4 * Copyright (C) International Business Machines Corp., 2007,2008
5 * Author(s): Steve French (sfrench@us.ibm.com)
7 * Contains the routines for mapping CIFS/NTFS ACLs
9 * This library is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU Lesser General Public License as published
11 * by the Free Software Foundation; either version 2.1 of the License, or
12 * (at your option) any later version.
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
17 * the GNU Lesser General Public License for more details.
19 * You should have received a copy of the GNU Lesser General Public License
20 * along with this library; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
25 #include <linux/slab.h>
26 #include <linux/string.h>
27 #include <linux/keyctl.h>
28 #include <linux/key-type.h>
29 #include <keys/user-type.h>
33 #include "cifsproto.h"
34 #include "cifs_debug.h"
36 /* security id for everyone/world system group */
37 static const struct cifs_sid sid_everyone
= {
38 1, 1, {0, 0, 0, 0, 0, 1}, {0} };
39 /* security id for Authenticated Users system group */
40 static const struct cifs_sid sid_authusers
= {
41 1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(11)} };
43 static const struct cifs_sid sid_user
= {1, 2 , {0, 0, 0, 0, 0, 5}, {} };
45 static const struct cred
*root_cred
;
48 cifs_idmap_key_instantiate(struct key
*key
, struct key_preparsed_payload
*prep
)
53 * If the payload is less than or equal to the size of a pointer, then
54 * an allocation here is wasteful. Just copy the data directly to the
55 * payload.value union member instead.
57 * With this however, you must check the datalen before trying to
58 * dereference payload.data!
60 if (prep
->datalen
<= sizeof(key
->payload
)) {
61 key
->payload
.data
[0] = NULL
;
62 memcpy(&key
->payload
, prep
->data
, prep
->datalen
);
64 payload
= kmemdup(prep
->data
, prep
->datalen
, GFP_KERNEL
);
67 key
->payload
.data
[0] = payload
;
70 key
->datalen
= prep
->datalen
;
75 cifs_idmap_key_destroy(struct key
*key
)
77 if (key
->datalen
> sizeof(key
->payload
))
78 kfree(key
->payload
.data
[0]);
81 static struct key_type cifs_idmap_key_type
= {
83 .instantiate
= cifs_idmap_key_instantiate
,
84 .destroy
= cifs_idmap_key_destroy
,
85 .describe
= user_describe
,
89 sid_to_key_str(struct cifs_sid
*sidptr
, unsigned int type
)
93 char *sidstr
, *strptr
;
94 unsigned long long id_auth_val
;
96 /* 3 bytes for prefix */
97 sidstr
= kmalloc(3 + SID_STRING_BASE_SIZE
+
98 (SID_STRING_SUBAUTH_SIZE
* sidptr
->num_subauth
),
104 len
= sprintf(strptr
, "%cs:S-%hhu", type
== SIDOWNER
? 'o' : 'g',
108 /* The authority field is a single 48-bit number */
109 id_auth_val
= (unsigned long long)sidptr
->authority
[5];
110 id_auth_val
|= (unsigned long long)sidptr
->authority
[4] << 8;
111 id_auth_val
|= (unsigned long long)sidptr
->authority
[3] << 16;
112 id_auth_val
|= (unsigned long long)sidptr
->authority
[2] << 24;
113 id_auth_val
|= (unsigned long long)sidptr
->authority
[1] << 32;
114 id_auth_val
|= (unsigned long long)sidptr
->authority
[0] << 48;
117 * MS-DTYP states that if the authority is >= 2^32, then it should be
118 * expressed as a hex value.
120 if (id_auth_val
<= UINT_MAX
)
121 len
= sprintf(strptr
, "-%llu", id_auth_val
);
123 len
= sprintf(strptr
, "-0x%llx", id_auth_val
);
127 for (i
= 0; i
< sidptr
->num_subauth
; ++i
) {
128 saval
= le32_to_cpu(sidptr
->sub_auth
[i
]);
129 len
= sprintf(strptr
, "-%u", saval
);
137 * if the two SIDs (roughly equivalent to a UUID for a user or group) are
138 * the same returns zero, if they do not match returns non-zero.
