s3/smbd: make make_default_filesystem_acl public

This will be used by another VFS module in a subsequent commit.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

diff --git a/source3/modules/vfs_acl_common.c b/source3/modules/vfs_acl_common.c
index 5e63b5803786a4c519c5c11e7fbb71c979db3254..546e97b9b5d5dde6a0787524318ad3733ac4837e 100644 (file)
--- a/source3/modules/vfs_acl_common.c
+++ b/source3/modules/vfs_acl_common.c
@@ -41,15 +41,13 @@ static NTSTATUS create_acl_blob(const struct security_descriptor *psd,
                                SECINFO_DACL | \
                                SECINFO_SACL)
 
-static const struct enum_list default_acl_style[] = {
-       {DEFAULT_ACL_POSIX,     "posix"},
-       {DEFAULT_ACL_WINDOWS,   "windows"}
-};
-
 bool init_acl_common_config(vfs_handle_struct *handle,
                            const char *module_name)
 {
        struct acl_common_config *config = NULL;
+       const struct enum_list *default_acl_style_list = NULL;
+
+       default_acl_style_list = get_default_acl_style_list();
 
        config = talloc_zero(handle->conn, struct acl_common_config);
        if (config == NULL) {
@@ -65,7 +63,7 @@ bool init_acl_common_config(vfs_handle_struct *handle,
        config->default_acl_style = lp_parm_enum(SNUM(handle->conn),
                                                 module_name,
                                                 "default acl style",
-                                                default_acl_style,
+                                                default_acl_style_list,
                                                 DEFAULT_ACL_POSIX);
 
        SMB_VFS_HANDLE_SET_DATA(handle, config, NULL,
@@ -386,212 +384,6 @@ static NTSTATUS add_directory_inheritable_components(vfs_handle_struct *handle,
        return NT_STATUS_OK;
 }
 
