Line data Source code
1 : /*
2 : * Store Windows ACLs in data store - common functions.
3 : * #included into modules/vfs_acl_xattr.c and modules/vfs_acl_tdb.c
4 : *
5 : * Copyright (C) Volker Lendecke, 2008
6 : * Copyright (C) Jeremy Allison, 2009
7 : * Copyright (C) Ralph Böhme, 2016
8 : *
9 : * This program is free software; you can redistribute it and/or modify
10 : * it under the terms of the GNU General Public License as published by
11 : * the Free Software Foundation; either version 3 of the License, or
12 : * (at your option) any later version.
13 : *
14 : * This program is distributed in the hope that it will be useful,
15 : * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 : * GNU General Public License for more details.
18 : *
19 : * You should have received a copy of the GNU General Public License
20 : * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 : */
22 :
23 : #include "includes.h"
24 : #include "vfs_acl_common.h"
25 : #include "smbd/smbd.h"
26 : #include "system/filesys.h"
27 : #include "librpc/gen_ndr/ndr_xattr.h"
28 : #include "../libcli/security/security.h"
29 : #include "../librpc/gen_ndr/ndr_security.h"
30 : #include "../lib/util/bitmap.h"
31 : #include "passdb/lookup_sid.h"
32 :
33 : #include <gnutls/gnutls.h>
34 : #include <gnutls/crypto.h>
35 :
36 : static NTSTATUS create_acl_blob(const struct security_descriptor *psd,
37 : DATA_BLOB *pblob,
38 : uint16_t hash_type,
39 : uint8_t hash[XATTR_SD_HASH_SIZE]);
40 :
41 : #define HASH_SECURITY_INFO (SECINFO_OWNER | \
42 : SECINFO_GROUP | \
43 : SECINFO_DACL | \
44 : SECINFO_SACL)
45 :
46 52938 : bool init_acl_common_config(vfs_handle_struct *handle,
47 : const char *module_name)
48 : {
49 52938 : struct acl_common_config *config = NULL;
50 52938 : const struct enum_list *default_acl_style_list = NULL;
51 :
52 52938 : default_acl_style_list = get_default_acl_style_list();
53 :
54 52938 : config = talloc_zero(handle->conn, struct acl_common_config);
55 52938 : if (config == NULL) {
56 0 : DBG_ERR("talloc_zero() failed\n");
57 0 : errno = ENOMEM;
58 0 : return false;
59 : }
60 :
61 52938 : config->ignore_system_acls = lp_parm_bool(SNUM(handle->conn),
62 : module_name,
63 : "ignore system acls",
64 : false);
65 52938 : config->default_acl_style = lp_parm_enum(SNUM(handle->conn),
66 : module_name,
67 : "default acl style",
68 : default_acl_style_list,
69 : DEFAULT_ACL_POSIX);
70 :
71 52938 : SMB_VFS_HANDLE_SET_DATA(handle, config, NULL,
72 : struct acl_common_config,
73 851 : return false);
74 :
75 52938 : return true;
76 : }
77 :
78 :
79 : /*******************************************************************
80 : Hash a security descriptor.
81 : *******************************************************************/
82 :
83 954632 : static NTSTATUS hash_blob_sha256(DATA_BLOB blob,
84 : uint8_t *hash)
85 : {
86 1920 : int rc;
87 :
88 954632 : ZERO_ARRAY_LEN(hash, XATTR_SD_HASH_SIZE);
89 :
90 956552 : rc = gnutls_hash_fast(GNUTLS_DIG_SHA256,
91 954632 : blob.data,
92 : blob.length,
93 : hash);
94 954632 : if (rc < 0) {
95 0 : return NT_STATUS_INTERNAL_ERROR;
96 : }
97 :
98 954632 : return NT_STATUS_OK;
99 : }
100 :
101 : /*******************************************************************
102 : Hash a security descriptor.
103 : *******************************************************************/
104 :
105 157824 : static NTSTATUS hash_sd_sha256(struct security_descriptor *psd,
106 : uint8_t *hash)
107 : {
108 431 : DATA_BLOB blob;
109 431 : NTSTATUS status;
110 :
111 157824 : memset(hash, '\0', XATTR_SD_HASH_SIZE);
112 157824 : status = create_acl_blob(psd, &blob, XATTR_SD_HASH_TYPE_SHA256, hash);
113 157824 : if (!NT_STATUS_IS_OK(status)) {
114 0 : return status;
115 : }
116 157824 : return hash_blob_sha256(blob, hash);
117 : }
118 :
119 : /*******************************************************************
120 : Parse out a struct security_descriptor from a DATA_BLOB.
