projects / linux-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
docs: update mapping documentation
[linux-block.git] / fs / ksmbd / smbacl.c
CommitLineData
e2f34481
NJ		 1// SPDX-License-Identifier: LGPL-2.1+
2/*
3 * Copyright (C) International Business Machines Corp., 2007,2008
4 * Author(s): Steve French (sfrench@us.ibm.com)
5 * Copyright (C) 2020 Samsung Electronics Co., Ltd.
6 * Author(s): Namjae Jeon <linkinjeon@kernel.org>
7 */
8
9#include <linux/fs.h>
10#include <linux/slab.h>
11#include <linux/string.h>
a793d79e 12#include <linux/mnt_idmapping.h>
e2f34481
NJ		 13
14#include "smbacl.h"
15#include "smb_common.h"
16#include "server.h"
17#include "misc.h"
e2f34481
NJ		 18#include "mgmt/share_config.h"
19
20static const struct smb_sid domain = {1, 4, {0, 0, 0, 0, 0, 5},
21 {cpu_to_le32(21), cpu_to_le32(1), cpu_to_le32(2), cpu_to_le32(3),
22 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
23
24/* security id for everyone/world system group */
25static const struct smb_sid creator_owner = {
26 1, 1, {0, 0, 0, 0, 0, 3}, {0} };
27/* security id for everyone/world system group */
28static const struct smb_sid creator_group = {
29 1, 1, {0, 0, 0, 0, 0, 3}, {cpu_to_le32(1)} };
30
31/* security id for everyone/world system group */
32static const struct smb_sid sid_everyone = {
33 1, 1, {0, 0, 0, 0, 0, 1}, {0} };
34/* security id for Authenticated Users system group */
35static const struct smb_sid sid_authusers = {
36 1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(11)} };
37
38/* S-1-22-1 Unmapped Unix users */
39static const struct smb_sid sid_unix_users = {1, 1, {0, 0, 0, 0, 0, 22},
40 {cpu_to_le32(1), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
41
42/* S-1-22-2 Unmapped Unix groups */
43static const struct smb_sid sid_unix_groups = { 1, 1, {0, 0, 0, 0, 0, 22},
44 {cpu_to_le32(2), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
45
46/*
47 * See http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx
48 */
49
50/* S-1-5-88 MS NFS and Apple style UID/GID/mode */
51
52/* S-1-5-88-1 Unix uid */
53static const struct smb_sid sid_unix_NFS_users = { 1, 2, {0, 0, 0, 0, 0, 5},
54 {cpu_to_le32(88),
55 cpu_to_le32(1), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
56
57/* S-1-5-88-2 Unix gid */
58static const struct smb_sid sid_unix_NFS_groups = { 1, 2, {0, 0, 0, 0, 0, 5},
59 {cpu_to_le32(88),
60 cpu_to_le32(2), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
61
62/* S-1-5-88-3 Unix mode */
63static const struct smb_sid sid_unix_NFS_mode = { 1, 2, {0, 0, 0, 0, 0, 5},
64 {cpu_to_le32(88),
65 cpu_to_le32(3), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
66
67/*
68 * if the two SIDs (roughly equivalent to a UUID for a user or group) are
69 * the same returns zero, if they do not match returns non-zero.
70 */
64b39f4a 71int compare_sids(const struct smb_sid *ctsid, const struct smb_sid *cwsid)
e2f34481
NJ		 72{
73 int i;
74 int num_subauth, num_sat, num_saw;
75
64b39f4a 76 if (!ctsid || !cwsid)
e2f34481
NJ		 77 return 1;
78
79 /* compare the revision */
80 if (ctsid->revision != cwsid->revision) {
81 if (ctsid->revision > cwsid->revision)
82 return 1;
83 else
84 return -1;
85 }
86
87 /* compare all of the six auth values */
88 for (i = 0; i < NUM_AUTHS; ++i) {
89 if (ctsid->authority[i] != cwsid->authority[i]) {
90 if (ctsid->authority[i] > cwsid->authority[i])
91 return 1;
92 else
93 return -1;
94 }
95 }
96
97 /* compare all of the subauth values if any */
98 num_sat = ctsid->num_subauth;
99 num_saw = cwsid->num_subauth;
100 num_subauth = num_sat < num_saw ? num_sat : num_saw;
101 if (num_subauth) {
102 for (i = 0; i < num_subauth; ++i) {
103 if (ctsid->sub_auth[i] != cwsid->sub_auth[i]) {
104 if (le32_to_cpu(ctsid->sub_auth[i]) >
64b39f4a 105 le32_to_cpu(cwsid->sub_auth[i]))
e2f34481
NJ		 106 return 1;
107 else
108 return -1;
109 }
110 }
111 }
112
113 return 0; /* sids compare/match */
114}
115
64b39f4a 116static void smb_copy_sid(struct smb_sid *dst, const struct smb_sid *src)
e2f34481
NJ		 117{
118 int i;
119
120 dst->revision = src->revision;
121 dst->num_subauth = min_t(u8, src->num_subauth, SID_MAX_SUB_AUTHORITIES);
122 for (i = 0; i < NUM_AUTHS; ++i)
123 dst->authority[i] = src->authority[i];
124 for (i = 0; i < dst->num_subauth; ++i)
125 dst->sub_auth[i] = src->sub_auth[i];
126}
127
128/*
129 * change posix mode to reflect permissions
130 * pmode is the existing mode (we only want to overwrite part of this
131 * bits to set can be: S_IRWXU, S_IRWXG or S_IRWXO ie 00700 or 00070 or 00007
132 */
133static umode_t access_flags_to_mode(struct smb_fattr *fattr, __le32 ace_flags,
070fb21e 134 int type)
e2f34481
NJ		 135{
136 __u32 flags = le32_to_cpu(ace_flags);
137 umode_t mode = 0;
138
139 if (flags & GENERIC_ALL) {
140 mode = 0777;
141 ksmbd_debug(SMB, "all perms\n");
142 return mode;
143 }
144
64b39f4a 145 if ((flags & GENERIC_READ) || (flags & FILE_READ_RIGHTS))
e2f34481 146 mode = 0444;
64b39f4a 147 if ((flags & GENERIC_WRITE) || (flags & FILE_WRITE_RIGHTS)) {
e2f34481
NJ		 148 mode |= 0222;
149 if (S_ISDIR(fattr->cf_mode))
150 mode |= 0111;
151 }
64b39f4a 152 if ((flags & GENERIC_EXECUTE) || (flags & FILE_EXEC_RIGHTS))
e2f34481
NJ		 153 mode |= 0111;
154
64b39f4a 155 if (type == ACCESS_DENIED_ACE_TYPE || type == ACCESS_DENIED_OBJECT_ACE_TYPE)
e2f34481
NJ		 156 mode = ~mode;
157
158 ksmbd_debug(SMB, "access flags 0x%x mode now %04o\n", flags, mode);
159
160 return mode;
161}
162
163/*
164 * Generate access flags to reflect permissions mode is the existing mode.
165 * This function is called for every ACE in the DACL whose SID matches
166 * with either owner or group or everyone.
