[SCM] Samba Shared Repository - branch master updated

Andrew Bartlett abartlet at samba.org
Mon Feb 4 06:11:04 MST 2013


The branch, master has been updated
       via  4c1527b s3:modules remove gpfs_getacl_alloc
       via  18bfcac s3:modules use vfs_gpfs_getacl in gpfsacl_get_posix_acl
       via  5388773 s3:modules use vfs_gpfs_getacl in gpfsacl_set_nt_acl_internal
       via  16940d8 s3:modules use vfs_gpfs_getacl in gpfs_get_nfs4_acl
       via  940b7ec s3:torture/vfstest add memreport option
       via  8e571fd s3:torture/vfstest implement sys_acl_blob_get_fd
       via  de67655 s3:torture/vfstest implement sys_acl_blob_get_file
       via  0621991 s3:vfs_gpfs use non_posix_sys_acl_blob_get_*_helper
       via  f1ff845 s3:vfs_gpfs add a generic vfs_gpfs_getacl function
       via  d9075e1 s3:modules/vfs_gpfs add GPFS_GETACL_NATIVE define
       via  b4be8d5 s3:modules/non_posix_acls: only stat if we do not have it cached
       via  7cd91ca s3:autoconf add non_posix_acls to NFS4ACL_OBJ
       via  ea6ac28 s3:autoconf introduce NFS4ACL_OBJ
       via  d7ad24a s3-waf:modules add non_posix_acls dependency to vfs_gpfs
       via  2a2dbf8 vfs: Add helper function for non posix ACL modules
       via  e650a5f idl: Provide a common wrapper for the data to hash for a non-POSIX ACL
       via  a133a98 selftest: add a test that demonstrates how new ACL blob code helps
       via  f0e49b0 vfs_acl_common: Do not fetch the underlying NT ACL unless we need it
       via  4e8c895 vfs: Whitespace fix only to get_nt_acl_internal indentation
       via  25526ed vfs: Implement an improved vfs_acl_common that uses the hash of the system ACL
       via  6a5f65b vfs: Add helper function hash_blob_sha256 to vfs_acl_common.c
      from  5a8e049 Fix typo in warning message

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 4c1527b1ce26759dbb7470b23f9f83a391d99b30
Author: Christian Ambach <ambi at samba.org>
Date:   Tue Jan 8 17:10:27 2013 +0100

    s3:modules remove gpfs_getacl_alloc
    
    last caller has gone
    
    Signed-off-by: Christian Ambach <ambi at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>
    
    Autobuild-User(master): Andrew Bartlett <abartlet at samba.org>
    Autobuild-Date(master): Mon Feb  4 14:10:08 CET 2013 on sn-devel-104

commit 18bfcac810bed431d0ca33ad02508fd87df1c626
Author: Christian Ambach <ambi at samba.org>
Date:   Tue Jan 8 17:10:10 2013 +0100

    s3:modules use vfs_gpfs_getacl in gpfsacl_get_posix_acl
    
    as preparation to remove gpfs_getacl_alloc()
    
    Signed-off-by: Christian Ambach <ambi at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

commit 5388773d4baf902d8dd70d046cacc5a15fa790d7
Author: Christian Ambach <ambi at samba.org>
Date:   Tue Jan 8 17:07:09 2013 +0100

    s3:modules use vfs_gpfs_getacl in gpfsacl_set_nt_acl_internal
    
    as preparation to remove gpfs_getacl_alloc()
    
    Signed-off-by: Christian Ambach <ambi at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

commit 16940d8a8ecb46a6de9cf5c83da7d2f54030777b
Author: Christian Ambach <ambi at samba.org>
Date:   Tue Jan 8 16:54:16 2013 +0100

    s3:modules use vfs_gpfs_getacl in gpfs_get_nfs4_acl
    
    as preparation to remove gpfs_getacl_alloc()
    
