Changeset 596 for trunk/server/source3/smbd/posix_acls.c

Timestamp:

Jul 2, 2011, 3:35:33 PM (14 years ago)

Author:

Herwig Bauernfeind

Message:

Samba 3.5: Update trunk to 3.5.8

File:

• trunk/server/source3/smbd/posix_acls.c (modified) (9 diffs)

trunk/server/source3/smbd/posix_acls.c

@@ -1746 +1746 @@
                                            sid_string_dbg(&psa->trustee)));
                                 SAFE_FREE(current_ace);
+                                continue;
+                        }
+
+                        if (lp_force_unknown_acl_user(SNUM(fsp->conn))) {
+                                DEBUG(10, ("create_canon_ace_lists: ignoring "
+                                        "unknown or foreign SID %s\n",
+                                        sid_string_dbg(&psa->trustee)));
+                                        SAFE_FREE(current_ace);
                                 continue;
                         }
@@ -3592 +3600 @@
         }
 
-        if (!NT_STATUS_IS_OK(open_file_fchmod(NULL, conn, smb_fname, &fsp))) {
+        if (!NT_STATUS_IS_OK(open_file_fchmod(conn, smb_fname, &fsp))) {
                 return -1;
         }
@@ -3611 +3619 @@
         unbecome_root();
 
-        close_file_fchmod(NULL, fsp);
+        close_file(NULL, fsp, NORMAL_CLOSE);
 
         return ret;
@@ -3823 +3831 @@
 ****************************************************************************/
 
-NTSTATUS set_nt_acl(files_struct *fsp, uint32 security_info_sent, const SEC_DESC *psd)
+NTSTATUS set_nt_acl(files_struct *fsp, uint32 security_info_sent, const SEC_DESC *psd_orig)
 {
         connection_struct *conn = fsp->conn;
@@ -3838 +3846 @@
         bool acl_set_support = false;
         bool ret = false;
+        SEC_DESC *psd = NULL;
 
         DEBUG(10,("set_nt_acl: called for file %s\n",
@@ -3847 +3856 @@
         }
 
+        if (!psd_orig) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        psd = dup_sec_desc(talloc_tos(), psd_orig);
+        if (!psd) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
         /*
          * Get the current state of the file.
@@ -3862 +3880 @@
          * Unpack the user/group/world id's.
          */
+
+        /* POSIX can't cope with missing owner/group. */
+        if ((security_info_sent & SECINFO_OWNER) && (psd->owner_sid == NULL)) {
+                security_info_sent &= ~SECINFO_OWNER;
+        }
+        if ((security_info_sent & SECINFO_GROUP) && (psd->group_sid == NULL)) {
+                security_info_sent &= ~SECINFO_GROUP;
+        }
 
         status = unpack_nt_owners( SNUM(conn), &user, &grp, security_info_sent, psd);
@@ -3912 +3938 @@
 
         create_file_sids(&fsp->fsp_name->st, &file_owner_sid, &file_grp_sid);
+
+        if((security_info_sent & SECINFO_DACL) &&
+                        (psd->type & SEC_DESC_DACL_PRESENT) &&
+                        (psd->dacl == NULL)) {
+                SEC_ACE ace[3];
+
+                /* We can't have NULL DACL in POSIX.
+                   Use owner/group/Everyone -> full access. */
+
+                init_sec_ace(&ace[0],
+                                &file_owner_sid,
+                                SEC_ACE_TYPE_ACCESS_ALLOWED,
+                                GENERIC_ALL_ACCESS,
+                                0);
+                init_sec_ace(&ace[1],
+                                &file_grp_sid,
+                                SEC_ACE_TYPE_ACCESS_ALLOWED,
+                                GENERIC_ALL_ACCESS,
+                                0);
+                init_sec_ace(&ace[2],
+                                &global_sid_World,
+                                SEC_ACE_TYPE_ACCESS_ALLOWED,
+                                GENERIC_ALL_ACCESS,
+                                0);
+                psd->dacl = make_sec_acl(talloc_tos(),
+                                        NT4_ACL_REVISION,
+                                        3,
+                                        ace);
+                if (psd->dacl == NULL) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                security_acl_map_generic(psd->dacl, &file_generic_mapping);
+        }
 
