blob: 57ecdc83c26f3852440e67957ca031577cba8543 [file] [log] [blame]
Steve Frenchbcb02032007-09-25 16:17:24 +00001/*
2 * fs/cifs/cifsacl.c
3 *
Steve French8b1327f2008-03-14 22:37:16 +00004 * Copyright (C) International Business Machines Corp., 2007,2008
Steve Frenchbcb02032007-09-25 16:17:24 +00005 * Author(s): Steve French (sfrench@us.ibm.com)
6 *
7 * Contains the routines for mapping CIFS/NTFS ACLs
8 *
9 * This library is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU Lesser General Public License as published
11 * by the Free Software Foundation; either version 2.1 of the License, or
12 * (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
17 * the GNU Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public License
20 * along with this library; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 */
23
Steve French65874002007-09-25 19:53:44 +000024#include <linux/fs.h>
25#include "cifspdu.h"
26#include "cifsglob.h"
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +000027#include "cifsacl.h"
Steve French65874002007-09-25 19:53:44 +000028#include "cifsproto.h"
29#include "cifs_debug.h"
Steve French65874002007-09-25 19:53:44 +000030
Steve French297647c2007-10-12 04:11:59 +000031
32#ifdef CONFIG_CIFS_EXPERIMENTAL
33
Steve Frenchaf6f4612007-10-16 18:40:37 +000034static struct cifs_wksid wksidarr[NUM_WK_SIDS] = {
Steve French297647c2007-10-12 04:11:59 +000035 {{1, 0, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0} }, "null user"},
36 {{1, 1, {0, 0, 0, 0, 0, 1}, {0, 0, 0, 0, 0} }, "nobody"},
Jeff Layton536abdb2008-07-12 13:48:00 -070037 {{1, 1, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(11), 0, 0, 0, 0} }, "net-users"},
38 {{1, 1, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(18), 0, 0, 0, 0} }, "sys"},
39 {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(544), 0, 0, 0} }, "root"},
40 {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(545), 0, 0, 0} }, "users"},
41 {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(546), 0, 0, 0} }, "guest"} }
Steve French44093ca2007-10-23 21:22:55 +000042;
Steve French297647c2007-10-12 04:11:59 +000043
44
Steve Frenchbcb02032007-09-25 16:17:24 +000045/* security id for everyone */
Shirish Pargaonkare01b6402007-10-30 04:45:14 +000046static const struct cifs_sid sid_everyone = {
47 1, 1, {0, 0, 0, 0, 0, 1}, {0} };
Steve Frenchbcb02032007-09-25 16:17:24 +000048/* group users */
Steve Frenchad7a2922008-02-07 23:25:02 +000049static const struct cifs_sid sid_user = {1, 2 , {0, 0, 0, 0, 0, 5}, {} };
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +000050
Steve French297647c2007-10-12 04:11:59 +000051
52int match_sid(struct cifs_sid *ctsid)
53{
54 int i, j;
55 int num_subauth, num_sat, num_saw;
56 struct cifs_sid *cwsid;
57
58 if (!ctsid)
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +000059 return -1;
Steve French297647c2007-10-12 04:11:59 +000060
61 for (i = 0; i < NUM_WK_SIDS; ++i) {
62 cwsid = &(wksidarr[i].cifssid);
63
64 /* compare the revision */
65 if (ctsid->revision != cwsid->revision)
66 continue;
67
68 /* compare all of the six auth values */
69 for (j = 0; j < 6; ++j) {
70 if (ctsid->authority[j] != cwsid->authority[j])
71 break;
72 }
73 if (j < 6)
74 continue; /* all of the auth values did not match */
75
76 /* compare all of the subauth values if any */
Dave Kleikampce51ae12007-10-16 21:35:39 +000077 num_sat = ctsid->num_subauth;
78 num_saw = cwsid->num_subauth;
Steve French297647c2007-10-12 04:11:59 +000079 num_subauth = num_sat < num_saw ? num_sat : num_saw;
80 if (num_subauth) {
81 for (j = 0; j < num_subauth; ++j) {
82 if (ctsid->sub_auth[j] != cwsid->sub_auth[j])
83 break;
84 }
85 if (j < num_subauth)
86 continue; /* all sub_auth values do not match */
87 }
88
89 cFYI(1, ("matching sid: %s\n", wksidarr[i].sidname));
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +000090 return 0; /* sids compare/match */
Steve French297647c2007-10-12 04:11:59 +000091 }
92
93 cFYI(1, ("No matching sid"));
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +000094 return -1;
Steve French297647c2007-10-12 04:11:59 +000095}
96
Steve Frencha750e772007-10-17 22:50:39 +000097/* if the two SIDs (roughly equivalent to a UUID for a user or group) are
98 the same returns 1, if they do not match returns 0 */
Steve French630f3f02007-10-25 21:17:17 +000099int compare_sids(const struct cifs_sid *ctsid, const struct cifs_sid *cwsid)
Steve French297647c2007-10-12 04:11:59 +0000100{
101 int i;
102 int num_subauth, num_sat, num_saw;
103
104 if ((!ctsid) || (!cwsid))