    Signed-off-by: Christian Ambach <ambi at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

commit 940b7ec78c50c41a399bee2775cd008618baf8f8
Author: Christian Ambach <ambi at samba.org>
Date:   Fri Nov 16 22:58:06 2012 +0100

    s3:torture/vfstest add memreport option
    
    this will run a talloc_report_full on the talloc stackframe after each command
    
    Signed-off-by: Christian Ambach <ambi at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

commit 8e571fd385334bc12ee5c5bdfd32b31ad2c4b4b8
Author: Christian Ambach <ambi at samba.org>
Date:   Thu Nov 15 15:25:52 2012 +0100

    s3:torture/vfstest implement sys_acl_blob_get_fd
    
    Signed-off-by: Christian Ambach <ambi at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

commit de676555ab882bd110a2649555645d58abe2bfeb
Author: Christian Ambach <ambi at samba.org>
Date:   Thu Nov 15 15:19:07 2012 +0100

    s3:torture/vfstest implement sys_acl_blob_get_file
    
    Signed-off-by: Christian Ambach <ambi at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

commit 06219913abc4f1c3912b377b4a9521a11ad45886
Author: Christian Ambach <ambi at samba.org>
Date:   Tue Oct 30 13:44:40 2012 +0100

    s3:vfs_gpfs use non_posix_sys_acl_blob_get_*_helper
    
    use the helper functions to return the blob based on the
    raw GPFS ACL blob (if it is a NFSv4 ACL). If not, fall back
    to the POSIX ACL code
    
    Signed-off-by: Christian Ambach <ambi at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

commit f1ff845720604fc32788a59ec9a1a128135efe35
Author: Christian Ambach <ambi at samba.org>
Date:   Mon Nov 5 19:26:57 2012 +0100

    s3:vfs_gpfs add a generic vfs_gpfs_getacl function
    
    in contrast to gpfs_getacl_alloc which always puts the
    ACL on talloc_tos(), this one allows to specify the memory
    context and if the caller is interested in the raw ACL blob
    or a structured version
    
    Signed-off-by: Christian Ambach <ambi at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

commit d9075e19ca8c788824208ee1d77ad5861fe778ed
Author: Christian Ambach <ambi at samba.org>
Date:   Tue Jan 8 15:15:02 2013 +0100

    s3:modules/vfs_gpfs add GPFS_GETACL_NATIVE define
    
    this is not in the official GPFS header file, but can be found
    in the GPL'd kernel module sources
    
    Signed-off-by: Christian Ambach <ambi at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

commit b4be8d5073c0476f1220569f7151f267a5c39635
Author: Christian Ambach <ambi at samba.org>
Date:   Tue Oct 30 13:43:59 2012 +0100

    s3:modules/non_posix_acls: only stat if we do not have it cached
    
    most probably we already have the stat() information
    
    Signed-off-by: Christian Ambach <ambi at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

commit 7cd91ca0c4acdb8ae1e5d5319d9d934d74ff4c74
Author: Christian Ambach <ambi at samba.org>
Date:   Tue Oct 30 10:47:22 2012 +0100

    s3:autoconf add non_posix_acls to NFS4ACL_OBJ
    
    Signed-off-by: Christian Ambach <ambi at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

commit ea6ac284cb974b0443000aa75b36d20d0d6814d8
Author: Christian Ambach <ambi at samba.org>
Date:   Tue Oct 30 10:45:23 2012 +0100

    s3:autoconf introduce NFS4ACL_OBJ
    
    use a definition instead of listing it separately
    
    Signed-off-by: Christian Ambach <ambi at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

commit d7ad24a3e7e498ec1e4cff1093f85116846397f6
Author: Christian Ambach <ambi at samba.org>
Date:   Tue Jan 8 17:56:50 2013 +0100

    s3-waf:modules add non_posix_acls dependency to vfs_gpfs
    
    Signed-off-by: Christian Ambach <ambi at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

commit 2a2dbf825972bfa16ae5dbe93e458de348571684
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Wed Oct 24 22:39:59 2012 +1100

    vfs: Add helper function for non posix ACL modules
    
    This handles the stat, and fills in the pre-supplied blob into a
    wrapper sturcture that can then be returned to vfs_acl_common for
    hashing.
    
