1/*
2 *
3 * Copyright (c) 2007-2008 Jean-Pierre Andre
4 *
5 */
6
7/*
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program (in the main directory of the NTFS-3G
20 * distribution in the file COPYING); if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
22 */
23
24#ifndef ACLS_H
25#define ACLS_H
26
27#include "endians.h"
28
29/*
30 *	JPA configuration modes for security.c / acls.c
31 *	should be moved to some config file
32 */
33
34#define BUFSZ 1024		/* buffer size to read mapping file */
35#define MAPPINGFILE ".NTFS-3G/UserMapping" /* default mapping file */
36#define LINESZ 120              /* maximum useful size of a mapping line */
37#define CACHE_PERMISSIONS_BITS 6  /* log2 of unitary allocation of permissions */
38#define CACHE_PERMISSIONS_SIZE 262144 /* max cacheable permissions */
39
40/*
41 *		Matching of ntfs permissions to Linux permissions
42 *	these constants are adapted to endianness
43 *	when setting, set them all
44 *	when checking, check one is present
45 */
46
47          /* flags which are set to mean exec, write or read */
48
49#define FILE_READ (FILE_READ_DATA)
50#define FILE_WRITE (FILE_WRITE_DATA | FILE_APPEND_DATA \
51		| READ_CONTROL | FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA)
52#define FILE_EXEC (FILE_EXECUTE)
53#define DIR_READ FILE_LIST_DIRECTORY
54#define DIR_WRITE (FILE_ADD_FILE | FILE_ADD_SUBDIRECTORY | FILE_DELETE_CHILD \
55	 	| READ_CONTROL | FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA)
56#define DIR_EXEC (FILE_TRAVERSE)
57
58          /* flags tested for meaning exec, write or read */
59	  /* tests for write allow for interpretation of a sticky bit */
60
61#define FILE_GREAD (FILE_READ_DATA | GENERIC_READ)
62#define FILE_GWRITE (FILE_WRITE_DATA | FILE_APPEND_DATA | GENERIC_WRITE)
63#define FILE_GEXEC (FILE_EXECUTE | GENERIC_EXECUTE)
64#define DIR_GREAD (FILE_LIST_DIRECTORY | GENERIC_READ)
65#define DIR_GWRITE (FILE_ADD_FILE | FILE_ADD_SUBDIRECTORY | GENERIC_WRITE)
66#define DIR_GEXEC (FILE_TRAVERSE | GENERIC_EXECUTE)
67
68	/* standard owner (and administrator) rights */
69
70#define OWNER_RIGHTS (DELETE | READ_CONTROL | WRITE_DAC | WRITE_OWNER \
71			| SYNCHRONIZE \
72			| FILE_READ_ATTRIBUTES | FILE_WRITE_ATTRIBUTES \
73			| FILE_READ_EA | FILE_WRITE_EA)
74
75	/* standard world rights */
76
77#define WORLD_RIGHTS (READ_CONTROL | FILE_READ_ATTRIBUTES | FILE_READ_EA \
78			| SYNCHRONIZE)
79
80          /* inheritance flags for files and directories */
81
82#define FILE_INHERITANCE NO_PROPAGATE_INHERIT_ACE
83#define DIR_INHERITANCE (OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE)
84
85/*
86 *		To identify NTFS ACL meaning Posix ACL granted to root
87 *	we use rights always granted to anybody, so they have no impact
88 *	either on Windows or on Linux.
