4 * Copyright (C) International Business Machines Corp., 2007,2008
5 * Author(s): Steve French (sfrench@us.ibm.com)
7 * Contains the routines for mapping CIFS/NTFS ACLs
9 * This library is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU Lesser General Public License as published
11 * by the Free Software Foundation; either version 2.1 of the License, or
12 * (at your option) any later version.
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
17 * the GNU Lesser General Public License for more details.
19 * You should have received a copy of the GNU Lesser General Public License
20 * along with this library; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
25 #include <linux/slab.h>
26 #include <linux/string.h>
27 #include <linux/keyctl.h>
28 #include <linux/key-type.h>
29 #include <keys/user-type.h>
33 #include "cifsproto.h"
34 #include "cifs_debug.h"
36 /* security id for everyone/world system group */
37 static const struct cifs_sid sid_everyone = {
38 1, 1, {0, 0, 0, 0, 0, 1}, {0} };
39 /* security id for Authenticated Users system group */
40 static const struct cifs_sid sid_authusers = {
41 1, 1, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(11)} };
43 static const struct cifs_sid sid_user = {1, 2 , {0, 0, 0, 0, 0, 5}, {} };
45 const struct cred *root_cred;
48 shrink_idmap_tree(struct rb_root *root, int nr_to_scan, int *nr_rem,
53 struct cifs_sid_id *psidid;
55 node = rb_first(root);
59 psidid = rb_entry(tmp, struct cifs_sid_id, rbnode);
60 if (nr_to_scan == 0 || *nr_del == nr_to_scan)
63 if (time_after(jiffies, psidid->time + SID_MAP_EXPIRE)
64 && psidid->refcount == 0) {
74 * Run idmap cache shrinker.
77 cifs_idmap_shrinker(struct shrinker *shrink, struct shrink_control *sc)
79 int nr_to_scan = sc->nr_to_scan;
85 spin_lock(&siduidlock);
86 shrink_idmap_tree(root, nr_to_scan, &nr_rem, &nr_del);
87 spin_unlock(&siduidlock);
90 spin_lock(&sidgidlock);
91 shrink_idmap_tree(root, nr_to_scan, &nr_rem, &nr_del);
92 spin_unlock(&sidgidlock);
97 static struct shrinker cifs_shrinker = {
98 .shrink = cifs_idmap_shrinker,
99 .seeks = DEFAULT_SEEKS,
103 cifs_idmap_key_instantiate(struct key *key, const void *data, size_t datalen)
107 payload = kmalloc(datalen, GFP_KERNEL);
111 memcpy(payload, data, datalen);
112 key->payload.data = payload;
117 cifs_idmap_key_destroy(struct key *key)
119 kfree(key->payload.data);
122 struct key_type cifs_idmap_key_type = {
123 .name = "cifs.idmap",
124 .instantiate = cifs_idmap_key_instantiate,
125 .destroy = cifs_idmap_key_destroy,
126 .describe = user_describe,
131 sid_to_str(struct cifs_sid *sidptr, char *sidstr)
139 sprintf(strptr, "%s", "S");
140 strptr = sidstr + strlen(sidstr);
142 sprintf(strptr, "-%d", sidptr->revision);
143 strptr = sidstr + strlen(sidstr);
145 for (i = 0; i < 6; ++i) {
146 if (sidptr->authority[i]) {
147 sprintf(strptr, "-%d", sidptr->authority[i]);
148 strptr = sidstr + strlen(sidstr);
152 for (i = 0; i < sidptr->num_subauth; ++i) {