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000105 return 0;
Steve French297647c2007-10-12 04:11:59 +0000106
107 /* compare the revision */
108 if (ctsid->revision != cwsid->revision)
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000109 return 0;
Steve French297647c2007-10-12 04:11:59 +0000110
111 /* compare all of the six auth values */
112 for (i = 0; i < 6; ++i) {
113 if (ctsid->authority[i] != cwsid->authority[i])
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000114 return 0;
Steve French297647c2007-10-12 04:11:59 +0000115 }
116
117 /* compare all of the subauth values if any */
Steve Frenchadbc0352007-10-17 02:12:46 +0000118 num_sat = ctsid->num_subauth;
Steve Frenchadddd492007-10-17 02:48:17 +0000119 num_saw = cwsid->num_subauth;
Steve French297647c2007-10-12 04:11:59 +0000120 num_subauth = num_sat < num_saw ? num_sat : num_saw;
121 if (num_subauth) {
122 for (i = 0; i < num_subauth; ++i) {
123 if (ctsid->sub_auth[i] != cwsid->sub_auth[i])
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000124 return 0;
Steve French297647c2007-10-12 04:11:59 +0000125 }
126 }
127
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000128 return 1; /* sids compare/match */
Steve French297647c2007-10-12 04:11:59 +0000129}
130
Steve French97837582007-12-31 07:47:21 +0000131
132/* copy ntsd, owner sid, and group sid from a security descriptor to another */
133static void copy_sec_desc(const struct cifs_ntsd *pntsd,
134 struct cifs_ntsd *pnntsd, __u32 sidsoffset)
135{
136 int i;
137
138 struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
139 struct cifs_sid *nowner_sid_ptr, *ngroup_sid_ptr;
140
141 /* copy security descriptor control portion */
142 pnntsd->revision = pntsd->revision;
143 pnntsd->type = pntsd->type;
144 pnntsd->dacloffset = cpu_to_le32(sizeof(struct cifs_ntsd));
145 pnntsd->sacloffset = 0;
146 pnntsd->osidoffset = cpu_to_le32(sidsoffset);
147 pnntsd->gsidoffset = cpu_to_le32(sidsoffset + sizeof(struct cifs_sid));
148
149 /* copy owner sid */
150 owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
151 le32_to_cpu(pntsd->osidoffset));
152 nowner_sid_ptr = (struct cifs_sid *)((char *)pnntsd + sidsoffset);
153
154 nowner_sid_ptr->revision = owner_sid_ptr->revision;
155 nowner_sid_ptr->num_subauth = owner_sid_ptr->num_subauth;
156 for (i = 0; i < 6; i++)
157 nowner_sid_ptr->authority[i] = owner_sid_ptr->authority[i];
158 for (i = 0; i < 5; i++)
159 nowner_sid_ptr->sub_auth[i] = owner_sid_ptr->sub_auth[i];
160
161 /* copy group sid */
162 group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
163 le32_to_cpu(pntsd->gsidoffset));
164 ngroup_sid_ptr = (struct cifs_sid *)((char *)pnntsd + sidsoffset +
165 sizeof(struct cifs_sid));
166
167 ngroup_sid_ptr->revision = group_sid_ptr->revision;
168 ngroup_sid_ptr->num_subauth = group_sid_ptr->num_subauth;
169 for (i = 0; i < 6; i++)
170 ngroup_sid_ptr->authority[i] = group_sid_ptr->authority[i];
171 for (i = 0; i < 5; i++)
Shirish Pargaonkarb1910ad2008-07-24 14:53:20 +0000172 ngroup_sid_ptr->sub_auth[i] = group_sid_ptr->sub_auth[i];
Steve French97837582007-12-31 07:47:21 +0000173
174 return;
175}
176
177
Steve French630f3f02007-10-25 21:17:17 +0000178/*
179 change posix mode to reflect permissions
180 pmode is the existing mode (we only want to overwrite part of this
181 bits to set can be: S_IRWXU, S_IRWXG or S_IRWXO ie 00700 or 00070 or 00007
182*/
Al Viro9b5e6852007-12-05 08:24:38 +0000183static void access_flags_to_mode(__le32 ace_flags, int type, umode_t *pmode,
Steve French15b03952007-11-08 17:57:40 +0000184 umode_t *pbits_to_set)
Steve French4879b442007-10-19 21:57:39 +0000185{
Al Viro9b5e6852007-12-05 08:24:38 +0000186 __u32 flags = le32_to_cpu(ace_flags);
Steve French15b03952007-11-08 17:57:40 +0000187 /* the order of ACEs is important. The canonical order is to begin with
Steve Frenchce06c9f2007-11-08 21:12:01 +0000188 DENY entries followed by ALLOW, otherwise an allow entry could be
Steve French15b03952007-11-08 17:57:40 +0000189 encountered first, making the subsequent deny entry like "dead code"
Steve Frenchce06c9f2007-11-08 21:12:01 +0000190 which would be superflous since Windows stops when a match is made
Steve French15b03952007-11-08 17:57:40 +0000191 for the operation you are trying to perform for your user */
192
193 /* For deny ACEs we change the mask so that subsequent allow access
194 control entries do not turn on the bits we are denying */
195 if (type == ACCESS_DENIED) {
Steve Frenchad7a2922008-02-07 23:25:02 +0000196 if (flags & GENERIC_ALL)
Steve French15b03952007-11-08 17:57:40 +0000197 *pbits_to_set &= ~S_IRWXUGO;
