4 * Copyright (C) International Business Machines Corp., 2007
5 * Author(s): Steve French (sfrench@us.ibm.com)
7 * Contains the routines for mapping CIFS/NTFS ACLs
9 * This library is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU Lesser General Public License as published
11 * by the Free Software Foundation; either version 2.1 of the License, or
12 * (at your option) any later version.
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
17 * the GNU Lesser General Public License for more details.
19 * You should have received a copy of the GNU Lesser General Public License
20 * along with this library; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
28 #include "cifsproto.h"
29 #include "cifs_debug.h"
32 #ifdef CONFIG_CIFS_EXPERIMENTAL
34 static struct cifs_wksid wksidarr[NUM_WK_SIDS] = {
35 {{1, 0, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0} }, "null user"},
36 {{1, 1, {0, 0, 0, 0, 0, 1}, {0, 0, 0, 0, 0} }, "nobody"},
37 {{1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(11), 0, 0, 0, 0} }, "net-users"},
38 {{1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(18), 0, 0, 0, 0} }, "sys"},
39 {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(544), 0, 0, 0} }, "root"},
40 {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(545), 0, 0, 0} }, "users"},
41 {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(546), 0, 0, 0} }, "guest"} }
45 /* security id for everyone */
46 static const struct cifs_sid sid_everyone = {
47 1, 1, {0, 0, 0, 0, 0, 1}, {0} };
49 static const struct cifs_sid sid_user =
50 {1, 2 , {0, 0, 0, 0, 0, 5}, {} };
53 int match_sid(struct cifs_sid *ctsid)
56 int num_subauth, num_sat, num_saw;
57 struct cifs_sid *cwsid;
62 for (i = 0; i < NUM_WK_SIDS; ++i) {
63 cwsid = &(wksidarr[i].cifssid);
65 /* compare the revision */
66 if (ctsid->revision != cwsid->revision)
69 /* compare all of the six auth values */
70 for (j = 0; j < 6; ++j) {
71 if (ctsid->authority[j] != cwsid->authority[j])
75 continue; /* all of the auth values did not match */
77 /* compare all of the subauth values if any */
78 num_sat = ctsid->num_subauth;
79 num_saw = cwsid->num_subauth;
80 num_subauth = num_sat < num_saw ? num_sat : num_saw;
82 for (j = 0; j < num_subauth; ++j) {
83 if (ctsid->sub_auth[j] != cwsid->sub_auth[j])
87 continue; /* all sub_auth values do not match */
90 cFYI(1, ("matching sid: %s\n", wksidarr[i].sidname));
91 return (0); /* sids compare/match */
94 cFYI(1, ("No matching sid"));
98 /* if the two SIDs (roughly equivalent to a UUID for a user or group) are
99 the same returns 1, if they do not match returns 0 */
100 int compare_sids(const struct cifs_sid *ctsid, const struct cifs_sid *cwsid)
103 int num_subauth, num_sat, num_saw;
105 if ((!ctsid) || (!cwsid))
108 /* compare the revision */
109 if (ctsid->revision != cwsid->revision)
112 /* compare all of the six auth values */
113 for (i = 0; i < 6; ++i) {
114 if (ctsid->authority[i] != cwsid->authority[i])
118 /* compare all of the subauth values if any */
119 num_sat = ctsid->num_subauth;
120 num_saw = cwsid->num_subauth;
121 num_subauth = num_sat < num_saw ? num_sat : num_saw;
123 for (i = 0; i < num_subauth; ++i) {
124 if (ctsid->sub_auth[i] != cwsid->sub_auth[i])
129 return (1); /* sids compare/match */
133 change posix mode to reflect permissions
134 pmode is the existing mode (we only want to overwrite part of this
135 bits to set can be: S_IRWXU, S_IRWXG or S_IRWXO ie 00700 or 00070 or 00007
137 static void access_flags_to_mode(__u32 ace_flags, int type, umode_t *pmode,
138 umode_t *pbits_to_set)
140 /* the order of ACEs is important. The canonical order is to begin with
141 DENY entries then follow with ALLOW, otherwise an allow entry could be
142 encountered first, making the subsequent deny entry like "dead code"
143 which would be superflous since Windows stops when a match is made
144 for the operation you are trying to perform for your user */
146 /* For deny ACEs we change the mask so that subsequent allow access
147 control entries do not turn on the bits we are denying */
148 if (type == ACCESS_DENIED) {
