| blob | 4f69a7749d8c870ebb0c650f0eff3cc52e379e35 |
1 /*
2 Unix SMB/CIFS implementation.
3 file opening and share modes
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Jeremy Allison 2001-2004
6 Copyright (C) Volker Lendecke 2005
7 Copyright (C) Ralph Boehme 2017
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
47 #if defined(HAVE_LINUX_MAGIC_H)
48 #include <linux/magic.h>
49 #endif
61 /*
62 * Timer for async opens, needed because they don't use a watch on
63 * a locking.tdb record. This is currently only used for real async
64 * opens and just terminates smbd if the async open times out.
65 */
68 /*
69 * For the samba kernel oplock case we use both a timeout and
70 * a watch on locking.tdb. This way in case it's smbd holding
71 * the kernel oplock we get directly notified for the retry
72 * once the kernel oplock is properly broken. Store the req
73 * here so that it can be timely discarded once the timer
74 * above fires.
75 */
77 };
79 /****************************************************************************
80 If the requester wanted DELETE_ACCESS and was rejected because
81 the file ACL didn't include DELETE_ACCESS, see if the parent ACL
82 overrides this.
83 ****************************************************************************/
90 {
95 }
98 }
100 /****************************************************************************
101 Check if we have open rights.
102 ****************************************************************************/
110 {
119 access_mask,
121 rejected_share_access);
123 }
131 }
134 /* I'm sorry sir, I didn't know you were root... */
139 }
143 {
147 access_mask);
149 }
154 {
155 /* We can always delete a symlink. */
159 }
162 }
172 {
174 NTSTATUS status;
178 }
182 use_privs,
189 access_mask,
190 rejected_mask,
198 }
199 }
205 {
207 }
209 /* Here we know status == NT_STATUS_ACCESS_DENIED. */
211 access_denied:
220 {
225 }
228 dirfsp,
229 smb_fname,
230 access_mask,
231 rejected_mask))
232 {
233 /*
234 * Were we trying to do an open for delete and didn't get DELETE
235 * access. Check if the directory allows DELETE_CHILD.
236 * See here:
237 * http://blogs.msdn.com/oldnewthing/archive/2004/06/04/148426.aspx
238 * for details.
239 */
245 }
249 }
251 }
257 {
260 NTSTATUS status;
262 /* Cope with fake/printer fsp's. */
266 }
268 }
271 /*
272 * This is a POSIX open on a symlink. For the pathname
273 * version of this function we used to return the st_mode
274 * bits turned into an NT ACL. For a symlink the mode bits
275 * are always rwxrwxrwx which means the pathname version always
276 * returned NT_STATUS_OK for a symlink. For the handle reference
277 * to a symlink use the handle access bits.
278 */
281 }
283 }
285 /*
286 * If we can access the path to this file, by
287 * default we have FILE_READ_ATTRIBUTES from the
288 * containing directory. See the section:
289 * "Algorithm to Check Access to an Existing File"
290 * in MS-FSA.pdf.
291 *
292 * se_file_access_check() also takes care of
293 * owner WRITE_DAC and READ_CONTROL.
294 */
297 /*
298 * Samba 3.6 and earlier granted execute access even
299 * if the ACL did not contain execute rights.
300 * Samba 4.0 is more correct and checks it.
301 * The compatibility mode allows one to skip this check
302 * to smoothen upgrades.
303 */
306 }
310 use_privs,
311 access_mask,
312 do_not_check_mask);
315 }
319 SECINFO_GROUP |
320 SECINFO_DACL),
328 }
331 dirfsp,
333 sd,
334 use_privs,
335 access_mask,
336 do_not_check_mask);
337 }
339 /*
340 * Given an fsp that represents a parent directory,
341 * check if the requested access can be granted.
342 */
345 {
346 NTSTATUS status;
354 /* I'm sorry sir, I didn't know you were root... */
360 }
364 frame,
373 }
375 /*
376 * If we can access the path to this file, by
377 * default we have FILE_READ_ATTRIBUTES from the
378 * containing directory. See the section:
379 * "Algorithm to Check Access to an Existing File"
380 * in MS-FSA.pdf.
381 *
382 * se_file_access_check() also takes care of
383 * owner WRITE_DAC and READ_CONTROL.
384 */
394 access_mask,
395 access_granted,
398 }
403 }
407 }
409 /* Check if the directory has delete-on-close set */
415 }
421 }
425 out:
428 }
430 /****************************************************************************
431 Ensure when opening a base file for a stream open that we have permissions
432 to do so given the access mask on the base file.
433 ****************************************************************************/
437 {
438 NTSTATUS status;
441 fsp,
443 access_mask,
451 }
457 }
461 }
462 }
465 fsp,
467 access_mask);
468 }
477 {
482 NTSTATUS status;
492 }
494 /* Pin parent directory in place. */
502 }
503 }
508 NULL,
509 NULL,
515 }
524 }
528 connectpath_len,
535 }
542 connectpath,
548 out:
553 }
556 }
558 /*
559 * Get the symlink target of dirfsp/symlink_name, making sure the
560 * target is below connection_path.
561 */
570 {
573 NTSTATUS status;
576 /*
577 * fsp is an O_PATH open, Linux does a "freadlink"
578 * with an empty name argument to readlinkat
579 */
584 }
588 }
591 connection_path,
593 target,
600 }
603 /*
604 * special case symlink to share root: "." is our
605 * share root filename
606 */
611 }
612 }
616 }
618 /****************************************************************************
619 Non-widelink open.
620 ****************************************************************************/
626 {
645 /*
646 * This can happen with shadow_copy2 if the snapshot
647 * path is not found
648 */
650 }
653 again:
661 }
662 }
663 }
669 smb_fname,
674 }
678 conn,
679 connpath,
680 connpath_len,
681 parent_dir_fname,
685 }
687 /* Setup fsp->fsp_name to be relative to cwd */
690 /*
691 * fsp->fsp_name is unchanged as it is already correctly
692 * relative to dirfsp.
693 */
695 }
697 {
698 /*
699 * Assert nobody can step in with a symlink on the
700 * path, there is no path anymore and we'll use
701 * O_NOFOLLOW to open.
702 */
705 }
710 dirfsp,
711 smb_fname_rel,
712 fsp,
721 }
723 /*
724 * ENOENT makes it worthless retrying with a
725 * stat, we know for sure the file does not
726 * exist. For everything else we want to know
727 * what's there.
728 */
731 dirfsp,
732 smb_fname_rel,
734 AT_SYMLINK_NOFOLLOW);
737 /*
738 * Keep the original error. Otherwise we would
739 * mask for example EROFS for open(O_CREAT),
740 * turning it into ENOENT.
741 */
743 }
746 }
754 }
761 }
763 /*
764 * Found a symlink to follow in user space
765 */
768 /* Never follow symlinks on posix open. */
771 }
773 /* Explicitly no symlinks. */
776 }
782 }
788 connpath,
789 fsp,
791 smb_fname_rel,
798 }
800 /*
801 * Close what openat(O_PATH) potentially left behind
802 */
807 }
814 }
816 }
818 /*
819 * And do it all again... As smb_fname is not relative to the passed in
820 * dirfsp anymore, we pass conn->cwd_fsp as dirfsp to
821 * non_widelink_open() to trigger the chdir(parentdir) logic.
822 */
827 out:
835 }
841 }
843 }
845 }
847 /****************************************************************************
848 fd support routines - attempt to do a dos_open.
849 ****************************************************************************/
855 {
864 /*
865 * Never follow symlinks on a POSIX client. The
866 * client should be doing this.
867 */
871 }
877 conn,
879 smb_fname,
880 fsp,
884 }
893 }
894 }
897 }
899 /*
900 * Only follow symlinks within a share
901 * definition.
902 */
910 "to open more! smbd's max "
914 }
915 }
924 }
933 }
935 /****************************************************************************
936 Close the file associated with a fsp.
937 ****************************************************************************/
940 {
946 }
949 /*
950 * capture status, if failure
951 * continue close processing
952 * and return status
953 */
955 }
959 }
961 /*
962 * Either a directory where the dptr_CloseDir() already closed
963 * the fd or a stat open.
