fsp->fsp_name->st) {
2663	fsp->fsp_name->st = *psbuf;
2664	}
2665
2666	#if defined(POSIX_ACL_NEEDS_MASK)
2667	/* HP-UX always wants to have a mask (called "class" there). */
2668	needs_mask = True;
2669	#endif
2670
2671	if (the_acl == NULL) {
2672
2673	if (!no_acl_syscall_error(errno)) {
2674	/*
2675	* Only print this error message if we have some kind of ACL
2676	* support that's not working. Otherwise we would always get this.
2677	*/
2678	DEBUG(0,("set_canon_ace_list: Unable to init %s ACL. (%s)\n",
2679	default_ace ? "default" : "file", strerror(errno) ));
2680	}
2681	*pacl_set_support = False;
2682	goto fail;
2683	}
2684
2685	if( DEBUGLVL( 10 )) {
2686	dbgtext("set_canon_ace_list: setting ACL:\n");
2687	for (i = 0, p_ace = the_ace; p_ace; p_ace = p_ace->next, i++ ) {
2688	print_canon_ace( p_ace, i);
2689	}
2690	}
2691
2692	for (i = 0, p_ace = the_ace; p_ace; p_ace = p_ace->next, i++ ) {
2693	SMB_ACL_ENTRY_T the_entry;
2694	SMB_ACL_PERMSET_T the_permset;
2695
2696	/*
2697	* ACLs only "need" an ACL_MASK entry if there are any named user or
2698	* named group entries. But if there is an ACL_MASK entry, it applies
2699	* to ACL_USER, ACL_GROUP, and ACL_GROUP_OBJ entries. Set the mask
2700	* so that it doesn't deny (i.e., mask off) any permissions.
2701	*/
2702
2703	if (p_ace->type == SMB_ACL_USER \|\| p_ace->type == SMB_ACL_GROUP) {
2704	needs_mask = True;
2705	mask_perms \|= p_ace->perms;
2706	} else if (p_ace->type == SMB_ACL_GROUP_OBJ) {
2707	mask_perms \|= p_ace->perms;
2708	}
2709
2710	/*
2711	* Get the entry for this ACE.
2712	*/
2713
2714	if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &the_entry) == -1) {
2715	DEBUG(0,("set_canon_ace_list: Failed to create entry %d. (%s)\n",
2716	i, strerror(errno) ));
2717	goto fail;
2718	}
2719
2720	if (p_ace->type == SMB_ACL_MASK) {
2721	mask_entry = the_entry;
2722	got_mask_entry = True;
2723	}
2724
2725	/*
2726	* Ok - we now know the ACL calls should be working, don't
2727	* allow fallback to chmod.
2728	*/
2729
2730	*pacl_set_support = True;
2731
2732	/*
2733	* Initialise the entry from the canon_ace.
2734	*/
2735
2736	/*
2737	* First tell the entry what type of ACE this is.
2738	*/
2739
2740	if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, the_entry, p_ace->type) == -1) {
2741	DEBUG(0,("set_canon_ace_list: Failed to set tag type on entry %d. (%s)\n",
2742	i, strerror(errno) ));
2743	goto fail;
2744	}
2745
2746	/*
2747	* Only set the qualifier (user or group id) if the entry is a user
2748	* or group id ACE.
2749	*/
2750
2751	if ((p_ace->type == SMB_ACL_USER) \|\| (p_ace->type == SMB_ACL_GROUP)) {
2752	if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&p_ace->unix_ug.uid) == -1) {
2753	DEBUG(0,("set_canon_ace_list: Failed to set qualifier on entry %d. (%s)\n",
2754	i, strerror(errno) ));
2755	goto fail;
2756	}
2757	}
2758
2759	/*
2760	* Convert the mode_t perms in the canon_ace to a POSIX permset.
2761	*/
2762
2763	if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, the_entry, &the_permset) == -1) {
2764	DEBUG(0,("set_canon_ace_list: Failed to get permset on entry %d. (%s)\n",
2765	i, strerror(errno) ));
2766	goto fail;
2767	}
2768
2769	if (map_acl_perms_to_permset(conn, p_ace->perms, &the_permset) == -1) {
2770	DEBUG(0,("set_canon_ace_list: Failed to create permset for mode (%u) on entry %d. (%s)\n",
2771	(unsigned int)p_ace->perms, i, strerror(errno) ));
2772	goto fail;
2773	}
2774
2775	/*
2776	* ..and apply them to the entry.
2777	*/
2778
2779	if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, the_entry, the_permset) == -1) {
2780	DEBUG(0,("set_canon_ace_list: Failed to add permset on entry %d. (%s)\n",
2781	i, strerror(errno) ));
2782	goto fail;
2783	}
2784
2785	if( DEBUGLVL( 10 ))
2786	print_canon_ace( p_ace, i);
2787
2788	}
2789
2790	if (needs_mask && !got_mask_entry) {
2791	if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &mask_entry) == -1) {
2792	DEBUG(0,("set_canon_ace_list: Failed to create mask entry. (%s)\n", strerror(errno) ));
2793	goto fail;
2794	}
2795
2796	if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, mask_entry, SMB_ACL_MASK) == -1) {
2797	DEBUG(0,("set_canon_ace_list: Failed to set tag type on mask entry. (%s)\n",strerror(errno) ));
2798	goto fail;
2799	}
2800
2801	if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, mask_entry, &mask_permset) == -1) {
2802	DEBUG(0,("set_canon_ace_list: Failed to get mask permset. (%s)\n", strerror(errno) ));
2803	goto fail;
2804	}
2805
2806	if (map_acl_perms_to_permset(conn, S_IRUSR\|S_IWUSR\|S_IXUSR, &mask_permset) == -1) {
2807	DEBUG(0,("set_canon_ace_list: Failed to create mask permset. (%s)\n", strerror(errno) ));
2808	goto fail;
2809	}
2810
2811	if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, mask_entry, mask_permset) == -1) {
2812	DEBUG(0,("set_canon_ace_list: Failed to add mask permset. (%s)\n", strerror(errno) ));
2813	goto fail;
2814	}
2815	}
2816
2817	/*
2818	* Finally apply it to the file or directory.
2819	*/
2820
2821	if(default_ace \|\| fsp->is_directory \|\| fsp->fh->fd == -1) {
2822	if (SMB_VFS_SYS_ACL_SET_FILE(conn, fsp->fsp_name->base_name,
2823	the_acl_type, the_acl) == -1) {
2824	/*
2825	* Some systems allow all the above calls and only fail with no ACL support
2826	* when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
2827	*/
2828	if (no_acl_syscall_error(errno)) {
2829	*pacl_set_support = False;
2830	}
2831
2832	if (acl_group_override(conn, fsp->fsp_name)) {
2833	int sret;
2834
2835	DEBUG(5,("set_canon_ace_list: acl group "
2836	"control on and current user in file "
2837	"%s primary group.\n",
2838	fsp_str_dbg(fsp)));
2839
2840	become_root();
2841	sret = SMB_VFS_SYS_ACL_SET_FILE(conn,
2842	fsp->fsp_name->base_name, the_acl_type,
2843	the_acl);
2844	unbecome_root();
2845	if (sret == 0) {
2846	ret = True;
2847	}
2848	}
2849
2850	if (ret == False) {
2851	DEBUG(2,("set_canon_ace_list: "
2852	"sys_acl_set_file type %s failed for "
2853	"file %s (%s).\n",
2854	the_acl_type == SMB_ACL_TYPE_DEFAULT ?
2855	"directory default" : "file",
2856	fsp_str_dbg(fsp), strerror(errno)));
2857	goto fail;
2858	}
2859	}
2860	} else {
2861	if (SMB_VFS_SYS_ACL_SET_FD(fsp, the_acl) == -1) {
2862	/*
2863	* Some systems allow all the above calls and only fail with no ACL support
2864	* when attempting to apply the acl. HPUX with HFS is an example of this. JRA.
2865	*/
2866	if (no_acl_syscall_error(errno)) {
2867	*pacl_set_support = False;
2868	}
2869
2870	if (acl_group_override(conn, fsp->fsp_name)) {
2871	int sret;
2872
2873	DEBUG(5,("set_canon_ace_list: acl group "
2874	"control on and current user in file "
2875	"%s primary group.\n",
2876	fsp_str_dbg(fsp)));
2877
2878	become_root();
2879	sret = SMB_VFS_SYS_ACL_SET_FD(fsp, the_acl);
2880	unbecome_root();
2881	if (sret == 0) {
2882	ret = True;
2883	}
2884	}
2885
2886	if (ret == False) {
2887	DEBUG(2,("set_canon_ace_list: "
2888	"sys_acl_set_file failed for file %s "
2889	"(%s).\n",
2890	fsp_str_dbg(fsp), strerror(errno)));
2891	goto fail;
2892	}
2893	}
2894	}
2895
2896	ret = True;
2897
2898	fail:
2899
2900	if (the_acl != NULL) {
2901	SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
2902	}
2903
2904	return ret;
2905	}
2906
2907	/****************************************************************************
2908	Find a particular canon_ace entry.
2909	****************************************************************************/
2910
2911	static struct canon_ace canon_ace_entry_for(struct canon_ace list, SMB_ACL_TAG_T type, posix_id *id)
2912	{
2913	while (list) {
2914	if (list->type == type && ((type != SMB_ACL_USER && type != SMB_ACL_GROUP) \|\|
2915	(type == SMB_ACL_USER && id && id->uid == list->unix_ug.uid) \|\|
2916	(type == SMB_ACL_GROUP && id && id->gid == list->unix_ug.gid)))
2917	break;
2918	list = list->next;
2919	}
2920	return list;
2921	}
2922
2923	/****************************************************************************
2924
2925	****************************************************************************/
2926
2927	SMB_ACL_T free_empty_sys_acl(connection_struct *conn, SMB_ACL_T the_acl)
2928	{
2929	SMB_ACL_ENTRY_T entry;
2930
2931	if (!the_acl)
2932	return NULL;
2933	if (SMB_VFS_SYS_ACL_GET_ENTRY(conn, the_acl, SMB_ACL_FIRST_ENTRY, &entry) != 1) {
2934	SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
2935	return NULL;
2936	}
2937	return the_acl;
2938	}
2939
2940	/****************************************************************************
