1/* 2 * Convert AFS acls to NT acls and vice versa. 3 * 4 * Copyright (C) Volker Lendecke, 2003 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation; either version 2 of the License, or 9 * (at your option) any later version. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 * You should have received a copy of the GNU General Public License 17 * along with this program; if not, write to the Free Software 18 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. 19 */ 20 21#include "includes.h" 22 23#undef DBGC_CLASS 24#define DBGC_CLASS DBGC_VFS 25 26#include <afs/stds.h> 27#include <afs/afs.h> 28#include <afs/auth.h> 29#include <afs/venus.h> 30#include <afs/prs_fs.h> 31 32#define MAXSIZE 2048 33 34extern DOM_SID global_sid_World; 35extern DOM_SID global_sid_Builtin_Administrators; 36extern DOM_SID global_sid_Builtin_Backup_Operators; 37extern DOM_SID global_sid_Authenticated_Users; 38extern DOM_SID global_sid_NULL; 39 40static char space_replacement = '%'; 41 42extern int afs_syscall(int, char *, int, char *, int); 43 44struct afs_ace { 45 BOOL positive; 46 char *name; 47 DOM_SID sid; 48 enum SID_NAME_USE type; 49 uint32 rights; 50 struct afs_ace *next; 51}; 52 53struct afs_acl { 54 TALLOC_CTX *ctx; 55 int type; 56 int num_aces; 57 struct afs_ace *acelist; 58}; 59 60struct afs_iob { 61 char *in, *out; 62 uint16 in_size, out_size; 63}; 64 65 66static BOOL init_afs_acl(struct afs_acl *acl) 67{ 68 ZERO_STRUCT(*acl); 69 acl->ctx = talloc_init("afs_acl"); 70 if (acl->ctx == NULL) { 71 DEBUG(10, ("Could not init afs_acl")); 72 return False; 73 } 74 return True; 75} 76 77static void free_afs_acl(struct afs_acl *acl) 78{ 79 if (acl->ctx != NULL) 80 talloc_destroy(acl->ctx); 81 acl->ctx = NULL; 82 acl->num_aces = 0; 83 acl->acelist = NULL; 84} 85 86static struct afs_ace *clone_afs_ace(TALLOC_CTX *mem_ctx, struct afs_ace *ace) 87{ 88 struct afs_ace *result = TALLOC_P(mem_ctx, struct afs_ace); 89 90 if (result == NULL) 91 return NULL; 92 93 *result = *ace; 94 95 result->next = NULL; 96 result->name = talloc_strdup(mem_ctx, ace->name); 97 98 if (result->name == NULL) { 99 return NULL; 100 } 101 102 return result; 103} 104 105 106/* Ok, this is sort-of a hack. We assume here that we have winbind users in 107 * AFS. And yet another copy of parse_domain_user.... */ 108 109static BOOL parse_domain_user(const char *domuser, fstring domain, 110 fstring user) 111{ 112 char *p = strchr(domuser,*lp_winbind_separator()); 113 114 if (p==NULL) { 115 return False; 116 } 117 118 fstrcpy(user, p+1); 119 fstrcpy(domain, domuser); 120 domain[PTR_DIFF(p, domuser)] = 0; 121 strupper_m(domain); 122 123 return True; 124} 125 126static struct afs_ace *new_afs_ace(TALLOC_CTX *mem_ctx, 127 BOOL positive, 128 const char *name, uint32 rights) 129{ 130 DOM_SID sid; 131 enum SID_NAME_USE type; 132 struct afs_ace *result; 133 134 if (strcmp(name, "system:administrators") == 0) { 135 136 sid_copy(&sid, &global_sid_Builtin_Administrators); 137 type = SID_NAME_ALIAS; 138 139 } else if (strcmp(name, "system:anyuser") == 0) { 140 141 sid_copy(&sid, &global_sid_World); 142 type = SID_NAME_ALIAS; 143 144 } else if (strcmp(name, "system:authuser") == 0) { 145 146 sid_copy(&sid, &global_sid_Authenticated_Users); 