4 * Copyright (C) International Business Machines Corp., 2007,2008
5 * Author(s): Steve French (sfrench@us.ibm.com)
7 * Contains the routines for mapping CIFS/NTFS ACLs
9 * This library is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU Lesser General Public License as published
11 * by the Free Software Foundation; either version 2.1 of the License, or
12 * (at your option) any later version.
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
17 * the GNU Lesser General Public License for more details.
19 * You should have received a copy of the GNU Lesser General Public License
20 * along with this library; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
25 #include <linux/slab.h>
26 #include <linux/string.h>
27 #include <linux/keyctl.h>
28 #include <linux/key-type.h>
29 #include <keys/user-type.h>
33 #include "cifsproto.h"
34 #include "cifs_debug.h"
36 /* security id for everyone/world system group */
37 static const struct cifs_sid sid_everyone
= {
38 1, 1, {0, 0, 0, 0, 0, 1}, {0} };
39 /* security id for Authenticated Users system group */
40 static const struct cifs_sid sid_authusers
= {
41 1, 1, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(11)} };
43 static const struct cifs_sid sid_user
= {1, 2 , {0, 0, 0, 0, 0, 5}, {} };
45 static const struct cred
*root_cred
;
48 cifs_idmap_key_instantiate(struct key
*key
, struct key_preparsed_payload
*prep
)
53 * If the payload is less than or equal to the size of a pointer, then
54 * an allocation here is wasteful. Just copy the data directly to the
55 * payload.value union member instead.
57 * With this however, you must check the datalen before trying to
58 * dereference payload.data!
60 if (prep
->datalen
<= sizeof(key
->payload
)) {
61 key
->payload
.value
= 0;
62 memcpy(&key
->payload
.value
, prep
->data
, prep
->datalen
);
63 key
->datalen
= prep
->datalen
;
66 payload
= kmemdup(prep
->data
, prep
->datalen
, GFP_KERNEL
);
70 key
->payload
.data
= payload
;
71 key
->datalen
= prep
->datalen
;
76 cifs_idmap_key_destroy(struct key
*key
)
78 if (key
->datalen
> sizeof(key
->payload
))
79 kfree(key
->payload
.data
);
82 static struct key_type cifs_idmap_key_type
= {
84 .instantiate
= cifs_idmap_key_instantiate
,
85 .destroy
= cifs_idmap_key_destroy
,
86 .describe
= user_describe
,
91 sid_to_key_str(struct cifs_sid
*sidptr
, unsigned int type
)
95 char *sidstr
, *strptr
;
96 unsigned long long id_auth_val
;
98 /* 3 bytes for prefix */
99 sidstr
= kmalloc(3 + SID_STRING_BASE_SIZE
+
100 (SID_STRING_SUBAUTH_SIZE
* sidptr
->num_subauth
),
106 len
= sprintf(strptr
, "%cs:S-%hhu", type
== SIDOWNER
? 'o' : 'g',
110 /* The authority field is a single 48-bit number */
111 id_auth_val
= (unsigned long long)sidptr
->authority
[5];
112 id_auth_val
|= (unsigned long long)sidptr
->authority
[4] << 8;
113 id_auth_val
|= (unsigned long long)sidptr
->authority
[3] << 16;
114 id_auth_val
|= (unsigned long long)sidptr
->authority
[2] << 24;
115 id_auth_val
|= (unsigned long long)sidptr
->authority
[1] << 32;
116 id_auth_val
|= (unsigned long long)sidptr
->authority
[0] << 48;
119 * MS-DTYP states that if the authority is >= 2^32, then it should be
120 * expressed as a hex value.
122 if (id_auth_val
<= UINT_MAX
)
123 len
= sprintf(strptr
, "-%llu", id_auth_val
);
125 len
= sprintf(strptr
, "-0x%llx", id_auth_val
);
129 for (i
= 0; i
< sidptr
->num_subauth
; ++i
) {
130 saval
= le32_to_cpu(sidptr
->sub_auth
[i
]);
131 len
= sprintf(strptr
, "-%u", saval
);
139 * if the two SIDs (roughly equivalent to a UUID for a user or group) are
140 * the same returns zero, if they do not match returns non-zero.
