source: vendor/current/source3/modules/vfs_solarisacl.c

Last change on this file was 988, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.3
File size: 21.1 KB
Line 
1/*
2 Unix SMB/Netbios implementation.
3 VFS module to get and set Solaris ACLs
4 Copyright (C) Michael Adam 2006,2008
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
18*/
19
20
21#include "includes.h"
22#include "system/filesys.h"
23#include "smbd/smbd.h"
24#include "modules/vfs_solarisacl.h"
25
26/* typedef struct acl SOLARIS_ACE_T; */
27typedef aclent_t SOLARIS_ACE_T;
28typedef aclent_t *SOLARIS_ACL_T;
29typedef int SOLARIS_ACL_TAG_T; /* the type of an ACL entry */
30typedef o_mode_t SOLARIS_PERM_T;
31
32/* for convenience: check if solaris acl entry is a default entry? */
33#define _IS_DEFAULT(ace) ((ace).a_type & ACL_DEFAULT)
34#define _IS_OF_TYPE(ace, type) ( \
35 (((type) == SMB_ACL_TYPE_ACCESS) && !_IS_DEFAULT(ace)) \
36 || \
37 (((type) == SMB_ACL_TYPE_DEFAULT) && _IS_DEFAULT(ace)) \
38)
39
40
41/* prototypes for private functions */
42
43static SOLARIS_ACL_T solaris_acl_init(int count);
44static bool smb_acl_to_solaris_acl(SMB_ACL_T smb_acl,
45 SOLARIS_ACL_T *solariacl, int *count,
46 SMB_ACL_TYPE_T type);
47static SMB_ACL_T solaris_acl_to_smb_acl(SOLARIS_ACL_T solarisacl, int count,
48 SMB_ACL_TYPE_T type, TALLOC_CTX *mem_ctx);
49static SOLARIS_ACL_TAG_T smb_tag_to_solaris_tag(SMB_ACL_TAG_T smb_tag);
50static SMB_ACL_TAG_T solaris_tag_to_smb_tag(SOLARIS_ACL_TAG_T solaris_tag);
51static bool solaris_add_to_acl(SOLARIS_ACL_T *solaris_acl, int *count,
52 SOLARIS_ACL_T add_acl, int add_count, SMB_ACL_TYPE_T type);
53static bool solaris_acl_get_file(const char *name, SOLARIS_ACL_T *solarisacl,
54 int *count);
55static bool solaris_acl_get_fd(int fd, SOLARIS_ACL_T *solarisacl, int *count);
56static bool solaris_acl_sort(SOLARIS_ACL_T theacl, int count);
57static SMB_ACL_PERM_T solaris_perm_to_smb_perm(const SOLARIS_PERM_T perm);
58static SOLARIS_PERM_T smb_perm_to_solaris_perm(const SMB_ACL_PERM_T perm);
59#if 0
60static bool solaris_acl_check(SOLARIS_ACL_T solaris_acl, int count);
61#endif
62
63/* public functions - the api */
64
65SMB_ACL_T solarisacl_sys_acl_get_file(vfs_handle_struct *handle,
66 const char *path_p,
67 SMB_ACL_TYPE_T type, TALLOC_CTX *mem_ctx)
68{
69 SMB_ACL_T result = NULL;
70 int count;
71 SOLARIS_ACL_T solaris_acl = NULL;
72
73 DEBUG(10, ("solarisacl_sys_acl_get_file called for file '%s'.\n",
74 path_p));
75
76 if (type != SMB_ACL_TYPE_ACCESS && type != SMB_ACL_TYPE_DEFAULT) {
77 DEBUG(10, ("invalid SMB_ACL_TYPE given (%d)\n", type));
78 errno = EINVAL;
79 goto done;
80 }
81
82 DEBUGADD(10, ("getting %s acl\n",
83 ((type == SMB_ACL_TYPE_ACCESS) ? "access" : "default")));
84
85 if (!solaris_acl_get_file(path_p, &solaris_acl, &count)) {
86 goto done;
87 }
88 result = solaris_acl_to_smb_acl(solaris_acl, count, type, mem_ctx);
89 if (result == NULL) {
90 DEBUG(10, ("conversion solaris_acl -> smb_acl failed (%s).\n",
91 strerror(errno)));
92 }
93
94 done:
95 DEBUG(10, ("solarisacl_sys_acl_get_file %s.\n",
96 ((result == NULL) ? "failed" : "succeeded" )));
97 SAFE_FREE(solaris_acl);
98 return result;
99}
100
101
102/*
103 * get the access ACL of a file referred to by a fd
104 */
105SMB_ACL_T solarisacl_sys_acl_get_fd(vfs_handle_struct *handle,
106 files_struct *fsp, TALLOC_CTX *mem_ctx)
107{
108 SMB_ACL_T result = NULL;
109 int count;
110 SOLARIS_ACL_T solaris_acl = NULL;
111
112 DEBUG(10, ("entering solarisacl_sys_acl_get_fd.\n"));
113
114 if (!solaris_acl_get_fd(fsp->fh->fd, &solaris_acl, &count)) {
115 goto done;
116 }
117 /*
118 * The facl call returns both ACCESS and DEFAULT acls (as present).