2941	Convert a canon_ace to a generic 3 element permission - if possible.
2942	****************************************************************************/
2943
2944	#define MAP_PERM(p,mask,result) (((p) & (mask)) ? (result) : 0 )
2945
2946	static bool convert_canon_ace_to_posix_perms( files_struct fsp, canon_ace file_ace_list, mode_t *posix_perms)
2947	{
2948	int snum = SNUM(fsp->conn);
2949	size_t ace_count = count_canon_ace_list(file_ace_list);
2950	canon_ace *ace_p;
2951	canon_ace *owner_ace = NULL;
2952	canon_ace *group_ace = NULL;
2953	canon_ace *other_ace = NULL;
2954	mode_t and_bits;
2955	mode_t or_bits;
2956
2957	if (ace_count != 3) {
2958	DEBUG(3,("convert_canon_ace_to_posix_perms: Too many ACE "
2959	"entries for file %s to convert to posix perms.\n",
2960	fsp_str_dbg(fsp)));
2961	return False;
2962	}
2963
2964	for (ace_p = file_ace_list; ace_p; ace_p = ace_p->next) {
2965	if (ace_p->owner_type == UID_ACE)
2966	owner_ace = ace_p;
2967	else if (ace_p->owner_type == GID_ACE)
2968	group_ace = ace_p;
2969	else if (ace_p->owner_type == WORLD_ACE)
2970	other_ace = ace_p;
2971	}
2972
2973	if (!owner_ace \|\| !group_ace \|\| !other_ace) {
2974	DEBUG(3,("convert_canon_ace_to_posix_perms: Can't get "
2975	"standard entries for file %s.\n", fsp_str_dbg(fsp)));
2976	return False;
2977	}
2978
2979	*posix_perms = (mode_t)0;
2980
2981	*posix_perms \|= owner_ace->perms;
2982	*posix_perms \|= MAP_PERM(group_ace->perms, S_IRUSR, S_IRGRP);
2983	*posix_perms \|= MAP_PERM(group_ace->perms, S_IWUSR, S_IWGRP);
2984	*posix_perms \|= MAP_PERM(group_ace->perms, S_IXUSR, S_IXGRP);
2985	*posix_perms \|= MAP_PERM(other_ace->perms, S_IRUSR, S_IROTH);
2986	*posix_perms \|= MAP_PERM(other_ace->perms, S_IWUSR, S_IWOTH);
2987	*posix_perms \|= MAP_PERM(other_ace->perms, S_IXUSR, S_IXOTH);
2988
2989	/* The owner must have at least read access. */
2990
2991	*posix_perms \|= S_IRUSR;
2992	if (fsp->is_directory)
2993	*posix_perms \|= (S_IWUSR\|S_IXUSR);
2994
2995	/* If requested apply the masks. */
2996
2997	/* Get the initial bits to apply. */
2998
2999	if (fsp->is_directory) {
3000	and_bits = lp_dir_security_mask(snum);
3001	or_bits = lp_force_dir_security_mode(snum);
3002	} else {
3003	and_bits = lp_security_mask(snum);
3004	or_bits = lp_force_security_mode(snum);
3005	}
3006
3007	posix_perms = (((posix_perms) & and_bits)\|or_bits);
3008
3009	DEBUG(10,("convert_canon_ace_to_posix_perms: converted u=%o,g=%o,w=%o "
3010	"to perm=0%o for file %s.\n", (int)owner_ace->perms,
3011	(int)group_ace->perms, (int)other_ace->perms,
3012	(int)*posix_perms, fsp_str_dbg(fsp)));
3013
3014	return True;
3015	}
3016
3017	/****************************************************************************
3018	Incoming NT ACLs on a directory can be split into a default POSIX acl (CI\|OI\|IO) and
3019	a normal POSIX acl. Win2k needs these split acls re-merging into one ACL
3020	with CI\|OI set so it is inherited and also applies to the directory.
3021	Based on code from "Jim McDonough" <jmcd@us.ibm.com>.
3022	****************************************************************************/
3023
3024	static size_t merge_default_aces( struct security_ace *nt_ace_list, size_t num_aces)
3025	{
3026	size_t i, j;
3027
3028	for (i = 0; i < num_aces; i++) {
3029	for (j = i+1; j < num_aces; j++) {
3030	uint32 i_flags_ni = (nt_ace_list[i].flags & ~SEC_ACE_FLAG_INHERITED_ACE);
3031	uint32 j_flags_ni = (nt_ace_list[j].flags & ~SEC_ACE_FLAG_INHERITED_ACE);
3032	bool i_inh = (nt_ace_list[i].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False;
3033	bool j_inh = (nt_ace_list[j].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False;
3034
3035	/* We know the lower number ACE's are file entries. */
3036	if ((nt_ace_list[i].type == nt_ace_list[j].type) &&
3037	(nt_ace_list[i].size == nt_ace_list[j].size) &&
3038	(nt_ace_list[i].access_mask == nt_ace_list[j].access_mask) &&
3039	dom_sid_equal(&nt_ace_list[i].trustee, &nt_ace_list[j].trustee) &&
3040	(i_inh == j_inh) &&
3041	(i_flags_ni == 0) &&
3042	(j_flags_ni == (SEC_ACE_FLAG_OBJECT_INHERIT\|
3043	SEC_ACE_FLAG_CONTAINER_INHERIT\|
3044	SEC_ACE_FLAG_INHERIT_ONLY))) {
3045	/*
3046	* W2K wants to have access allowed zero access ACE's
3047	* at the end of the list. If the mask is zero, merge
3048	* the non-inherited ACE onto the inherited ACE.
3049	*/
3050
3051	if (nt_ace_list[i].access_mask == 0) {
3052	nt_ace_list[j].flags = SEC_ACE_FLAG_OBJECT_INHERIT\|SEC_ACE_FLAG_CONTAINER_INHERIT\|
3053	(i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0);
3054	if (num_aces - i - 1 > 0)
3055	memmove(&nt_ace_list[i], &nt_ace_list[i+1], (num_aces-i-1) *
3056	sizeof(struct security_ace));
3057
3058	DEBUG(10,("merge_default_aces: Merging zero access ACE %u onto ACE %u.\n",
3059	(unsigned int)i, (unsigned int)j ));
3060	} else {
3061	/*
3062	* These are identical except for the flags.
3063	* Merge the inherited ACE onto the non-inherited ACE.
3064	*/
3065
3066	nt_ace_list[i].flags = SEC_ACE_FLAG_OBJECT_INHERIT\|SEC_ACE_FLAG_CONTAINER_INHERIT\|
3067	(i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0);
3068	if (num_aces - j - 1 > 0)
3069	memmove(&nt_ace_list[j], &nt_ace_list[j+1], (num_aces-j-1) *
3070	sizeof(struct security_ace));
3071
3072	DEBUG(10,("merge_default_aces: Merging ACE %u onto ACE %u.\n",
3073	(unsigned int)j, (unsigned int)i ));
3074	}
3075	num_aces--;
3076	break;
3077	}
3078	}
3079	}
3080
3081	return num_aces;
3082	}
3083
3084	/*
3085	* Add or Replace ACE entry.
3086	* In some cases we need to add a specific ACE for compatibility reasons.
3087	* When doing that we must make sure we are not actually creating a duplicate
3088	* entry. So we need to search whether an ACE entry already exist and eventually
3089	* replacce the access mask, or add a completely new entry if none was found.
3090	*
3091	* This function assumes the array has enough space to add a new entry without
3092	* any reallocation of memory.
3093	*/
3094
3095	static void add_or_replace_ace(struct security_ace nt_ace_list, size_t num_aces,
3096	const struct dom_sid *sid, enum security_ace_type type,
3097	uint32_t mask, uint8_t flags)
3098	{
3099	int i;
3100
3101	/* first search for a duplicate */
3102	for (i = 0; i < *num_aces; i++) {
3103	if (dom_sid_equal(&nt_ace_list[i].trustee, sid) &&
3104	(nt_ace_list[i].flags == flags)) break;
3105	}
3106
3107	if (i < num_aces) { / found */
3108	nt_ace_list[i].type = type;
3109	nt_ace_list[i].access_mask = mask;
3110	DEBUG(10, ("Replacing ACE %d with SID %s and flags %02x\n",
3111	i, sid_string_dbg(sid), flags));
3112	return;
3113	}
3114
3115	/* not found, append it */
3116	init_sec_ace(&nt_ace_list[(*num_aces)++], sid, type, mask, flags);
3117	}
3118
3119
3120	/****************************************************************************
3121	Reply to query a security descriptor from an fsp. If it succeeds it allocates
3122	the space for the return elements and returns the size needed to return the
3123	security descriptor. This should be the only external function needed for
3124	the UNIX style get ACL.
3125	****************************************************************************/
3126
3127	static NTSTATUS posix_get_nt_acl_common(struct connection_struct *conn,
3128	const char *name,
3129	const SMB_STRUCT_STAT *sbuf,
3130	struct pai_val *pal,
3131	SMB_ACL_T posix_acl,
3132	SMB_ACL_T def_acl,
3133	uint32_t security_info,
3134	struct security_descriptor **ppdesc)
3135	{
3136	struct dom_sid owner_sid;
3137	struct dom_sid group_sid;
3138	size_t sd_size = 0;
3139	struct security_acl *psa = NULL;
3140	size_t num_acls = 0;
3141	size_t num_def_acls = 0;
3142	size_t num_aces = 0;
3143	canon_ace *file_ace = NULL;
3144	canon_ace *dir_ace = NULL;
3145	struct security_ace *nt_ace_list = NULL;
3146	size_t num_profile_acls = 0;
3147	struct dom_sid orig_owner_sid;
3148	struct security_descriptor *psd = NULL;
3149	int i;
3150
3151	/*
3152	* Get the owner, group and world SIDs.
3153	*/
3154
3155	create_file_sids(sbuf, &owner_sid, &group_sid);
3156
3157	if (lp_profile_acls(SNUM(conn))) {
3158	/* For WXP SP1 the owner must be administrators. */
3159	sid_copy(&orig_owner_sid, &owner_sid);
3160	sid_copy(&owner_sid, &global_sid_Builtin_Administrators);
3161	sid_copy(&group_sid, &global_sid_Builtin_Users);
3162	num_profile_acls = 3;
3163	}
3164
3165	if ((security_info & SECINFO_DACL) && !(security_info & SECINFO_PROTECTED_DACL)) {
3166
3167	/*
3168	* In the optimum case Creator Owner and Creator Group would be used for
3169	* the ACL_USER_OBJ and ACL_GROUP_OBJ entries, respectively, but this
3170	* would lead to usability problems under Windows: The Creator entries
3171	* are only available in browse lists of directories and not for files;
3172	* additionally the identity of the owning group couldn't be determined.
3173	* We therefore use those identities only for Default ACLs.
