| blob | a05ccb6b7f3021efae7fffeb74ec857b91662387 |
1 /*
2 Unix SMB/CIFS implementation.
3 file opening and share modes
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Jeremy Allison 2001-2004
6 Copyright (C) Volker Lendecke 2005
7 Copyright (C) Ralph Boehme 2017
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
47 #if defined(HAVE_LINUX_MAGIC_H)
48 #include <linux/magic.h>
49 #endif
61 /*
62 * Timer for async opens, needed because they don't use a watch on
63 * a locking.tdb record. This is currently only used for real async
64 * opens and just terminates smbd if the async open times out.
65 */
68 /*
69 * For the samba kernel oplock case we use both a timeout and
70 * a watch on locking.tdb. This way in case it's smbd holding
71 * the kernel oplock we get directly notified for the retry
72 * once the kernel oplock is properly broken. Store the req
73 * here so that it can be timely discarded once the timer
74 * above fires.
75 */
77 };
79 /****************************************************************************
80 If the requester wanted DELETE_ACCESS and was rejected because
81 the file ACL didn't include DELETE_ACCESS, see if the parent ACL
82 overrides this.
83 ****************************************************************************/
90 {
95 }
98 }
100 /****************************************************************************
101 Check if we have open rights.
102 ****************************************************************************/
110 {
119 access_mask,
121 rejected_share_access);
123 }
131 }
134 /* I'm sorry sir, I didn't know you were root... */
139 }
143 {
147 access_mask);
149 }
154 {
155 /* We can always delete a symlink. */
159 }
162 }
172 {
174 NTSTATUS status;
178 }
182 use_privs,
189 access_mask,
190 rejected_mask,
198 }
199 }
205 {
207 }
209 /* Here we know status == NT_STATUS_ACCESS_DENIED. */
211 access_denied:
220 {
225 }
228 dirfsp,
229 smb_fname,
230 access_mask,
231 rejected_mask))
232 {
233 /*
234 * Were we trying to do an open for delete and didn't get DELETE
235 * access. Check if the directory allows DELETE_CHILD.
236 * See here:
237 * http://blogs.msdn.com/oldnewthing/archive/2004/06/04/148426.aspx
238 * for details.
239 */
245 }
249 }
251 }
257 {
260 NTSTATUS status;
262 /* Cope with fake/printer fsp's. */
266 }
268 }
271 /*
272 * This is a POSIX open on a symlink. For the pathname
273 * version of this function we used to return the st_mode
274 * bits turned into an NT ACL. For a symlink the mode bits
275 * are always rwxrwxrwx which means the pathname version always
276 * returned NT_STATUS_OK for a symlink. For the handle reference
277 * to a symlink use the handle access bits.
278 */
281 }
283 }
285 /*
286 * If we can access the path to this file, by
287 * default we have FILE_READ_ATTRIBUTES from the
288 * containing directory. See the section:
289 * "Algorithm to Check Access to an Existing File"
290 * in MS-FSA.pdf.
291 *
292 * se_file_access_check() also takes care of
293 * owner WRITE_DAC and READ_CONTROL.
294 */
297 /*
298 * Samba 3.6 and earlier granted execute access even
299 * if the ACL did not contain execute rights.
300 * Samba 4.0 is more correct and checks it.
301 * The compatibility mode allows one to skip this check
302 * to smoothen upgrades.
303 */
306 }
310 use_privs,
311 access_mask,
312 do_not_check_mask);
315 }
319 SECINFO_GROUP |
320 SECINFO_DACL),
328 }
331 dirfsp,
333 sd,
334 use_privs,
335 access_mask,
336 do_not_check_mask);
337 }
339 /*
340 * Given an fsp that represents a parent directory,
341 * check if the requested access can be granted.
342 */
345 {
346 NTSTATUS status;
354 /* I'm sorry sir, I didn't know you were root... */
360 }
364 frame,
373 }
375 /*
376 * If we can access the path to this file, by
377 * default we have FILE_READ_ATTRIBUTES from the
378 * containing directory. See the section:
379 * "Algorithm to Check Access to an Existing File"
380 * in MS-FSA.pdf.
381 *
382 * se_file_access_check() also takes care of
383 * owner WRITE_DAC and READ_CONTROL.
384 */
394 access_mask,
395 access_granted,
398 }
403 }
407 }
409 /* Check if the directory has delete-on-close set */
415 }
421 }
425 out:
428 }
430 /****************************************************************************
431 Ensure when opening a base file for a stream open that we have permissions
432 to do so given the access mask on the base file.
433 ****************************************************************************/
437 {
438 NTSTATUS status;
441 fsp,
443 access_mask,
451 }
457 }
461 }
462 }
465 fsp,
467 access_mask);
468 }
477 {
482 NTSTATUS status;
492 }
494 /* Pin parent directory in place. */
502 }
503 }
508 NULL,
509 NULL,
515 }
524 }
528 connectpath_len,
535 }
542 connectpath,
548 out:
553 }
556 }
558 /*
559 * Get the symlink target of dirfsp/symlink_name, making sure the
560 * target is below connection_path.
561 */
570 {
573 NTSTATUS status;
576 /*
577 * fsp is an O_PATH open, Linux does a "freadlink"
578 * with an empty name argument to readlinkat
579 */
584 }
588 }
591 connection_path,
593 target,
600 }
603 /*
604 * special case symlink to share root: "." is our
605 * share root filename
606 */
611 }
612 }
616 }
618 /****************************************************************************
619 Non-widelink open.
620 ****************************************************************************/
626 {
645 /*
646 * This can happen with shadow_copy2 if the snapshot
647 * path is not found
648 */
650 }
653 again:
661 }
662 }
663 }
669 smb_fname,
674 }
678 conn,
679 connpath,
680 connpath_len,
681 parent_dir_fname,
685 }
687 /* Setup fsp->fsp_name to be relative to cwd */
690 /*
691 * fsp->fsp_name is unchanged as it is already correctly
692 * relative to dirfsp.
693 */
695 }
697 {
698 /*
699 * Assert nobody can step in with a symlink on the
700 * path, there is no path anymore and we'll use
701 * O_NOFOLLOW to open.
702 */
705 }
710 dirfsp,
711 smb_fname_rel,
712 fsp,
721 }
723 /*
724 * ENOENT makes it worthless retrying with a
725 * stat, we know for sure the file does not
726 * exist. For everything else we want to know
727 * what's there.
728 */
731 dirfsp,
732 smb_fname_rel,
734 AT_SYMLINK_NOFOLLOW);
737 /*
738 * Keep the original error. Otherwise we would
739 * mask for example EROFS for open(O_CREAT),
740 * turning it into ENOENT.
741 */
743 }
746 }
754 }
761 }
763 /*
764 * Found a symlink to follow in user space
765 */
768 /* Never follow symlinks on posix open. */
771 }
773 /* Explicitly no symlinks. */
776 }
782 }
788 connpath,
789 fsp,
791 smb_fname_rel,
798 }
800 /*
801 * Close what openat(O_PATH) potentially left behind
802 */
807 }
814 }
816 }
818 /*
819 * And do it all again... As smb_fname is not relative to the passed in
820 * dirfsp anymore, we pass conn->cwd_fsp as dirfsp to
821 * non_widelink_open() to trigger the chdir(parentdir) logic.
822 */
827 out:
835 }
841 }
843 }
845 }
847 /****************************************************************************
848 fd support routines - attempt to do a dos_open.
849 ****************************************************************************/
855 {
864 /*
865 * Never follow symlinks on a POSIX client. The
866 * client should be doing this.
867 */
871 }
877 conn,
879 smb_fname,
880 fsp,
884 }
893 }
894 }
897 }
899 /*
900 * Only follow symlinks within a share
901 * definition.
902 */
910 "to open more! smbd's max "
914 }
915 }
924 }
933 }
935 /****************************************************************************
936 Close the file associated with a fsp.
937 ****************************************************************************/
940 {
946 }
949 /*
950 * capture status, if failure
951 * continue close processing
952 * and return status
953 */
955 }
959 }
961 /*
962 * Either a directory where the dptr_CloseDir() already closed
963 * the fd or a stat open.