153 saval = le32_to_cpu(sidptr->sub_auth[i]);
154 sprintf(strptr, "-%ld", saval);
155 strptr = sidstr + strlen(sidstr);
160 id_rb_insert(struct rb_root *root, struct cifs_sid *sidptr,
161 struct cifs_sid_id **psidid, char *typestr)
165 struct rb_node *node = root->rb_node;
166 struct rb_node *parent = NULL;
167 struct rb_node **linkto = &(root->rb_node);
168 struct cifs_sid_id *lsidid;
171 lsidid = rb_entry(node, struct cifs_sid_id, rbnode);
173 rc = compare_sids(sidptr, &((lsidid)->sid));
175 linkto = &(node->rb_left);
176 node = node->rb_left;
178 linkto = &(node->rb_right);
179 node = node->rb_right;
183 memcpy(&(*psidid)->sid, sidptr, sizeof(struct cifs_sid));
184 (*psidid)->time = jiffies - (SID_MAP_RETRY + 1);
185 (*psidid)->refcount = 0;
187 sprintf((*psidid)->sidstr, "%s", typestr);
188 strptr = (*psidid)->sidstr + strlen((*psidid)->sidstr);
189 sid_to_str(&(*psidid)->sid, strptr);
191 clear_bit(SID_ID_PENDING, &(*psidid)->state);
192 clear_bit(SID_ID_MAPPED, &(*psidid)->state);
194 rb_link_node(&(*psidid)->rbnode, parent, linkto);
195 rb_insert_color(&(*psidid)->rbnode, root);
198 static struct cifs_sid_id *
199 id_rb_search(struct rb_root *root, struct cifs_sid *sidptr)
202 struct rb_node *node = root->rb_node;
203 struct cifs_sid_id *lsidid;
206 lsidid = rb_entry(node, struct cifs_sid_id, rbnode);
207 rc = compare_sids(sidptr, &((lsidid)->sid));
209 node = node->rb_left;
211 node = node->rb_right;
212 } else /* node found */
220 sidid_pending_wait(void *unused)
223 return signal_pending(current) ? -ERESTARTSYS : 0;
227 sid_to_id(struct cifs_sb_info *cifs_sb, struct cifs_sid *psid,
228 struct cifs_fattr *fattr, uint sidtype)
233 const struct cred *saved_cred;
234 struct cifs_sid_id *psidid, *npsidid;
235 struct rb_root *cidtree;
238 if (sidtype == SIDOWNER) {
239 cid = cifs_sb->mnt_uid; /* default uid, in case upcall fails */
240 cidlock = &siduidlock;
242 } else if (sidtype == SIDGROUP) {
243 cid = cifs_sb->mnt_gid; /* default gid, in case upcall fails */
244 cidlock = &sidgidlock;
250 psidid = id_rb_search(cidtree, psid);
252 if (!psidid) { /* node does not exist, allocate one & attempt adding */
253 spin_unlock(cidlock);
254 npsidid = kzalloc(sizeof(struct cifs_sid_id), GFP_KERNEL);
258 npsidid->sidstr = kmalloc(SIDLEN, GFP_KERNEL);
259 if (!npsidid->sidstr) {
265 psidid = id_rb_search(cidtree, psid);
266 if (psidid) { /* node happened to get inserted meanwhile */
268 spin_unlock(cidlock);
269 kfree(npsidid->sidstr);
273 id_rb_insert(cidtree, psid, &psidid,
274 sidtype == SIDOWNER ? "os:" : "gs:");
276 spin_unlock(cidlock);
280 spin_unlock(cidlock);
284 * If we are here, it is safe to access psidid and its fields
285 * since a reference was taken earlier while holding the spinlock.
286 * A reference on the node is put without holding the spinlock
287 * and it is OK to do so in this case, shrinker will not erase
288 * this node until all references are put and we do not access
289 * any fields of the node after a reference is put .