143 compare_sids(const struct cifs_sid
*ctsid
, const struct cifs_sid
*cwsid
)
146 int num_subauth
, num_sat
, num_saw
;
148 if ((!ctsid
) || (!cwsid
))
151 /* compare the revision */
152 if (ctsid
->revision
!= cwsid
->revision
) {
153 if (ctsid
->revision
> cwsid
->revision
)
159 /* compare all of the six auth values */
160 for (i
= 0; i
< NUM_AUTHS
; ++i
) {
161 if (ctsid
->authority
[i
] != cwsid
->authority
[i
]) {
162 if (ctsid
->authority
[i
] > cwsid
->authority
[i
])
169 /* compare all of the subauth values if any */
170 num_sat
= ctsid
->num_subauth
;
171 num_saw
= cwsid
->num_subauth
;
172 num_subauth
= num_sat
< num_saw
? num_sat
: num_saw
;
174 for (i
= 0; i
< num_subauth
; ++i
) {
175 if (ctsid
->sub_auth
[i
] != cwsid
->sub_auth
[i
]) {
176 if (le32_to_cpu(ctsid
->sub_auth
[i
]) >
177 le32_to_cpu(cwsid
->sub_auth
[i
]))
185 return 0; /* sids compare/match */
189 cifs_copy_sid(struct cifs_sid
*dst
, const struct cifs_sid
*src
)
193 dst
->revision
= src
->revision
;
194 dst
->num_subauth
= min_t(u8
, src
->num_subauth
, SID_MAX_SUB_AUTHORITIES
);
195 for (i
= 0; i
< NUM_AUTHS
; ++i
)
196 dst
->authority
[i
] = src
->authority
[i
];
197 for (i
= 0; i
< dst
->num_subauth
; ++i
)
198 dst
->sub_auth
[i
] = src
->sub_auth
[i
];
202 id_to_sid(unsigned int cid
, uint sidtype
, struct cifs_sid
*ssid
)
206 struct cifs_sid
*ksid
;
207 unsigned int ksid_size
;
208 char desc
[3 + 10 + 1]; /* 3 byte prefix + 10 bytes for value + NULL */
209 const struct cred
*saved_cred
;
211 rc
= snprintf(desc
, sizeof(desc
), "%ci:%u",
212 sidtype
== SIDOWNER
? 'o' : 'g', cid
);
213 if (rc
>= sizeof(desc
))
217 saved_cred
= override_creds(root_cred
);
218 sidkey
= request_key(&cifs_idmap_key_type
, desc
, "");
219 if (IS_ERR(sidkey
)) {
221 cifs_dbg(FYI
, "%s: Can't map %cid %u to a SID\n",
222 __func__
, sidtype
== SIDOWNER
? 'u' : 'g', cid
);
223 goto out_revert_creds
;
224 } else if (sidkey
->datalen
< CIFS_SID_BASE_SIZE
) {
226 cifs_dbg(FYI
, "%s: Downcall contained malformed key (datalen=%hu)\n",
227 __func__
, sidkey
->datalen
);
232 * A sid is usually too large to be embedded in payload.value, but if
233 * there are no subauthorities and the host has 8-byte pointers, then
236 ksid
= sidkey
->datalen
<= sizeof(sidkey
->payload
) ?
237 (struct cifs_sid
*)&sidkey
->payload
.value
:
238 (struct cifs_sid
*)sidkey
->payload
.data
;
240 ksid_size
= CIFS_SID_BASE_SIZE
+ (ksid
->num_subauth
* sizeof(__le32
));
241 if (ksid_size
> sidkey
->datalen
) {
243 cifs_dbg(FYI
, "%s: Downcall contained malformed key (datalen=%hu, ksid_size=%u)\n",
244 __func__
, sidkey
->datalen
, ksid_size
);
248 cifs_copy_sid(ssid
, ksid
);
252 revert_creds(saved_cred
);
256 key_invalidate(sidkey
);
261 sid_to_id(struct cifs_sb_info
*cifs_sb
, struct cifs_sid
*psid
,
262 struct cifs_fattr
*fattr
, uint sidtype
)
267 const struct cred
*saved_cred
;
268 kuid_t fuid
= cifs_sb
->mnt_uid
;
269 kgid_t fgid
= cifs_sb
->mnt_gid
;
272 * If we have too many subauthorities, then something is really wrong.
273 * Just return an error.
275 if (unlikely(psid
->num_subauth
> SID_MAX_SUB_AUTHORITIES
)) {
276 cifs_dbg(FYI
, "%s: %u subauthorities is too many!\n",
277 __func__
, psid
->num_subauth
);
281 sidstr
= sid_to_key_str(psid
, sidtype
);
285 saved_cred
= override_creds(root_cred
);
286 sidkey
= request_key(&cifs_idmap_key_type
, sidstr
, "");
287 if (IS_ERR(sidkey
)) {
289 cifs_dbg(FYI
, "%s: Can't map SID %s to a %cid\n",
290 __func__
, sidstr
, sidtype
== SIDOWNER
? 'u' : 'g');
291 goto out_revert_creds
;
295 * FIXME: Here we assume that uid_t and gid_t are same size. It's
296 * probably a safe assumption but might be better to check based on
299 BUILD_BUG_ON(sizeof(uid_t
) != sizeof(gid_t
));
300 if (sidkey
->datalen
!= sizeof(uid_t
)) {
302 cifs_dbg(FYI
, "%s: Downcall contained malformed key (datalen=%hu)\n",
303 __func__
, sidkey
->datalen
);
304 key_invalidate(sidkey
);
308 if (sidtype
== SIDOWNER
) {
311 memcpy(&id
, &sidkey
->payload
.value
, sizeof(uid_t
));
312 uid
= make_kuid(&init_user_ns
, id
);
318 memcpy(&id
, &sidkey
->payload
.value
, sizeof(gid_t
));
319 gid
= make_kgid(&init_user_ns
, id
);
327 revert_creds(saved_cred
);
331 * Note that we return 0 here unconditionally. If the mapping
332 * fails then we just fall back to using the mnt_uid/mnt_gid.
