1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3 *
4 * Copyright (C) International Business Machines Corp., 2007,2008
5 * Author(s): Steve French (sfrench@us.ibm.com)
6 *
7 * Contains the routines for mapping CIFS/NTFS ACLs
8 *
9 */
10
11 #include <linux/fs.h>
12 #include <linux/slab.h>
13 #include <linux/string.h>
14 #include <linux/keyctl.h>
15 #include <linux/key-type.h>
16 #include <uapi/linux/posix_acl.h>
17 #include <linux/posix_acl.h>
18 #include <linux/posix_acl_xattr.h>
19 #include <keys/user-type.h>
20 #include "cifspdu.h"
21 #include "cifsglob.h"
22 #include "cifsacl.h"
23 #include "cifsproto.h"
24 #include "cifs_debug.h"
25 #include "fs_context.h"
26 #include "cifs_fs_sb.h"
27 #include "cifs_unicode.h"
28
29 /* security id for everyone/world system group */
30 static const struct smb_sid sid_everyone = {
31 1, 1, {0, 0, 0, 0, 0, 1}, {0} };
32 /* security id for Authenticated Users system group */
33 static const struct smb_sid sid_authusers = {
34 1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(11)} };
35
36 /* S-1-22-1 Unmapped Unix users */
37 static const struct smb_sid sid_unix_users = {1, 1, {0, 0, 0, 0, 0, 22},
38 {cpu_to_le32(1), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
39
40 /* S-1-22-2 Unmapped Unix groups */
41 static const struct smb_sid sid_unix_groups = { 1, 1, {0, 0, 0, 0, 0, 22},
42 {cpu_to_le32(2), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
43
44 /*
45 * See https://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx
46 */
47
48 /* S-1-5-88 MS NFS and Apple style UID/GID/mode */
49
50 /* S-1-5-88-1 Unix uid */
51 static const struct smb_sid sid_unix_NFS_users = { 1, 2, {0, 0, 0, 0, 0, 5},
52 {cpu_to_le32(88),
53 cpu_to_le32(1), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
54
55 /* S-1-5-88-2 Unix gid */
56 static const struct smb_sid sid_unix_NFS_groups = { 1, 2, {0, 0, 0, 0, 0, 5},
57 {cpu_to_le32(88),
58 cpu_to_le32(2), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
59
60 /* S-1-5-88-3 Unix mode */
61 static const struct smb_sid sid_unix_NFS_mode = { 1, 2, {0, 0, 0, 0, 0, 5},
62 {cpu_to_le32(88),
63 cpu_to_le32(3), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
64
65 static const struct cred *root_cred;
66
67 static int
cifs_idmap_key_instantiate(struct key * key,struct key_preparsed_payload * prep)68 cifs_idmap_key_instantiate(struct key *key, struct key_preparsed_payload *prep)
69 {
70 char *payload;
71
72 /*
73 * If the payload is less than or equal to the size of a pointer, then
74 * an allocation here is wasteful. Just copy the data directly to the
75 * payload.value union member instead.
76 *
77 * With this however, you must check the datalen before trying to
78 * dereference payload.data!
79 */
80 if (prep->datalen <= sizeof(key->payload)) {
81 key->payload.data[0] = NULL;
82 memcpy(&key->payload, prep->data, prep->datalen);
83 } else {
84 payload = kmemdup(prep->data, prep->datalen, GFP_KERNEL);
85 if (!payload)
86 return -ENOMEM;
87 key->payload.data[0] = payload;
88 }
89
90 key->datalen = prep->datalen;
91 return 0;
92 }
93
94 static inline void
cifs_idmap_key_destroy(struct key * key)95 cifs_idmap_key_destroy(struct key *key)
96 {
97 if (key->datalen > sizeof(key->payload))
98 kfree(key->payload.data[0]);
99 }
100
101 static struct key_type cifs_idmap_key_type = {
102 .name = "cifs.idmap",
103 .instantiate = cifs_idmap_key_instantiate,
104 .destroy = cifs_idmap_key_destroy,
105 .describe = user_describe,
106 };
107
108 static char *
sid_to_key_str(struct smb_sid * sidptr,unsigned int type)109 sid_to_key_str(struct smb_sid *sidptr, unsigned int type)
110 {
111 int i, len;
112 unsigned int saval;
113 char *sidstr, *strptr;
114 unsigned long long id_auth_val;
115
116 /* 3 bytes for prefix */
117 sidstr = kmalloc(3 + SID_STRING_BASE_SIZE +
118 (SID_STRING_SUBAUTH_SIZE * sidptr->num_subauth),
119 GFP_KERNEL);
120 if (!sidstr)
121 return sidstr;
122
123 strptr = sidstr;
124 len = sprintf(strptr, "%cs:S-%hhu", type == SIDOWNER ? 'o' : 'g',
125 sidptr->revision);
126 strptr += len;
127
128 /* The authority field is a single 48-bit number */
129 id_auth_val = (unsigned long long)sidptr->authority[5];
130 id_auth_val |= (unsigned long long)sidptr->authority[4] << 8;
131 id_auth_val |= (unsigned long long)sidptr->authority[3] << 16;
132 id_auth_val |= (unsigned long long)sidptr->authority[2] << 24;
133 id_auth_val |= (unsigned long long)sidptr->authority[1] << 32;
134 id_auth_val |= (unsigned long long)sidptr->authority[0] << 48;
135
136 /*
137 * MS-DTYP states that if the authority is >= 2^32, then it should be
138 * expressed as a hex value.
139 */
140 if (id_auth_val <= UINT_MAX)
141 len = sprintf(strptr, "-%llu", id_auth_val);
142 else
143 len = sprintf(strptr, "-0x%llx", id_auth_val);
144
145 strptr += len;
146
147 for (i = 0; i < sidptr->num_subauth; ++i) {
148 saval = le32_to_cpu(sidptr->sub_auth[i]);
149 len = sprintf(strptr, "-%u", saval);
150 strptr += len;
151 }
152
153 return sidstr;
154 }
155
156 /*
157 * if the two SIDs (roughly equivalent to a UUID for a user or group) are
158 * the same returns zero, if they do not match returns non-zero.
159 */
160 static int
compare_sids(const struct smb_sid * ctsid,const struct smb_sid * cwsid)161 compare_sids(const struct smb_sid *ctsid, const struct smb_sid *cwsid)
162 {
163 int i;
164 int num_subauth, num_sat, num_saw;
165
166 if ((!ctsid) || (!cwsid))
167 return 1;
168
169 /* compare the revision */
170 if (ctsid->revision != cwsid->revision) {
171 if (ctsid->revision > cwsid->revision)
172 return 1;
173 else
174 return -1;
175 }
176
177 /* compare all of the six auth values */
178 for (i = 0; i < NUM_AUTHS; ++i) {
179 if (ctsid->authority[i] != cwsid->authority[i]) {
180 if (ctsid->authority[i] > cwsid->authority[i])
181 return 1;
182 else
183 return -1;
184 }
185 }
186
187 /* compare all of the subauth values if any */
188 num_sat = ctsid->num_subauth;
189 num_saw = cwsid->num_subauth;
190 num_subauth = num_sat < num_saw ? num_sat : num_saw;
191 if (num_subauth) {
192 for (i = 0; i < num_subauth; ++i) {
193 if (ctsid->sub_auth[i] != cwsid->sub_auth[i]) {
194 if (le32_to_cpu(ctsid->sub_auth[i]) >
195 le32_to_cpu(cwsid->sub_auth[i]))
196 return 1;
197 else
198 return -1;
199 }
200 }
201 }
202
203 return 0; /* sids compare/match */
204 }
205
206 static bool
is_well_known_sid(const struct smb_sid * psid,uint32_t * puid,bool is_group)207 is_well_known_sid(const struct smb_sid *psid, uint32_t *puid, bool is_group)
208 {
209 int i;
210 int num_subauth;
211 const struct smb_sid *pwell_known_sid;
212
213 if (!psid || (puid == NULL))
214 return false;
215
216 num_subauth = psid->num_subauth;
217
218 /* check if Mac (or Windows NFS) vs. Samba format for Unix owner SID */
219 if (num_subauth == 2) {
220 if (is_group)
221 pwell_known_sid = &sid_unix_groups;
222 else
223 pwell_known_sid = &sid_unix_users;
224 } else if (num_subauth == 3) {
225 if (is_group)
226 pwell_known_sid = &sid_unix_NFS_groups;
227 else
228 pwell_known_sid = &sid_unix_NFS_users;
229 } else
230 return false;
231
232 /* compare the revision */
233 if (psid->revision != pwell_known_sid->revision)
234 return false;
235
236 /* compare all of the six auth values */
237 for (i = 0; i < NUM_AUTHS; ++i) {
238 if (psid->authority[i] != pwell_known_sid->authority[i]) {
239 cifs_dbg(FYI, "auth %d did not match\n", i);
240 return false;
241 }
242 }
243
244 if (num_subauth == 2) {
245 if (psid->sub_auth[0] != pwell_known_sid->sub_auth[0])
246 return false;
247
248 *puid = le32_to_cpu(psid->sub_auth[1]);
249 } else /* 3 subauths, ie Windows/Mac style */ {
250 *puid = le32_to_cpu(psid->sub_auth[0]);
251 if ((psid->sub_auth[0] != pwell_known_sid->sub_auth[0]) ||
252 (psid->sub_auth[1] != pwell_known_sid->sub_auth[1]))
253 return false;
254
255 *puid = le32_to_cpu(psid->sub_auth[2]);
256 }
257
258 cifs_dbg(FYI, "Unix UID %d returned from SID\n", *puid);
259 return true; /* well known sid found, uid returned */
260 }
261
262 static __u16
cifs_copy_sid(struct smb_sid * dst,const struct smb_sid * src)263 cifs_copy_sid(struct smb_sid *dst, const struct smb_sid *src)
264 {
265 int i;
266 __u16 size = 1 + 1 + 6;
267
268 dst->revision = src->revision;
269 dst->num_subauth = min_t(u8, src->num_subauth, SID_MAX_SUB_AUTHORITIES);
270 for (i = 0; i < NUM_AUTHS; ++i)
271 dst->authority[i] = src->authority[i];
272 for (i = 0; i < dst->num_subauth; ++i)
273 dst->sub_auth[i] = src->sub_auth[i];
274 size += (dst->num_subauth * 4);
275
276 return size;
277 }
278
279 static int
id_to_sid(unsigned int cid,uint sidtype,struct smb_sid * ssid)280 id_to_sid(unsigned int cid, uint sidtype, struct smb_sid *ssid)
281 {
282 int rc;
283 struct key *sidkey;
284 struct smb_sid *ksid;
285 unsigned int ksid_size;
286 char desc[3 + 10 + 1]; /* 3 byte prefix + 10 bytes for value + NULL */
287 const struct cred *saved_cred;
288
289 rc = snprintf(desc, sizeof(desc), "%ci:%u",
290 sidtype == SIDOWNER ? 'o' : 'g', cid);
291 if (rc >= sizeof(desc))
292 return -EINVAL;
293
294 rc = 0;
295 saved_cred = override_creds(root_cred);
296 sidkey = request_key(&cifs_idmap_key_type, desc, "");
297 if (IS_ERR(sidkey)) {
298 rc = -EINVAL;
299 cifs_dbg(FYI, "%s: Can't map %cid %u to a SID\n",
300 __func__, sidtype == SIDOWNER ? 'u' : 'g', cid);
301 goto out_revert_creds;
302 } else if (sidkey->datalen < CIFS_SID_BASE_SIZE) {
303 rc = -EIO;
304 cifs_dbg(FYI, "%s: Downcall contained malformed key (datalen=%hu)\n",
305 __func__, sidkey->datalen);
306 goto invalidate_key;
307 }
308
309 /*
310 * A sid is usually too large to be embedded in payload.value, but if
311 * there are no subauthorities and the host has 8-byte pointers, then
312 * it could be.