291 if (test_bit(SID_ID_MAPPED, &psidid->state)) {
293 psidid->time = jiffies; /* update ts for accessing */
297 if (time_after(psidid->time + SID_MAP_RETRY, jiffies))
300 if (!test_and_set_bit(SID_ID_PENDING, &psidid->state)) {
301 saved_cred = override_creds(root_cred);
302 idkey = request_key(&cifs_idmap_key_type, psidid->sidstr, "");
304 cFYI(1, "%s: Can't map SID to an id", __func__);
306 cid = *(unsigned long *)idkey->payload.value;
308 set_bit(SID_ID_MAPPED, &psidid->state);
310 kfree(psidid->sidstr);
312 revert_creds(saved_cred);
313 psidid->time = jiffies; /* update ts for accessing */
314 clear_bit(SID_ID_PENDING, &psidid->state);
315 wake_up_bit(&psidid->state, SID_ID_PENDING);
317 rc = wait_on_bit(&psidid->state, SID_ID_PENDING,
318 sidid_pending_wait, TASK_INTERRUPTIBLE);
320 cFYI(1, "%s: sidid_pending_wait interrupted %d",
322 --psidid->refcount; /* decremented without spinlock */
325 if (test_bit(SID_ID_MAPPED, &psidid->state))
330 --psidid->refcount; /* decremented without spinlock */
331 if (sidtype == SIDOWNER)
340 init_cifs_idmap(void)
346 cFYI(1, "Registering the %s key type\n", cifs_idmap_key_type.name);
348 /* create an override credential set with a special thread keyring in
349 * which requests are cached
351 * this is used to prevent malicious redirections from being installed
354 cred = prepare_kernel_cred(NULL);
358 keyring = key_alloc(&key_type_keyring, ".cifs_idmap", 0, 0, cred,
359 (KEY_POS_ALL & ~KEY_POS_SETATTR) |
360 KEY_USR_VIEW | KEY_USR_READ,
361 KEY_ALLOC_NOT_IN_QUOTA);
362 if (IS_ERR(keyring)) {
363 ret = PTR_ERR(keyring);
364 goto failed_put_cred;
367 ret = key_instantiate_and_link(keyring, NULL, 0, NULL, NULL);
371 ret = register_key_type(&cifs_idmap_key_type);
375 /* instruct request_key() to use this special keyring as a cache for
376 * the results it looks up */
377 cred->thread_keyring = keyring;
378 cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
381 spin_lock_init(&siduidlock);
383 spin_lock_init(&sidgidlock);
386 register_shrinker(&cifs_shrinker);
388 cFYI(1, "cifs idmap keyring: %d\n", key_serial(keyring));
399 exit_cifs_idmap(void)
401 key_revoke(root_cred->thread_keyring);
402 unregister_key_type(&cifs_idmap_key_type);
404 unregister_shrinker(&cifs_shrinker);
405 cFYI(1, "Unregistered %s key type\n", cifs_idmap_key_type.name);
409 cifs_destroy_idmaptrees(void)
411 struct rb_root *root;
412 struct rb_node *node;
415 spin_lock(&siduidlock);
416 while ((node = rb_first(root)))
417 rb_erase(node, root);
418 spin_unlock(&siduidlock);
421 spin_lock(&sidgidlock);
422 while ((node = rb_first(root)))
423 rb_erase(node, root);
424 spin_unlock(&sidgidlock);
427 /* if the two SIDs (roughly equivalent to a UUID for a user or group) are
428 the same returns 1, if they do not match returns 0 */
429 int compare_sids(const struct cifs_sid *ctsid, const struct cifs_sid *cwsid)
432 int num_subauth, num_sat, num_saw;
434 if ((!ctsid) || (!cwsid))
437 /* compare the revision */
438 if (ctsid->revision != cwsid->revision) {
439 if (ctsid->revision > cwsid->revision)
445 /* compare all of the six auth values */
446 for (i = 0; i < 6; ++i) {
447 if (ctsid->authority[i] != cwsid->authority[i]) {
448 if (ctsid->authority[i] > cwsid->authority[i])
455 /* compare all of the subauth values if any */
456 num_sat = ctsid->num_subauth;
457 num_saw = cwsid->num_subauth;
458 num_subauth = num_sat < num_saw ? num_sat : num_saw;
460 for (i = 0; i < num_subauth; ++i) {
461 if (ctsid->sub_auth[i] != cwsid->sub_auth[i]) {
462 if (le32_to_cpu(ctsid->sub_auth[i]) >
463 le32_to_cpu(cwsid->sub_auth[i]))
471 return 0; /* sids compare/match */
475 /* copy ntsd, owner sid, and group sid from a security descriptor to another */
476 static void copy_sec_desc(const struct cifs_ntsd *pntsd,
