]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - fs/cifs/cifsacl.c
[CIFS] update cifs version number
[mirror_ubuntu-bionic-kernel.git] / fs / cifs / cifsacl.c
CommitLineData
bcb02034
SF
1/*
2 * fs/cifs/cifsacl.c
3 *
8b1327f6 4 * Copyright (C) International Business Machines Corp., 2007,2008
bcb02034
SF
5 * Author(s): Steve French (sfrench@us.ibm.com)
6 *
7 * Contains the routines for mapping CIFS/NTFS ACLs
8 *
9 * This library is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU Lesser General Public License as published
11 * by the Free Software Foundation; either version 2.1 of the License, or
12 * (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
17 * the GNU Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public License
20 * along with this library; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 */
23
65874007
SF
24#include <linux/fs.h>
25#include "cifspdu.h"
26#include "cifsglob.h"
d0d66c44 27#include "cifsacl.h"
65874007
SF
28#include "cifsproto.h"
29#include "cifs_debug.h"
65874007 30
297647c2
SF
31
32#ifdef CONFIG_CIFS_EXPERIMENTAL
33
af6f4612 34static struct cifs_wksid wksidarr[NUM_WK_SIDS] = {
297647c2
SF
35 {{1, 0, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0} }, "null user"},
36 {{1, 1, {0, 0, 0, 0, 0, 1}, {0, 0, 0, 0, 0} }, "nobody"},
536abdb0
JL
37 {{1, 1, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(11), 0, 0, 0, 0} }, "net-users"},
38 {{1, 1, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(18), 0, 0, 0, 0} }, "sys"},
39 {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(544), 0, 0, 0} }, "root"},
40 {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(545), 0, 0, 0} }, "users"},
41 {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(546), 0, 0, 0} }, "guest"} }
44093ca2 42;
297647c2
SF
43
44
bcb02034 45/* security id for everyone */
e01b6400
SP
46static const struct cifs_sid sid_everyone = {
47 1, 1, {0, 0, 0, 0, 0, 1}, {0} };
bcb02034 48/* group users */
ad7a2926 49static const struct cifs_sid sid_user = {1, 2 , {0, 0, 0, 0, 0, 5}, {} };
d0d66c44 50
297647c2
SF
51
52int match_sid(struct cifs_sid *ctsid)
53{
54 int i, j;
55 int num_subauth, num_sat, num_saw;
56 struct cifs_sid *cwsid;
57
58 if (!ctsid)
ef571cad 59 return -1;
297647c2
SF
60
61 for (i = 0; i < NUM_WK_SIDS; ++i) {
62 cwsid = &(wksidarr[i].cifssid);
63
64 /* compare the revision */
65 if (ctsid->revision != cwsid->revision)
66 continue;
67
68 /* compare all of the six auth values */
69 for (j = 0; j < 6; ++j) {
70 if (ctsid->authority[j] != cwsid->authority[j])
71 break;
72 }
73 if (j < 6)
74 continue; /* all of the auth values did not match */
75
76 /* compare all of the subauth values if any */
ce51ae14
DK
77 num_sat = ctsid->num_subauth;
78 num_saw = cwsid->num_subauth;
297647c2
SF
79 num_subauth = num_sat < num_saw ? num_sat : num_saw;
80 if (num_subauth) {
81 for (j = 0; j < num_subauth; ++j) {
82 if (ctsid->sub_auth[j] != cwsid->sub_auth[j])
83 break;
84 }
85 if (j < num_subauth)
86 continue; /* all sub_auth values do not match */
87 }
88
89 cFYI(1, ("matching sid: %s\n", wksidarr[i].sidname));
ef571cad 90 return 0; /* sids compare/match */
297647c2
SF
91 }