-static NTSTATUS make_default_acl_posix(TALLOC_CTX *ctx,
-                                      const char *name,
-                                      SMB_STRUCT_STAT *psbuf,
-                                      struct security_descriptor **ppdesc)
-{
-       struct dom_sid owner_sid, group_sid;
-       size_t size = 0;
-       struct security_ace aces[4];
-       uint32_t access_mask = 0;
-       mode_t mode = psbuf->st_ex_mode;
-       struct security_acl *new_dacl = NULL;
-       int idx = 0;
-
-       DBG_DEBUG("file %s mode = 0%o\n",name, (int)mode);
-
-       uid_to_sid(&owner_sid, psbuf->st_ex_uid);
-       gid_to_sid(&group_sid, psbuf->st_ex_gid);
-
-       /*
-        We provide up to 4 ACEs
-               - Owner
-               - Group
-               - Everyone
-               - NT System
-       */
-
-       if (mode & S_IRUSR) {
-               if (mode & S_IWUSR) {
-                       access_mask |= SEC_RIGHTS_FILE_ALL;
-               } else {
-                       access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
-               }
-       }
-       if (mode & S_IWUSR) {
-               access_mask |= SEC_RIGHTS_FILE_WRITE | SEC_STD_DELETE;
-       }
-
-       init_sec_ace(&aces[idx],
-                       &owner_sid,
-                       SEC_ACE_TYPE_ACCESS_ALLOWED,
-                       access_mask,
-                       0);
-       idx++;
-
-       access_mask = 0;
-       if (mode & S_IRGRP) {
-               access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
-       }
-       if (mode & S_IWGRP) {
-               /* note that delete is not granted - this matches posix behaviour */
-               access_mask |= SEC_RIGHTS_FILE_WRITE;
-       }
-       if (access_mask) {
-               init_sec_ace(&aces[idx],
-                       &group_sid,
-                       SEC_ACE_TYPE_ACCESS_ALLOWED,
-                       access_mask,
-                       0);
-               idx++;
-       }
-
-       access_mask = 0;
-       if (mode & S_IROTH) {
-               access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
-       }
-       if (mode & S_IWOTH) {
-               access_mask |= SEC_RIGHTS_FILE_WRITE;
-       }
-       if (access_mask) {
-               init_sec_ace(&aces[idx],
-                       &global_sid_World,
-                       SEC_ACE_TYPE_ACCESS_ALLOWED,
-                       access_mask,
-                       0);
-               idx++;
-       }
-
-       init_sec_ace(&aces[idx],
-                       &global_sid_System,
-                       SEC_ACE_TYPE_ACCESS_ALLOWED,
-                       SEC_RIGHTS_FILE_ALL,
-                       0);
-       idx++;
-
-       new_dacl = make_sec_acl(ctx,
-                       NT4_ACL_REVISION,
-                       idx,
-                       aces);
-
-       if (!new_dacl) {
-               return NT_STATUS_NO_MEMORY;
-       }
-
-       *ppdesc = make_sec_desc(ctx,
-                       SECURITY_DESCRIPTOR_REVISION_1,
-                       SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT,
-                       &owner_sid,
-                       &group_sid,
-                       NULL,
-                       new_dacl,
-                       &size);
-       if (!*ppdesc) {
-               return NT_STATUS_NO_MEMORY;
-       }
-       return NT_STATUS_OK;
-}
-
-static NTSTATUS make_default_acl_windows(TALLOC_CTX *ctx,
-                                        const char *name,
-                                        SMB_STRUCT_STAT *psbuf,
-                                        struct security_descriptor **ppdesc)
-{
-       struct dom_sid owner_sid, group_sid;
-       size_t size = 0;
-       struct security_ace aces[4];
-       uint32_t access_mask = 0;
-       mode_t mode = psbuf->st_ex_mode;
-       struct security_acl *new_dacl = NULL;
-       int idx = 0;
-
-       DBG_DEBUG("file [%s] mode [0%o]\n", name, (int)mode);
-
-       uid_to_sid(&owner_sid, psbuf->st_ex_uid);
-       gid_to_sid(&group_sid, psbuf->st_ex_gid);
-
-       /*
-        * We provide 2 ACEs:
-        * - Owner
-        * - NT System
-        */
-
-       if (mode & S_IRUSR) {
-               if (mode & S_IWUSR) {
-                       access_mask |= SEC_RIGHTS_FILE_ALL;
-               } else {
-                       access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
-               }
-       }
-       if (mode & S_IWUSR) {
-               access_mask |= SEC_RIGHTS_FILE_WRITE | SEC_STD_DELETE;
-       }
-
-       init_sec_ace(&aces[idx],
-                    &owner_sid,
-                    SEC_ACE_TYPE_ACCESS_ALLOWED,
-                    access_mask,
-                    0);
-       idx++;
-
-       init_sec_ace(&aces[idx],
-                    &global_sid_System,
-                    SEC_ACE_TYPE_ACCESS_ALLOWED,
-                    SEC_RIGHTS_FILE_ALL,
-                    0);
-       idx++;
-
-       new_dacl = make_sec_acl(ctx,
-                               NT4_ACL_REVISION,
-                               idx,
-                               aces);
-
-       if (!new_dacl) {
-               return NT_STATUS_NO_MEMORY;
-       }
-
-       *ppdesc = make_sec_desc(ctx,
-                               SECURITY_DESCRIPTOR_REVISION_1,
-                               SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT,
-                               &owner_sid,
-                               &group_sid,
-                               NULL,
-                               new_dacl,
-                               &size);
-       if (!*ppdesc) {
-               return NT_STATUS_NO_MEMORY;
-       }
-       return NT_STATUS_OK;
-}
-
-static NTSTATUS make_default_filesystem_acl(
-       TALLOC_CTX *ctx,
-       enum default_acl_style acl_style,
-       const char *name,
-       SMB_STRUCT_STAT *psbuf,
-       struct security_descriptor **ppdesc)
-{
-       NTSTATUS status;
-
-       switch (acl_style) {
-       case DEFAULT_ACL_POSIX:
-               status =  make_default_acl_posix(ctx, name, psbuf, ppdesc);
-               break;
-
-       case DEFAULT_ACL_WINDOWS:
-               status =  make_default_acl_windows(ctx, name, psbuf, ppdesc);
-               break;
-
-       default:
-               DBG_ERR("unknown acl style %d", acl_style);
-               status = NT_STATUS_INTERNAL_ERROR;
-               break;
-       }
-
-       return status;
-}
-
 /**
  * Validate an ACL blob
  *

diff --git a/source3/modules/vfs_acl_common.h b/source3/modules/vfs_acl_common.h
index c52fc5094c562f0da6a2646590eb5547c089cb4b..24803e0215e82cbe8b81091fe24579ce3126eb88 100644 (file)
--- a/source3/modules/vfs_acl_common.h
+++ b/source3/modules/vfs_acl_common.h
@@ -22,7 +22,7 @@
 #ifndef __VFS_ACL_COMMON_H__
 #define __VFS_ACL_COMMON_H__
 