313 */
314 ksid = sidkey->datalen <= sizeof(sidkey->payload) ?
315 (struct smb_sid *)&sidkey->payload :
316 (struct smb_sid *)sidkey->payload.data[0];
317
318 ksid_size = CIFS_SID_BASE_SIZE + (ksid->num_subauth * sizeof(__le32));
319 if (ksid_size > sidkey->datalen) {
320 rc = -EIO;
321 cifs_dbg(FYI, "%s: Downcall contained malformed key (datalen=%hu, ksid_size=%u)\n",
322 __func__, sidkey->datalen, ksid_size);
323 goto invalidate_key;
324 }
325
326 cifs_copy_sid(ssid, ksid);
327 out_key_put:
328 key_put(sidkey);
329 out_revert_creds:
330 revert_creds(saved_cred);
331 return rc;
332
333 invalidate_key:
334 key_invalidate(sidkey);
335 goto out_key_put;
336 }
337
338 int
sid_to_id(struct cifs_sb_info * cifs_sb,struct smb_sid * psid,struct cifs_fattr * fattr,uint sidtype)339 sid_to_id(struct cifs_sb_info *cifs_sb, struct smb_sid *psid,
340 struct cifs_fattr *fattr, uint sidtype)
341 {
342 int rc = 0;
343 struct key *sidkey;
344 char *sidstr;
345 const struct cred *saved_cred;
346 kuid_t fuid = cifs_sb->ctx->linux_uid;
347 kgid_t fgid = cifs_sb->ctx->linux_gid;
348
349 /*
350 * If we have too many subauthorities, then something is really wrong.
351 * Just return an error.
352 */
353 if (unlikely(psid->num_subauth > SID_MAX_SUB_AUTHORITIES)) {
354 cifs_dbg(FYI, "%s: %u subauthorities is too many!\n",
355 __func__, psid->num_subauth);
356 return -EIO;
357 }
358
359 if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UID_FROM_ACL) ||
360 (cifs_sb_master_tcon(cifs_sb)->posix_extensions)) {
361 uint32_t unix_id;
362 bool is_group;
363
364 if (sidtype != SIDOWNER)
365 is_group = true;
366 else
367 is_group = false;
368
369 if (is_well_known_sid(psid, &unix_id, is_group) == false)
370 goto try_upcall_to_get_id;
371
372 if (is_group) {
373 kgid_t gid;
374 gid_t id;
375
376 id = (gid_t)unix_id;
377 gid = make_kgid(&init_user_ns, id);
378 if (gid_valid(gid)) {
379 fgid = gid;
380 goto got_valid_id;
381 }
382 } else {
383 kuid_t uid;
384 uid_t id;
385
386 id = (uid_t)unix_id;
387 uid = make_kuid(&init_user_ns, id);
388 if (uid_valid(uid)) {
389 fuid = uid;
390 goto got_valid_id;
391 }
392 }
393 /* If unable to find uid/gid easily from SID try via upcall */
394 }
395
396 try_upcall_to_get_id:
397 sidstr = sid_to_key_str(psid, sidtype);
398 if (!sidstr)
399 return -ENOMEM;
400
401 saved_cred = override_creds(root_cred);
402 sidkey = request_key(&cifs_idmap_key_type, sidstr, "");
403 if (IS_ERR(sidkey)) {
404 cifs_dbg(FYI, "%s: Can't map SID %s to a %cid\n",
405 __func__, sidstr, sidtype == SIDOWNER ? 'u' : 'g');
406 goto out_revert_creds;
407 }
408
409 /*
410 * FIXME: Here we assume that uid_t and gid_t are same size. It's
411 * probably a safe assumption but might be better to check based on
412 * sidtype.
413 */
414 BUILD_BUG_ON(sizeof(uid_t) != sizeof(gid_t));
415 if (sidkey->datalen != sizeof(uid_t)) {
416 cifs_dbg(FYI, "%s: Downcall contained malformed key (datalen=%hu)\n",
417 __func__, sidkey->datalen);
418 key_invalidate(sidkey);
419 goto out_key_put;
420 }
421
422 if (sidtype == SIDOWNER) {
423 kuid_t uid;
424 uid_t id;
425 memcpy(&id, &sidkey->payload.data[0], sizeof(uid_t));
426 uid = make_kuid(&init_user_ns, id);
427 if (uid_valid(uid))
428 fuid = uid;
429 } else {
430 kgid_t gid;
431 gid_t id;
432 memcpy(&id, &sidkey->payload.data[0], sizeof(gid_t));
433 gid = make_kgid(&init_user_ns, id);
434 if (gid_valid(gid))
435 fgid = gid;
436 }
437
438 out_key_put:
439 key_put(sidkey);
440 out_revert_creds:
441 revert_creds(saved_cred);
442 kfree(sidstr);
443
444 /*
445 * Note that we return 0 here unconditionally. If the mapping
446 * fails then we just fall back to using the ctx->linux_uid/linux_gid.
447 */
448 got_valid_id:
449 rc = 0;
450 if (sidtype == SIDOWNER)
451 fattr->cf_uid = fuid;
452 else
453 fattr->cf_gid = fgid;
454 return rc;
455 }
456
457 int
init_cifs_idmap(void)458 init_cifs_idmap(void)
459 {
460 struct cred *cred;
461 struct key *keyring;
462 int ret;
463
464 cifs_dbg(FYI, "Registering the %s key type\n",
465 cifs_idmap_key_type.name);
466
467 /* create an override credential set with a special thread keyring in
468 * which requests are cached
469 *
470 * this is used to prevent malicious redirections from being installed
471 * with add_key().
