1aa015c8eSEdward Tomasz Napierala /*- 2aa015c8eSEdward Tomasz Napierala * Copyright (c) 2001 Chris D. Faulhaber 3aa015c8eSEdward Tomasz Napierala * All rights reserved. 4aa015c8eSEdward Tomasz Napierala * 5aa015c8eSEdward Tomasz Napierala * Redistribution and use in source and binary forms, with or without 6aa015c8eSEdward Tomasz Napierala * modification, are permitted provided that the following conditions 7aa015c8eSEdward Tomasz Napierala * are met: 8aa015c8eSEdward Tomasz Napierala * 1. Redistributions of source code must retain the above copyright 9aa015c8eSEdward Tomasz Napierala * notice, this list of conditions and the following disclaimer. 10aa015c8eSEdward Tomasz Napierala * 2. Redistributions in binary form must reproduce the above copyright 11aa015c8eSEdward Tomasz Napierala * notice, this list of conditions and the following disclaimer in the 12aa015c8eSEdward Tomasz Napierala * documentation and/or other materials provided with the distribution. 13aa015c8eSEdward Tomasz Napierala * 14aa015c8eSEdward Tomasz Napierala * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15aa015c8eSEdward Tomasz Napierala * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16aa015c8eSEdward Tomasz Napierala * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17a303eae7SJoel Dahl * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18a303eae7SJoel Dahl * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19a303eae7SJoel Dahl * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20a303eae7SJoel Dahl * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21a303eae7SJoel Dahl * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22a303eae7SJoel Dahl * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23a303eae7SJoel Dahl * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24a303eae7SJoel Dahl * SUCH DAMAGE. 25aa015c8eSEdward Tomasz Napierala */ 26aa015c8eSEdward Tomasz Napierala 27aa015c8eSEdward Tomasz Napierala #include <sys/cdefs.h> 28aa015c8eSEdward Tomasz Napierala __FBSDID("$FreeBSD$"); 29aa015c8eSEdward Tomasz Napierala 30aa015c8eSEdward Tomasz Napierala #include <errno.h> 31aa015c8eSEdward Tomasz Napierala #include <stdio.h> 32aa015c8eSEdward Tomasz Napierala #include <assert.h> 33aa015c8eSEdward Tomasz Napierala #include <sys/acl.h> 344089cc8aSEdward Tomasz Napierala #include <sys/stat.h> 35aa015c8eSEdward Tomasz Napierala 36aa015c8eSEdward Tomasz Napierala #include "acl_support.h" 37aa015c8eSEdward Tomasz Napierala 38aa015c8eSEdward Tomasz Napierala /* 39cdec3856SEdward Tomasz Napierala * These routines from sys/kern/subr_acl_nfs4.c are used by both kernel 40aa015c8eSEdward Tomasz Napierala * and libc. 41aa015c8eSEdward Tomasz Napierala */ 42aa015c8eSEdward Tomasz Napierala void acl_nfs4_sync_mode_from_acl(mode_t *_mode, const struct acl *aclp); 43cdec3856SEdward Tomasz Napierala void acl_nfs4_trivial_from_mode_libc(struct acl *aclp, int file_owner_id, 44cdec3856SEdward Tomasz Napierala int canonical_six); 45aa015c8eSEdward Tomasz Napierala 46aa015c8eSEdward Tomasz Napierala static acl_t 474089cc8aSEdward Tomasz Napierala _nfs4_acl_strip_np(const acl_t aclp, int canonical_six) 48aa015c8eSEdward Tomasz Napierala { 49aa015c8eSEdward Tomasz Napierala acl_t newacl; 507945d60dSEdward Tomasz Napierala mode_t mode = 0; 51aa015c8eSEdward Tomasz Napierala 52aa015c8eSEdward Tomasz Napierala newacl = acl_init(ACL_MAX_ENTRIES); 53aa015c8eSEdward Tomasz Napierala if (newacl == NULL) { 54aa015c8eSEdward Tomasz Napierala errno = ENOMEM; 55aa015c8eSEdward Tomasz Napierala return (NULL); 56aa015c8eSEdward Tomasz Napierala } 57aa015c8eSEdward Tomasz Napierala 58aa015c8eSEdward Tomasz Napierala _acl_brand_as(newacl, ACL_BRAND_NFS4); 59aa015c8eSEdward Tomasz Napierala 60aa015c8eSEdward Tomasz Napierala acl_nfs4_sync_mode_from_acl(&mode, &(aclp->ats_acl)); 61cdec3856SEdward Tomasz Napierala acl_nfs4_trivial_from_mode_libc(&(newacl->ats_acl), mode, canonical_six); 62aa015c8eSEdward Tomasz Napierala 63aa015c8eSEdward Tomasz Napierala return (newacl); 64aa015c8eSEdward Tomasz Napierala } 65aa015c8eSEdward Tomasz Napierala 66aa015c8eSEdward Tomasz Napierala static acl_t 67aa015c8eSEdward Tomasz Napierala _posix1e_acl_strip_np(const acl_t aclp, int recalculate_mask) 68aa015c8eSEdward Tomasz Napierala { 69aa015c8eSEdward Tomasz Napierala acl_t acl_new, acl_old; 70aa015c8eSEdward Tomasz Napierala acl_entry_t entry, entry_new; 71aa015c8eSEdward Tomasz Napierala acl_permset_t perm; 72aa015c8eSEdward Tomasz Napierala acl_tag_t tag; 73aa015c8eSEdward Tomasz Napierala int entry_id, have_mask_entry; 74aa015c8eSEdward Tomasz Napierala 75aa015c8eSEdward Tomasz Napierala assert(_acl_brand(aclp) == ACL_BRAND_POSIX); 76aa015c8eSEdward Tomasz Napierala 77aa015c8eSEdward Tomasz Napierala acl_old = acl_dup(aclp); 78aa015c8eSEdward Tomasz Napierala if (acl_old == NULL) 79aa015c8eSEdward Tomasz Napierala return (NULL); 80aa015c8eSEdward Tomasz Napierala 81aa015c8eSEdward Tomasz Napierala assert(_acl_brand(acl_old) == ACL_BRAND_POSIX); 82aa015c8eSEdward Tomasz Napierala 83aa015c8eSEdward Tomasz Napierala have_mask_entry = 0; 84aa015c8eSEdward Tomasz Napierala acl_new = acl_init(ACL_MAX_ENTRIES); 85cf0f0b80SPedro F. Giffuni if (acl_new == NULL) { 86cf0f0b80SPedro F. Giffuni acl_free(acl_old); 87aa015c8eSEdward Tomasz Napierala return (NULL); 88cf0f0b80SPedro F. Giffuni } 89aa015c8eSEdward Tomasz Napierala tag = ACL_UNDEFINED_TAG; 90aa015c8eSEdward Tomasz Napierala 91aa015c8eSEdward Tomasz Napierala /* only save the default user/group/other entries */ 92aa015c8eSEdward Tomasz Napierala entry_id = ACL_FIRST_ENTRY; 93aa015c8eSEdward Tomasz Napierala while (acl_get_entry(acl_old, entry_id, &entry) == 1) { 94aa015c8eSEdward Tomasz Napierala entry_id = ACL_NEXT_ENTRY; 95aa015c8eSEdward Tomasz Napierala 96aa015c8eSEdward Tomasz Napierala assert(_entry_brand(entry) == ACL_BRAND_POSIX); 97aa015c8eSEdward Tomasz Napierala 98aa015c8eSEdward Tomasz Napierala if (acl_get_tag_type(entry, &tag) == -1) 99cf0f0b80SPedro F. Giffuni goto fail; 100aa015c8eSEdward Tomasz Napierala 101aa015c8eSEdward Tomasz Napierala switch(tag) { 102aa015c8eSEdward Tomasz Napierala case ACL_USER_OBJ: 103aa015c8eSEdward Tomasz Napierala case ACL_GROUP_OBJ: 104aa015c8eSEdward Tomasz Napierala case ACL_OTHER: 105aa015c8eSEdward Tomasz Napierala if (acl_get_tag_type(entry, &tag) == -1) 106cf0f0b80SPedro F. Giffuni goto fail; 107aa015c8eSEdward Tomasz Napierala if (acl_get_permset(entry, &perm) == -1) 108cf0f0b80SPedro F. Giffuni goto fail; 109aa015c8eSEdward Tomasz Napierala if (acl_create_entry(&acl_new, &entry_new) == -1) 110*8e6acc53SEdward Tomasz Napierala goto fail; 111aa015c8eSEdward Tomasz Napierala if (acl_set_tag_type(entry_new, tag) == -1) 112*8e6acc53SEdward Tomasz Napierala goto fail; 113aa015c8eSEdward Tomasz Napierala if (acl_set_permset(entry_new, perm) == -1) 114*8e6acc53SEdward Tomasz Napierala goto fail; 115aa015c8eSEdward Tomasz Napierala if (acl_copy_entry(entry_new, entry) == -1) 116*8e6acc53SEdward Tomasz Napierala goto fail; 117aa015c8eSEdward Tomasz Napierala assert(_entry_brand(entry_new) == ACL_BRAND_POSIX); 118aa015c8eSEdward Tomasz Napierala break; 119aa015c8eSEdward Tomasz Napierala case ACL_MASK: 120aa015c8eSEdward Tomasz Napierala have_mask_entry = 1; 121aa015c8eSEdward Tomasz Napierala break; 122aa015c8eSEdward Tomasz Napierala default: 123aa015c8eSEdward Tomasz Napierala break; 124aa015c8eSEdward Tomasz Napierala } 125aa015c8eSEdward Tomasz Napierala } 126aa015c8eSEdward Tomasz Napierala 127aa015c8eSEdward Tomasz Napierala assert(_acl_brand(acl_new) == ACL_BRAND_POSIX); 128aa015c8eSEdward Tomasz Napierala 129aa015c8eSEdward Tomasz Napierala if (have_mask_entry && recalculate_mask) { 130aa015c8eSEdward Tomasz Napierala if (acl_calc_mask(&acl_new) == -1) 131*8e6acc53SEdward Tomasz Napierala goto fail; 132aa015c8eSEdward Tomasz Napierala } 133aa015c8eSEdward Tomasz Napierala 134aa015c8eSEdward Tomasz Napierala return (acl_new); 135*8e6acc53SEdward Tomasz Napierala 136*8e6acc53SEdward Tomasz Napierala fail: 137*8e6acc53SEdward Tomasz Napierala acl_free(acl_new); 138*8e6acc53SEdward Tomasz Napierala acl_free(acl_old); 139*8e6acc53SEdward Tomasz Napierala 140*8e6acc53SEdward Tomasz Napierala return (NULL); 141aa015c8eSEdward Tomasz Napierala } 142aa015c8eSEdward Tomasz Napierala 143aa015c8eSEdward Tomasz Napierala acl_t 144aa015c8eSEdward Tomasz Napierala acl_strip_np(const acl_t aclp, int recalculate_mask) 145aa015c8eSEdward Tomasz Napierala { 146aa015c8eSEdward Tomasz Napierala switch (_acl_brand(aclp)) { 147aa015c8eSEdward Tomasz Napierala case ACL_BRAND_NFS4: 148e43af6d3SEdward Tomasz Napierala return (_nfs4_acl_strip_np(aclp, 0)); 149aa015c8eSEdward Tomasz Napierala 150aa015c8eSEdward Tomasz Napierala case ACL_BRAND_POSIX: 151aa015c8eSEdward Tomasz Napierala return (_posix1e_acl_strip_np(aclp, recalculate_mask)); 152aa015c8eSEdward Tomasz Napierala 153aa015c8eSEdward Tomasz Napierala default: 154aa015c8eSEdward Tomasz Napierala errno = EINVAL; 155aa015c8eSEdward Tomasz Napierala return (NULL); 156aa015c8eSEdward Tomasz Napierala } 157aa015c8eSEdward Tomasz Napierala } 158aa015c8eSEdward Tomasz Napierala 159aa015c8eSEdward Tomasz Napierala /* 160aa015c8eSEdward Tomasz Napierala * Return 1, if ACL is trivial, 0 otherwise. 161aa015c8eSEdward Tomasz Napierala * 162aa015c8eSEdward Tomasz Napierala * ACL is trivial, iff its meaning could be fully expressed using just file 163aa015c8eSEdward Tomasz Napierala * mode. In other words, ACL is trivial iff it doesn't have "+" to the right 164aa015c8eSEdward Tomasz Napierala * of the mode bits in "ls -l" output ;-) 165aa015c8eSEdward Tomasz Napierala */ 166aa015c8eSEdward Tomasz Napierala int 167aa015c8eSEdward Tomasz Napierala acl_is_trivial_np(const acl_t aclp, int *trivialp) 168aa015c8eSEdward Tomasz Napierala { 169aa015c8eSEdward Tomasz