← Back to branch summary

~lefteris-nikoltsios/+junk/samba-lp1016895

« back to all changes in this revision

Viewing changes to source3/modules/onefs_acl.c

  • Committer: Package Import Robot
  • Author(s): Chuck Short
  • Date: 2011-12-21 13:18:04 UTC
  • mfrom: (0.39.21 sid)
  • Revision ID: package-import@ubuntu.com-20111221131804-xtlr39wx6njehxxr
Tags: 2:3.6.1-3ubuntu1
* Merge from Debian testing.  Remaining changes:
  + debian/patches/VERSION.patch:
    - set SAMBA_VERSION_SUFFIX to Ubuntu.
  + debian/patches/error-trans.fix-276472:
    - Add the translation of Unix Error code -ENOTSUP to NT Error Code
    - NT_STATUS_NOT_SUPPORTED to prevent the Permission denied error.
  + debian/smb.conf:
    - add "(Samba, Ubuntu)" to server string.
    - comment out the default [homes] share, and add a comment about
      "valid users = %S" to show users how to restrict access to
      \\server\username to only username.
    - Set 'usershare allow guests', so that usershare admins are 
      allowed to create public shares in addition to authenticated
      ones.
    - add map to guest = Bad user, maps bad username to guest access.
  + debian/samba-common.config:
    - Do not change priority to high if dhclient3 is installed.
    - Use priority medium instead of high for the workgroup question.
  + debian/control:
    - Don't build against or suggest ctdb.
    - Add dependency on samba-common-bin to samba.
  + Add ufw integration:
    - Created debian/samba.ufw.profile
    - debian/rules, debian/samba.dirs, debian/samba.files: install
      profile
    - debian/control: have samba suggest ufw
  + Add apport hook:
    - Created debian/source_samba.py.
    - debian/rules, debian/samba.dirs, debian/samba-common-bin.files: install
  + Switch to upstart:
    - Add debian/samba.{nmbd,smbd}.upstart.
  + debian/samba.logrotate, debian/samba-common.dhcp, debian/samba.if-up:
    - Make them upstart compatible
  + debian/samba.postinst: 
    - Avoid scary pdbedit warnings on first import.
  + debian/samba-common.postinst: Add more informative error message for
    the case where smb.conf was manually deleted
  + debian/patches/fix-debuglevel-name-conflict.patch: don't use 'debug_level'
    as a global variable name in an NSS module 
  + Dropped:
    - debian/patches/error-trans.fix-276472
    - debian/patches/fix-debuglevel-name-conflict.patch

Show diffs side-by-side

added added

removed removed

Lines of Context:
source3/modules/onefs_acl.c
20
20
 */
21
21
 
22
22
#include "includes.h"
 
23
#include "smbd/smbd.h"
23
24
#include "onefs.h"
24
25
#include "onefs_config.h"
25
26
 
38
39
 * Turn SID into UID/GID and setup a struct ifs_identity
39
40
 */
40
41
static bool
41
 
onefs_sid_to_identity(const DOM_SID *sid, struct ifs_identity *id,
 
42
onefs_sid_to_identity(const struct dom_sid *sid, struct ifs_identity *id,
42
43
    bool is_group)
43
44
{
44
45
        enum ifs_identity_type type = IFS_ID_TYPE_LAST+1;
80
81
 * Turn struct ifs_identity into SID
81
82
 */
82
83
static bool
83
 
onefs_identity_to_sid(struct ifs_identity *id, DOM_SID *sid)
 
84
onefs_identity_to_sid(struct ifs_identity *id, struct dom_sid *sid)
84
85
{
85
86
        if (!id || !sid)
86
87
                return false;
116
117
}
117
118
 
118
119
static bool
119
 
onefs_og_to_identity(DOM_SID *sid, struct ifs_identity * ident,
 
120
onefs_og_to_identity(struct dom_sid *sid, struct ifs_identity * ident,
120
121
    bool is_group, int snum)
121
122
{
122
 
        const DOM_SID *b_admin_sid = &global_sid_Builtin_Administrators;
 
