2003-01-12 12:38:51 +01:00
|
|
|
/* sec_acl.cc: Sun compatible ACL functions.
|
2001-04-20 15:02:32 +02:00
|
|
|
|
2013-01-21 05:38:31 +01:00
|
|
|
Copyright 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
|
2015-02-19 15:15:44 +01:00
|
|
|
2011, 2012, 2014, 2015 Red Hat, Inc.
|
2001-04-20 15:02:32 +02:00
|
|
|
|
|
|
|
|
Written by Corinna Vinschen <corinna@vinschen.de>
|
|
|
|
|
|
|
|
|
|
This file is part of Cygwin.
|
|
|
|
|
|
|
|
|
|
This software is a copyrighted work licensed under the terms of the
|
|
|
|
|
Cygwin license. Please consult the file "CYGWIN_LICENSE" for
|
|
|
|
|
details. */
|
|
|
|
|
|
|
|
|
|
#include "winsup.h"
|
|
|
|
|
#include <stdlib.h>
|
|
|
|
|
#include <sys/acl.h>
|
|
|
|
|
#include <ctype.h>
|
|
|
|
|
#include "cygerrno.h"
|
2001-07-26 21:22:24 +02:00
|
|
|
#include "security.h"
|
2001-04-20 15:02:32 +02:00
|
|
|
#include "path.h"
|
* devices.cc: New file.
* devices.gperf: New file.
* devices.shilka: New file.
* cygwin-gperf: New file.
* cygwin-shilka: New file.
* fhandler_fifo.cc: New file.
* fhandler_nodevice.cc : New file. Reorganize headers so that path.h precedes
fhandler.h throughout. Remove device argument and unit arguments from fhandler
constructors throughout. Remove pc arguments to fhandler functions and use
internal pc element instead, throughout. Use dev element in pc throughout.
Use major/minor elements rather than units and device numbers previously in
fhandler class. Use correct methods for fhandler file names rather than
directly accessing file name variables, throughout.
* Makefile.in (DLL_OFILES): Add devices.o, fhandler_fifo.o
* dcrt0.cc (dll_crt0_1): Call device::init.
* devices.h: Renumber devices based on more Linux-like major/minor numbers.
Add more devices. Declare standard device storage.
(device): Declare struct.
* dir.cc (opendir): Use new 'build_fh_name' to construct a fhandler_* type.
* dtable.cc (dtable::get_debugger_info): Ditto.
(cygwin_attach_handle_to_fd): Ditto.
(dtable::release): Remove special FH_SOCKET case in favor of generic
"need_fixup_before" test.
(dtable::init_std_file_from_handle): Use either build_fh_dev or build_fh_name
to build standard fhandler.
(dtable::build_fh_name): Renamed from dtable::build_fhandler_from_name. Move
out of dtable class. Don't accept a path_conv argument. Just build it here
and pass it to:
(build_fh_pc): Renamed from dtable::build_fhandler. Move out of dtable class.
Use intrinsic device type in path_conv to create new fhandler.
(build_fh_dev): Renamed from dtable::build_fhandler. Move out of dtable class.
Simplify arguments to just take new 'device' type and a name. Just return
pointer to fhandler rather than trying to insert into dtable.
(dtable::dup_worker): Accommodate above build_fh name changes.
(dtable::find_fifo): New (currently broken) function.
(handle_to_fn): Use strechr for efficiency.
* dtable.h: Reflect above build_fh name changes and argument differences.
(fhandler_base *&operator []): Return self rather than copy of self.
* fhandler.cc (fhandler_base::operator =): Use pc element to set normalized
path.
(fhandler_base::set_name): Ditto.
(fhandler_base::raw_read): Use method to access name.
(fhandler_base::write): Correctly use get_output_handle rather than get_handle.
(handler_base::device_access_denied): New function.
(fhandler_base::open): Eliminate pc argument and use pc element of
fhandler_base throughout.
(fhandler_base::fstat): Detect if device is based in filesystem and use
fstat_fs to calculate stat, if so.
(fhandler_base::fhandler_base): Eliminate handling of file names and, instead,
just free appropriate component from pc.
(fhandler_base::opendir): Remove path_conv parameter.
* fhandler.h: Remove all device flags.
(fhandler_base::pc): New element.
(fhandler_base::set_name): Change argument to path_conv.
(fhandler_base::error): New function.
(fhandler_base::exists): New function.
(fhandler_base::pc_binmode): New function.
(fhandler_base::dev): New function.
(fhandler_base::open_fs): New function.
(fhandler_base::fstat_fs): New function.
(fhandler_base::fstat_by_name): New function.
(fhandler_base::fstat_by_handle): New function.
(fhandler_base::isfifo): New function.
(fhandler_base::is_slow): New function.
(fhandler_base::is_auto_device): New function.
(fhandler_base::is_fs_special): New function.
(fhandler_base::device_access_denied): New function.
(fhandler_base::operator DWORD&): New operator.
(fhandler_base::get_name): Return normalized path from pc.
(fhandler_base::get_win32_name): Return windows path from pc.
(fhandler_base::isdevice): Renamed from is_device.
(fhandler_base::get_native_name): Return device format.
(fhandler_fifo): New class.
(fhandler_nodevice): New class.
(select_stuff::device_specific): Remove array.
(select_stuff::device_specific_pipe): New class element.
(select_stuff::device_specific_socket): New class element.
(select_stuff::device_specific_serial): New class element.
(select_stuff::select_stuff): Initialize new elements.
* fhandler_disk_file.cc (fhandler_base::fstat_by_handle): Move to base class
from fhandler_disk_file.
(fhandler_base::fstat_by_name): Ditto.
(fhandler_base::fstat_by_name): Ditto.
(fhandler_disk_file::open): Move most functionality into
fhandler_base::open_fs.
(fhandler_base::open_fs): New function.
(fhandler_disk_file::close): Move most functionality into
fhandler_base::close_fs.
(fhandler_base::close_fs): New function.
* fhandler_mem.cc (fhandler_dev_mem::open): Use device name in debugging
output.
* fhandler_socket.cc (fhandler_socket::set_connect_secret): Copy standard
urandom device into appropriate place.
(fhandler_socket::accept): Reflect change in fdsock return value.
* fhandler_tty.cc: See "throughouts" above.
* net.cc: Accommodate fdsock change throughout.
(fdsock): Return success or failure, accept fd argument and device argument.
* path.cc (symlink_info::major): New element.
(symlink_info::minor): New element.
(symlink_info::parse_device): Declare new function.
(fs_info::update): Accommodate changes in path_conv class.
(path_conv::fillin): Ditto.
(path_conv::return_and_clear_normalized_path): Eliminate.
(path_conv::set_normalized_path): New function.
(path_conv::path_conv): Set info in dev element. Use path_conv methods Check
for FH_FS rather than FH_BAD to indicate when to fill in filesystem stuff.
where appropriate rather than direct access. Use set_normalized_path to set
normalized path.
(windows_device_names): Eliminate.
(get_dev): Ditto.
(get_raw_device_number): Ditto.
(get_device_number): Ditto.
(win32_device_name): Call new device name parser to do most of the heavy
lifting.
(mount_info::conv_to_win32_path): Fill in dev field as appropriate.
(symlink_worker): Handle new device files.
(symlink_info::check): Ditto.
(symlink_info::parse_device): Define new function.
* path.h (executable_states): Move here from fhandler.h.
(fs_info): Rename variables to *_storage and create methods for accessing same.
(path_conv): Add dev element, remove devn and unit and adjust inline methods to
accommodate.
(set_normalized_path): Declare new function.
* pinfo.cc (_pinfo::commune_recv): Add broken support for handling fifos.
(_pinfo::commune_send): Ditto.
* pipe.cc (fhandler_pipe::close): check for existence of handle before closing
it.
(handler_pipe::create): Rename from make_pipe. Change arguments to accept
fhandler_pipe array. Accommodate fifos.
(pipe): Rework to deal with fhandler_pipe::create changes.
(_pipe): Ditto.
* select.cc: Use individual device_specific types throughout rather than
indexing with obsolete device number.
(set_bits): Use is_socket call rather than checking device number.
* shared_info.h (CURR_MOUNT_MAGIC): Update.
(conv_to_win32_path): Reflect addition of device argument.
* syscalls.cc (mknod_worker): New function.
(open): Use build_fh_name to build fhandler.
(chown_worker): Detect if this is an 'auto' device rather than an on-filesystem
device and handle appropriately.
(chmod_device): New function.
(chmod): Detect if this is an 'auto' device rather than an on-filesystem device
and handle appropriately. Use chmod_device to set mode of in-filesystem
devices.
(stat_worker): Eliminate path_conv argument. Call build_fh_name to construct
fhandler. Use fh->error() rather than pc->error to detect errors in fhandler
construction.
(access_worker): New function pulled from access. Accommodate in-filesystem
devices.
(access): Use access_worker.
(fpathconf): Detect if this is an 'auto' device rather than an on-filesystem
device and handle appropriately.
(mknod_worker): New function.
(mknod32): New function.
(chroot): Free normalized path -- assuming it was actually cmalloced.
* tty.cc (create_tty_master): Tweak for new device class.
(tty::common_init): Ditto.
* winsup.h (stat_worker): Remove.
(symlink_worker): Declare.
* exceptions.cc (set_process_mask): Just call sig_dispatch_pending and don't
worry about pending_signals since sig_dispatch_pending should always do the
right thing now.
(sig_handle): Reorganize SIGCONT handling to more closely conform to SUSv3.
* pinfo.h: Move __SIG enum to sigproc.h.
(PICOM_FIFO): New enum element.
(_pinfo): Remove 'thread2signal' stuff throughout class.
(_pinfo::commune_send): Make varargs.
(_pinfo::sigtodo): Eliminate.
(_pinfo::thread2signal): Ditto.
* signal.cc (kill_worker): Eliminate call to setthread2signal.
* sigproc.cc (local_sigtodo): Eliminate.
(getlocal_sigtodo): Ditto.
(sigelem): New class.
(pending_signals): New class.
(sigqueue): New variable, start of sigqueue linked list.
(sigcatch_nonmain): Eliminate.
(sigcatch_main): Eliminate.
(sigcatch_nosync): Eliminate.
(sigcomplete_nonmain): Eliminate.
(pending_signals): Eliminate.
(sig_clear): Call signal thread to clear pending signals, unless already in
signal thread.
(sigpending): Call signal thread to get pending signals.
(sig_dispatch_pending): Eliminate use of pending_signals and just check
sigqueue.
(sigproc_terminate): Eliminate all of the obsolete semaphore stuff. Close
signal pipe handle.