121 : *******************************************************************/
122 :
123 639478 : static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
124 : TALLOC_CTX *mem_ctx,
125 : struct security_descriptor **ppdesc,
126 : uint16_t *p_hash_type,
127 : uint16_t *p_version,
128 : uint8_t hash[XATTR_SD_HASH_SIZE],
129 : uint8_t sys_acl_hash[XATTR_SD_HASH_SIZE])
130 : {
131 1058 : struct xattr_NTACL xacl;
132 1058 : enum ndr_err_code ndr_err;
133 1058 : size_t sd_size;
134 639478 : TALLOC_CTX *frame = talloc_stackframe();
135 :
136 639478 : ndr_err = ndr_pull_struct_blob(pblob, frame, &xacl,
137 : (ndr_pull_flags_fn_t)ndr_pull_xattr_NTACL);
138 :
139 639478 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
140 0 : DBG_INFO("ndr_pull_xattr_NTACL failed: %s\n",
141 : ndr_errstr(ndr_err));
142 0 : TALLOC_FREE(frame);
143 0 : return ndr_map_error2ntstatus(ndr_err);
144 : }
145 :
146 639478 : *p_version = xacl.version;
147 :
148 639478 : switch (xacl.version) {
149 108 : case 1:
150 216 : *ppdesc = make_sec_desc(mem_ctx, SD_REVISION,
151 108 : xacl.info.sd->type | SEC_DESC_SELF_RELATIVE,
152 108 : xacl.info.sd->owner_sid,
153 108 : xacl.info.sd->group_sid,
154 108 : xacl.info.sd->sacl,
155 108 : xacl.info.sd->dacl,
156 : &sd_size);
157 : /* No hash - null out. */
158 108 : *p_hash_type = XATTR_SD_HASH_TYPE_NONE;
159 108 : memset(hash, '\0', XATTR_SD_HASH_SIZE);
160 108 : break;
161 0 : case 2:
162 0 : *ppdesc = make_sec_desc(mem_ctx, SD_REVISION,
163 0 : xacl.info.sd_hs2->sd->type | SEC_DESC_SELF_RELATIVE,
164 0 : xacl.info.sd_hs2->sd->owner_sid,
165 0 : xacl.info.sd_hs2->sd->group_sid,
166 0 : xacl.info.sd_hs2->sd->sacl,
167 0 : xacl.info.sd_hs2->sd->dacl,
168 : &sd_size);
169 : /* No hash - null out. */
170 0 : *p_hash_type = XATTR_SD_HASH_TYPE_NONE;
171 0 : memset(hash, '\0', XATTR_SD_HASH_SIZE);
172 0 : break;
173 168 : case 3:
174 336 : *ppdesc = make_sec_desc(mem_ctx, SD_REVISION,
175 168 : xacl.info.sd_hs3->sd->type | SEC_DESC_SELF_RELATIVE,
176 168 : xacl.info.sd_hs3->sd->owner_sid,
177 168 : xacl.info.sd_hs3->sd->group_sid,
178 168 : xacl.info.sd_hs3->sd->sacl,
179 168 : xacl.info.sd_hs3->sd->dacl,
180 : &sd_size);
181 168 : *p_hash_type = xacl.info.sd_hs3->hash_type;
182 : /* Current version 3 (if no sys acl hash available). */
183 168 : memcpy(hash, xacl.info.sd_hs3->hash, XATTR_SD_HASH_SIZE);
184 168 : break;
185 639202 : case 4:
186 1278404 : *ppdesc = make_sec_desc(mem_ctx, SD_REVISION,
187 639202 : xacl.info.sd_hs4->sd->type | SEC_DESC_SELF_RELATIVE,
188 639202 : xacl.info.sd_hs4->sd->owner_sid,
189 639202 : xacl.info.sd_hs4->sd->group_sid,
190 638144 : xacl.info.sd_hs4->sd->sacl,
191 639202 : xacl.info.sd_hs4->sd->dacl,
192 : &sd_size);
193 639202 : *p_hash_type = xacl.info.sd_hs4->hash_type;
194 : /* Current version 4. */
195 639202 : memcpy(hash, xacl.info.sd_hs4->hash, XATTR_SD_HASH_SIZE);
196 639202 : memcpy(sys_acl_hash, xacl.info.sd_hs4->sys_acl_hash, XATTR_SD_HASH_SIZE);
197 638144 : break;
198 0 : default:
199 0 : TALLOC_FREE(frame);
200 0 : return NT_STATUS_REVISION_MISMATCH;
201 : }
202 :
203 639478 : TALLOC_FREE(frame);
204 :
205 639478 : return (*ppdesc != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
206 : }
207 :
208 : /*******************************************************************
209 : Create a DATA_BLOB from a hash of the security descriptor storead at
210 : the system layer and the NT ACL we wish to preserve
211 : *******************************************************************/
212 :
213 157870 : static NTSTATUS create_acl_blob(const struct security_descriptor *psd,
214 : DATA_BLOB *pblob,
215 : uint16_t hash_type,
216 : uint8_t hash[XATTR_SD_HASH_SIZE])
217 : {
218 431 : struct xattr_NTACL xacl;
219 431 : struct security_descriptor_hash_v3 sd_hs3;
220 431 : enum ndr_err_code ndr_err;
221 157870 : TALLOC_CTX *ctx = talloc_tos();
222 :
223 157870 : ZERO_STRUCT(xacl);
224 157870 : ZERO_STRUCT(sd_hs3);
225 :
226 157870 : xacl.version = 3;
227 157870 : xacl.info.sd_hs3 = &sd_hs3;
228 157870 : xacl.info.sd_hs3->sd = discard_const_p(struct security_descriptor, psd);
229 157870 : xacl.info.sd_hs3->hash_type = hash_type;
230 157870 : memcpy(&xacl.info.sd_hs3->hash[0], hash, XATTR_SD_HASH_SIZE);
231 :
232 157870 : ndr_err = ndr_push_struct_blob(
233 : pblob, ctx, &xacl,
234 : (ndr_push_flags_fn_t)ndr_push_xattr_NTACL);
235 :
236 157870 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
237 0 : DBG_INFO("ndr_push_xattr_NTACL failed: %s\n",
238 : ndr_errstr(ndr_err));
239 0 : return ndr_map_error2ntstatus(ndr_err);
240 : }
241 :
242 157870 : return NT_STATUS_OK;
243 : }
244 :
245 : /*******************************************************************
246 : Create a DATA_BLOB from a hash of the security descriptors
247 : (system and NT) stored at the system layer and the NT ACL we wish
248 : to preserve.
249 : *******************************************************************/
250 :
251 157642 : static NTSTATUS create_sys_acl_blob(const struct security_descriptor *psd,
252 : DATA_BLOB *pblob,
253 : uint16_t hash_type,
254 : uint8_t hash[XATTR_SD_HASH_SIZE],
255 : const char *description,
256 : uint8_t sys_acl_hash[XATTR_SD_HASH_SIZE])
257 : {
258 431 : struct xattr_NTACL xacl;
259 431 : struct security_descriptor_hash_v4 sd_hs4;
260 431 : enum ndr_err_code ndr_err;
261 157642 : TALLOC_CTX *ctx = talloc_tos();
262 :
263 157642 : ZERO_STRUCT(xacl);
264 157642 : ZERO_STRUCT(sd_hs4);
265 :
266 157642 : xacl.version = 4;
267 157642 : xacl.info.sd_hs4 = &sd_hs4;
268 157642 : xacl.info.sd_hs4->sd = discard_const_p(struct security_descriptor, psd);
269 157642 : xacl.info.sd_hs4->hash_type = hash_type;
270 157642 : memcpy(&xacl.info.sd_hs4->hash[0], hash, XATTR_SD_HASH_SIZE);
271 157642 : xacl.info.sd_hs4->description = description;
272 157642 : memcpy(&xacl.info.sd_hs4->sys_acl_hash[0], sys_acl_hash, XATTR_SD_HASH_SIZE);
273 :
274 157642 : ndr_err = ndr_push_struct_blob(
275 : pblob, ctx, &xacl,
276 : (ndr_push_flags_fn_t)ndr_push_xattr_NTACL);
277 :
278 157642 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
279 0 : DBG_INFO("ndr_push_xattr_NTACL failed: %s\n",
280 : ndr_errstr(ndr_err));
281 0 : return ndr_map_error2ntstatus(ndr_err);
282 : }
283 :
284 157642 : return NT_STATUS_OK;
285 : }
286 :
287 : /*******************************************************************
288 : Add in 3 inheritable components for a non-inheritable directory ACL.
