The branch, master has been updated
via 4c1527b s3:modules remove gpfs_getacl_alloc
via 18bfcac s3:modules use vfs_gpfs_getacl in gpfsacl_get_posix_acl
via 5388773 s3:modules use vfs_gpfs_getacl in
gpfsacl_set_nt_acl_internal
via 16940d8 s3:modules use vfs_gpfs_getacl in gpfs_get_nfs4_acl
via 940b7ec s3:torture/vfstest add memreport option
via 8e571fd s3:torture/vfstest implement sys_acl_blob_get_fd
via de67655 s3:torture/vfstest implement sys_acl_blob_get_file
via 0621991 s3:vfs_gpfs use non_posix_sys_acl_blob_get_*_helper
via f1ff845 s3:vfs_gpfs add a generic vfs_gpfs_getacl function
via d9075e1 s3:modules/vfs_gpfs add GPFS_GETACL_NATIVE define
via b4be8d5 s3:modules/non_posix_acls: only stat if we do not have it
cached
via 7cd91ca s3:autoconf add non_posix_acls to NFS4ACL_OBJ
via ea6ac28 s3:autoconf introduce NFS4ACL_OBJ
via d7ad24a s3-waf:modules add non_posix_acls dependency to vfs_gpfs
via 2a2dbf8 vfs: Add helper function for non posix ACL modules
via e650a5f idl: Provide a common wrapper for the data to hash for a
non-POSIX ACL
via a133a98 selftest: add a test that demonstrates how new ACL blob
code helps
via f0e49b0 vfs_acl_common: Do not fetch the underlying NT ACL unless
we need it
via 4e8c895 vfs: Whitespace fix only to get_nt_acl_internal indentation
via 25526ed vfs: Implement an improved vfs_acl_common that uses the
hash of the system ACL
via 6a5f65b vfs: Add helper function hash_blob_sha256 to
vfs_acl_common.c
from 5a8e049 Fix typo in warning message
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 4c1527b1ce26759dbb7470b23f9f83a391d99b30
Author: Christian Ambach <a...@samba.org>
Date: Tue Jan 8 17:10:27 2013 +0100
s3:modules remove gpfs_getacl_alloc
last caller has gone
Signed-off-by: Christian Ambach <a...@samba.org>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
Autobuild-User(master): Andrew Bartlett <abart...@samba.org>
Autobuild-Date(master): Mon Feb 4 14:10:08 CET 2013 on sn-devel-104
commit 18bfcac810bed431d0ca33ad02508fd87df1c626
Author: Christian Ambach <a...@samba.org>
Date: Tue Jan 8 17:10:10 2013 +0100
s3:modules use vfs_gpfs_getacl in gpfsacl_get_posix_acl
as preparation to remove gpfs_getacl_alloc()
Signed-off-by: Christian Ambach <a...@samba.org>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit 5388773d4baf902d8dd70d046cacc5a15fa790d7
Author: Christian Ambach <a...@samba.org>
Date: Tue Jan 8 17:07:09 2013 +0100
s3:modules use vfs_gpfs_getacl in gpfsacl_set_nt_acl_internal
as preparation to remove gpfs_getacl_alloc()
Signed-off-by: Christian Ambach <a...@samba.org>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit 16940d8a8ecb46a6de9cf5c83da7d2f54030777b
Author: Christian Ambach <a...@samba.org>
Date: Tue Jan 8 16:54:16 2013 +0100
s3:modules use vfs_gpfs_getacl in gpfs_get_nfs4_acl
as preparation to remove gpfs_getacl_alloc()
Signed-off-by: Christian Ambach <a...@samba.org>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit 940b7ec78c50c41a399bee2775cd008618baf8f8
Author: Christian Ambach <a...@samba.org>
Date: Fri Nov 16 22:58:06 2012 +0100
s3:torture/vfstest add memreport option
this will run a talloc_report_full on the talloc stackframe after each
command
Signed-off-by: Christian Ambach <a...@samba.org>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit 8e571fd385334bc12ee5c5bdfd32b31ad2c4b4b8