Steve Frenchad7a2922008-02-07 23:25:02 +0000198
Al Viro9b5e6852007-12-05 08:24:38 +0000199 if ((flags & GENERIC_WRITE) ||
200 ((flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS))
Steve French15b03952007-11-08 17:57:40 +0000201 *pbits_to_set &= ~S_IWUGO;
Al Viro9b5e6852007-12-05 08:24:38 +0000202 if ((flags & GENERIC_READ) ||
203 ((flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS))
Steve French15b03952007-11-08 17:57:40 +0000204 *pbits_to_set &= ~S_IRUGO;
Al Viro9b5e6852007-12-05 08:24:38 +0000205 if ((flags & GENERIC_EXECUTE) ||
206 ((flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS))
Steve French15b03952007-11-08 17:57:40 +0000207 *pbits_to_set &= ~S_IXUGO;
208 return;
209 } else if (type != ACCESS_ALLOWED) {
210 cERROR(1, ("unknown access control type %d", type));
211 return;
212 }
213 /* else ACCESS_ALLOWED type */
Steve French44093ca2007-10-23 21:22:55 +0000214
Al Viro9b5e6852007-12-05 08:24:38 +0000215 if (flags & GENERIC_ALL) {
Steve French15b03952007-11-08 17:57:40 +0000216 *pmode |= (S_IRWXUGO & (*pbits_to_set));
Steve French90c81e02008-02-12 20:32:36 +0000217 cFYI(DBG2, ("all perms"));
Steve Frenchd61e5802007-10-26 04:32:43 +0000218 return;
219 }
Al Viro9b5e6852007-12-05 08:24:38 +0000220 if ((flags & GENERIC_WRITE) ||
221 ((flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS))
Steve French15b03952007-11-08 17:57:40 +0000222 *pmode |= (S_IWUGO & (*pbits_to_set));
Al Viro9b5e6852007-12-05 08:24:38 +0000223 if ((flags & GENERIC_READ) ||
224 ((flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS))
Steve French15b03952007-11-08 17:57:40 +0000225 *pmode |= (S_IRUGO & (*pbits_to_set));
Al Viro9b5e6852007-12-05 08:24:38 +0000226 if ((flags & GENERIC_EXECUTE) ||
227 ((flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS))
Steve French15b03952007-11-08 17:57:40 +0000228 *pmode |= (S_IXUGO & (*pbits_to_set));
Steve Frenchd61e5802007-10-26 04:32:43 +0000229
Steve French90c81e02008-02-12 20:32:36 +0000230 cFYI(DBG2, ("access flags 0x%x mode now 0x%x", flags, *pmode));
Steve French630f3f02007-10-25 21:17:17 +0000231 return;
232}
233
Steve Frenchce06c9f2007-11-08 21:12:01 +0000234/*
235 Generate access flags to reflect permissions mode is the existing mode.
236 This function is called for every ACE in the DACL whose SID matches
237 with either owner or group or everyone.
238*/
239
240static void mode_to_access_flags(umode_t mode, umode_t bits_to_use,
241 __u32 *pace_flags)
242{
243 /* reset access mask */
244 *pace_flags = 0x0;
245
246 /* bits to use are either S_IRWXU or S_IRWXG or S_IRWXO */
247 mode &= bits_to_use;
248
249 /* check for R/W/X UGO since we do not know whose flags
250 is this but we have cleared all the bits sans RWX for
251 either user or group or other as per bits_to_use */
252 if (mode & S_IRUGO)
253 *pace_flags |= SET_FILE_READ_RIGHTS;
254 if (mode & S_IWUGO)
255 *pace_flags |= SET_FILE_WRITE_RIGHTS;
256 if (mode & S_IXUGO)
257 *pace_flags |= SET_FILE_EXEC_RIGHTS;
258
Steve French90c81e02008-02-12 20:32:36 +0000259 cFYI(DBG2, ("mode: 0x%x, access flags now 0x%x", mode, *pace_flags));
Steve Frenchce06c9f2007-11-08 21:12:01 +0000260 return;
261}
262
Al Viro2b210ad2008-03-29 03:09:18 +0000263static __u16 fill_ace_for_sid(struct cifs_ace *pntace,
Steve French97837582007-12-31 07:47:21 +0000264 const struct cifs_sid *psid, __u64 nmode, umode_t bits)
265{
266 int i;
267 __u16 size = 0;
268 __u32 access_req = 0;
269
270 pntace->type = ACCESS_ALLOWED;
271 pntace->flags = 0x0;
272 mode_to_access_flags(nmode, bits, &access_req);
273 if (!access_req)
274 access_req = SET_MINIMUM_RIGHTS;
275 pntace->access_req = cpu_to_le32(access_req);
276
277 pntace->sid.revision = psid->revision;
278 pntace->sid.num_subauth = psid->num_subauth;
279 for (i = 0; i < 6; i++)
280 pntace->sid.authority[i] = psid->authority[i];
281 for (i = 0; i < psid->num_subauth; i++)
282 pntace->sid.sub_auth[i] = psid->sub_auth[i];
283
284 size = 1 + 1 + 2 + 4 + 1 + 1 + 6 + (psid->num_subauth * 4);
285 pntace->size = cpu_to_le16(size);
286
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000287 return size;
Steve French97837582007-12-31 07:47:21 +0000288}
289
Steve French297647c2007-10-12 04:11:59 +0000290
Steve French953f8682007-10-31 04:54:42 +0000291#ifdef CONFIG_CIFS_DEBUG2
292static void dump_ace(struct cifs_ace *pace, char *end_of_acl)
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000293{
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000294 int num_subauth;
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000295
