blob: 1403b5d86a739d67725e0dc94db1bec593e5ddab [file] [log] [blame]
Steve Frenchbcb02032007-09-25 16:17:24 +00001/*
2 * fs/cifs/cifsacl.c
3 *
Steve French8b1327f2008-03-14 22:37:16 +00004 * Copyright (C) International Business Machines Corp., 2007,2008
Steve Frenchbcb02032007-09-25 16:17:24 +00005 * Author(s): Steve French (sfrench@us.ibm.com)
6 *
7 * Contains the routines for mapping CIFS/NTFS ACLs
8 *
9 * This library is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU Lesser General Public License as published
11 * by the Free Software Foundation; either version 2.1 of the License, or
12 * (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
17 * the GNU Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public License
20 * along with this library; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 */
23
Steve French65874002007-09-25 19:53:44 +000024#include <linux/fs.h>
25#include "cifspdu.h"
26#include "cifsglob.h"
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +000027#include "cifsacl.h"
Steve French65874002007-09-25 19:53:44 +000028#include "cifsproto.h"
29#include "cifs_debug.h"
Steve French65874002007-09-25 19:53:44 +000030
Steve French297647c2007-10-12 04:11:59 +000031
32#ifdef CONFIG_CIFS_EXPERIMENTAL
33
Steve Frenchaf6f4612007-10-16 18:40:37 +000034static struct cifs_wksid wksidarr[NUM_WK_SIDS] = {
Steve French297647c2007-10-12 04:11:59 +000035 {{1, 0, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0} }, "null user"},
36 {{1, 1, {0, 0, 0, 0, 0, 1}, {0, 0, 0, 0, 0} }, "nobody"},
Jeff Layton536abdb2008-07-12 13:48:00 -070037 {{1, 1, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(11), 0, 0, 0, 0} }, "net-users"},
38 {{1, 1, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(18), 0, 0, 0, 0} }, "sys"},
39 {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(544), 0, 0, 0} }, "root"},
40 {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(545), 0, 0, 0} }, "users"},
41 {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(546), 0, 0, 0} }, "guest"} }
Steve French44093ca2007-10-23 21:22:55 +000042;
Steve French297647c2007-10-12 04:11:59 +000043
44
Steve Frenchbcb02032007-09-25 16:17:24 +000045/* security id for everyone */
Shirish Pargaonkare01b6402007-10-30 04:45:14 +000046static const struct cifs_sid sid_everyone = {
47 1, 1, {0, 0, 0, 0, 0, 1}, {0} };
Steve Frenchbcb02032007-09-25 16:17:24 +000048/* group users */
Steve Frenchad7a2922008-02-07 23:25:02 +000049static const struct cifs_sid sid_user = {1, 2 , {0, 0, 0, 0, 0, 5}, {} };
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +000050
Steve French297647c2007-10-12 04:11:59 +000051
52int match_sid(struct cifs_sid *ctsid)
53{
54 int i, j;
55 int num_subauth, num_sat, num_saw;
56 struct cifs_sid *cwsid;
57
58 if (!ctsid)
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +000059 return -1;
Steve French297647c2007-10-12 04:11:59 +000060
61 for (i = 0; i < NUM_WK_SIDS; ++i) {
62 cwsid = &(wksidarr[i].cifssid);
63
64 /* compare the revision */
65 if (ctsid->revision != cwsid->revision)
66 continue;
67
68 /* compare all of the six auth values */
69 for (j = 0; j < 6; ++j) {
70 if (ctsid->authority[j] != cwsid->authority[j])
71 break;
72 }
73 if (j < 6)
74 continue; /* all of the auth values did not match */
75
76 /* compare all of the subauth values if any */
Dave Kleikampce51ae12007-10-16 21:35:39 +000077 num_sat = ctsid->num_subauth;
78 num_saw = cwsid->num_subauth;
Steve French297647c2007-10-12 04:11:59 +000079 num_subauth = num_sat < num_saw ? num_sat : num_saw;
80 if (num_subauth) {
81 for (j = 0; j < num_subauth; ++j) {
82 if (ctsid->sub_auth[j] != cwsid->sub_auth[j])
83 break;
84 }
85 if (j < num_subauth)
86 continue; /* all sub_auth values do not match */
87 }
88
89 cFYI(1, ("matching sid: %s\n", wksidarr[i].sidname));
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +000090 return 0; /* sids compare/match */
Steve French297647c2007-10-12 04:11:59 +000091 }
92
93 cFYI(1, ("No matching sid"));
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +000094 return -1;
Steve French297647c2007-10-12 04:11:59 +000095}
96
Steve Frencha750e772007-10-17 22:50:39 +000097/* if the two SIDs (roughly equivalent to a UUID for a user or group) are
98 the same returns 1, if they do not match returns 0 */
Steve French630f3f02007-10-25 21:17:17 +000099int compare_sids(const struct cifs_sid *ctsid, const struct cifs_sid *cwsid)
Steve French297647c2007-10-12 04:11:59 +0000100{
101 int i;
102 int num_subauth, num_sat, num_saw;
103
104 if ((!ctsid) || (!cwsid))
