Changeset 745 for trunk/server/source3/smbd/posix_acls.c

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/smbd/posix_acls.c (modified) (75 diffs)

trunk/server/source3/smbd/posix_acls.c

@@ -21 +21 @@
 
 #include "includes.h"
-
-extern struct current_user current_user;
+#include "smbd/smbd.h"
+#include "system/filesys.h"
+#include "../libcli/security/security.h"
+#include "trans2.h"
+#include "passdb/lookup_sid.h"
+#include "auth.h"
+
 extern const struct generic_mapping file_generic_mapping;
 
@@ -45 +50 @@
         SMB_ACL_TAG_T type;
         mode_t perms; /* Only use S_I(R|W|X)USR mode bits here. */
-        DOM_SID trustee;
+        struct dom_sid trustee;
         enum ace_owner owner_type;
         enum ace_attribute attr;
@@ -443 +448 @@
                 paie->ace_flags = SEC_ACE_FLAG_INHERITED_ACE;
                 if (!get_pai_owner_type(paie, entry_offset)) {
+                        SAFE_FREE(paie);
                         return NULL;
                 }
@@ -477 +483 @@
 
         paiv->sd_type = (CVAL(buf,PAI_V1_FLAG_OFFSET) == PAI_V1_ACL_FLAG_PROTECTED) ?
-                        SE_DESC_DACL_PROTECTED : 0;
+                        SEC_DESC_DACL_PROTECTED : 0;
 
         paiv->num_entries = SVAL(buf,PAI_V1_NUM_ENTRIES_OFFSET);
@@ -521 +527 @@
 
                 if (!get_pai_owner_type(paie, entry_offset+1)) {
+                        SAFE_FREE(paie);
                         return NULL;
                 }
@@ -907 +914 @@
 ****************************************************************************/
 
-void create_file_sids(const SMB_STRUCT_STAT *psbuf, DOM_SID *powner_sid, DOM_SID *pgroup_sid)
+void create_file_sids(const SMB_STRUCT_STAT *psbuf, struct dom_sid *powner_sid, struct dom_sid *pgroup_sid)
 {
         uid_to_sid( powner_sid, psbuf->st_ex_uid );
@@ -946 +953 @@
 
                         if (!dir_acl) {
-                                can_merge = (sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
+                                can_merge = (dom_sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
                                                 (curr_ace->attr == curr_ace_outer->attr));
                         } else {
-                                can_merge = (sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
+                                can_merge = (dom_sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
                                                 (curr_ace->type == curr_ace_outer->type) &&
                                                 (curr_ace->attr == curr_ace_outer->attr));
@@ -998 +1005 @@
                          */
 
-                        if (sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
+                        if (dom_sid_equal(&curr_ace->trustee, &curr_ace_outer->trustee) &&
                                 (curr_ace_outer->attr == DENY_ACE) && (curr_ace->attr == ALLOW_ACE)) {
 
@@ -1166 +1173 @@
 
 /****************************************************************************
- Unpack a SEC_DESC into a UNIX owner and group.
-****************************************************************************/
-
-NTSTATUS unpack_nt_owners(int snum, uid_t *puser, gid_t *pgrp, uint32 security_info_sent, const SEC_DESC *psd)
-{
-        DOM_SID owner_sid;
-        DOM_SID grp_sid;
+ Unpack a struct security_descriptor into a UNIX owner and group.
+****************************************************************************/
+
+NTSTATUS unpack_nt_owners(struct connection_struct *conn,
+                        uid_t *puser, gid_t *pgrp,
+                        uint32 security_info_sent, const struct
+                        security_descriptor *psd)
+{
+        struct dom_sid owner_sid;
+        struct dom_sid grp_sid;
 
         *puser = (uid_t)-1;
@@ -1196 +1206 @@
          */
 
-        if (security_info_sent & OWNER_SECURITY_INFORMATION) {
+        if (security_info_sent & SECINFO_OWNER) {
                 sid_copy(&owner_sid, psd->owner_sid);
                 if (!sid_to_uid(&owner_sid, puser)) {
-                        if (lp_force_unknown_acl_user(snum)) {
+                        if (lp_force_unknown_acl_user(SNUM(conn))) {
                                 /* this allows take ownership to work
                                  * reasonably */
-                                *puser = current_user.ut.uid;
+                                *puser = get_current_uid(conn);
                         } else {
                                 DEBUG(3,("unpack_nt_owners: unable to validate"
@@ -1219 +1229 @@
          */
 
-        if (security_info_sent & GROUP_SECURITY_INFORMATION) {
+        if (security_info_sent & SECINFO_GROUP) {
                 sid_copy(&grp_sid, psd->group_sid);
                 if (!sid_to_gid( &grp_sid, pgrp)) {
-                        if (lp_force_unknown_acl_user(snum)) {
+                        if (lp_force_unknown_acl_user(SNUM(conn))) {
                                 /* this allows take group ownership to work
                                  * reasonably */
-                                *pgrp = current_user.ut.gid;
+                                *pgrp = get_current_gid(conn);
                         } else {
                                 DEBUG(3,("unpack_nt_owners: unable to validate"
@@ -1290 +1300 @@
 ****************************************************************************/
 