92
93 cFYI(1, ("No matching sid"));
ef571cad 94 return -1;
297647c2
SF
95}
96
a750e77c
SF
97/* if the two SIDs (roughly equivalent to a UUID for a user or group) are
98 the same returns 1, if they do not match returns 0 */
630f3f0c 99int compare_sids(const struct cifs_sid *ctsid, const struct cifs_sid *cwsid)
297647c2
SF
100{
101 int i;
102 int num_subauth, num_sat, num_saw;
103
104 if ((!ctsid) || (!cwsid))
ef571cad 105 return 0;
297647c2
SF
106
107 /* compare the revision */
108 if (ctsid->revision != cwsid->revision)
ef571cad 109 return 0;
297647c2
SF
110
111 /* compare all of the six auth values */
112 for (i = 0; i < 6; ++i) {
113 if (ctsid->authority[i] != cwsid->authority[i])
ef571cad 114 return 0;
297647c2
SF
115 }
116
117 /* compare all of the subauth values if any */
adbc0358 118 num_sat = ctsid->num_subauth;
adddd49d 119 num_saw = cwsid->num_subauth;
297647c2
SF
120 num_subauth = num_sat < num_saw ? num_sat : num_saw;
121 if (num_subauth) {
122 for (i = 0; i < num_subauth; ++i) {
123 if (ctsid->sub_auth[i] != cwsid->sub_auth[i])
ef571cad 124 return 0;
297647c2
SF
125 }
126 }
127
ef571cad 128 return 1; /* sids compare/match */
297647c2
SF
129}
130
97837582
SF
131
132/* copy ntsd, owner sid, and group sid from a security descriptor to another */
133static void copy_sec_desc(const struct cifs_ntsd *pntsd,
134 struct cifs_ntsd *pnntsd, __u32 sidsoffset)
135{
136 int i;
137
138 struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
139 struct cifs_sid *nowner_sid_ptr, *ngroup_sid_ptr;
140
141 /* copy security descriptor control portion */
142 pnntsd->revision = pntsd->revision;
143 pnntsd->type = pntsd->type;
144 pnntsd->dacloffset = cpu_to_le32(sizeof(struct cifs_ntsd));
145 pnntsd->sacloffset = 0;
146 pnntsd->osidoffset = cpu_to_le32(sidsoffset);
147 pnntsd->gsidoffset = cpu_to_le32(sidsoffset + sizeof(struct cifs_sid));
148
149 /* copy owner sid */
150 owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
151 le32_to_cpu(pntsd->osidoffset));
152 nowner_sid_ptr = (struct cifs_sid *)((char *)pnntsd + sidsoffset);
153
154 nowner_sid_ptr->revision = owner_sid_ptr->revision;
155 nowner_sid_ptr->num_subauth = owner_sid_ptr->num_subauth;
156 for (i = 0; i < 6; i++)
157 nowner_sid_ptr->authority[i] = owner_sid_ptr->authority[i];
158 for (i = 0; i < 5; i++)
159 nowner_sid_ptr->sub_auth[i] = owner_sid_ptr->sub_auth[i];
160
161 /* copy group sid */
162 group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
163 le32_to_cpu(pntsd->gsidoffset));
164 ngroup_sid_ptr = (struct cifs_sid *)((char *)pnntsd + sidsoffset +
165 sizeof(struct cifs_sid));
166
167 ngroup_sid_ptr->revision = group_sid_ptr->revision;
168 ngroup_sid_ptr->num_subauth = group_sid_ptr->num_subauth;
169 for (i = 0; i < 6; i++)
170 ngroup_sid_ptr->authority[i] = group_sid_ptr->authority[i];
171 for (i = 0; i < 5; i++)
b1910ad6 172 ngroup_sid_ptr->sub_auth[i] = group_sid_ptr->sub_auth[i];
97837582
SF
173
174 return;
175}
176
177
630f3f0c
SF
178/*
179 change posix mode to reflect permissions
180 pmode is the existing mode (we only want to overwrite part of this
181 bits to set can be: S_IRWXU, S_IRWXG or S_IRWXO ie 00700 or 00070 or 00007
