5185 lines
132 KiB
C
5185 lines
132 KiB
C
/**
|
|
* security.c - Handling security/ACLs in NTFS. Originated from the Linux-NTFS project.
|
|
*
|
|
* Copyright (c) 2004 Anton Altaparmakov
|
|
* Copyright (c) 2005-2006 Szabolcs Szakacsits
|
|
* Copyright (c) 2006 Yura Pakhuchiy
|
|
* Copyright (c) 2007-2009 Jean-Pierre Andre
|
|
*
|
|
* This program/include file is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public License as published
|
|
* by the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program/include file is distributed in the hope that it will be
|
|
* useful, but WITHOUT ANY WARRANTY; without even the implied warranty
|
|
* of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program (in the main directory of the NTFS-3G
|
|
* distribution in the file COPYING); if not, write to the Free Software
|
|
* Foundation,Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
*/
|
|
|
|
#ifdef HAVE_CONFIG_H
|
|
#include "config.h"
|
|
#endif
|
|
|
|
#ifdef HAVE_STDIO_H
|
|
#include <stdio.h>
|
|
#endif
|
|
#ifdef HAVE_STDLIB_H
|
|
#include <stdlib.h>
|
|
#endif
|
|
#ifdef HAVE_STRING_H
|
|
#include <string.h>
|
|
#endif
|
|
#ifdef HAVE_ERRNO_H
|
|
#include <errno.h>
|
|
#endif
|
|
#ifdef HAVE_FCNTL_H
|
|
#include <fcntl.h>
|
|
#endif
|
|
#ifdef HAVE_SETXATTR
|
|
#include <sys/xattr.h>
|
|
#endif
|
|
#ifdef HAVE_SYS_STAT_H
|
|
#include <sys/stat.h>
|
|
#endif
|
|
|
|
#include <unistd.h>
|
|
#include <pwd.h>
|
|
#include <grp.h>
|
|
|
|
#include "param.h"
|
|
#include "types.h"
|
|
#include "layout.h"
|
|
#include "attrib.h"
|
|
#include "index.h"
|
|
#include "dir.h"
|
|
#include "bitmap.h"
|
|
#include "security.h"
|
|
#include "acls.h"
|
|
#include "cache.h"
|
|
#include "misc.h"
|
|
|
|
/*
|
|
* JPA NTFS constants or structs
|
|
* should be moved to layout.h
|
|
*/
|
|
|
|
#define ALIGN_SDS_BLOCK 0x40000 /* Alignment for a $SDS block */
|
|
#define ALIGN_SDS_ENTRY 16 /* Alignment for a $SDS entry */
|
|
#define STUFFSZ 0x4000 /* unitary stuffing size for $SDS */
|
|
#define FIRST_SECURITY_ID 0x100 /* Lowest security id */
|
|
|
|
/* Mask for attributes which can be forced */
|
|
#define FILE_ATTR_SETTABLE ( FILE_ATTR_READONLY \
|
|
| FILE_ATTR_HIDDEN \
|
|
| FILE_ATTR_SYSTEM \
|
|
| FILE_ATTR_ARCHIVE \
|
|
| FILE_ATTR_TEMPORARY \
|
|
| FILE_ATTR_OFFLINE \
|
|
| FILE_ATTR_NOT_CONTENT_INDEXED )
|
|
|
|
struct SII { /* this is an image of an $SII index entry */
|
|
le16 offs;
|
|
le16 size;
|
|
le32 fill1;
|
|
le16 indexsz;
|
|
le16 indexksz;
|
|
le16 flags;
|
|
le16 fill2;
|
|
le32 keysecurid;
|
|
|
|
/* did not find official description for the following */
|
|
le32 hash;
|
|
le32 securid;
|
|
le32 dataoffsl; /* documented as badly aligned */
|
|
le32 dataoffsh;
|
|
le32 datasize;
|
|
} ;
|
|
|
|
struct SDH { /* this is an image of an $SDH index entry */
|
|
le16 offs;
|
|
le16 size;
|
|
le32 fill1;
|
|
le16 indexsz;
|
|
le16 indexksz;
|
|
le16 flags;
|
|
le16 fill2;
|
|
le32 keyhash;
|
|
le32 keysecurid;
|
|
|
|
/* did not find official description for the following */
|
|
le32 hash;
|
|
le32 securid;
|
|
le32 dataoffsl;
|
|
le32 dataoffsh;
|
|
le32 datasize;
|
|
le32 fill3;
|
|
} ;
|
|
|
|
/*
|
|
* A few useful constants
|
|
*/
|
|
|
|
static ntfschar sii_stream[] = { const_cpu_to_le16('$'),
|
|
const_cpu_to_le16('S'),
|
|
const_cpu_to_le16('I'),
|
|
const_cpu_to_le16('I'),
|
|
const_cpu_to_le16(0) };
|
|
static ntfschar sdh_stream[] = { const_cpu_to_le16('$'),
|
|
const_cpu_to_le16('S'),
|
|
const_cpu_to_le16('D'),
|
|
const_cpu_to_le16('H'),
|
|
const_cpu_to_le16(0) };
|
|
|
|
/*
|
|
* null SID (S-1-0-0)
|
|
*/
|
|
|
|
extern const SID *nullsid;
|
|
|
|
/*
|
|
* The zero GUID.
