1aa015c8eSEdward Tomasz Napierala /*- 2aa015c8eSEdward Tomasz Napierala * Copyright (c) 2001 Chris D. Faulhaber 3aa015c8eSEdward Tomasz Napierala * All rights reserved. 4aa015c8eSEdward Tomasz Napierala * 5aa015c8eSEdward Tomasz Napierala * Redistribution and use in source and binary forms, with or without 6aa015c8eSEdward Tomasz Napierala * modification, are permitted provided that the following conditions 7aa015c8eSEdward Tomasz Napierala * are met: 8aa015c8eSEdward Tomasz Napierala * 1. Redistributions of source code must retain the above copyright 9aa015c8eSEdward Tomasz Napierala * notice, this list of conditions and the following disclaimer. 10aa015c8eSEdward Tomasz Napierala * 2. Redistributions in binary form must reproduce the above copyright 11aa015c8eSEdward Tomasz Napierala * notice, this list of conditions and the following disclaimer in the 12aa015c8eSEdward Tomasz Napierala * documentation and/or other materials provided with the distribution. 13aa015c8eSEdward Tomasz Napierala * 14aa015c8eSEdward Tomasz Napierala * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15aa015c8eSEdward Tomasz Napierala * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16aa015c8eSEdward Tomasz Napierala * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17a303eae7SJoel Dahl * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18a303eae7SJoel Dahl * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19a303eae7SJoel Dahl * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20a303eae7SJoel Dahl * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21a303eae7SJoel Dahl * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22a303eae7SJoel Dahl * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23a303eae7SJoel Dahl * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24a303eae7SJoel Dahl * SUCH DAMAGE. 25aa015c8eSEdward Tomasz Napierala */ 26aa015c8eSEdward Tomasz Napierala 27aa015c8eSEdward Tomasz Napierala #include <sys/cdefs.h> 28aa015c8eSEdward Tomasz Napierala __FBSDID("$FreeBSD$"); 29aa015c8eSEdward Tomasz Napierala 30aa015c8eSEdward Tomasz Napierala #include <errno.h> 31aa015c8eSEdward Tomasz Napierala #include <stdio.h> 32aa015c8eSEdward Tomasz Napierala #include <assert.h> 33aa015c8eSEdward Tomasz Napierala #include <sys/acl.h> 344089cc8aSEdward Tomasz Napierala #include <sys/stat.h> 35aa015c8eSEdward Tomasz Napierala 36aa015c8eSEdward Tomasz Napierala #include "acl_support.h" 37aa015c8eSEdward Tomasz Napierala 38aa015c8eSEdward Tomasz Napierala /* 394089cc8aSEdward Tomasz Napierala * These three routines from sys/kern/subr_acl_nfs4.c are used by both kernel 40aa015c8eSEdward Tomasz Napierala * and libc. 41aa015c8eSEdward Tomasz Napierala */ 424089cc8aSEdward Tomasz Napierala void acl_nfs4_trivial_from_mode(struct acl *aclp, mode_t mode); 43aa015c8eSEdward Tomasz Napierala void acl_nfs4_sync_acl_from_mode(struct acl *aclp, mode_t mode, 44aa015c8eSEdward Tomasz Napierala int file_owner_id); 45aa015c8eSEdward Tomasz Napierala void acl_nfs4_sync_mode_from_acl(mode_t *_mode, const struct acl *aclp); 46aa015c8eSEdward Tomasz Napierala 47aa015c8eSEdward Tomasz Napierala static acl_t 484089cc8aSEdward Tomasz Napierala _nfs4_acl_strip_np(const acl_t aclp, int canonical_six) 49aa015c8eSEdward Tomasz Napierala { 50aa015c8eSEdward Tomasz Napierala acl_t newacl; 517945d60dSEdward Tomasz Napierala mode_t mode = 0; 52aa015c8eSEdward Tomasz Napierala 53aa015c8eSEdward Tomasz Napierala newacl = acl_init(ACL_MAX_ENTRIES); 54aa015c8eSEdward Tomasz Napierala if (newacl == NULL) { 55aa015c8eSEdward Tomasz Napierala errno = ENOMEM; 56aa015c8eSEdward Tomasz Napierala return (NULL); 57aa015c8eSEdward Tomasz Napierala } 58aa015c8eSEdward Tomasz Napierala 59aa015c8eSEdward Tomasz Napierala _acl_brand_as(newacl, ACL_BRAND_NFS4); 60aa015c8eSEdward Tomasz Napierala 61aa015c8eSEdward Tomasz Napierala acl_nfs4_sync_mode_from_acl(&mode, &(aclp->ats_acl)); 624089cc8aSEdward Tomasz Napierala if (canonical_six) 63aa015c8eSEdward Tomasz Napierala acl_nfs4_sync_acl_from_mode(&(newacl->ats_acl), mode, -1); 644089cc8aSEdward Tomasz Napierala else 654089cc8aSEdward Tomasz Napierala acl_nfs4_trivial_from_mode(&(newacl->ats_acl), mode); 66aa015c8eSEdward Tomasz Napierala 67aa015c8eSEdward Tomasz Napierala return (newacl); 68aa015c8eSEdward Tomasz Napierala } 69aa015c8eSEdward Tomasz Napierala 70aa015c8eSEdward Tomasz Napierala static acl_t 71aa015c8eSEdward Tomasz Napierala _posix1e_acl_strip_np(const acl_t aclp, int recalculate_mask) 72aa015c8eSEdward Tomasz Napierala { 73aa015c8eSEdward Tomasz Napierala acl_t acl_new, acl_old; 74aa015c8eSEdward Tomasz Napierala acl_entry_t entry, entry_new; 75aa015c8eSEdward Tomasz Napierala acl_permset_t perm; 76aa015c8eSEdward Tomasz Napierala acl_tag_t tag; 77aa015c8eSEdward Tomasz Napierala int entry_id, have_mask_entry; 78aa015c8eSEdward Tomasz Napierala 79aa015c8eSEdward Tomasz Napierala assert(_acl_brand(aclp) == ACL_BRAND_POSIX); 80aa015c8eSEdward Tomasz Napierala 81aa015c8eSEdward Tomasz Napierala acl_old = acl_dup(aclp); 82aa015c8eSEdward Tomasz Napierala if (acl_old == NULL) 83aa015c8eSEdward Tomasz Napierala return (NULL); 84aa015c8eSEdward Tomasz Napierala 85aa015c8eSEdward Tomasz Napierala assert(_acl_brand(acl_old) == ACL_BRAND_POSIX); 86aa015c8eSEdward Tomasz Napierala 87aa015c8eSEdward Tomasz Napierala have_mask_entry = 0; 88aa015c8eSEdward Tomasz Napierala acl_new = acl_init(ACL_MAX_ENTRIES); 89aa015c8eSEdward Tomasz Napierala if (acl_new == NULL) 90aa015c8eSEdward Tomasz Napierala return (NULL); 91aa015c8eSEdward Tomasz Napierala tag = ACL_UNDEFINED_TAG; 92aa015c8eSEdward Tomasz Napierala 93aa015c8eSEdward Tomasz Napierala /* only save the default user/group/other entries */ 94aa015c8eSEdward Tomasz Napierala entry_id = ACL_FIRST_ENTRY; 95aa015c8eSEdward Tomasz Napierala while (acl_get_entry(acl_old, entry_id, &entry) == 1) { 96aa015c8eSEdward Tomasz Napierala entry_id = ACL_NEXT_ENTRY; 97aa015c8eSEdward Tomasz Napierala 98aa015c8eSEdward Tomasz Napierala assert(_entry_brand(entry) == ACL_BRAND_POSIX); 99aa015c8eSEdward Tomasz Napierala 100aa015c8eSEdward Tomasz Napierala if (acl_get_tag_type(entry, &tag) == -1) 101aa015c8eSEdward Tomasz Napierala return (NULL); 102aa015c8eSEdward Tomasz Napierala 103aa015c8eSEdward Tomasz Napierala switch(tag) { 104aa015c8eSEdward Tomasz Napierala case ACL_USER_OBJ: 105aa015c8eSEdward Tomasz Napierala case ACL_GROUP_OBJ: 106aa015c8eSEdward Tomasz Napierala case ACL_OTHER: 107aa015c8eSEdward Tomasz Napierala if (acl_get_tag_type(entry, &tag) == -1) 