    Andrew Bartlett
    
    Signed-off-by: Andrew Bartlett <abartlet at samba.org>
    Reviewed-by: Christian Ambach <ambi at samba.org>

commit e650a5fd61d7925888e3abf0a561af5a9a23f00b
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Wed Oct 24 17:06:33 2012 +1100

    idl: Provide a common wrapper for the data to hash for a non-POSIX ACL
    
    Signed-off-by: Andrew Bartlett <abartlet at samba.org>
    Reviewed-by: Christian Ambach <ambi at samba.org>

commit a133a989c319bfba18ea8b204716d8e362e28f80
Author: Christian Ambach <ambi at samba.org>
Date:   Wed Jan 30 11:00:48 2013 +0100

    selftest: add a test that demonstrates how new ACL blob code helps
    
    this test shows that a change to POSIX ACL->SD mapping behavior does not invalidate the stored SD
    
    Signed-off-by: Christian Ambach <ambi at samba.org>
    
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

commit f0e49b015bfcb021aea61615185d9da57538c68d
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Wed Oct 24 17:03:41 2012 +1100

    vfs_acl_common: Do not fetch the underlying NT ACL unless we need it
    
    This avoids asking for the posix ACL on disk twice, and avoids running
    a good deal of mapping code if it is not needed.
    
    Andrew Bartlett
    
    Signed-off-by: Andrew Bartlett <abartlet at samba.org>
    Reviewed-by: Christian Ambach <ambi at samba.org>

commit 4e8c8952ad8f4d1d658b947da2f1264bfeff8fdf
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Mon Jan 21 12:45:14 2013 +1100

    vfs: Whitespace fix only to get_nt_acl_internal indentation
    
    Signed-off-by: Andrew Bartlett <abartlet at samba.org>
    Reviewed-by: Christian Ambach <ambi at samba.org>

commit 25526ed3f590e4fa90c237a37f08bb23f449dd8c
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Wed Oct 10 16:36:47 2012 +1100

    vfs: Implement an improved vfs_acl_common that uses the hash of the system ACL
    
    Where supported by the system ACL backend, this avoids hashing the
    result of the ACL mapping, instead hashing the original ACL,
    linearlised.
    
    For maximum robustness, the hash of the NT and system ACL are stored,
    along with the time and a description of the system ACL.  This variety
    of extra metadata may assist some future implementation in determining
    which hash to validate.
    
    Andrew Bartlett
    
    Signed-off-by: Andrew Bartlett <abartlet at samba.org>
    Reviewed-by: Christian Ambach <ambi at samba.org>

commit 6a5f65b0e971f068ebae5b2f93a6dfccfaa93b26
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Mon Jan 21 12:43:00 2013 +1100

    vfs: Add helper function hash_blob_sha256 to vfs_acl_common.c
    
    Signed-off-by: Andrew Bartlett <abartlet at samba.org>
    Reviewed-by: Christian Ambach <ambi at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 librpc/idl/xattr.idl                               |   12 +
 source3/Makefile.in                                |    8 +-
 source3/modules/non_posix_acls.c                   |  106 +++++
 .../modules/non_posix_acls.h                       |   20 +-
 source3/modules/vfs_acl_common.c                   |  437 +++++++++++++++-----
 source3/modules/vfs_gpfs.c                         |  222 ++++++++---
 source3/modules/vfs_gpfs.h                         |    4 +
 source3/modules/wscript_build                      |    7 +-
 source3/torture/cmd_vfs.c                          |   77 ++++
 source3/torture/vfstest.c                          |    8 +
 source4/scripting/python/samba/tests/posixacl.py   |   17 +
 11 files changed, 754 insertions(+), 164 deletions(-)
 create mode 100644 source3/modules/non_posix_acls.c
 copy file_server/file_server.h => source3/modules/non_posix_acls.h (61%)