-static bool uid_entry_in_group( canon_ace *uid_ace, canon_ace *group_ace )
+static bool uid_entry_in_group(connection_struct *conn, canon_ace *uid_ace, canon_ace *group_ace )
 {
         const char *u_name = NULL;
@@ -1296 +1306 @@
         /* "Everyone" always matches every uid. */
 
-        if (sid_equal(&group_ace->trustee, &global_sid_World))
+        if (dom_sid_equal(&group_ace->trustee, &global_sid_World))
                 return True;
 
@@ -1303 +1313 @@
          * and don't need to do the complex user_in_group_sid() call
          */
-        if (uid_ace->unix_ug.uid == current_user.ut.uid) {
+        if (uid_ace->unix_ug.uid == get_current_uid(conn)) {
+                const struct security_unix_token *curr_utok = NULL;
                 size_t i;
 
-                if (group_ace->unix_ug.gid == current_user.ut.gid) {
+                if (group_ace->unix_ug.gid == get_current_gid(conn)) {
                         return True;
                 }
 
-                for (i=0; i < current_user.ut.ngroups; i++) {
-                        if (group_ace->unix_ug.gid == current_user.ut.groups[i]) {
+                curr_utok = get_current_utok(conn);
+                for (i=0; i < curr_utok->ngroups; i++) {
+                        if (group_ace->unix_ug.gid == curr_utok->groups[i]) {
                                 return True;
                         }
@@ -1342 +1354 @@
 ****************************************************************************/
 
-static bool ensure_canon_entry_valid(canon_ace **pp_ace,
+static bool ensure_canon_entry_valid(connection_struct *conn, canon_ace **pp_ace,
                                      const struct share_params *params,
                                      const bool is_directory,
-                                                        const DOM_SID *pfile_owner_sid,
-                                                        const DOM_SID *pfile_grp_sid,
+                                                        const struct dom_sid *pfile_owner_sid,
+                                                        const struct dom_sid *pfile_grp_sid,
                                                         const SMB_STRUCT_STAT *pst,
                                                         bool setting_acl)
@@ -1408 +1420 @@
                         for (pace_iter = *pp_ace; pace_iter; pace_iter = pace_iter->next) {
                                 if (pace_iter->type == SMB_ACL_GROUP_OBJ || pace_iter->type == SMB_ACL_GROUP) {
-                                        if (uid_entry_in_group(pace, pace_iter)) {
+                                        if (uid_entry_in_group(conn, pace, pace_iter)) {
                                                 pace->perms |= pace_iter->perms;
                                                 group_matched = True;
@@ -1487 +1499 @@
 ****************************************************************************/
 
-static void check_owning_objs(canon_ace *ace, DOM_SID *pfile_owner_sid, DOM_SID *pfile_grp_sid)
+static void check_owning_objs(canon_ace *ace, struct dom_sid *pfile_owner_sid, struct dom_sid *pfile_grp_sid)
 {
         bool got_user_obj, got_group_obj;
@@ -1510 +1522 @@
         for (i=0, current_ace = ace; i < entries; i++, current_ace = current_ace->next) {
                 if (!got_user_obj && current_ace->owner_type == UID_ACE &&
-                                sid_equal(&current_ace->trustee, pfile_owner_sid)) {
+                                dom_sid_equal(&current_ace->trustee, pfile_owner_sid)) {
                         current_ace->type = SMB_ACL_USER_OBJ;
                         got_user_obj = True;
                 }
                 if (!got_group_obj && current_ace->owner_type == GID_ACE &&
-                                sid_equal(&current_ace->trustee, pfile_grp_sid)) {
+                                dom_sid_equal(&current_ace->trustee, pfile_grp_sid)) {
                         current_ace->type = SMB_ACL_GROUP_OBJ;
                         got_group_obj = True;
@@ -1546 +1558 @@
 
         if (ace->type == SMB_ACL_USER_OBJ &&
-                        !(sid_equal(&ace->trustee, &global_sid_Creator_Owner))) {
+                        !(dom_sid_equal(&ace->trustee, &global_sid_Creator_Owner))) {
                 canon_ace *dup_ace = dup_canon_ace(ace);
 
@@ -1557 +1569 @@
 
         if (ace->type == SMB_ACL_GROUP_OBJ &&
-                        !(sid_equal(&ace->trustee, &global_sid_Creator_Group))) {
+                        !(dom_sid_equal(&ace->trustee, &global_sid_Creator_Group))) {
                 canon_ace *dup_ace = dup_canon_ace(ace);
 
