1/* 2 * 3 * Copyright (c) 2007-2008 Jean-Pierre Andre 4 * 5 */ 6 7/* 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 2 of the License, or 11 * (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program (in the main directory of the NTFS-3G 20 * distribution in the file COPYING); if not, write to the Free Software 21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 22 */ 23 24#ifndef ACLS_H 25#define ACLS_H 26 27#include "endians.h" 28 29/* 30 * JPA configuration modes for security.c / acls.c 31 * should be moved to some config file 32 */ 33 34#define BUFSZ 1024 /* buffer size to read mapping file */ 35#define MAPPINGFILE ".NTFS-3G/UserMapping" /* default mapping file */ 36#define LINESZ 120 /* maximum useful size of a mapping line */ 37#define CACHE_PERMISSIONS_BITS 6 /* log2 of unitary allocation of permissions */ 38#define CACHE_PERMISSIONS_SIZE 262144 /* max cacheable permissions */ 39 40/* 41 * Matching of ntfs permissions to Linux permissions 42 * these constants are adapted to endianness 43 * when setting, set them all 44 * when checking, check one is present 45 */ 46 47 /* flags which are set to mean exec, write or read */ 48 49#define FILE_READ (FILE_READ_DATA) 50#define FILE_WRITE (FILE_WRITE_DATA | FILE_APPEND_DATA \ 51 | READ_CONTROL | FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA) 52#define FILE_EXEC (FILE_EXECUTE) 53#define DIR_READ FILE_LIST_DIRECTORY 54#define DIR_WRITE (FILE_ADD_FILE | FILE_ADD_SUBDIRECTORY | FILE_DELETE_CHILD \ 55 | READ_CONTROL | FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA) 56#define DIR_EXEC (FILE_TRAVERSE) 57 58 /* flags tested for meaning exec, write or read */ 59 /* tests for write allow for interpretation of a sticky bit */ 60 61#define FILE_GREAD (FILE_READ_DATA | GENERIC_READ) 62#define FILE_GWRITE (FILE_WRITE_DATA | FILE_APPEND_DATA | GENERIC_WRITE) 63#define FILE_GEXEC (FILE_EXECUTE | GENERIC_EXECUTE) 64#define DIR_GREAD (FILE_LIST_DIRECTORY | GENERIC_READ) 65#define DIR_GWRITE (FILE_ADD_FILE | FILE_ADD_SUBDIRECTORY | GENERIC_WRITE) 66#define DIR_GEXEC (FILE_TRAVERSE | GENERIC_EXECUTE) 67 68 /* standard owner (and administrator) rights */ 69 70#define OWNER_RIGHTS (DELETE | READ_CONTROL | WRITE_DAC | WRITE_OWNER \ 71 | SYNCHRONIZE \ 72 | FILE_READ_ATTRIBUTES | FILE_WRITE_ATTRIBUTES \ 73 | FILE_READ_EA | FILE_WRITE_EA) 74 75 /* standard world rights */ 76 77#define WORLD_RIGHTS (READ_CONTROL | FILE_READ_ATTRIBUTES | FILE_READ_EA \ 78 | SYNCHRONIZE) 79 80 /* inheritance flags for files and directories */ 81 82#define FILE_INHERITANCE NO_PROPAGATE_INHERIT_ACE 83#define DIR_INHERITANCE (OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE) 84 85/* 86 * To identify NTFS ACL meaning Posix ACL granted to root 87 * we use rights always granted to anybody, so they have no impact 88 * either on Windows or on Linux. 