]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - fs/cifs/cifsacl.c
cifs: have cifsFileInfo hold a reference to a tlink rather than tcon pointer
[mirror_ubuntu-bionic-kernel.git] / fs / cifs / cifsacl.c
CommitLineData
bcb02034
SF
1/*
2 * fs/cifs/cifsacl.c
3 *
8b1327f6 4 * Copyright (C) International Business Machines Corp., 2007,2008
bcb02034
SF
5 * Author(s): Steve French (sfrench@us.ibm.com)
6 *
7 * Contains the routines for mapping CIFS/NTFS ACLs
8 *
9 * This library is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU Lesser General Public License as published
11 * by the Free Software Foundation; either version 2.1 of the License, or
12 * (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
17 * the GNU Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public License
20 * along with this library; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 */
23
65874007 24#include <linux/fs.h>
5a0e3ad6 25#include <linux/slab.h>
65874007
SF
26#include "cifspdu.h"
27#include "cifsglob.h"
d0d66c44 28#include "cifsacl.h"
65874007
SF
29#include "cifsproto.h"
30#include "cifs_debug.h"
65874007 31
297647c2
SF
32
33#ifdef CONFIG_CIFS_EXPERIMENTAL
34
af6f4612 35static struct cifs_wksid wksidarr[NUM_WK_SIDS] = {
297647c2
SF
36 {{1, 0, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0} }, "null user"},
37 {{1, 1, {0, 0, 0, 0, 0, 1}, {0, 0, 0, 0, 0} }, "nobody"},
536abdb0
JL
38 {{1, 1, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(11), 0, 0, 0, 0} }, "net-users"},
39 {{1, 1, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(18), 0, 0, 0, 0} }, "sys"},
40 {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(544), 0, 0, 0} }, "root"},
41 {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(545), 0, 0, 0} }, "users"},
42 {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(546), 0, 0, 0} }, "guest"} }
44093ca2 43;
297647c2
SF
44
45
bcb02034 46/* security id for everyone */
e01b6400
SP
47static const struct cifs_sid sid_everyone = {
48 1, 1, {0, 0, 0, 0, 0, 1}, {0} };
bcb02034 49/* group users */
ad7a2926 50static const struct cifs_sid sid_user = {1, 2 , {0, 0, 0, 0, 0, 5}, {} };
d0d66c44 51
297647c2
SF
52
53int match_sid(struct cifs_sid *ctsid)
54{
55 int i, j;
56 int num_subauth, num_sat, num_saw;
57 struct cifs_sid *cwsid;
58
59 if (!ctsid)
ef571cad 60 return -1;
297647c2
SF
61
62 for (i = 0; i < NUM_WK_SIDS; ++i) {
63 cwsid = &(wksidarr[i].cifssid);
64
65 /* compare the revision */
66 if (ctsid->revision != cwsid->revision)
67 continue;
68
69 /* compare all of the six auth values */
70 for (j = 0; j < 6; ++j) {
71 if (ctsid->authority[j] != cwsid->authority[j])
72 break;
73 }
74 if (j < 6)
75 continue; /* all of the auth values did not match */
76
77 /* compare all of the subauth values if any */
ce51ae14
DK
78 num_sat = ctsid->num_subauth;
79 num_saw = cwsid->num_subauth;
297647c2
SF
80 num_subauth = num_sat < num_saw ? num_sat : num_saw;
81 if (num_subauth) {
82 for (j = 0; j < num_subauth; ++j) {
83 if (ctsid->sub_auth[j] != cwsid->sub_auth[j])
84 break;
85 }
86 if (j < num_subauth)
87 continue; /* all sub_auth values do not match */
88 }
89
b6b38f70 90 cFYI(1, "matching sid: %s\n", wksidarr[i].sidname);
ef571cad 91 return 0; /* sids compare/match */
297647c2
SF
92 }
93
b6b38f70 94 cFYI(1, "No matching sid");
ef571cad 95 return -1;
297647c2
SF
96}
97
a750e77c
SF