296 /* validate that we do not go past end of acl */
Steve French297647c2007-10-12 04:11:59 +0000297
Steve French44093ca2007-10-23 21:22:55 +0000298 if (le16_to_cpu(pace->size) < 16) {
299 cERROR(1, ("ACE too small, %d", le16_to_cpu(pace->size)));
300 return;
301 }
302
303 if (end_of_acl < (char *)pace + le16_to_cpu(pace->size)) {
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000304 cERROR(1, ("ACL too small to parse ACE"));
305 return;
Steve French44093ca2007-10-23 21:22:55 +0000306 }
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000307
Steve French44093ca2007-10-23 21:22:55 +0000308 num_subauth = pace->sid.num_subauth;
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000309 if (num_subauth) {
Steve French8f18c132007-10-12 18:54:12 +0000310 int i;
Steve French44093ca2007-10-23 21:22:55 +0000311 cFYI(1, ("ACE revision %d num_auth %d type %d flags %d size %d",
312 pace->sid.revision, pace->sid.num_subauth, pace->type,
Steve French97837582007-12-31 07:47:21 +0000313 pace->flags, le16_to_cpu(pace->size)));
Steve Frenchd12fd122007-10-03 19:43:19 +0000314 for (i = 0; i < num_subauth; ++i) {
315 cFYI(1, ("ACE sub_auth[%d]: 0x%x", i,
Steve French44093ca2007-10-23 21:22:55 +0000316 le32_to_cpu(pace->sid.sub_auth[i])));
Steve Frenchd12fd122007-10-03 19:43:19 +0000317 }
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000318
Steve Frenchd12fd122007-10-03 19:43:19 +0000319 /* BB add length check to make sure that we do not have huge
320 num auths and therefore go off the end */
Steve Frenchd12fd122007-10-03 19:43:19 +0000321 }
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000322
Steve Frenchd12fd122007-10-03 19:43:19 +0000323 return;
324}
Steve French953f8682007-10-31 04:54:42 +0000325#endif
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000326
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000327
Steve Frencha750e772007-10-17 22:50:39 +0000328static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
Steve Frenchd61e5802007-10-26 04:32:43 +0000329 struct cifs_sid *pownersid, struct cifs_sid *pgrpsid,
Steve French630f3f02007-10-25 21:17:17 +0000330 struct inode *inode)
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000331{
332 int i;
333 int num_aces = 0;
334 int acl_size;
335 char *acl_base;
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000336 struct cifs_ace **ppace;
337
338 /* BB need to add parm so we can store the SID BB */
339
Steve French2b834572007-11-25 10:01:00 +0000340 if (!pdacl) {
341 /* no DACL in the security descriptor, set
342 all the permissions for user/group/other */
343 inode->i_mode |= S_IRWXUGO;
344 return;
345 }
346
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000347 /* validate that we do not go past end of acl */
Steve Frenchaf6f4612007-10-16 18:40:37 +0000348 if (end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size)) {
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000349 cERROR(1, ("ACL too small to parse DACL"));
350 return;
351 }
352
Steve French90c81e02008-02-12 20:32:36 +0000353 cFYI(DBG2, ("DACL revision %d size %d num aces %d",
Steve Frenchaf6f4612007-10-16 18:40:37 +0000354 le16_to_cpu(pdacl->revision), le16_to_cpu(pdacl->size),
355 le32_to_cpu(pdacl->num_aces)));
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000356
Steve French7505e052007-11-01 18:03:01 +0000357 /* reset rwx permissions for user/group/other.
358 Also, if num_aces is 0 i.e. DACL has no ACEs,
359 user/group/other have no permissions */
360 inode->i_mode &= ~(S_IRWXUGO);
361
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000362 acl_base = (char *)pdacl;
363 acl_size = sizeof(struct cifs_acl);
364
Steve Frenchadbc0352007-10-17 02:12:46 +0000365 num_aces = le32_to_cpu(pdacl->num_aces);
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000366 if (num_aces > 0) {
Steve French15b03952007-11-08 17:57:40 +0000367 umode_t user_mask = S_IRWXU;
368 umode_t group_mask = S_IRWXG;
369 umode_t other_mask = S_IRWXO;
370
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000371 ppace = kmalloc(num_aces * sizeof(struct cifs_ace *),
372 GFP_KERNEL);
373
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000374 for (i = 0; i < num_aces; ++i) {
Steve French44093ca2007-10-23 21:22:55 +0000375 ppace[i] = (struct cifs_ace *) (acl_base + acl_size);
Steve French953f8682007-10-31 04:54:42 +0000376#ifdef CONFIG_CIFS_DEBUG2
377 dump_ace(ppace[i], end_of_acl);
378#endif
Shirish Pargaonkare01b6402007-10-30 04:45:14 +0000379 if (compare_sids(&(ppace[i]->sid), pownersid))
380 access_flags_to_mode(ppace[i]->access_req,