(sig_send): Eliminate all of the obsolete semaphore stuff and use pipe to send
signals.
(getevent): Eliminate.
(pending_signals::add): New function.
(pending_signals::del): New function.
(pending_signals::next): New function.
(wait_sig): Eliminate all of the obsolete semaphore stuff. Use pipe to
communicate and maintain a linked list of signals.
* sigproc.h: Move __SIG defines here. Add __SIGPENDING.
(sig_dispatch_pending): Remove "C" specifier.
(sig_handle): Accept a mask argument.
* thread.cc: Remove signal handling considerations throughout.
2003-09-25 02:37:18 +02:00
|
|
|
#include "fhandler.h"
|
2001-04-20 15:02:32 +02:00
|
|
|
#include "dtable.h"
|
|
|
|
|
#include "cygheap.h"
|
2011-04-28 11:30:36 +02:00
|
|
|
#include "ntdll.h"
|
2010-09-10 16:53:44 +02:00
|
|
|
#include "tls_pbuf.h"
|
2001-04-20 15:02:32 +02:00
|
|
|
|
|
|
|
|
static int
|
2013-04-23 11:44:36 +02:00
|
|
|
searchace (aclent_t *aclp, int nentries, int type, uid_t id = ILLEGAL_UID)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
|
|
|
|
int i;
|
|
|
|
|
|
|
|
|
|
for (i = 0; i < nentries; ++i)
|
2003-02-05 17:15:22 +01:00
|
|
|
if ((aclp[i].a_type == type && (id == ILLEGAL_UID || aclp[i].a_id == id))
|
2001-04-20 15:02:32 +02:00
|
|
|
|| !aclp[i].a_type)
|
|
|
|
|
return i;
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
|
|
|
|
|
2014-08-31 16:13:01 +02:00
|
|
|
/* This function *requires* an acl list sorted with aclsort{32}. */
|
2004-04-14 18:36:26 +02:00
|
|
|
int
|
2013-04-23 11:44:36 +02:00
|
|
|
setacl (HANDLE handle, path_conv &pc, int nentries, aclent_t *aclbufp,
|
2007-01-07 13:44:10 +01:00
|
|
|
bool &writable)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2003-11-26 14:23:27 +01:00
|
|
|
security_descriptor sd_ret;
|
2010-09-10 16:53:44 +02:00
|
|
|
tmp_pathbuf tp;
|
2001-04-20 15:02:32 +02:00
|
|
|
|
2010-09-10 11:32:13 +02:00
|
|
|
if (get_file_sd (handle, pc, sd_ret, false))
|
2007-07-20 16:29:43 +02:00
|
|
|
return -1;
|
2001-04-20 15:02:32 +02:00
|
|
|
|
2011-04-28 11:53:11 +02:00
|
|
|
NTSTATUS status;
|
2014-08-31 16:13:01 +02:00
|
|
|
PACL acl;
|
|
|
|
|
BOOLEAN acl_exists, dummy;
|
2001-04-20 15:02:32 +02:00
|
|
|
|
|
|
|
|
/* Get owner SID. */
|
2003-02-05 17:15:22 +01:00
|
|
|
PSID owner_sid;
|
2011-04-28 11:53:11 +02:00
|
|
|
status = RtlGetOwnerSecurityDescriptor (sd_ret, &owner_sid, &dummy);
|
|
|
|
|
if (!NT_SUCCESS (status))
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2011-04-28 11:53:11 +02:00
|
|
|
__seterrno_from_nt_status (status);
|
2001-04-20 15:02:32 +02:00
|
|
|
return -1;
|
|
|
|
|
}
|
2001-04-25 11:43:25 +02:00
|
|
|
cygsid owner (owner_sid);
|
2001-04-20 15:02:32 +02:00
|
|
|
|
|
|
|
|
/* Get group SID. */
|
2003-02-05 17:15:22 +01:00
|
|
|
PSID group_sid;
|
2011-04-28 11:53:11 +02:00
|
|
|
status = RtlGetGroupSecurityDescriptor (sd_ret, &group_sid, &dummy);
|
|
|
|
|
if (!NT_SUCCESS (status))
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2011-04-28 11:53:11 +02:00
|
|
|
__seterrno_from_nt_status (status);
|
2001-04-20 15:02:32 +02:00
|
|
|
return -1;
|
|
|
|
|
}
|
2001-04-25 11:43:25 +02:00
|
|
|
cygsid group (group_sid);
|
2001-04-20 15:02:32 +02:00
|
|
|
|
2014-08-31 16:13:01 +02:00
|
|
|
/* Search for NULL ACE and store state of SUID, SGID and VTX bits. */
|
|
|
|
|
DWORD null_mask = 0;
|
|
|
|
|
if (NT_SUCCESS (RtlGetDaclSecurityDescriptor (sd_ret, &acl_exists, &acl,
|
|
|
|
|
&dummy)))
|
|
|
|
|
for (USHORT i = 0; i < acl->AceCount; ++i)
|
|
|
|
|
{
|
|
|
|
|
ACCESS_ALLOWED_ACE *ace;
|
|
|
|
|
if (NT_SUCCESS (RtlGetAce (acl, i, (PVOID *) &ace)))
|
|
|
|
|
{
|
|
|
|
|
cygpsid ace_sid ((PSID) &ace->SidStart);
|
|
|
|
|
if (ace_sid == well_known_null_sid)
|
|
|
|
|
{
|
|
|
|
|
null_mask = ace->Mask;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2001-04-20 15:02:32 +02:00
|
|
|
/* Initialize local security descriptor. */
|
|
|
|
|
SECURITY_DESCRIPTOR sd;
|
2011-04-28 11:30:36 +02:00
|
|
|
RtlCreateSecurityDescriptor (&sd, SECURITY_DESCRIPTOR_REVISION);
|
2014-08-31 16:13:01 +02:00
|
|
|
|
|
|
|
|
/* As in alloc_sd, set SE_DACL_PROTECTED to prevent the DACL from being
|
|
|
|
|
modified by inheritable ACEs. */
|
|
|
|
|
RtlSetControlSecurityDescriptor (&sd, SE_DACL_PROTECTED, SE_DACL_PROTECTED);
|
|
|
|
|
|
2011-04-28 17:54:47 +02:00
|
|
|
status = RtlSetOwnerSecurityDescriptor (&sd, owner, FALSE);
|
|
|
|
|
if (!NT_SUCCESS (status))
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2011-04-28 17:54:47 +02:00
|
|
|
__seterrno_from_nt_status (status);
|
2001-04-20 15:02:32 +02:00
|
|
|
return -1;
|
|
|
|
|
}
|
2011-04-28 17:54:47 +02:00
|
|
|
status = RtlSetGroupSecurityDescriptor (&sd, group, FALSE);
|
|
|
|
|
if (!NT_SUCCESS (status))
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2011-04-28 17:54:47 +02:00
|
|
|
__seterrno_from_nt_status (status);
|
2001-04-20 15:02:32 +02:00
|
|
|
return -1;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Fill access control list. */
|
2014-08-31 16:13:01 +02:00
|
|
|
acl = (PACL) tp.w_get ();
|
2001-04-20 15:02:32 +02:00
|
|
|
size_t acl_len = sizeof (ACL);
|
|
|
|
|
int ace_off = 0;
|
|
|
|
|
|
2001-04-25 11:43:25 +02:00
|
|
|
cygsid sid;
|
2001-04-20 15:02:32 +02:00
|
|
|
struct passwd *pw;
|
2013-04-23 11:44:36 +02:00
|
|
|
struct group *gr;
|
2001-04-20 15:02:32 +02:00
|
|
|
int pos;
|
2014-02-27 13:57:27 +01:00
|
|
|
cyg_ldap cldap;
|
2001-04-20 15:02:32 +02:00
|
|
|
|
2011-04-28 11:30:36 +02:00
|
|
|
RtlCreateAcl (acl, ACL_MAXIMUM_SIZE, ACL_REVISION);
|
2007-01-07 13:44:10 +01:00
|
|
|
|
|
|
|
|
writable = false;
|
|
|
|
|
|
2015-02-12 18:53:24 +01:00
|
|
|
bool *invalid = (bool *) tp.c_get ();
|
|
|
|
|
memset (invalid, 0, nentries * sizeof *invalid);
|
|
|
|
|
|
2014-08-31 16:13:01 +02:00
|
|
|
/* Pre-compute owner, group, and other permissions to allow creating
|
|
|
|
|
matching deny ACEs as in alloc_sd. */
|
|
|
|
|
DWORD owner_allow = 0, group_allow = 0, other_allow = 0;
|
|
|
|
|
PDWORD allow;
|
2001-04-20 15:02:32 +02:00
|
|
|
for (int i = 0; i < nentries; ++i)
|
|
|
|
|
{
|
2014-08-31 16:13:01 +02:00
|
|
|
switch (aclbufp[i].a_type)
|
|
|
|
|
{
|
|
|
|
|
case USER_OBJ:
|
|
|
|
|
allow = &owner_allow;
|
2015-02-19 15:15:44 +01:00
|
|
|
*allow = STANDARD_RIGHTS_ALL
|
|
|
|
|
| (pc.fs_is_samba () ? 0 : FILE_WRITE_ATTRIBUTES);
|
2014-08-31 16:13:01 +02:00
|
|
|
break;
|
|
|
|
|
case GROUP_OBJ:
|
|
|
|
|
allow = &group_allow;
|
|
|
|
|
break;
|
|
|
|
|
case OTHER_OBJ:
|
|
|
|
|
allow = &other_allow;
|
|
|
|
|
break;
|
|
|
|
|
default:
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
*allow |= STANDARD_RIGHTS_READ | SYNCHRONIZE
|
2008-10-13 18:01:50 +02:00
|
|
|
| (pc.fs_is_samba () ? 0 : FILE_READ_ATTRIBUTES);
|
2014-08-31 16:13:01 +02:00
|
|
|
if (aclbufp[i].a_perm & S_IROTH)
|
|
|
|
|
*allow |= FILE_GENERIC_READ;
|
|
|
|
|
if (aclbufp[i].a_perm & S_IWOTH)
|
|
|
|
|
{
|
|
|
|
|
*allow |= FILE_GENERIC_WRITE;
|
|
|
|
|
writable = true;
|
|
|
|
|
}
|
|
|
|
|
if (aclbufp[i].a_perm & S_IXOTH)
|
|
|
|
|
*allow |= FILE_GENERIC_EXECUTE & ~FILE_READ_ATTRIBUTES;
|
|
|
|
|
/* Keep S_ISVTX rule in sync with alloc_sd. */
|