89 */
90
91#define ROOT_OWNER_UNMARK SYNCHRONIZE	/* ACL granted to root as owner */
92#define ROOT_GROUP_UNMARK FILE_READ_EA	/* ACL granted to root as group */
93
94/*
95 *		Maximum SID size and a type large enough to hold it
96 */
97
98#define MAX_SID_SIZE (8 + SID_MAX_SUB_AUTHORITIES*4)
99typedef char BIGSID[MAX_SID_SIZE];
100
101/*
102 *		Struct to hold the input mapping file
103 *	(private to this module)
104 */
105
106struct MAPLIST {
107	struct MAPLIST *next;
108	char *uidstr;		/* uid text from the same record */
109	char *gidstr;		/* gid text from the same record */
110	char *sidstr;		/* sid text from the same record */
111	char maptext[LINESZ + 1];
112};
113
114typedef int (*FILEREADER)(void *fileid, char *buf, size_t size, off_t pos);
115
116/*
117 *		Constants defined in acls.c
118 */
119
120extern const SID *adminsid;
121extern const SID *worldsid;
122
123/*
124 *		Functions defined in acls.c
125 */
126
127BOOL ntfs_valid_descr(const char *securattr, unsigned int attrsz);
128BOOL ntfs_valid_pattern(const SID *sid);
129BOOL ntfs_valid_sid(const SID *sid);
130BOOL ntfs_same_sid(const SID *first, const SID *second);
131
132BOOL ntfs_is_user_sid(const SID *usid);
133
134
135int ntfs_sid_size(const SID * sid);
136unsigned int ntfs_attr_size(const char *attr);
137
138const SID *ntfs_find_usid(const struct MAPPING *usermapping,
139			uid_t uid, SID *pdefsid);
140const SID *ntfs_find_gsid(const struct MAPPING *groupmapping,
141			gid_t gid, SID *pdefsid);
142uid_t ntfs_find_user(const struct MAPPING *usermapping, const SID *usid);
143gid_t ntfs_find_group(const struct MAPPING *groupmapping, const SID * gsid);
144const SID *ntfs_acl_owner(const char *secattr);
145
146#if POSIXACLS
147
148BOOL ntfs_valid_posix(const struct POSIX_SECURITY *pxdesc);
149void ntfs_sort_posix(struct POSIX_SECURITY *pxdesc);
150int ntfs_merge_mode_posix(struct POSIX_SECURITY *pxdesc, mode_t mode);
151struct POSIX_SECURITY *ntfs_build_inherited_posix(
152		const struct POSIX_SECURITY *pxdesc, mode_t mode,
153		mode_t umask, BOOL isdir);
154struct POSIX_SECURITY *ntfs_build_basic_posix(
155		const struct POSIX_SECURITY *pxdesc, mode_t mode,
156		mode_t umask, BOOL isdir);
157struct POSIX_SECURITY *ntfs_replace_acl(const struct POSIX_SECURITY *oldpxdesc,
158		const struct POSIX_ACL *newacl, int count, BOOL deflt);
159struct POSIX_SECURITY *ntfs_build_permissions_posix(
160			struct MAPPING* const mapping[],
161			const char *securattr,
162			const SID *usid, const SID *gsid, BOOL isdir);
163struct POSIX_SECURITY *ntfs_merge_descr_posix(const struct POSIX_SECURITY *first,
164			const struct POSIX_SECURITY *second);
165char *ntfs_build_descr_posix(struct MAPPING* const mapping[],
166			struct POSIX_SECURITY *pxdesc,
167			int isdir, const SID *usid, const SID *gsid);
168
169#endif /* POSIXACLS */
170
171int ntfs_inherit_acl(const ACL *oldacl, ACL *newacl,
172			const SID *usid, const SID *gsid,
173			BOOL fordir, le16 inherited);
174int ntfs_build_permissions(const char *securattr,
175			const SID *usid, const SID *gsid, BOOL isdir);
176char *ntfs_build_descr(mode_t mode,
177			int isdir, const SID * usid, const SID * gsid);
178struct MAPLIST *ntfs_read_mapping(FILEREADER reader, void *fileid);
179struct MAPPING *ntfs_do_user_mapping(struct MAPLIST *firstitem);
180struct MAPPING *ntfs_do_group_mapping(struct MAPLIST *firstitem);
181void ntfs_free_mapping(struct MAPPING *mapping[]);
182
183#endif /* ACLS_H */
184
185