182*/
9b5e6857 183static void access_flags_to_mode(__le32 ace_flags, int type, umode_t *pmode,
15b03959 184 umode_t *pbits_to_set)
630f3f0c 185{
9b5e6857 186 __u32 flags = le32_to_cpu(ace_flags);
15b03959 187 /* the order of ACEs is important. The canonical order is to begin with
ce06c9f0 188 DENY entries followed by ALLOW, otherwise an allow entry could be
15b03959 189 encountered first, making the subsequent deny entry like "dead code"
ce06c9f0 190 which would be superflous since Windows stops when a match is made
15b03959
SF
191 for the operation you are trying to perform for your user */
192
193 /* For deny ACEs we change the mask so that subsequent allow access
194 control entries do not turn on the bits we are denying */
195 if (type == ACCESS_DENIED) {
ad7a2926 196 if (flags & GENERIC_ALL)
15b03959 197 *pbits_to_set &= ~S_IRWXUGO;
ad7a2926 198
9b5e6857
AV
199 if ((flags & GENERIC_WRITE) ||
200 ((flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS))
15b03959 201 *pbits_to_set &= ~S_IWUGO;
9b5e6857
AV
202 if ((flags & GENERIC_READ) ||
203 ((flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS))
15b03959 204 *pbits_to_set &= ~S_IRUGO;
9b5e6857
AV
205 if ((flags & GENERIC_EXECUTE) ||
206 ((flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS))
15b03959
SF
207 *pbits_to_set &= ~S_IXUGO;
208 return;
209 } else if (type != ACCESS_ALLOWED) {
210 cERROR(1, ("unknown access control type %d", type));
211 return;
212 }
213 /* else ACCESS_ALLOWED type */
630f3f0c 214
9b5e6857 215 if (flags & GENERIC_ALL) {
15b03959 216 *pmode |= (S_IRWXUGO & (*pbits_to_set));
90c81e0b 217 cFYI(DBG2, ("all perms"));
d61e5808
SF
218 return;
219 }
9b5e6857
AV
220 if ((flags & GENERIC_WRITE) ||
221 ((flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS))
15b03959 222 *pmode |= (S_IWUGO & (*pbits_to_set));
9b5e6857
AV
223 if ((flags & GENERIC_READ) ||
224 ((flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS))
15b03959 225 *pmode |= (S_IRUGO & (*pbits_to_set));
9b5e6857
AV
226 if ((flags & GENERIC_EXECUTE) ||
227 ((flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS))
15b03959 228 *pmode |= (S_IXUGO & (*pbits_to_set));
630f3f0c 229
90c81e0b 230 cFYI(DBG2, ("access flags 0x%x mode now 0x%x", flags, *pmode));
630f3f0c
SF
231 return;
232}
233
ce06c9f0
SF
234/*
235 Generate access flags to reflect permissions mode is the existing mode.
236 This function is called for every ACE in the DACL whose SID matches
237 with either owner or group or everyone.
238*/
239
240static void mode_to_access_flags(umode_t mode, umode_t bits_to_use,
241 __u32 *pace_flags)
242{
243 /* reset access mask */
244 *pace_flags = 0x0;
245
246 /* bits to use are either S_IRWXU or S_IRWXG or S_IRWXO */
247 mode &= bits_to_use;
248
249 /* check for R/W/X UGO since we do not know whose flags
250 is this but we have cleared all the bits sans RWX for
251 either user or group or other as per bits_to_use */
252 if (mode & S_IRUGO)
253 *pace_flags |= SET_FILE_READ_RIGHTS;
254 if (mode & S_IWUGO)
255 *pace_flags |= SET_FILE_WRITE_RIGHTS;
256 if (mode & S_IXUGO)
257 *pace_flags |= SET_FILE_EXEC_RIGHTS;
258