Author: Christian Ambach <a...@samba.org>
Date: Thu Nov 15 15:25:52 2012 +0100
s3:torture/vfstest implement sys_acl_blob_get_fd
Signed-off-by: Christian Ambach <a...@samba.org>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit de676555ab882bd110a2649555645d58abe2bfeb
Author: Christian Ambach <a...@samba.org>
Date: Thu Nov 15 15:19:07 2012 +0100
s3:torture/vfstest implement sys_acl_blob_get_file
Signed-off-by: Christian Ambach <a...@samba.org>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit 06219913abc4f1c3912b377b4a9521a11ad45886
Author: Christian Ambach <a...@samba.org>
Date: Tue Oct 30 13:44:40 2012 +0100
s3:vfs_gpfs use non_posix_sys_acl_blob_get_*_helper
use the helper functions to return the blob based on the
raw GPFS ACL blob (if it is a NFSv4 ACL). If not, fall back
to the POSIX ACL code
Signed-off-by: Christian Ambach <a...@samba.org>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit f1ff845720604fc32788a59ec9a1a128135efe35
Author: Christian Ambach <a...@samba.org>
Date: Mon Nov 5 19:26:57 2012 +0100
s3:vfs_gpfs add a generic vfs_gpfs_getacl function
in contrast to gpfs_getacl_alloc which always puts the
ACL on talloc_tos(), this one allows to specify the memory
context and if the caller is interested in the raw ACL blob
or a structured version
Signed-off-by: Christian Ambach <a...@samba.org>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit d9075e19ca8c788824208ee1d77ad5861fe778ed
Author: Christian Ambach <a...@samba.org>
Date: Tue Jan 8 15:15:02 2013 +0100
s3:modules/vfs_gpfs add GPFS_GETACL_NATIVE define
this is not in the official GPFS header file, but can be found
in the GPL'd kernel module sources
Signed-off-by: Christian Ambach <a...@samba.org>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit b4be8d5073c0476f1220569f7151f267a5c39635
Author: Christian Ambach <a...@samba.org>
Date: Tue Oct 30 13:43:59 2012 +0100
s3:modules/non_posix_acls: only stat if we do not have it cached
most probably we already have the stat() information
Signed-off-by: Christian Ambach <a...@samba.org>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit 7cd91ca0c4acdb8ae1e5d5319d9d934d74ff4c74
Author: Christian Ambach <a...@samba.org>
Date: Tue Oct 30 10:47:22 2012 +0100
s3:autoconf add non_posix_acls to NFS4ACL_OBJ
Signed-off-by: Christian Ambach <a...@samba.org>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit ea6ac284cb974b0443000aa75b36d20d0d6814d8
Author: Christian Ambach <a...@samba.org>
Date: Tue Oct 30 10:45:23 2012 +0100
s3:autoconf introduce NFS4ACL_OBJ
use a definition instead of listing it separately
Signed-off-by: Christian Ambach <a...@samba.org>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit d7ad24a3e7e498ec1e4cff1093f85116846397f6
Author: Christian Ambach <a...@samba.org>
Date: Tue Jan 8 17:56:50 2013 +0100
s3-waf:modules add non_posix_acls dependency to vfs_gpfs
Signed-off-by: Christian Ambach <a...@samba.org>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit 2a2dbf825972bfa16ae5dbe93e458de348571684
Author: Andrew Bartlett <abart...@samba.org>
Date: Wed Oct 24 22:39:59 2012 +1100
vfs: Add helper function for non posix ACL modules
This handles the stat, and fills in the pre-supplied blob into a
wrapper sturcture that can then be returned to vfs_acl_common for
hashing.