|
|
|
|
if (pc.isdir ()
|
|
|
|
|
&& (aclbufp[i].a_perm & (S_IWOTH | S_IXOTH)) == (S_IWOTH | S_IXOTH)
|
|
|
|
|
&& (aclbufp[i].a_type == USER_OBJ
|
|
|
|
|
|| !(null_mask & FILE_READ_DATA)))
|
|
|
|
|
*allow |= FILE_DELETE_CHILD;
|
2015-02-12 18:53:24 +01:00
|
|
|
invalid[i] = true;
|
2014-08-31 16:13:01 +02:00
|
|
|
}
|
|
|
|
|
bool isownergroup = (owner_sid == group_sid);
|
|
|
|
|
DWORD owner_deny = ~owner_allow & (group_allow | other_allow);
|
|
|
|
|
owner_deny &= ~(STANDARD_RIGHTS_READ
|
|
|
|
|
| FILE_READ_ATTRIBUTES | FILE_WRITE_ATTRIBUTES);
|
|
|
|
|
DWORD group_deny = ~group_allow & other_allow;
|
|
|
|
|
group_deny &= ~(STANDARD_RIGHTS_READ | FILE_READ_ATTRIBUTES);
|
|
|
|
|
|
|
|
|
|
/* Set deny ACE for owner. */
|
|
|
|
|
if (owner_deny
|
|
|
|
|
&& !add_access_denied_ace (acl, ace_off++, owner_deny,
|
|
|
|
|
owner_sid, acl_len, NO_INHERITANCE))
|
|
|
|
|
return -1;
|
|
|
|
|
/* Set deny ACE for group here to respect the canonical order,
|
|
|
|
|
if this does not impact owner */
|
|
|
|
|
if (group_deny && !(group_deny & owner_allow) && !isownergroup
|
|
|
|
|
&& !add_access_denied_ace (acl, ace_off++, group_deny,
|
|
|
|
|
group_sid, acl_len, NO_INHERITANCE))
|
|
|
|
|
return -1;
|
|
|
|
|
/* Set allow ACE for owner. */
|
|
|
|
|
if (!add_access_allowed_ace (acl, ace_off++, owner_allow,
|
|
|
|
|
owner_sid, acl_len, NO_INHERITANCE))
|
|
|
|
|
return -1;
|
|
|
|
|
/* Set deny ACE for group, if still needed. */
|
|
|
|
|
if (group_deny & owner_allow && !isownergroup
|
|
|
|
|
&& !add_access_denied_ace (acl, ace_off++, group_deny,
|
|
|
|
|
group_sid, acl_len, NO_INHERITANCE))
|
|
|
|
|
return -1;
|
|
|
|
|
/* Set allow ACE for group. */
|
|
|
|
|
if (!isownergroup
|
|
|
|
|
&& !add_access_allowed_ace (acl, ace_off++, group_allow,
|
|
|
|
|
group_sid, acl_len, NO_INHERITANCE))
|
|
|
|
|
return -1;
|
|
|
|
|
/* Set allow ACE for everyone. */
|
|
|
|
|
if (!add_access_allowed_ace (acl, ace_off++, other_allow,
|
|
|
|
|
well_known_world_sid, acl_len, NO_INHERITANCE))
|
|
|
|
|
return -1;
|
|
|
|
|
/* If a NULL ACE exists, copy it verbatim. */
|
|
|
|
|
if (null_mask)
|
|
|
|
|
if (!add_access_allowed_ace (acl, ace_off++, null_mask, well_known_null_sid,
|
|
|
|
|
acl_len, NO_INHERITANCE))
|
|
|
|
|
return -1;
|
|
|
|
|
for (int i = 0; i < nentries; ++i)
|
|
|
|
|
{
|
|
|
|
|
DWORD allow;
|
|
|
|
|
/* Skip invalidated entries. */
|
2015-02-12 18:53:24 +01:00
|
|
|
if (invalid[i])
|
2014-08-31 16:13:01 +02:00
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
allow = STANDARD_RIGHTS_READ
|
|
|
|
|
| (pc.fs_is_samba () ? 0 : FILE_READ_ATTRIBUTES);
|
2001-04-20 15:02:32 +02:00
|
|
|
if (aclbufp[i].a_perm & S_IROTH)
|
|
|
|
|
allow |= FILE_GENERIC_READ;
|
|
|
|
|
if (aclbufp[i].a_perm & S_IWOTH)
|
2007-01-07 13:44:10 +01:00
|
|
|
{
|
2008-10-13 18:01:50 +02:00
|
|
|
allow |= FILE_GENERIC_WRITE;
|
2007-01-07 13:44:10 +01:00
|
|
|
writable = true;
|
|
|
|
|
}
|
2001-04-20 15:02:32 +02:00
|
|
|
if (aclbufp[i].a_perm & S_IXOTH)
|
2008-10-13 18:01:50 +02:00
|
|
|
allow |= FILE_GENERIC_EXECUTE & ~FILE_READ_ATTRIBUTES;
|
2014-08-31 16:13:01 +02:00
|
|
|
/* Keep S_ISVTX rule in sync with alloc_sd. */
|
|
|
|
|
if (pc.isdir ()
|
|
|
|
|
&& (aclbufp[i].a_perm & (S_IWOTH | S_IXOTH)) == (S_IWOTH | S_IXOTH)
|
|
|
|
|
&& !(null_mask & FILE_READ_DATA))
|
2001-09-07 23:32:07 +02:00
|
|
|
allow |= FILE_DELETE_CHILD;
|
2001-04-20 15:02:32 +02:00
|
|
|
/* Set inherit property. */
|
|
|
|
|
DWORD inheritance = (aclbufp[i].a_type & ACL_DEFAULT)
|
2009-10-30 20:58:53 +01:00
|
|
|
? (CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE
|
|
|
|
|
| INHERIT_ONLY_ACE)
|
2002-07-02 10:11:15 +02:00
|
|
|
: NO_INHERITANCE;
|
2001-04-20 15:02:32 +02:00
|
|
|
/*
|
|
|
|
|
* If a specific acl contains a corresponding default entry with
|
|
|
|
|
* identical permissions, only one Windows ACE with proper
|
|
|
|
|
* inheritance bits is created.
|
|
|
|
|
*/
|
|
|
|
|
if (!(aclbufp[i].a_type & ACL_DEFAULT)
|
2014-08-31 16:13:01 +02:00
|
|
|
&& aclbufp[i].a_type & (USER|GROUP)
|
2003-01-26 07:42:40 +01:00
|
|
|
&& (pos = searchace (aclbufp + i + 1, nentries - i - 1,
|
2001-04-20 15:02:32 +02:00
|
|
|
aclbufp[i].a_type | ACL_DEFAULT,
|
|
|
|
|
(aclbufp[i].a_type & (USER|GROUP))
|
2003-02-05 17:15:22 +01:00
|
|
|
? aclbufp[i].a_id : ILLEGAL_UID)) >= 0
|
2004-04-10 22:18:11 +02:00
|
|
|
&& aclbufp[i].a_perm == aclbufp[i + 1 + pos].a_perm)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2009-10-30 20:58:53 +01:00
|
|
|
inheritance = CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE;
|
2014-08-31 16:13:01 +02:00
|
|
|
/* invalidate the corresponding default entry. */
|
2015-02-12 18:53:24 +01:00
|
|
|
invalid[i + 1 + pos] = true;
|
2001-04-20 15:02:32 +02:00
|
|
|
}
|
|
|
|
|
switch (aclbufp[i].a_type)
|
|
|
|
|
{
|
2003-01-12 12:38:51 +01:00
|
|
|
case DEF_USER_OBJ:
|
2015-02-25 22:30:45 +01:00
|
|
|
allow |= STANDARD_RIGHTS_ALL
|
|
|
|
|
| (pc.fs_is_samba () ? 0 : FILE_WRITE_ATTRIBUTES);
|
2003-01-12 12:38:51 +01:00
|
|
|
if (!add_access_allowed_ace (acl, ace_off++, allow,
|
|
|
|
|
well_known_creator_owner_sid, acl_len, inheritance))
|
|
|
|
|
return -1;
|
|
|
|
|
break;
|
2001-04-20 15:02:32 +02:00
|
|
|
case USER:
|
|
|
|
|
case DEF_USER:
|
2014-02-27 13:57:27 +01:00
|
|
|
if (!(pw = internal_getpwuid (aclbufp[i].a_id, &cldap))
|
2008-05-22 14:43:18 +02:00
|
|
|
|| !sid.getfrompw (pw))
|
|
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
|
|
|
|
if (!add_access_allowed_ace (acl, ace_off++, allow,
|
|
|
|
|
sid, acl_len, inheritance))
|
2001-04-20 15:02:32 +02:00
|
|
|
return -1;
|
|
|
|
|
break;
|
2003-01-12 12:38:51 +01:00
|
|
|
case DEF_GROUP_OBJ:
|
|
|
|
|
if (!add_access_allowed_ace (acl, ace_off++, allow,
|
|
|
|
|
well_known_creator_group_sid, acl_len, inheritance))
|
|
|
|
|
return -1;
|
|
|
|
|
break;
|
2001-04-20 15:02:32 +02:00
|
|
|
case GROUP:
|
|
|
|
|
case DEF_GROUP:
|
2014-02-27 13:57:27 +01:00
|
|
|
if (!(gr = internal_getgrgid (aclbufp[i].a_id, &cldap))
|
2008-05-22 14:43:18 +02:00
|
|
|
|| !sid.getfromgr (gr))
|
|
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
|
|
|
|
if (!add_access_allowed_ace (acl, ace_off++, allow,
|
|
|
|
|
sid, acl_len, inheritance))
|
2001-04-20 15:02:32 +02:00
|
|
|
return -1;
|
|
|
|
|
break;
|
|
|
|
|
case DEF_OTHER_OBJ:
|
|
|
|
|
if (!add_access_allowed_ace (acl, ace_off++, allow,
|
* fork.cc (fork): Eliminate superfluous call to getuid().
* security.h: New define `NO_SID'. Remove declarations of functions
moved to methods into class cygsid.
(class cygsid): Declare new methods `getfromstr', `get_sid',
`getfrompw', `getfromgr', `get_rid', `get_uid', `get_gid', `string'
and new constructors and operators =, == and !=.
Declare new global cygsids `well_known_XXX_sid' substituting the
corresponding `get_XXX_sid' functions. Remove declarations of
these functions.
* sec_helper.cc (well_known_admin_sid): New global variable.
(well_known_system_sid): Ditto
(well_known_creator_owner_sid): Ditto
(well_known_world_sid): Ditto
(cygsid::string): New method, substituting `convert_sid_to_string_sid'.
