/* Unix SMB/Netbios implementation. VFS module to get and set posix acls Copyright (C) Jim McDonough 2006 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . */ #include "includes.h" #include "system/filesys.h" #include "smbd/smbd.h" #include "vfs_aixacl_util.h" SMB_ACL_T aixacl_to_smbacl(struct acl *file_acl, TALLOC_CTX *mem_ctx) { struct acl_entry *acl_entry; struct ace_id *idp; struct smb_acl_t *result = sys_acl_init(mem_ctx); struct smb_acl_entry *ace; int i; if (result == NULL) { return NULL; } /* Point to the first acl entry in the acl */ acl_entry = file_acl->acl_ext; DEBUG(10,("acl_entry is %p\n",(void *)acl_entry)); DEBUG(10,("acl_last(file_acl) id %p\n",(void *)acl_last(file_acl))); /* Check if the extended acl bit is on. * * If it isn't, do not show the * * contents of the acl since AIX intends * * the extended info to remain unused */ if(file_acl->acl_mode & S_IXACL){ /* while we are not pointing to the very end */ while(acl_entry < acl_last(file_acl)) { /* before we malloc anything, make sure this is */ /* a valid acl entry and one that we want to map */ idp = id_nxt(acl_entry->ace_id); if((acl_entry->ace_type == ACC_SPECIFY || (acl_entry->ace_type == ACC_PERMIT)) && (idp != id_last(acl_entry))) { acl_entry = acl_nxt(acl_entry); continue; } idp = acl_entry->ace_id; DEBUG(10,("idp->id_data is %d\n",idp->id_data[0])); result->acl = talloc_realloc(result, result->acl, struct smb_acl_entry, result->count+1); if (result == NULL) { DEBUG(0, ("talloc_realloc failed\n")); errno = ENOMEM; return NULL; } DEBUG(10,("idp->id_type is %d\n",idp->id_type)); ace = &result->acl[result->count]; ace->a_type = idp->id_type; switch(ace->a_type) { case ACEID_USER: { ace->info.user.uid = idp->id_data[0]; DEBUG(10,("case ACEID_USER ace->info.user.uid is %d\n",ace->info.user.uid)); ace->a_type = SMB_ACL_USER; break; } case ACEID_GROUP: { ace->info.group.gid = idp->id_data[0]; DEBUG(10,("case ACEID_GROUP ace->info.group.gid is %d\n",ace->info.group.gid)); ace->a_type = SMB_ACL_GROUP; break; } default: break; } /* The access in the acl entries must be left shifted by * * three bites, because they will ultimately be compared * * to S_IRUSR, S_IWUSR, and S_IXUSR. */ switch(acl_entry->ace_type){ case ACC_PERMIT: case ACC_SPECIFY: ace->a_perm = acl_entry->ace_access; ace->a_perm <<= 6; DEBUG(10,("ace->a_perm is %d\n",ace->a_perm)); break; case ACC_DENY: /* Since there is no way to return a DENY acl entry * * change to PERMIT and then shift. */ DEBUG(10,("acl_entry->ace_access is %d\n",acl_entry->ace_access)); ace->a_perm = ~acl_entry->ace_access & 7; DEBUG(10,("ace->a_perm is %d\n",ace->a_perm)); ace->a_perm <<= 6; break; default: DEBUG(0, ("unknown ace->type\n")); TALLOC_FREE(result); return(0); } result->count++; ace->a_perm |= (ace->a_perm & S_IRUSR) ? SMB_ACL_READ : 0; ace->a_perm |= (ace->a_perm & S_IWUSR) ? SMB_ACL_WRITE : 0; ace->a_perm |= (ace->a_perm & S_IXUSR) ? SMB_ACL_EXECUTE : 0; DEBUG(10,("ace->a_perm is %d\n",ace->a_perm)); DEBUG(10,("acl_entry = %p\n",(void *)acl_entry)); DEBUG(10,("The ace_type is %d\n",acl_entry->ace_type)); acl_entry = acl_nxt(acl_entry); } } /* end of if enabled */ /* Since owner, group, other acl entries are not * * part of the acl entries in an acl, they must * * be dummied up to become part of the list. */ for( i = 1; i < 4; i++) { DEBUG(10,("i is %d\n",i)); result->acl = talloc_realloc(result, result->acl, struct smb_acl_entry, result->count+1); if (result->acl == NULL) { TALLOC_FREE(result); DEBUG(0, ("talloc_realloc failed\n")); errno = ENOMEM; DEBUG(0,("Error in AIX sys_acl_get_file is %d\n",errno)); return