|
|
*/
|
|
|
|
static const GUID __zero_guid = { const_cpu_to_le32(0), const_cpu_to_le16(0),
|
|
const_cpu_to_le16(0), { 0, 0, 0, 0, 0, 0, 0, 0 } };
|
|
static const GUID *const zero_guid = &__zero_guid;
|
|
|
|
/**
|
|
* ntfs_guid_is_zero - check if a GUID is zero
|
|
* @guid: [IN] guid to check
|
|
*
|
|
* Return TRUE if @guid is a valid pointer to a GUID and it is the zero GUID
|
|
* and FALSE otherwise.
|
|
*/
|
|
BOOL ntfs_guid_is_zero(const GUID *guid)
|
|
{
|
|
return (memcmp(guid, zero_guid, sizeof(*zero_guid)));
|
|
}
|
|
|
|
/**
|
|
* ntfs_guid_to_mbs - convert a GUID to a multi byte string
|
|
* @guid: [IN] guid to convert
|
|
* @guid_str: [OUT] string in which to return the GUID (optional)
|
|
*
|
|
* Convert the GUID pointed to by @guid to a multi byte string of the form
|
|
* "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX". Therefore, @guid_str (if not NULL)
|
|
* needs to be able to store at least 37 bytes.
|
|
*
|
|
* If @guid_str is not NULL it will contain the converted GUID on return. If
|
|
* it is NULL a string will be allocated and this will be returned. The caller
|
|
* is responsible for free()ing the string in that case.
|
|
*
|
|
* On success return the converted string and on failure return NULL with errno
|
|
* set to the error code.
|
|
*/
|
|
char *ntfs_guid_to_mbs(const GUID *guid, char *guid_str)
|
|
{
|
|
char *_guid_str;
|
|
int res;
|
|
|
|
if (!guid) {
|
|
errno = EINVAL;
|
|
return NULL;
|
|
}
|
|
_guid_str = guid_str;
|
|
if (!_guid_str) {
|
|
_guid_str = (char*)ntfs_malloc(37);
|
|
if (!_guid_str)
|
|
return _guid_str;
|
|
}
|
|
res = snprintf(_guid_str, 37,
|
|
"%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
|
|
(unsigned int)le32_to_cpu(guid->data1),
|
|
le16_to_cpu(guid->data2), le16_to_cpu(guid->data3),
|
|
guid->data4[0], guid->data4[1],
|
|
guid->data4[2], guid->data4[3], guid->data4[4],
|
|
guid->data4[5], guid->data4[6], guid->data4[7]);
|
|
if (res == 36)
|
|
return _guid_str;
|
|
if (!guid_str)
|
|
free(_guid_str);
|
|
errno = EINVAL;
|
|
return NULL;
|
|
}
|
|
|
|
/**
|
|
* ntfs_sid_to_mbs_size - determine maximum size for the string of a SID
|
|
* @sid: [IN] SID for which to determine the maximum string size
|
|
*
|
|
* Determine the maximum multi byte string size in bytes which is needed to
|
|
* store the standard textual representation of the SID pointed to by @sid.