Steve French15b03952007-11-08 17:57:40 +0000381 ppace[i]->type,
382 &(inode->i_mode),
383 &user_mask);
Shirish Pargaonkare01b6402007-10-30 04:45:14 +0000384 if (compare_sids(&(ppace[i]->sid), pgrpsid))
385 access_flags_to_mode(ppace[i]->access_req,
Steve French15b03952007-11-08 17:57:40 +0000386 ppace[i]->type,
387 &(inode->i_mode),
388 &group_mask);
Shirish Pargaonkare01b6402007-10-30 04:45:14 +0000389 if (compare_sids(&(ppace[i]->sid), &sid_everyone))
390 access_flags_to_mode(ppace[i]->access_req,
Steve French15b03952007-11-08 17:57:40 +0000391 ppace[i]->type,
392 &(inode->i_mode),
393 &other_mask);
Shirish Pargaonkare01b6402007-10-30 04:45:14 +0000394
Steve French44093ca2007-10-23 21:22:55 +0000395/* memcpy((void *)(&(cifscred->aces[i])),
Steve Frenchd12fd122007-10-03 19:43:19 +0000396 (void *)ppace[i],
397 sizeof(struct cifs_ace)); */
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000398
Steve French44093ca2007-10-23 21:22:55 +0000399 acl_base = (char *)ppace[i];
400 acl_size = le16_to_cpu(ppace[i]->size);
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000401 }
402
403 kfree(ppace);
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000404 }
405
406 return;
407}
408
Steve Frenchbcb02032007-09-25 16:17:24 +0000409
Steve French97837582007-12-31 07:47:21 +0000410static int set_chmod_dacl(struct cifs_acl *pndacl, struct cifs_sid *pownersid,
411 struct cifs_sid *pgrpsid, __u64 nmode)
412{
Al Viro2b210ad2008-03-29 03:09:18 +0000413 u16 size = 0;
Steve French97837582007-12-31 07:47:21 +0000414 struct cifs_acl *pnndacl;
415
416 pnndacl = (struct cifs_acl *)((char *)pndacl + sizeof(struct cifs_acl));
417
418 size += fill_ace_for_sid((struct cifs_ace *) ((char *)pnndacl + size),
419 pownersid, nmode, S_IRWXU);
420 size += fill_ace_for_sid((struct cifs_ace *)((char *)pnndacl + size),
421 pgrpsid, nmode, S_IRWXG);
422 size += fill_ace_for_sid((struct cifs_ace *)((char *)pnndacl + size),
423 &sid_everyone, nmode, S_IRWXO);
424
425 pndacl->size = cpu_to_le16(size + sizeof(struct cifs_acl));
Shirish Pargaonkard9f382e2008-02-12 20:46:26 +0000426 pndacl->num_aces = cpu_to_le32(3);
Steve French97837582007-12-31 07:47:21 +0000427
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000428 return 0;
Steve French97837582007-12-31 07:47:21 +0000429}
430
431
Steve Frenchbcb02032007-09-25 16:17:24 +0000432static int parse_sid(struct cifs_sid *psid, char *end_of_acl)
433{
434 /* BB need to add parm so we can store the SID BB */
435
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000436 /* validate that we do not go past end of ACL - sid must be at least 8
437 bytes long (assuming no sub-auths - e.g. the null SID */
438 if (end_of_acl < (char *)psid + 8) {
439 cERROR(1, ("ACL too small to parse SID %p", psid));
Steve Frenchbcb02032007-09-25 16:17:24 +0000440 return -EINVAL;
441 }
Steve Frenchbcb02032007-09-25 16:17:24 +0000442
Steve Frenchaf6f4612007-10-16 18:40:37 +0000443 if (psid->num_subauth) {
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000444#ifdef CONFIG_CIFS_DEBUG2
Steve French8f18c132007-10-12 18:54:12 +0000445 int i;
Steve French44093ca2007-10-23 21:22:55 +0000446 cFYI(1, ("SID revision %d num_auth %d",
447 psid->revision, psid->num_subauth));
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000448
Steve Frenchaf6f4612007-10-16 18:40:37 +0000449 for (i = 0; i < psid->num_subauth; i++) {
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000450 cFYI(1, ("SID sub_auth[%d]: 0x%x ", i,
Steve French297647c2007-10-12 04:11:59 +0000451 le32_to_cpu(psid->sub_auth[i])));
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000452 }
453
Steve Frenchd12fd122007-10-03 19:43:19 +0000454 /* BB add length check to make sure that we do not have huge
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000455 num auths and therefore go off the end */
Steve Frenchd12fd122007-10-03 19:43:19 +0000456 cFYI(1, ("RID 0x%x",
Steve Frenchaf6f4612007-10-16 18:40:37 +0000457 le32_to_cpu(psid->sub_auth[psid->num_subauth-1])));
Steve Frenchbcb02032007-09-25 16:17:24 +0000458#endif
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000459 }
460
Steve Frenchbcb02032007-09-25 16:17:24 +0000461 return 0;
462}
463
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000464
Steve Frenchbcb02032007-09-25 16:17:24 +0000465/* Convert CIFS ACL to POSIX form */
Steve French630f3f02007-10-25 21:17:17 +0000466static int parse_sec_desc(struct cifs_ntsd *pntsd, int acl_len,
467 struct inode *inode)
Steve Frenchbcb02032007-09-25 16:17:24 +0000468{
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000469 int rc;