90c81e0b 259 cFYI(DBG2, ("mode: 0x%x, access flags now 0x%x", mode, *pace_flags));
ce06c9f0
SF
260 return;
261}
262
2b210adc 263static __u16 fill_ace_for_sid(struct cifs_ace *pntace,
97837582
SF
264 const struct cifs_sid *psid, __u64 nmode, umode_t bits)
265{
266 int i;
267 __u16 size = 0;
268 __u32 access_req = 0;
269
270 pntace->type = ACCESS_ALLOWED;
271 pntace->flags = 0x0;
272 mode_to_access_flags(nmode, bits, &access_req);
273 if (!access_req)
274 access_req = SET_MINIMUM_RIGHTS;
275 pntace->access_req = cpu_to_le32(access_req);
276
277 pntace->sid.revision = psid->revision;
278 pntace->sid.num_subauth = psid->num_subauth;
279 for (i = 0; i < 6; i++)
280 pntace->sid.authority[i] = psid->authority[i];
281 for (i = 0; i < psid->num_subauth; i++)
282 pntace->sid.sub_auth[i] = psid->sub_auth[i];
283
284 size = 1 + 1 + 2 + 4 + 1 + 1 + 6 + (psid->num_subauth * 4);
285 pntace->size = cpu_to_le16(size);
286
ef571cad 287 return size;
97837582
SF
288}
289
297647c2 290
953f8681
SF
291#ifdef CONFIG_CIFS_DEBUG2
292static void dump_ace(struct cifs_ace *pace, char *end_of_acl)
d0d66c44 293{
d0d66c44 294 int num_subauth;
d0d66c44
SP
295
296 /* validate that we do not go past end of acl */
297647c2 297
44093ca2
SF
298 if (le16_to_cpu(pace->size) < 16) {
299 cERROR(1, ("ACE too small, %d", le16_to_cpu(pace->size)));
300 return;
301 }
302
303 if (end_of_acl < (char *)pace + le16_to_cpu(pace->size)) {
d0d66c44
SP
304 cERROR(1, ("ACL too small to parse ACE"));
305 return;
44093ca2 306 }
d0d66c44 307
44093ca2 308 num_subauth = pace->sid.num_subauth;
d0d66c44 309 if (num_subauth) {
8f18c131 310 int i;
44093ca2
SF
311 cFYI(1, ("ACE revision %d num_auth %d type %d flags %d size %d",
312 pace->sid.revision, pace->sid.num_subauth, pace->type,
97837582 313 pace->flags, le16_to_cpu(pace->size)));
d12fd121
SF
314 for (i = 0; i < num_subauth; ++i) {
315 cFYI(1, ("ACE sub_auth[%d]: 0x%x", i,
44093ca2 316 le32_to_cpu(pace->sid.sub_auth[i])));
d12fd121
SF
317 }
318
319 /* BB add length check to make sure that we do not have huge
320 num auths and therefore go off the end */
d12fd121
SF
321 }
322
323 return;
324}
953f8681 325#endif
d12fd121 326
d0d66c44 327
a750e77c 328static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
d61e5808 329 struct cifs_sid *pownersid, struct cifs_sid *pgrpsid,
630f3f0c 330 struct inode *inode)
d0d66c44
SP
331{
332 int i;
333 int num_aces = 0;
334 int acl_size;
335 char *acl_base;
d0d66c44
SP
336 struct cifs_ace **ppace;
337
338 /* BB need to add parm so we can store the SID BB */
339
2b83457b
SF
340 if (!pdacl) {
341 /* no DACL in the security descriptor, set
342 all the permissions for user/group/other */
343 inode->i_mode |= S_IRWXUGO;
344 return;
345 }
346
d0d66c44 347 /* validate that we do not go past end of acl */
af6f4612 348 if (end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size)) {
d0d66c44
SP
349 cERROR(1, ("ACL too small to parse DACL"));
350 return;
351 }
352
90c81e0b 353 cFYI(DBG2, ("DACL revision %d size %d num aces %d",
af6f4612
SF
354 le16_to_cpu(pdacl->revision), le16_to_cpu(pdacl->size),
355 le32_to_cpu(pdacl->num_aces)));
d0d66c44 356
7505e052
SF
357 /* reset rwx permissions for user/group/other.