Changeset truncated at 500 lines:

diff --git a/librpc/idl/xattr.idl b/librpc/idl/xattr.idl
index f7e6984..b4c1b98 100644
--- a/librpc/idl/xattr.idl
+++ b/librpc/idl/xattr.idl
@@ -207,4 +207,16 @@ interface xattr
 		uint16 version;
 		[switch_is(version)] xattr_NTACL_Info info;
 	} xattr_NTACL;
+
+	/*
+	 * A wrapper of the common information required to be in the
+	 * hash of the ACL, for the acl_xattr and acl_tdb modules.
+	 */
+	[public] typedef struct {
+		DATA_BLOB acl_as_blob;
+		uid_t owner;
+		gid_t group;
+		mode_t mode;
+	} xattr_sys_acl_hash_wrapper;
+
 }
diff --git a/source3/Makefile.in b/source3/Makefile.in
index 80cb27c..35199e9 100644
--- a/source3/Makefile.in
+++ b/source3/Makefile.in
@@ -853,6 +853,8 @@ NOTIFY_OBJ = smbd/notify.o smbd/notify_inotify.o smbd/notify_internal.o \
 
 FNAME_UTIL_OBJ = lib/filename_util.o
 
+NFS4ACL_OBJ = modules/nfs4_acls.o modules/non_posix_acls.o
+
 VFS_DEFAULT_OBJ = modules/vfs_default.o
 VFS_AUDIT_OBJ = modules/vfs_audit.o
 VFS_EXTD_AUDIT_OBJ = modules/vfs_extd_audit.o
@@ -871,9 +873,9 @@ VFS_AFSACL_OBJ = modules/vfs_afsacl.o
 VFS_XATTR_TDB_OBJ = modules/vfs_xattr_tdb.o lib/xattr_tdb.o
 VFS_POSIXACL_OBJ = modules/vfs_posixacl.o
 VFS_AIXACL_OBJ = modules/vfs_aixacl.o modules/vfs_aixacl_util.o
-VFS_AIXACL2_OBJ = modules/vfs_aixacl2.o modules/vfs_aixacl_util.o modules/nfs4_acls.o
+VFS_AIXACL2_OBJ = modules/vfs_aixacl2.o modules/vfs_aixacl_util.o $(NFS4ACL_OBJ)
 VFS_SOLARISACL_OBJ = modules/vfs_solarisacl.o
-VFS_ZFSACL_OBJ = modules/vfs_zfsacl.o modules/nfs4_acls.o
+VFS_ZFSACL_OBJ = modules/vfs_zfsacl.o $(NFS4ACL_OBJ)
 VFS_HPUXACL_OBJ = modules/vfs_hpuxacl.o
 VFS_TRU64ACL_OBJ = modules/vfs_tru64acl.o
 VFS_CATIA_OBJ = modules/vfs_catia.o
@@ -882,7 +884,7 @@ VFS_STREAMS_DEPOT_OBJ = modules/vfs_streams_depot.o
 VFS_CACHEPRIME_OBJ = modules/vfs_cacheprime.o
 VFS_PREALLOC_OBJ = modules/vfs_prealloc.o
 VFS_COMMIT_OBJ = modules/vfs_commit.o
-VFS_GPFS_OBJ = modules/vfs_gpfs.o modules/gpfs.o modules/nfs4_acls.o
+VFS_GPFS_OBJ = modules/vfs_gpfs.o modules/gpfs.o $(NFS4ACL_OBJ)
 VFS_NOTIFY_FAM_OBJ = modules/vfs_notify_fam.o
 VFS_READAHEAD_OBJ = modules/vfs_readahead.o
 VFS_TSMSM_OBJ = modules/vfs_tsmsm.o
diff --git a/source3/modules/non_posix_acls.c b/source3/modules/non_posix_acls.c
new file mode 100644
index 0000000..6c1dfbf
--- /dev/null
+++ b/source3/modules/non_posix_acls.c
@@ -0,0 +1,106 @@
+/*
+   Unix SMB/CIFS implementation.
+   Access Control List handling
+   Copyright (C) Andrew Bartlett 2012.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "../librpc/gen_ndr/ndr_xattr.h"
+#include "modules/non_posix_acls.h"
+
+int non_posix_sys_acl_blob_get_file_helper(vfs_handle_struct *handle,
+					   const char *path_p,
+					   DATA_BLOB acl_as_blob,
+					   TALLOC_CTX *mem_ctx,
+					   DATA_BLOB *blob)
+{
+	int ret;
+	TALLOC_CTX *frame = talloc_stackframe();
+	struct xattr_sys_acl_hash_wrapper acl_wrapper = {};
+	struct smb_filename *smb_fname = NULL;
+	NTSTATUS status = create_synthetic_smb_fname_split(frame, path_p,
+							   NULL,
+							   &smb_fname);
+	if (!NT_STATUS_IS_OK(status)) {