289 : CREATOR_OWNER/CREATOR_GROUP/WORLD.
290 : *******************************************************************/
291 :
292 51214 : static NTSTATUS add_directory_inheritable_components(vfs_handle_struct *handle,
293 : const char *name,
294 : SMB_STRUCT_STAT *psbuf,
295 : struct security_descriptor *psd)
296 : {
297 51214 : struct connection_struct *conn = handle->conn;
298 51214 : int num_aces = (psd->dacl ? psd->dacl->num_aces : 0);
299 936 : struct smb_filename smb_fname;
300 936 : enum security_ace_type acltype;
301 936 : uint32_t access_mask;
302 936 : mode_t dir_mode;
303 936 : mode_t file_mode;
304 936 : mode_t mode;
305 936 : struct security_ace *new_ace_list;
306 :
307 51214 : if (psd->dacl) {
308 51214 : new_ace_list = talloc_zero_array(psd->dacl,
309 : struct security_ace,
310 : num_aces + 3);
311 : } else {
312 : /*
313 : * make_sec_acl() at the bottom of this function
314 : * duplicates new_ace_list
315 : */
316 0 : new_ace_list = talloc_zero_array(talloc_tos(),
317 : struct security_ace,
318 : num_aces + 3);
319 : }
320 :
321 51214 : if (new_ace_list == NULL) {
322 0 : return NT_STATUS_NO_MEMORY;
323 : }
324 :
325 : /* Fake a quick smb_filename. */
326 51214 : ZERO_STRUCT(smb_fname);
327 51214 : smb_fname.st = *psbuf;
328 51214 : smb_fname.base_name = discard_const_p(char, name);
329 :
330 51214 : dir_mode = unix_mode(conn,
331 : FILE_ATTRIBUTE_DIRECTORY, &smb_fname, NULL);
332 51214 : file_mode = unix_mode(conn,
333 : FILE_ATTRIBUTE_ARCHIVE, &smb_fname, NULL);
334 :
335 51214 : mode = dir_mode | file_mode;
336 :
337 51214 : DBG_DEBUG("directory %s, mode = 0%o\n", name, (unsigned int)mode);
338 :
339 51214 : if (num_aces) {
340 51214 : memcpy(new_ace_list, psd->dacl->aces,
341 : num_aces * sizeof(struct security_ace));
342 : }
343 51214 : access_mask = map_canon_ace_perms(SNUM(conn), &acltype,
344 : mode & 0700, false);
345 :
346 51214 : init_sec_ace(&new_ace_list[num_aces],
347 : &global_sid_Creator_Owner,
348 : acltype,
349 : access_mask,
350 : SEC_ACE_FLAG_CONTAINER_INHERIT|
351 : SEC_ACE_FLAG_OBJECT_INHERIT|
352 : SEC_ACE_FLAG_INHERIT_ONLY);
353 51214 : access_mask = map_canon_ace_perms(SNUM(conn), &acltype,
354 51214 : (mode << 3) & 0700, false);
355 51214 : init_sec_ace(&new_ace_list[num_aces+1],
356 : &global_sid_Creator_Group,
357 : acltype,
358 : access_mask,
359 : SEC_ACE_FLAG_CONTAINER_INHERIT|
360 : SEC_ACE_FLAG_OBJECT_INHERIT|
361 : SEC_ACE_FLAG_INHERIT_ONLY);
362 51214 : access_mask = map_canon_ace_perms(SNUM(conn), &acltype,
363 51214 : (mode << 6) & 0700, false);
364 51214 : init_sec_ace(&new_ace_list[num_aces+2],
365 : &global_sid_World,
366 : acltype,
367 : access_mask,
368 : SEC_ACE_FLAG_CONTAINER_INHERIT|
369 : SEC_ACE_FLAG_OBJECT_INHERIT|
370 : SEC_ACE_FLAG_INHERIT_ONLY);
371 51214 : if (psd->dacl) {
372 51214 : psd->dacl->aces = new_ace_list;
373 51214 : psd->dacl->num_aces += 3;
374 51214 : psd->dacl->size += new_ace_list[num_aces].size +
375 51214 : new_ace_list[num_aces+1].size +
376 51214 : new_ace_list[num_aces+2].size;
377 : } else {
378 0 : psd->dacl = make_sec_acl(psd,
379 : NT4_ACL_REVISION,
380 : 3,
381 : new_ace_list);
382 0 : if (psd->dacl == NULL) {
383 0 : return NT_STATUS_NO_MEMORY;
384 : }
385 : }
386 51214 : return NT_STATUS_OK;
387 : }
388 :
389 : /**
390 : * Validate an ACL blob
391 : *
392 : * This validates an ACL blob against the underlying filesystem ACL. If this
393 : * function returns NT_STATUS_OK ppsd can be
394 : *
395 : * 1. the ACL from the blob (psd_from_fs=false), or
396 : * 2. the ACL from the fs (psd_from_fs=true), or
397 : * 3. NULL (!)
398 : *
399 : * If the return value is anything else then NT_STATUS_OK, ppsd is set to NULL
400 : * and psd_from_fs set to false.
401 : *
402 : * Returning the underlying filesystem ACL in case no. 2 is really just an
403 : * optimisation, because some validations have to fetch the filesystem ACL as
404 : * part of the validation, so we already have it available and callers might
405 : * need it as well.