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000105 return 0;
Steve French297647c2007-10-12 04:11:59 +0000106
107 /* compare the revision */
108 if (ctsid->revision != cwsid->revision)
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000109 return 0;
Steve French297647c2007-10-12 04:11:59 +0000110
111 /* compare all of the six auth values */
112 for (i = 0; i < 6; ++i) {
113 if (ctsid->authority[i] != cwsid->authority[i])
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000114 return 0;
Steve French297647c2007-10-12 04:11:59 +0000115 }
116
117 /* compare all of the subauth values if any */
Steve Frenchadbc0352007-10-17 02:12:46 +0000118 num_sat = ctsid->num_subauth;
Steve Frenchadddd492007-10-17 02:48:17 +0000119 num_saw = cwsid->num_subauth;
Steve French297647c2007-10-12 04:11:59 +0000120 num_subauth = num_sat < num_saw ? num_sat : num_saw;
121 if (num_subauth) {
122 for (i = 0; i < num_subauth; ++i) {
123 if (ctsid->sub_auth[i] != cwsid->sub_auth[i])
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000124 return 0;
Steve French297647c2007-10-12 04:11:59 +0000125 }
126 }
127
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000128 return 1; /* sids compare/match */
Steve French297647c2007-10-12 04:11:59 +0000129}
130
Steve French97837582007-12-31 07:47:21 +0000131
132/* copy ntsd, owner sid, and group sid from a security descriptor to another */
133static void copy_sec_desc(const struct cifs_ntsd *pntsd,
134 struct cifs_ntsd *pnntsd, __u32 sidsoffset)
135{
136 int i;
137
138 struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
139 struct cifs_sid *nowner_sid_ptr, *ngroup_sid_ptr;
140
141 /* copy security descriptor control portion */
142 pnntsd->revision = pntsd->revision;
143 pnntsd->type = pntsd->type;
144 pnntsd->dacloffset = cpu_to_le32(sizeof(struct cifs_ntsd));
145 pnntsd->sacloffset = 0;
146 pnntsd->osidoffset = cpu_to_le32(sidsoffset);
147 pnntsd->gsidoffset = cpu_to_le32(sidsoffset + sizeof(struct cifs_sid));
148
149 /* copy owner sid */
150 owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
151 le32_to_cpu(pntsd->osidoffset));
152 nowner_sid_ptr = (struct cifs_sid *)((char *)pnntsd + sidsoffset);
153
154 nowner_sid_ptr->revision = owner_sid_ptr->revision;
155 nowner_sid_ptr->num_subauth = owner_sid_ptr->num_subauth;
156 for (i = 0; i < 6; i++)
157 nowner_sid_ptr->authority[i] = owner_sid_ptr->authority[i];
158 for (i = 0; i < 5; i++)
159 nowner_sid_ptr->sub_auth[i] = owner_sid_ptr->sub_auth[i];
160
161 /* copy group sid */
162 group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
163 le32_to_cpu(pntsd->gsidoffset));
164 ngroup_sid_ptr = (struct cifs_sid *)((char *)pnntsd + sidsoffset +
165 sizeof(struct cifs_sid));
166
167 ngroup_sid_ptr->revision = group_sid_ptr->revision;
168 ngroup_sid_ptr->num_subauth = group_sid_ptr->num_subauth;
169 for (i = 0; i < 6; i++)
170 ngroup_sid_ptr->authority[i] = group_sid_ptr->authority[i];
171 for (i = 0; i < 5; i++)
Shirish Pargaonkarb1910ad2008-07-24 14:53:20 +0000172 ngroup_sid_ptr->sub_auth[i] = group_sid_ptr->sub_auth[i];
Steve French97837582007-12-31 07:47:21 +0000173
174 return;
175}
176
177
Steve French630f3f02007-10-25 21:17:17 +0000178/*
179 change posix mode to reflect permissions
180 pmode is the existing mode (we only want to overwrite part of this
181 bits to set can be: S_IRWXU, S_IRWXG or S_IRWXO ie 00700 or 00070 or 00007
182*/
Al Viro9b5e6852007-12-05 08:24:38 +0000183static void access_flags_to_mode(__le32 ace_flags, int type, umode_t *pmode,
Steve French15b03952007-11-08 17:57:40 +0000184 umode_t *pbits_to_set)
Steve French4879b442007-10-19 21:57:39 +0000185{
Al Viro9b5e6852007-12-05 08:24:38 +0000186 __u32 flags = le32_to_cpu(ace_flags);
Steve French15b03952007-11-08 17:57:40 +0000187 /* the order of ACEs is important. The canonical order is to begin with
Steve Frenchce06c9f2007-11-08 21:12:01 +0000188 DENY entries followed by ALLOW, otherwise an allow entry could be
Steve French15b03952007-11-08 17:57:40 +0000189 encountered first, making the subsequent deny entry like "dead code"
Steve Frenchce06c9f2007-11-08 21:12:01 +0000190 which would be superflous since Windows stops when a match is made
Steve French15b03952007-11-08 17:57:40 +0000191 for the operation you are trying to perform for your user */
192
193 /* For deny ACEs we change the mask so that subsequent allow access
194 control entries do not turn on the bits we are denying */
195 if (type == ACCESS_DENIED) {
Steve Frenchad7a2922008-02-07 23:25:02 +0000196 if (flags & GENERIC_ALL)