472 */
473 cred = prepare_kernel_cred(&init_task);
474 if (!cred)
475 return -ENOMEM;
476
477 keyring = keyring_alloc(".cifs_idmap",
478 GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred,
479 (KEY_POS_ALL & ~KEY_POS_SETATTR) |
480 KEY_USR_VIEW | KEY_USR_READ,
481 KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
482 if (IS_ERR(keyring)) {
483 ret = PTR_ERR(keyring);
484 goto failed_put_cred;
485 }
486
487 ret = register_key_type(&cifs_idmap_key_type);
488 if (ret < 0)
489 goto failed_put_key;
490
491 /* instruct request_key() to use this special keyring as a cache for
492 * the results it looks up */
493 set_bit(KEY_FLAG_ROOT_CAN_CLEAR, &keyring->flags);
494 cred->thread_keyring = keyring;
495 cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
496 root_cred = cred;
497
498 cifs_dbg(FYI, "cifs idmap keyring: %d\n", key_serial(keyring));
499 return 0;
500
501 failed_put_key:
502 key_put(keyring);
503 failed_put_cred:
504 put_cred(cred);
505 return ret;
506 }
507
508 void
exit_cifs_idmap(void)509 exit_cifs_idmap(void)
510 {
511 key_revoke(root_cred->thread_keyring);
512 unregister_key_type(&cifs_idmap_key_type);
513 put_cred(root_cred);
514 cifs_dbg(FYI, "Unregistered %s key type\n", cifs_idmap_key_type.name);
515 }
516
517 /* copy ntsd, owner sid, and group sid from a security descriptor to another */
copy_sec_desc(const struct smb_ntsd * pntsd,struct smb_ntsd * pnntsd,__u32 sidsoffset,struct smb_sid * pownersid,struct smb_sid * pgrpsid)518 static __u32 copy_sec_desc(const struct smb_ntsd *pntsd,
519 struct smb_ntsd *pnntsd,
520 __u32 sidsoffset,
521 struct smb_sid *pownersid,
522 struct smb_sid *pgrpsid)
523 {
524 struct smb_sid *owner_sid_ptr, *group_sid_ptr;
525 struct smb_sid *nowner_sid_ptr, *ngroup_sid_ptr;
526
527 /* copy security descriptor control portion */
528 pnntsd->revision = pntsd->revision;
529 pnntsd->type = pntsd->type;
530 pnntsd->dacloffset = cpu_to_le32(sizeof(struct smb_ntsd));
531 pnntsd->sacloffset = 0;
532 pnntsd->osidoffset = cpu_to_le32(sidsoffset);
533 pnntsd->gsidoffset = cpu_to_le32(sidsoffset + sizeof(struct smb_sid));
534
535 /* copy owner sid */
536 if (pownersid)
537 owner_sid_ptr = pownersid;
538 else
539 owner_sid_ptr = (struct smb_sid *)((char *)pntsd +
540 le32_to_cpu(pntsd->osidoffset));
541 nowner_sid_ptr = (struct smb_sid *)((char *)pnntsd + sidsoffset);
542 cifs_copy_sid(nowner_sid_ptr, owner_sid_ptr);
543
544 /* copy group sid */
545 if (pgrpsid)
546 group_sid_ptr = pgrpsid;
547 else
548 group_sid_ptr = (struct smb_sid *)((char *)pntsd +
549 le32_to_cpu(pntsd->gsidoffset));
550 ngroup_sid_ptr = (struct smb_sid *)((char *)pnntsd + sidsoffset +
551 sizeof(struct smb_sid));
552 cifs_copy_sid(ngroup_sid_ptr, group_sid_ptr);
553
554 return sidsoffset + (2 * sizeof(struct smb_sid));
555 }
556
557
558 /*
559 change posix mode to reflect permissions
560 pmode is the existing mode (we only want to overwrite part of this
561 bits to set can be: S_IRWXU, S_IRWXG or S_IRWXO ie 00700 or 00070 or 00007
562 */
access_flags_to_mode(__le32 ace_flags,int type,umode_t * pmode,umode_t * pdenied,umode_t mask)563 static void access_flags_to_mode(__le32 ace_flags, int type, umode_t *pmode,
564 umode_t *pdenied, umode_t mask)
565 {
566 __u32 flags = le32_to_cpu(ace_flags);
567 /*
568 * Do not assume "preferred" or "canonical" order.
569 * The first DENY or ALLOW ACE which matches perfectly is
570 * the permission to be used. Once allowed or denied, same
571 * permission in later ACEs do not matter.
572 */
573
574 /* If not already allowed, deny these bits */
575 if (type == ACCESS_DENIED) {
576 if (flags & GENERIC_ALL &&
577 !(*pmode & mask & 0777))
578 *pdenied |= mask & 0777;
579
580 if (((flags & GENERIC_WRITE) ||
581 ((flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS)) &&
582 !(*pmode & mask & 0222))
583 *pdenied |= mask & 0222;
584
585 if (((flags & GENERIC_READ) ||
586 ((flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS)) &&
587 !(*pmode & mask & 0444))
588 *pdenied |= mask & 0444;
589
590 if (((flags & GENERIC_EXECUTE) ||
591 ((flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS)) &&
592 !(*pmode & mask & 0111))
593 *pdenied |= mask & 0111;
594
595 return;
596 } else if (type != ACCESS_ALLOWED) {
597 cifs_dbg(VFS, "unknown access control type %d\n", type);
598 return;
599 }
600 /* else ACCESS_ALLOWED type */
601
602 if ((flags & GENERIC_ALL) &&
603 !(*pdenied & mask & 0777)) {
604 *pmode |= mask & 0777;
605 cifs_dbg(NOISY, "all perms\n");
606 return;
607 }
608
609 if (((flags & GENERIC_WRITE) ||
610 ((flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS)) &&
611 !(*pdenied & mask & 0222))
612 *pmode |= mask & 0222;
613
614 if (((flags & GENERIC_READ) ||
615 ((flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS)) &&
616 !(*pdenied & mask & 0444))
617 *pmode |= mask & 0444;
618
619 if (((flags & GENERIC_EXECUTE) ||
620 ((flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS)) &&
621 !(*pdenied & mask & 0111))
622 *pmode |= mask & 0111;
623
624 /* If DELETE_CHILD is set only on an owner ACE, set sticky bit */
625 if (flags & FILE_DELETE_CHILD) {
626 if (mask == ACL_OWNER_MASK) {
627 if (!(*pdenied & 01000))
628 *pmode |= 01000;
629 } else if (!(*pdenied & 01000)) {
630 *pmode &= ~01000;
631 *pdenied |= 01000;
632 }
633 }
634
635 cifs_dbg(NOISY, "access flags 0x%x mode now %04o\n", flags, *pmode);
636 return;
637 }
638
639 /*
640 Generate access flags to reflect permissions mode is the existing mode.
641 This function is called for every ACE in the DACL whose SID matches
642 with either owner or group or everyone.
643 */
644
mode_to_access_flags(umode_t mode,umode_t bits_to_use,__u32 * pace_flags)645 static void mode_to_access_flags(umode_t mode, umode_t bits_to_use,
646 __u32 *pace_flags)
647 {
648 /* reset access mask */
649 *pace_flags = 0x0;
650
651 /* bits to use are either S_IRWXU or S_IRWXG or S_IRWXO */
652 mode &= bits_to_use;
653
654 /* check for R/W/X UGO since we do not know whose flags
655 is this but we have cleared all the bits sans RWX for
656 either user or group or other as per bits_to_use */
657 if (mode & S_IRUGO)
658 *pace_flags |= SET_FILE_READ_RIGHTS;
659 if (mode & S_IWUGO)
660 *pace_flags |= SET_FILE_WRITE_RIGHTS;
661 if (mode & S_IXUGO)
662 *pace_flags |= SET_FILE_EXEC_RIGHTS;
663
664 cifs_dbg(NOISY, "mode: %04o, access flags now 0x%x\n",
665 mode, *pace_flags);
666 return;
667 }
668
cifs_copy_ace(struct smb_ace * dst,struct smb_ace * src,struct smb_sid * psid)669 static __u16 cifs_copy_ace(struct smb_ace *dst, struct smb_ace *src, struct smb_sid *psid)
670 {
671 __u16 size = 1 + 1 + 2 + 4;
672
673 dst->type = src->type;
674 dst->flags = src->flags;
675 dst->access_req = src->access_req;
676
677 /* Check if there's a replacement sid specified */
678 if (psid)
679 size += cifs_copy_sid(&dst->sid, psid);
680 else
681 size += cifs_copy_sid(&dst->sid, &src->sid);
682
683 dst->size = cpu_to_le16(size);
684
685 return size;
686 }
687
fill_ace_for_sid(struct smb_ace * pntace,const struct smb_sid * psid,__u64 nmode,umode_t bits,__u8 access_type,bool allow_delete_child)688 static __u16 fill_ace_for_sid(struct smb_ace *pntace,
689 const struct smb_sid *psid, __u64 nmode,
690 umode_t bits, __u8 access_type,
691 bool allow_delete_child)
692 {
693 int i;
694 __u16 size = 0;
695 __u32 access_req = 0;
696
697 pntace->type = access_type;
698 pntace->flags = 0x0;
699 mode_to_access_flags(nmode, bits, &access_req);
700
701 if (access_type == ACCESS_ALLOWED && allow_delete_child)
702 access_req |= FILE_DELETE_CHILD;
703
704 if (access_type == ACCESS_ALLOWED && !access_req)
705 access_req = SET_MINIMUM_RIGHTS;
706 else if (access_type == ACCESS_DENIED)
707 access_req &= ~SET_MINIMUM_RIGHTS;
708
709 pntace->access_req = cpu_to_le32(access_req);
710
711 pntace->sid.revision = psid->revision;
712 pntace->sid.num_subauth = psid->num_subauth;
713 for (i = 0; i < NUM_AUTHS; i++)
714 pntace->sid.authority[i] = psid->authority[i];
715 for (i = 0; i < psid->num_subauth; i++)
716 pntace->sid.sub_auth[i] = psid->sub_auth[i];
717
718 size = 1 + 1 + 2 + 4 + 1 + 1 + 6 + (psid->num_subauth * 4);
719 pntace->size = cpu_to_le16(size);
720
721 return size;
722 }
723
724
725 #ifdef CONFIG_CIFS_DEBUG2
dump_ace(struct smb_ace * pace,char * end_of_acl)726 static void dump_ace(struct smb_ace *pace, char *end_of_acl)
727 {
728 int num_subauth;
729
730 /* validate that we do not go past end of acl */
731
732 if (le16_to_cpu(pace->size) < 16) {
733 cifs_dbg(VFS, "ACE too small %d\n", le16_to_cpu(pace->size));
734 return;
735 }
736
737 if (end_of_acl < (char *)pace + le16_to_cpu(pace->size)) {
738 cifs_dbg(VFS, "ACL too small to parse ACE\n");
739 return;
740 }
741
742 num_subauth = pace->sid.num_subauth;
743 if (num_subauth) {
744 int i;
745 cifs_dbg(FYI, "ACE revision %d num_auth %d type %d flags %d size %d\n",
746 pace->sid.revision, pace->sid.num_subauth, pace->type,
747 pace->flags, le16_to_cpu(pace->size));
748 for (i = 0; i < num_subauth; ++i) {
749 cifs_dbg(FYI, "ACE sub_auth[%d]: 0x%x\n",
750 i, le32_to_cpu(pace->sid.sub_auth[i]));
751 }
752
753 /* BB add length check to make sure that we do not have huge
754 num auths and therefore go off the end */
755 }
756
757 return;
758 }
759 #endif
760
parse_dacl(struct smb_acl * pdacl,char * end_of_acl,struct smb_sid * pownersid,struct smb_sid * pgrpsid,struct cifs_fattr * fattr,bool mode_from_special_sid)761 static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl,
762 struct smb_sid *pownersid, struct smb_sid *pgrpsid,
763 struct cifs_fattr *fattr, bool mode_from_special_sid)
764 {
765 int i;
766 int num_aces = 0;
767 int acl_size;
768 char *acl_base;
769 struct smb_ace **ppace;
770
771 /* BB need to add parm so we can store the SID BB */
772
773 if (!pdacl) {
774 /* no DACL in the security descriptor, set
775 all the permissions for user/group/other */
776 fattr->cf_mode |= 0777;
777 return;
778 }
779
780 /* validate that we do not go past end of acl */
781 if (end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size)) {
782 cifs_dbg(VFS, "ACL too small to parse DACL\n");
783 return;
784 }
785
786 cifs_dbg(NOISY, "DACL revision %d size %d num aces %d\n",
787 le16_to_cpu(pdacl->revision), le16_to_cpu(pdacl->size),
788 le32_to_cpu(pdacl->num_aces));
789
790 /* reset rwx permissions for user/group/other.