3174	*/
3175
3176	/* Create the canon_ace lists. */
3177	file_ace = canonicalise_acl(conn, name, posix_acl, sbuf,
3178	&owner_sid, &group_sid, pal,
3179	SMB_ACL_TYPE_ACCESS);
3180
3181	/* We must have some ACLS. */
3182
3183	if (count_canon_ace_list(file_ace) == 0) {
3184	DEBUG(0,("get_nt_acl : No ACLs on file (%s) !\n", name));
3185	goto done;
3186	}
3187
3188	if (S_ISDIR(sbuf->st_ex_mode) && def_acl) {
3189	dir_ace = canonicalise_acl(conn, name, def_acl,
3190	sbuf,
3191	&global_sid_Creator_Owner,
3192	&global_sid_Creator_Group,
3193	pal, SMB_ACL_TYPE_DEFAULT);
3194	}
3195
3196	/*
3197	* Create the NT ACE list from the canonical ace lists.
3198	*/
3199
3200	{
3201	canon_ace *ace;
3202	enum security_ace_type nt_acl_type;
3203
3204	if (nt4_compatible_acls() && dir_ace) {
3205	/*
3206	* NT 4 chokes if an ACL contains an INHERIT_ONLY entry
3207	* but no non-INHERIT_ONLY entry for one SID. So we only
3208	* remove entries from the Access ACL if the
3209	* corresponding Default ACL entries have also been
3210	* removed. ACEs for CREATOR-OWNER and CREATOR-GROUP
3211	* are exceptions. We can do nothing
3212	* intelligent if the Default ACL contains entries that
3213	* are not also contained in the Access ACL, so this
3214	* case will still fail under NT 4.
3215	*/
3216
3217	ace = canon_ace_entry_for(dir_ace, SMB_ACL_OTHER, NULL);
3218	if (ace && !ace->perms) {
3219	DLIST_REMOVE(dir_ace, ace);
3220	SAFE_FREE(ace);
3221
3222	ace = canon_ace_entry_for(file_ace, SMB_ACL_OTHER, NULL);
3223	if (ace && !ace->perms) {
3224	DLIST_REMOVE(file_ace, ace);
3225	SAFE_FREE(ace);
3226	}
3227	}
3228
3229	/*
3230	* WinNT doesn't usually have Creator Group
3231	* in browse lists, so we send this entry to
3232	* WinNT even if it contains no relevant
3233	* permissions. Once we can add
3234	* Creator Group to browse lists we can
3235	* re-enable this.
3236	*/
3237
3238	#if 0
3239	ace = canon_ace_entry_for(dir_ace, SMB_ACL_GROUP_OBJ, NULL);
3240	if (ace && !ace->perms) {
3241	DLIST_REMOVE(dir_ace, ace);
3242	SAFE_FREE(ace);
3243	}
3244	#endif
3245
3246	ace = canon_ace_entry_for(file_ace, SMB_ACL_GROUP_OBJ, NULL);
3247	if (ace && !ace->perms) {
3248	DLIST_REMOVE(file_ace, ace);
3249	SAFE_FREE(ace);
3250	}
3251	}
3252
3253	num_acls = count_canon_ace_list(file_ace);
3254	num_def_acls = count_canon_ace_list(dir_ace);
3255
3256	/* Allocate the ace list. */
3257	if ((nt_ace_list = SMB_MALLOC_ARRAY(struct security_ace,num_acls + num_profile_acls + num_def_acls)) == NULL) {
3258	DEBUG(0,("get_nt_acl: Unable to malloc space for nt_ace_list.\n"));
3259	goto done;
3260	}
3261
3262	memset(nt_ace_list, '\0', (num_acls + num_def_acls) * sizeof(struct security_ace) );
3263
3264	/*
3265	* Create the NT ACE list from the canonical ace lists.
3266	*/
3267
3268	for (ace = file_ace; ace != NULL; ace = ace->next) {
3269	uint32_t acc = map_canon_ace_perms(SNUM(conn),
3270	&nt_acl_type,
3271	ace->perms,
3272	S_ISDIR(sbuf->st_ex_mode));
3273	init_sec_ace(&nt_ace_list[num_aces++],
3274	&ace->trustee,
3275	nt_acl_type,
3276	acc,
3277	ace->ace_flags);
3278	}
3279
3280	/* The User must have access to a profile share - even
3281	* if we can't map the SID. */
3282	if (lp_profile_acls(SNUM(conn))) {
3283	add_or_replace_ace(nt_ace_list, &num_aces,
3284	&global_sid_Builtin_Users,
3285	SEC_ACE_TYPE_ACCESS_ALLOWED,
3286	FILE_GENERIC_ALL, 0);
3287	}
3288
3289	for (ace = dir_ace; ace != NULL; ace = ace->next) {
3290	uint32_t acc = map_canon_ace_perms(SNUM(conn),
3291	&nt_acl_type,
3292	ace->perms,
3293	S_ISDIR(sbuf->st_ex_mode));
3294	init_sec_ace(&nt_ace_list[num_aces++],
3295	&ace->trustee,
3296	nt_acl_type,
3297	acc,
3298	ace->ace_flags \|
3299	SEC_ACE_FLAG_OBJECT_INHERIT\|
3300	SEC_ACE_FLAG_CONTAINER_INHERIT\|
3301	SEC_ACE_FLAG_INHERIT_ONLY);
3302	}
3303
3304	/* The User must have access to a profile share - even
3305	* if we can't map the SID. */
3306	if (lp_profile_acls(SNUM(conn))) {
3307	add_or_replace_ace(nt_ace_list, &num_aces,
3308	&global_sid_Builtin_Users,
3309	SEC_ACE_TYPE_ACCESS_ALLOWED,
3310	FILE_GENERIC_ALL,
3311	SEC_ACE_FLAG_OBJECT_INHERIT \|
3312	SEC_ACE_FLAG_CONTAINER_INHERIT \|
3313	SEC_ACE_FLAG_INHERIT_ONLY);
3314	}
3315
3316	/*
3317	* Merge POSIX default ACLs and normal ACLs into one NT ACE.
3318	* Win2K needs this to get the inheritance correct when replacing ACLs
3319	* on a directory tree. Based on work by Jim @ IBM.
3320	*/
3321
3322	num_aces = merge_default_aces(nt_ace_list, num_aces);
3323
3324	if (lp_profile_acls(SNUM(conn))) {
3325	for (i = 0; i < num_aces; i++) {
3326	if (dom_sid_equal(&nt_ace_list[i].trustee, &owner_sid)) {
3327	add_or_replace_ace(nt_ace_list, &num_aces,
3328	&orig_owner_sid,
3329	nt_ace_list[i].type,
3330	nt_ace_list[i].access_mask,
3331	nt_ace_list[i].flags);
3332	break;
3333	}
3334	}
3335	}
3336	}
3337
3338	if (num_aces) {
3339	if((psa = make_sec_acl( talloc_tos(), NT4_ACL_REVISION, num_aces, nt_ace_list)) == NULL) {
3340	DEBUG(0,("get_nt_acl: Unable to malloc space for acl.\n"));
3341	goto done;
3342	}
3343	}
3344	} /* security_info & SECINFO_DACL */
3345
3346	psd = make_standard_sec_desc( talloc_tos(),
3347	(security_info & SECINFO_OWNER) ? &owner_sid : NULL,
3348	(security_info & SECINFO_GROUP) ? &group_sid : NULL,
3349	psa,
3350	&sd_size);
3351
3352	if(!psd) {
3353	DEBUG(0,("get_nt_acl: Unable to malloc space for security descriptor.\n"));
3354	sd_size = 0;
3355	goto done;
3356	}
3357
3358	/*
3359	* Windows 2000: The DACL_PROTECTED flag in the security
3360	* descriptor marks the ACL as non-inheriting, i.e., no
3361	* ACEs from higher level directories propagate to this
3362	* ACL. In the POSIX ACL model permissions are only
3363	* inherited at file create time, so ACLs never contain
3364	* any ACEs that are inherited dynamically. The DACL_PROTECTED
3365	* flag doesn't seem to bother Windows NT.
3366	* Always set this if map acl inherit is turned off.
3367	*/
3368	if (pal == NULL \|\| !lp_map_acl_inherit(SNUM(conn))) {
3369	psd->type \|= SEC_DESC_DACL_PROTECTED;
3370	} else {
3371	psd->type \|= pal->sd_type;
3372	}
3373
3374	if (psd->dacl) {
3375	dacl_sort_into_canonical_order(psd->dacl->aces, (unsigned int)psd->dacl->num_aces);
3376	}
3377
3378	*ppdesc = psd;
3379
3380	done:
3381
3382	if (posix_acl) {
3383	SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
3384	}
3385	if (def_acl) {
3386	SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
3387	}
3388	free_canon_ace_list(file_ace);
3389	free_canon_ace_list(dir_ace);
3390	free_inherited_info(pal);
3391	SAFE_FREE(nt_ace_list);
3392
3393	return NT_STATUS_OK;
3394	}
3395
3396	NTSTATUS posix_fget_nt_acl(struct files_struct *fsp, uint32_t security_info,
3397	struct security_descriptor **ppdesc)
3398	{
3399	SMB_STRUCT_STAT sbuf;
3400	SMB_ACL_T posix_acl = NULL;
3401	struct pai_val *pal;
3402
3403	*ppdesc = NULL;
3404
3405	DEBUG(10,("posix_fget_nt_acl: called for file %s\n",
3406	fsp_str_dbg(fsp)));
3407
3408	/* can it happen that fsp_name == NULL ? */
3409	if (fsp->is_directory \|\| fsp->fh->fd == -1) {
3410	return posix_get_nt_acl(fsp->conn, fsp->fsp_name->base_name,
3411	security_info, ppdesc);
3412	}
3413
3414	/* Get the stat struct for the owner info. */
3415	if(SMB_VFS_FSTAT(fsp, &sbuf) != 0) {
3416	return map_nt_error_from_unix(errno);
3417	}
3418
3419	/* Get the ACL from the fd. */
3420	posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp);
3421
3422	pal = fload_inherited_info(fsp);
3423
3424	return posix_get_nt_acl_common(fsp->conn, fsp->fsp_name->base_name,
3425	&sbuf, pal, posix_acl, NULL,
3426	security_info, ppdesc);
3427	}
3428
3429	NTSTATUS posix_get_nt_acl(struct connection_struct conn, const char name,
3430	uint32_t security_info, struct security_descriptor **ppdesc)
3431	{
3432	SMB_ACL_T posix_acl = NULL;
3433	SMB_ACL_T def_acl = NULL;
3434	struct pai_val *pal;
3435	struct smb_filename smb_fname;
3436	int ret;
3437
3438	*ppdesc = NULL;
3439
3440	DEBUG(10,("posix_get_nt_acl: called for file %s\n", name ));
3441
3442	ZERO_STRUCT(smb_fname);
3443	smb_fname.base_name = discard_const_p(char, name);
3444
3445	/* Get the stat struct for the owner info. */
3446	if (lp_posix_pathnames()) {
3447	ret = SMB_VFS_LSTAT(conn, &smb_fname);
3448	} else {
3449	ret = SMB_VFS_STAT(conn, &smb_fname);
3450	}
3451
3452	if (ret == -1) {
3453	return map_nt_error_from_unix(errno);
3454	}
3455
3456	/* Get the ACL from the path. */
3457	posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name, SMB_ACL_TYPE_ACCESS);
3458
3459	/* If it's a directory get the default POSIX ACL. */
3460	if(S_ISDIR(smb_fname.st.st_ex_mode)) {
3461	def_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name, SMB_ACL_TYPE_DEFAULT);
3462	def_acl = free_empty_sys_acl(conn, def_acl);
3463	}
3464
3465	pal = load_inherited_info(conn, name);
3466
3467	return posix_get_nt_acl_common(conn, name, &smb_fname.st, pal,
3468	posix_acl, def_acl, security_info,
3469	ppdesc);
3470	}
3471
3472	/****************************************************************************
3473	Try to chown a file. We will be able to chown it under the following conditions.
3474
3475	1) If we have root privileges, then it will just work.