+		errno = map_errno_from_nt_status(status);
+		TALLOC_FREE(frame);
+		return -1;
+	}
+
+	acl_wrapper.acl_as_blob = acl_as_blob;
+
+	ret = smb_vfs_call_stat(handle, smb_fname);
+	if (ret == -1) {
+		TALLOC_FREE(frame);
+		return -1;
+	}
+
+	acl_wrapper.owner = smb_fname->st.st_ex_uid;
+	acl_wrapper.group = smb_fname->st.st_ex_gid;
+	acl_wrapper.mode = smb_fname->st.st_ex_mode;
+
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_push_struct_blob(blob, mem_ctx,
+							  &acl_wrapper,
+							  (ndr_push_flags_fn_t)ndr_push_xattr_sys_acl_hash_wrapper))) {
+		errno = EINVAL;
+		TALLOC_FREE(frame);
+		return -1;
+	}
+
+	TALLOC_FREE(frame);
+	return 0;
+}
+
+int non_posix_sys_acl_blob_get_fd_helper(vfs_handle_struct *handle,
+					 files_struct *fsp,
+					 DATA_BLOB acl_as_blob,
+					 TALLOC_CTX *mem_ctx,
+					 DATA_BLOB *blob)
+{
+	SMB_STRUCT_STAT sbuf;
+	TALLOC_CTX *frame;
+	struct xattr_sys_acl_hash_wrapper acl_wrapper;
+	int ret;
+
+	frame = talloc_stackframe();
+
+	acl_wrapper.acl_as_blob = acl_as_blob;
+
+	if (!VALID_STAT(fsp->fsp_name->st)) {
+		ret = smb_vfs_call_fstat(handle, fsp, &sbuf);
+		if (ret == -1) {
+			TALLOC_FREE(frame);
+			return -1;
+		}
+	} else {
+		sbuf = fsp->fsp_name->st;
+	}
+
+	acl_wrapper.owner = sbuf.st_ex_uid;
+	acl_wrapper.group = sbuf.st_ex_gid;
+	acl_wrapper.mode = sbuf.st_ex_mode;
+
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_push_struct_blob(blob, mem_ctx,
+							  &acl_wrapper,
+							  (ndr_push_flags_fn_t)ndr_push_xattr_sys_acl_hash_wrapper))) {
+		errno = EINVAL;
+		TALLOC_FREE(frame);
+		return -1;
+	}
+
+	TALLOC_FREE(frame);
+	return 0;
+}
diff --git a/file_server/file_server.h b/source3/modules/non_posix_acls.h
similarity index 61%
copy from file_server/file_server.h
copy to source3/modules/non_posix_acls.h
index 7da9437..6567a31 100644
--- a/file_server/file_server.h
+++ b/source3/modules/non_posix_acls.h
@@ -1,9 +1,7 @@
 /*
    Unix SMB/CIFS implementation.
-
-   run s3 file server within Samba4
-
-   Copyright (C) Andrew Tridgell	2011
+   Access Control List handling
+   Copyright (C) Andrew Bartlett 2012.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -19,7 +17,13 @@
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
-/*
-  open the s3 smb server sockets
-*/
-void s3_smbd_task_init(struct task_server *task);
+int non_posix_sys_acl_blob_get_file_helper(vfs_handle_struct *handle,
+					   const char *path_p,
+					   DATA_BLOB acl_as_blob,
+					   TALLOC_CTX *mem_ctx,
+					   DATA_BLOB *blob);
+int non_posix_sys_acl_blob_get_fd_helper(vfs_handle_struct *handle,
+					 files_struct *fsp,
+					 DATA_BLOB acl_as_blob,
+					 TALLOC_CTX *mem_ctx,
+					 DATA_BLOB *blob);
diff --git a/source3/modules/vfs_acl_common.c b/source3/modules/vfs_acl_common.c
index 4e3aa72..57fc6c8 100644
--- a/source3/modules/vfs_acl_common.c
+++ b/source3/modules/vfs_acl_common.c
@@ -49,11 +49,28 @@ static NTSTATUS store_acl_blob_fsp(vfs_handle_struct *handle,
  Hash a security descriptor.
 *******************************************************************/
 
