static NTSTATUS get_nt_acl_xattr_internal(vfs_handle_struct *handle, files_struct *fsp, const char *name, uint32 security_info, struct security_descriptor **ppdesc) { TALLOC_CTX *ctx = talloc_tos(); DATA_BLOB blob; NTSTATUS status; if (fsp && name == NULL) { name = fsp->fsp_name; } DEBUG(10, ("get_nt_acl_xattr_internal: name=%s\n", name)); status = get_acl_blob(ctx, handle, fsp, name, &blob); if (!NT_STATUS_IS_OK(status)) { DEBUG(10, ("get_acl_blob returned %s\n", nt_errstr(status))); return status; } status = parse_acl_blob(&blob, security_info, ppdesc); if (!NT_STATUS_IS_OK(status)) { DEBUG(10, ("parse_acl_blob returned %s\n", nt_errstr(status))); return status; } TALLOC_FREE(blob.data); return status; }
static NTSTATUS get_nt_acl_internal(vfs_handle_struct *handle, files_struct *fsp, const char *name, uint32_t security_info, struct security_descriptor **ppdesc) { DATA_BLOB blob; NTSTATUS status; uint16_t hash_type; uint8_t hash[XATTR_SD_HASH_SIZE]; uint8_t hash_tmp[XATTR_SD_HASH_SIZE]; struct security_descriptor *psd = NULL; struct security_descriptor *pdesc_next = NULL; if (fsp && name == NULL) { name = fsp->fsp_name->base_name; } DEBUG(10, ("get_nt_acl_internal: name=%s\n", name)); /* Get the full underlying sd for the hash or to return as backup. */ if (fsp) { status = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, HASH_SECURITY_INFO, &pdesc_next); } else { status = SMB_VFS_NEXT_GET_NT_ACL(handle, name, HASH_SECURITY_INFO, &pdesc_next); } if (!NT_STATUS_IS_OK(status)) { DEBUG(10, ("get_nt_acl_internal: get_next_acl for file %s " "returned %s\n", name, nt_errstr(status))); return status; } status = get_acl_blob(talloc_tos(), handle, fsp, name, &blob); if (!NT_STATUS_IS_OK(status)) { DEBUG(10, ("get_nt_acl_internal: get_acl_blob returned %s\n", nt_errstr(status))); psd = pdesc_next; goto out; } status = parse_acl_blob(&blob, &psd, &hash_type, &hash[0]); if (!NT_STATUS_IS_OK(status)) { DEBUG(10, ("parse_acl_blob returned %s\n", nt_errstr(status))); psd = pdesc_next; goto out; } /* Ensure the hash type is one we know. */ switch (hash_type) { case XATTR_SD_HASH_TYPE_NONE: /* No hash, just return blob sd. */ goto out; case XATTR_SD_HASH_TYPE_SHA256: break; default: DEBUG(10, ("get_nt_acl_internal: ACL blob revision " "mismatch (%u) for file %s\n", (unsigned int)hash_type, name)); TALLOC_FREE(psd); psd = pdesc_next; goto out; } status = hash_sd_sha256(pdesc_next, hash_tmp); if (!NT_STATUS_IS_OK(status)) { TALLOC_FREE(psd); psd = pdesc_next; goto out; } if (memcmp(&hash[0], &hash_tmp[0], XATTR_SD_HASH_SIZE) == 0) { /* Hash matches, return blob sd. */ goto out; } /* Hash doesn't match, return underlying sd. */ TALLOC_FREE(psd); psd = pdesc_next; out: if (psd != pdesc_next) { /* We're returning the blob, throw * away the filesystem SD. */ TALLOC_FREE(pdesc_next); } else { SMB_STRUCT_STAT sbuf; SMB_STRUCT_STAT *psbuf = &sbuf; bool is_directory = false; /* * We're returning the underlying ACL from the * filesystem. If it's a directory, and has no * inheritable ACE entries we have to fake them. */ if (fsp) { is_directory = fsp->is_directory; psbuf = &fsp->fsp_name->st; } else { if (vfs_stat_smb_fname(handle->conn, name, &sbuf) == 0) { is_directory = S_ISDIR(sbuf.st_ex_mode); } } if (is_directory && !sd_has_inheritable_components(psd, true)) { add_directory_inheritable_components(handle, name, psbuf, psd); } } if (!(security_info & OWNER_SECURITY_INFORMATION)) { psd->owner_sid = NULL; } if (!(security_info & GROUP_SECURITY_INFORMATION)) { psd->group_sid = NULL; } if (!(security_info & DACL_SECURITY_INFORMATION)) { psd->dacl = NULL; } if (!(security_info & SACL_SECURITY_INFORMATION)) { psd->sacl = NULL; } TALLOC_FREE(blob.data); *ppdesc = psd; return NT_STATUS_OK; }