477 struct cifs_ntsd *pnntsd, __u32 sidsoffset)
481 struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
482 struct cifs_sid *nowner_sid_ptr, *ngroup_sid_ptr;
484 /* copy security descriptor control portion */
485 pnntsd->revision = pntsd->revision;
486 pnntsd->type = pntsd->type;
487 pnntsd->dacloffset = cpu_to_le32(sizeof(struct cifs_ntsd));
488 pnntsd->sacloffset = 0;
489 pnntsd->osidoffset = cpu_to_le32(sidsoffset);
490 pnntsd->gsidoffset = cpu_to_le32(sidsoffset + sizeof(struct cifs_sid));
493 owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
494 le32_to_cpu(pntsd->osidoffset));
495 nowner_sid_ptr = (struct cifs_sid *)((char *)pnntsd + sidsoffset);
497 nowner_sid_ptr->revision = owner_sid_ptr->revision;
498 nowner_sid_ptr->num_subauth = owner_sid_ptr->num_subauth;
499 for (i = 0; i < 6; i++)
500 nowner_sid_ptr->authority[i] = owner_sid_ptr->authority[i];
501 for (i = 0; i < 5; i++)
502 nowner_sid_ptr->sub_auth[i] = owner_sid_ptr->sub_auth[i];
505 group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
506 le32_to_cpu(pntsd->gsidoffset));
507 ngroup_sid_ptr = (struct cifs_sid *)((char *)pnntsd + sidsoffset +
508 sizeof(struct cifs_sid));
510 ngroup_sid_ptr->revision = group_sid_ptr->revision;
511 ngroup_sid_ptr->num_subauth = group_sid_ptr->num_subauth;
512 for (i = 0; i < 6; i++)
513 ngroup_sid_ptr->authority[i] = group_sid_ptr->authority[i];
514 for (i = 0; i < 5; i++)
515 ngroup_sid_ptr->sub_auth[i] = group_sid_ptr->sub_auth[i];
522 change posix mode to reflect permissions
523 pmode is the existing mode (we only want to overwrite part of this
524 bits to set can be: S_IRWXU, S_IRWXG or S_IRWXO ie 00700 or 00070 or 00007
526 static void access_flags_to_mode(__le32 ace_flags, int type, umode_t *pmode,
527 umode_t *pbits_to_set)
529 __u32 flags = le32_to_cpu(ace_flags);
530 /* the order of ACEs is important. The canonical order is to begin with
531 DENY entries followed by ALLOW, otherwise an allow entry could be
532 encountered first, making the subsequent deny entry like "dead code"
533 which would be superflous since Windows stops when a match is made
534 for the operation you are trying to perform for your user */
536 /* For deny ACEs we change the mask so that subsequent allow access
537 control entries do not turn on the bits we are denying */
538 if (type == ACCESS_DENIED) {
539 if (flags & GENERIC_ALL)
540 *pbits_to_set &= ~S_IRWXUGO;
542 if ((flags & GENERIC_WRITE) ||
543 ((flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS))
544 *pbits_to_set &= ~S_IWUGO;
545 if ((flags & GENERIC_READ) ||
546 ((flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS))
547 *pbits_to_set &= ~S_IRUGO;
548 if ((flags & GENERIC_EXECUTE) ||
549 ((flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS))
550 *pbits_to_set &= ~S_IXUGO;
552 } else if (type != ACCESS_ALLOWED) {
553 cERROR(1, "unknown access control type %d", type);
556 /* else ACCESS_ALLOWED type */
558 if (flags & GENERIC_ALL) {
559 *pmode |= (S_IRWXUGO & (*pbits_to_set));
560 cFYI(DBG2, "all perms");
563 if ((flags & GENERIC_WRITE) ||
564 ((flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS))
565 *pmode |= (S_IWUGO & (*pbits_to_set));
566 if ((flags & GENERIC_READ) ||
567 ((flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS))
568 *pmode |= (S_IRUGO & (*pbits_to_set));
569 if ((flags & GENERIC_EXECUTE) ||
570 ((flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS))
571 *pmode |= (S_IXUGO & (*pbits_to_set));
573 cFYI(DBG2, "access flags 0x%x mode now 0x%x", flags, *pmode);
578 Generate access flags to reflect permissions mode is the existing mode.
579 This function is called for every ACE in the DACL whose SID matches
580 with either owner or group or everyone.
