1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 /* 28 * ACL API for smbfs 29 */ 30 31 #include <sys/types.h> 32 #include <sys/errno.h> 33 #include <sys/cred.h> 34 #include <sys/cmn_err.h> 35 #include <sys/kmem.h> 36 #include <sys/sunddi.h> 37 #include <sys/acl.h> 38 #include <sys/vnode.h> 39 #include <sys/vfs.h> 40 #include <sys/byteorder.h> 41 42 #include <errno.h> 43 #include <stdio.h> 44 #include <strings.h> 45 #include <unistd.h> 46 47 #include <umem.h> 48 #include <idmap.h> 49 50 #include <sys/fs/smbfs_ioctl.h> 51 52 #include <netsmb/smb.h> 53 #include <netsmb/smb_lib.h> 54 #include <netsmb/smbfs_acl.h> 55 56 #include "acl_nt.h" 57 #include "private.h" 58 59 /* Sanity check SD sizes */ 60 #define MAX_RAW_SD_SIZE 32768 61 62 /* XXX: acl_common.h */ 63 acl_t *acl_alloc(enum acl_type); 64 void acl_free(acl_t *); 65 66 67 /* 68 * Get/set a Windows security descriptor (SD) 69 * using the (private) smbfs ioctl mechanism. 70 * Note: Get allocates mbp->mb_top 71 */ 72 73 /* ARGSUSED */ 74 int 75 smbfs_acl_iocget(int fd, uint32_t selector, mbdata_t *mbp) 76 { 77 ioc_sdbuf_t iocb; 78 struct mbuf *m; 79 int error; 80 81 error = mb_init(mbp, MAX_RAW_SD_SIZE); 82 if (error) 83 return (error); 84 85 m = mbp->mb_top; 86 iocb.addr = mtod(m, uintptr_t); 87 iocb.alloc = m->m_maxlen; 88 iocb.used = 0; 89 iocb.selector = selector; 90 91 /* 92 * This does the OTW Get. 93 */ 94 if (ioctl(fd, SMBFSIO_GETSD, &iocb) < 0) { 95 error = errno; 96 goto errout; 97 } 98 99 m->m_len = iocb.used; 100 return (0); 101 102 errout: 103 mb_done(mbp); 104 return (error); 105 } 106 107 /* ARGSUSED */ 108 int 109 smbfs_acl_iocset(int fd, uint32_t selector, mbdata_t *mbp) 110 { 111 ioc_sdbuf_t iocb; 112 struct mbuf *m; 113 int error; 114 115 /* Make the data contiguous. */ 116 error = m_lineup(mbp->mb_top, &m); 117 if (error) 118 return (error); 119 120 if (mbp->mb_top != m) 121 mb_initm(mbp, m); 122 123 iocb.addr = mtod(m, uintptr_t); 124 iocb.alloc = m->m_maxlen; 125 iocb.used = m->m_len; 126 iocb.selector = selector; 127 128 /* 129 * This does the OTW Set. 130 */ 131 if (ioctl(fd, SMBFSIO_SETSD, &iocb) < 0) 132 error = errno; 133 134 return (error); 135 } 136 137 /* 138 * Get an NT SD from the open file via ioctl. 139 */ 140 int 141 smbfs_acl_getsd(int fd, uint32_t selector, i_ntsd_t **sdp) 142 { 143 mbdata_t *mbp, mb_store; 144 int error; 145 146 mbp = &mb_store; 147 bzero(mbp, sizeof (*mbp)); 148 149 /* 150 * Get the raw Windows SD via ioctl. 151 * Returns allocated mbchain in mbp. 152 */ 153 error = smbfs_acl_iocget(fd, selector, mbp); 154 if (error == 0) { 155 /* 156 * Import the raw SD into "internal" form. 157 * (like "absolute" form per. NT docs) 158 * Returns allocated data in sdp 159 */ 160 error = mb_get_ntsd(mbp, sdp); 161 } 162 163 mb_done(mbp); 164 return (error); 165 } 166 167 /* 168 * Set an NT SD onto the open file via ioctl. 