Napierala acl_t tmpacl; 170aa015c8eSEdward Tomasz Napierala int differs; 171aa015c8eSEdward Tomasz Napierala 172aa015c8eSEdward Tomasz Napierala if (aclp == NULL || trivialp == NULL) { 173aa015c8eSEdward Tomasz Napierala errno = EINVAL; 174aa015c8eSEdward Tomasz Napierala return (-1); 175aa015c8eSEdward Tomasz Napierala } 176aa015c8eSEdward Tomasz Napierala 177aa015c8eSEdward Tomasz Napierala switch (_acl_brand(aclp)) { 178aa015c8eSEdward Tomasz Napierala case ACL_BRAND_POSIX: 179aa015c8eSEdward Tomasz Napierala if (aclp->ats_acl.acl_cnt == 3) 180aa015c8eSEdward Tomasz Napierala *trivialp = 1; 181aa015c8eSEdward Tomasz Napierala else 182aa015c8eSEdward Tomasz Napierala *trivialp = 0; 183aa015c8eSEdward Tomasz Napierala 184aa015c8eSEdward Tomasz Napierala return (0); 185aa015c8eSEdward Tomasz Napierala 186aa015c8eSEdward Tomasz Napierala case ACL_BRAND_NFS4: 187aa015c8eSEdward Tomasz Napierala /* 1887eaa29b5SEdward Tomasz Napierala * If the ACL has more than canonical six entries, 1897eaa29b5SEdward Tomasz Napierala * it's non trivial by definition. 1907eaa29b5SEdward Tomasz Napierala */ 1917eaa29b5SEdward Tomasz Napierala if (aclp->ats_acl.acl_cnt > 6) { 19278141351SEdward Tomasz Napierala *trivialp = 0; 1937eaa29b5SEdward Tomasz Napierala return (0); 1947eaa29b5SEdward Tomasz Napierala } 1957eaa29b5SEdward Tomasz Napierala 1967eaa29b5SEdward Tomasz Napierala /* 1974089cc8aSEdward Tomasz Napierala * Calculate trivial ACL - using acl_strip_np(3) - and compare 198aa015c8eSEdward Tomasz Napierala * with the original. 199aa015c8eSEdward Tomasz Napierala */ 2004089cc8aSEdward Tomasz Napierala tmpacl = _nfs4_acl_strip_np(aclp, 0); 2014089cc8aSEdward Tomasz Napierala if (tmpacl == NULL) 2024089cc8aSEdward Tomasz Napierala return (-1); 2034089cc8aSEdward Tomasz Napierala 2044089cc8aSEdward Tomasz Napierala differs = _acl_differs(aclp, tmpacl); 2054089cc8aSEdward Tomasz Napierala acl_free(tmpacl); 2064089cc8aSEdward Tomasz Napierala 2074089cc8aSEdward Tomasz Napierala if (differs == 0) { 2084089cc8aSEdward Tomasz Napierala *trivialp = 1; 2094089cc8aSEdward Tomasz Napierala return (0); 2104089cc8aSEdward Tomasz Napierala } 2114089cc8aSEdward Tomasz Napierala 2124089cc8aSEdward Tomasz Napierala /* 2134089cc8aSEdward Tomasz Napierala * Try again with an old-style, "canonical six" trivial ACL. 2144089cc8aSEdward Tomasz Napierala */ 2154089cc8aSEdward Tomasz Napierala tmpacl = _nfs4_acl_strip_np(aclp, 1); 216aa015c8eSEdward Tomasz Napierala if (tmpacl == NULL) 217aa015c8eSEdward Tomasz Napierala return (-1); 218aa015c8eSEdward Tomasz Napierala 219aa015c8eSEdward Tomasz Napierala differs = _acl_differs(aclp, tmpacl); 220aa015c8eSEdward Tomasz Napierala acl_free(tmpacl); 221aa015c8eSEdward Tomasz Napierala 222aa015c8eSEdward Tomasz Napierala if (differs) 223aa015c8eSEdward Tomasz Napierala *trivialp = 0; 224aa015c8eSEdward Tomasz Napierala else 225aa015c8eSEdward Tomasz Napierala *trivialp = 1; 226aa015c8eSEdward Tomasz Napierala 227aa015c8eSEdward Tomasz Napierala return (0); 228aa015c8eSEdward Tomasz Napierala 229aa015c8eSEdward Tomasz Napierala default: 230aa015c8eSEdward Tomasz Napierala errno = EINVAL; 231aa015c8eSEdward Tomasz Napierala return (-1); 232aa015c8eSEdward Tomasz Napierala } 233aa015c8eSEdward Tomasz Napierala } 234