Changeset 124 for branches/samba-3.0/source/smbd/posix_acls.c

Timestamp:

Mar 12, 2008, 9:08:18 AM (17 years ago)

Author:

Paul Smedley

Message:

Update source to 3.0.28a

File:

• branches/samba-3.0/source/smbd/posix_acls.c (modified) (9 diffs)

branches/samba-3.0/source/smbd/posix_acls.c

@@ -1337 +1337 @@
                                 psa1->flags |= (psa2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT));
                                 psa2->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT);
-                                
+
                         } else if (psa2->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
 
                                 psa2->flags |= (psa1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT));
                                 psa1->flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT);
-                                
+
                         }
                 }
@@ -1403 +1403 @@
                 } else if (sid_to_uid( &current_ace->trustee, &current_ace->unix_ug.uid)) {
                         current_ace->owner_type = UID_ACE;
-                        current_ace->type = SMB_ACL_USER;
+                        /* If it's the owning user, this is a user_obj, not
+                         * a user. */
+                        if (current_ace->unix_ug.uid == pst->st_uid) {
+                                current_ace->type = SMB_ACL_USER_OBJ;
+                        } else {
+                                current_ace->type = SMB_ACL_USER;
+                        }
                 } else if (sid_to_gid( &current_ace->trustee, &current_ace->unix_ug.gid)) {
                         current_ace->owner_type = GID_ACE;
-                        current_ace->type = SMB_ACL_GROUP;
+                        /* If it's the primary group, this is a group_obj, not
+                         * a group. */
+                        if (current_ace->unix_ug.gid == pst->st_gid) {
+                                current_ace->type = SMB_ACL_GROUP_OBJ;
+                        } else {
+                                current_ace->type = SMB_ACL_GROUP;
+                        }
                 } else {
                         fstring str;
@@ -3100 +3112 @@
 }
 
-static NTSTATUS append_ugw_ace(files_struct *fsp,
-                        SMB_STRUCT_STAT *psbuf,
-                        mode_t unx_mode,
-                        int ugw,
-                        SEC_ACE *se)
-{
-        mode_t perms;
-        SEC_ACCESS acc;
-        int nt_acl_type; /* Tru64 has "acl_type" as a macro.. */
-        DOM_SID trustee;
-
-        switch (ugw) {
-                case S_IRUSR:
-                        perms = unix_perms_to_acl_perms(unx_mode,
-                                                        S_IRUSR,
-                                                        S_IWUSR,
-                                                        S_IXUSR);
-                        uid_to_sid(&trustee, psbuf->st_uid );
-                        break;
-                case S_IRGRP:
-                        perms = unix_perms_to_acl_perms(unx_mode,
-                                                        S_IRGRP,
-                                                        S_IWGRP,
-                                                        S_IXGRP);
-                        gid_to_sid(&trustee, psbuf->st_gid );
-                        break;
-                case S_IROTH:
-                        perms = unix_perms_to_acl_perms(unx_mode,
-                                                        S_IROTH,
-                                                        S_IWOTH,
-                                                        S_IXOTH);
-                        sid_copy(&trustee, &global_sid_World);
-                        break;
-                default:
-                        return NT_STATUS_INVALID_PARAMETER;
-        }
-        acc = map_canon_ace_perms(SNUM(fsp->conn),
-                                &nt_acl_type,
-                                perms,
-                                fsp->is_directory);
-
-        init_sec_ace(se,
-                &trustee,
-                nt_acl_type,
-                acc,
-                0);
-        return NT_STATUS_OK;
-}
-
-/****************************************************************************
- If this is an
+/****************************************************************************
+ Take care of parent ACL inheritance.
 ****************************************************************************/
 
@@ -3169 +3132 @@
         size_t sd_size;
         unsigned int i, j;
-        mode_t unx_mode;
+        BOOL is_dacl_protected = (psd->type & SE_DESC_DACL_PROTECTED);
 
         ZERO_STRUCT(sbuf);
@@ -3183 +3146 @@
                 return NT_STATUS_NO_MEMORY;
         }
-
-        /* Create a default mode for u/g/w. */
-        unx_mode = unix_mode(fsp->conn,
-                        aARCH | (fsp->is_directory ? aDIR : 0),
-                        fsp->fsp_name,
-                        parent_name);
 
         status = open_directory(fsp->conn,
@@ -3214 +3171 @@
         }
 
-        /*
+        /*
          * Make room for potentially all the ACLs from
-         * the parent, plus the user/group/other triple.
+         * the parent. We used to add the ugw triple here,
+         * as we knew we were dealing with POSIX ACLs.
+         * We no longer need to do so as we can guarentee
+         * that a default ACL from the parent directory will
+         * be well formed for POSIX ACLs if it came from a
+         * POSIX ACL source, and if we're not writing to a
+         * POSIX ACL sink then we don't care if it's not well
+         * formed. JRA.
          */
 