         acl_perms = unpack_canon_ace(fsp, &fsp->fsp_name->st, &file_owner_sid,
@@ -4757 +4816 @@
         return ret_sd;
 }
+
+/* Stolen shamelessly from pvfs_default_acl() in source4 :-). */
+
+NTSTATUS make_default_filesystem_acl(TALLOC_CTX *ctx,
+                                        const char *name,
+                                        SMB_STRUCT_STAT *psbuf,
+                                        SEC_DESC **ppdesc)
+{
+        struct dom_sid owner_sid, group_sid;
+        size_t size = 0;
+        SEC_ACE aces[4];
+        uint32_t access_mask = 0;
+        mode_t mode = psbuf->st_ex_mode;
+        SEC_ACL *new_dacl = NULL;
+        int idx = 0;
+
+        DEBUG(10,("make_default_filesystem_acl: file %s mode = 0%o\n",
+                name, (int)mode ));
+
+        uid_to_sid(&owner_sid, psbuf->st_ex_uid);
+        gid_to_sid(&group_sid, psbuf->st_ex_gid);
+
+        /*
+         We provide up to 4 ACEs
+                - Owner
+                - Group
+                - Everyone
+                - NT System
+        */
+
+        if (mode & S_IRUSR) {
+                if (mode & S_IWUSR) {
+                        access_mask |= SEC_RIGHTS_FILE_ALL;
+                } else {
+                        access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
+                }
+        }
+        if (mode & S_IWUSR) {
+                access_mask |= SEC_RIGHTS_FILE_WRITE | SEC_STD_DELETE;
+        }
+
+        init_sec_ace(&aces[idx],
+                        &owner_sid,
+                        SEC_ACE_TYPE_ACCESS_ALLOWED,
+                        access_mask,
+                        0);
+        idx++;
+
+        access_mask = 0;
+        if (mode & S_IRGRP) {
+                access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
+        }
+        if (mode & S_IWGRP) {
+                /* note that delete is not granted - this matches posix behaviour */
+                access_mask |= SEC_RIGHTS_FILE_WRITE;
+        }
+        if (access_mask) {
+                init_sec_ace(&aces[idx],
+                        &group_sid,
+                        SEC_ACE_TYPE_ACCESS_ALLOWED,
+                        access_mask,
+                        0);
+                idx++;
+        }
+
+        access_mask = 0;
+        if (mode & S_IROTH) {
+                access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
+        }
+        if (mode & S_IWOTH) {
+                access_mask |= SEC_RIGHTS_FILE_WRITE;
+        }
+        if (access_mask) {
+                init_sec_ace(&aces[idx],
+                        &global_sid_World,
+                        SEC_ACE_TYPE_ACCESS_ALLOWED,
+                        access_mask,
+                        0);
+                idx++;
+        }
+
+        init_sec_ace(&aces[idx],
+                        &global_sid_System,
+                        SEC_ACE_TYPE_ACCESS_ALLOWED,
+                        SEC_RIGHTS_FILE_ALL,
+                        0);
+        idx++;
+
+        new_dacl = make_sec_acl(ctx,
+                        NT4_ACL_REVISION,
+                        idx,
+                        aces);
+
+        if (!new_dacl) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        *ppdesc = make_sec_desc(ctx,
+                        SECURITY_DESCRIPTOR_REVISION_1,
+                        SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT,
+                        &owner_sid,
+                        &group_sid,
+                        NULL,
+                        new_dacl,
+                        &size);
+        if (!*ppdesc) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        return NT_STATUS_OK;
+}