147 type = SID_NAME_WKN_GRP; 148 149 } else if (strcmp(name, "system:backup") == 0) { 150 151 sid_copy(&sid, &global_sid_Builtin_Backup_Operators); 152 type = SID_NAME_ALIAS; 153 154 } else { 155 156 fstring user, domain; 157 158 if (!parse_domain_user(name, domain, user)) { 159 fstrcpy(user, name); 160 fstrcpy(domain, lp_workgroup()); 161 } 162 163 if (!lookup_name(domain, user, &sid, &type)) { 164 DEBUG(10, ("Could not find AFS user %s\n", name)); 165 166 sid_copy(&sid, &global_sid_NULL); 167 type = SID_NAME_UNKNOWN; 168 169 } 170 } 171 172 result = TALLOC_P(mem_ctx, struct afs_ace); 173 174 if (result == NULL) { 175 DEBUG(0, ("Could not talloc AFS ace\n")); 176 return NULL; 177 } 178 179 result->name = talloc_strdup(mem_ctx, name); 180 if (result->name == NULL) { 181 DEBUG(0, ("Could not talloc AFS ace name\n")); 182 return NULL; 183 } 184 185 result->sid = sid; 186 result->type = type; 187 188 result->positive = positive; 189 result->rights = rights; 190 191 return result; 192} 193 194static void add_afs_ace(struct afs_acl *acl, 195 BOOL positive, 196 const char *name, uint32 rights) 197{ 198 struct afs_ace *ace; 199 200 for (ace = acl->acelist; ace != NULL; ace = ace->next) { 201 if ((ace->positive == positive) && 202 (strequal(ace->name, name))) { 203 ace->rights |= rights; 204 return; 205 } 206 } 207 208 ace = new_afs_ace(acl->ctx, positive, name, rights); 209 210 ace->next = acl->acelist; 211 acl->acelist = ace; 212 213 acl->num_aces += 1; 214 215 DEBUG(10, ("add_afs_ace: Added %s entry for %s with rights %d\n", 216 ace->positive?"positive":"negative", 217 ace->name, ace->rights)); 218 219 return; 220} 221 222/* AFS ACLs in string form are a long string of fields delimited with \n. 223 * 224 * First line: Number of positive entries 225 * Second line: Number of negative entries 226 * Third and following lines: The entries themselves 227 * 228 * An ACE is a line of two fields, delimited by \t. 229 * 230 * First field: Name 231 * Second field: Rights 232 */ 233 234static BOOL parse_afs_acl(struct afs_acl *acl, const char *acl_str) 235{ 236 int nplus, nminus; 237 int aces; 238 239 char str[MAXSIZE+1]; 240 char *p = str; 241 242 strncpy(str, acl_str, MAXSIZE); 243 244 if (sscanf(p, "%d", &nplus) != 1) 245 return False; 246 247 DEBUG(10, ("Found %d positive entries\n", nplus)); 248 249 if ((p = strchr(p, '\n')) == NULL) 250 return False; 251 p += 1; 252 253 if (sscanf(p, "%d", &nminus) != 1) 254 return False; 255 256 DEBUG(10, ("Found %d negative entries\n", nminus)); 257 258 if ((p = strchr(p, '\n')) == NULL) 259 return False; 260 p += 1; 261 262 for (aces = nplus+nminus; aces > 0; aces--) 263 { 264 265 const char *namep; 266 fstring name; 267 uint32 rights; 268 char *space; 269 270 namep = p; 271 272 if ((p = strchr(p, '\t')) == NULL) 273 return False; 274 *p = '\0'; 275 p += 1; 276 277 if (sscanf(p, "%d", &rights) != 1) 278 return False; 279 280 if ((p = strchr(p, '\n')) == NULL) 281 return False; 282 p += 1; 283 284 fstrcpy(name, namep); 285 286 while ((space = strchr_m(name, space_replacement)) != NULL) 287 *space = ' '; 288 289 add_afs_ace(acl, nplus>0, name, rights); 290 291 nplus -= 1; 292 } 293 294 return True; 295} 296 297static