3476	2) If we have SeRestorePrivilege we can change the user + group to any other user.
3477	3) If we have SeTakeOwnershipPrivilege we can change the user to the current user.
3478	4) If we have write permission to the file and dos_filemodes is set
3479	then allow chown to the currently authenticated user.
3480	****************************************************************************/
3481
3482	NTSTATUS try_chown(files_struct *fsp, uid_t uid, gid_t gid)
3483	{
3484	NTSTATUS status;
3485
3486	if(!CAN_WRITE(fsp->conn)) {
3487	return NT_STATUS_MEDIA_WRITE_PROTECTED;
3488	}
3489
3490	/* Case (1). */
3491	status = vfs_chown_fsp(fsp, uid, gid);
3492	if (NT_STATUS_IS_OK(status)) {
3493	return status;
3494	}
3495
3496	/* Case (2) / (3) */
3497	if (lp_enable_privileges()) {
3498	bool has_take_ownership_priv = security_token_has_privilege(
3499	get_current_nttok(fsp->conn),
3500	SEC_PRIV_TAKE_OWNERSHIP);
3501	bool has_restore_priv = security_token_has_privilege(
3502	get_current_nttok(fsp->conn),
3503	SEC_PRIV_RESTORE);
3504
3505	if (has_restore_priv) {
3506	; /* Case (2) */
3507	} else if (has_take_ownership_priv) {
3508	/* Case (3) */
3509	if (uid == get_current_uid(fsp->conn)) {
3510	gid = (gid_t)-1;
3511	} else {
3512	has_take_ownership_priv = false;
3513	}
3514	}
3515
3516	if (has_take_ownership_priv \|\| has_restore_priv) {
3517	become_root();
3518	status = vfs_chown_fsp(fsp, uid, gid);
3519	unbecome_root();
3520	return status;
3521	}
3522	}
3523
3524	/* Case (4). */
3525	if (!lp_dos_filemode(SNUM(fsp->conn))) {
3526	return NT_STATUS_ACCESS_DENIED;
3527	}
3528
3529	/* only allow chown to the current user. This is more secure,
3530	and also copes with the case where the SID in a take ownership ACL is
3531	a local SID on the users workstation
3532	*/
3533	if (uid != get_current_uid(fsp->conn)) {
3534	return NT_STATUS_ACCESS_DENIED;
3535	}
3536
3537	become_root();
3538	/* Keep the current file gid the same. */
3539	status = vfs_chown_fsp(fsp, uid, (gid_t)-1);
3540	unbecome_root();
3541
3542	return status;
3543	}
3544
3545	#if 0
3546	/* Disable this - prevents ACL inheritance from the ACL editor. JRA. */
3547
3548	/****************************************************************************
3549	Take care of parent ACL inheritance.
3550	****************************************************************************/
3551
3552	NTSTATUS append_parent_acl(files_struct *fsp,
3553	const struct security_descriptor *pcsd,
3554	struct security_descriptor **pp_new_sd)
3555	{
3556	struct smb_filename *smb_dname = NULL;
3557	struct security_descriptor *parent_sd = NULL;
3558	files_struct *parent_fsp = NULL;
3559	TALLOC_CTX *mem_ctx = talloc_tos();
3560	char *parent_name = NULL;
3561	struct security_ace *new_ace = NULL;
3562	unsigned int num_aces = pcsd->dacl->num_aces;
3563	NTSTATUS status;
3564	int info;
3565	unsigned int i, j;
3566	struct security_descriptor *psd = dup_sec_desc(talloc_tos(), pcsd);
3567	bool is_dacl_protected = (pcsd->type & SEC_DESC_DACL_PROTECTED);
3568
3569	if (psd == NULL) {
3570	return NT_STATUS_NO_MEMORY;
3571	}
3572
3573	if (!parent_dirname(mem_ctx, fsp->fsp_name->base_name, &parent_name,
3574	NULL)) {
3575	return NT_STATUS_NO_MEMORY;
3576	}
3577
3578	status = create_synthetic_smb_fname(mem_ctx, parent_name, NULL, NULL,
3579	&smb_dname);
3580	if (!NT_STATUS_IS_OK(status)) {
3581	goto fail;
3582	}
3583
3584	status = SMB_VFS_CREATE_FILE(
3585	fsp->conn, /* conn */
3586	NULL, /* req */
3587	0, /* root_dir_fid */
3588	smb_dname, /* fname */
3589	FILE_READ_ATTRIBUTES, /* access_mask */
3590	FILE_SHARE_NONE, /* share_access */
3591	FILE_OPEN, /* create_disposition*/
3592	FILE_DIRECTORY_FILE, /* create_options */
3593	0, /* file_attributes */
3594	INTERNAL_OPEN_ONLY, /* oplock_request */
3595	0, /* allocation_size */
3596	NULL, /* sd */
3597	NULL, /* ea_list */
3598	&parent_fsp, /* result */
3599	&info); /* pinfo */
3600
3601	if (!NT_STATUS_IS_OK(status)) {
3602	TALLOC_FREE(smb_dname);
3603	return status;
3604	}
3605
3606	status = SMB_VFS_GET_NT_ACL(parent_fsp->conn, smb_dname->base_name,
3607	SECINFO_DACL, &parent_sd );
3608
3609	close_file(NULL, parent_fsp, NORMAL_CLOSE);
3610	TALLOC_FREE(smb_dname);
3611
3612	if (!NT_STATUS_IS_OK(status)) {
3613	return status;
3614	}
3615
3616	/*
3617	* Make room for potentially all the ACLs from
3618	* the parent. We used to add the ugw triple here,
3619	* as we knew we were dealing with POSIX ACLs.
3620	* We no longer need to do so as we can guarentee
3621	* that a default ACL from the parent directory will
3622	* be well formed for POSIX ACLs if it came from a
3623	* POSIX ACL source, and if we're not writing to a
3624	* POSIX ACL sink then we don't care if it's not well
3625	* formed. JRA.
3626	*/
3627
3628	num_aces += parent_sd->dacl->num_aces;
3629
3630	if((new_ace = TALLOC_ZERO_ARRAY(mem_ctx, struct security_ace,
3631	num_aces)) == NULL) {
3632	return NT_STATUS_NO_MEMORY;
3633	}
3634
3635	/* Start by copying in all the given ACE entries. */
3636	for (i = 0; i < psd->dacl->num_aces; i++) {
3637	sec_ace_copy(&new_ace[i], &psd->dacl->aces[i]);
3638	}
3639
3640	/*
3641	* Note that we're ignoring "inherit permissions" here
3642	* as that really only applies to newly created files. JRA.
3643	*/
3644
3645	/* Finally append any inherited ACEs. */
3646	for (j = 0; j < parent_sd->dacl->num_aces; j++) {
3647	struct security_ace *se = &parent_sd->dacl->aces[j];
3648
3649	if (fsp->is_directory) {
3650	if (!(se->flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
3651	/* Doesn't apply to a directory - ignore. */
3652	DEBUG(10,("append_parent_acl: directory %s "
3653	"ignoring non container "
3654	"inherit flags %u on ACE with sid %s "
3655	"from parent %s\n",
3656	fsp_str_dbg(fsp),
3657	(unsigned int)se->flags,
3658	sid_string_dbg(&se->trustee),
3659	parent_name));
3660	continue;
3661	}
3662	} else {
3663	if (!(se->flags & SEC_ACE_FLAG_OBJECT_INHERIT)) {
3664	/* Doesn't apply to a file - ignore. */
3665	DEBUG(10,("append_parent_acl: file %s "
3666	"ignoring non object "
3667	"inherit flags %u on ACE with sid %s "
3668	"from parent %s\n",
3669	fsp_str_dbg(fsp),
3670	(unsigned int)se->flags,
3671	sid_string_dbg(&se->trustee),
3672	parent_name));
3673	continue;
3674	}
3675	}
3676
3677	if (is_dacl_protected) {
3678	/* If the DACL is protected it means we must
3679	* not overwrite an existing ACE entry with the
3680	* same SID. This is order N^2. Ouch :-(. JRA. */
3681	unsigned int k;
3682	for (k = 0; k < psd->dacl->num_aces; k++) {
3683	if (dom_sid_equal(&psd->dacl->aces[k].trustee,
3684	&se->trustee)) {
3685	break;
3686	}
3687	}
3688	if (k < psd->dacl->num_aces) {
3689	/* SID matched. Ignore. */
3690	DEBUG(10,("append_parent_acl: path %s "
3691	"ignoring ACE with protected sid %s "
3692	"from parent %s\n",
3693	fsp_str_dbg(fsp),
3694	sid_string_dbg(&se->trustee),
3695	parent_name));
3696	continue;
3697	}
3698	}
3699
3700	sec_ace_copy(&new_ace[i], se);
3701	if (se->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
3702	new_ace[i].flags &= ~(SEC_ACE_FLAG_VALID_INHERIT);
3703	}
3704	new_ace[i].flags \|= SEC_ACE_FLAG_INHERITED_ACE;
3705
3706	if (fsp->is_directory) {
3707	/*
3708	* Strip off any inherit only. It's applied.