Andrew Bartlett
Signed-off-by: Andrew Bartlett <abart...@samba.org>
Reviewed-by: Christian Ambach <a...@samba.org>
commit e650a5fd61d7925888e3abf0a561af5a9a23f00b
Author: Andrew Bartlett <abart...@samba.org>
Date: Wed Oct 24 17:06:33 2012 +1100
idl: Provide a common wrapper for the data to hash for a non-POSIX ACL
Signed-off-by: Andrew Bartlett <abart...@samba.org>
Reviewed-by: Christian Ambach <a...@samba.org>
commit a133a989c319bfba18ea8b204716d8e362e28f80
Author: Christian Ambach <a...@samba.org>
Date: Wed Jan 30 11:00:48 2013 +0100
selftest: add a test that demonstrates how new ACL blob code helps
this test shows that a change to POSIX ACL->SD mapping behavior does not
invalidate the stored SD
Signed-off-by: Christian Ambach <a...@samba.org>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit f0e49b015bfcb021aea61615185d9da57538c68d
Author: Andrew Bartlett <abart...@samba.org>
Date: Wed Oct 24 17:03:41 2012 +1100
vfs_acl_common: Do not fetch the underlying NT ACL unless we need it
This avoids asking for the posix ACL on disk twice, and avoids running
a good deal of mapping code if it is not needed.
Andrew Bartlett
Signed-off-by: Andrew Bartlett <abart...@samba.org>
Reviewed-by: Christian Ambach <a...@samba.org>
commit 4e8c8952ad8f4d1d658b947da2f1264bfeff8fdf
Author: Andrew Bartlett <abart...@samba.org>
Date: Mon Jan 21 12:45:14 2013 +1100
vfs: Whitespace fix only to get_nt_acl_internal indentation
Signed-off-by: Andrew Bartlett <abart...@samba.org>
Reviewed-by: Christian Ambach <a...@samba.org>
commit 25526ed3f590e4fa90c237a37f08bb23f449dd8c
Author: Andrew Bartlett <abart...@samba.org>
Date: Wed Oct 10 16:36:47 2012 +1100
vfs: Implement an improved vfs_acl_common that uses the hash of the system
ACL
Where supported by the system ACL backend, this avoids hashing the
result of the ACL mapping, instead hashing the original ACL,
linearlised.
For maximum robustness, the hash of the NT and system ACL are stored,
along with the time and a description of the system ACL. This variety
of extra metadata may assist some future implementation in determining
which hash to validate.
Andrew Bartlett
Signed-off-by: Andrew Bartlett <abart...@samba.org>
Reviewed-by: Christian Ambach <a...@samba.org>
commit 6a5f65b0e971f068ebae5b2f93a6dfccfaa93b26
Author: Andrew Bartlett <abart...@samba.org>
Date: Mon Jan 21 12:43:00 2013 +1100
vfs: Add helper function hash_blob_sha256 to vfs_acl_common.c
Signed-off-by: Andrew Bartlett <abart...@samba.org>
Reviewed-by: Christian Ambach <a...@samba.org>
-----------------------------------------------------------------------
Summary of changes:
librpc/idl/xattr.idl | 12 +
source3/Makefile.in | 8 +-
source3/modules/non_posix_acls.c | 106 +++++
.../modules/non_posix_acls.h | 20 +-
source3/modules/vfs_acl_common.c | 437 +++++++++++++++-----
source3/modules/vfs_gpfs.c | 222 ++++++++---
source3/modules/vfs_gpfs.h | 4 +
source3/modules/wscript_build | 7 +-
source3/torture/cmd_vfs.c | 77 ++++
source3/torture/vfstest.c | 8 +
source4/scripting/python/samba/tests/posixacl.py | 17 +
11 files changed, 754 insertions(+), 164 deletions(-)
create mode 100644 source3/modules/non_posix_acls.c
copy file_server/file_server.h => source3/modules/non_posix_acls.h (61%)
Changeset truncated at 500 lines:
diff --git a/librpc/idl/xattr.idl b/librpc/idl/xattr.idl
index f7e6984..b4c1b98 100644
--- a/librpc/idl/xattr.idl
+++ b/librpc/idl/xattr.idl
@@ -207,4 +207,16 @@ interface xattr
uint16 version;
[switch_is(version)] xattr_NTACL_Info info;
} xattr_NTACL;
+
+ /*
+ * A wrapper of the common information required to be in the
+ * hash of the ACL, for the acl_xattr and acl_tdb modules.