BOOL unparse_afs_acl(struct afs_acl *acl, char *acl_str) 298{ 299 /* TODO: String length checks!!!! */ 300 301 int positives = 0; 302 int negatives = 0; 303 fstring line; 304 305 *acl_str = 0; 306 307 struct afs_ace *ace = acl->acelist; 308 309 while (ace != NULL) { 310 if (ace->positive) 311 positives++; 312 else 313 negatives++; 314 ace = ace->next; 315 } 316 317 fstr_sprintf(line, "%d\n", positives); 318 safe_strcat(acl_str, line, MAXSIZE); 319 320 fstr_sprintf(line, "%d\n", negatives); 321 safe_strcat(acl_str, line, MAXSIZE); 322 323 ace = acl->acelist; 324 325 while (ace != NULL) { 326 fstr_sprintf(line, "%s\t%d\n", ace->name, ace->rights); 327 safe_strcat(acl_str, line, MAXSIZE); 328 ace = ace->next; 329 } 330 return True; 331} 332 333static uint32 afs_to_nt_file_rights(uint32 rights) 334{ 335 uint32 result = 0; 336 337 if (rights & PRSFS_READ) 338 result |= FILE_READ_DATA | FILE_READ_EA | 339 FILE_EXECUTE | FILE_READ_ATTRIBUTES | 340 READ_CONTROL_ACCESS | SYNCHRONIZE_ACCESS; 341 342 if (rights & PRSFS_WRITE) 343 result |= FILE_WRITE_DATA | FILE_WRITE_ATTRIBUTES | 344 FILE_WRITE_EA | FILE_APPEND_DATA; 345 346 if (rights & PRSFS_LOCK) 347 result |= WRITE_OWNER_ACCESS; 348 349 if (rights & PRSFS_DELETE) 350 result |= DELETE_ACCESS; 351 352 return result; 353} 354 355static void afs_to_nt_dir_rights(uint32 afs_rights, uint32 *nt_rights, 356 uint8 *flag) 357{ 358 *nt_rights = 0; 359 *flag = SEC_ACE_FLAG_OBJECT_INHERIT | 360 SEC_ACE_FLAG_CONTAINER_INHERIT; 361 362 if (afs_rights & PRSFS_INSERT) 363 *nt_rights |= FILE_ADD_FILE | FILE_ADD_SUBDIRECTORY; 364 365 if (afs_rights & PRSFS_LOOKUP) 366 *nt_rights |= FILE_READ_DATA | FILE_READ_EA | 367 FILE_EXECUTE | FILE_READ_ATTRIBUTES | 368 READ_CONTROL_ACCESS | SYNCHRONIZE_ACCESS; 369 370 if (afs_rights & PRSFS_WRITE) 371 *nt_rights |= FILE_WRITE_ATTRIBUTES | FILE_WRITE_DATA | 372 FILE_APPEND_DATA | FILE_WRITE_EA; 373 374 if ((afs_rights & (PRSFS_INSERT|PRSFS_LOOKUP|PRSFS_DELETE)) == 375 (PRSFS_INSERT|PRSFS_LOOKUP|PRSFS_DELETE)) 376 *nt_rights |= FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA | 377 GENERIC_WRITE_ACCESS; 378 379 if (afs_rights & PRSFS_DELETE) 380 *nt_rights |= DELETE_ACCESS; 381 382 if (afs_rights & PRSFS_ADMINISTER) 383 *nt_rights |= FILE_DELETE_CHILD | WRITE_DAC_ACCESS | 384 WRITE_OWNER_ACCESS; 385 386 if ( (afs_rights & PRSFS_LOOKUP) == 387 (afs_rights & (PRSFS_LOOKUP|PRSFS_READ)) ) { 388 /* Only lookup right */ 389 *flag = SEC_ACE_FLAG_CONTAINER_INHERIT; 390 } 391 392 return; 393} 394 395#define AFS_FILE_RIGHTS (PRSFS_READ|PRSFS_WRITE|PRSFS_LOCK) 396#define AFS_DIR_RIGHTS (PRSFS_INSERT|PRSFS_LOOKUP|PRSFS_DELETE|PRSFS_ADMINISTER) 397 398static void split_afs_acl(struct afs_acl *acl, 399 struct afs_acl *dir_acl, 400 struct afs_acl *file_acl) 401{ 402 struct afs_ace *ace; 403 404 init_afs_acl(dir_acl); 405 init_afs_acl(file_acl); 406 407 for (ace = acl->acelist; ace != NULL; ace = ace->next) { 408 if (ace->rights & AFS_FILE_RIGHTS) { 409 add_afs_ace(file_acl, ace->positive, ace->name, 410 ace->rights & AFS_FILE_RIGHTS); 411 } 412 413 if (ace->rights & AFS_DIR_RIGHTS) { 414 add_afs_ace(dir_acl, ace->positive, ace->name, 415 ace->rights & AFS_DIR_RIGHTS); 416 } 417 } 418 return; 419} 420 