smb_sd.c revision bbf6f00c25b6a2bed23c35eac6d62998ecdb338c
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro/*
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * CDDL HEADER START
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro *
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * The contents of this file are subject to the terms of the
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * Common Development and Distribution License (the "License").
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * You may not use this file except in compliance with the License.
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro *
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * or http://www.opensolaris.org/os/licensing.
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * See the License for the specific language governing permissions
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * and limitations under the License.
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro *
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * When distributing Covered Code, include this CDDL HEADER in each
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * If applicable, add the following below this CDDL HEADER, with the
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * fields enclosed by brackets "[]" replaced with your own identifying
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * information: Portions Copyright [yyyy] [name of copyright owner]
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro *
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * CDDL HEADER END
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro */
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro/*
794f0adb050e571bbfde4d2a19b9f88b852079ddRoger A. Faulkner * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
fc2512cfb727d49529d8ed99164db871f4829b73Robert Mustacchi * Use is subject to license terms.
5dbfd19ad5fcc2b779f40f80fa05c1bd28fd0b4eTheo Schlossnagle */
2d08521bd15501c8370ba2153b9cca4f094979d0Garrett D'Amore
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro/*
475b496bc008381e64c802250441cc256622ce91Garrett D'Amore * This module provides Security Descriptor handling functions.
4297a3b0d0a35d80f86fff155e288e885a100e6dGarrett D'Amore */
4297a3b0d0a35d80f86fff155e288e885a100e6dGarrett D'Amore
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro#include <smbsrv/smb_kproto.h>
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro#include <smbsrv/smb_fsops.h>
1e49577a7fcde812700ded04431b49d67cc57d6dRod Evans#include <smbsrv/smb_idmap.h>
1e49577a7fcde812700ded04431b49d67cc57d6dRod Evans
1e49577a7fcde812700ded04431b49d67cc57d6dRod Evansstatic void smb_sd_set_sacl(smb_sd_t *, smb_acl_t *, boolean_t, int);
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorostatic void smb_sd_set_dacl(smb_sd_t *, smb_acl_t *, boolean_t, int);
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorostatic uint32_t smb_sd_fromfs(smb_fssd_t *, smb_sd_t *);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorovoid
1e49577a7fcde812700ded04431b49d67cc57d6dRod Evanssmb_sd_init(smb_sd_t *sd, uint8_t revision)
1e49577a7fcde812700ded04431b49d67cc57d6dRod Evans{
1e49577a7fcde812700ded04431b49d67cc57d6dRod Evans bzero(sd, sizeof (smb_sd_t));
1e49577a7fcde812700ded04431b49d67cc57d6dRod Evans sd->sd_revision = revision;
1e49577a7fcde812700ded04431b49d67cc57d6dRod Evans}
1e49577a7fcde812700ded04431b49d67cc57d6dRod Evans
1e49577a7fcde812700ded04431b49d67cc57d6dRod Evans/*
1e49577a7fcde812700ded04431b49d67cc57d6dRod Evans * smb_sd_term
1e49577a7fcde812700ded04431b49d67cc57d6dRod Evans *
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * Free non-NULL members of 'sd' which has to be in
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * absolute (pointer) form.
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro */
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorovoid
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorosmb_sd_term(smb_sd_t *sd)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro{
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro ASSERT(sd);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro ASSERT((sd->sd_control & SE_SELF_RELATIVE) == 0);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_sid_free(sd->sd_owner);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_sid_free(sd->sd_group);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_acl_free(sd->sd_dacl);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_acl_free(sd->sd_sacl);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro bzero(sd, sizeof (smb_sd_t));
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro}
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorouint32_t
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorosmb_sd_len(smb_sd_t *sd, uint32_t secinfo)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro{
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro uint32_t length = SMB_SD_HDRSIZE;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (secinfo & SMB_OWNER_SECINFO)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro length += smb_sid_len(sd->sd_owner);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (secinfo & SMB_GROUP_SECINFO)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro length += smb_sid_len(sd->sd_group);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (secinfo & SMB_DACL_SECINFO)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro length += smb_acl_len(sd->sd_dacl);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (secinfo & SMB_SACL_SECINFO)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro length += smb_acl_len(sd->sd_sacl);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro return (length);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro}
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro/*
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * smb_sd_get_secinfo
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro *
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * Return the security information mask for the specified security
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * descriptor.
