s3/smbd: move make_default_filesystem_acl() to vfs_acl_common.c

This function is only used in vfs_acl_common.c and will be modified in
the next commit.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12028

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit afc2417b107af572081974ff9d013ddec890d31f)

diff --git a/source3/modules/vfs_acl_common.c b/source3/modules/vfs_acl_common.c
index 76ac5985c66f3721bb800506979589846a68ca94..dc9676106c2a960f6ccacde54312303647a59610 100644 (file)
--- a/source3/modules/vfs_acl_common.c
+++ b/source3/modules/vfs_acl_common.c
@@ -358,6 +358,114 @@ static NTSTATUS add_directory_inheritable_components(vfs_handle_struct *handle,
        return NT_STATUS_OK;
 }
 
+static NTSTATUS make_default_filesystem_acl(TALLOC_CTX *ctx,
+                                           const char *name,
+                                           SMB_STRUCT_STAT *psbuf,
+                                           struct security_descriptor **ppdesc)
+{
+       struct dom_sid owner_sid, group_sid;
+       size_t size = 0;
+       struct security_ace aces[4];
+       uint32_t access_mask = 0;
+       mode_t mode = psbuf->st_ex_mode;
+       struct security_acl *new_dacl = NULL;
+       int idx = 0;
+
+       DEBUG(10,("make_default_filesystem_acl: file %s mode = 0%o\n",
+               name, (int)mode ));
+
+       uid_to_sid(&owner_sid, psbuf->st_ex_uid);
+       gid_to_sid(&group_sid, psbuf->st_ex_gid);
+
+       /*
+        We provide up to 4 ACEs
+               - Owner
+               - Group
+               - Everyone
+               - NT System
+       */
+
+       if (mode & S_IRUSR) {
+               if (mode & S_IWUSR) {
+                       access_mask |= SEC_RIGHTS_FILE_ALL;
+               } else {
+                       access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
+               }
+       }
+       if (mode & S_IWUSR) {
+               access_mask |= SEC_RIGHTS_FILE_WRITE | SEC_STD_DELETE;
+       }
+
+       init_sec_ace(&aces[idx],
+                       &owner_sid,
+                       SEC_ACE_TYPE_ACCESS_ALLOWED,
+                       access_mask,
+                       0);
+       idx++;
+
+       access_mask = 0;
+       if (mode & S_IRGRP) {
+               access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
+       }
+       if (mode & S_IWGRP) {
+               /* note that delete is not granted - this matches posix behaviour */
+               access_mask |= SEC_RIGHTS_FILE_WRITE;
+       }
+       if (access_mask) {
+               init_sec_ace(&aces[idx],
+                       &group_sid,
+                       SEC_ACE_TYPE_ACCESS_ALLOWED,
+                       access_mask,
+                       0);
+               idx++;
+       }
+
+       access_mask = 0;
+       if (mode & S_IROTH) {
+               access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
+       }
+       if (mode & S_IWOTH) {
+               access_mask |= SEC_RIGHTS_FILE_WRITE;
+       }
+       if (access_mask) {
+               init_sec_ace(&aces[idx],
+                       &global_sid_World,
+                       SEC_ACE_TYPE_ACCESS_ALLOWED,
+                       access_mask,
+                       0);
+               idx++;
+       }
+
+       init_sec_ace(&aces[idx],
+                       &global_sid_System,
+                       SEC_ACE_TYPE_ACCESS_ALLOWED,
+                       SEC_RIGHTS_FILE_ALL,
+                       0);
+       idx++;
+
+       new_dacl = make_sec_acl(ctx,
+                       NT4_ACL_REVISION,
+                       idx,
+                       aces);
+
+       if (!new_dacl) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       *ppdesc = make_sec_desc(ctx,
+                       SECURITY_DESCRIPTOR_REVISION_1,
+                       SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT,
+                       &owner_sid,
+                       &group_sid,
+                       NULL,
+                       new_dacl,
+                       &size);
+       if (!*ppdesc) {
+               return NT_STATUS_NO_MEMORY;
+       }
+       return NT_STATUS_OK;
+}
+
 /*******************************************************************
  Pull a DATA_BLOB from an xattr given a pathname.
  If the hash doesn't match, or doesn't exist - return the underlying

diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index 80d4feaec42091d59fc6ced273de6ef20cbbe6f8..8770fdbb40adf6bec75cea2d84c894e53f572008 100644 (file)
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -4662,116 +4662,6 @@ NTSTATUS get_nt_acl_no_snum(TALLOC_CTX *ctx, const char *fname,
        return status;
 }
 