334 if (sidtype
== SIDOWNER
)
335 fattr
->cf_uid
= fuid
;
337 fattr
->cf_gid
= fgid
;
342 init_cifs_idmap(void)
348 cifs_dbg(FYI
, "Registering the %s key type\n",
349 cifs_idmap_key_type
.name
);
351 /* create an override credential set with a special thread keyring in
352 * which requests are cached
354 * this is used to prevent malicious redirections from being installed
357 cred
= prepare_kernel_cred(NULL
);
361 keyring
= keyring_alloc(".cifs_idmap",
362 GLOBAL_ROOT_UID
, GLOBAL_ROOT_GID
, cred
,
363 (KEY_POS_ALL
& ~KEY_POS_SETATTR
) |
364 KEY_USR_VIEW
| KEY_USR_READ
,
365 KEY_ALLOC_NOT_IN_QUOTA
, NULL
);
366 if (IS_ERR(keyring
)) {
367 ret
= PTR_ERR(keyring
);
368 goto failed_put_cred
;
371 ret
= register_key_type(&cifs_idmap_key_type
);
375 /* instruct request_key() to use this special keyring as a cache for
376 * the results it looks up */
377 set_bit(KEY_FLAG_ROOT_CAN_CLEAR
, &keyring
->flags
);
378 cred
->thread_keyring
= keyring
;
379 cred
->jit_keyring
= KEY_REQKEY_DEFL_THREAD_KEYRING
;
382 cifs_dbg(FYI
, "cifs idmap keyring: %d\n", key_serial(keyring
));
393 exit_cifs_idmap(void)
395 key_revoke(root_cred
->thread_keyring
);
396 unregister_key_type(&cifs_idmap_key_type
);
398 cifs_dbg(FYI
, "Unregistered %s key type\n", cifs_idmap_key_type
.name
);
401 /* copy ntsd, owner sid, and group sid from a security descriptor to another */
402 static void copy_sec_desc(const struct cifs_ntsd
*pntsd
,
403 struct cifs_ntsd
*pnntsd
, __u32 sidsoffset
)
405 struct cifs_sid
*owner_sid_ptr
, *group_sid_ptr
;
406 struct cifs_sid
*nowner_sid_ptr
, *ngroup_sid_ptr
;
408 /* copy security descriptor control portion */
409 pnntsd
->revision
= pntsd
->revision
;
410 pnntsd
->type
= pntsd
->type
;
411 pnntsd
->dacloffset
= cpu_to_le32(sizeof(struct cifs_ntsd
));
412 pnntsd
->sacloffset
= 0;
413 pnntsd
->osidoffset
= cpu_to_le32(sidsoffset
);
414 pnntsd
->gsidoffset
= cpu_to_le32(sidsoffset
+ sizeof(struct cifs_sid
));
417 owner_sid_ptr
= (struct cifs_sid
*)((char *)pntsd
+
418 le32_to_cpu(pntsd
->osidoffset
));
419 nowner_sid_ptr
= (struct cifs_sid
*)((char *)pnntsd
+ sidsoffset
);
420 cifs_copy_sid(nowner_sid_ptr
, owner_sid_ptr
);
423 group_sid_ptr
= (struct cifs_sid
*)((char *)pntsd
+
424 le32_to_cpu(pntsd
->gsidoffset
));
425 ngroup_sid_ptr
= (struct cifs_sid
*)((char *)pnntsd
+ sidsoffset
+
426 sizeof(struct cifs_sid
));
427 cifs_copy_sid(ngroup_sid_ptr
, group_sid_ptr
);
434 change posix mode to reflect permissions
435 pmode is the existing mode (we only want to overwrite part of this
436 bits to set can be: S_IRWXU, S_IRWXG or S_IRWXO ie 00700 or 00070 or 00007
438 static void access_flags_to_mode(__le32 ace_flags
, int type
, umode_t
*pmode
,
439 umode_t
*pbits_to_set
)
441 __u32 flags
= le32_to_cpu(ace_flags
);
442 /* the order of ACEs is important. The canonical order is to begin with
443 DENY entries followed by ALLOW, otherwise an allow entry could be
444 encountered first, making the subsequent deny entry like "dead code"
445 which would be superflous since Windows stops when a match is made
446 for the operation you are trying to perform for your user */
448 /* For deny ACEs we change the mask so that subsequent allow access
449 control entries do not turn on the bits we are denying */
450 if (type
== ACCESS_DENIED
) {
451 if (flags
& GENERIC_ALL
)
452 *pbits_to_set
&= ~S_IRWXUGO
;
454 if ((flags
& GENERIC_WRITE
) ||
455 ((flags
& FILE_WRITE_RIGHTS
) == FILE_WRITE_RIGHTS
))
456 *pbits_to_set
&= ~S_IWUGO
;
457 if ((flags
& GENERIC_READ
) ||
458 ((flags
& FILE_READ_RIGHTS
) == FILE_READ_RIGHTS
))
459 *pbits_to_set
&= ~S_IRUGO
;
460 if ((flags
& GENERIC_EXECUTE
) ||
461 ((flags
& FILE_EXEC_RIGHTS
) == FILE_EXEC_RIGHTS
))
462 *pbits_to_set
&= ~S_IXUGO
;
464 } else if (type
!= ACCESS_ALLOWED
) {
465 cifs_dbg(VFS