Steve Frenchbcb02032007-09-25 16:17:24 +0000470 struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
471 struct cifs_acl *dacl_ptr; /* no need for SACL ptr */
Steve Frenchbcb02032007-09-25 16:17:24 +0000472 char *end_of_acl = ((char *)pntsd) + acl_len;
Steve French7505e052007-11-01 18:03:01 +0000473 __u32 dacloffset;
Steve Frenchbcb02032007-09-25 16:17:24 +0000474
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000475 if ((inode == NULL) || (pntsd == NULL))
476 return -EIO;
477
Steve Frenchbcb02032007-09-25 16:17:24 +0000478 owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
Steve Frenchaf6f4612007-10-16 18:40:37 +0000479 le32_to_cpu(pntsd->osidoffset));
Steve Frenchbcb02032007-09-25 16:17:24 +0000480 group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
Steve Frenchaf6f4612007-10-16 18:40:37 +0000481 le32_to_cpu(pntsd->gsidoffset));
Steve French7505e052007-11-01 18:03:01 +0000482 dacloffset = le32_to_cpu(pntsd->dacloffset);
Steve French63d25832007-11-05 21:46:10 +0000483 dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset);
Steve French90c81e02008-02-12 20:32:36 +0000484 cFYI(DBG2, ("revision %d type 0x%x ooffset 0x%x goffset 0x%x "
Steve Frenchbcb02032007-09-25 16:17:24 +0000485 "sacloffset 0x%x dacloffset 0x%x",
Steve Frenchaf6f4612007-10-16 18:40:37 +0000486 pntsd->revision, pntsd->type, le32_to_cpu(pntsd->osidoffset),
487 le32_to_cpu(pntsd->gsidoffset),
Steve French7505e052007-11-01 18:03:01 +0000488 le32_to_cpu(pntsd->sacloffset), dacloffset));
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000489/* cifs_dump_mem("owner_sid: ", owner_sid_ptr, 64); */
Steve Frenchbcb02032007-09-25 16:17:24 +0000490 rc = parse_sid(owner_sid_ptr, end_of_acl);
491 if (rc)
492 return rc;
493
494 rc = parse_sid(group_sid_ptr, end_of_acl);
495 if (rc)
496 return rc;
497
Steve French7505e052007-11-01 18:03:01 +0000498 if (dacloffset)
499 parse_dacl(dacl_ptr, end_of_acl, owner_sid_ptr,
Steve French63d25832007-11-05 21:46:10 +0000500 group_sid_ptr, inode);
Steve French7505e052007-11-01 18:03:01 +0000501 else
502 cFYI(1, ("no ACL")); /* BB grant all or default perms? */
Shirish Pargaonkard0d66c42007-10-03 18:22:19 +0000503
Steve Frenchbcb02032007-09-25 16:17:24 +0000504/* cifscred->uid = owner_sid_ptr->rid;
505 cifscred->gid = group_sid_ptr->rid;
506 memcpy((void *)(&(cifscred->osid)), (void *)owner_sid_ptr,
Steve French630f3f02007-10-25 21:17:17 +0000507 sizeof(struct cifs_sid));
Steve Frenchbcb02032007-09-25 16:17:24 +0000508 memcpy((void *)(&(cifscred->gsid)), (void *)group_sid_ptr,
Steve French630f3f02007-10-25 21:17:17 +0000509 sizeof(struct cifs_sid)); */
Steve Frenchbcb02032007-09-25 16:17:24 +0000510
Steve French297647c2007-10-12 04:11:59 +0000511
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000512 return 0;
Steve Frenchbcb02032007-09-25 16:17:24 +0000513}
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000514
515
Steve French97837582007-12-31 07:47:21 +0000516/* Convert permission bits from mode to equivalent CIFS ACL */
517static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd,
Steve Frenchcce246e2008-04-09 20:55:31 +0000518 struct inode *inode, __u64 nmode)
Steve French97837582007-12-31 07:47:21 +0000519{
520 int rc = 0;
521 __u32 dacloffset;
522 __u32 ndacloffset;
523 __u32 sidsoffset;
524 struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
525 struct cifs_acl *dacl_ptr = NULL; /* no need for SACL ptr */
526 struct cifs_acl *ndacl_ptr = NULL; /* no need for SACL ptr */
527
528 if ((inode == NULL) || (pntsd == NULL) || (pnntsd == NULL))
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000529 return -EIO;
Steve French97837582007-12-31 07:47:21 +0000530
531 owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
532 le32_to_cpu(pntsd->osidoffset));
533 group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
534 le32_to_cpu(pntsd->gsidoffset));
535
536 dacloffset = le32_to_cpu(pntsd->dacloffset);
537 dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset);
538
539 ndacloffset = sizeof(struct cifs_ntsd);
540 ndacl_ptr = (struct cifs_acl *)((char *)pnntsd + ndacloffset);
541 ndacl_ptr->revision = dacl_ptr->revision;
542 ndacl_ptr->size = 0;
543 ndacl_ptr->num_aces = 0;
544
545 rc = set_chmod_dacl(ndacl_ptr, owner_sid_ptr, group_sid_ptr, nmode);
546
547 sidsoffset = ndacloffset + le16_to_cpu(ndacl_ptr->size);
548
549 /* copy security descriptor control portion and owner and group sid */
550 copy_sec_desc(pntsd, pnntsd, sidsoffset);
551
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000552 return rc;
Steve French97837582007-12-31 07:47:21 +0000553}