98/* if the two SIDs (roughly equivalent to a UUID for a user or group) are
99 the same returns 1, if they do not match returns 0 */
630f3f0c 100int compare_sids(const struct cifs_sid *ctsid, const struct cifs_sid *cwsid)
297647c2
SF
101{
102 int i;
103 int num_subauth, num_sat, num_saw;
104
105 if ((!ctsid) || (!cwsid))
ef571cad 106 return 0;
297647c2
SF
107
108 /* compare the revision */
109 if (ctsid->revision != cwsid->revision)
ef571cad 110 return 0;
297647c2
SF
111
112 /* compare all of the six auth values */
113 for (i = 0; i < 6; ++i) {
114 if (ctsid->authority[i] != cwsid->authority[i])
ef571cad 115 return 0;
297647c2
SF
116 }
117
118 /* compare all of the subauth values if any */
adbc0358 119 num_sat = ctsid->num_subauth;
adddd49d 120 num_saw = cwsid->num_subauth;
297647c2
SF
121 num_subauth = num_sat < num_saw ? num_sat : num_saw;
122 if (num_subauth) {
123 for (i = 0; i < num_subauth; ++i) {
124 if (ctsid->sub_auth[i] != cwsid->sub_auth[i])
ef571cad 125 return 0;
297647c2
SF
126 }
127 }
128
ef571cad 129 return 1; /* sids compare/match */
297647c2
SF
130}
131
97837582
SF
132
133/* copy ntsd, owner sid, and group sid from a security descriptor to another */
134static void copy_sec_desc(const struct cifs_ntsd *pntsd,
135 struct cifs_ntsd *pnntsd, __u32 sidsoffset)
136{
137 int i;
138
139 struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
140 struct cifs_sid *nowner_sid_ptr, *ngroup_sid_ptr;
141
142 /* copy security descriptor control portion */
143 pnntsd->revision = pntsd->revision;
144 pnntsd->type = pntsd->type;
145 pnntsd->dacloffset = cpu_to_le32(sizeof(struct cifs_ntsd));
146 pnntsd->sacloffset = 0;
147 pnntsd->osidoffset = cpu_to_le32(sidsoffset);
148 pnntsd->gsidoffset = cpu_to_le32(sidsoffset + sizeof(struct cifs_sid));
149
150 /* copy owner sid */
151 owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
152 le32_to_cpu(pntsd->osidoffset));
153 nowner_sid_ptr = (struct cifs_sid *)((char *)pnntsd + sidsoffset);
154
155 nowner_sid_ptr->revision = owner_sid_ptr->revision;
156 nowner_sid_ptr->num_subauth = owner_sid_ptr->num_subauth;
157 for (i = 0; i < 6; i++)
158 nowner_sid_ptr->authority[i] = owner_sid_ptr->authority[i];
159 for (i = 0; i < 5; i++)
160 nowner_sid_ptr->sub_auth[i] = owner_sid_ptr->sub_auth[i];
161
162 /* copy group sid */
163 group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
164 le32_to_cpu(pntsd->gsidoffset));
165 ngroup_sid_ptr = (struct cifs_sid *)((char *)pnntsd + sidsoffset +
166 sizeof(struct cifs_sid));
167
168 ngroup_sid_ptr->revision = group_sid_ptr->revision;
169 ngroup_sid_ptr->num_subauth = group_sid_ptr->num_subauth;
170 for (i = 0; i < 6; i++)
171 ngroup_sid_ptr->authority[i] = group_sid_ptr->authority[i];
172 for (i = 0; i < 5; i++)
b1910ad6 173 ngroup_sid_ptr->sub_auth[i] = group_sid_ptr->sub_auth[i];
97837582
SF
174
175 return;
176}
177
178
630f3f0c
SF
179/*
180 change posix mode to reflect permissions
181 pmode is the existing mode (we only want to overwrite part of this
182 bits to set can be: S_IRWXU, S_IRWXG or S_IRWXO ie 00700 or 00070 or 00007
183*/
9b5e6857 184static void access_flags_to_mode(__le32 ace_flags, int type, umode_t *pmode,
15b03959 185 umode_t *pbits_to_set)
630f3f0c 186{
9b5e6857 187 __u32 flags = le32_to_cpu(ace_flags);
15b03959 188 /* the order of ACEs is important. The canonical order is to begin with
ce06c9f0 189 DENY entries followed by ALLOW, otherwise an allow entry could be