791 Also, if num_aces is 0 i.e. DACL has no ACEs,
792 user/group/other have no permissions */
793 fattr->cf_mode &= ~(0777);
794
795 acl_base = (char *)pdacl;
796 acl_size = sizeof(struct smb_acl);
797
798 num_aces = le32_to_cpu(pdacl->num_aces);
799 if (num_aces > 0) {
800 umode_t denied_mode = 0;
801
802 if (num_aces > ULONG_MAX / sizeof(struct smb_ace *))
803 return;
804 ppace = kmalloc_array(num_aces, sizeof(struct smb_ace *),
805 GFP_KERNEL);
806 if (!ppace)
807 return;
808
809 for (i = 0; i < num_aces; ++i) {
810 ppace[i] = (struct smb_ace *) (acl_base + acl_size);
811 #ifdef CONFIG_CIFS_DEBUG2
812 dump_ace(ppace[i], end_of_acl);
813 #endif
814 if (mode_from_special_sid &&
815 (compare_sids(&(ppace[i]->sid),
816 &sid_unix_NFS_mode) == 0)) {
817 /*
818 * Full permissions are:
819 * 07777 = S_ISUID | S_ISGID | S_ISVTX |
820 * S_IRWXU | S_IRWXG | S_IRWXO
821 */
822 fattr->cf_mode &= ~07777;
823 fattr->cf_mode |=
824 le32_to_cpu(ppace[i]->sid.sub_auth[2]);
825 break;
826 } else {
827 if (compare_sids(&(ppace[i]->sid), pownersid) == 0) {
828 access_flags_to_mode(ppace[i]->access_req,
829 ppace[i]->type,
830 &fattr->cf_mode,
831 &denied_mode,
832 ACL_OWNER_MASK);
833 } else if (compare_sids(&(ppace[i]->sid), pgrpsid) == 0) {
834 access_flags_to_mode(ppace[i]->access_req,
835 ppace[i]->type,
836 &fattr->cf_mode,
837 &denied_mode,
838 ACL_GROUP_MASK);
839 } else if ((compare_sids(&(ppace[i]->sid), &sid_everyone) == 0) ||
840 (compare_sids(&(ppace[i]->sid), &sid_authusers) == 0)) {
841 access_flags_to_mode(ppace[i]->access_req,
842 ppace[i]->type,
843 &fattr->cf_mode,
844 &denied_mode,
845 ACL_EVERYONE_MASK);
846 }
847 }
848
849
850 /* memcpy((void *)(&(cifscred->aces[i])),
851 (void *)ppace[i],
852 sizeof(struct smb_ace)); */
853
854 acl_base = (char *)ppace[i];
855 acl_size = le16_to_cpu(ppace[i]->size);
856 }
857
858 kfree(ppace);
859 }
860
861 return;
862 }
863
setup_authusers_ACE(struct smb_ace * pntace)864 unsigned int setup_authusers_ACE(struct smb_ace *pntace)
865 {
866 int i;
867 unsigned int ace_size = 20;
868
869 pntace->type = ACCESS_ALLOWED_ACE_TYPE;
870 pntace->flags = 0x0;
871 pntace->access_req = cpu_to_le32(GENERIC_ALL);
872 pntace->sid.num_subauth = 1;
873 pntace->sid.revision = 1;
874 for (i = 0; i < NUM_AUTHS; i++)
875 pntace->sid.authority[i] = sid_authusers.authority[i];
876
877 pntace->sid.sub_auth[0] = sid_authusers.sub_auth[0];
878
879 /* size = 1 + 1 + 2 + 4 + 1 + 1 + 6 + (psid->num_subauth*4) */
880 pntace->size = cpu_to_le16(ace_size);
881 return ace_size;
882 }
883
884 /*
885 * Fill in the special SID based on the mode. See
886 * https://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx
887 */
setup_special_mode_ACE(struct smb_ace * pntace,bool posix,__u64 nmode)888 unsigned int setup_special_mode_ACE(struct smb_ace *pntace,
889 bool posix,
890 __u64 nmode)
891 {
892 int i;
893 unsigned int ace_size = 28;
894
895 if (posix)
896 pntace->type = ACCESS_ALLOWED_ACE_TYPE;
897 else
898 pntace->type = ACCESS_DENIED_ACE_TYPE;
899 pntace->flags = 0x0;
900 pntace->access_req = 0;
901 pntace->sid.num_subauth = 3;
902 pntace->sid.revision = 1;
903 for (i = 0; i < NUM_AUTHS; i++)
904 pntace->sid.authority[i] = sid_unix_NFS_mode.authority[i];
905
906 pntace->sid.sub_auth[0] = sid_unix_NFS_mode.sub_auth[0];
907 pntace->sid.sub_auth[1] = sid_unix_NFS_mode.sub_auth[1];
908 pntace->sid.sub_auth[2] = cpu_to_le32(nmode & 07777);
909
910 /* size = 1 + 1 + 2 + 4 + 1 + 1 + 6 + (psid->num_subauth*4) */
911 pntace->size = cpu_to_le16(ace_size);
912 return ace_size;
913 }
914
setup_special_user_owner_ACE(struct smb_ace * pntace)915 unsigned int setup_special_user_owner_ACE(struct smb_ace *pntace)
916 {
917 int i;
918 unsigned int ace_size = 28;
919
920 pntace->type = ACCESS_ALLOWED_ACE_TYPE;
921 pntace->flags = 0x0;
922 pntace->access_req = cpu_to_le32(GENERIC_ALL);
923 pntace->sid.num_subauth = 3;
924 pntace->sid.revision = 1;
925 for (i = 0; i < NUM_AUTHS; i++)
926 pntace->sid.authority[i] = sid_unix_NFS_users.authority[i];
927
928 pntace->sid.sub_auth[0] = sid_unix_NFS_users.sub_auth[0];
929 pntace->sid.sub_auth[1] = sid_unix_NFS_users.sub_auth[1];
930 pntace->sid.sub_auth[2] = cpu_to_le32(current_fsgid().val);
931
932 /* size = 1 + 1 + 2 + 4 + 1 + 1 + 6 + (psid->num_subauth*4) */
933 pntace->size = cpu_to_le16(ace_size);
934 return ace_size;
935 }
936
populate_new_aces(char * nacl_base,struct smb_sid * pownersid,struct smb_sid * pgrpsid,__u64 * pnmode,u32 * pnum_aces,u16 * pnsize,bool modefromsid,bool posix)937 static void populate_new_aces(char *nacl_base,
938 struct smb_sid *pownersid,
939 struct smb_sid *pgrpsid,
940 __u64 *pnmode, u32 *pnum_aces, u16 *pnsize,
941 bool modefromsid,
942 bool posix)
943 {
944 __u64 nmode;
945 u32 num_aces = 0;
946 u16 nsize = 0;
947 __u64 user_mode;
948 __u64 group_mode;
949 __u64 other_mode;
950 __u64 deny_user_mode = 0;
951 __u64 deny_group_mode = 0;
952 bool sticky_set = false;
953 struct smb_ace *pnntace = NULL;
954
955 nmode = *pnmode;
956 num_aces = *pnum_aces;
957 nsize = *pnsize;
958
959 if (modefromsid || posix) {
960 pnntace = (struct smb_ace *) (nacl_base + nsize);
961 nsize += setup_special_mode_ACE(pnntace, posix, nmode);
962 num_aces++;
963 if (modefromsid) {
964 pnntace = (struct smb_ace *) (nacl_base + nsize);
965 nsize += setup_authusers_ACE(pnntace);
966 num_aces++;
967 }
968 goto set_size;
969 }
970
971 /*
972 * We'll try to keep the mode as requested by the user.
973 * But in cases where we cannot meaningfully convert that
974 * into ACL, return back the updated mode, so that it is
975 * updated in the inode.