964 */
966 }
969 }
975 }
977 }
979 /****************************************************************************
980 Change the ownership of a file to that of the parent directory.
981 Do this by fd if possible.
982 ****************************************************************************/
986 {
990 /* Already this uid - no need to change. */
995 }
1004 "file %s to parent directory uid %u. Error "
1014 /* Ensure the uid entry is updated. */
1017 }
1018 }
1022 {
1023 NTSTATUS status;
1027 /* Already this uid - no need to change. */
1032 }
1042 "directory %s to parent directory uid %u. "
1048 }
1055 /* Ensure the uid entry is updated. */
1059 }
1061 /****************************************************************************
1062 Open a file - returning a guaranteed ATOMIC indication of if the
1063 file was created or not.
1064 ****************************************************************************/
1071 {
1074 NTSTATUS retry_status;
1078 /*
1079 * We're not creating the file, just pass through.
1080 */
1084 }
1087 /*
1088 * Fail if already exists, just pass through.
1089 */
1092 /*
1093 * Here we've opened with O_CREAT|O_EXCL. If that went
1094 * NT_STATUS_OK, we *know* we created this file.
1095 */
1099 }
1101 /*
1102 * Now it gets tricky. We have O_CREAT, but not O_EXCL.
1103 * To know absolutely if we created the file or not,
1104 * we can never call O_CREAT without O_EXCL. So if
1105 * we think the file existed, try without O_CREAT|O_EXCL.
1106 * If we think the file didn't exist, try with
1107 * O_CREAT|O_EXCL.
1108 *
1109 * The big problem here is dangling symlinks. Opening
1110 * without O_NOFOLLOW means both bad symlink
1111 * and missing path return -1, ENOENT from open(). As POSIX
1112 * is pathname based it's not possible to tell
1113 * the difference between these two cases in a
1114 * non-racy way, so change to try only two attempts before
1115 * giving up.
1116 *
1117 * We don't have this problem for the O_NOFOLLOW
1118 * case as it just returns NT_STATUS_OBJECT_PATH_NOT_FOUND
1119 * mapped from the ELOOP POSIX error.
1120 */
1128 }
1134 }
1147 }
1150 }
1154 }
1161 {
1162 NTSTATUS status;
1171 };
1179 }
1182 }
1189 fsp,
1190 how);
1192 #if defined(HAVE_FSTATFS) && defined(HAVE_LINUX_MAGIC_H)
1201 /*
1202 * When reopening an as-yet
1203 * unmounted autofs mount
1204 * point we get ENOENT. We
1205 * have to retry pathbased.
1206 */
1208 }
1209 /* restore ENOENT if changed in the meantime */
1211 }
1212 #endif
1216 }
1221 }
1225 }
1227 #if defined(HAVE_FSTATFS) && defined(HAVE_LINUX_MAGIC_H)
1228 namebased_open:
1229 #endif
1230 /*
1231 * Close the existing pathref fd and set the fsp flag
1232 * is_pathref to false so we get a "normal" fd this time.
1233 */
1237 }
1243 }
1245 /****************************************************************************
1246 Open a file.
1247 ****************************************************************************/
1259 {
1266 FILE_READ_DATA |
1267 FILE_WRITE_DATA |
1268 FILE_APPEND_DATA |
1269 FILE_EXECUTE |
1270 SEC_FLAG_SYSTEM_SECURITY;
1275 /*
1276 * Catch early an attempt to open an existing
1277 * directory as a file.
1278 */
1281 }
1283 /*
1284 * This little piece of insanity is inspired by the
1285 * fact that an NT client can open a file for O_RDONLY,
1286 * but set the create disposition to FILE_EXISTS_TRUNCATE.
1287 * If the client *can* write to the file, then it expects to
1288 * truncate the file, even though it is opening for readonly.
1289 * Quicken uses this stupid trick in backup file creation...
1290 * Thanks *greatly* to "David W. Chapman Jr." <dwcjr@inethouston.net>
1291 * for helping track this one down. It didn't bite us in 2.0.x
1292 * as we always opened files read-write in that release. JRA.
1293 */
1299 }
1301 /* Check permissions */
1303 /*
1304 * This code was changed after seeing a client open request
1305 * containing the open mode of (DENY_WRITE/read-only) with
1306 * the 'create if not exist' bit set. The previous code
1307 * would fail to open the file read only on a read-only share
1308 * as it was checking the flags parameter directly against O_RDONLY,
1309 * this was failing as the flags parameter was set to O_RDONLY|O_CREAT.
1310 * JRA.
1311 */
1314 /* It's a read-only share - fail if we wanted to write. */
1320 }
1321 /*
1322 * We don't want to write - but we must make sure that
1323 * O_CREAT doesn't create the file if we have write
1324 * access into the directory.
1325 */
1327 }
1332 }
1337 #if defined(O_NONBLOCK) && defined(S_ISFIFO)
1338 /*
1339 * We would block on opening a FIFO with no one else on the
1340 * other end. Do what we used to do and add O_NONBLOCK to the
1341 * open flags. JRA.
1342 */
1346 }
1347 #endif
1351 /*
1352 * Don't open files with Microsoft wildcard characters.
1353 */
1355 /*
1356 * wildcard characters are allowed in stream
1357 * names only test the basefilename
1358 */
1360 }
1364 }
1365 }
1367 /* Can we access this file ? */
1369 /* Only do this check on non-stream open. */
1372 dirfsp,
1373 fsp,
1375 open_access_mask);
1382 }
1386 NT_STATUS_OBJECT_NAME_NOT_FOUND))
1387 {
1389 }
1392 NT_STATUS_OBJECT_NAME_NOT_FOUND))
1393 {
1395 "file %s vanished since we "
1400 }
1401 }
1405 /* File didn't exist and no O_CREAT. */
1407 }
1410 dirfsp,
1411 SEC_DIR_ADD_FILE);
1414 "directory %s for file %s "
1421 }
1422 }
1423 }
1425 /*
1426 * Actually do the open - if O_TRUNC is needed handle it
1427 * below under the share mode lock.
1428 */
1431 smb_fname_atname,
1432 fsp,
1434 p_file_created);
1436 /*
1437 * Non-O_PATH reopen that hit a race
1438 * condition: Someone has put a symlink where
1439 * we used to have a file. Can't happen with
1440 * O_PATH and reopening from /proc/self/fd/ or
1441 * equivalent.
1442 */
1444 }
1453 }
1456 /*
1457 * GPFS can return ETIMEDOUT for pread on
1458 * nonblocking file descriptors when files
1459 * migrated to tape need to be recalled. I
1460 * could imagine this happens elsewhere
1461 * too. With blocking file descriptors this
1462 * does not happen.
1463 */
1471 }
1472 }
1475 /* We created this file. */
1478 /* Do all inheritance work after we've
1479 done a successful fstat call and filled
1480 in the stat struct in fsp->fsp_name. */
1482 /* Inherit the ACL if required */
1485 dirfsp,
1486 smb_fname,
1489 }
1491 /* Change the owner if required. */
1495 }
1499 /*
1500 * If we have an fd, this stat should succeed.
1501 */
1509 }
1510 }
1513 FILE_NOTIFY_CHANGE_FILE_NAME,
1515 }
1518 /* File must exist for a stat open. */
1520 }
1524 {
1525 /*
1526 * Don't allow stat opens on symlinks directly unless
1527 * it's a POSIX open. Match the return code from
1528 * openat_pathref_fsp().
1529 */
1531 }
1534 /*
1535 * There is only one legit case where end up here:
1536 * openat_pathref_fsp() failed to open a symlink, so the
1537 * fsp was created by fsp_new() which doesn't set
1538 * is_pathref. Other than that, we should always have a
1539 * pathref fsp at this point. The subsequent checks
1540 * assert this.
1541 */
1546 }
1551 }
1557 }
1558 }
1560 /*
1561 * Access to streams is checked by checking the basefile and
1562 * that has already been checked by check_base_file_access()
1563 * in create_file_unixpath().