583 static void mode_to_access_flags(umode_t mode, umode_t bits_to_use,
586 /* reset access mask */
589 /* bits to use are either S_IRWXU or S_IRWXG or S_IRWXO */
592 /* check for R/W/X UGO since we do not know whose flags
593 is this but we have cleared all the bits sans RWX for
594 either user or group or other as per bits_to_use */
596 *pace_flags |= SET_FILE_READ_RIGHTS;
598 *pace_flags |= SET_FILE_WRITE_RIGHTS;
600 *pace_flags |= SET_FILE_EXEC_RIGHTS;
602 cFYI(DBG2, "mode: 0x%x, access flags now 0x%x", mode, *pace_flags);
606 static __u16 fill_ace_for_sid(struct cifs_ace *pntace,
607 const struct cifs_sid *psid, __u64 nmode, umode_t bits)
611 __u32 access_req = 0;
613 pntace->type = ACCESS_ALLOWED;
615 mode_to_access_flags(nmode, bits, &access_req);
617 access_req = SET_MINIMUM_RIGHTS;
618 pntace->access_req = cpu_to_le32(access_req);
620 pntace->sid.revision = psid->revision;
621 pntace->sid.num_subauth = psid->num_subauth;
622 for (i = 0; i < 6; i++)
623 pntace->sid.authority[i] = psid->authority[i];
624 for (i = 0; i < psid->num_subauth; i++)
625 pntace->sid.sub_auth[i] = psid->sub_auth[i];
627 size = 1 + 1 + 2 + 4 + 1 + 1 + 6 + (psid->num_subauth * 4);
628 pntace->size = cpu_to_le16(size);
634 #ifdef CONFIG_CIFS_DEBUG2
635 static void dump_ace(struct cifs_ace *pace, char *end_of_acl)
639 /* validate that we do not go past end of acl */
641 if (le16_to_cpu(pace->size) < 16) {
642 cERROR(1, "ACE too small %d", le16_to_cpu(pace->size));
646 if (end_of_acl < (char *)pace + le16_to_cpu(pace->size)) {
647 cERROR(1, "ACL too small to parse ACE");
651 num_subauth = pace->sid.num_subauth;
654 cFYI(1, "ACE revision %d num_auth %d type %d flags %d size %d",
655 pace->sid.revision, pace->sid.num_subauth, pace->type,
656 pace->flags, le16_to_cpu(pace->size));
657 for (i = 0; i < num_subauth; ++i) {
658 cFYI(1, "ACE sub_auth[%d]: 0x%x", i,
659 le32_to_cpu(pace->sid.sub_auth[i]));
662 /* BB add length check to make sure that we do not have huge
663 num auths and therefore go off the end */
671 static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
672 struct cifs_sid *pownersid, struct cifs_sid *pgrpsid,
673 struct cifs_fattr *fattr)
679 struct cifs_ace **ppace;
681 /* BB need to add parm so we can store the SID BB */
684 /* no DACL in the security descriptor, set
685 all the permissions for user/group/other */
686 fattr->cf_mode |= S_IRWXUGO;
690 /* validate that we do not go past end of acl */
691 if (end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size)) {
692 cERROR(1, "ACL too small to parse DACL");
696 cFYI(DBG2, "DACL revision %d size %d num aces %d",
697 le16_to_cpu(pdacl->revision), le16_to_cpu(pdacl->size),
698 le32_to_cpu(pdacl->num_aces));
700 /* reset rwx permissions for user/group/other.