167 */
168static void mode_to_access_flags(umode_t mode, umode_t bits_to_use,
070fb21e 169 __u32 *pace_flags)
e2f34481
NJ		 170{
171 /* reset access mask */
172 *pace_flags = 0x0;
173
174 /* bits to use are either S_IRWXU or S_IRWXG or S_IRWXO */
175 mode &= bits_to_use;
176
177 /*
178 * check for R/W/X UGO since we do not know whose flags
179 * is this but we have cleared all the bits sans RWX for
180 * either user or group or other as per bits_to_use
181 */
182 if (mode & 0444)
183 *pace_flags |= SET_FILE_READ_RIGHTS;
184 if (mode & 0222)
185 *pace_flags |= FILE_WRITE_RIGHTS;
186 if (mode & 0111)
187 *pace_flags |= SET_FILE_EXEC_RIGHTS;
188
189 ksmbd_debug(SMB, "mode: %o, access flags now 0x%x\n",
070fb21e 190 mode, *pace_flags);
e2f34481
NJ		 191}
192
193static __u16 fill_ace_for_sid(struct smb_ace *pntace,
070fb21e
NJ		 194 const struct smb_sid *psid, int type, int flags,
195 umode_t mode, umode_t bits)
e2f34481
NJ		 196{
197 int i;
198 __u16 size = 0;
199 __u32 access_req = 0;
200
201 pntace->type = type;
202 pntace->flags = flags;
203 mode_to_access_flags(mode, bits, &access_req);
204 if (!access_req)
205 access_req = SET_MINIMUM_RIGHTS;
206 pntace->access_req = cpu_to_le32(access_req);
207
208 pntace->sid.revision = psid->revision;
209 pntace->sid.num_subauth = psid->num_subauth;
210 for (i = 0; i < NUM_AUTHS; i++)
211 pntace->sid.authority[i] = psid->authority[i];
212 for (i = 0; i < psid->num_subauth; i++)
213 pntace->sid.sub_auth[i] = psid->sub_auth[i];
214
215 size = 1 + 1 + 2 + 4 + 1 + 1 + 6 + (psid->num_subauth * 4);
216 pntace->size = cpu_to_le16(size);
217
218 return size;
219}
220
221void id_to_sid(unsigned int cid, uint sidtype, struct smb_sid *ssid)
222{
223 switch (sidtype) {
224 case SIDOWNER:
225 smb_copy_sid(ssid, &server_conf.domain_sid);
226 break;
227 case SIDUNIX_USER:
228 smb_copy_sid(ssid, &sid_unix_users);
229 break;
230 case SIDUNIX_GROUP:
231 smb_copy_sid(ssid, &sid_unix_groups);
232 break;
233 case SIDCREATOR_OWNER:
234 smb_copy_sid(ssid, &creator_owner);
235 return;
236 case SIDCREATOR_GROUP:
237 smb_copy_sid(ssid, &creator_group);
238 return;
239 case SIDNFS_USER:
240 smb_copy_sid(ssid, &sid_unix_NFS_users);
241 break;
242 case SIDNFS_GROUP:
243 smb_copy_sid(ssid, &sid_unix_NFS_groups);
244 break;
245 case SIDNFS_MODE:
246 smb_copy_sid(ssid, &sid_unix_NFS_mode);
247 break;
248 default:
249 return;
250 }
251
252 /* RID */
253 ssid->sub_auth[ssid->num_subauth] = cpu_to_le32(cid);
254 ssid->num_subauth++;
255}
256
af34983e
HL		 257static int sid_to_id(struct user_namespace *user_ns,
258 struct smb_sid *psid, uint sidtype,
070fb21e 259 struct smb_fattr *fattr)
e2f34481
NJ		 260{
261 int rc = -EINVAL;
262
263 /*
264 * If we have too many subauthorities, then something is really wrong.
265 * Just return an error.
266 */
267 if (unlikely(psid->num_subauth > SID_MAX_SUB_AUTHORITIES)) {
bde1694a
NJ		 268 pr_err("%s: %u subauthorities is too many!\n",
269 __func__, psid->num_subauth);
e2f34481
NJ		 270 return -EIO;
271 }
272
273 if (sidtype == SIDOWNER) {
274 kuid_t uid;
275 uid_t id;
276
277 id = le32_to_cpu(psid->sub_auth[psid->num_subauth - 1]);
4cf0ccd0
NJ		 278 /*
279 * Translate raw sid into kuid in the server's user
280 * namespace.
281 */
282 uid = make_kuid(&init_user_ns, id);
283
284 /* If this is an idmapped mount, apply the idmapping. */
285 uid = kuid_from_mnt(user_ns, uid);
286 if (uid_valid(uid)) {
287 fattr->cf_uid = uid;
288 rc = 0;
e2f34481
NJ		 289 }
290 } else {
291 kgid_t gid;
292 gid_t id;
293
294 id = le32_to_cpu(psid->sub_auth[psid->num_subauth - 1]);
4cf0ccd0
NJ		 295 /*
296 * Translate raw sid into kgid in the server's user
297 * namespace.
298 */
299 gid = make_kgid(&init_user_ns, id);
300
301 /* If this is an idmapped mount, apply the idmapping. */
302 gid = kgid_from_mnt(user_ns, gid);
303 if (gid_valid(gid)) {
304 fattr->cf_gid = gid;
305 rc = 0;
e2f34481
NJ		 306 }
307 }
308
309 return rc;
310}
311
312void posix_state_to_acl(struct posix_acl_state *state,
070fb21e 313 struct posix_acl_entry *pace)
e2f34481
NJ		 314{
315 int i;
316
317 pace->e_tag = ACL_USER_OBJ;
318 pace->e_perm = state->owner.allow;
319 for (i = 0; i < state->users->n; i++) {
320 pace++;
321 pace->e_tag = ACL_USER;
322 pace->e_uid = state->users->aces[i].uid;
323 pace->e_perm = state->users->aces[i].perms.allow;
324 }
325
326 pace++;
327 pace->e_tag = ACL_GROUP_OBJ;
328 pace->e_perm = state->group.allow;
329
330 for (i = 0; i < state->groups->n; i++) {
331 pace++;
332 pace->e_tag = ACL_GROUP;
333 pace->e_gid = state->groups->aces[i].gid;
334 pace->e_perm = state->groups->aces[i].perms.allow;
335 }
336
337 if (state->users->n || state->groups->n) {
338 pace++;
339 pace->e_tag = ACL_MASK;
340 pace->e_perm = state->mask.allow;
341 }
342
343 pace++;
344 pace->e_tag = ACL_OTHER;
345 pace->e_perm = state->other.allow;
346}
347
348int init_acl_state(struct posix_acl_state *state, int cnt)
349{
350 int alloc;
351
352 memset(state, 0, sizeof(struct posix_acl_state));
353 /*
354 * In the worst case, each individual acl could be for a distinct
355 * named user or group, but we don't know which, so we allocate
356 * enough space for either:
357 */
358 alloc = sizeof(struct posix_ace_state_array)
64b39f4a 359 + cnt * sizeof(struct posix_user_ace_state);
e2f34481
NJ		 360 state->users = kzalloc(alloc, GFP_KERNEL);
361 if (!state->users)
362 return -ENOMEM;
363 state->groups = kzalloc(alloc, GFP_KERNEL);
364 if (!state->groups) {
365 kfree(state->users);
366 return -ENOMEM;
367 }
368 return 0;
369}
370
371void free_acl_state(struct posix_acl_state *state)
372{
373 kfree(state->users);
374 kfree(state->groups);
375}
376
af34983e
HL		 377static void parse_dacl(struct user_namespace *user_ns,
378 struct smb_acl *pdacl, char *end_of_acl,
070fb21e
NJ		 379 struct smb_sid *pownersid, struct smb_sid *pgrpsid,
380 struct smb_fattr *fattr)
e2f34481
NJ		 381{
382 int i, ret;
383 int num_aces = 0;
8f77150c 384 unsigned int acl_size;
e2f34481
NJ		 385 char *acl_base;
386 struct smb_ace **ppace;
387 struct posix_acl_entry *cf_pace, *cf_pdace;
388 struct posix_acl_state acl_state, default_acl_state;
389 umode_t mode = 0, acl_mode;
390 bool owner_found = false, group_found = false, others_found = false;
391
392 if (!pdacl)
393 return;
394
395 /* validate that we do not go past end of acl */
8f77150c 396 if (end_of_acl < (char *)pdacl + sizeof(struct smb_acl) ||
548e9ad3 397 end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size)) {
bde1694a 398 pr_err("ACL too small to parse DACL\n");
e2f34481
NJ		 399 return;
400 }
401
402 ksmbd_debug(SMB, "DACL revision %d size %d num aces %d\n",
070fb21e
NJ		 403 le16_to_cpu(pdacl->revision), le16_to_cpu(pdacl->size),
404 le32_to_cpu(pdacl->num_aces));
e2f34481
NJ		 405
406 acl_base = (char *)pdacl;
407 acl_size = sizeof(struct smb_acl);
408
409 num_aces = le32_to_cpu(pdacl->num_aces);
410 if (num_aces <= 0)
411 return;
412
413 if (num_aces > ULONG_MAX / sizeof(struct smb_ace *))
414 return;
415
070fb21e 416 ppace = kmalloc_array(num_aces, sizeof(struct smb_ace *), GFP_KERNEL);
e2f34481
NJ		 417 if (!ppace)
418 return;
419
420 ret = init_acl_state(&acl_state, num_aces);
421 if (ret)
422 return;
423 ret = init_acl_state(&default_acl_state, num_aces);
424 if (ret) {
425 free_acl_state(&acl_state);
426 return;
427 }
428
429 /*
430 * reset rwx permissions for user/group/other.
