1 // SPDX-License-Identifier: LGPL-2.1 2 /* 3 * 4 * Copyright (C) International Business Machines Corp., 2007,2008 5 * Author(s): Steve French (sfrench@us.ibm.com) 6 * 7 * Contains the routines for mapping CIFS/NTFS ACLs 8 * 9 */ 10 11 #include <linux/fs.h> 12 #include <linux/slab.h> 13 #include <linux/string.h> 14 #include <linux/keyctl.h> 15 #include <linux/key-type.h> 16 #include <uapi/linux/posix_acl.h> 17 #include <linux/posix_acl.h> 18 #include <linux/posix_acl_xattr.h> 19 #include <keys/user-type.h> 20 #include "cifsglob.h" 21 #include "cifsacl.h" 22 #include "cifsproto.h" 23 #include "cifs_debug.h" 24 #include "fs_context.h" 25 #include "cifs_fs_sb.h" 26 #include "cifs_unicode.h" 27 28 /* security id for everyone/world system group */ 29 static const struct smb_sid sid_everyone = { 30 1, 1, {0, 0, 0, 0, 0, 1}, {0} }; 31 /* security id for Authenticated Users system group */ 32 static const struct smb_sid sid_authusers = { 33 1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(11)} }; 34 35 /* S-1-22-1 Unmapped Unix users */ 36 static const struct smb_sid sid_unix_users = {1, 1, {0, 0, 0, 0, 0, 22}, 37 {cpu_to_le32(1), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} }; 38 39 /* S-1-22-2 Unmapped Unix groups */ 40 static const struct smb_sid sid_unix_groups = { 1, 1, {0, 0, 0, 0, 0, 22}, 41 {cpu_to_le32(2), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} }; 42 43 /* 44 * See https://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx 45 */ 46 47 /* S-1-5-88 MS NFS and Apple style UID/GID/mode */ 48 49 /* S-1-5-88-1 Unix uid */ 50 static const struct smb_sid sid_unix_NFS_users = { 1, 2, {0, 0, 0, 0, 0, 5}, 51 {cpu_to_le32(88), 52 cpu_to_le32(1), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} }; 53 54 /* S-1-5-88-2 Unix gid */ 55 static const struct smb_sid sid_unix_NFS_groups = { 1, 2, {0, 0, 0, 0, 0, 5}, 56 {cpu_to_le32(88), 57 cpu_to_le32(2), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} }; 58 59 /* S-1-5-88-3 Unix mode */ 60 static const struct smb_sid sid_unix_NFS_mode = { 1, 2, {0, 0, 0, 0, 0, 5}, 61 {cpu_to_le32(88), 62 cpu_to_le32(3), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} }; 63 64 static const struct cred *root_cred; 65 66 static int 67 cifs_idmap_key_instantiate(struct key *key, struct key_preparsed_payload *prep) 68 { 69 char *payload; 70 71 /* 72 * If the payload is less than or equal to the size of a pointer, then 73 * an allocation here is wasteful. Just copy the data directly to the 74 * payload.value union member instead. 75 * 76 * With this however, you must check the datalen before trying to 77 * dereference payload.data! 78 */ 79 if (prep->datalen <= sizeof(key->payload)) { 80 key->payload.data[0] = NULL; 81 memcpy(&key->payload, prep->data, prep->datalen); 82 } else { 83 payload = kmemdup(prep->data, prep->datalen, GFP_KERNEL); 84 if (!payload) 85 return -ENOMEM; 86 key->payload.data[0] = payload; 87 } 88 89 key->datalen = prep->datalen; 90 return 0; 91 } 92 93 static inline void 94 cifs_idmap_key_destroy(struct key *key) 95 { 96 if (key->datalen > sizeof(key->payload)) 97 kfree(key->payload.data[0]); 98 } 99 100 static struct key_type cifs_idmap_key_type = { 101 .name = "cifs.idmap", 102 .instantiate = cifs_idmap_key_instantiate, 103 .destroy = cifs_idmap_key_destroy, 104 .describe = user_describe, 105 }; 106 107 static char * 108 sid_to_key_str(struct smb_sid *sidptr, unsigned int type) 109 { 110 int i, len; 111 unsigned int saval; 112 char *sidstr, *strptr; 113 unsigned long long id_auth_val; 114 115 /* 3 bytes for prefix */ 116 sidstr = kmalloc(3 + SID_STRING_BASE_SIZE + 117 (SID_STRING_SUBAUTH_SIZE * sidptr->num_subauth), 118 GFP_KERNEL); 119 if (!sidstr) 120 return sidstr; 121 122 strptr = sidstr; 123 len = sprintf(strptr, "%cs:S-%hhu", type == SIDOWNER ? 'o' : 'g', 124 sidptr->revision); 125 strptr += len; 126 127 /* The authority field is a single 48-bit number */ 128 id_auth_val = (unsigned long long)sidptr->authority[5]; 129 id_auth_val |= (unsigned long long)sidptr->authority[4] << 8; 130 id_auth_val |= (unsigned long long)sidptr->authority[3] << 16; 131 id_auth_val |= (unsigned long long)sidptr->authority[2] << 24; 132 id_auth_val |= (unsigned long long)sidptr->authority[1] << 32; 133 id_auth_val |= (unsigned long long)sidptr->authority[0] << 48; 134 135 /* 136 * MS-DTYP states that if the authority is >= 2^32, then it should be 137 * expressed as a hex value. 138 */ 139 if (id_auth_val <= UINT_MAX) 140 len = sprintf(strptr, "-%llu", id_auth_val); 141 else 142 len = sprintf(strptr, "-0x%llx", id_auth_val); 143 144 strptr += len; 145 146 for (i = 0; i < sidptr->num_subauth; ++i) { 147 saval = le32_to_cpu(sidptr->sub_auth[i]); 148 len = sprintf(strptr, "-%u", saval); 149 strptr += len; 150 } 151 152 return sidstr; 153 } 154 155 /* 156 * if the two SIDs (roughly equivalent to a UUID for a user or group) are 157 * the same returns zero, if they do not match returns non-zero. 158 */ 159 static int 160 compare_sids(const struct smb_sid *ctsid, const struct smb_sid *cwsid) 161 { 162 int i; 163 int num_subauth, num_sat, num_saw; 164 165 if ((!ctsid) || (!cwsid)) 166 return 1; 167 168 /* compare the revision */ 169 if (ctsid->revision != cwsid->revision) { 170 if (ctsid->revision > cwsid->revision) 171 return 1; 172 else 173 return -1; 174 } 175 176 /* compare all of the six auth values */ 177 for (i = 0; i < NUM_AUTHS; ++i) { 178 if (ctsid->authority[i] != cwsid->authority[i]) { 179 if (ctsid->authority[i] > cwsid->authority[i]) 180 return 1; 181 else 182 return -1; 183 } 184 } 185 186 /* compare all of the subauth values if any */ 187 num_sat = ctsid->num_subauth; 188 num_saw = cwsid->num_subauth; 189 num_subauth = min(num_sat, num_saw); 190 if (num_subauth) { 191 for (i = 0; i < num_subauth; ++i) { 192 if (ctsid->sub_auth[i] != cwsid->sub_auth[i]) { 193 if (le32_to_cpu(ctsid->sub_auth[i]) > 194 le32_to_cpu(cwsid->sub_auth[i])) 195 return 1; 196 else 197 return -1; 198 } 199 } 200 } 201 202 return 0; /* sids compare/match */ 203 } 204 205 static bool 206 is_well_known_sid(const struct smb_sid *psid, uint32_t *puid, bool is_group) 207 { 208 int i; 209 int num_subauth; 210 const struct smb_sid *pwell_known_sid; 211 212 if (!psid || (puid == NULL)) 213 return false; 214 215 num_subauth = psid->num_subauth; 216 217 /* check if Mac (or Windows NFS) vs. Samba format for Unix owner SID */ 218 if (num_subauth == 2) { 219 if (is_group) 220 pwell_known_sid = &sid_unix_groups; 221 else 222 pwell_known_sid = &sid_unix_users; 223 } else if (num_subauth == 3) { 224 if (is_group) 225 pwell_known_sid = &sid_unix_NFS_groups; 226 else 227 pwell_known_sid = &sid_unix_NFS_users; 228 } else 229 return false; 230 231 /* compare the revision */ 232 if (psid->revision != pwell_known_sid->revision) 233 return false; 234 235 /* compare all of the six auth values */ 236 for (i = 0; i < NUM_AUTHS; ++i) { 237 if (psid->authority[i] != pwell_known_sid->authority[i]) { 238 cifs_dbg(FYI, "auth %d did not match\n", i); 239 return false; 240 } 241 } 242 243 if (num_subauth == 2) { 244 if (psid->sub_auth[0] != pwell_known_sid->sub_auth[0]) 245 return false; 246 247 *puid = le32_to_cpu(psid->sub_auth[1]); 248 } else /* 3 subauths, ie Windows/Mac style */ { 249 *puid = le32_to_cpu(psid->sub_auth[0]); 250 if ((psid->sub_auth[0] != pwell_known_sid->sub_auth[0]) || 251 (psid->sub_auth[1] != pwell_known_sid->sub_auth[1])) 252 return false; 253 254 *puid = le32_to_cpu(psid->sub_auth[2]); 255 } 256 257 cifs_dbg(FYI, "Unix UID %d returned from SID\n", *puid); 258 return true; /* well known sid found, uid returned */ 259 } 260 261 static __u16 262 cifs_copy_sid(struct smb_sid *dst, const struct smb_sid *src) 263 { 264 int i; 265 __u16 size = 1 + 1 + 6; 266 267 dst->revision = src->revision; 268 dst->num_subauth = min_t(u8, src->num_subauth, SID_MAX_SUB_AUTHORITIES); 269 for (i = 0; i < NUM_AUTHS; ++i) 270 dst->authority[i] = src->authority[i]; 271 for (i = 0; i < dst->num_subauth; ++i) 272 dst->sub_auth[i] = src->sub_auth[i]; 273 size += (dst->num_subauth * 4); 274 275 return size; 276 } 277 278 static int parse_sid(const struct smb_sid *psid, const char *end_of_acl) 279 { 280 unsigned int sid_len; 281 282 /* SID must contain the fixed header before num_subauth is trusted. */ 283 if (end_of_acl < (const char *)psid + CIFS_SID_BASE_SIZE) { 284 cifs_dbg(VFS, "ACL too small to parse SID %p\n", psid); 285 return -EINVAL; 286 } 287 if (psid->num_subauth > SID_MAX_SUB_AUTHORITIES) { 288 cifs_dbg(VFS, "SID contains too many subauthorities %u\n", 289 psid->num_subauth); 290 return -EINVAL; 291 } 292 293 sid_len = CIFS_SID_BASE_SIZE + psid->num_subauth * sizeof(__le32); 294 if (end_of_acl < (const char *)psid + sid_len) { 295 cifs_dbg(VFS, "ACL too small to parse SID %p\n", psid); 296 return -EINVAL; 297 } 298 299 #ifdef CONFIG_CIFS_DEBUG2 300 if (psid->num_subauth) { 301 int i; 302 303 cifs_dbg(FYI, "SID revision %d num_auth %d\n", 304 psid->revision, psid->num_subauth); 305 306 for (i = 0; i < psid->num_subauth; i++) { 307 cifs_dbg(FYI, "SID sub_auth[%d]: 0x%x\n", 308 i, le32_to_cpu(psid->sub_auth[i])); 309 } 310 311 cifs_dbg(FYI, "RID 0x%x\n", 312 le32_to_cpu(psid->sub_auth[psid->num_subauth - 1])); 313 } 314 #endif 315 316 return 0; 317 } 318 319 static int sid_from_sd(const struct smb_ntsd *pntsd, __u32 secdesclen, 320 __u32 sid_offset, struct smb_sid **sid) 321 { 322 struct smb_sid *psid; 323 char *end_of_acl; 324 325 if (secdesclen < sizeof(struct smb_ntsd)) { 326 cifs_dbg(VFS, "ACL too small to parse security descriptor\n"); 327 return -EINVAL; 328 } 329 end_of_acl = (char *)pntsd + secdesclen; 330 331 if (sid_offset < sizeof(struct smb_ntsd) || 332 sid_offset > secdesclen - CIFS_SID_BASE_SIZE) { 333 cifs_dbg(VFS, "Server returned illegal SID offset\n"); 334 return -EINVAL; 335 } 336 337 psid = (struct smb_sid *)((char *)pntsd + sid_offset); 338 if (parse_sid(psid, end_of_acl)) 339 return -EINVAL; 340 341 *sid = psid; 342 return 0; 343 } 344 345 static int 346 id_to_sid(unsigned int cid, uint sidtype, struct smb_sid *ssid) 347 { 348 int rc; 349 struct key *sidkey; 350 struct smb_sid *ksid; 351 unsigned int ksid_size; 352 char desc[3 + 10 + 1]; /* 3 byte prefix + 10 bytes for value + NULL */ 353 const struct cred *saved_cred; 354 355 rc = snprintf(desc, sizeof(desc), "%ci:%u", 356 sidtype == SIDOWNER ? 'o' : 'g', cid); 357 if (rc >= sizeof(desc)) 358 return -EINVAL; 359 360 rc = 0; 361 saved_cred = override_creds(root_cred); 362 sidkey = request_key(&cifs_idmap_key_type, desc, ""); 363 if (IS_ERR(sidkey)) { 364 rc = -EINVAL; 365 cifs_dbg(FYI, "%s: Can't map %cid %u to a SID\n", 366 __func__, sidtype == SIDOWNER ? 'u' : 'g', cid); 367 goto out_revert_creds; 368 } else if (sidkey->datalen < CIFS_SID_BASE_SIZE) { 369 rc = smb_EIO1(smb_eio_trace_malformed_sid_key, sidkey->datalen); 370 cifs_dbg(FYI, "%s: Downcall contained malformed key (datalen=%hu)\n", 371 __func__, sidkey->datalen); 372 goto invalidate_key; 373 } 374 375 /* 376 * A sid is usually too large to be embedded in payload.value, but if 377 * there are no subauthorities and the host has 8-byte pointers, then 378 * it could be. 379 */ 380 ksid = sidkey->datalen <= sizeof(sidkey->payload) ? 381 (struct smb_sid *)&sidkey->payload : 382 (struct smb_sid *)sidkey->payload.data[0]; 383 384 ksid_size = CIFS_SID_BASE_SIZE + (ksid->num_subauth * sizeof(__le32)); 385 if (ksid_size > sidkey->datalen) { 386 rc = smb_EIO2(smb_eio_trace_malformed_ksid_key, 387 ksid_size, sidkey->datalen); 388 cifs_dbg(FYI, "%s: Downcall contained malformed key (datalen=%hu, ksid_size=%u)\n", 389 __func__, sidkey->datalen, ksid_size); 390 goto invalidate_key; 391 } 392 393 cifs_copy_sid(ssid, ksid); 394 out_key_put: 395 key_put(sidkey); 396 out_revert_creds: 397 revert_creds(saved_cred); 398 return rc; 399 400 invalidate_key: 401 key_invalidate(sidkey); 402 goto out_key_put; 403 } 404 405 int 406 sid_to_id(struct cifs_sb_info *cifs_sb, struct smb_sid *psid, 407 struct cifs_fattr *fattr, uint sidtype) 408 { 409 struct key *sidkey; 410 char *sidstr; 411 const struct cred *saved_cred; 412 kuid_t fuid = cifs_sb->ctx->linux_uid; 413 kgid_t fgid = cifs_sb->ctx->linux_gid; 414 415 /* 416 * If we have too many subauthorities, then something is really wrong. 417 * Just return an error. 418 */ 419 if (unlikely(psid->num_subauth > SID_MAX_SUB_AUTHORITIES)) { 420 cifs_dbg(FYI, "%s: %u subauthorities is too many!\n", 421 __func__, psid->num_subauth); 422 return smb_EIO2(smb_eio_trace_sid_too_many_auth, 423 psid->num_subauth, SID_MAX_SUB_AUTHORITIES); 424 } 425 426 if ((cifs_sb_flags(cifs_sb) & CIFS_MOUNT_UID_FROM_ACL) || 427 (cifs_sb_master_tcon(cifs_sb)->posix_extensions)) { 428 uint32_t unix_id; 429 bool is_group; 430 431 if (sidtype != SIDOWNER) 432 is_group = true; 433 else 434 is_group = false; 435 436 if (is_well_known_sid(psid, &unix_id, is_group) == false) 437 goto try_upcall_to_get_id; 438 439 if (is_group) { 440 kgid_t gid; 441 gid_t id; 442 443 id = (gid_t)unix_id; 444 gid = make_kgid(&init_user_ns, id); 445 if (gid_valid(gid)) { 446 fgid = gid; 447 goto got_valid_id; 448 } 449 } else { 450 kuid_t uid; 451 uid_t id; 452 453 id = (uid_t)unix_id; 454 uid = make_kuid(&init_user_ns, id); 455 if (uid_valid(uid)) { 456 fuid = uid; 457 goto got_valid_id; 458 } 459 } 460 /* If unable to find uid/gid easily from SID try via upcall */ 461 } 462 463 try_upcall_to_get_id: 464 sidstr = sid_to_key_str(psid, sidtype); 465 if (!sidstr) 466 return -ENOMEM; 467 468 saved_cred = override_creds(root_cred); 469 sidkey = request_key(&cifs_idmap_key_type, sidstr, ""); 470 if (IS_ERR(sidkey)) { 471 cifs_dbg(FYI, "%s: Can't map SID %s to a %cid\n", 472 __func__, sidstr, sidtype == SIDOWNER ? 'u' : 'g'); 473 goto out_revert_creds; 474 } 475 476 /* 477 * FIXME: Here we assume that uid_t and gid_t are same size. It's 478 * probably a safe assumption but might be better to check based on 479 * sidtype. 480 */ 481 BUILD_BUG_ON(sizeof(uid_t) != sizeof(gid_t)); 482 if (sidkey->datalen != sizeof(uid_t)) { 483 cifs_dbg(FYI, "%s: Downcall contained malformed key (datalen=%hu)\n", 484 __func__, sidkey->datalen); 485 key_invalidate(sidkey); 486 goto out_key_put; 487 } 488 489 if (sidtype == SIDOWNER) { 490 kuid_t uid; 491 uid_t id; 492 memcpy(&id, &sidkey->payload.data[0], sizeof(uid_t)); 493 uid = make_kuid(&init_user_ns, id); 494 if (uid_valid(uid)) 495 fuid = uid; 496 } else { 497 kgid_t gid; 498 gid_t id; 499 memcpy(&id, &sidkey->payload.data[0], sizeof(gid_t)); 500 gid = make_kgid(&init_user_ns, id); 501 if (gid_valid(gid)) 502 fgid = gid; 503 } 504 505 out_key_put: 506 key_put(sidkey); 507 out_revert_creds: 508 revert_creds(saved_cred); 509 kfree(sidstr); 510 511 /* 512 * Note that we return 0 here unconditionally. If the mapping 513 * fails then we just fall back to using the ctx->linux_uid/linux_gid. 514 */ 515 got_valid_id: 516 if (sidtype == SIDOWNER) 517 fattr->cf_uid = fuid; 518 else 519 fattr->cf_gid = fgid; 520 521 return 0; 522 } 523 524 int 525 init_cifs_idmap(void) 526 { 527 struct cred *cred; 528 struct key *keyring; 529 int ret; 530 531 cifs_dbg(FYI, "Registering the %s key type\n", 532 cifs_idmap_key_type.name); 533 534 /* create an override credential set with a special thread keyring in 535 * which requests are cached 536 * 537 * this is used to prevent malicious redirections from being installed 538 * with add_key(). 