119 * The posix acl_get_fd function returns only the
120 * access acl. So we need to filter this out here.
121 */
122 result = solaris_acl_to_smb_acl(solaris_acl, count,
123 SMB_ACL_TYPE_ACCESS, mem_ctx);
124 if (result == NULL) {
125 DEBUG(10, ("conversion solaris_acl -> smb_acl failed (%s).\n",
126 strerror(errno)));
127 }
128
129 done:
130 DEBUG(10, ("solarisacl_sys_acl_get_fd %s.\n",
131 ((result == NULL) ? "failed" : "succeeded")));
132 SAFE_FREE(solaris_acl);
133 return result;
134}
135
136int solarisacl_sys_acl_set_file(vfs_handle_struct *handle,
137 const char *name,
138 SMB_ACL_TYPE_T type,
139 SMB_ACL_T theacl)
140{
141 int ret = -1;
142 struct stat_ex s;
143 SOLARIS_ACL_T solaris_acl = NULL;
144 int count;
145
146 DEBUG(10, ("solarisacl_sys_acl_set_file called for file '%s'\n",
147 name));
148
149 if ((type != SMB_ACL_TYPE_ACCESS) && (type != SMB_ACL_TYPE_DEFAULT)) {
150 errno = EINVAL;
151 DEBUG(10, ("invalid smb acl type given (%d).\n", type));
152 goto done;
153 }
154 DEBUGADD(10, ("setting %s acl\n",
155 ((type == SMB_ACL_TYPE_ACCESS) ? "access" : "default")));
156
157 if(!smb_acl_to_solaris_acl(theacl, &solaris_acl, &count, type)) {
158 DEBUG(10, ("conversion smb_acl -> solaris_acl failed (%s).\n",
159 strerror(errno)));
160 goto done;
161 }
162
163 /*
164 * if the file is a directory, there is extra work to do:
165 * since the solaris acl call stores both the access acl and
166 * the default acl as provided, we have to get the acl part
167 * that has not been specified in "type" from the file first
168 * and concatenate it with the acl provided.
169 */
170 if (vfs_stat_smb_basename(handle->conn, name, &s) != 0) {
171 DEBUG(10, ("Error in stat call: %s\n", strerror(errno)));
172 goto done;
173 }
174 if (S_ISDIR(s.st_ex_mode)) {
175 SOLARIS_ACL_T other_acl = NULL;
176 int other_count;
177 SMB_ACL_TYPE_T other_type;
178
179 other_type = (type == SMB_ACL_TYPE_ACCESS)
180 ? SMB_ACL_TYPE_DEFAULT
181 : SMB_ACL_TYPE_ACCESS;
182 DEBUGADD(10, ("getting acl from filesystem\n"));
183 if (!solaris_acl_get_file(name, &other_acl, &other_count)) {
184 DEBUG(10, ("error getting acl from directory\n"));
185 goto done;
186 }
187 DEBUG(10, ("adding %s part of fs acl to given acl\n",
188 ((other_type == SMB_ACL_TYPE_ACCESS)
189 ? "access"
190 : "default")));
191 if (!solaris_add_to_acl(&solaris_acl, &count, other_acl,
192 other_count, other_type))
193 {
194 DEBUG(10, ("error adding other acl.\n"));
195 SAFE_FREE(other_acl);
196 goto done;
197 }
198 SAFE_FREE(other_acl);
199 }
200 else if (type != SMB_ACL_TYPE_ACCESS) {
201 errno = EINVAL;
202 goto done;
203 }
204
205 if (!solaris_acl_sort(solaris_acl, count)) {
206 DEBUG(10, ("resulting acl is not valid!\n"));
207 goto done;
208 }
209
210 ret = acl(name, SETACL, count, solaris_acl);
211
212 done:
213 DEBUG(10, ("solarisacl_sys_acl_set_file %s.\n",
214 ((ret != 0) ? "failed" : "succeeded")));
215 SAFE_FREE(solaris_acl);
216 return ret;
217}
218
219/*
220 * set the access ACL on the file referred to by a fd
221 */
222int solarisacl_sys_acl_set_fd(vfs_handle_struct *handle,
223 files_struct *fsp,
224 SMB_ACL_T theacl)
225{
226 SOLARIS_ACL_T solaris_acl = NULL;
227 SOLARIS_ACL_T default_acl = NULL;
228 int count, default_count;
229 int ret = -1;
230
231 DEBUG(10, ("entering solarisacl_sys_acl_set_fd\n"));
232
233 /*
234 * the posix acl_set_fd call sets the access acl of the
235 * file referred to by fd. the solaris facl-SETACL call
236 * sets the access and default acl as provided, so we
237 * have to retrieve the default acl of the file and
238 * concatenate it with the access acl provided.