(cygsid::get_sid): New method, substituting `get_sid'.
(cygsid::getfromstr): New method, substituting
`convert_string_sid_to_sid'.
(cygsid::getfrompw): New method, substituting `get_pw_sid'.
(cygsid::getfromgr): New method, substituting `get_gr_sid'.
(cygsid::get_id): New method, substituting `get_id_from_sid'.
(get_admin_sid): Eliminated.
(get_system_sid): Ditto.
(get_creator_owner_sid): Ditto.
(get_world_sid): Ditto.
* grp.cc: Use new cygsid methods and well known sids throughout.
* registry.cc: Ditto.
* sec_acl.cc: Ditto.
* security.cc: Ditto.
* shared.cc: Ditto.
* syscalls.cc (seteuid): Ditto. Eliminate redundant conditional.
* uinfo.cc (internal_getlogin): Ditto.
* spawn.cc (spawn_guts) Revert previous patch.
2001-05-15 21:23:31 +02:00
|
|
|
well_known_world_sid,
|
|
|
|
|
acl_len, inheritance))
|
2001-04-20 15:02:32 +02:00
|
|
|
return -1;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
/* Set AclSize to computed value. */
|
|
|
|
|
acl->AclSize = acl_len;
|
2013-04-23 11:44:36 +02:00
|
|
|
debug_printf ("ACL-Size: %u", acl_len);
|
2001-04-20 15:02:32 +02:00
|
|
|
/* Create DACL for local security descriptor. */
|
2011-04-28 17:54:47 +02:00
|
|
|
status = RtlSetDaclSecurityDescriptor (&sd, TRUE, acl, FALSE);
|
|
|
|
|
if (!NT_SUCCESS (status))
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2011-04-28 17:54:47 +02:00
|
|
|
__seterrno_from_nt_status (status);
|
2001-04-20 15:02:32 +02:00
|
|
|
return -1;
|
|
|
|
|
}
|
2003-11-26 14:23:27 +01:00
|
|
|
/* Make self relative security descriptor in sd_ret. */
|
|
|
|
|
DWORD sd_size = 0;
|
2011-04-29 12:38:12 +02:00
|
|
|
RtlAbsoluteToSelfRelativeSD (&sd, sd_ret, &sd_size);
|
2001-04-20 15:02:32 +02:00
|
|
|
if (sd_size <= 0)
|
|
|
|
|
{
|
|
|
|
|
__seterrno ();
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
2004-01-20 10:13:20 +01:00
|
|
|
if (!sd_ret.realloc (sd_size))
|
|
|
|
|
{
|
|
|
|
|
set_errno (ENOMEM);
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
2011-04-29 12:38:12 +02:00
|
|
|
status = RtlAbsoluteToSelfRelativeSD (&sd, sd_ret, &sd_size);
|
|
|
|
|
if (!NT_SUCCESS (status))
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2011-04-29 12:38:12 +02:00
|
|
|
__seterrno_from_nt_status (status);
|
2001-04-20 15:02:32 +02:00
|
|
|
return -1;
|
|
|
|
|
}
|
2013-04-23 11:44:36 +02:00
|
|
|
debug_printf ("Created SD-Size: %u", sd_ret.size ());
|
2009-04-09 11:19:03 +02:00
|
|
|
return set_file_sd (handle, pc, sd_ret, false);
|
2001-04-20 15:02:32 +02:00
|
|
|
}
|
|
|
|
|
|
2002-11-24 19:58:47 +01:00
|
|
|
/* Temporary access denied bits */
|
|
|
|
|
#define DENY_R 040000
|
|
|
|
|
#define DENY_W 020000
|
|
|
|
|
#define DENY_X 010000
|
|
|
|
|
|
2001-04-20 15:02:32 +02:00
|
|
|
static void
|
2013-04-23 11:44:36 +02:00
|
|
|
getace (aclent_t &acl, int type, int id, DWORD win_ace_mask,
|
2003-01-26 07:42:40 +01:00
|
|
|
DWORD win_ace_type)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
|
|
|
|
acl.a_type = type;
|
|
|
|
|
acl.a_id = id;
|
|
|
|
|
|
2003-11-26 11:52:21 +01:00
|
|
|
if ((win_ace_mask & FILE_READ_BITS) && !(acl.a_perm & (S_IROTH | DENY_R)))
|
2008-09-11 06:34:24 +02:00
|
|
|
{
|
|
|
|
|
if (win_ace_type == ACCESS_ALLOWED_ACE_TYPE)
|
|
|
|
|
acl.a_perm |= S_IROTH;
|
|
|
|
|
else if (win_ace_type == ACCESS_DENIED_ACE_TYPE)
|
|
|
|
|
acl.a_perm |= DENY_R;
|
|
|
|
|
}
|
2001-04-20 15:02:32 +02:00
|
|
|
|
2003-11-26 11:52:21 +01:00
|
|
|
if ((win_ace_mask & FILE_WRITE_BITS) && !(acl.a_perm & (S_IWOTH | DENY_W)))
|
2008-09-11 06:34:24 +02:00
|
|
|
{
|
|
|
|
|
if (win_ace_type == ACCESS_ALLOWED_ACE_TYPE)
|
|
|
|
|
acl.a_perm |= S_IWOTH;
|
|
|
|
|
else if (win_ace_type == ACCESS_DENIED_ACE_TYPE)
|
|
|
|
|
acl.a_perm |= DENY_W;
|
|
|
|
|
}
|
2001-04-20 15:02:32 +02:00
|
|
|
|
2003-11-26 11:52:21 +01:00
|
|
|
if ((win_ace_mask & FILE_EXEC_BITS) && !(acl.a_perm & (S_IXOTH | DENY_X)))
|
2008-09-11 06:34:24 +02:00
|
|
|
{
|
|
|
|
|
if (win_ace_type == ACCESS_ALLOWED_ACE_TYPE)
|
|
|
|
|
acl.a_perm |= S_IXOTH;
|
|
|
|
|
else if (win_ace_type == ACCESS_DENIED_ACE_TYPE)
|
|
|
|
|
acl.a_perm |= DENY_X;
|
|
|
|
|
}
|
2001-04-20 15:02:32 +02:00
|
|
|
}
|
|
|
|
|
|
2004-04-14 18:36:26 +02:00
|
|
|
int
|
2013-04-23 11:44:36 +02:00
|
|
|
getacl (HANDLE handle, path_conv &pc, int nentries, aclent_t *aclbufp)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2003-11-26 14:23:27 +01:00
|
|
|
security_descriptor sd;
|
2001-04-20 15:02:32 +02:00
|
|
|
|
2010-09-10 11:32:13 +02:00
|
|
|
if (get_file_sd (handle, pc, sd, false))
|
2007-07-20 16:29:43 +02:00
|
|
|
return -1;
|
2001-04-20 15:02:32 +02:00
|
|
|
|
2003-02-05 17:15:22 +01:00
|
|
|
cygpsid owner_sid;
|
|
|
|
|
cygpsid group_sid;
|
2011-04-28 11:53:11 +02:00
|
|
|
NTSTATUS status;
|
|
|
|
|
BOOLEAN dummy;
|
2013-04-23 11:44:36 +02:00
|
|
|
uid_t uid;
|
|
|
|
|
gid_t gid;
|
2014-02-27 13:57:27 +01:00
|
|
|
cyg_ldap cldap;
|
2001-04-20 15:02:32 +02:00
|
|
|
|
2011-04-28 11:53:11 +02:00
|
|
|
status = RtlGetOwnerSecurityDescriptor (sd, (PSID *) &owner_sid, &dummy);
|
|
|
|
|
if (!NT_SUCCESS (status))
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2011-04-28 11:53:11 +02:00
|
|
|
__seterrno_from_nt_status (status);
|
2001-04-20 15:02:32 +02:00
|
|
|
return -1;
|
|
|
|
|
}
|
2014-02-27 13:57:27 +01:00
|
|
|
uid = owner_sid.get_uid (&cldap);
|
2001-04-20 15:02:32 +02:00
|
|
|
|
2011-04-28 11:53:11 +02:00
|
|
|
status = RtlGetGroupSecurityDescriptor (sd, (PSID *) &group_sid, &dummy);
|
|
|
|
|
if (!NT_SUCCESS (status))
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2011-04-28 11:53:11 +02:00
|
|
|
__seterrno_from_nt_status (status);
|
2001-04-20 15:02:32 +02:00
|
|
|
return -1;
|
|
|
|
|
}
|
2014-02-27 13:57:27 +01:00
|
|
|
gid = group_sid.get_gid (&cldap);
|
2001-04-20 15:02:32 +02:00
|
|
|
|
2013-04-23 11:44:36 +02:00
|
|
|
aclent_t lacl[MAX_ACL_ENTRIES];
|
|
|
|
|
memset (&lacl, 0, MAX_ACL_ENTRIES * sizeof (aclent_t));
|
2001-04-20 15:02:32 +02:00
|
|
|
lacl[0].a_type = USER_OBJ;
|
|
|
|
|
lacl[0].a_id = uid;
|
|
|
|
|
lacl[1].a_type = GROUP_OBJ;
|
|
|
|
|
lacl[1].a_id = gid;
|
|
|
|
|
lacl[2].a_type = OTHER_OBJ;
|
2002-11-24 19:58:47 +01:00
|
|
|
lacl[2].a_id = ILLEGAL_GID;
|
2001-04-20 15:02:32 +02:00
|
|
|
|
|
|
|
|
PACL acl;
|
2011-04-28 11:53:11 +02:00
|
|
|
BOOLEAN acl_exists;
|
2001-04-20 15:02:32 +02:00
|
|
|
|
2011-04-28 11:53:11 +02:00
|
|
|
status = RtlGetDaclSecurityDescriptor (sd, &acl_exists, &acl, &dummy);
|
|
|
|
|
if (!NT_SUCCESS (status))
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2011-04-28 11:53:11 +02:00
|
|
|
__seterrno_from_nt_status (status);
|
2001-04-20 15:02:32 +02:00
|
|
|
return -1;
|
|
|
|
|
}
|
|
|
|
|
|
2002-11-24 19:58:47 +01:00
|
|
|
int pos, i, types_def = 0;
|
2014-08-28 14:38:52 +02:00
|
|
|
int pgrp_pos = 1, def_pgrp_pos = -1;
|
|
|
|
|
mode_t class_perm = 0, def_class_perm = 0;
|
2001-04-20 15:02:32 +02:00
|
|
|
|
|
|
|
|
if (!acl_exists || !acl)
|
2014-08-28 14:38:52 +02:00
|
|
|
for (pos = 0; pos < 3; ++pos)
|
2002-11-24 19:58:47 +01:00
|
|
|
lacl[pos].a_perm = S_IROTH | S_IWOTH | S_IXOTH;
|
|
|
|
|
else