-        num_aces += parent_sd->dacl->num_aces + 3;
+        num_aces += parent_sd->dacl->num_aces;
 
         if((new_ace = TALLOC_ZERO_ARRAY(mem_ctx, SEC_ACE,
@@ -3225 +3189 @@
                 return NT_STATUS_NO_MEMORY;
         }
-
-        DEBUG(10,("append_parent_acl: parent ACL has %u entries. New "
-                "ACL has %u entries\n",
-                parent_sd->dacl->num_aces, num_aces ));
 
         /* Start by copying in all the given ACE entries. */
@@ -3240 +3200 @@
          */
 
-         /*
-          * Append u/g/w.
-          */
-
-        status = append_ugw_ace(fsp, psbuf, unx_mode, S_IRUSR, &new_ace[i++]);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-        status = append_ugw_ace(fsp, psbuf, unx_mode, S_IRGRP, &new_ace[i++]);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-        status = append_ugw_ace(fsp, psbuf, unx_mode, S_IROTH, &new_ace[i++]);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
         /* Finally append any inherited ACEs. */
         for (j = 0; j < parent_sd->dacl->num_aces; j++) {
                 SEC_ACE *se = &parent_sd->dacl->aces[j];
-                uint32 i_flags = se->flags & (SEC_ACE_FLAG_OBJECT_INHERIT|
-                                        SEC_ACE_FLAG_CONTAINER_INHERIT|
-                                        SEC_ACE_FLAG_INHERIT_ONLY);
 
                 if (fsp->is_directory) {
-                        if (i_flags == SEC_ACE_FLAG_OBJECT_INHERIT) {
-                                /* Should only apply to a file - ignore. */
+                        if (!(se->flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
+                                /* Doesn't apply to a directory - ignore. */
+                                DEBUG(10,("append_parent_acl: directory %s "
+                                        "ignoring non container "
+                                        "inherit flags %u on ACE with sid %s "
+                                        "from parent %s\n",
+                                        fsp->fsp_name,
+                                        (unsigned int)se->flags,
+                                        sid_string_static(&se->trustee),
+                                        parent_name));
                                 continue;
                         }
                 } else {
-                        if ((i_flags & (SEC_ACE_FLAG_OBJECT_INHERIT|
-                                        SEC_ACE_FLAG_INHERIT_ONLY)) !=
-                                        SEC_ACE_FLAG_OBJECT_INHERIT) {
-                                /* Should not apply to a file - ignore. */
+                        if (!(se->flags & SEC_ACE_FLAG_OBJECT_INHERIT)) {
+                                /* Doesn't apply to a file - ignore. */
+                                DEBUG(10,("append_parent_acl: file %s "
+                                        "ignoring non object "
+                                        "inherit flags %u on ACE with sid %s "
+                                        "from parent %s\n",
+                                        fsp->fsp_name,
+                                        (unsigned int)se->flags,
+                                        sid_string_static(&se->trustee),
+                                        parent_name));
                                 continue;
                         }
                 }
+
+                if (is_dacl_protected) {
+                        /* If the DACL is protected it means we must
+                         * not overwrite an existing ACE entry with the
+                         * same SID. This is order N^2. Ouch :-(. JRA. */
+                        unsigned int k;
+                        for (k = 0; k < psd->dacl->num_aces; k++) {
+                                if (sid_equal(&psd->dacl->aces[k].trustee,
+                                                &se->trustee)) {
+                                        break;
+                                }
+                        }
+                        if (k < psd->dacl->num_aces) {
+                                /* SID matched. Ignore. */
+                                DEBUG(10,("append_parent_acl: path %s "
+                                        "ignoring ACE with protected sid %s "
+                                        "from parent %s\n",
+                                        fsp->fsp_name,
+                                        sid_string_static(&se->trustee),
+                                        parent_name));
+                                continue;
+                        }
+                }
+
                 sec_ace_copy(&new_ace[i], se);
                 if (se->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
@@ -3282 +3260 @@
                 }
                 new_ace[i].flags |= SEC_ACE_FLAG_INHERITED_ACE;
+
+                if (fsp->is_directory) {
+                        /*
+                         * Strip off any inherit only. It's applied.
+                         */
+                        new_ace[i].flags &= ~(SEC_ACE_FLAG_INHERIT_ONLY);
+                        if (se->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
+                                /* No further inheritance. */
+                                new_ace[i].flags &=
+                                        ~(SEC_ACE_FLAG_CONTAINER_INHERIT|
+                                        SEC_ACE_FLAG_OBJECT_INHERIT);
+                        }
+                } else {
+                        /*
+                         * Strip off any container or inherit
+                         * flags, they can't apply to objects.
+                         */
+                        new_ace[i].flags &= ~(SEC_ACE_FLAG_CONTAINER_INHERIT|
+                                                SEC_ACE_FLAG_INHERIT_ONLY|
+                                                SEC_ACE_FLAG_NO_PROPAGATE_INHERIT);
+                }
+
                 i++;
+
+                DEBUG(10,("append_parent_acl: path %s "
+                        "inheriting ACE with sid %s "
+                        "from parent %s\n",
+                        fsp->fsp_name,
+                        sid_string_static(&se->trustee),
+                        parent_name));
+
         }