141 compare_sids(const struct cifs_sid
*ctsid
, const struct cifs_sid
*cwsid
)
144 int num_subauth
, num_sat
, num_saw
;
146 if ((!ctsid
) || (!cwsid
))
149 /* compare the revision */
150 if (ctsid
->revision
!= cwsid
->revision
) {
151 if (ctsid
->revision
> cwsid
->revision
)
157 /* compare all of the six auth values */
158 for (i
= 0; i
< NUM_AUTHS
; ++i
) {
159 if (ctsid
->authority
[i
] != cwsid
->authority
[i
]) {
160 if (ctsid
->authority
[i
] > cwsid
->authority
[i
])
167 /* compare all of the subauth values if any */
168 num_sat
= ctsid
->num_subauth
;
169 num_saw
= cwsid
->num_subauth
;
170 num_subauth
= num_sat
< num_saw
? num_sat
: num_saw
;
172 for (i
= 0; i
< num_subauth
; ++i
) {
173 if (ctsid
->sub_auth
[i
] != cwsid
->sub_auth
[i
]) {
174 if (le32_to_cpu(ctsid
->sub_auth
[i
]) >
175 le32_to_cpu(cwsid
->sub_auth
[i
]))
183 return 0; /* sids compare/match */
187 cifs_copy_sid(struct cifs_sid
*dst
, const struct cifs_sid
*src
)
191 dst
->revision
= src
->revision
;
192 dst
->num_subauth
= min_t(u8
, src
->num_subauth
, SID_MAX_SUB_AUTHORITIES
);
193 for (i
= 0; i
< NUM_AUTHS
; ++i
)
194 dst
->authority
[i
] = src
->authority
[i
];
195 for (i
= 0; i
< dst
->num_subauth
; ++i
)
196 dst
->sub_auth
[i
] = src
->sub_auth
[i
];
200 id_to_sid(unsigned int cid
, uint sidtype
, struct cifs_sid
*ssid
)
204 struct cifs_sid
*ksid
;
205 unsigned int ksid_size
;
206 char desc
[3 + 10 + 1]; /* 3 byte prefix + 10 bytes for value + NULL */
207 const struct cred
*saved_cred
;
209 rc
= snprintf(desc
, sizeof(desc
), "%ci:%u",
210 sidtype
== SIDOWNER
? 'o' : 'g', cid
);
211 if (rc
>= sizeof(desc
))
215 saved_cred
= override_creds(root_cred
);
216 sidkey
= request_key(&cifs_idmap_key_type
, desc
, "");
217 if (IS_ERR(sidkey
)) {
219 cifs_dbg(FYI
, "%s: Can't map %cid %u to a SID\n",
220 __func__
, sidtype
== SIDOWNER
? 'u' : 'g', cid
);
221 goto out_revert_creds
;
222 } else if (sidkey
->datalen
< CIFS_SID_BASE_SIZE
) {
224 cifs_dbg(FYI
, "%s: Downcall contained malformed key (datalen=%hu)\n",
225 __func__
, sidkey
->datalen
);
230 * A sid is usually too large to be embedded in payload.value, but if
231 * there are no subauthorities and the host has 8-byte pointers, then
234 ksid
= sidkey
->datalen
<= sizeof(sidkey
->payload
) ?
235 (struct cifs_sid
*)&sidkey
->payload
:
236 (struct cifs_sid
*)sidkey
->payload
.data
[0];
238 ksid_size
= CIFS_SID_BASE_SIZE
+ (ksid
->num_subauth
* sizeof(__le32
));
239 if (ksid_size
> sidkey
->datalen
) {
241 cifs_dbg(FYI
, "%s: Downcall contained malformed key (datalen=%hu, ksid_size=%u)\n",
242 __func__
, sidkey
->datalen
, ksid_size
);
246 cifs_copy_sid(ssid
, ksid
);
250 revert_creds(saved_cred
);
254 key_invalidate(sidkey
);
259 sid_to_id(struct cifs_sb_info
*cifs_sb
, struct cifs_sid
*psid
,
260 struct cifs_fattr
*fattr
, uint sidtype
)
265 const struct cred
*saved_cred
;
266 kuid_t fuid
= cifs_sb
->mnt_uid
;
267 kgid_t fgid
= cifs_sb
->mnt_gid
;
270 * If we have too many subauthorities, then something is really wrong.
271 * Just return an error.
273 if (unlikely(psid
->num_subauth
> SID_MAX_SUB_AUTHORITIES
)) {
274 cifs_dbg(FYI
, "%s: %u subauthorities is too many!\n",
275 __func__
, psid
->num_subauth
);
279 sidstr
= sid_to_key_str(psid
, sidtype
);
283 saved_cred
= override_creds(root_cred
);
284 sidkey
= request_key(&cifs_idmap_key_type
, sidstr
, "");
285 if (IS_ERR(sidkey
)) {
287 cifs_dbg(FYI
, "%s: Can't map SID %s to a %cid\n",
288 __func__
, sidstr
, sidtype
== SIDOWNER
? 'u' : 'g');
289 goto out_revert_creds
;
293 * FIXME: Here we assume that uid_t and gid_t are same size. It's
294 * probably a safe assumption but might be better to check based on
297 BUILD_BUG_ON(sizeof(uid_t
) != sizeof(gid_t
));
298 if (sidkey
->datalen
!= sizeof(uid_t
)) {
300 cifs_dbg(FYI
, "%s: Downcall contained malformed key (datalen=%hu)\n",
301 __func__
, sidkey
->datalen
);
302 key_invalidate(sidkey
);
306 if (sidtype
== SIDOWNER
) {
309 memcpy(&id
, &sidkey
->payload
.data
[0], sizeof(uid_t
));
310 uid
= make_kuid(&init_user_ns
, id
);
316 memcpy(&id
, &sidkey
->payload
.data
[0], sizeof(gid_t
));
317 gid
= make_kgid(&init_user_ns
, id
);
325 revert_creds(saved_cred
);
329 * Note that we return 0 here unconditionally. If the mapping
330 * fails then we just fall back to using the mnt_uid/mnt_gid.