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2002-11-24 19:58:47 +01:00
|
|
|
for (i = 0; i < acl->AceCount; ++i)
|
|
|
|
|
{
|
|
|
|
|
ACCESS_ALLOWED_ACE *ace;
|
2002-12-12 04:09:38 +01:00
|
|
|
|
2011-04-28 11:30:36 +02:00
|
|
|
if (!NT_SUCCESS (RtlGetAce (acl, i, (PVOID *) &ace)))
|
2002-11-24 19:58:47 +01:00
|
|
|
continue;
|
2001-04-20 15:02:32 +02:00
|
|
|
|
2003-02-05 17:15:22 +01:00
|
|
|
cygpsid ace_sid ((PSID) &ace->SidStart);
|
2002-11-24 19:58:47 +01:00
|
|
|
int id;
|
|
|
|
|
int type = 0;
|
2001-04-20 15:02:32 +02:00
|
|
|
|
2014-08-31 16:13:01 +02:00
|
|
|
if (ace_sid == well_known_null_sid)
|
|
|
|
|
{
|
|
|
|
|
/* Simply ignore. */
|
|
|
|
|
continue;
|
|
|
|
|
}
|
2002-11-24 19:58:47 +01:00
|
|
|
if (ace_sid == well_known_world_sid)
|
|
|
|
|
{
|
|
|
|
|
type = OTHER_OBJ;
|
|
|
|
|
id = ILLEGAL_GID;
|
|
|
|
|
}
|
|
|
|
|
else if (ace_sid == group_sid)
|
|
|
|
|
{
|
|
|
|
|
type = GROUP_OBJ;
|
|
|
|
|
id = gid;
|
|
|
|
|
}
|
|
|
|
|
else if (ace_sid == owner_sid)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2002-11-24 19:58:47 +01:00
|
|
|
type = USER_OBJ;
|
|
|
|
|
id = uid;
|
|
|
|
|
}
|
2003-01-12 12:38:51 +01:00
|
|
|
else if (ace_sid == well_known_creator_group_sid)
|
|
|
|
|
{
|
2014-08-28 14:38:52 +02:00
|
|
|
type = DEF_GROUP_OBJ;
|
2010-12-15 15:11:03 +01:00
|
|
|
types_def |= type;
|
2003-01-12 12:38:51 +01:00
|
|
|
id = ILLEGAL_GID;
|
|
|
|
|
}
|
|
|
|
|
else if (ace_sid == well_known_creator_owner_sid)
|
|
|
|
|
{
|
2014-08-28 14:38:52 +02:00
|
|
|
type = DEF_USER_OBJ;
|
2010-12-15 15:11:03 +01:00
|
|
|
types_def |= type;
|
2003-01-12 12:38:51 +01:00
|
|
|
id = ILLEGAL_GID;
|
|
|
|
|
}
|
2002-11-24 19:58:47 +01:00
|
|
|
else
|
2014-02-27 13:57:27 +01:00
|
|
|
id = ace_sid.get_id (TRUE, &type, &cldap);
|
2003-02-05 17:15:22 +01:00
|
|
|
|
2002-11-24 19:58:47 +01:00
|
|
|
if (!type)
|
|
|
|
|
continue;
|
2009-10-30 20:58:53 +01:00
|
|
|
if (!(ace->Header.AceFlags & INHERIT_ONLY_ACE || type & ACL_DEFAULT))
|
2002-11-24 19:58:47 +01:00
|
|
|
{
|
|
|
|
|
if ((pos = searchace (lacl, MAX_ACL_ENTRIES, type, id)) >= 0)
|
2014-08-28 14:38:52 +02:00
|
|
|
{
|
|
|
|
|
getace (lacl[pos], type, id, ace->Mask, ace->Header.AceType);
|
|
|
|
|
/* Fix up CLASS_OBJ value. */
|
|
|
|
|
if (type == USER || type == GROUP)
|
|
|
|
|
class_perm |= lacl[pos].a_perm;
|
|
|
|
|
}
|
2002-11-24 19:58:47 +01:00
|
|
|
}
|
2009-10-30 20:58:53 +01:00
|
|
|
if ((ace->Header.AceFlags
|
|
|
|
|
& (CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE))
|
2007-07-20 16:29:43 +02:00
|
|
|
&& pc.isdir ())
|
2002-11-24 19:58:47 +01:00
|
|
|
{
|
2003-01-12 12:38:51 +01:00
|
|
|
if (type == USER_OBJ)
|
|
|
|
|
type = USER;
|
|
|
|
|
else if (type == GROUP_OBJ)
|
|
|
|
|
type = GROUP;
|
2002-11-24 19:58:47 +01:00
|
|
|
type |= ACL_DEFAULT;
|
|
|
|
|
types_def |= type;
|
|
|
|
|
if ((pos = searchace (lacl, MAX_ACL_ENTRIES, type, id)) >= 0)
|
2014-08-28 14:38:52 +02:00
|
|
|
{
|
|
|
|
|
getace (lacl[pos], type, id, ace->Mask, ace->Header.AceType);
|
|
|
|
|
/* Fix up DEF_CLASS_OBJ value. */
|
|
|
|
|
if (type == DEF_USER || type == DEF_GROUP)
|
|
|
|
|
def_class_perm |= lacl[pos].a_perm;
|
|
|
|
|
/* And note the position of the DEF_GROUP_OBJ entry. */
|
|
|
|
|
else if (type == DEF_GROUP_OBJ)
|
|
|
|
|
def_pgrp_pos = pos;
|
|
|
|
|
}
|
2002-11-24 19:58:47 +01:00
|
|
|
}
|
2001-04-20 15:02:32 +02:00
|
|
|
}
|
2014-08-28 14:38:52 +02:00
|
|
|
/* If secondary user and group entries exist in the ACL, fake a matching
|
|
|
|
|
CLASS_OBJ entry. The CLASS_OBJ permissions are the or'ed permissions
|
|
|
|
|
of the primary group permissions and all secondary user and group
|
|
|
|
|
permissions. */
|
|
|
|
|
if (class_perm && (pos = searchace (lacl, MAX_ACL_ENTRIES, 0)) >= 0)
|
|
|
|
|
{
|
|
|
|
|
lacl[pos].a_type = CLASS_OBJ;
|
|
|
|
|
lacl[pos].a_id = ILLEGAL_GID;
|
|
|
|
|
lacl[pos].a_perm = class_perm | lacl[pgrp_pos].a_perm;
|
|
|
|
|
}
|
|
|
|
|
/* Ensure that the default acl contains at least
|
|
|
|
|
DEF_(USER|GROUP|OTHER)_OBJ entries. */
|
2010-12-15 15:11:03 +01:00
|
|
|
if (types_def && (pos = searchace (lacl, MAX_ACL_ENTRIES, 0)) >= 0)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2010-12-15 15:11:03 +01:00
|
|
|
if (!(types_def & USER_OBJ))
|
|
|
|
|
{
|
|
|
|
|
lacl[pos].a_type = DEF_USER_OBJ;
|
|
|
|
|
lacl[pos].a_id = uid;
|
|
|
|
|
lacl[pos].a_perm = lacl[0].a_perm;
|
|
|
|
|
pos++;
|
|
|
|
|
}
|
|
|
|
|
if (!(types_def & GROUP_OBJ) && pos < MAX_ACL_ENTRIES)
|
|
|
|
|
{
|
|
|
|
|
lacl[pos].a_type = DEF_GROUP_OBJ;
|
|
|
|
|
lacl[pos].a_id = gid;
|
|
|
|
|
lacl[pos].a_perm = lacl[1].a_perm;
|
2014-08-28 14:38:52 +02:00
|
|
|
/* Note the position of the DEF_GROUP_OBJ entry. */
|
|
|
|
|
def_pgrp_pos = pos;
|
2010-12-15 15:11:03 +01:00
|
|
|
pos++;
|
|
|
|
|
}
|
|
|
|
|
if (!(types_def & OTHER_OBJ) && pos < MAX_ACL_ENTRIES)
|
|
|
|
|
{
|
|
|
|
|
lacl[pos].a_type = DEF_OTHER_OBJ;
|
|
|
|
|
lacl[pos].a_id = ILLEGAL_GID;
|
|
|
|
|
lacl[pos].a_perm = lacl[2].a_perm;
|
|
|
|
|
pos++;
|
|
|
|
|
}
|
2014-08-28 14:38:52 +02:00
|
|
|
}
|
|
|
|
|
/* If secondary user default and group default entries exist in the ACL,
|
|
|
|
|
fake a matching DEF_CLASS_OBJ entry. The DEF_CLASS_OBJ permissions are
|
|
|
|
|
the or'ed permissions of the primary group default permissions and all
|
|
|
|
|
secondary user and group default permissions. */
|
|
|
|
|
if (def_class_perm && (pos = searchace (lacl, MAX_ACL_ENTRIES, 0)) >= 0)
|
|
|
|
|
{
|
|
|
|
|
lacl[pos].a_type = DEF_CLASS_OBJ;
|
|
|
|
|
lacl[pos].a_id = ILLEGAL_GID;
|
|
|
|
|
lacl[pos].a_perm = def_class_perm;
|
|
|
|
|
if (def_pgrp_pos >= 0)
|
|
|
|
|
lacl[pos].a_perm |= lacl[def_pgrp_pos].a_perm;
|
2001-04-20 15:02:32 +02:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
if ((pos = searchace (lacl, MAX_ACL_ENTRIES, 0)) < 0)
|
|
|
|
|
pos = MAX_ACL_ENTRIES;
|
2002-11-24 19:58:47 +01:00
|
|
|
if (aclbufp) {
|
2003-02-05 17:15:22 +01:00
|
|
|
if (owner_sid == group_sid)
|
2002-11-24 19:58:47 +01:00
|
|
|
lacl[0].a_perm = lacl[1].a_perm;
|
|
|
|
|
if (pos > nentries)
|
2002-11-25 12:23:21 +01:00
|
|
|
{
|
2003-01-26 07:42:40 +01:00
|
|
|
set_errno (ENOSPC);
|
2002-11-25 12:23:21 +01:00
|
|
|
return -1;
|
|
|
|
|
}
|
2013-04-23 11:44:36 +02:00
|
|
|
memcpy (aclbufp, lacl, pos * sizeof (aclent_t));
|
2002-11-24 19:58:47 +01:00
|
|
|
for (i = 0; i < pos; ++i)
|
|
|
|
|
aclbufp[i].a_perm &= ~(DENY_R | DENY_W | DENY_X);
|
2003-02-05 17:15:22 +01:00
|
|
|
aclsort32 (pos, 0, aclbufp);
|
2002-11-24 19:58:47 +01:00
|
|
|
}
|
2011-12-03 22:43:27 +01:00
|
|
|
syscall_printf ("%R = getacl(%S)", pos, pc.get_nt_native_path ());
|
2001-04-20 15:02:32 +02:00
|
|
|
return pos;
|
|
|
|
|
}
|
|
|
|
|
|
2010-09-12 21:43:55 +02:00
|
|
|
extern "C" int
|
2013-04-23 11:44:36 +02:00
|
|
|
acl32 (const char *path, int cmd, int nentries, aclent_t *aclbufp)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2004-04-14 18:36:26 +02:00
|
|
|
int res = -1;
|
2010-09-12 21:43:55 +02:00
|
|
|
|
|
|
|
|
fhandler_base *fh = build_fh_name (path, PC_SYM_FOLLOW | PC_KEEP_HANDLE,
|