539 */ 540 cred = prepare_kernel_cred(&init_task); 541 if (!cred) 542 return -ENOMEM; 543 544 keyring = keyring_alloc(".cifs_idmap", 545 GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred, 546 (KEY_POS_ALL & ~KEY_POS_SETATTR) | 547 KEY_USR_VIEW | KEY_USR_READ, 548 KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL); 549 if (IS_ERR(keyring)) { 550 ret = PTR_ERR(keyring); 551 goto failed_put_cred; 552 } 553 554 ret = register_key_type(&cifs_idmap_key_type); 555 if (ret < 0) 556 goto failed_put_key; 557 558 /* instruct request_key() to use this special keyring as a cache for 559 * the results it looks up */ 560 set_bit(KEY_FLAG_ROOT_CAN_CLEAR, &keyring->flags); 561 cred->thread_keyring = keyring; 562 cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING; 563 root_cred = cred; 564 565 cifs_dbg(FYI, "cifs idmap keyring: %d\n", key_serial(keyring)); 566 return 0; 567 568 failed_put_key: 569 key_put(keyring); 570 failed_put_cred: 571 put_cred(cred); 572 return ret; 573 } 574 575 void 576 exit_cifs_idmap(void) 577 { 578 key_revoke(root_cred->thread_keyring); 579 unregister_key_type(&cifs_idmap_key_type); 580 put_cred(root_cred); 581 cifs_dbg(FYI, "Unregistered %s key type\n", cifs_idmap_key_type.name); 582 } 583 584 /* copy ntsd, owner sid, and group sid from a security descriptor to another */ 585 static int copy_sec_desc(const struct smb_ntsd *pntsd, struct smb_ntsd *pnntsd, 586 __u32 sidsoffset, __u32 secdesclen, 587 __u32 *pnsecdesclen, struct smb_sid *pownersid, 588 struct smb_sid *pgrpsid) 589 { 590 struct smb_sid *owner_sid_ptr, *group_sid_ptr; 591 struct smb_sid *nowner_sid_ptr, *ngroup_sid_ptr; 592 int rc; 593 594 /* copy security descriptor control portion */ 595 pnntsd->revision = pntsd->revision; 596 pnntsd->type = pntsd->type; 597 pnntsd->dacloffset = cpu_to_le32(sizeof(struct smb_ntsd)); 598 pnntsd->sacloffset = 0; 599 pnntsd->osidoffset = cpu_to_le32(sidsoffset); 600 pnntsd->gsidoffset = cpu_to_le32(sidsoffset + sizeof(struct smb_sid)); 601 602 /* copy owner sid */ 603 if (pownersid) { 604 owner_sid_ptr = pownersid; 605 } else { 606 rc = sid_from_sd(pntsd, secdesclen, 607 le32_to_cpu(pntsd->osidoffset), &owner_sid_ptr); 608 if (rc) 609 return rc; 610 } 611 nowner_sid_ptr = (struct smb_sid *)((char *)pnntsd + sidsoffset); 612 cifs_copy_sid(nowner_sid_ptr, owner_sid_ptr); 613 614 /* copy group sid */ 615 if (pgrpsid) { 616 group_sid_ptr = pgrpsid; 617 } else { 618 rc = sid_from_sd(pntsd, secdesclen, 619 le32_to_cpu(pntsd->gsidoffset), &group_sid_ptr); 620 if (rc) 621 return rc; 622 } 623 ngroup_sid_ptr = (struct smb_sid *)((char *)pnntsd + sidsoffset + 624 sizeof(struct smb_sid)); 625 cifs_copy_sid(ngroup_sid_ptr, group_sid_ptr); 626 627 *pnsecdesclen = sidsoffset + (2 * sizeof(struct smb_sid)); 628 return 0; 629 } 630 631 /* 632 change posix mode to reflect permissions 633 pmode is the existing mode (we only want to overwrite part of this 634 bits to set can be: S_IRWXU, S_IRWXG or S_IRWXO ie 00700 or 00070 or 00007 635 */ 636 static void access_flags_to_mode(__le32 ace_flags, int type, umode_t *pmode, 637 umode_t *pdenied, umode_t mask) 638 { 639 __u32 flags = le32_to_cpu(ace_flags); 640 /* 641 * Do not assume "preferred" or "canonical" order. 642 * The first DENY or ALLOW ACE which matches perfectly is 643 * the permission to be used. Once allowed or denied, same 644 * permission in later ACEs do not matter. 645 */ 646 647 /* If not already allowed, deny these bits */ 648 if (type == ACCESS_DENIED) { 649 if (flags & GENERIC_ALL && 650 !(*pmode & mask & 0777)) 651 *pdenied |= mask & 0777; 652 653 if (((flags & GENERIC_WRITE) || 654 ((flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS)) && 655 !(*pmode & mask & 0222)) 656 *pdenied |= mask & 0222; 657 658 if (((flags & GENERIC_READ) || 659 ((flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS)) && 660 !(*pmode & mask & 0444)) 661 *pdenied |= mask & 0444; 662 663 if (((flags & GENERIC_EXECUTE) || 664 ((flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS)) && 665 !(*pmode & mask & 0111)) 666 *pdenied |= mask & 0111; 667 668 return; 669 } else if (type != ACCESS_ALLOWED) { 670 cifs_dbg(VFS, "unknown access control type %d\n", type); 671 return; 672 } 673 /* else ACCESS_ALLOWED type */ 674 675 if ((flags & GENERIC_ALL) && 676 !(*pdenied & mask & 0777)) { 677 *pmode |= mask & 0777; 678 cifs_dbg(NOISY, "all perms\n"); 679 return; 680 } 681 682 if (((flags & GENERIC_WRITE) || 683 ((flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS)) && 684 !(*pdenied & mask & 0222)) 685 *pmode |= mask & 0222; 686 687 if (((flags & GENERIC_READ) || 688 ((flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS)) && 689 !(*pdenied & mask & 0444)) 690 *pmode |= mask & 0444; 691 692 if (((flags & GENERIC_EXECUTE) || 693 ((flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS)) && 694 !(*pdenied & mask & 0111)) 695 *pmode |= mask & 0111; 696 697 /* If DELETE_CHILD is set only on an owner ACE, set sticky bit */ 698 if (flags & FILE_DELETE_CHILD) { 699 if (mask == ACL_OWNER_MASK) { 700 if (!(*pdenied & 01000)) 701 *pmode |= 01000; 702 } else if (!(*pdenied & 01000)) { 703 *pmode &= ~01000; 704 *pdenied |= 01000; 705 } 706 } 707 708 cifs_dbg(NOISY, "access flags 0x%x mode now %04o\n", flags, *pmode); 709 return; 710 } 711 712 /* 713 Generate access flags to reflect permissions mode is the existing mode. 714 This function is called for every ACE in the DACL whose SID matches 715 with either owner or group or everyone. 716 */ 717 718 static void mode_to_access_flags(umode_t mode, umode_t bits_to_use, 719 __u32 *pace_flags) 720 { 721 /* reset access mask */ 722 *pace_flags = 0x0; 723 724 /* bits to use are either S_IRWXU or S_IRWXG or S_IRWXO */ 725 mode &= bits_to_use; 726 727 /* check for R/W/X UGO since we do not know whose flags 728 is this but we have cleared all the bits sans RWX for 729 either user or group or other as per bits_to_use */ 730 if (mode & S_IRUGO) 731 *pace_flags |= SET_FILE_READ_RIGHTS; 732 if (mode & S_IWUGO) 733 *pace_flags |= SET_FILE_WRITE_RIGHTS; 734 if (mode & S_IXUGO) 735 *pace_flags |= SET_FILE_EXEC_RIGHTS; 736 737 cifs_dbg(NOISY, "mode: %04o, access flags now 0x%x\n", 738 mode, *pace_flags); 739 return; 740 } 741 742 static __u16 cifs_copy_ace(struct smb_ace *dst, struct smb_ace *src, struct smb_sid *psid) 743 { 744 __u16 size = 1 + 1 + 2 + 4; 745 746 dst->type = src->type; 747 dst->flags = src->flags; 748 dst->access_req = src->access_req; 749 750 /* Check if there's a replacement sid specified */ 751 if (psid) 752 size += cifs_copy_sid(&dst->sid, psid); 753 else 754 size += cifs_copy_sid(&dst->sid, &src->sid); 755 756 dst->size = cpu_to_le16(size); 757 758 return size; 759 } 760 761 static __u16 fill_ace_for_sid(struct smb_ace *pntace, 762 const struct smb_sid *psid, __u64 nmode, 763 umode_t bits, __u8 access_type, 764 bool allow_delete_child) 765 { 766 int i; 767 __u16 size = 0; 768 __u32 access_req = 0; 769 770 pntace->type = access_type; 