Steve French15b03952007-11-08 17:57:40 +0000197 *pbits_to_set &= ~S_IRWXUGO;
Steve Frenchad7a2922008-02-07 23:25:02 +0000198
Al Viro9b5e6852007-12-05 08:24:38 +0000199 if ((flags & GENERIC_WRITE) ||
200 ((flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS))
Steve French15b03952007-11-08 17:57:40 +0000201 *pbits_to_set &= ~S_IWUGO;
Al Viro9b5e6852007-12-05 08:24:38 +0000202 if ((flags & GENERIC_READ) ||
203 ((flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS))
Steve French15b03952007-11-08 17:57:40 +0000204 *pbits_to_set &= ~S_IRUGO;
Al Viro9b5e6852007-12-05 08:24:38 +0000205 if ((flags & GENERIC_EXECUTE) ||
206 ((flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS))
Steve French15b03952007-11-08 17:57:40 +0000207 *pbits_to_set &= ~S_IXUGO;
208 return;
209 } else if (type != ACCESS_ALLOWED) {
210 cERROR(1, ("unknown access control type %d", type));
211 return;
212 }
213 /* else ACCESS_ALLOWED type */
Steve French44093ca2007-10-23 21:22:55 +0000214
Al Viro9b5e6852007-12-05 08:24:38 +0000215 if (flags & GENERIC_ALL) {
Steve French15b03952007-11-08 17:57:40 +0000216 *pmode |= (S_IRWXUGO & (*pbits_to_set));
Steve French90c81e02008-02-12 20:32:36 +0000217 cFYI(DBG2, ("all perms"));
Steve Frenchd61e5802007-10-26 04:32:43 +0000218 return;
219 }
Al Viro9b5e6852007-12-05 08:24:38 +0000220 if ((flags & GENERIC_WRITE) ||
221 ((flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS))
Steve French15b03952007-11-08 17:57:40 +0000222 *pmode |= (S_IWUGO & (*pbits_to_set));
Al Viro9b5e6852007-12-05 08:24:38 +0000223 if ((flags & GENERIC_READ) ||
224 ((flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS))
Steve French15b03952007-11-08 17:57:40 +0000225 *pmode |= (S_IRUGO & (*pbits_to_set));
Al Viro9b5e6852007-12-05 08:24:38 +0000226 if ((flags & GENERIC_EXECUTE) ||
227 ((flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS))
Steve French15b03952007-11-08 17:57:40 +0000228 *pmode |= (S_IXUGO & (*pbits_to_set));
Steve Frenchd61e5802007-10-26 04:32:43 +0000229
Steve French90c81e02008-02-12 20:32:36 +0000230 cFYI(DBG2, ("access flags 0x%x mode now 0x%x", flags, *pmode));
Steve French630f3f02007-10-25 21:17:17 +0000231 return;
232}
233
Steve Frenchce06c9f2007-11-08 21:12:01 +0000234/*
235 Generate access flags to reflect permissions mode is the existing mode.
236 This function is called for every ACE in the DACL whose SID matches
237 with either owner or group or everyone.
238*/
239
240static void mode_to_access_flags(umode_t mode, umode_t bits_to_use,
241 __u32 *pace_flags)
242{
243 /* reset access mask */
244 *pace_flags = 0x0;
245
246 /* bits to use are either S_IRWXU or S_IRWXG or S_IRWXO */
247 mode &= bits_to_use;
248
249 /* check for R/W/X UGO since we do not know whose flags
250 is this but we have cleared all the bits sans RWX for
251 either user or group or other as per bits_to_use */
252 if (mode & S_IRUGO)
253 *pace_flags |= SET_FILE_READ_RIGHTS;
254 if (mode & S_IWUGO)
255 *pace_flags |= SET_FILE_WRITE_RIGHTS;
256 if (mode & S_IXUGO)
257 *pace_flags |= SET_FILE_EXEC_RIGHTS;
258
Steve French90c81e02008-02-12 20:32:36 +0000259 cFYI(DBG2, ("mode: 0x%x, access flags now 0x%x", mode, *pace_flags));
Steve Frenchce06c9f2007-11-08 21:12:01 +0000260 return;
261}
262
Al Viro2b210ad2008-03-29 03:09:18 +0000263static __u16 fill_ace_for_sid(struct cifs_ace *pntace,
Steve French97837582007-12-31 07:47:21 +0000264 const struct cifs_sid *psid, __u64 nmode, umode_t bits)
265{
266 int i;
267 __u16 size = 0;
268 __u32 access_req = 0;
269
270 pntace->type = ACCESS_ALLOWED;
271 pntace->flags = 0x0;
272 mode_to_access_flags(nmode, bits, &access_req);
273 if (!access_req)
274 access_req = SET_MINIMUM_RIGHTS;
275 pntace->access_req = cpu_to_le32(access_req);
276
277 pntace->sid.revision = psid->revision;
278 pntace->sid.num_subauth = psid->num_subauth;
279 for (i = 0; i < 6; i++)
280 pntace->sid.authority[i] = psid->authority[i];
281 for (i = 0; i < psid->num_subauth; i++)
282 pntace->sid.sub_auth[i] = psid->sub_auth[i];
283
284 size = 1 + 1 + 2 + 4 + 1 + 1 + 6 + (psid->num_subauth * 4);
285 pntace->size = cpu_to_le16(size);
286
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000287 return size;
Steve French97837582007-12-31 07:47:21 +0000288}
289
Steve French297647c2007-10-12 04:11:59 +0000290
Steve French953f8682007-10-31 04:54:42 +0000291#ifdef CONFIG_CIFS_DEBUG2
292static void dump_ace(struct cifs_ace *pace, char *end_of_acl)
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000293{