431 * Also, if num_aces is 0 i.e. DACL has no ACEs,
432 * user/group/other have no permissions
433 */
434 for (i = 0; i < num_aces; ++i) {
8f77150c
HL		 435 if (end_of_acl - acl_base < acl_size)
436 break;
437
64b39f4a 438 ppace[i] = (struct smb_ace *)(acl_base + acl_size);
e2f34481 439 acl_base = (char *)ppace[i];
8f77150c
HL		 440 acl_size = offsetof(struct smb_ace, sid) +
441 offsetof(struct smb_sid, sub_auth);
442
443 if (end_of_acl - acl_base < acl_size ||
444 ppace[i]->sid.num_subauth > SID_MAX_SUB_AUTHORITIES ||
445 (end_of_acl - acl_base <
446 acl_size + sizeof(__le32) * ppace[i]->sid.num_subauth) ||
447 (le16_to_cpu(ppace[i]->size) <
448 acl_size + sizeof(__le32) * ppace[i]->sid.num_subauth))
449 break;
450
e2f34481
NJ		 451 acl_size = le16_to_cpu(ppace[i]->size);
452 ppace[i]->access_req =
453 smb_map_generic_desired_access(ppace[i]->access_req);
454
64b39f4a 455 if (!(compare_sids(&ppace[i]->sid, &sid_unix_NFS_mode))) {
e2f34481
NJ		 456 fattr->cf_mode =
457 le32_to_cpu(ppace[i]->sid.sub_auth[2]);
458 break;
64b39f4a 459 } else if (!compare_sids(&ppace[i]->sid, pownersid)) {
e2f34481 460 acl_mode = access_flags_to_mode(fattr,
070fb21e
NJ		 461 ppace[i]->access_req,
462 ppace[i]->type);
e2f34481
NJ		 463 acl_mode &= 0700;
464
465 if (!owner_found) {
466 mode &= ~(0700);
467 mode |= acl_mode;
468 }
469 owner_found = true;
64b39f4a
NJ		 470 } else if (!compare_sids(&ppace[i]->sid, pgrpsid) ||
471 ppace[i]->sid.sub_auth[ppace[i]->sid.num_subauth - 1] ==
472 DOMAIN_USER_RID_LE) {
e2f34481 473 acl_mode = access_flags_to_mode(fattr,
070fb21e
NJ		 474 ppace[i]->access_req,
475 ppace[i]->type);
e2f34481
NJ		 476 acl_mode &= 0070;
477 if (!group_found) {
478 mode &= ~(0070);
479 mode |= acl_mode;
480 }
481 group_found = true;
64b39f4a 482 } else if (!compare_sids(&ppace[i]->sid, &sid_everyone)) {
e2f34481 483 acl_mode = access_flags_to_mode(fattr,
070fb21e
NJ		 484 ppace[i]->access_req,
485 ppace[i]->type);
e2f34481
NJ		 486 acl_mode &= 0007;
487 if (!others_found) {
488 mode &= ~(0007);
489 mode |= acl_mode;
490 }
491 others_found = true;
64b39f4a 492 } else if (!compare_sids(&ppace[i]->sid, &creator_owner)) {
e2f34481 493 continue;
64b39f4a 494 } else if (!compare_sids(&ppace[i]->sid, &creator_group)) {
e2f34481 495 continue;
64b39f4a 496 } else if (!compare_sids(&ppace[i]->sid, &sid_authusers)) {
e2f34481 497 continue;
64b39f4a 498 } else {
e2f34481
NJ		 499 struct smb_fattr temp_fattr;
500
501 acl_mode = access_flags_to_mode(fattr, ppace[i]->access_req,
070fb21e 502 ppace[i]->type);
e2f34481 503 temp_fattr.cf_uid = INVALID_UID;
af34983e 504 ret = sid_to_id(user_ns, &ppace[i]->sid, SIDOWNER, &temp_fattr);
e2f34481 505 if (ret || uid_eq(temp_fattr.cf_uid, INVALID_UID)) {
bde1694a
NJ		 506 pr_err("%s: Error %d mapping Owner SID to uid\n",
507 __func__, ret);
e2f34481
NJ		 508 continue;
509 }
510
511 acl_state.owner.allow = ((acl_mode & 0700) >> 6) | 0004;
512 acl_state.users->aces[acl_state.users->n].uid =
513 temp_fattr.cf_uid;
514 acl_state.users->aces[acl_state.users->n++].perms.allow =
515 ((acl_mode & 0700) >> 6) | 0004;
516 default_acl_state.owner.allow = ((acl_mode & 0700) >> 6) | 0004;
517 default_acl_state.users->aces[default_acl_state.users->n].uid =
518 temp_fattr.cf_uid;
519 default_acl_state.users->aces[default_acl_state.users->n++].perms.allow =
520 ((acl_mode & 0700) >> 6) | 0004;
521 }
522 }
523 kfree(ppace);
524
525 if (owner_found) {
526 /* The owner must be set to at least read-only. */
527 acl_state.owner.allow = ((mode & 0700) >> 6) | 0004;
528 acl_state.users->aces[acl_state.users->n].uid = fattr->cf_uid;
529 acl_state.users->aces[acl_state.users->n++].perms.allow =
530 ((mode & 0700) >> 6) | 0004;
531 default_acl_state.owner.allow = ((mode & 0700) >> 6) | 0004;
532 default_acl_state.users->aces[default_acl_state.users->n].uid =
533 fattr->cf_uid;
534 default_acl_state.users->aces[default_acl_state.users->n++].perms.allow =
535 ((mode & 0700) >> 6) | 0004;
536 }
537
538 if (group_found) {
539 acl_state.group.allow = (mode & 0070) >> 3;
540 acl_state.groups->aces[acl_state.groups->n].gid =
541 fattr->cf_gid;
542 acl_state.groups->aces[acl_state.groups->n++].perms.allow =
543 (mode & 0070) >> 3;
86df49e1 544 default_acl_state.group.allow = (mode & 0070) >> 3;
e2f34481
NJ		 545 default_acl_state.groups->aces[default_acl_state.groups->n].gid =
546 fattr->cf_gid;
547 default_acl_state.groups->aces[default_acl_state.groups->n++].perms.allow =
548 (mode & 0070) >> 3;
549 }
550
551 if (others_found) {
552 fattr->cf_mode &= ~(0007);
553 fattr->cf_mode |= mode & 0007;
554
555 acl_state.other.allow = mode & 0007;
556 default_acl_state.other.allow = mode & 0007;
557 }
558
559 if (acl_state.users->n || acl_state.groups->n) {
560 acl_state.mask.allow = 0x07;
777cad16
NJ		 561
562 if (IS_ENABLED(CONFIG_FS_POSIX_ACL)) {
563 fattr->cf_acls =
564 posix_acl_alloc(acl_state.users->n +
565 acl_state.groups->n + 4, GFP_KERNEL);
566 if (fattr->cf_acls) {
567 cf_pace = fattr->cf_acls->a_entries;
568 posix_state_to_acl(&acl_state, cf_pace);
569 }
e2f34481
NJ		 570 }
571 }
572
573 if (default_acl_state.users->n || default_acl_state.groups->n) {
574 default_acl_state.mask.allow = 0x07;
777cad16
NJ		 575
576 if (IS_ENABLED(CONFIG_FS_POSIX_ACL)) {
577 fattr->cf_dacls =
578 posix_acl_alloc(default_acl_state.users->n +
579 default_acl_state.groups->n + 4, GFP_KERNEL);
580 if (fattr->cf_dacls) {
581 cf_pdace = fattr->cf_dacls->a_entries;