332 if (sidtype
== SIDOWNER
)
333 fattr
->cf_uid
= fuid
;
335 fattr
->cf_gid
= fgid
;
340 init_cifs_idmap(void)
346 cifs_dbg(FYI
, "Registering the %s key type\n",
347 cifs_idmap_key_type
.name
);
349 /* create an override credential set with a special thread keyring in
350 * which requests are cached
352 * this is used to prevent malicious redirections from being installed
355 cred
= prepare_kernel_cred(NULL
);
359 keyring
= keyring_alloc(".cifs_idmap",
360 GLOBAL_ROOT_UID
, GLOBAL_ROOT_GID
, cred
,
361 (KEY_POS_ALL
& ~KEY_POS_SETATTR
) |
362 KEY_USR_VIEW
| KEY_USR_READ
,
363 KEY_ALLOC_NOT_IN_QUOTA
, NULL
, NULL
);
364 if (IS_ERR(keyring
)) {
365 ret
= PTR_ERR(keyring
);
366 goto failed_put_cred
;
369 ret
= register_key_type(&cifs_idmap_key_type
);
373 /* instruct request_key() to use this special keyring as a cache for
374 * the results it looks up */
375 set_bit(KEY_FLAG_ROOT_CAN_CLEAR
, &keyring
->flags
);
376 cred
->thread_keyring
= keyring
;
377 cred
->jit_keyring
= KEY_REQKEY_DEFL_THREAD_KEYRING
;
380 cifs_dbg(FYI
, "cifs idmap keyring: %d\n", key_serial(keyring
));
391 exit_cifs_idmap(void)
393 key_revoke(root_cred
->thread_keyring
);
394 unregister_key_type(&cifs_idmap_key_type
);
396 cifs_dbg(FYI
, "Unregistered %s key type\n", cifs_idmap_key_type
.name
);
399 /* copy ntsd, owner sid, and group sid from a security descriptor to another */
400 static void copy_sec_desc(const struct cifs_ntsd
*pntsd
,
401 struct cifs_ntsd
*pnntsd
, __u32 sidsoffset
)
403 struct cifs_sid
*owner_sid_ptr
, *group_sid_ptr
;
404 struct cifs_sid
*nowner_sid_ptr
, *ngroup_sid_ptr
;
406 /* copy security descriptor control portion */
407 pnntsd
->revision
= pntsd
->revision
;
408 pnntsd
->type
= pntsd
->type
;
409 pnntsd
->dacloffset
= cpu_to_le32(sizeof(struct cifs_ntsd
));
410 pnntsd
->sacloffset
= 0;
411 pnntsd
->osidoffset
= cpu_to_le32(sidsoffset
);
412 pnntsd
->gsidoffset
= cpu_to_le32(sidsoffset
+ sizeof(struct cifs_sid
));
415 owner_sid_ptr
= (struct cifs_sid
*)((char *)pntsd
+
416 le32_to_cpu(pntsd
->osidoffset
));
417 nowner_sid_ptr
= (struct cifs_sid
*)((char *)pnntsd
+ sidsoffset
);
418 cifs_copy_sid(nowner_sid_ptr
, owner_sid_ptr
);
421 group_sid_ptr
= (struct cifs_sid
*)((char *)pntsd
+
422 le32_to_cpu(pntsd
->gsidoffset
));
423 ngroup_sid_ptr
= (struct cifs_sid
*)((char *)pnntsd
+ sidsoffset
+
424 sizeof(struct cifs_sid
));
425 cifs_copy_sid(ngroup_sid_ptr
, group_sid_ptr
);
432 change posix mode to reflect permissions
433 pmode is the existing mode (we only want to overwrite part of this
434 bits to set can be: S_IRWXU, S_IRWXG or S_IRWXO ie 00700 or 00070 or 00007
436 static void access_flags_to_mode(__le32 ace_flags
, int type
, umode_t
*pmode
,
437 umode_t
*pbits_to_set
)
439 __u32 flags
= le32_to_cpu(ace_flags
);
440 /* the order of ACEs is important. The canonical order is to begin with
441 DENY entries followed by ALLOW, otherwise an allow entry could be
442 encountered first, making the subsequent deny entry like "dead code"
443 which would be superflous since Windows stops when a match is made
444 for the operation you are trying to perform for your user */
446 /* For deny ACEs we change the mask so that subsequent allow access
447 control entries do not turn on the bits we are denying */
448 if (type
== ACCESS_DENIED
) {
449 if (flags
& GENERIC_ALL
)
450 *pbits_to_set
&= ~S_IRWXUGO
;
452 if ((flags
& GENERIC_WRITE
) ||
453 ((flags
& FILE_WRITE_RIGHTS
) == FILE_WRITE_RIGHTS
))
454 *pbits_to_set
&= ~S_IWUGO
;
455 if ((flags
& GENERIC_READ
) ||
456 ((flags
& FILE_READ_RIGHTS
) == FILE_READ_RIGHTS
))
457 *pbits_to_set
&= ~S_IRUGO
;
458 if ((flags
& GENERIC_EXECUTE
) ||
459 ((flags
& FILE_EXEC_RIGHTS
) == FILE_EXEC_RIGHTS
))
460 *pbits_to_set
&= ~S_IXUGO
;
462 } else if (type
!= ACCESS_ALLOWED
) {