976 */
977
978 if (!memcmp(pownersid, pgrpsid, sizeof(struct smb_sid))) {
979 /*
980 * Case when owner and group SIDs are the same.
981 * Set the more restrictive of the two modes.
982 */
983 user_mode = nmode & (nmode << 3) & 0700;
984 group_mode = nmode & (nmode >> 3) & 0070;
985 } else {
986 user_mode = nmode & 0700;
987 group_mode = nmode & 0070;
988 }
989
990 other_mode = nmode & 0007;
991
992 /* We need DENY ACE when the perm is more restrictive than the next sets. */
993 deny_user_mode = ~(user_mode) & ((group_mode << 3) | (other_mode << 6)) & 0700;
994 deny_group_mode = ~(group_mode) & (other_mode << 3) & 0070;
995
996 *pnmode = user_mode | group_mode | other_mode | (nmode & ~0777);
997
998 /* This tells if we should allow delete child for group and everyone. */
999 if (nmode & 01000)
1000 sticky_set = true;
1001
1002 if (deny_user_mode) {
1003 pnntace = (struct smb_ace *) (nacl_base + nsize);
1004 nsize += fill_ace_for_sid(pnntace, pownersid, deny_user_mode,
1005 0700, ACCESS_DENIED, false);
1006 num_aces++;
1007 }
1008
1009 /* Group DENY ACE does not conflict with owner ALLOW ACE. Keep in preferred order*/
1010 if (deny_group_mode && !(deny_group_mode & (user_mode >> 3))) {
1011 pnntace = (struct smb_ace *) (nacl_base + nsize);
1012 nsize += fill_ace_for_sid(pnntace, pgrpsid, deny_group_mode,
1013 0070, ACCESS_DENIED, false);
1014 num_aces++;
1015 }
1016
1017 pnntace = (struct smb_ace *) (nacl_base + nsize);
1018 nsize += fill_ace_for_sid(pnntace, pownersid, user_mode,
1019 0700, ACCESS_ALLOWED, true);
1020 num_aces++;
1021
1022 /* Group DENY ACE conflicts with owner ALLOW ACE. So keep it after. */
1023 if (deny_group_mode && (deny_group_mode & (user_mode >> 3))) {
1024 pnntace = (struct smb_ace *) (nacl_base + nsize);
1025 nsize += fill_ace_for_sid(pnntace, pgrpsid, deny_group_mode,
1026 0070, ACCESS_DENIED, false);
1027 num_aces++;
1028 }
1029
1030 pnntace = (struct smb_ace *) (nacl_base + nsize);
1031 nsize += fill_ace_for_sid(pnntace, pgrpsid, group_mode,
1032 0070, ACCESS_ALLOWED, !sticky_set);
1033 num_aces++;
1034
1035 pnntace = (struct smb_ace *) (nacl_base + nsize);
1036 nsize += fill_ace_for_sid(pnntace, &sid_everyone, other_mode,
1037 0007, ACCESS_ALLOWED, !sticky_set);
1038 num_aces++;
1039
1040 set_size:
1041 *pnum_aces = num_aces;
1042 *pnsize = nsize;
1043 }
1044
replace_sids_and_copy_aces(struct smb_acl * pdacl,struct smb_acl * pndacl,struct smb_sid * pownersid,struct smb_sid * pgrpsid,struct smb_sid * pnownersid,struct smb_sid * pngrpsid)1045 static __u16 replace_sids_and_copy_aces(struct smb_acl *pdacl, struct smb_acl *pndacl,
1046 struct smb_sid *pownersid, struct smb_sid *pgrpsid,
1047 struct smb_sid *pnownersid, struct smb_sid *pngrpsid)
1048 {
1049 int i;
1050 u16 size = 0;
1051 struct smb_ace *pntace = NULL;
1052 char *acl_base = NULL;
1053 u32 src_num_aces = 0;
1054 u16 nsize = 0;
1055 struct smb_ace *pnntace = NULL;
1056 char *nacl_base = NULL;
1057 u16 ace_size = 0;
1058
1059 acl_base = (char *)pdacl;
1060 size = sizeof(struct smb_acl);
1061 src_num_aces = le32_to_cpu(pdacl->num_aces);
1062
1063 nacl_base = (char *)pndacl;
1064 nsize = sizeof(struct smb_acl);
1065
1066 /* Go through all the ACEs */
1067 for (i = 0; i < src_num_aces; ++i) {
1068 pntace = (struct smb_ace *) (acl_base + size);
1069 pnntace = (struct smb_ace *) (nacl_base + nsize);
1070
1071 if (pnownersid && compare_sids(&pntace->sid, pownersid) == 0)
1072 ace_size = cifs_copy_ace(pnntace, pntace, pnownersid);
1073 else if (pngrpsid && compare_sids(&pntace->sid, pgrpsid) == 0)
1074 ace_size = cifs_copy_ace(pnntace, pntace, pngrpsid);
1075 else
1076 ace_size = cifs_copy_ace(pnntace, pntace, NULL);
1077
1078 size += le16_to_cpu(pntace->size);
1079 nsize += ace_size;
1080 }
1081
1082 return nsize;
1083 }
1084
set_chmod_dacl(struct smb_acl * pdacl,struct smb_acl * pndacl,struct smb_sid * pownersid,struct smb_sid * pgrpsid,__u64 * pnmode,bool mode_from_sid,bool posix)1085 static int set_chmod_dacl(struct smb_acl *pdacl, struct smb_acl *pndacl,
1086 struct smb_sid *pownersid, struct smb_sid *pgrpsid,
1087 __u64 *pnmode, bool mode_from_sid, bool posix)
1088 {
1089 int i;
1090 u16 size = 0;
1091 struct smb_ace *pntace = NULL;
1092 char *acl_base = NULL;
1093 u32 src_num_aces = 0;
1094 u16 nsize = 0;
1095 struct smb_ace *pnntace = NULL;
1096 char *nacl_base = NULL;
1097 u32 num_aces = 0;
1098 bool new_aces_set = false;
1099
1100 /* Assuming that pndacl and pnmode are never NULL */
1101 nacl_base = (char *)pndacl;
1102 nsize = sizeof(struct smb_acl);
1103
1104 /* If pdacl is NULL, we don't have a src. Simply populate new ACL. */
1105 if (!pdacl || posix) {
1106 populate_new_aces(nacl_base,
1107 pownersid, pgrpsid,
1108 pnmode, &num_aces, &nsize,
1109 mode_from_sid, posix);
1110 goto finalize_dacl;
1111 }
1112
1113 acl_base = (char *)pdacl;
1114 size = sizeof(struct smb_acl);
1115 src_num_aces = le32_to_cpu(pdacl->num_aces);
1116
1117 /* Retain old ACEs which we can retain */
1118 for (i = 0; i < src_num_aces; ++i) {
1119 pntace = (struct smb_ace *) (acl_base + size);
1120
1121 if (!new_aces_set && (pntace->flags & INHERITED_ACE)) {
1122 /* Place the new ACEs in between existing explicit and inherited */
1123 populate_new_aces(nacl_base,
1124 pownersid, pgrpsid,
1125 pnmode, &num_aces, &nsize,
1126 mode_from_sid, posix);
1127
1128 new_aces_set = true;
1129 }
1130
1131 /* If it's any one of the ACE we're replacing, skip! */
1132 if (((compare_sids(&pntace->sid, &sid_unix_NFS_mode) == 0) ||
1133 (compare_sids(&pntace->sid, pownersid) == 0) ||
1134 (compare_sids(&pntace->sid, pgrpsid) == 0) ||
1135 (compare_sids(&pntace->sid, &sid_everyone) == 0) ||
1136 (compare_sids(&pntace->sid, &sid_authusers) == 0))) {
1137 goto next_ace;
1138 }
1139
1140 /* update the pointer to the next ACE to populate*/
1141 pnntace = (struct smb_ace *) (nacl_base + nsize);
1142
1143 nsize += cifs_copy_ace(pnntace, pntace, NULL);
1144 num_aces++;
1145
1146 next_ace:
1147 size += le16_to_cpu(pntace->size);
1148 }
1149
1150 /* If inherited ACEs are not present, place the new ones at the tail */
1151 if (!new_aces_set) {
1152 populate_new_aces(nacl_base,
1153 pownersid, pgrpsid,
1154 pnmode, &num_aces, &nsize,
1155 mode_from_sid, posix);
1156
1157 new_aces_set = true;
1158 }
1159
1160 finalize_dacl:
1161 pndacl->num_aces = cpu_to_le32(num_aces);
1162 pndacl->size = cpu_to_le16(nsize);
1163
1164 return 0;
1165 }
1166
parse_sid(struct smb_sid * psid,char * end_of_acl)1167 static int parse_sid(struct smb_sid *psid, char *end_of_acl)
1168 {
1169 /* BB need to add parm so we can store the SID BB */
1170
1171 /* validate that we do not go past end of ACL - sid must be at least 8
1172 bytes long (assuming no sub-auths - e.g. the null SID */
1173 if (end_of_acl < (char *)psid + 8) {
1174 cifs_dbg(VFS, "ACL too small to parse SID %p\n", psid);
1175 return -EINVAL;
1176 }
1177
1178 #ifdef CONFIG_CIFS_DEBUG2
1179 if (psid->num_subauth) {
1180 int i;
1181 cifs_dbg(FYI, "SID revision %d num_auth %d\n",