358 Also, if num_aces is 0 i.e. DACL has no ACEs,
359 user/group/other have no permissions */
360 inode->i_mode &= ~(S_IRWXUGO);
361
d0d66c44
SP
362 acl_base = (char *)pdacl;
363 acl_size = sizeof(struct cifs_acl);
364
adbc0358 365 num_aces = le32_to_cpu(pdacl->num_aces);
d0d66c44 366 if (num_aces > 0) {
15b03959
SF
367 umode_t user_mask = S_IRWXU;
368 umode_t group_mask = S_IRWXG;
369 umode_t other_mask = S_IRWXO;
370
d0d66c44
SP
371 ppace = kmalloc(num_aces * sizeof(struct cifs_ace *),
372 GFP_KERNEL);
373
d0d66c44 374 for (i = 0; i < num_aces; ++i) {
44093ca2 375 ppace[i] = (struct cifs_ace *) (acl_base + acl_size);
953f8681
SF
376#ifdef CONFIG_CIFS_DEBUG2
377 dump_ace(ppace[i], end_of_acl);
378#endif
e01b6400
SP
379 if (compare_sids(&(ppace[i]->sid), pownersid))
380 access_flags_to_mode(ppace[i]->access_req,
15b03959
SF
381 ppace[i]->type,
382 &(inode->i_mode),
383 &user_mask);
e01b6400
SP
384 if (compare_sids(&(ppace[i]->sid), pgrpsid))
385 access_flags_to_mode(ppace[i]->access_req,
15b03959
SF
386 ppace[i]->type,
387 &(inode->i_mode),
388 &group_mask);
e01b6400
SP
389 if (compare_sids(&(ppace[i]->sid), &sid_everyone))
390 access_flags_to_mode(ppace[i]->access_req,
15b03959
SF
391 ppace[i]->type,
392 &(inode->i_mode),
393 &other_mask);
e01b6400 394
44093ca2 395/* memcpy((void *)(&(cifscred->aces[i])),
d12fd121
SF
396 (void *)ppace[i],
397 sizeof(struct cifs_ace)); */
d0d66c44 398
44093ca2
SF
399 acl_base = (char *)ppace[i];
400 acl_size = le16_to_cpu(ppace[i]->size);
d0d66c44
SP
401 }
402
403 kfree(ppace);
d0d66c44
SP
404 }
405
406 return;
407}
408
bcb02034 409
97837582
SF
410static int set_chmod_dacl(struct cifs_acl *pndacl, struct cifs_sid *pownersid,
411 struct cifs_sid *pgrpsid, __u64 nmode)
412{
2b210adc 413 u16 size = 0;
97837582
SF
414 struct cifs_acl *pnndacl;
415
416 pnndacl = (struct cifs_acl *)((char *)pndacl + sizeof(struct cifs_acl));
417
418 size += fill_ace_for_sid((struct cifs_ace *) ((char *)pnndacl + size),
419 pownersid, nmode, S_IRWXU);
420 size += fill_ace_for_sid((struct cifs_ace *)((char *)pnndacl + size),
421 pgrpsid, nmode, S_IRWXG);
422 size += fill_ace_for_sid((struct cifs_ace *)((char *)pnndacl + size),
423 &sid_everyone, nmode, S_IRWXO);
424
425 pndacl->size = cpu_to_le16(size + sizeof(struct cifs_acl));
d9f382ef 426 pndacl->num_aces = cpu_to_le32(3);
97837582 427
ef571cad 428 return 0;
97837582
SF
429}
430
431
bcb02034
SF
432static int parse_sid(struct cifs_sid *psid, char *end_of_acl)
433{
434 /* BB need to add parm so we can store the SID BB */
435
b9c7a2bb
SF
436 /* validate that we do not go past end of ACL - sid must be at least 8
437 bytes long (assuming no sub-auths - e.g. the null SID */
438 if (end_of_acl < (char *)psid + 8) {
439 cERROR(1, ("ACL too small to parse SID %p", psid));
bcb02034
SF
440 return -EINVAL;
441 }
d0d66c44 442
af6f4612 443 if (psid->num_subauth) {
bcb02034 444#ifdef CONFIG_CIFS_DEBUG2
8f18c131 445 int i;
44093ca2
SF
446 cFYI(1, ("SID revision %d num_auth %d",
447 psid->revision, psid->num_subauth));
bcb02034 448
af6f4612 449 for (i = 0; i < psid->num_subauth; i++) {
d0d66c44 450 cFYI(1, ("SID sub_auth[%d]: 0x%x ", i,
297647c2 451 le32_to_cpu(psid->sub_auth[i])));
d0d66c44
SP
452 }
453
d12fd121 454 /* BB add length check to make sure that we do not have huge
d0d66c44 455 num auths and therefore go off the end */
