source: vendor/current/source3/modules/vfs_acl_tdb.c@ 746

Last change on this file since 746 was 746, checked in by Silvan Scherrer, 12 years ago

Samba Server: updated vendor to 3.6.9
File size: 10.8 KB
Line 
1/*
2 * Store Windows ACLs in a tdb.
3 *
4 * Copyright (C) Volker Lendecke, 2008
5 * Copyright (C) Jeremy Allison, 2008
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 */
20
21#include "includes.h"
22#include "smbd/smbd.h"
23#include "system/filesys.h"
24#include "librpc/gen_ndr/xattr.h"
25#include "librpc/gen_ndr/ndr_xattr.h"
26#include "../lib/crypto/crypto.h"
27#include "dbwrap.h"
28#include "auth.h"
29#include "util_tdb.h"
30
31#undef DBGC_CLASS
32#define DBGC_CLASS DBGC_VFS
33
34#define ACL_MODULE_NAME "acl_tdb"
35#include "modules/vfs_acl_common.c"
36
37static unsigned int ref_count;
38static struct db_context *acl_db;
39
40/*******************************************************************
41 Open acl_db if not already open, increment ref count.
42*******************************************************************/
43
44static bool acl_tdb_init(void)
45{
46 char *dbname;
47
48 if (acl_db) {
49 ref_count++;
50 return true;
51 }
52
53 dbname = state_path("file_ntacls.tdb");
54
55 if (dbname == NULL) {
56 errno = ENOSYS;
57 return false;
58 }
59
60 become_root();
61 acl_db = db_open(NULL, dbname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
62 unbecome_root();
63
64 if (acl_db == NULL) {
65#if defined(ENOTSUP)
66 errno = ENOTSUP;
67#else
68 errno = ENOSYS;
69#endif
70 TALLOC_FREE(dbname);
71 return false;
72 }
73
74 ref_count++;
75 TALLOC_FREE(dbname);
76 return true;
77}
78
79/*******************************************************************
80 Lower ref count and close acl_db if zero.
81*******************************************************************/
82
83static void disconnect_acl_tdb(struct vfs_handle_struct *handle)
84{
85 SMB_VFS_NEXT_DISCONNECT(handle);
86 ref_count--;
87 if (ref_count == 0) {
88 TALLOC_FREE(acl_db);
89 }
90}
91
92/*******************************************************************
93 Fetch_lock the tdb acl record for a file
94*******************************************************************/
95
96static struct db_record *acl_tdb_lock(TALLOC_CTX *mem_ctx,
97 struct db_context *db,
98 const struct file_id *id)
99{
100 uint8 id_buf[16];
101
102 /* For backwards compatibility only store the dev/inode. */
103 push_file_id_16((char *)id_buf, id);
104 return db->fetch_locked(db,
105 mem_ctx,
106 make_tdb_data(id_buf,
107 sizeof(id_buf)));
108}
109
110/*******************************************************************
111 Delete the tdb acl record for a file
112*******************************************************************/
113
114static NTSTATUS acl_tdb_delete(vfs_handle_struct *handle,
115 struct db_context *db,
116 SMB_STRUCT_STAT *psbuf)
117{
118 NTSTATUS status;
119 struct file_id id = vfs_file_id_from_sbuf(handle->conn, psbuf);
120 struct db_record *rec = acl_tdb_lock(talloc_tos(), db, &id);
121
122 /*
123 * If rec == NULL there's not much we can do about it
124 */
125
126 if (rec == NULL) {
127 DEBUG(10,("acl_tdb_delete: rec == NULL\n"));
128 TALLOC_FREE(rec);
129 return NT_STATUS_OK;
130 }
131
132 status = rec->delete_rec(rec);
133 TALLOC_FREE(rec);
134 return status;