|
|
* See ntfs_sid_to_mbs(), below.
|
|
*
|
|
* On success return the maximum number of bytes needed to store the multi byte
|
|
* string and on failure return -1 with errno set to the error code.
|
|
*/
|
|
int ntfs_sid_to_mbs_size(const SID *sid)
|
|
{
|
|
int size, i;
|
|
|
|
if (!ntfs_sid_is_valid(sid)) {
|
|
errno = EINVAL;
|
|
return -1;
|
|
}
|
|
/* Start with "S-". */
|
|
size = 2;
|
|
/*
|
|
* Add the SID_REVISION. Hopefully the compiler will optimize this
|
|
* away as SID_REVISION is a constant.
|
|
*/
|
|
for (i = SID_REVISION; i > 0; i /= 10)
|
|
size++;
|
|
/* Add the "-". */
|
|
size++;
|
|
/*
|
|
* Add the identifier authority. If it needs to be in decimal, the
|
|
* maximum is 2^32-1 = 4294967295 = 10 characters. If it needs to be
|
|
* in hexadecimal, then maximum is 0x665544332211 = 14 characters.
|
|
*/
|
|
if (!sid->identifier_authority.high_part)
|
|
size += 10;
|
|
else
|
|
size += 14;
|
|
/*
|
|
* Finally, add the sub authorities. For each we have a "-" followed
|
|
* by a decimal which can be up to 2^32-1 = 4294967295 = 10 characters.
|
|
*/
|
|
size += (1 + 10) * sid->sub_authority_count;
|
|
/* We need the zero byte at the end, too. */
|
|
size++;
|
|
return size * sizeof(char);
|
|
}
|
|
|
|
/**
|
|
* ntfs_sid_to_mbs - convert a SID to a multi byte string
|
|
* @sid: [IN] SID to convert
|
|
* @sid_str: [OUT] string in which to return the SID (optional)
|
|
* @sid_str_size: [IN] size in bytes of @sid_str
|
|
*
|
|
* Convert the SID pointed to by @sid to its standard textual representation.
|
|
* @sid_str (if not NULL) needs to be able to store at least
|
|
* ntfs_sid_to_mbs_size() bytes. @sid_str_size is the size in bytes of
|
|
* @sid_str if @sid_str is not NULL.
|
|
*
|
|
* The standard textual representation of the SID is of the form:
|
|
* S-R-I-S-S...
|
|
* Where:
|
|
* - The first "S" is the literal character 'S' identifying the following
|
|
* digits as a SID.
|
|
* - R is the revision level of the SID expressed as a sequence of digits
|
|
* in decimal.
|
|
* - I is the 48-bit identifier_authority, expressed as digits in decimal,
|
|
* if I < 2^32, or hexadecimal prefixed by "0x", if I >= 2^32.
|
|
* - S... is one or more sub_authority values, expressed as digits in
|
|
* decimal.
|
|
*
|
|
* If @sid_str is not NULL it will contain the converted SUID on return. If it
|
|
* is NULL a string will be allocated and this will be returned. The caller is
|
|
* responsible for free()ing the string in that case.
|
|
*
|
|
* On success return the converted string and on failure return NULL with errno
|
|
* set to the error code.
|
|
*/
|
|
char *ntfs_sid_to_mbs(const SID *sid, char *sid_str, size_t sid_str_size)
|
|
{
|
|
u64 u;
|
|
le32 leauth;
|
|
char *s;
|
|
int i, j, cnt;
|
|
|
|
/*
|
|
* No need to check @sid if !@sid_str since ntfs_sid_to_mbs_size() will
|
|
* check @sid, too. 8 is the minimum SID string size.