d12fd121 456 cFYI(1, ("RID 0x%x",
af6f4612 457 le32_to_cpu(psid->sub_auth[psid->num_subauth-1])));
bcb02034 458#endif
d0d66c44
SP
459 }
460
bcb02034
SF
461 return 0;
462}
463
d0d66c44 464
bcb02034 465/* Convert CIFS ACL to POSIX form */
630f3f0c
SF
466static int parse_sec_desc(struct cifs_ntsd *pntsd, int acl_len,
467 struct inode *inode)
bcb02034 468{
d0d66c44 469 int rc;
bcb02034
SF
470 struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
471 struct cifs_acl *dacl_ptr; /* no need for SACL ptr */
bcb02034 472 char *end_of_acl = ((char *)pntsd) + acl_len;
7505e052 473 __u32 dacloffset;
bcb02034 474
b9c7a2bb
SF
475 if ((inode == NULL) || (pntsd == NULL))
476 return -EIO;
477
bcb02034 478 owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
af6f4612 479 le32_to_cpu(pntsd->osidoffset));
bcb02034 480 group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
af6f4612 481 le32_to_cpu(pntsd->gsidoffset));
7505e052 482 dacloffset = le32_to_cpu(pntsd->dacloffset);
63d2583f 483 dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset);
90c81e0b 484 cFYI(DBG2, ("revision %d type 0x%x ooffset 0x%x goffset 0x%x "
bcb02034 485 "sacloffset 0x%x dacloffset 0x%x",
af6f4612
SF
486 pntsd->revision, pntsd->type, le32_to_cpu(pntsd->osidoffset),
487 le32_to_cpu(pntsd->gsidoffset),
7505e052 488 le32_to_cpu(pntsd->sacloffset), dacloffset));
b9c7a2bb 489/* cifs_dump_mem("owner_sid: ", owner_sid_ptr, 64); */
bcb02034
SF
490 rc = parse_sid(owner_sid_ptr, end_of_acl);
491 if (rc)
492 return rc;
493
494 rc = parse_sid(group_sid_ptr, end_of_acl);
495 if (rc)
496 return rc;
497
7505e052
SF
498 if (dacloffset)
499 parse_dacl(dacl_ptr, end_of_acl, owner_sid_ptr,
63d2583f 500 group_sid_ptr, inode);
7505e052
SF
501 else
502 cFYI(1, ("no ACL")); /* BB grant all or default perms? */
d0d66c44 503
bcb02034
SF
504/* cifscred->uid = owner_sid_ptr->rid;
505 cifscred->gid = group_sid_ptr->rid;
506 memcpy((void *)(&(cifscred->osid)), (void *)owner_sid_ptr,
630f3f0c 507 sizeof(struct cifs_sid));
bcb02034 508 memcpy((void *)(&(cifscred->gsid)), (void *)group_sid_ptr,
630f3f0c 509 sizeof(struct cifs_sid)); */
bcb02034 510
297647c2 511
ef571cad 512 return 0;
bcb02034 513}
b9c7a2bb
SF
514
515
97837582
SF
516/* Convert permission bits from mode to equivalent CIFS ACL */
517static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd,
cce246ee 518 struct inode *inode, __u64 nmode)
97837582
SF
519{
520 int rc = 0;
521 __u32 dacloffset;
522 __u32 ndacloffset;
523 __u32 sidsoffset;
524 struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
525 struct cifs_acl *dacl_ptr = NULL; /* no need for SACL ptr */
526 struct cifs_acl *ndacl_ptr = NULL; /* no need for SACL ptr */
527
528 if ((inode == NULL) || (pntsd == NULL) || (pnntsd == NULL))
ef571cad 529 return -EIO;
97837582
SF
530
531 owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
532 le32_to_cpu(pntsd->osidoffset));
533 group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
534 le32_to_cpu(pntsd->gsidoffset));
535
536 dacloffset = le32_to_cpu(pntsd->dacloffset);
537 dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset);
538
539 ndacloffset = sizeof(struct cifs_ntsd);
540 ndacl_ptr = (struct cifs_acl *)((char *)pnntsd + ndacloffset);
541 ndacl_ptr->revision = dacl_ptr->revision;
542 ndacl_ptr->size = 0;