1182 psid->revision, psid->num_subauth);
1183
1184 for (i = 0; i < psid->num_subauth; i++) {
1185 cifs_dbg(FYI, "SID sub_auth[%d]: 0x%x\n",
1186 i, le32_to_cpu(psid->sub_auth[i]));
1187 }
1188
1189 /* BB add length check to make sure that we do not have huge
1190 num auths and therefore go off the end */
1191 cifs_dbg(FYI, "RID 0x%x\n",
1192 le32_to_cpu(psid->sub_auth[psid->num_subauth-1]));
1193 }
1194 #endif
1195
1196 return 0;
1197 }
1198
1199
1200 /* Convert CIFS ACL to POSIX form */
parse_sec_desc(struct cifs_sb_info * cifs_sb,struct smb_ntsd * pntsd,int acl_len,struct cifs_fattr * fattr,bool get_mode_from_special_sid)1201 static int parse_sec_desc(struct cifs_sb_info *cifs_sb,
1202 struct smb_ntsd *pntsd, int acl_len, struct cifs_fattr *fattr,
1203 bool get_mode_from_special_sid)
1204 {
1205 int rc = 0;
1206 struct smb_sid *owner_sid_ptr, *group_sid_ptr;
1207 struct smb_acl *dacl_ptr; /* no need for SACL ptr */
1208 char *end_of_acl = ((char *)pntsd) + acl_len;
1209 __u32 dacloffset;
1210
1211 if (pntsd == NULL)
1212 return -EIO;
1213
1214 owner_sid_ptr = (struct smb_sid *)((char *)pntsd +
1215 le32_to_cpu(pntsd->osidoffset));
1216 group_sid_ptr = (struct smb_sid *)((char *)pntsd +
1217 le32_to_cpu(pntsd->gsidoffset));
1218 dacloffset = le32_to_cpu(pntsd->dacloffset);
1219 dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset);
1220 cifs_dbg(NOISY, "revision %d type 0x%x ooffset 0x%x goffset 0x%x sacloffset 0x%x dacloffset 0x%x\n",
1221 pntsd->revision, pntsd->type, le32_to_cpu(pntsd->osidoffset),
1222 le32_to_cpu(pntsd->gsidoffset),
1223 le32_to_cpu(pntsd->sacloffset), dacloffset);
1224 /* cifs_dump_mem("owner_sid: ", owner_sid_ptr, 64); */
1225 rc = parse_sid(owner_sid_ptr, end_of_acl);
1226 if (rc) {
1227 cifs_dbg(FYI, "%s: Error %d parsing Owner SID\n", __func__, rc);
1228 return rc;
1229 }
1230 rc = sid_to_id(cifs_sb, owner_sid_ptr, fattr, SIDOWNER);
1231 if (rc) {
1232 cifs_dbg(FYI, "%s: Error %d mapping Owner SID to uid\n",
1233 __func__, rc);
1234 return rc;
1235 }
1236
1237 rc = parse_sid(group_sid_ptr, end_of_acl);
1238 if (rc) {
1239 cifs_dbg(FYI, "%s: Error %d mapping Owner SID to gid\n",
1240 __func__, rc);
1241 return rc;
1242 }
1243 rc = sid_to_id(cifs_sb, group_sid_ptr, fattr, SIDGROUP);
1244 if (rc) {
1245 cifs_dbg(FYI, "%s: Error %d mapping Group SID to gid\n",
1246 __func__, rc);
1247 return rc;
1248 }
1249
1250 if (dacloffset)
1251 parse_dacl(dacl_ptr, end_of_acl, owner_sid_ptr,
1252 group_sid_ptr, fattr, get_mode_from_special_sid);
1253 else
1254 cifs_dbg(FYI, "no ACL\n"); /* BB grant all or default perms? */
1255
1256 return rc;
1257 }
1258
1259 /* Convert permission bits from mode to equivalent CIFS ACL */
build_sec_desc(struct smb_ntsd * pntsd,struct smb_ntsd * pnntsd,__u32 secdesclen,__u32 * pnsecdesclen,__u64 * pnmode,kuid_t uid,kgid_t gid,bool mode_from_sid,bool id_from_sid,bool posix,int * aclflag)1260 static int build_sec_desc(struct smb_ntsd *pntsd, struct smb_ntsd *pnntsd,
1261 __u32 secdesclen, __u32 *pnsecdesclen, __u64 *pnmode, kuid_t uid, kgid_t gid,
1262 bool mode_from_sid, bool id_from_sid, bool posix, int *aclflag)
1263 {
1264 int rc = 0;
1265 __u32 dacloffset;
1266 __u32 ndacloffset;
1267 __u32 sidsoffset;
1268 struct smb_sid *owner_sid_ptr, *group_sid_ptr;
1269 struct smb_sid *nowner_sid_ptr = NULL, *ngroup_sid_ptr = NULL;
1270 struct smb_acl *dacl_ptr = NULL; /* no need for SACL ptr */
1271 struct smb_acl *ndacl_ptr = NULL; /* no need for SACL ptr */
1272 char *end_of_acl = ((char *)pntsd) + secdesclen;
1273 u16 size = 0;
1274
1275 dacloffset = le32_to_cpu(pntsd->dacloffset);
1276 if (dacloffset) {
1277 dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset);
1278 if (end_of_acl < (char *)dacl_ptr + le16_to_cpu(dacl_ptr->size)) {
1279 cifs_dbg(VFS, "Server returned illegal ACL size\n");
1280 return -EINVAL;
1281 }
1282 }
1283
1284 owner_sid_ptr = (struct smb_sid *)((char *)pntsd +
1285 le32_to_cpu(pntsd->osidoffset));
1286 group_sid_ptr = (struct smb_sid *)((char *)pntsd +
1287 le32_to_cpu(pntsd->gsidoffset));
1288
1289 if (pnmode && *pnmode != NO_CHANGE_64) { /* chmod */
1290 ndacloffset = sizeof(struct smb_ntsd);
1291 ndacl_ptr = (struct smb_acl *)((char *)pnntsd + ndacloffset);
1292 ndacl_ptr->revision =
1293 dacloffset ? dacl_ptr->revision : cpu_to_le16(ACL_REVISION);
1294
1295 ndacl_ptr->size = cpu_to_le16(0);
1296 ndacl_ptr->num_aces = cpu_to_le32(0);
1297
1298 rc = set_chmod_dacl(dacl_ptr, ndacl_ptr, owner_sid_ptr, group_sid_ptr,
1299 pnmode, mode_from_sid, posix);
1300
1301 sidsoffset = ndacloffset + le16_to_cpu(ndacl_ptr->size);
1302 /* copy the non-dacl portion of secdesc */
1303 *pnsecdesclen = copy_sec_desc(pntsd, pnntsd, sidsoffset,
1304 NULL, NULL);
1305
1306 *aclflag |= CIFS_ACL_DACL;
1307 } else {
1308 ndacloffset = sizeof(struct smb_ntsd);
1309 ndacl_ptr = (struct smb_acl *)((char *)pnntsd + ndacloffset);
1310 ndacl_ptr->revision =
1311 dacloffset ? dacl_ptr->revision : cpu_to_le16(ACL_REVISION);
1312 ndacl_ptr->num_aces = dacl_ptr ? dacl_ptr->num_aces : 0;
1313
1314 if (uid_valid(uid)) { /* chown */
1315 uid_t id;
1316 nowner_sid_ptr = kzalloc(sizeof(struct smb_sid),
1317 GFP_KERNEL);
1318 if (!nowner_sid_ptr) {
1319 rc = -ENOMEM;
1320 goto chown_chgrp_exit;
1321 }
1322 id = from_kuid(&init_user_ns, uid);
1323 if (id_from_sid) {
1324 struct owner_sid *osid = (struct owner_sid *)nowner_sid_ptr;
1325 /* Populate the user ownership fields S-1-5-88-1 */
1326 osid->Revision = 1;
1327 osid->NumAuth = 3;
1328 osid->Authority[5] = 5;
1329 osid->SubAuthorities[0] = cpu_to_le32(88);
1330 osid->SubAuthorities[1] = cpu_to_le32(1);
1331 osid->SubAuthorities[2] = cpu_to_le32(id);
1332
1333 } else { /* lookup sid with upcall */
1334 rc = id_to_sid(id, SIDOWNER, nowner_sid_ptr);
1335 if (rc) {
1336 cifs_dbg(FYI, "%s: Mapping error %d for owner id %d\n",
1337 __func__, rc, id);
1338 goto chown_chgrp_exit;
1339 }
1340 }
1341 *aclflag |= CIFS_ACL_OWNER;
1342 }
1343 if (gid_valid(gid)) { /* chgrp */
1344 gid_t id;
1345 ngroup_sid_ptr = kzalloc(sizeof(struct smb_sid),
1346 GFP_KERNEL);
1347 if (!ngroup_sid_ptr) {
1348 rc = -ENOMEM;
1349 goto chown_chgrp_exit;
1350 }
1351 id = from_kgid(&init_user_ns, gid);
1352 if (id_from_sid) {
1353 struct owner_sid *gsid = (struct owner_sid *)ngroup_sid_ptr;
1354 /* Populate the group ownership fields S-1-5-88-2 */
1355 gsid->Revision = 1;
1356 gsid->NumAuth = 3;
1357 gsid->Authority[5] = 5;
1358 gsid->SubAuthorities[0] = cpu_to_le32(88);
1359 gsid->SubAuthorities[1] = cpu_to_le32(2);
1360 gsid->SubAuthorities[2] = cpu_to_le32(id);
1361
1362 } else { /* lookup sid with upcall */
1363 rc = id_to_sid(id, SIDGROUP, ngroup_sid_ptr);
1364 if (rc) {
1365 cifs_dbg(FYI, "%s: Mapping error %d for group id %d\n",
1366 __func__, rc, id);
1367 goto chown_chgrp_exit;
1368 }
1369 }
1370 *aclflag |= CIFS_ACL_GROUP;
1371 }
1372
1373 if (dacloffset) {
1374 /* Replace ACEs for old owner with new one */
1375 size = replace_sids_and_copy_aces(dacl_ptr, ndacl_ptr,
1376 owner_sid_ptr, group_sid_ptr,