2010-06-15 14:05:15 +02:00
|
|
|
stat_suffixes);
|
2012-03-29 17:01:18 +02:00
|
|
|
if (!fh || !fh->exists ())
|
|
|
|
|
set_errno (ENOENT);
|
|
|
|
|
else if (fh->error ())
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2004-04-14 18:36:26 +02:00
|
|
|
debug_printf ("got %d error from build_fh_name", fh->error ());
|
|
|
|
|
set_errno (fh->error ());
|
2001-04-20 15:02:32 +02:00
|
|
|
}
|
2004-04-14 18:36:26 +02:00
|
|
|
else
|
|
|
|
|
res = fh->facl (cmd, nentries, aclbufp);
|
2004-04-14 23:11:45 +02:00
|
|
|
|
|
|
|
|
delete fh;
|
2011-12-03 22:43:27 +01:00
|
|
|
syscall_printf ("%R = acl(%s)", res, path);
|
2004-04-14 18:36:26 +02:00
|
|
|
return res;
|
2001-04-20 15:02:32 +02:00
|
|
|
}
|
|
|
|
|
|
2013-04-23 11:44:36 +02:00
|
|
|
#ifndef __x86_64__
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" int
|
2013-04-23 11:44:36 +02:00
|
|
|
lacl32 (const char *path, int cmd, int nentries, aclent_t *aclbufp)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2010-09-12 21:43:55 +02:00
|
|
|
/* This call was an accident. Make it absolutely clear. */
|
|
|
|
|
set_errno (ENOSYS);
|
|
|
|
|
return -1;
|
2001-04-20 15:02:32 +02:00
|
|
|
}
|
2013-04-23 11:44:36 +02:00
|
|
|
#endif
|
2001-04-20 15:02:32 +02:00
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" int
|
2013-04-23 11:44:36 +02:00
|
|
|
facl32 (int fd, int cmd, int nentries, aclent_t *aclbufp)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2001-10-16 01:39:33 +02:00
|
|
|
cygheap_fdget cfd (fd);
|
|
|
|
|
if (cfd < 0)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
|
|
|
|
syscall_printf ("-1 = facl (%d)", fd);
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
2004-04-14 18:36:26 +02:00
|
|
|
int res = cfd->facl (cmd, nentries, aclbufp);
|
2011-12-03 22:43:27 +01:00
|
|
|
syscall_printf ("%R = facl(%s) )", res, cfd->get_name ());
|
2004-04-14 18:36:26 +02:00
|
|
|
return res;
|
2001-04-20 15:02:32 +02:00
|
|
|
}
|
|
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" int
|
2013-04-23 11:44:36 +02:00
|
|
|
aclcheck32 (aclent_t *aclbufp, int nentries, int *which)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2003-12-07 23:37:12 +01:00
|
|
|
bool has_user_obj = false;
|
|
|
|
|
bool has_group_obj = false;
|
|
|
|
|
bool has_other_obj = false;
|
|
|
|
|
bool has_class_obj = false;
|
2013-04-23 11:44:36 +02:00
|
|
|
bool has_ug_objs __attribute__ ((unused)) = false;
|
2014-09-03 14:46:19 +02:00
|
|
|
bool has_def_objs __attribute__ ((unused)) = false;
|
2013-04-23 11:44:36 +02:00
|
|
|
bool has_def_user_obj __attribute__ ((unused)) = false;
|
2003-12-07 23:37:12 +01:00
|
|
|
bool has_def_group_obj = false;
|
|
|
|
|
bool has_def_other_obj = false;
|
|
|
|
|
bool has_def_class_obj = false;
|
2013-04-23 11:44:36 +02:00
|
|
|
bool has_def_ug_objs __attribute__ ((unused)) = false;
|
2001-04-20 15:02:32 +02:00
|
|
|
int pos2;
|
|
|
|
|
|
|
|
|
|
for (int pos = 0; pos < nentries; ++pos)
|
|
|
|
|
switch (aclbufp[pos].a_type)
|
|
|
|
|
{
|
|
|
|
|
case USER_OBJ:
|
|
|
|
|
if (has_user_obj)
|
|
|
|
|
{
|
|
|
|
|
if (which)
|
|
|
|
|
*which = pos;
|
|
|
|
|
return USER_ERROR;
|
|
|
|
|
}
|
2003-12-07 23:37:12 +01:00
|
|
|
has_user_obj = true;
|
2001-04-20 15:02:32 +02:00
|
|
|
break;
|
|
|
|
|
case GROUP_OBJ:
|
|
|
|
|
if (has_group_obj)
|
|
|
|
|
{
|
|
|
|
|
if (which)
|
|
|
|
|
*which = pos;
|
|
|
|
|
return GRP_ERROR;
|
|
|
|
|
}
|
2003-12-07 23:37:12 +01:00
|
|
|
has_group_obj = true;
|
2001-04-20 15:02:32 +02:00
|
|
|
break;
|
|
|
|
|
case OTHER_OBJ:
|
|
|
|
|
if (has_other_obj)
|
|
|
|
|
{
|
|
|
|
|
if (which)
|
|
|
|
|
*which = pos;
|
|
|
|
|
return OTHER_ERROR;
|
|
|
|
|
}
|
2003-12-07 23:37:12 +01:00
|
|
|
has_other_obj = true;
|
2001-04-20 15:02:32 +02:00
|
|
|
break;
|
|
|
|
|
case CLASS_OBJ:
|
|
|
|
|
if (has_class_obj)
|
|
|
|
|
{
|
|
|
|
|
if (which)
|
|
|
|
|
*which = pos;
|
|
|
|
|
return CLASS_ERROR;
|
|
|
|
|
}
|
2003-12-07 23:37:12 +01:00
|
|
|
has_class_obj = true;
|
2001-04-20 15:02:32 +02:00
|
|
|
break;
|
|
|
|
|
case USER:
|
|
|
|
|
case GROUP:
|
|
|
|
|
if ((pos2 = searchace (aclbufp + pos + 1, nentries - pos - 1,
|
|
|
|
|
aclbufp[pos].a_type, aclbufp[pos].a_id)) >= 0)
|
|
|
|
|
{
|
|
|
|
|
if (which)
|
|
|
|
|
*which = pos2;
|
|
|
|
|
return DUPLICATE_ERROR;
|
|
|
|
|
}
|
2003-12-07 23:37:12 +01:00
|
|
|
has_ug_objs = true;
|
2001-04-20 15:02:32 +02:00
|
|
|
break;
|
|
|
|
|
case DEF_USER_OBJ:
|
|
|
|
|
if (has_def_user_obj)
|
|
|
|
|
{
|
|
|
|
|
if (which)
|
|
|
|
|
*which = pos;
|
|
|
|
|
return USER_ERROR;
|
|
|
|
|
}
|
2014-09-03 14:46:19 +02:00
|
|
|
has_def_objs = has_def_user_obj = true;
|
2001-04-20 15:02:32 +02:00
|
|
|
break;
|
|
|
|
|
case DEF_GROUP_OBJ:
|
|
|
|
|
if (has_def_group_obj)
|
|
|
|
|
{
|
|
|
|
|
if (which)
|
|
|
|
|
*which = pos;
|
|
|
|
|
return GRP_ERROR;
|
|
|
|
|
}
|
2014-09-03 14:46:19 +02:00
|
|
|
has_def_objs = has_def_group_obj = true;
|
2001-04-20 15:02:32 +02:00
|
|
|
break;
|
|
|
|
|
case DEF_OTHER_OBJ:
|
|
|
|
|
if (has_def_other_obj)
|
|
|
|
|
{
|
|
|
|
|
if (which)
|
|
|
|
|
*which = pos;
|
|
|
|
|
return OTHER_ERROR;
|
|
|
|
|
}
|
2014-09-03 14:46:19 +02:00
|
|
|
has_def_objs = has_def_other_obj = true;
|
2001-04-20 15:02:32 +02:00
|
|
|
break;
|
|
|
|
|
case DEF_CLASS_OBJ:
|
|
|
|
|
if (has_def_class_obj)
|
|
|
|
|
{
|
|
|
|
|
if (which)
|
|
|
|
|
*which = pos;
|
|
|
|
|
return CLASS_ERROR;
|
|
|
|
|
}
|
2014-09-03 14:46:19 +02:00
|
|
|
has_def_objs = has_def_class_obj = true;
|
2001-04-20 15:02:32 +02:00
|
|
|
break;
|
|
|
|
|
case DEF_USER:
|
|
|
|
|
case DEF_GROUP:
|
|
|
|
|
if ((pos2 = searchace (aclbufp + pos + 1, nentries - pos - 1,
|
|
|
|
|
aclbufp[pos].a_type, aclbufp[pos].a_id)) >= 0)
|
|
|
|
|
{
|
|
|
|
|
if (which)
|
|
|
|
|
*which = pos2;
|
|
|
|
|
return DUPLICATE_ERROR;
|
|
|
|
|
}
|
2014-09-03 14:46:19 +02:00
|
|
|
has_def_objs = has_def_ug_objs = true;
|
2001-04-20 15:02:32 +02:00
|
|
|
break;
|
|
|
|
|
default:
|
|
|
|
|
return ENTRY_ERROR;
|
|
|
|
|
}
|
|
|
|
|
if (!has_user_obj
|
|
|
|
|
|| !has_group_obj
|
|
|
|
|
|| !has_other_obj
|
2014-09-03 14:46:19 +02:00
|
|
|
|| (has_def_objs
|
|
|
|
|
&& (!has_def_user_obj || !has_def_group_obj || !has_def_other_obj))
|
2001-04-20 15:02:32 +02:00
|
|
|
|| (has_ug_objs && !has_class_obj)
|
|
|
|
|
|| (has_def_ug_objs && !has_def_class_obj)
|
|
|
|
|
)
|
|
|
|
|
{
|
|
|
|
|
if (which)
|
|
|
|
|
*which = -1;
|
|
|
|
|
return MISS_ERROR;
|
|
|
|
|
}
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
static int
|
|
|
|
|
acecmp (const void *a1, const void *a2)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2013-04-23 11:44:36 +02:00
|
|
|
#define ace(i) ((const aclent_t *) a##i)
|
2002-09-22 05:38:57 +02:00
|
|
|
int ret = ace (1)->a_type - ace (2)->a_type;
|
2001-04-20 15:02:32 +02:00
|
|
|
if (!ret)
|
2002-09-22 05:38:57 +02:00
|
|
|
ret = ace (1)->a_id - ace (2)->a_id;
|
2001-04-20 15:02:32 +02:00
|
|
|
return ret;
|
|
|
|
|
#undef ace
|
|
|
|
|
}
|
|
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" int
|
2013-04-23 11:44:36 +02:00
|
|
|