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro */
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorouint32_t
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorosmb_sd_get_secinfo(smb_sd_t *sd)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro{
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro uint32_t sec_info = 0;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (sd == NULL)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro return (0);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (sd->sd_owner)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sec_info |= SMB_OWNER_SECINFO;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (sd->sd_group)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sec_info |= SMB_GROUP_SECINFO;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (sd->sd_dacl)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sec_info |= SMB_DACL_SECINFO;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (sd->sd_sacl)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sec_info |= SMB_SACL_SECINFO;
23a1ccea6aac035f084a7a4cdc968687d1b02dafRoger A. Faulkner
23a1ccea6aac035f084a7a4cdc968687d1b02dafRoger A. Faulkner return (sec_info);
23a1ccea6aac035f084a7a4cdc968687d1b02dafRoger A. Faulkner}
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro/*
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * smb_sd_read
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro *
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * Read uid, gid and ACL from filesystem. The returned ACL from read
9d12795f87b63c2e39e87bff369182edd34677d3Robert Mustacchi * routine is always in ZFS format. Convert the ZFS acl to a Win acl
9d12795f87b63c2e39e87bff369182edd34677d3Robert Mustacchi * and return the Win SD in absolute form.
9d12795f87b63c2e39e87bff369182edd34677d3Robert Mustacchi *
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * NOTE: upon successful return caller MUST free the memory allocated
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * for the returned SD by calling smb_sd_term().
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro */
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorouint32_t
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorosmb_sd_read(smb_request_t *sr, smb_sd_t *sd, uint32_t secinfo)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro{
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_fssd_t fs_sd;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_error_t smb_err;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_node_t *node;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro uint32_t status = NT_STATUS_SUCCESS;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro uint32_t sd_flags;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro int error;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro node = sr->fid_ofile->f_node;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sd_flags = (node->vp->v_type == VDIR) ? SMB_FSSD_FLAGS_DIR : 0;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_fssd_init(&fs_sd, secinfo, sd_flags);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro error = smb_fsop_sdread(sr, sr->user_cr, node, &fs_sd);
d2a70789f056fc6c9ce3ab047b52126d80b0e3daRichard Lowe if (error) {
d2a70789f056fc6c9ce3ab047b52126d80b0e3daRichard Lowe smbsr_map_errno(error, &smb_err);
d2a70789f056fc6c9ce3ab047b52126d80b0e3daRichard Lowe return (smb_err.status);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro status = smb_sd_fromfs(&fs_sd, sd);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_fssd_term(&fs_sd);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
9d12795f87b63c2e39e87bff369182edd34677d3Robert Mustacchi return (status);
9d12795f87b63c2e39e87bff369182edd34677d3Robert Mustacchi}
23a1ccea6aac035f084a7a4cdc968687d1b02dafRoger A. Faulkner
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro/*
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * smb_sd_write
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro *
7dc9a163b382daee1ce43b6588dd1b507363dae5Robert Mustacchi * Takes a Win SD in absolute form, converts it to
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * ZFS format and write it to filesystem. The write routine
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * converts ZFS acl to Posix acl if required.
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro */
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorouint32_t
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorosmb_sd_write(smb_request_t *sr, smb_sd_t *sd, uint32_t secinfo)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro{
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_node_t *node;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_fssd_t fs_sd;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_error_t smb_err;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro uint32_t status;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro uint32_t sd_flags;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro int error;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro node = sr->fid_ofile->f_node;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sd_flags = (node->vp->v_type == VDIR) ? SMB_FSSD_FLAGS_DIR : 0;
e2c5185af3c50d9510e5df68aa37abdc6c0d3aacChristopher Kiick smb_fssd_init(&fs_sd, secinfo, sd_flags);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro status = smb_sd_tofs(sd, &fs_sd);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (status != NT_STATUS_SUCCESS) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_fssd_term(&fs_sd);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro return (status);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro error = smb_fsop_sdwrite(sr, sr->user_cr, node, &fs_sd, 0);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_fssd_term(&fs_sd);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (error) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (error == EBADE)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro return (NT_STATUS_INVALID_OWNER);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smbsr_map_errno(error, &smb_err);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro return (smb_err.status);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
c242ec1b4cd260e90178d81575297bb3b3648766Roger A. Faulkner
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro return (NT_STATUS_SUCCESS);
fca543ca45b12c44a243625bce68b645ba8ed791DJ Hoffman}
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
fca543ca45b12c44a243625bce68b645ba8ed791DJ Hoffman
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro/*
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * smb_sd_tofs
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro *
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * Creates a filesystem security structure based on the given
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * Windows security descriptor.