463 cifs_dbg(VFS
, "unknown access control type %d\n", type
);
466 /* else ACCESS_ALLOWED type */
468 if (flags
& GENERIC_ALL
) {
469 *pmode
|= (S_IRWXUGO
& (*pbits_to_set
));
470 cifs_dbg(NOISY
, "all perms\n");
473 if ((flags
& GENERIC_WRITE
) ||
474 ((flags
& FILE_WRITE_RIGHTS
) == FILE_WRITE_RIGHTS
))
475 *pmode
|= (S_IWUGO
& (*pbits_to_set
));
476 if ((flags
& GENERIC_READ
) ||
477 ((flags
& FILE_READ_RIGHTS
) == FILE_READ_RIGHTS
))
478 *pmode
|= (S_IRUGO
& (*pbits_to_set
));
479 if ((flags
& GENERIC_EXECUTE
) ||
480 ((flags
& FILE_EXEC_RIGHTS
) == FILE_EXEC_RIGHTS
))
481 *pmode
|= (S_IXUGO
& (*pbits_to_set
));
483 cifs_dbg(NOISY
, "access flags 0x%x mode now 0x%x\n", flags
, *pmode
);
488 Generate access flags to reflect permissions mode is the existing mode.
489 This function is called for every ACE in the DACL whose SID matches
490 with either owner or group or everyone.
493 static void mode_to_access_flags(umode_t mode
, umode_t bits_to_use
,
496 /* reset access mask */
499 /* bits to use are either S_IRWXU or S_IRWXG or S_IRWXO */
502 /* check for R/W/X UGO since we do not know whose flags
503 is this but we have cleared all the bits sans RWX for
504 either user or group or other as per bits_to_use */
506 *pace_flags
|= SET_FILE_READ_RIGHTS
;
508 *pace_flags
|= SET_FILE_WRITE_RIGHTS
;
510 *pace_flags
|= SET_FILE_EXEC_RIGHTS
;
512 cifs_dbg(NOISY
, "mode: 0x%x, access flags now 0x%x\n",
517 static __u16
fill_ace_for_sid(struct cifs_ace
*pntace
,
518 const struct cifs_sid
*psid
, __u64 nmode
, umode_t bits
)
522 __u32 access_req
= 0;
524 pntace
->type
= ACCESS_ALLOWED
;
526 mode_to_access_flags(nmode
, bits
, &access_req
);
528 access_req
= SET_MINIMUM_RIGHTS
;
529 pntace
->access_req
= cpu_to_le32(access_req
);
531 pntace
->sid
.revision
= psid
->revision
;
532 pntace
->sid
.num_subauth
= psid
->num_subauth
;
533 for (i
= 0; i
< NUM_AUTHS
; i
++)
534 pntace
->sid
.authority
[i
] = psid
->authority
[i
];
535 for (i
= 0; i
< psid
->num_subauth
; i
++)
536 pntace
->sid
.sub_auth
[i
] = psid
->sub_auth
[i
];
538 size
= 1 + 1 + 2 + 4 + 1 + 1 + 6 + (psid
->num_subauth
* 4);
539 pntace
->size
= cpu_to_le16(size
);
545 #ifdef CONFIG_CIFS_DEBUG2
546 static void dump_ace(struct cifs_ace
*pace
, char *end_of_acl
)
550 /* validate that we do not go past end of acl */
552 if (le16_to_cpu(pace
->size
) < 16) {
553 cifs_dbg(VFS
, "ACE too small %d\n", le16_to_cpu(pace
->size
));
557 if (end_of_acl
< (char *)pace
+ le16_to_cpu(pace
->size
)) {
558 cifs_dbg(VFS
, "ACL too small to parse ACE\n");
562 num_subauth
= pace
->sid
.num_subauth
;
565 cifs_dbg(FYI
, "ACE revision %d num_auth %d type %d flags %d size %d\n",
566 pace
->sid
.revision
, pace
->sid
.num_subauth
, pace
->type
,
567 pace
->flags
, le16_to_cpu(pace
->size
));
568 for (i
= 0; i
< num_subauth
; ++i
) {
569 cifs_dbg(FYI
, "ACE sub_auth[%d]: 0x%x\n",
570 i
, le32_to_cpu(pace
->sid
.sub_auth
[i
]));
573 /* BB add length check to make sure that we do not have huge
574 num auths and therefore go off the end */
582 static void parse_dacl(struct cifs_acl
*pdacl
, char *end_of_acl
,
583 struct cifs_sid
*pownersid
, struct cifs_sid
*pgrpsid
,
584 struct cifs_fattr
*fattr
)
590 struct cifs_ace
**ppace
;
592 /* BB need to add parm so we can store the SID BB */
595 /* no DACL in the security descriptor, set
596 all the permissions for user/group/other */
597 fattr
->cf_mode
|= S_IRWXUGO
;
601 /* validate that we do not go past end of acl */
602 if (end_of_acl
< (char *)pdacl
+ le16_to_cpu(pdacl
->size
)) {
603 cifs_dbg(VFS
, "ACL too small to parse DACL\n");
607 cifs_dbg(NOISY
, "DACL revision %d size %d num aces %d\n",
608 le16_to_cpu(pdacl
->revision
), le16_to_cpu(pdacl
->size
),
609 le32_to_cpu(pdacl
->num_aces
));
611 /* reset rwx permissions for user/group/other.