406 : **/
407 639478 : static NTSTATUS validate_nt_acl_blob(TALLOC_CTX *mem_ctx,
408 : vfs_handle_struct *handle,
409 : struct files_struct *fsp,
410 : const struct smb_filename *smb_fname,
411 : const DATA_BLOB *blob,
412 : struct security_descriptor **ppsd,
413 : bool *psd_is_from_fs)
414 : {
415 1058 : NTSTATUS status;
416 639478 : uint16_t hash_type = XATTR_SD_HASH_TYPE_NONE;
417 639478 : uint16_t xattr_version = 0;
418 1058 : uint8_t hash[XATTR_SD_HASH_SIZE];
419 1058 : uint8_t sys_acl_hash[XATTR_SD_HASH_SIZE];
420 1058 : uint8_t hash_tmp[XATTR_SD_HASH_SIZE];
421 1058 : uint8_t sys_acl_hash_tmp[XATTR_SD_HASH_SIZE];
422 639478 : struct security_descriptor *psd = NULL;
423 639478 : struct security_descriptor *psd_blob = NULL;
424 639478 : struct security_descriptor *psd_fs = NULL;
425 639478 : char *sys_acl_blob_description = NULL;
426 639478 : DATA_BLOB sys_acl_blob = { 0 };
427 639478 : struct acl_common_config *config = NULL;
428 :
429 639478 : *ppsd = NULL;
430 639478 : *psd_is_from_fs = false;
431 :
432 639478 : SMB_VFS_HANDLE_GET_DATA(handle, config,
433 : struct acl_common_config,
434 1058 : return NT_STATUS_UNSUCCESSFUL);
435 :
436 639478 : status = parse_acl_blob(blob,
437 : mem_ctx,
438 : &psd_blob,
439 : &hash_type,
440 : &xattr_version,
441 : &hash[0],
442 : &sys_acl_hash[0]);
443 639478 : if (!NT_STATUS_IS_OK(status)) {
444 0 : DBG_DEBUG("parse_acl_blob returned %s\n", nt_errstr(status));
445 0 : goto fail;
446 : }
447 :
448 : /* determine which type of xattr we got */
449 639478 : switch (xattr_version) {
450 108 : case 1:
451 : case 2:
452 : /* These xattr types are unilateral, they do not
453 : * require confirmation of the hash. In particular,
454 : * the NTVFS file server uses version 1, but
455 : * 'samba-tool ntacl' can set these as well */
456 108 : *ppsd = psd_blob;
457 300 : return NT_STATUS_OK;
458 639370 : case 3:
459 : case 4:
460 639370 : if (config->ignore_system_acls) {
461 192 : *ppsd = psd_blob;
462 192 : return NT_STATUS_OK;
463 : }
464 :
465 639178 : break;
466 0 : default:
467 0 : DBG_DEBUG("ACL blob revision mismatch (%u) for file %s\n",
468 : (unsigned int)hash_type, smb_fname->base_name);
469 0 : TALLOC_FREE(psd_blob);
470 0 : return NT_STATUS_OK;
471 : }
472 :
473 : /* determine which type of xattr we got */
474 639178 : if (hash_type != XATTR_SD_HASH_TYPE_SHA256) {
475 0 : DBG_DEBUG("ACL blob hash type (%u) unexpected for file %s\n",
476 : (unsigned int)hash_type, smb_fname->base_name);
477 0 : TALLOC_FREE(psd_blob);
478 0 : return NT_STATUS_OK;
479 : }
480 :
481 : /* determine which type of xattr we got */
482 639178 : switch (xattr_version) {
483 639166 : case 4:
484 : {
485 1058 : int ret;
486 : /* Get the full underlying sd, then hash. */
487 639166 : ret = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD(handle,
488 : fsp,
489 : mem_ctx,
490 : &sys_acl_blob_description,
491 : &sys_acl_blob);
492 : /* If we fail to get the ACL blob (for some reason) then this
493 : * is not fatal, we just work based on the NT ACL only */
494 639166 : if (ret == 0) {
495 639166 : status = hash_blob_sha256(sys_acl_blob, sys_acl_hash_tmp);
496 639166 : if (!NT_STATUS_IS_OK(status)) {
497 0 : goto fail;
498 : }
499 :
500 639166 : TALLOC_FREE(sys_acl_blob_description);
501 639166 : TALLOC_FREE(sys_acl_blob.data);
502 :
503 639166 : if (memcmp(&sys_acl_hash[0], &sys_acl_hash_tmp[0],
504 : XATTR_SD_HASH_SIZE) == 0) {
505 : /* Hash matches, return blob sd. */
506 638996 : DBG_DEBUG("blob hash matches for file %s\n",
507 : smb_fname->base_name);
508 638996 : *ppsd = psd_blob;
509 638996 : return NT_STATUS_OK;
510 : }
511 : }
512 :
513 : /* Otherwise, fall though and see if the NT ACL hash matches */
514 0 : FALL_THROUGH;
515 : }
516 : case 3:
517 : /* Get the full underlying sd for the hash
518 : or to return as backup. */
519 182 : status = SMB_VFS_NEXT_FGET_NT_ACL(handle,
520 : fsp,
521 : HASH_SECURITY_INFO,
522 : mem_ctx,
523 : &psd_fs);
524 182 : if (!NT_STATUS_IS_OK(status)) {
525 0 : DBG_DEBUG("get_next_acl for file %s returned %s\n",
526 : smb_fname->base_name, nt_errstr(status));
527 0 : goto fail;
528 : }
529 :
530 182 : status = hash_sd_sha256(psd_fs, hash_tmp);
531 182 : if (!NT_STATUS_IS_OK(status)) {
532 0 : TALLOC_FREE(psd_blob);
533 0 : *ppsd = psd_fs;
534 0 : *psd_is_from_fs = true;
535 0 : return NT_STATUS_OK;
536 : }
537 :
538 182 : if (memcmp(&hash[0], &hash_tmp[0], XATTR_SD_HASH_SIZE) == 0) {
539 : /* Hash matches, return blob sd. */
540 26 : DBG_DEBUG("blob hash matches for file %s\n",
541 : smb_fname->base_name);
542 26 : *ppsd = psd_blob;
543 26 : return NT_STATUS_OK;
544 : }
545 :
546 : /* Hash doesn't match, return underlying sd. */
547 156 : DBG_DEBUG("blob hash does not match for file %s - returning "
548 : "file system SD mapping.\n",
549 : smb_fname->base_name);
550 :
551 156 : if (DEBUGLEVEL >= 10) {
552 0 : DBG_DEBUG("acl for blob hash for %s is:\n",
553 : smb_fname->base_name);
554 0 : NDR_PRINT_DEBUG(security_descriptor, psd_fs);
555 : }
556 :
557 156 : TALLOC_FREE(psd_blob);
558 156 : *ppsd = psd_fs;
559 156 : *psd_is_from_fs = true;
560 : }
561 :
562 156 : return NT_STATUS_OK;
563 :
564 0 : fail:
565 0 : TALLOC_FREE(psd);
566 0 : TALLOC_FREE(psd_blob);
567 0 : TALLOC_FREE(psd_fs);
568 0 : TALLOC_FREE(sys_acl_blob_description);
569 0 : TALLOC_FREE(sys_acl_blob.data);
570 0 : return status;
571 : }
572 :
573 : /*******************************************************************
574 : Pull a DATA_BLOB from an xattr given an fsp.