@@ -1571 +1583 @@
 
 /****************************************************************************
- Unpack a SEC_DESC into two canonical ace lists.
+ Unpack a struct security_descriptor into two canonical ace lists.
 ****************************************************************************/
 
 static bool create_canon_ace_lists(files_struct *fsp,
                                         const SMB_STRUCT_STAT *pst,
-                                        DOM_SID *pfile_owner_sid,
-                                        DOM_SID *pfile_grp_sid,
+                                        struct dom_sid *pfile_owner_sid,
+                                        struct dom_sid *pfile_grp_sid,
                                         canon_ace **ppfile_ace,
                                         canon_ace **ppdir_ace,
-                                        const SEC_ACL *dacl)
+                                        const struct security_acl *dacl)
 {
         bool all_aces_are_inherit_only = (fsp->is_directory ? True : False);
@@ -1598 +1610 @@
 
         for(i = 0; i < dacl->num_aces; i++) {
-                SEC_ACE *psa = &dacl->aces[i];
+                struct security_ace *psa = &dacl->aces[i];
 
                 if((psa->type != SEC_ACE_TYPE_ACCESS_ALLOWED) && (psa->type != SEC_ACE_TYPE_ACCESS_DENIED)) {
@@ -1635 +1647 @@
 
         for(i = 0; i < dacl->num_aces; i++) {
-                SEC_ACE *psa1 = &dacl->aces[i];
+                struct security_ace *psa1 = &dacl->aces[i];
 
                 for (j = i + 1; j < dacl->num_aces; j++) {
-                        SEC_ACE *psa2 = &dacl->aces[j];
+                        struct security_ace *psa2 = &dacl->aces[j];
 
                         if (psa1->access_mask != psa2->access_mask)
                                 continue;
 
-                        if (!sid_equal(&psa1->trustee, &psa2->trustee))
+                        if (!dom_sid_equal(&psa1->trustee, &psa2->trustee))
                                 continue;
 
@@ -1666 +1678 @@
 
         for(i = 0; i < dacl->num_aces; i++) {
-                SEC_ACE *psa = &dacl->aces[i];
+                struct security_ace *psa = &dacl->aces[i];
 
                 /*
-                 * Create a cannon_ace entry representing this NT DACL ACE.
+                 * Create a canon_ace entry representing this NT DACL ACE.
                  */
 
@@ -1689 +1701 @@
                  */
 
-                if( sid_equal(&current_ace->trustee, &global_sid_World)) {
+                if( dom_sid_equal(&current_ace->trustee, &global_sid_World)) {
                         current_ace->owner_type = WORLD_ACE;
                         current_ace->unix_ug.world = -1;
                         current_ace->type = SMB_ACL_OTHER;
-                } else if (sid_equal(&current_ace->trustee, &global_sid_Creator_Owner)) {
+                } else if (dom_sid_equal(&current_ace->trustee, &global_sid_Creator_Owner)) {
                         current_ace->owner_type = UID_ACE;
                         current_ace->unix_ug.uid = pst->st_ex_uid;
@@ -1706 +1718 @@
                         psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
 
-                } else if (sid_equal(&current_ace->trustee, &global_sid_Creator_Group)) {
+                } else if (dom_sid_equal(&current_ace->trustee, &global_sid_Creator_Group)) {
                         current_ace->owner_type = GID_ACE;
                         current_ace->unix_ug.gid = pst->st_ex_gid;
@@ -1753 +1765 @@
                                         "unknown or foreign SID %s\n",
                                         sid_string_dbg(&psa->trustee)));
-                                        SAFE_FREE(current_ace);
+                                SAFE_FREE(current_ace);
                                 continue;
                         }
@@ -2066 +2078 @@
 ****************************************************************************/
 
-static void process_deny_list( canon_ace **pp_ace_list )
+static void process_deny_list(connection_struct *conn, canon_ace **pp_ace_list )
 {
         canon_ace *ace_list = *pp_ace_list;
@@ -2090 +2102 @@
                 }
 
-                if (!sid_equal(&curr_ace->trustee, &global_sid_World))
+                if (!dom_sid_equal(&curr_ace->trustee, &global_sid_World))
                         continue;
 
@@ -2103 +2115 @@
                          */
 
-                        canon_ace *prev_entry = curr_ace->prev;
+                        canon_ace *prev_entry = DLIST_PREV(curr_ace);
 
                         free_canon_ace_list( curr_ace );
                         if (prev_entry)
-                                prev_entry->next = NULL;
+                                DLIST_REMOVE(ace_list, prev_entry);
                         else {
                                 /* We deleted the entire list. */
@@ -2171 +2183 @@
                                 continue;
 
-                        if (uid_entry_in_group( curr_ace, allow_ace_p))
+                        if (uid_entry_in_group(conn, curr_ace, allow_ace_p))
                                 new_perms |= allow_ace_p->perms;
                 }
@@ -2215 +2227 @@
                         /* Mask off the deny group perms. */
 