+static NTSTATUS hash_blob_sha256(DATA_BLOB blob,
+				 uint8_t *hash)
+{
+	SHA256_CTX tctx;
+
+	memset(hash, '\0', XATTR_SD_HASH_SIZE);
+
+	samba_SHA256_Init(&tctx);
+	samba_SHA256_Update(&tctx, blob.data, blob.length);
+	samba_SHA256_Final(hash, &tctx);
+
+	return NT_STATUS_OK;
+}
+
+/*******************************************************************
+ Hash a security descriptor.
+*******************************************************************/
+
 static NTSTATUS hash_sd_sha256(struct security_descriptor *psd,
 			uint8_t *hash)
 {
 	DATA_BLOB blob;
-	SHA256_CTX tctx;
 	NTSTATUS status;
 
 	memset(hash, '\0', XATTR_SD_HASH_SIZE);
@@ -61,12 +78,7 @@ static NTSTATUS hash_sd_sha256(struct security_descriptor *psd,
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
-
-	samba_SHA256_Init(&tctx);
-	samba_SHA256_Update(&tctx, blob.data, blob.length);
-	samba_SHA256_Final(hash, &tctx);
-
-	return NT_STATUS_OK;
+	return hash_blob_sha256(blob, hash);
 }
 
 /*******************************************************************
@@ -75,9 +87,11 @@ static NTSTATUS hash_sd_sha256(struct security_descriptor *psd,
 
 static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
 			       TALLOC_CTX *mem_ctx,
-				struct security_descriptor **ppdesc,
-				uint16_t *p_hash_type,
-				uint8_t hash[XATTR_SD_HASH_SIZE])
+			       struct security_descriptor **ppdesc,
+			       uint16_t *p_hash_type,
+			       uint16_t *p_version,
+			       uint8_t hash[XATTR_SD_HASH_SIZE],
+			       uint8_t sys_acl_hash[XATTR_SD_HASH_SIZE])
 {
 	struct xattr_NTACL xacl;
 	enum ndr_err_code ndr_err;
@@ -94,6 +108,8 @@ static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
 		return ndr_map_error2ntstatus(ndr_err);
 	}
 
+	*p_version = xacl.version;
+
 	switch (xacl.version) {
 		case 1:
 			*ppdesc = make_sec_desc(mem_ctx, SD_REVISION,
@@ -128,9 +144,22 @@ static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
 					xacl.info.sd_hs3->sd->dacl,
 					&sd_size);
 			*p_hash_type = xacl.info.sd_hs3->hash_type;
-			/* Current version 3. */
+			/* Current version 3 (if no sys acl hash available). */
 			memcpy(hash, xacl.info.sd_hs3->hash, XATTR_SD_HASH_SIZE);
 			break;
+		case 4:
+			*ppdesc = make_sec_desc(mem_ctx, SD_REVISION,
+					xacl.info.sd_hs4->sd->type | SEC_DESC_SELF_RELATIVE,
+					xacl.info.sd_hs4->sd->owner_sid,
+					xacl.info.sd_hs4->sd->group_sid,
+					xacl.info.sd_hs4->sd->sacl,
+					xacl.info.sd_hs4->sd->dacl,
+					&sd_size);
+			*p_hash_type = xacl.info.sd_hs4->hash_type;
+			/* Current version 4. */
+			memcpy(hash, xacl.info.sd_hs4->hash, XATTR_SD_HASH_SIZE);
+			memcpy(sys_acl_hash, xacl.info.sd_hs4->sys_acl_hash, XATTR_SD_HASH_SIZE);
+			break;
 		default:
 			TALLOC_FREE(frame);
 			return NT_STATUS_REVISION_MISMATCH;
@@ -142,7 +171,8 @@ static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
 }
 