582 posix_state_to_acl(&default_acl_state, cf_pdace);
583 }
e2f34481
NJ		 584 }
585 }
586 free_acl_state(&acl_state);
587 free_acl_state(&default_acl_state);
588}
589
af34983e
HL		 590static void set_posix_acl_entries_dacl(struct user_namespace *user_ns,
591 struct smb_ace *pndace,
070fb21e
NJ		 592 struct smb_fattr *fattr, u32 *num_aces,
593 u16 *size, u32 nt_aces_num)
e2f34481
NJ		 594{
595 struct posix_acl_entry *pace;
596 struct smb_sid *sid;
597 struct smb_ace *ntace;
598 int i, j;
599
600 if (!fattr->cf_acls)
601 goto posix_default_acl;
602
603 pace = fattr->cf_acls->a_entries;
604 for (i = 0; i < fattr->cf_acls->a_count; i++, pace++) {
605 int flags = 0;
606
607 sid = kmalloc(sizeof(struct smb_sid), GFP_KERNEL);
608 if (!sid)
609 break;
610
611 if (pace->e_tag == ACL_USER) {
612 uid_t uid;
613 unsigned int sid_type = SIDOWNER;
614
0e844efe 615 uid = posix_acl_uid_translate(user_ns, pace);
e2f34481
NJ		 616 if (!uid)
617 sid_type = SIDUNIX_USER;
618 id_to_sid(uid, sid_type, sid);
619 } else if (pace->e_tag == ACL_GROUP) {
620 gid_t gid;
621
0e844efe 622 gid = posix_acl_gid_translate(user_ns, pace);
e2f34481
NJ		 623 id_to_sid(gid, SIDUNIX_GROUP, sid);
624 } else if (pace->e_tag == ACL_OTHER && !nt_aces_num) {
625 smb_copy_sid(sid, &sid_everyone);
626 } else {
627 kfree(sid);
628 continue;
629 }
630 ntace = pndace;
631 for (j = 0; j < nt_aces_num; j++) {
632 if (ntace->sid.sub_auth[ntace->sid.num_subauth - 1] ==
633 sid->sub_auth[sid->num_subauth - 1])
634 goto pass_same_sid;
635 ntace = (struct smb_ace *)((char *)ntace +
636 le16_to_cpu(ntace->size));
637 }
638
639 if (S_ISDIR(fattr->cf_mode) && pace->e_tag == ACL_OTHER)
640 flags = 0x03;
641
64b39f4a 642 ntace = (struct smb_ace *)((char *)pndace + *size);
e2f34481
NJ		 643 *size += fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED, flags,
644 pace->e_perm, 0777);
645 (*num_aces)++;
646 if (pace->e_tag == ACL_USER)
647 ntace->access_req |=
648 FILE_DELETE_LE | FILE_DELETE_CHILD_LE;
649
650 if (S_ISDIR(fattr->cf_mode) &&
64b39f4a
NJ		 651 (pace->e_tag == ACL_USER || pace->e_tag == ACL_GROUP)) {
652 ntace = (struct smb_ace *)((char *)pndace + *size);
e2f34481
NJ		 653 *size += fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED,
654 0x03, pace->e_perm, 0777);
655 (*num_aces)++;
656 if (pace->e_tag == ACL_USER)
657 ntace->access_req |=
658 FILE_DELETE_LE | FILE_DELETE_CHILD_LE;
659 }
660
661pass_same_sid:
662 kfree(sid);
663 }
664
665 if (nt_aces_num)
666 return;
667
668posix_default_acl:
669 if (!fattr->cf_dacls)
670 return;
671
672 pace = fattr->cf_dacls->a_entries;
673 for (i = 0; i < fattr->cf_dacls->a_count; i++, pace++) {
674 sid = kmalloc(sizeof(struct smb_sid), GFP_KERNEL);
675 if (!sid)
676 break;
677
678 if (pace->e_tag == ACL_USER) {
679 uid_t uid;
680
0e844efe 681 uid = posix_acl_uid_translate(user_ns, pace);
e2f34481
NJ		 682 id_to_sid(uid, SIDCREATOR_OWNER, sid);
683 } else if (pace->e_tag == ACL_GROUP) {
684 gid_t gid;
685
0e844efe 686 gid = posix_acl_gid_translate(user_ns, pace);
e2f34481
NJ		 687 id_to_sid(gid, SIDCREATOR_GROUP, sid);
688 } else {
689 kfree(sid);
690 continue;
691 }
692
64b39f4a 693 ntace = (struct smb_ace *)((char *)pndace + *size);
e2f34481
NJ		 694 *size += fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED, 0x0b,
695 pace->e_perm, 0777);
696 (*num_aces)++;
697 if (pace->e_tag == ACL_USER)
698 ntace->access_req |=
699 FILE_DELETE_LE | FILE_DELETE_CHILD_LE;
700 kfree(sid);
701 }
702}
703
af34983e
HL		 704static void set_ntacl_dacl(struct user_namespace *user_ns,
705 struct smb_acl *pndacl,
706 struct smb_acl *nt_dacl,
070fb21e
NJ		 707 const struct smb_sid *pownersid,
708 const struct smb_sid *pgrpsid,
709 struct smb_fattr *fattr)
e2f34481
NJ		 710{
711 struct smb_ace *ntace, *pndace;
712 int nt_num_aces = le32_to_cpu(nt_dacl->num_aces), num_aces = 0;
713 unsigned short size = 0;
714 int i;
715
716 pndace = (struct smb_ace *)((char *)pndacl + sizeof(struct smb_acl));
717 if (nt_num_aces) {
718 ntace = (struct smb_ace *)((char *)nt_dacl + sizeof(struct smb_acl));
719 for (i = 0; i < nt_num_aces; i++) {
720 memcpy((char *)pndace + size, ntace, le16_to_cpu(ntace->size));
721 size += le16_to_cpu(ntace->size);
722 ntace = (struct smb_ace *)((char *)ntace + le16_to_cpu(ntace->size));
723 num_aces++;
724 }
725 }
726
af34983e
HL		 727 set_posix_acl_entries_dacl(user_ns, pndace, fattr,
728 &num_aces, &size, nt_num_aces);
e2f34481
NJ		 729 pndacl->num_aces = cpu_to_le32(num_aces);
730 pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size);
731}
732
af34983e
HL		 733static void set_mode_dacl(struct user_namespace *user_ns,
734 struct smb_acl *pndacl, struct smb_fattr *fattr)
e2f34481
NJ		 735{
736 struct smb_ace *pace, *pndace;
737 u32 num_aces = 0;
738 u16 size = 0, ace_size = 0;
739 uid_t uid;
740 const struct smb_sid *sid;
741
742 pace = pndace = (struct smb_ace *)((char *)pndacl + sizeof(struct smb_acl));
743
744 if (fattr->cf_acls) {
af34983e
HL		 745 set_posix_acl_entries_dacl(user_ns, pndace, fattr,
746 &num_aces, &size, num_aces);
e2f34481
NJ		 747 goto out;
748 }
749
750 /* owner RID */
43205ca7 751 uid = from_kuid(&init_user_ns, fattr->cf_uid);
e2f34481
NJ		 752 if (uid)
753 sid = &server_conf.domain_sid;
754 else
755 sid = &sid_unix_users;
756 ace_size = fill_ace_for_sid(pace, sid, ACCESS_ALLOWED, 0,
070fb21e 757 fattr->cf_mode, 0700);
e2f34481 758 pace->sid.sub_auth[pace->sid.num_subauth++] = cpu_to_le32(uid);
e2f34481