-                        if (uid_entry_in_group( allow_ace_p, curr_ace))
+                        if (uid_entry_in_group(conn, allow_ace_p, curr_ace))
                                 allow_ace_p->perms &= ~curr_ace->perms;
                 }
@@ -2265 +2277 @@
                         /* OR in the group perms. */
 
-                        if (uid_entry_in_group( curr_ace, allow_ace_p))
+                        if (uid_entry_in_group(conn, curr_ace, allow_ace_p))
                                 curr_ace->perms |= allow_ace_p->perms;
                 }
@@ -2313 +2325 @@
 
 /****************************************************************************
- Unpack a SEC_DESC into two canonical ace lists. We don't depend on this
+ Unpack a struct security_descriptor into two canonical ace lists. We don't depend on this
  succeeding.
 ****************************************************************************/
@@ -2319 +2331 @@
 static bool unpack_canon_ace(files_struct *fsp,
                                 const SMB_STRUCT_STAT *pst,
-                                DOM_SID *pfile_owner_sid,
-                                DOM_SID *pfile_grp_sid,
+                                struct dom_sid *pfile_owner_sid,
+                                struct dom_sid *pfile_grp_sid,
                                 canon_ace **ppfile_ace,
                                 canon_ace **ppdir_ace,
                                 uint32 security_info_sent,
-                                const SEC_DESC *psd)
+                                const struct security_descriptor *psd)
 {
         SMB_STRUCT_STAT st;
@@ -2342 +2354 @@
          */
 
-        if(!(security_info_sent & DACL_SECURITY_INFORMATION) || !psd->dacl)
+        if(!(security_info_sent & SECINFO_DACL) || !psd->dacl)
                 return True;
 
@@ -2377 +2389 @@
 
         print_canon_ace_list( "file ace - before deny", file_ace);
-        process_deny_list( &file_ace);
+        process_deny_list(fsp->conn, &file_ace);
 
         print_canon_ace_list( "dir ace - before deny", dir_ace);
-        process_deny_list( &dir_ace);
+        process_deny_list(fsp->conn, &dir_ace);
 
         /*
@@ -2399 +2411 @@
         st.st_ex_mode = create_default_mode(fsp, False);
 
-        if (!ensure_canon_entry_valid(&file_ace, fsp->conn->params,
+        if (!ensure_canon_entry_valid(fsp->conn, &file_ace, fsp->conn->params,
                         fsp->is_directory, pfile_owner_sid, pfile_grp_sid, &st, True)) {
                 free_canon_ace_list(file_ace);
@@ -2416 +2428 @@
         st.st_ex_mode = create_default_mode(fsp, True);
 
-        if (dir_ace && !ensure_canon_entry_valid(&dir_ace, fsp->conn->params,
+        if (dir_ace && !ensure_canon_entry_valid(fsp->conn, &dir_ace, fsp->conn->params,
                         fsp->is_directory, pfile_owner_sid, pfile_grp_sid, &st, True)) {
                 free_canon_ace_list(file_ace);
@@ -2498 +2510 @@
                                    const char *fname, SMB_ACL_T posix_acl,
                                    const SMB_STRUCT_STAT *psbuf,
-                                   const DOM_SID *powner, const DOM_SID *pgroup, struct pai_val *pal, SMB_ACL_TYPE_T the_acl_type)
+                                   const struct dom_sid *powner, const struct dom_sid *pgroup, struct pai_val *pal, SMB_ACL_TYPE_T the_acl_type)
 {
         mode_t acl_mask = (S_IRUSR|S_IWUSR|S_IXUSR);
@@ -2511 +2523 @@
                 SMB_ACL_TAG_T tagtype;
                 SMB_ACL_PERMSET_T permset;
-                DOM_SID sid;
+                struct dom_sid sid;
                 posix_id unix_ug;
                 enum ace_owner owner_type;
@@ -2601 +2613 @@
          */
 
-        if (!ensure_canon_entry_valid(&l_head, conn->params,
+        if (!ensure_canon_entry_valid(conn, &l_head, conn->params,
                                       S_ISDIR(psbuf->st_ex_mode), powner, pgroup,
                                       psbuf, False))
@@ -2645 +2657 @@
 ****************************************************************************/
 
-bool current_user_in_group(gid_t gid)
+bool current_user_in_group(connection_struct *conn, gid_t gid)
 {
         int i;
-
-        for (i = 0; i < current_user.ut.ngroups; i++) {
-                if (current_user.ut.groups[i] == gid) {
+        const struct security_unix_token *utok = get_current_utok(conn);
+
+        for (i = 0; i < utok->ngroups; i++) {
+                if (utok->groups[i] == gid) {
                         return True;
                 }
@@ -2671 +2684 @@
         /* file primary group == user primary or supplementary group */
         if (lp_acl_group_control(SNUM(conn)) &&
-            current_user_in_group(smb_fname->st.st_ex_gid)) {
+            current_user_in_group(conn, smb_fname->st.st_ex_gid)) {
                 return true;
         }
@@ -3069 +3082 @@
 ****************************************************************************/
 