|
|
*/
|
|
if (sid_str && (sid_str_size < 8 || !ntfs_sid_is_valid(sid))) {
|
|
errno = EINVAL;
|
|
return NULL;
|
|
}
|
|
/* Allocate string if not provided. */
|
|
if (!sid_str) {
|
|
cnt = ntfs_sid_to_mbs_size(sid);
|
|
if (cnt < 0)
|
|
return NULL;
|
|
s = (char*)ntfs_malloc(cnt);
|
|
if (!s)
|
|
return s;
|
|
sid_str = s;
|
|
/* So we know we allocated it. */
|
|
sid_str_size = 0;
|
|
} else {
|
|
s = sid_str;
|
|
cnt = sid_str_size;
|
|
}
|
|
/* Start with "S-R-". */
|
|
i = snprintf(s, cnt, "S-%hhu-", (unsigned char)sid->revision);
|
|
if (i < 0 || i >= cnt)
|
|
goto err_out;
|
|
s += i;
|
|
cnt -= i;
|
|
/* Add the identifier authority. */
|
|
for (u = i = 0, j = 40; i < 6; i++, j -= 8)
|
|
u += (u64)sid->identifier_authority.value[i] << j;
|
|
if (!sid->identifier_authority.high_part)
|
|
i = snprintf(s, cnt, "%lu", (unsigned long)u);
|
|
else
|
|
i = snprintf(s, cnt, "0x%llx", (unsigned long long)u);
|
|
if (i < 0 || i >= cnt)
|
|
goto err_out;
|
|
s += i;
|
|
cnt -= i;
|
|
/* Finally, add the sub authorities. */
|
|
for (j = 0; j < sid->sub_authority_count; j++) {
|
|
leauth = sid->sub_authority[j];
|
|
i = snprintf(s, cnt, "-%u", (unsigned int)
|
|
le32_to_cpu(leauth));
|
|
if (i < 0 || i >= cnt)
|
|
goto err_out;
|
|
s += i;
|
|
cnt -= i;
|
|
}
|
|
return sid_str;
|
|
err_out:
|
|
if (i >= cnt)
|
|
i = EMSGSIZE;
|
|
else
|
|
i = errno;
|
|
if (!sid_str_size)
|
|
free(sid_str);
|
|
errno = i;
|
|
return NULL;
|
|
}
|
|
|
|
/**
|
|
* ntfs_generate_guid - generatates a random current guid.
|
|
* @guid: [OUT] pointer to a GUID struct to hold the generated guid.
|
|
*
|
|
* perhaps not a very good random number generator though...
|
|
*/
|
|
void ntfs_generate_guid(GUID *guid)
|
|
{
|
|
unsigned int i;
|
|
u8 *p = (u8 *)guid;
|
|
|
|
for (i = 0; i < sizeof(GUID); i++) {
|
|
p[i] = (u8)(random() & 0xFF);
|
|
if (i == 7)
|
|
p[7] = (p[7] & 0x0F) | 0x40;
|
|
if (i == 8)
|
|
p[8] = (p[8] & 0x3F) | 0x80;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* ntfs_security_hash - calculate the hash of a security descriptor
|
|
* @sd: self-relative security descriptor whose hash to calculate
|
|
* @length: size in bytes of the security descritor @sd
|
|
*
|
|
* Calculate the hash of the self-relative security descriptor @sd of length
|
|
* @length bytes.
|
|
*
|
|
* This hash is used in the $Secure system file as the primary key for the $SDH
|
|
* index and is also stored in the header of each security descriptor in the
|
|
* $SDS data stream as well as in the index data of both the $SII and $SDH
|
|
* indexes. In all three cases it forms part of the SDS_ENTRY_HEADER
|
|
* structure.
|
|
*
|
|
* Return the calculated security hash in little endian.