149 if (ace_flags & GENERIC_ALL) {
150 *pbits_to_set &= ~S_IRWXUGO;
152 if ((ace_flags & GENERIC_WRITE) ||
153 ((ace_flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS))
154 *pbits_to_set &= ~S_IWUGO;
155 if ((ace_flags & GENERIC_READ) ||
156 ((ace_flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS))
157 *pbits_to_set &= ~S_IRUGO;
158 if ((ace_flags & GENERIC_EXECUTE) ||
159 ((ace_flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS))
160 *pbits_to_set &= ~S_IXUGO;
162 } else if (type != ACCESS_ALLOWED) {
163 cERROR(1, ("unknown access control type %d", type));
166 /* else ACCESS_ALLOWED type */
168 if (ace_flags & GENERIC_ALL) {
169 *pmode |= (S_IRWXUGO & (*pbits_to_set));
170 #ifdef CONFIG_CIFS_DEBUG2
171 cFYI(1, ("all perms"));
175 if ((ace_flags & GENERIC_WRITE) ||
176 ((ace_flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS))
177 *pmode |= (S_IWUGO & (*pbits_to_set));
178 if ((ace_flags & GENERIC_READ) ||
179 ((ace_flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS))
180 *pmode |= (S_IRUGO & (*pbits_to_set));
181 if ((ace_flags & GENERIC_EXECUTE) ||
182 ((ace_flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS))
183 *pmode |= (S_IXUGO & (*pbits_to_set));
185 #ifdef CONFIG_CIFS_DEBUG2
186 cFYI(1, ("access flags 0x%x mode now 0x%x", ace_flags, *pmode));
192 #ifdef CONFIG_CIFS_DEBUG2
193 static void dump_ace(struct cifs_ace *pace, char *end_of_acl)
197 /* validate that we do not go past end of acl */
199 if (le16_to_cpu(pace->size) < 16) {
200 cERROR(1, ("ACE too small, %d", le16_to_cpu(pace->size)));
204 if (end_of_acl < (char *)pace + le16_to_cpu(pace->size)) {
205 cERROR(1, ("ACL too small to parse ACE"));
209 num_subauth = pace->sid.num_subauth;
212 cFYI(1, ("ACE revision %d num_auth %d type %d flags %d size %d",
213 pace->sid.revision, pace->sid.num_subauth, pace->type,
214 pace->flags, pace->size));
215 for (i = 0; i < num_subauth; ++i) {
216 cFYI(1, ("ACE sub_auth[%d]: 0x%x", i,
217 le32_to_cpu(pace->sid.sub_auth[i])));
220 /* BB add length check to make sure that we do not have huge
221 num auths and therefore go off the end */
229 static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
230 struct cifs_sid *pownersid, struct cifs_sid *pgrpsid,
237 struct cifs_ace **ppace;
239 /* BB need to add parm so we can store the SID BB */
241 /* validate that we do not go past end of acl */
242 if (end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size)) {
243 cERROR(1, ("ACL too small to parse DACL"));
247 #ifdef CONFIG_CIFS_DEBUG2
248 cFYI(1, ("DACL revision %d size %d num aces %d",
249 le16_to_cpu(pdacl->revision), le16_to_cpu(pdacl->size),
250 le32_to_cpu(pdacl->num_aces)));
253 /* reset rwx permissions for user/group/other.
254 Also, if num_aces is 0 i.e. DACL has no ACEs,
255 user/group/other have no permissions */
256 inode->i_mode &= ~(S_IRWXUGO);
259 /* no DACL in the security descriptor, set
260 all the permissions for user/group/other */
261 inode->i_mode |= S_IRWXUGO;
264 acl_base = (char *)pdacl;
265 acl_size = sizeof(struct cifs_acl);
267 num_aces = le32_to_cpu(pdacl->num_aces);
269 umode_t user_mask = S_IRWXU;
270 umode_t group_mask = S_IRWXG;
271 umode_t other_mask = S_IRWXO;
273 ppace = kmalloc(num_aces * sizeof(struct cifs_ace *),
276 /* cifscred->cecount = pdacl->num_aces;
277 cifscred->aces = kmalloc(num_aces *
278 sizeof(struct cifs_ace *), GFP_KERNEL);*/
280 for (i = 0; i < num_aces; ++i) {
281 ppace[i] = (struct cifs_ace *) (acl_base + acl_size);
282 #ifdef CONFIG_CIFS_DEBUG2
283 dump_ace(ppace[i], end_of_acl);
285 if (compare_sids(&(ppace[i]->sid), pownersid))
286 access_flags_to_mode(ppace[i]->access_req,
290 if (compare_sids(&(ppace[i]->sid), pgrpsid))
291 access_flags_to_mode(ppace[i]->access_req,
295 if (compare_sids(&(ppace[i]->sid), &sid_everyone))
296 access_flags_to_mode(ppace[i]->access_req,
301 /* memcpy((void *)(&(cifscred->aces[i])),
303 sizeof(struct cifs_ace)); */
305 acl_base = (char *)ppace[i];
306 acl_size = le16_to_cpu(ppace[i]->size);
316 static int parse_sid(struct cifs_sid *psid, char *end_of_acl)