135}
136
137/*******************************************************************
138 Pull a security descriptor into a DATA_BLOB from a tdb store.
139*******************************************************************/
140
141static NTSTATUS get_acl_blob(TALLOC_CTX *ctx,
142 vfs_handle_struct *handle,
143 files_struct *fsp,
144 const char *name,
145 DATA_BLOB *pblob)
146{
147 uint8 id_buf[16];
148 TDB_DATA data;
149 struct file_id id;
150 struct db_context *db = acl_db;
151 NTSTATUS status = NT_STATUS_OK;
152 SMB_STRUCT_STAT sbuf;
153
154 ZERO_STRUCT(sbuf);
155
156 if (fsp) {
157 status = vfs_stat_fsp(fsp);
158 sbuf = fsp->fsp_name->st;
159 } else {
160 int ret = vfs_stat_smb_fname(handle->conn, name, &sbuf);
161 if (ret == -1) {
162 status = map_nt_error_from_unix(errno);
163 }
164 }
165
166 if (!NT_STATUS_IS_OK(status)) {
167 return status;
168 }
169
170 id = vfs_file_id_from_sbuf(handle->conn, &sbuf);
171
172 /* For backwards compatibility only store the dev/inode. */
173 push_file_id_16((char *)id_buf, &id);
174
175 if (db->fetch(db,
176 ctx,
177 make_tdb_data(id_buf, sizeof(id_buf)),
178 &data) == -1) {
179 return NT_STATUS_INTERNAL_DB_CORRUPTION;
180 }
181
182 pblob->data = data.dptr;
183 pblob->length = data.dsize;
184
185 DEBUG(10,("get_acl_blob: returned %u bytes from file %s\n",
186 (unsigned int)data.dsize, name ));
187
188 if (pblob->length == 0 || pblob->data == NULL) {
189 return NT_STATUS_NOT_FOUND;
190 }
191 return NT_STATUS_OK;
192}
193
194/*******************************************************************
195 Store a DATA_BLOB into a tdb record given an fsp pointer.
196*******************************************************************/
197
198static NTSTATUS store_acl_blob_fsp(vfs_handle_struct *handle,
199 files_struct *fsp,
200 DATA_BLOB *pblob)
201{
202 uint8 id_buf[16];
203 struct file_id id;
204 TDB_DATA data;
205 struct db_context *db = acl_db;
206 struct db_record *rec;
207 NTSTATUS status;
208
209 DEBUG(10,("store_acl_blob_fsp: storing blob length %u on file %s\n",
210 (unsigned int)pblob->length, fsp_str_dbg(fsp)));
211
212 status = vfs_stat_fsp(fsp);
213 if (!NT_STATUS_IS_OK(status)) {
214 return status;
215 }
216
217 id = vfs_file_id_from_sbuf(handle->conn, &fsp->fsp_name->st);
218
219 /* For backwards compatibility only store the dev/inode. */
220 push_file_id_16((char *)id_buf, &id);
221 rec = db->fetch_locked(db, talloc_tos(),
222 make_tdb_data(id_buf,
223 sizeof(id_buf)));
224 if (rec == NULL) {
225 DEBUG(0, ("store_acl_blob_fsp_tdb: fetch_lock failed\n"));
226 return NT_STATUS_INTERNAL_DB_CORRUPTION;
227 }
228 data.dptr = pblob->data;
229 data.dsize = pblob->length;
230 return rec->store(rec, data, 0);
231}
232
233/*********************************************************************
234 On unlink we need to delete the tdb record (if using tdb).
235*********************************************************************/
236
237static int unlink_acl_tdb(vfs_handle_struct *handle,
238 const struct smb_filename *smb_fname)
239{
240 struct smb_filename *smb_fname_tmp = NULL;
241 struct db_context *db = acl_db;
242 NTSTATUS status;
243 int ret = -1;
244
245 status = copy_smb_filename(talloc_tos(), smb_fname, &smb_fname_tmp);
246 if (!NT_STATUS_IS_OK(status)) {
247 errno = map_errno_from_nt_status(status);
248 goto out;
249 }
250
251 if (lp_posix_pathnames()) {
252 ret = SMB_VFS_LSTAT(handle->conn, smb_fname_tmp);
253 } else {
254 ret = SMB_VFS_STAT(handle->conn, smb_fname_tmp);
255 }
256
257 if (ret == -1) {
258 goto out;
259 }
260
261 ret = unlink_acl_common(handle, smb_fname_tmp);
262
263 if (ret == -1) {
264 goto out;
265 }
266
267 acl_tdb_delete(handle, db, &smb_fname_tmp->st);
268 out:
269 return ret;