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000294 int num_subauth;
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000295
296 /* validate that we do not go past end of acl */
Steve French297647c2007-10-12 04:11:59 +0000297
Steve French44093ca2007-10-23 21:22:55 +0000298 if (le16_to_cpu(pace->size) < 16) {
299 cERROR(1, ("ACE too small, %d", le16_to_cpu(pace->size)));
300 return;
301 }
302
303 if (end_of_acl < (char *)pace + le16_to_cpu(pace->size)) {
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000304 cERROR(1, ("ACL too small to parse ACE"));
305 return;
Steve French44093ca2007-10-23 21:22:55 +0000306 }
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000307
Steve French44093ca2007-10-23 21:22:55 +0000308 num_subauth = pace->sid.num_subauth;
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000309 if (num_subauth) {
Steve French8f18c132007-10-12 18:54:12 +0000310 int i;
Steve French44093ca2007-10-23 21:22:55 +0000311 cFYI(1, ("ACE revision %d num_auth %d type %d flags %d size %d",
312 pace->sid.revision, pace->sid.num_subauth, pace->type,
Steve French97837582007-12-31 07:47:21 +0000313 pace->flags, le16_to_cpu(pace->size)));
Steve Frenchd12fd122007-10-03 19:43:19 +0000314 for (i = 0; i < num_subauth; ++i) {
315 cFYI(1, ("ACE sub_auth[%d]: 0x%x", i,
Steve French44093ca2007-10-23 21:22:55 +0000316 le32_to_cpu(pace->sid.sub_auth[i])));
Steve Frenchd12fd122007-10-03 19:43:19 +0000317 }
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000318
Steve Frenchd12fd122007-10-03 19:43:19 +0000319 /* BB add length check to make sure that we do not have huge
320 num auths and therefore go off the end */
Steve Frenchd12fd122007-10-03 19:43:19 +0000321 }
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000322
Steve Frenchd12fd122007-10-03 19:43:19 +0000323 return;
324}
Steve French953f8682007-10-31 04:54:42 +0000325#endif
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000326
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000327
Steve Frencha750e772007-10-17 22:50:39 +0000328static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
Steve Frenchd61e5802007-10-26 04:32:43 +0000329 struct cifs_sid *pownersid, struct cifs_sid *pgrpsid,
Steve French630f3f02007-10-25 21:17:17 +0000330 struct inode *inode)
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000331{
332 int i;
333 int num_aces = 0;
334 int acl_size;
335 char *acl_base;
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000336 struct cifs_ace **ppace;
337
338 /* BB need to add parm so we can store the SID BB */
339
Steve French2b834572007-11-25 10:01:00 +0000340 if (!pdacl) {
341 /* no DACL in the security descriptor, set
342 all the permissions for user/group/other */
343 inode->i_mode |= S_IRWXUGO;
344 return;
345 }
346
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000347 /* validate that we do not go past end of acl */
Steve Frenchaf6f4612007-10-16 18:40:37 +0000348 if (end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size)) {
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000349 cERROR(1, ("ACL too small to parse DACL"));
350 return;
351 }
352
Steve French90c81e02008-02-12 20:32:36 +0000353 cFYI(DBG2, ("DACL revision %d size %d num aces %d",
Steve Frenchaf6f4612007-10-16 18:40:37 +0000354 le16_to_cpu(pdacl->revision), le16_to_cpu(pdacl->size),
355 le32_to_cpu(pdacl->num_aces)));
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000356
Steve French7505e052007-11-01 18:03:01 +0000357 /* reset rwx permissions for user/group/other.
358 Also, if num_aces is 0 i.e. DACL has no ACEs,
359 user/group/other have no permissions */
360 inode->i_mode &= ~(S_IRWXUGO);
361
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000362 acl_base = (char *)pdacl;
363 acl_size = sizeof(struct cifs_acl);
364
Steve Frenchadbc0352007-10-17 02:12:46 +0000365 num_aces = le32_to_cpu(pdacl->num_aces);
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000366 if (num_aces > 0) {
Steve French15b03952007-11-08 17:57:40 +0000367 umode_t user_mask = S_IRWXU;
368 umode_t group_mask = S_IRWXG;
369 umode_t other_mask = S_IRWXO;
370
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000371 ppace = kmalloc(num_aces * sizeof(struct cifs_ace *),
372 GFP_KERNEL);
373
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000374 for (i = 0; i < num_aces; ++i) {
Steve French44093ca2007-10-23 21:22:55 +0000375 ppace[i] = (struct cifs_ace *) (acl_base + acl_size);
Steve French953f8682007-10-31 04:54:42 +0000376#ifdef CONFIG_CIFS_DEBUG2
377 dump_ace(ppace[i], end_of_acl);
378#endif