aclsort32 (int nentries, int, aclent_t *aclbufp)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2003-02-05 17:15:22 +01:00
|
|
|
if (aclcheck32 (aclbufp, nentries, NULL))
|
2014-09-02 22:07:21 +02:00
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
2001-04-20 15:02:32 +02:00
|
|
|
if (!aclbufp || nentries < 1)
|
|
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
2013-04-23 11:44:36 +02:00
|
|
|
qsort ((void *) aclbufp, nentries, sizeof (aclent_t), acecmp);
|
2001-04-20 15:02:32 +02:00
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" int
|
2013-04-23 11:44:36 +02:00
|
|
|
acltomode32 (aclent_t *aclbufp, int nentries, mode_t *modep)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
|
|
|
|
int pos;
|
|
|
|
|
|
|
|
|
|
if (!aclbufp || nentries < 1 || !modep)
|
|
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
|
|
|
|
*modep = 0;
|
2002-11-24 19:58:47 +01:00
|
|
|
if ((pos = searchace (aclbufp, nentries, USER_OBJ)) < 0
|
|
|
|
|
|| !aclbufp[pos].a_type)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
2002-11-24 19:58:47 +01:00
|
|
|
*modep |= (aclbufp[pos].a_perm & S_IRWXO) << 6;
|
|
|
|
|
if ((pos = searchace (aclbufp, nentries, GROUP_OBJ)) < 0
|
|
|
|
|
|| !aclbufp[pos].a_type)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
2002-11-24 19:58:47 +01:00
|
|
|
*modep |= (aclbufp[pos].a_perm & S_IRWXO) << 3;
|
|
|
|
|
int cpos;
|
|
|
|
|
if ((cpos = searchace (aclbufp, nentries, CLASS_OBJ)) >= 0
|
|
|
|
|
&& aclbufp[cpos].a_type == CLASS_OBJ)
|
|
|
|
|
*modep |= ((aclbufp[pos].a_perm & S_IRWXO) & aclbufp[cpos].a_perm) << 3;
|
|
|
|
|
if ((pos = searchace (aclbufp, nentries, OTHER_OBJ)) < 0
|
|
|
|
|
|| !aclbufp[pos].a_type)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
2002-11-24 19:58:47 +01:00
|
|
|
*modep |= aclbufp[pos].a_perm & S_IRWXO;
|
2001-04-20 15:02:32 +02:00
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" int
|
2013-04-23 11:44:36 +02:00
|
|
|
aclfrommode32 (aclent_t *aclbufp, int nentries, mode_t *modep)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
|
|
|
|
int pos;
|
|
|
|
|
|
|
|
|
|
if (!aclbufp || nentries < 1 || !modep)
|
|
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
2002-11-24 19:58:47 +01:00
|
|
|
if ((pos = searchace (aclbufp, nentries, USER_OBJ)) < 0
|
|
|
|
|
|| !aclbufp[pos].a_type)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
2002-11-24 19:58:47 +01:00
|
|
|
aclbufp[pos].a_perm = (*modep & S_IRWXU) >> 6;
|
|
|
|
|
if ((pos = searchace (aclbufp, nentries, GROUP_OBJ)) < 0
|
|
|
|
|
|| !aclbufp[pos].a_type)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
2002-11-24 19:58:47 +01:00
|
|
|
aclbufp[pos].a_perm = (*modep & S_IRWXG) >> 3;
|
|
|
|
|
if ((pos = searchace (aclbufp, nentries, CLASS_OBJ)) >= 0
|
|
|
|
|
&& aclbufp[pos].a_type == CLASS_OBJ)
|
|
|
|
|
aclbufp[pos].a_perm = (*modep & S_IRWXG) >> 3;
|
|
|
|
|
if ((pos = searchace (aclbufp, nentries, OTHER_OBJ)) < 0
|
|
|
|
|
|| !aclbufp[pos].a_type)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
2002-11-24 19:58:47 +01:00
|
|
|
aclbufp[pos].a_perm = (*modep & S_IRWXO);
|
2001-04-20 15:02:32 +02:00
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" int
|
2013-04-23 11:44:36 +02:00
|
|
|
acltopbits32 (aclent_t *aclbufp, int nentries, mode_t *pbitsp)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2003-02-05 17:15:22 +01:00
|
|
|
return acltomode32 (aclbufp, nentries, pbitsp);
|
2001-04-20 15:02:32 +02:00
|
|
|
}
|
|
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" int
|
2013-04-23 11:44:36 +02:00
|
|
|
aclfrompbits32 (aclent_t *aclbufp, int nentries, mode_t *pbitsp)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
2003-02-05 17:15:22 +01:00
|
|
|
return aclfrommode32 (aclbufp, nentries, pbitsp);
|
2001-04-20 15:02:32 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static char *
|
|
|
|
|
permtostr (mode_t perm)
|
|
|
|
|
{
|
|
|
|
|
static char pbuf[4];
|
|
|
|
|
|
2002-11-24 19:58:47 +01:00
|
|
|
pbuf[0] = (perm & S_IROTH) ? 'r' : '-';
|
|
|
|
|
pbuf[1] = (perm & S_IWOTH) ? 'w' : '-';
|
|
|
|
|
pbuf[2] = (perm & S_IXOTH) ? 'x' : '-';
|
2001-04-20 15:02:32 +02:00
|
|
|
pbuf[3] = '\0';
|
|
|
|
|
return pbuf;
|
|
|
|
|
}
|
|
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" char *
|
2013-04-23 11:44:36 +02:00
|
|
|
acltotext32 (aclent_t *aclbufp, int aclcnt)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
|
|
|
|
if (!aclbufp || aclcnt < 1 || aclcnt > MAX_ACL_ENTRIES
|
2003-02-05 17:15:22 +01:00
|
|
|
|| aclcheck32 (aclbufp, aclcnt, NULL))
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
char buf[32000];
|
|
|
|
|
buf[0] = '\0';
|
2003-12-07 23:37:12 +01:00
|
|
|
bool first = true;
|
2001-04-20 15:02:32 +02:00
|
|
|
|
|
|
|
|
for (int pos = 0; pos < aclcnt; ++pos)
|
|
|
|
|
{
|
|
|
|
|
if (!first)
|
|
|
|
|
strcat (buf, ",");
|
2003-12-07 23:37:12 +01:00
|
|
|
first = false;
|
2001-04-20 15:02:32 +02:00
|
|
|
if (aclbufp[pos].a_type & ACL_DEFAULT)
|
|
|
|
|
strcat (buf, "default");
|
2006-07-18 16:11:38 +02:00
|
|
|
switch (aclbufp[pos].a_type & ~ACL_DEFAULT)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
|
|
|
|
case USER_OBJ:
|
|
|
|
|
__small_sprintf (buf + strlen (buf), "user::%s",
|
|
|
|
|
permtostr (aclbufp[pos].a_perm));
|
|
|
|
|
break;
|
|
|
|
|
case USER:
|
|
|
|
|
__small_sprintf (buf + strlen (buf), "user:%d:%s",
|
|
|
|
|
aclbufp[pos].a_id, permtostr (aclbufp[pos].a_perm));
|
|
|
|
|
break;
|
|
|
|
|
case GROUP_OBJ:
|
|
|
|
|
__small_sprintf (buf + strlen (buf), "group::%s",
|
|
|
|
|
permtostr (aclbufp[pos].a_perm));
|
|
|
|
|
break;
|
|
|
|
|
case GROUP:
|
|
|
|
|
__small_sprintf (buf + strlen (buf), "group:%d:%s",
|
|
|
|
|
aclbufp[pos].a_id, permtostr (aclbufp[pos].a_perm));
|
|
|
|
|
break;
|
|
|
|
|
case CLASS_OBJ:
|
|
|
|
|
__small_sprintf (buf + strlen (buf), "mask::%s",
|
|
|
|
|
permtostr (aclbufp[pos].a_perm));
|
|
|
|
|
break;
|
|
|
|
|
case OTHER_OBJ:
|
|
|
|
|
__small_sprintf (buf + strlen (buf), "other::%s",
|
|
|
|
|
permtostr (aclbufp[pos].a_perm));
|
|
|
|
|
break;
|
|
|
|
|
default:
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
return strdup (buf);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static mode_t
|
|
|
|
|
permfromstr (char *perm)
|
|
|
|
|
{
|
|
|
|
|
mode_t mode = 0;
|
|
|
|
|
|
|
|
|
|
if (strlen (perm) != 3)
|
|
|
|
|
return 01000;
|
|
|
|
|
if (perm[0] == 'r')
|
2002-11-24 19:58:47 +01:00
|
|
|
mode |= S_IROTH;
|
2001-04-20 15:02:32 +02:00
|
|
|
else if (perm[0] != '-')
|
|
|
|
|
return 01000;
|
|
|
|
|
if (perm[1] == 'w')
|
2002-11-24 19:58:47 +01:00
|
|
|
mode |= S_IWOTH;
|
2001-04-20 15:02:32 +02:00
|
|
|
else if (perm[1] != '-')
|
|
|
|
|
return 01000;
|
|
|
|
|
if (perm[2] == 'x')
|
2002-11-24 19:58:47 +01:00
|
|
|
mode |= S_IXOTH;
|
2001-04-20 15:02:32 +02:00
|
|
|
else if (perm[2] != '-')
|
|
|
|
|
return 01000;
|
|
|
|
|
return mode;
|
|
|
|
|
}
|
|
|
|
|
|
2013-04-23 11:44:36 +02:00
|
|
|
extern "C" aclent_t *
|
2003-02-05 17:15:22 +01:00
|
|
|
aclfromtext32 (char *acltextp, int *)
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
|
|
|
|
if (!acltextp)
|
|