-enum default_acl_style {DEFAULT_ACL_POSIX, DEFAULT_ACL_WINDOWS};
+#include "smbd/proto.h"
 
 struct acl_common_config {
        bool ignore_system_acls;

diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index 7bd653904065771061692dc41c34c02674c176b2..7337c5e8ecb31a210b327a9286219dcf32bf6f3c 100644 (file)
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -4857,3 +4857,219 @@ int posix_sys_acl_blob_get_fd(vfs_handle_struct *handle,
        TALLOC_FREE(frame);
        return 0;
 }
+
+static NTSTATUS make_default_acl_posix(TALLOC_CTX *ctx,
+                                      const char *name,
+                                      SMB_STRUCT_STAT *psbuf,
+                                      struct security_descriptor **ppdesc)
+{
+       struct dom_sid owner_sid, group_sid;
+       size_t size = 0;
+       struct security_ace aces[4];
+       uint32_t access_mask = 0;
+       mode_t mode = psbuf->st_ex_mode;
+       struct security_acl *new_dacl = NULL;
+       int idx = 0;
+
+       DBG_DEBUG("file %s mode = 0%o\n",name, (int)mode);
+
+       uid_to_sid(&owner_sid, psbuf->st_ex_uid);
+       gid_to_sid(&group_sid, psbuf->st_ex_gid);
+
+       /*
+        We provide up to 4 ACEs
+               - Owner
+               - Group
+               - Everyone
+               - NT System
+       */
+
+       if (mode & S_IRUSR) {
+               if (mode & S_IWUSR) {
+                       access_mask |= SEC_RIGHTS_FILE_ALL;
+               } else {
+                       access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
+               }
+       }
+       if (mode & S_IWUSR) {
+               access_mask |= SEC_RIGHTS_FILE_WRITE | SEC_STD_DELETE;
+       }
+
+       init_sec_ace(&aces[idx],
+                       &owner_sid,
+                       SEC_ACE_TYPE_ACCESS_ALLOWED,
+                       access_mask,
+                       0);
+       idx++;
+
+       access_mask = 0;
+       if (mode & S_IRGRP) {
+               access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
+       }
+       if (mode & S_IWGRP) {
+               /* note that delete is not granted - this matches posix behaviour */
+               access_mask |= SEC_RIGHTS_FILE_WRITE;
+       }
+       if (access_mask) {
+               init_sec_ace(&aces[idx],
+                       &group_sid,
+                       SEC_ACE_TYPE_ACCESS_ALLOWED,
+                       access_mask,
+                       0);
+               idx++;
+       }
+
+       access_mask = 0;
+       if (mode & S_IROTH) {
+               access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
+       }
+       if (mode & S_IWOTH) {
+               access_mask |= SEC_RIGHTS_FILE_WRITE;
+       }
+       if (access_mask) {
+               init_sec_ace(&aces[idx],
+                       &global_sid_World,
+                       SEC_ACE_TYPE_ACCESS_ALLOWED,
+                       access_mask,
+                       0);
+               idx++;
+       }
+
+       init_sec_ace(&aces[idx],
+                       &global_sid_System,
+                       SEC_ACE_TYPE_ACCESS_ALLOWED,
+                       SEC_RIGHTS_FILE_ALL,
+                       0);
+       idx++;
+
+       new_dacl = make_sec_acl(ctx,
+                       NT4_ACL_REVISION,
+                       idx,
+                       aces);
+
+       if (!new_dacl) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       *ppdesc = make_sec_desc(ctx,
+                       SECURITY_DESCRIPTOR_REVISION_1,
+                       SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT,
+                       &owner_sid,
+                       &group_sid,
+                       NULL,
+                       new_dacl,
+                       &size);
+       if (!*ppdesc) {
+               return NT_STATUS_NO_MEMORY;
+       }
+       return NT_STATUS_OK;
+}
+
+static NTSTATUS make_default_acl_windows(TALLOC_CTX *ctx,
+                                        const char *name,