543 ndacl_ptr->num_aces = 0;
544
545 rc = set_chmod_dacl(ndacl_ptr, owner_sid_ptr, group_sid_ptr, nmode);
546
547 sidsoffset = ndacloffset + le16_to_cpu(ndacl_ptr->size);
548
549 /* copy security descriptor control portion and owner and group sid */
550 copy_sec_desc(pntsd, pnntsd, sidsoffset);
551
ef571cad 552 return rc;
97837582
SF
553}
554
1bf4072d
CH
555static struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb,
556 __u16 fid, u32 *pacllen)
b9c7a2bb 557{
b9c7a2bb 558 struct cifs_ntsd *pntsd = NULL;
1bf4072d 559 int xid, rc;
b9c7a2bb 560
1bf4072d
CH
561 xid = GetXid();
562 rc = CIFSSMBGetCIFSACL(xid, cifs_sb->tcon, fid, &pntsd, pacllen);
563 FreeXid(xid);
b9c7a2bb 564
b9c7a2bb 565
1bf4072d
CH
566 cFYI(1, ("GetCIFSACL rc = %d ACL len %d", rc, *pacllen));
567 return pntsd;
568}
8b1327f6 569
1bf4072d
CH
570static struct cifs_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb,
571 const char *path, u32 *pacllen)
572{
573 struct cifs_ntsd *pntsd = NULL;
574 int oplock = 0;
575 int xid, rc;
576 __u16 fid;
b9c7a2bb 577
1bf4072d
CH
578 xid = GetXid();
579
580 rc = CIFSSMBOpen(xid, cifs_sb->tcon, path, FILE_OPEN, READ_CONTROL, 0,
581 &fid, &oplock, NULL, cifs_sb->local_nls,
582 cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
583 if (rc) {
584 cERROR(1, ("Unable to open file to get ACL"));
585 goto out;
b9c7a2bb
SF
586 }
587
7505e052
SF
588 rc = CIFSSMBGetCIFSACL(xid, cifs_sb->tcon, fid, &pntsd, pacllen);
589 cFYI(1, ("GetCIFSACL rc = %d ACL len %d", rc, *pacllen));
b9c7a2bb 590
1bf4072d
CH
591 CIFSSMBClose(xid, cifs_sb->tcon, fid);
592 out:
7505e052
SF
593 FreeXid(xid);
594 return pntsd;
595}
596
1bf4072d
CH
597/* Retrieve an ACL from the server */
598static struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb,
599 struct inode *inode, const char *path,
600 u32 *pacllen)
601{
602 struct cifs_ntsd *pntsd = NULL;
603 struct cifsFileInfo *open_file = NULL;
604
605 if (inode)
606 open_file = find_readable_file(CIFS_I(inode));
607 if (!open_file)
608 return get_cifs_acl_by_path(cifs_sb, path, pacllen);
609
610 pntsd = get_cifs_acl_by_fid(cifs_sb, open_file->netfid, pacllen);
611 atomic_dec(&open_file->wrtPending);
612 return pntsd;
613}
614
b96d31a6
CH
615static int set_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb, __u16 fid,
616 struct cifs_ntsd *pnntsd, u32 acllen)
97837582 617{
b96d31a6 618 int xid, rc;
97837582 619
b96d31a6
CH
620 xid = GetXid();
621 rc = CIFSSMBSetCIFSACL(xid, cifs_sb->tcon, fid, pnntsd, acllen);
622 FreeXid(xid);
97837582 623
b96d31a6
CH
624 cFYI(DBG2, ("SetCIFSACL rc = %d", rc));
625 return rc;
626}
97837582 627
b96d31a6
CH
628static int set_cifs_acl_by_path(struct cifs_sb_info *cifs_sb, const char *path,
629 struct cifs_ntsd *pnntsd, u32 acllen)
630{
631 int oplock = 0;
632 int xid, rc;
633 __u16 fid;
97837582 634
97837582
SF
635 xid = GetXid();
636
b96d31a6
CH
637 rc = CIFSSMBOpen(xid, cifs_sb->tcon, path, FILE_OPEN, WRITE_DAC, 0,
638 &fid, &oplock, NULL, cifs_sb->local_nls,
639 cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
640 if (rc) {
641 cERROR(1, ("Unable to open file to set ACL"));
642 goto out;
97837582
SF
643 }
644
645 rc = CIFSSMBSetCIFSACL(xid, cifs_sb->tcon, fid, pnntsd, acllen);
90c81e0b 646 cFYI(DBG2, ("SetCIFSACL rc = %d", rc));
97837582 647
b96d31a6
CH
648 CIFSSMBClose(xid, cifs_sb->tcon, fid);