NJ		 759 pace->size = cpu_to_le16(ace_size + 4);
760 size += le16_to_cpu(pace->size);
761 pace = (struct smb_ace *)((char *)pndace + size);
762
763 /* Group RID */
764 ace_size = fill_ace_for_sid(pace, &sid_unix_groups,
070fb21e 765 ACCESS_ALLOWED, 0, fattr->cf_mode, 0070);
e2f34481 766 pace->sid.sub_auth[pace->sid.num_subauth++] =
43205ca7 767 cpu_to_le32(from_kgid(&init_user_ns, fattr->cf_gid));
e2f34481
NJ		 768 pace->size = cpu_to_le16(ace_size + 4);
769 size += le16_to_cpu(pace->size);
770 pace = (struct smb_ace *)((char *)pndace + size);
771 num_aces = 3;
772
773 if (S_ISDIR(fattr->cf_mode)) {
774 pace = (struct smb_ace *)((char *)pndace + size);
775
776 /* creator owner */
777 size += fill_ace_for_sid(pace, &creator_owner, ACCESS_ALLOWED,
070fb21e 778 0x0b, fattr->cf_mode, 0700);
e2f34481
NJ		 779 pace = (struct smb_ace *)((char *)pndace + size);
780
781 /* creator group */
782 size += fill_ace_for_sid(pace, &creator_group, ACCESS_ALLOWED,
070fb21e 783 0x0b, fattr->cf_mode, 0070);
e2f34481
NJ		 784 pace = (struct smb_ace *)((char *)pndace + size);
785 num_aces = 5;
786 }
787
788 /* other */
789 size += fill_ace_for_sid(pace, &sid_everyone, ACCESS_ALLOWED, 0,
070fb21e 790 fattr->cf_mode, 0007);
e2f34481
NJ		 791
792out:
793 pndacl->num_aces = cpu_to_le32(num_aces);
794 pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size);
795}
796
797static int parse_sid(struct smb_sid *psid, char *end_of_acl)
798{
799 /*
800 * validate that we do not go past end of ACL - sid must be at least 8
801 * bytes long (assuming no sub-auths - e.g. the null SID
802 */
803 if (end_of_acl < (char *)psid + 8) {
bde1694a 804 pr_err("ACL too small to parse SID %p\n", psid);
e2f34481
NJ		 805 return -EINVAL;
806 }
807
808 return 0;
809}
810
811/* Convert CIFS ACL to POSIX form */
af34983e
HL		 812int parse_sec_desc(struct user_namespace *user_ns, struct smb_ntsd *pntsd,
813 int acl_len, struct smb_fattr *fattr)
e2f34481
NJ		 814{
815 int rc = 0;
816 struct smb_sid *owner_sid_ptr, *group_sid_ptr;
817 struct smb_acl *dacl_ptr; /* no need for SACL ptr */
818 char *end_of_acl = ((char *)pntsd) + acl_len;
819 __u32 dacloffset;
548e9ad3 820 int pntsd_type;
e2f34481 821
64b39f4a 822 if (!pntsd)
e2f34481
NJ		 823 return -EIO;
824
8f77150c
HL		 825 if (acl_len < sizeof(struct smb_ntsd))
826 return -EINVAL;
827
e2f34481
NJ		 828 owner_sid_ptr = (struct smb_sid *)((char *)pntsd +
829 le32_to_cpu(pntsd->osidoffset));
830 group_sid_ptr = (struct smb_sid *)((char *)pntsd +
831 le32_to_cpu(pntsd->gsidoffset));
832 dacloffset = le32_to_cpu(pntsd->dacloffset);
833 dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset);
834 ksmbd_debug(SMB,
070fb21e
NJ		 835 "revision %d type 0x%x ooffset 0x%x goffset 0x%x sacloffset 0x%x dacloffset 0x%x\n",
836 pntsd->revision, pntsd->type, le32_to_cpu(pntsd->osidoffset),
837 le32_to_cpu(pntsd->gsidoffset),
838 le32_to_cpu(pntsd->sacloffset), dacloffset);
e2f34481 839
e2f34481 840 pntsd_type = le16_to_cpu(pntsd->type);
e2f34481
NJ		 841 if (!(pntsd_type & DACL_PRESENT)) {
842 ksmbd_debug(SMB, "DACL_PRESENT in DACL type is not set\n");
843 return rc;
844 }
845
846 pntsd->type = cpu_to_le16(DACL_PRESENT);
847
848 if (pntsd->osidoffset) {
849 rc = parse_sid(owner_sid_ptr, end_of_acl);
850 if (rc) {
bde1694a 851 pr_err("%s: Error %d parsing Owner SID\n", __func__, rc);
e2f34481
NJ		 852 return rc;
853 }
854
af34983e 855 rc = sid_to_id(user_ns, owner_sid_ptr, SIDOWNER, fattr);
e2f34481 856 if (rc) {
bde1694a
NJ		 857 pr_err("%s: Error %d mapping Owner SID to uid\n",
858 __func__, rc);
e2f34481
NJ		 859 owner_sid_ptr = NULL;
860 }
861 }
862
863 if (pntsd->gsidoffset) {
864 rc = parse_sid(group_sid_ptr, end_of_acl);
865 if (rc) {
bde1694a
NJ		 866 pr_err("%s: Error %d mapping Owner SID to gid\n",
867 __func__, rc);
e2f34481
NJ		 868 return rc;
869 }
af34983e 870 rc = sid_to_id(user_ns, group_sid_ptr, SIDUNIX_GROUP, fattr);
e2f34481 871 if (rc) {
bde1694a
NJ		 872 pr_err("%s: Error %d mapping Group SID to gid\n",
873 __func__, rc);
e2f34481
NJ		 874 group_sid_ptr = NULL;
875 }
876 }
877
070fb21e 878 if ((pntsd_type & (DACL_AUTO_INHERITED | DACL_AUTO_INHERIT_REQ)) ==
e2f34481
NJ		 879 (DACL_AUTO_INHERITED | DACL_AUTO_INHERIT_REQ))
880 pntsd->type |= cpu_to_le16(DACL_AUTO_INHERITED);
881 if (pntsd_type & DACL_PROTECTED)
882 pntsd->type |= cpu_to_le16(DACL_PROTECTED);
883
884 if (dacloffset) {
af34983e
HL		 885 parse_dacl(user_ns, dacl_ptr, end_of_acl,
886 owner_sid_ptr, group_sid_ptr, fattr);
e2f34481
NJ		 887 }
888
889 return 0;
890}
891
892/* Convert permission bits from mode to equivalent CIFS ACL */
af34983e
HL		 893int build_sec_desc(struct user_namespace *user_ns,
894 struct smb_ntsd *pntsd, struct smb_ntsd *ppntsd,
070fb21e
NJ		 895 int addition_info, __u32 *secdesclen,
896 struct smb_fattr *fattr)
e2f34481
NJ		 897{
898 int rc = 0;
899 __u32 offset;
900 struct smb_sid *owner_sid_ptr, *group_sid_ptr;
901 struct smb_sid *nowner_sid_ptr, *ngroup_sid_ptr;
902 struct smb_acl *dacl_ptr = NULL; /* no need for SACL ptr */
903 uid_t uid;
904 gid_t gid;
905 unsigned int sid_type = SIDOWNER;
906
907 nowner_sid_ptr = kmalloc(sizeof(struct smb_sid), GFP_KERNEL);
908 if (!nowner_sid_ptr)
909 return -ENOMEM;
910
43205ca7 911 uid = from_kuid(&init_user_ns, fattr->cf_uid);
e2f34481
NJ		 912 if (!uid)
913 sid_type = SIDUNIX_USER;
914 id_to_sid(uid, sid_type, nowner_sid_ptr);
915
916 ngroup_sid_ptr = kmalloc(sizeof(struct smb_sid), GFP_KERNEL);
