1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 /* 28 * Copyright (c) 2018, Joyent, Inc. 29 */ 30 31 /* 32 * This is the smbfs/chacl command. 33 * (just for testing - not installed) 34 * 35 * Works like chmod(1), but only supporting A=... forms. 36 * i.e. chacl A=everyone@:full_set:fd:allow /mnt/foo 37 * 38 * Some more test cases: 39 * /usr/lib/fs/smbfs/chacl -v 40 * A=user:2147483649:rwxpdDaARWcCos::allow, 41 * user:2147483653:raRcs::allow, 42 * everyone@:raRcs::allow 43 */ 44 45 #include <sys/types.h> 46 #include <sys/errno.h> 47 #include <sys/stat.h> 48 #include <sys/acl.h> 49 #include <sys/acl_impl.h> 50 51 #include <fcntl.h> 52 #include <stdio.h> 53 #include <stdlib.h> 54 #include <unistd.h> 55 #include <string.h> 56 #include <aclutils.h> 57 58 #include <netsmb/smbfs_acl.h> 59 60 char *progname; 61 int Vflag; 62 63 void chacl(char *, uint32_t, uid_t, gid_t, acl_t *); 64 65 static const char Usage[] = 66 "Usage: %s [-v] [-u UID] [-g GID] A=ACL... file ...\n" 67 "\twhere A=ACL is like chmod(1)\n"; 68 69 void 70 usage(void) 71 { 72 fprintf(stderr, Usage, progname); 73 exit(1); 74 } 75 76 int 77 main(int argc, char **argv) 78 { 79 uid_t uid = (uid_t)-1; 80 gid_t gid = (gid_t)-1; 81 acl_t *acl = NULL; 82 char *acl_arg; 83 ulong_t tl; 84 int c, error; 85 uint32_t selector; 86 87 progname = argv[0]; 88 89 while ((c = getopt(argc, argv, "vu:g:")) != -1) { 90 switch (c) { 91 case 'v': 92 Vflag++; 93 break; 94 case 'u': 95 tl = strtoul(optarg, NULL, 10); 96 if (tl == 0) 97 goto badopt; 98 uid = (uid_t)tl; 99 break; 100 case 'g': 101 tl = strtoul(optarg, NULL, 10); 102 if (tl == 0) 103 goto badopt; 104 gid = (gid_t)tl; 105 break; 106 case ':': 107 fprintf(stderr, "%s: option %c requires arg\n", 108 progname, c); 109 usage(); 110 break; 111 112 badopt: 113 default: 114 fprintf(stderr, "%s: bad option: %c\n", 115 progname, c); 116 usage(); 117 break; 118 } 119 } 120 121 if (optind + 1 > argc) 122 usage(); 123 acl_arg = argv[optind++]; 124 125 /* 126 * Ask libsec to parse the ACL arg. 127 */ 128 if (strncmp(acl_arg, "A=", 2) != 0) 129 usage(); 130 error = acl_parse(acl_arg + 2, &acl); 131 if (error) { 132 fprintf(stderr, "%s: can not parse ACL: %s\n", 133 progname, acl_arg); 134 exit(1); 135 } 136 if (acl->acl_type != ACE_T) { 137 fprintf(stderr, "%s: ACL not ACE_T type: %s\n", 138 progname, acl_arg); 139 exit(1); 140 } 141 142 /* 143 * Which parts of the SD are being modified? 144 */ 145 selector = DACL_SECURITY_INFORMATION; 146 147 if (uid != (uid_t)-1) 148 selector |= OWNER_SECURITY_INFORMATION; 149 if (gid != (gid_t)-1) 150 selector |= GROUP_SECURITY_INFORMATION; 151 152 if (optind == argc) 153 usage(); 154 for (; optind < argc; optind++) 155 chacl(argv[optind], selector, uid, gid, acl); 156 157 done: 158 acl_free(acl); 159 return (0); 160 } 161 162 void 163 chacl(char *file, uint32_t selector, uid_t uid, gid_t gid, acl_t *acl) 164 { 165 struct stat st; 166 struct i_ntsd *sd = NULL; 167 int error, fd; 168 169 /* 170 * OK, try setting the ACL (via ioctl). Open 171 * read-only because we're NOT writing data. 172 * The driver will re-open with the necessary 173 * access rights to set the ACL. 174 */ 175 fd = open(file, O_RDONLY, 0); 176 if (fd < 0) { 177 perror(file); 178 exit(1); 179 } 180 181 if (uid == (uid_t)-1 || gid == (gid_t)-1) { 182 /* 183 * If not setting owner or group, we need the 184 * current owner and group for translating 185 * references via owner@ or group@ ACEs. 186 */ 187 if (fstat(fd, &st) != 0) { 188 perror(file); 189 exit(1); 190 } 191 if (uid == (uid_t)-1) 192 uid = st.st_uid; 193 if (gid == (gid_t)-1) 194 gid = st.st_gid; 195 } 196 197 /* 198 * Convert the ZFS ACL to an NT SD. 199 */ 200 error = smbfs_acl_zfs2sd(acl, uid, gid, selector, &sd); 201 if (error) { 202 fprintf(stderr, "%s: failed to convert ACL\n", progname); 203 exit(1); 204 } 205 206 if (Vflag) { 207 208 /* 209 * Print the SD in ZFS form. 210 */ 211 printf("Solaris security data:\n"); 212 if (uid == (uid_t)-1) 213 printf("owner: -1\n"); 214 else 215 printf("owner: %u\n", uid); 216 if (gid == (gid_t)-1) 217 printf("group: -1\n"); 218 else 219 printf("group: %u\n", gid); 220 acl_printacl(acl, 80, 1); 221 printf("\n"); 222 223 /* 224 * Print the SD in Windows form. 225 */ 226 printf("CIFS security data:\n"); 227 smbfs_acl_print_sd(stdout, sd); 228 printf("\n"); 229 } 230 231 error = smbfs_acl_setsd(fd, selector, sd); 232 (void) close(fd); 233 234 if (error) { 235 fprintf(stderr, "%s: ACL set failed, %s\n", 236 file, strerror(error)); 237 exit(1); 238 } 239 240 smbfs_acl_free_sd(sd); 241 } 242