|
|
*/
|
|
le32 ntfs_security_hash(const SECURITY_DESCRIPTOR_RELATIVE *sd, const u32 len)
|
|
{
|
|
const le32 *pos = (const le32*)sd;
|
|
const le32 *end = pos + (len >> 2);
|
|
u32 hash = 0;
|
|
|
|
while (pos < end) {
|
|
hash = le32_to_cpup(pos) + ntfs_rol32(hash, 3);
|
|
pos++;
|
|
}
|
|
return cpu_to_le32(hash);
|
|
}
|
|
|
|
/*
|
|
* Internal read
|
|
* copied and pasted from ntfs_fuse_read() and made independent
|
|
* of fuse context
|
|
*/
|
|
|
|
static int ntfs_local_read(ntfs_inode *ni,
|
|
ntfschar *stream_name, int stream_name_len,
|
|
char *buf, size_t size, off_t offset)
|
|
{
|
|
ntfs_attr *na = NULL;
|
|
int res, total = 0;
|
|
|
|
na = ntfs_attr_open(ni, AT_DATA, stream_name, stream_name_len);
|
|
if (!na) {
|
|
res = -errno;
|
|
goto exit;
|
|
}
|
|
if ((size_t)offset < (size_t)na->data_size) {
|
|
if (offset + size > (size_t)na->data_size)
|
|
size = na->data_size - offset;
|
|
while (size) {
|
|
res = ntfs_attr_pread(na, offset, size, buf);
|
|
if ((off_t)res < (off_t)size)
|
|
ntfs_log_perror("ntfs_attr_pread partial read "
|
|
"(%lld : %lld <> %d)",
|
|
(long long)offset,
|
|
(long long)size, res);
|
|
if (res <= 0) {
|
|
res = -errno;
|
|
goto exit;
|
|
}
|
|
size -= res;
|
|
offset += res;
|
|
total += res;
|
|
}
|
|
}
|
|
res = total;
|
|
exit:
|
|
if (na)
|
|
ntfs_attr_close(na);
|
|
return res;
|
|
}
|
|
|
|
|
|
/*
|
|
* Internal write
|
|
* copied and pasted from ntfs_fuse_write() and made independent
|
|
* of fuse context
|
|
*/
|
|
|
|
static int ntfs_local_write(ntfs_inode *ni,
|
|
ntfschar *stream_name, int stream_name_len,
|
|
char *buf, size_t size, off_t offset)
|
|
{
|
|
ntfs_attr *na = NULL;
|
|
int res, total = 0;
|
|
|
|
na = ntfs_attr_open(ni, AT_DATA, stream_name, stream_name_len);
|
|
if (!na) {
|
|
res = -errno;
|
|
goto exit;
|
|
}
|
|
while (size) {
|
|
res = ntfs_attr_pwrite(na, offset, size, buf);
|
|
if (res < (s64)size)
|
|
ntfs_log_perror("ntfs_attr_pwrite partial write (%lld: "
|
|
"%lld <> %d)", (long long)offset,
|
|
(long long)size, res);
|
|
if (res <= 0) {
|
|
res = -errno;
|
|
goto exit;
|
|
}
|
|
size -= res;
|
|
offset += res;
|
|
total += res;
|
|
}
|
|
res = total;
|
|
exit:
|
|
if (na)
|
|
ntfs_attr_close(na);
|
|
return res;
|
|
}
|
|
|
|
|
|
/*
|
|
* Get the first entry of current index block
|
|
* cut and pasted form ntfs_ie_get_first() in index.c
|
|
*/
|
|
|
|
static INDEX_ENTRY *ntfs_ie_get_first(INDEX_HEADER *ih)
|
|
{
|
|
return (INDEX_ENTRY*)((u8*)ih + le32_to_cpu(ih->entries_offset));
|
|
}
|
|
|
|
/*
|
|
* Stuff a 256KB block into $SDS before writing descriptors
|
|
* into the block.
|
|
*
|
|
* This prevents $SDS from being automatically declared as sparse
|
|
* when the second copy of the first security descriptor is written
|
|
* 256KB further ahead.
|
|
*
|
|
* Having $SDS declared as a sparse file is not wrong by itself
|
|
* and chkdsk leaves it as a sparse file. It does however complain
|
|
* and add a sparse flag (0x0200) into field file_attributes of
|
|
* STANDARD_INFORMATION of $Secure. This probably means that a
|
|
* sparse attribute (ATTR_IS_SPARSE) is only allowed in sparse
|
|
* files (FILE_ATTR_SPARSE_FILE).
|
|
*
|
|
* Windows normally does not convert to sparse attribute or sparse
|
|
* file. Stuffing is just a way to get to the same result.