964 */
966 }
969 }
975 }
977 }
979 /****************************************************************************
980 Change the ownership of a file to that of the parent directory.
981 Do this by fd if possible.
982 ****************************************************************************/
986 {
990 /* Already this uid - no need to change. */
995 }
1004 "file %s to parent directory uid %u. Error "
1014 /* Ensure the uid entry is updated. */
1017 }
1018 }
1022 {
1023 NTSTATUS status;
1027 /* Already this uid - no need to change. */
1032 }
1042 "directory %s to parent directory uid %u. "
1048 }
1055 /* Ensure the uid entry is updated. */
1059 }
1061 /****************************************************************************
1062 Open a file - returning a guaranteed ATOMIC indication of if the
1063 file was created or not.
1064 ****************************************************************************/
1071 {
1074 NTSTATUS retry_status;
1078 /*
1079 * We're not creating the file, just pass through.
1080 */
1084 }
1087 /*
1088 * Fail if already exists, just pass through.
1089 */
1092 /*
1093 * Here we've opened with O_CREAT|O_EXCL. If that went
1094 * NT_STATUS_OK, we *know* we created this file.
1095 */
1099 }
1101 /*
1102 * Now it gets tricky. We have O_CREAT, but not O_EXCL.
1103 * To know absolutely if we created the file or not,
1104 * we can never call O_CREAT without O_EXCL. So if
1105 * we think the file existed, try without O_CREAT|O_EXCL.
1106 * If we think the file didn't exist, try with
1107 * O_CREAT|O_EXCL.
1108 *
1109 * The big problem here is dangling symlinks. Opening
1110 * without O_NOFOLLOW means both bad symlink
1111 * and missing path return -1, ENOENT from open(). As POSIX
1112 * is pathname based it's not possible to tell
1113 * the difference between these two cases in a
1114 * non-racy way, so change to try only two attempts before
1115 * giving up.
1116 *
1117 * We don't have this problem for the O_NOFOLLOW
1118 * case as it just returns NT_STATUS_OBJECT_PATH_NOT_FOUND
1119 * mapped from the ELOOP POSIX error.
1120 */
1128 }
1134 }
1147 }
1150 }
1154 }
1161 {
1162 NTSTATUS status;
1171 };
1179 }
1182 }
1189 fsp,
1190 how);
1192 #if defined(HAVE_FSTATFS) && defined(HAVE_LINUX_MAGIC_H)
1201 /*
1202 * When reopening an as-yet
1203 * unmounted autofs mount
1204 * point we get ENOENT. We
1205 * have to retry pathbased.
1206 */
1208 }
1209 /* restore ENOENT if changed in the meantime */
1211 }
1212 #endif
1216 }
1221 }
1225 }
1227 #if defined(HAVE_FSTATFS) && defined(HAVE_LINUX_MAGIC_H)
1228 namebased_open:
1229 #endif
1230 /*
1231 * Close the existing pathref fd and set the fsp flag
1232 * is_pathref to false so we get a "normal" fd this time.
1233 */
1237 }
1243 }
1245 /****************************************************************************
1246 Open a file.
1247 ****************************************************************************/
1259 {
1266 FILE_READ_DATA |
1267 FILE_WRITE_DATA |
1268 FILE_APPEND_DATA |
1269 FILE_EXECUTE |
1270 SEC_FLAG_SYSTEM_SECURITY;
1275 /*
1276 * Catch early an attempt to open an existing
1277 * directory as a file.
1278 */
1281 }
1283 /*
1284 * This little piece of insanity is inspired by the
1285 * fact that an NT client can open a file for O_RDONLY,
1286 * but set the create disposition to FILE_EXISTS_TRUNCATE.
1287 * If the client *can* write to the file, then it expects to
1288 * truncate the file, even though it is opening for readonly.
1289 * Quicken uses this stupid trick in backup file creation...
1290 * Thanks *greatly* to "David W. Chapman Jr." <dwcjr@inethouston.net>
1291 * for helping track this one down. It didn't bite us in 2.0.x
1292 * as we always opened files read-write in that release. JRA.
1293 */
1299 }
1301 /* Check permissions */
1303 /*
1304 * This code was changed after seeing a client open request
1305 * containing the open mode of (DENY_WRITE/read-only) with
1306 * the 'create if not exist' bit set. The previous code
1307 * would fail to open the file read only on a read-only share
1308 * as it was checking the flags parameter directly against O_RDONLY,
1309 * this was failing as the flags parameter was set to O_RDONLY|O_CREAT.
1310 * JRA.
1311 */
1314 /* It's a read-only share - fail if we wanted to write. */
1320 }
1321 /*
1322 * We don't want to write - but we must make sure that
1323 * O_CREAT doesn't create the file if we have write
1324 * access into the directory.
1325 */
1327 }
1332 }
1337 #if defined(O_NONBLOCK) && defined(S_ISFIFO)
1338 /*
1339 * We would block on opening a FIFO with no one else on the
1340 * other end. Do what we used to do and add O_NONBLOCK to the
1341 * open flags. JRA.
1342 */
1346 }
1347 #endif
1351 /*
1352 * Don't open files with Microsoft wildcard characters.
1353 */
1355 /*
1356 * wildcard characters are allowed in stream
1357 * names only test the basefilename
1358 */
1360 }
1364 }
1365 }
1367 /* Can we access this file ? */
1369 /* Only do this check on non-stream open. */
1372 dirfsp,
1373 fsp,
1375 open_access_mask);
1382 }
1386 NT_STATUS_OBJECT_NAME_NOT_FOUND))
1387 {
1389 }
1392 NT_STATUS_OBJECT_NAME_NOT_FOUND))
1393 {
1395 "file %s vanished since we "
1400 }
1401 }
1405 /* File didn't exist and no O_CREAT. */
1407 }
1410 dirfsp,
1411 SEC_DIR_ADD_FILE);
1414 "directory %s for file %s "
1421 }
1422 }
1423 }
1425 /*
1426 * Actually do the open - if O_TRUNC is needed handle it
1427 * below under the share mode lock.
1428 */
1431 smb_fname_atname,
1432 fsp,
1434 p_file_created);
1436 /*
1437 * Non-O_PATH reopen that hit a race
1438 * condition: Someone has put a symlink where
1439 * we used to have a file. Can't happen with
1440 * O_PATH and reopening from /proc/self/fd/ or
1441 * equivalent.
1442 */
1444 }
1453 }
1456 /*
1457 * GPFS can return ETIMEDOUT for pread on
1458 * nonblocking file descriptors when files
1459 * migrated to tape need to be recalled. I
1460 * could imagine this happens elsewhere
1461 * too. With blocking file descriptors this
1462 * does not happen.
1463 */
1471 }
1472 }
1475 /* We created this file. */
1478 /* Do all inheritance work after we've
1479 done a successful fstat call and filled
1480 in the stat struct in fsp->fsp_name. */
1482 /* Inherit the ACL if required */
1485 dirfsp,
1486 smb_fname,
1489 }
1491 /* Change the owner if required. */
1495 }
1499 /*
1500 * If we have an fd, this stat should succeed.
1501 */
1509 }
1510 }
1511 }
1514 /* File must exist for a stat open. */
1516 }
1520 {
1521 /*
1522 * Don't allow stat opens on symlinks directly unless
1523 * it's a POSIX open. Match the return code from
1524 * openat_pathref_fsp().
1525 */
1527 }
1530 /*
1531 * There is only one legit case where end up here:
1532 * openat_pathref_fsp() failed to open a symlink, so the
1533 * fsp was created by fsp_new() which doesn't set
1534 * is_pathref. Other than that, we should always have a
1535 * pathref fsp at this point. The subsequent checks
1536 * assert this.
1537 */
1542 }
1547 }
1553 }
1554 }
1556 /*
1557 * Access to streams is checked by checking the basefile and
1558 * that has already been checked by check_base_file_access()
1559 * in create_file_unixpath().