108aa015c8eSEdward Tomasz Napierala return (NULL); 109aa015c8eSEdward Tomasz Napierala if (acl_get_permset(entry, &perm) == -1) 110aa015c8eSEdward Tomasz Napierala return (NULL); 111aa015c8eSEdward Tomasz Napierala if (acl_create_entry(&acl_new, &entry_new) == -1) 112aa015c8eSEdward Tomasz Napierala return (NULL); 113aa015c8eSEdward Tomasz Napierala if (acl_set_tag_type(entry_new, tag) == -1) 114aa015c8eSEdward Tomasz Napierala return (NULL); 115aa015c8eSEdward Tomasz Napierala if (acl_set_permset(entry_new, perm) == -1) 116aa015c8eSEdward Tomasz Napierala return (NULL); 117aa015c8eSEdward Tomasz Napierala if (acl_copy_entry(entry_new, entry) == -1) 118aa015c8eSEdward Tomasz Napierala return (NULL); 119aa015c8eSEdward Tomasz Napierala assert(_entry_brand(entry_new) == ACL_BRAND_POSIX); 120aa015c8eSEdward Tomasz Napierala break; 121aa015c8eSEdward Tomasz Napierala case ACL_MASK: 122aa015c8eSEdward Tomasz Napierala have_mask_entry = 1; 123aa015c8eSEdward Tomasz Napierala break; 124aa015c8eSEdward Tomasz Napierala default: 125aa015c8eSEdward Tomasz Napierala break; 126aa015c8eSEdward Tomasz Napierala } 127aa015c8eSEdward Tomasz Napierala } 128aa015c8eSEdward Tomasz Napierala 129aa015c8eSEdward Tomasz Napierala assert(_acl_brand(acl_new) == ACL_BRAND_POSIX); 130aa015c8eSEdward Tomasz Napierala 131aa015c8eSEdward Tomasz Napierala if (have_mask_entry && recalculate_mask) { 132aa015c8eSEdward Tomasz Napierala if (acl_calc_mask(&acl_new) == -1) 133aa015c8eSEdward Tomasz Napierala return (NULL); 134aa015c8eSEdward Tomasz Napierala } 135aa015c8eSEdward Tomasz Napierala 136aa015c8eSEdward Tomasz Napierala return (acl_new); 137aa015c8eSEdward Tomasz Napierala } 138aa015c8eSEdward Tomasz Napierala 139aa015c8eSEdward Tomasz Napierala acl_t 140aa015c8eSEdward Tomasz Napierala acl_strip_np(const acl_t aclp, int recalculate_mask) 141aa015c8eSEdward Tomasz Napierala { 142aa015c8eSEdward Tomasz Napierala switch (_acl_brand(aclp)) { 143aa015c8eSEdward Tomasz Napierala case ACL_BRAND_NFS4: 144*e43af6d3SEdward Tomasz Napierala return (_nfs4_acl_strip_np(aclp, 0)); 145aa015c8eSEdward Tomasz Napierala 146aa015c8eSEdward Tomasz Napierala case ACL_BRAND_POSIX: 147aa015c8eSEdward Tomasz Napierala return (_posix1e_acl_strip_np(aclp, recalculate_mask)); 148aa015c8eSEdward Tomasz Napierala 149aa015c8eSEdward Tomasz Napierala default: 150aa015c8eSEdward Tomasz Napierala errno = EINVAL; 151aa015c8eSEdward Tomasz Napierala return (NULL); 152aa015c8eSEdward Tomasz Napierala } 153aa015c8eSEdward Tomasz Napierala } 154aa015c8eSEdward Tomasz Napierala 155aa015c8eSEdward Tomasz Napierala /* 156aa015c8eSEdward Tomasz Napierala * Return 1, if ACL is trivial, 0 otherwise. 157aa015c8eSEdward Tomasz Napierala * 158aa015c8eSEdward Tomasz Napierala * ACL is trivial, iff its meaning could be fully expressed using just file 159aa015c8eSEdward Tomasz Napierala * mode. In other words, ACL is trivial iff it doesn't have "+" to the right 160aa015c8eSEdward Tomasz Napierala * of the mode bits in "ls -l" output ;-) 161aa015c8eSEdward Tomasz Napierala */ 162aa015c8eSEdward Tomasz Napierala int 163aa015c8eSEdward Tomasz Napierala acl_is_trivial_np(const acl_t aclp, int *trivialp) 164aa015c8eSEdward Tomasz Napierala { 165aa015c8eSEdward Tomasz Napierala acl_t tmpacl; 166aa015c8eSEdward Tomasz Napierala int differs; 167aa015c8eSEdward Tomasz Napierala 168aa015c8eSEdward Tomasz Napierala if (aclp == NULL || trivialp == NULL) { 169aa015c8eSEdward Tomasz Napierala errno = EINVAL; 170aa015c8eSEdward Tomasz Napierala return (-1); 171aa015c8eSEdward Tomasz Napierala } 172aa015c8eSEdward Tomasz Napierala 173aa015c8eSEdward Tomasz Napierala switch (_acl_brand(aclp)) { 174aa015c8eSEdward Tomasz Napierala case ACL_BRAND_POSIX: 175aa015c8eSEdward Tomasz Napierala if (aclp->ats_acl.acl_cnt == 3) 176aa015c8eSEdward Tomasz Napierala *trivialp = 1; 177aa015c8eSEdward Tomasz Napierala else 178aa015c8eSEdward Tomasz Napierala *trivialp = 0; 179aa015c8eSEdward Tomasz Napierala 180aa015c8eSEdward Tomasz Napierala return (0); 181aa015c8eSEdward Tomasz Napierala 182aa015c8eSEdward Tomasz Napierala case ACL_BRAND_NFS4: 183aa015c8eSEdward Tomasz Napierala /* 1847eaa29b5SEdward Tomasz Napierala * If the ACL has more than canonical six entries, 1857eaa29b5SEdward Tomasz Napierala * it's non trivial by definition. 1867eaa29b5SEdward Tomasz Napierala */ 1877eaa29b5SEdward Tomasz Napierala if (aclp->ats_acl.acl_cnt > 6) { 18878141351SEdward Tomasz Napierala *trivialp = 0; 1897eaa29b5SEdward Tomasz Napierala return (0); 1907eaa29b5SEdward Tomasz Napierala } 1917eaa29b5SEdward Tomasz Napierala 1927eaa29b5SEdward Tomasz Napierala /* 1934089cc8aSEdward Tomasz Napierala * Calculate trivial ACL - using acl_strip_np(3) - and compare 194aa015c8eSEdward Tomasz Napierala * with the original. 195aa015c8eSEdward Tomasz Napierala */ 1964089cc8aSEdward Tomasz Napierala tmpacl = _nfs4_acl_strip_np(aclp, 0); 1974089cc8aSEdward Tomasz Napierala if (tmpacl == NULL) 1984089cc8aSEdward Tomasz Napierala return (-1); 1994089cc8aSEdward Tomasz Napierala 2004089cc8aSEdward Tomasz Napierala differs = _acl_differs(aclp, tmpacl); 2014089cc8aSEdward Tomasz Napierala acl_free(tmpacl); 2024089cc8aSEdward Tomasz Napierala 2034089cc8aSEdward Tomasz Napierala if (differs == 0) { 2044089cc8aSEdward Tomasz Napierala *trivialp = 1; 2054089cc8aSEdward Tomasz Napierala return (0); 2064089cc8aSEdward Tomasz Napierala } 2074089cc8aSEdward Tomasz Napierala 2084089cc8aSEdward Tomasz Napierala /* 2094089cc8aSEdward Tomasz Napierala * Try again with an old-style, "canonical six" trivial ACL. 2104089cc8aSEdward Tomasz Napierala */ 2114089cc8aSEdward Tomasz Napierala tmpacl = _nfs4_acl_strip_np(aclp, 1); 212aa015c8eSEdward Tomasz Napierala if (tmpacl == NULL) 213aa015c8eSEdward Tomasz Napierala return (-1); 214aa015c8eSEdward Tomasz Napierala 215aa015c8eSEdward Tomasz Napierala differs = _acl_differs(aclp, tmpacl); 216aa015c8eSEdward Tomasz Napierala acl_free(tmpacl); 217aa015c8eSEdward Tomasz Napierala 218aa015c8eSEdward Tomasz Napierala if (differs) 219aa015c8eSEdward Tomasz Napierala *trivialp = 0; 220aa015c8eSEdward Tomasz Napierala else 221aa015c8eSEdward Tomasz Napierala *trivialp = 1; 222aa015c8eSEdward Tomasz Napierala 223aa015c8eSEdward Tomasz Napierala return (0); 224aa015c8eSEdward Tomasz Napierala 225aa015c8eSEdward Tomasz Napierala default: 226aa015c8eSEdward Tomasz Napierala errno = EINVAL; 227aa015c8eSEdward Tomasz Napierala return (-1); 228aa015c8eSEdward Tomasz Napierala } 229aa015c8eSEdward Tomasz Napierala } 230