15b03959 190 encountered first, making the subsequent deny entry like "dead code"
ce06c9f0 191 which would be superflous since Windows stops when a match is made
15b03959
SF
192 for the operation you are trying to perform for your user */
193
194 /* For deny ACEs we change the mask so that subsequent allow access
195 control entries do not turn on the bits we are denying */
196 if (type == ACCESS_DENIED) {
ad7a2926 197 if (flags & GENERIC_ALL)
15b03959 198 *pbits_to_set &= ~S_IRWXUGO;
ad7a2926 199
9b5e6857
AV
200 if ((flags & GENERIC_WRITE) ||
201 ((flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS))
15b03959 202 *pbits_to_set &= ~S_IWUGO;
9b5e6857
AV
203 if ((flags & GENERIC_READ) ||
204 ((flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS))
15b03959 205 *pbits_to_set &= ~S_IRUGO;
9b5e6857
AV
206 if ((flags & GENERIC_EXECUTE) ||
207 ((flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS))
15b03959
SF
208 *pbits_to_set &= ~S_IXUGO;
209 return;
210 } else if (type != ACCESS_ALLOWED) {
b6b38f70 211 cERROR(1, "unknown access control type %d", type);
15b03959
SF
212 return;
213 }
214 /* else ACCESS_ALLOWED type */
630f3f0c 215
9b5e6857 216 if (flags & GENERIC_ALL) {
15b03959 217 *pmode |= (S_IRWXUGO & (*pbits_to_set));
b6b38f70 218 cFYI(DBG2, "all perms");
d61e5808
SF
219 return;
220 }
9b5e6857
AV
221 if ((flags & GENERIC_WRITE) ||
222 ((flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS))
15b03959 223 *pmode |= (S_IWUGO & (*pbits_to_set));
9b5e6857
AV
224 if ((flags & GENERIC_READ) ||
225 ((flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS))
15b03959 226 *pmode |= (S_IRUGO & (*pbits_to_set));
9b5e6857
AV
227 if ((flags & GENERIC_EXECUTE) ||
228 ((flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS))
15b03959 229 *pmode |= (S_IXUGO & (*pbits_to_set));
630f3f0c 230
b6b38f70 231 cFYI(DBG2, "access flags 0x%x mode now 0x%x", flags, *pmode);
630f3f0c
SF
232 return;
233}
234
ce06c9f0
SF
235/*
236 Generate access flags to reflect permissions mode is the existing mode.
237 This function is called for every ACE in the DACL whose SID matches
238 with either owner or group or everyone.
239*/
240
241static void mode_to_access_flags(umode_t mode, umode_t bits_to_use,
242 __u32 *pace_flags)
243{
244 /* reset access mask */
245 *pace_flags = 0x0;
246
247 /* bits to use are either S_IRWXU or S_IRWXG or S_IRWXO */
248 mode &= bits_to_use;
249
250 /* check for R/W/X UGO since we do not know whose flags
251 is this but we have cleared all the bits sans RWX for
252 either user or group or other as per bits_to_use */
253 if (mode & S_IRUGO)
254 *pace_flags |= SET_FILE_READ_RIGHTS;
255 if (mode & S_IWUGO)
256 *pace_flags |= SET_FILE_WRITE_RIGHTS;
257 if (mode & S_IXUGO)
258 *pace_flags |= SET_FILE_EXEC_RIGHTS;
259
b6b38f70 260 cFYI(DBG2, "mode: 0x%x, access flags now 0x%x", mode, *pace_flags);
ce06c9f0
SF
261 return;
262}
263
2b210adc 264static __u16 fill_ace_for_sid(struct cifs_ace *pntace,
97837582
SF
265 const struct cifs_sid *psid, __u64 nmode, umode_t bits)
266{
267 int i;
268 __u16 size = 0;
269 __u32 access_req = 0;
270
271 pntace->type = ACCESS_ALLOWED;
272 pntace->flags = 0x0;
273 mode_to_access_flags(nmode, bits, &access_req);
274 if (!access_req)
275 access_req = SET_MINIMUM_RIGHTS;
276 pntace->access_req = cpu_to_le32(access_req);
277
278 pntace->sid.revision = psid->revision;