575 : If the hash doesn't match, or doesn't exist - return the underlying
576 : filesystem sd.
577 : *******************************************************************/
578 :
579 833208 : NTSTATUS fget_nt_acl_common(
580 : NTSTATUS (*fget_acl_blob_fn)(TALLOC_CTX *ctx,
581 : vfs_handle_struct *handle,
582 : files_struct *fsp,
583 : DATA_BLOB *pblob),
584 : vfs_handle_struct *handle,
585 : files_struct *fsp,
586 : uint32_t security_info,
587 : TALLOC_CTX *mem_ctx,
588 : struct security_descriptor **ppdesc)
589 : {
590 833208 : DATA_BLOB blob = data_blob_null;
591 2279 : NTSTATUS status;
592 833208 : struct security_descriptor *psd = NULL;
593 833208 : const struct smb_filename *smb_fname = fsp->fsp_name;
594 833208 : bool psd_is_from_fs = false;
595 833208 : struct acl_common_config *config = NULL;
596 :
597 833208 : SMB_VFS_HANDLE_GET_DATA(handle, config,
598 : struct acl_common_config,
599 2279 : return NT_STATUS_UNSUCCESSFUL);
600 :
601 833208 : DBG_DEBUG("name=%s\n", smb_fname->base_name);
602 :
603 833208 : status = fget_acl_blob_fn(mem_ctx, handle, fsp, &blob);
604 833208 : if (NT_STATUS_IS_OK(status)) {
605 639478 : status = validate_nt_acl_blob(mem_ctx,
606 : handle,
607 : fsp,
608 : smb_fname,
609 : &blob,
610 : &psd,
611 : &psd_is_from_fs);
612 639478 : TALLOC_FREE(blob.data);
613 639478 : if (!NT_STATUS_IS_OK(status)) {
614 0 : DBG_DEBUG("ACL validation for [%s] failed\n",
615 : smb_fname->base_name);
616 0 : goto fail;
617 : }
618 : }
619 :
620 833208 : if (psd == NULL) {
621 : /* Get the full underlying sd, as we failed to get the
622 : * blob for the hash, or the revision/hash type wasn't
623 : * known */
624 :
625 193730 : if (config->ignore_system_acls) {
626 274 : status = vfs_stat_fsp(fsp);
627 274 : if (!NT_STATUS_IS_OK(status)) {
628 0 : goto fail;
629 : }
630 :
631 274 : status = make_default_filesystem_acl(
632 : mem_ctx,
633 : config->default_acl_style,
634 274 : smb_fname->base_name,
635 274 : &fsp->fsp_name->st,
636 : &psd);
637 274 : if (!NT_STATUS_IS_OK(status)) {
638 0 : goto fail;
639 : }
640 : } else {
641 193456 : status = SMB_VFS_NEXT_FGET_NT_ACL(handle,
642 : fsp,
643 : security_info,
644 : mem_ctx,
645 : &psd);
646 :
647 193456 : if (!NT_STATUS_IS_OK(status)) {
648 0 : DBG_DEBUG("get_next_acl for file %s "
649 : "returned %s\n",
650 : smb_fname->base_name,
651 : nt_errstr(status));
652 0 : goto fail;
653 : }
654 :
655 193456 : psd_is_from_fs = true;
656 : }
657 : }
658 :
659 833208 : if (psd_is_from_fs) {
660 193612 : status = vfs_stat_fsp(fsp);
661 193612 : if (!NT_STATUS_IS_OK(status)) {
662 0 : goto fail;
663 : }
664 :
665 : /*
666 : * We're returning the underlying ACL from the
667 : * filesystem. If it's a directory, and has no
668 : * inheritable ACE entries we have to fake them.
669 : */
670 :
671 194548 : if (fsp->fsp_flags.is_directory &&
672 51638 : !sd_has_inheritable_components(psd, true)) {
673 52150 : status = add_directory_inheritable_components(
674 : handle,
675 51214 : smb_fname->base_name,
676 51214 : &fsp->fsp_name->st,
677 : psd);
678 51214 : if (!NT_STATUS_IS_OK(status)) {
679 0 : goto fail;
680 : }
681 : }
682 :
683 : /*
684 : * The underlying POSIX module always sets the
685 : * ~SEC_DESC_DACL_PROTECTED bit, as ACLs can't be inherited in
686 : * this way under POSIX. Remove it for Windows-style ACLs.
687 : */
688 193612 : psd->type &= ~SEC_DESC_DACL_PROTECTED;
689 : }
690 :
691 833208 : if (!(security_info & SECINFO_OWNER)) {
692 306907 : psd->owner_sid = NULL;
693 : }
694 833208 : if (!(security_info & SECINFO_GROUP)) {
695 311777 : psd->group_sid = NULL;
696 : }
697 833208 : if (!(security_info & SECINFO_DACL)) {
698 12 : psd->type &= ~SEC_DESC_DACL_PRESENT;
699 12 : psd->dacl = NULL;
700 : }
701 833208 : if (!(security_info & SECINFO_SACL)) {
702 674650 : psd->type &= ~SEC_DESC_SACL_PRESENT;
703 674650 : psd->sacl = NULL;
704 : }
705 :
706 833208 : if (DEBUGLEVEL >= 10) {
707 0 : DBG_DEBUG("returning acl for %s is:\n",
708 : smb_fname->base_name);
709 0 : NDR_PRINT_DEBUG(security_descriptor, psd);
710 : }
711 :
712 833208 : *ppdesc = psd;
713 :
714 833208 : return NT_STATUS_OK;
715 :
716 0 : fail:
717 0 : TALLOC_FREE(psd);
718 0 : return status;
719 : }
720 :
721 : /*********************************************************************
722 : Set the underlying ACL (e.g. POSIX ACLS, POSIX owner, etc)
723 : *********************************************************************/
724 157666 : static NTSTATUS set_underlying_acl(vfs_handle_struct *handle, files_struct *fsp,
725 : struct security_descriptor *psd,
726 : uint32_t security_info_sent,
727 : bool chown_needed)
728 : {
729 431 : NTSTATUS status;
730 157666 : const struct security_token *token = NULL;
731 431 : struct dom_sid_buf buf;
732 :
733 157666 : status = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
734 157666 : if (!NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
735 157666 : return status;
736 : }
737 :
738 : /* We got access denied here. If we're already root,
739 : or we didn't need to do a chown, or the fsp isn't
740 : open with WRITE_OWNER access, just return. */
741 0 : if (get_current_uid(handle->conn) == 0 || !chown_needed ||
742 0 : !(fsp->access_mask & SEC_STD_WRITE_OWNER)) {
743 0 : return NT_STATUS_ACCESS_DENIED;
744 : }
745 :
746 : /*
747 : * Only allow take-ownership, not give-ownership. That's the way Windows
748 : * implements SEC_STD_WRITE_OWNER. MS-FSA 2.1.5.16 just states: If
749 : * InputBuffer.OwnerSid is not a valid owner SID for a file in the
750 : * objectstore, as determined in an implementation specific manner, the
751 : * object store MUST return STATUS_INVALID_OWNER.