3709	*/
3710	new_ace[i].flags &= ~(SEC_ACE_FLAG_INHERIT_ONLY);
3711	if (se->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
3712	/* No further inheritance. */
3713	new_ace[i].flags &=
3714	~(SEC_ACE_FLAG_CONTAINER_INHERIT\|
3715	SEC_ACE_FLAG_OBJECT_INHERIT);
3716	}
3717	} else {
3718	/*
3719	* Strip off any container or inherit
3720	* flags, they can't apply to objects.
3721	*/
3722	new_ace[i].flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT\|
3723	SEC_ACE_FLAG_INHERIT_ONLY\|
3724	SEC_ACE_FLAG_NO_PROPAGATE_INHERIT);
3725	}
3726	i++;
3727
3728	DEBUG(10,("append_parent_acl: path %s "
3729	"inheriting ACE with sid %s "
3730	"from parent %s\n",
3731	fsp_str_dbg(fsp),
3732	sid_string_dbg(&se->trustee),
3733	parent_name));
3734	}
3735
3736	psd->dacl->aces = new_ace;
3737	psd->dacl->num_aces = i;
3738	psd->type &= ~(SEC_DESC_DACL_AUTO_INHERITED\|
3739	SEC_DESC_DACL_AUTO_INHERIT_REQ);
3740
3741	*pp_new_sd = psd;
3742	return status;
3743	}
3744	#endif
3745
3746	/****************************************************************************
3747	Reply to set a security descriptor on an fsp. security_info_sent is the
3748	description of the following NT ACL.
3749	This should be the only external function needed for the UNIX style set ACL.
3750	We make a copy of psd_orig as internal functions modify the elements inside
3751	it, even though it's a const pointer.
3752	****************************************************************************/
3753
3754	NTSTATUS set_nt_acl(files_struct fsp, uint32 security_info_sent, const struct security_descriptor psd_orig)
3755	{
3756	connection_struct *conn = fsp->conn;
3757	uid_t user = (uid_t)-1;
3758	gid_t grp = (gid_t)-1;
3759	struct dom_sid file_owner_sid;
3760	struct dom_sid file_grp_sid;
3761	canon_ace *file_ace_list = NULL;
3762	canon_ace *dir_ace_list = NULL;
3763	bool acl_perms = False;
3764	mode_t orig_mode = (mode_t)0;
3765	NTSTATUS status;
3766	bool set_acl_as_root = false;
3767	bool acl_set_support = false;
3768	bool ret = false;
3769	struct security_descriptor *psd = NULL;
3770
3771	DEBUG(10,("set_nt_acl: called for file %s\n",
3772	fsp_str_dbg(fsp)));
3773
3774	if (!CAN_WRITE(conn)) {
3775	DEBUG(10,("set acl rejected on read-only share\n"));
3776	return NT_STATUS_MEDIA_WRITE_PROTECTED;
3777	}
3778
3779	if (!psd_orig) {
3780	return NT_STATUS_INVALID_PARAMETER;
3781	}
3782
3783	psd = dup_sec_desc(talloc_tos(), psd_orig);
3784	if (!psd) {
3785	return NT_STATUS_NO_MEMORY;
3786	}
3787
3788	/*
3789	* Get the current state of the file.
3790	*/
3791
3792	status = vfs_stat_fsp(fsp);
3793	if (!NT_STATUS_IS_OK(status)) {
3794	return status;
3795	}
3796
3797	/* Save the original element we check against. */
3798	orig_mode = fsp->fsp_name->st.st_ex_mode;
3799
3800	/*
3801	* Unpack the user/group/world id's.
3802	*/
3803
3804	/* POSIX can't cope with missing owner/group. */
3805	if ((security_info_sent & SECINFO_OWNER) && (psd->owner_sid == NULL)) {
3806	security_info_sent &= ~SECINFO_OWNER;
3807	}
3808	if ((security_info_sent & SECINFO_GROUP) && (psd->group_sid == NULL)) {
3809	security_info_sent &= ~SECINFO_GROUP;
3810	}
3811
3812	status = unpack_nt_owners( conn, &user, &grp, security_info_sent, psd);
3813	if (!NT_STATUS_IS_OK(status)) {
3814	return status;
3815	}
3816
3817	/*
3818	* Do we need to chown ? If so this must be done first as the incoming
3819	* CREATOR_OWNER acl will be relative to the new owner, not the old.
3820	* Noticed by Simo.
3821	*/
3822
3823	if (((user != (uid_t)-1) && (fsp->fsp_name->st.st_ex_uid != user)) \|\|
3824	(( grp != (gid_t)-1) && (fsp->fsp_name->st.st_ex_gid != grp))) {
3825
3826	DEBUG(3,("set_nt_acl: chown %s. uid = %u, gid = %u.\n",
3827	fsp_str_dbg(fsp), (unsigned int)user,
3828	(unsigned int)grp));
3829
3830	status = try_chown(fsp, user, grp);
3831	if(!NT_STATUS_IS_OK(status)) {
3832	DEBUG(3,("set_nt_acl: chown %s, %u, %u failed. Error "
3833	"= %s.\n", fsp_str_dbg(fsp),
3834	(unsigned int)user,
3835	(unsigned int)grp,
3836	nt_errstr(status)));
3837	return status;
3838	}
3839
3840	/*
3841	* Recheck the current state of the file, which may have changed.
3842	* (suid/sgid bits, for instance)
3843	*/
3844
3845	status = vfs_stat_fsp(fsp);
3846	if (!NT_STATUS_IS_OK(status)) {
3847	return status;
3848	}
3849
3850	/* Save the original element we check against. */
3851	orig_mode = fsp->fsp_name->st.st_ex_mode;
3852
3853	/* If we successfully chowned, we know we must
3854	* be able to set the acl, so do it as root.
3855	*/
3856	set_acl_as_root = true;
3857	}
3858
3859	create_file_sids(&fsp->fsp_name->st, &file_owner_sid, &file_grp_sid);
3860
3861	if((security_info_sent & SECINFO_DACL) &&
3862	(psd->type & SEC_DESC_DACL_PRESENT) &&
3863	(psd->dacl == NULL)) {
3864	struct security_ace ace[3];
3865
3866	/* We can't have NULL DACL in POSIX.
3867	Use owner/group/Everyone -> full access. */
3868
3869	init_sec_ace(&ace[0],
3870	&file_owner_sid,
3871	SEC_ACE_TYPE_ACCESS_ALLOWED,
3872	GENERIC_ALL_ACCESS,
3873	0);
3874	init_sec_ace(&ace[1],
3875	&file_grp_sid,
3876	SEC_ACE_TYPE_ACCESS_ALLOWED,
3877	GENERIC_ALL_ACCESS,
3878	0);
3879	init_sec_ace(&ace[2],
3880	&global_sid_World,
3881	SEC_ACE_TYPE_ACCESS_ALLOWED,
3882	GENERIC_ALL_ACCESS,
3883	0);
3884	psd->dacl = make_sec_acl(talloc_tos(),
3885	NT4_ACL_REVISION,
3886	3,
3887	ace);
3888	if (psd->dacl == NULL) {
3889	return NT_STATUS_NO_MEMORY;
3890	}
3891	security_acl_map_generic(psd->dacl, &file_generic_mapping);
3892	}
3893
3894	acl_perms = unpack_canon_ace(fsp, &fsp->fsp_name->st, &file_owner_sid,
3895	&file_grp_sid, &file_ace_list,
3896	&dir_ace_list, security_info_sent, psd);
3897
3898	/* Ignore W2K traverse DACL set. */
3899	if (!file_ace_list && !dir_ace_list) {
3900	return NT_STATUS_OK;
3901	}
3902
3903	if (!acl_perms) {
3904	DEBUG(3,("set_nt_acl: cannot set permissions\n"));
3905	free_canon_ace_list(file_ace_list);
3906	free_canon_ace_list(dir_ace_list);
3907	return NT_STATUS_ACCESS_DENIED;
3908	}
3909
3910	/*
3911	* Only change security if we got a DACL.
3912	*/
3913
3914	if(!(security_info_sent & SECINFO_DACL) \|\| (psd->dacl == NULL)) {
3915	free_canon_ace_list(file_ace_list);
3916	free_canon_ace_list(dir_ace_list);
3917	return NT_STATUS_OK;
3918	}
3919
3920	/*
3921	* Try using the POSIX ACL set first. Fall back to chmod if
3922	* we have no ACL support on this filesystem.
3923	*/
3924
3925	if (acl_perms && file_ace_list) {
3926	if (set_acl_as_root) {
3927	become_root();
3928	}
3929	ret = set_canon_ace_list(fsp, file_ace_list, false,
3930	&fsp->fsp_name->st, &acl_set_support);
3931	if (set_acl_as_root) {
3932	unbecome_root();
3933	}
3934	if (acl_set_support && ret == false) {
3935	DEBUG(3,("set_nt_acl: failed to set file acl on file "
3936	"%s (%s).\n", fsp_str_dbg(fsp),
3937	strerror(errno)));
3938	free_canon_ace_list(file_ace_list);
3939	free_canon_ace_list(dir_ace_list);
3940	return map_nt_error_from_unix(errno);
3941	}
3942	}
3943
3944	if (acl_perms && acl_set_support && fsp->is_directory) {
3945	if (dir_ace_list) {
3946	if (set_acl_as_root) {
3947	become_root();
3948	}
3949	ret = set_canon_ace_list(fsp, dir_ace_list, true,
3950	&fsp->fsp_name->st,
3951	&acl_set_support);
3952	if (set_acl_as_root) {
3953	unbecome_root();
3954	}
3955	if (ret == false) {
3956	DEBUG(3,("set_nt_acl: failed to set default "
3957	"acl on directory %s (%s).\n",
3958	fsp_str_dbg(fsp), strerror(errno)));
3959	free_canon_ace_list(file_ace_list);
3960	free_canon_ace_list(dir_ace_list);
3961	return map_nt_error_from_unix(errno);
3962	}
3963	} else {
3964	int sret = -1;
3965
3966	/*
3967	* No default ACL - delete one if it exists.