318 /* BB need to add parm so we can store the SID BB */
320 /* validate that we do not go past end of ACL - sid must be at least 8
321 bytes long (assuming no sub-auths - e.g. the null SID */
322 if (end_of_acl < (char *)psid + 8) {
323 cERROR(1, ("ACL too small to parse SID %p", psid));
327 if (psid->num_subauth) {
328 #ifdef CONFIG_CIFS_DEBUG2
330 cFYI(1, ("SID revision %d num_auth %d",
331 psid->revision, psid->num_subauth));
333 for (i = 0; i < psid->num_subauth; i++) {
334 cFYI(1, ("SID sub_auth[%d]: 0x%x ", i,
335 le32_to_cpu(psid->sub_auth[i])));
338 /* BB add length check to make sure that we do not have huge
339 num auths and therefore go off the end */
341 le32_to_cpu(psid->sub_auth[psid->num_subauth-1])));
349 /* Convert CIFS ACL to POSIX form */
350 static int parse_sec_desc(struct cifs_ntsd *pntsd, int acl_len,
354 struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
355 struct cifs_acl *dacl_ptr; /* no need for SACL ptr */
356 char *end_of_acl = ((char *)pntsd) + acl_len;
359 if ((inode == NULL) || (pntsd == NULL))
362 owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
363 le32_to_cpu(pntsd->osidoffset));
364 group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
365 le32_to_cpu(pntsd->gsidoffset));
366 dacloffset = le32_to_cpu(pntsd->dacloffset);
367 dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset);
368 #ifdef CONFIG_CIFS_DEBUG2
369 cFYI(1, ("revision %d type 0x%x ooffset 0x%x goffset 0x%x "
370 "sacloffset 0x%x dacloffset 0x%x",
371 pntsd->revision, pntsd->type, le32_to_cpu(pntsd->osidoffset),
372 le32_to_cpu(pntsd->gsidoffset),
373 le32_to_cpu(pntsd->sacloffset), dacloffset));
375 /* cifs_dump_mem("owner_sid: ", owner_sid_ptr, 64); */
376 rc = parse_sid(owner_sid_ptr, end_of_acl);
380 rc = parse_sid(group_sid_ptr, end_of_acl);
385 parse_dacl(dacl_ptr, end_of_acl, owner_sid_ptr,
386 group_sid_ptr, inode);
388 cFYI(1, ("no ACL")); /* BB grant all or default perms? */
390 /* cifscred->uid = owner_sid_ptr->rid;
391 cifscred->gid = group_sid_ptr->rid;
392 memcpy((void *)(&(cifscred->osid)), (void *)owner_sid_ptr,
393 sizeof(struct cifs_sid));
394 memcpy((void *)(&(cifscred->gsid)), (void *)group_sid_ptr,
395 sizeof(struct cifs_sid)); */
402 /* Retrieve an ACL from the server */
403 static struct cifs_ntsd *get_cifs_acl(u32 *pacllen, struct inode *inode,
406 struct cifsFileInfo *open_file;
407 int unlock_file = FALSE;
411 struct super_block *sb;
412 struct cifs_sb_info *cifs_sb;
413 struct cifs_ntsd *pntsd = NULL;
415 cFYI(1, ("get mode from ACL for %s", path));
421 open_file = find_readable_file(CIFS_I(inode));
427 cifs_sb = CIFS_SB(sb);
431 fid = open_file->netfid;
435 rc = CIFSSMBOpen(xid, cifs_sb->tcon, path, FILE_OPEN,
436 READ_CONTROL, 0, &fid, &oplock, NULL,
437 cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
438 CIFS_MOUNT_MAP_SPECIAL_CHR);
440 cERROR(1, ("Unable to open file to get ACL"));
446 rc = CIFSSMBGetCIFSACL(xid, cifs_sb->tcon, fid, &pntsd, pacllen);
447 cFYI(1, ("GetCIFSACL rc = %d ACL len %d", rc, *pacllen));
448 if (unlock_file == TRUE)
449 atomic_dec(&open_file->wrtPending);
451 CIFSSMBClose(xid, cifs_sb->tcon, fid);
457 /* Translate the CIFS ACL (simlar to NTFS ACL) for a file into mode bits */
458 void acl_to_uid_mode(struct inode *inode, const char *path)
460 struct cifs_ntsd *pntsd = NULL;
464 #ifdef CONFIG_CIFS_DEBUG2
465 cFYI(1, ("converting ACL to mode for %s", path));
467 pntsd = get_cifs_acl(&acllen, inode, path);
469 /* if we can retrieve the ACL, now parse Access Control Entries, ACEs */
471 rc = parse_sec_desc(pntsd, acllen, inode);
473 cFYI(1, ("parse sec desc failed rc = %d", rc));
479 /* Convert mode bits to an ACL so we can update the ACL on the server */
480 int mode_to_acl(struct inode *inode, const char *path)
484 struct cifs_ntsd *pntsd = NULL;
486 cFYI(1, ("set ACL from mode for %s", path));
488 /* Get the security descriptor */
489 pntsd = get_cifs_acl(&acllen, inode, path);
491 /* Add/Modify the three ACEs for owner, group, everyone
492 while retaining the other ACEs */
494 /* Set the security descriptor */
500 #endif /* CONFIG_CIFS_EXPERIMENTAL */