279 pntace->sid.num_subauth = psid->num_subauth;
280 for (i = 0; i < 6; i++)
281 pntace->sid.authority[i] = psid->authority[i];
282 for (i = 0; i < psid->num_subauth; i++)
283 pntace->sid.sub_auth[i] = psid->sub_auth[i];
284
285 size = 1 + 1 + 2 + 4 + 1 + 1 + 6 + (psid->num_subauth * 4);
286 pntace->size = cpu_to_le16(size);
287
ef571cad 288 return size;
97837582
SF
289}
290
297647c2 291
953f8681
SF
292#ifdef CONFIG_CIFS_DEBUG2
293static void dump_ace(struct cifs_ace *pace, char *end_of_acl)
d0d66c44 294{
d0d66c44 295 int num_subauth;
d0d66c44
SP
296
297 /* validate that we do not go past end of acl */
297647c2 298
44093ca2 299 if (le16_to_cpu(pace->size) < 16) {
b6b38f70 300 cERROR(1, "ACE too small %d", le16_to_cpu(pace->size));
44093ca2
SF
301 return;
302 }
303
304 if (end_of_acl < (char *)pace + le16_to_cpu(pace->size)) {
b6b38f70 305 cERROR(1, "ACL too small to parse ACE");
d0d66c44 306 return;
44093ca2 307 }
d0d66c44 308
44093ca2 309 num_subauth = pace->sid.num_subauth;
d0d66c44 310 if (num_subauth) {
8f18c131 311 int i;
b6b38f70 312 cFYI(1, "ACE revision %d num_auth %d type %d flags %d size %d",
44093ca2 313 pace->sid.revision, pace->sid.num_subauth, pace->type,
b6b38f70 314 pace->flags, le16_to_cpu(pace->size));
d12fd121 315 for (i = 0; i < num_subauth; ++i) {
b6b38f70
JP
316 cFYI(1, "ACE sub_auth[%d]: 0x%x", i,
317 le32_to_cpu(pace->sid.sub_auth[i]));
d12fd121
SF
318 }
319
320 /* BB add length check to make sure that we do not have huge
321 num auths and therefore go off the end */
d12fd121
SF
322 }
323
324 return;
325}
953f8681 326#endif
d12fd121 327
d0d66c44 328
a750e77c 329static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
d61e5808 330 struct cifs_sid *pownersid, struct cifs_sid *pgrpsid,
0b8f18e3 331 struct cifs_fattr *fattr)
d0d66c44
SP
332{
333 int i;
334 int num_aces = 0;
335 int acl_size;
336 char *acl_base;
d0d66c44
SP
337 struct cifs_ace **ppace;
338
339 /* BB need to add parm so we can store the SID BB */
340
2b83457b
SF
341 if (!pdacl) {
342 /* no DACL in the security descriptor, set
343 all the permissions for user/group/other */
0b8f18e3 344 fattr->cf_mode |= S_IRWXUGO;
2b83457b
SF
345 return;
346 }
347
d0d66c44 348 /* validate that we do not go past end of acl */
af6f4612 349 if (end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size)) {
b6b38f70 350 cERROR(1, "ACL too small to parse DACL");
d0d66c44
SP
351 return;
352 }
353
b6b38f70 354 cFYI(DBG2, "DACL revision %d size %d num aces %d",
af6f4612 355 le16_to_cpu(pdacl->revision), le16_to_cpu(pdacl->size),
b6b38f70 356 le32_to_cpu(pdacl->num_aces));
d0d66c44 357
7505e052
SF
358 /* reset rwx permissions for user/group/other.
359 Also, if num_aces is 0 i.e. DACL has no ACEs,
360 user/group/other have no permissions */
0b8f18e3 361 fattr->cf_mode &= ~(S_IRWXUGO);
7505e052 362
d0d66c44
SP
363 acl_base = (char *)pdacl;
364 acl_size = sizeof(struct cifs_acl);
365
adbc0358 366 num_aces = le32_to_cpu(pdacl->num_aces);
d0d66c44 367 if (num_aces > 0) {
15b03959
SF
368 umode_t user_mask = S_IRWXU;
369 umode_t group_mask = S_IRWXG;
370 umode_t other_mask = S_IRWXO;
371
d0d66c44
SP
372 ppace = kmalloc(num_aces * sizeof(struct cifs_ace *),
373 GFP_KERNEL);
374
d0d66c44 375 for (i = 0; i < num_aces; ++i) {
44093ca2 376 ppace[i] = (struct cifs_ace *) (acl_base + acl_size);
953f8681
SF
377#ifdef CONFIG_CIFS_DEBUG2
378 dump_ace(ppace[i], end_of_acl);