3968	*/
3969
3970	if (set_acl_as_root) {
3971	become_root();
3972	}
3973	sret = SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn,
3974	fsp->fsp_name->base_name);
3975	if (set_acl_as_root) {
3976	unbecome_root();
3977	}
3978	if (sret == -1) {
3979	if (acl_group_override(conn, fsp->fsp_name)) {
3980	DEBUG(5,("set_nt_acl: acl group "
3981	"control on and current user "
3982	"in file %s primary group. "
3983	"Override delete_def_acl\n",
3984	fsp_str_dbg(fsp)));
3985
3986	become_root();
3987	sret =
3988	SMB_VFS_SYS_ACL_DELETE_DEF_FILE(
3989	conn,
3990	fsp->fsp_name->base_name);
3991	unbecome_root();
3992	}
3993
3994	if (sret == -1) {
3995	DEBUG(3,("set_nt_acl: sys_acl_delete_def_file failed (%s)\n", strerror(errno)));
3996	free_canon_ace_list(file_ace_list);
3997	free_canon_ace_list(dir_ace_list);
3998	return map_nt_error_from_unix(errno);
3999	}
4000	}
4001	}
4002	}
4003
4004	if (acl_set_support) {
4005	if (set_acl_as_root) {
4006	become_root();
4007	}
4008	store_inheritance_attributes(fsp,
4009	file_ace_list,
4010	dir_ace_list,
4011	psd->type);
4012	if (set_acl_as_root) {
4013	unbecome_root();
4014	}
4015	}
4016
4017	/*
4018	* If we cannot set using POSIX ACLs we fall back to checking if we need to chmod.
4019	*/
4020
4021	if(!acl_set_support && acl_perms) {
4022	mode_t posix_perms;
4023
4024	if (!convert_canon_ace_to_posix_perms( fsp, file_ace_list, &posix_perms)) {
4025	free_canon_ace_list(file_ace_list);
4026	free_canon_ace_list(dir_ace_list);
4027	DEBUG(3,("set_nt_acl: failed to convert file acl to "
4028	"posix permissions for file %s.\n",
4029	fsp_str_dbg(fsp)));
4030	return NT_STATUS_ACCESS_DENIED;
4031	}
4032
4033	if (orig_mode != posix_perms) {
4034	int sret = -1;
4035
4036	DEBUG(3,("set_nt_acl: chmod %s. perms = 0%o.\n",
4037	fsp_str_dbg(fsp), (unsigned int)posix_perms));
4038
4039	if (set_acl_as_root) {
4040	become_root();
4041	}
4042	sret = SMB_VFS_CHMOD(conn, fsp->fsp_name->base_name,
4043	posix_perms);
4044	if (set_acl_as_root) {
4045	unbecome_root();
4046	}
4047	if(sret == -1) {
4048	if (acl_group_override(conn, fsp->fsp_name)) {
4049	DEBUG(5,("set_nt_acl: acl group "
4050	"control on and current user "
4051	"in file %s primary group. "
4052	"Override chmod\n",
4053	fsp_str_dbg(fsp)));
4054
4055	become_root();
4056	sret = SMB_VFS_CHMOD(conn,
4057	fsp->fsp_name->base_name,
4058	posix_perms);
4059	unbecome_root();
4060	}
4061
4062	if (sret == -1) {
4063	DEBUG(3,("set_nt_acl: chmod %s, 0%o "
4064	"failed. Error = %s.\n",
4065	fsp_str_dbg(fsp),
4066	(unsigned int)posix_perms,
4067	strerror(errno)));
4068	free_canon_ace_list(file_ace_list);
4069	free_canon_ace_list(dir_ace_list);
4070	return map_nt_error_from_unix(errno);
4071	}
4072	}
4073	}
4074	}
4075
4076	free_canon_ace_list(file_ace_list);
4077	free_canon_ace_list(dir_ace_list);
4078
4079	/* Ensure the stat struct in the fsp is correct. */
4080	status = vfs_stat_fsp(fsp);
4081
4082	return NT_STATUS_OK;
4083	}
4084
4085	/****************************************************************************
4086	Get the actual group bits stored on a file with an ACL. Has no effect if
4087	the file has no ACL. Needed in dosmode code where the stat() will return
4088	the mask bits, not the real group bits, for a file with an ACL.
4089	****************************************************************************/
4090
4091	int get_acl_group_bits( connection_struct conn, const char fname, mode_t *mode )
4092	{
4093	int entry_id = SMB_ACL_FIRST_ENTRY;
4094	SMB_ACL_ENTRY_T entry;
4095	SMB_ACL_T posix_acl;
4096	int result = -1;
4097
4098	posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS);
4099	if (posix_acl == (SMB_ACL_T)NULL)
4100	return -1;
4101
4102	while (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) {
4103	SMB_ACL_TAG_T tagtype;
4104	SMB_ACL_PERMSET_T permset;
4105
4106	entry_id = SMB_ACL_NEXT_ENTRY;
4107
4108	if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) ==-1)
4109	break;
4110
4111	if (tagtype == SMB_ACL_GROUP_OBJ) {
4112	if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1) {
4113	break;
4114	} else {
4115	*mode &= ~(S_IRGRP\|S_IWGRP\|S_IXGRP);
4116	*mode \|= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ) ? S_IRGRP : 0);
4117	*mode \|= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE) ? S_IWGRP : 0);
4118	*mode \|= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_EXECUTE) ? S_IXGRP : 0);
4119	result = 0;
4120	break;
4121	}
4122	}
4123	}
4124	SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
4125	return result;
4126	}
4127
4128	/****************************************************************************
4129	Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4130	and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4131	****************************************************************************/
4132
4133	static int chmod_acl_internals( connection_struct *conn, SMB_ACL_T posix_acl, mode_t mode)
4134	{
4135	int entry_id = SMB_ACL_FIRST_ENTRY;
4136	SMB_ACL_ENTRY_T entry;
4137	int num_entries = 0;
4138
4139	while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) {
4140	SMB_ACL_TAG_T tagtype;
4141	SMB_ACL_PERMSET_T permset;
4142	mode_t perms;
4143
4144	entry_id = SMB_ACL_NEXT_ENTRY;
4145
4146	if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1)
4147	return -1;
4148
4149	if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1)
4150	return -1;
4151
4152	num_entries++;
4153
4154	switch(tagtype) {
4155	case SMB_ACL_USER_OBJ:
4156	perms = unix_perms_to_acl_perms(mode, S_IRUSR, S_IWUSR, S_IXUSR);
4157	break;
4158	case SMB_ACL_GROUP_OBJ:
4159	perms = unix_perms_to_acl_perms(mode, S_IRGRP, S_IWGRP, S_IXGRP);
4160	break;
4161	case SMB_ACL_MASK:
4162	/*
4163	* FIXME: The ACL_MASK entry permissions should really be set to
4164	* the union of the permissions of all ACL_USER,
4165	* ACL_GROUP_OBJ, and ACL_GROUP entries. That's what
4166	* acl_calc_mask() does, but Samba ACLs doesn't provide it.
4167	*/
4168	perms = S_IRUSR\|S_IWUSR\|S_IXUSR;
4169	break;
4170	case SMB_ACL_OTHER:
4171	perms = unix_perms_to_acl_perms(mode, S_IROTH, S_IWOTH, S_IXOTH);
4172	break;
4173	default:
4174	continue;
4175	}
4176
4177	if (map_acl_perms_to_permset(conn, perms, &permset) == -1)
4178	return -1;
4179
4180	if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, entry, permset) == -1)
4181	return -1;
4182	}
4183
4184	/*
4185	* If this is a simple 3 element ACL or no elements then it's a standard
4186	* UNIX permission set. Just use chmod...
4187	*/
4188
4189	if ((num_entries == 3) \|\| (num_entries == 0))
4190	return -1;
4191
4192	return 0;
4193	}
4194
4195	/****************************************************************************
4196	Get the access ACL of FROM, do a chmod by setting the ACL USER_OBJ,
4197	GROUP_OBJ and OTHER bits in an ACL and set the mask to rwx. Set the
4198	resulting ACL on TO. Note that name is in UNIX character set.
4199	****************************************************************************/
4200
4201	static int copy_access_posix_acl(connection_struct conn, const char from, const char *to, mode_t mode)
4202	{
4203	SMB_ACL_T posix_acl = NULL;
4204	int ret = -1;
4205
4206	if ((posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, from, SMB_ACL_TYPE_ACCESS)) == NULL)
4207	return -1;
4208
4209	if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
4210	goto done;
4211
4212	ret = SMB_VFS_SYS_ACL_SET_FILE(conn, to, SMB_ACL_TYPE_ACCESS, posix_acl);
4213
4214	done:
4215
4216	SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
4217	return ret;
4218	}
4219
4220	/****************************************************************************
4221	Do a chmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4222	and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4223	Note that name is in UNIX character set.
4224	****************************************************************************/
4225
4226	int chmod_acl(connection_struct conn, const char name, mode_t mode)
4227	{
4228	return copy_access_posix_acl(conn, name, name, mode);
4229	}
4230
4231	/****************************************************************************
4232	Check for an existing default POSIX ACL on a directory.
4233	****************************************************************************/
4234
4235	static bool directory_has_default_posix_acl(connection_struct conn, const char fname)
4236	{
4237	SMB_ACL_T def_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_DEFAULT);
4238	bool has_acl = False;
4239	SMB_ACL_ENTRY_T entry;
4240
4241	if (def_acl != NULL && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, def_acl, SMB_ACL_FIRST_ENTRY, &entry) == 1)) {
4242	has_acl = True;
4243	}
4244
4245	if (def_acl) {
4246	SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4247	}
4248	return has_acl;
4249	}
4250
4251	/****************************************************************************
4252	If the parent directory has no default ACL but it does have an Access ACL,
4253	inherit this Access ACL to file name.
4254	****************************************************************************/
4255
4256	int inherit_access_posix_acl(connection_struct conn, const char inherit_from_dir,
4257	const char *name, mode_t mode)
4258	{
4259	if (directory_has_default_posix_acl(conn, inherit_from_dir))
4260	return 0;
4261
4262	return copy_access_posix_acl(conn, inherit_from_dir, name, mode);
4263	}
4264
4265	/****************************************************************************
4266	Do an fchmod by setting the ACL USER_OBJ, GROUP_OBJ and OTHER bits in an ACL
4267	and set the mask to rwx. Needed to preserve complex ACLs set by NT.