771 pntace->flags = 0x0; 772 mode_to_access_flags(nmode, bits, &access_req); 773 774 if (access_type == ACCESS_ALLOWED && allow_delete_child) 775 access_req |= FILE_DELETE_CHILD; 776 777 if (access_type == ACCESS_ALLOWED && !access_req) 778 access_req = SET_MINIMUM_RIGHTS; 779 else if (access_type == ACCESS_DENIED) 780 access_req &= ~SET_MINIMUM_RIGHTS; 781 782 pntace->access_req = cpu_to_le32(access_req); 783 784 pntace->sid.revision = psid->revision; 785 pntace->sid.num_subauth = psid->num_subauth; 786 for (i = 0; i < NUM_AUTHS; i++) 787 pntace->sid.authority[i] = psid->authority[i]; 788 for (i = 0; i < psid->num_subauth; i++) 789 pntace->sid.sub_auth[i] = psid->sub_auth[i]; 790 791 size = 1 + 1 + 2 + 4 + 1 + 1 + 6 + (psid->num_subauth * 4); 792 pntace->size = cpu_to_le16(size); 793 794 return size; 795 } 796 797 798 #ifdef CONFIG_CIFS_DEBUG2 799 static void dump_ace(struct smb_ace *pace, char *end_of_acl) 800 { 801 int num_subauth; 802 803 /* validate that we do not go past end of acl */ 804 805 if (le16_to_cpu(pace->size) < 16) { 806 cifs_dbg(VFS, "ACE too small %d\n", le16_to_cpu(pace->size)); 807 return; 808 } 809 810 if (end_of_acl < (char *)pace + le16_to_cpu(pace->size)) { 811 cifs_dbg(VFS, "ACL too small to parse ACE\n"); 812 return; 813 } 814 815 num_subauth = pace->sid.num_subauth; 816 if (num_subauth) { 817 int i; 818 cifs_dbg(FYI, "ACE revision %d num_auth %d type %d flags %d size %d\n", 819 pace->sid.revision, pace->sid.num_subauth, pace->type, 820 pace->flags, le16_to_cpu(pace->size)); 821 for (i = 0; i < num_subauth; ++i) { 822 cifs_dbg(FYI, "ACE sub_auth[%d]: 0x%x\n", 823 i, le32_to_cpu(pace->sid.sub_auth[i])); 824 } 825 826 /* BB add length check to make sure that we do not have huge 827 num auths and therefore go off the end */ 828 } 829 830 return; 831 } 832 #endif 833 834 static int validate_dacl(struct smb_acl *pdacl, char *end_of_acl) 835 { 836 int i, ace_hdr_size, ace_size, min_ace_size; 837 u16 dacl_size, num_aces; 838 char *acl_base, *end_of_dacl; 839 struct smb_ace *pace; 840 841 if (!pdacl) 842 return 0; 843 844 if (end_of_acl < (char *)pdacl + sizeof(struct smb_acl)) { 845 cifs_dbg(VFS, "ACL too small to parse DACL\n"); 846 return -EINVAL; 847 } 848 849 dacl_size = le16_to_cpu(pdacl->size); 850 if (dacl_size < sizeof(struct smb_acl) || 851 end_of_acl < (char *)pdacl + dacl_size) { 852 cifs_dbg(VFS, "ACL too small to parse DACL\n"); 853 return -EINVAL; 854 } 855 856 num_aces = le16_to_cpu(pdacl->num_aces); 857 if (!num_aces) 858 return 0; 859 860 ace_hdr_size = offsetof(struct smb_ace, sid) + 861 offsetof(struct smb_sid, sub_auth); 862 min_ace_size = ace_hdr_size + sizeof(__le32); 863 if (num_aces > (dacl_size - sizeof(struct smb_acl)) / min_ace_size) { 864 cifs_dbg(VFS, "ACL too small to parse DACL\n"); 865 return -EINVAL; 866 } 867 868 end_of_dacl = (char *)pdacl + dacl_size; 869 acl_base = (char *)pdacl; 870 ace_size = sizeof(struct smb_acl); 871 872 for (i = 0; i < num_aces; ++i) { 873 if (end_of_dacl - acl_base < ace_size) { 874 cifs_dbg(VFS, "ACL too small to parse ACE\n"); 875 return -EINVAL; 876 } 877 878 pace = (struct smb_ace *)(acl_base + ace_size); 879 acl_base = (char *)pace; 880 881 if (end_of_dacl - acl_base < ace_hdr_size || 882 pace->sid.num_subauth == 0 || 883 pace->sid.num_subauth > SID_MAX_SUB_AUTHORITIES) { 884 cifs_dbg(VFS, "ACL too small to parse ACE\n"); 885 return -EINVAL; 886 } 887 888 ace_size = ace_hdr_size + sizeof(__le32) * pace->sid.num_subauth; 889 if (end_of_dacl - acl_base < ace_size || 890 le16_to_cpu(pace->size) < ace_size) { 891 cifs_dbg(VFS, "ACL too small to parse ACE\n"); 892 return -EINVAL; 893 } 894 895 ace_size = le16_to_cpu(pace->size); 896 if (end_of_dacl - acl_base < ace_size) { 897 cifs_dbg(VFS, "ACL too small to parse ACE\n"); 898 return -EINVAL; 899 } 900 } 901 902 return 0; 903 } 904 905 static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, 906 struct smb_sid *pownersid, struct smb_sid *pgrpsid, 907 struct cifs_fattr *fattr, bool mode_from_special_sid) 908 { 909 int i; 910 u16 num_aces = 0; 911 int acl_size; 912 char *acl_base; 913 struct smb_ace **ppace; 914 915 /* BB need to add parm so we can store the SID BB */ 916 917 if (!pdacl) { 918 /* no DACL in the security descriptor, set 919 all the permissions for user/group/other */ 920 fattr->cf_mode |= 0777; 921 return; 922 } 923 924 if (validate_dacl(pdacl, end_of_acl)) 925 return; 926 927 cifs_dbg(NOISY, "DACL revision %d size %d num aces %d\n", 928 le16_to_cpu(pdacl->revision), le16_to_cpu(pdacl->size), 929 le16_to_cpu(pdacl->num_aces)); 930 931 /* reset rwx permissions for user/group/other. 932 Also, if num_aces is 0 i.e. DACL has no ACEs, 933 user/group/other have no permissions */ 934 fattr->cf_mode &= ~(0777); 935 936 acl_base = (char *)pdacl; 937 acl_size = sizeof(struct smb_acl); 938 939 num_aces = le16_to_cpu(pdacl->num_aces); 940 if (num_aces > 0) { 941 umode_t denied_mode = 0; 942 943 ppace = kmalloc_objs(struct smb_ace *, num_aces); 944 if (!ppace) 945 return; 946 947 for (i = 0; i < num_aces; ++i) { 948 ppace[i] = (struct smb_ace *) (acl_base + acl_size); 949 950 #ifdef CONFIG_CIFS_DEBUG2 951 dump_ace(ppace[i], 952 (char *)pdacl + le16_to_cpu(pdacl->size)); 953 #endif 954 if (mode_from_special_sid && 955 ppace[i]->sid.num_subauth >= 3 && 956 (compare_sids(&(ppace[i]->sid), 957 &sid_unix_NFS_mode) == 0)) { 958 /* 959 * Full permissions are: 960 * 07777 = S_ISUID | S_ISGID | S_ISVTX | 961 * S_IRWXU | S_IRWXG | S_IRWXO 962 */ 963 fattr->cf_mode &= ~07777; 964 fattr->cf_mode |= 965 le32_to_cpu(ppace[i]->sid.sub_auth[2]); 966 break; 967 } else { 968 if (compare_sids(&(ppace[i]->sid), pownersid) == 0) { 969 access_flags_to_mode(ppace[i]->access_req, 970 ppace[i]->type, 971 &fattr->cf_mode, 972 &denied_mode, 973 ACL_OWNER_MASK); 974 } else if (compare_sids(&(ppace[i]->sid), pgrpsid) == 0) { 975 access_flags_to_mode(ppace[i]->access_req, 976 ppace[i]->type, 977 &fattr->cf_mode, 978 &denied_mode, 979 ACL_GROUP_MASK); 980 } else if ((compare_sids(&(ppace[i]->sid), &sid_everyone) == 0) || 981 (compare_sids(&(ppace[i]->sid), &sid_authusers) == 0)) { 982 access_flags_to_mode(ppace[i]->access_req, 983 ppace[i]->type, 984 &fattr->cf_mode, 985 &denied_mode, 986 ACL_EVERYONE_MASK); 987 } 988 } 989 990 991 /* memcpy((void *)(&(cifscred->aces[i])), 992 (void *)ppace[i], 993 sizeof(struct smb_ace)); */ 994 995 acl_base = (char *)ppace[i]; 996 acl_size = le16_to_cpu(ppace[i]->size); 997 } 998 999 kfree(ppace); 1000 } 1001 1002 return; 1003 } 1004 1005 unsigned int setup_authusers_ACE(struct smb_ace *pntace) 1006 { 1007 int i; 1008 unsigned int ace_size = 20; 1009 1010 pntace->type = ACCESS_ALLOWED_ACE_TYPE; 1011 pntace->flags = 0x0; 1012 pntace->access_req = cpu_to_le32(GENERIC_ALL); 1013 pntace->sid.num_subauth = 1; 1014 pntace->sid.revision = 1; 1015 for (i = 0; i < NUM_AUTHS; i++) 1016 pntace->sid.authority[i] = sid_authusers.authority[i]; 1017 1018 pntace->sid.sub_auth[0] = sid_authusers.sub_auth[0]; 1019 1020 /* size = 1 + 1 + 2 + 4 + 1 + 1 + 6 + (psid->num_subauth*4) */ 1021 pntace->size = cpu_to_le16(ace_size); 1022 return ace_size; 1023 } 1024 1025 /* 1026 * Fill in the special SID based on the mode. See 1027 * https://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx 1028 */ 1029 unsigned int setup_special_mode_ACE(struct smb_ace *pntace, 1030 bool posix, 1031 __u64 nmode) 1032 { 1033 int i; 1034 unsigned int ace_size = 28; 1035 1036 if (posix) 1037 pntace->type = ACCESS_ALLOWED_ACE_TYPE; 1038 else 1039 pntace->type = ACCESS_DENIED_ACE_TYPE; 1040 pntace->flags = 0x0; 1041 pntace->access_req = 0; 1042 pntace->sid.num_subauth = 3; 1043 pntace->sid.revision = 1; 1044 for (i = 0; i < NUM_AUTHS; i++) 1045 pntace->sid.authority[i] = sid_unix_NFS_mode.authority[i]; 1046 1047 pntace->sid.sub_auth[0] = sid_unix_NFS_mode.sub_auth[0]; 1048 pntace->sid.sub_auth[1] = sid_unix_NFS_mode.sub_auth[1]; 1049 pntace->sid.sub_auth[2] = cpu_to_le32(nmode & 07777); 1050 1051 /* size = 1 + 1 + 2 + 4 + 1 + 1 + 6 + (psid->num_subauth*4) */ 1052 pntace->size = cpu_to_le16(ace_size); 1053 return ace_size; 1054 } 1055 1056 unsigned int setup_special_user_owner_ACE(struct smb_ace *pntace) 1057 { 1058 int i; 1059 unsigned int ace_size = 28; 1060 1061 pntace->type = ACCESS_ALLOWED_ACE_TYPE; 1062 pntace->flags = 0x0; 1063 pntace->access_req = cpu_to_le32(GENERIC_ALL); 1064 pntace->sid.num_subauth = 3; 1065 pntace->sid.revision = 1; 1066 for (i = 0; i < NUM_AUTHS; i++) 1067 pntace->sid.authority[i] = sid_unix_NFS_users.authority[i]; 1068 1069 pntace->sid.sub_auth[0] = sid_unix_NFS_users.sub_auth[0]; 1070 pntace->sid.sub_auth[1] = sid_unix_NFS_users.sub_auth[1]; 1071 pntace->sid.sub_auth[2] = cpu_to_le32(current_fsgid().val); 1072 1073 /* size = 1 + 1 + 2 + 4 + 1 + 1 + 6 + (psid->num_subauth*4) */ 1074 pntace->size = cpu_to_le16(ace_size); 1075 return ace_size; 1076 } 1077 1078 static void populate_new_aces(char *nacl_base, 1079 struct smb_sid *pownersid, 1080 struct smb_sid *pgrpsid, 1081 __u64 *pnmode, u16 *pnum_aces, u16 *pnsize, 1082 bool modefromsid, 1083 bool posix) 1084 { 1085 __u64 nmode; 1086 u16 num_aces = 0; 1087 u16 nsize = 0; 1088 __u64 user_mode; 1089 __u64 group_mode; 1090 __u64 other_mode; 1091 __u64 deny_user_mode = 0; 1092 __u64 deny_group_mode = 0; 1093 bool sticky_set = false; 1094 struct smb_ace *pnntace = NULL; 1095 1096 nmode = *pnmode; 1097 num_aces = *pnum_aces; 1098 nsize = *pnsize; 1099 1100 if (modefromsid || posix) { 1101 pnntace = (struct smb_ace *) (nacl_base + nsize); 1102 nsize += setup_special_mode_ACE(pnntace, posix, nmode); 1103 num_aces++; 1104 if (modefromsid) { 1105 pnntace = (struct smb_ace *) (nacl_base + nsize); 1106 nsize += setup_authusers_ACE(pnntace); 1107 num_aces++; 1108 } 1109 goto set_size; 1110 } 1111 1112 /* 1113 * We'll try to keep the mode as requested by the user. 1114 * But in cases where we cannot meaningfully convert that 1115 * into ACL, return back the updated mode, so that it is 1116 * updated in the inode. 1117 */ 1118 1119 if (!memcmp(pownersid, pgrpsid, sizeof(struct smb_sid))) { 1120 /* 1121 * Case when owner and group SIDs are the same. 1122 * Set the more restrictive of the two modes. 1123 */ 1124 user_mode = nmode & (nmode << 3) & 0700; 1125 group_mode = nmode & (nmode >> 3) & 0070; 1126 } else { 1127 user_mode = nmode & 0700; 1128 group_mode = nmode & 0070; 1129 } 1130 1131 other_mode = nmode & 0007; 1132 1133 /* We need DENY ACE when the perm is more restrictive than the next sets. */ 1134 deny_user_mode = ~(user_mode) & ((group_mode << 3) | (other_mode << 6)) & 0700; 1135 deny_group_mode = ~(group_mode) & (other_mode << 3) & 0070; 1136 1137 *pnmode = user_mode | group_mode | other_mode | (nmode & ~0777); 1138 1139 /* This tells if we should allow delete child for group and everyone. */ 1140 if (nmode & 01000) 1141 sticky_set = true; 1142 1143 if (deny_user_mode) { 1144 pnntace = (struct smb_ace *) (nacl_base + nsize); 1145 nsize += fill_ace_for_sid(pnntace, pownersid, deny_user_mode, 1146 0700, ACCESS_DENIED, false); 1147 num_aces++; 1148 } 1149 1150 /* Group DENY ACE does not conflict with owner ALLOW ACE. Keep in preferred order*/ 1151 if (deny_group_mode && !(deny_group_mode & (user_mode >> 3))) { 1152 pnntace = (struct smb_ace *) (nacl_base + nsize); 1153 nsize += fill_ace_for_sid(pnntace, pgrpsid, deny_group_mode, 1154 0070, ACCESS_DENIED, false); 1155 num_aces++; 1156 } 1157 1158 pnntace = (struct smb_ace *) (nacl_base + nsize); 1159 nsize += fill_ace_for_sid(pnntace, pownersid, user_mode, 1160 0700, ACCESS_ALLOWED, true); 1161 num_aces++; 1162 1163 /* Group DENY ACE conflicts with owner ALLOW ACE. So keep it after. */ 1164 if (deny_group_mode && (deny_group_mode & (user_mode >> 3))) { 1165 pnntace = (struct smb_ace *) (nacl_base + nsize); 1166 nsize += fill_ace_for_sid(pnntace, pgrpsid, deny_group_mode, 1167 0070, ACCESS_DENIED, false); 1168 num_aces++; 1169 } 1170 1171 pnntace = (struct smb_ace *) (nacl_base + nsize); 1172 nsize += fill_ace_for_sid(pnntace, pgrpsid, group_mode, 1173 0070, ACCESS_ALLOWED, !sticky_set); 1174 num_aces++; 1175 1176 pnntace = (struct smb_ace *) (nacl_base + nsize); 1177 nsize += fill_ace_for_sid(pnntace, &sid_everyone, other_mode, 1178 0007, ACCESS_ALLOWED, !sticky_set); 1179 num_aces++; 1180 1181 set_size: 1182 *pnum_aces = num_aces; 1183 *pnsize = nsize; 1184 } 1185 1186 static __u16 replace_sids_and_copy_aces(struct smb_acl *pdacl, struct smb_acl *pndacl, 1187 struct smb_sid *pownersid, struct smb_sid *pgrpsid, 1188 struct smb_sid *pnownersid, struct smb_sid *pngrpsid, 1189 int *aclflag) 1190 { 1191 int i; 1192 u16 size = 0; 1193 struct smb_ace *pntace = NULL; 1194 char *acl_base = NULL; 1195 u16 src_num_aces = 0; 1196 u16 nsize = 0; 1197 struct smb_ace *pnntace = NULL; 1198 char *nacl_base = NULL; 1199 u16 ace_size = 0; 1200 1201 acl_base = (char *)pdacl; 1202 size = sizeof(struct smb_acl); 1203 src_num_aces = le16_to_cpu(pdacl->num_aces); 1204 1205 nacl_base = (char *)pndacl; 1206 nsize = sizeof(struct smb_acl); 1207 1208 /* Go through all the ACEs */ 1209 for (i = 0; i < src_num_aces; ++i) { 1210 pntace = (struct smb_ace *) (acl_base + size); 1211 pnntace = (struct smb_ace *) (nacl_base + nsize); 1212 1213 if (pnownersid && compare_sids(&pntace->sid, pownersid) == 0) { 1214 ace_size = cifs_copy_ace(pnntace, pntace, pnownersid); 1215 *aclflag |= CIFS_ACL_DACL; 1216 } else if (pngrpsid && compare_sids(&pntace->sid, pgrpsid) == 0) { 1217 ace_size = cifs_copy_ace(pnntace, pntace, pngrpsid); 1218 *aclflag |= CIFS_ACL_DACL; 1219 } else { 1220 ace_size = cifs_copy_ace(pnntace, pntace, NULL); 1221 } 1222 1223 size += le16_to_cpu(pntace->size); 1224 nsize += ace_size; 1225 } 1226 1227 return nsize; 1228 } 1229 1230 static int set_chmod_dacl(struct smb_acl *pdacl, struct smb_acl *pndacl, 1231 struct smb_sid *pownersid, struct smb_sid *pgrpsid, 1232 __u64 *pnmode, bool mode_from_sid, bool posix) 1233 { 1234 int i; 1235 u16 size = 0; 1236 struct smb_ace *pntace = NULL; 1237 char *acl_base = NULL; 1238 u16 src_num_aces = 0; 1239 u16 nsize = 0; 1240 struct smb_ace *pnntace = NULL; 1241 char *nacl_base = NULL; 1242 u16 num_aces = 0; 1243 bool new_aces_set = false; 1244 1245 /* Assuming that pndacl and pnmode are never NULL */ 1246 nacl_base = (char *)pndacl; 1247 nsize = sizeof(struct smb_acl); 1248 1249 /* If pdacl is NULL, we don't have a src. Simply populate new ACL. */ 1250 if (!pdacl || posix) { 1251 populate_new_aces(nacl_base, 1252 pownersid, pgrpsid, 1253 pnmode, &num_aces, &nsize, 1254 mode_from_sid, posix); 1255 goto finalize_dacl; 1256 } 1257 1258 acl_base = (char *)pdacl; 1259 size = sizeof(struct smb_acl); 1260 src_num_aces = le16_to_cpu(pdacl->num_aces); 1261 1262 /* Retain old ACEs which we can retain */ 1263 for (i = 0; i < src_num_aces; ++i) { 1264 pntace = (struct smb_ace *) (acl_base + size); 1265 1266 if (!new_aces_set && (pntace->flags & INHERITED_ACE)) { 1267 /* Place the new ACEs in between existing explicit and inherited */ 1268 populate_new_aces(nacl_base, 1269 pownersid, pgrpsid, 1270 pnmode, &num_aces, &nsize, 1271 mode_from_sid, posix); 1272 1273 new_aces_set = true; 1274 } 1275 1276 /* If it's any one of the ACE we're replacing, skip! */ 1277 if (((compare_sids(&pntace->sid, &sid_unix_NFS_mode) == 0) || 1278 (compare_sids(&pntace->sid, pownersid) == 0) || 1279 (compare_sids(&pntace->sid, pgrpsid) == 0) || 1280 (compare_sids(&pntace->sid, &sid_everyone) == 0) || 1281 (compare_sids(&pntace->sid, &sid_authusers) == 0))) { 1282 goto next_ace; 1283 } 1284 1285 /* update the pointer to the next ACE to populate*/ 1286 pnntace = (struct smb_ace *) (nacl_base + nsize); 1287 1288 nsize += cifs_copy_ace(pnntace, pntace, NULL); 1289 num_aces++; 1290 1291 next_ace: 1292 size += le16_to_cpu(pntace->size); 1293 } 1294 1295 /* If inherited ACEs are not present, place the new ones at the tail */ 1296 if (!new_aces_set) { 1297 populate_new_aces(nacl_base, 1298 pownersid, pgrpsid, 1299 pnmode, &num_aces, &nsize, 1300 mode_from_sid, posix); 1301 1302 new_aces_set = true; 1303 } 1304 1305 finalize_dacl: 1306 pndacl->num_aces = cpu_to_le16(num_aces); 1307 pndacl->size = cpu_to_le16(nsize); 1308 1309 return 0; 1310 } 1311 1312 static bool dacl_offset_valid(unsigned int acl_len, __u32 dacloffset) 1313 { 1314 if (acl_len < sizeof(struct smb_acl)) 1315 return false; 1316 1317 if (dacloffset < sizeof(struct smb_ntsd)) 1318 return false; 1319 1320 return dacloffset <= acl_len - sizeof(struct smb_acl); 1321 } 1322 1323 1324 /* Convert CIFS ACL to POSIX form */ 1325 static int parse_sec_desc(struct cifs_sb_info *cifs_sb, 1326 struct smb_ntsd *pntsd, int acl_len, struct cifs_fattr *fattr, 1327 bool get_mode_from_special_sid) 1328 { 1329 int rc = 0; 1330 struct smb_sid *owner_sid_ptr, *group_sid_ptr; 1331 struct smb_acl *dacl_ptr; /* no need for SACL ptr */ 1332 char *end_of_acl; 1333 __u32 dacloffset, osidoffset, gsidoffset; 1334 1335 if (pntsd == NULL) 1336 return smb_EIO(smb_eio_trace_null_pointers); 1337 if (acl_len < (int)sizeof(struct smb_ntsd)) { 1338 cifs_dbg(VFS, "ACL too small to parse security descriptor\n"); 1339 return -EINVAL; 1340 } 1341 end_of_acl = ((char *)pntsd) + acl_len; 1342 1343 osidoffset = le32_to_cpu(pntsd->osidoffset); 1344 gsidoffset = le32_to_cpu(pntsd->gsidoffset); 1345 dacloffset = le32_to_cpu(pntsd->dacloffset); 1346 cifs_dbg(NOISY, "revision %d type 0x%x ooffset 0x%x goffset 0x%x sacloffset 0x%x dacloffset 0x%x\n", 1347 pntsd->revision, pntsd->type, osidoffset, gsidoffset, 1348 le32_to_cpu(pntsd->sacloffset), dacloffset); 1349 /* cifs_dump_mem("owner_sid: ", owner_sid_ptr, 64); */ 1350 rc = sid_from_sd(pntsd, acl_len, osidoffset, &owner_sid_ptr); 1351 if (rc) { 1352 cifs_dbg(FYI, "%s: Error %d parsing Owner SID\n", __func__, rc); 1353 return rc; 1354 } 1355 rc = sid_to_id(cifs_sb, owner_sid_ptr, fattr, SIDOWNER); 1356 if (rc) { 1357 cifs_dbg(FYI, "%s: Error %d mapping Owner SID to uid\n", 1358 __func__, rc); 1359 return rc; 1360 } 1361 1362 rc = sid_from_sd(pntsd, acl_len, gsidoffset, &group_sid_ptr); 1363 if (rc) { 1364 cifs_dbg(FYI, "%s: Error %d parsing Group SID\n", 1365 __func__, rc); 1366 return rc; 1367 } 1368 rc = sid_to_id(cifs_sb, group_sid_ptr, fattr, SIDGROUP); 1369 if (rc) { 1370 cifs_dbg(FYI, "%s: Error %d mapping Group SID to gid\n", 1371 __func__, rc); 1372 return rc; 1373 } 1374 1375 if (dacloffset) { 1376 if (!dacl_offset_valid(acl_len, dacloffset)) { 1377 cifs_dbg(VFS, "Server returned illegal DACL offset\n"); 1378 return -EINVAL; 1379 } 1380 1381 dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset); 1382 parse_dacl(dacl_ptr, end_of_acl, owner_sid_ptr, 1383 group_sid_ptr, fattr, get_mode_from_special_sid); 1384 } else { 1385 cifs_dbg(FYI, "no ACL\n"); /* BB grant all or default perms? */ 1386 } 1387 1388 return rc; 1389 } 1390 1391 /* Convert permission bits from mode to equivalent CIFS ACL */ 1392 static int build_sec_desc(struct smb_ntsd *pntsd, struct smb_ntsd *pnntsd, 1393 __u32 secdesclen, __u32 *pnsecdesclen, __u64 *pnmode, kuid_t uid, kgid_t gid, 1394 bool mode_from_sid, bool id_from_sid, bool posix, int *aclflag) 1395 { 1396 int rc = 0; 1397 __u32 dacloffset; 1398 __u32 ndacloffset; 1399 __u32 sidsoffset; 1400 struct smb_sid *owner_sid_ptr, *group_sid_ptr; 1401 struct smb_sid *nowner_sid_ptr = NULL, *ngroup_sid_ptr = NULL; 1402 struct smb_acl *dacl_ptr = NULL; /* no need for SACL ptr */ 1403 struct smb_acl *ndacl_ptr = NULL; /* no need for SACL ptr */ 1404 char *end_of_acl; 1405 u16 size = 0; 1406 __u32 osidoffset, gsidoffset; 1407 1408 if (secdesclen < sizeof(struct smb_ntsd)) { 1409 cifs_dbg(VFS, "ACL too small to parse security descriptor\n"); 1410 return -EINVAL; 1411 } 1412 end_of_acl = ((char *)pntsd) + secdesclen; 1413 1414 dacloffset = le32_to_cpu(pntsd->dacloffset); 1415 if (dacloffset) { 1416 if (!dacl_offset_valid(secdesclen, dacloffset)) { 1417 cifs_dbg(VFS, "Server returned illegal DACL offset\n"); 1418 return -EINVAL; 1419 } 1420 1421 dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset); 1422 rc = validate_dacl(dacl_ptr, end_of_acl); 1423 if (rc) 1424 return rc; 1425 } 1426 1427 osidoffset = le32_to_cpu(pntsd->osidoffset); 1428 gsidoffset = le32_to_cpu(pntsd->gsidoffset); 1429 rc = sid_from_sd(pntsd, secdesclen, osidoffset, &owner_sid_ptr); 1430 if (rc) { 1431 cifs_dbg(FYI, "%s: Error %d parsing Owner SID\n", __func__, rc); 1432 return rc; 1433 } 1434 rc = sid_from_sd(pntsd, secdesclen, gsidoffset, &group_sid_ptr); 1435 if (rc) { 1436 cifs_dbg(FYI, "%s: Error %d parsing Group SID\n", __func__, rc); 1437 return rc; 1438 } 1439 1440 if (pnmode && *pnmode != NO_CHANGE_64) { /* chmod */ 1441 ndacloffset = sizeof(struct smb_ntsd); 1442 ndacl_ptr = (struct smb_acl *)((char *)pnntsd + ndacloffset); 1443 ndacl_ptr->revision = 1444 dacloffset ? dacl_ptr->revision : cpu_to_le16(ACL_REVISION); 1445 1446 ndacl_ptr->size = cpu_to_le16(0); 1447 ndacl_ptr->num_aces = cpu_to_le16(0); 1448 1449 rc = set_chmod_dacl(dacl_ptr, ndacl_ptr, owner_sid_ptr, group_sid_ptr, 1450 pnmode, mode_from_sid, posix); 1451 1452 sidsoffset = ndacloffset + le16_to_cpu(ndacl_ptr->size); 1453 /* copy the non-dacl portion of secdesc */ 1454 rc = copy_sec_desc(pntsd, pnntsd, sidsoffset, secdesclen, 1455 pnsecdesclen, NULL, NULL); 1456 if (rc) 1457 return rc; 1458 1459 *aclflag |= CIFS_ACL_DACL; 1460 } else { 1461 ndacloffset = sizeof(struct smb_ntsd); 1462 ndacl_ptr = (struct smb_acl *)((char *)pnntsd + ndacloffset); 1463 ndacl_ptr->revision = 1464 dacloffset ? dacl_ptr->revision : cpu_to_le16(ACL_REVISION); 1465 ndacl_ptr->num_aces = dacl_ptr ? dacl_ptr->num_aces : 0; 1466 1467 if (uid_valid(uid)) { /* chown */ 1468 uid_t id; 1469 nowner_sid_ptr = kzalloc_obj(struct smb_sid); 1470 if (!nowner_sid_ptr) { 1471 rc = -ENOMEM; 1472 goto chown_chgrp_exit; 1473 } 1474 id = from_kuid(&init_user_ns, uid); 1475 if (id_from_sid) { 1476 struct owner_sid *osid = (struct owner_sid *)nowner_sid_ptr; 1477 /* Populate the user ownership fields S-1-5-88-1 */ 1478 osid->Revision = 1; 1479 osid->NumAuth = 3; 1480 osid->Authority[5] = 5; 1481 osid->SubAuthorities[0] = cpu_to_le32(88); 1482 osid->SubAuthorities[1] = cpu_to_le32(1); 1483 osid->SubAuthorities[2] = cpu_to_le32(id); 1484 1485 } else { /* lookup sid with upcall */ 1486 rc = id_to_sid(id, SIDOWNER, nowner_sid_ptr); 1487 if (rc) { 1488 cifs_dbg(FYI, "%s: Mapping error %d for owner id %d\n", 1489 __func__, rc, id); 1490 goto chown_chgrp_exit; 1491 } 1492 } 1493 *aclflag |= CIFS_ACL_OWNER; 1494 } 1495 if (gid_valid(gid)) { /* chgrp */ 1496 gid_t id; 1497 ngroup_sid_ptr = kzalloc_obj(struct smb_sid); 1498 if (!ngroup_sid_ptr) { 1499 rc = -ENOMEM; 1500 goto chown_chgrp_exit; 1501 } 1502 id = from_kgid(&init_user_ns, gid); 1503 if (id_from_sid) { 1504 struct owner_sid *gsid = (struct owner_sid *)ngroup_sid_ptr; 1505 /* Populate the group ownership fields S-1-5-88-2 */ 1506 gsid->Revision = 1; 1507 gsid->NumAuth = 3; 1508 gsid->Authority[5] = 5; 1509 gsid->SubAuthorities[0] = cpu_to_le32(88); 1510 gsid->SubAuthorities[1] = cpu_to_le32(2); 1511 gsid->SubAuthorities[2] = cpu_to_le32(id); 1512 1513 } else { /* lookup sid with upcall */ 1514 rc = id_to_sid(id, SIDGROUP, ngroup_sid_ptr); 1515 if (rc) { 1516 cifs_dbg(FYI, "%s: Mapping error %d for group id %d\n", 1517 __func__, rc, id); 1518 goto chown_chgrp_exit; 1519 } 1520 } 1521 *aclflag |= CIFS_ACL_GROUP; 1522 } 1523 1524 if (dacloffset) { 1525 /* Replace ACEs for old owner with new one */ 1526 size = replace_sids_and_copy_aces(dacl_ptr, ndacl_ptr, 1527 owner_sid_ptr, group_sid_ptr, 1528 nowner_sid_ptr, ngroup_sid_ptr, 1529 aclflag); 1530 ndacl_ptr->size = cpu_to_le16(size); 1531 } 1532 1533 sidsoffset = ndacloffset + le16_to_cpu(ndacl_ptr->size); 1534 /* copy the non-dacl portion of secdesc */ 1535 rc = copy_sec_desc(pntsd, pnntsd, sidsoffset, secdesclen, 1536 pnsecdesclen, nowner_sid_ptr, ngroup_sid_ptr); 1537 if (rc) 1538 goto chown_chgrp_exit; 1539 1540 chown_chgrp_exit: 1541 /* errors could jump here. So make sure we return soon after this */ 1542 kfree(nowner_sid_ptr); 1543 kfree(ngroup_sid_ptr); 1544 } 1545 1546 return rc; 1547 } 1548 1549 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY 1550 struct smb_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb, 1551 const struct cifs_fid *cifsfid, u32 *pacllen, 1552 u32 info) 1553 { 1554 struct smb_ntsd *pntsd = NULL; 1555 unsigned int xid; 1556 int rc; 1557 struct tcon_link *tlink = cifs_sb_tlink(cifs_sb); 1558 1559 if (IS_ERR(tlink)) 1560 return ERR_CAST(tlink); 1561 1562 xid = get_xid(); 1563 rc = CIFSSMBGetCIFSACL(xid, tlink_tcon(tlink), cifsfid->netfid, &pntsd, 1564 pacllen, info); 1565 free_xid(xid); 1566 1567 cifs_put_tlink(tlink); 1568 1569 cifs_dbg(FYI, "%s: rc = %d ACL len %d\n", __func__, rc, *pacllen); 1570 if (rc) 1571 return ERR_PTR(rc); 1572 return pntsd; 1573 } 1574 1575 static struct smb_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb, 1576 const char *path, u32 *pacllen, u32 info) 1577 { 1578 struct smb_ntsd *pntsd = NULL; 1579 int oplock = 0; 1580 unsigned int xid; 1581 int rc; 1582 struct cifs_tcon *tcon; 1583 struct tcon_link *tlink = cifs_sb_tlink(cifs_sb); 1584 struct cifs_fid fid; 1585 struct cifs_open_parms oparms; 1586 1587 if (IS_ERR(tlink)) 1588 return ERR_CAST(tlink); 1589 1590 tcon = tlink_tcon(tlink); 1591 xid = get_xid(); 1592 1593 oparms = (struct cifs_open_parms) { 1594 .tcon = tcon, 1595 .cifs_sb = cifs_sb, 1596 .desired_access = READ_CONTROL, 1597 .create_options = cifs_create_options(cifs_sb, 0), 1598 .disposition = FILE_OPEN, 1599 .path = path, 1600 .fid = &fid, 1601 }; 1602 1603 if (info & SACL_SECINFO) 1604 oparms.desired_access |= SYSTEM_SECURITY; 1605 1606 rc = CIFS_open(xid, &oparms, &oplock, NULL); 1607 if (!rc) { 1608 rc = CIFSSMBGetCIFSACL(xid, tcon, fid.netfid, &pntsd, pacllen, info); 1609 CIFSSMBClose(xid, tcon, fid.netfid); 1610 } 1611 1612 cifs_put_tlink(tlink); 1613 free_xid(xid); 1614 1615 cifs_dbg(FYI, "%s: rc = %d ACL len %d\n", __func__, rc, *pacllen); 1616 if (rc) 1617 return ERR_PTR(rc); 1618 return pntsd; 1619 } 1620 1621 /* Retrieve an ACL from the server */ 1622 struct smb_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb, 1623 struct inode *inode, const char *path, 1624 u32 *pacllen, u32 info) 1625 { 1626 struct smb_ntsd *pntsd = NULL; 1627 struct cifsFileInfo *open_file = NULL; 1628 1629 if (inode) 1630 open_file = find_readable_file(CIFS_I(inode), FIND_FSUID_ONLY); 1631 if (!open_file) 1632 return get_cifs_acl_by_path(cifs_sb, path, pacllen, info); 1633 1634 pntsd = get_cifs_acl_by_fid(cifs_sb, &open_file->fid, pacllen, info); 1635 cifsFileInfo_put(open_file); 1636 return pntsd; 1637 } 1638 1639 /* Set an ACL on the server */ 1640 int set_cifs_acl(struct smb_ntsd *pnntsd, __u32 acllen, 1641 struct inode *inode, const char *path, int aclflag) 1642 { 1643 int oplock = 0; 1644 unsigned int xid; 1645 int rc, access_flags = 0; 1646 struct cifs_tcon *tcon; 1647 struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); 1648 struct tcon_link *tlink = cifs_sb_tlink(cifs_sb); 1649 struct cifs_fid fid; 1650 struct cifs_open_parms oparms; 1651 1652 if (IS_ERR(tlink)) 1653 return PTR_ERR(tlink); 1654 1655 tcon = tlink_tcon(tlink); 1656 xid = get_xid(); 1657 1658 if (aclflag & CIFS_ACL_OWNER || aclflag & CIFS_ACL_GROUP) 1659 access_flags |= WRITE_OWNER; 1660 if (aclflag & CIFS_ACL_SACL) 1661 access_flags |= SYSTEM_SECURITY; 1662 if (aclflag & CIFS_ACL_DACL) 1663 access_flags |= WRITE_DAC; 1664 1665 oparms = (struct cifs_open_parms) { 1666 .tcon = tcon, 1667 .cifs_sb = cifs_sb, 1668 .desired_access = access_flags, 1669 .create_options = cifs_create_options(cifs_sb, 0), 1670 .disposition = FILE_OPEN, 1671 .path = path, 1672 .fid = &fid, 1673 }; 1674 1675 rc = CIFS_open(xid, &oparms, &oplock, NULL); 1676 if (rc) { 1677 cifs_dbg(VFS, "Unable to open file to set ACL\n"); 1678 goto out; 1679 } 1680 1681 rc = CIFSSMBSetCIFSACL(xid, tcon, fid.netfid, pnntsd, acllen, aclflag); 1682 cifs_dbg(NOISY, "SetCIFSACL rc = %d\n", rc); 1683 1684 CIFSSMBClose(xid, tcon, fid.netfid); 1685 out: 1686 free_xid(xid); 1687 cifs_put_tlink(tlink); 1688 return rc; 1689 } 1690 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */ 1691 1692 /* Translate the CIFS ACL (similar to NTFS ACL) for a file into mode bits */ 1693 int 1694 cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr, 1695 struct inode *inode, bool mode_from_special_sid, 1696 const char *path, const struct cifs_fid *pfid) 1697 { 1698 struct smb_ntsd *pntsd = NULL; 1699 u32 acllen = 0; 1700 int rc = 0; 1701 struct tcon_link *tlink = cifs_sb_tlink(cifs_sb); 1702 struct smb_version_operations *ops; 1703 const u32 info = OWNER_SECINFO | GROUP_SECINFO | DACL_SECINFO; 1704 1705 cifs_dbg(NOISY, "converting ACL to mode for %s\n", path); 1706 1707 if (IS_ERR(tlink)) 1708 return PTR_ERR(tlink); 1709 1710 ops = tlink_tcon(tlink)->ses->server->ops; 1711 1712 if (pfid && (ops->get_acl_by_fid)) 1713 pntsd = ops->get_acl_by_fid(cifs_sb, pfid, &acllen, info); 1714 else if (ops->get_acl) 1715 pntsd = ops->get_acl(cifs_sb, inode, path, &acllen, info); 1716 else { 1717 cifs_put_tlink(tlink); 1718 return -EOPNOTSUPP; 1719 } 1720 /* if we can retrieve the ACL, now parse Access Control Entries, ACEs */ 1721 if (IS_ERR(pntsd)) { 1722 rc = PTR_ERR(pntsd); 1723 cifs_dbg(VFS, "%s: error %d getting sec desc\n", __func__, rc); 1724 } else if (mode_from_special_sid) { 1725 rc = parse_sec_desc(cifs_sb, pntsd, acllen, fattr, true); 1726 kfree(pntsd); 1727 } else { 1728 /* get approximated mode from ACL */ 1729 rc = parse_sec_desc(cifs_sb, pntsd, acllen, fattr, false); 1730 kfree(pntsd); 1731 if (rc) 1732 cifs_dbg(VFS, "parse sec desc failed rc = %d\n", rc); 1733 } 1734 1735 cifs_put_tlink(tlink); 1736 1737 return rc; 1738 } 1739 1740 /* Convert mode bits to an ACL so we can update the ACL on the server */ 1741 int 1742 