239 */
240 if (!smb_acl_to_solaris_acl(theacl, &solaris_acl, &count,
241 SMB_ACL_TYPE_ACCESS))
242 {
243 DEBUG(10, ("conversion smb_acl -> solaris_acl failed (%s).\n",
244 strerror(errno)));
245 goto done;
246 }
247 if (!solaris_acl_get_fd(fsp->fh->fd, &default_acl, &default_count)) {
248 DEBUG(10, ("error getting (default) acl from fd\n"));
249 goto done;
250 }
251 if (!solaris_add_to_acl(&solaris_acl, &count,
252 default_acl, default_count,
253 SMB_ACL_TYPE_DEFAULT))
254 {
255 DEBUG(10, ("error adding default acl to solaris acl\n"));
256 goto done;
257 }
258 if (!solaris_acl_sort(solaris_acl, count)) {
259 DEBUG(10, ("resulting acl is not valid!\n"));
260 goto done;
261 }
262
263 ret = facl(fsp->fh->fd, SETACL, count, solaris_acl);
264 if (ret != 0) {
265 DEBUG(10, ("call of facl failed (%s).\n", strerror(errno)));
266 }
267
268 done:
269 DEBUG(10, ("solarisacl_sys_acl_set_fd %s.\n",
270 ((ret == 0) ? "succeeded" : "failed" )));
271 SAFE_FREE(solaris_acl);
272 SAFE_FREE(default_acl);
273 return ret;
274}
275
276/*
277 * delete the default ACL of a directory
278 *
279 * This is achieved by fetching the access ACL and rewriting it
280 * directly, via the solaris system call: the SETACL call on
281 * directories writes both the access and the default ACL as provided.
282 *
283 * XXX: posix acl_delete_def_file returns an error if
284 * the file referred to by path is not a directory.
285 * this function does not complain but the actions
286 * have no effect on a file other than a directory.
287 * But sys_acl_delete_default_file is only called in
288 * smbd/posixacls.c after having checked that the file
289 * is a directory, anyways. So implementing the extra
290 * check is considered unnecessary. --- Agreed? XXX
291 */
292int solarisacl_sys_acl_delete_def_file(vfs_handle_struct *handle,
293 const char *path)
294{
295 SMB_ACL_T smb_acl;
296 int ret = -1;
297 SOLARIS_ACL_T solaris_acl = NULL;
298 int count;
299
300 DEBUG(10, ("entering solarisacl_sys_acl_delete_def_file.\n"));
301
302 smb_acl = solarisacl_sys_acl_get_file(handle, path,
303 SMB_ACL_TYPE_ACCESS, talloc_tos());
304 if (smb_acl == NULL) {
305 DEBUG(10, ("getting file acl failed!\n"));
306 goto done;
307 }
308 if (!smb_acl_to_solaris_acl(smb_acl, &solaris_acl, &count,
309 SMB_ACL_TYPE_ACCESS))
310 {
311 DEBUG(10, ("conversion smb_acl -> solaris_acl failed.\n"));
312 goto done;
313 }
314 if (!solaris_acl_sort(solaris_acl, count)) {
315 DEBUG(10, ("resulting acl is not valid!\n"));
316 goto done;
317 }
318 ret = acl(path, SETACL, count, solaris_acl);
319 if (ret != 0) {
320 DEBUG(10, ("settinge file acl failed!\n"));
321 }
322
323 done:
324 DEBUG(10, ("solarisacl_sys_acl_delete_def_file %s.\n",
325 ((ret != 0) ? "failed" : "succeeded" )));
326 TALLOC_FREE(smb_acl);
327 return ret;
328}
329
330
331/* private functions */
332
333static SOLARIS_ACL_T solaris_acl_init(int count)
334{
335 SOLARIS_ACL_T solaris_acl =
336 (SOLARIS_ACL_T)SMB_MALLOC(sizeof(aclent_t) * count);
337 if (solaris_acl == NULL) {
338 errno = ENOMEM;
339 }
340 return solaris_acl;
341}
342
343/*
344 * Convert the SMB acl to the ACCESS or DEFAULT part of a
345 * solaris ACL, as desired.