649 out:
97837582 650 FreeXid(xid);
b96d31a6
CH
651 return rc;
652}
97837582 653
b96d31a6
CH
654/* Set an ACL on the server */
655static int set_cifs_acl(struct cifs_ntsd *pnntsd, __u32 acllen,
656 struct inode *inode, const char *path)
657{
658 struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
659 struct cifsFileInfo *open_file;
660 int rc;
661
662 cFYI(DBG2, ("set ACL for %s from mode 0x%x", path, inode->i_mode));
663
664 open_file = find_readable_file(CIFS_I(inode));
665 if (!open_file)
666 return set_cifs_acl_by_path(cifs_sb, path, pnntsd, acllen);
667
668 rc = set_cifs_acl_by_fid(cifs_sb, open_file->netfid, pnntsd, acllen);
669 atomic_dec(&open_file->wrtPending);
ef571cad 670 return rc;
97837582
SF
671}
672
7505e052 673/* Translate the CIFS ACL (simlar to NTFS ACL) for a file into mode bits */
1bf4072d
CH
674void acl_to_uid_mode(struct cifs_sb_info *cifs_sb, struct inode *inode,
675 const char *path, const __u16 *pfid)
7505e052
SF
676{
677 struct cifs_ntsd *pntsd = NULL;
678 u32 acllen = 0;
679 int rc = 0;
680
90c81e0b 681 cFYI(DBG2, ("converting ACL to mode for %s", path));
1bf4072d
CH
682
683 if (pfid)
684 pntsd = get_cifs_acl_by_fid(cifs_sb, *pfid, &acllen);
685 else
686 pntsd = get_cifs_acl(cifs_sb, inode, path, &acllen);
7505e052
SF
687
688 /* if we can retrieve the ACL, now parse Access Control Entries, ACEs */
689 if (pntsd)
b9c7a2bb 690 rc = parse_sec_desc(pntsd, acllen, inode);
7505e052
SF
691 if (rc)
692 cFYI(1, ("parse sec desc failed rc = %d", rc));
693
b9c7a2bb 694 kfree(pntsd);
b9c7a2bb
SF
695 return;
696}
953f8681 697
7505e052 698/* Convert mode bits to an ACL so we can update the ACL on the server */
97837582 699int mode_to_acl(struct inode *inode, const char *path, __u64 nmode)
953f8681
SF
700{
701 int rc = 0;
cce246ee 702 __u32 secdesclen = 0;
97837582
SF
703 struct cifs_ntsd *pntsd = NULL; /* acl obtained from server */
704 struct cifs_ntsd *pnntsd = NULL; /* modified acl to be sent to server */
953f8681 705
90c81e0b 706 cFYI(DBG2, ("set ACL from mode for %s", path));
953f8681
SF
707
708 /* Get the security descriptor */
1bf4072d 709 pntsd = get_cifs_acl(CIFS_SB(inode->i_sb), inode, path, &secdesclen);
953f8681 710
97837582
SF
711 /* Add three ACEs for owner, group, everyone getting rid of
712 other ACEs as chmod disables ACEs and set the security descriptor */
953f8681 713
97837582
SF
714 if (pntsd) {
715 /* allocate memory for the smb header,
716 set security descriptor request security descriptor
717 parameters, and secuirty descriptor itself */
953f8681 718
cce246ee
SF
719 secdesclen = secdesclen < DEFSECDESCLEN ?
720 DEFSECDESCLEN : secdesclen;
721 pnntsd = kmalloc(secdesclen, GFP_KERNEL);
97837582
SF
722 if (!pnntsd) {
723 cERROR(1, ("Unable to allocate security descriptor"));
724 kfree(pntsd);
ef571cad 725 return -ENOMEM;
97837582 726 }
7505e052 727
cce246ee 728 rc = build_sec_desc(pntsd, pnntsd, inode, nmode);
97837582 729
90c81e0b 730 cFYI(DBG2, ("build_sec_desc rc: %d", rc));
97837582
SF
731
732 if (!rc) {
733 /* Set the security descriptor */
cce246ee 734 rc = set_cifs_acl(pnntsd, secdesclen, inode, path);
90c81e0b 735 cFYI(DBG2, ("set_cifs_acl rc: %d", rc));
97837582
SF
736 }
737
738 kfree(pnntsd);
739 kfree(pntsd);
740 }
741
ef571cad 742 return rc;
953f8681 743}
297647c2 744#endif /* CONFIG_CIFS_EXPERIMENTAL */