701 Also, if num_aces is 0 i.e. DACL has no ACEs,
702 user/group/other have no permissions */
703 fattr->cf_mode &= ~(S_IRWXUGO);
705 acl_base = (char *)pdacl;
706 acl_size = sizeof(struct cifs_acl);
708 num_aces = le32_to_cpu(pdacl->num_aces);
710 umode_t user_mask = S_IRWXU;
711 umode_t group_mask = S_IRWXG;
712 umode_t other_mask = S_IRWXU | S_IRWXG | S_IRWXO;
714 ppace = kmalloc(num_aces * sizeof(struct cifs_ace *),
717 cERROR(1, "DACL memory allocation error");
721 for (i = 0; i < num_aces; ++i) {
722 ppace[i] = (struct cifs_ace *) (acl_base + acl_size);
723 #ifdef CONFIG_CIFS_DEBUG2
724 dump_ace(ppace[i], end_of_acl);
726 if (compare_sids(&(ppace[i]->sid), pownersid) == 0)
727 access_flags_to_mode(ppace[i]->access_req,
731 if (compare_sids(&(ppace[i]->sid), pgrpsid) == 0)
732 access_flags_to_mode(ppace[i]->access_req,
736 if (compare_sids(&(ppace[i]->sid), &sid_everyone) == 0)
737 access_flags_to_mode(ppace[i]->access_req,
741 if (compare_sids(&(ppace[i]->sid), &sid_authusers) == 0)
742 access_flags_to_mode(ppace[i]->access_req,
748 /* memcpy((void *)(&(cifscred->aces[i])),
750 sizeof(struct cifs_ace)); */
752 acl_base = (char *)ppace[i];
753 acl_size = le16_to_cpu(ppace[i]->size);
763 static int set_chmod_dacl(struct cifs_acl *pndacl, struct cifs_sid *pownersid,
764 struct cifs_sid *pgrpsid, __u64 nmode)
767 struct cifs_acl *pnndacl;
769 pnndacl = (struct cifs_acl *)((char *)pndacl + sizeof(struct cifs_acl));
771 size += fill_ace_for_sid((struct cifs_ace *) ((char *)pnndacl + size),
772 pownersid, nmode, S_IRWXU);
773 size += fill_ace_for_sid((struct cifs_ace *)((char *)pnndacl + size),
774 pgrpsid, nmode, S_IRWXG);
775 size += fill_ace_for_sid((struct cifs_ace *)((char *)pnndacl + size),
776 &sid_everyone, nmode, S_IRWXO);
778 pndacl->size = cpu_to_le16(size + sizeof(struct cifs_acl));
779 pndacl->num_aces = cpu_to_le32(3);
785 static int parse_sid(struct cifs_sid *psid, char *end_of_acl)
787 /* BB need to add parm so we can store the SID BB */
789 /* validate that we do not go past end of ACL - sid must be at least 8
790 bytes long (assuming no sub-auths - e.g. the null SID */
791 if (end_of_acl < (char *)psid + 8) {
792 cERROR(1, "ACL too small to parse SID %p", psid);
796 if (psid->num_subauth) {
797 #ifdef CONFIG_CIFS_DEBUG2
799 cFYI(1, "SID revision %d num_auth %d",
800 psid->revision, psid->num_subauth);
802 for (i = 0; i < psid->num_subauth; i++) {
803 cFYI(1, "SID sub_auth[%d]: 0x%x ", i,
804 le32_to_cpu(psid->sub_auth[i]));
807 /* BB add length check to make sure that we do not have huge
808 num auths and therefore go off the end */
810 le32_to_cpu(psid->sub_auth[psid->num_subauth-1]));
818 /* Convert CIFS ACL to POSIX form */
819 static int parse_sec_desc(struct cifs_sb_info *cifs_sb,
820 struct cifs_ntsd *pntsd, int acl_len, struct cifs_fattr *fattr)
823 struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
824 struct cifs_acl *dacl_ptr; /* no need for SACL ptr */
825 char *end_of_acl = ((char *)pntsd) + acl_len;
831 owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
832 le32_to_cpu(pntsd->osidoffset));
833 group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
834 le32_to_cpu(pntsd->gsidoffset));
835 dacloffset = le32_to_cpu(pntsd->dacloffset);
836 dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset);
837 cFYI(DBG2, "revision %d type 0x%x ooffset 0x%x goffset 0x%x "
838 "sacloffset 0x%x dacloffset 0x%x",
839 pntsd->revision, pntsd->type, le32_to_cpu(pntsd->osidoffset),
840 le32_to_cpu(pntsd->gsidoffset),