, "unknown access control type %d\n", type
);
468 /* else ACCESS_ALLOWED type */
470 if (flags
& GENERIC_ALL
) {
471 *pmode
|= (S_IRWXUGO
& (*pbits_to_set
));
472 cifs_dbg(NOISY
, "all perms\n");
475 if ((flags
& GENERIC_WRITE
) ||
476 ((flags
& FILE_WRITE_RIGHTS
) == FILE_WRITE_RIGHTS
))
477 *pmode
|= (S_IWUGO
& (*pbits_to_set
));
478 if ((flags
& GENERIC_READ
) ||
479 ((flags
& FILE_READ_RIGHTS
) == FILE_READ_RIGHTS
))
480 *pmode
|= (S_IRUGO
& (*pbits_to_set
));
481 if ((flags
& GENERIC_EXECUTE
) ||
482 ((flags
& FILE_EXEC_RIGHTS
) == FILE_EXEC_RIGHTS
))
483 *pmode
|= (S_IXUGO
& (*pbits_to_set
));
485 cifs_dbg(NOISY
, "access flags 0x%x mode now 0x%x\n", flags
, *pmode
);
490 Generate access flags to reflect permissions mode is the existing mode.
491 This function is called for every ACE in the DACL whose SID matches
492 with either owner or group or everyone.
495 static void mode_to_access_flags(umode_t mode
, umode_t bits_to_use
,
498 /* reset access mask */
501 /* bits to use are either S_IRWXU or S_IRWXG or S_IRWXO */
504 /* check for R/W/X UGO since we do not know whose flags
505 is this but we have cleared all the bits sans RWX for
506 either user or group or other as per bits_to_use */
508 *pace_flags
|= SET_FILE_READ_RIGHTS
;
510 *pace_flags
|= SET_FILE_WRITE_RIGHTS
;
512 *pace_flags
|= SET_FILE_EXEC_RIGHTS
;
514 cifs_dbg(NOISY
, "mode: 0x%x, access flags now 0x%x\n",
519 static __u16
fill_ace_for_sid(struct cifs_ace
*pntace
,
520 const struct cifs_sid
*psid
, __u64 nmode
, umode_t bits
)
524 __u32 access_req
= 0;
526 pntace
->type
= ACCESS_ALLOWED
;
528 mode_to_access_flags(nmode
, bits
, &access_req
);
530 access_req
= SET_MINIMUM_RIGHTS
;
531 pntace
->access_req
= cpu_to_le32(access_req
);
533 pntace
->sid
.revision
= psid
->revision
;
534 pntace
->sid
.num_subauth
= psid
->num_subauth
;
535 for (i
= 0; i
< NUM_AUTHS
; i
++)
536 pntace
->sid
.authority
[i
] = psid
->authority
[i
];
537 for (i
= 0; i
< psid
->num_subauth
; i
++)
538 pntace
->sid
.sub_auth
[i
] = psid
->sub_auth
[i
];
540 size
= 1 + 1 + 2 + 4 + 1 + 1 + 6 + (psid
->num_subauth
* 4);
541 pntace
->size
= cpu_to_le16(size
);
547 #ifdef CONFIG_CIFS_DEBUG2
548 static void dump_ace(struct cifs_ace
*pace
, char *end_of_acl
)
552 /* validate that we do not go past end of acl */
554 if (le16_to_cpu(pace
->size
) < 16) {
555 cifs_dbg(VFS
, "ACE too small %d\n", le16_to_cpu(pace
->size
));
559 if (end_of_acl
< (char *)pace
+ le16_to_cpu(pace
->size
)) {
560 cifs_dbg(VFS
, "ACL too small to parse ACE\n");
564 num_subauth
= pace
->sid
.num_subauth
;
567 cifs_dbg(FYI
, "ACE revision %d num_auth %d type %d flags %d size %d\n",
568 pace
->sid
.revision
, pace
->sid
.num_subauth
, pace
->type
,
569 pace
->flags
, le16_to_cpu(pace
->size
));
570 for (i
= 0; i
< num_subauth
; ++i
) {
571 cifs_dbg(FYI
, "ACE sub_auth[%d]: 0x%x\n",
572 i
, le32_to_cpu(pace
->sid
.sub_auth
[i
]));
575 /* BB add length check to make sure that we do not have huge
576 num auths and therefore go off the end */
584 static void parse_dacl(struct cifs_acl
*pdacl
, char *end_of_acl
,
585 struct cifs_sid
*pownersid
, struct cifs_sid
*pgrpsid
,
586 struct cifs_fattr
*fattr
)
592 struct cifs_ace
**ppace
;
594 /* BB need to add parm so we can store the SID BB */
597 /* no DACL in the security descriptor, set
598 all the permissions for user/group/other */
599 fattr
->cf_mode
|= S_IRWXUGO
;
603 /* validate that we do not go past end of acl */
604 if (end_of_acl
< (char *)pdacl
+ le16_to_cpu(pdacl
->size
)) {
605 cifs_dbg(VFS
, "ACL too small to parse DACL\n");
609 cifs_dbg(NOISY
, "DACL revision %d size %d num aces %d\n",
610 le16_to_cpu(pdacl
->revision
), le16_to_cpu(pdacl
->size
),
611 le32_to_cpu(pdacl
->num_aces
));
613 /* reset rwx permissions for user/group/other.