-static size_t merge_default_aces( SEC_ACE *nt_ace_list, size_t num_aces)
+static size_t merge_default_aces( struct security_ace *nt_ace_list, size_t num_aces)
 {
         size_t i, j;
@@ -3084 +3097 @@
                                 (nt_ace_list[i].size == nt_ace_list[j].size) &&
                                 (nt_ace_list[i].access_mask == nt_ace_list[j].access_mask) &&
-                                sid_equal(&nt_ace_list[i].trustee, &nt_ace_list[j].trustee) &&
+                                dom_sid_equal(&nt_ace_list[i].trustee, &nt_ace_list[j].trustee) &&
                                 (i_inh == j_inh) &&
                                 (i_flags_ni == 0) &&
@@ -3101 +3114 @@
                                         if (num_aces - i - 1 > 0)
                                                 memmove(&nt_ace_list[i], &nt_ace_list[i+1], (num_aces-i-1) *
-                                                                sizeof(SEC_ACE));
+                                                                sizeof(struct security_ace));
 
                                         DEBUG(10,("merge_default_aces: Merging zero access ACE %u onto ACE %u.\n",
@@ -3115 +3128 @@
                                         if (num_aces - j - 1 > 0)
                                                 memmove(&nt_ace_list[j], &nt_ace_list[j+1], (num_aces-j-1) *
-                                                                sizeof(SEC_ACE));
+                                                                sizeof(struct security_ace));
 
                                         DEBUG(10,("merge_default_aces: Merging ACE %u onto ACE %u.\n",
@@ -3140 +3153 @@
  */
 
-static void add_or_replace_ace(SEC_ACE *nt_ace_list, size_t *num_aces,
-                                const DOM_SID *sid, enum security_ace_type type,
+static void add_or_replace_ace(struct security_ace *nt_ace_list, size_t *num_aces,
+                                const struct dom_sid *sid, enum security_ace_type type,
                                 uint32_t mask, uint8_t flags)
 {
@@ -3148 +3161 @@
         /* first search for a duplicate */
         for (i = 0; i < *num_aces; i++) {
-                if (sid_equal(&nt_ace_list[i].trustee, sid) &&
+                if (dom_sid_equal(&nt_ace_list[i].trustee, sid) &&
                     (nt_ace_list[i].flags == flags)) break;
         }
@@ -3179 +3192 @@
                                       SMB_ACL_T def_acl,
                                       uint32_t security_info,
-                                      SEC_DESC **ppdesc)
-{
-        DOM_SID owner_sid;
-        DOM_SID group_sid;
+                                      struct security_descriptor **ppdesc)
+{
+        struct dom_sid owner_sid;
+        struct dom_sid group_sid;
         size_t sd_size = 0;
-        SEC_ACL *psa = NULL;
+        struct security_acl *psa = NULL;
         size_t num_acls = 0;
         size_t num_def_acls = 0;
@@ -3190 +3203 @@
         canon_ace *file_ace = NULL;
         canon_ace *dir_ace = NULL;
-        SEC_ACE *nt_ace_list = NULL;
+        struct security_ace *nt_ace_list = NULL;
         size_t num_profile_acls = 0;
-        DOM_SID orig_owner_sid;
-        SEC_DESC *psd = NULL;
+        struct dom_sid orig_owner_sid;
+        struct security_descriptor *psd = NULL;
         int i;
 
@@ -3210 +3223 @@
         }
 
-        if ((security_info & DACL_SECURITY_INFORMATION) && !(security_info & PROTECTED_DACL_SECURITY_INFORMATION)) {
+        if ((security_info & SECINFO_DACL) && !(security_info & SECINFO_PROTECTED_DACL)) {
 
                 /*
@@ -3302 +3315 @@
 
                         /* Allocate the ace list. */
-                        if ((nt_ace_list = SMB_MALLOC_ARRAY(SEC_ACE,num_acls + num_profile_acls + num_def_acls)) == NULL) {
+                        if ((nt_ace_list = SMB_MALLOC_ARRAY(struct security_ace,num_acls + num_profile_acls + num_def_acls)) == NULL) {
                                 DEBUG(0,("get_nt_acl: Unable to malloc space for nt_ace_list.\n"));
                                 goto done;
                         }
 
-                        memset(nt_ace_list, '\0', (num_acls + num_def_acls) * sizeof(SEC_ACE) );
+                        memset(nt_ace_list, '\0', (num_acls + num_def_acls) * sizeof(struct security_ace) );
 