|
|
*/
|
|
|
|
static int entersecurity_stuff(ntfs_volume *vol, off_t offs)
|
|
{
|
|
int res;
|
|
int written;
|
|
unsigned long total;
|
|
char *stuff;
|
|
|
|
res = 0;
|
|
total = 0;
|
|
stuff = (char*)ntfs_malloc(STUFFSZ);
|
|
if (stuff) {
|
|
memset(stuff, 0, STUFFSZ);
|
|
do {
|
|
written = ntfs_local_write(vol->secure_ni,
|
|
STREAM_SDS, 4, stuff, STUFFSZ, offs);
|
|
if (written == STUFFSZ) {
|
|
total += STUFFSZ;
|
|
offs += STUFFSZ;
|
|
} else {
|
|
errno = ENOSPC;
|
|
res = -1;
|
|
}
|
|
} while (!res && (total < ALIGN_SDS_BLOCK));
|
|
free(stuff);
|
|
} else {
|
|
errno = ENOMEM;
|
|
res = -1;
|
|
}
|
|
return (res);
|
|
}
|
|
|
|
/*
|
|
* Enter a new security descriptor into $Secure (data only)
|
|
* it has to be written twice with an offset of 256KB
|
|
*
|
|
* Should only be called by entersecurityattr() to ensure consistency
|
|
*
|
|
* Returns zero if sucessful
|
|
*/
|
|
|
|
static int entersecurity_data(ntfs_volume *vol,
|
|
const SECURITY_DESCRIPTOR_RELATIVE *attr, s64 attrsz,
|
|
le32 hash, le32 keyid, off_t offs, int gap)
|
|
{
|
|
int res;
|
|
int written1;
|
|
int written2;
|
|
char *fullattr;
|
|
int fullsz;
|
|
SECURITY_DESCRIPTOR_HEADER *phsds;
|
|
|
|
res = -1;
|
|
fullsz = attrsz + gap + sizeof(SECURITY_DESCRIPTOR_HEADER);
|
|
fullattr = (char*)ntfs_malloc(fullsz);
|
|
if (fullattr) {
|
|
/*
|
|
* Clear the gap from previous descriptor
|
|
* this could be useful for appending the second
|
|
* copy to the end of file. When creating a new
|
|
* 256K block, the gap is cleared while writing
|
|
* the first copy
|
|
*/
|
|
if (gap)
|
|
memset(fullattr,0,gap);
|
|
memcpy(&fullattr[gap + sizeof(SECURITY_DESCRIPTOR_HEADER)],
|
|
attr,attrsz);
|
|
phsds = (SECURITY_DESCRIPTOR_HEADER*)&fullattr[gap];
|
|
phsds->hash = hash;
|
|
phsds->security_id = keyid;
|
|
phsds->offset = cpu_to_le64(offs);
|
|
phsds->length = cpu_to_le32(fullsz - gap);
|
|
written1 = ntfs_local_write(vol->secure_ni,
|
|
STREAM_SDS, 4, fullattr, fullsz,
|
|
offs - gap);
|
|
written2 = ntfs_local_write(vol->secure_ni,
|
|
STREAM_SDS, 4, fullattr, fullsz,
|
|
offs - gap + ALIGN_SDS_BLOCK);
|
|
if ((written1 == fullsz)
|
|
&& (written2 == written1))
|
|
res = 0;
|
|
else
|
|
errno = ENOSPC;
|
|
free(fullattr);
|
|
} else
|
|
errno = ENOMEM;
|
|
return (res);
|
|
}
|
|
|
|
/*
|
|
* Enter a new security descriptor in $Secure (indexes only)
|
|
*
|
|
* Should only be called by entersecurityattr() to ensure consistency
|
|
*
|
|
* Returns zero if sucessful
|
|
*/
|
|
|
|
static int entersecurity_indexes(ntfs_volume *vol, s64 attrsz,
|
|
le32 hash, le32 keyid, off_t offs)
|
|
{
|
|
union {
|
|
struct {
|
|
le32 dataoffsl;
|
|
le32 dataoffsh;
|
|
} parts;
|
|
le64 all;
|
|
} realign;
|
|
int res;
|
|
ntfs_index_context *xsii;
|
|
ntfs_index_context *xsdh;