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro */
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorouint32_t
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorosmb_sd_tofs(smb_sd_t *sd, smb_fssd_t *fs_sd)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro{
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_sid_t *sid;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro uint32_t status = NT_STATUS_SUCCESS;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro uint16_t sd_control;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro idmap_stat idm_stat;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro int idtype;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro int flags = 0;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sd_control = sd->sd_control;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro /*
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * ZFS only has one set of flags so for now only
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * Windows DACL flags are taken into account.
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro */
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (sd_control & SE_DACL_DEFAULTED)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro flags |= ACL_DEFAULTED;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (sd_control & SE_DACL_AUTO_INHERITED)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro flags |= ACL_AUTO_INHERIT;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (sd_control & SE_DACL_PROTECTED)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro flags |= ACL_PROTECTED;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (fs_sd->sd_flags & SMB_FSSD_FLAGS_DIR)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro flags |= ACL_IS_DIR;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro /* Owner */
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (fs_sd->sd_secinfo & SMB_OWNER_SECINFO) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sid = sd->sd_owner;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (!smb_sid_isvalid(sid))
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro return (NT_STATUS_INVALID_SID);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro idtype = SMB_IDMAP_USER;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro idm_stat = smb_idmap_getid(sid, &fs_sd->sd_uid, &idtype);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (idm_stat != IDMAP_SUCCESS) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro return (NT_STATUS_NONE_MAPPED);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro /* Group */
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (fs_sd->sd_secinfo & SMB_GROUP_SECINFO) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sid = sd->sd_group;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (!smb_sid_isvalid(sid))
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro return (NT_STATUS_INVALID_SID);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro idtype = SMB_IDMAP_GROUP;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro idm_stat = smb_idmap_getid(sid, &fs_sd->sd_gid, &idtype);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (idm_stat != IDMAP_SUCCESS) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro return (NT_STATUS_NONE_MAPPED);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro /* DACL */
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (fs_sd->sd_secinfo & SMB_DACL_SECINFO) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (sd->sd_control & SE_DACL_PRESENT) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro status = smb_acl_to_zfs(sd->sd_dacl, flags,
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro SMB_DACL_SECINFO, &fs_sd->sd_zdacl);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (status != NT_STATUS_SUCCESS)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro return (status);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro else
9d12795f87b63c2e39e87bff369182edd34677d3Robert Mustacchi return (NT_STATUS_INVALID_ACL);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro /* SACL */
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (fs_sd->sd_secinfo & SMB_SACL_SECINFO) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (sd->sd_control & SE_SACL_PRESENT) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro status = smb_acl_to_zfs(sd->sd_sacl, flags,
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro SMB_SACL_SECINFO, &fs_sd->sd_zsacl);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (status != NT_STATUS_SUCCESS) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro return (status);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro } else {
c242ec1b4cd260e90178d81575297bb3b3648766Roger A. Faulkner return (NT_STATUS_INVALID_ACL);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro return (status);
c242ec1b4cd260e90178d81575297bb3b3648766Roger A. Faulkner}
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro/*
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * smb_sd_fromfs
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro *
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * Makes an Windows style security descriptor in absolute form
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * based on the given filesystem security information.
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro *
5dbfd19ad5fcc2b779f40f80fa05c1bd28fd0b4eTheo Schlossnagle * Should call smb_sd_term() for the returned sd to free allocated
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * members.
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro */
fca543ca45b12c44a243625bce68b645ba8ed791DJ Hoffmanstatic uint32_t
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorosmb_sd_fromfs(smb_fssd_t *fs_sd, smb_sd_t *sd)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro{
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro uint32_t status = NT_STATUS_SUCCESS;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_acl_t *acl = NULL;
d2a70789f056fc6c9ce3ab047b52126d80b0e3daRichard Lowe smb_sid_t *sid;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro idmap_stat idm_stat;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro ASSERT(fs_sd);
fca543ca45b12c44a243625bce68b645ba8ed791DJ Hoffman ASSERT(sd);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_sd_init(sd, SECURITY_DESCRIPTOR_REVISION);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro /* Owner */
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (fs_sd->sd_secinfo & SMB_OWNER_SECINFO) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro idm_stat = smb_idmap_getsid(fs_sd->sd_uid,
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro SMB_IDMAP_USER, &sid);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (idm_stat != IDMAP_SUCCESS) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_sd_term(sd);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro return (NT_STATUS_NONE_MAPPED);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sd->sd_owner = sid;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro /* Group */
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (fs_sd->sd_secinfo & SMB_GROUP_SECINFO) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro idm_stat = smb_idmap_getsid(fs_sd->sd_gid,
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro SMB_IDMAP_GROUP, &sid);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (idm_stat != IDMAP_SUCCESS) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_sd_term(sd);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro return (NT_STATUS_NONE_MAPPED);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sd->sd_group = sid;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro /* DACL */
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (fs_sd->sd_secinfo & SMB_DACL_SECINFO) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (fs_sd->sd_zdacl != NULL) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro acl = smb_acl_from_zfs(fs_sd->sd_zdacl, fs_sd->sd_uid,
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro fs_sd->sd_gid);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (acl == NULL) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_sd_term(sd);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro return (NT_STATUS_INTERNAL_ERROR);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
050c4bfe6b1d1f7437af48ce2b7670e840e94f97Gangadhar Mylapuram /*
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * Need to sort the ACL before send it to Windows
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * clients. Winodws GUI is sensitive about the order
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * of ACEs.