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
char buf[strlen (acltextp) + 1];
|
2013-04-23 11:44:36 +02:00
|
|
|
aclent_t lacl[MAX_ACL_ENTRIES];
|
2001-04-20 15:02:32 +02:00
|
|
|
memset (lacl, 0, sizeof lacl);
|
|
|
|
|
int pos = 0;
|
|
|
|
|
strcpy (buf, acltextp);
|
|
|
|
|
char *lasts;
|
2014-02-27 13:57:27 +01:00
|
|
|
cyg_ldap cldap;
|
2001-04-20 15:02:32 +02:00
|
|
|
for (char *c = strtok_r (buf, ",", &lasts);
|
|
|
|
|
c;
|
|
|
|
|
c = strtok_r (NULL, ",", &lasts))
|
|
|
|
|
{
|
|
|
|
|
if (!strncmp (c, "default", 7))
|
|
|
|
|
{
|
|
|
|
|
lacl[pos].a_type |= ACL_DEFAULT;
|
|
|
|
|
c += 7;
|
|
|
|
|
}
|
|
|
|
|
if (!strncmp (c, "user:", 5))
|
|
|
|
|
{
|
|
|
|
|
if (c[5] == ':')
|
|
|
|
|
lacl[pos].a_type |= USER_OBJ;
|
|
|
|
|
else
|
|
|
|
|
{
|
|
|
|
|
lacl[pos].a_type |= USER;
|
|
|
|
|
c += 5;
|
|
|
|
|
if (isalpha (*c))
|
|
|
|
|
{
|
2014-02-27 13:57:27 +01:00
|
|
|
struct passwd *pw = internal_getpwnam (c, &cldap);
|
2001-04-20 15:02:32 +02:00
|
|
|
if (!pw)
|
|
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
lacl[pos].a_id = pw->pw_uid;
|
2012-10-27 14:09:38 +02:00
|
|
|
c = strchrnul (c, ':');
|
2001-04-20 15:02:32 +02:00
|
|
|
}
|
|
|
|
|
else if (isdigit (*c))
|
|
|
|
|
lacl[pos].a_id = strtol (c, &c, 10);
|
2003-02-05 17:15:22 +01:00
|
|
|
if (*c != ':')
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
else if (!strncmp (c, "group:", 6))
|
|
|
|
|
{
|
|
|
|
|
if (c[5] == ':')
|
|
|
|
|
lacl[pos].a_type |= GROUP_OBJ;
|
|
|
|
|
else
|
|
|
|
|
{
|
|
|
|
|
lacl[pos].a_type |= GROUP;
|
|
|
|
|
c += 5;
|
|
|
|
|
if (isalpha (*c))
|
|
|
|
|
{
|
2014-02-27 13:57:27 +01:00
|
|
|
struct group *gr = internal_getgrnam (c, &cldap);
|
2001-04-20 15:02:32 +02:00
|
|
|
if (!gr)
|
|
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
lacl[pos].a_id = gr->gr_gid;
|
2012-10-27 14:09:38 +02:00
|
|
|
c = strchrnul (c, ':');
|
2001-04-20 15:02:32 +02:00
|
|
|
}
|
|
|
|
|
else if (isdigit (*c))
|
|
|
|
|
lacl[pos].a_id = strtol (c, &c, 10);
|
2003-02-05 17:15:22 +01:00
|
|
|
if (*c != ':')
|
2001-04-20 15:02:32 +02:00
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
else if (!strncmp (c, "mask:", 5))
|
|
|
|
|
{
|
|
|
|
|
if (c[5] == ':')
|
|
|
|
|
lacl[pos].a_type |= CLASS_OBJ;
|
|
|
|
|
else
|
|
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
else if (!strncmp (c, "other:", 6))
|
|
|
|
|
{
|
|
|
|
|
if (c[5] == ':')
|
|
|
|
|
lacl[pos].a_type |= OTHER_OBJ;
|
|
|
|
|
else
|
|
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
if ((lacl[pos].a_perm = permfromstr (c)) == 01000)
|
|
|
|
|
{
|
|
|
|
|
set_errno (EINVAL);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
++pos;
|
|
|
|
|
}
|
2013-04-23 11:44:36 +02:00
|
|
|
aclent_t *aclp = (aclent_t *) malloc (pos * sizeof (aclent_t));
|
2001-04-20 15:02:32 +02:00
|
|
|
if (aclp)
|
2013-04-23 11:44:36 +02:00
|
|
|
memcpy (aclp, lacl, pos * sizeof (aclent_t));
|
2001-04-20 15:02:32 +02:00
|
|
|
return aclp;
|
|
|
|
|
}
|
|
|
|
|
|
2013-04-23 11:44:36 +02:00
|
|
|
#ifdef __x86_64__
|
|
|
|
|
EXPORT_ALIAS (acl32, acl)
|
|
|
|
|
EXPORT_ALIAS (facl32, facl)
|
|
|
|
|
EXPORT_ALIAS (aclcheck32, aclcheck)
|
|
|
|
|
EXPORT_ALIAS (aclsort32, aclsort)
|
|
|
|
|
EXPORT_ALIAS (acltomode32, acltomode)
|
|
|
|
|
EXPORT_ALIAS (aclfrommode32, aclfrommode)
|
|
|
|
|
EXPORT_ALIAS (acltopbits32, acltopbits)
|
|
|
|
|
EXPORT_ALIAS (aclfrompbits32, aclfrompbits)
|
|
|
|
|
EXPORT_ALIAS (acltotext32, acltotext)
|
|
|
|
|
EXPORT_ALIAS (aclfromtext32, aclfromtext)
|
|
|
|
|
#else
|
|
|
|
|
/* __aclent16_t and aclent_t have same size and same member offsets */
|
|
|
|
|
static aclent_t *
|
2003-02-05 17:15:22 +01:00
|
|
|
acl16to32 (__aclent16_t *aclbufp, int nentries)
|
|
|
|
|
{
|
2013-04-23 11:44:36 +02:00
|
|
|
aclent_t *aclbufp32 = (aclent_t *) aclbufp;
|
2003-02-05 17:15:22 +01:00
|
|
|
if (aclbufp32)
|
|
|
|
|
for (int i = 0; i < nentries; i++)
|
|
|
|
|
aclbufp32[i].a_id &= USHRT_MAX;
|
|
|
|
|
return aclbufp32;
|
|
|
|
|
}
|
|
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" int
|
2003-02-05 17:15:22 +01:00
|
|
|
acl (const char *path, int cmd, int nentries, __aclent16_t *aclbufp)
|
|
|
|
|
{
|
|
|
|
|
return acl32 (path, cmd, nentries, acl16to32 (aclbufp, nentries));
|
|
|
|
|
}
|
|
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" int
|
2003-02-05 17:15:22 +01:00
|
|
|
facl (int fd, int cmd, int nentries, __aclent16_t *aclbufp)
|
|
|
|
|
{
|
|
|
|
|
return facl32 (fd, cmd, nentries, acl16to32 (aclbufp, nentries));
|
|
|
|
|
}
|
|
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" int
|
2003-02-05 17:15:22 +01:00
|
|
|
lacl (const char *path, int cmd, int nentries, __aclent16_t *aclbufp)
|
|
|
|
|
{
|
2010-09-12 21:43:55 +02:00
|
|
|
/* This call was an accident. Make it absolutely clear. */
|
|
|
|
|
set_errno (ENOSYS);
|
|
|
|
|
return -1;
|
2003-02-05 17:15:22 +01:00
|
|
|
}
|
|
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" int
|
2003-02-05 17:15:22 +01:00
|
|
|
aclcheck (__aclent16_t *aclbufp, int nentries, int *which)
|
|
|
|
|
{
|
|
|
|
|
return aclcheck32 (acl16to32 (aclbufp, nentries), nentries, which);
|
|
|
|
|
}
|
|
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" int
|
2003-02-05 17:15:22 +01:00
|
|
|
aclsort (int nentries, int i, __aclent16_t *aclbufp)
|
|
|
|
|
{
|
|
|
|
|
return aclsort32 (nentries, i, acl16to32 (aclbufp, nentries));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" int
|
2003-02-05 17:15:22 +01:00
|
|
|
acltomode (__aclent16_t *aclbufp, int nentries, mode_t *modep)
|
|
|
|
|
{
|
|
|
|
|
return acltomode32 (acl16to32 (aclbufp, nentries), nentries, modep);
|
|
|
|
|
}
|
|
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" int
|
2003-02-05 17:15:22 +01:00
|
|
|
aclfrommode (__aclent16_t *aclbufp, int nentries, mode_t *modep)
|
|
|
|
|
{
|
2013-04-23 11:44:36 +02:00
|
|
|
return aclfrommode32 ((aclent_t *)aclbufp, nentries, modep);
|
2003-02-05 17:15:22 +01:00
|
|
|
}
|
|
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" int
|
2003-02-05 17:15:22 +01:00
|
|
|
acltopbits (__aclent16_t *aclbufp, int nentries, mode_t *pbitsp)
|
|
|
|
|
{
|
|
|
|
|
return acltopbits32 (acl16to32 (aclbufp, nentries), nentries, pbitsp);
|
|
|
|
|
}
|
|
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" int
|
2003-02-05 17:15:22 +01:00
|
|
|
aclfrompbits (__aclent16_t *aclbufp, int nentries, mode_t *pbitsp)
|
|
|
|
|
{
|
2013-04-23 11:44:36 +02:00
|
|
|
return aclfrompbits32 ((aclent_t *)aclbufp, nentries, pbitsp);
|
2003-02-05 17:15:22 +01:00
|
|
|
}
|
|
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" char *
|
2003-02-05 17:15:22 +01:00
|
|
|
acltotext (__aclent16_t *aclbufp, int aclcnt)
|
|
|
|
|
{
|
|
|
|
|
return acltotext32 (acl16to32 (aclbufp, aclcnt), aclcnt);
|
|
|
|
|
}
|
|
|
|
|
|
2003-03-09 21:10:25 +01:00
|
|
|
extern "C" __aclent16_t *
|
2003-02-05 17:15:22 +01:00
|
|
|
aclfromtext (char *acltextp, int * aclcnt)
|
|
|
|
|
{
|
|
|
|
|
return (__aclent16_t *) aclfromtext32 (acltextp, aclcnt);
|
|
|
|
|
}
|
2013-04-23 11:44:36 +02:00
|
|
|
#endif /* !__x86_64__ */
|