Shirish Pargaonkare01b6402007-10-30 04:45:14 +0000379 if (compare_sids(&(ppace[i]->sid), pownersid))
380 access_flags_to_mode(ppace[i]->access_req,
Steve French15b03952007-11-08 17:57:40 +0000381 ppace[i]->type,
382 &(inode->i_mode),
383 &user_mask);
Shirish Pargaonkare01b6402007-10-30 04:45:14 +0000384 if (compare_sids(&(ppace[i]->sid), pgrpsid))
385 access_flags_to_mode(ppace[i]->access_req,
Steve French15b03952007-11-08 17:57:40 +0000386 ppace[i]->type,
387 &(inode->i_mode),
388 &group_mask);
Shirish Pargaonkare01b6402007-10-30 04:45:14 +0000389 if (compare_sids(&(ppace[i]->sid), &sid_everyone))
390 access_flags_to_mode(ppace[i]->access_req,
Steve French15b03952007-11-08 17:57:40 +0000391 ppace[i]->type,
392 &(inode->i_mode),
393 &other_mask);
Shirish Pargaonkare01b6402007-10-30 04:45:14 +0000394
Steve French44093ca2007-10-23 21:22:55 +0000395/* memcpy((void *)(&(cifscred->aces[i])),
Steve Frenchd12fd122007-10-03 19:43:19 +0000396 (void *)ppace[i],
397 sizeof(struct cifs_ace)); */
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000398
Steve French44093ca2007-10-23 21:22:55 +0000399 acl_base = (char *)ppace[i];
400 acl_size = le16_to_cpu(ppace[i]->size);
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000401 }
402
403 kfree(ppace);
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000404 }
405
406 return;
407}
408
Steve Frenchbcb02032007-09-25 16:17:24 +0000409
Steve French97837582007-12-31 07:47:21 +0000410static int set_chmod_dacl(struct cifs_acl *pndacl, struct cifs_sid *pownersid,
411 struct cifs_sid *pgrpsid, __u64 nmode)
412{
Al Viro2b210ad2008-03-29 03:09:18 +0000413 u16 size = 0;
Steve French97837582007-12-31 07:47:21 +0000414 struct cifs_acl *pnndacl;
415
416 pnndacl = (struct cifs_acl *)((char *)pndacl + sizeof(struct cifs_acl));
417
418 size += fill_ace_for_sid((struct cifs_ace *) ((char *)pnndacl + size),
419 pownersid, nmode, S_IRWXU);
420 size += fill_ace_for_sid((struct cifs_ace *)((char *)pnndacl + size),
421 pgrpsid, nmode, S_IRWXG);
422 size += fill_ace_for_sid((struct cifs_ace *)((char *)pnndacl + size),
423 &sid_everyone, nmode, S_IRWXO);
424
425 pndacl->size = cpu_to_le16(size + sizeof(struct cifs_acl));
Shirish Pargaonkard9f382e2008-02-12 20:46:26 +0000426 pndacl->num_aces = cpu_to_le32(3);
Steve French97837582007-12-31 07:47:21 +0000427
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000428 return 0;
Steve French97837582007-12-31 07:47:21 +0000429}
430
431
Steve Frenchbcb02032007-09-25 16:17:24 +0000432static int parse_sid(struct cifs_sid *psid, char *end_of_acl)
433{
434 /* BB need to add parm so we can store the SID BB */
435
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000436 /* validate that we do not go past end of ACL - sid must be at least 8
437 bytes long (assuming no sub-auths - e.g. the null SID */
438 if (end_of_acl < (char *)psid + 8) {
439 cERROR(1, ("ACL too small to parse SID %p", psid));
Steve Frenchbcb02032007-09-25 16:17:24 +0000440 return -EINVAL;
441 }
Steve Frenchbcb02032007-09-25 16:17:24 +0000442
Steve Frenchaf6f4612007-10-16 18:40:37 +0000443 if (psid->num_subauth) {
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000444#ifdef CONFIG_CIFS_DEBUG2
Steve French8f18c132007-10-12 18:54:12 +0000445 int i;
Steve French44093ca2007-10-23 21:22:55 +0000446 cFYI(1, ("SID revision %d num_auth %d",
447 psid->revision, psid->num_subauth));
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000448
Steve Frenchaf6f4612007-10-16 18:40:37 +0000449 for (i = 0; i < psid->num_subauth; i++) {
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000450 cFYI(1, ("SID sub_auth[%d]: 0x%x ", i,
Steve French297647c2007-10-12 04:11:59 +0000451 le32_to_cpu(psid->sub_auth[i])));
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000452 }
453
Steve Frenchd12fd122007-10-03 19:43:19 +0000454 /* BB add length check to make sure that we do not have huge
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000455 num auths and therefore go off the end */
Steve Frenchd12fd122007-10-03 19:43:19 +0000456 cFYI(1, ("RID 0x%x",
Steve Frenchaf6f4612007-10-16 18:40:37 +0000457 le32_to_cpu(psid->sub_auth[psid->num_subauth-1])));
Steve Frenchbcb02032007-09-25 16:17:24 +0000458#endif
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000459 }
460
Steve Frenchbcb02032007-09-25 16:17:24 +0000461 return 0;
462}
463
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000464
Steve Frenchbcb02032007-09-25 16:17:24 +0000465/* Convert CIFS ACL to POSIX form */