169 */ 170 int 171 smbfs_acl_setsd(int fd, uint32_t selector, i_ntsd_t *sd) 172 { 173 mbdata_t *mbp, mb_store; 174 int error; 175 176 mbp = &mb_store; 177 mb_init(mbp, M_MINSIZE); 178 179 /* 180 * Export the "internal" SD into an mb chain. 181 * (a.k.a "self-relative" form per. NT docs) 182 * Returns allocated mbchain in mbp. 183 */ 184 error = mb_put_ntsd(mbp, sd); 185 if (error == 0) { 186 /* 187 * Set the raw Windows SD via ioctl. 188 */ 189 error = smbfs_acl_iocset(fd, selector, mbp); 190 } 191 192 mb_done(mbp); 193 194 return (error); 195 } 196 197 198 199 /* 200 * Convenience function to Get security using a 201 * ZFS-style ACL (libsec acl, type=ACE_T) 202 * Intentionally similar to: facl_get(3SEC) 203 */ 204 int 205 smbfs_acl_get(int fd, acl_t **aclp, uid_t *uidp, gid_t *gidp) 206 { 207 i_ntsd_t *sd = NULL; 208 acl_t *acl = NULL; 209 uint32_t selector; 210 int error; 211 212 /* 213 * Which parts of the SD are being requested? 214 * XXX: Should we request the SACL too? If so, 215 * might that cause this access to be denied? 216 * Or maybe: if we get access denied, try the 217 * open/fetch again without the SACL bit. 218 */ 219 selector = 0; 220 if (aclp) 221 selector |= DACL_SECURITY_INFORMATION; 222 if (uidp) 223 selector |= OWNER_SECURITY_INFORMATION; 224 if (gidp) 225 selector |= GROUP_SECURITY_INFORMATION; 226 227 if (selector == 0) 228 return (0); 229 230 /* 231 * Get the Windows SD via ioctl, in 232 * "internal" (absolute) form. 233 */ 234 error = smbfs_acl_getsd(fd, selector, &sd); 235 if (error) 236 return (error); 237 /* Note: sd now holds allocated data. */ 238 239 /* 240 * Convert the internal SD to a ZFS ACL. 241 * Get uid/gid too if pointers != NULL. 242 */ 243 if (aclp) { 244 acl = acl_alloc(ACE_T); 245 if (acl == NULL) { 246 error = ENOMEM; 247 goto out; 248 } 249 } 250 error = smbfs_acl_sd2zfs(sd, acl, uidp, gidp); 251 if (error) 252 goto out; 253 254 /* Success! */ 255 if (aclp) { 256 *aclp = acl; 257 acl = NULL; 258 } 259 260 out: 261 if (acl) 262 acl_free(acl); 263 smbfs_acl_free_sd(sd); 264 return (error); 265 } 266 267 /* 268 * Convenience function to Set security using a 269 * ZFS-style ACL (libsec acl, type=ACE_T) 270 * Intentionally similar to: facl_set(3SEC) 271 */ 272 int 273 smbfs_acl_set(int fd, acl_t *acl, uid_t uid, gid_t gid) 274 { 275 i_ntsd_t *sd = NULL; 276 uint32_t selector; 277 int error; 278 279 /* 280 * Which parts of the SD are being modified? 281 * XXX: Ditto comments above re. SACL. 282 */ 283 selector = 0; 284 if (acl) 285 selector |= DACL_SECURITY_INFORMATION; 286 if (uid != (uid_t)-1) 287 selector |= OWNER_SECURITY_INFORMATION; 288 if (gid != (gid_t)-1) 289 selector |= GROUP_SECURITY_INFORMATION; 290 if (selector == 0) 291 return (0); 292 293 if (acl && acl->acl_type != ACE_T) 294 return (EINVAL); 295 296 /* 297 * Convert the ZFS ACL to an internal SD. 298 * Returns allocated data in sd 299 */ 300 error = smbfs_acl_zfs2sd(acl, uid, gid, &sd); 301 if (error == 0) 302 error = smbfs_acl_setsd(fd, selector, sd); 303 304 smbfs_acl_free_sd(sd); 305 306 return (error); 307 } 308