1564 */
1567 fsp,
1569 open_access_mask);
1572 posix_open &&
1574 /* This is a POSIX stat open for delete
1575 * or rename on a symlink that points
1576 * nowhere. Allow. */
1581 }
1589 }
1590 }
1591 }
1603 }
1612 }
1622 }
1631 {
1640 new_access,
1641 access_mask,
1642 existing_sharemode,
1643 sharemode_mask);
1645 }
1649 new_sharemode,
1650 sharemode_mask,
1651 existing_access,
1652 access_mask);
1654 }
1656 }
1658 /****************************************************************************
1659 Check if we can open a file with a share mode.
1660 Returns True if conflict, False if not.
1661 ****************************************************************************/
1664 FILE_WRITE_DATA|
1665 FILE_APPEND_DATA|
1666 FILE_READ_DATA|
1667 FILE_EXECUTE|
1668 DELETE_ACCESS;
1674 {
1681 e_access_mask,
1682 e_share_access,
1683 access_mask,
1684 share_access);
1689 e_access_mask);
1691 }
1694 access_mask);
1696 }
1710 }
1712 #if defined(DEVELOPER)
1718 };
1724 {
1730 }
1733 /* INTERNAL_OPEN_ONLY */
1735 }
1743 }
1747 }
1751 panic:
1752 {
1757 "validate_my_share_entries: "
1763 }
1766 }
1767 #endif
1769 /**
1770 * Allowed access mask for stat opens relevant to oplocks
1771 **/
1773 {
1776 FILE_READ_ATTRIBUTES|
1777 FILE_WRITE_ATTRIBUTES);
1781 }
1783 /**
1784 * Allowed access mask for stat opens relevant to leases
1785 **/
1787 {
1790 FILE_READ_ATTRIBUTES|
1791 FILE_WRITE_ATTRIBUTES|
1792 READ_CONTROL_ACCESS);
1796 }
1800 };
1806 {
1810 }
1814 {
1820 }
1826 }
1828 }
1835 {
1840 lck,
1848 }
1852 lck,
1853 existing_access_mask,
1854 existing_share_mode,
1855 existing_lease_type,
1856 NULL);
1857 }
1859 /****************************************************************************
1860 Deal with share modes
1861 Invariant: Share mode must be locked on entry and exit.
1862 Returns -1 on error, or number of share modes on success (may be zero).
1863 ****************************************************************************/
1870 };
1876 {
1884 }
1890 }
1897 }
1902 }
1909 }
1916 {
1922 /* Stat open that doesn't trigger oplock breaks or share mode
1923 * checks... ! JRA. */
1925 }
1927 /*
1928 * Check if the share modes will give us access.
1929 */
1931 #if defined(DEVELOPER)
1932 {
1937 };
1941 }
1942 #endif
1950 access_mask,
1951 share_access);
1955 }
1960 FILE_SHARE_WRITE|
1961 FILE_SHARE_DELETE),
1962 };
1964 /*
1965 * Walk the share mode array to recalculate d->flags
1966 */
1972 }
1975 lck,
1981 /*
1982 * We only end up here if we had a sharing violation
1983 * from d->flags and have recalculated it.
1984 */
1986 }
1991 access_mask,
1992 share_access);
1996 }
1999 }
2001 /*
2002 * Send a break message to the oplock holder and delay the open for
2003 * our client.
2004 */
2010 {
2015 };
2019 NTSTATUS status;
2026 }
2036 }
2040 MSG_SMB_BREAK_REQUEST,
2045 }
2048 }
2057 };
2063 {
2067 /* INTERNAL_OPEN_ONLY */
2069 }
2072 /*
2073 * We ignore stat opens in the table - they always
2074 * have NO_OPLOCK and never get or cause breaks. JRA.
2075 */
2077 }
2082 /* batch - can only be one. */
2086 }
2094 }
2096 }
2102 }
2103 /* Exclusive or batch - can only be one. */
2110 }
2112 }
2119 }
2123 }
2125 }
2132 }
2136 }
2138 }
2141 }
2143 /*
2144 * Do internal consistency checks on the share mode for a file.
2145 */
2148 {
2156 }
2163 }
2169 }
2173 }
2183 }
2186 }
2191 {
2194 }
2197 }
2203 }
2206 {
2214 }
2221 {
2224 /*
2225 * TODO: Measure how expensive this loop is with thousands of open
2226 * handles...
2227 */
2235 }
2238 }
2242 }
2243 }
2245 /* Not found - must be leased in another smbd. */
2249 }
2254 /*
2255 * We internally treat all leases as V2 and update
2256 * the epoch, but when sending breaks it matters if
2257 * the requesting lease was v1 or v2.
2258 */
2262 }
2269 {
2275 NTSTATUS status;
2278 client_guid,
2289 }
2292 fsp,
2294 current_state,
2295 lease_version,
2296 epoch);
2301 }
2303 /*
2304 * Upgrade only if the requested lease is a strict upgrade.
2305 */
2309 /*
2310 * Tricky: This test makes sure that "requested" is a
2311 * strict bitwise superset of "existing".
2312 */
2315 /*
2316 * Upgrade only if there's a change.
2317 */
2320 /*
2321 * Upgrade only if other leases don't prevent what was asked
2322 * for.
2323 */
2326 /*
2327 * only upgrade if we are not in breaking state
2328 */
2336 NTSTATUS set_status;
2342 client_guid,
2344 current_state,
2345 breaking,
2346 breaking_to_requested,
2347 breaking_to_required,
2348 lease_version,
2349 epoch);
2355 }
2356 }
2361 }
2368 {
2369 NTSTATUS status;
2374 }
2396 }
2398 /*
2399 * We used to set lck->data->modified=true here without
2400 * actually modifying lck->data, triggering a needless
2401 * writeback of lck->data.
2402 *
2403 * Apart from that writeback, setting modified=true has the
2404 * effect of triggering all waiters for this file to
2405 * retry. This only makes sense if any blocking condition
2406 * (i.e. waiting for a lease to be downgraded or removed) is
2407 * gone. This routine here only adds a lease, so it will never
2408 * free up resources that blocked waiters can now claim. So
2409 * that second effect also does not matter in this
2410 * routine. Thus setting lck->data->modified=true does not
2411 * need to be done here.
2412 */
2415 }
2421 {
2423 NTSTATUS status;
2430 }
2433 }
2436 {
2450 }
2453 }
2457 };
2471 };
2474 {
2477 }
2482 }
2490 {
2502 NTSTATUS status;
2509 }
2510 }
2523 /*
2524 * leases_db_get() can return NT_STATUS_NOT_FOUND
2525 * if the share_mode_entry e is stale and the
2526 * lease record was already removed. In this case return
2527 * false so the traverse continues.
2528 */
2532 {
2537 "file_id [%s] failed for stale "
2544 }
2557 }
2560 }
2564 {
2566 }
2572 }
2578 }
2584 }
2588 }
2594 }
2603 }
2605 }
2609 }
2612 /*
2613 * If we break anyway break to NONE directly.
2614 * Otherwise vfs_set_filelen() will trigger the
2615 * break.
2616 */
2618 }
2621 /*
2622 * Oplocks only support breaking to R or NONE.
2623 */
2625 }
2634 }
2637 }
2641 }
2645 }
2654 }
2657 delay_for_oplock_fn_watch_done,
2668 };
2671 {
2682 }
2685 blocker_debug_state,
2687 }
2699 {
2704 };
2714 /*
2715 * No directory leases yet
2716 */
2720 }
2722 }
2726 /*
2727 * The SMB2 layer should have checked this
2728 */
2730 }
2736 }
2742 }
2748 {
2753 }
2757 blocker_debug_state_destructor);
2758 }
2772 }
2778 }
2783 }
2785 grant:
2788 }
2796 }
2800 }
2804 }
2808 }
2809 }
2815 }
2818 /*
2819 * Can grant only one writer
2820 */
2822 }
2831 }
2832 }
2837 }
2843 }
2845 /*
2846 * Reflect possible downgrades from:
2847 * - map_lease_type_to_oplock() => "RH" to just LEVEL_II
2848 */
2851 }
2855 {
2860 }
2868 granted,
2870 oplock_request,
2874 requested,
2883 }
2897 {
2899 NTSTATUS status;
2909 }
2913 }
2919 }
2921 /*
2922 * Internal opens never do oplocks or leases. We don't
2923 * need to go through delay_for_oplock().
2924 */
2926 }
2929 fsp,
2930 oplock_request,
2931 lease,
2932 lck,
2933 sharing_violation,
2934 create_disposition,
2935 first_open_attempt,
2936 poplock_type,
2937 pgranted,
2938 blocker_debug_state);
2941 }
2944 }
2947 {
2950 }
2955 };
2959 /**
2960 * Defer an open and watch a locking.tdb record
2961 *
2962 * This defers an open that gets rescheduled once the locking.tdb record watch
2963 * is triggered by a change to the record.
2964 *
2965 * It is used to defer opens that triggered an oplock break and for the SMB1
2966 * sharing violation delay.
2967 **/
2973 {
2995 }
3000 }
3007 watch_state,
3009 lck,
3013 }
3021 }
3027 }
3028 }
3031 {
3034 NTSTATUS status;
3043 /*
3044 * Even if it failed, retry anyway. TODO: We need a way to
3045 * tell a re-scheduled open about that error.
3046 */
3047 }
3054 }
3056 /**
3057 * Actually attempt the kernel oplock polling open.
3058 */
3064 {
3075 }
3077 }
3085 };
3089 {
3095 }
3100 lck,
3105 }
3106 }
3108 /**
3109 * Reschedule an open for 1 second from now, if not timed out.
3110 **/
3116 {
3125 }
3131 }
3135 /*
3136 * Make sure open_rec->te does not come later than the
3137 * request's maximum endtime.
3138 */
3146 open_rec,
3147 next_interval,
3148 poll_open_fn,
3149 open_rec);
3154 }
3160 };
3161 NTSTATUS status;
3164 poll_open_setup_watcher_fn,
3171 }
3174 poll_open_done,
3175 open_rec);
3181 }
3184 }
3191 }
3199 }
3202 {
3205 NTSTATUS status;
3220 }
3221 }
3224 {
3230 }
3232 /*
3233 * Try every 200msec up to (by default) one second. To be
3234 * precise, according to behaviour note <247> in [MS-CIFS],
3235 * the server tries 5 times. But up to one second should be
3236 * close enough.
3237 */
3243 SHARING_VIOLATION_USEC_WAIT);
3246 req,
3247 NULL,
3251 }
3253 /****************************************************************************
3254 On overwrite open ensure that the attributes match.
3255 ****************************************************************************/
3260 mode_t new_unx_mode,
3262 {
3269 (noarch_old_dos_attr != 0 && ((noarch_old_dos_attr & noarch_new_dos_attr) == noarch_old_dos_attr))) {
3273 }
3276 "new_dos_attr = 0x%x "
3282 /* If we're mapping SYSTEM and HIDDEN ensure they match. */
3287 }
3288 }
3293 }
3294 }
3296 }
3302 {
3303 /* This is a relative time, added to the absolute
3304 request_time value to get the absolute timeout time.
3305 Note that if this is the second or greater time we enter
3306 this codepath for this particular request mid then
3307 request_time is left as the absolute time of the *first*
3308 time this request mid was processed. This is what allows
3309 the request to eventually time out. */
3313 /* Normally the smbd we asked should respond within
3314 * OPLOCK_BREAK_TIMEOUT seconds regardless of whether
3315 * the client did, give twice the timeout as a safety
3316 * measure here in case the other smbd is stuck
3317 * somewhere else. */
3323 }
3326 }
3328 /****************************************************************************
3329 Reschedule an open call that went asynchronous.
3330 ****************************************************************************/
3336 {
3338 }
3341 {
3348 }
3353 }
3360 }
3363 req,
3365 schedule_async_open_timer,
3366 open_rec);
3369 }
3370 }
3382 {
3383 NTSTATUS status;
3391 /* Get the types we need to examine. */
3394 }
3399 }
3402 lck,
3403 create_disposition,
3404 access_mask,
3405 share_access,
3406 oplock_request,
3407 lease,
3408 first_open_attempt,
3415 }
3418 }
3422 }
3427 fsp,
3430 oplock_type,
3431 lease_key,
3432 share_access,
3433 access_mask);
3436 }
3443 }
3446 }
3451 }
3453 /****************************************************************************
3454 Work out what access_mask to use from what the client sent us.
3455 ****************************************************************************/
3462 {
3466 NTSTATUS status;
3468 /* Cope with symlinks */
3472 }
3474 /* Cope with fake/printer fsp's. */
3478 }
3483 }
3487 SECINFO_GROUP |
3488 SECINFO_DACL),
3493 /*
3494 * File did not exist
3495 */
3498 }
3504 }
3506 /*
3507 * If we can access the path to this file, by
3508 * default we have FILE_READ_ATTRIBUTES from the
3509 * containing directory. See the section:
3510 * "Algorithm to Check Access to an Existing File"
3511 * in MS-FSA.pdf.
3512 *
3513 * se_file_access_check()
3514 * also takes care of owner WRITE_DAC and READ_CONTROL.
3515 */
3518 use_privs,
3530 }
3536 dirfsp,
3539 }
3540 }
3545 }
3548 }
3555 {
3556 NTSTATUS status;
3562 access_mask);
3564 }
3566 /*
3567 * Convert GENERIC bits to specific bits.
3568 */
3572 /* Calculate MAXIMUM_ALLOWED_ACCESS if requested. */
3576 dirfsp,
3577 fsp,
3578 use_privs,
3583 }
3586 }
3592 "rejected by share access mask[0x%08X] "
3597 rejected_share_access);
3599 }
3603 }
3605 /****************************************************************************
3606 Remove the deferred open entry under lock.
3607 ****************************************************************************/
3609 /****************************************************************************
3610 Return true if this is a state pointer to an asynchronous create.
3611 ****************************************************************************/
3614 {
3616 }
3619 {
3630 }
3632 }
3635 {
3638 /*
3639 * Currently we're using FILE_SUPERSEDE as the same as
3640 * FILE_OVERWRITE_IF but they really are
3641 * different. FILE_SUPERSEDE deletes an existing file
3642 * (requiring delete access) then recreates it.
3643 */
3648 /*
3649 * If file exists replace/overwrite. If file doesn't
3650 * exist create.
3651 */
3656 /*
3657 * If file exists open. If file doesn't exist error.
3658 */
3663 /*
3664 * If file exists overwrite. If file doesn't exist
3665 * error.
3666 */
3671 /*
3672 * If file exists error. If file doesn't exist create.
3673 */
3678 /*
3679 * If file exists open. If file doesn't exist create.
3680 */
3683 }
3685 }
3689 NTTIME twrp)
3690 {
3693 /*
3694 * Note that we ignore the append flag as append does not
3695 * mean the same thing under DOS and Unix.
3696 */
3699 /*
3700 * Pave over the user requested mode and force O_RDONLY for the
3701 * file handle. Windows allows opening a VSS file with O_RDWR,
3702 * even though actual writes on the handle will fail.
3703 */
3705 }
3710 }
3712 /* DENY_DOS opens are always underlying read-write on the
3713 file handle, no matter what the requested access mask
3714 says. */
3716 need_read =
3723 }
3725 }
3739 NTSTATUS status;
3741 share_mode_entry_prepare_unlock_fn_t cleanup_fn;
3742 };
3747 {
3751 /*
3752 * By default drop the g_lock again if we leave the
3753 * tdb chainlock.
3754 */
3759 lck,
3768 }
3772 /*
3773 * keep the g_lock while existing the tdb chainlock,
3774 * we we're asked to, which mean we'll keep
3775 * the share_mode_lock during object creation,
3776 * or setting delete on close.
3777 */
3779 }
3783 {
3792 }
3793 }
3797 {
3806 }
3807 }
3816 {
3822 }
3824 /* Overwritten files should be initially set as archive */
3829 }
3832 }
3835 smb_fname,
3837 parent_dir_fname,
3841 }
3843 }
3845 /****************************************************************************
3846 Open a file with a share mode. Passed in an already created files_struct *.
3847 ****************************************************************************/
3858 /* Information (FILE_EXISTS etc.) */
3864 {
3881 NTSTATUS status;
3885 NTSTATUS ulstatus;
3888 /*
3889 * Printers are handled completely differently.
3890 * Most of the passed parameters are ignored.
3891 */
3895 }
3903 }
3907 }
3914 /* Windows allows a new file to be created and
3915 silently removes a FILE_ATTRIBUTE_DIRECTORY
3916 sent by the client. Do the same. */
3920 /* We add FILE_ATTRIBUTE_ARCHIVE to this as this mode is only used if the file is
3921 * created new. */
3923 conn,
3925 smb_fname,
3927 }
3930 "access_mask=0x%x share_access=0x%x "
3931 "create_disposition = 0x%x create_options=0x%x "
3939 /* Ensure req == NULL means INTERNAL_OPEN_ONLY */
3942 /* And req != NULL means no INTERNAL_OPEN_ONLY */
3944 }
3946 /*
3947 * Only non-internal opens can be deferred at all
3948 */
3954 /* If it was an async create retry, the file
3955 didn't exist. */
3960 }
3962 /* Ensure we don't reprocess this message. */
3966 }
3967 }
3972 /*
3973 * Only use stored DOS attributes for checks
3974 * against requested attributes (below via
3975 * open_match_attributes()), cf bug #11992
3976 * for details. -slow
3977 */
3981 conn,
3986 }
3987 }
3988 }
3990 /* ignore any oplock requests if oplocks are disabled */
3993 /* Mask off everything except the private Samba bits. */
3995 }
3997 /* this is for OS/2 long file names - say we don't support them */
4000 /* OS/2 Workplace shell fix may be main code stream in a later
4001 * release. */
4006 }
4008 }
4012 /* If file exists open. If file doesn't exist error. */
4015 "requested for file %s and file "
4019 }
4023 /* If file exists overwrite. If file doesn't exist
4024 * error. */
4027 "requested for file %s and file "
4031 }
4034 }
4038 /* If file exists error. If file doesn't exist
4039 * create. */
4042 "requested for file %s and file "
4047 }
4049 }
4052 }
4059 }
4065 }
4067 }
4071 }
4075 /* We only care about matching attributes on file exists and
4076 * overwrite. */
4082 new_dos_attributes,
4087 existing_dos_attributes,
4088 new_dos_attributes,
4092 }
4093 }
4098 access_mask,
4106 }
4112 }
4115 /*
4116 * stat opens on existing files don't get oplocks.
4117 * They can get leases.
4118 *
4119 * Note that we check for stat open on the *open_access_mask*,
4120 * i.e. the access mask we actually used to do the open,
4121 * not the one the client asked for (which is in
4122 * fsp->access_mask). This is due to the fact that
4123 * FILE_OVERWRITE and FILE_OVERWRITE_IF add in O_TRUNC,
4124 * which adds FILE_WRITE_DATA to open_access_mask.
4125 */
4128 }
4129 }
4133 access_mask));
4135 /*
4136 * Note that we ignore the append flag as append does not
4137 * mean the same thing under DOS and Unix.
4138 */
4141 private_flags,
4144 /*
4145 * Currently we only look at FILE_WRITE_THROUGH for create options.
4146 */
4148 #if defined(O_SYNC)
4151 }
4156 }
4159 /*
4160 * We should really return a permission denied error if either
4161 * O_CREAT or O_TRUNC are set, but for compatibility with
4162 * older versions of Samba we just AND them out.
4163 */
4165 }
4167 /*
4168 * With kernel oplocks the open breaking an oplock
4169 * blocks until the oplock holder has given up the
4170 * oplock or closed the file. We prevent this by always
4171 * trying to open the file with O_NONBLOCK (see "man
4172 * fcntl" on Linux).
4173 *
4174 * If a process that doesn't use the smbd open files
4175 * database or communication methods holds a kernel
4176 * oplock we must periodically poll for available open
4177 * using O_NONBLOCK.
4178 */
4181 /*
4182 * Ensure we can't write on a read-only share or file.
4183 */
4193 }
4196 /*
4197 * Only try and create a file id before open
4198 * for an existing file. For a file being created
4199 * this won't do anything useful until the file
4200 * exists and has a valid stat struct.
4201 */
4203 }
4206 * requested access_mask after
4207 * the open is done. */
4210 }
4214 /* Delete on close semantics for new files. */
4216 new_dos_attributes);
4220 }
4221 }
4223 /*
4224 * Ensure we pay attention to default ACLs on directories if required.
4225 */
4230 }
4240 {
4244 };
4248 }
4252 smb_fname_atname,
4253 fsp,
4255 access_mask,
4256 open_access_mask,
4257 private_flags,
4259 }
4264 }
4268 }
4269 /*
4270 * This handles the kernel oplock case:
4271 *
4272 * the file has an active kernel oplock and the open() returned
4273 * EWOULDBLOCK/EAGAIN which maps to NETWORK_BUSY.
4274 *
4275 * "Samba locking.tdb oplocks" are handled below after acquiring
4276 * the sharemode lock with get_share_mode_lock().
4277 */
4279 }
4282 /*
4283 * EINTR from the open(2) syscall. Just setup a retry
4284 * in a bit. We can't use the sys_write() tight retry
4285 * loop here, as we might have to actually deal with
4286 * lease-break signals to avoid a deadlock.
4287 */
4289 }
4292 /*
4293 * Retry once a second. If there's a share_mode_lock
4294 * around, also wait for it in case it was smbd
4295 * holding that kernel oplock that can quickly tell us
4296 * the oplock got removed.
4297 */
4306 }
4313 }
4315 }
4318 /*
4319 * As we atomically create using O_CREAT|O_EXCL,
4320 * then if new_file_created is true, then
4321 * file_existed *MUST* have been false (even
4322 * if the file was previously detected as being
4323 * there).
4324 */
4326 }
4329 /*
4330 * The file did exist, but some other (local or NFS)
4331 * process either renamed/unlinked and re-created the
4332 * file with different dev/ino after we walked the path,
4333 * but before we did the open. We could retry the
4334 * open but it's a rare enough case it's easier to
4335 * just fail the open to prevent creating any problems
4336 * in the open file db having the wrong dev/ino key.
4337 */
4340 "Old (dev=%ju, ino=%ju). "
4341 "New (dev=%ju, ino=%ju). Failing open "
4349 }
4353 /*
4354 * Deal with the race condition where two smbd's detect the
4355 * file doesn't exist and do the create at the same time. One
4356 * of them will win and set a share mode, the other (ie. this
4357 * one) should check if the requested share mode for this
4358 * create is allowed.
4359 */
4361 /*
4362 * Now the file exists and fsp is successfully opened,
4363 * fsp->dev and fsp->inode are valid and should replace the
4364 * dev=0,inode=0 from a non existent file. Spotted by
4365 * Nadav Danieli <nadavd@exanet.com>. JRA.
4366 */
4375 }
4376 }
4378 /*
4379 * If we created a new file, overwrite an existing one
4380 * or going to delete it later, we should keep
4381 * the share_mode_lock (g_lock) until we call
4382 * share_mode_entry_prepare_unlock()
4383 */
4388 }
4401 };
4406 smb_fname,
4408 open_ntcreate_lock_add_entry,
4415 }
4421 }
4423 /*
4424 * From here we need to use 'goto unlock;' instead of return !!!
4425 */
4428 /*
4429 * Now ask for kernel oplocks
4430 * and cleanup on failure.
4431 */
4434 /*
4435 * Could not get the kernel oplock
4436 */
4438 open_ntcreate_lock_cleanup_oplock;
4440 }
4441 }
4443 /* Should we atomically (to the client at least) truncate ? */
4452 open_ntcreate_lock_cleanup_entry;
4454 }
4456 FILE_NOTIFY_CHANGE_SIZE
4459 }
4461 /*
4462 * We have the share entry *locked*.....
4463 */
4465 /* Delete streams if create_disposition requires it */
4472 open_ntcreate_lock_cleanup_entry;
4474 }
4475 }
4480 {
4482 /*
4483 * Beware: streams implementing VFS modules may
4484 * implement streams in a way that fsp will have the
4485 * basefile open in the fsp fd, so lacking a distinct
4486 * fd for the stream the file-system sharemode will
4487 * apply on the basefile which is wrong. The actual
4488 * check is deferred to the VFS module implementing
4489 * the file-system sharemode call.
4490 */
4492 share_access,
4493 access_mask);
4497 open_ntcreate_lock_cleanup_entry;
4499 }
4502 }
4504 /*
4505 * At this point onwards, we can guarantee that the share entry
4506 * is locked, whether we created the file or not, and that the
4507 * deny mode is compatible with all current opens.
4508 */
4510 /*
4511 * According to Samba4, SEC_FILE_READ_ATTRIBUTE is always granted,
4512 * but we don't have to store this - just ignore it on access check.
4513 */
4515 /*
4516 * SMB2 doesn't return it (according to Microsoft tests).
4517 * Test Case: TestSuite_ScenarioNo009GrantedAccessTestS0
4518 * File created with access = 0x7 (Read, Write, Delete)
4519 * Query Info on file returns 0x87 (Read, Write, Delete, Read Attributes)
4520 */
4523 /* But SMB1 does. */
4525 }
4529 }
4531 /* Handle strange delete on close create semantics. */
4535 existing_dos_attributes);
4538 /* Remember to delete the mode we just added. */
4540 open_ntcreate_lock_cleanup_entry;
4542 }
4543 }
4544 /* Note that here we set the *initial* delete on close flag,
4545 not the regular one. The magic gets handled in close. */
4547 }
4550 fsp,
4551 smb_fname,
4552 parent_dir_fname,
4553 info,
4554 new_dos_attributes,
4557 /* Determine sparse flag. */
4559 /* POSIX opens are sparse by default. */
4564 }
4566 /*
4567 * Take care of inherited ACLs on created files - if default ACL not
4568 * selected.
4569 */
4579 }
4580 }
4583 /*
4584 * We only get here in the case of:
4585 *
4586 * a). Not a POSIX open.
4587 * b). File already existed.
4588 * c). File was overwritten.
4589 * d). Requested DOS attributes didn't match
4590 * the DOS attributes on the existing file.
4591 *
4592 * In that case new_unx_mode has been set
4593 * equal to the calculated mode (including
4594 * possible inheritance of the mode from the
4595 * containing directory).
4596 *
4597 * Note this mode was calculated with the
4598 * DOS attribute FILE_ATTRIBUTE_ARCHIVE added,
4599 * so the mode change here is suitable for
4600 * an overwritten file.
4601 */
4610 }
4611 }
4612 }
4614 /*
4615 * Deal with other opens having a modified write time.
4616 */
4619 {
4621 }
4625 unlock:
4633 }
4638 }
4641 }
4646 {
4647 NTSTATUS status;
4650 /*
4651 * According to the MS documentation, the only time the security
4652 * descriptor is applied to the opened file is iff we *created* the
4653 * file; an existing file stays the same.
4654 *
4655 * Also, it seems (from observation) that you can open the file with
4656 * any access mask but you can still write the sd. We need to override
4657 * the granted access before we call set_sd
4658 * Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
4659 */
4669 SECINFO_GROUP|
4670 SECINFO_DACL|
4671 SECINFO_SACL)) {
4675 }
4683 }
4686 }
4690 }
4692 /* Inherit from parent. Errors here are not fatal. */
4697 }
4700 }
4703 {
4711 }
4715 }
4723 }
4727 }
4733 }
4736 }
4739 }
4743 }
4747 /*
4748 * let the caller know it's stale
4749 * and should be removed
4750 */
4752 }
4755 }
4764 {
4768 mode_t mode;
4769 NTSTATUS status;
4791 }
4798 FILE_ATTRIBUTE_DIRECTORY,
4799 smb_dname,
4801 }
4812 }
4817 }
4827 }
4831 }
4836 }
4838 /*
4839 * In order to avoid races where other clients could
4840 * see the directory before it is setup completely
4841 * we use a temporary name and rename it
4842 * when everything is ready.
4843 */
4848 smb_fname_atname);
4852 }
4856 SMBD_TMPDIR_PREFIX,
4857 idstr,
4862 }
4872 }
4878 }
4879 }
4888 mkdir_first:
4891 first_atname,
4892 mode);
4898 }
4900 /*
4901 * Make this a pathref fsp for now. open_directory() will reopen as a
4902 * full fsp.
4903 */
4911 }
4913 /* Ensure we're checking for a symlink here.... */
4914 /* We don't want to get caught by a symlink racer. */
4921 }
4928 }
4932 smb_dname,
4934 parent_dir_fname,
4936 }
4942 }
4945 /*
4946 * Check if high bits should have been set,
4947 * then (if bits are missing): add them.
4948 * Consider bits automagically set by UNIX, i.e. SGID bit from parent
4949 * dir.
4950 */
4957 }
4958 }
4960 /* Change the owner if required. */
4963 fsp);
4965 }
4973 }
4974 }
4978 fsp,
4979 sd);
4985 }
4986 }
4990 }
4992 /*
4993 * A rename needs a valid stat for the source,
4994 * see vfs_fruit.c ...
4995 */
4998 /*
4999 * We first try VFS_RENAME_HOW_NO_REPLACE,
5000 * if it's implemented in the kernel,
5001 * we'll always get EEXIST if the target
5002 * exist, as it's handled at the linux vfs
5003 * layer. But if it doesn't exist we
5004 * can still get EINVAL if the actual
5005 * filesystem doesn't support RENAME_NOREPLACE.
5006 *
5007 * If the kernel doesn't support rename2()
5008 * we get EINVAL instead of ENOSYS (this
5009 * is mapped in the libreplace replacement
5010 * (as well as the glibc replacement).
5011 */
5014 tmp_atname,
5016 smb_fname_atname,
5019 /*
5020 * This is the strategie we use without having
5021 * renameat2(RENAME_NOREPLACE):
5022 *
5023 * renameat() is able to replace a directory if the source is
5024 * also a directory.
5025 *
5026 * So in order to avoid races as much as possible we do a
5027 * mkdirat() with mode 0 in order to catch EEXIST almost
5028 * atomically, when this code runs by two processes at the same
5029 * time.
5030 *
5031 * Then a renameat() makes the temporary directory available for
5032 * clients.
5033 *
5034 * This a much smaller window where the other clients may see
5035 * the incomplete directory, which has a mode of 0.
5036 */
5045 smb_fname_atname,
5052 }
5056 tmp_atname,
5058 smb_fname_atname,
5060 }
5067 }
5071 done:
5081 do_unlink:
5084 tmp_dname);
5087 tmp_atname,
5088 AT_REMOVEDIR);
5091 tmp_dname);
5096 }
5098 restore_orig:
5102 }
5105 tmp_dname,
5106 orig_dname);
5112 }
5114 /****************************************************************************
5115 Open a directory from an NT SMB call.
5116 ****************************************************************************/
5130 {
5135 NTSTATUS status;
5139 NTSTATUS ulstatus;
5145 }
5148 /* Ensure we have a directory attribute. */
5150 }
5157 access_mask,
5158 share_access,
5159 create_options,
5160 create_disposition,
5161 file_attributes);
5166 access_mask,
5174 }
5178 SEC_PRIV_SECURITY)) {
5183 }
5190 }
5197 /* If directory exists error. If directory doesn't
5198 * exist create. */
5207 }
5211 }
5214 parent_dir_fname,
5215 smb_fname_atname,
5216 smb_dname,
5217 sd,
5218 file_attributes,
5219 fsp);
5227 }
5233 /*
5234 * If directory exists open. If directory doesn't
5235 * exist create.
5236 */
5244 }
5246 parent_dir_fname,
5247 smb_fname_atname,
5248 smb_dname,
5249 sd,
5250 file_attributes,
5251 fsp);
5257 /* Cope with create race. */
5259 NT_STATUS_OBJECT_NAME_COLLISION)) {
5265 }
5267 /*
5268 * If mkdir_internal() returned
5269 * NT_STATUS_OBJECT_NAME_COLLISION
5270 * we still must lstat the path.
5271 */
5273 conn,
5275 smb_fname_atname,
5277 AT_SYMLINK_NOFOLLOW);
5280 "directory '%s' just "
5283 smb_dname),
5286 errno);
5287 }
5290 }
5291 }
5304 }
5310 }
5312 /*
5313 * Setup the files_struct for it.
5314 */
5324 /*
5325 * According to Samba4, SEC_FILE_READ_ATTRIBUTE is always granted,
5326 */
5335 }
5337 /* Don't store old timestamps for directory
5338 handles in the internal database. We don't
5339 update them in there if new objects
5340 are created in the directory. Currently
5341 we only update timestamps on file writes.
5342 See bug #9870.
5343 */
5346 /*
5347 * Obviously for FILE_LIST_DIRECTORY we need to reopen to get an fd
5348 * usable for reading a directory. SMB2_FLUSH may be called on
5349 * directories opened with FILE_ADD_FILE and FILE_ADD_SUBDIRECTORY so
5350 * for those we need to reopen as well.
5351 */
5352 need_fd_access =
5353 FILE_LIST_DIRECTORY |
5354 FILE_ADD_FILE |
5355 FILE_ADD_SUBDIRECTORY;
5360 };
5364 smb_fname_atname,
5365 fsp,
5373 }
5374 }
5380 }
5387 }
5389 /* Ensure there was no race condition. We need to check
5390 * dev/inode but not permissions, as these can change
5391 * legitimately */
5398 }
5402 fsp,
5404 access_mask);
5412 }
5413 }
5415 /*
5416 * If we created a new directory or going to delete it later,
5417 * we should keep * the share_mode_lock (g_lock) until we call
5418 * share_mode_entry_prepare_unlock()
5419 */
5424 }
5437 };
5442 smb_dname,
5444 open_ntcreate_lock_add_entry,
5451 }
5457 }
5459 /*
5460 * From here we need to use 'goto unlock;' instead of return !!!
5461 */
5463 /* For directories the delete on close bit at open time seems
5464 always to be honored on close... See test 19 in Samba4 BASE-DELETE. */
5469 open_ntcreate_lock_cleanup_entry;
5471 }
5474 /* Note that here we set the *initial* delete on close flag,
5475 not the regular one. The magic gets handled in close. */
5477 }
5478 }
5480 /*
5481 * Deal with other opens having a modified write time.
5482 */
5485 }
5489 }
5493 unlock:
5501 }
5506 }
5509 }
5515 {
5516 NTSTATUS status;
5541 }
5544 }
5546 /****************************************************************************
5547 Receive notification that one of our open files has been renamed by another
5548 smbd process.
5549 ****************************************************************************/
5556 {
5569 }
5572 data,
5573 msg,
5574 msg,
5580 }
5586 }
5588 /* stream_name must always be NULL if there is no stream. */
5591 }
5596 NULL,
5602 }
5608 }
5611 SMB_STRUCT_STAT fsp_orig_sbuf;
5612 NTSTATUS status;
5618 /*
5619 * The incoming smb_fname here has an
5620 * invalid stat struct from synthetic_smb_fname()
5621 * above.
5622 * Preserve the existing stat from the
5623 * open fsp after fsp_set_smb_fname()
5624 * overwrites with the invalid stat.
5625 *
5626 * (We could just copy this into
5627 * smb_fname->st, but keep this code
5628 * identical to the fix in rename_open_files()
5629 * for clarity.
5630 *
5631 * We will do an fstat before returning
5632 * any of this metadata to the client anyway.
5633 */
5639 }
5642 /* TODO. JRA. */
5643 /*
5644 * Now we have the complete path we can work out if
5645 * this is actually within this share and adjust
5646 * newname accordingly.
5647 */
5655 }
5656 out:
5658 }
5660 /*
5661 * If a main file is opened for delete, all streams need to be checked for
5662 * !FILE_SHARE_DELETE. Do this by opening with DELETE_ACCESS.
5663 * If that works, delete them all by setting the delete on close and close.
5664 */
5668 {
5675 NTSTATUS status;
5682 NULL,
5683 NULL,
5690 NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
5694 }
5698 }
5702 }
5711 }
5717 }
5720 num_streams));
5725 }
5732 }
5740 }
5745 NULL,
5752 }
5761 }
5791 }
5793 }
5795 /*
5796 * don't touch the variable "status" beyond this point :-)
5797 */
5802 }
5807 }
5809 fail:
5812 }
5814 /*********************************************************************
5815 Create a default ACL by inheriting from the parent. If no inheritance
5816 from the parent available, don't set anything. This will leave the actual
5817 permissions the new file or directory already got from the filesystem
5818 as the NT ACL when read.
5819 *********************************************************************/
5822 {
5845 frame,
5850 }
5857 /* Nothing to inherit and not setting owner. */
5859 }
5861 /* Create an inherited descriptor from the parent. */
5867 }
5869 /* Inherit from parent descriptor if "inherit owner" set. */
5873 }
5881 }
5882 }
5886 {
5890 }
5891 }
5911 }
5912 }
5913 }
5933 }
5934 }
5935 }
5939 }
5943 }
5947 }
5951 }
5955 }
5961 }
5962 }
5967 parent_desc,
5968 owner_sid,
5969 group_sid,
5974 }
5976 /* If inheritable_components == false,
5977 se_create_child_secdesc()
5978 creates a security descriptor with a NULL dacl
5979 entry, but with SEC_DESC_DACL_PRESENT. We need
5980 to remove that flag. */
5985 }
5991 }
5994 /* We need to be root to force this. */
5996 }
5998 security_info_sent,
5999 psd);
6002 }
6005 }
6007 /*
6008 * If we already have a lease, it must match the new file id. [MS-SMB2]
6009 * 3.3.5.9.8 speaks about INVALID_PARAMETER if an already used lease key is
6010 * used for a different file name.
6011 */
6014 /* Input parameters. */
6020 /* Return parameters. */
6023 NTSTATUS match_status;
6024 };
6026 /*************************************************************
6027 File doesn't exist but this lease key+guid is already in use.
6029 This is only allowable in the dynamic share case where the
6030 service path must be different.
6032 There is a small race condition here in the multi-connection
6033 case where a client sends two create calls on different connections,
6034 where the file doesn't exist and one smbd creates the leases_db
6035 entry first, but this will get fixed by the multichannel cleanup
6036 when all identical client_guids get handled by a single smbd.
6037 **************************************************************/
6043 {
6051 }
6052 }
6054 /* Dynamic share case. Break leases on all other files. */
6056 num_files,
6057 files,
6061 }
6066 }
6072 {
6078 /*
6079 * Deal with name mismatch or
6080 * possible dynamic share case separately
6081 * to make code clearer.
6082 */
6084 files,
6085 state);
6087 }
6089 /* File existed. */
6095 /* Everything should be the same. */
6097 /*
6098 * The client asked for a lease on a
6099 * file that doesn't match the file_id
6100 * in the database.
6101 *
6102 * Maybe this is a dynamic share, i.e.
6103 * a share where the servicepath is
6104 * different for different users (e.g.
6105 * the [HOMES] share.
6106 *
6107 * If the servicepath is different, but the requested
6108 * file name + stream name is the same then this is
6109 * a dynamic share, the client is using the same share
6110 * name and doesn't know that the underlying servicepath
6111 * is different. It was expecting a lease on the
6112 * same file. Return NT_STATUS_OPLOCK_NOT_GRANTED
6113 * to break leases
6114 *
6115 * Otherwise the client has messed up, or is
6116 * testing our error codes, so return
6117 * NT_STATUS_INVALID_PARAMETER.
6118 */
6122 {
6123 /*
6124 * Name is the same but servicepath is
6125 * different, dynamic share. Break leases.
6126 */
6128 NT_STATUS_OPLOCK_NOT_GRANTED;
6131 NT_STATUS_INVALID_PARAMETER;
6132 }
6134 }
6138 }
6142 }
6146 }
6147 }
6150 /*
6151 * Common case - just opening another handle on a
6152 * file on a non-dynamic share.
6153 */
6155 }
6158 /* Mismatched path. Error back to client. */
6160 }
6162 /*
6163 * File id mismatch. Dynamic share case NT_STATUS_OPLOCK_NOT_GRANTED.
6164 * Don't allow leases.
6165 */
6168 num_files,
6169 files,
6173 }
6178 }
6188 };
6193 {
6197 NTSTATUS status;
6202 }
6207 }
6225 }
6229 }
6232 /*
6233 * Windows 7 and 8 lease clients are broken in that they will
6234 * not respond to lease break requests whilst waiting for an
6235 * outstanding open request on that lease handle on the same
6236 * TCP connection, due to holding an internal inode lock.
6237 *
6238 * This means we can't reschedule ourselves here, but must
6239 * return from the create.
6240 *
6241 * Work around:
6242 *
6243 * Send the breaks and then return SMB2_LEASE_NONE in the
6244 * lease handle to cause them to acknowledge the lease
6245 * break. Consultation with Microsoft engineering confirmed
6246 * this approach is safe.