+ */
+ [public] typedef struct {
+ DATA_BLOB acl_as_blob;
+ uid_t owner;
+ gid_t group;
+ mode_t mode;
+ } xattr_sys_acl_hash_wrapper;
+
}
diff --git a/source3/Makefile.in b/source3/Makefile.in
index 80cb27c..35199e9 100644
--- a/source3/Makefile.in
+++ b/source3/Makefile.in
@@ -853,6 +853,8 @@ NOTIFY_OBJ = smbd/notify.o smbd/notify_inotify.o
smbd/notify_internal.o \
FNAME_UTIL_OBJ = lib/filename_util.o
+NFS4ACL_OBJ = modules/nfs4_acls.o modules/non_posix_acls.o
+
VFS_DEFAULT_OBJ = modules/vfs_default.o
VFS_AUDIT_OBJ = modules/vfs_audit.o
VFS_EXTD_AUDIT_OBJ = modules/vfs_extd_audit.o
@@ -871,9 +873,9 @@ VFS_AFSACL_OBJ = modules/vfs_afsacl.o
VFS_XATTR_TDB_OBJ = modules/vfs_xattr_tdb.o lib/xattr_tdb.o
VFS_POSIXACL_OBJ = modules/vfs_posixacl.o
VFS_AIXACL_OBJ = modules/vfs_aixacl.o modules/vfs_aixacl_util.o
-VFS_AIXACL2_OBJ = modules/vfs_aixacl2.o modules/vfs_aixacl_util.o
modules/nfs4_acls.o
+VFS_AIXACL2_OBJ = modules/vfs_aixacl2.o modules/vfs_aixacl_util.o
$(NFS4ACL_OBJ)
VFS_SOLARISACL_OBJ = modules/vfs_solarisacl.o
-VFS_ZFSACL_OBJ = modules/vfs_zfsacl.o modules/nfs4_acls.o
+VFS_ZFSACL_OBJ = modules/vfs_zfsacl.o $(NFS4ACL_OBJ)
VFS_HPUXACL_OBJ = modules/vfs_hpuxacl.o
VFS_TRU64ACL_OBJ = modules/vfs_tru64acl.o
VFS_CATIA_OBJ = modules/vfs_catia.o
@@ -882,7 +884,7 @@ VFS_STREAMS_DEPOT_OBJ = modules/vfs_streams_depot.o
VFS_CACHEPRIME_OBJ = modules/vfs_cacheprime.o
VFS_PREALLOC_OBJ = modules/vfs_prealloc.o
VFS_COMMIT_OBJ = modules/vfs_commit.o
-VFS_GPFS_OBJ = modules/vfs_gpfs.o modules/gpfs.o modules/nfs4_acls.o
+VFS_GPFS_OBJ = modules/vfs_gpfs.o modules/gpfs.o $(NFS4ACL_OBJ)
VFS_NOTIFY_FAM_OBJ = modules/vfs_notify_fam.o
VFS_READAHEAD_OBJ = modules/vfs_readahead.o
VFS_TSMSM_OBJ = modules/vfs_tsmsm.o
diff --git a/source3/modules/non_posix_acls.c b/source3/modules/non_posix_acls.c
new file mode 100644
index 0000000..6c1dfbf
--- /dev/null
+++ b/source3/modules/non_posix_acls.c
@@ -0,0 +1,106 @@
+/*
+ Unix SMB/CIFS implementation.
+ Access Control List handling
+ Copyright (C) Andrew Bartlett 2012.