614 Also, if num_aces is 0 i.e. DACL has no ACEs,
615 user/group/other have no permissions */
616 fattr
->cf_mode
&= ~(S_IRWXUGO
);
618 acl_base
= (char *)pdacl
;
619 acl_size
= sizeof(struct cifs_acl
);
621 num_aces
= le32_to_cpu(pdacl
->num_aces
);
623 umode_t user_mask
= S_IRWXU
;
624 umode_t group_mask
= S_IRWXG
;
625 umode_t other_mask
= S_IRWXU
| S_IRWXG
| S_IRWXO
;
627 if (num_aces
> ULONG_MAX
/ sizeof(struct cifs_ace
*))
629 ppace
= kmalloc(num_aces
* sizeof(struct cifs_ace
*),
634 for (i
= 0; i
< num_aces
; ++i
) {
635 ppace
[i
] = (struct cifs_ace
*) (acl_base
+ acl_size
);
636 #ifdef CONFIG_CIFS_DEBUG2
637 dump_ace(ppace
[i
], end_of_acl
);
639 if (compare_sids(&(ppace
[i
]->sid
), pownersid
) == 0)
640 access_flags_to_mode(ppace
[i
]->access_req
,
644 if (compare_sids(&(ppace
[i
]->sid
), pgrpsid
) == 0)
645 access_flags_to_mode(ppace
[i
]->access_req
,
649 if (compare_sids(&(ppace
[i
]->sid
), &sid_everyone
) == 0)
650 access_flags_to_mode(ppace
[i
]->access_req
,
654 if (compare_sids(&(ppace
[i
]->sid
), &sid_authusers
) == 0)
655 access_flags_to_mode(ppace
[i
]->access_req
,
661 /* memcpy((void *)(&(cifscred->aces[i])),
663 sizeof(struct cifs_ace)); */
665 acl_base
= (char *)ppace
[i
];
666 acl_size
= le16_to_cpu(ppace
[i
]->size
);
676 static int set_chmod_dacl(struct cifs_acl
*pndacl
, struct cifs_sid
*pownersid
,
677 struct cifs_sid
*pgrpsid
, __u64 nmode
)
680 struct cifs_acl
*pnndacl
;
682 pnndacl
= (struct cifs_acl
*)((char *)pndacl
+ sizeof(struct cifs_acl
));
684 size
+= fill_ace_for_sid((struct cifs_ace
*) ((char *)pnndacl
+ size
),
685 pownersid
, nmode
, S_IRWXU
);
686 size
+= fill_ace_for_sid((struct cifs_ace
*)((char *)pnndacl
+ size
),
687 pgrpsid
, nmode
, S_IRWXG
);
688 size
+= fill_ace_for_sid((struct cifs_ace
*)((char *)pnndacl
+ size
),
689 &sid_everyone
, nmode
, S_IRWXO
);
691 pndacl
->size
= cpu_to_le16(size
+ sizeof(struct cifs_acl
));
692 pndacl
->num_aces
= cpu_to_le32(3);
698 static int parse_sid(struct cifs_sid
*psid
, char *end_of_acl
)
700 /* BB need to add parm so we can store the SID BB */
702 /* validate that we do not go past end of ACL - sid must be at least 8
703 bytes long (assuming no sub-auths - e.g. the null SID */
704 if (end_of_acl
< (char *)psid
+ 8) {
705 cifs_dbg(VFS
, "ACL too small to parse SID %p\n", psid
);
709 #ifdef CONFIG_CIFS_DEBUG2
710 if (psid
->num_subauth
) {
712 cifs_dbg(FYI
, "SID revision %d num_auth %d\n",
713 psid
->revision
, psid
->num_subauth
);
715 for (i
= 0; i
< psid
->num_subauth
; i
++) {
716 cifs_dbg(FYI
, "SID sub_auth[%d]: 0x%x\n",
717 i
, le32_to_cpu(psid
->sub_auth
[i
]));
720 /* BB add length check to make sure that we do not have huge
721 num auths and therefore go off the end */
722 cifs_dbg(FYI
, "RID 0x%x\n",
723 le32_to_cpu(psid
->sub_auth
[psid
->num_subauth
-1]));
731 /* Convert CIFS ACL to POSIX form */
732 static int parse_sec_desc(struct cifs_sb_info
*cifs_sb
,
733 struct cifs_ntsd
*pntsd
, int acl_len
, struct cifs_fattr