752 : */
753 0 : token = get_current_nttok(fsp->conn);
754 0 : if (!security_token_is_sid(token, psd->owner_sid)) {
755 0 : return NT_STATUS_INVALID_OWNER;
756 : }
757 :
758 0 : DBG_DEBUG("overriding chown on file %s for sid %s\n",
759 : fsp_str_dbg(fsp),
760 : dom_sid_str_buf(psd->owner_sid, &buf));
761 :
762 : /* Ok, we failed to chown and we have
763 : SEC_STD_WRITE_OWNER access - override. */
764 0 : set_effective_capability(DAC_OVERRIDE_CAPABILITY);
765 0 : status = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
766 0 : drop_effective_capability(DAC_OVERRIDE_CAPABILITY);
767 :
768 0 : return status;
769 : }
770 :
771 : /*********************************************************************
772 : Store a v3 security descriptor
773 : *********************************************************************/
774 46 : static NTSTATUS store_v3_blob(
775 : NTSTATUS (*store_acl_blob_fsp_fn)(vfs_handle_struct *handle,
776 : files_struct *fsp,
777 : DATA_BLOB *pblob),
778 : vfs_handle_struct *handle, files_struct *fsp,
779 : struct security_descriptor *psd,
780 : struct security_descriptor *pdesc_next,
781 : uint8_t hash[XATTR_SD_HASH_SIZE])
782 : {
783 0 : NTSTATUS status;
784 0 : DATA_BLOB blob;
785 :
786 46 : if (DEBUGLEVEL >= 10) {
787 0 : DBG_DEBUG("storing xattr sd for file %s\n",
788 : fsp_str_dbg(fsp));
789 0 : NDR_PRINT_DEBUG(
790 : security_descriptor,
791 : discard_const_p(struct security_descriptor, psd));
792 :
793 0 : if (pdesc_next != NULL) {
794 0 : DBG_DEBUG("storing xattr sd based on \n");
795 0 : NDR_PRINT_DEBUG(
796 : security_descriptor,
797 : discard_const_p(struct security_descriptor,
798 : pdesc_next));
799 : } else {
800 0 : DBG_DEBUG("ignoring underlying sd\n");
801 : }
802 : }
803 46 : status = create_acl_blob(psd, &blob, XATTR_SD_HASH_TYPE_SHA256, hash);
804 46 : if (!NT_STATUS_IS_OK(status)) {
805 0 : DBG_DEBUG("create_acl_blob failed\n");
806 0 : return status;
807 : }
808 :
809 46 : status = store_acl_blob_fsp_fn(handle, fsp, &blob);
810 46 : return status;
811 : }
812 :
813 : /*********************************************************************
814 : Store a security descriptor given an fsp.
815 : *********************************************************************/
816 :
817 157690 : NTSTATUS fset_nt_acl_common(
818 : NTSTATUS (*fget_acl_blob_fn)(TALLOC_CTX *ctx,
819 : vfs_handle_struct *handle,
820 : files_struct *fsp,
821 : DATA_BLOB *pblob),
822 : NTSTATUS (*store_acl_blob_fsp_fn)(vfs_handle_struct *handle,
823 : files_struct *fsp,
824 : DATA_BLOB *pblob),
825 : const char *module_name,
826 : vfs_handle_struct *handle, files_struct *fsp,
827 : uint32_t security_info_sent,
828 : const struct security_descriptor *orig_psd)
829 : {
830 431 : NTSTATUS status;
831 431 : int ret;
832 431 : DATA_BLOB blob, sys_acl_blob;
833 157690 : struct security_descriptor *pdesc_next = NULL;
834 157690 : struct security_descriptor *psd = NULL;
835 431 : uint8_t hash[XATTR_SD_HASH_SIZE];
836 431 : uint8_t sys_acl_hash[XATTR_SD_HASH_SIZE];
837 157690 : bool chown_needed = false;
838 431 : char *sys_acl_description;
839 157690 : TALLOC_CTX *frame = talloc_stackframe();
840 157690 : bool ignore_file_system_acl = lp_parm_bool(
841 157690 : SNUM(handle->conn), module_name, "ignore system acls", false);
842 157690 : struct acl_common_fsp_ext *ext = NULL;
843 :
844 157690 : if (DEBUGLEVEL >= 10) {
845 0 : DBG_DEBUG("incoming sd for file %s\n", fsp_str_dbg(fsp));
846 0 : NDR_PRINT_DEBUG(security_descriptor,
847 : discard_const_p(struct security_descriptor, orig_psd));
848 : }
849 :
850 157690 : status = fget_nt_acl_common(fget_acl_blob_fn, handle, fsp,
851 : SECINFO_OWNER|SECINFO_GROUP|SECINFO_DACL|SECINFO_SACL,
852 : frame,
853 : &psd);
854 :
855 157690 : if (!NT_STATUS_IS_OK(status)) {
856 0 : TALLOC_FREE(frame);
857 0 : return status;
858 : }
859 :
860 157690 : psd->revision = orig_psd->revision;
861 157690 : if (security_info_sent & SECINFO_DACL) {
862 155602 : psd->type = orig_psd->type;
863 : /* All our SD's are self relative. */
864 155602 : psd->type |= SEC_DESC_SELF_RELATIVE;
865 : }
866 :
867 157690 : if ((security_info_sent & SECINFO_OWNER) && (orig_psd->owner_sid != NULL)) {
868 153175 : if (!dom_sid_equal(orig_psd->owner_sid, psd->owner_sid)) {
869 : /* We're changing the owner. */
870 61912 : chown_needed = true;
871 : }
872 153175 : psd->owner_sid = orig_psd->owner_sid;
873 : }
874 157690 : if ((security_info_sent & SECINFO_GROUP) && (orig_psd->group_sid != NULL)) {
875 150883 : if (!dom_sid_equal(orig_psd->group_sid, psd->group_sid)) {
876 : /* We're changing the group. */
877 148756 : chown_needed = true;
878 : }
879 150883 : psd->group_sid = orig_psd->group_sid;
880 : }
881 157690 : if (security_info_sent & SECINFO_DACL) {
882 155602 : if (security_descriptor_with_ms_nfs(orig_psd)) {
883 : /*
884 : * If the sd contains a MS NFS SID, do
885 : * nothing, it's a chmod() request from OS X
886 : * with AAPL context.