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "../librpc/gen_ndr/ndr_xattr.h"
+#include "modules/non_posix_acls.h"
+
+int non_posix_sys_acl_blob_get_file_helper(vfs_handle_struct *handle,
+ const char *path_p,
+ DATA_BLOB acl_as_blob,
+ TALLOC_CTX *mem_ctx,
+ DATA_BLOB *blob)
+{
+ int ret;
+ TALLOC_CTX *frame = talloc_stackframe();
+ struct xattr_sys_acl_hash_wrapper acl_wrapper = {};
+ struct smb_filename *smb_fname = NULL;
+ NTSTATUS status = create_synthetic_smb_fname_split(frame, path_p,
+ NULL,
+ &smb_fname);
+ if (!NT_STATUS_IS_OK(status)) {
+ errno = map_errno_from_nt_status(status);
+ TALLOC_FREE(frame);
+ return -1;
+ }
+
+ acl_wrapper.acl_as_blob = acl_as_blob;
+
+ ret = smb_vfs_call_stat(handle, smb_fname);
+ if (ret == -1) {
+ TALLOC_FREE(frame);
+ return -1;
+ }
+
+ acl_wrapper.owner = smb_fname->st.st_ex_uid;
+ acl_wrapper.group = smb_fname->st.st_ex_gid;
+ acl_wrapper.mode = smb_fname->st.st_ex_mode;
+
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_push_struct_blob(blob, mem_ctx,
+ &acl_wrapper,
+
(ndr_push_flags_fn_t)ndr_push_xattr_sys_acl_hash_wrapper))) {
+ errno = EINVAL;
+ TALLOC_FREE(frame);
+ return -1;
+ }
+
+ TALLOC_FREE(frame);
+ return 0;
+}
+
+int non_posix_sys_acl_blob_get_fd_helper(vfs_handle_struct *handle,
+ files_struct *fsp,
+ DATA_BLOB acl_as_blob,
+ TALLOC_CTX *mem_ctx,
+ DATA_BLOB *blob)
+{
+ SMB_STRUCT_STAT sbuf;
+ TALLOC_CTX *frame;
+ struct xattr_sys_acl_hash_wrapper acl_wrapper;
+ int ret;
+
+ frame = talloc_stackframe();
+
+ acl_wrapper.acl_as_blob = acl_as_blob;
+
+ if (!VALID_STAT(fsp->fsp_name->st)) {
+ ret = smb_vfs_call_fstat(handle, fsp, &sbuf);
+ if (ret == -1) {
+ TALLOC_FREE(frame);
+ return -1;
+ }
+ } else {
+ sbuf = fsp->fsp_name->st;
+ }
+
+ acl_wrapper.owner = sbuf.st_ex_uid;
+ acl_wrapper.group = sbuf.st_ex_gid;
+ acl_wrapper.mode = sbuf.st_ex_mode;
+
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_push_struct_blob(blob, mem_ctx,
+ &acl_wrapper,
+
(ndr_push_flags_fn_t)ndr_push_xattr_sys_acl_hash_wrapper))) {
+ errno = EINVAL;
+ TALLOC_FREE(frame);
+ return -1;
+ }
+
+ TALLOC_FREE(frame);
+ return 0;
+}
diff --git a/file_server/file_server.h b/source3/modules/non_posix_acls.h
similarity index 61%
copy from file_server/file_server.h
copy to source3/modules/non_posix_acls.h
index 7da9437..6567a31 100644
--- a/file_server/file_server.h
+++ b/source3/modules/non_posix_acls.h
@@ -1,9 +1,7 @@
/*
Unix SMB/CIFS implementation.