917 if (!ngroup_sid_ptr) {
918 kfree(nowner_sid_ptr);
919 return -ENOMEM;
920 }
921
43205ca7 922 gid = from_kgid(&init_user_ns, fattr->cf_gid);
e2f34481
NJ		 923 id_to_sid(gid, SIDUNIX_GROUP, ngroup_sid_ptr);
924
925 offset = sizeof(struct smb_ntsd);
926 pntsd->sacloffset = 0;
927 pntsd->revision = cpu_to_le16(1);
928 pntsd->type = cpu_to_le16(SELF_RELATIVE);
929 if (ppntsd)
930 pntsd->type |= ppntsd->type;
931
932 if (addition_info & OWNER_SECINFO) {
933 pntsd->osidoffset = cpu_to_le32(offset);
934 owner_sid_ptr = (struct smb_sid *)((char *)pntsd + offset);
935 smb_copy_sid(owner_sid_ptr, nowner_sid_ptr);
936 offset += 1 + 1 + 6 + (nowner_sid_ptr->num_subauth * 4);
937 }
938
939 if (addition_info & GROUP_SECINFO) {
940 pntsd->gsidoffset = cpu_to_le32(offset);
941 group_sid_ptr = (struct smb_sid *)((char *)pntsd + offset);
942 smb_copy_sid(group_sid_ptr, ngroup_sid_ptr);
943 offset += 1 + 1 + 6 + (ngroup_sid_ptr->num_subauth * 4);
944 }
945
946 if (addition_info & DACL_SECINFO) {
947 pntsd->type |= cpu_to_le16(DACL_PRESENT);
948 dacl_ptr = (struct smb_acl *)((char *)pntsd + offset);
949 dacl_ptr->revision = cpu_to_le16(2);
950 dacl_ptr->size = cpu_to_le16(sizeof(struct smb_acl));
951 dacl_ptr->num_aces = 0;
952
64b39f4a 953 if (!ppntsd) {
af34983e 954 set_mode_dacl(user_ns, dacl_ptr, fattr);
64b39f4a 955 } else if (!ppntsd->dacloffset) {
e2f34481 956 goto out;
64b39f4a 957 } else {
e2f34481
NJ		 958 struct smb_acl *ppdacl_ptr;
959
960 ppdacl_ptr = (struct smb_acl *)((char *)ppntsd +
961 le32_to_cpu(ppntsd->dacloffset));
af34983e
HL		 962 set_ntacl_dacl(user_ns, dacl_ptr, ppdacl_ptr,
963 nowner_sid_ptr, ngroup_sid_ptr, fattr);
e2f34481
NJ		 964 }
965 pntsd->dacloffset = cpu_to_le32(offset);
966 offset += le16_to_cpu(dacl_ptr->size);
967 }
968
969out:
970 kfree(nowner_sid_ptr);
971 kfree(ngroup_sid_ptr);
972 *secdesclen = offset;
973 return rc;
974}
975
976static void smb_set_ace(struct smb_ace *ace, const struct smb_sid *sid, u8 type,
070fb21e 977 u8 flags, __le32 access_req)
e2f34481
NJ		 978{
979 ace->type = type;
980 ace->flags = flags;
981 ace->access_req = access_req;
982 smb_copy_sid(&ace->sid, sid);
983 ace->size = cpu_to_le16(1 + 1 + 2 + 4 + 1 + 1 + 6 + (sid->num_subauth * 4));
984}
985
ef24c962
HL		 986int smb_inherit_dacl(struct ksmbd_conn *conn,
987 struct path *path,
070fb21e 988 unsigned int uid, unsigned int gid)
e2f34481
NJ		 989{
990 const struct smb_sid *psid, *creator = NULL;
991 struct smb_ace *parent_aces, *aces;
992 struct smb_acl *parent_pdacl;
993 struct smb_ntsd *parent_pntsd = NULL;
994 struct smb_sid owner_sid, group_sid;
ef24c962 995 struct dentry *parent = path->dentry->d_parent;
465d7204 996 struct user_namespace *user_ns = mnt_user_ns(path->mnt);
e2f34481 997 int inherited_flags = 0, flags = 0, i, ace_cnt = 0, nt_size = 0;
a9071e3c 998 int rc = 0, num_aces, dacloffset, pntsd_type, acl_len;
e2f34481 999 char *aces_base;
ef24c962 1000 bool is_dir = S_ISDIR(d_inode(path->dentry)->i_mode);
e2f34481 1001
465d7204 1002 acl_len = ksmbd_vfs_get_sd_xattr(conn, user_ns,
af34983e 1003 parent, &parent_pntsd);
e2f34481 1004 if (acl_len <= 0)
a9071e3c 1005 return -ENOENT;
e2f34481 1006 dacloffset = le32_to_cpu(parent_pntsd->dacloffset);
a9071e3c
NJ		 1007 if (!dacloffset) {
1008 rc = -EINVAL;
1009 goto free_parent_pntsd;
1010 }
e2f34481
NJ		 1011
1012 parent_pdacl = (struct smb_acl *)((char *)parent_pntsd + dacloffset);
1013 num_aces = le32_to_cpu(parent_pdacl->num_aces);
1014 pntsd_type = le16_to_cpu(parent_pntsd->type);
1015
1016 aces_base = kmalloc(sizeof(struct smb_ace) * num_aces * 2, GFP_KERNEL);
a9071e3c
NJ		 1017 if (!aces_base) {
1018 rc = -ENOMEM;
1019 goto free_parent_pntsd;
1020 }
e2f34481
NJ		 1021
1022 aces = (struct smb_ace *)aces_base;
1023 parent_aces = (struct smb_ace *)((char *)parent_pdacl +
1024 sizeof(struct smb_acl));
1025
1026 if (pntsd_type & DACL_AUTO_INHERITED)
1027 inherited_flags = INHERITED_ACE;
1028
1029 for (i = 0; i < num_aces; i++) {
1030 flags = parent_aces->flags;
1031 if (!smb_inherit_flags(flags, is_dir))
1032 goto pass;
1033 if (is_dir) {
1034 flags &= ~(INHERIT_ONLY_ACE | INHERITED_ACE);
1035 if (!(flags & CONTAINER_INHERIT_ACE))
1036 flags |= INHERIT_ONLY_ACE;
1037 if (flags & NO_PROPAGATE_INHERIT_ACE)
1038 flags = 0;
64b39f4a 1039 } else {
e2f34481 1040 flags = 0;
64b39f4a 1041 }
e2f34481
NJ		 1042
1043 if (!compare_sids(&creator_owner, &parent_aces->sid)) {
1044 creator = &creator_owner;
1045 id_to_sid(uid, SIDOWNER, &owner_sid);
1046 psid = &owner_sid;
1047 } else if (!compare_sids(&creator_group, &parent_aces->sid)) {
1048 creator = &creator_group;
1049 id_to_sid(gid, SIDUNIX_GROUP, &group_sid);
1050 psid = &group_sid;
1051 } else {
1052 creator = NULL;
1053 psid = &parent_aces->sid;
1054 }
1055
1056 if (is_dir && creator && flags & CONTAINER_INHERIT_ACE) {
1057 smb_set_ace(aces, psid, parent_aces->type, inherited_flags,
070fb21e 1058 parent_aces->access_req);
e2f34481
NJ		 1059 nt_size += le16_to_cpu(aces->size);
1060 ace_cnt++;
1061 aces = (struct smb_ace *)((char *)aces + le16_to_cpu(aces->size));
1062 flags |= INHERIT_ONLY_ACE;
1063 psid = creator;
64b39f4a 1064 } else if (is_dir && !(parent_aces->flags & NO_PROPAGATE_INHERIT_ACE)) {
e2f34481 1065 psid = &parent_aces->sid;
64b39f4a 1066 }
e2f34481
NJ		 1067
1068 smb_set_ace(aces, psid, parent_aces->type, flags | inherited_flags,
070fb21e 1069 parent_aces->access_req);
e2f34481
NJ		 1070 nt_size += le16_to_cpu(aces->size);