*fattr
)
736 struct cifs_sid
*owner_sid_ptr
, *group_sid_ptr
;
737 struct cifs_acl
*dacl_ptr
; /* no need for SACL ptr */
738 char *end_of_acl
= ((char *)pntsd
) + acl_len
;
744 owner_sid_ptr
= (struct cifs_sid
*)((char *)pntsd
+
745 le32_to_cpu(pntsd
->osidoffset
));
746 group_sid_ptr
= (struct cifs_sid
*)((char *)pntsd
+
747 le32_to_cpu(pntsd
->gsidoffset
));
748 dacloffset
= le32_to_cpu(pntsd
->dacloffset
);
749 dacl_ptr
= (struct cifs_acl
*)((char *)pntsd
+ dacloffset
);
750 cifs_dbg(NOISY
, "revision %d type 0x%x ooffset 0x%x goffset 0x%x sacloffset 0x%x dacloffset 0x%x\n",
751 pntsd
->revision
, pntsd
->type
, le32_to_cpu(pntsd
->osidoffset
),
752 le32_to_cpu(pntsd
->gsidoffset
),
753 le32_to_cpu(pntsd
->sacloffset
), dacloffset
);
754 /* cifs_dump_mem("owner_sid: ", owner_sid_ptr, 64); */
755 rc
= parse_sid(owner_sid_ptr
, end_of_acl
);
757 cifs_dbg(FYI
, "%s: Error %d parsing Owner SID\n", __func__
, rc
);
760 rc
= sid_to_id(cifs_sb
, owner_sid_ptr
, fattr
, SIDOWNER
);
762 cifs_dbg(FYI
, "%s: Error %d mapping Owner SID to uid\n",
767 rc
= parse_sid(group_sid_ptr
, end_of_acl
);
769 cifs_dbg(FYI
, "%s: Error %d mapping Owner SID to gid\n",
773 rc
= sid_to_id(cifs_sb
, group_sid_ptr
, fattr
, SIDGROUP
);
775 cifs_dbg(FYI
, "%s: Error %d mapping Group SID to gid\n",
781 parse_dacl(dacl_ptr
, end_of_acl
, owner_sid_ptr
,
782 group_sid_ptr
, fattr
);
784 cifs_dbg(FYI
, "no ACL\n"); /* BB grant all or default perms? */
789 /* Convert permission bits from mode to equivalent CIFS ACL */
790 static int build_sec_desc(struct cifs_ntsd
*pntsd
, struct cifs_ntsd
*pnntsd
,
791 __u32 secdesclen
, __u64 nmode
, kuid_t uid
, kgid_t gid
, int *aclflag
)
797 struct cifs_sid
*owner_sid_ptr
, *group_sid_ptr
;
798 struct cifs_sid
*nowner_sid_ptr
, *ngroup_sid_ptr
;
799 struct cifs_acl
*dacl_ptr
= NULL
; /* no need for SACL ptr */
800 struct cifs_acl
*ndacl_ptr
= NULL
; /* no need for SACL ptr */
802 if (nmode
!= NO_CHANGE_64
) { /* chmod */
803 owner_sid_ptr
= (struct cifs_sid
*)((char *)pntsd
+
804 le32_to_cpu(pntsd
->osidoffset
));
805 group_sid_ptr
= (struct cifs_sid
*)((char *)pntsd
+
806 le32_to_cpu(pntsd
->gsidoffset
));
807 dacloffset
= le32_to_cpu(pntsd
->dacloffset
);
808 dacl_ptr
= (struct cifs_acl
*)((char *)pntsd
+ dacloffset
);
809 ndacloffset
= sizeof(struct cifs_ntsd
);
810 ndacl_ptr
= (struct cifs_acl
*)((char *)pnntsd
+ ndacloffset
);
811 ndacl_ptr
->revision
= dacl_ptr
->revision
;
813 ndacl_ptr
->num_aces
= 0;
815 rc
= set_chmod_dacl(ndacl_ptr
, owner_sid_ptr
, group_sid_ptr
,
817 sidsoffset
= ndacloffset
+ le16_to_cpu(ndacl_ptr
->size
);
818 /* copy sec desc control portion & owner and group sids */
819 copy_sec_desc(pntsd
, pnntsd
, sidsoffset
);
820 *aclflag
= CIFS_ACL_DACL
;
822 memcpy(pnntsd
, pntsd
, secdesclen
);
823 if (uid_valid(uid
)) { /* chown */
825 owner_sid_ptr
= (struct cifs_sid
*)((char *)pnntsd
+
826 le32_to_cpu(pnntsd
->osidoffset
));
827 nowner_sid_ptr
= kmalloc(sizeof(struct cifs_sid
),