270}
271
272/*********************************************************************
273 On rmdir we need to delete the tdb record (if using tdb).
274*********************************************************************/
275
276static int rmdir_acl_tdb(vfs_handle_struct *handle, const char *path)
277{
278
279 SMB_STRUCT_STAT sbuf;
280 struct db_context *db = acl_db;
281 int ret = -1;
282
283 if (lp_posix_pathnames()) {
284 ret = vfs_lstat_smb_fname(handle->conn, path, &sbuf);
285 } else {
286 ret = vfs_stat_smb_fname(handle->conn, path, &sbuf);
287 }
288
289 if (ret == -1) {
290 return -1;
291 }
292
293 ret = rmdir_acl_common(handle, path);
294 if (ret == -1) {
295 return -1;
296 }
297
298 acl_tdb_delete(handle, db, &sbuf);
299 return 0;
300}
301
302/*******************************************************************
303 Handle opening the storage tdb if so configured.
304*******************************************************************/
305
306static int connect_acl_tdb(struct vfs_handle_struct *handle,
307 const char *service,
308 const char *user)
309{
310 int ret = SMB_VFS_NEXT_CONNECT(handle, service, user);
311
312 if (ret < 0) {
313 return ret;
314 }
315
316 if (!acl_tdb_init()) {
317 SMB_VFS_NEXT_DISCONNECT(handle);
318 return -1;
319 }
320
321 /* Ensure we have the parameters correct if we're
322 * using this module. */
323 DEBUG(2,("connect_acl_tdb: setting 'inherit acls = true' "
324 "'dos filemode = true' and "
325 "'force unknown acl user = true' for service %s\n",
326 service ));
327
328 lp_do_parameter(SNUM(handle->conn), "inherit acls", "true");
329 lp_do_parameter(SNUM(handle->conn), "dos filemode", "true");
330 lp_do_parameter(SNUM(handle->conn), "force unknown acl user", "true");
331
332 return 0;
333}
334
335/*********************************************************************
336 Remove a Windows ACL - we're setting the underlying POSIX ACL.
337*********************************************************************/
338
339static int sys_acl_set_file_tdb(vfs_handle_struct *handle,
340 const char *path,
341 SMB_ACL_TYPE_T type,
342 SMB_ACL_T theacl)
343{
344 SMB_STRUCT_STAT sbuf;
345 struct db_context *db = acl_db;
346 int ret = -1;
347
348 if (lp_posix_pathnames()) {
349 ret = vfs_lstat_smb_fname(handle->conn, path, &sbuf);
350 } else {
351 ret = vfs_stat_smb_fname(handle->conn, path, &sbuf);
352 }
353
354 if (ret == -1) {
355 return -1;
356 }
357
358 ret = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle,
359 path,
360 type,
361 theacl);
362 if (ret == -1) {
363 return -1;
364 }
365
366 acl_tdb_delete(handle, db, &sbuf);
367 return 0;
368}
369
370/*********************************************************************
371 Remove a Windows ACL - we're setting the underlying POSIX ACL.
372*********************************************************************/
373
374static int sys_acl_set_fd_tdb(vfs_handle_struct *handle,
375 files_struct *fsp,
376 SMB_ACL_T theacl)
377{
378 struct db_context *db = acl_db;
379 NTSTATUS status;
380 int ret;
381
382 status = vfs_stat_fsp(fsp);
383 if (!NT_STATUS_IS_OK(status)) {
384 return -1;
385 }
386
387 ret = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle,
388 fsp,
389 theacl);
390 if (ret == -1) {
391 return -1;
392 }
393
394 acl_tdb_delete(handle, db, &fsp->fsp_name->st);
395 return 0;
396}
397
398static struct vfs_fn_pointers vfs_acl_tdb_fns = {
399 .connect_fn = connect_acl_tdb,
400 .disconnect = disconnect_acl_tdb,
401 .opendir = opendir_acl_common,
402 .mkdir = mkdir_acl_common,
403 .rmdir = rmdir_acl_tdb,
404 .open_fn = open_acl_common,
405 .create_file = create_file_acl_common,
406 .unlink = unlink_acl_tdb,
407 .chmod = chmod_acl_module_common,
408 .fchmod = fchmod_acl_module_common,
409 .fget_nt_acl = fget_nt_acl_common,
410 .get_nt_acl = get_nt_acl_common,
411 .fset_nt_acl = fset_nt_acl_common,
412 .chmod_acl = chmod_acl_acl_module_common,
413 .fchmod_acl = fchmod_acl_acl_module_common,
414 .sys_acl_set_file = sys_acl_set_file_tdb,
415 .sys_acl_set_fd = sys_acl_set_fd_tdb
416};
417
418NTSTATUS vfs_acl_tdb_init(void)
419{
420 return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "acl_tdb",
421 &vfs_acl_tdb_fns);
422}
Note: See TracBrowser for help on using the repository browser.