1071 aces = (struct smb_ace *)((char *)aces + le16_to_cpu(aces->size));
1072 ace_cnt++;
1073pass:
1074 parent_aces =
1075 (struct smb_ace *)((char *)parent_aces + le16_to_cpu(parent_aces->size));
1076 }
1077
1078 if (nt_size > 0) {
1079 struct smb_ntsd *pntsd;
1080 struct smb_acl *pdacl;
1081 struct smb_sid *powner_sid = NULL, *pgroup_sid = NULL;
1082 int powner_sid_size = 0, pgroup_sid_size = 0, pntsd_size;
1083
1084 if (parent_pntsd->osidoffset) {
1085 powner_sid = (struct smb_sid *)((char *)parent_pntsd +
1086 le32_to_cpu(parent_pntsd->osidoffset));
1087 powner_sid_size = 1 + 1 + 6 + (powner_sid->num_subauth * 4);
1088 }
1089 if (parent_pntsd->gsidoffset) {
1090 pgroup_sid = (struct smb_sid *)((char *)parent_pntsd +
1091 le32_to_cpu(parent_pntsd->gsidoffset));
1092 pgroup_sid_size = 1 + 1 + 6 + (pgroup_sid->num_subauth * 4);
1093 }
1094
1095 pntsd = kzalloc(sizeof(struct smb_ntsd) + powner_sid_size +
1096 pgroup_sid_size + sizeof(struct smb_acl) +
1097 nt_size, GFP_KERNEL);
1098 if (!pntsd) {
1099 rc = -ENOMEM;
a9071e3c 1100 goto free_aces_base;
e2f34481
NJ		 1101 }
1102
1103 pntsd->revision = cpu_to_le16(1);
1104 pntsd->type = cpu_to_le16(SELF_RELATIVE | DACL_PRESENT);
1105 if (le16_to_cpu(parent_pntsd->type) & DACL_AUTO_INHERITED)
1106 pntsd->type |= cpu_to_le16(DACL_AUTO_INHERITED);
1107 pntsd_size = sizeof(struct smb_ntsd);
1108 pntsd->osidoffset = parent_pntsd->osidoffset;
1109 pntsd->gsidoffset = parent_pntsd->gsidoffset;
1110 pntsd->dacloffset = parent_pntsd->dacloffset;
1111
1112 if (pntsd->osidoffset) {
1113 struct smb_sid *owner_sid = (struct smb_sid *)((char *)pntsd +
1114 le32_to_cpu(pntsd->osidoffset));
1115 memcpy(owner_sid, powner_sid, powner_sid_size);
1116 pntsd_size += powner_sid_size;
1117 }
1118
1119 if (pntsd->gsidoffset) {
1120 struct smb_sid *group_sid = (struct smb_sid *)((char *)pntsd +
1121 le32_to_cpu(pntsd->gsidoffset));
1122 memcpy(group_sid, pgroup_sid, pgroup_sid_size);
1123 pntsd_size += pgroup_sid_size;
1124 }
1125
1126 if (pntsd->dacloffset) {
1127 struct smb_ace *pace;
1128
1129 pdacl = (struct smb_acl *)((char *)pntsd + le32_to_cpu(pntsd->dacloffset));
1130 pdacl->revision = cpu_to_le16(2);
1131 pdacl->size = cpu_to_le16(sizeof(struct smb_acl) + nt_size);
1132 pdacl->num_aces = cpu_to_le32(ace_cnt);
1133 pace = (struct smb_ace *)((char *)pdacl + sizeof(struct smb_acl));
1134 memcpy(pace, aces_base, nt_size);
1135 pntsd_size += sizeof(struct smb_acl) + nt_size;
1136 }
1137
465d7204 1138 ksmbd_vfs_set_sd_xattr(conn, user_ns,
af34983e 1139 path->dentry, pntsd, pntsd_size);
e2f34481 1140 kfree(pntsd);
e2f34481
NJ		 1141 }
1142
a9071e3c 1143free_aces_base:
e2f34481 1144 kfree(aces_base);
a9071e3c
NJ		 1145free_parent_pntsd:
1146 kfree(parent_pntsd);
e2f34481
NJ		 1147 return rc;
1148}
1149
1150bool smb_inherit_flags(int flags, bool is_dir)
1151{
1152 if (!is_dir)
1153 return (flags & OBJECT_INHERIT_ACE) != 0;
1154
1155 if (flags & OBJECT_INHERIT_ACE && !(flags & NO_PROPAGATE_INHERIT_ACE))
1156 return true;
1157
1158 if (flags & CONTAINER_INHERIT_ACE)
1159 return true;
1160 return false;
1161}
1162
ef24c962 1163int smb_check_perm_dacl(struct ksmbd_conn *conn, struct path *path,
070fb21e 1164 __le32 *pdaccess, int uid)
e2f34481 1165{
465d7204 1166 struct user_namespace *user_ns = mnt_user_ns(path->mnt);
e2f34481
NJ		 1167 struct smb_ntsd *pntsd = NULL;
1168 struct smb_acl *pdacl;
1169 struct posix_acl *posix_acls;
1170 int rc = 0, acl_size;
1171 struct smb_sid sid;
1172 int granted = le32_to_cpu(*pdaccess & ~FILE_MAXIMAL_ACCESS_LE);
1173 struct smb_ace *ace;
1174 int i, found = 0;
1175 unsigned int access_bits = 0;
1176 struct smb_ace *others_ace = NULL;
1177 struct posix_acl_entry *pa_entry;
1178 unsigned int sid_type = SIDOWNER;
50355b0b 1179 char *end_of_acl;
e2f34481
NJ		 1180
1181 ksmbd_debug(SMB, "check permission using windows acl\n");
465d7204 1182 acl_size = ksmbd_vfs_get_sd_xattr(conn, user_ns,
af34983e 1183 path->dentry, &pntsd);
50355b0b
NJ		 1184 if (acl_size <= 0 || !pntsd || !pntsd->dacloffset) {
1185 kfree(pntsd);
e2f34481 1186 return 0;
50355b0b 1187 }
e2f34481
NJ		 1188
1189 pdacl = (struct smb_acl *)((char *)pntsd + le32_to_cpu(pntsd->dacloffset));
50355b0b
NJ		 1190 end_of_acl = ((char *)pntsd) + acl_size;
1191 if (end_of_acl <= (char *)pdacl) {
1192 kfree(pntsd);
1193 return 0;
1194 }
1195
1196 if (end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size) ||
1197 le16_to_cpu(pdacl->size) < sizeof(struct smb_acl)) {
1198 kfree(pntsd);
1199 return 0;
1200 }
1201
e2f34481
NJ		 1202 if (!pdacl->num_aces) {
1203 if (!(le16_to_cpu(pdacl->size) - sizeof(struct smb_acl)) &&
1204 *pdaccess & ~(FILE_READ_CONTROL_LE | FILE_WRITE_DAC_LE)) {
1205 rc = -EACCES;
1206 goto err_out;
1207 }
1208 kfree(pntsd);
1209 return 0;
1210 }
1211
1212 if (*pdaccess & FILE_MAXIMAL_ACCESS_LE) {
1213 granted = READ_CONTROL | WRITE_DAC | FILE_READ_ATTRIBUTES |
1214 DELETE;
1215
1216 ace = (struct smb_ace *)((char *)pdacl + sizeof(struct smb_acl));
1217 for (i = 0; i < le32_to_cpu(pdacl->num_aces); i++) {
1218 granted |= le32_to_cpu(ace->access_req);
64b39f4a 1219 ace = (struct smb_ace *)((char *)ace + le16_to_cpu(ace->size));
50355b0b
NJ		 1220 if (end_of_acl < (char *)ace)
1221 goto err_out;
e2f34481
NJ		 1222 }
1223
1224 if (!pdacl->num_aces)
1225 granted = GENERIC_ALL_FLAGS;
1226 }
1227
1228 if (!uid)
1229 sid_type = SIDUNIX_USER;
1230 id_to_sid(uid, sid_type, &sid);
1231