346 */
347static bool smb_acl_to_solaris_acl(SMB_ACL_T smb_acl,
348 SOLARIS_ACL_T *solaris_acl, int *count,
349 SMB_ACL_TYPE_T type)
350{
351 bool ret = False;
352 int i;
353
354 DEBUG(10, ("entering smb_acl_to_solaris_acl\n"));
355
356 *solaris_acl = NULL;
357 *count = 0;
358
359 for (i = 0; i < smb_acl->count; i++) {
360 const struct smb_acl_entry *smb_entry = &(smb_acl->acl[i]);
361 SOLARIS_ACE_T solaris_entry;
362
363 ZERO_STRUCT(solaris_entry);
364
365 solaris_entry.a_type = smb_tag_to_solaris_tag(smb_entry->a_type);
366 if (solaris_entry.a_type == 0) {
367 DEBUG(10, ("smb_tag to solaris_tag failed\n"));
368 goto fail;
369 }
370 switch(solaris_entry.a_type) {
371 case USER:
372 DEBUG(10, ("got tag type USER with uid %u\n",
373 (unsigned int)smb_entry->info.user.uid));
374 solaris_entry.a_id = (uid_t)smb_entry->info.user.uid;
375 break;
376 case GROUP:
377 DEBUG(10, ("got tag type GROUP with gid %u\n",
378 (unsigned int)smb_entry->info.group.gid));
379 solaris_entry.a_id = (uid_t)smb_entry->info.group.gid;
380 break;
381 default:
382 break;
383 }
384 if (type == SMB_ACL_TYPE_DEFAULT) {
385 DEBUG(10, ("adding default bit to solaris ace\n"));
386 solaris_entry.a_type |= ACL_DEFAULT;
387 }
388
389 solaris_entry.a_perm =
390 smb_perm_to_solaris_perm(smb_entry->a_perm);
391 DEBUG(10, ("assembled the following solaris ace:\n"));
392 DEBUGADD(10, (" - type: 0x%04x\n", solaris_entry.a_type));
393 DEBUGADD(10, (" - id: %u\n", (unsigned int)solaris_entry.a_id));
394 DEBUGADD(10, (" - perm: o%o\n", solaris_entry.a_perm));
395 if (!solaris_add_to_acl(solaris_acl, count, &solaris_entry,
396 1, type))
397 {
398 DEBUG(10, ("error adding acl entry\n"));
399 goto fail;
400 }
401 DEBUG(10, ("count after adding: %d (i: %d)\n", *count, i));
402 DEBUG(10, ("test, if entry has been copied into acl:\n"));
403 DEBUGADD(10, (" - type: 0x%04x\n",
404 (*solaris_acl)[(*count)-1].a_type));
405 DEBUGADD(10, (" - id: %u\n",
406 (unsigned int)(*solaris_acl)[(*count)-1].a_id));
407 DEBUGADD(10, (" - perm: o%o\n",
408 (*solaris_acl)[(*count)-1].a_perm));
409 }
410
411 ret = True;
412 goto done;
413
414 fail:
415 SAFE_FREE(*solaris_acl);
416 done:
417 DEBUG(10, ("smb_acl_to_solaris_acl %s\n",
418 ((ret == True) ? "succeeded" : "failed")));
419 return ret;
420}
421
422/*
423 * convert either the access or the default part of a
424 * soaris acl to the SMB_ACL format.