                         /*
@@ -3371 +3384 @@
                         if (lp_profile_acls(SNUM(conn))) {
                                 for (i = 0; i < num_aces; i++) {
-                                        if (sid_equal(&nt_ace_list[i].trustee, &owner_sid)) {
+                                        if (dom_sid_equal(&nt_ace_list[i].trustee, &owner_sid)) {
                                                 add_or_replace_ace(nt_ace_list, &num_aces,
                                                                    &orig_owner_sid,
@@ -3389 +3402 @@
                         }
                 }
-        } /* security_info & DACL_SECURITY_INFORMATION */
+        } /* security_info & SECINFO_DACL */
 
         psd = make_standard_sec_desc( talloc_tos(),
-                        (security_info & OWNER_SECURITY_INFORMATION) ? &owner_sid : NULL,
-                        (security_info & GROUP_SECURITY_INFORMATION) ? &group_sid : NULL,
+                        (security_info & SECINFO_OWNER) ? &owner_sid : NULL,
+                        (security_info & SECINFO_GROUP) ? &group_sid : NULL,
                         psa,
                         &sd_size);
@@ -3442 +3455 @@
 
 NTSTATUS posix_fget_nt_acl(struct files_struct *fsp, uint32_t security_info,
-                           SEC_DESC **ppdesc)
+                           struct security_descriptor **ppdesc)
 {
         SMB_STRUCT_STAT sbuf;
@@ -3475 +3488 @@
 
 NTSTATUS posix_get_nt_acl(struct connection_struct *conn, const char *name,
-                          uint32_t security_info, SEC_DESC **ppdesc)
+                          uint32_t security_info, struct security_descriptor **ppdesc)
 {
         SMB_ACL_T posix_acl = NULL;
@@ -3521 +3534 @@
 
   1) If we have root privileges, then it will just work.
-  2) If we have SeTakeOwnershipPrivilege we can change the user to the current user.
-  3) If we have SeRestorePrivilege we can change the user to any other user. 
+  2) If we have SeRestorePrivilege we can change the user + group to any other user. 
+  3) If we have SeTakeOwnershipPrivilege we can change the user to the current user.
   4) If we have write permission to the file and dos_filemodes is set
      then allow chown to the currently authenticated user.
 ****************************************************************************/
 
-int try_chown(connection_struct *conn, struct smb_filename *smb_fname,
-              uid_t uid, gid_t gid)
-{
-        int ret;
-        files_struct *fsp;
-
-        if(!CAN_WRITE(conn)) {
-                return -1;
+NTSTATUS try_chown(files_struct *fsp, uid_t uid, gid_t gid)
+{
+        NTSTATUS status;
+
+        if(!CAN_WRITE(fsp->conn)) {
+                return NT_STATUS_MEDIA_WRITE_PROTECTED;
         }
 
         /* Case (1). */
-        /* try the direct way first */
-        if (lp_posix_pathnames()) {
-                ret = SMB_VFS_LCHOWN(conn, smb_fname->base_name, uid, gid);
-        } else {
-                ret = SMB_VFS_CHOWN(conn, smb_fname->base_name, uid, gid);
-        }
-
-        if (ret == 0)
-                return 0;
+        status = vfs_chown_fsp(fsp, uid, gid);
+        if (NT_STATUS_IS_OK(status)) {
+                return status;
+        }
 
         /* Case (2) / (3) */
         if (lp_enable_privileges()) {
-
-                bool has_take_ownership_priv = user_has_privileges(current_user.nt_user_token,
-                                                              &se_take_ownership);
-                bool has_restore_priv = user_has_privileges(current_user.nt_user_token,
-                                                       &se_restore);
-
-                /* Case (2) */
-                if ( ( has_take_ownership_priv && ( uid == current_user.ut.uid ) ) ||
-                /* Case (3) */
-                     ( has_restore_priv ) ) {
-
+                bool has_take_ownership_priv = security_token_has_privilege(
+                                                get_current_nttok(fsp->conn),
+                                                SEC_PRIV_TAKE_OWNERSHIP);
+                bool has_restore_priv = security_token_has_privilege(
+                                                get_current_nttok(fsp->conn),
+                                                SEC_PRIV_RESTORE);
+
+                if (has_restore_priv) {
+                        ; /* Case (2) */
+                } else if (has_take_ownership_priv) {
+                        /* Case (3) */
+                        if (uid == get_current_uid(fsp->conn)) {
+                                gid = (gid_t)-1;
+                        } else {
+                                has_take_ownership_priv = false;
+                        }
+                }
+
+                if (has_take_ownership_priv || has_restore_priv) {
                         become_root();
-                        /* Keep the current file gid the same - take ownership doesn't imply group change. */
-                        if (lp_posix_pathnames()) {
-                                ret = SMB_VFS_LCHOWN(conn, smb_fname->base_name, uid,
-                                                    (gid_t)-1);
-                        } else {
-                                ret = SMB_VFS_CHOWN(conn, smb_fname->base_name, uid,
-                                                    (gid_t)-1);
-                        }
+                        status = vfs_chown_fsp(fsp, uid, gid);
                         unbecome_root();
-                        return ret;
+                        return status;
                 }
         }
 
