From 33c0b0df01e21c9e031bfe79986e1cfdb993ef6f Mon Sep 17 00:00:00 2001 From: Ralph Boehme Date: Thu, 28 Sep 2017 07:53:48 +0200 Subject: [PATCH] s3/smbd: make make_default_filesystem_acl public This will be used by another VFS module in a subsequent commit. Signed-off-by: Ralph Boehme Reviewed-by: Jeremy Allison --- source3/modules/vfs_acl_common.c | 216 +------------------------------ source3/modules/vfs_acl_common.h | 2 +- source3/smbd/posix_acls.c | 216 +++++++++++++++++++++++++++++++ source3/smbd/proto.h | 11 ++ 4 files changed, 232 insertions(+), 213 deletions(-) diff --git a/source3/modules/vfs_acl_common.c b/source3/modules/vfs_acl_common.c index 5e63b580378..546e97b9b5d 100644 --- a/source3/modules/vfs_acl_common.c +++ b/source3/modules/vfs_acl_common.c @@ -41,15 +41,13 @@ static NTSTATUS create_acl_blob(const struct security_descriptor *psd, SECINFO_DACL | \ SECINFO_SACL) -static const struct enum_list default_acl_style[] = { - {DEFAULT_ACL_POSIX, "posix"}, - {DEFAULT_ACL_WINDOWS, "windows"} -}; - bool init_acl_common_config(vfs_handle_struct *handle, const char *module_name) { struct acl_common_config *config = NULL; + const struct enum_list *default_acl_style_list = NULL; + + default_acl_style_list = get_default_acl_style_list(); config = talloc_zero(handle->conn, struct acl_common_config); if (config == NULL) { @@ -65,7 +63,7 @@ bool init_acl_common_config(vfs_handle_struct *handle, config->default_acl_style = lp_parm_enum(SNUM(handle->conn), module_name, "default acl style", - default_acl_style, + default_acl_style_list, DEFAULT_ACL_POSIX); SMB_VFS_HANDLE_SET_DATA(handle, config, NULL, @@ -386,212 +384,6 @@ static NTSTATUS add_directory_inheritable_components(vfs_handle_struct *handle, return NT_STATUS_OK; } -static NTSTATUS make_default_acl_posix(TALLOC_CTX *ctx, - const char *name, - SMB_STRUCT_STAT *psbuf, - struct security_descriptor **ppdesc) -{ - struct dom_sid owner_sid, group_sid; - size_t size = 0; - struct security_ace aces[4]; - uint32_t access_mask = 0; - mode_t mode = psbuf->st_ex_mode; - struct security_acl *new_dacl = NULL; - int idx = 0; - - DBG_DEBUG("file %s mode = 0%o\n",name, (int)mode); - - uid_to_sid(&owner_sid, psbuf->st_ex_uid); - gid_to_sid(&group_sid, psbuf->st_ex_gid); - - /* - We provide up to 4 ACEs - - Owner - - Group - - Everyone - - NT System - */ - - if (mode & S_IRUSR) { - if (mode & S_IWUSR) { - access_mask |= SEC_RIGHTS_FILE_ALL; - } else { - access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE; - } - } - if (mode & S_IWUSR) { - access_mask |= SEC_RIGHTS_FILE_WRITE | SEC_STD_DELETE; - } - - init_sec_ace(&aces[idx], - &owner_sid, - SEC_ACE_TYPE_ACCESS_ALLOWED, - access_mask, - 0); - idx++; - - access_mask = 0; - if (mode & S_IRGRP) { - access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE; - } - if (mode & S_IWGRP) { - /* note that delete is not granted - this matches posix behaviour */ - access_mask |= SEC_RIGHTS_FILE_WRITE; - } - if (access_mask) { - init_sec_ace(&aces[idx], - &group_sid, - SEC_ACE_TYPE_ACCESS_ALLOWED, - access_mask, - 0); - idx++; - } - - access_mask = 0; - if (mode & S_IROTH) { - access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE; - } - if (mode & S_IWOTH) { - access_mask |= SEC_RIGHTS_FILE_WRITE; - } - if (access_mask) { - init_sec_ace(&aces[idx], - &global_sid_World, - SEC_ACE_TYPE_ACCESS_ALLOWED, - access_mask, - 0); - idx++; - } - - init_sec_ace(&aces[idx], - &global_sid_System, - SEC_ACE_TYPE_ACCESS_ALLOWED, - SEC_RIGHTS_FILE_ALL, - 0); - idx++; - - new_dacl = make_sec_acl(ctx, - NT4_ACL_REVISION, - idx, - aces); - - if (!new_dacl) { - return NT_STATUS_NO_MEMORY; - } - - *ppdesc = make_sec_desc(ctx, - SECURITY_DESCRIPTOR_REVISION_1, - SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT, - &owner_sid, - &group_sid, - NULL, - new_dacl, - &size); - if (!