887 : */
888 0 : TALLOC_FREE(frame);
889 0 : return NT_STATUS_OK;
890 : }
891 155602 : psd->dacl = orig_psd->dacl;
892 155602 : psd->type |= SEC_DESC_DACL_PRESENT;
893 : }
894 157690 : if (security_info_sent & SECINFO_SACL) {
895 2108 : psd->sacl = orig_psd->sacl;
896 2108 : psd->type |= SEC_DESC_SACL_PRESENT;
897 : }
898 :
899 157690 : ext = VFS_ADD_FSP_EXTENSION(handle,
900 : fsp,
901 : struct acl_common_fsp_ext,
902 : NULL);
903 157690 : ext->setting_nt_acl = true;
904 :
905 157690 : if (ignore_file_system_acl) {
906 46 : if (chown_needed) {
907 : /* send only ownership stuff to lower layer */
908 22 : security_info_sent &= (SECINFO_OWNER | SECINFO_GROUP);
909 22 : status = set_underlying_acl(handle, fsp, psd,
910 : security_info_sent, true);
911 22 : if (!NT_STATUS_IS_OK(status)) {
912 0 : goto done;
913 : }
914 : }
915 46 : ZERO_ARRAY(hash);
916 46 : status = store_v3_blob(store_acl_blob_fsp_fn, handle, fsp, psd,
917 : NULL, hash);
918 46 : goto done;
919 : }
920 :
921 157644 : status = set_underlying_acl(handle, fsp, psd, security_info_sent,
922 : chown_needed);
923 157644 : if (!NT_STATUS_IS_OK(status)) {
924 2 : goto done;
925 : }
926 :
927 : /* Get the full underlying sd, then hash. */
928 157642 : status = SMB_VFS_NEXT_FGET_NT_ACL(handle,
929 : fsp,
930 : HASH_SECURITY_INFO,
931 : frame,
932 : &pdesc_next);
933 :
934 157642 : if (!NT_STATUS_IS_OK(status)) {
935 0 : goto done;
936 : }
937 :
938 157642 : status = hash_sd_sha256(pdesc_next, hash);
939 157642 : if (!NT_STATUS_IS_OK(status)) {
940 0 : goto done;
941 : }
942 :
943 : /* Get the full underlying sd, then hash. */
944 157642 : ret = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD(handle,
945 : fsp,
946 : frame,
947 : &sys_acl_description,
948 : &sys_acl_blob);
949 :
950 : /* If we fail to get the ACL blob (for some reason) then this
951 : * is not fatal, we just work based on the NT ACL only */
952 157642 : if (ret != 0) {
953 0 : status = store_v3_blob(store_acl_blob_fsp_fn, handle, fsp, psd,
954 : pdesc_next, hash);
955 :
956 0 : goto done;
957 : }
958 :
959 157642 : status = hash_blob_sha256(sys_acl_blob, sys_acl_hash);
960 157642 : if (!NT_STATUS_IS_OK(status)) {
961 0 : goto done;
962 : }
963 :
964 157642 : if (DEBUGLEVEL >= 10) {
965 0 : DBG_DEBUG("storing xattr sd for file %s based on system ACL\n",
966 : fsp_str_dbg(fsp));
967 0 : NDR_PRINT_DEBUG(security_descriptor,
968 : discard_const_p(struct security_descriptor, psd));
969 :
970 0 : DBG_DEBUG("storing hash in xattr sd based on system ACL and:\n");
971 0 : NDR_PRINT_DEBUG(security_descriptor,
972 : discard_const_p(struct security_descriptor, pdesc_next));
973 : }
974 :
975 : /* We store hashes of both the sys ACL blob and the NT
976 : * security descriptor mapped from that ACL so as to improve
977 : * our chances against some inadvertent change breaking the
978 : * hash used */
979 157642 : status = create_sys_acl_blob(psd, &blob, XATTR_SD_HASH_TYPE_SHA256, hash,
980 : sys_acl_description, sys_acl_hash);
981 157642 : if (!NT_STATUS_IS_OK(status)) {
982 0 : DBG_DEBUG("create_sys_acl_blob failed\n");
983 0 : goto done;
984 : }
985 :
986 157642 : status = store_acl_blob_fsp_fn(handle, fsp, &blob);
987 :
988 157690 : done:
989 157690 : VFS_REMOVE_FSP_EXTENSION(handle, fsp);
990 157690 : TALLOC_FREE(frame);
991 157690 : return status;
992 : }
993 :
994 0 : static int acl_common_remove_object(vfs_handle_struct *handle,
995 : struct files_struct *dirfsp,
996 : const struct smb_filename *smb_fname,
997 : bool is_directory)
998 : {
999 0 : connection_struct *conn = handle->conn;
1000 0 : struct file_id id;
1001 0 : files_struct *fsp = NULL;
1002 0 : int ret = 0;
1003 0 : struct smb_filename *full_fname = NULL;
1004 0 : struct smb_filename *local_fname = NULL;
1005 0 : struct smb_filename *parent_dir_fname = NULL;
1006 0 : int saved_errno = 0;
1007 0 : struct smb_filename *saved_dir_fname = NULL;
1008 0 : NTSTATUS status;
1009 :
1010 0 : saved_dir_fname = vfs_GetWd(talloc_tos(),conn);
1011 0 : if (saved_dir_fname == NULL) {
1012 0 : saved_errno = errno;
1013 0 : goto out;
1014 : }
1015 :
1016 0 : full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1017 : dirfsp,
1018 : smb_fname);
1019 0 : if (full_fname == NULL) {
1020 0 : goto out;
1021 : }
1022 :
1023 0 : status = SMB_VFS_PARENT_PATHNAME(conn,