421static BOOL same_principal(struct afs_ace *x, struct afs_ace *y) 422{ 423 return ( (x->positive == y->positive) && 424 (sid_compare(&x->sid, &y->sid) == 0) ); 425} 426 427static void merge_afs_acls(struct afs_acl *dir_acl, 428 struct afs_acl *file_acl, 429 struct afs_acl *target) 430{ 431 struct afs_ace *ace; 432 433 init_afs_acl(target); 434 435 for (ace = dir_acl->acelist; ace != NULL; ace = ace->next) { 436 struct afs_ace *file_ace; 437 BOOL found = False; 438 439 for (file_ace = file_acl->acelist; 440 file_ace != NULL; 441 file_ace = file_ace->next) { 442 if (!same_principal(ace, file_ace)) 443 continue; 444 445 add_afs_ace(target, ace->positive, ace->name, 446 ace->rights | file_ace->rights); 447 found = True; 448 break; 449 } 450 if (!found) 451 add_afs_ace(target, ace->positive, ace->name, 452 ace->rights); 453 } 454 455 for (ace = file_acl->acelist; ace != NULL; ace = ace->next) { 456 struct afs_ace *dir_ace; 457 BOOL already_seen = False; 458 459 for (dir_ace = dir_acl->acelist; 460 dir_ace != NULL; 461 dir_ace = dir_ace->next) { 462 if (!same_principal(ace, dir_ace)) 463 continue; 464 already_seen = True; 465 break; 466 } 467 if (!already_seen) 468 add_afs_ace(target, ace->positive, ace->name, 469 ace->rights); 470 } 471} 472 473#define PERMS_READ 0x001200a9 474#define PERMS_CHANGE 0x001301bf 475#define PERMS_FULL 0x001f01ff 476 477static struct static_dir_ace_mapping { 478 uint8 type; 479 uint8 flags; 480 uint32 mask; 481 uint32 afs_rights; 482} ace_mappings[] = { 483 484 /* Full control */ 485 { 0, SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT, 486 PERMS_FULL, 127 /* rlidwka */ }, 487 488 /* Change (write) */ 489 { 0, SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT, 490 PERMS_CHANGE, 63 /* rlidwk */ }, 491 492 /* Read (including list folder content) */ 493 { 0, SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT, 494 PERMS_READ, 9 /* rl */ }, 495 496 /* Read without list folder content -- same as "l" */ 497 { 0, SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT, 498 0x00120089, 8 /* l */ }, 499 500 /* some stupid workaround for preventing fallbacks */ 501 { 0, 0x3, 0x0012019F, 9 /* rl */ }, 502 { 0, 0x13, PERMS_FULL, 127 /* full */ }, 503 504 /* read, delete and execute access plus synchronize */ 505 { 0, 0x3, 0x001300A9, 9 /* should be rdl, set to rl */}, 506 /* classical read list */ 507 { 0, 0x13, 0x001200A9, 9 /* rl */}, 508 /* almost full control, no delete */ 509 { 0, 0x13, PERMS_CHANGE, 63 /* rwidlk */}, 510 511 /* List folder */ 512 { 0, SEC_ACE_FLAG_CONTAINER_INHERIT, 513 PERMS_READ, 8 /* l */ }, 514 515 /* FULL without inheritance -- in all cases here we also get 516 the corresponding INHERIT_ONLY ACE in the same ACL */ 517 { 0, 0, PERMS_FULL, 127 /* rlidwka */ }, 518 519 /* FULL inherit only -- counterpart to previous one */ 520 { 0, SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_INHERIT_ONLY, 521 PERMS_FULL | GENERIC_RIGHT_WRITE_ACCESS, 127 /* rlidwka */ }, 522 523 /* CHANGE without inheritance -- in all cases here we also get 524 the corresponding INHERIT_ONLY ACE in the same ACL */ 525 { 0, 0, PERMS_CHANGE, 63 /* rlidwk */ }, 526 527 /* CHANGE inherit only -- counterpart to previous one */ 528 { 0, SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_INHERIT_ONLY, 529 PERMS_CHANGE | GENERIC_RIGHT_WRITE_ACCESS, 63 /* rlidwk */ }, 530 531 /* End marker, hopefully there's no afs right 9999 :-) */ 532 { 0, 0, 0, 9999 } 533}; 534 535static uint32 nt_to_afs_dir_rights(const char *filename, const SEC_ACE *ace) 536{ 537 uint32 result = 0; 538 uint32 rights = ace->info.mask; 539 uint8 flags = ace->flags; 540 541 struct static_dir_ace_mapping *m; 542 543 for (m = &ace_mappings[0]; m->afs_rights != 9999; m++) { 544 if ( (ace->type == m->type) && 545 (ace->flags == m->flags) && 546 (ace->info.mask == m->mask) ) 547 return m->afs_rights; 548 } 549 550 DEBUG(1, ("AFSACL FALLBACK: 0x%X 0x%X 0x%X %s %X\n", 551 ace->type, ace->flags, ace->info.mask, filename, rights)); 552 553 if (rights & (GENERIC_ALL_ACCESS|WRITE_DAC_ACCESS)) { 554 result |= PRSFS_READ | PRSFS_WRITE | PRSFS_INSERT | 555 PRSFS_LOOKUP | PRSFS_DELETE | PRSFS_LOCK | 556 PRSFS_ADMINISTER; 557 } 558 559 if (rights & (GENERIC_READ_ACCESS|FILE_READ_DATA)) { 560 result |= PRSFS_LOOKUP; 561 if (flags & SEC_ACE_FLAG_OBJECT_INHERIT) { 562 result |= PRSFS_READ; 563 } 564 } 565 566 if (rights & (GENERIC_WRITE_ACCESS|FILE_WRITE_DATA)) { 567 result |= PRSFS_INSERT | PRSFS_DELETE; 568 if (flags & SEC_ACE_FLAG_OBJECT_INHERIT) { 569 result |= PRSFS_WRITE | PRSFS_LOCK; 570 } 571 } 572 573 return result; 574} 575 576static uint32 nt_to_afs_file_rights(const char *filename, const SEC_ACE *ace) 577{ 578 uint32 result = 0; 579 uint32 rights = ace->info.mask; 580 581 if (rights & (GENERIC_READ_ACCESS|FILE_READ_DATA)) { 582 result |= PRSFS_READ; 583 } 584 585 if (rights & (GENERIC_WRITE_ACCESS|FILE_WRITE_DATA)) { 586 result |= PRSFS_WRITE | PRSFS_LOCK; 587 } 588 589 return result; 590} 591 592static size_t afs_to_nt_acl(struct afs_acl *afs_acl, 593 struct files_struct *fsp, 594 uint32 security_info, 595 struct security_descriptor_info **ppdesc) 596{ 597 SEC_ACE *nt_ace_list; 598 DOM_SID owner_sid, group_sid; 599 SEC_ACCESS mask; 600 SMB_STRUCT_STAT sbuf; 601 SEC_ACL *psa = NULL; 602 int good_aces; 603 size_t sd_size; 604 TALLOC_CTX *mem_ctx = main_loop_talloc_get(); 605 606 struct afs_ace *afs_ace; 607 608 if (fsp->is_directory || fsp->fd == -1) { 609 /* Get the stat struct for the owner info. */ 610 if(SMB_VFS_STAT(fsp->conn,fsp->fsp_name, &sbuf) != 0) { 611 return 0; 612 } 613 } else { 614 if(SMB_VFS_FSTAT(fsp,fsp->fd,&sbuf) != 0) { 615 return 0; 616 } 617 } 618 619 uid_to_sid(&owner_sid, sbuf.st_uid); 620 gid_to_sid(&group_sid, sbuf.st_gid); 621 622 nt_ace_list = SMB_MALLOC_ARRAY(SEC_ACE, afs_acl->num_aces); 623 624 if (nt_ace_list == NULL) 625 return 0; 626 627 afs_ace = afs_acl->acelist; 628 good_aces = 0; 629 630 while (afs_ace != NULL) { 631 uint32 nt_rights; 632 uint8 flag = SEC_ACE_FLAG_OBJECT_INHERIT | 633 SEC_ACE_FLAG_CONTAINER_INHERIT; 634 635 if (afs_ace->type == SID_NAME_UNKNOWN) { 636 DEBUG(10, ("Ignoring unknown name %s\n", 637 afs_ace->name)); 638 afs_ace = afs_ace->next; 639 continue; 640 } 641 642 if (fsp->is_directory) 643 afs_to_nt_dir_rights(afs_ace->rights, &nt_rights, 644 &flag); 645 else 646 nt_rights = afs_to_nt_file_rights(afs_ace->rights); 647 648 init_sec_access(&mask, nt_rights); 649 