static NTSTATUS get_nt_acl_internal(vfs_handle_struct *handle,
files_struct *fsp,
const char *name,
uint32_t security_info,
struct security_descriptor **ppdesc)
{
DATA_BLOB blob;
NTSTATUS status;
uint16_t hash_type;
uint8_t hash[XATTR_SD_HASH_SIZE];
uint8_t hash_tmp[XATTR_SD_HASH_SIZE];
struct security_descriptor *psd = NULL;
struct security_descriptor *pdesc_next = NULL;
if (fsp && name == NULL) {
name = fsp->fsp_name->base_name;
}
DEBUG(10, ("get_nt_acl_internal: name=%s\n", name));
/* Get the full underlying sd for the hash
or to return as backup. */
if (fsp) {
status = SMB_VFS_NEXT_FGET_NT_ACL(handle,
fsp,
HASH_SECURITY_INFO,
&pdesc_next);
} else {
status = SMB_VFS_NEXT_GET_NT_ACL(handle,
name,
HASH_SECURITY_INFO,
&pdesc_next);
}
if (!NT_STATUS_IS_OK(status)) {
DEBUG(10, ("get_nt_acl_internal: get_next_acl for file %s "
"returned %s\n",
name,
nt_errstr(status)));
return status;
}
status = get_acl_blob(talloc_tos(), handle, fsp, name, &blob);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(10, ("get_nt_acl_internal: get_acl_blob returned %s\n",
nt_errstr(status)));
psd = pdesc_next;
goto out;
}
status = parse_acl_blob(&blob, &psd,
&hash_type, &hash[0]);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(10, ("parse_acl_blob returned %s\n",
nt_errstr(status)));
psd = pdesc_next;
goto out;
}
/* Ensure the hash type is one we know. */
switch (hash_type) {
case XATTR_SD_HASH_TYPE_NONE:
/* No hash, just return blob sd. */
goto out;
case XATTR_SD_HASH_TYPE_SHA256:
break;
default:
DEBUG(10, ("get_nt_acl_internal: ACL blob revision "
"mismatch (%u) for file %s\n",
(unsigned int)hash_type,
name));
TALLOC_FREE(psd);
psd = pdesc_next;
goto out;
}
status = hash_sd_sha256(pdesc_next, hash_tmp);
if (!NT_STATUS_IS_OK(status)) {
TALLOC_FREE(psd);
psd = pdesc_next;
goto out;
}
if (memcmp(&hash[0], &hash_tmp[0], XATTR_SD_HASH_SIZE) == 0) {
/* Hash matches, return blob sd. */
goto out;
}
/* Hash doesn't match, return underlying sd. */
TALLOC_FREE(psd);
psd = pdesc_next;
out:
if (psd != pdesc_next) {
/* We're returning the blob, throw
* away the filesystem SD. */
TALLOC_FREE(pdesc_next);
} else {
SMB_STRUCT_STAT sbuf;
SMB_STRUCT_STAT *psbuf = &sbuf;
bool is_directory = false;
/*
* We're returning the underlying ACL from the
* filesystem. If it's a directory, and has no
* inheritable ACE entries we have to fake them.
*/
if (fsp) {
is_directory = fsp->is_directory;
psbuf = &fsp->fsp_name->st;
} else {
if (vfs_stat_smb_fname(handle->conn,
name,
&sbuf) == 0) {
is_directory = S_ISDIR(sbuf.st_ex_mode);
}
}
if (is_directory &&
!sd_has_inheritable_components(psd,
true)) {
add_directory_inheritable_components(handle,
name,
psbuf,
psd);
}
}
if (!(security_info & OWNER_SECURITY_INFORMATION)) {
psd->owner_sid = NULL;
}
if (!(security_info & GROUP_SECURITY_INFORMATION)) {
psd->group_sid = NULL;
}
if (!(security_info & DACL_SECURITY_INFORMATION)) {
psd->dacl = NULL;
}
if (!(security_info & SACL_SECURITY_INFORMATION)) {
psd->sacl = NULL;
}
TALLOC_FREE(blob.data);
*ppdesc = psd;
return NT_STATUS_OK;
}
static NTSTATUS get_nt_acl_internal(vfs_handle_struct *handle,
files_struct *fsp,
const char *name,
uint32_t security_info,
struct security_descriptor **ppdesc)
{
DATA_BLOB blob = data_blob_null;
NTSTATUS status;
uint16_t hash_type = XATTR_SD_HASH_TYPE_NONE;
uint8_t hash[XATTR_SD_HASH_SIZE];
uint8_t hash_tmp[XATTR_SD_HASH_SIZE];
struct security_descriptor *psd = NULL;
struct security_descriptor *pdesc_next = NULL;
bool ignore_file_system_acl = lp_parm_bool(SNUM(handle->conn),