static NTSTATUS get_nt_acl_internal(vfs_handle_struct *handle, files_struct *fsp, const char *name, uint32_t security_info, struct security_descriptor **ppdesc) { DATA_BLOB blob = data_blob_null; NTSTATUS status; uint16_t hash_type = XATTR_SD_HASH_TYPE_NONE; uint8_t hash[XATTR_SD_HASH_SIZE]; uint8_t hash_tmp[XATTR_SD_HASH_SIZE]; struct security_descriptor *psd = NULL; struct security_descriptor *pdesc_next = NULL; bool ignore_file_system_acl = lp_parm_bool(SNUM(handle->conn), ACL_MODULE_NAME, "ignore system acls", false); if (fsp && name == NULL) { name = fsp->fsp_name->base_name; } DEBUG(10, ("get_nt_acl_internal: name=%s\n", name)); /* Get the full underlying sd for the hash or to return as backup. */ if (fsp) { status = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, HASH_SECURITY_INFO, &pdesc_next); } else { status = SMB_VFS_NEXT_GET_NT_ACL(handle, name, HASH_SECURITY_INFO, &pdesc_next); } if (!NT_STATUS_IS_OK(status)) { DEBUG(10, ("get_nt_acl_internal: get_next_acl for file %s " "returned %s\n", name, nt_errstr(status))); return status; } status = get_acl_blob(talloc_tos(), handle, fsp, name, &blob); if (!NT_STATUS_IS_OK(status)) { DEBUG(10, ("get_nt_acl_internal: get_acl_blob returned %s\n", nt_errstr(status))); psd = pdesc_next; goto out; } status = parse_acl_blob(&blob, &psd, &hash_type, &hash[0]); if (!NT_STATUS_IS_OK(status)) { DEBUG(10, ("parse_acl_blob returned %s\n", nt_errstr(status))); psd = pdesc_next; goto out; } /* Ensure the hash type is one we know. */ switch (hash_type) { case XATTR_SD_HASH_TYPE_NONE: /* No hash, just return blob sd. */ goto out; case XATTR_SD_HASH_TYPE_SHA256: break; default: DEBUG(10, ("get_nt_acl_internal: ACL blob revision " "mismatch (%u) for file %s\n", (unsigned int)hash_type, name)); TALLOC_FREE(psd); psd = pdesc_next; goto out; } if (ignore_file_system_acl) { goto out; } status = hash_sd_sha256(pdesc_next, hash_tmp); if (!NT_STATUS_IS_OK(status)) { TALLOC_FREE(psd); psd = pdesc_next; goto out; } if (memcmp(&hash[0], &hash_tmp[0], XATTR_SD_HASH_SIZE) == 0) { /* Hash matches, return blob sd. */ DEBUG(10, ("get_nt_acl_internal: blob hash " "matches for file %s\n", name )); goto out; } /* Hash doesn't match, return underlying sd. */ TALLOC_FREE(psd); psd = pdesc_next; out: if (psd != pdesc_next) { /* We're returning the blob, throw * away the filesystem SD. */ TALLOC_FREE(pdesc_next); } else { SMB_STRUCT_STAT sbuf; SMB_STRUCT_STAT *psbuf = &sbuf; bool is_directory = false; /* * We're returning the underlying ACL from the * filesystem. If it's a directory, and has no * inheritable ACE entries we have to fake them. */ if (fsp) { status = vfs_stat_fsp(fsp); if (!NT_STATUS_IS_OK(status)) { return status; } psbuf = &fsp->fsp_name->st; } else { int ret = vfs_stat_smb_fname(handle->conn, name, &sbuf); if (ret == -1) { return map_nt_error_from_unix(errno); } } is_directory = S_ISDIR(psbuf->st_ex_mode); if (ignore_file_system_acl) { TALLOC_FREE(pdesc_next); status = make_default_filesystem_acl(talloc_tos(), name, psbuf, &psd); if (!NT_STATUS_IS_OK(status)) { return status; } } else { if (is_directory && !sd_has_inheritable_components(psd, true)) { add_directory_inheritable_components(handle, name, psbuf, psd); } /* The underlying POSIX module always sets the ~SEC_DESC_DACL_PROTECTED bit, as ACLs can't be inherited in this way under POSIX. Remove it for Windows-style ACLs. */ psd->type &= ~SEC_DESC_DACL_PROTECTED; } } if (!(security_info & SECINFO_OWNER)) { psd->owner_sid = NULL; } if (!(security_info & SECINFO_GROUP)) { psd->group_sid = NULL; } if (!(security_info & SECINFO_DACL)) { psd->type &= ~SEC_DESC_DACL_PRESENT; psd->dacl = NULL; } if (!(security_info & SECINFO_SACL)) { psd->type &= ~SEC_DESC_SACL_PRESENT; psd->sacl = NULL; } TALLOC_FREE(blob.data); *ppdesc = psd; if (DEBUGLEVEL >= 10) { DEBUG(10,("get_nt_acl_internal: returning acl for %s is:\n", name )); NDR_PRINT_DEBUG(security_descriptor, psd); } return NT_STATUS_OK; }