+                                        SMB_STRUCT_STAT *psbuf,
+                                        struct security_descriptor **ppdesc)
+{
+       struct dom_sid owner_sid, group_sid;
+       size_t size = 0;
+       struct security_ace aces[4];
+       uint32_t access_mask = 0;
+       mode_t mode = psbuf->st_ex_mode;
+       struct security_acl *new_dacl = NULL;
+       int idx = 0;
+
+       DBG_DEBUG("file [%s] mode [0%o]\n", name, (int)mode);
+
+       uid_to_sid(&owner_sid, psbuf->st_ex_uid);
+       gid_to_sid(&group_sid, psbuf->st_ex_gid);
+
+       /*
+        * We provide 2 ACEs:
+        * - Owner
+        * - NT System
+        */
+
+       if (mode & S_IRUSR) {
+               if (mode & S_IWUSR) {
+                       access_mask |= SEC_RIGHTS_FILE_ALL;
+               } else {
+                       access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE;
+               }
+       }
+       if (mode & S_IWUSR) {
+               access_mask |= SEC_RIGHTS_FILE_WRITE | SEC_STD_DELETE;
+       }
+
+       init_sec_ace(&aces[idx],
+                    &owner_sid,
+                    SEC_ACE_TYPE_ACCESS_ALLOWED,
+                    access_mask,
+                    0);
+       idx++;
+
+       init_sec_ace(&aces[idx],
+                    &global_sid_System,
+                    SEC_ACE_TYPE_ACCESS_ALLOWED,
+                    SEC_RIGHTS_FILE_ALL,
+                    0);
+       idx++;
+
+       new_dacl = make_sec_acl(ctx,
+                               NT4_ACL_REVISION,
+                               idx,
+                               aces);
+
+       if (!new_dacl) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       *ppdesc = make_sec_desc(ctx,
+                               SECURITY_DESCRIPTOR_REVISION_1,
+                               SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT,
+                               &owner_sid,
+                               &group_sid,
+                               NULL,
+                               new_dacl,
+                               &size);
+       if (!*ppdesc) {
+               return NT_STATUS_NO_MEMORY;
+       }
+       return NT_STATUS_OK;
+}
+
+static const struct enum_list default_acl_style_list[] = {
+       {DEFAULT_ACL_POSIX,     "posix"},
+       {DEFAULT_ACL_WINDOWS,   "windows"}
+};
+
+const struct enum_list *get_default_acl_style_list(void)
+{
+       return default_acl_style_list;
+}
+
+NTSTATUS make_default_filesystem_acl(
+       TALLOC_CTX *ctx,
+       enum default_acl_style acl_style,
+       const char *name,
+       SMB_STRUCT_STAT *psbuf,
+       struct security_descriptor **ppdesc)
+{
+       NTSTATUS status;
+
+       switch (acl_style) {
+       case DEFAULT_ACL_POSIX:
+               status =  make_default_acl_posix(ctx, name, psbuf, ppdesc);
+               break;
+
+       case DEFAULT_ACL_WINDOWS:
+               status =  make_default_acl_windows(ctx, name, psbuf, ppdesc);
+               break;
+
+       default:
+               DBG_ERR("unknown acl style %d", acl_style);
+               status = NT_STATUS_INTERNAL_ERROR;
+               break;
+       }
+
+       return status;
+}

diff --git a/source3/smbd/proto.h b/source3/smbd/proto.h
index a688341c64dd37c8a054114c370913e12c115054..2e40711df41e3ce7ced8dc9ccf3c442bf3d82ce6 100644 (file)
--- a/source3/smbd/proto.h
+++ b/source3/smbd/proto.h
@@ -806,6 +806,17 @@ int posix_sys_acl_blob_get_fd(vfs_handle_struct *handle,
                              char **blob_description,
                              DATA_BLOB *blob);
 
+enum default_acl_style {DEFAULT_ACL_POSIX, DEFAULT_ACL_WINDOWS};
+
+const struct enum_list *get_default_acl_style_list(void);
+
+NTSTATUS make_default_filesystem_acl(
+       TALLOC_CTX *ctx,
+       enum default_acl_style acl_style,
+       const char *name,
+       SMB_STRUCT_STAT *psbuf,
+       struct security_descriptor **ppdesc);
+
 /* The following definitions come from smbd/process.c  */
 
 void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn);