fs/cifs/cifsacl.c

   1 /*
   2  *   fs/cifs/cifsacl.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2007
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *
   7  *   Contains the routines for mapping CIFS/NTFS ACLs
   8  *
   9  *   This library is free software; you can redistribute it and/or modify
  10  *   it under the terms of the GNU Lesser General Public License as published
  11  *   by the Free Software Foundation; either version 2.1 of the License, or
  12  *   (at your option) any later version.
  13  *
  14  *   This library is distributed in the hope that it will be useful,
  15  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  17  *   the GNU Lesser General Public License for more details.
  18  *
  19  *   You should have received a copy of the GNU Lesser General Public License
  20  *   along with this library; if not, write to the Free Software
  21  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  22  */
  23
  24 #include <linux/fs.h>
  25 #include "cifspdu.h"
  26 #include "cifsglob.h"
  27 #include "cifsacl.h"
  28 #include "cifsproto.h"
  29 #include "cifs_debug.h"
  30
  31
  32 #ifdef CONFIG_CIFS_EXPERIMENTAL
  33
  34 static struct cifs_wksid wksidarr[NUM_WK_SIDS] = {
  35         {{1, 0, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0} }, "null user"},
  36         {{1, 1, {0, 0, 0, 0, 0, 1}, {0, 0, 0, 0, 0} }, "nobody"},
  37         {{1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(11), 0, 0, 0, 0} }, "net-users"},
  38         {{1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(18), 0, 0, 0, 0} }, "sys"},
  39         {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(544), 0, 0, 0} }, "root"},
  40         {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(545), 0, 0, 0} }, "users"},
  41         {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(546), 0, 0, 0} }, "guest"} }
  42 ;
  43
  44
  45 /* security id for everyone */
  46 static const struct cifs_sid sid_everyone = {
  47         1, 1, {0, 0, 0, 0, 0, 1}, {0} };
  48 /* group users */
  49 static const struct cifs_sid sid_user =
  50                 {1, 2 , {0, 0, 0, 0, 0, 5}, {} };
  51
  52
  53 int match_sid(struct cifs_sid *ctsid)
  54 {
  55         int i, j;
  56         int num_subauth, num_sat, num_saw;
  57         struct cifs_sid *cwsid;
  58
  59         if (!ctsid)
  60                 return (-1);
  61
  62         for (i = 0; i < NUM_WK_SIDS; ++i) {
  63                 cwsid = &(wksidarr[i].cifssid);
  64
  65                 /* compare the revision */
  66                 if (ctsid->revision != cwsid->revision)
  67                         continue;
  68
  69                 /* compare all of the six auth values */
  70                 for (j = 0; j < 6; ++j) {
  71                         if (ctsid->authority[j] != cwsid->authority[j])
  72                                 break;
  73                 }
  74                 if (j < 6)
  75                         continue; /* all of the auth values did not match */
  76
  77                 /* compare all of the subauth values if any */
  78                 num_sat = ctsid->num_subauth;
  79                 num_saw = cwsid->num_subauth;
  80                 num_subauth = num_sat < num_saw ? num_sat : num_saw;
  81                 if (num_subauth) {
  82                         for (j = 0; j < num_subauth; ++j) {
  83                                 if (ctsid->sub_auth[j] != cwsid->sub_auth[j])
  84                                         break;
  85                         }
  86                         if (j < num_subauth)
  87                                 continue; /* all sub_auth values do not match */
  88                 }
  89
  90                 cFYI(1, ("matching sid: %s\n", wksidarr[i].sidname));
  91                 return (0); /* sids compare/match */
  92         }
  93
  94         cFYI(1, ("No matching sid"));
  95         return (-1);
  96 }
  97
  98 /* if the two SIDs (roughly equivalent to a UUID for a user or group) are
  99    the same returns 1, if they do not match returns 0 */
 100 int compare_sids(const struct cifs_sid *ctsid, const struct cifs_sid *cwsid)
 101 {
 102         int i;
 103         int num_subauth, num_sat, num_saw;
 104
 105         if ((!ctsid) || (!cwsid))
 106                 return (0);
 107
 108         /* compare the revision */
 109         if (ctsid->revision != cwsid->revision)
 110                 return (0);
 111
 112         /* compare all of the six auth values */
 113         for (i = 0; i < 6; ++i) {
 114                 if (ctsid->authority[i] != cwsid->authority[i])
 115                         return (0);
 116         }
 117
 118         /* compare all of the subauth values if any */
 119         num_sat = ctsid->num_subauth;
 120         num_saw = cwsid->num_subauth;
 121         num_subauth = num_sat < num_saw ? num_sat : num_saw;
 122         if (num_subauth) {
 123                 for (i = 0; i < num_subauth; ++i) {
 124                         if (ctsid->sub_auth[i] != cwsid->sub_auth[i])
 125                                 return (0);
 126                 }
 127         }
 128
 129         return (1); /* sids compare/match */
 130 }
 131
 132 /*
 133    change posix mode to reflect permissions
 134    pmode is the existing mode (we only want to overwrite part of this
 135    bits to set can be: S_IRWXU, S_IRWXG or S_IRWXO ie 00700 or 00070 or 00007
 136 */
 137 static void access_flags_to_mode(__u32 ace_flags, int type, umode_t *pmode,
 138                                  umode_t *pbits_to_set)
 139 {
 140         /* the order of ACEs is important.  The canonical order is to begin with
 141            DENY entries followed by ALLOW, otherwise an allow entry could be
 142            encountered first, making the subsequent deny entry like "dead code"
 143            which would be superflous since Windows stops when a match is made
 144            for the operation you are trying to perform for your user */
 145
 146         /* For deny ACEs we change the mask so that subsequent allow access
 147            control entries do not turn on the bits we are denying */
 148         if (type == ACCESS_DENIED) {
 149                 if (ace_flags & GENERIC_ALL) {
 150                         *pbits_to_set &= ~S_IRWXUGO;
 151                 }
 152                 if ((ace_flags & GENERIC_WRITE) ||
 153                         ((ace_flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS))
 154                         *pbits_to_set &= ~S_IWUGO;
 155                 if ((ace_flags & GENERIC_READ) ||
 156                         ((ace_flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS))
 157                         *pbits_to_set &= ~S_IRUGO;
 158                 if ((ace_flags & GENERIC_EXECUTE) ||
 159                         ((ace_flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS))
 160                         *pbits_to_set &= ~S_IXUGO;
 161                 return;
 162         } else if (type != ACCESS_ALLOWED) {
 163                 cERROR(1, ("unknown access control type %d", type));
 164                 return;
 165         }
 166         /* else ACCESS_ALLOWED type */
 167
 168         if (ace_flags & GENERIC_ALL) {
 169                 *pmode |= (S_IRWXUGO & (*pbits_to_set));
 170 #ifdef CONFIG_CIFS_DEBUG2
 171                 cFYI(1, ("all perms"));
 172 #endif
 173                 return;
 174         }
 175         if ((ace_flags & GENERIC_WRITE) ||
 176                         ((ace_flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS))
 177                 *pmode |= (S_IWUGO & (*pbits_to_set));
 178         if ((ace_flags & GENERIC_READ) ||
 179                         ((ace_flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS))
 180                 *pmode |= (S_IRUGO & (*pbits_to_set));
 181         if ((ace_flags & GENERIC_EXECUTE) ||
 182                         ((ace_flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS))
 183                 *pmode |= (S_IXUGO & (*pbits_to_set));
 184
 185 #ifdef CONFIG_CIFS_DEBUG2
 186         cFYI(1, ("access flags 0x%x mode now 0x%x", ace_flags, *pmode));
 187 #endif
 188         return;
 189 }
 190
 191 /*
 192    Generate access flags to reflect permissions mode is the existing mode.
 193    This function is called for every ACE in the DACL whose SID matches
 194    with either owner or group or everyone.
 195 */
 196
 197 static void mode_to_access_flags(umode_t mode, umode_t bits_to_use,
 198                                 __u32 *pace_flags)
 199 {
 200         /* reset access mask */
 201         *pace_flags = 0x0;
 202
 203         /* bits to use are either S_IRWXU or S_IRWXG or S_IRWXO */
 204         mode &= bits_to_use;
 205
 206         /* check for R/W/X UGO since we do not know whose flags
 207            is this but we have cleared all the bits sans RWX for
 208            either user or group or other as per bits_to_use */
 209         if (mode & S_IRUGO)
 210                 *pace_flags |= SET_FILE_READ_RIGHTS;
 211         if (mode & S_IWUGO)
 212                 *pace_flags |= SET_FILE_WRITE_RIGHTS;
 213         if (mode & S_IXUGO)
 214                 *pace_flags |= SET_FILE_EXEC_RIGHTS;
 215
 216 #ifdef CONFIG_CIFS_DEBUG2
 217         cFYI(1, ("mode: 0x%x, access flags now 0x%x", mode, *pace_flags));
 218 #endif
 219         return;
 220 }
 221
 222
 223 #ifdef CONFIG_CIFS_DEBUG2
 224 static void dump_ace(struct cifs_ace *pace, char *end_of_acl)
 225 {
 226         int num_subauth;
 227
 228         /* validate that we do not go past end of acl */
 229
 230         if (le16_to_cpu(pace->size) < 16) {
 231                 cERROR(1, ("ACE too small, %d", le16_to_cpu(pace->size)));
 232                 return;
 233         }
 234
 235         if (end_of_acl < (char *)pace + le16_to_cpu(pace->size)) {
 236                 cERROR(1, ("ACL too small to parse ACE"));
 237                 return;
 238         }
 239
 240         num_subauth = pace->sid.num_subauth;
 241         if (num_subauth) {
 242                 int i;
 243                 cFYI(1, ("ACE revision %d num_auth %d type %d flags %d size %d",
 244                         pace->sid.revision, pace->sid.num_subauth, pace->type,
 245                         pace->flags, pace->size));
 246                 for (i = 0; i < num_subauth; ++i) {
 247                         cFYI(1, ("ACE sub_auth[%d]: 0x%x", i,
 248                                 le32_to_cpu(pace->sid.sub_auth[i])));
 249                 }
 250
 251                 /* BB add length check to make sure that we do not have huge
 252                         num auths and therefore go off the end */
 253         }
 254
 255         return;
 256 }
 257 #endif
 258
 259
 260 static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
 261                        struct cifs_sid *pownersid, struct cifs_sid *pgrpsid,
 262                        struct inode *inode)
 263 {
 264         int i;
 265         int num_aces = 0;
 266         int acl_size;
 267         char *acl_base;
 268         struct cifs_ace **ppace;
 269
 270         /* BB need to add parm so we can store the SID BB */
 271
 272         /* validate that we do not go past end of acl */
 273         if (end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size)) {
 274                 cERROR(1, ("ACL too small to parse DACL"));
 275                 return;
 276         }
 277
 278 #ifdef CONFIG_CIFS_DEBUG2
 279         cFYI(1, ("DACL revision %d size %d num aces %d",
 280                 le16_to_cpu(pdacl->revision), le16_to_cpu(pdacl->size),
 281                 le32_to_cpu(pdacl->num_aces)));
 282 #endif
 283
 284         /* reset rwx permissions for user/group/other.
 285            Also, if num_aces is 0 i.e. DACL has no ACEs,
 286            user/group/other have no permissions */
 287         inode->i_mode &= ~(S_IRWXUGO);
 288
 289         if (!pdacl) {
 290                 /* no DACL in the security descriptor, set
 291                    all the permissions for user/group/other */
 292                 inode->i_mode |= S_IRWXUGO;
 293                 return;
 294         }
 295         acl_base = (char *)pdacl;
 296         acl_size = sizeof(struct cifs_acl);
 297
 298         num_aces = le32_to_cpu(pdacl->num_aces);
 299         if (num_aces  > 0) {
 300                 umode_t user_mask = S_IRWXU;
 301                 umode_t group_mask = S_IRWXG;
 302                 umode_t other_mask = S_IRWXO;
 303
 304                 ppace = kmalloc(num_aces * sizeof(struct cifs_ace *),
 305                                 GFP_KERNEL);
 306
 307 /*              cifscred->cecount = pdacl->num_aces;
 308                 cifscred->aces = kmalloc(num_aces *
 309                         sizeof(struct cifs_ace *), GFP_KERNEL);*/
 310
 311                 for (i = 0; i < num_aces; ++i) {
 312                         ppace[i] = (struct cifs_ace *) (acl_base + acl_size);
 313 #ifdef CONFIG_CIFS_DEBUG2
 314                         dump_ace(ppace[i], end_of_acl);
 315 #endif
 316                         if (compare_sids(&(ppace[i]->sid), pownersid))
 317                                 access_flags_to_mode(ppace[i]->access_req,
 318                                                      ppace[i]->type,
 319                                                      &(inode->i_mode),
 320                                                      &user_mask);
 321                         if (compare_sids(&(ppace[i]->sid), pgrpsid))
 322                                 access_flags_to_mode(ppace[i]->access_req,
 323                                                      ppace[i]->type,
 324                                                      &(inode->i_mode),
 325                                                      &group_mask);
 326                         if (compare_sids(&(ppace[i]->sid), &sid_everyone))
 327                                 access_flags_to_mode(ppace[i]->access_req,
 328                                                      ppace[i]->type,
 329                                                      &(inode->i_mode),
 330                                                      &other_mask);
 331
 332 /*                      memcpy((void *)(&(cifscred->aces[i])),
 333                                 (void *)ppace[i],
 334                                 sizeof(struct cifs_ace)); */
 335
 336                         acl_base = (char *)ppace[i];
 337                         acl_size = le16_to_cpu(ppace[i]->size);
 338                 }
 339
 340                 kfree(ppace);
 341         }
 342
 343         return;
 344 }
 345
 346
 347 static int parse_sid(struct cifs_sid *psid, char *end_of_acl)
 348 {
 349         /* BB need to add parm so we can store the SID BB */
 350
 351         /* validate that we do not go past end of ACL - sid must be at least 8
 352            bytes long (assuming no sub-auths - e.g. the null SID */
 353         if (end_of_acl < (char *)psid + 8) {
 354                 cERROR(1, ("ACL too small to parse SID %p", psid));
 355                 return -EINVAL;
 356         }
 357
 358         if (psid->num_subauth) {
 359 #ifdef CONFIG_CIFS_DEBUG2
 360                 int i;
 361                 cFYI(1, ("SID revision %d num_auth %d",
 362                         psid->revision, psid->num_subauth));
 363
 364                 for (i = 0; i < psid->num_subauth; i++) {
 365                         cFYI(1, ("SID sub_auth[%d]: 0x%x ", i,
 366                                 le32_to_cpu(psid->sub_auth[i])));
 367                 }
 368
 369                 /* BB add length check to make sure that we do not have huge
 370                         num auths and therefore go off the end */
 371                 cFYI(1, ("RID 0x%x",
 372                         le32_to_cpu(psid->sub_auth[psid->num_subauth-1])));
 373 #endif
 374         }
 375
 376         return 0;
 377 }
 378
 379
 380 /* Convert CIFS ACL to POSIX form */
 381 static int parse_sec_desc(struct cifs_ntsd *pntsd, int acl_len,
 382                           struct inode *inode)
 383 {
 384         int rc;
 385         struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
 386         struct cifs_acl *dacl_ptr; /* no need for SACL ptr */
 387         char *end_of_acl = ((char *)pntsd) + acl_len;
 388         __u32 dacloffset;
 389
 390         if ((inode == NULL) || (pntsd == NULL))
 391                 return -EIO;
 392
 393         owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
 394                                 le32_to_cpu(pntsd->osidoffset));
 395         group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
 396                                 le32_to_cpu(pntsd->gsidoffset));
 397         dacloffset = le32_to_cpu(pntsd->dacloffset);
 398         dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset);
 399 #ifdef CONFIG_CIFS_DEBUG2
 400         cFYI(1, ("revision %d type 0x%x ooffset 0x%x goffset 0x%x "
 401                  "sacloffset 0x%x dacloffset 0x%x",
 402                  pntsd->revision, pntsd->type, le32_to_cpu(pntsd->osidoffset),
 403                  le32_to_cpu(pntsd->gsidoffset),
 404                  le32_to_cpu(pntsd->sacloffset), dacloffset));
 405 #endif
 406 /*      cifs_dump_mem("owner_sid: ", owner_sid_ptr, 64); */