init_sec_ace(&nt_ace_list[good_aces++], &(afs_ace->sid), 650 SEC_ACE_TYPE_ACCESS_ALLOWED, mask, flag); 651 afs_ace = afs_ace->next; 652 } 653 654 psa = make_sec_acl(mem_ctx, NT4_ACL_REVISION, 655 good_aces, nt_ace_list); 656 if (psa == NULL) 657 return 0; 658 659 660 *ppdesc = make_sec_desc(mem_ctx, SEC_DESC_REVISION, 661 SEC_DESC_SELF_RELATIVE, 662 (security_info & OWNER_SECURITY_INFORMATION) 663 ? &owner_sid : NULL, 664 (security_info & GROUP_SECURITY_INFORMATION) 665 ? &group_sid : NULL, 666 NULL, psa, &sd_size); 667 668 return sd_size; 669} 670 671static BOOL mappable_sid(const DOM_SID *sid) 672{ 673 DOM_SID domain_sid; 674 675 if (sid_compare(sid, &global_sid_Builtin_Administrators) == 0) 676 return True; 677 678 if (sid_compare(sid, &global_sid_World) == 0) 679 return True; 680 681 if (sid_compare(sid, &global_sid_Authenticated_Users) == 0) 682 return True; 683 684 if (sid_compare(sid, &global_sid_Builtin_Backup_Operators) == 0) 685 return True; 686 687 string_to_sid(&domain_sid, "S-1-5-21"); 688 689 if (sid_compare_domain(sid, &domain_sid) == 0) 690 return True; 691 692 return False; 693} 694 695static BOOL nt_to_afs_acl(const char *filename, 696 uint32 security_info_sent, 697 struct security_descriptor_info *psd, 698 uint32 (*nt_to_afs_rights)(const char *filename, 699 const SEC_ACE *ace), 700 struct afs_acl *afs_acl) 701{ 702 SEC_ACL *dacl; 703 int i; 704 705 /* Currently we *only* look at the dacl */ 706 707 if (((security_info_sent & DACL_SECURITY_INFORMATION) == 0) || 708 (psd->dacl == NULL)) 709 return True; 710 711 if (!init_afs_acl(afs_acl)) 712 return False; 713 714 dacl = psd->dacl; 715 716 for (i = 0; i < dacl->num_aces; i++) { 717 SEC_ACE *ace = &(dacl->ace[i]); 718 fstring dom_name; 719 fstring name; 720 enum SID_NAME_USE name_type; 721 char *p; 722 723 if (ace->type != SEC_ACE_TYPE_ACCESS_ALLOWED) { 724 /* First cut: Only positive ACEs */ 725 return False; 726 } 727 728 if (!mappable_sid(&ace->trustee)) { 729 DEBUG(10, ("Ignoring unmappable SID %s\n", 730 sid_string_static(&ace->trustee))); 731 continue; 732 } 733 734 if (sid_compare(&ace->trustee, 735 &global_sid_Builtin_Administrators) == 0) { 736 737 fstrcpy(name, "system:administrators"); 738 739 } else if (sid_compare(&ace->trustee, 740 &global_sid_World) == 0) { 741 742 fstrcpy(name, "system:anyuser"); 743 744 } else if (sid_compare(&ace->trustee, 745 &global_sid_Authenticated_Users) == 0) { 746 747 fstrcpy(name, "system:authuser"); 748 749 } else if (sid_compare(&ace->trustee, 750 &global_sid_Builtin_Backup_Operators) 751 == 0) { 752 753 fstrcpy(name, "system:backup"); 754 755 } else { 756 757 if (!lookup_sid(&ace->trustee, 758 dom_name, name, &name_type)) { 759 DEBUG(1, ("AFSACL: Could not lookup SID %s on file %s\n", 760 sid_string_static(&ace->trustee), filename)); 761 continue; 762 } 763 764 if ( (name_type == SID_NAME_USER) || 765 (name_type == SID_NAME_DOM_GRP) || 766 (name_type == SID_NAME_ALIAS) ) { 767 fstring only_username; 768 fstrcpy(only_username, name); 769 fstr_sprintf(name, "%s%s%s", 770 dom_name, lp_winbind_separator(), 771 only_username); 772 strlower_m(name); 773 } 774 } 775 776 while ((p = strchr_m(name, ' ')) != NULL) 777 *p = space_replacement; 778 779 