         /* Case (4). */
-        if (!lp_dos_filemode(SNUM(conn))) {
-                errno = EPERM;
-                return -1;
+        if (!lp_dos_filemode(SNUM(fsp->conn))) {
+                return NT_STATUS_ACCESS_DENIED;
         }
 
@@ -3585 +3591 @@
            a local SID on the users workstation
         */
-        if (uid != current_user.ut.uid) {
-                errno = EPERM;
-                return -1;
-        }
-
-        if (lp_posix_pathnames()) {
-                ret = SMB_VFS_LSTAT(conn, smb_fname);
-        } else {
-                ret = SMB_VFS_STAT(conn, smb_fname);
-        }
-
-        if (ret == -1) {
-                return -1;
-        }
-
-        if (!NT_STATUS_IS_OK(open_file_fchmod(conn, smb_fname, &fsp))) {
-                return -1;
+        if (uid != get_current_uid(fsp->conn)) {
+                return NT_STATUS_ACCESS_DENIED;
         }
 
         become_root();
         /* Keep the current file gid the same. */
-        if (fsp->fh->fd == -1) {
-                if (lp_posix_pathnames()) {
-                        ret = SMB_VFS_LCHOWN(conn, smb_fname->base_name, uid,
-                                            (gid_t)-1);
-                } else {
-                        ret = SMB_VFS_CHOWN(conn, smb_fname->base_name, uid,
-                                            (gid_t)-1);
-                }
-        } else {
-                ret = SMB_VFS_FCHOWN(fsp, uid, (gid_t)-1);
-        }
+        status = vfs_chown_fsp(fsp, uid, (gid_t)-1);
         unbecome_root();
 
-        close_file(NULL, fsp, NORMAL_CLOSE);
-
-        return ret;
+        return status;
 }
 
@@ -3632 +3611 @@
 
 NTSTATUS append_parent_acl(files_struct *fsp,
-                                const SEC_DESC *pcsd,
-                                SEC_DESC **pp_new_sd)
+                                const struct security_descriptor *pcsd,
+                                struct security_descriptor **pp_new_sd)
 {
         struct smb_filename *smb_dname = NULL;
-        SEC_DESC *parent_sd = NULL;
+        struct security_descriptor *parent_sd = NULL;
         files_struct *parent_fsp = NULL;
         TALLOC_CTX *mem_ctx = talloc_tos();
         char *parent_name = NULL;
-        SEC_ACE *new_ace = NULL;
+        struct security_ace *new_ace = NULL;
         unsigned int num_aces = pcsd->dacl->num_aces;
         NTSTATUS status;
         int info;
         unsigned int i, j;
-        SEC_DESC *psd = dup_sec_desc(talloc_tos(), pcsd);
+        struct security_descriptor *psd = dup_sec_desc(talloc_tos(), pcsd);
         bool is_dacl_protected = (pcsd->type & SEC_DESC_DACL_PROTECTED);
 
@@ -3686 +3665 @@
 
         status = SMB_VFS_GET_NT_ACL(parent_fsp->conn, smb_dname->base_name,
-                                    DACL_SECURITY_INFORMATION, &parent_sd );
+                                    SECINFO_DACL, &parent_sd );
 
         close_file(NULL, parent_fsp, NORMAL_CLOSE);
@@ -3709 +3688 @@
         num_aces += parent_sd->dacl->num_aces;
 
-        if((new_ace = TALLOC_ZERO_ARRAY(mem_ctx, SEC_ACE,
+        if((new_ace = TALLOC_ZERO_ARRAY(mem_ctx, struct security_ace,
                                         num_aces)) == NULL) {
                 return NT_STATUS_NO_MEMORY;
@@ -3726 +3705 @@
         /* Finally append any inherited ACEs. */
         for (j = 0; j < parent_sd->dacl->num_aces; j++) {
-                SEC_ACE *se = &parent_sd->dacl->aces[j];
+                struct security_ace *se = &parent_sd->dacl->aces[j];
 
                 if (fsp->is_directory) {
@@ -3762 +3741 @@
                         unsigned int k;
                         for (k = 0; k < psd->dacl->num_aces; k++) {
-                                if (sid_equal(&psd->dacl->aces[k].trustee,
+                                if (dom_sid_equal(&psd->dacl->aces[k].trustee,
                                                 &se->trustee)) {
                                         break;
@@ -3817 +3796 @@
         psd->dacl->aces = new_ace;
         psd->dacl->num_aces = i;
-        psd->type &= ~(SE_DESC_DACL_AUTO_INHERITED|
-                         SE_DESC_DACL_AUTO_INHERIT_REQ);
+        psd->type &= ~(SEC_DESC_DACL_AUTO_INHERITED|
+                         SEC_DESC_DACL_AUTO_INHERIT_REQ);
 