1560 */
1563 fsp,
1565 open_access_mask);
1568 posix_open &&
1570 /* This is a POSIX stat open for delete
1571 * or rename on a symlink that points
1572 * nowhere. Allow. */
1577 }
1585 }
1586 }
1587 }
1599 }
1608 }
1618 }
1627 {
1636 new_access,
1637 access_mask,
1638 existing_sharemode,
1639 sharemode_mask);
1641 }
1645 new_sharemode,
1646 sharemode_mask,
1647 existing_access,
1648 access_mask);
1650 }
1652 }
1654 /****************************************************************************
1655 Check if we can open a file with a share mode.
1656 Returns True if conflict, False if not.
1657 ****************************************************************************/
1660 FILE_WRITE_DATA|
1661 FILE_APPEND_DATA|
1662 FILE_READ_DATA|
1663 FILE_EXECUTE|
1664 DELETE_ACCESS;
1670 {
1677 e_access_mask,
1678 e_share_access,
1679 access_mask,
1680 share_access);
1685 e_access_mask);
1687 }
1690 access_mask);
1692 }
1706 }
1708 #if defined(DEVELOPER)
1714 };
1720 {
1726 }
1729 /* INTERNAL_OPEN_ONLY */
1731 }
1739 }
1743 }
1747 panic:
1748 {
1753 "validate_my_share_entries: "
1759 }
1762 }
1763 #endif
1765 /**
1766 * Allowed access mask for stat opens relevant to oplocks
1767 **/
1769 {
1772 FILE_READ_ATTRIBUTES|
1773 FILE_WRITE_ATTRIBUTES);
1777 }
1779 /**
1780 * Allowed access mask for stat opens relevant to leases
1781 **/
1783 {
1786 FILE_READ_ATTRIBUTES|
1787 FILE_WRITE_ATTRIBUTES|
1788 READ_CONTROL_ACCESS);
1792 }
1796 };
1802 {
1806 }
1810 {
1816 }
1822 }
1824 }
1831 {
1836 lck,
1844 }
1848 lck,
1849 existing_access_mask,
1850 existing_share_mode,
1851 existing_lease_type,
1852 NULL);
1853 }
1855 /****************************************************************************
1856 Deal with share modes
1857 Invariant: Share mode must be locked on entry and exit.
1858 Returns -1 on error, or number of share modes on success (may be zero).
1859 ****************************************************************************/
1866 };
1872 {
1880 }
1886 }
1893 }
1898 }
1905 }
1912 {
1918 /* Stat open that doesn't trigger oplock breaks or share mode
1919 * checks... ! JRA. */
1921 }
1923 /*
1924 * Check if the share modes will give us access.
1925 */
1927 #if defined(DEVELOPER)
1928 {
1933 };
1937 }
1938 #endif
1946 access_mask,
1947 share_access);
1951 }
1956 FILE_SHARE_WRITE|
1957 FILE_SHARE_DELETE),
1958 };
1960 /*
1961 * Walk the share mode array to recalculate d->flags
1962 */
1968 }
1971 lck,
1977 /*
1978 * We only end up here if we had a sharing violation
1979 * from d->flags and have recalculated it.
1980 */
1982 }
1987 access_mask,
1988 share_access);
1992 }
1995 }
1997 /*
1998 * Send a break message to the oplock holder and delay the open for
1999 * our client.
2000 */
2006 {
2011 };
2015 NTSTATUS status;
2022 }
2032 }
2036 MSG_SMB_BREAK_REQUEST,
2041 }
2044 }
2053 };
2059 {
2063 /* INTERNAL_OPEN_ONLY */
2065 }
2068 /*
2069 * We ignore stat opens in the table - they always
2070 * have NO_OPLOCK and never get or cause breaks. JRA.
2071 */
2073 }
2078 /* batch - can only be one. */
2082 }
2090 }
2092 }
2098 }
2099 /* Exclusive or batch - can only be one. */
2106 }
2108 }
2115 }
2119 }
2121 }
2128 }
2132 }
2134 }
2137 }
2139 /*
2140 * Do internal consistency checks on the share mode for a file.
2141 */
2144 {
2152 }
2159 }
2165 }
2169 }
2179 }
2182 }
2187 {
2190 }
2193 }
2199 }
2202 {
2210 }
2217 {
2220 /*
2221 * TODO: Measure how expensive this loop is with thousands of open
2222 * handles...
2223 */
2231 }
2234 }
2238 }
2239 }
2241 /* Not found - must be leased in another smbd. */
2245 }
2250 /*
2251 * We internally treat all leases as V2 and update
2252 * the epoch, but when sending breaks it matters if
2253 * the requesting lease was v1 or v2.
2254 */
2258 }
2265 {
2271 NTSTATUS status;
2274 client_guid,
2285 }
2288 fsp,
2290 current_state,
2291 lease_version,
2292 epoch);
2297 }
2299 /*
2300 * Upgrade only if the requested lease is a strict upgrade.
2301 */
2305 /*
2306 * Tricky: This test makes sure that "requested" is a
2307 * strict bitwise superset of "existing".
2308 */
2311 /*
2312 * Upgrade only if there's a change.
2313 */
2316 /*
2317 * Upgrade only if other leases don't prevent what was asked
2318 * for.
2319 */
2322 /*
2323 * only upgrade if we are not in breaking state
2324 */
2332 NTSTATUS set_status;
2338 client_guid,
2340 current_state,
2341 breaking,
2342 breaking_to_requested,
2343 breaking_to_required,
2344 lease_version,
2345 epoch);
2351 }
2352 }
2357 }
2364 {
2365 NTSTATUS status;
2370 }
2394 }
2396 /*
2397 * We used to set lck->data->modified=true here without
2398 * actually modifying lck->data, triggering a needless
2399 * writeback of lck->data.
2400 *
2401 * Apart from that writeback, setting modified=true has the
2402 * effect of triggering all waiters for this file to
2403 * retry. This only makes sense if any blocking condition
2404 * (i.e. waiting for a lease to be downgraded or removed) is
2405 * gone. This routine here only adds a lease, so it will never
2406 * free up resources that blocked waiters can now claim. So
2407 * that second effect also does not matter in this
2408 * routine. Thus setting lck->data->modified=true does not
2409 * need to be done here.
2410 */
2413 }
2419 {
2421 NTSTATUS status;
2428 }
2431 }
2434 {
2448 }
2451 }
2455 };
2469 };
2472 {
2475 }
2480 }
2488 {
2500 NTSTATUS status;
2507 }
2508 }
2521 /*
2522 * leases_db_get() can return NT_STATUS_NOT_FOUND
2523 * if the share_mode_entry e is stale and the
2524 * lease record was already removed. In this case return
2525 * false so the traverse continues.
2526 */
2530 {
2535 "file_id [%s] failed for stale "
2542 }
2555 }
2558 }
2562 {
2564 }
2570 }
2577 }
2579 /*
2580 * Two things prevent a write lease
2581 * to be granted:
2582 *
2583 * 1. Any oplock or lease (even broken to NONE)
2584 * 2. An open with an access mask other than
2585 * FILE_READ_ATTRIBUTES, FILE_WRITE_ATTRIBUTES
2586 * or SYNCHRONIZE_ACCESS
2587 */
2592 {
2594 }
2598 }
2604 }
2613 }
2615 }
2619 }
2622 /*
2623 * If we break anyway break to NONE directly.
2624 * Otherwise vfs_set_filelen() will trigger the
2625 * break.
2626 */
2628 }
2631 /*
2632 * Oplocks only support breaking to R or NONE.
2633 */
2635 }
2644 }
2647 }
2651 }
2655 }
2664 }
2667 delay_for_oplock_fn_watch_done,
2678 };
2681 {
2692 }
2695 blocker_debug_state,
2697 }
2709 {
2714 };
2725 /*
2726 * The SMB2 layer should have checked this
2727 */
2729 }
2733 /*
2734 * According to "MS-FSA 2.1.5.18 Server Requests an
2735 * Oplock" this should fail with
2736 * STATUS_INVALID_PARAMETER, but Windows 2022 just
2737 * ignores the SMB2_LEASE_WRITE bit.
2738 */
2740 }
2744 }
2750 }
2756 {
2761 }
2765 blocker_debug_state_destructor);
2766 }
2780 }
2786 }
2791 }
2793 grant:
2796 }
2804 }
2808 }
2812 }
2816 }
2817 }
2823 }
2826 /*
2827 * Can grant only a write lease
2828 * if there are no other leases
2829 * and no other non-stat opens.
2830 */
2832 }
2841 }
2842 }
2847 }
2853 }
2855 /*
2856 * Reflect possible downgrades from:
2857 * - map_lease_type_to_oplock() => "RH" to just LEVEL_II
2858 */
2861 }
2865 {
2870 }
2878 granted,
2880 oplock_request,
2884 requested,
2893 }
2907 {
2909 NTSTATUS status;
2919 }
2923 }
2928 {
2933 }
2939 }
2941 /*
2942 * Internal opens never do oplocks or leases. We don't
2943 * need to go through delay_for_oplock().