1377 nowner_sid_ptr, ngroup_sid_ptr);
1378 ndacl_ptr->size = cpu_to_le16(size);
1379 }
1380
1381 sidsoffset = ndacloffset + le16_to_cpu(ndacl_ptr->size);
1382 /* copy the non-dacl portion of secdesc */
1383 *pnsecdesclen = copy_sec_desc(pntsd, pnntsd, sidsoffset,
1384 nowner_sid_ptr, ngroup_sid_ptr);
1385
1386 chown_chgrp_exit:
1387 /* errors could jump here. So make sure we return soon after this */
1388 kfree(nowner_sid_ptr);
1389 kfree(ngroup_sid_ptr);
1390 }
1391
1392 return rc;
1393 }
1394
1395 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
get_cifs_acl_by_fid(struct cifs_sb_info * cifs_sb,const struct cifs_fid * cifsfid,u32 * pacllen,u32 info)1396 struct smb_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb,
1397 const struct cifs_fid *cifsfid, u32 *pacllen,
1398 u32 info)
1399 {
1400 struct smb_ntsd *pntsd = NULL;
1401 unsigned int xid;
1402 int rc;
1403 struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
1404
1405 if (IS_ERR(tlink))
1406 return ERR_CAST(tlink);
1407
1408 xid = get_xid();
1409 rc = CIFSSMBGetCIFSACL(xid, tlink_tcon(tlink), cifsfid->netfid, &pntsd,
1410 pacllen, info);
1411 free_xid(xid);
1412
1413 cifs_put_tlink(tlink);
1414
1415 cifs_dbg(FYI, "%s: rc = %d ACL len %d\n", __func__, rc, *pacllen);
1416 if (rc)
1417 return ERR_PTR(rc);
1418 return pntsd;
1419 }
1420
get_cifs_acl_by_path(struct cifs_sb_info * cifs_sb,const char * path,u32 * pacllen,u32 info)1421 static struct smb_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb,
1422 const char *path, u32 *pacllen, u32 info)
1423 {
1424 struct smb_ntsd *pntsd = NULL;
1425 int oplock = 0;
1426 unsigned int xid;
1427 int rc;
1428 struct cifs_tcon *tcon;
1429 struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
1430 struct cifs_fid fid;
1431 struct cifs_open_parms oparms;
1432
1433 if (IS_ERR(tlink))
1434 return ERR_CAST(tlink);
1435
1436 tcon = tlink_tcon(tlink);
1437 xid = get_xid();
1438
1439 oparms = (struct cifs_open_parms) {
1440 .tcon = tcon,
1441 .cifs_sb = cifs_sb,
1442 .desired_access = READ_CONTROL,
1443 .create_options = cifs_create_options(cifs_sb, 0),
1444 .disposition = FILE_OPEN,
1445 .path = path,
1446 .fid = &fid,
1447 };
1448
1449 if (info & SACL_SECINFO)
1450 oparms.desired_access |= SYSTEM_SECURITY;
1451
1452 rc = CIFS_open(xid, &oparms, &oplock, NULL);
1453 if (!rc) {
1454 rc = CIFSSMBGetCIFSACL(xid, tcon, fid.netfid, &pntsd, pacllen, info);
1455 CIFSSMBClose(xid, tcon, fid.netfid);
1456 }
1457
1458 cifs_put_tlink(tlink);
1459 free_xid(xid);
1460
1461 cifs_dbg(FYI, "%s: rc = %d ACL len %d\n", __func__, rc, *pacllen);
1462 if (rc)
1463 return ERR_PTR(rc);
1464 return pntsd;
1465 }
1466
1467 /* Retrieve an ACL from the server */
get_cifs_acl(struct cifs_sb_info * cifs_sb,struct inode * inode,const char * path,u32 * pacllen,u32 info)1468 struct smb_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb,
1469 struct inode *inode, const char *path,
1470 u32 *pacllen, u32 info)
1471 {
1472 struct smb_ntsd *pntsd = NULL;
1473 struct cifsFileInfo *open_file = NULL;
1474
1475 if (inode)
1476 open_file = find_readable_file(CIFS_I(inode), true);
1477 if (!open_file)
1478 return get_cifs_acl_by_path(cifs_sb, path, pacllen, info);
1479
1480 pntsd = get_cifs_acl_by_fid(cifs_sb, &open_file->fid, pacllen, info);
1481 cifsFileInfo_put(open_file);
1482 return pntsd;
1483 }
1484
1485 /* Set an ACL on the server */
set_cifs_acl(struct smb_ntsd * pnntsd,__u32 acllen,struct inode * inode,const char * path,int aclflag)1486 int set_cifs_acl(struct smb_ntsd *pnntsd, __u32 acllen,
1487 struct inode *inode, const char *path, int aclflag)
1488 {
1489 int oplock = 0;
1490 unsigned int xid;
1491 int rc, access_flags = 0;
1492 struct cifs_tcon *tcon;
1493 struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
1494 struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
1495 struct cifs_fid fid;
1496 struct cifs_open_parms oparms;
1497
1498 if (IS_ERR(tlink))
1499 return PTR_ERR(tlink);
1500
1501 tcon = tlink_tcon(tlink);
1502 xid = get_xid();
1503
1504 if (aclflag & CIFS_ACL_OWNER || aclflag & CIFS_ACL_GROUP)
1505 access_flags |= WRITE_OWNER;
1506 if (aclflag & CIFS_ACL_SACL)
1507 access_flags |= SYSTEM_SECURITY;
1508 if (aclflag & CIFS_ACL_DACL)
1509 access_flags |= WRITE_DAC;
1510
1511 oparms = (struct cifs_open_parms) {
1512 .tcon = tcon,
1513 .cifs_sb = cifs_sb,
1514 .desired_access = access_flags,
1515 .create_options = cifs_create_options(cifs_sb, 0),
1516 .disposition = FILE_OPEN,
1517 .path = path,
1518 .fid = &fid,
1519 };
1520
1521 rc = CIFS_open(xid, &oparms, &oplock, NULL);
1522 if (rc) {
1523 cifs_dbg(VFS, "Unable to open file to set ACL\n");
1524 goto out;
1525 }
1526
1527 rc = CIFSSMBSetCIFSACL(xid, tcon, fid.netfid, pnntsd, acllen, aclflag);
1528 cifs_dbg(NOISY, "SetCIFSACL rc = %d\n", rc);
1529
1530 CIFSSMBClose(xid, tcon, fid.netfid);
1531 out:
1532 free_xid(xid);
1533 cifs_put_tlink(tlink);
1534 return rc;
1535 }
1536 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
1537
1538 /* Translate the CIFS ACL (similar to NTFS ACL) for a file into mode bits */
1539 int
cifs_acl_to_fattr(struct cifs_sb_info * cifs_sb,struct cifs_fattr * fattr,struct inode * inode,bool mode_from_special_sid,const char * path,const struct cifs_fid * pfid)1540 cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
1541 struct inode *inode, bool mode_from_special_sid,
1542 const char *path, const struct cifs_fid *pfid)
1543 {
1544 struct smb_ntsd *pntsd = NULL;
1545 u32 acllen = 0;
1546 int rc = 0;
1547 struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
1548 struct smb_version_operations *ops;
1549 const u32 info = 0;
1550
1551 cifs_dbg(NOISY, "converting ACL to mode for %s\n", path);
1552
1553 if (IS_ERR(tlink))
1554 return PTR_ERR(tlink);
1555
1556 ops = tlink_tcon(tlink)->ses->server->ops;
1557
1558 if (pfid && (ops->get_acl_by_fid))
1559 pntsd = ops->get_acl_by_fid(cifs_sb, pfid, &acllen, info);
1560 else if (ops->get_acl)
1561 pntsd = ops->get_acl(cifs_sb, inode, path, &acllen, info);
1562 else {
1563 cifs_put_tlink(tlink);
1564 return -EOPNOTSUPP;
1565 }
1566 /* if we can retrieve the ACL, now parse Access Control Entries, ACEs */
1567 if (IS_ERR(pntsd)) {
1568 rc = PTR_ERR(pntsd);
1569 cifs_dbg(VFS, "%s: error %d getting sec desc\n", __func__, rc);
1570 } else if (mode_from_special_sid) {
1571 rc = parse_sec_desc(cifs_sb, pntsd, acllen, fattr, true);
1572 kfree(pntsd);
1573 } else {
1574 /* get approximated mode from ACL */
1575 rc = parse_sec_desc(cifs_sb, pntsd, acllen, fattr, false);
1576 kfree(pntsd);
1577 if (rc)
1578 cifs_dbg(VFS, "parse sec desc failed rc = %d\n", rc);
1579 }
1580
1581 cifs_put_tlink(tlink);
1582
1583 return rc;
1584 }
1585
1586 /* Convert mode bits to an ACL so we can update the ACL on the server */
1587 int
id_mode_to_cifs_acl(struct inode * inode,const char * path,__u64 * pnmode,kuid_t uid,kgid_t gid)1588 id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode,
1589 kuid_t uid, kgid_t gid)
1590 {
1591 int rc = 0;