425 */
426static SMB_ACL_T solaris_acl_to_smb_acl(SOLARIS_ACL_T solaris_acl, int count,
427 SMB_ACL_TYPE_T type, TALLOC_CTX *mem_ctx)
428{
429 SMB_ACL_T result;
430 int i;
431
432 if ((result = sys_acl_init(mem_ctx)) == NULL) {
433 DEBUG(10, ("error allocating memory for SMB_ACL\n"));
434 goto fail;
435 }
436 for (i = 0; i < count; i++) {
437 SMB_ACL_ENTRY_T smb_entry;
438 SMB_ACL_PERM_T smb_perm;
439
440 if (!_IS_OF_TYPE(solaris_acl[i], type)) {
441 continue;
442 }
443 result->acl = talloc_realloc(result, result->acl, struct smb_acl_entry, result->count + 1);
444 if (result->acl == NULL) {
445 DEBUG(10, ("error reallocating memory for SMB_ACL\n"));
446 goto fail;
447 }
448 smb_entry = &result->acl[result->count];
449 if (sys_acl_set_tag_type(smb_entry,
450 solaris_tag_to_smb_tag(solaris_acl[i].a_type)) != 0)
451 {
452 DEBUG(10, ("invalid tag type given: 0x%04x\n",
453 solaris_acl[i].a_type));
454 goto fail;
455 }
456 /* intentionally not checking return code here: */
457 sys_acl_set_qualifier(smb_entry, (void *)&solaris_acl[i].a_id);
458 smb_perm = solaris_perm_to_smb_perm(solaris_acl[i].a_perm);
459 if (sys_acl_set_permset(smb_entry, &smb_perm) != 0) {
460 DEBUG(10, ("invalid permset given: %d\n",
461 solaris_acl[i].a_perm));
462 goto fail;
463 }
464 result->count += 1;
465 }
466 goto done;
467
468 fail:
469 TALLOC_FREE(result);
470 done:
471 DEBUG(10, ("solaris_acl_to_smb_acl %s\n",
472 ((result == NULL) ? "failed" : "succeeded")));
473 return result;
474}
475
476
477
478static SOLARIS_ACL_TAG_T smb_tag_to_solaris_tag(SMB_ACL_TAG_T smb_tag)
479{
480 SOLARIS_ACL_TAG_T solaris_tag = 0;
481
482 DEBUG(10, ("smb_tag_to_solaris_tag\n"));
483 DEBUGADD(10, (" --> got smb tag 0x%04x\n", smb_tag));
484
485 switch (smb_tag) {
486 case SMB_ACL_USER:
487 solaris_tag = USER;
488 break;
489 case SMB_ACL_USER_OBJ:
490 solaris_tag = USER_OBJ;
491 break;
492 case SMB_ACL_GROUP:
493 solaris_tag = GROUP;
494 break;
495 case SMB_ACL_GROUP_OBJ:
496 solaris_tag = GROUP_OBJ;
497 break;
498 case SMB_ACL_OTHER:
499 solaris_tag = OTHER_OBJ;
500 break;
501 case SMB_ACL_MASK:
502 solaris_tag = CLASS_OBJ;
503 break;
504 default:
505 DEBUGADD(10, (" !!! unknown smb tag type 0x%04x\n", smb_tag));
506 break;
507 }
508
509 DEBUGADD(10, (" --> determined solaris tag 0x%04x\n", solaris_tag));
510
511 return solaris_tag;
512}
513
514static SMB_ACL_TAG_T solaris_tag_to_smb_tag(SOLARIS_ACL_TAG_T solaris_tag)
515{
516 SMB_ACL_TAG_T smb_tag = 0;
517
518 DEBUG(10, ("solaris_tag_to_smb_tag:\n"));
519 DEBUGADD(10, (" --> got solaris tag 0x%04x\n", solaris_tag));
520
521 solaris_tag &= ~ACL_DEFAULT;
522
523 switch (solaris_tag) {
524 case USER:
525 smb_tag = SMB_ACL_USER;
526 break;
527 case USER_OBJ:
528 smb_tag = SMB_ACL_USER_OBJ;
529 break;
530 case GROUP:
531 smb_tag = SMB_ACL_GROUP;
532 break;
533 case GROUP_OBJ:
534 smb_tag = SMB_ACL_GROUP_OBJ;
535 break;
536 case OTHER_OBJ:
537 smb_tag = SMB_ACL_OTHER;
538 break;
539 case CLASS_OBJ:
540 smb_tag = SMB_ACL_MASK;
541 break;
542 default:
543 DEBUGADD(10, (" !!! unknown solaris tag type: 0x%04x\n",
544 solaris_tag));
545 break;
546 }
547