89 */ 90 91#define ROOT_OWNER_UNMARK SYNCHRONIZE /* ACL granted to root as owner */ 92#define ROOT_GROUP_UNMARK FILE_READ_EA /* ACL granted to root as group */ 93 94/* 95 * Maximum SID size and a type large enough to hold it 96 */ 97 98#define MAX_SID_SIZE (8 + SID_MAX_SUB_AUTHORITIES*4) 99typedef char BIGSID[MAX_SID_SIZE]; 100 101/* 102 * Struct to hold the input mapping file 103 * (private to this module) 104 */ 105 106struct MAPLIST { 107 struct MAPLIST *next; 108 char *uidstr; /* uid text from the same record */ 109 char *gidstr; /* gid text from the same record */ 110 char *sidstr; /* sid text from the same record */ 111 char maptext[LINESZ + 1]; 112}; 113 114typedef int (*FILEREADER)(void *fileid, char *buf, size_t size, off_t pos); 115 116/* 117 * Constants defined in acls.c 118 */ 119 120extern const SID *adminsid; 121extern const SID *worldsid; 122 123/* 124 * Functions defined in acls.c 125 */ 126 127BOOL ntfs_valid_descr(const char *securattr, unsigned int attrsz); 128BOOL ntfs_valid_pattern(const SID *sid); 129BOOL ntfs_valid_sid(const SID *sid); 130BOOL ntfs_same_sid(const SID *first, const SID *second); 131 132BOOL ntfs_is_user_sid(const SID *usid); 133 134 135int ntfs_sid_size(const SID * sid); 136unsigned int ntfs_attr_size(const char *attr); 137 138const SID *ntfs_find_usid(const struct MAPPING *usermapping, 139 uid_t uid, SID *pdefsid); 140const SID *ntfs_find_gsid(const struct MAPPING *groupmapping, 141 gid_t gid, SID *pdefsid); 142uid_t ntfs_find_user(const struct MAPPING *usermapping, const SID *usid); 143gid_t ntfs_find_group(const struct MAPPING *groupmapping, const SID * gsid); 144const SID *ntfs_acl_owner(const char *secattr); 145 146#if POSIXACLS 147 148BOOL ntfs_valid_posix(const struct POSIX_SECURITY *pxdesc); 149void ntfs_sort_posix(struct POSIX_SECURITY *pxdesc); 150int ntfs_merge_mode_posix(struct POSIX_SECURITY *pxdesc, mode_t mode); 151struct POSIX_SECURITY *ntfs_build_inherited_posix( 152 const struct POSIX_SECURITY *pxdesc, mode_t mode, 153 mode_t umask, BOOL isdir); 154struct POSIX_SECURITY *ntfs_build_basic_posix( 155 const struct POSIX_SECURITY *pxdesc, mode_t mode, 156 mode_t umask, BOOL isdir); 157struct POSIX_SECURITY *ntfs_replace_acl(const struct POSIX_SECURITY *oldpxdesc, 158 const struct POSIX_ACL *newacl, int count, BOOL deflt); 159struct POSIX_SECURITY *ntfs_build_permissions_posix( 160 struct MAPPING* const mapping[], 161 const char *securattr, 162 const SID *usid, const SID *gsid, BOOL isdir); 163struct POSIX_SECURITY *ntfs_merge_descr_posix(const struct POSIX_SECURITY *first, 164 const struct POSIX_SECURITY *second); 165char *ntfs_build_descr_posix(struct MAPPING* const mapping[], 166 struct POSIX_SECURITY *pxdesc, 167 int isdir, const SID *usid, const SID *gsid); 168 169#endif /* POSIXACLS */ 170 171int ntfs_inherit_acl(const ACL *oldacl, ACL *newacl, 172 const SID *usid, const SID *gsid, 173 BOOL fordir, le16 inherited); 174int ntfs_build_permissions(const char *securattr, 175 const SID *usid, const SID *gsid, BOOL isdir); 176char *ntfs_build_descr(mode_t mode, 177 int isdir, const SID * usid, const SID * gsid); 178struct MAPLIST *ntfs_read_mapping(FILEREADER reader, void *fileid); 179struct MAPPING *ntfs_do_user_mapping(struct MAPLIST *firstitem); 180struct MAPPING *ntfs_do_group_mapping(struct MAPLIST *firstitem); 181void ntfs_free_mapping(struct MAPPING *mapping[]); 182 183#endif /* ACLS_H */ 184 185