123
        const struct dom_sid *b_admin_sid = &global_sid_Builtin_Administrators;
123
124
 
124
125
        if (!onefs_sid_to_identity(sid, ident, is_group)) {
125
126
                if (!lp_parm_bool(snum, PARM_ONEFS_TYPE,
140
141
}
141
142
 
142
143
static bool
143
 
sid_in_ignore_list(DOM_SID * sid, int snum)
 
144
sid_in_ignore_list(struct dom_sid * sid, int snum)
144
145
{
145
146
        const char ** sid_list = NULL;
146
 
        DOM_SID match;
 
147
        struct dom_sid match;
147
148
 
148
149
        sid_list = lp_parm_string_list(snum, PARM_ONEFS_TYPE,
149
150
            PARM_UNMAPPABLE_SIDS_IGNORE_LIST,
167
168
 * Convert a trustee to a struct identity
168
169
 */
169
170
static bool
170
 
onefs_samba_ace_to_ace(SEC_ACE * samba_ace, struct ifs_ace * ace,
 
171
onefs_samba_ace_to_ace(struct security_ace * samba_ace, struct ifs_ace * ace,
171
172
    bool *mapped, int snum)
172
173
{
173
174
        struct ifs_identity ident = {.type=IFS_ID_TYPE_LAST, .id.uid=0};
232
233
}
233
234
 
234
235
/**
235
 
 * Convert a SEC_ACL to a struct ifs_security_acl
 
236
 * Convert a struct security_acl to a struct ifs_security_acl
236
237
 */
237
238
static bool
238
 
onefs_samba_acl_to_acl(SEC_ACL *samba_acl, struct ifs_security_acl **acl,
 
239
onefs_samba_acl_to_acl(struct security_acl *samba_acl, struct ifs_security_acl **acl,
239
240
    bool * ignore_aces, int snum)
240
241
{
241
242
        int num_aces = 0;
242
243
        struct ifs_ace *aces = NULL;
243
 
        SEC_ACE *samba_aces;
 
244
        struct security_ace *samba_aces;
244
245
        bool mapped;
245
246
        int i, j;
246
247
 
287
288
}
288
289
 
289
290
/**
290
 
 * Convert a struct ifs_security_acl to a SEC_ACL
 
291
 * Convert a struct ifs_security_acl to a struct security_acl
291
292
 */
292
293
static bool
293
 
onefs_acl_to_samba_acl(struct ifs_security_acl *acl, SEC_ACL **samba_acl)
 
294
onefs_acl_to_samba_acl(struct ifs_security_acl *acl, struct security_acl **samba_acl)
294
295
{
295
 
        SEC_ACE *samba_aces = NULL;
296
 
        SEC_ACL *tmp_samba_acl = NULL;
 
296
        struct security_ace *samba_aces = NULL;
 
297
        struct security_acl *tmp_samba_acl = NULL;
297
298
        int i, num_aces = 0;
298
299
 
299
300
        if (!samba_acl)
313
314
 
314
315
        /* Allocate the ace list. */
315
316
        if (num_aces > 0) {
316
 
                if ((samba_aces = SMB_MALLOC_ARRAY(SEC_ACE, num_aces)) == NULL)
 
317
                if ((samba_aces = SMB_MALLOC_ARRAY(struct security_ace, num_aces)) == NULL)
317
318
                {
318
319
                        DEBUG(0, ("Unable to malloc space for %d aces.\n",
319
320
                            num_aces));
320
321
                        return false;
321
322
                }
322
 
                memset(samba_aces, '\0', (num_aces) * sizeof(SEC_ACE));
 
323
                memset(samba_aces, '\0', (num_aces) * sizeof(struct security_ace));
323
324
        }
324
325
 
325
326
        for (i = 0; i < num_aces; i++) {
326
 
                DOM_SID sid;
 
327
                struct dom_sid sid;
327
328
 
328
329
                if (!onefs_identity_to_sid(&acl->aces[i].trustee, &sid))
329
330
                        goto err_free;
553
554
 