 407         rc = parse_sid(owner_sid_ptr, end_of_acl);
 408         if (rc)
 409                 return rc;
 410
 411         rc = parse_sid(group_sid_ptr, end_of_acl);
 412         if (rc)
 413                 return rc;
 414
 415         if (dacloffset)
 416                 parse_dacl(dacl_ptr, end_of_acl, owner_sid_ptr,
 417                            group_sid_ptr, inode);
 418         else
 419                 cFYI(1, ("no ACL")); /* BB grant all or default perms? */
 420
 421 /*      cifscred->uid = owner_sid_ptr->rid;
 422         cifscred->gid = group_sid_ptr->rid;
 423         memcpy((void *)(&(cifscred->osid)), (void *)owner_sid_ptr,
 424                         sizeof(struct cifs_sid));
 425         memcpy((void *)(&(cifscred->gsid)), (void *)group_sid_ptr,
 426                         sizeof(struct cifs_sid)); */
 427
 428
 429         return (0);
 430 }
 431
 432
 433 /* Retrieve an ACL from the server */
 434 static struct cifs_ntsd *get_cifs_acl(u32 *pacllen, struct inode *inode,
 435                                        const char *path)
 436 {
 437         struct cifsFileInfo *open_file;
 438         int unlock_file = FALSE;
 439         int xid;
 440         int rc = -EIO;
 441         __u16 fid;
 442         struct super_block *sb;
 443         struct cifs_sb_info *cifs_sb;
 444         struct cifs_ntsd *pntsd = NULL;
 445
 446         cFYI(1, ("get mode from ACL for %s", path));
 447
 448         if (inode == NULL)
 449                 return NULL;
 450
 451         xid = GetXid();
 452         open_file = find_readable_file(CIFS_I(inode));
 453         sb = inode->i_sb;
 454         if (sb == NULL) {
 455                 FreeXid(xid);
 456                 return NULL;
 457         }
 458         cifs_sb = CIFS_SB(sb);
 459
 460         if (open_file) {
 461                 unlock_file = TRUE;
 462                 fid = open_file->netfid;
 463         } else {
 464                 int oplock = FALSE;
 465                 /* open file */
 466                 rc = CIFSSMBOpen(xid, cifs_sb->tcon, path, FILE_OPEN,
 467                                 READ_CONTROL, 0, &fid, &oplock, NULL,
 468                                 cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
 469                                         CIFS_MOUNT_MAP_SPECIAL_CHR);
 470                 if (rc != 0) {
 471                         cERROR(1, ("Unable to open file to get ACL"));
 472                         FreeXid(xid);
 473                         return NULL;
 474                 }
 475         }
 476
 477         rc = CIFSSMBGetCIFSACL(xid, cifs_sb->tcon, fid, &pntsd, pacllen);
 478         cFYI(1, ("GetCIFSACL rc = %d ACL len %d", rc, *pacllen));
 479         if (unlock_file == TRUE)
 480                 atomic_dec(&open_file->wrtPending);
 481         else
 482                 CIFSSMBClose(xid, cifs_sb->tcon, fid);
 483
 484         FreeXid(xid);
 485         return pntsd;
 486 }
 487
 488 /* Translate the CIFS ACL (simlar to NTFS ACL) for a file into mode bits */
 489 void acl_to_uid_mode(struct inode *inode, const char *path)
 490 {
 491         struct cifs_ntsd *pntsd = NULL;
 492         u32 acllen = 0;
 493         int rc = 0;
 494
 495 #ifdef CONFIG_CIFS_DEBUG2
 496         cFYI(1, ("converting ACL to mode for %s", path));
 497 #endif
 498         pntsd = get_cifs_acl(&acllen, inode, path);
 499
 500         /* if we can retrieve the ACL, now parse Access Control Entries, ACEs */
 501         if (pntsd)
 502                 rc = parse_sec_desc(pntsd, acllen, inode);
 503         if (rc)
 504                 cFYI(1, ("parse sec desc failed rc = %d", rc));
 505
 506         kfree(pntsd);
 507         return;
 508 }
 509
 510 /* Convert mode bits to an ACL so we can update the ACL on the server */
 511 int mode_to_acl(struct inode *inode, const char *path)
 512 {
 513         int rc = 0;
 514         __u32 acllen = 0;
 515         struct cifs_ntsd *pntsd = NULL;
 516
 517         cFYI(1, ("set ACL from mode for %s", path));
 518
 519         /* Get the security descriptor */
 520         pntsd = get_cifs_acl(&acllen, inode, path);
 521
 522         /* Add/Modify the three ACEs for owner, group, everyone
 523            while retaining the other ACEs */
 524
 525         /* Set the security descriptor */
 526
 527
 528         kfree(pntsd);
 529         return rc;
 530 }
 531 #endif /* CONFIG_CIFS_EXPERIMENTAL */