548 DEBUGADD(10, (" --> determined smb tag 0x%04x\n", smb_tag));
549
550 return smb_tag;
551}
552
553
554static SMB_ACL_PERM_T solaris_perm_to_smb_perm(const SOLARIS_PERM_T perm)
555{
556 SMB_ACL_PERM_T smb_perm = 0;
557 smb_perm |= ((perm & SMB_ACL_READ) ? SMB_ACL_READ : 0);
558 smb_perm |= ((perm & SMB_ACL_WRITE) ? SMB_ACL_WRITE : 0);
559 smb_perm |= ((perm & SMB_ACL_EXECUTE) ? SMB_ACL_EXECUTE : 0);
560 return smb_perm;
561}
562
563
564static SOLARIS_PERM_T smb_perm_to_solaris_perm(const SMB_ACL_PERM_T perm)
565{
566 SOLARIS_PERM_T solaris_perm = 0;
567 solaris_perm |= ((perm & SMB_ACL_READ) ? SMB_ACL_READ : 0);
568 solaris_perm |= ((perm & SMB_ACL_WRITE) ? SMB_ACL_WRITE : 0);
569 solaris_perm |= ((perm & SMB_ACL_EXECUTE) ? SMB_ACL_EXECUTE : 0);
570 return solaris_perm;
571}
572
573
574static bool solaris_acl_get_file(const char *name, SOLARIS_ACL_T *solaris_acl,
575 int *count)
576{
577 bool result = False;
578
579 DEBUG(10, ("solaris_acl_get_file called for file '%s'\n", name));
580
581 /*
582 * The original code tries some INITIAL_ACL_SIZE
583 * and only did the GETACLCNT call upon failure
584 * (for performance reasons).
585 * For the sake of simplicity, I skip this for now.
586 */
587 *count = acl(name, GETACLCNT, 0, NULL);
588 if (*count < 0) {
589 DEBUG(10, ("acl GETACLCNT failed: %s\n", strerror(errno)));
590 goto done;
591 }
592 *solaris_acl = solaris_acl_init(*count);
593 if (*solaris_acl == NULL) {
594 DEBUG(10, ("error allocating memory for solaris acl...\n"));
595 goto done;
596 }
597 *count = acl(name, GETACL, *count, *solaris_acl);
598 if (*count < 0) {
599 DEBUG(10, ("acl GETACL failed: %s\n", strerror(errno)));
600 goto done;
601 }
602 result = True;
603
604 done:
605 DEBUG(10, ("solaris_acl_get_file %s.\n",
606 ((result == True) ? "succeeded" : "failed" )));
607 return result;
608}
609
610
611static bool solaris_acl_get_fd(int fd, SOLARIS_ACL_T *solaris_acl, int *count)
612{
613 bool ret = False;
614
615 DEBUG(10, ("entering solaris_acl_get_fd\n"));
616
617 /*
618 * see solaris_acl_get_file for comment about omission
619 * of INITIAL_ACL_SIZE...
620 */
621 *count = facl(fd, GETACLCNT, 0, NULL);
622 if (*count < 0) {
623 DEBUG(10, ("facl GETACLCNT failed: %s\n", strerror(errno)));
624 goto done;
625 }
626 *solaris_acl = solaris_acl_init(*count);
627 if (*solaris_acl == NULL) {
628 DEBUG(10, ("error allocating memory for solaris acl...\n"));
629 goto done;
630 }
631 *count = facl(fd, GETACL, *count, *solaris_acl);
632 if (*count < 0) {
633 DEBUG(10, ("facl GETACL failed: %s\n", strerror(errno)));
634 goto done;
635 }
636 ret = True;
637
638 done:
639 DEBUG(10, ("solaris_acl_get_fd %s\n",
640 ((ret == True) ? "succeeded" : "failed")));
641 return ret;
642}
643
644
645
646/*
647 * Add entries to a solaris ACL.
648 *
649 * Entries are directly added to the solarisacl parameter.
650 * if memory allocation fails, this may result in solarisacl
651 * being NULL. if the resulting acl is to be checked and is
652 * not valid, it is kept in solarisacl but False is returned.
653 *
654 * The type of ACEs (access/default) to be added to the ACL can
655 * be selected via the type parameter.