Steve French630f3f02007-10-25 21:17:17 +0000466static int parse_sec_desc(struct cifs_ntsd *pntsd, int acl_len,
467 struct inode *inode)
Steve Frenchbcb02032007-09-25 16:17:24 +0000468{
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000469 int rc;
Steve Frenchbcb02032007-09-25 16:17:24 +0000470 struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
471 struct cifs_acl *dacl_ptr; /* no need for SACL ptr */
Steve Frenchbcb02032007-09-25 16:17:24 +0000472 char *end_of_acl = ((char *)pntsd) + acl_len;
Steve French7505e052007-11-01 18:03:01 +0000473 __u32 dacloffset;
Steve Frenchbcb02032007-09-25 16:17:24 +0000474
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000475 if ((inode == NULL) || (pntsd == NULL))
476 return -EIO;
477
Steve Frenchbcb02032007-09-25 16:17:24 +0000478 owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
Steve Frenchaf6f4612007-10-16 18:40:37 +0000479 le32_to_cpu(pntsd->osidoffset));
Steve Frenchbcb02032007-09-25 16:17:24 +0000480 group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
Steve Frenchaf6f4612007-10-16 18:40:37 +0000481 le32_to_cpu(pntsd->gsidoffset));
Steve French7505e052007-11-01 18:03:01 +0000482 dacloffset = le32_to_cpu(pntsd->dacloffset);
Steve French63d25832007-11-05 21:46:10 +0000483 dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset);
Steve French90c81e02008-02-12 20:32:36 +0000484 cFYI(DBG2, ("revision %d type 0x%x ooffset 0x%x goffset 0x%x "
Steve Frenchbcb02032007-09-25 16:17:24 +0000485 "sacloffset 0x%x dacloffset 0x%x",
Steve Frenchaf6f4612007-10-16 18:40:37 +0000486 pntsd->revision, pntsd->type, le32_to_cpu(pntsd->osidoffset),
487 le32_to_cpu(pntsd->gsidoffset),
Steve French7505e052007-11-01 18:03:01 +0000488 le32_to_cpu(pntsd->sacloffset), dacloffset));
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000489/* cifs_dump_mem("owner_sid: ", owner_sid_ptr, 64); */
Steve Frenchbcb02032007-09-25 16:17:24 +0000490 rc = parse_sid(owner_sid_ptr, end_of_acl);
491 if (rc)
492 return rc;
493
494 rc = parse_sid(group_sid_ptr, end_of_acl);
495 if (rc)
496 return rc;
497
Steve French7505e052007-11-01 18:03:01 +0000498 if (dacloffset)
499 parse_dacl(dacl_ptr, end_of_acl, owner_sid_ptr,
Steve French63d25832007-11-05 21:46:10 +0000500 group_sid_ptr, inode);
Steve French7505e052007-11-01 18:03:01 +0000501 else
502 cFYI(1, ("no ACL")); /* BB grant all or default perms? */
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000503
Steve Frenchbcb02032007-09-25 16:17:24 +0000504/* cifscred->uid = owner_sid_ptr->rid;
505 cifscred->gid = group_sid_ptr->rid;
506 memcpy((void *)(&(cifscred->osid)), (void *)owner_sid_ptr,
Steve French630f3f02007-10-25 21:17:17 +0000507 sizeof(struct cifs_sid));
Steve Frenchbcb02032007-09-25 16:17:24 +0000508 memcpy((void *)(&(cifscred->gsid)), (void *)group_sid_ptr,
Steve French630f3f02007-10-25 21:17:17 +0000509 sizeof(struct cifs_sid)); */
Steve Frenchbcb02032007-09-25 16:17:24 +0000510
Steve French297647c2007-10-12 04:11:59 +0000511
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000512 return 0;
Steve Frenchbcb02032007-09-25 16:17:24 +0000513}
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000514
515
Steve French97837582007-12-31 07:47:21 +0000516/* Convert permission bits from mode to equivalent CIFS ACL */
517static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd,
Steve Frenchcce246e2008-04-09 20:55:31 +0000518 struct inode *inode, __u64 nmode)
Steve French97837582007-12-31 07:47:21 +0000519{
520 int rc = 0;
521 __u32 dacloffset;
522 __u32 ndacloffset;
523 __u32 sidsoffset;
524 struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
525 struct cifs_acl *dacl_ptr = NULL; /* no need for SACL ptr */
526 struct cifs_acl *ndacl_ptr = NULL; /* no need for SACL ptr */
527
528 if ((inode == NULL) || (pntsd == NULL) || (pnntsd == NULL))
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000529 return -EIO;
Steve French97837582007-12-31 07:47:21 +0000530
531 owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
532 le32_to_cpu(pntsd->osidoffset));
533 group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
534 le32_to_cpu(pntsd->gsidoffset));
535
536 dacloffset = le32_to_cpu(pntsd->dacloffset);
537 dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset);
538
539 ndacloffset = sizeof(struct cifs_ntsd);
540 ndacl_ptr = (struct cifs_acl *)((char *)pnntsd + ndacloffset);
541 ndacl_ptr->revision = dacl_ptr->revision;
542 ndacl_ptr->size = 0;
543 ndacl_ptr->num_aces = 0;
544
545 rc = set_chmod_dacl(ndacl_ptr, owner_sid_ptr, group_sid_ptr, nmode);
546