6247 */
6250 }
6254 {
6260 }
6261 }
6270 {
6278 };
6280 NTSTATUS status;
6285 }
6290 /*
6291 * Not found or error means okay: We can make the lease pass
6292 */
6294 }
6296 /*
6297 * Anything but NT_STATUS_OPLOCK_NOT_GRANTED, let the caller
6298 * deal with it.
6299 */
6301 }
6303 /* We have to break all existing leases. */
6308 };
6311 /* Don't need to break our own file. */
6313 }
6318 lease_match_fid_fn,
6321 /* Race condition - file already closed. */
6323 }
6328 }
6329 }
6330 /*
6331 * Ensure we don't grant anything more so we
6332 * never upgrade.
6333 */
6335 }
6337 /*
6338 * Wrapper around open_file_ntcreate and open_directory
6339 */
6359 {
6365 NTSTATUS status;
6377 "ea_list = %p, "
6378 "sd = %p, "
6380 access_mask,
6381 file_attributes,
6382 share_access,
6383 create_disposition,
6384 create_options,
6385 oplock_request,
6386 private_flags,
6387 ea_list,
6388 sd,
6394 }
6399 }
6404 {
6406 S_IFMT);
6410 FALL_THROUGH;
6414 /*
6415 * We should never get this far with a symlink
6416 * "as such". Report as not existing.
6417 */
6423 }
6424 }
6428 }
6438 }
6441 req,
6444 smb_fname,
6448 /* Dynamic share file. No leases and update epoch... */
6456 }
6457 }
6462 /*
6463 * We can't open a file with DELETE access if any of the
6464 * streams is open without FILE_SHARE_DELETE
6465 */
6470 }
6471 }
6477 SEC_PRIV_SECURITY);
6484 }
6488 {
6489 /*
6490 * No other bits set. Windows SMB2 refuses this.
6491 * See smbtorture3 SMB2-SACL test.
6492 *
6493 * Note this is an SMB2-only behavior,
6494 * smbtorture3 SMB1-SYSTEM-SECURITY already tests
6495 * that SMB1 allows this.
6496 */
6499 }
6500 }
6502 /*
6503 * Files or directories can't be opened DELETE_ON_CLOSE without
6504 * delete access.
6505 * BUG: https://bugzilla.samba.org/show_bug.cgi?id=13358
6506 */
6511 }
6515 {
6524 }
6533 }
6541 }
6543 /*
6544 * We may be creating the basefile as part of creating the
6545 * stream, so it's legal if the basefile doesn't exist at this
6546 * point, the create_file_unixpath() below will create it. But
6547 * if the basefile exists we want a handle so we can fstat() it.
6548 */
6555 }
6558 smb_fname_base);
6565 }
6567 /*
6568 * https://bugzilla.samba.org/show_bug.cgi?id=10229
6569 * We need to check if the requested access mask
6570 * could be used to open the underlying file (if
6571 * it existed), as we're passing in zero for the
6572 * access mask to the base filename.
6573 */
6575 access_mask);
6579 "for base %s failed: "
6584 }
6585 }
6589 /* Open the base file. */
6591 NULL,
6592 dirfsp,
6593 smb_fname_base,
6595 FILE_SHARE_READ
6596 | FILE_SHARE_WRITE
6598 base_create_disposition,
6602 NULL,
6604 base_privflags,
6605 NULL,
6606 NULL,
6608 NULL);
6616 }
6617 }
6623 /*
6624 * We're about to use smb_fname->fsp for the fresh open.
6625 *
6626 * Every fsp passed in via smb_fname->fsp already
6627 * holds a fsp->fsp_name. If it is already this
6628 * fsp->fsp_name that we got passed in as our input
6629 * argument smb_fname, these two are assumed to have
6630 * the same lifetime: Every fsp hangs of "conn", and
6631 * fsp->fsp_name is its talloc child.
6632 */
6635 /*
6636 * "smb_fname" is temporary in this case, but
6637 * the destructor of smb_fname would also tear
6638 * down the fsp we're about to use. Unlink
6639 * them from each other.
6640 */
6643 /*
6644 * "fsp" is ours now
6645 */
6647 }
6652 }
6661 }
6663 /*
6664 * No fsp passed in that we can use, create one
6665 */
6669 }
6675 }
6676 }
6682 /*
6683 * We're opening the stream element of a
6684 * base_fsp we already opened. Set up the
6685 * base_fsp pointer.
6686 */
6688 }
6692 conn,
6694 smb_fname,
6699 }
6701 /*
6702 * Get a pathref on the parent. We can re-use this for
6703 * multiple calls to check parent ACLs etc. to avoid
6704 * pathname calls.
6705 */
6708 smb_fname,
6713 }
6719 }
6720 }
6722 /*
6723 * If it's a request for a directory open, deal with it separately.
6724 */
6731 }
6733 /* Can't open a temp directory. IFS kit test. */
6738 }
6740 /*
6741 * We will get a create directory here if the Win32
6742 * app specified a security descriptor in the
6743 * CreateDirectory() call.
6744 */
6748 req,
6749 access_mask,
6750 share_access,
6751 create_disposition,
6752 create_options,
6753 file_attributes,
6755 smb_fname_atname,
6756 sd,
6758 fsp);
6761 /*
6762 * Ordinary file case.
6763 */
6767 allocation_size);
6768 }
6771 req,
6772 access_mask,
6773 share_access,
6774 create_disposition,
6775 create_options,
6776 file_attributes,
6777 oplock_request,
6778 lease,
6779 private_flags,
6781 smb_fname_atname,
6783 fsp);
6786 /* A stream open never opens a directory */
6791 }
6793 /*
6794 * Fail the open if it was explicitly a non-directory
6795 * file.
6796 */
6801 }
6805 req,
6806 access_mask,
6807 share_access,
6808 create_disposition,
6809 create_options,
6810 file_attributes,
6812 smb_fname_atname,
6813 sd,
6815 fsp);
6816 }
6817 }
6821 }
6830 }
6831 }
6835 {
6838 }
6840 /* Save the requested allocation size. */
6844 {
6851 }
6855 }
6858 }
6869 }
6870 }
6876 COMPRESSION_FORMAT_NONE);
6880 }
6881 }
6888 }
6896 fail:
6900 /*
6901 * The close_file below will close
6902 * fsp->base_fsp.
6903 */
6909 }
6910 }
6913 }
6918 }
6939 {
6942 NTSTATUS status;
6947 " file_attributes = 0x%" PRIu32
6948 " share_access = 0x%" PRIu32
6949 " create_disposition = 0x%" PRIu32
6950 " create_options = 0x%" PRIu32
6951 " oplock_request = 0x%" PRIu32
6952 " private_flags = 0x%" PRIu32
6954 access_mask,
6955 file_attributes,
6956 share_access,
6957 create_disposition,
6958 create_options,
6959 oplock_request,
6960 private_flags,
6961 ea_list,
6962 sd,
6966 /*
6967 * Remember the absolute time of the original request
6968 * with this mid. We'll use it later to see if this
6969 * has timed out.
6970 */
6972 }
6974 /*
6975 * Check to see if this is a mac fork of some kind.
6976 */
6986 /*
6987 * Here we go! support for changing the disk quotas
6988 * --metze
6989 *
6990 * We need to fake up to open this MAGIC QUOTA file
6991 * and return a valid FID.
6992 *
6993 * w2k close this file directly after opening xp
6994 * also tries a QUERY_FILE_INFO on the file and then
6995 * close it
6996 */
7002 }
7006 }
7011 }
7012 }
7016 /* We have to handle this error here. */
7020 }
7025 }
7026 }
7038 }
7043 wire_mode_bits,
7047 }
7052 }
7053 /*
7054 * Remove type info from mode, leaving only the
7055 * permissions and setuid/gid bits.
7056 */
7060 }
7063 req,
7064 dirfsp,
7065 smb_fname,
7066 access_mask,
7067 share_access,
7068 create_disposition,
7069 create_options,
7070 file_attributes,
7071 oplock_request,
7072 lease,
7073 allocation_size,
7074 private_flags,
7075 sd,
7076 ea_list,
7081 }
7083 done:
7089 }
7092 fail:
7097 }
7099 }