379#endif
e01b6400
SP
380 if (compare_sids(&(ppace[i]->sid), pownersid))
381 access_flags_to_mode(ppace[i]->access_req,
15b03959 382 ppace[i]->type,
0b8f18e3 383 &fattr->cf_mode,
15b03959 384 &user_mask);
e01b6400
SP
385 if (compare_sids(&(ppace[i]->sid), pgrpsid))
386 access_flags_to_mode(ppace[i]->access_req,
15b03959 387 ppace[i]->type,
0b8f18e3 388 &fattr->cf_mode,
15b03959 389 &group_mask);
e01b6400
SP
390 if (compare_sids(&(ppace[i]->sid), &sid_everyone))
391 access_flags_to_mode(ppace[i]->access_req,
15b03959 392 ppace[i]->type,
0b8f18e3 393 &fattr->cf_mode,
15b03959 394 &other_mask);
e01b6400 395
44093ca2 396/* memcpy((void *)(&(cifscred->aces[i])),
d12fd121
SF
397 (void *)ppace[i],
398 sizeof(struct cifs_ace)); */
d0d66c44 399
44093ca2
SF
400 acl_base = (char *)ppace[i];
401 acl_size = le16_to_cpu(ppace[i]->size);
d0d66c44
SP
402 }
403
404 kfree(ppace);
d0d66c44
SP
405 }
406
407 return;
408}
409
bcb02034 410
97837582
SF
411static int set_chmod_dacl(struct cifs_acl *pndacl, struct cifs_sid *pownersid,
412 struct cifs_sid *pgrpsid, __u64 nmode)
413{
2b210adc 414 u16 size = 0;
97837582
SF
415 struct cifs_acl *pnndacl;
416
417 pnndacl = (struct cifs_acl *)((char *)pndacl + sizeof(struct cifs_acl));
418
419 size += fill_ace_for_sid((struct cifs_ace *) ((char *)pnndacl + size),
420 pownersid, nmode, S_IRWXU);
421 size += fill_ace_for_sid((struct cifs_ace *)((char *)pnndacl + size),
422 pgrpsid, nmode, S_IRWXG);
423 size += fill_ace_for_sid((struct cifs_ace *)((char *)pnndacl + size),
424 &sid_everyone, nmode, S_IRWXO);
425
426 pndacl->size = cpu_to_le16(size + sizeof(struct cifs_acl));
d9f382ef 427 pndacl->num_aces = cpu_to_le32(3);
97837582 428
ef571cad 429 return 0;
97837582
SF
430}
431
432
bcb02034
SF
433static int parse_sid(struct cifs_sid *psid, char *end_of_acl)
434{
435 /* BB need to add parm so we can store the SID BB */
436
b9c7a2bb
SF
437 /* validate that we do not go past end of ACL - sid must be at least 8
438 bytes long (assuming no sub-auths - e.g. the null SID */
439 if (end_of_acl < (char *)psid + 8) {
b6b38f70 440 cERROR(1, "ACL too small to parse SID %p", psid);
bcb02034
SF
441 return -EINVAL;
442 }
d0d66c44 443
af6f4612 444 if (psid->num_subauth) {
bcb02034 445#ifdef CONFIG_CIFS_DEBUG2
8f18c131 446 int i;
b6b38f70
JP
447 cFYI(1, "SID revision %d num_auth %d",
448 psid->revision, psid->num_subauth);
bcb02034 449
af6f4612 450 for (i = 0; i < psid->num_subauth; i++) {
b6b38f70
JP
451 cFYI(1, "SID sub_auth[%d]: 0x%x ", i,
452 le32_to_cpu(psid->sub_auth[i]));
d0d66c44
SP
453 }
454
d12fd121 455 /* BB add length check to make sure that we do not have huge
d0d66c44 456 num auths and therefore go off the end */
b6b38f70
JP
457 cFYI(1, "RID 0x%x",
458 le32_to_cpu(psid->sub_auth[psid->num_subauth-1]));
bcb02034 459#endif
d0d66c44
SP
460 }
461
bcb02034
SF
462 return 0;
463}
464
d0d66c44 465
bcb02034 466/* Convert CIFS ACL to POSIX form */
630f3f0c 467static int parse_sec_desc(struct cifs_ntsd *pntsd, int acl_len,
0b8f18e3 468 struct cifs_fattr *fattr)
bcb02034 469{
d0d66c44 470 int rc;
bcb02034
SF
471 struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
472 struct cifs_acl *dacl_ptr; /* no need for SACL ptr */
bcb02034 473 char *end_of_acl = ((char *)pntsd) + acl_len;
7505e052 474 __u32 dacloffset;
bcb02034 475
0b8f18e3 476 if (pntsd == NULL)
b9c7a2bb
SF
477 return -EIO;
478