656 * I use the SMB_ACL_TYPE_T type here. Since SMB_ACL_TYPE_ACCESS
657 * is defined as "0", this means that one can only add either
658 * access or default ACEs, not both at the same time. If it
659 * should become necessary to add all of an ACL, one would have
660 * to replace this parameter by another type.
661 */
662static bool solaris_add_to_acl(SOLARIS_ACL_T *solaris_acl, int *count,
663 SOLARIS_ACL_T add_acl, int add_count,
664 SMB_ACL_TYPE_T type)
665{
666 int i;
667
668 if ((type != SMB_ACL_TYPE_ACCESS) && (type != SMB_ACL_TYPE_DEFAULT))
669 {
670 DEBUG(10, ("invalid acl type given: %d\n", type));
671 errno = EINVAL;
672 return False;
673 }
674 for (i = 0; i < add_count; i++) {
675 if (!_IS_OF_TYPE(add_acl[i], type)) {
676 continue;
677 }
678 ADD_TO_ARRAY(NULL, SOLARIS_ACE_T, add_acl[i],
679 solaris_acl, count);
680 if (solaris_acl == NULL) {
681 DEBUG(10, ("error enlarging acl.\n"));
682 errno = ENOMEM;
683 return False;
684 }
685 }
686 return True;
687}
688
689
690/*
691 * sort the ACL and check it for validity
692 *
693 * [original comment from lib/sysacls.c:]
694 *
695 * if it's a minimal ACL with only 4 entries then we
696 * need to recalculate the mask permissions to make
697 * sure that they are the same as the GROUP_OBJ
698 * permissions as required by the UnixWare acl() system call.
699 *
700 * (note: since POSIX allows minimal ACLs which only contain
701 * 3 entries - ie there is no mask entry - we should, in theory,
702 * check for this and add a mask entry if necessary - however
703 * we "know" that the caller of this interface always specifies
704 * a mask, so in practice "this never happens" (tm) - if it *does*
705 * happen aclsort() will fail and return an error and someone will
706 * have to fix it...)
707 */
708static bool solaris_acl_sort(SOLARIS_ACL_T solaris_acl, int count)
709{
710 int fixmask = (count <= 4);
711
712 if (aclsort(count, fixmask, solaris_acl) != 0) {
713 errno = EINVAL;
714 return False;
715 }
716 return True;
717}
718
719#if 0
720/*
721 * acl check function:
722 * unused at the moment but could be used to get more
723 * concrete error messages for debugging...
724 * (acl sort just says that the acl is invalid...)
725 */
726static bool solaris_acl_check(SOLARIS_ACL_T solaris_acl, int count)
727{
728 int check_rc;
729 int check_which;
730
731 check_rc = aclcheck(solaris_acl, count, &check_which);
732 if (check_rc != 0) {
733 DEBUG(10, ("acl is not valid:\n"));
734 DEBUGADD(10, (" - return code: %d\n", check_rc));
735 DEBUGADD(10, (" - which: %d\n", check_which));
736 if (check_which != -1) {
737 DEBUGADD(10, (" - invalid entry:\n"));
738 DEBUGADD(10, (" * type: %d:\n",
739 solaris_acl[check_which].a_type));
740 DEBUGADD(10, (" * id: %d\n",
741 solaris_acl[check_which].a_id));
742 DEBUGADD(10, (" * perm: 0o%o\n",
743 solaris_acl[check_which].a_perm));
744 }
745 return False;
746 }
747 return True;
748}
749#endif
750
751static struct vfs_fn_pointers solarisacl_fns = {
752 .sys_acl_get_file_fn = solarisacl_sys_acl_get_file,
753 .sys_acl_get_fd_fn = solarisacl_sys_acl_get_fd,
754 .sys_acl_blob_get_file_fn = posix_sys_acl_blob_get_file,
755 .sys_acl_blob_get_fd_fn = posix_sys_acl_blob_get_fd,
756 .sys_acl_set_file_fn = solarisacl_sys_acl_set_file,
757 .sys_acl_set_fd_fn = solarisacl_sys_acl_set_fd,
758 .sys_acl_delete_def_file_fn = solarisacl_sys_acl_delete_def_file,
759};
760
761NTSTATUS vfs_solarisacl_init(void);
762NTSTATUS vfs_solarisacl_init(void)
763{
764 return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "solarisacl",
765 &solarisacl_fns);
766}
767
768/* ENTE */
Note: See TracBrowser for help on using the repository browser.