831 id
= from_kuid(&init_user_ns
, uid
);
832 rc
= id_to_sid(id
, SIDOWNER
, nowner_sid_ptr
);
834 cifs_dbg(FYI
, "%s: Mapping error %d for owner id %d\n",
836 kfree(nowner_sid_ptr
);
839 cifs_copy_sid(owner_sid_ptr
, nowner_sid_ptr
);
840 kfree(nowner_sid_ptr
);
841 *aclflag
= CIFS_ACL_OWNER
;
843 if (gid_valid(gid
)) { /* chgrp */
845 group_sid_ptr
= (struct cifs_sid
*)((char *)pnntsd
+
846 le32_to_cpu(pnntsd
->gsidoffset
));
847 ngroup_sid_ptr
= kmalloc(sizeof(struct cifs_sid
),
851 id
= from_kgid(&init_user_ns
, gid
);
852 rc
= id_to_sid(id
, SIDGROUP
, ngroup_sid_ptr
);
854 cifs_dbg(FYI
, "%s: Mapping error %d for group id %d\n",
856 kfree(ngroup_sid_ptr
);
859 cifs_copy_sid(group_sid_ptr
, ngroup_sid_ptr
);
860 kfree(ngroup_sid_ptr
);
861 *aclflag
= CIFS_ACL_GROUP
;
868 static struct cifs_ntsd
*get_cifs_acl_by_fid(struct cifs_sb_info
*cifs_sb
,
869 __u16 fid
, u32
*pacllen
)
871 struct cifs_ntsd
*pntsd
= NULL
;
874 struct tcon_link
*tlink
= cifs_sb_tlink(cifs_sb
);
877 return ERR_CAST(tlink
);
880 rc
= CIFSSMBGetCIFSACL(xid
, tlink_tcon(tlink
), fid
, &pntsd
, pacllen
);
883 cifs_put_tlink(tlink
);
885 cifs_dbg(FYI
, "%s: rc = %d ACL len %d\n", __func__
, rc
, *pacllen
);
891 static struct cifs_ntsd
*get_cifs_acl_by_path(struct cifs_sb_info
*cifs_sb
,
892 const char *path
, u32
*pacllen
)
894 struct cifs_ntsd
*pntsd
= NULL
;
897 int rc
, create_options
= 0;
898 struct cifs_tcon
*tcon
;
899 struct tcon_link
*tlink
= cifs_sb_tlink(cifs_sb
);
901 struct cifs_open_parms oparms
;
904 return ERR_CAST(tlink
);
906 tcon
= tlink_tcon(tlink
);
909 if (backup_cred(cifs_sb
))
910 create_options
|= CREATE_OPEN_BACKUP_INTENT
;
913 oparms
.cifs_sb
= cifs_sb
;
914 oparms
.desired_access
= READ_CONTROL
;
915 oparms
.create_options
= create_options
;
916 oparms
.disposition
= FILE_OPEN
;
919 oparms
.reconnect
= false;
921 rc
= CIFS_open(xid
, &oparms
, &oplock
, NULL
);
923 rc
= CIFSSMBGetCIFSACL(xid
, tcon
, fid
.netfid
, &pntsd
, pacllen
);
924 CIFSSMBClose(xid
, tcon
, fid
.netfid
);
927 cifs_put_tlink(tlink
);
930 cifs_dbg(FYI
, "%s: rc = %d ACL len %d\n", __func__
, rc
, *pacllen
);
936 /* Retrieve an ACL from the server */
937 struct cifs_ntsd
*get_cifs_acl(struct cifs_sb_info
*cifs_sb
,
938 struct inode
*inode
, const char *path
,
941 struct cifs_ntsd
*pntsd
= NULL
;
942 struct cifsFileInfo
*open_file
= NULL
;
945 open_file
= find_readable_file(CIFS_I(inode
), true);
947 return get_cifs_acl_by_path(cifs_sb
, path
, pacllen
);
949 pntsd
= get_cifs_acl_by_fid(cifs_sb
, open_file
->fid
.netfid
, pacllen
);
950 cifsFileInfo_put(open_file
);
954 /* Set an ACL on the server */
955 int set_cifs_acl(struct cifs_ntsd
*pnntsd
, __u32 acllen
,
956 struct inode
*inode
, const char *path
, int aclflag
)
960 int rc
, access_flags
, create_options
= 0;
961 struct cifs_tcon
*tcon
;
962 struct cifs_sb_info
*cifs_sb
= CIFS_SB(inode
->i_sb
);
963 struct tcon_link
*tlink
= cifs_sb_tlink(cifs_sb
);
965 struct cifs_open_parms oparms
;