 /*******************************************************************
- Create a DATA_BLOB from a security descriptor.
+ Create a DATA_BLOB from a hash of the security descriptor storead at
+ the system layer and the NT ACL we wish to preserve
 *******************************************************************/
 
 static NTSTATUS create_acl_blob(const struct security_descriptor *psd,
@@ -178,6 +208,52 @@ static NTSTATUS create_acl_blob(const struct security_descriptor *psd,
 }
 
 /*******************************************************************
+ Create a DATA_BLOB from a hash of the security descriptors 
+ (system and NT) stored at the system layer and the NT ACL we wish 
+ to preserve.
+*******************************************************************/
+
+static NTSTATUS create_sys_acl_blob(const struct security_descriptor *psd,
+				    DATA_BLOB *pblob,
+				    uint16_t hash_type,
+				    uint8_t hash[XATTR_SD_HASH_SIZE],
+				    const char *description,
+				    uint8_t sys_acl_hash[XATTR_SD_HASH_SIZE])
+{
+	struct xattr_NTACL xacl;
+	struct security_descriptor_hash_v4 sd_hs4;
+	enum ndr_err_code ndr_err;
+	TALLOC_CTX *ctx = talloc_tos();
+	NTTIME nttime_now;
+	struct timeval now = timeval_current();
+	nttime_now = timeval_to_nttime(&now);
+
+	ZERO_STRUCT(xacl);
+	ZERO_STRUCT(sd_hs4);
+
+	xacl.version = 4;
+	xacl.info.sd_hs4 = &sd_hs4;
+	xacl.info.sd_hs4->sd = discard_const_p(struct security_descriptor, psd);
+	xacl.info.sd_hs4->hash_type = hash_type;
+	memcpy(&xacl.info.sd_hs4->hash[0], hash, XATTR_SD_HASH_SIZE);
+	xacl.info.sd_hs4->description = description;
+	xacl.info.sd_hs4->time = nttime_now;
+	memcpy(&xacl.info.sd_hs4->sys_acl_hash[0], sys_acl_hash, XATTR_SD_HASH_SIZE);
+
+	ndr_err = ndr_push_struct_blob(
+			pblob, ctx, &xacl,
+			(ndr_push_flags_fn_t)ndr_push_xattr_NTACL);
+
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		DEBUG(5, ("create_acl_blob: ndr_push_xattr_NTACL failed: %s\n",
+			ndr_errstr(ndr_err)));
+		return ndr_map_error2ntstatus(ndr_err);
+	}
+
+	return NT_STATUS_OK;
+}
+
+/*******************************************************************
  Add in 3 inheritable components for a non-inheritable directory ACL.
  CREATOR_OWNER/CREATOR_GROUP/WORLD.
 *******************************************************************/
@@ -286,23 +362,27 @@ static NTSTATUS add_directory_inheritable_components(vfs_handle_struct *handle,
 *******************************************************************/
 
 static NTSTATUS get_nt_acl_internal(vfs_handle_struct *handle,
-				files_struct *fsp,
-				const char *name,
-			        uint32_t security_info,
-				TALLOC_CTX *mem_ctx,
+				    files_struct *fsp,
+				    const char *name,
+				    uint32_t security_info,
+				    TALLOC_CTX *mem_ctx,
 				    struct security_descriptor **ppdesc)
 {
 	DATA_BLOB blob = data_blob_null;
 	NTSTATUS status;
 	uint16_t hash_type = XATTR_SD_HASH_TYPE_NONE;
+	uint16_t xattr_version = 0;
 	uint8_t hash[XATTR_SD_HASH_SIZE];
+	uint8_t sys_acl_hash[XATTR_SD_HASH_SIZE];
 	uint8_t hash_tmp[XATTR_SD_HASH_SIZE];
+	uint8_t sys_acl_hash_tmp[XATTR_SD_HASH_SIZE];
 	struct security_descriptor *psd = NULL;
 	struct security_descriptor *pdesc_next = NULL;
 	bool ignore_file_system_acl = lp_parm_bool(SNUM(handle->conn),
 						ACL_MODULE_NAME,
 						"ignore system acls",
 						false);
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	if (fsp && name == NULL) {
 		name = fsp->fsp_name->base_name;
@@ -310,100 +390,212 @@ static NTSTATUS get_nt_acl_internal(vfs_handle_struct *handle,
 