bcb02034 479 owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
af6f4612 480 le32_to_cpu(pntsd->osidoffset));
bcb02034 481 group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
af6f4612 482 le32_to_cpu(pntsd->gsidoffset));
7505e052 483 dacloffset = le32_to_cpu(pntsd->dacloffset);
63d2583f 484 dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset);
b6b38f70 485 cFYI(DBG2, "revision %d type 0x%x ooffset 0x%x goffset 0x%x "
bcb02034 486 "sacloffset 0x%x dacloffset 0x%x",
af6f4612
SF
487 pntsd->revision, pntsd->type, le32_to_cpu(pntsd->osidoffset),
488 le32_to_cpu(pntsd->gsidoffset),
b6b38f70 489 le32_to_cpu(pntsd->sacloffset), dacloffset);
b9c7a2bb 490/* cifs_dump_mem("owner_sid: ", owner_sid_ptr, 64); */
bcb02034
SF
491 rc = parse_sid(owner_sid_ptr, end_of_acl);
492 if (rc)
493 return rc;
494
495 rc = parse_sid(group_sid_ptr, end_of_acl);
496 if (rc)
497 return rc;
498
7505e052
SF
499 if (dacloffset)
500 parse_dacl(dacl_ptr, end_of_acl, owner_sid_ptr,
0b8f18e3 501 group_sid_ptr, fattr);
7505e052 502 else
b6b38f70 503 cFYI(1, "no ACL"); /* BB grant all or default perms? */
d0d66c44 504
bcb02034
SF
505/* cifscred->uid = owner_sid_ptr->rid;
506 cifscred->gid = group_sid_ptr->rid;
507 memcpy((void *)(&(cifscred->osid)), (void *)owner_sid_ptr,
630f3f0c 508 sizeof(struct cifs_sid));
bcb02034 509 memcpy((void *)(&(cifscred->gsid)), (void *)group_sid_ptr,
630f3f0c 510 sizeof(struct cifs_sid)); */
bcb02034 511
ef571cad 512 return 0;
bcb02034 513}
b9c7a2bb
SF
514
515
97837582
SF
516/* Convert permission bits from mode to equivalent CIFS ACL */
517static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd,
cce246ee 518 struct inode *inode, __u64 nmode)
97837582
SF
519{
520 int rc = 0;
521 __u32 dacloffset;
522 __u32 ndacloffset;
523 __u32 sidsoffset;
524 struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
525 struct cifs_acl *dacl_ptr = NULL; /* no need for SACL ptr */
526 struct cifs_acl *ndacl_ptr = NULL; /* no need for SACL ptr */
527
528 if ((inode == NULL) || (pntsd == NULL) || (pnntsd == NULL))
ef571cad 529 return -EIO;
97837582
SF
530
531 owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
532 le32_to_cpu(pntsd->osidoffset));
533 group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
534 le32_to_cpu(pntsd->gsidoffset));
535
536 dacloffset = le32_to_cpu(pntsd->dacloffset);
537 dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset);
538
539 ndacloffset = sizeof(struct cifs_ntsd);
540 ndacl_ptr = (struct cifs_acl *)((char *)pnntsd + ndacloffset);
541 ndacl_ptr->revision = dacl_ptr->revision;
542 ndacl_ptr->size = 0;
543 ndacl_ptr->num_aces = 0;
544
545 rc = set_chmod_dacl(ndacl_ptr, owner_sid_ptr, group_sid_ptr, nmode);
546
547 sidsoffset = ndacloffset + le16_to_cpu(ndacl_ptr->size);
548
549 /* copy security descriptor control portion and owner and group sid */
550 copy_sec_desc(pntsd, pnntsd, sidsoffset);
551
ef571cad 552 return rc;
97837582
SF
553}
554
1bf4072d
CH
555static struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb,
556 __u16 fid, u32 *pacllen)
b9c7a2bb 557{
b9c7a2bb 558 struct cifs_ntsd *pntsd = NULL;
1bf4072d 559 int xid, rc;
7ffec372
JL
560 struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
561
562 if (IS_ERR(tlink))
563 return NULL;
b9c7a2bb 564
1bf4072d 565 xid = GetXid();
7ffec372 566 rc = CIFSSMBGetCIFSACL(xid, tlink_tcon(tlink), fid, &pntsd, pacllen);
1bf4072d 567 FreeXid(xid);