554
555
                /* Use existing samba logic to derive the mode bits. */
555
556
                file_mode = unix_mode(fsp->conn, 0, fsp->fsp_name, NULL);
556
 
                dir_mode = unix_mode(fsp->conn, aDIR, fsp->fsp_name, NULL);
 
557
                dir_mode = unix_mode(fsp->conn, FILE_ATTRIBUTE_DIRECTORY, fsp->fsp_name, NULL);
557
558
 
558
559
                /* Initialize ACEs. */
559
560
                new_aces[0] = onefs_init_ace(fsp->conn, file_mode, false, USR);
604
605
 */
605
606
NTSTATUS
606
607
onefs_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
607
 
                  uint32 security_info, SEC_DESC **ppdesc)
 
608
                  uint32 security_info, struct security_descriptor **ppdesc)
608
609
{
609
610
        int error;
610
611
        uint32_t sd_size = 0;
611
612
        size_t size = 0;
612
613
        struct ifs_security_descriptor *sd = NULL;
613
 
        DOM_SID owner_sid, group_sid;
614
 
        DOM_SID *ownerp, *groupp;
615
 
        SEC_ACL *dacl, *sacl;
616
 
        SEC_DESC *pdesc;
 
614
        struct dom_sid owner_sid, group_sid;
 
615
        struct dom_sid *ownerp, *groupp;
 
616
        struct security_acl *dacl, *sacl;
 
617
        struct security_descriptor *pdesc;
617
618
        bool alloced = false;
618
619
        bool new_aces_alloced = false;
619
620
        bool fopened = false;
629
630
        if (lp_parm_bool(SNUM(fsp->conn), PARM_ONEFS_TYPE,
630
631
                PARM_IGNORE_SACLS, PARM_IGNORE_SACLS_DEFAULT)) {
631
632
                DEBUG(5, ("Ignoring SACL on %s.\n", fsp_str_dbg(fsp)));
632
 
                security_info &= ~SACL_SECURITY_INFORMATION;
 
633
                security_info &= ~SECINFO_SACL;
633
634
        }
634
635
 
635
636
        if (fsp->fh->fd == -1) {
705
706
        sacl = NULL;
706
707
 
707
708
        /* Copy owner into ppdesc */
708
 
        if (security_info & OWNER_SECURITY_INFORMATION) {
 
709
        if (security_info & SECINFO_OWNER) {
709
710
                if (!onefs_identity_to_sid(sd->owner, &owner_sid)) {
710
711
                        status = NT_STATUS_INVALID_PARAMETER;
711
712
                        goto out;
715
716
        }
716
717
 
717
718
        /* Copy group into ppdesc */
718
 
        if (security_info & GROUP_SECURITY_INFORMATION) {
 
719
        if (security_info & SECINFO_GROUP) {
719
720
                if (!onefs_identity_to_sid(sd->group, &group_sid)) {
720
721
                        status = NT_STATUS_INVALID_PARAMETER;
721
722
                        goto out;
725
726
        }
726
727
 
727
728
        /* Copy DACL into ppdesc */
728
 
        if (security_info & DACL_SECURITY_INFORMATION) {
 
729
        if (security_info & SECINFO_DACL) {
729
730
                if (!onefs_acl_to_samba_acl(sd->dacl, &dacl)) {
730
731
                        status = NT_STATUS_INVALID_PARAMETER;
731
732
                        goto out;
733
734
        }
734
735
 
735
736
        /* Copy SACL into ppdesc */
736
 
        if (security_info & SACL_SECURITY_INFORMATION) {
 
737
        if (security_info & SECINFO_SACL) {
737
738
                if (!onefs_acl_to_samba_acl(sd->sacl, &sacl)) {
738
739
                        status = NT_STATUS_INVALID_PARAMETER;
739
740
                        goto out;
790
791
 */
791
792
NTSTATUS
792
793
onefs_get_nt_acl(vfs_handle_struct *handle, const char* name,
793
 
                 uint32 security_info, SEC_DESC **ppdesc)
 
794
                 uint32 security_info, struct security_descriptor **ppdesc)
794
795
{
795
796
        files_struct finfo;
796
797
        struct fd_handle fh;
817
818
 
818
819
/**
819
820
 * Isilon-specific function for setting up an ifs_security_descriptor, given a
820
 
 * samba SEC_DESC.
 