-/* Stolen shamelessly from pvfs_default_acl() in source4 :-). */
-
-NTSTATUS make_default_filesystem_acl(TALLOC_CTX *ctx,
-                                       const char *name,
-                                       SMB_STRUCT_STAT *psbuf,
-                                       struct security_descriptor **ppdesc)
-{
-       struct dom_sid owner_sid, group_sid;
-       size_t size = 0;
-       struct security_ace aces[4];
-       uint32_t access_mask = 0;
-       mode_t mode = psbuf->st_ex_mode;
-       struct security_acl *new_dacl = NULL;
-       int idx = 0;
-
-       DEBUG(10,("make_default_filesystem_acl: file %s mode = 0%o\n",
-               name, (int)mode ));
-
-       uid_to_sid(&owner_sid, psbuf->st_ex_uid);
-       gid_to_sid(&group_sid, psbuf->st_ex_gid);
-
-       /*
-        We provide up to 4 ACEs
-               - Owner
-               - Group
-               - Everyone
-               - NT System
-       */
-
-       if (mode & S_IRUSR) {
-               if (mode & S_IWUSR) {
-                       access_mask |= SEC_RIGHTS_FILE_ALL;
-               } else {
-                       access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
-               }
-       }
-       if (mode & S_IWUSR) {
-               access_mask |= SEC_RIGHTS_FILE_WRITE | SEC_STD_DELETE;
-       }
-
-       init_sec_ace(&aces[idx],
-                       &owner_sid,
-                       SEC_ACE_TYPE_ACCESS_ALLOWED,
-                       access_mask,
-                       0);
-       idx++;
-
-       access_mask = 0;
-       if (mode & S_IRGRP) {
-               access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
-       }
-       if (mode & S_IWGRP) {
-               /* note that delete is not granted - this matches posix behaviour */
-               access_mask |= SEC_RIGHTS_FILE_WRITE;
-       }
-       if (access_mask) {
-               init_sec_ace(&aces[idx],
-                       &group_sid,
-                       SEC_ACE_TYPE_ACCESS_ALLOWED,
-                       access_mask,
-                       0);
-               idx++;
-       }
-
-       access_mask = 0;
-       if (mode & S_IROTH) {
-               access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
-       }
-       if (mode & S_IWOTH) {
-               access_mask |= SEC_RIGHTS_FILE_WRITE;
-       }
-       if (access_mask) {
-               init_sec_ace(&aces[idx],
-                       &global_sid_World,
-                       SEC_ACE_TYPE_ACCESS_ALLOWED,
-                       access_mask,
-                       0);
-               idx++;
-       }
-
-       init_sec_ace(&aces[idx],
-                       &global_sid_System,
-                       SEC_ACE_TYPE_ACCESS_ALLOWED,
-                       SEC_RIGHTS_FILE_ALL,
-                       0);
-       idx++;
-
-       new_dacl = make_sec_acl(ctx,
-                       NT4_ACL_REVISION,
-                       idx,
-                       aces);
-
-       if (!new_dacl) {
-               return NT_STATUS_NO_MEMORY;
-       }
-
-       *ppdesc = make_sec_desc(ctx,
-                       SECURITY_DESCRIPTOR_REVISION_1,
-                       SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT,
-                       &owner_sid,
-                       &group_sid,
-                       NULL,
-                       new_dacl,
-                       &size);
-       if (!*ppdesc) {
-               return NT_STATUS_NO_MEMORY;
-       }
-       return NT_STATUS_OK;
-}
-
 int posix_sys_acl_blob_get_file(vfs_handle_struct *handle,
                                const char *path_p,
                                TALLOC_CTX *mem_ctx,

diff --git a/source3/smbd/proto.h b/source3/smbd/proto.h
index 92224611f13e997c7ef7ce4985a7f56b3e8ffc78..08cdba991a60de5361c970f973739ef9f5d8b7f4 100644 (file)
--- a/source3/smbd/proto.h
+++ b/source3/smbd/proto.h
@@ -762,10 +762,6 @@ bool set_unix_posix_acl(connection_struct *conn, files_struct *fsp, const char *
 NTSTATUS get_nt_acl_no_snum( TALLOC_CTX *ctx, const char *fname,
                             uint32_t security_info_wanted,
                             struct security_descriptor **sd);
-NTSTATUS make_default_filesystem_acl(TALLOC_CTX *ctx,
-                                       const char *name,
-                                       SMB_STRUCT_STAT *psbuf,
-                                       struct security_descriptor **ppdesc);
 int posix_sys_acl_blob_get_file(vfs_handle_struct *handle,
                                const char *path_p,
                                TALLOC_CTX *mem_ctx,