547 sidsoffset = ndacloffset + le16_to_cpu(ndacl_ptr->size);
548
549 /* copy security descriptor control portion and owner and group sid */
550 copy_sec_desc(pntsd, pnntsd, sidsoffset);
551
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000552 return rc;
Steve French97837582007-12-31 07:47:21 +0000553}
554
Christoph Hellwig1bf40722009-05-27 09:37:33 -0400555static struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb,
556 __u16 fid, u32 *pacllen)
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000557{
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000558 struct cifs_ntsd *pntsd = NULL;
Christoph Hellwig1bf40722009-05-27 09:37:33 -0400559 int xid, rc;
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000560
561 xid = GetXid();
Christoph Hellwig1bf40722009-05-27 09:37:33 -0400562 rc = CIFSSMBGetCIFSACL(xid, cifs_sb->tcon, fid, &pntsd, pacllen);
563 FreeXid(xid);
Steve French8b1327f2008-03-14 22:37:16 +0000564
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000565
Christoph Hellwig1bf40722009-05-27 09:37:33 -0400566 cFYI(1, ("GetCIFSACL rc = %d ACL len %d", rc, *pacllen));
567 return pntsd;
568}
569
570static struct cifs_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb,
571 const char *path, u32 *pacllen)
572{
573 struct cifs_ntsd *pntsd = NULL;
574 int oplock = 0;
575 int xid, rc;
576 __u16 fid;
577
578 xid = GetXid();
579
580 rc = CIFSSMBOpen(xid, cifs_sb->tcon, path, FILE_OPEN, READ_CONTROL, 0,
581 &fid, &oplock, NULL, cifs_sb->local_nls,
582 cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
583 if (rc) {
584 cERROR(1, ("Unable to open file to get ACL"));
585 goto out;
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000586 }
587
Steve French7505e052007-11-01 18:03:01 +0000588 rc = CIFSSMBGetCIFSACL(xid, cifs_sb->tcon, fid, &pntsd, pacllen);
589 cFYI(1, ("GetCIFSACL rc = %d ACL len %d", rc, *pacllen));
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000590
Christoph Hellwig1bf40722009-05-27 09:37:33 -0400591 CIFSSMBClose(xid, cifs_sb->tcon, fid);
592 out:
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000593 FreeXid(xid);
Steve French7505e052007-11-01 18:03:01 +0000594 return pntsd;
595}
596
Christoph Hellwig1bf40722009-05-27 09:37:33 -0400597/* Retrieve an ACL from the server */
598static struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb,
599 struct inode *inode, const char *path,
600 u32 *pacllen)
601{
602 struct cifs_ntsd *pntsd = NULL;
603 struct cifsFileInfo *open_file = NULL;
604
605 if (inode)
606 open_file = find_readable_file(CIFS_I(inode));
607 if (!open_file)
608 return get_cifs_acl_by_path(cifs_sb, path, pacllen);
609
610 pntsd = get_cifs_acl_by_fid(cifs_sb, open_file->netfid, pacllen);
611 atomic_dec(&open_file->wrtPending);
612 return pntsd;
613}
614
Christoph Hellwigb96d31a2009-05-27 09:37:33 -0400615static int set_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb, __u16 fid,
616 struct cifs_ntsd *pnntsd, u32 acllen)
Steve French97837582007-12-31 07:47:21 +0000617{
Christoph Hellwigb96d31a2009-05-27 09:37:33 -0400618 int xid, rc;
619
620 xid = GetXid();
621 rc = CIFSSMBSetCIFSACL(xid, cifs_sb->tcon, fid, pnntsd, acllen);
622 FreeXid(xid);
623
624 cFYI(DBG2, ("SetCIFSACL rc = %d", rc));
625 return rc;
626}
627
628static int set_cifs_acl_by_path(struct cifs_sb_info *cifs_sb, const char *path,
629 struct cifs_ntsd *pnntsd, u32 acllen)
630{
631 int oplock = 0;
632 int xid, rc;
Steve French97837582007-12-31 07:47:21 +0000633 __u16 fid;
Steve French97837582007-12-31 07:47:21 +0000634
Steve French97837582007-12-31 07:47:21 +0000635 xid = GetXid();
636
Christoph Hellwigb96d31a2009-05-27 09:37:33 -0400637 rc = CIFSSMBOpen(xid, cifs_sb->tcon, path, FILE_OPEN, WRITE_DAC, 0,
638 &fid, &oplock, NULL, cifs_sb->local_nls,
639 cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
640 if (rc) {
641 cERROR(1, ("Unable to open file to set ACL"));
642 goto out;
Steve French97837582007-12-31 07:47:21 +0000643 }
644
645 rc = CIFSSMBSetCIFSACL(xid, cifs_sb->tcon, fid, pnntsd, acllen);
Steve French90c81e02008-02-12 20:32:36 +0000646 cFYI(DBG2, ("SetCIFSACL rc = %d", rc));
Steve French97837582007-12-31 07:47:21 +0000647
Christoph Hellwigb96d31a2009-05-27 09:37:33 -0400648 CIFSSMBClose(xid, cifs_sb->tcon, fid);
649 out:
Steve French97837582007-12-31 07:47:21 +0000650 FreeXid(xid);
Christoph Hellwigb96d31a2009-05-27 09:37:33 -0400651 return rc;
652}
Steve French97837582007-12-31 07:47:21 +0000653
Christoph Hellwigb96d31a2009-05-27 09:37:33 -0400654/* Set an ACL on the server */