 	DEBUG(10, ("get_nt_acl_internal: name=%s\n", name));
 
-	/* Get the full underlying sd for the hash
-	   or to return as backup. */
-	if (fsp) {
-		status = SMB_VFS_NEXT_FGET_NT_ACL(handle,
-						  fsp,
-						  HASH_SECURITY_INFO,
-						  mem_ctx,
-						  &pdesc_next);
-	} else {
-		status = SMB_VFS_NEXT_GET_NT_ACL(handle,
-						 name,
-						 HASH_SECURITY_INFO,
-						 mem_ctx,
-						 &pdesc_next);
-	}
-
-	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(10, ("get_nt_acl_internal: get_next_acl for file %s "
-			"returned %s\n",
-			name,
-			nt_errstr(status)));
-		return status;
-	}
-
-	status = get_acl_blob(talloc_tos(), handle, fsp, name, &blob);
+	status = get_acl_blob(frame, handle, fsp, name, &blob);
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(10, ("get_nt_acl_internal: get_acl_blob returned %s\n",
 			nt_errstr(status)));
-		psd = pdesc_next;
+		psd = NULL;
 		goto out;
+	} else {
+		status = parse_acl_blob(&blob, mem_ctx, &psd,
+					&hash_type, &xattr_version, &hash[0], &sys_acl_hash[0]);
+		if (!NT_STATUS_IS_OK(status)) {
+			DEBUG(10, ("parse_acl_blob returned %s\n",
+				   nt_errstr(status)));
+			psd = NULL;
+			goto out;
+		}
 	}
 
-	status = parse_acl_blob(&blob, mem_ctx, &psd,
-				&hash_type, &hash[0]);
-	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(10, ("parse_acl_blob returned %s\n",
-				nt_errstr(status)));
-		psd = pdesc_next;
+	/* Ensure we don't leak psd if we don't choose it.
+	 *
+	 * We don't allocate it onto frame as it is preferred not to
+	 * steal from a talloc pool.
+	 */
+	talloc_steal(frame, psd);
+
+	/* determine which type of xattr we got */
+	switch (xattr_version) {
+	case 1:
+	case 2:
+		/* These xattr types are unilatteral, they do not
+		 * require confirmation of the hash.  In particular,
+		 * the NTVFS file server uses version 1, but
+		 * 'samba-tool ntacl' can set these as well */
 		goto out;
-	}
-
-	/* Ensure the hash type is one we know. */
-	switch (hash_type) {
-		case XATTR_SD_HASH_TYPE_NONE:
-			/* No hash, just return blob sd. */
-			goto out;
-		case XATTR_SD_HASH_TYPE_SHA256:
-			break;
-		default:
-			DEBUG(10, ("get_nt_acl_internal: ACL blob revision "
-				"mismatch (%u) for file %s\n",
-				(unsigned int)hash_type,
-				name));
-			TALLOC_FREE(psd);
-			psd = pdesc_next;
+	case 3:
+	case 4:
+		if (ignore_file_system_acl) {
 			goto out;
-	}
+		}
 
-	if (ignore_file_system_acl) {
+		break;
+	default:
+		DEBUG(10, ("get_nt_acl_internal: ACL blob revision "
+			   "mismatch (%u) for file %s\n",
+			   (unsigned int)hash_type,
+			   name));
+		TALLOC_FREE(psd);
+		psd = NULL;
 		goto out;
 	}
 
-	status = hash_sd_sha256(pdesc_next, hash_tmp);


-- 
Samba Shared Repository


More information about the samba-cvs mailing list