         *pp_new_sd = psd;
@@ -3829 +3808 @@
  description of the following NT ACL.
  This should be the only external function needed for the UNIX style set ACL.
-****************************************************************************/
-
-NTSTATUS set_nt_acl(files_struct *fsp, uint32 security_info_sent, const SEC_DESC *psd_orig)
+ We make a copy of psd_orig as internal functions modify the elements inside
+ it, even though it's a const pointer.
+****************************************************************************/
+
+NTSTATUS set_nt_acl(files_struct *fsp, uint32 security_info_sent, const struct security_descriptor *psd_orig)
 {
         connection_struct *conn = fsp->conn;
         uid_t user = (uid_t)-1;
         gid_t grp = (gid_t)-1;
-        DOM_SID file_owner_sid;
-        DOM_SID file_grp_sid;
+        struct dom_sid file_owner_sid;
+        struct dom_sid file_grp_sid;
         canon_ace *file_ace_list = NULL;
         canon_ace *dir_ace_list = NULL;
@@ -3846 +3827 @@
         bool acl_set_support = false;
         bool ret = false;
-        SEC_DESC *psd = NULL;
+        struct security_descriptor *psd = NULL;
 
         DEBUG(10,("set_nt_acl: called for file %s\n",
@@ -3889 +3870 @@
         }
 
-        status = unpack_nt_owners( SNUM(conn), &user, &grp, security_info_sent, psd);
+        status = unpack_nt_owners( conn, &user, &grp, security_info_sent, psd);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -3907 +3888 @@
                          (unsigned int)grp));
 
-                if(try_chown(fsp->conn, fsp->fsp_name, user, grp) == -1) {
+                status = try_chown(fsp, user, grp);
+                if(!NT_STATUS_IS_OK(status)) {
                         DEBUG(3,("set_nt_acl: chown %s, %u, %u failed. Error "
-                                 "= %s.\n", fsp_str_dbg(fsp),
-                                 (unsigned int)user, (unsigned int)grp,
-                                 strerror(errno)));
-                        if (errno == EPERM) {
-                                return NT_STATUS_INVALID_OWNER;
-                        }
-                        return map_nt_error_from_unix(errno);
+                                "= %s.\n", fsp_str_dbg(fsp),
+                                (unsigned int)user,
+                                (unsigned int)grp,
+                                nt_errstr(status)));
+                        return status;
                 }
 
@@ -3942 +3922 @@
                         (psd->type & SEC_DESC_DACL_PRESENT) &&
                         (psd->dacl == NULL)) {
-                SEC_ACE ace[3];
+                struct security_ace ace[3];
 
                 /* We can't have NULL DACL in POSIX.
@@ -3992 +3972 @@
          */
 
-        if(!(security_info_sent & DACL_SECURITY_INFORMATION) || (psd->dacl == NULL)) {
+        if(!(security_info_sent & SECINFO_DACL) || (psd->dacl == NULL)) {
                 free_canon_ace_list(file_ace_list);
                 free_canon_ace_list(dir_ace_list);
@@ -4757 +4737 @@
 ********************************************************************/
 
-SEC_DESC *get_nt_acl_no_snum( TALLOC_CTX *ctx, const char *fname)
-{
-        SEC_DESC *psd, *ret_sd;
+struct security_descriptor *get_nt_acl_no_snum( TALLOC_CTX *ctx, const char *fname)
+{
+        struct security_descriptor *psd, *ret_sd;
         connection_struct *conn;
         files_struct finfo;
@@ -4802 +4782 @@
         }
 
-        if (!NT_STATUS_IS_OK(SMB_VFS_FGET_NT_ACL( &finfo, DACL_SECURITY_INFORMATION, &psd))) {
+        if (!NT_STATUS_IS_OK(SMB_VFS_FGET_NT_ACL( &finfo, SECINFO_DACL, &psd))) {
                 DEBUG(0,("get_nt_acl_no_snum: get_nt_acl returned zero.\n"));
                 TALLOC_FREE(finfo.fsp_name);
@@ -4822 +4802 @@
                                         const char *name,
                                         SMB_STRUCT_STAT *psbuf,
-                                        SEC_DESC **ppdesc)
+                                        struct security_descriptor **ppdesc)
 {
         struct dom_sid owner_sid, group_sid;
         size_t size = 0;
-        SEC_ACE aces[4];
+        struct security_ace aces[4];
         uint32_t access_mask = 0;
         mode_t mode = psbuf->st_ex_mode;
-        SEC_ACL *new_dacl = NULL;
+        struct security_acl *new_dacl = NULL;
         int idx = 0;