1592 int aclflag = CIFS_ACL_DACL; /* default flag to set */
1593 __u32 secdesclen = 0;
1594 __u32 nsecdesclen = 0;
1595 __u32 dacloffset = 0;
1596 struct smb_acl *dacl_ptr = NULL;
1597 struct smb_ntsd *pntsd = NULL; /* acl obtained from server */
1598 struct smb_ntsd *pnntsd = NULL; /* modified acl to be sent to server */
1599 struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
1600 struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
1601 struct smb_version_operations *ops;
1602 bool mode_from_sid, id_from_sid;
1603 bool posix = tlink_tcon(tlink)->posix_extensions;
1604 const u32 info = 0;
1605
1606 if (IS_ERR(tlink))
1607 return PTR_ERR(tlink);
1608
1609 ops = tlink_tcon(tlink)->ses->server->ops;
1610
1611 cifs_dbg(NOISY, "set ACL from mode for %s\n", path);
1612
1613 /* Get the security descriptor */
1614
1615 if (ops->get_acl == NULL) {
1616 cifs_put_tlink(tlink);
1617 return -EOPNOTSUPP;
1618 }
1619
1620 pntsd = ops->get_acl(cifs_sb, inode, path, &secdesclen, info);
1621 if (IS_ERR(pntsd)) {
1622 rc = PTR_ERR(pntsd);
1623 cifs_dbg(VFS, "%s: error %d getting sec desc\n", __func__, rc);
1624 cifs_put_tlink(tlink);
1625 return rc;
1626 }
1627
1628 if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MODE_FROM_SID)
1629 mode_from_sid = true;
1630 else
1631 mode_from_sid = false;
1632
1633 if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UID_FROM_ACL)
1634 id_from_sid = true;
1635 else
1636 id_from_sid = false;
1637
1638 /* Potentially, five new ACEs can be added to the ACL for U,G,O mapping */
1639 if (pnmode && *pnmode != NO_CHANGE_64) { /* chmod */
1640 if (posix)
1641 nsecdesclen = 1 * sizeof(struct smb_ace);
1642 else if (mode_from_sid)
1643 nsecdesclen = secdesclen + (2 * sizeof(struct smb_ace));
1644 else /* cifsacl */
1645 nsecdesclen = secdesclen + (5 * sizeof(struct smb_ace));
1646 } else { /* chown */
1647 /* When ownership changes, changes new owner sid length could be different */
1648 nsecdesclen = sizeof(struct smb_ntsd) + (sizeof(struct smb_sid) * 2);
1649 dacloffset = le32_to_cpu(pntsd->dacloffset);
1650 if (dacloffset) {
1651 dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset);
1652 if (mode_from_sid)
1653 nsecdesclen +=
1654 le32_to_cpu(dacl_ptr->num_aces) * sizeof(struct smb_ace);
1655 else /* cifsacl */
1656 nsecdesclen += le16_to_cpu(dacl_ptr->size);
1657 }
1658 }
1659
1660 /*
1661 * Add three ACEs for owner, group, everyone getting rid of other ACEs
1662 * as chmod disables ACEs and set the security descriptor. Allocate
1663 * memory for the smb header, set security descriptor request security
1664 * descriptor parameters, and security descriptor itself
1665 */
1666 nsecdesclen = max_t(u32, nsecdesclen, DEFAULT_SEC_DESC_LEN);
1667 pnntsd = kmalloc(nsecdesclen, GFP_KERNEL);
1668 if (!pnntsd) {
1669 kfree(pntsd);
1670 cifs_put_tlink(tlink);
1671 return -ENOMEM;
1672 }
1673
1674 rc = build_sec_desc(pntsd, pnntsd, secdesclen, &nsecdesclen, pnmode, uid, gid,
1675 mode_from_sid, id_from_sid, posix, &aclflag);
1676
1677 cifs_dbg(NOISY, "build_sec_desc rc: %d\n", rc);
1678
1679 if (ops->set_acl == NULL)
1680 rc = -EOPNOTSUPP;
1681
1682 if (!rc) {
1683 /* Set the security descriptor */
1684 rc = ops->set_acl(pnntsd, nsecdesclen, inode, path, aclflag);
1685 cifs_dbg(NOISY, "set_cifs_acl rc: %d\n", rc);
1686 }
1687 cifs_put_tlink(tlink);
1688
1689 kfree(pnntsd);
1690 kfree(pntsd);
1691 return rc;
1692 }
1693
cifs_get_acl(struct mnt_idmap * idmap,struct dentry * dentry,int type)1694 struct posix_acl *cifs_get_acl(struct mnt_idmap *idmap,
1695 struct dentry *dentry, int type)
1696 {
1697 #if defined(CONFIG_CIFS_ALLOW_INSECURE_LEGACY) && defined(CONFIG_CIFS_POSIX)
1698 struct posix_acl *acl = NULL;
1699 ssize_t rc = -EOPNOTSUPP;
1700 unsigned int xid;
1701 struct super_block *sb = dentry->d_sb;
1702 struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
1703 struct tcon_link *tlink;
1704 struct cifs_tcon *pTcon;
1705 const char *full_path;
1706 void *page;
1707
1708 tlink = cifs_sb_tlink(cifs_sb);
1709 if (IS_ERR(tlink))
1710 return ERR_CAST(tlink);
1711 pTcon = tlink_tcon(tlink);
1712
1713 xid = get_xid();
1714 page = alloc_dentry_path();
1715
1716 full_path = build_path_from_dentry(dentry, page);
1717 if (IS_ERR(full_path)) {
1718 acl = ERR_CAST(full_path);
1719 goto out;
1720 }
1721
1722 /* return alt name if available as pseudo attr */
1723 switch (type) {
1724 case ACL_TYPE_ACCESS:
1725 if (sb->s_flags & SB_POSIXACL)
1726 rc = cifs_do_get_acl(xid, pTcon, full_path, &acl,
1727 ACL_TYPE_ACCESS,
1728 cifs_sb->local_nls,
1729 cifs_remap(cifs_sb));
1730 break;
1731
1732 case ACL_TYPE_DEFAULT:
1733 if (sb->s_flags & SB_POSIXACL)
1734 rc = cifs_do_get_acl(xid, pTcon, full_path, &acl,
1735 ACL_TYPE_DEFAULT,
1736 cifs_sb->local_nls,
1737 cifs_remap(cifs_sb));
1738 break;
1739 }
1740
1741 if (rc < 0) {
1742 if (rc == -EINVAL)
1743 acl = ERR_PTR(-EOPNOTSUPP);
1744 else
1745 acl = ERR_PTR(rc);
1746 }
1747
1748 out:
1749 free_dentry_path(page);
1750 free_xid(xid);
1751 cifs_put_tlink(tlink);
1752 return acl;
1753 #else
1754 return ERR_PTR(-EOPNOTSUPP);
1755 #endif
1756 }
1757
cifs_set_acl(struct mnt_idmap * idmap,struct dentry * dentry,struct posix_acl * acl,int type)1758 int cifs_set_acl(struct mnt_idmap *idmap, struct dentry *dentry,
1759 struct posix_acl *acl, int type)
1760 {
1761 #if defined(CONFIG_CIFS_ALLOW_INSECURE_LEGACY) && defined(CONFIG_CIFS_POSIX)
1762 int rc = -EOPNOTSUPP;
1763 unsigned int xid;
1764 struct super_block *sb = dentry->d_sb;
1765 struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
1766 struct tcon_link *tlink;
1767 struct cifs_tcon *pTcon;
1768 const char *full_path;
1769 void *page;
1770
1771 tlink = cifs_sb_tlink(cifs_sb);
1772 if (IS_ERR(tlink))
1773 return PTR_ERR(tlink);
1774 pTcon = tlink_tcon(tlink);
1775
1776 xid = get_xid();
1777 page = alloc_dentry_path();
1778
1779 full_path = build_path_from_dentry(dentry, page);
1780 if (IS_ERR(full_path)) {
1781 rc = PTR_ERR(full_path);
1782 goto out;
1783 }
1784
1785 if (!acl)
1786 goto out;
1787
1788 /* return dos attributes as pseudo xattr */
1789 /* return alt name if available as pseudo attr */
1790
1791 /* if proc/fs/cifs/streamstoxattr is set then
1792 search server for EAs or streams to
1793 returns as xattrs */
1794 if (posix_acl_xattr_size(acl->a_count) > CIFSMaxBufSize) {
1795 cifs_dbg(FYI, "size of EA value too large\n");
1796 rc = -EOPNOTSUPP;
1797 goto out;
1798 }
1799
1800 switch (type) {
1801 case ACL_TYPE_ACCESS:
1802 if (sb->s_flags & SB_POSIXACL)
1803 rc = cifs_do_set_acl(xid, pTcon, full_path, acl,
1804 ACL_TYPE_ACCESS,
1805 cifs_sb->local_nls,
1806 cifs_remap(cifs_sb));
1807 break;
1808
1809 case ACL_TYPE_DEFAULT:
1810 if (sb->s_flags & SB_POSIXACL)
1811 rc = cifs_do_set_acl(xid, pTcon, full_path, acl,
1812 ACL_TYPE_DEFAULT,
1813 cifs_sb->local_nls,
1814 cifs_remap(cifs_sb));
1815 break;
1816 }
1817
1818 out:
1819 free_dentry_path(page);
1820 free_xid(xid);
1821 cifs_put_tlink(tlink);
1822 return rc;
1823 #else
1824 return -EOPNOTSUPP;
1825 #endif
1826 }
1827