4268	****************************************************************************/
4269
4270	int fchmod_acl(files_struct *fsp, mode_t mode)
4271	{
4272	connection_struct *conn = fsp->conn;
4273	SMB_ACL_T posix_acl = NULL;
4274	int ret = -1;
4275
4276	if ((posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp)) == NULL)
4277	return -1;
4278
4279	if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
4280	goto done;
4281
4282	ret = SMB_VFS_SYS_ACL_SET_FD(fsp, posix_acl);
4283
4284	done:
4285
4286	SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
4287	return ret;
4288	}
4289
4290	/****************************************************************************
4291	Map from wire type to permset.
4292	****************************************************************************/
4293
4294	static bool unix_ex_wire_to_permset(connection_struct conn, unsigned char wire_perm, SMB_ACL_PERMSET_T p_permset)
4295	{
4296	if (wire_perm & ~(SMB_POSIX_ACL_READ\|SMB_POSIX_ACL_WRITE\|SMB_POSIX_ACL_EXECUTE)) {
4297	return False;
4298	}
4299
4300	if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn, *p_permset) == -1) {
4301	return False;
4302	}
4303
4304	if (wire_perm & SMB_POSIX_ACL_READ) {
4305	if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_READ) == -1) {
4306	return False;
4307	}
4308	}
4309	if (wire_perm & SMB_POSIX_ACL_WRITE) {
4310	if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_WRITE) == -1) {
4311	return False;
4312	}
4313	}
4314	if (wire_perm & SMB_POSIX_ACL_EXECUTE) {
4315	if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_EXECUTE) == -1) {
4316	return False;
4317	}
4318	}
4319	return True;
4320	}
4321
4322	/****************************************************************************
4323	Map from wire type to tagtype.
4324	****************************************************************************/
4325
4326	static bool unix_ex_wire_to_tagtype(unsigned char wire_tt, SMB_ACL_TAG_T *p_tt)
4327	{
4328	switch (wire_tt) {
4329	case SMB_POSIX_ACL_USER_OBJ:
4330	*p_tt = SMB_ACL_USER_OBJ;
4331	break;
4332	case SMB_POSIX_ACL_USER:
4333	*p_tt = SMB_ACL_USER;
4334	break;
4335	case SMB_POSIX_ACL_GROUP_OBJ:
4336	*p_tt = SMB_ACL_GROUP_OBJ;
4337	break;
4338	case SMB_POSIX_ACL_GROUP:
4339	*p_tt = SMB_ACL_GROUP;
4340	break;
4341	case SMB_POSIX_ACL_MASK:
4342	*p_tt = SMB_ACL_MASK;
4343	break;
4344	case SMB_POSIX_ACL_OTHER:
4345	*p_tt = SMB_ACL_OTHER;
4346	break;
4347	default:
4348	return False;
4349	}
4350	return True;
4351	}
4352
4353	/****************************************************************************
4354	Create a new POSIX acl from wire permissions.
4355	FIXME ! How does the share mask/mode fit into this.... ?
4356	****************************************************************************/
4357
4358	static SMB_ACL_T create_posix_acl_from_wire(connection_struct conn, uint16 num_acls, const char pdata)
4359	{
4360	unsigned int i;
4361	SMB_ACL_T the_acl = SMB_VFS_SYS_ACL_INIT(conn, num_acls);
4362
4363	if (the_acl == NULL) {
4364	return NULL;
4365	}
4366
4367	for (i = 0; i < num_acls; i++) {
4368	SMB_ACL_ENTRY_T the_entry;
4369	SMB_ACL_PERMSET_T the_permset;
4370	SMB_ACL_TAG_T tag_type;
4371
4372	if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &the_entry) == -1) {
4373	DEBUG(0,("create_posix_acl_from_wire: Failed to create entry %u. (%s)\n",
4374	i, strerror(errno) ));
4375	goto fail;
4376	}
4377
4378	if (!unix_ex_wire_to_tagtype(CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)), &tag_type)) {
4379	DEBUG(0,("create_posix_acl_from_wire: invalid wire tagtype %u on entry %u.\n",
4380	CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)), i ));
4381	goto fail;
4382	}
4383
4384	if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, the_entry, tag_type) == -1) {
4385	DEBUG(0,("create_posix_acl_from_wire: Failed to set tagtype on entry %u. (%s)\n",
4386	i, strerror(errno) ));
4387	goto fail;
4388	}
4389
4390	/* Get the permset pointer from the new ACL entry. */
4391	if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, the_entry, &the_permset) == -1) {
4392	DEBUG(0,("create_posix_acl_from_wire: Failed to get permset on entry %u. (%s)\n",
4393	i, strerror(errno) ));
4394	goto fail;
4395	}
4396
4397	/* Map from wire to permissions. */
4398	if (!unix_ex_wire_to_permset(conn, CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+1), &the_permset)) {
4399	DEBUG(0,("create_posix_acl_from_wire: invalid permset %u on entry %u.\n",
4400	CVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE) + 1), i ));
4401	goto fail;
4402	}
4403
4404	/* Now apply to the new ACL entry. */
4405	if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, the_entry, the_permset) == -1) {
4406	DEBUG(0,("create_posix_acl_from_wire: Failed to add permset on entry %u. (%s)\n",
4407	i, strerror(errno) ));
4408	goto fail;
4409	}
4410
4411	if (tag_type == SMB_ACL_USER) {
4412	uint32 uidval = IVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+2);
4413	uid_t uid = (uid_t)uidval;
4414	if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&uid) == -1) {
4415	DEBUG(0,("create_posix_acl_from_wire: Failed to set uid %u on entry %u. (%s)\n",
4416	(unsigned int)uid, i, strerror(errno) ));
4417	goto fail;
4418	}
4419	}
4420
4421	if (tag_type == SMB_ACL_GROUP) {
4422	uint32 gidval = IVAL(pdata,(i*SMB_POSIX_ACL_ENTRY_SIZE)+2);
4423	gid_t gid = (uid_t)gidval;
4424	if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&gid) == -1) {
4425	DEBUG(0,("create_posix_acl_from_wire: Failed to set gid %u on entry %u. (%s)\n",
4426	(unsigned int)gid, i, strerror(errno) ));
4427	goto fail;
4428	}
4429	}
4430	}
4431
4432	return the_acl;
4433
4434	fail:
4435
4436	if (the_acl != NULL) {
4437	SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl);
4438	}
4439	return NULL;
4440	}
4441
4442	/****************************************************************************
4443	Calls from UNIX extensions - Default POSIX ACL set.
4444	If num_def_acls == 0 and not a directory just return. If it is a directory
4445	and num_def_acls == 0 then remove the default acl. Else set the default acl
4446	on the directory.
4447	****************************************************************************/
4448
4449	bool set_unix_posix_default_acl(connection_struct conn, const char fname, const SMB_STRUCT_STAT *psbuf,
4450	uint16 num_def_acls, const char *pdata)
4451	{
4452	SMB_ACL_T def_acl = NULL;
4453
4454	if (!S_ISDIR(psbuf->st_ex_mode)) {
4455	if (num_def_acls) {
4456	DEBUG(5,("set_unix_posix_default_acl: Can't set default ACL on non-directory file %s\n", fname ));
4457	errno = EISDIR;
4458	return False;
4459	} else {
4460	return True;
4461	}
4462	}
4463
4464	if (!num_def_acls) {
4465	/* Remove the default ACL. */
4466	if (SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn, fname) == -1) {
4467	DEBUG(5,("set_unix_posix_default_acl: acl_delete_def_file failed on directory %s (%s)\n",
4468	fname, strerror(errno) ));
4469	return False;
4470	}
4471	return True;
4472	}
4473
4474	if ((def_acl = create_posix_acl_from_wire(conn, num_def_acls, pdata)) == NULL) {
4475	return False;
4476	}
4477
4478	if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_DEFAULT, def_acl) == -1) {
4479	DEBUG(5,("set_unix_posix_default_acl: acl_set_file failed on directory %s (%s)\n",
4480	fname, strerror(errno) ));
4481	SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4482	return False;
4483	}
4484
4485	DEBUG(10,("set_unix_posix_default_acl: set default acl for file %s\n", fname ));
4486	SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
4487	return True;
4488	}
4489
4490	/****************************************************************************
4491	Remove an ACL from a file. As we don't have acl_delete_entry() available
4492	we must read the current acl and copy all entries except MASK, USER and GROUP
4493	to a new acl, then set that. This (at least on Linux) causes any ACL to be
4494	removed.
4495	FIXME ! How does the share mask/mode fit into this.... ?
4496	****************************************************************************/
4497
4498	static bool remove_posix_acl(connection_struct conn, files_struct fsp, const char *fname)
4499	{
4500	SMB_ACL_T file_acl = NULL;
4501	int entry_id = SMB_ACL_FIRST_ENTRY;
4502	SMB_ACL_ENTRY_T entry;
4503	bool ret = False;
4504	/* Create a new ACL with only 3 entries, u/g/w. */
4505	SMB_ACL_T new_file_acl = SMB_VFS_SYS_ACL_INIT(conn, 3);
4506	SMB_ACL_ENTRY_T user_ent = NULL;
4507	SMB_ACL_ENTRY_T group_ent = NULL;
4508	SMB_ACL_ENTRY_T other_ent = NULL;
4509
4510	if (new_file_acl == NULL) {
4511	DEBUG(5,("remove_posix_acl: failed to init new ACL with 3 entries for file %s.\n", fname));
4512	return False;
4513	}
4514
4515	/* Now create the u/g/w entries. */
4516	if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &user_ent) == -1) {
4517	DEBUG(5,("remove_posix_acl: Failed to create user entry for file %s. (%s)\n",
4518	fname, strerror(errno) ));
4519	goto done;
4520	}
4521	if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, user_ent, SMB_ACL_USER_OBJ) == -1) {
4522	DEBUG(5,("remove_posix_acl: Failed to set user entry for file %s. (%s)\n",
4523	fname, strerror(errno) ));
4524	goto done;
4525	}
4526
4527	if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &group_ent) == -1) {
4528	DEBUG(5,("remove_posix_acl: Failed to create group entry for file %s. (%s)\n",
4529	fname, strerror(errno) ));
4530	goto done;
4531	}
4532	if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, group_ent, SMB_ACL_GROUP_OBJ) == -1) {
4533	DEBUG(5,("remove_posix_acl: Failed to set group entry for file %s. (%s)\n",
4534	fname, strerror(errno) ));
4535	goto done;
4536	}
4537
4538	if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &new_file_acl, &other_ent) == -1) {
4539	DEBUG(5,("remove_posix_acl: Failed to create other entry for file %s. (%s)\n",
4540	fname, strerror(errno) ));
4541	goto done;
4542	}
4543	if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, other_ent, SMB_ACL_OTHER) == -1) {
4544	DEBUG(5,("remove_posix_acl: Failed to set other entry for file %s. (%s)\n",
4545	fname, strerror(errno) ));
4546	goto done;
4547	}
4548
4549	/* Get the current file ACL. */
4550	if (fsp && fsp->fh->fd != -1) {
4551	file_acl = SMB_VFS_SYS_ACL_GET_FD(fsp);
4552	} else {
4553	file_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_ACCESS);
4554	}
4555
4556	if (file_acl == NULL) {
4557	/* This is only returned if an error occurred. Even for a file with
4558	no acl a u/g/w acl should be returned. */
4559	DEBUG(5,("remove_posix_acl: failed to get ACL from file %s (%s).\n",
4560	fname, strerror(errno) ));
4561	goto done;
4562	}
4563
4564	while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, file_acl, entry_id, &entry) == 1) {
4565	SMB_ACL_TAG_T tagtype;
4566	SMB_ACL_PERMSET_T permset;
4567
4568	entry_id = SMB_ACL_NEXT_ENTRY;
4569
4570	if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1) {
4571	DEBUG(5,("remove_posix_acl: failed to get tagtype from ACL on file %s (%s).\n",
4572	fname, strerror(errno) ));
4573	goto done;
4574	}
4575
4576	if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1) {
4577	DEBUG(5,("remove_posix_acl: failed to get permset from ACL on file %s (%s).\n",
4578	fname, strerror(errno) ));
4579	goto done;
4580	}
4581
4582	if (tagtype == SMB_ACL_USER_OBJ) {
4583	if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, user_ent, permset) == -1) {
4584	DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4585	fname, strerror(errno) ));
4586	}
4587	} else if (tagtype == SMB_ACL_GROUP_OBJ) {
4588	if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, group_ent, permset) == -1) {
4589	DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4590	fname, strerror(errno) ));
4591	}
4592	} else if (tagtype == SMB_ACL_OTHER) {
4593	if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, other_ent, permset) == -1) {
4594	DEBUG(5,("remove_posix_acl: failed to set permset from ACL on file %s (%s).\n",
4595	fname, strerror(errno) ));
4596	}
4597	}
4598	}
4599
4600	/* Set the new empty file ACL. */
4601	if (fsp && fsp->fh->fd != -1) {
4602	if (SMB_VFS_SYS_ACL_SET_FD(fsp, new_file_acl) == -1) {
4603	DEBUG(5,("remove_posix_acl: acl_set_file failed on %s (%s)\n",
4604	fname, strerror(errno) ));
4605	goto done;
4606	}
4607	} else {
4608	if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS, new_file_acl) == -1) {
4609	DEBUG(5,("remove_posix_acl: acl_set_file failed on %s (%s)\n",
4610	fname, strerror(errno) ));
4611	goto done;
4612	}
4613	}
4614
4615	ret = True;
4616
4617	done:
4618
4619	if (file_acl) {
4620	SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4621	}
4622	if (new_file_acl) {
4623	SMB_VFS_SYS_ACL_FREE_ACL(conn, new_file_acl);
4624	}
4625	return ret;
4626	}
4627
4628	/****************************************************************************