612 Also, if num_aces is 0 i.e. DACL has no ACEs,
613 user/group/other have no permissions */
614 fattr
->cf_mode
&= ~(S_IRWXUGO
);
616 acl_base
= (char *)pdacl
;
617 acl_size
= sizeof(struct cifs_acl
);
619 num_aces
= le32_to_cpu(pdacl
->num_aces
);
621 umode_t user_mask
= S_IRWXU
;
622 umode_t group_mask
= S_IRWXG
;
623 umode_t other_mask
= S_IRWXU
| S_IRWXG
| S_IRWXO
;
625 if (num_aces
> ULONG_MAX
/ sizeof(struct cifs_ace
*))
627 ppace
= kmalloc(num_aces
* sizeof(struct cifs_ace
*),
632 for (i
= 0; i
< num_aces
; ++i
) {
633 ppace
[i
] = (struct cifs_ace
*) (acl_base
+ acl_size
);
634 #ifdef CONFIG_CIFS_DEBUG2
635 dump_ace(ppace
[i
], end_of_acl
);
637 if (compare_sids(&(ppace
[i
]->sid
), pownersid
) == 0)
638 access_flags_to_mode(ppace
[i
]->access_req
,
642 if (compare_sids(&(ppace
[i
]->sid
), pgrpsid
) == 0)
643 access_flags_to_mode(ppace
[i
]->access_req
,
647 if (compare_sids(&(ppace
[i
]->sid
), &sid_everyone
) == 0)
648 access_flags_to_mode(ppace
[i
]->access_req
,
652 if (compare_sids(&(ppace
[i
]->sid
), &sid_authusers
) == 0)
653 access_flags_to_mode(ppace
[i
]->access_req
,
659 /* memcpy((void *)(&(cifscred->aces[i])),
661 sizeof(struct cifs_ace)); */
663 acl_base
= (char *)ppace
[i
];
664 acl_size
= le16_to_cpu(ppace
[i
]->size
);
674 static int set_chmod_dacl(struct cifs_acl
*pndacl
, struct cifs_sid
*pownersid
,
675 struct cifs_sid
*pgrpsid
, __u64 nmode
)
678 struct cifs_acl
*pnndacl
;
680 pnndacl
= (struct cifs_acl
*)((char *)pndacl
+ sizeof(struct cifs_acl
));
682 size
+= fill_ace_for_sid((struct cifs_ace
*) ((char *)pnndacl
+ size
),
683 pownersid
, nmode
, S_IRWXU
);
684 size
+= fill_ace_for_sid((struct cifs_ace
*)((char *)pnndacl
+ size
),
685 pgrpsid
, nmode
, S_IRWXG
);
686 size
+= fill_ace_for_sid((struct cifs_ace
*)((char *)pnndacl
+ size
),
687 &sid_everyone
, nmode
, S_IRWXO
);
689 pndacl
->size
= cpu_to_le16(size
+ sizeof(struct cifs_acl
));
690 pndacl
->num_aces
= cpu_to_le32(3);
696 static int parse_sid(struct cifs_sid
*psid
, char *end_of_acl
)
698 /* BB need to add parm so we can store the SID BB */
700 /* validate that we do not go past end of ACL - sid must be at least 8
701 bytes long (assuming no sub-auths - e.g. the null SID */
702 if (end_of_acl
< (char *)psid
+ 8) {
703 cifs_dbg(VFS
, "ACL too small to parse SID %p\n", psid
);
707 #ifdef CONFIG_CIFS_DEBUG2
708 if (psid
->num_subauth
) {
710 cifs_dbg(FYI
, "SID revision %d num_auth %d\n",
711 psid
->revision
, psid
->num_subauth
);
713 for (i
= 0; i
< psid
->num_subauth
; i
++) {
714 cifs_dbg(FYI
, "SID sub_auth[%d]: 0x%x\n",
715 i
, le32_to_cpu(psid
->sub_auth
[i
]));
718 /* BB add length check to make sure that we do not have huge
719 num auths and therefore go off the end */
720 cifs_dbg(FYI
, "RID 0x%x\n",
721 le32_to_cpu(psid
->sub_auth
[psid
->num_subauth
-1]));
729 /* Convert CIFS ACL to POSIX form */
730 static int parse_sec_desc(struct cifs_sb_info
*cifs_sb
,
731 struct cifs_ntsd
*pntsd
, int acl_len
, struct cifs_fattr
*fattr
)
734 struct cifs_sid
*owner_sid_ptr
, *group_sid_ptr
;
735 struct cifs_acl
*dacl_ptr
; /* no need for SACL ptr */
736 char *end_of_acl
= ((char *)pntsd
) + acl_len
;
742 owner_sid_ptr