2944 */
2946 }
2949 fsp,
2950 oplock_request,
2951 lease,
2952 lck,
2953 sharing_violation,
2954 create_disposition,
2955 first_open_attempt,
2956 poplock_type,
2957 pgranted,
2958 blocker_debug_state);
2961 }
2964 }
2967 {
2970 }
2975 };
2979 /**
2980 * Defer an open and watch a locking.tdb record
2981 *
2982 * This defers an open that gets rescheduled once the locking.tdb record watch
2983 * is triggered by a change to the record.
2984 *
2985 * It is used to defer opens that triggered an oplock break and for the SMB1
2986 * sharing violation delay.
2987 **/
2993 {
3015 }
3020 }
3027 watch_state,
3033 }
3041 }
3047 }
3048 }
3051 {
3054 NTSTATUS status;
3063 /*
3064 * Even if it failed, retry anyway. TODO: We need a way to
3065 * tell a re-scheduled open about that error.
3066 */
3067 }
3074 }
3076 /**
3077 * Actually attempt the kernel oplock polling open.
3078 */
3084 {
3095 }
3097 }
3106 };
3110 {
3116 }
3126 }
3127 }
3129 /**
3130 * Reschedule an open for 1 second from now, if not timed out.
3131 **/
3137 {
3146 }
3152 }
3156 /*
3157 * Make sure open_rec->te does not come later than the
3158 * request's maximum endtime.
3159 */
3167 open_rec,
3168 next_interval,
3169 poll_open_fn,
3170 open_rec);
3175 }
3182 };
3183 NTSTATUS status;
3186 poll_open_setup_watcher_fn,
3193 }
3196 poll_open_done,
3197 open_rec);
3203 }
3206 }
3213 }
3221 }
3224 {
3227 NTSTATUS status;
3242 }
3243 }
3246 {
3252 }
3254 /*
3255 * Try every 200msec up to (by default) one second. To be
3256 * precise, according to behaviour note <247> in [MS-CIFS],
3257 * the server tries 5 times. But up to one second should be
3258 * close enough.
3259 */
3265 SHARING_VIOLATION_USEC_WAIT);
3268 req,
3269 NULL,
3273 }
3275 /****************************************************************************
3276 On overwrite open ensure that the attributes match.
3277 ****************************************************************************/
3282 mode_t new_unx_mode,
3284 {
3291 (noarch_old_dos_attr != 0 && ((noarch_old_dos_attr & noarch_new_dos_attr) == noarch_old_dos_attr))) {
3295 }
3298 "new_dos_attr = 0x%x "
3304 /* If we're mapping SYSTEM and HIDDEN ensure they match. */
3309 }
3310 }
3315 }
3316 }
3318 }
3324 {
3325 /* This is a relative time, added to the absolute
3326 request_time value to get the absolute timeout time.
3327 Note that if this is the second or greater time we enter
3328 this codepath for this particular request mid then
3329 request_time is left as the absolute time of the *first*
3330 time this request mid was processed. This is what allows
3331 the request to eventually time out. */
3335 /* Normally the smbd we asked should respond within
3336 * OPLOCK_BREAK_TIMEOUT seconds regardless of whether
3337 * the client did, give twice the timeout as a safety
3338 * measure here in case the other smbd is stuck
3339 * somewhere else. */
3345 }
3348 }
3350 /****************************************************************************
3351 Reschedule an open call that went asynchronous.
3352 ****************************************************************************/
3358 {
3360 }
3363 {
3370 }
3375 }
3382 }
3385 req,
3387 schedule_async_open_timer,
3388 open_rec);
3391 }
3392 }
3405 {
3406 NTSTATUS status;
3414 /* Get the types we need to examine. */
3417 }
3422 }
3425 lck,
3426 create_disposition,
3427 open_access_mask,
3428 share_access,
3429 oplock_request,
3430 lease,
3431 first_open_attempt,
3438 }
3441 }
3445 }
3450 fsp,
3453 oplock_type,
3454 lease_key,
3455 share_access,
3456 access_mask);
3459 }
3466 }
3469 }
3474 }
3476 /****************************************************************************
3477 Work out what access_mask to use from what the client sent us.
3478 ****************************************************************************/
3485 {
3489 NTSTATUS status;
3491 /* Cope with symlinks */
3495 }
3497 /* Cope with fake/printer fsp's. */
3501 }
3506 }
3510 SECINFO_GROUP |
3511 SECINFO_DACL),
3516 /*
3517 * File did not exist
3518 */
3521 }
3527 }
3529 /*
3530 * If we can access the path to this file, by
3531 * default we have FILE_READ_ATTRIBUTES from the
3532 * containing directory. See the section:
3533 * "Algorithm to Check Access to an Existing File"
3534 * in MS-FSA.pdf.
3535 *
3536 * se_file_access_check()
3537 * also takes care of owner WRITE_DAC and READ_CONTROL.
3538 */
3541 use_privs,
3553 }
3559 dirfsp,
3562 }
3563 }
3568 }
3571 }
3578 {
3579 NTSTATUS status;
3585 access_mask);
3587 }
3589 /*
3590 * Convert GENERIC bits to specific bits.
3591 */
3595 /* Calculate MAXIMUM_ALLOWED_ACCESS if requested. */
3599 dirfsp,
3600 fsp,
3601 use_privs,
3606 }
3609 }
3615 "rejected by share access mask[0x%08X] "
3620 rejected_share_access);
3622 }
3626 }
3628 /****************************************************************************
3629 Remove the deferred open entry under lock.
3630 ****************************************************************************/
3632 /****************************************************************************
3633 Return true if this is a state pointer to an asynchronous create.
3634 ****************************************************************************/
3637 {
3639 }
3642 {
3653 }
3655 }
3658 {
3661 /*
3662 * Currently we're using FILE_SUPERSEDE as the same as
3663 * FILE_OVERWRITE_IF but they really are
3664 * different. FILE_SUPERSEDE deletes an existing file
3665 * (requiring delete access) then recreates it.
3666 */
3671 /*
3672 * If file exists replace/overwrite. If file doesn't
3673 * exist create.
3674 */
3679 /*
3680 * If file exists open. If file doesn't exist error.
3681 */
3686 /*
3687 * If file exists overwrite. If file doesn't exist
3688 * error.
3689 */
3694 /*
3695 * If file exists error. If file doesn't exist create.
3696 */
3701 /*
3702 * If file exists open. If file doesn't exist create.
3703 */
3706 }
3708 }
3712 NTTIME twrp)
3713 {
3716 /*
3717 * Note that we ignore the append flag as append does not
3718 * mean the same thing under DOS and Unix.
3719 */
3722 /*
3723 * Pave over the user requested mode and force O_RDONLY for the
3724 * file handle. Windows allows opening a VSS file with O_RDWR,
3725 * even though actual writes on the handle will fail.
3726 */
3728 }
3733 }
3735 /* DENY_DOS opens are always underlying read-write on the
3736 file handle, no matter what the requested access mask
3737 says. */
3739 need_read =
3746 }
3748 }
3763 NTSTATUS status;
3765 share_mode_entry_prepare_unlock_fn_t cleanup_fn;
3766 };
3771 {
3775 /*
3776 * By default drop the g_lock again if we leave the
3777 * tdb chainlock.
3778 */
3783 lck,
3793 }
3797 /*
3798 * keep the g_lock while existing the tdb chainlock,
3799 * we we're asked to, which mean we'll keep
3800 * the share_mode_lock during object creation,
3801 * or setting delete on close.
3802 */
3804 }
3808 {
3817 }
3818 }
3822 {
3831 }
3832 }
3841 {
3847 }
3849 /* Overwritten files should be initially set as archive */
3854 }
3857 }
3860 smb_fname,
3862 parent_dir_fname,
3866 }
3868 }
3870 /****************************************************************************
3871 Open a file with a share mode. Passed in an already created files_struct *.
3872 ****************************************************************************/
3883 /* Information (FILE_EXISTS etc.) */
3889 {
3907 NTSTATUS status;
3911 NTSTATUS ulstatus;
3914 /*
3915 * Printers are handled completely differently.
3916 * Most of the passed parameters are ignored.