1232 ace = (struct smb_ace *)((char *)pdacl + sizeof(struct smb_acl));
1233 for (i = 0; i < le32_to_cpu(pdacl->num_aces); i++) {
1234 if (!compare_sids(&sid, &ace->sid) ||
1235 !compare_sids(&sid_unix_NFS_mode, &ace->sid)) {
1236 found = 1;
1237 break;
1238 }
1239 if (!compare_sids(&sid_everyone, &ace->sid))
1240 others_ace = ace;
1241
64b39f4a 1242 ace = (struct smb_ace *)((char *)ace + le16_to_cpu(ace->size));
50355b0b
NJ		 1243 if (end_of_acl < (char *)ace)
1244 goto err_out;
e2f34481
NJ		 1245 }
1246
1247 if (*pdaccess & FILE_MAXIMAL_ACCESS_LE && found) {
1248 granted = READ_CONTROL | WRITE_DAC | FILE_READ_ATTRIBUTES |
1249 DELETE;
1250
1251 granted |= le32_to_cpu(ace->access_req);
1252
1253 if (!pdacl->num_aces)
1254 granted = GENERIC_ALL_FLAGS;
1255 }
1256
777cad16
NJ		 1257 if (IS_ENABLED(CONFIG_FS_POSIX_ACL)) {
1258 posix_acls = get_acl(d_inode(path->dentry), ACL_TYPE_ACCESS);
1259 if (posix_acls && !found) {
1260 unsigned int id = -1;
1261
1262 pa_entry = posix_acls->a_entries;
1263 for (i = 0; i < posix_acls->a_count; i++, pa_entry++) {
1264 if (pa_entry->e_tag == ACL_USER)
0e844efe 1265 id = posix_acl_uid_translate(user_ns, pa_entry);
777cad16 1266 else if (pa_entry->e_tag == ACL_GROUP)
0e844efe 1267 id = posix_acl_gid_translate(user_ns, pa_entry);
777cad16
NJ		 1268 else
1269 continue;
1270
1271 if (id == uid) {
1272 mode_to_access_flags(pa_entry->e_perm,
1273 0777,
1274 &access_bits);
1275 if (!access_bits)
1276 access_bits =
1277 SET_MINIMUM_RIGHTS;
1278 goto check_access_bits;
1279 }
e2f34481
NJ		 1280 }
1281 }
777cad16
NJ		 1282 if (posix_acls)
1283 posix_acl_release(posix_acls);
e2f34481 1284 }
e2f34481
NJ		 1285
1286 if (!found) {
64b39f4a 1287 if (others_ace) {
e2f34481 1288 ace = others_ace;
64b39f4a 1289 } else {
e2f34481
NJ		 1290 ksmbd_debug(SMB, "Can't find corresponding sid\n");
1291 rc = -EACCES;
1292 goto err_out;
1293 }
1294 }
1295
1296 switch (ace->type) {
1297 case ACCESS_ALLOWED_ACE_TYPE:
1298 access_bits = le32_to_cpu(ace->access_req);
1299 break;
1300 case ACCESS_DENIED_ACE_TYPE:
1301 case ACCESS_DENIED_CALLBACK_ACE_TYPE:
1302 access_bits = le32_to_cpu(~ace->access_req);
1303 break;
1304 }
1305
1306check_access_bits:
070fb21e
NJ		 1307 if (granted &
1308 ~(access_bits | FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC | DELETE)) {
e2f34481 1309 ksmbd_debug(SMB, "Access denied with winACL, granted : %x, access_req : %x\n",
070fb21e 1310 granted, le32_to_cpu(ace->access_req));
e2f34481
NJ		 1311 rc = -EACCES;
1312 goto err_out;
1313 }
1314
1315 *pdaccess = cpu_to_le32(granted);
1316err_out:
1317 kfree(pntsd);
1318 return rc;
1319}
1320
1321int set_info_sec(struct ksmbd_conn *conn, struct ksmbd_tree_connect *tcon,
ef24c962 1322 struct path *path, struct smb_ntsd *pntsd, int ntsd_len,
070fb21e 1323 bool type_check)
e2f34481
NJ		 1324{
1325 int rc;
1326 struct smb_fattr fattr = {{0}};
ef24c962 1327 struct inode *inode = d_inode(path->dentry);
465d7204 1328 struct user_namespace *user_ns = mnt_user_ns(path->mnt);
e70e392f 1329 struct iattr newattrs;
e2f34481
NJ		 1330
1331 fattr.cf_uid = INVALID_UID;
1332 fattr.cf_gid = INVALID_GID;
1333 fattr.cf_mode = inode->i_mode;
1334
465d7204 1335 rc = parse_sec_desc(user_ns, pntsd, ntsd_len, &fattr);
e2f34481
NJ		 1336 if (rc)
1337 goto out;
1338
e70e392f
NJ		 1339 newattrs.ia_valid = ATTR_CTIME;
1340 if (!uid_eq(fattr.cf_uid, INVALID_UID)) {
1341 newattrs.ia_valid |= ATTR_UID;
1342 newattrs.ia_uid = fattr.cf_uid;
1343 }
1344 if (!gid_eq(fattr.cf_gid, INVALID_GID)) {
1345 newattrs.ia_valid |= ATTR_GID;
1346 newattrs.ia_gid = fattr.cf_gid;
1347 }
1348 newattrs.ia_valid |= ATTR_MODE;
1349 newattrs.ia_mode = (inode->i_mode & ~0777) | (fattr.cf_mode & 0777);
1350
465d7204 1351 ksmbd_vfs_remove_acl_xattrs(user_ns, path->dentry);
e2f34481 1352 /* Update posix acls */
777cad16 1353 if (IS_ENABLED(CONFIG_FS_POSIX_ACL) && fattr.cf_dacls) {
465d7204 1354 rc = set_posix_acl(user_ns, inode,
af34983e 1355 ACL_TYPE_ACCESS, fattr.cf_acls);
28a5d3de
CB		 1356 if (rc < 0)
1357 ksmbd_debug(SMB,
1358 "Set posix acl(ACL_TYPE_ACCESS) failed, rc : %d\n",
1359 rc);
1360 if (S_ISDIR(inode->i_mode) && fattr.cf_dacls) {
465d7204 1361 rc = set_posix_acl(user_ns, inode,
67d1c432 1362 ACL_TYPE_DEFAULT, fattr.cf_dacls);
28a5d3de
CB		 1363 if (rc)
1364 ksmbd_debug(SMB,
1365 "Set posix acl(ACL_TYPE_DEFAULT) failed, rc : %d\n",
1366 rc);
1367 }
e2f34481
NJ		 1368 }
1369
28a5d3de
CB		 1370 inode_lock(inode);
1371 rc = notify_change(user_ns, path->dentry, &newattrs, NULL);
1372 inode_unlock(inode);
1373 if (rc)
1374 goto out;
1375
e2f34481
NJ		 1376 /* Check it only calling from SD BUFFER context */
1377 if (type_check && !(le16_to_cpu(pntsd->type) & DACL_PRESENT))
1378 goto out;
1379
64b39f4a 1380 if (test_share_config_flag(tcon->share_conf, KSMBD_SHARE_FLAG_ACL_XATTR)) {
e2f34481 1381 /* Update WinACL in xattr */
465d7204
HL		 1382 ksmbd_vfs_remove_sd_xattrs(user_ns, path->dentry);
1383 ksmbd_vfs_set_sd_xattr(conn, user_ns,
af34983e 1384 path->dentry, pntsd, ntsd_len);
e2f34481
NJ		 1385 }
1386
1387out:
1388 posix_acl_release(fattr.cf_acls);
1389 posix_acl_release(fattr.cf_dacls);
1390 mark_inode_dirty(inode);
1391 return rc;
1392}
1393
1394void ksmbd_init_domain(u32 *sub_auth)
1395{
1396 int i;
1397
1398 memcpy(&server_conf.domain_sid, &domain, sizeof(struct smb_sid));
1399 for (i = 0; i < 3; ++i)
1400 server_conf.domain_sid.sub_auth[i + 1] = cpu_to_le32(sub_auth[i]);
1401}
Linux 6.x block layer and io_uring tree(s)