1024 : talloc_tos(),
1025 : full_fname,
1026 : &parent_dir_fname,
1027 : &local_fname);
1028 0 : if (!NT_STATUS_IS_OK(status)) {
1029 0 : saved_errno = map_errno_from_nt_status(status);
1030 0 : goto out;
1031 : }
1032 :
1033 0 : DBG_DEBUG("removing %s %s\n", is_directory ? "directory" : "file",
1034 : smb_fname_str_dbg(full_fname));
1035 :
1036 : /* cd into the parent dir to pin it. */
1037 0 : ret = vfs_ChDir(conn, parent_dir_fname);
1038 0 : if (ret == -1) {
1039 0 : saved_errno = errno;
1040 0 : goto out;
1041 : }
1042 :
1043 : /* Must use lstat here. */
1044 0 : ret = SMB_VFS_LSTAT(conn, local_fname);
1045 0 : if (ret == -1) {
1046 0 : saved_errno = errno;
1047 0 : goto out;
1048 : }
1049 :
1050 : /* Ensure we have this file open with DELETE access. */
1051 0 : id = vfs_file_id_from_sbuf(conn, &local_fname->st);
1052 0 : for (fsp = file_find_di_first(conn->sconn, id, true); fsp;
1053 0 : fsp = file_find_di_next(fsp, true)) {
1054 0 : if (fsp->access_mask & DELETE_ACCESS &&
1055 : fsp->fsp_flags.delete_on_close)
1056 : {
1057 : /* We did open this for delete,
1058 : * allow the delete as root.
1059 : */
1060 0 : break;
1061 : }
1062 : }
1063 :
1064 0 : if (!fsp) {
1065 0 : DBG_DEBUG("%s %s not an open file\n",
1066 : is_directory ? "directory" : "file",
1067 : smb_fname_str_dbg(full_fname));
1068 0 : saved_errno = EACCES;
1069 0 : goto out;
1070 : }
1071 :
1072 0 : set_effective_capability(DAC_OVERRIDE_CAPABILITY);
1073 0 : if (is_directory) {
1074 0 : ret = SMB_VFS_NEXT_UNLINKAT(handle,
1075 : dirfsp,
1076 : smb_fname,
1077 : AT_REMOVEDIR);
1078 : } else {
1079 0 : ret = SMB_VFS_NEXT_UNLINKAT(handle,
1080 : dirfsp,
1081 : smb_fname,
1082 : 0);
1083 : }
1084 0 : drop_effective_capability(DAC_OVERRIDE_CAPABILITY);
1085 :
1086 0 : if (ret == -1) {
1087 0 : saved_errno = errno;
1088 : }
1089 :
1090 0 : out:
1091 :
1092 0 : TALLOC_FREE(parent_dir_fname);
1093 0 : TALLOC_FREE(full_fname);
1094 :
1095 0 : if (saved_dir_fname) {
1096 0 : vfs_ChDir(conn, saved_dir_fname);
1097 0 : TALLOC_FREE(saved_dir_fname);
1098 : }
1099 0 : if (saved_errno) {
1100 0 : errno = saved_errno;
1101 : }
1102 0 : return ret;
1103 : }
1104 :
1105 10007 : int rmdir_acl_common(struct vfs_handle_struct *handle,
1106 : struct files_struct *dirfsp,
1107 : const struct smb_filename *smb_fname)
1108 : {
1109 64 : int ret;
1110 :
1111 : /* Try the normal rmdir first. */
1112 10007 : ret = SMB_VFS_NEXT_UNLINKAT(handle,
1113 : dirfsp,
1114 : smb_fname,
1115 : AT_REMOVEDIR);
1116 10007 : if (ret == 0) {
1117 9927 : return 0;
1118 : }
1119 16 : if (errno == EACCES || errno == EPERM) {
1120 : /* Failed due to access denied,
1121 : see if we need to root override. */
1122 0 : return acl_common_remove_object(handle,
1123 : dirfsp,
1124 : smb_fname,
1125 : true);
1126 : }
1127 :
1128 16 : DBG_DEBUG("unlink of %s failed %s\n",
1129 : smb_fname->base_name,
1130 : strerror(errno));
1131 16 : return -1;
1132 : }
1133 :
1134 138519 : int unlink_acl_common(struct vfs_handle_struct *handle,
1135 : struct files_struct *dirfsp,
1136 : const struct smb_filename *smb_fname,
1137 : int flags)
1138 : {
1139 273 : int ret;
1140 :
1141 : /* Try the normal unlink first. */
1142 138519 : ret = SMB_VFS_NEXT_UNLINKAT(handle,
1143 : dirfsp,
1144 : smb_fname,
1145 : flags);
1146 138519 : if (ret == 0) {
1147 137750 : return 0;
1148 : }
1149 496 : if (errno == EACCES || errno == EPERM) {
1150 : /* Failed due to access denied,
1151 : see if we need to root override. */
1152 :
1153 : /* Don't do anything fancy for streams. */
1154 0 : if (smb_fname->stream_name) {
1155 0 : return -1;
1156 : }
1157 0 : return acl_common_remove_object(handle,
1158 : dirfsp,
1159 : smb_fname,
1160 : false);
1161 : }
1162 :
1163 496 : DBG_DEBUG("unlink of %s failed %s\n",
1164 : smb_fname->base_name,
1165 : strerror(errno));
1166 496 : return -1;
1167 : }
1168 :
1169 278 : int fchmod_acl_module_common(struct vfs_handle_struct *handle,
1170 : struct files_struct *fsp, mode_t mode)
1171 : {
1172 278 : if (fsp->posix_flags & FSP_POSIX_FLAGS_PATHNAMES
1173 278 : || fsp->fsp_name->flags & SMB_FILENAME_POSIX_PATH) {
1174 : /* Only allow this on POSIX opens. */
1175 12 : return SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1176 : }
1177 244 : return 0;
1178 : }
|