3917 */
3921 }
3929 }
3933 }
3940 /* Windows allows a new file to be created and
3941 silently removes a FILE_ATTRIBUTE_DIRECTORY
3942 sent by the client. Do the same. */
3946 /* We add FILE_ATTRIBUTE_ARCHIVE to this as this mode is only used if the file is
3947 * created new. */
3949 conn,
3951 smb_fname,
3953 }
3956 "access_mask=0x%x share_access=0x%x "
3957 "create_disposition = 0x%x create_options=0x%x "
3965 /* Ensure req == NULL means INTERNAL_OPEN_ONLY */
3968 /* And req != NULL means no INTERNAL_OPEN_ONLY */
3970 }
3972 /*
3973 * Only non-internal opens can be deferred at all
3974 */
3980 /* If it was an async create retry, the file
3981 didn't exist. */
3986 }
3988 /* Ensure we don't reprocess this message. */
3992 }
3993 }
3998 /*
3999 * Only use stored DOS attributes for checks
4000 * against requested attributes (below via
4001 * open_match_attributes()), cf bug #11992
4002 * for details. -slow
4003 */
4007 conn,
4012 }
4013 }
4014 }
4016 /* ignore any oplock requests if oplocks are disabled */
4019 /* Mask off everything except the private Samba bits. */
4021 }
4023 /* this is for OS/2 long file names - say we don't support them */
4026 /* OS/2 Workplace shell fix may be main code stream in a later
4027 * release. */
4032 }
4034 }
4038 /* If file exists open. If file doesn't exist error. */
4041 "requested for file %s and file "
4045 }
4049 /* If file exists overwrite. If file doesn't exist
4050 * error. */
4053 "requested for file %s and file "
4057 }
4060 }
4064 /* If file exists error. If file doesn't exist
4065 * create. */
4068 "requested for file %s and file "
4073 }
4075 }
4078 }
4085 }
4091 }
4093 }
4097 }
4101 /* We only care about matching attributes on file exists and
4102 * overwrite. */
4108 new_dos_attributes,
4113 existing_dos_attributes,
4114 new_dos_attributes,
4118 }
4119 }
4124 access_mask,
4132 }
4138 }
4141 /*
4142 * stat opens on existing files don't get oplocks.
4143 * They can get leases.
4144 *
4145 * Note that we check for stat open on the *open_access_mask*,
4146 * i.e. the access mask we actually used to do the open,
4147 * not the one the client asked for (which is in
4148 * fsp->access_mask). This is due to the fact that
4149 * FILE_OVERWRITE and FILE_OVERWRITE_IF add in O_TRUNC,
4150 * which adds FILE_WRITE_DATA to open_access_mask.
4151 */
4154 }
4155 }
4159 access_mask));
4161 /*
4162 * Note that we ignore the append flag as append does not
4163 * mean the same thing under DOS and Unix.
4164 */
4167 private_flags,
4170 /*
4171 * Currently we only look at FILE_WRITE_THROUGH for create options.
4172 */
4174 #if defined(O_SYNC)
4177 }
4182 }
4185 /*
4186 * We should really return a permission denied error if either
4187 * O_CREAT or O_TRUNC are set, but for compatibility with
4188 * older versions of Samba we just AND them out.
4189 */
4191 }
4193 /*
4194 * With kernel oplocks the open breaking an oplock
4195 * blocks until the oplock holder has given up the
4196 * oplock or closed the file. We prevent this by always
4197 * trying to open the file with O_NONBLOCK (see "man
4198 * fcntl" on Linux).
4199 *
4200 * If a process that doesn't use the smbd open files
4201 * database or communication methods holds a kernel
4202 * oplock we must periodically poll for available open
4203 * using O_NONBLOCK.
4204 */
4207 /*
4208 * Ensure we can't write on a read-only share or file.
4209 */
4219 }
4222 /*
4223 * Only try and create a file id before open
4224 * for an existing file. For a file being created
4225 * this won't do anything useful until the file
4226 * exists and has a valid stat struct.
4227 */
4229 }
4232 * requested access_mask after
4233 * the open is done. */
4236 }
4240 /* Delete on close semantics for new files. */
4242 new_dos_attributes);
4246 }
4247 }
4249 /*
4250 * Ensure we pay attention to default ACLs on directories if required.
4251 */
4256 }
4266 {
4270 };
4274 }
4278 smb_fname_atname,
4279 fsp,
4281 access_mask,
4282 open_access_mask,
4283 private_flags,
4285 }
4290 }
4294 }
4295 /*
4296 * This handles the kernel oplock case:
4297 *
4298 * the file has an active kernel oplock and the open() returned
4299 * EWOULDBLOCK/EAGAIN which maps to NETWORK_BUSY.
4300 *
4301 * "Samba locking.tdb oplocks" are handled below after acquiring
4302 * the sharemode lock with get_share_mode_lock().
4303 */
4305 }
4308 /*
4309 * EINTR from the open(2) syscall. Just setup a retry
4310 * in a bit. We can't use the sys_write() tight retry
4311 * loop here, as we might have to actually deal with
4312 * lease-break signals to avoid a deadlock.
4313 */
4315 }
4318 /*
4319 * Retry once a second. If there's a share_mode_lock
4320 * around, also wait for it in case it was smbd
4321 * holding that kernel oplock that can quickly tell us
4322 * the oplock got removed.
4323 */
4332 }
4339 }
4341 }
4344 /*
4345 * As we atomically create using O_CREAT|O_EXCL,
4346 * then if new_file_created is true, then
4347 * file_existed *MUST* have been false (even
4348 * if the file was previously detected as being
4349 * there).
4350 */
4352 }
4355 /*
4356 * The file did exist, but some other (local or NFS)
4357 * process either renamed/unlinked and re-created the
4358 * file with different dev/ino after we walked the path,
4359 * but before we did the open. We could retry the
4360 * open but it's a rare enough case it's easier to
4361 * just fail the open to prevent creating any problems
4362 * in the open file db having the wrong dev/ino key.
4363 */
4366 "Old (dev=%ju, ino=%ju). "
4367 "New (dev=%ju, ino=%ju). Failing open "
4375 }
4379 /*
4380 * Deal with the race condition where two smbd's detect the
4381 * file doesn't exist and do the create at the same time. One
4382 * of them will win and set a share mode, the other (ie. this
4383 * one) should check if the requested share mode for this
4384 * create is allowed.
4385 */
4387 /*
4388 * Now the file exists and fsp is successfully opened,
4389 * fsp->dev and fsp->inode are valid and should replace the
4390 * dev=0,inode=0 from a non existent file. Spotted by
4391 * Nadav Danieli <nadavd@exanet.com>. JRA.
4392 */
4401 }
4402 }
4404 /*
4405 * If we created a new file, overwrite an existing one
4406 * or going to delete it later, we should keep
4407 * the share_mode_lock (g_lock) until we call
4408 * share_mode_entry_prepare_unlock()
4409 */
4414 }
4428 };
4433 smb_fname,
4435 open_ntcreate_lock_add_entry,
4442 }
4448 }
4450 /*
4451 * From here we need to use 'goto unlock;' instead of return !!!
4452 */
4455 /*
4456 * Now ask for kernel oplocks
4457 * and cleanup on failure.
4458 */
4461 /*
4462 * Could not get the kernel oplock
4463 */
4465 open_ntcreate_lock_cleanup_oplock;
4467 }
4468 }
4470 /* Should we atomically (to the client at least) truncate ? */
4479 open_ntcreate_lock_cleanup_entry;
4481 }
4483 }
4485 /*
4486 * We have the share entry *locked*.....
4487 */
4489 /* Delete streams if create_disposition requires it */
4496 open_ntcreate_lock_cleanup_entry;
4498 }
4499 }
4504 {
4506 /*
4507 * Beware: streams implementing VFS modules may
4508 * implement streams in a way that fsp will have the
4509 * basefile open in the fsp fd, so lacking a distinct
4510 * fd for the stream the file-system sharemode will
4511 * apply on the basefile which is wrong. The actual
4512 * check is deferred to the VFS module implementing
4513 * the file-system sharemode call.
4514 */
4516 share_access,
4517 access_mask);
4521 open_ntcreate_lock_cleanup_entry;
4523 }
4526 }
4528 /*
4529 * At this point onwards, we can guarantee that the share entry
4530 * is locked, whether we created the file or not, and that the
4531 * deny mode is compatible with all current opens.
4532 */
4534 /*
4535 * According to Samba4, SEC_FILE_READ_ATTRIBUTE is always granted,
4536 * but we don't have to store this - just ignore it on access check.
4537 */
4539 /*
4540 * SMB2 doesn't return it (according to Microsoft tests).