554
555
Steve French7505e052007-11-01 18:03:01 +0000556/* Retrieve an ACL from the server */
557static struct cifs_ntsd *get_cifs_acl(u32 *pacllen, struct inode *inode,
Steve French8b1327f2008-03-14 22:37:16 +0000558 const char *path, const __u16 *pfid)
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000559{
Steve French8b1327f2008-03-14 22:37:16 +0000560 struct cifsFileInfo *open_file = NULL;
Steve French4b18f2a2008-04-29 00:06:05 +0000561 bool unlock_file = false;
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000562 int xid;
563 int rc = -EIO;
564 __u16 fid;
565 struct super_block *sb;
566 struct cifs_sb_info *cifs_sb;
567 struct cifs_ntsd *pntsd = NULL;
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000568
569 cFYI(1, ("get mode from ACL for %s", path));
570
571 if (inode == NULL)
Steve French7505e052007-11-01 18:03:01 +0000572 return NULL;
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000573
574 xid = GetXid();
Steve French8b1327f2008-03-14 22:37:16 +0000575 if (pfid == NULL)
576 open_file = find_readable_file(CIFS_I(inode));
577 else
578 fid = *pfid;
579
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000580 sb = inode->i_sb;
581 if (sb == NULL) {
582 FreeXid(xid);
Steve French7505e052007-11-01 18:03:01 +0000583 return NULL;
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000584 }
585 cifs_sb = CIFS_SB(sb);
586
587 if (open_file) {
Steve French4b18f2a2008-04-29 00:06:05 +0000588 unlock_file = true;
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000589 fid = open_file->netfid;
Steve French8b1327f2008-03-14 22:37:16 +0000590 } else if (pfid == NULL) {
Steve Frenchaf4b3c32008-05-09 03:48:05 +0000591 int oplock = 0;
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000592 /* open file */
593 rc = CIFSSMBOpen(xid, cifs_sb->tcon, path, FILE_OPEN,
Steve French953f8682007-10-31 04:54:42 +0000594 READ_CONTROL, 0, &fid, &oplock, NULL,
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000595 cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
596 CIFS_MOUNT_MAP_SPECIAL_CHR);
597 if (rc != 0) {
598 cERROR(1, ("Unable to open file to get ACL"));
599 FreeXid(xid);
Steve French7505e052007-11-01 18:03:01 +0000600 return NULL;
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000601 }
602 }
603
Steve French7505e052007-11-01 18:03:01 +0000604 rc = CIFSSMBGetCIFSACL(xid, cifs_sb->tcon, fid, &pntsd, pacllen);
605 cFYI(1, ("GetCIFSACL rc = %d ACL len %d", rc, *pacllen));
Steve French4b18f2a2008-04-29 00:06:05 +0000606 if (unlock_file == true) /* find_readable_file increments ref count */
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000607 atomic_dec(&open_file->wrtPending);
Steve French8b1327f2008-03-14 22:37:16 +0000608 else if (pfid == NULL) /* if opened above we have to close the handle */
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000609 CIFSSMBClose(xid, cifs_sb->tcon, fid);
Steve French8b1327f2008-03-14 22:37:16 +0000610 /* else handle was passed in by caller */
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000611
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000612 FreeXid(xid);
Steve French7505e052007-11-01 18:03:01 +0000613 return pntsd;
614}
615
Steve French97837582007-12-31 07:47:21 +0000616/* Set an ACL on the server */
617static int set_cifs_acl(struct cifs_ntsd *pnntsd, __u32 acllen,
618 struct inode *inode, const char *path)
619{
620 struct cifsFileInfo *open_file;
Steve French4b18f2a2008-04-29 00:06:05 +0000621 bool unlock_file = false;
Steve French97837582007-12-31 07:47:21 +0000622 int xid;
623 int rc = -EIO;
624 __u16 fid;
625 struct super_block *sb;
626 struct cifs_sb_info *cifs_sb;
627
Steve French90c81e02008-02-12 20:32:36 +0000628 cFYI(DBG2, ("set ACL for %s from mode 0x%x", path, inode->i_mode));
Steve French97837582007-12-31 07:47:21 +0000629
630 if (!inode)
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000631 return rc;
Steve French97837582007-12-31 07:47:21 +0000632
633 sb = inode->i_sb;
634 if (sb == NULL)
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000635 return rc;
Steve French97837582007-12-31 07:47:21 +0000636
637 cifs_sb = CIFS_SB(sb);
638 xid = GetXid();
639
640 open_file = find_readable_file(CIFS_I(inode));
641 if (open_file) {
Steve French4b18f2a2008-04-29 00:06:05 +0000642 unlock_file = true;
Steve French97837582007-12-31 07:47:21 +0000643 fid = open_file->netfid;
644 } else {
Steve French4b18f2a2008-04-29 00:06:05 +0000645 int oplock = 0;
Steve French97837582007-12-31 07:47:21 +0000646 /* open file */
647 rc = CIFSSMBOpen(xid, cifs_sb->tcon, path, FILE_OPEN,