b9c7a2bb 568
7ffec372 569 cifs_put_tlink(tlink);
b9c7a2bb 570
b6b38f70 571 cFYI(1, "GetCIFSACL rc = %d ACL len %d", rc, *pacllen);
1bf4072d
CH
572 return pntsd;
573}
8b1327f6 574
1bf4072d
CH
575static struct cifs_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb,
576 const char *path, u32 *pacllen)
577{
578 struct cifs_ntsd *pntsd = NULL;
579 int oplock = 0;
580 int xid, rc;
581 __u16 fid;
7ffec372
JL
582 struct cifsTconInfo *tcon;
583 struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
584
585 if (IS_ERR(tlink))
586 return NULL;
b9c7a2bb 587
7ffec372 588 tcon = tlink_tcon(tlink);
1bf4072d
CH
589 xid = GetXid();
590
7ffec372 591 rc = CIFSSMBOpen(xid, tcon, path, FILE_OPEN, READ_CONTROL, 0,
1bf4072d
CH
592 &fid, &oplock, NULL, cifs_sb->local_nls,
593 cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
594 if (rc) {
b6b38f70 595 cERROR(1, "Unable to open file to get ACL");
1bf4072d 596 goto out;
b9c7a2bb
SF
597 }
598
7ffec372 599 rc = CIFSSMBGetCIFSACL(xid, tcon, fid, &pntsd, pacllen);
b6b38f70 600 cFYI(1, "GetCIFSACL rc = %d ACL len %d", rc, *pacllen);
b9c7a2bb 601
7ffec372 602 CIFSSMBClose(xid, tcon, fid);
1bf4072d 603 out:
7ffec372 604 cifs_put_tlink(tlink);
7505e052
SF
605 FreeXid(xid);
606 return pntsd;
607}
608
1bf4072d
CH
609/* Retrieve an ACL from the server */
610static struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb,
611 struct inode *inode, const char *path,
612 u32 *pacllen)
613{
614 struct cifs_ntsd *pntsd = NULL;
615 struct cifsFileInfo *open_file = NULL;
616
617 if (inode)
618 open_file = find_readable_file(CIFS_I(inode));
619 if (!open_file)
620 return get_cifs_acl_by_path(cifs_sb, path, pacllen);
621
622 pntsd = get_cifs_acl_by_fid(cifs_sb, open_file->netfid, pacllen);
6ab409b5 623 cifsFileInfo_put(open_file);
1bf4072d
CH
624 return pntsd;
625}
626
b96d31a6
CH
627static int set_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb, __u16 fid,
628 struct cifs_ntsd *pnntsd, u32 acllen)
97837582 629{
b96d31a6 630 int xid, rc;
7ffec372
JL
631 struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
632
633 if (IS_ERR(tlink))
634 return PTR_ERR(tlink);
97837582 635
b96d31a6 636 xid = GetXid();
7ffec372 637 rc = CIFSSMBSetCIFSACL(xid, tlink_tcon(tlink), fid, pnntsd, acllen);
b96d31a6 638 FreeXid(xid);
7ffec372 639 cifs_put_tlink(tlink);
97837582 640
b6b38f70 641 cFYI(DBG2, "SetCIFSACL rc = %d", rc);
b96d31a6
CH
642 return rc;
643}
97837582 644
b96d31a6
CH
645static int set_cifs_acl_by_path(struct cifs_sb_info *cifs_sb, const char *path,
646 struct cifs_ntsd *pnntsd, u32 acllen)
647{
648 int oplock = 0;
649 int xid, rc;
650 __u16 fid;
7ffec372
JL
651 struct cifsTconInfo *tcon;
652 struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
97837582 653
7ffec372
JL
654 if (IS_ERR(tlink))
655 return PTR_ERR(tlink);
656
657 tcon = tlink_tcon(tlink);
97837582
SF
658 xid = GetXid();
659
7ffec372 660 rc = CIFSSMBOpen(xid, tcon, path, FILE_OPEN, WRITE_DAC, 0,
b96d31a6
CH
661 &fid, &oplock, NULL, cifs_sb->local_nls,
662 cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
663 if (rc) {
b6b38f70 664 cERROR(1, "Unable to open file to set ACL");
b96d31a6 665 goto out;
97837582
SF
666 }
667
7ffec372 668 rc = CIFSSMBSetCIFSACL(xid, tcon, fid, pnntsd, acllen);
b6b38f70 669 cFYI(DBG2, "SetCIFSACL rc = %d", rc);
97837582 670
7ffec372
JL
671 CIFSSMBClose(xid, tcon, fid);
672out:
97837582 673 FreeXid(xid);