add_afs_ace(afs_acl, True, name, 780 nt_to_afs_rights(filename, ace)); 781 } 782 783 return True; 784} 785 786static BOOL afs_get_afs_acl(char *filename, struct afs_acl *acl) 787{ 788 struct afs_iob iob; 789 790 int ret; 791 792 char space[MAXSIZE]; 793 794 DEBUG(5, ("afs_get_afs_acl: %s\n", filename)); 795 796 iob.in_size = 0; 797 iob.out_size = MAXSIZE; 798 iob.in = iob.out = space; 799 800 ret = afs_syscall(AFSCALL_PIOCTL, filename, VIOCGETAL, 801 (char *)&iob, 0); 802 803 if (ret) { 804 DEBUG(1, ("got error from PIOCTL: %d\n", ret)); 805 return False; 806 } 807 808 if (!init_afs_acl(acl)) 809 return False; 810 811 if (!parse_afs_acl(acl, space)) { 812 DEBUG(1, ("Could not parse AFS acl\n")); 813 free_afs_acl(acl); 814 return False; 815 } 816 817 return True; 818} 819 820static size_t afs_get_nt_acl(struct files_struct *fsp, uint32 security_info, 821 struct security_descriptor_info **ppdesc) 822{ 823 struct afs_acl acl; 824 size_t sd_size; 825 826 DEBUG(5, ("afs_get_nt_acl: %s\n", fsp->fsp_name)); 827 828 if (!afs_get_afs_acl(fsp->fsp_name, &acl)) { 829 return 0; 830 } 831 832 sd_size = afs_to_nt_acl(&acl, fsp, security_info, ppdesc); 833 834 free_afs_acl(&acl); 835 836 return sd_size; 837} 838 839/* For setting an AFS ACL we have to take care of the ACEs we could 840 * not properly map to SIDs. Merge all of them into the new ACL. */ 841 842static void merge_unknown_aces(struct afs_acl *src, struct afs_acl *dst) 843{ 844 struct afs_ace *ace; 845 846 for (ace = src->acelist; ace != NULL; ace = ace->next) 847 { 848 struct afs_ace *copy; 849 850 if (ace->type != SID_NAME_UNKNOWN) { 851 DEBUG(10, ("Not merging known ACE for %s\n", 852 ace->name)); 853 continue; 854 } 855 856 DEBUG(10, ("Merging unknown ACE for %s\n", ace->name)); 857 858 copy = clone_afs_ace(dst->ctx, ace); 859 860 if (copy == NULL) { 861 DEBUG(0, ("Could not clone ACE for %s\n", ace->name)); 862 continue; 863 } 864 865 copy->next = dst->acelist; 866 dst->acelist = copy; 867 dst->num_aces += 1; 868 } 869} 870 871static BOOL afs_set_nt_acl(vfs_handle_struct *handle, files_struct *fsp, 872 uint32 security_info_sent, 873 struct security_descriptor_info *psd) 874{ 875 struct afs_acl old_afs_acl, new_afs_acl; 876 struct afs_acl dir_acl, file_acl; 877 char acl_string[2049]; 878 struct afs_iob iob; 879 int ret = -1; 880 pstring name; 881 const char *fileacls; 882 883 fileacls = lp_parm_const_string(SNUM(handle->conn), "afsacl", "fileacls", 884 "yes"); 885 886 ZERO_STRUCT(old_afs_acl); 887 ZERO_STRUCT(new_afs_acl); 888 ZERO_STRUCT(dir_acl); 889 ZERO_STRUCT(file_acl); 890 891 pstr_sprintf(name, fsp->fsp_name); 892 893 if (!fsp->is_directory) { 894 char *p = strrchr(name, '/'); 895 if (p == NULL) { 896 DEBUG(3, ("No / in file string\n")); 897 return False; 898 } 899 *p = '\0'; 900 } 901 902 if (!afs_get_afs_acl(name, &old_afs_acl)) { 903 DEBUG(3, ("Could not get old ACL of %s\n", fsp->fsp_name)); 904 goto done; 905 } 906 907 split_afs_acl(&old_afs_acl, &dir_acl, &file_acl); 908 909 if (fsp->is_directory) { 910 911 if (!strequal(fileacls, "yes")) { 912 /* Throw away file acls, we depend on the 913 * inheritance ACEs that also give us file 914 * permissions */ 915 free_afs_acl(&file_acl); 916 } 917 918 