*ppdesc) { - return NT_STATUS_NO_MEMORY; - } - return NT_STATUS_OK; -} - -static NTSTATUS make_default_acl_windows(TALLOC_CTX *ctx, - const char *name, - SMB_STRUCT_STAT *psbuf, - struct security_descriptor **ppdesc) -{ - struct dom_sid owner_sid, group_sid; - size_t size = 0; - struct security_ace aces[4]; - uint32_t access_mask = 0; - mode_t mode = psbuf->st_ex_mode; - struct security_acl *new_dacl = NULL; - int idx = 0; - - DBG_DEBUG("file [%s] mode [0%o]\n", name, (int)mode); - - uid_to_sid(&owner_sid, psbuf->st_ex_uid); - gid_to_sid(&group_sid, psbuf->st_ex_gid); - - /* - * We provide 2 ACEs: - * - Owner - * - NT System - */ - - if (mode & S_IRUSR) { - if (mode & S_IWUSR) { - access_mask |= SEC_RIGHTS_FILE_ALL; - } else { - access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE; - } - } - if (mode & S_IWUSR) { - access_mask |= SEC_RIGHTS_FILE_WRITE | SEC_STD_DELETE; - } - - init_sec_ace(&aces[idx], - &owner_sid, - SEC_ACE_TYPE_ACCESS_ALLOWED, - access_mask, - 0); - idx++; - - init_sec_ace(&aces[idx], - &global_sid_System, - SEC_ACE_TYPE_ACCESS_ALLOWED, - SEC_RIGHTS_FILE_ALL, - 0); - idx++; - - new_dacl = make_sec_acl(ctx, - NT4_ACL_REVISION, - idx, - aces); - - if (!new_dacl) { - return NT_STATUS_NO_MEMORY; - } - - *ppdesc = make_sec_desc(ctx, - SECURITY_DESCRIPTOR_REVISION_1, - SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT, - &owner_sid, - &group_sid, - NULL, - new_dacl, - &size); - if (!*ppdesc) { - return NT_STATUS_NO_MEMORY; - } - return NT_STATUS_OK; -} - -static NTSTATUS make_default_filesystem_acl( - TALLOC_CTX *ctx, - enum default_acl_style acl_style, - const char *name, - SMB_STRUCT_STAT *psbuf, - struct security_descriptor **ppdesc) -{ - NTSTATUS status; - - switch (acl_style) { - case DEFAULT_ACL_POSIX: - status = make_default_acl_posix(ctx, name, psbuf, ppdesc); - break; - - case DEFAULT_ACL_WINDOWS: - status = make_default_acl_windows(ctx, name, psbuf, ppdesc); - break; - - default: - DBG_ERR("unknown acl style %d", acl_style); - status = NT_STATUS_INTERNAL_ERROR; - break; - } - - return status; -} - /** * Validate an ACL blob * diff --git a/source3/modules/vfs_acl_common.h b/source3/modules/vfs_acl_common.h index c52fc5094c5..24803e0215e 100644 --- a/source3/modules/vfs_acl_common.h +++ b/source3/modules/vfs_acl_common.h @@ -22,7 +22,7 @@ #ifndef __VFS_ACL_COMMON_H__ #define __VFS_ACL_COMMON_H__ -enum default_acl_style {DEFAULT_ACL_POSIX, DEFAULT_ACL_WINDOWS}; +#include "smbd/proto.h" struct acl_common_config { bool ignore_system_acls; diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c index 7bd65390406..7337c5e8ecb 100644 --- a/source3/smbd/posix_acls.c +++ b/source3/smbd/posix_acls.c @@ -4857,3 +4857,219 @@ int posix_sys_acl_blob_get_fd(vfs_handle_struct *handle, TALLOC_FREE(frame); return 0; } + +static NTSTATUS make_default_acl_posix(TALLOC_CTX *ctx, + const char *name, + SMB_STRUCT_STAT *psbuf, + struct security_descriptor **ppdesc) +{ + struct dom_sid owner_sid, group_sid; + size_t size = 0; + struct security_ace aces[4]; + uint32_t access_mask = 0; + mode_t mode = psbuf->st_ex_mode; + struct security_acl *new_dacl = NULL; + int idx = 0; + + DBG_DEBUG("file %s mode = 0%o\n",name, (int)mode); + + uid_to_sid(&owner_sid, psbuf->st_ex_uid); + gid_to_sid(&group_sid, psbuf->st_ex_gid); + + /* + We provide up to 4 ACEs + - Owner + - Group + - Everyone + - NT System + */ + + if (mode & S_IRUSR) { + if (mode & S_IWUSR) { + access_mask |= SEC_RIGHTS_FILE_ALL; + } else { + access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE; + } + } + if (mode & S_IWUSR) { + access_mask |= SEC_RIGHTS_FILE_WRITE | SEC_STD_DELETE; + } + + init_sec_ace(&aces[idx], + &owner_sid, + SEC_ACE_TYPE_ACCESS_ALLOWED, + access_mask, + 0); + idx++; + + access_mask = 0; + if (mode & S_IRGRP) { + access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE; + } + if (mode & S_IWGRP) { + /* note that delete is not granted - this matches posix behaviour */ + access_mask |= SEC_RIGHTS_FILE_WRITE; + } + if (access_mask) { + init_sec_ace(&aces[idx], + &group_sid, + SEC_ACE_TYPE_ACCESS_ALLOWED, + access_mask, + 0); + idx++; + } + + access_mask = 0; + if (mode & S_IROTH) { + access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE; + } + if (mode & S_IWOTH) { + access_mask |= SEC_RIGHTS_FILE_WRITE; + } + if (access_mask) { + init_sec_ace(&aces[idx], + &global_sid_World, + SEC_ACE_TYPE_ACCESS_ALLOWED, + access_mask, + 0); + idx++; + } + + init_sec_ace(&aces[idx], + &global_sid_System, + SEC_ACE_TYPE_ACCESS_ALLOWED, + SEC_RIGHTS_FILE_ALL, + 0); + idx++; + + new_dacl = make_sec_acl(ctx, + NT4_ACL_REVISION, + idx, + aces); + + if (!new_dacl) { + return NT_STATUS_NO_MEMORY; + } + + *ppdesc = make_sec_desc(ctx, + SECURITY_DESCRIPTOR_REVISION_1, + SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT, + &owner_sid, + &group_sid, + NULL, + new_dacl, + &size); + if (!*ppdesc) { + return NT_STATUS_NO_MEMORY; + } + return NT_STATUS_OK; +} + +static NTSTATUS make_default_acl_windows(TALLOC_CTX *ctx, + const char *name, + SMB_STRUCT_STAT *psbuf, + struct security_descriptor **ppdesc) +{ + struct dom_sid owner_sid, group_sid; + size_t size = 0; + struct security_ace aces[4]; + uint32_t access_mask = 0; + mode_t mode = psbuf->st_ex_mode; + struct security_acl *new_dacl = NULL; + int idx = 0; + + DBG_DEBUG("file [%s] mode [0%o]\n", name, (int)mode); + + uid_to_sid(&owner_sid, psbuf->st_ex_uid); + gid_to_sid(&group_sid, psbuf->st_ex_gid); + + /* + * We provide 2 ACEs: + * - Owner + * - NT System + */ + + if (mode & S_IRUSR) { + if (mode & S_IWUSR) { + access_mask |= SEC_RIGHTS_FILE_ALL; + } else { + access_mask |= SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE; + } + } + if (mode & S_IWUSR) { + access_mask |= SEC_RIGHTS_FILE_WRITE | SEC_STD_DELETE; + } + + init_sec_ace(&aces[idx], + &owner_sid, + SEC_ACE_TYPE_ACCESS_ALLOWED, + access_mask, + 0); + idx++; + + init_sec_ace(&aces[idx], + &global_sid_System, + SEC_ACE_TYPE_ACCESS_ALLOWED, + SEC_RIGHTS_FILE_ALL, + 0); + idx++; + + new_dacl = make_sec_acl(ctx, + NT4_ACL_REVISION, + idx, + aces); + + if (!new_dacl) { + return NT_STATUS_NO_MEMORY; + } + + *ppdesc = make_sec_desc(ctx, + SECURITY_DESCRIPTOR_REVISION_1, + SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT, + &owner_sid, + &group_sid, + NULL, + new_dacl, + &size); + if (!*ppdesc) { + return NT_STATUS_NO_MEMORY; + } + return NT_STATUS_OK; +} + +static const struct enum_list default_acl_style_list[] = { + {DEFAULT_ACL_POSIX, "posix"}, + {DEFAULT_ACL_WINDOWS, "windows"} +}; + +const struct enum_list *get_default_acl_style_list(void) +{ + return default_acl_style_list; +} + +NTSTATUS make_default_filesystem_acl( + TALLOC_CTX *ctx, + enum default_acl_style acl_style, + const char *name, + SMB_STRUCT_STAT *psbuf, + struct security_descriptor **ppdesc) +{ + NTSTATUS status; + + switch (acl_style) { + case DEFAULT_ACL_POSIX: + status = make_default_acl_posix(ctx, name, psbuf, ppdesc); + break; + + case DEFAULT_ACL_WINDOWS: + status = make_default_acl_windows(ctx, name, psbuf, ppdesc); + break; + + default: + DBG_ERR("unknown acl style %d", acl_style); + status = NT_STATUS_INTERNAL_ERROR; + break; + } + + return status; +} diff --git a/source3/smbd/proto.h b/source3/smbd/proto.h index a688341c64d..2e40711df41 100644 --- a/source3/smbd/proto.h +++ b/source3/smbd/proto.h @@ -806,6 +806,17 @@ int posix_sys_acl_blob_get_fd(vfs_handle_struct *handle, char **blob_description, DATA_BLOB *blob); +enum default_acl_style {DEFAULT_ACL_POSIX, DEFAULT_ACL_WINDOWS}; + +const struct enum_list *get_default_acl_style_list(void); + +NTSTATUS make_default_filesystem_acl( + TALLOC_CTX *ctx, + enum default_acl_style acl_style, + const char *name, + SMB_STRUCT_STAT *psbuf, + struct security_descriptor **ppdesc); + /* The following definitions come from smbd/process.c */ void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn); -- 2.47.3