968 return PTR_ERR(tlink
);
970 tcon
= tlink_tcon(tlink
);
973 if (backup_cred(cifs_sb
))
974 create_options
|= CREATE_OPEN_BACKUP_INTENT
;
976 if (aclflag
== CIFS_ACL_OWNER
|| aclflag
== CIFS_ACL_GROUP
)
977 access_flags
= WRITE_OWNER
;
979 access_flags
= WRITE_DAC
;
982 oparms
.cifs_sb
= cifs_sb
;
983 oparms
.desired_access
= access_flags
;
984 oparms
.create_options
= create_options
;
985 oparms
.disposition
= FILE_OPEN
;
988 oparms
.reconnect
= false;
990 rc
= CIFS_open(xid
, &oparms
, &oplock
, NULL
);
992 cifs_dbg(VFS
, "Unable to open file to set ACL\n");
996 rc
= CIFSSMBSetCIFSACL(xid
, tcon
, fid
.netfid
, pnntsd
, acllen
, aclflag
);
997 cifs_dbg(NOISY
, "SetCIFSACL rc = %d\n", rc
);
999 CIFSSMBClose(xid
, tcon
, fid
.netfid
);
1002 cifs_put_tlink(tlink
);
1006 /* Translate the CIFS ACL (simlar to NTFS ACL) for a file into mode bits */
1008 cifs_acl_to_fattr(struct cifs_sb_info
*cifs_sb
, struct cifs_fattr
*fattr
,
1009 struct inode
*inode
, const char *path
, const __u16
*pfid
)
1011 struct cifs_ntsd
*pntsd
= NULL
;
1015 cifs_dbg(NOISY
, "converting ACL to mode for %s\n", path
);
1018 pntsd
= get_cifs_acl_by_fid(cifs_sb
, *pfid
, &acllen
);
1020 pntsd
= get_cifs_acl(cifs_sb
, inode
, path
, &acllen
);
1022 /* if we can retrieve the ACL, now parse Access Control Entries, ACEs */
1023 if (IS_ERR(pntsd
)) {
1024 rc
= PTR_ERR(pntsd
);
1025 cifs_dbg(VFS
, "%s: error %d getting sec desc\n", __func__
, rc
);
1027 rc
= parse_sec_desc(cifs_sb
, pntsd
, acllen
, fattr
);
1030 cifs_dbg(VFS
, "parse sec desc failed rc = %d\n", rc
);
1036 /* Convert mode bits to an ACL so we can update the ACL on the server */
1038 id_mode_to_cifs_acl(struct inode
*inode
, const char *path
, __u64 nmode
,
1039 kuid_t uid
, kgid_t gid
)
1042 int aclflag
= CIFS_ACL_DACL
; /* default flag to set */
1043 __u32 secdesclen
= 0;
1044 struct cifs_ntsd
*pntsd
= NULL
; /* acl obtained from server */
1045 struct cifs_ntsd
*pnntsd
= NULL
; /* modified acl to be sent to server */
1047 cifs_dbg(NOISY
, "set ACL from mode for %s\n", path
);
1049 /* Get the security descriptor */
1050 pntsd
= get_cifs_acl(CIFS_SB(inode
->i_sb
), inode
, path
, &secdesclen
);
1051 if (IS_ERR(pntsd
)) {
1052 rc
= PTR_ERR(pntsd
);
1053 cifs_dbg(VFS
, "%s: error %d getting sec desc\n", __func__
, rc
);
1058 * Add three ACEs for owner, group, everyone getting rid of other ACEs
1059 * as chmod disables ACEs and set the security descriptor. Allocate
1060 * memory for the smb header, set security descriptor request security
1061 * descriptor parameters, and secuirty descriptor itself
1063 secdesclen
= max_t(u32
, secdesclen
, DEFAULT_SEC_DESC_LEN
);
1064 pnntsd
= kmalloc(secdesclen
, GFP_KERNEL
);
1070 rc
= build_sec_desc(pntsd
, pnntsd
, secdesclen
, nmode
, uid
, gid
,
1073 cifs_dbg(NOISY
, "build_sec_desc rc: %d\n", rc
);
1076 /* Set the security descriptor */
1077 rc
= set_cifs_acl(pnntsd
, secdesclen
, inode
, path
, aclflag
);
1078 cifs_dbg(NOISY
, "set_cifs_acl rc: %d\n", rc
);