-
- run s3 file server within Samba4
-
- Copyright (C) Andrew Tridgell 2011
+ Access Control List handling
+ Copyright (C) Andrew Bartlett 2012.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -19,7 +17,13 @@
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
-/*
- open the s3 smb server sockets
-*/
-void s3_smbd_task_init(struct task_server *task);
+int non_posix_sys_acl_blob_get_file_helper(vfs_handle_struct *handle,
+ const char *path_p,
+ DATA_BLOB acl_as_blob,
+ TALLOC_CTX *mem_ctx,
+ DATA_BLOB *blob);
+int non_posix_sys_acl_blob_get_fd_helper(vfs_handle_struct *handle,
+ files_struct *fsp,
+ DATA_BLOB acl_as_blob,
+ TALLOC_CTX *mem_ctx,
+ DATA_BLOB *blob);
diff --git a/source3/modules/vfs_acl_common.c b/source3/modules/vfs_acl_common.c
index 4e3aa72..57fc6c8 100644
--- a/source3/modules/vfs_acl_common.c
+++ b/source3/modules/vfs_acl_common.c
@@ -49,11 +49,28 @@ static NTSTATUS store_acl_blob_fsp(vfs_handle_struct
*handle,
Hash a security descriptor.
*******************************************************************/
+static NTSTATUS hash_blob_sha256(DATA_BLOB blob,
+ uint8_t *hash)
+{
+ SHA256_CTX tctx;
+
+ memset(hash, '\0', XATTR_SD_HASH_SIZE);
+
+ samba_SHA256_Init(&tctx);
+ samba_SHA256_Update(&tctx, blob.data, blob.length);
+ samba_SHA256_Final(hash, &tctx);
+
+ return NT_STATUS_OK;
+}
+
+/*******************************************************************
+ Hash a security descriptor.
+*******************************************************************/
+
static NTSTATUS hash_sd_sha256(struct security_descriptor *psd,
uint8_t *hash)
{
DATA_BLOB blob;
- SHA256_CTX tctx;
NTSTATUS status;
memset(hash, '\0', XATTR_SD_HASH_SIZE);
@@ -61,12 +78,7 @@ static NTSTATUS hash_sd_sha256(struct security_descriptor
*psd,
if (!NT_STATUS_IS_OK(status)) {
return status;
}
-
- samba_SHA256_Init(&tctx);
- samba_SHA256_Update(&tctx, blob.data, blob.length);
- samba_SHA256_Final(hash, &tctx);
-
- return NT_STATUS_OK;
+ return hash_blob_sha256(blob, hash);
}
/*******************************************************************
@@ -75,9 +87,11 @@ static NTSTATUS hash_sd_sha256(struct security_descriptor
*psd,
static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
TALLOC_CTX *mem_ctx,
- struct security_descriptor **ppdesc,
- uint16_t *p_hash_type,
- uint8_t hash[XATTR_SD_HASH_SIZE])
+ struct security_descriptor **ppdesc,
+ uint16_t *p_hash_type,
+ uint16_t *p_version,
+ uint8_t hash[XATTR_SD_HASH_SIZE],
+ uint8_t sys_acl_hash[XATTR_SD_HASH_SIZE])
{
struct xattr_NTACL xacl;
enum ndr_err_code ndr_err;
@@ -94,6 +108,8 @@ static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
return ndr_map_error2ntstatus(ndr_err);
}
+ *p_version = xacl.version;
+
switch (xacl.version) {
case 1:
*ppdesc = make_sec_desc(mem_ctx, SD_REVISION,
@@ -128,9 +144,22 @@ static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
xacl.info.sd_hs3->sd->dacl,
&sd_size);
*p_hash_type = xacl.info.sd_hs3->hash_type;
- /* Current version 3. */
+ /* Current version 3 (if no sys acl hash available). */
memcpy(hash, xacl.info.sd_hs3->hash,
XATTR_SD_HASH_SIZE);
break;
+ case 4:
+ *ppdesc = make_sec_desc(mem_ctx, SD_REVISION,
+ xacl.info.sd_hs4->sd->type |
SEC_DESC_SELF_RELATIVE,
+ xacl.info.sd_hs4->sd->owner_sid,
+ xacl.info.sd_hs4->sd->group_sid,
+ xacl.info.sd_hs4->sd->sacl,
+ xacl.info.sd_hs4->sd->dacl,
+ &sd_size);
+ *p_hash_type = xacl.info.sd_hs4->hash_type;
+ /* Current version 4. */
+ memcpy(hash, xacl.info.sd_hs4->hash,
XATTR_SD_HASH_SIZE);
+ memcpy(sys_acl_hash, xacl.info.sd_hs4->sys_acl_hash,
XATTR_SD_HASH_SIZE);
+ break;
default:
TALLOC_FREE(frame);
return NT_STATUS_REVISION_MISMATCH;
@@ -142,7 +171,8 @@ static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
}
/*******************************************************************
- Create a DATA_BLOB from a security descriptor.