NULL; } ace = &result->acl[result->count]; ace->info.user.uid = 0; ace->info.group.gid = 0; DEBUG(10,("ace->info.user.uid = %d\n",ace->info.user.uid)); switch(i) { case 2: ace->a_perm = file_acl->g_access << 6; ace->a_type = SMB_ACL_GROUP_OBJ; break; case 3: ace->a_perm = file_acl->o_access << 6; ace->a_type = SMB_ACL_OTHER; break; case 1: ace->a_perm = file_acl->u_access << 6; ace->a_type = SMB_ACL_USER_OBJ; break; default: return(NULL); } ace->a_perm |= ((ace->a_perm & S_IRUSR) ? SMB_ACL_READ : 0); ace->a_perm |= ((ace->a_perm & S_IWUSR) ? SMB_ACL_WRITE : 0); ace->a_perm |= ((ace->a_perm & S_IXUSR) ? SMB_ACL_EXECUTE : 0); memcpy(&result->acl[result->count],ace,sizeof(struct smb_acl_entry)); result->count++; DEBUG(10,("ace->a_perm = %d\n",ace->a_perm)); DEBUG(10,("ace->a_type = %d\n",ace->a_type)); } return result; } static ushort aixacl_smb_to_aixperm(SMB_ACL_PERM_T a_perm) { ushort ret = (ushort)0; if (a_perm & SMB_ACL_READ) ret |= R_ACC; if (a_perm & SMB_ACL_WRITE) ret |= W_ACC; if (a_perm & SMB_ACL_EXECUTE) ret |= X_ACC; return ret; } struct acl *aixacl_smb_to_aixacl(SMB_ACL_TYPE_T acltype, SMB_ACL_T theacl) { struct smb_acl_entry *smb_entry = NULL; struct acl *file_acl = NULL; struct acl *file_acl_temp = NULL; struct acl_entry *acl_entry = NULL; struct ace_id *ace_id = NULL; unsigned int id_type; unsigned int acl_length; int i; DEBUG(10,("Entering aixacl_smb_to_aixacl\n")); /* AIX has no default ACL */ if(acltype == SMB_ACL_TYPE_DEFAULT) return NULL; acl_length = BUFSIZ; file_acl = (struct acl *)SMB_MALLOC(BUFSIZ); if(file_acl == NULL) { errno = ENOMEM; DEBUG(0,("Error in aixacl_smb_to_aixacl is %d\n",errno)); return NULL; } memset(file_acl,0,BUFSIZ); file_acl->acl_len = ACL_SIZ; file_acl->acl_mode = S_IXACL; for(i=0; icount; i++ ) { smb_entry = &(theacl->acl[i]); id_type = smb_entry->a_type; DEBUG(10,("The id_type is %d\n",id_type)); switch(id_type) { case SMB_ACL_USER_OBJ: file_acl->u_access = aixacl_smb_to_aixperm(smb_entry->a_perm); continue; case SMB_ACL_GROUP_OBJ: file_acl->g_access = aixacl_smb_to_aixperm(smb_entry->a_perm); continue; case SMB_ACL_OTHER: file_acl->o_access = aixacl_smb_to_aixperm(smb_entry->a_perm); continue; case SMB_ACL_MASK: continue; case SMB_ACL_GROUP: break; /* process this */ case SMB_ACL_USER: break; /* process this */ default: /* abnormal case */ DEBUG(10,("The id_type is unknown !\n")); continue; } if((file_acl->acl_len + sizeof(struct acl_entry)) > acl_length) { acl_length += sizeof(struct acl_entry); file_acl_temp = (struct acl *)SMB_MALLOC(acl_length); if(file_acl_temp == NULL) { SAFE_FREE(file_acl); errno = ENOMEM; DEBUG(0,("Error in aixacl_smb_to_aixacl is %d\n",errno)); return NULL; } memcpy(file_acl_temp,file_acl,file_acl->acl_len); SAFE_FREE(file_acl); file_acl = file_acl_temp; } acl_entry = (struct acl_entry *)((char *)file_acl + file_acl->acl_len); file_acl->acl_len += sizeof(struct acl_entry); acl_entry->ace_len = sizeof(struct acl_entry); /* contains 1 ace_id */ acl_entry->ace_access = aixacl_smb_to_aixperm(smb_entry->a_perm); /* In order to use this, we'll need to wait until we can get denies */ /* if(!acl_entry->ace_access && acl_entry->ace_type == ACC_PERMIT) acl_entry->ace_type = ACC_SPECIFY; */ acl_entry->ace_type = ACC_SPECIFY; ace_id = acl_entry->ace_id; ace_id->id_type = (smb_entry->a_type==SMB_ACL_GROUP) ? ACEID_GROUP : ACEID_USER; DEBUG(10,("The id type is %d\n",ace_id->id_type)); ace_id->id_len = sizeof(struct ace_id); /* contains 1 id_data */ ace_id->id_data[0] = (smb_entry->a_type==SMB_ACL_GROUP) ? smb_entry->info.group.gid : smb_entry->info.user.uid; } return file_acl; }