4541 * Test Case: TestSuite_ScenarioNo009GrantedAccessTestS0
4542 * File created with access = 0x7 (Read, Write, Delete)
4543 * Query Info on file returns 0x87 (Read, Write, Delete, Read Attributes)
4544 */
4547 /* But SMB1 does. */
4549 }
4553 }
4555 /* Handle strange delete on close create semantics. */
4559 existing_dos_attributes);
4562 /* Remember to delete the mode we just added. */
4564 open_ntcreate_lock_cleanup_entry;
4566 }
4567 }
4568 /* Note that here we set the *initial* delete on close flag,
4569 not the regular one. The magic gets handled in close. */
4571 }
4574 fsp,
4575 smb_fname,
4576 parent_dir_fname,
4577 info,
4578 new_dos_attributes,
4581 /* Determine sparse flag. */
4583 /* POSIX opens are sparse by default. */
4588 }
4590 /*
4591 * Take care of inherited ACLs on created files - if default ACL not
4592 * selected.
4593 */
4603 }
4604 }
4607 /*
4608 * We only get here in the case of:
4609 *
4610 * a). Not a POSIX open.
4611 * b). File already existed.
4612 * c). File was overwritten.
4613 * d). Requested DOS attributes didn't match
4614 * the DOS attributes on the existing file.
4615 *
4616 * In that case new_unx_mode has been set
4617 * equal to the calculated mode (including
4618 * possible inheritance of the mode from the
4619 * containing directory).
4620 *
4621 * Note this mode was calculated with the
4622 * DOS attribute FILE_ATTRIBUTE_ARCHIVE added,
4623 * so the mode change here is suitable for
4624 * an overwritten file.
4625 */
4634 }
4635 }
4636 }
4638 /*
4639 * Deal with other opens having a modified write time.
4640 */
4643 {
4645 }
4649 unlock:
4657 }
4661 NOTIFY_ACTION_ADDED |
4662 NOTIFY_ACTION_DIRLEASE_BREAK,
4663 FILE_NOTIFY_CHANGE_FILE_NAME,
4664 smb_fname,
4666 }
4669 NOTIFY_ACTION_MODIFIED |
4670 NOTIFY_ACTION_DIRLEASE_BREAK,
4671 FILE_NOTIFY_CHANGE_SIZE |
4672 FILE_NOTIFY_CHANGE_ATTRIBUTES,
4675 }
4679 }
4682 }
4687 {
4688 NTSTATUS status;
4691 /*
4692 * According to the MS documentation, the only time the security
4693 * descriptor is applied to the opened file is iff we *created* the
4694 * file; an existing file stays the same.
4695 *
4696 * Also, it seems (from observation) that you can open the file with
4697 * any access mask but you can still write the sd. We need to override
4698 * the granted access before we call set_sd
4699 * Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
4700 */
4710 SECINFO_GROUP|
4711 SECINFO_DACL|
4712 SECINFO_SACL)) {
4716 }
4724 }
4727 }
4731 }
4733 /* Inherit from parent. Errors here are not fatal. */
4738 }
4741 }
4744 {
4752 }
4756 }
4764 }
4768 }
4774 }
4777 }
4780 }
4784 }
4788 /*
4789 * let the caller know it's stale
4790 * and should be removed
4791 */
4793 }
4796 }
4805 {
4809 mode_t mode;
4810 NTSTATUS status;
4832 }
4839 FILE_ATTRIBUTE_DIRECTORY,
4840 smb_dname,
4842 }
4853 }
4858 }
4868 }
4872 }
4877 }
4879 /*
4880 * In order to avoid races where other clients could
4881 * see the directory before it is setup completely
4882 * we use a temporary name and rename it
4883 * when everything is ready.
4884 */
4889 smb_fname_atname);
4893 }
4897 SMBD_TMPDIR_PREFIX,
4898 idstr,
4903 }
4913 }
4919 }
4920 }
4929 mkdir_first:
4932 first_atname,
4933 mode);
4939 }
4941 /*
4942 * Make this a pathref fsp for now. open_directory() will reopen as a
4943 * full fsp.
4944 */
4952 }
4954 /* Ensure we're checking for a symlink here.... */
4955 /* We don't want to get caught by a symlink racer. */
4962 }
4969 }
4973 smb_dname,
4975 parent_dir_fname,
4977 }
4983 }
4986 /*
4987 * Check if high bits should have been set,
4988 * then (if bits are missing): add them.
4989 * Consider bits automagically set by UNIX, i.e. SGID bit from parent
4990 * dir.
4991 */
4998 }
4999 }
5001 /* Change the owner if required. */
5004 fsp);
5006 }
5014 }
5015 }
5019 fsp,
5020 sd);
5026 }
5027 }
5031 }
5033 /*
5034 * A rename needs a valid stat for the source,
5035 * see vfs_fruit.c ...
5036 */
5039 /*
5040 * We first try VFS_RENAME_HOW_NO_REPLACE,
5041 * if it's implemented in the kernel,
5042 * we'll always get EEXIST if the target
5043 * exist, as it's handled at the linux vfs
5044 * layer. But if it doesn't exist we
5045 * can still get EINVAL if the actual
5046 * filesystem doesn't support RENAME_NOREPLACE.
5047 *
5048 * If the kernel doesn't support rename2()
5049 * we get EINVAL instead of ENOSYS (this
5050 * is mapped in the libreplace replacement
5051 * (as well as the glibc replacement).
5052 */
5055 tmp_atname,
5057 smb_fname_atname,
5060 /*
5061 * This is the strategie we use without having
5062 * renameat2(RENAME_NOREPLACE):
5063 *
5064 * renameat() is able to replace a directory if the source is
5065 * also a directory.
5066 *
5067 * So in order to avoid races as much as possible we do a
5068 * mkdirat() with mode 0 in order to catch EEXIST almost
5069 * atomically, when this code runs by two processes at the same
5070 * time.
5071 *
5072 * Then a renameat() makes the temporary directory available for
5073 * clients.
5074 *
5075 * This a much smaller window where the other clients may see
5076 * the incomplete directory, which has a mode of 0.
5077 */
5086 smb_fname_atname,
5093 }
5097 tmp_atname,
5099 smb_fname_atname,
5101 }
5108 }
5112 done:
5119 do_unlink:
5122 tmp_dname);
5125 tmp_atname,
5126 AT_REMOVEDIR);
5129 tmp_dname);
5134 }
5136 restore_orig:
5140 }
5143 tmp_dname,
5144 orig_dname);
5150 }
5152 /****************************************************************************
5153 Open a directory from an NT SMB call.
5154 ****************************************************************************/
5170 {
5176 NTSTATUS status;
5180 NTSTATUS ulstatus;
5186 }
5189 /* Ensure we have a directory attribute. */
5191 }
5198 access_mask,
5199 share_access,
5200 create_options,
5201 create_disposition,
5202 file_attributes);
5205 /* Ensure req == NULL means INTERNAL_OPEN_ONLY */
5208 /* And req != NULL means no INTERNAL_OPEN_ONLY */
5210 }
5218 }
5219 }
5224 access_mask,
5232 }
5236 SEC_PRIV_SECURITY)) {
5241 }
5248 }
5255 /* If directory exists error. If directory doesn't
5256 * exist create. */
5265 }
5269 }
5272 parent_dir_fname,
5273 smb_fname_atname,
5274 smb_dname,
5275 sd,
5276 file_attributes,
5277 fsp);
5285 }
5291 /*
5292 * If directory exists open. If directory doesn't
5293 * exist create.
5294 */
5302 }
5304 parent_dir_fname,
5305 smb_fname_atname,
5306 smb_dname,
5307 sd,
5308 file_attributes,
5309 fsp);
5315 /* Cope with create race. */
5317 NT_STATUS_OBJECT_NAME_COLLISION)) {
5323 }
5325 /*
5326 * If mkdir_internal() returned
5327 * NT_STATUS_OBJECT_NAME_COLLISION
5328 * we still must lstat the path.
5329 */
5331 conn,
5333 smb_fname_atname,
5335 AT_SYMLINK_NOFOLLOW);
5338 "directory '%s' just "
5341 smb_dname),
5344 errno);
5345 }
5348 }
5349 }
5362 }
5368 }
5370 /*
5371 * Setup the files_struct for it.
5372 */
5382 /*
5383 * According to Samba4, SEC_FILE_READ_ATTRIBUTE is always granted,
5384 */
5393 }
5395 /* Don't store old timestamps for directory
5396 handles in the internal database. We don't
5397 update them in there if new objects
5398 are created in the directory. Currently
5399 we only update timestamps on file writes.