ACL_MODULE_NAME,
"ignore system acls",
false);
if (fsp && name == NULL) {
name = fsp->fsp_name->base_name;
}
DEBUG(10, ("get_nt_acl_internal: name=%s\n", name));
/* Get the full underlying sd for the hash
or to return as backup. */
if (fsp) {
status = SMB_VFS_NEXT_FGET_NT_ACL(handle,
fsp,
HASH_SECURITY_INFO,
&pdesc_next);
} else {
status = SMB_VFS_NEXT_GET_NT_ACL(handle,
name,
HASH_SECURITY_INFO,
&pdesc_next);
}
if (!NT_STATUS_IS_OK(status)) {
DEBUG(10, ("get_nt_acl_internal: get_next_acl for file %s "
"returned %s\n",
name,
nt_errstr(status)));
return status;
}
status = get_acl_blob(talloc_tos(), handle, fsp, name, &blob);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(10, ("get_nt_acl_internal: get_acl_blob returned %s\n",
nt_errstr(status)));
psd = pdesc_next;
goto out;
}
status = parse_acl_blob(&blob, &psd,
&hash_type, &hash[0]);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(10, ("parse_acl_blob returned %s\n",
nt_errstr(status)));
psd = pdesc_next;
goto out;
}
/* Ensure the hash type is one we know. */
switch (hash_type) {
case XATTR_SD_HASH_TYPE_NONE:
/* No hash, just return blob sd. */
goto out;
case XATTR_SD_HASH_TYPE_SHA256:
break;
default:
DEBUG(10, ("get_nt_acl_internal: ACL blob revision "
"mismatch (%u) for file %s\n",
(unsigned int)hash_type,
name));
TALLOC_FREE(psd);
psd = pdesc_next;
goto out;
}
if (ignore_file_system_acl) {
goto out;
}
status = hash_sd_sha256(pdesc_next, hash_tmp);
if (!NT_STATUS_IS_OK(status)) {
TALLOC_FREE(psd);
psd = pdesc_next;
goto out;
}
if (memcmp(&hash[0], &hash_tmp[0], XATTR_SD_HASH_SIZE) == 0) {
/* Hash matches, return blob sd. */
DEBUG(10, ("get_nt_acl_internal: blob hash "
"matches for file %s\n",
name ));
goto out;
}
/* Hash doesn't match, return underlying sd. */
TALLOC_FREE(psd);
psd = pdesc_next;
out:
if (psd != pdesc_next) {
/* We're returning the blob, throw
* away the filesystem SD. */
TALLOC_FREE(pdesc_next);
} else {
SMB_STRUCT_STAT sbuf;
SMB_STRUCT_STAT *psbuf = &sbuf;
bool is_directory = false;
/*
* We're returning the underlying ACL from the
* filesystem. If it's a directory, and has no
* inheritable ACE entries we have to fake them.
*/
if (fsp) {
status = vfs_stat_fsp(fsp);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
psbuf = &fsp->fsp_name->st;
} else {
int ret = vfs_stat_smb_fname(handle->conn,
name,
&sbuf);
if (ret == -1) {
return map_nt_error_from_unix(errno);
}
}
is_directory = S_ISDIR(psbuf->st_ex_mode);
if (ignore_file_system_acl) {
TALLOC_FREE(pdesc_next);
status = make_default_filesystem_acl(talloc_tos(),
name,
psbuf,
&psd);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
} else {
if (is_directory &&
!sd_has_inheritable_components(psd,
true)) {
add_directory_inheritable_components(handle,
name,
psbuf,
psd);
}
/* The underlying POSIX module always sets
the ~SEC_DESC_DACL_PROTECTED bit, as ACLs
can't be inherited in this way under POSIX.
Remove it for Windows-style ACLs. */
psd->type &= ~SEC_DESC_DACL_PROTECTED;
}
}
if (!(security_info & SECINFO_OWNER)) {
psd->owner_sid = NULL;
}
if (!(security_info & SECINFO_GROUP)) {
psd->group_sid = NULL;
}
if (!(security_info & SECINFO_DACL)) {
psd->type &= ~SEC_DESC_DACL_PRESENT;
psd->dacl = NULL;
}
if (!(security_info & SECINFO_SACL)) {
psd->type &= ~SEC_DESC_SACL_PRESENT;
psd->sacl = NULL;
}
TALLOC_FREE(blob.data);
*ppdesc = psd;
if (DEBUGLEVEL >= 10) {
DEBUG(10,("get_nt_acl_internal: returning acl for %s is:\n",
name ));
NDR_PRINT_DEBUG(security_descriptor, psd);
}
return NT_STATUS_OK;
}