= (struct cifs_sid
*)((char *)pntsd
+
743 le32_to_cpu(pntsd
->osidoffset
));
744 group_sid_ptr
= (struct cifs_sid
*)((char *)pntsd
+
745 le32_to_cpu(pntsd
->gsidoffset
));
746 dacloffset
= le32_to_cpu(pntsd
->dacloffset
);
747 dacl_ptr
= (struct cifs_acl
*)((char *)pntsd
+ dacloffset
);
748 cifs_dbg(NOISY
, "revision %d type 0x%x ooffset 0x%x goffset 0x%x sacloffset 0x%x dacloffset 0x%x\n",
749 pntsd
->revision
, pntsd
->type
, le32_to_cpu(pntsd
->osidoffset
),
750 le32_to_cpu(pntsd
->gsidoffset
),
751 le32_to_cpu(pntsd
->sacloffset
), dacloffset
);
752 /* cifs_dump_mem("owner_sid: ", owner_sid_ptr, 64); */
753 rc
= parse_sid(owner_sid_ptr
, end_of_acl
);
755 cifs_dbg(FYI
, "%s: Error %d parsing Owner SID\n", __func__
, rc
);
758 rc
= sid_to_id(cifs_sb
, owner_sid_ptr
, fattr
, SIDOWNER
);
760 cifs_dbg(FYI
, "%s: Error %d mapping Owner SID to uid\n",
765 rc
= parse_sid(group_sid_ptr
, end_of_acl
);
767 cifs_dbg(FYI
, "%s: Error %d mapping Owner SID to gid\n",
771 rc
= sid_to_id(cifs_sb
, group_sid_ptr
, fattr
, SIDGROUP
);
773 cifs_dbg(FYI
, "%s: Error %d mapping Group SID to gid\n",
779 parse_dacl(dacl_ptr
, end_of_acl
, owner_sid_ptr
,
780 group_sid_ptr
, fattr
);
782 cifs_dbg(FYI
, "no ACL\n"); /* BB grant all or default perms? */
787 /* Convert permission bits from mode to equivalent CIFS ACL */
788 static int build_sec_desc(struct cifs_ntsd
*pntsd
, struct cifs_ntsd
*pnntsd
,
789 __u32 secdesclen
, __u64 nmode
, kuid_t uid
, kgid_t gid
, int *aclflag
)
795 struct cifs_sid
*owner_sid_ptr
, *group_sid_ptr
;
796 struct cifs_sid
*nowner_sid_ptr
, *ngroup_sid_ptr
;
797 struct cifs_acl
*dacl_ptr
= NULL
; /* no need for SACL ptr */
798 struct cifs_acl
*ndacl_ptr
= NULL
; /* no need for SACL ptr */
800 if (nmode
!= NO_CHANGE_64
) { /* chmod */
801 owner_sid_ptr
= (struct cifs_sid
*)((char *)pntsd
+
802 le32_to_cpu(pntsd
->osidoffset
));
803 group_sid_ptr
= (struct cifs_sid
*)((char *)pntsd
+
804 le32_to_cpu(pntsd
->gsidoffset
));
805 dacloffset
= le32_to_cpu(pntsd
->dacloffset
);
806 dacl_ptr
= (struct cifs_acl
*)((char *)pntsd
+ dacloffset
);
807 ndacloffset
= sizeof(struct cifs_ntsd
);
808 ndacl_ptr
= (struct cifs_acl
*)((char *)pnntsd
+ ndacloffset
);
809 ndacl_ptr
->revision
= dacl_ptr
->revision
;
811 ndacl_ptr
->num_aces
= 0;
813 rc
= set_chmod_dacl(ndacl_ptr
, owner_sid_ptr
, group_sid_ptr
,
815 sidsoffset
= ndacloffset
+ le16_to_cpu(ndacl_ptr
->size
);
816 /* copy sec desc control portion & owner and group sids */
817 copy_sec_desc(pntsd
, pnntsd
, sidsoffset
);
818 *aclflag
= CIFS_ACL_DACL
;
820 memcpy(pnntsd
, pntsd
, secdesclen
);
821 if (uid_valid(uid
)) { /* chown */
823 owner_sid_ptr
= (struct cifs_sid
*)((char *)pnntsd
+
824 le32_to_cpu(pnntsd
->osidoffset
));
825 nowner_sid_ptr
= kmalloc(sizeof(struct cifs_sid
),
829 id
= from_kuid(&init_user_ns
, uid
);
830 rc
= id_to_sid(id
, SIDOWNER
, nowner_sid_ptr
);
832 cifs_dbg(FYI
, "%s: Mapping error %d for owner id %d\n",
834 kfree(nowner_sid_ptr
);
837 cifs_copy_sid(owner_sid_ptr
, nowner_sid_ptr
);
838 kfree(nowner_sid_ptr
);
839 *aclflag
= CIFS_ACL_OWNER
;
841 if (gid_valid(gid
)) { /* chgrp */
843 group_sid_ptr
= (struct cifs_sid
*)((char *)pnntsd
+