5400 See bug #9870.
5401 */
5404 /*
5405 * Obviously for FILE_LIST_DIRECTORY we need to reopen to get an fd
5406 * usable for reading a directory. SMB2_FLUSH may be called on
5407 * directories opened with FILE_ADD_FILE and FILE_ADD_SUBDIRECTORY so
5408 * for those we need to reopen as well.
5409 */
5410 need_fd_access =
5411 FILE_LIST_DIRECTORY |
5412 FILE_ADD_FILE |
5413 FILE_ADD_SUBDIRECTORY;
5418 };
5422 smb_fname_atname,
5423 fsp,
5431 }
5432 }
5438 }
5445 }
5447 /* Ensure there was no race condition. We need to check
5448 * dev/inode but not permissions, as these can change
5449 * legitimately */
5456 }
5460 fsp,
5462 access_mask);
5470 }
5471 }
5473 /*
5474 * If we created a new directory or going to delete it later,
5475 * we should keep * the share_mode_lock (g_lock) until we call
5476 * share_mode_entry_prepare_unlock()
5477 */
5482 }
5496 };
5501 smb_dname,
5503 open_ntcreate_lock_add_entry,
5510 }
5516 }
5518 /*
5519 * From here we need to use 'goto unlock;' instead of return !!!
5520 */
5522 /* For directories the delete on close bit at open time seems
5523 always to be honored on close... See test 19 in Samba4 BASE-DELETE. */
5528 open_ntcreate_lock_cleanup_entry;
5530 }
5533 /* Note that here we set the *initial* delete on close flag,
5534 not the regular one. The magic gets handled in close. */
5536 }
5537 }
5539 /*
5540 * Deal with other opens having a modified write time.
5541 */
5544 }
5548 }
5552 unlock:
5560 }
5564 NOTIFY_ACTION_ADDED |
5565 NOTIFY_ACTION_DIRLEASE_BREAK,
5566 FILE_NOTIFY_CHANGE_DIR_NAME,
5567 smb_dname,
5569 }
5574 }
5577 }
5583 {
5584 NTSTATUS status;
5609 }
5612 }
5614 /****************************************************************************
5615 Receive notification that one of our open files has been renamed by another
5616 smbd process.
5617 ****************************************************************************/
5624 {
5637 }
5640 data,
5641 msg,
5642 msg,
5648 }
5654 }
5656 /* stream_name must always be NULL if there is no stream. */
5659 }
5664 NULL,
5670 }
5676 }
5679 SMB_STRUCT_STAT fsp_orig_sbuf;
5680 NTSTATUS status;
5686 /*
5687 * The incoming smb_fname here has an
5688 * invalid stat struct from synthetic_smb_fname()
5689 * above.
5690 * Preserve the existing stat from the
5691 * open fsp after fsp_set_smb_fname()
5692 * overwrites with the invalid stat.
5693 *
5694 * (We could just copy this into
5695 * smb_fname->st, but keep this code
5696 * identical to the fix in rename_open_files()
5697 * for clarity.
5698 *
5699 * We will do an fstat before returning
5700 * any of this metadata to the client anyway.
5701 */
5707 }
5710 /* TODO. JRA. */
5711 /*
5712 * Now we have the complete path we can work out if
5713 * this is actually within this share and adjust
5714 * newname accordingly.
5715 */
5723 }
5724 out:
5726 }
5728 /*
5729 * If a main file is opened for delete, all streams need to be checked for
5730 * !FILE_SHARE_DELETE. Do this by opening with DELETE_ACCESS.
5731 * If that works, delete them all by setting the delete on close and close.
5732 */
5736 {
5743 NTSTATUS status;
5750 NULL,
5751 NULL,
5758 NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
5762 }
5766 }
5770 }
5779 }
5785 }
5788 num_streams));
5793 }
5800 }
5808 }
5813 NULL,
5820 }
5829 }
5859 }
5861 }
5863 /*
5864 * don't touch the variable "status" beyond this point :-)
5865 */
5870 }
5875 }
5877 fail:
5880 }
5882 /*********************************************************************
5883 Create a default ACL by inheriting from the parent. If no inheritance
5884 from the parent available, don't set anything. This will leave the actual
5885 permissions the new file or directory already got from the filesystem
5886 as the NT ACL when read.
5887 *********************************************************************/
5890 {
5913 frame,
5918 }
5925 /* Nothing to inherit and not setting owner. */
5927 }
5929 /* Create an inherited descriptor from the parent. */
5935 }
5937 /* Inherit from parent descriptor if "inherit owner" set. */
5941 }
5949 }
5950 }
5954 {
5958 }
5959 }
5979 }
5980 }
5981 }
6001 }
6002 }
6003 }
6007 }
6011 }
6015 }
6019 }
6023 }
6029 }
6030 }
6035 parent_desc,
6036 owner_sid,
6037 group_sid,
6042 }
6044 /* If inheritable_components == false,
6045 se_create_child_secdesc()
6046 creates a security descriptor with a NULL dacl
6047 entry, but with SEC_DESC_DACL_PRESENT. We need
6048 to remove that flag. */
6053 }
6059 }
6062 /* We need to be root to force this. */
6064 }
6066 security_info_sent,
6067 psd);
6070 }
6073 }
6075 /*
6076 * If we already have a lease, it must match the new file id. [MS-SMB2]
6077 * 3.3.5.9.8 speaks about INVALID_PARAMETER if an already used lease key is
6078 * used for a different file name.
6079 */
6082 /* Input parameters. */
6088 /* Return parameters. */
6091 NTSTATUS match_status;
6092 };
6094 /*************************************************************
6095 File doesn't exist but this lease key+guid is already in use.
6097 This is only allowable in the dynamic share case where the
6098 service path must be different.
6100 There is a small race condition here in the multi-connection
6101 case where a client sends two create calls on different connections,
6102 where the file doesn't exist and one smbd creates the leases_db
6103 entry first, but this will get fixed by the multichannel cleanup
6104 when all identical client_guids get handled by a single smbd.
6105 **************************************************************/
6111 {
6119 }
6120 }
6122 /* Dynamic share case. Break leases on all other files. */
6124 num_files,
6125 files,
6129 }
6134 }
6140 {
6146 /*
6147 * Deal with name mismatch or
6148 * possible dynamic share case separately
6149 * to make code clearer.
6150 */
6152 files,
6153 state);
6155 }
6157 /* File existed. */
6163 /* Everything should be the same. */
6165 /*
6166 * The client asked for a lease on a
6167 * file that doesn't match the file_id
6168 * in the database.
6169 *
6170 * Maybe this is a dynamic share, i.e.
6171 * a share where the servicepath is
6172 * different for different users (e.g.
6173 * the [HOMES] share.
6174 *
6175 * If the servicepath is different, but the requested
6176 * file name + stream name is the same then this is
6177 * a dynamic share, the client is using the same share
6178 * name and doesn't know that the underlying servicepath
6179 * is different. It was expecting a lease on the
6180 * same file. Return NT_STATUS_OPLOCK_NOT_GRANTED
6181 * to break leases
6182 *
6183 * Otherwise the client has messed up, or is
6184 * testing our error codes, so return
6185 * NT_STATUS_INVALID_PARAMETER.
6186 */
6190 {
6191 /*
6192 * Name is the same but servicepath is
6193 * different, dynamic share. Break leases.
6194 */
6196 NT_STATUS_OPLOCK_NOT_GRANTED;
6199 NT_STATUS_INVALID_PARAMETER;
6200 }
6202 }
6206 }
6210 }
6214 }
6215 }
6218 /*
6219 * Common case - just opening another handle on a
6220 * file on a non-dynamic share.
6221 */
6223 }
6226 /* Mismatched path. Error back to client. */
6228 }
6230 /*
6231 * File id mismatch. Dynamic share case NT_STATUS_OPLOCK_NOT_GRANTED.
6232 * Don't allow leases.
6233 */
6236 num_files,
6237 files,
6241 }
6246 }
6256 };
6261 {
6265 NTSTATUS status;
6270 }
6275 }
6293 }
6297 }
6300 /*
6301 * Windows 7 and 8 lease clients are broken in that they will
6302 * not respond to lease break requests whilst waiting for an
6303 * outstanding open request on that lease handle on the same
6304 * TCP connection, due to holding an internal inode lock.
6305 *
6306 * This means we can't reschedule ourselves here, but must
6307 * return from the create.
6308 *
6309 * Work around:
6310 *
6311 * Send the breaks and then return SMB2_LEASE_NONE in the
6312 * lease handle to cause them to acknowledge the lease
6313 * break. Consultation with Microsoft engineering confirmed
6314 * this approach is safe.