4629	Calls from UNIX extensions - POSIX ACL set.
4630	If num_def_acls == 0 then read/modify/write acl after removing all entries
4631	except SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER.
4632	****************************************************************************/
4633
4634	bool set_unix_posix_acl(connection_struct conn, files_struct fsp, const char fname, uint16 num_acls, const char pdata)
4635	{
4636	SMB_ACL_T file_acl = NULL;
4637
4638	if (!num_acls) {
4639	/* Remove the ACL from the file. */
4640	return remove_posix_acl(conn, fsp, fname);
4641	}
4642
4643	if ((file_acl = create_posix_acl_from_wire(conn, num_acls, pdata)) == NULL) {
4644	return False;
4645	}
4646
4647	if (fsp && fsp->fh->fd != -1) {
4648	/* The preferred way - use an open fd. */
4649	if (SMB_VFS_SYS_ACL_SET_FD(fsp, file_acl) == -1) {
4650	DEBUG(5,("set_unix_posix_acl: acl_set_file failed on %s (%s)\n",
4651	fname, strerror(errno) ));
4652	SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4653	return False;
4654	}
4655	} else {
4656	if (SMB_VFS_SYS_ACL_SET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS, file_acl) == -1) {
4657	DEBUG(5,("set_unix_posix_acl: acl_set_file failed on %s (%s)\n",
4658	fname, strerror(errno) ));
4659	SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4660	return False;
4661	}
4662	}
4663
4664	DEBUG(10,("set_unix_posix_acl: set acl for file %s\n", fname ));
4665	SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
4666	return True;
4667	}
4668
4669	/********************************************************************
4670	Pull the NT ACL from a file on disk or the OpenEventlog() access
4671	check. Caller is responsible for freeing the returned security
4672	descriptor via TALLOC_FREE(). This is designed for dealing with
4673	user space access checks in smbd outside of the VFS. For example,
4674	checking access rights in OpenEventlog().
4675
4676	Assume we are dealing with files (for now)
4677	********************************************************************/
4678
4679	struct security_descriptor get_nt_acl_no_snum( TALLOC_CTX ctx, const char *fname)
4680	{
4681	struct security_descriptor psd, ret_sd;
4682	connection_struct *conn;
4683	files_struct finfo;
4684	struct fd_handle fh;
4685	NTSTATUS status;
4686
4687	conn = TALLOC_ZERO_P(ctx, connection_struct);
4688	if (conn == NULL) {
4689	DEBUG(0, ("talloc failed\n"));
4690	return NULL;
4691	}
4692
4693	if (!(conn->params = TALLOC_P(conn, struct share_params))) {
4694	DEBUG(0,("get_nt_acl_no_snum: talloc() failed!\n"));
4695	TALLOC_FREE(conn);
4696	return NULL;
4697	}
4698
4699	conn->params->service = -1;
4700
4701	set_conn_connectpath(conn, "/");
4702
4703	if (!smbd_vfs_init(conn)) {
4704	DEBUG(0,("get_nt_acl_no_snum: Unable to create a fake connection struct!\n"));
4705	conn_free(conn);
4706	return NULL;
4707	}
4708
4709	ZERO_STRUCT( finfo );
4710	ZERO_STRUCT( fh );
4711
4712	finfo.fnum = -1;
4713	finfo.conn = conn;
4714	finfo.fh = &fh;
4715	finfo.fh->fd = -1;
4716
4717	status = create_synthetic_smb_fname(talloc_tos(), fname, NULL, NULL,
4718	&finfo.fsp_name);
4719	if (!NT_STATUS_IS_OK(status)) {
4720	conn_free(conn);
4721	return NULL;
4722	}
4723
4724	if (!NT_STATUS_IS_OK(SMB_VFS_FGET_NT_ACL( &finfo, SECINFO_DACL, &psd))) {
4725	DEBUG(0,("get_nt_acl_no_snum: get_nt_acl returned zero.\n"));
4726	TALLOC_FREE(finfo.fsp_name);
4727	conn_free(conn);
4728	return NULL;
4729	}
4730
4731	ret_sd = dup_sec_desc( ctx, psd );
4732
4733	TALLOC_FREE(finfo.fsp_name);
4734	conn_free(conn);
4735
4736	return ret_sd;
4737	}
4738
4739	/* Stolen shamelessly from pvfs_default_acl() in source4 :-). */
4740
4741	NTSTATUS make_default_filesystem_acl(TALLOC_CTX *ctx,
4742	const char *name,
4743	SMB_STRUCT_STAT *psbuf,
4744	struct security_descriptor **ppdesc)
4745	{
4746	struct dom_sid owner_sid, group_sid;
4747	size_t size = 0;
4748	struct security_ace aces[4];
4749	uint32_t access_mask = 0;
4750	mode_t mode = psbuf->st_ex_mode;
4751	struct security_acl *new_dacl = NULL;
4752	int idx = 0;
4753
4754	DEBUG(10,("make_default_filesystem_acl: file %s mode = 0%o\n",
4755	name, (int)mode ));
4756
4757	uid_to_sid(&owner_sid, psbuf->st_ex_uid);
4758	gid_to_sid(&group_sid, psbuf->st_ex_gid);
4759
4760	/*
4761	We provide up to 4 ACEs
4762	- Owner
4763	- Group
4764	- Everyone
4765	- NT System
4766	*/
4767
4768	if (mode & S_IRUSR) {
4769	if (mode & S_IWUSR) {
4770	access_mask \|= SEC_RIGHTS_FILE_ALL;
4771	} else {
4772	access_mask \|= SEC_RIGHTS_FILE_READ \| SEC_FILE_EXECUTE;
4773	}
4774	}
4775	if (mode & S_IWUSR) {
4776	access_mask \|= SEC_RIGHTS_FILE_WRITE \| SEC_STD_DELETE;
4777	}
4778
4779	init_sec_ace(&aces[idx],
4780	&owner_sid,
4781	SEC_ACE_TYPE_ACCESS_ALLOWED,
4782	access_mask,
4783	0);
4784	idx++;
4785
4786	access_mask = 0;
4787	if (mode & S_IRGRP) {
4788	access_mask \|= SEC_RIGHTS_FILE_READ \| SEC_FILE_EXECUTE;
4789	}
4790	if (mode & S_IWGRP) {
4791	/* note that delete is not granted - this matches posix behaviour */
4792	access_mask \|= SEC_RIGHTS_FILE_WRITE;
4793	}
4794	if (access_mask) {
4795	init_sec_ace(&aces[idx],
4796	&group_sid,
4797	SEC_ACE_TYPE_ACCESS_ALLOWED,
4798	access_mask,
4799	0);
4800	idx++;
4801	}
4802
4803	access_mask = 0;
4804	if (mode & S_IROTH) {
4805	access_mask \|= SEC_RIGHTS_FILE_READ \| SEC_FILE_EXECUTE;
4806	}
4807	if (mode & S_IWOTH) {
4808	access_mask \|= SEC_RIGHTS_FILE_WRITE;
4809	}
4810	if (access_mask) {
4811	init_sec_ace(&aces[idx],
4812	&global_sid_World,
4813	SEC_ACE_TYPE_ACCESS_ALLOWED,
4814	access_mask,
4815	0);
4816	idx++;
4817	}
4818
4819	init_sec_ace(&aces[idx],
4820	&global_sid_System,
4821	SEC_ACE_TYPE_ACCESS_ALLOWED,
4822	SEC_RIGHTS_FILE_ALL,
4823	0);
4824	idx++;
4825
4826	new_dacl = make_sec_acl(ctx,
4827	NT4_ACL_REVISION,
4828	idx,
4829	aces);
4830
4831	if (!new_dacl) {
4832	return NT_STATUS_NO_MEMORY;
4833	}
4834
4835	*ppdesc = make_sec_desc(ctx,
4836	SECURITY_DESCRIPTOR_REVISION_1,
4837	SEC_DESC_SELF_RELATIVE\|SEC_DESC_DACL_PRESENT,
4838	&owner_sid,
4839	&group_sid,
4840	NULL,
4841	new_dacl,
4842	&size);
4843	if (!*ppdesc) {
4844	return NT_STATUS_NO_MEMORY;
4845	}
4846	return NT_STATUS_OK;
4847	}

Note: See TracBrowser for help on using the repository browser.

Context Navigation

source: trunk/server/source3/smbd/posix_acls.c

Download in other formats: