1 // SPDX-License-Identifier: LGPL-2.1+ 2 /* 3 * Copyright (C) International Business Machines Corp., 2007,2008 4 * Author(s): Steve French (sfrench@us.ibm.com) 5 * Copyright (C) 2020 Samsung Electronics Co., Ltd. 6 * Author(s): Namjae Jeon <linkinjeon@kernel.org> 7 */ 8 9 #include <linux/fs.h> 10 #include <linux/slab.h> 11 #include <linux/string.h> 12 #include <linux/mnt_idmapping.h> 13 14 #include "smbacl.h" 15 #include "smb_common.h" 16 #include "server.h" 17 #include "misc.h" 18 #include "mgmt/share_config.h" 19 20 static const struct smb_sid domain = {1, 4, {0, 0, 0, 0, 0, 5}, 21 {cpu_to_le32(21), cpu_to_le32(1), cpu_to_le32(2), cpu_to_le32(3), 22 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} }; 23 24 /* security id for everyone/world system group */ 25 static const struct smb_sid creator_owner = { 26 1, 1, {0, 0, 0, 0, 0, 3}, {0} }; 27 /* security id for everyone/world system group */ 28 static const struct smb_sid creator_group = { 29 1, 1, {0, 0, 0, 0, 0, 3}, {cpu_to_le32(1)} }; 30 /* security id for owner rights */ 31 static const struct smb_sid sid_owner_rights = { 32 1, 1, {0, 0, 0, 0, 0, 3}, {cpu_to_le32(4)} }; 33 34 /* security id for everyone/world system group */ 35 static const struct smb_sid sid_everyone = { 36 1, 1, {0, 0, 0, 0, 0, 1}, {0} }; 37 /* security id for Authenticated Users system group */ 38 static const struct smb_sid sid_authusers = { 39 1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(11)} }; 40 41 /* S-1-22-1 Unmapped Unix users */ 42 static const struct smb_sid sid_unix_users = {1, 1, {0, 0, 0, 0, 0, 22}, 43 {cpu_to_le32(1), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} }; 44 45 /* S-1-22-2 Unmapped Unix groups */ 46 static const struct smb_sid sid_unix_groups = { 1, 1, {0, 0, 0, 0, 0, 22}, 47 {cpu_to_le32(2), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} }; 48 49 /* 50 * See http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx 51 */ 52 53 /* S-1-5-88 MS NFS and Apple style UID/GID/mode */ 54 55 /* S-1-5-88-1 Unix uid */ 56 static const struct smb_sid sid_unix_NFS_users = { 1, 2, {0, 0, 0, 0, 0, 5}, 57 {cpu_to_le32(88), 58 cpu_to_le32(1), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} }; 59 60 /* S-1-5-88-2 Unix gid */ 61 static const struct smb_sid sid_unix_NFS_groups = { 1, 2, {0, 0, 0, 0, 0, 5}, 62 {cpu_to_le32(88), 63 cpu_to_le32(2), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} }; 64 65 /* S-1-5-88-3 Unix mode */ 66 static const struct smb_sid sid_unix_NFS_mode = { 1, 2, {0, 0, 0, 0, 0, 5}, 67 {cpu_to_le32(88), 68 cpu_to_le32(3), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} }; 69 70 /* 71 * if the two SIDs (roughly equivalent to a UUID for a user or group) are 72 * the same returns zero, if they do not match returns non-zero. 73 */ 74 int compare_sids(const struct smb_sid *ctsid, const struct smb_sid *cwsid) 75 { 76 int i; 77 int num_subauth, num_sat, num_saw; 78 79 if (!ctsid || !cwsid) 80 return 1; 81 82 /* compare the revision */ 83 if (ctsid->revision != cwsid->revision) { 84 if (ctsid->revision > cwsid->revision) 85 return 1; 86 else 87 return -1; 88 } 89 90 /* compare all of the six auth values */ 91 for (i = 0; i < NUM_AUTHS; ++i) { 92 if (ctsid->authority[i] != cwsid->authority[i]) { 93 if (ctsid->authority[i] > cwsid->authority[i]) 94 return 1; 95 else 96 return -1; 97 } 98 } 99 100 /* compare all of the subauth values if any */ 101 num_sat = ctsid->num_subauth; 102 num_saw = cwsid->num_subauth; 103 num_subauth = min(num_sat, num_saw); 104 if (num_subauth) { 105 for (i = 0; i < num_subauth; ++i) { 106 if (ctsid->sub_auth[i] != cwsid->sub_auth[i]) { 107 if (le32_to_cpu(ctsid->sub_auth[i]) > 108 le32_to_cpu(cwsid->sub_auth[i])) 109 return 1; 110 else 111 return -1; 112 } 113 } 114 } 115 116 return 0; /* sids compare/match */ 117 } 118 119 static void smb_copy_sid(struct smb_sid *dst, const struct smb_sid *src) 120 { 121 int i; 122 123 dst->revision = src->revision; 124 dst->num_subauth = min_t(u8, src->num_subauth, SID_MAX_SUB_AUTHORITIES); 125 for (i = 0; i < NUM_AUTHS; ++i) 126 dst->authority[i] = src->authority[i]; 127 for (i = 0; i < dst->num_subauth; ++i) 128 dst->sub_auth[i] = src->sub_auth[i]; 129 } 130 131 /* 132 * change posix mode to reflect permissions 133 * pmode is the existing mode (we only want to overwrite part of this 134 * bits to set can be: S_IRWXU, S_IRWXG or S_IRWXO ie 00700 or 00070 or 00007 135 */ 136 static umode_t access_flags_to_mode(struct smb_fattr *fattr, __le32 ace_flags, 137 int type) 138 { 139 __u32 flags = le32_to_cpu(ace_flags); 140 umode_t mode = 0; 141 142 if (flags & GENERIC_ALL) { 143 mode = 0777; 144 ksmbd_debug(SMB, "all perms\n"); 145 return mode; 146 } 147 148 if ((flags & GENERIC_READ) || (flags & FILE_READ_RIGHTS)) 149 mode = 0444; 150 if ((flags & GENERIC_WRITE) || (flags & FILE_WRITE_RIGHTS)) { 151 mode |= 0222; 152 if (S_ISDIR(fattr->cf_mode)) 153 mode |= 0111; 154 } 155 if ((flags & GENERIC_EXECUTE) || (flags & FILE_EXEC_RIGHTS)) 156 mode |= 0111; 157 158 if (type == ACCESS_DENIED_ACE_TYPE || type == ACCESS_DENIED_OBJECT_ACE_TYPE) 159 mode = ~mode; 160 161 ksmbd_debug(SMB, "access flags 0x%x mode now %04o\n", flags, mode); 162 163 return mode; 164 } 165 166 /* 167 * Generate access flags to reflect permissions mode is the existing mode. 168 * This function is called for every ACE in the DACL whose SID matches 169 * with either owner or group or everyone. 170 */ 171 static void mode_to_access_flags(umode_t mode, umode_t bits_to_use, 172 __u32 *pace_flags) 173 { 174 /* reset access mask */ 175 *pace_flags = 0x0; 176 177 /* bits to use are either S_IRWXU or S_IRWXG or S_IRWXO */ 178 mode &= bits_to_use; 179 180 /* 181 * check for R/W/X UGO since we do not know whose flags 182 * is this but we have cleared all the bits sans RWX for 183 * either user or group or other as per bits_to_use 184 */ 185 if (mode & 0444) 186 *pace_flags |= SET_FILE_READ_RIGHTS; 187 if (mode & 0222) 188 *pace_flags |= FILE_WRITE_RIGHTS; 189 if (mode & 0111) 190 *pace_flags |= SET_FILE_EXEC_RIGHTS; 191 192 ksmbd_debug(SMB, "mode: %o, access flags now 0x%x\n", 193 mode, *pace_flags); 194 } 195 196 static __u16 fill_ace_for_sid(struct smb_ace *pntace, 197 const struct smb_sid *psid, int type, int flags, 198 umode_t mode, umode_t bits) 199 { 200 int i; 201 __u16 size = 0; 202 __u32 access_req = 0; 203 204 pntace->type = type; 205 pntace->flags = flags; 206 mode_to_access_flags(mode, bits, &access_req); 207 if (!access_req) 208 access_req = SET_MINIMUM_RIGHTS; 209 pntace->access_req = cpu_to_le32(access_req); 210 211 pntace->sid.revision = psid->revision; 212 pntace->sid.num_subauth = psid->num_subauth; 213 for (i = 0; i < NUM_AUTHS; i++) 214 pntace->sid.authority[i] = psid->authority[i]; 215 for (i = 0; i < psid->num_subauth; i++) 216 pntace->sid.sub_auth[i] = psid->sub_auth[i]; 217 218 size = 1 + 1 + 2 + 4 + 1 + 1 + 6 + (psid->num_subauth * 4); 219 pntace->size = cpu_to_le16(size); 220 221 return size; 222 } 223 224 void id_to_sid(unsigned int cid, uint sidtype, struct smb_sid *ssid) 225 { 226 switch (sidtype) { 227 case SIDOWNER: 228 smb_copy_sid(ssid, &server_conf.domain_sid); 229 break; 230 case SIDUNIX_USER: 231 smb_copy_sid(ssid, &sid_unix_users); 232 break; 233 case SIDUNIX_GROUP: 234 smb_copy_sid(ssid, &sid_unix_groups); 235 break; 236 case SIDCREATOR_OWNER: 237 smb_copy_sid(ssid, &creator_owner); 238 return; 239 case SIDCREATOR_GROUP: 240 smb_copy_sid(ssid, &creator_group); 241 return; 242 case SIDNFS_USER: 243 smb_copy_sid(ssid, &sid_unix_NFS_users); 244 break; 245 case SIDNFS_GROUP: 246 smb_copy_sid(ssid, &sid_unix_NFS_groups); 247 break; 248 case SIDNFS_MODE: 249 smb_copy_sid(ssid, &sid_unix_NFS_mode); 250 break; 251 default: 252 return; 253 } 254 255 /* RID */ 256 ssid->sub_auth[ssid->num_subauth] = cpu_to_le32(cid); 257 ssid->num_subauth++; 258 } 259 260 static int sid_to_id(struct mnt_idmap *idmap, 261 struct smb_sid *psid, uint sidtype, 262 struct smb_fattr *fattr) 263 { 264 const struct smb_sid *sid_prefix; 265 int rc = -EINVAL; 266 267 /* 268 * If we have too many subauthorities, then something is really wrong. 269 * Just return an error. 270 */ 271 if (unlikely(psid->num_subauth > SID_MAX_SUB_AUTHORITIES)) { 272 pr_err("%s: %u subauthorities is too many!\n", 273 __func__, psid->num_subauth); 274 return -EIO; 275 } 276 277 if (psid->num_subauth == 0) { 278 pr_err("%s: zero subauthorities!\n", __func__); 279 return -EIO; 280 } 281 282 if (sidtype == SIDOWNER) { 283 kuid_t uid; 284 uid_t id; 285 286 /* Only the server domain RID has a local uid representation. */ 287 sid_prefix = &server_conf.domain_sid; 288 if (psid->num_subauth != sid_prefix->num_subauth + 1 || 289 compare_sids(psid, sid_prefix)) 290 return -EINVAL; 291 292 id = le32_to_cpu(psid->sub_auth[psid->num_subauth - 1]); 293 uid = KUIDT_INIT(id); 294 uid = from_vfsuid(idmap, &init_user_ns, VFSUIDT_INIT(uid)); 295 if (uid_valid(uid)) { 296 fattr->cf_uid = uid; 297 rc = 0; 298 } 299 } else { 300 kgid_t gid; 301 gid_t id; 302 303 /* Local gids are represented by S-1-22-2-<gid>. */ 304 sid_prefix = &sid_unix_groups; 305 if (psid->num_subauth != sid_prefix->num_subauth + 1 || 306 compare_sids(psid, sid_prefix)) 307 return -EINVAL; 308 309 id = le32_to_cpu(psid->sub_auth[psid->num_subauth - 1]); 310 gid = KGIDT_INIT(id); 311 gid = from_vfsgid(idmap, &init_user_ns, VFSGIDT_INIT(gid)); 312 if (gid_valid(gid)) { 313 fattr->cf_gid = gid; 314 rc = 0; 315 } 316 } 317 318 return rc; 319 } 320 321 void posix_state_to_acl(struct posix_acl_state *state, 322 struct posix_acl_entry *pace) 323 { 324 int i; 325 326 pace->e_tag = ACL_USER_OBJ; 327 pace->e_perm = state->owner.allow; 328 for (i = 0; i < state->users->n; i++) { 329 pace++; 330 pace->e_tag = ACL_USER; 331 pace->e_uid = state->users->aces[i].uid; 332 pace->e_perm = state->users->aces[i].perms.allow; 333 } 334 335 pace++; 336 pace->e_tag = ACL_GROUP_OBJ; 337 pace->e_perm = state->group.allow; 338 339 for (i = 0; i < state->groups->n; i++) { 340 pace++; 341 pace->e_tag = ACL_GROUP; 342 pace->e_gid = state->groups->aces[i].gid; 343 pace->e_perm = state->groups->aces[i].perms.allow; 344 } 345 346 if (state->users->n || state->groups->n) { 347 pace++; 348 pace->e_tag = ACL_MASK; 349 pace->e_perm = state->mask.allow; 350 } 351 352 pace++; 353 pace->e_tag = ACL_OTHER; 354 pace->e_perm = state->other.allow; 355 } 356 357 int init_acl_state(struct posix_acl_state *state, u16 cnt) 358 { 359 int alloc; 360 361 memset(state, 0, sizeof(struct posix_acl_state)); 362 /* 363 * In the worst case, each individual acl could be for a distinct 364 * named user or group, but we don't know which, so we allocate 365 * enough space for either: 366 */ 367 alloc = sizeof(struct posix_ace_state_array) 368 + cnt * sizeof(struct posix_user_ace_state); 369 state->users = kzalloc(alloc, KSMBD_DEFAULT_GFP); 370 if (!state->users) 371 return -ENOMEM; 372 state->groups = kzalloc(alloc, KSMBD_DEFAULT_GFP); 373 if (!state->groups) { 374 kfree(state->users); 375 return -ENOMEM; 376 } 377 return 0; 378 } 379 380 void free_acl_state(struct posix_acl_state *state) 381 { 382 kfree(state->users); 383 kfree(state->groups); 384 } 385 386 static int parse_dacl(struct mnt_idmap *idmap, 387 struct smb_acl *pdacl, char *end_of_acl, 388 struct smb_sid *pownersid, struct smb_sid *pgrpsid, 389 struct smb_fattr *fattr) 390 { 391 int i, ret; 392 u16 num_aces = 0; 393 u16 dacl_size; 394 unsigned int acl_size; 395 char *acl_base; 396 struct smb_ace **ppace; 397 struct posix_acl_entry *cf_pace, *cf_pdace; 398 struct posix_acl_state acl_state, default_acl_state; 399 umode_t mode = 0, acl_mode; 400 bool owner_found = false, group_found = false, others_found = false; 401 402 if (!pdacl) 403 return 0; 404 405 /* validate that we do not go past end of acl */ 406 if (end_of_acl < (char *)pdacl + sizeof(struct smb_acl) || 407 end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size)) { 408 pr_err("ACL too small to parse DACL\n"); 409 return -EINVAL; 410 } 411 412 ksmbd_debug(SMB, "DACL revision %d size %d num aces %d\n", 413 le16_to_cpu(pdacl->revision), le16_to_cpu(pdacl->size), 414 le16_to_cpu(pdacl->num_aces)); 415 416 acl_base = (char *)pdacl; 417 acl_size = sizeof(struct smb_acl); 418 419 num_aces = le16_to_cpu(pdacl->num_aces); 420 if (num_aces <= 0) 421 return 0; 422 423 dacl_size = le16_to_cpu(pdacl->size); 424 if (dacl_size < sizeof(struct smb_acl)) 425 return -EINVAL; 426 427 if (num_aces > (dacl_size - sizeof(struct smb_acl)) / 428 (offsetof(struct smb_ace, sid) + 429 offsetof(struct smb_sid, sub_auth) + sizeof(__le16))) 430 return -EINVAL; 431 432 ret = init_acl_state(&acl_state, num_aces); 433 if (ret) 434 return ret; 435 ret = init_acl_state(&default_acl_state, num_aces); 436 if (ret) { 437 free_acl_state(&acl_state); 438 return ret; 439 } 440 441 ppace = kmalloc_objs(struct smb_ace *, num_aces, KSMBD_DEFAULT_GFP); 442 if (!ppace) { 443 free_acl_state(&default_acl_state); 444 free_acl_state(&acl_state); 445 return -ENOMEM; 446 } 447 448 /* 449 * reset rwx permissions for user/group/other. 450 * Also, if num_aces is 0 i.e. DACL has no ACEs, 451 * user/group/other have no permissions 452 */ 453 for (i = 0; i < num_aces; ++i) { 454 if (end_of_acl - acl_base < acl_size) { 455 ret = -EINVAL; 456 goto out; 457 } 458 459 ppace[i] = (struct smb_ace *)(acl_base + acl_size); 460 acl_base = (char *)ppace[i]; 461 acl_size = offsetof(struct smb_ace, sid) + 462 offsetof(struct smb_sid, sub_auth); 463 464 if (end_of_acl - acl_base < acl_size || 465 ppace[i]->sid.num_subauth == 0 || 466 ppace[i]->sid.num_subauth > SID_MAX_SUB_AUTHORITIES || 467 (end_of_acl - acl_base < 468 acl_size + sizeof(__le32) * ppace[i]->sid.num_subauth) || 469 (le16_to_cpu(ppace[i]->size) < 470 acl_size + sizeof(__le32) * ppace[i]->sid.num_subauth)) { 471 ret = -EINVAL; 472 goto out; 473 } 474 475 acl_size = le16_to_cpu(ppace[i]->size); 476 ppace[i]->access_req = 477 smb_map_generic_desired_access(ppace[i]->access_req); 478 479 if (ppace[i]->sid.num_subauth >= 3 && 480 !(compare_sids(&ppace[i]->sid, &sid_unix_NFS_mode))) { 481 fattr->cf_mode = 482 le32_to_cpu(ppace[i]->sid.sub_auth[2]); 483 break; 484 } else if (!compare_sids(&ppace[i]->sid, pownersid)) { 485 acl_mode = access_flags_to_mode(fattr, 486 ppace[i]->access_req, 487 ppace[i]->type); 488 acl_mode &= 0700; 489 490 if (!owner_found) { 491 mode &= ~(0700); 492 mode |= acl_mode; 493 } 494 owner_found = true; 495 } else if (!compare_sids(&ppace[i]->sid, pgrpsid) || 496 ppace[i]->sid.sub_auth[ppace[i]->sid.num_subauth - 1] == 497 DOMAIN_USER_RID_LE) { 498 acl_mode = access_flags_to_mode(fattr, 499 ppace[i]->access_req, 500 ppace[i]->type); 501 acl_mode &= 0070; 502 if (!group_found) { 503 mode &= ~(0070); 504 mode |= acl_mode; 505 } 506 group_found = true; 507 } else if (!compare_sids(&ppace[i]->sid, &sid_everyone)) { 508 acl_mode = access_flags_to_mode(fattr, 509 ppace[i]->access_req, 510 ppace[i]->type); 511 acl_mode &= 0007; 512 if (!others_found) { 513 mode &= ~(0007); 514 mode |= acl_mode; 515 } 516 others_found = true; 517 } else if (!compare_sids(&ppace[i]->sid, &creator_owner)) { 518 continue; 519 } else if (!compare_sids(&ppace[i]->sid, &creator_group)) { 520 continue; 521 } else if (!compare_sids(&ppace[i]->sid, &sid_authusers)) { 522 continue; 523 } else { 524 struct smb_fattr temp_fattr; 525 526 acl_mode = access_flags_to_mode(fattr, ppace[i]->access_req, 527 ppace[i]->type); 528 temp_fattr.cf_uid = INVALID_UID; 529 ret = sid_to_id(idmap, &ppace[i]->sid, SIDOWNER, &temp_fattr); 530 if (ret || uid_eq(temp_fattr.cf_uid, INVALID_UID)) { 531 pr_err_ratelimited("%s: Error %d mapping Owner SID to uid\n", 532 __func__, ret); 533 continue; 534 } 535 536 acl_state.owner.allow = ((acl_mode & 0700) >> 6) | 0004; 537 acl_state.users->aces[acl_state.users->n].uid = 538 temp_fattr.cf_uid; 539 acl_state.users->aces[acl_state.users->n++].perms.allow = 540 ((acl_mode & 0700) >> 6) | 0004; 541 default_acl_state.owner.allow = ((acl_mode & 0700) >> 6) | 0004; 542 default_acl_state.users->aces[default_acl_state.users->n].uid = 543 temp_fattr.cf_uid; 544 default_acl_state.users->aces[default_acl_state.users->n++].perms.allow = 545 ((acl_mode & 0700) >> 6) | 0004; 546 } 547 } 548 549 if (owner_found) { 550 /* The owner must be set to at least read-only. */ 551 acl_state.owner.allow = ((mode & 0700) >> 6) | 0004; 552 acl_state.users->aces[acl_state.users->n].uid = fattr->cf_uid; 553 acl_state.users->aces[acl_state.users->n++].perms.allow = 554 ((mode & 0700) >> 6) | 0004; 555 default_acl_state.owner.allow = ((mode & 0700) >> 6) | 0004; 556 default_acl_state.users->aces[default_acl_state.users->n].uid = 557 fattr->cf_uid; 558 default_acl_state.users->aces[default_acl_state.users->n++].perms.allow = 559 ((mode & 0700) >> 6) | 0004; 560 } 561 562 if (group_found) { 563 acl_state.group.allow = (mode & 0070) >> 3; 564 acl_state.groups->aces[acl_state.groups->n].gid = 565 fattr->cf_gid; 566 acl_state.groups->aces[acl_state.groups->n++].perms.allow = 567 (mode & 0070) >> 3; 568 default_acl_state.group.allow = (mode & 0070) >> 3; 569 default_acl_state.groups->aces[default_acl_state.groups->n].gid = 570 fattr->cf_gid; 571 default_acl_state.groups->aces[default_acl_state.groups->n++].perms.allow = 572 (mode & 0070) >> 3; 573 } 574 575 if (others_found) { 576 fattr->cf_mode &= ~(0007); 577 fattr->cf_mode |= mode & 0007; 578 579 acl_state.other.allow = mode & 0007; 580 default_acl_state.other.allow = mode & 0007; 581 } 582 583 if (acl_state.users->n || acl_state.groups->n) { 584 acl_state.mask.allow = 0x07; 585 586 if (IS_ENABLED(CONFIG_FS_POSIX_ACL)) { 587 fattr->cf_acls = 588 posix_acl_alloc(acl_state.users->n + 589 acl_state.groups->n + 4, KSMBD_DEFAULT_GFP); 590 if (!fattr->cf_acls) { 591 ret = -ENOMEM; 592 goto out; 593 } 594 cf_pace = fattr->cf_acls->a_entries; 595 posix_state_to_acl(&acl_state, cf_pace); 596 } 597 } 598 599 if (default_acl_state.users->n || default_acl_state.groups->n) { 600 default_acl_state.mask.allow = 0x07; 601 602 if (IS_ENABLED(CONFIG_FS_POSIX_ACL)) { 603 fattr->cf_dacls = 604 posix_acl_alloc(default_acl_state.users->n + 605 default_acl_state.groups->n + 4, KSMBD_DEFAULT_GFP); 606 if (!fattr->cf_dacls) { 607 ret = -ENOMEM; 608 goto out; 609 } 610 cf_pdace = fattr->cf_dacls->a_entries; 611 posix_state_to_acl(&default_acl_state, cf_pdace); 612 } 613 } 614 ret = 0; 615 out: 616 kfree(ppace); 617 free_acl_state(&acl_state); 618 free_acl_state(&default_acl_state); 619 return ret; 620 } 621 622 static void set_posix_acl_entries_dacl(struct mnt_idmap *idmap, 623 struct smb_ace *pndace, 624 struct smb_fattr *fattr, u16 *num_aces, 625 u16 *size, u16 existing_nt_aces, 626 bool had_nt_aces) 627 { 628 struct posix_acl_entry *pace; 629 struct smb_sid *sid; 630 struct smb_ace *ntace; 631 int i, j; 632 u16 ace_sz; 633 634 if (!fattr->cf_acls) 635 goto posix_default_acl; 636 637 pace = fattr->cf_acls->a_entries; 638 for (i = 0; i < fattr->cf_acls->a_count; i++, pace++) { 639 int flags = 0; 640 641 sid = kmalloc_obj(struct smb_sid, KSMBD_DEFAULT_GFP); 642 if (!sid) 643 break; 644 645 if (pace->e_tag == ACL_USER) { 646 uid_t uid; 647 unsigned int sid_type = SIDOWNER; 648 649 uid = posix_acl_uid_translate(idmap, pace); 650 if (!uid) 651 sid_type = SIDUNIX_USER; 652 id_to_sid(uid, sid_type, sid); 653 } else if (pace->e_tag == ACL_GROUP) { 654 gid_t gid; 655 656 gid = posix_acl_gid_translate(idmap, pace); 657 id_to_sid(gid, SIDUNIX_GROUP, sid); 658 } else if (pace->e_tag == ACL_OTHER && !had_nt_aces) { 659 smb_copy_sid(sid, &sid_everyone); 660 } else { 661 kfree(sid); 662 continue; 663 } 664 ntace = pndace; 665 for (j = 0; j < existing_nt_aces; j++) { 666 if (ntace->sid.sub_auth[ntace->sid.num_subauth - 1] == 667 sid->sub_auth[sid->num_subauth - 1]) 668 goto pass_same_sid; 669 ntace = (struct smb_ace *)((char *)ntace + 670 le16_to_cpu(ntace->size)); 671 } 672 673 if (S_ISDIR(fattr->cf_mode) && pace->e_tag == ACL_OTHER) 674 flags = 0x03; 675 676 ntace = (struct smb_ace *)((char *)pndace + *size); 677 ace_sz = fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED, flags, 678 pace->e_perm, 0777); 679 if (check_add_overflow(*size, ace_sz, size)) { 680 *size -= ace_sz; 681 kfree(sid); 682 break; 683 } 684 (*num_aces)++; 685 if (pace->e_tag == ACL_USER) 686 ntace->access_req |= 687 FILE_DELETE_LE | FILE_DELETE_CHILD_LE; 688 689 if (S_ISDIR(fattr->cf_mode) && 690 (pace->e_tag == ACL_USER || pace->e_tag == ACL_GROUP)) { 691 ntace = (struct smb_ace *)((char *)pndace + *size); 692 ace_sz = fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED, 693 0x03, pace->e_perm, 0777); 694 if (check_add_overflow(*size, ace_sz, size)) { 695 *size -= ace_sz; 696 kfree(sid); 697 break; 698 } 699 (*num_aces)++; 700 if (pace->e_tag == ACL_USER) 701 ntace->access_req |= 702 FILE_DELETE_LE | FILE_DELETE_CHILD_LE; 703 } 704 705 pass_same_sid: 706 kfree(sid); 707 } 708 709 if (had_nt_aces) 710 return; 711 712 posix_default_acl: 713 if (!fattr->cf_dacls) 714 return; 715 716 pace = fattr->cf_dacls->a_entries; 717 for (i = 0; i < fattr->cf_dacls->a_count; i++, pace++) { 718 sid = kmalloc_obj(struct smb_sid, KSMBD_DEFAULT_GFP); 719 if (!sid) 720 break; 721 722 if (pace->e_tag == ACL_USER) { 723 uid_t uid; 724 725 uid = posix_acl_uid_translate(idmap, pace); 726 id_to_sid(uid, SIDCREATOR_OWNER, sid); 727 } else if (pace->e_tag == ACL_GROUP) { 728 gid_t gid; 729 730 gid = posix_acl_gid_translate(idmap, pace); 731 id_to_sid(gid, SIDCREATOR_GROUP, sid); 732 } else { 733 kfree(sid); 734 continue; 735 } 736 737 ntace = (struct smb_ace *)((char *)pndace + *size); 738 ace_sz = fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED, 0x0b, 739 pace->e_perm, 0777); 740 if (check_add_overflow(*size, ace_sz, size)) { 741 *size -= ace_sz; 742 kfree(sid); 743 break; 744 } 745 (*num_aces)++; 746 if (pace->e_tag == ACL_USER) 747 ntace->access_req |= 748 FILE_DELETE_LE | FILE_DELETE_CHILD_LE; 749 kfree(sid); 750 } 751 } 752 753 static void set_ntacl_dacl(struct mnt_idmap *idmap, 754 struct smb_acl *pndacl, 755 struct smb_acl *nt_dacl, 756 unsigned int aces_size, 757 const struct smb_sid *pownersid, 758 const struct smb_sid *pgrpsid, 759 struct smb_fattr *fattr) 760 { 761 struct smb_ace *ntace, *pndace; 762 u16 nt_num_aces = le16_to_cpu(nt_dacl->num_aces), num_aces = 0; 763 u16 copied_nt_aces; 764 unsigned short size = 0; 765 int i; 766 767 pndace = (struct smb_ace *)((char *)pndacl + sizeof(struct smb_acl)); 768 if (nt_num_aces) { 769 ntace = (struct smb_ace *)((char *)nt_dacl + sizeof(struct smb_acl)); 770 for (i = 0; i < nt_num_aces; i++) { 771 unsigned short nt_ace_size; 772 773 if (aces_size < offsetof(struct smb_ace, sid) + 774 CIFS_SID_BASE_SIZE) 775 break; 776 777 nt_ace_size = le16_to_cpu(ntace->size); 778 if (nt_ace_size > aces_size || 779 nt_ace_size < offsetof(struct smb_ace, sid) + 780 CIFS_SID_BASE_SIZE) 781 break; 782 783 if (ntace->sid.num_subauth == 0 || 784 ntace->sid.num_subauth > SID_MAX_SUB_AUTHORITIES || 785 nt_ace_size < offsetof(struct smb_ace, sid) + 786 CIFS_SID_BASE_SIZE + 787 sizeof(__le32) * 788 ntace->sid.num_subauth) 789 goto next_ace; 790 791 memcpy((char *)pndace + size, ntace, nt_ace_size); 792 if (check_add_overflow(size, nt_ace_size, &size)) { 793 size -= nt_ace_size; 794 break; 795 } 796 num_aces++; 797 798 next_ace: 799 aces_size -= nt_ace_size; 800 ntace = (struct smb_ace *)((char *)ntace + nt_ace_size); 801 } 802 } 803 804 copied_nt_aces = num_aces; 805 set_posix_acl_entries_dacl(idmap, pndace, fattr, 806 &num_aces, &size, copied_nt_aces, 807 nt_num_aces != 0); 808 pndacl->num_aces = cpu_to_le16(num_aces); 809 pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size); 810 } 811 812 static void set_mode_dacl(struct mnt_idmap *idmap, 813 struct smb_acl *pndacl, struct smb_fattr *fattr) 814 { 815 struct smb_ace *pace, *pndace; 816 u16 num_aces = 0; 817 u16 size = 0, ace_size = 0; 818 uid_t uid; 819 const struct smb_sid *sid; 820 821 pace = pndace = (struct smb_ace *)((char *)pndacl + sizeof(struct smb_acl)); 822 823 if (fattr->cf_acls) { 824 set_posix_acl_entries_dacl(idmap, pndace, fattr, 825 &num_aces, &size, num_aces, false); 826 goto out; 827 } 828 829 /* owner RID */ 830 uid = from_kuid(&init_user_ns, fattr->cf_uid); 831 if (uid) 832 sid = &server_conf.domain_sid; 833 else 834 sid = &sid_unix_users; 835 ace_size = fill_ace_for_sid(pace, sid, ACCESS_ALLOWED, 0, 836 fattr->cf_mode, 0700); 837 pace->sid.sub_auth[pace->sid.num_subauth++] = cpu_to_le32(uid); 838 pace->size = cpu_to_le16(ace_size + 4); 839 size += le16_to_cpu(pace->size); 840 pace = (struct smb_ace *)((char *)pndace + size); 841 842 /* Group RID */ 843 ace_size = fill_ace_for_sid(pace, &sid_unix_groups, 844 ACCESS_ALLOWED, 0, fattr->cf_mode, 0070); 845 pace->sid.sub_auth[pace->sid.num_subauth++] = 846 cpu_to_le32(from_kgid(&init_user_ns, fattr->cf_gid)); 847 pace->size = cpu_to_le16(ace_size + 4); 848 size += le16_to_cpu(pace->size); 849 pace = (struct smb_ace *)((char *)pndace + size); 850 num_aces = 3; 851 852 if (S_ISDIR(fattr->cf_mode)) { 853 pace = (struct smb_ace *)((char *)pndace + size); 854 855 /* creator owner */ 856 size += fill_ace_for_sid(pace, &creator_owner, ACCESS_ALLOWED, 857 0x0b, fattr->cf_mode, 0700); 858 pace = (struct smb_ace *)((char *)pndace + size); 859 860 /* creator group */ 861 size += fill_ace_for_sid(pace, &creator_group, ACCESS_ALLOWED, 862 0x0b, fattr->cf_mode, 0070); 863 pace = (struct smb_ace *)((char *)pndace + size); 864 num_aces = 5; 865 } 866 867 /* other */ 868 size += fill_ace_for_sid(pace, &sid_everyone, ACCESS_ALLOWED, 0, 869 fattr->cf_mode, 0007); 870 871 out: 872 pndacl->num_aces = cpu_to_le16(num_aces); 873 pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size); 874 } 875 876 static int parse_sid(struct smb_sid *psid, char *end_of_acl) 877 { 878 /* 879 * validate that we do not go past end of ACL - sid must be at least 8 880 * bytes long (assuming no sub-auths - e.g. the null SID 881 */ 882 if (end_of_acl < (char *)psid + 8) { 883 pr_err("ACL too small to parse SID %p\n", psid); 884 return -EINVAL; 885 } 886 887 if (!psid->num_subauth) 888 return 0; 889 890 if (psid->num_subauth > SID_MAX_SUB_AUTHORITIES || 891 end_of_acl < (char *)psid + 8 + sizeof(__le32) * psid->num_subauth) 892 return -EINVAL; 893 894 return 0; 895 } 896 897 /* Convert CIFS ACL to POSIX form */ 898 int parse_sec_desc(struct mnt_idmap *idmap, struct smb_ntsd *pntsd, 899 int acl_len, struct smb_fattr *fattr) 900 { 901 int rc = 0; 902 struct smb_sid *owner_sid_ptr, *group_sid_ptr; 903 struct smb_acl *dacl_ptr; /* no need for SACL ptr */ 904 char *end_of_acl = ((char *)pntsd) + acl_len; 905 __u32 dacloffset; 906 int pntsd_type; 907 908 if (!pntsd) 909 return -EIO; 910 911 if (acl_len < sizeof(struct smb_ntsd)) 912 return -EINVAL; 913 914 owner_sid_ptr = (struct smb_sid *)((char *)pntsd + 915 le32_to_cpu(pntsd->osidoffset)); 916 group_sid_ptr = (struct smb_sid *)((char *)pntsd + 917 le32_to_cpu(pntsd->gsidoffset)); 918 dacloffset = le32_to_cpu(pntsd->dacloffset); 919 dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset); 920 ksmbd_debug(SMB, 921 "revision %d type 0x%x ooffset 0x%x goffset 0x%x sacloffset 0x%x dacloffset 0x%x\n", 922 pntsd->revision, pntsd->type, le32_to_cpu(pntsd->osidoffset), 923 le32_to_cpu(pntsd->gsidoffset), 924 le32_to_cpu(pntsd->sacloffset), dacloffset); 925 926 pntsd_type = le16_to_cpu(pntsd->type); 927 if (!(pntsd_type & DACL_PRESENT)) { 928 ksmbd_debug(SMB, "DACL_PRESENT in DACL type is not set\n"); 929 return rc; 930 } 931 932 pntsd->type = cpu_to_le16(DACL_PRESENT); 933 934 if (pntsd->osidoffset) { 935 if (le32_to_cpu(pntsd->osidoffset) < sizeof(struct smb_ntsd)) 936 return -EINVAL; 937 938 rc = parse_sid(owner_sid_ptr, end_of_acl); 939 if (rc) { 940 pr_err("%s: Error %d parsing Owner SID\n", __func__, rc); 941 return rc; 942 } 943 944 rc = sid_to_id(idmap, owner_sid_ptr, SIDOWNER, fattr); 945 if (rc) { 946 ksmbd_debug(SMB, "Owner SID has no Unix uid mapping\n"); 947 owner_sid_ptr = NULL; 948 rc = 0; 949 } 950 } 951 952 if (pntsd->gsidoffset) { 953 if (le32_to_cpu(pntsd->gsidoffset) < sizeof(struct smb_ntsd)) 954 return -EINVAL; 955 956 rc = parse_sid(group_sid_ptr, end_of_acl); 957 if (rc) { 958 pr_err("%s: Error %d mapping Owner SID to gid\n", 959 __func__, rc); 960 return rc; 961 } 962 rc = sid_to_id(idmap, group_sid_ptr, SIDUNIX_GROUP, fattr); 963 if (rc) { 964 ksmbd_debug(SMB, "Group SID has no Unix gid mapping\n"); 965 group_sid_ptr = NULL; 966 rc = 0; 967 } 968 } 969 970 if ((pntsd_type & (DACL_AUTO_INHERITED | DACL_AUTO_INHERIT_REQ)) == 971 (DACL_AUTO_INHERITED | DACL_AUTO_INHERIT_REQ)) 972 pntsd->type |= cpu_to_le16(DACL_AUTO_INHERITED); 973 if (pntsd_type & DACL_PROTECTED) 974 pntsd->type |= cpu_to_le16(DACL_PROTECTED); 975 976 if (dacloffset) { 977 if (dacloffset < sizeof(struct smb_ntsd)) 978 return -EINVAL; 979 980 rc = parse_dacl(idmap, dacl_ptr, end_of_acl, 981 owner_sid_ptr, group_sid_ptr, fattr); 982 if (rc) 983 return rc; 984 } 985 986 return 0; 987 } 988 989 size_t smb_acl_sec_desc_scratch_len(struct smb_fattr *fattr, 990 struct smb_ntsd *ppntsd, int ppntsd_size, int addition_info) 991 { 992 size_t len = sizeof(struct smb_ntsd); 993 size_t tmp; 994 995 if (addition_info & OWNER_SECINFO) 996 len += sizeof(struct smb_sid); 997 if (addition_info & GROUP_SECINFO) 998 len += sizeof(struct smb_sid); 999 if (!(addition_info & DACL_SECINFO)) 1000 return len; 1001 1002 len += sizeof(struct smb_acl); 1003 if (ppntsd && ppntsd_size > 0) { 1004 unsigned int dacl_offset = le32_to_cpu(ppntsd->dacloffset); 1005 1006 if (dacl_offset < ppntsd_size && 1007 check_add_overflow(len, ppntsd_size - dacl_offset, &len)) 1008 return 0; 1009 } 1010 1011 if (fattr->cf_acls) { 1012 if (check_mul_overflow((size_t)fattr->cf_acls->a_count, 1013 2 * sizeof(struct smb_ace), &tmp) || 1014 check_add_overflow(len, tmp, &len)) 1015 return 0; 1016 } else { 1017 /* default/minimum DACL */ 1018 if (check_add_overflow(len, 5 * sizeof(struct smb_ace), &len)) 1019 return 0; 1020 } 1021 1022 if (fattr->cf_dacls) { 1023 if (check_mul_overflow((size_t)fattr->cf_dacls->a_count, 1024 sizeof(struct smb_ace), &tmp) || 1025 check_add_overflow(len, tmp, &len)) 1026 return 0; 1027 } 1028 1029 return len; 1030 } 1031 1032 /* Convert permission bits from mode to equivalent CIFS ACL */ 1033 int build_sec_desc(struct mnt_idmap *idmap, 1034 struct smb_ntsd *pntsd, struct smb_ntsd *ppntsd, 1035 int ppntsd_size, int addition_info, __u32 *secdesclen, 1036 struct smb_fattr *fattr) 1037 { 1038 int rc = 0; 1039 __u32 offset; 1040 struct smb_sid *owner_sid_ptr, *group_sid_ptr; 1041 struct smb_sid *nowner_sid_ptr, *ngroup_sid_ptr; 1042 struct smb_acl *dacl_ptr = NULL; /* no need for SACL ptr */ 1043 uid_t uid; 1044 gid_t gid; 1045 unsigned int sid_type = SIDOWNER; 1046 1047 nowner_sid_ptr = kmalloc_obj(struct smb_sid, KSMBD_DEFAULT_GFP); 1048 if (!nowner_sid_ptr) 1049 return -ENOMEM; 1050 1051 uid = from_kuid(&init_user_ns, fattr->cf_uid); 1052 if (!uid) 1053 sid_type = SIDUNIX_USER; 1054 id_to_sid(uid, sid_type, nowner_sid_ptr); 1055 1056 ngroup_sid_ptr = kmalloc_obj(struct smb_sid, KSMBD_DEFAULT_GFP); 1057 if (!ngroup_sid_ptr) { 1058 kfree(nowner_sid_ptr); 1059 return -ENOMEM; 1060 } 1061 1062 gid = from_kgid(&init_user_ns, fattr->cf_gid); 1063 id_to_sid(gid, SIDUNIX_GROUP, ngroup_sid_ptr); 1064 1065 offset = sizeof(struct smb_ntsd); 1066 pntsd->sacloffset = 0; 1067 pntsd->revision = cpu_to_le16(1); 1068 pntsd->type = cpu_to_le16(SELF_RELATIVE); 1069 if (ppntsd) 1070 pntsd->type |= ppntsd->type; 1071 1072 if (addition_info & OWNER_SECINFO) { 1073 pntsd->osidoffset = cpu_to_le32(offset); 1074 owner_sid_ptr = (struct smb_sid *)((char *)pntsd + offset); 1075 smb_copy_sid(owner_sid_ptr, nowner_sid_ptr); 1076 offset += 1 + 1 + 6 + (nowner_sid_ptr->num_subauth * 4); 1077 } 1078 1079 if (addition_info & GROUP_SECINFO) { 1080 pntsd->gsidoffset = cpu_to_le32(offset); 1081 group_sid_ptr = (struct smb_sid *)((char *)pntsd + offset); 1082 smb_copy_sid(group_sid_ptr, ngroup_sid_ptr); 1083 offset += 1 + 1 + 6 + (ngroup_sid_ptr->num_subauth * 4); 1084 } 1085 1086 if (addition_info & DACL_SECINFO) { 1087 pntsd->type |= cpu_to_le16(DACL_PRESENT); 1088 dacl_ptr = (struct smb_acl *)((char *)pntsd + offset); 1089 dacl_ptr->revision = cpu_to_le16(2); 1090 dacl_ptr->size = cpu_to_le16(sizeof(struct smb_acl)); 1091 dacl_ptr->num_aces = 0; 1092 1093 if (!ppntsd) { 1094 set_mode_dacl(idmap, dacl_ptr, fattr); 1095 } else { 1096 struct smb_acl *ppdacl_ptr; 1097 unsigned int dacl_offset = le32_to_cpu(ppntsd->dacloffset); 1098 int ppdacl_size, ntacl_size = ppntsd_size - dacl_offset; 1099 1100 if (!dacl_offset || 1101 (dacl_offset + sizeof(struct smb_acl) > ppntsd_size)) 1102 goto out; 1103 1104 ppdacl_ptr = (struct smb_acl *)((char *)ppntsd + dacl_offset); 1105 ppdacl_size = le16_to_cpu(ppdacl_ptr->size); 1106 if (ppdacl_size > ntacl_size || 1107 ppdacl_size < sizeof(struct smb_acl)) 1108 goto out; 1109 1110 set_ntacl_dacl(idmap, dacl_ptr, ppdacl_ptr, 1111 ntacl_size - sizeof(struct smb_acl), 1112 nowner_sid_ptr, ngroup_sid_ptr, 1113 fattr); 1114 } 1115 pntsd->dacloffset = cpu_to_le32(offset); 1116 offset += le16_to_cpu(dacl_ptr->size); 1117 } 1118 1119 out: 1120 kfree(nowner_sid_ptr); 1121 kfree(ngroup_sid_ptr); 1122 *secdesclen = offset; 1123 return rc; 1124 } 1125 1126 static void smb_set_ace(struct smb_ace *ace, const struct smb_sid *sid, u8 type, 1127 u8 flags, __le32 access_req) 1128 { 1129 ace->type = type; 1130 ace->flags = flags; 1131 ace->access_req = access_req; 1132 smb_copy_sid(&ace->sid, sid); 1133 ace->size = cpu_to_le16(1 + 1 + 2 + 4 + 1 + 1 + 6 + 1134 (ace->sid.num_subauth * 4)); 1135 } 1136 1137 static int smb_append_inherited_ace(struct smb_ace **ace, int *nt_size, 1138 u16 *ace_cnt, const struct smb_sid *sid, 1139 u8 type, u8 flags, __le32 access_req) 1140 { 1141 int ace_size; 1142 1143 smb_set_ace(*ace, sid, type, flags, access_req); 1144 ace_size = le16_to_cpu((*ace)->size); 1145 /* pdacl->size is __le16 and includes struct smb_acl. */ 1146 if (check_add_overflow(*nt_size, ace_size, nt_size) || 1147 *nt_size > U16_MAX - (int)sizeof(struct smb_acl)) 1148 return -EINVAL; 1149 1150 (*ace_cnt)++; 1151 *ace = (struct smb_ace *)((char *)*ace + ace_size); 1152 return 0; 1153 } 1154 1155 static int smb_validate_ntsd_sid(struct smb_ntsd *pntsd, size_t pntsd_size, 1156 unsigned int sid_offset, struct smb_sid **sid, 1157 size_t *sid_size) 1158 { 1159 size_t sid_end; 1160 1161 *sid = NULL; 1162 *sid_size = 0; 1163 1164 if (!sid_offset) 1165 return 0; 1166 1167 if (sid_offset < sizeof(struct smb_ntsd) || 1168 check_add_overflow(sid_offset, (size_t)CIFS_SID_BASE_SIZE, 1169 &sid_end) || 1170 sid_end > pntsd_size) 1171 return -EINVAL; 1172 1173 *sid = (struct smb_sid *)((char *)pntsd + sid_offset); 1174 if ((*sid)->num_subauth > SID_MAX_SUB_AUTHORITIES) 1175 return -EINVAL; 1176 1177 if (check_add_overflow((size_t)CIFS_SID_BASE_SIZE, 1178 sizeof(__le32) * (size_t)(*sid)->num_subauth, 1179 &sid_end)) 1180 return -EINVAL; 1181 1182 if (sid_offset > pntsd_size || sid_end > pntsd_size - sid_offset) 1183 return -EINVAL; 1184 1185 *sid_size = sid_end; 1186 return 0; 1187 } 1188 1189 int smb_inherit_dacl(struct ksmbd_conn *conn, 1190 const struct path *path, 1191 unsigned int uid, unsigned int gid) 1192 { 1193 const struct smb_sid *psid, *creator = NULL; 1194 struct smb_ace *parent_aces, *aces; 1195 struct smb_acl *parent_pdacl; 1196 struct smb_ntsd *parent_pntsd = NULL; 1197 struct smb_sid owner_sid, group_sid; 1198 struct dentry *parent = path->dentry->d_parent; 1199 struct mnt_idmap *idmap = mnt_idmap(path->mnt); 1200 int inherited_flags = 0, flags = 0, i, nt_size = 0, pdacl_size; 1201 int rc = 0, pntsd_type, ppntsd_size, acl_len, aces_size; 1202 unsigned int dacloffset; 1203 size_t dacl_struct_end; 1204 u16 num_aces, ace_cnt = 0; 1205 char *aces_base; 1206 bool is_dir = S_ISDIR(d_inode(path->dentry)->i_mode); 1207 1208 ppntsd_size = ksmbd_vfs_get_sd_xattr(conn, idmap, 1209 parent, &parent_pntsd); 1210 if (ppntsd_size <= 0) 1211 return -ENOENT; 1212 1213 dacloffset = le32_to_cpu(parent_pntsd->dacloffset); 1214 if (!dacloffset || 1215 check_add_overflow(dacloffset, sizeof(struct smb_acl), &dacl_struct_end) || 1216 dacl_struct_end > (size_t)ppntsd_size) { 1217 rc = -EINVAL; 1218 goto free_parent_pntsd; 1219 } 1220 1221 parent_pdacl = (struct smb_acl *)((char *)parent_pntsd + dacloffset); 1222 acl_len = ppntsd_size - dacloffset; 1223 num_aces = le16_to_cpu(parent_pdacl->num_aces); 1224 pntsd_type = le16_to_cpu(parent_pntsd->type); 1225 pdacl_size = le16_to_cpu(parent_pdacl->size); 1226 1227 if (pdacl_size > acl_len || pdacl_size < sizeof(struct smb_acl)) { 1228 rc = -EINVAL; 1229 goto free_parent_pntsd; 1230 } 1231 1232 aces_size = pdacl_size - sizeof(struct smb_acl); 1233 1234 /* 1235 * Validate num_aces against the DACL payload before allocating. 1236 * Each ACE must be at least as large as its fixed-size header 1237 * (up to the SID base), so num_aces cannot exceed the payload 1238 * divided by the minimum ACE size. This mirrors the existing 1239 * check in parse_dacl(). 1240 */ 1241 if (num_aces > aces_size / (offsetof(struct smb_ace, sid) + 1242 offsetof(struct smb_sid, sub_auth) + 1243 sizeof(__le16))) { 1244 rc = -EINVAL; 1245 goto free_parent_pntsd; 1246 } 1247 1248 aces_base = kmalloc_array(num_aces * 2, sizeof(struct smb_ace), 1249 KSMBD_DEFAULT_GFP); 1250 if (!aces_base) { 1251 rc = -ENOMEM; 1252 goto free_parent_pntsd; 1253 } 1254 1255 aces = (struct smb_ace *)aces_base; 1256 parent_aces = (struct smb_ace *)((char *)parent_pdacl + 1257 sizeof(struct smb_acl)); 1258 1259 if (pntsd_type & DACL_AUTO_INHERITED) 1260 inherited_flags = INHERITED_ACE; 1261 1262 for (i = 0; i < num_aces; i++) { 1263 int pace_size; 1264 1265 if (aces_size < offsetof(struct smb_ace, sid) + 1266 CIFS_SID_BASE_SIZE) 1267 break; 1268 1269 pace_size = le16_to_cpu(parent_aces->size); 1270 if (pace_size > aces_size || 1271 pace_size < offsetof(struct smb_ace, sid) + 1272 CIFS_SID_BASE_SIZE) 1273 break; 1274 1275 if (parent_aces->sid.num_subauth > SID_MAX_SUB_AUTHORITIES || 1276 pace_size < offsetof(struct smb_ace, sid) + 1277 CIFS_SID_BASE_SIZE + 1278 sizeof(__le32) * parent_aces->sid.num_subauth) 1279 break; 1280 1281 aces_size -= pace_size; 1282 1283 flags = parent_aces->flags; 1284 if (!smb_inherit_flags(flags, is_dir)) 1285 goto pass; 1286 if (is_dir) { 1287 flags &= ~(INHERIT_ONLY_ACE | INHERITED_ACE); 1288 if (!(flags & CONTAINER_INHERIT_ACE)) 1289 flags |= INHERIT_ONLY_ACE; 1290 if (flags & NO_PROPAGATE_INHERIT_ACE) 1291 flags = 0; 1292 } else { 1293 flags = 0; 1294 } 1295 1296 if (!compare_sids(&creator_owner, &parent_aces->sid)) { 1297 creator = &creator_owner; 1298 id_to_sid(uid, SIDOWNER, &owner_sid); 1299 psid = &owner_sid; 1300 } else if (!compare_sids(&creator_group, &parent_aces->sid)) { 1301 creator = &creator_group; 1302 id_to_sid(gid, SIDUNIX_GROUP, &group_sid); 1303 psid = &group_sid; 1304 } else { 1305 creator = NULL; 1306 psid = &parent_aces->sid; 1307 } 1308 1309 if (is_dir && creator && flags & CONTAINER_INHERIT_ACE) { 1310 rc = smb_append_inherited_ace(&aces, &nt_size, &ace_cnt, 1311 psid, parent_aces->type, 1312 inherited_flags, 1313 parent_aces->access_req); 1314 if (rc) 1315 goto free_aces_base; 1316 flags |= INHERIT_ONLY_ACE; 1317 psid = creator; 1318 } else if (is_dir && !