841 le32_to_cpu(pntsd->sacloffset), dacloffset);
842 /* cifs_dump_mem("owner_sid: ", owner_sid_ptr, 64); */
843 rc = parse_sid(owner_sid_ptr, end_of_acl);
845 cFYI(1, "%s: Error %d parsing Owner SID", __func__, rc);
848 rc = sid_to_id(cifs_sb, owner_sid_ptr, fattr, SIDOWNER);
850 cFYI(1, "%s: Error %d mapping Owner SID to uid", __func__, rc);
854 rc = parse_sid(group_sid_ptr, end_of_acl);
856 cFYI(1, "%s: Error %d mapping Owner SID to gid", __func__, rc);
859 rc = sid_to_id(cifs_sb, group_sid_ptr, fattr, SIDGROUP);
861 cFYI(1, "%s: Error %d mapping Group SID to gid", __func__, rc);
866 parse_dacl(dacl_ptr, end_of_acl, owner_sid_ptr,
867 group_sid_ptr, fattr);
869 cFYI(1, "no ACL"); /* BB grant all or default perms? */
871 /* cifscred->uid = owner_sid_ptr->rid;
872 cifscred->gid = group_sid_ptr->rid;
873 memcpy((void *)(&(cifscred->osid)), (void *)owner_sid_ptr,
874 sizeof(struct cifs_sid));
875 memcpy((void *)(&(cifscred->gsid)), (void *)group_sid_ptr,
876 sizeof(struct cifs_sid)); */
882 /* Convert permission bits from mode to equivalent CIFS ACL */
883 static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd,
884 struct inode *inode, __u64 nmode)
890 struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
891 struct cifs_acl *dacl_ptr = NULL; /* no need for SACL ptr */
892 struct cifs_acl *ndacl_ptr = NULL; /* no need for SACL ptr */
894 if ((inode == NULL) || (pntsd == NULL) || (pnntsd == NULL))
897 owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
898 le32_to_cpu(pntsd->osidoffset));
899 group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
900 le32_to_cpu(pntsd->gsidoffset));
902 dacloffset = le32_to_cpu(pntsd->dacloffset);
903 dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset);
905 ndacloffset = sizeof(struct cifs_ntsd);
906 ndacl_ptr = (struct cifs_acl *)((char *)pnntsd + ndacloffset);
907 ndacl_ptr->revision = dacl_ptr->revision;
909 ndacl_ptr->num_aces = 0;
911 rc = set_chmod_dacl(ndacl_ptr, owner_sid_ptr, group_sid_ptr, nmode);
913 sidsoffset = ndacloffset + le16_to_cpu(ndacl_ptr->size);
915 /* copy security descriptor control portion and owner and group sid */
916 copy_sec_desc(pntsd, pnntsd, sidsoffset);
921 static struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb,
922 __u16 fid, u32 *pacllen)
924 struct cifs_ntsd *pntsd = NULL;
926 struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
929 return ERR_CAST(tlink);
932 rc = CIFSSMBGetCIFSACL(xid, tlink_tcon(tlink), fid, &pntsd, pacllen);
935 cifs_put_tlink(tlink);
937 cFYI(1, "%s: rc = %d ACL len %d", __func__, rc, *pacllen);
943 static struct cifs_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb,
944 const char *path, u32 *pacllen)
946 struct cifs_ntsd *pntsd = NULL;
948 int xid, rc, create_options = 0;
950 struct cifs_tcon *tcon;
951 struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
954 return ERR_CAST(tlink);
956 tcon = tlink_tcon(tlink);
959 if (backup_cred(cifs_sb))
960 create_options |= CREATE_OPEN_BACKUP_INTENT;
962 rc = CIFSSMBOpen(xid, tcon, path, FILE_OPEN, READ_CONTROL,
963 create_options, &fid, &oplock, NULL, cifs_sb->local_nls,
964 cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
966 rc = CIFSSMBGetCIFSACL(xid, tcon, fid, &pntsd, pacllen);
967 CIFSSMBClose(xid, tcon, fid);
970 cifs_put_tlink(tlink);
973 cFYI(1, "%s: rc = %d ACL len %d", __func__, rc, *pacllen);
979 /* Retrieve an ACL from the server */
980 struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb,
981 struct inode *inode, const char *path,