821
 * samba struct security_descriptor
821
822
 *
822
823
 * @param[out] sd ifs_security_descriptor to fill in
823
824
 *
824
825
 * @return NTSTATUS_OK if successful
825
826
 */
826
 
NTSTATUS onefs_samba_sd_to_sd(uint32_t security_info_sent, const SEC_DESC *psd,
 
827
NTSTATUS onefs_samba_sd_to_sd(uint32_t security_info_sent,
 
828
                              const struct security_descriptor *psd,
827
829
                              struct ifs_security_descriptor *sd, int snum,
828
830
                              uint32_t *security_info_effective)
829
831
{
839
841
        *security_info_effective = security_info_sent;
840
842
 
841
843
        /* Setup owner */
842
 
        if (security_info_sent & OWNER_SECURITY_INFORMATION) {
 
844
        if (security_info_sent & SECINFO_OWNER) {
843
845
                if (!onefs_og_to_identity(psd->owner_sid, &owner, false, snum))
844
846
                        return NT_STATUS_ACCESS_DENIED;
845
847
 
849
851
        }
850
852
 
851
853
        /* Setup group */
852
 
        if (security_info_sent & GROUP_SECURITY_INFORMATION) {
 
854
        if (security_info_sent & SECINFO_GROUP) {
853
855
                if (!onefs_og_to_identity(psd->group_sid, &group, true, snum))
854
856
                        return NT_STATUS_ACCESS_DENIED;
855
857
 
859
861
        }
860
862
 
861
863
        /* Setup DACL */
862
 
        if ((security_info_sent & DACL_SECURITY_INFORMATION) && (psd->dacl)) {
 
864
        if ((security_info_sent & SECINFO_DACL) && (psd->dacl)) {
863
865
                if (!onefs_samba_acl_to_acl(psd->dacl, &daclp, &ignore_aces,
864
866
                        snum))
865
867
                        return NT_STATUS_ACCESS_DENIED;
866
868
 
867
869
                if (ignore_aces == true)
868
 
                        *security_info_effective &= ~DACL_SECURITY_INFORMATION;
 
870
                        *security_info_effective &= ~SECINFO_DACL;
869
871
        }
870
872
 
871
873
        /* Setup SACL */
872
 
        if (security_info_sent & SACL_SECURITY_INFORMATION) {
 
874
        if (security_info_sent & SECINFO_SACL) {
873
875
 
874
876
                if (lp_parm_bool(snum, PARM_ONEFS_TYPE,
875
877
                            PARM_IGNORE_SACLS, PARM_IGNORE_SACLS_DEFAULT)) {
876
878
                        DEBUG(5, ("Ignoring SACL.\n"));
877
 
                        *security_info_effective &= ~SACL_SECURITY_INFORMATION;
 
879
                        *security_info_effective &= ~SECINFO_SACL;
878
880
                } else {
879
881
                        if (psd->sacl) {
880
882
                                if (!onefs_samba_acl_to_acl(psd->sacl,
883
885
 
884
886
                                if (ignore_aces == true) {
885
887
                                        *security_info_effective &=
886
 
                                            ~SACL_SECURITY_INFORMATION;
 
888
                                            ~SECINFO_SACL;
887
889
                                }
888
890
                        }
889
891
                }
909
911
 */
910
912
NTSTATUS
911
913
onefs_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
912
 
                  uint32_t sec_info_sent, const SEC_DESC *psd)
 
914
                  uint32_t sec_info_sent, const struct security_descriptor *psd)
913
915
{
914
916
        struct ifs_security_descriptor sd = {};
915
917
        int fd = -1;