+ Create a DATA_BLOB from a hash of the security descriptor storead at
+ the system layer and the NT ACL we wish to preserve
*******************************************************************/
static NTSTATUS create_acl_blob(const struct security_descriptor *psd,
@@ -178,6 +208,52 @@ static NTSTATUS create_acl_blob(const struct
security_descriptor *psd,
}
/*******************************************************************
+ Create a DATA_BLOB from a hash of the security descriptors
+ (system and NT) stored at the system layer and the NT ACL we wish
+ to preserve.
+*******************************************************************/
+
+static NTSTATUS create_sys_acl_blob(const struct security_descriptor *psd,
+ DATA_BLOB *pblob,
+ uint16_t hash_type,
+ uint8_t hash[XATTR_SD_HASH_SIZE],
+ const char *description,
+ uint8_t sys_acl_hash[XATTR_SD_HASH_SIZE])
+{
+ struct xattr_NTACL xacl;
+ struct security_descriptor_hash_v4 sd_hs4;
+ enum ndr_err_code ndr_err;
+ TALLOC_CTX *ctx = talloc_tos();
+ NTTIME nttime_now;
+ struct timeval now = timeval_current();
+ nttime_now = timeval_to_nttime(&now);
+
+ ZERO_STRUCT(xacl);
+ ZERO_STRUCT(sd_hs4);
+
+ xacl.version = 4;
+ xacl.info.sd_hs4 = &sd_hs4;
+ xacl.info.sd_hs4->sd = discard_const_p(struct security_descriptor, psd);
+ xacl.info.sd_hs4->hash_type = hash_type;
+ memcpy(&xacl.info.sd_hs4->hash[0], hash, XATTR_SD_HASH_SIZE);
+ xacl.info.sd_hs4->description = description;
+ xacl.info.sd_hs4->time = nttime_now;
+ memcpy(&xacl.info.sd_hs4->sys_acl_hash[0], sys_acl_hash,
XATTR_SD_HASH_SIZE);
+
+ ndr_err = ndr_push_struct_blob(
+ pblob, ctx, &xacl,
+ (ndr_push_flags_fn_t)ndr_push_xattr_NTACL);
+
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ DEBUG(5, ("create_acl_blob: ndr_push_xattr_NTACL failed: %s\n",
+ ndr_errstr(ndr_err)));
+ return ndr_map_error2ntstatus(ndr_err);
+ }
+
+ return NT_STATUS_OK;
+}
+
+/*******************************************************************
Add in 3 inheritable components for a non-inheritable directory ACL.
CREATOR_OWNER/CREATOR_GROUP/WORLD.