7ffec372 674 cifs_put_tlink(tlink);
b96d31a6
CH
675 return rc;
676}
97837582 677
b96d31a6
CH
678/* Set an ACL on the server */
679static int set_cifs_acl(struct cifs_ntsd *pnntsd, __u32 acllen,
680 struct inode *inode, const char *path)
681{
682 struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
683 struct cifsFileInfo *open_file;
684 int rc;
685
b6b38f70 686 cFYI(DBG2, "set ACL for %s from mode 0x%x", path, inode->i_mode);
b96d31a6
CH
687
688 open_file = find_readable_file(CIFS_I(inode));
689 if (!open_file)
690 return set_cifs_acl_by_path(cifs_sb, path, pnntsd, acllen);
691
692 rc = set_cifs_acl_by_fid(cifs_sb, open_file->netfid, pnntsd, acllen);
6ab409b5 693 cifsFileInfo_put(open_file);
ef571cad 694 return rc;
97837582
SF
695}
696
7505e052 697/* Translate the CIFS ACL (simlar to NTFS ACL) for a file into mode bits */
0b8f18e3
JL
698void
699cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
700 struct inode *inode, const char *path, const __u16 *pfid)
7505e052
SF
701{
702 struct cifs_ntsd *pntsd = NULL;
703 u32 acllen = 0;
704 int rc = 0;
705
b6b38f70 706 cFYI(DBG2, "converting ACL to mode for %s", path);
1bf4072d
CH
707
708 if (pfid)
709 pntsd = get_cifs_acl_by_fid(cifs_sb, *pfid, &acllen);
710 else
711 pntsd = get_cifs_acl(cifs_sb, inode, path, &acllen);
7505e052
SF
712
713 /* if we can retrieve the ACL, now parse Access Control Entries, ACEs */
714 if (pntsd)
0b8f18e3 715 rc = parse_sec_desc(pntsd, acllen, fattr);
7505e052 716 if (rc)
b6b38f70 717 cFYI(1, "parse sec desc failed rc = %d", rc);
7505e052 718
b9c7a2bb 719 kfree(pntsd);
b9c7a2bb
SF
720 return;
721}
953f8681 722
7505e052 723/* Convert mode bits to an ACL so we can update the ACL on the server */
97837582 724int mode_to_acl(struct inode *inode, const char *path, __u64 nmode)
953f8681
SF
725{
726 int rc = 0;
cce246ee 727 __u32 secdesclen = 0;
97837582
SF
728 struct cifs_ntsd *pntsd = NULL; /* acl obtained from server */
729 struct cifs_ntsd *pnntsd = NULL; /* modified acl to be sent to server */
953f8681 730
b6b38f70 731 cFYI(DBG2, "set ACL from mode for %s", path);
953f8681
SF
732
733 /* Get the security descriptor */
1bf4072d 734 pntsd = get_cifs_acl(CIFS_SB(inode->i_sb), inode, path, &secdesclen);
953f8681 735
97837582
SF
736 /* Add three ACEs for owner, group, everyone getting rid of
737 other ACEs as chmod disables ACEs and set the security descriptor */
953f8681 738
97837582
SF
739 if (pntsd) {
740 /* allocate memory for the smb header,
741 set security descriptor request security descriptor
742 parameters, and secuirty descriptor itself */
953f8681 743
cce246ee
SF
744 secdesclen = secdesclen < DEFSECDESCLEN ?
745 DEFSECDESCLEN : secdesclen;
746 pnntsd = kmalloc(secdesclen, GFP_KERNEL);
97837582 747 if (!pnntsd) {
b6b38f70 748 cERROR(1, "Unable to allocate security descriptor");
97837582 749 kfree(pntsd);
ef571cad 750 return -ENOMEM;
97837582 751 }
7505e052 752
cce246ee 753 rc = build_sec_desc(pntsd, pnntsd, inode, nmode);
97837582 754
b6b38f70 755 cFYI(DBG2, "build_sec_desc rc: %d", rc);
97837582
SF
756
757 if (!rc) {
758 /* Set the security descriptor */
cce246ee 759 rc = set_cifs_acl(pnntsd, secdesclen, inode, path);
b6b38f70 760 cFYI(DBG2, "set_cifs_acl rc: %d", rc);
97837582
SF
761 }
762
763 kfree(pnntsd);
764 kfree(pntsd);
765 }
766
ef571cad 767 return rc;
953f8681 768}
297647c2 769#endif /* CONFIG_CIFS_EXPERIMENTAL */