648 WRITE_DAC, 0, &fid, &oplock, NULL,
649 cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
650 CIFS_MOUNT_MAP_SPECIAL_CHR);
651 if (rc != 0) {
652 cERROR(1, ("Unable to open file to set ACL"));
653 FreeXid(xid);
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000654 return rc;
Steve French97837582007-12-31 07:47:21 +0000655 }
656 }
657
658 rc = CIFSSMBSetCIFSACL(xid, cifs_sb->tcon, fid, pnntsd, acllen);
Steve French90c81e02008-02-12 20:32:36 +0000659 cFYI(DBG2, ("SetCIFSACL rc = %d", rc));
Steve French4b18f2a2008-04-29 00:06:05 +0000660 if (unlock_file)
Steve French97837582007-12-31 07:47:21 +0000661 atomic_dec(&open_file->wrtPending);
662 else
663 CIFSSMBClose(xid, cifs_sb->tcon, fid);
664
665 FreeXid(xid);
666
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000667 return rc;
Steve French97837582007-12-31 07:47:21 +0000668}
669
Steve French7505e052007-11-01 18:03:01 +0000670/* Translate the CIFS ACL (simlar to NTFS ACL) for a file into mode bits */
Steve French8b1327f2008-03-14 22:37:16 +0000671void acl_to_uid_mode(struct inode *inode, const char *path, const __u16 *pfid)
Steve French7505e052007-11-01 18:03:01 +0000672{
673 struct cifs_ntsd *pntsd = NULL;
674 u32 acllen = 0;
675 int rc = 0;
676
Steve French90c81e02008-02-12 20:32:36 +0000677 cFYI(DBG2, ("converting ACL to mode for %s", path));
Steve French8b1327f2008-03-14 22:37:16 +0000678 pntsd = get_cifs_acl(&acllen, inode, path, pfid);
Steve French7505e052007-11-01 18:03:01 +0000679
680 /* if we can retrieve the ACL, now parse Access Control Entries, ACEs */
681 if (pntsd)
682 rc = parse_sec_desc(pntsd, acllen, inode);
683 if (rc)
684 cFYI(1, ("parse sec desc failed rc = %d", rc));
685
686 kfree(pntsd);
Steve Frenchb9c7a2b2007-10-26 23:40:20 +0000687 return;
688}
Steve French953f8682007-10-31 04:54:42 +0000689
Steve French7505e052007-11-01 18:03:01 +0000690/* Convert mode bits to an ACL so we can update the ACL on the server */
Steve French97837582007-12-31 07:47:21 +0000691int mode_to_acl(struct inode *inode, const char *path, __u64 nmode)
Steve French953f8682007-10-31 04:54:42 +0000692{
693 int rc = 0;
Steve Frenchcce246e2008-04-09 20:55:31 +0000694 __u32 secdesclen = 0;
Steve French97837582007-12-31 07:47:21 +0000695 struct cifs_ntsd *pntsd = NULL; /* acl obtained from server */
696 struct cifs_ntsd *pnntsd = NULL; /* modified acl to be sent to server */
Steve French953f8682007-10-31 04:54:42 +0000697
Steve French90c81e02008-02-12 20:32:36 +0000698 cFYI(DBG2, ("set ACL from mode for %s", path));
Steve French953f8682007-10-31 04:54:42 +0000699
700 /* Get the security descriptor */
Steve Frenchcce246e2008-04-09 20:55:31 +0000701 pntsd = get_cifs_acl(&secdesclen, inode, path, NULL);
Steve French953f8682007-10-31 04:54:42 +0000702
Steve French97837582007-12-31 07:47:21 +0000703 /* Add three ACEs for owner, group, everyone getting rid of
704 other ACEs as chmod disables ACEs and set the security descriptor */
Steve French953f8682007-10-31 04:54:42 +0000705
Steve French97837582007-12-31 07:47:21 +0000706 if (pntsd) {
707 /* allocate memory for the smb header,
708 set security descriptor request security descriptor
709 parameters, and secuirty descriptor itself */
Steve French953f8682007-10-31 04:54:42 +0000710
Steve Frenchcce246e2008-04-09 20:55:31 +0000711 secdesclen = secdesclen < DEFSECDESCLEN ?
712 DEFSECDESCLEN : secdesclen;
713 pnntsd = kmalloc(secdesclen, GFP_KERNEL);
Steve French97837582007-12-31 07:47:21 +0000714 if (!pnntsd) {
715 cERROR(1, ("Unable to allocate security descriptor"));
716 kfree(pntsd);
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000717 return -ENOMEM;
Steve French97837582007-12-31 07:47:21 +0000718 }
Steve French7505e052007-11-01 18:03:01 +0000719
Steve Frenchcce246e2008-04-09 20:55:31 +0000720 rc = build_sec_desc(pntsd, pnntsd, inode, nmode);
Steve French97837582007-12-31 07:47:21 +0000721
Steve French90c81e02008-02-12 20:32:36 +0000722 cFYI(DBG2, ("build_sec_desc rc: %d", rc));
Steve French97837582007-12-31 07:47:21 +0000723
724 if (!rc) {
725 /* Set the security descriptor */
Steve Frenchcce246e2008-04-09 20:55:31 +0000726 rc = set_cifs_acl(pnntsd, secdesclen, inode, path);
Steve French90c81e02008-02-12 20:32:36 +0000727 cFYI(DBG2, ("set_cifs_acl rc: %d", rc));
Steve French97837582007-12-31 07:47:21 +0000728 }
729
730 kfree(pnntsd);
731 kfree(pntsd);
732 }
733
Shirish Pargaonkaref571ca2008-07-24 15:56:05 +0000734 return rc;
Steve French953f8682007-10-31 04:54:42 +0000735}
Steve French297647c2007-10-12 04:11:59 +0000736#endif /* CONFIG_CIFS_EXPERIMENTAL */