(parent_aces->flags & NO_PROPAGATE_INHERIT_ACE)) { 1319 psid = &parent_aces->sid; 1320 } 1321 1322 rc = smb_append_inherited_ace(&aces, &nt_size, &ace_cnt, psid, 1323 parent_aces->type, 1324 flags | inherited_flags, 1325 parent_aces->access_req); 1326 if (rc) 1327 goto free_aces_base; 1328 pass: 1329 parent_aces = (struct smb_ace *)((char *)parent_aces + pace_size); 1330 } 1331 1332 if (nt_size > 0) { 1333 struct smb_ntsd *pntsd; 1334 struct smb_acl *pdacl; 1335 struct smb_sid *powner_sid = NULL, *pgroup_sid = NULL; 1336 size_t powner_sid_size = 0, pgroup_sid_size = 0, pntsd_size; 1337 size_t pntsd_alloc_size; 1338 1339 rc = smb_validate_ntsd_sid(parent_pntsd, ppntsd_size, 1340 le32_to_cpu(parent_pntsd->osidoffset), 1341 &powner_sid, &powner_sid_size); 1342 if (rc) 1343 goto free_aces_base; 1344 rc = smb_validate_ntsd_sid(parent_pntsd, ppntsd_size, 1345 le32_to_cpu(parent_pntsd->gsidoffset), 1346 &pgroup_sid, &pgroup_sid_size); 1347 if (rc) 1348 goto free_aces_base; 1349 1350 if (check_add_overflow(sizeof(struct smb_ntsd), 1351 (size_t)powner_sid_size, 1352 &pntsd_alloc_size) || 1353 check_add_overflow(pntsd_alloc_size, 1354 (size_t)pgroup_sid_size, 1355 &pntsd_alloc_size) || 1356 check_add_overflow(pntsd_alloc_size, sizeof(struct smb_acl), 1357 &pntsd_alloc_size) || 1358 check_add_overflow(pntsd_alloc_size, (size_t)nt_size, 1359 &pntsd_alloc_size)) { 1360 rc = -EINVAL; 1361 goto free_aces_base; 1362 } 1363 1364 pntsd = kzalloc(pntsd_alloc_size, KSMBD_DEFAULT_GFP); 1365 if (!pntsd) { 1366 rc = -ENOMEM; 1367 goto free_aces_base; 1368 } 1369 1370 pntsd->revision = cpu_to_le16(1); 1371 pntsd->type = cpu_to_le16(SELF_RELATIVE | DACL_PRESENT); 1372 if (le16_to_cpu(parent_pntsd->type) & DACL_AUTO_INHERITED) 1373 pntsd->type |= cpu_to_le16(DACL_AUTO_INHERITED); 1374 pntsd_size = sizeof(struct smb_ntsd); 1375 pntsd->osidoffset = parent_pntsd->osidoffset; 1376 pntsd->gsidoffset = parent_pntsd->gsidoffset; 1377 pntsd->dacloffset = parent_pntsd->dacloffset; 1378 1379 if ((u64)le32_to_cpu(pntsd->osidoffset) + powner_sid_size > 1380 pntsd_alloc_size) { 1381 rc = -EINVAL; 1382 kfree(pntsd); 1383 goto free_aces_base; 1384 } 1385 1386 if ((u64)le32_to_cpu(pntsd->gsidoffset) + pgroup_sid_size > 1387 pntsd_alloc_size) { 1388 rc = -EINVAL; 1389 kfree(pntsd); 1390 goto free_aces_base; 1391 } 1392 1393 if ((u64)le32_to_cpu(pntsd->dacloffset) + sizeof(struct smb_acl) + nt_size > 1394 pntsd_alloc_size) { 1395 rc = -EINVAL; 1396 kfree(pntsd); 1397 goto free_aces_base; 1398 } 1399 1400 if (pntsd->osidoffset) { 1401 struct smb_sid *owner_sid = (struct smb_sid *)((char *)pntsd + 1402 le32_to_cpu(pntsd->osidoffset)); 1403 memcpy(owner_sid, powner_sid, powner_sid_size); 1404 pntsd_size += powner_sid_size; 1405 } 1406 1407 if (pntsd->gsidoffset) { 1408 struct smb_sid *group_sid = (struct smb_sid *)((char *)pntsd + 1409 le32_to_cpu(pntsd->gsidoffset)); 1410 memcpy(group_sid, pgroup_sid, pgroup_sid_size); 1411 pntsd_size += pgroup_sid_size; 1412 } 1413 1414 if (pntsd->dacloffset) { 1415 struct smb_ace *pace; 1416 1417 pdacl = (struct smb_acl *)((char *)pntsd + le32_to_cpu(pntsd->dacloffset)); 1418 pdacl->revision = cpu_to_le16(2); 1419 pdacl->size = cpu_to_le16(sizeof(struct smb_acl) + nt_size); 1420 pdacl->num_aces = cpu_to_le16(ace_cnt); 1421 pace = (struct smb_ace *)((char *)pdacl + sizeof(struct smb_acl)); 1422 memcpy(pace, aces_base, nt_size); 1423 pntsd_size += sizeof(struct smb_acl) + nt_size; 1424 } 1425 1426 ksmbd_vfs_set_sd_xattr(conn, idmap, path, pntsd, pntsd_size, false); 1427 kfree(pntsd); 1428 } 1429 1430 free_aces_base: 1431 kfree(aces_base); 1432 free_parent_pntsd: 1433 kfree(parent_pntsd); 1434 return rc; 1435 } 1436 1437 bool smb_inherit_flags(int flags, bool is_dir) 1438 { 1439 if (!is_dir) 1440 return (flags & OBJECT_INHERIT_ACE) != 0; 1441 1442 if (flags & OBJECT_INHERIT_ACE && !(flags & NO_PROPAGATE_INHERIT_ACE)) 1443 return true; 1444 1445 if (flags & CONTAINER_INHERIT_ACE) 1446 return true; 1447 return false; 1448 } 1449 1450 int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path, 1451 __le32 *pdaccess, __le32 raw_daccess, int uid, 1452 bool strict) 1453 { 1454 struct mnt_idmap *idmap = mnt_idmap(path->mnt); 1455 struct smb_ntsd *pntsd = NULL; 1456 struct smb_acl *pdacl; 1457 struct posix_acl *posix_acls; 1458 int rc = 0, pntsd_size, acl_size, aces_size, pdacl_size; 1459 unsigned int dacl_offset; 1460 size_t dacl_struct_end; 1461 struct smb_sid sid; 1462 int requested = le32_to_cpu(*pdaccess & ~FILE_MAXIMAL_ACCESS_LE); 1463 int granted = requested; 1464 struct smb_ace *ace; 1465 int i, found = 0; 1466 unsigned int access_bits = 0, denied = 0; 1467 struct smb_ace *others_ace = NULL; 1468 struct posix_acl_entry *pa_entry; 1469 unsigned int sid_type = SIDOWNER; 1470 unsigned short ace_size; 1471 bool is_owner, owner_rights = false; 1472 vfsuid_t vfsuid; 1473 1474 ksmbd_debug(SMB, "check permission using windows acl\n"); 1475 pntsd_size = ksmbd_vfs_get_sd_xattr(conn, idmap, 1476 path->dentry, &pntsd); 1477 if (pntsd_size <= 0 || !pntsd) 1478 goto err_out; 1479 1480 dacl_offset = le32_to_cpu(pntsd->dacloffset); 1481 if (!dacl_offset || 1482 check_add_overflow(dacl_offset, sizeof(struct smb_acl), &dacl_struct_end) || 1483 dacl_struct_end > (size_t)pntsd_size) 1484 goto err_out; 1485 1486 pdacl = (struct smb_acl *)((char *)pntsd + le32_to_cpu(pntsd->dacloffset)); 1487 acl_size = pntsd_size - dacl_offset; 1488 pdacl_size = le16_to_cpu(pdacl->size); 1489 1490 if (pdacl_size > acl_size || pdacl_size < sizeof(struct smb_acl)) 1491 goto err_out; 1492 1493 if (!pdacl->num_aces) { 1494 if (!(pdacl_size - sizeof(struct smb_acl)) && 1495 *pdaccess & ~(FILE_READ_CONTROL_LE | FILE_WRITE_DAC_LE)) { 1496 rc = -EACCES; 1497 goto err_out; 1498 } 1499 goto err_out; 1500 } 1501 1502 if (!uid) 1503 sid_type = SIDUNIX_USER; 1504 id_to_sid(uid, sid_type, &sid); 1505 vfsuid = i_uid_into_vfsuid(idmap, d_inode(path->dentry)); 1506 is_owner = uid == from_kuid(&init_user_ns, vfsuid_into_kuid(vfsuid)); 1507 1508 if (*pdaccess & FILE_MAXIMAL_ACCESS_LE) { 1509 ace = (struct smb_ace *)((char *)pdacl + sizeof(struct smb_acl)); 1510 aces_size = pdacl_size - sizeof(struct smb_acl); 1511 for (i = 0; i < le16_to_cpu(pdacl->num_aces); i++) { 1512 if (aces_size < offsetof(struct smb_ace, sid) + 1513 CIFS_SID_BASE_SIZE) 1514 break; 1515 ace_size = le16_to_cpu(ace->size); 1516 if (ace_size > aces_size || 1517 ace_size < offsetof(struct smb_ace, sid) + 1518 CIFS_SID_BASE_SIZE) 1519 break; 1520 aces_size -= ace_size; 1521 1522 if (ace->sid.num_subauth > SID_MAX_SUB_AUTHORITIES || 1523 ace_size < offsetof(struct smb_ace, sid) + 1524 CIFS_SID_BASE_SIZE + 1525 sizeof(__le32) * ace->sid.num_subauth) 1526 break; 1527 1528 if (!compare_sids(&sid_owner_rights, &ace->sid)) { 1529 owner_rights = true; 1530 if (!is_owner) 1531 goto next_ace; 1532 } 1533 1534 if (ace->flags & INHERIT_ONLY_ACE || 1535 (compare_sids(&sid, &ace->sid) && 1536 compare_sids(&sid_unix_NFS_mode, &ace->sid) && 1537 compare_sids(&sid_everyone, &ace->sid) && 1538 compare_sids(&sid_authusers, &ace->sid) && 1539 compare_sids(&sid_owner_rights, &ace->sid))) 1540 goto next_ace; 1541 1542 switch (ace->type) { 1543 case ACCESS_ALLOWED_ACE_TYPE: 1544 access_bits |= le32_to_cpu(ace->access_req); 1545 break; 1546 case ACCESS_DENIED_ACE_TYPE: 1547 case ACCESS_DENIED_CALLBACK_ACE_TYPE: 1548 denied |= ~access_bits & 1549 le32_to_cpu(ace->access_req); 1550 break; 1551 } 1552 next_ace: 1553 ace = (struct smb_ace *)((char *)ace + le16_to_cpu(ace->size)); 1554 } 1555 if (is_owner && !owner_rights) 1556 access_bits |= READ_CONTROL | WRITE_DAC | 1557 FILE_READ_ATTRIBUTES | DELETE; 1558 access_bits &= ~denied; 1559 if ((raw_daccess & FILE_GENERIC_EXECUTE_LE) && 1560 S_ISREG(d_inode(path->dentry)->i_mode) && 1561 (access_bits & GENERIC_READ_FLAGS) == GENERIC_READ_FLAGS) 1562 access_bits |= FILE_EXECUTE; 1563 granted = requested | access_bits; 1564 } 1565 1566 ace = (struct smb_ace *)((char *)pdacl + sizeof(struct smb_acl)); 1567 aces_size = pdacl_size - sizeof(struct smb_acl); 1568 for (i = 0; i < le16_to_cpu(pdacl->num_aces); i++) { 1569 if (aces_size < offsetof(struct smb_ace, sid) + 1570 CIFS_SID_BASE_SIZE) 1571 break; 1572 ace_size = le16_to_cpu(ace->size); 1573 if (ace_size > aces_size || 1574 ace_size < offsetof(struct smb_ace, sid) + 1575 CIFS_SID_BASE_SIZE) 1576 break; 1577 aces_size -= ace_size; 1578 1579 if (ace->sid.num_subauth > SID_MAX_SUB_AUTHORITIES || 1580 ace_size < offsetof(struct smb_ace, sid) + CIFS_SID_BASE_SIZE + 1581 sizeof(__le32) * ace->sid.num_subauth) 1582 break; 1583 1584 if (!compare_sids(&sid, &ace->sid) || 1585 !compare_sids(&sid_unix_NFS_mode, &ace->sid)) { 1586 found = 1; 1587 break; 1588 } 1589 if (!compare_sids(&sid_everyone, &ace->sid) || 1590 !compare_sids(&sid_authusers, &ace->sid)) 1591 others_ace = ace; 1592 1593 ace = (struct smb_ace *)((char *)ace + le16_to_cpu(ace->size)); 1594 } 1595 1596 if (IS_ENABLED(CONFIG_FS_POSIX_ACL)) { 1597 posix_acls = get_inode_acl(d_inode(path->dentry), ACL_TYPE_ACCESS); 1598 if (!IS_ERR_OR_NULL(posix_acls) && !found && !others_ace) { 1599 unsigned int id = -1; 1600 1601 pa_entry = posix_acls->a_entries; 1602 for (i = 0; i < posix_acls->a_count; i++, pa_entry++) { 1603 if (pa_entry->e_tag == ACL_USER) 1604 id = posix_acl_uid_translate(idmap, pa_entry); 1605 else if (pa_entry->e_tag == ACL_GROUP) 1606 id = posix_acl_gid_translate(idmap, pa_entry); 1607 else 1608 continue; 1609 1610 if (id == uid) { 1611 mode_to_access_flags(pa_entry->e_perm, 1612 0777, 1613 &access_bits); 1614 if (!access_bits) 1615 access_bits = 1616 SET_MINIMUM_RIGHTS; 1617 posix_acl_release(posix_acls); 1618 goto check_access_bits; 1619 } 1620 } 1621 } 1622 if (!IS_ERR_OR_NULL(posix_acls)) 1623 posix_acl_release(posix_acls); 1624 } 1625 1626 if (!found) { 1627 if (others_ace) { 1628 ace = others_ace; 1629 } else { 1630 ksmbd_debug(SMB, "Can't find corresponding sid\n"); 1631 rc = -EACCES; 1632 goto err_out; 1633 } 1634 } 1635 1636 if (!(*pdaccess & FILE_MAXIMAL_ACCESS_LE)) { 1637 switch (ace->type) { 1638 case ACCESS_ALLOWED_ACE_TYPE: 1639 access_bits = le32_to_cpu(ace->access_req); 1640 break; 1641 case ACCESS_DENIED_ACE_TYPE: 1642 case ACCESS_DENIED_CALLBACK_ACE_TYPE: 1643 access_bits = le32_to_cpu(~ace->access_req); 1644 break; 1645 } 1646 } 1647 1648 check_access_bits: 1649 if (strict) { 1650 access_bits &= granted; 1651 } else { 1652 access_bits |= FILE_READ_ATTRIBUTES | READ_CONTROL | 1653 WRITE_DAC | DELETE; 1654 } 1655 1656 if (granted & ~access_bits) { 1657 ksmbd_debug(SMB, "Access denied with winACL, granted : %x, access_req : %x\n", 1658 granted, le32_to_cpu(ace->access_req)); 1659 rc = -EACCES; 1660 goto err_out; 1661 } 1662 1663 *pdaccess = cpu_to_le32(granted); 1664 err_out: 1665 kfree(pntsd); 1666 return rc; 1667 } 1668 1669 int set_info_sec(struct ksmbd_conn *conn, struct ksmbd_tree_connect *tcon, 1670 const struct path *path, struct smb_ntsd *pntsd, int ntsd_len, 1671 bool type_check, bool get_write) 1672 { 1673 int rc; 1674 struct smb_fattr fattr = {{0}}; 1675 struct inode *inode = d_inode(path->dentry); 1676 struct mnt_idmap *idmap = mnt_idmap(path->mnt); 1677 struct iattr newattrs; 1678 1679 fattr.cf_uid = INVALID_UID; 1680 fattr.cf_gid = INVALID_GID; 1681 fattr.cf_mode = inode->i_mode; 1682 1683 rc = parse_sec_desc(idmap, pntsd, ntsd_len, &fattr); 1684 if (rc) 1685 goto out; 1686 1687 newattrs.ia_valid = ATTR_CTIME; 1688 if (!uid_eq(fattr.cf_uid, INVALID_UID)) { 1689 newattrs.ia_valid |= ATTR_UID; 1690 newattrs.ia_uid = fattr.cf_uid; 1691 } 1692 if (!gid_eq(fattr.cf_gid, INVALID_GID)) { 1693 newattrs.ia_valid |= ATTR_GID; 1694 newattrs.ia_gid = fattr.cf_gid; 1695 } 1696 newattrs.ia_valid |= ATTR_MODE; 1697 newattrs.ia_mode = (inode->i_mode & ~0777) | (fattr.cf_mode & 0777); 1698 1699 ksmbd_vfs_remove_acl_xattrs(idmap, path); 1700 /* Update posix acls */ 1701 if (IS_ENABLED(CONFIG_FS_POSIX_ACL) && fattr.cf_dacls) { 1702 rc = set_posix_acl(idmap, path->dentry, 1703 ACL_TYPE_ACCESS, fattr.cf_acls); 1704 if (rc < 0) 1705 ksmbd_debug(SMB, 1706 "Set posix acl(ACL_TYPE_ACCESS) failed, rc : %d\n", 1707 rc); 1708 if (S_ISDIR(inode->i_mode) && fattr.cf_dacls) { 1709 rc = set_posix_acl(idmap, path->dentry, 1710 ACL_TYPE_DEFAULT, fattr.cf_dacls); 1711 if (rc) 1712 ksmbd_debug(SMB, 1713 "Set posix acl(ACL_TYPE_DEFAULT) failed, rc : %d\n", 1714 rc); 1715 } 1716 } 1717 1718 inode_lock(inode); 1719 rc = notify_change(idmap, path->dentry, &newattrs, NULL); 1720 inode_unlock(inode); 1721 if (rc) 1722 goto out; 1723 1724 /* Check it only calling from SD BUFFER context */ 1725 if (type_check && !(le16_to_cpu(pntsd->type) & DACL_PRESENT)) 1726 goto out; 1727 1728 if (test_share_config_flag(tcon->share_conf, KSMBD_SHARE_FLAG_ACL_XATTR)) { 1729 /* Update WinACL in xattr */ 1730 ksmbd_vfs_remove_sd_xattrs(idmap, path); 1731 ksmbd_vfs_set_sd_xattr(conn, idmap, path, pntsd, ntsd_len, 1732 get_write); 1733 } 1734 1735 out: 1736 posix_acl_release(fattr.cf_acls); 1737 posix_acl_release(fattr.cf_dacls); 1738 return rc; 1739 } 1740 1741 void ksmbd_init_domain(u32 *sub_auth) 1742 { 1743 int i; 1744 1745 memcpy(&server_conf.domain_sid, &domain, sizeof(struct smb_sid)); 1746 for (i = 0; i < 3; ++i) 1747 server_conf.domain_sid.sub_auth[i + 1] = cpu_to_le32(sub_auth[i]); 1748 } 1749