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro */
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_acl_sort(acl);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_sd_set_dacl(sd, acl, B_TRUE,
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro fs_sd->sd_zdacl->acl_flags);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro } else {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_sd_set_dacl(sd, NULL, B_FALSE, 0);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro /* SACL */
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (fs_sd->sd_secinfo & SMB_SACL_SECINFO) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (fs_sd->sd_zsacl != NULL) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro acl = smb_acl_from_zfs(fs_sd->sd_zsacl, fs_sd->sd_uid,
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro fs_sd->sd_gid);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (acl == NULL) {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_sd_term(sd);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro return (NT_STATUS_INTERNAL_ERROR);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_sd_set_sacl(sd, acl, B_TRUE,
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro fs_sd->sd_zsacl->acl_flags);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro } else {
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_sd_set_sacl(sd, NULL, B_FALSE, 0);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro }
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro return (status);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro}
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorostatic void
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorosmb_sd_set_dacl(smb_sd_t *sd, smb_acl_t *acl, boolean_t present, int flags)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro{
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro ASSERT((sd->sd_control & SE_SELF_RELATIVE) == 0);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sd->sd_dacl = acl;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (flags & ACL_DEFAULTED)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sd->sd_control |= SE_DACL_DEFAULTED;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (flags & ACL_AUTO_INHERIT)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sd->sd_control |= SE_DACL_AUTO_INHERITED;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (flags & ACL_PROTECTED)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sd->sd_control |= SE_DACL_PROTECTED;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (present)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sd->sd_control |= SE_DACL_PRESENT;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro}
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorostatic void
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorosmb_sd_set_sacl(smb_sd_t *sd, smb_acl_t *acl, boolean_t present, int flags)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro{
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro ASSERT((sd->sd_control & SE_SELF_RELATIVE) == 0);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sd->sd_sacl = acl;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
a80670315ce377f65d0b82e01c8c0538cd176f39Richard Lowe if (flags & ACL_DEFAULTED)
a80670315ce377f65d0b82e01c8c0538cd176f39Richard Lowe sd->sd_control |= SE_SACL_DEFAULTED;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (flags & ACL_AUTO_INHERIT)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sd->sd_control |= SE_SACL_AUTO_INHERITED;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (flags & ACL_PROTECTED)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sd->sd_control |= SE_SACL_PROTECTED;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro if (present)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro sd->sd_control |= SE_SACL_PRESENT;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro}
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro/*
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * smb_fssd_init
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro *
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * Initializes the given FS SD structure.
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro */
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorovoid
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorosmb_fssd_init(smb_fssd_t *fs_sd, uint32_t secinfo, uint32_t flags)
23a1ccea6aac035f084a7a4cdc968687d1b02dafRoger A. Faulkner{
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro bzero(fs_sd, sizeof (smb_fssd_t));
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro fs_sd->sd_secinfo = secinfo;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro fs_sd->sd_flags = flags;
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro}
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro/*
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * smb_fssd_term
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro *
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro * Frees allocated memory for acl fields.
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro */
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorovoid
b1593d50e783f7d66722dde093752b74ffa95176Jason Belorosmb_fssd_term(smb_fssd_t *fs_sd)
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro{
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro ASSERT(fs_sd);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_fsacl_free(fs_sd->sd_zdacl);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro smb_fsacl_free(fs_sd->sd_zsacl);
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro bzero(fs_sd, sizeof (smb_fssd_t));
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro}
b1593d50e783f7d66722dde093752b74ffa95176Jason Beloro