655static int set_cifs_acl(struct cifs_ntsd *pnntsd, __u32 acllen,
656 struct inode *inode, const char *path)
657{
658 struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
659 struct cifsFileInfo *open_file;
660 int rc;
661
662 cFYI(DBG2, ("set ACL for %s from mode 0x%x", path, inode->i_mode));
663
664 open_file = find_readable_file(CIFS_I(inode));
665 if (!open_file)
666 return set_cifs_acl_by_path(cifs_sb, path, pnntsd, acllen);
667
668 rc = set_cifs_acl_by_fid(cifs_sb, open_file->netfid, pnntsd, acllen);
669 atomic_dec(&open_file->wrtPending);
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000670 return rc;
Steve French97837582007-12-31 07:47:21 +0000671}
672
Steve French7505e052007-11-01 18:03:01 +0000673/* Translate the CIFS ACL (simlar to NTFS ACL) for a file into mode bits */
Christoph Hellwig1bf40722009-05-27 09:37:33 -0400674void acl_to_uid_mode(struct cifs_sb_info *cifs_sb, struct inode *inode,
675 const char *path, const __u16 *pfid)
Steve French7505e052007-11-01 18:03:01 +0000676{
677 struct cifs_ntsd *pntsd = NULL;
678 u32 acllen = 0;
679 int rc = 0;
680
Steve French90c81e02008-02-12 20:32:36 +0000681 cFYI(DBG2, ("converting ACL to mode for %s", path));
Christoph Hellwig1bf40722009-05-27 09:37:33 -0400682
683 if (pfid)
684 pntsd = get_cifs_acl_by_fid(cifs_sb, *pfid, &acllen);
685 else
686 pntsd = get_cifs_acl(cifs_sb, inode, path, &acllen);
Steve French7505e052007-11-01 18:03:01 +0000687
688 /* if we can retrieve the ACL, now parse Access Control Entries, ACEs */
689 if (pntsd)
690 rc = parse_sec_desc(pntsd, acllen, inode);
691 if (rc)
692 cFYI(1, ("parse sec desc failed rc = %d", rc));
693
694 kfree(pntsd);
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000695 return;
696}
Steve French953f8682007-10-31 04:54:42 +0000697
Steve French7505e052007-11-01 18:03:01 +0000698/* Convert mode bits to an ACL so we can update the ACL on the server */
Steve French97837582007-12-31 07:47:21 +0000699int mode_to_acl(struct inode *inode, const char *path, __u64 nmode)
Steve French953f8682007-10-31 04:54:42 +0000700{
701 int rc = 0;
Steve Frenchcce246e2008-04-09 20:55:31 +0000702 __u32 secdesclen = 0;
Steve French97837582007-12-31 07:47:21 +0000703 struct cifs_ntsd *pntsd = NULL; /* acl obtained from server */
704 struct cifs_ntsd *pnntsd = NULL; /* modified acl to be sent to server */
Steve French953f8682007-10-31 04:54:42 +0000705
Steve French90c81e02008-02-12 20:32:36 +0000706 cFYI(DBG2, ("set ACL from mode for %s", path));
Steve French953f8682007-10-31 04:54:42 +0000707
708 /* Get the security descriptor */
Christoph Hellwig1bf40722009-05-27 09:37:33 -0400709 pntsd = get_cifs_acl(CIFS_SB(inode->i_sb), inode, path, &secdesclen);
Steve French953f8682007-10-31 04:54:42 +0000710
Steve French97837582007-12-31 07:47:21 +0000711 /* Add three ACEs for owner, group, everyone getting rid of
712 other ACEs as chmod disables ACEs and set the security descriptor */
Steve French953f8682007-10-31 04:54:42 +0000713
Steve French97837582007-12-31 07:47:21 +0000714 if (pntsd) {
715 /* allocate memory for the smb header,
716 set security descriptor request security descriptor
717 parameters, and secuirty descriptor itself */
Steve French953f8682007-10-31 04:54:42 +0000718
Steve Frenchcce246e2008-04-09 20:55:31 +0000719 secdesclen = secdesclen < DEFSECDESCLEN ?
720 DEFSECDESCLEN : secdesclen;
721 pnntsd = kmalloc(secdesclen, GFP_KERNEL);
Steve French97837582007-12-31 07:47:21 +0000722 if (!pnntsd) {
723 cERROR(1, ("Unable to allocate security descriptor"));
724 kfree(pntsd);
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000725 return -ENOMEM;
Steve French97837582007-12-31 07:47:21 +0000726 }
Steve French7505e052007-11-01 18:03:01 +0000727
Steve Frenchcce246e2008-04-09 20:55:31 +0000728 rc = build_sec_desc(pntsd, pnntsd, inode, nmode);
Steve French97837582007-12-31 07:47:21 +0000729
Steve French90c81e02008-02-12 20:32:36 +0000730 cFYI(DBG2, ("build_sec_desc rc: %d", rc));
Steve French97837582007-12-31 07:47:21 +0000731
732 if (!rc) {
733 /* Set the security descriptor */
Steve Frenchcce246e2008-04-09 20:55:31 +0000734 rc = set_cifs_acl(pnntsd, secdesclen, inode, path);
Steve French90c81e02008-02-12 20:32:36 +0000735 cFYI(DBG2, ("set_cifs_acl rc: %d", rc));
Steve French97837582007-12-31 07:47:21 +0000736 }
737
738 kfree(pnntsd);
739 kfree(pntsd);
740 }
741
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000742 return rc;
Steve French953f8682007-10-31 04:54:42 +0000743}
Steve French297647c2007-10-12 04:11:59 +0000744#endif /* CONFIG_CIFS_EXPERIMENTAL */