id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode, 1743 kuid_t uid, kgid_t gid) 1744 { 1745 int rc = 0; 1746 int aclflag = 0; 1747 __u32 secdesclen = 0; 1748 __u32 nsecdesclen = 0; 1749 __u32 dacloffset = 0; 1750 struct smb_acl *dacl_ptr = NULL; 1751 struct smb_ntsd *pntsd = NULL; /* acl obtained from server */ 1752 struct smb_ntsd *pnntsd = NULL; /* modified acl to be sent to server */ 1753 struct cifs_sb_info *cifs_sb = CIFS_SB(inode); 1754 unsigned int sbflags; 1755 struct tcon_link *tlink; 1756 struct smb_version_operations *ops; 1757 bool mode_from_sid, id_from_sid; 1758 const u32 info = OWNER_SECINFO | GROUP_SECINFO | DACL_SECINFO; 1759 bool posix; 1760 1761 tlink = cifs_sb_tlink(cifs_sb); 1762 if (IS_ERR(tlink)) 1763 return PTR_ERR(tlink); 1764 posix = tlink_tcon(tlink)->posix_extensions; 1765 1766 ops = tlink_tcon(tlink)->ses->server->ops; 1767 1768 cifs_dbg(NOISY, "set ACL from mode for %s\n", path); 1769 1770 /* Get the security descriptor */ 1771 1772 if (ops->get_acl == NULL) { 1773 cifs_put_tlink(tlink); 1774 return -EOPNOTSUPP; 1775 } 1776 1777 pntsd = ops->get_acl(cifs_sb, inode, path, &secdesclen, info); 1778 if (IS_ERR(pntsd)) { 1779 rc = PTR_ERR(pntsd); 1780 cifs_dbg(VFS, "%s: error %d getting sec desc\n", __func__, rc); 1781 cifs_put_tlink(tlink); 1782 return rc; 1783 } 1784 1785 sbflags = cifs_sb_flags(cifs_sb); 1786 mode_from_sid = sbflags & CIFS_MOUNT_MODE_FROM_SID; 1787 id_from_sid = sbflags & CIFS_MOUNT_UID_FROM_ACL; 1788 1789 /* Potentially, five new ACEs can be added to the ACL for U,G,O mapping */ 1790 if (pnmode && *pnmode != NO_CHANGE_64) { /* chmod */ 1791 if (posix) 1792 nsecdesclen = 1 * sizeof(struct smb_ace); 1793 else if (mode_from_sid) 1794 nsecdesclen = secdesclen + (2 * sizeof(struct smb_ace)); 1795 else /* cifsacl */ 1796 nsecdesclen = secdesclen + (5 * sizeof(struct smb_ace)); 1797 } else { /* chown */ 1798 /* When ownership changes, changes new owner sid length could be different */ 1799 nsecdesclen = sizeof(struct smb_ntsd) + (sizeof(struct smb_sid) * 2); 1800 dacloffset = le32_to_cpu(pntsd->dacloffset); 1801 if (dacloffset) { 1802 if (!dacl_offset_valid(secdesclen, dacloffset)) { 1803 cifs_dbg(VFS, "Server returned illegal DACL offset\n"); 1804 rc = -EINVAL; 1805 goto id_mode_to_cifs_acl_exit; 1806 } 1807 1808 dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset); 1809 rc = validate_dacl(dacl_ptr, (char *)pntsd + secdesclen); 1810 if (rc) { 1811 kfree(pntsd); 1812 cifs_put_tlink(tlink); 1813 return rc; 1814 } 1815 if (mode_from_sid) 1816 nsecdesclen += 1817 le16_to_cpu(dacl_ptr->num_aces) * sizeof(struct smb_ace); 1818 else /* cifsacl */ 1819 nsecdesclen += le16_to_cpu(dacl_ptr->size); 1820 } 1821 } 1822 1823 /* 1824 * Add three ACEs for owner, group, everyone getting rid of other ACEs 1825 * as chmod disables ACEs and set the security descriptor. Allocate 1826 * memory for the smb header, set security descriptor request security 1827 * descriptor parameters, and security descriptor itself 1828 */ 1829 nsecdesclen = max_t(u32, nsecdesclen, DEFAULT_SEC_DESC_LEN); 1830 pnntsd = kzalloc(nsecdesclen, GFP_KERNEL); 1831 if (!pnntsd) { 1832 kfree(pntsd); 1833 cifs_put_tlink(tlink); 1834 return -ENOMEM; 1835 } 1836 1837 rc = build_sec_desc(pntsd, pnntsd, secdesclen, &nsecdesclen, pnmode, uid, gid, 1838 mode_from_sid, id_from_sid, posix, &aclflag); 1839 1840 cifs_dbg(NOISY, "build_sec_desc rc: %d\n", rc); 1841 1842 if (rc != 0) 1843 goto id_mode_to_cifs_acl_exit; 1844 1845 if (aclflag == 0) { 1846 cifs_dbg(FYI, "set_cifs_acl aclflag=0, no change mapped\n"); 1847 goto id_mode_to_cifs_acl_exit; 1848 } 1849 1850 if (ops->set_acl == NULL) { 1851 rc = -EOPNOTSUPP; 1852 goto id_mode_to_cifs_acl_exit; 1853 } 1854 1855 /* Set the security descriptor */ 1856 rc = ops->set_acl(pnntsd, nsecdesclen, inode, path, aclflag); 1857 cifs_dbg(NOISY, "set_cifs_acl rc: %d\n", rc); 1858 1859 id_mode_to_cifs_acl_exit: 1860 cifs_put_tlink(tlink); 1861 1862 kfree(pnntsd); 1863 kfree(pntsd); 1864 return rc; 1865 } 1866 1867 struct posix_acl *cifs_get_acl(struct mnt_idmap *idmap, 1868 struct dentry *dentry, int type) 1869 { 1870 #if defined(CONFIG_CIFS_ALLOW_INSECURE_LEGACY) && defined(CONFIG_CIFS_POSIX) 1871 struct posix_acl *acl = NULL; 1872 ssize_t rc = -EOPNOTSUPP; 1873 unsigned int xid; 1874 struct super_block *sb = dentry->d_sb; 1875 struct cifs_sb_info *cifs_sb = CIFS_SB(sb); 1876 struct tcon_link *tlink; 1877 struct cifs_tcon *pTcon; 1878 const char *full_path; 1879 void *page; 1880 1881 tlink = cifs_sb_tlink(cifs_sb); 1882 if (IS_ERR(tlink)) 1883 return ERR_CAST(tlink); 1884 pTcon = tlink_tcon(tlink); 1885 1886 xid = get_xid(); 1887 page = alloc_dentry_path(); 1888 1889 full_path = build_path_from_dentry(dentry, page); 1890 if (IS_ERR(full_path)) { 1891 acl = ERR_CAST(full_path); 1892 goto out; 1893 } 1894 1895 /* return alt name if available as pseudo attr */ 1896 switch (type) { 1897 case ACL_TYPE_ACCESS: 1898 if (sb->s_flags & SB_POSIXACL) 1899 rc = cifs_do_get_acl(xid, pTcon, full_path, &acl, 1900 ACL_TYPE_ACCESS, 1901 cifs_sb->local_nls, 1902 cifs_remap(cifs_sb)); 1903 break; 1904 1905 case ACL_TYPE_DEFAULT: 1906 if (sb->s_flags & SB_POSIXACL) 1907 rc = cifs_do_get_acl(xid, pTcon, full_path, &acl, 1908 ACL_TYPE_DEFAULT, 1909 cifs_sb->local_nls, 1910 cifs_remap(cifs_sb)); 1911 break; 1912 } 1913 1914 if (rc < 0) { 1915 if (rc == -EINVAL) 1916 acl = ERR_PTR(-EOPNOTSUPP); 1917 else 1918 acl = ERR_PTR(rc); 1919 } 1920 1921 out: 1922 free_dentry_path(page); 1923 free_xid(xid); 1924 cifs_put_tlink(tlink); 1925 return acl; 1926 #else 1927 return ERR_PTR(-EOPNOTSUPP); 1928 #endif 1929 } 1930 1931 int cifs_set_acl(struct mnt_idmap *idmap, struct dentry *dentry, 1932 struct posix_acl *acl, int type) 1933 { 1934 #if defined(CONFIG_CIFS_ALLOW_INSECURE_LEGACY) && defined(CONFIG_CIFS_POSIX) 1935 int rc = -EOPNOTSUPP; 1936 unsigned int xid; 1937 struct super_block *sb = dentry->d_sb; 1938 struct cifs_sb_info *cifs_sb = CIFS_SB(sb); 1939 struct tcon_link *tlink; 1940 struct cifs_tcon *pTcon; 1941 const char *full_path; 1942 void *page; 1943 1944 tlink = cifs_sb_tlink(cifs_sb); 1945 if (IS_ERR(tlink)) 1946 return PTR_ERR(tlink); 1947 pTcon = tlink_tcon(tlink); 1948 1949 xid = get_xid(); 1950 page = alloc_dentry_path(); 1951 1952 full_path = build_path_from_dentry(dentry, page); 1953 if (IS_ERR(full_path)) { 1954 rc = PTR_ERR(full_path); 1955 goto out; 1956 } 1957 1958 if (!acl) 1959 goto out; 1960 1961 /* return dos attributes as pseudo xattr */ 1962 /* return alt name if available as pseudo attr */ 1963 1964 /* if proc/fs/cifs/streamstoxattr is set then 1965 search server for EAs or streams to 1966 returns as xattrs */ 1967 if (posix_acl_xattr_size(acl->a_count) > CIFSMaxBufSize) { 1968 cifs_dbg(FYI, "size of EA value too large\n"); 1969 rc = -EOPNOTSUPP; 1970 goto out; 1971 } 1972 1973 switch (type) { 1974 case ACL_TYPE_ACCESS: 1975 if (sb->s_flags & SB_POSIXACL) 1976 rc = cifs_do_set_acl(xid, pTcon, full_path, acl, 1977 ACL_TYPE_ACCESS, 1978 cifs_sb->local_nls, 1979 cifs_remap(cifs_sb)); 1980 break; 1981 1982 case ACL_TYPE_DEFAULT: 1983 if (sb->s_flags & SB_POSIXACL) 1984 rc = cifs_do_set_acl(xid, pTcon, full_path, acl, 1985 ACL_TYPE_DEFAULT, 1986 cifs_sb->local_nls, 1987 cifs_remap(cifs_sb)); 1988 break; 1989 } 1990 1991 out: 1992 free_dentry_path(page); 1993 free_xid(xid); 1994 cifs_put_tlink(tlink); 1995 return rc; 1996 #else 1997 return -EOPNOTSUPP; 1998 #endif 1999 } 2000