*******************************************************************/
@@ -286,23 +362,27 @@ static NTSTATUS
add_directory_inheritable_components(vfs_handle_struct *handle,
*******************************************************************/
static NTSTATUS get_nt_acl_internal(vfs_handle_struct *handle,
- files_struct *fsp,
- const char *name,
- uint32_t security_info,
- TALLOC_CTX *mem_ctx,
+ files_struct *fsp,
+ const char *name,
+ uint32_t security_info,
+ TALLOC_CTX *mem_ctx,
struct security_descriptor **ppdesc)
{
DATA_BLOB blob = data_blob_null;
NTSTATUS status;
uint16_t hash_type = XATTR_SD_HASH_TYPE_NONE;
+ uint16_t xattr_version = 0;
uint8_t hash[XATTR_SD_HASH_SIZE];
+ uint8_t sys_acl_hash[XATTR_SD_HASH_SIZE];
uint8_t hash_tmp[XATTR_SD_HASH_SIZE];
+ uint8_t sys_acl_hash_tmp[XATTR_SD_HASH_SIZE];
struct security_descriptor *psd = NULL;
struct security_descriptor *pdesc_next = NULL;
bool ignore_file_system_acl = lp_parm_bool(SNUM(handle->conn),
ACL_MODULE_NAME,
"ignore system acls",
false);
+ TALLOC_CTX *frame = talloc_stackframe();
if (fsp && name == NULL) {
name = fsp->fsp_name->base_name;
@@ -310,100 +390,212 @@ static NTSTATUS get_nt_acl_internal(vfs_handle_struct
*handle,
DEBUG(10, ("get_nt_acl_internal: name=%s\n", name));
- /* Get the full underlying sd for the hash
- or to return as backup. */
- if (fsp) {
- status = SMB_VFS_NEXT_FGET_NT_ACL(handle,
- fsp,
- HASH_SECURITY_INFO,
- mem_ctx,
- &pdesc_next);
- } else {
- status = SMB_VFS_NEXT_GET_NT_ACL(handle,
- name,
- HASH_SECURITY_INFO,
- mem_ctx,
- &pdesc_next);
- }
-
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(10, ("get_nt_acl_internal: get_next_acl for file %s "
- "returned %s\n",
- name,
- nt_errstr(status)));
- return status;
- }
-
- status = get_acl_blob(talloc_tos(), handle, fsp, name, &blob);
+ status = get_acl_blob(frame, handle, fsp, name, &blob);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(10, ("get_nt_acl_internal: get_acl_blob returned %s\n",
nt_errstr(status)));
- psd = pdesc_next;
+ psd = NULL;
goto out;
+ } else {
+ status = parse_acl_blob(&blob, mem_ctx, &psd,
+ &hash_type, &xattr_version, &hash[0],
&sys_acl_hash[0]);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(10, ("parse_acl_blob returned %s\n",
+ nt_errstr(status)));
+ psd = NULL;
+ goto out;
+ }
}
- status = parse_acl_blob(&blob, mem_ctx, &psd,
- &hash_type, &hash[0]);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(10, ("parse_acl_blob returned %s\n",
- nt_errstr(status)));
- psd = pdesc_next;
+ /* Ensure we don't leak psd if we don't choose it.
+ *
+ * We don't allocate it onto frame as it is preferred not to
+ * steal from a talloc pool.
+ */
+ talloc_steal(frame, psd);
+
+ /* determine which type of xattr we got */
+ switch (xattr_version) {
+ case 1:
+ case 2:
+ /* These xattr types are unilatteral, they do not
+ * require confirmation of the hash. In particular,
+ * the NTVFS file server uses version 1, but
+ * 'samba-tool ntacl' can set these as well */
goto out;
- }
-
- /* Ensure the hash type is one we know. */
- switch (hash_type) {
- case XATTR_SD_HASH_TYPE_NONE:
- /* No hash, just return blob sd. */
- goto out;
- case XATTR_SD_HASH_TYPE_SHA256:
- break;
- default:
- DEBUG(10, ("get_nt_acl_internal: ACL blob revision "
- "mismatch (%u) for file %s\n",
- (unsigned int)hash_type,
- name));
- TALLOC_FREE(psd);
- psd = pdesc_next;
+ case 3:
+ case 4:
+ if (ignore_file_system_acl) {
goto out;
- }
+ }
- if (ignore_file_system_acl) {
+ break;
+ default:
+ DEBUG(10, ("get_nt_acl_internal: ACL blob revision "
+ "mismatch (%u) for file %s\n",
+ (unsigned int)hash_type,
+ name));
+ TALLOC_FREE(psd);
+ psd = NULL;
goto out;
}
- status = hash_sd_sha256(pdesc_next, hash_tmp);
--
Samba Shared Repository