984 struct cifs_ntsd *pntsd = NULL;
985 struct cifsFileInfo *open_file = NULL;
988 open_file = find_readable_file(CIFS_I(inode), true);
990 return get_cifs_acl_by_path(cifs_sb, path, pacllen);
992 pntsd = get_cifs_acl_by_fid(cifs_sb, open_file->netfid, pacllen);
993 cifsFileInfo_put(open_file);
997 static int set_cifs_acl_by_path(struct cifs_sb_info *cifs_sb, const char *path,
998 struct cifs_ntsd *pnntsd, u32 acllen)
1001 int xid, rc, create_options = 0;
1003 struct cifs_tcon *tcon;
1004 struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
1007 return PTR_ERR(tlink);
1009 tcon = tlink_tcon(tlink);
1012 if (backup_cred(cifs_sb))
1013 create_options |= CREATE_OPEN_BACKUP_INTENT;
1015 rc = CIFSSMBOpen(xid, tcon, path, FILE_OPEN, WRITE_DAC, create_options,
1016 &fid, &oplock, NULL, cifs_sb->local_nls,
1017 cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
1019 cERROR(1, "Unable to open file to set ACL");
1023 rc = CIFSSMBSetCIFSACL(xid, tcon, fid, pnntsd, acllen);
1024 cFYI(DBG2, "SetCIFSACL rc = %d", rc);
1026 CIFSSMBClose(xid, tcon, fid);
1029 cifs_put_tlink(tlink);
1033 /* Set an ACL on the server */
1034 int set_cifs_acl(struct cifs_ntsd *pnntsd, __u32 acllen,
1035 struct inode *inode, const char *path)
1037 struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
1039 cFYI(DBG2, "set ACL for %s from mode 0x%x", path, inode->i_mode);
1041 return set_cifs_acl_by_path(cifs_sb, path, pnntsd, acllen);
1044 /* Translate the CIFS ACL (simlar to NTFS ACL) for a file into mode bits */
1046 cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
1047 struct inode *inode, const char *path, const __u16 *pfid)
1049 struct cifs_ntsd *pntsd = NULL;
1053 cFYI(DBG2, "converting ACL to mode for %s", path);
1056 pntsd = get_cifs_acl_by_fid(cifs_sb, *pfid, &acllen);
1058 pntsd = get_cifs_acl(cifs_sb, inode, path, &acllen);
1060 /* if we can retrieve the ACL, now parse Access Control Entries, ACEs */
1061 if (IS_ERR(pntsd)) {
1062 rc = PTR_ERR(pntsd);
1063 cERROR(1, "%s: error %d getting sec desc", __func__, rc);
1065 rc = parse_sec_desc(cifs_sb, pntsd, acllen, fattr);
1068 cERROR(1, "parse sec desc failed rc = %d", rc);
1074 /* Convert mode bits to an ACL so we can update the ACL on the server */
1075 int mode_to_cifs_acl(struct inode *inode, const char *path, __u64 nmode)
1078 __u32 secdesclen = 0;
1079 struct cifs_ntsd *pntsd = NULL; /* acl obtained from server */
1080 struct cifs_ntsd *pnntsd = NULL; /* modified acl to be sent to server */
1082 cFYI(DBG2, "set ACL from mode for %s", path);
1084 /* Get the security descriptor */
1085 pntsd = get_cifs_acl(CIFS_SB(inode->i_sb), inode, path, &secdesclen);
1087 /* Add three ACEs for owner, group, everyone getting rid of
1088 other ACEs as chmod disables ACEs and set the security descriptor */
1090 if (IS_ERR(pntsd)) {
1091 rc = PTR_ERR(pntsd);
1092 cERROR(1, "%s: error %d getting sec desc", __func__, rc);
1094 /* allocate memory for the smb header,
1095 set security descriptor request security descriptor
1096 parameters, and secuirty descriptor itself */
1098 secdesclen = secdesclen < DEFSECDESCLEN ?
1099 DEFSECDESCLEN : secdesclen;
1100 pnntsd = kmalloc(secdesclen, GFP_KERNEL);
1102 cERROR(1, "Unable to allocate security descriptor");
1107 rc = build_sec_desc(pntsd, pnntsd, inode, nmode);
1109 cFYI(DBG2, "build_sec_desc rc: %d", rc);
1112 /* Set the security descriptor */
1113 rc = set_cifs_acl(pnntsd, secdesclen, inode, path);
1114 cFYI(DBG2, "set_cifs_acl rc: %d", rc);