6315 */
6318 }
6322 {
6328 }
6329 }
6338 {
6346 };
6348 NTSTATUS status;
6353 }
6358 /*
6359 * Not found or error means okay: We can make the lease pass
6360 */
6362 }
6364 /*
6365 * Anything but NT_STATUS_OPLOCK_NOT_GRANTED, let the caller
6366 * deal with it.
6367 */
6369 }
6371 /* We have to break all existing leases. */
6376 };
6379 /* Don't need to break our own file. */
6381 }
6386 lease_match_fid_fn,
6389 /* Race condition - file already closed. */
6391 }
6396 }
6397 }
6398 /*
6399 * Ensure we don't grant anything more so we
6400 * never upgrade.
6401 */
6403 }
6405 /*
6406 * Wrapper around open_file_ntcreate and open_directory
6407 */
6427 {
6433 NTSTATUS status;
6445 "ea_list = %p, "
6446 "sd = %p, "
6448 access_mask,
6449 file_attributes,
6450 share_access,
6451 create_disposition,
6452 create_options,
6453 oplock_request,
6454 private_flags,
6455 ea_list,
6456 sd,
6462 }
6467 }
6472 {
6474 S_IFMT);
6478 FALL_THROUGH;
6482 /*
6483 * We should never get this far with a symlink
6484 * "as such". Report as not existing.
6485 */
6491 }
6492 }
6496 }
6506 }
6509 req,
6512 smb_fname,
6516 /* Dynamic share file. No leases and update epoch... */
6524 }
6525 }
6530 /*
6531 * We can't open a file with DELETE access if any of the
6532 * streams is open without FILE_SHARE_DELETE
6533 */
6538 }
6539 }
6545 SEC_PRIV_SECURITY);
6552 }
6556 {
6557 /*
6558 * No other bits set. Windows SMB2 refuses this.
6559 * See smbtorture3 SMB2-SACL test.
6560 *
6561 * Note this is an SMB2-only behavior,
6562 * smbtorture3 SMB1-SYSTEM-SECURITY already tests
6563 * that SMB1 allows this.
6564 */
6567 }
6568 }
6570 /*
6571 * Files or directories can't be opened DELETE_ON_CLOSE without
6572 * delete access.
6573 * BUG: https://bugzilla.samba.org/show_bug.cgi?id=13358
6574 */
6579 }
6583 {
6592 }
6601 }
6609 }
6611 /*
6612 * We may be creating the basefile as part of creating the
6613 * stream, so it's legal if the basefile doesn't exist at this
6614 * point, the create_file_unixpath() below will create it. But
6615 * if the basefile exists we want a handle so we can fstat() it.
6616 */
6623 }
6626 smb_fname_base);
6633 }
6635 /*
6636 * https://bugzilla.samba.org/show_bug.cgi?id=10229
6637 * We need to check if the requested access mask
6638 * could be used to open the underlying file (if
6639 * it existed), as we're passing in zero for the
6640 * access mask to the base filename.
6641 */
6643 access_mask);
6647 "for base %s failed: "
6652 }
6653 }
6657 /* Open the base file. */
6659 NULL,
6660 dirfsp,
6661 smb_fname_base,
6663 FILE_SHARE_READ
6664 | FILE_SHARE_WRITE
6666 base_create_disposition,
6670 NULL,
6672 base_privflags,
6673 NULL,
6674 NULL,
6676 NULL);
6684 }
6685 }
6691 /*
6692 * We're about to use smb_fname->fsp for the fresh open.
6693 *
6694 * Every fsp passed in via smb_fname->fsp already
6695 * holds a fsp->fsp_name. If it is already this
6696 * fsp->fsp_name that we got passed in as our input
6697 * argument smb_fname, these two are assumed to have
6698 * the same lifetime: Every fsp hangs of "conn", and
6699 * fsp->fsp_name is its talloc child.
6700 */
6703 /*
6704 * "smb_fname" is temporary in this case, but
6705 * the destructor of smb_fname would also tear
6706 * down the fsp we're about to use. Unlink
6707 * them from each other.
6708 */
6711 /*
6712 * "fsp" is ours now
6713 */
6715 }
6720 }
6729 }
6731 /*
6732 * No fsp passed in that we can use, create one
6733 */
6737 }
6743 }
6744 }
6750 /*
6751 * We're opening the stream element of a
6752 * base_fsp we already opened. Set up the
6753 * base_fsp pointer.
6754 */
6756 }
6760 conn,
6762 smb_fname,
6767 }
6769 /*
6770 * Get a pathref on the parent. We can re-use this for
6771 * multiple calls to check parent ACLs etc. to avoid
6772 * pathname calls.
6773 */
6776 smb_fname,
6781 }
6787 }
6788 }
6790 /*
6791 * If it's a request for a directory open, deal with it separately.
6792 */
6799 }
6801 /* Can't open a temp directory. IFS kit test. */
6806 }
6808 /*
6809 * We will get a create directory here if the Win32
6810 * app specified a security descriptor in the
6811 * CreateDirectory() call.
6812 */
6815 req,
6816 access_mask,
6817 share_access,
6818 create_disposition,
6819 create_options,
6820 file_attributes,
6822 smb_fname_atname,
6823 oplock_request,
6824 lease,
6825 sd,
6827 fsp);
6830 /*
6831 * Ordinary file case.
6832 */
6836 allocation_size);
6837 }
6840 req,
6841 access_mask,
6842 share_access,
6843 create_disposition,
6844 create_options,
6845 file_attributes,
6846 oplock_request,
6847 lease,
6848 private_flags,
6850 smb_fname_atname,
6852 fsp);
6855 /* A stream open never opens a directory */
6860 }
6862 /*
6863 * Fail the open if it was explicitly a non-directory
6864 * file.
6865 */
6870 }
6873 req,
6874 access_mask,
6875 share_access,
6876 create_disposition,
6877 create_options,
6878 file_attributes,
6880 smb_fname_atname,
6881 oplock_request,
6882 lease,
6883 sd,
6885 fsp);
6886 }
6887 }
6891 }
6900 }
6901 }
6905 {
6908 }
6910 /* Save the requested allocation size. */
6914 {
6921 }
6925 }
6928 }
6939 }
6940 }
6946 COMPRESSION_FORMAT_NONE);
6950 }
6951 }
6958 }
6966 fail:
6970 /*
6971 * The close_file below will close
6972 * fsp->base_fsp.
6973 */
6979 }
6980 }
6983 }
6988 }
6995 {
6997 NTSTATUS status;
7004 }
7010 }
7014 }
7019 wire_mode_bits,
7023 }
7028 }
7029 /*
7030 * Remove type info from mode, leaving only the
7031 * permissions and setuid/gid bits.
7032 */
7038 }
7059 {
7062 NTSTATUS status;
7066 " file_attributes = 0x%" PRIu32
7067 " share_access = 0x%" PRIu32
7068 " create_disposition = 0x%" PRIu32
7069 " create_options = 0x%" PRIu32
7070 " oplock_request = 0x%" PRIu32
7071 " private_flags = 0x%" PRIu32
7073 access_mask,
7074 file_attributes,
7075 share_access,
7076 create_disposition,
7077 create_options,
7078 oplock_request,
7079 private_flags,
7080 ea_list,
7081 sd,
7085 /*
7086 * Remember the absolute time of the original request
7087 * with this mid. We'll use it later to see if this
7088 * has timed out.
7089 */
7091 }
7093 /*
7094 * Check to see if this is a mac fork of some kind.
7095 */
7105 /*
7106 * Here we go! support for changing the disk quotas
7107 * --metze
7108 *
7109 * We need to fake up to open this MAGIC QUOTA file
7110 * and return a valid FID.
7111 *
7112 * w2k close this file directly after opening xp
7113 * also tries a QUERY_FILE_INFO on the file and then
7114 * close it
7115 */
7121 }
7125 }
7130 }
7131 }
7135 /* We have to handle this error here. */
7139 }
7144 }
7145 }
7148 req,
7149 in_context_blobs,
7150 create_options,
7154 }
7157 req,
7158 dirfsp,
7159 smb_fname,
7160 access_mask,
7161 share_access,
7162 create_disposition,
7163 create_options,
7164 file_attributes,
7165 oplock_request,
7166 lease,
7167 allocation_size,
7168 private_flags,
7169 sd,
7170 ea_list,
7175 }
7177 done:
7183 }
7186 fail:
7191 }
7193 }