free_afs_acl(&dir_acl); 919 if (!nt_to_afs_acl(fsp->fsp_name, security_info_sent, psd, 920 nt_to_afs_dir_rights, &dir_acl)) 921 goto done; 922 } else { 923 if (strequal(fileacls, "no")) { 924 ret = -1; 925 goto done; 926 } 927 928 if (strequal(fileacls, "ignore")) { 929 ret = 0; 930 goto done; 931 } 932 933 free_afs_acl(&file_acl); 934 if (!nt_to_afs_acl(fsp->fsp_name, security_info_sent, psd, 935 nt_to_afs_file_rights, &file_acl)) 936 goto done; 937 } 938 939 merge_afs_acls(&dir_acl, &file_acl, &new_afs_acl); 940 941 merge_unknown_aces(&old_afs_acl, &new_afs_acl); 942 943 unparse_afs_acl(&new_afs_acl, acl_string); 944 945 iob.in = acl_string; 946 iob.in_size = 1+strlen(iob.in); 947 iob.out = NULL; 948 iob.out_size = 0; 949 950 DEBUG(10, ("trying to set acl '%s' on file %s\n", iob.in, name)); 951 952 ret = afs_syscall(AFSCALL_PIOCTL, name, VIOCSETAL, (char *)&iob, 0); 953 954 if (ret != 0) { 955 DEBUG(10, ("VIOCSETAL returned %d\n", ret)); 956 } 957 958 done: 959 free_afs_acl(&dir_acl); 960 free_afs_acl(&file_acl); 961 free_afs_acl(&old_afs_acl); 962 free_afs_acl(&new_afs_acl); 963 964 return (ret == 0); 965} 966 967static size_t afsacl_fget_nt_acl(struct vfs_handle_struct *handle, 968 struct files_struct *fsp, 969 int fd, uint32 security_info, 970 struct security_descriptor_info **ppdesc) 971{ 972 return afs_get_nt_acl(fsp, security_info, ppdesc); 973} 974static size_t afsacl_get_nt_acl(struct vfs_handle_struct *handle, 975 struct files_struct *fsp, 976 const char *name, uint32 security_info, 977 struct security_descriptor_info **ppdesc) 978{ 979 return afs_get_nt_acl(fsp, security_info, ppdesc); 980} 981 982BOOL afsacl_fset_nt_acl(vfs_handle_struct *handle, 983 files_struct *fsp, 984 int fd, uint32 security_info_sent, 985 SEC_DESC *psd) 986{ 987 return afs_set_nt_acl(handle, fsp, security_info_sent, psd); 988} 989 990BOOL afsacl_set_nt_acl(vfs_handle_struct *handle, 991 files_struct *fsp, 992 const char *name, uint32 security_info_sent, 993 SEC_DESC *psd) 994{ 995 return afs_set_nt_acl(handle, fsp, security_info_sent, psd); 996} 997 998static int afsacl_connect(vfs_handle_struct *handle, 999 connection_struct *conn, 1000 const char *service, 1001 const char *user) 1002{ 1003 char *spc; 1004 1005 spc = lp_parm_const_string(SNUM(handle->conn), "afsacl", "space", "%"); 1006 1007 if (spc != NULL) 1008 space_replacement = spc[0]; 1009 1010 return SMB_VFS_NEXT_CONNECT(handle, conn, service, user); 1011} 1012 1013/* VFS operations structure */ 1014 1015static vfs_op_tuple afsacl_ops[] = { 1016 {SMB_VFS_OP(afsacl_connect), SMB_VFS_OP_CONNECT, 1017 SMB_VFS_LAYER_TRANSPARENT}, 1018 {SMB_VFS_OP(afsacl_fget_nt_acl), SMB_VFS_OP_FGET_NT_ACL, 1019 SMB_VFS_LAYER_TRANSPARENT}, 1020 {SMB_VFS_OP(afsacl_get_nt_acl), SMB_VFS_OP_GET_NT_ACL, 1021 SMB_VFS_LAYER_TRANSPARENT}, 1022 {SMB_VFS_OP(afsacl_fset_nt_acl), SMB_VFS_OP_FSET_NT_ACL, 1023 SMB_VFS_LAYER_TRANSPARENT}, 1024 {SMB_VFS_OP(afsacl_set_nt_acl), SMB_VFS_OP_SET_NT_ACL, 1025 SMB_VFS_LAYER_TRANSPARENT}, 1026 {SMB_VFS_OP(NULL), SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} 1027}; 1028 1029NTSTATUS vfs_afsacl_init(void) 1030{ 1031 return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "afsacl", 1032 afsacl_ops); 1033} 1034