844 le32_to_cpu(pnntsd
->gsidoffset
));
845 ngroup_sid_ptr
= kmalloc(sizeof(struct cifs_sid
),
849 id
= from_kgid(&init_user_ns
, gid
);
850 rc
= id_to_sid(id
, SIDGROUP
, ngroup_sid_ptr
);
852 cifs_dbg(FYI
, "%s: Mapping error %d for group id %d\n",
854 kfree(ngroup_sid_ptr
);
857 cifs_copy_sid(group_sid_ptr
, ngroup_sid_ptr
);
858 kfree(ngroup_sid_ptr
);
859 *aclflag
= CIFS_ACL_GROUP
;
866 struct cifs_ntsd
*get_cifs_acl_by_fid(struct cifs_sb_info
*cifs_sb
,
867 const struct cifs_fid
*cifsfid
, u32
*pacllen
)
869 struct cifs_ntsd
*pntsd
= NULL
;
872 struct tcon_link
*tlink
= cifs_sb_tlink(cifs_sb
);
875 return ERR_CAST(tlink
);
878 rc
= CIFSSMBGetCIFSACL(xid
, tlink_tcon(tlink
), cifsfid
->netfid
, &pntsd
,
882 cifs_put_tlink(tlink
);
884 cifs_dbg(FYI
, "%s: rc = %d ACL len %d\n", __func__
, rc
, *pacllen
);
890 static struct cifs_ntsd
*get_cifs_acl_by_path(struct cifs_sb_info
*cifs_sb
,
891 const char *path
, u32
*pacllen
)
893 struct cifs_ntsd
*pntsd
= NULL
;
896 int rc
, create_options
= 0;
897 struct cifs_tcon
*tcon
;
898 struct tcon_link
*tlink
= cifs_sb_tlink(cifs_sb
);
900 struct cifs_open_parms oparms
;
903 return ERR_CAST(tlink
);
905 tcon
= tlink_tcon(tlink
);
908 if (backup_cred(cifs_sb
))
909 create_options
|= CREATE_OPEN_BACKUP_INTENT
;
912 oparms
.cifs_sb
= cifs_sb
;
913 oparms
.desired_access
= READ_CONTROL
;
914 oparms
.create_options
= create_options
;
915 oparms
.disposition
= FILE_OPEN
;
918 oparms
.reconnect
= false;
920 rc
= CIFS_open(xid
, &oparms
, &oplock
, NULL
);
922 rc
= CIFSSMBGetCIFSACL(xid
, tcon
, fid
.netfid
, &pntsd
, pacllen
);
923 CIFSSMBClose(xid
, tcon
, fid
.netfid
);
926 cifs_put_tlink(tlink
);
929 cifs_dbg(FYI
, "%s: rc = %d ACL len %d\n", __func__
, rc
, *pacllen
);
935 /* Retrieve an ACL from the server */
936 struct cifs_ntsd
*get_cifs_acl(struct cifs_sb_info
*cifs_sb
,
937 struct inode
*inode
, const char *path
,
940 struct cifs_ntsd
*pntsd
= NULL
;
941 struct cifsFileInfo
*open_file
= NULL
;
944 open_file
= find_readable_file(CIFS_I(inode
), true);
946 return get_cifs_acl_by_path(cifs_sb
, path
, pacllen
);
948 pntsd
= get_cifs_acl_by_fid(cifs_sb
, &open_file
->fid
, pacllen
);
949 cifsFileInfo_put(open_file
);
953 /* Set an ACL on the server */
954 int set_cifs_acl(struct cifs_ntsd
*pnntsd
, __u32 acllen
,
955 struct inode
*inode
, const char *path
, int aclflag
)
959 int rc
, access_flags
, create_options
= 0;
960 struct cifs_tcon
*tcon
;
961 struct cifs_sb_info
*cifs_sb
= CIFS_SB(inode
->i_sb
);
962 struct tcon_link
*tlink
= cifs_sb_tlink(cifs_sb
);
964 struct cifs_open_parms oparms
;
967 return PTR_ERR(tlink
);
969 tcon
= tlink_tcon(tlink
);
972 if (backup_cred(cifs_sb
))
973 create_options
|= CREATE_OPEN_BACKUP_INTENT
;
975 if (aclflag
== CIFS_ACL_OWNER
|| aclflag
== CIFS_ACL_GROUP
)
976 access_flags
= WRITE_OWNER
;
978 access_flags
= WRITE_DAC
;
981 oparms
.cifs_sb
= cifs_sb
;
982 oparms
.desired_access
= access_flags
;
983 oparms
.create_options
= create_options
;
984 oparms
.disposition
= FILE_OPEN
;
987 oparms
.reconnect
= false;
989 rc
= CIFS_open(xid
, &oparms
, &oplock
, NULL
);
991 cifs_dbg(VFS
, "Unable to open file to set ACL\n");
995 rc
= CIFSSMBSetCIFSACL(xid
, tcon
, fid
.netfid
, pnntsd
, acllen
, aclflag
);
996 cifs_dbg(NOISY
, "SetCIFSACL rc = %d\n", rc
);
998 CIFSSMBClose(xid
, tcon
, fid
.netfid
);
1001 cifs_put_tlink(tlink
);
1005 /* Translate the CIFS ACL (simlar to NTFS ACL) for a file into mode bits */
1007 cifs_acl_to_fattr(struct cifs_sb_info
*cifs_sb
, struct cifs_fattr
*fattr
,
1008 struct inode
*inode
, const char *path
,
1009 const struct cifs_fid
*pfid
)
1011 struct cifs_ntsd
*pntsd
= NULL
;
1014 struct tcon_link
*tlink
= cifs_sb_tlink(cifs_sb
);
1015 struct cifs_tcon
*tcon
;
1017 cifs_dbg(NOISY
, "converting ACL to mode for %s\n", path
);
1020 return PTR_ERR(tlink
);
1021 tcon
= tlink_tcon(tlink
);
1023 if (pfid
&& (tcon
->ses
->server
->ops
->get_acl_by_fid
))
1024 pntsd
= tcon
->ses
->server
->ops
->get_acl_by_fid(cifs_sb
, pfid
,
1026 else if (tcon
->ses
->server
->ops
->get_acl
)
1027 pntsd
= tcon
->ses
->server
->ops
->get_acl(cifs_sb
, inode
, path
,
1030 cifs_put_tlink(tlink
);
1033 /* if we can retrieve the ACL, now parse Access Control Entries, ACEs */
1034 if (IS_ERR(pntsd
)) {
1035 rc
= PTR_ERR(pntsd
);
1036 cifs_dbg(VFS
, "%s: error %d getting sec desc\n", __func__
, rc
);
1038 rc
= parse_sec_desc(cifs_sb
, pntsd
, acllen
, fattr
);
1041 cifs_dbg(VFS
, "parse sec desc failed rc = %d\n", rc
);
1044 cifs_put_tlink(tlink
);
1049 /* Convert mode bits to an ACL so we can update the ACL on the server */
1051 id_mode_to_cifs_acl(struct inode
*inode
, const char *path
, __u64 nmode
,
1052 kuid_t uid
, kgid_t gid
)
1055 int aclflag
= CIFS_ACL_DACL
; /* default flag to set */
1056 __u32 secdesclen
= 0;
1057 struct cifs_ntsd
*pntsd
= NULL
; /* acl obtained from server */
1058 struct cifs_ntsd
*pnntsd
= NULL
; /* modified acl to be sent to server */
1059 struct cifs_sb_info
*cifs_sb
= CIFS_SB(inode
->i_sb
);
1060 struct tcon_link
*tlink
= cifs_sb_tlink(cifs_sb
);
1061 struct cifs_tcon
*tcon
;
1064 return PTR_ERR(tlink
);
1065 tcon
= tlink_tcon(tlink
);
1067 cifs_dbg(NOISY
, "set ACL from mode for %s\n", path
);
1069 /* Get the security descriptor */
1071 if (tcon
->ses
->server
->ops
->get_acl
== NULL
) {
1072 cifs_put_tlink(tlink
);
1076 pntsd
= tcon
->ses
->server
->ops
->get_acl(cifs_sb
, inode
, path
,
1078 if (IS_ERR(pntsd
)) {
1079 rc
= PTR_ERR(pntsd
);
1080 cifs_dbg(VFS
, "%s: error %d getting sec desc\n", __func__
, rc
);
1081 cifs_put_tlink(tlink
);
1086 * Add three ACEs for owner, group, everyone getting rid of other ACEs
1087 * as chmod disables ACEs and set the security descriptor. Allocate
1088 * memory for the smb header, set security descriptor request security
1089 * descriptor parameters, and secuirty descriptor itself
1091 secdesclen
= max_t(u32
, secdesclen
, DEFAULT_SEC_DESC_LEN
);
1092 pnntsd
= kmalloc(secdesclen
, GFP_KERNEL
);
1095 cifs_put_tlink(tlink
);
1099 rc
= build_sec_desc(pntsd
, pnntsd
, secdesclen
, nmode
, uid
, gid
,
1102 cifs_dbg(NOISY
, "build_sec_desc rc: %d\n", rc
);
1104 if (tcon
->ses
->server
->ops
->set_acl
== NULL
)
1108 /* Set the security descriptor */
1109 rc
= tcon
->ses
->server
->ops
->set_acl(pnntsd
, secdesclen
, inode
,
1111 cifs_dbg(NOISY
, "set_cifs_acl rc: %d\n", rc
);
1113 cifs_put_tlink(tlink
);