|
|
struct SII newsii;
|
|
struct SDH newsdh;
|
|
|
|
res = -1;
|
|
/* enter a new $SII record */
|
|
|
|
xsii = vol->secure_xsii;
|
|
ntfs_index_ctx_reinit(xsii);
|
|
newsii.offs = const_cpu_to_le16(20);
|
|
newsii.size = const_cpu_to_le16(sizeof(struct SII) - 20);
|
|
newsii.fill1 = const_cpu_to_le32(0);
|
|
newsii.indexsz = const_cpu_to_le16(sizeof(struct SII));
|
|
newsii.indexksz = const_cpu_to_le16(sizeof(SII_INDEX_KEY));
|
|
newsii.flags = const_cpu_to_le16(0);
|
|
newsii.fill2 = const_cpu_to_le16(0);
|
|
newsii.keysecurid = keyid;
|
|
newsii.hash = hash;
|
|
newsii.securid = keyid;
|
|
realign.all = cpu_to_le64(offs);
|
|
newsii.dataoffsh = realign.parts.dataoffsh;
|
|
newsii.dataoffsl = realign.parts.dataoffsl;
|
|
newsii.datasize = cpu_to_le32(attrsz
|
|
+ sizeof(SECURITY_DESCRIPTOR_HEADER));
|
|
if (!ntfs_ie_add(xsii,(INDEX_ENTRY*)&newsii)) {
|
|
|
|
/* enter a new $SDH record */
|
|
|
|
xsdh = vol->secure_xsdh;
|
|
ntfs_index_ctx_reinit(xsdh);
|
|
newsdh.offs = const_cpu_to_le16(24);
|
|
newsdh.size = const_cpu_to_le16(
|
|
sizeof(SECURITY_DESCRIPTOR_HEADER));
|
|
newsdh.fill1 = const_cpu_to_le32(0);
|
|
newsdh.indexsz = const_cpu_to_le16(
|
|
sizeof(struct SDH));
|
|
newsdh.indexksz = const_cpu_to_le16(
|
|
sizeof(SDH_INDEX_KEY));
|
|
newsdh.flags = const_cpu_to_le16(0);
|
|
newsdh.fill2 = const_cpu_to_le16(0);
|
|
newsdh.keyhash = hash;
|
|
newsdh.keysecurid = keyid;
|
|
newsdh.hash = hash;
|
|
newsdh.securid = keyid;
|
|
newsdh.dataoffsh = realign.parts.dataoffsh;
|
|
newsdh.dataoffsl = realign.parts.dataoffsl;
|
|
newsdh.datasize = cpu_to_le32(attrsz
|
|
+ sizeof(SECURITY_DESCRIPTOR_HEADER));
|
|
/* special filler value, Windows generally */
|
|
/* fills with 0x00490049, sometimes with zero */
|
|
newsdh.fill3 = const_cpu_to_le32(0x00490049);
|
|
if (!ntfs_ie_add(xsdh,(INDEX_ENTRY*)&newsdh))
|
|
res = 0;
|
|
}
|
|
return (res);
|
|
}
|
|
|
|
/*
|
|
* Enter a new security descriptor in $Secure (data and indexes)
|
|
* Returns id of entry, or zero if there is a problem.
|
|
* (should not be called for NTFS version < 3.0)
|
|
*
|
|
* important : calls have to be serialized, however no locking is
|
|
* needed while fuse is not multithreaded
|
|
*/
|
|
|
|
static le32 entersecurityattr(ntfs_volume *vol,
|
|
const SECURITY_DESCRIPTOR_RELATIVE *attr, s64 attrsz,
|
|
le32 hash)
|
|
{
|
|
union {
|
|
struct {
|
|
le32 dataoffsl;
|
|
le32 dataoffsh;
|
|
} parts;
|
|
le64 all;
|
|
} realign;
|
|
le32 securid;
|
|
le32 keyid;
|
|
u32 newkey;
|
|
off_t offs;
|
|
int gap;
|
|
int size;
|
|
BOOL found;
|
|
struct SII *psii;
|
|
INDEX_ENTRY *entry;
|
|
INDEX_ENTRY *next;
|
|
ntfs_index_context *xsii;
|
|
int retries;
|
|
ntfs_attr *na;
|
|
int olderrno;
|
|
|
|
/* find the first available securid beyond the last key */
|
|
/* in $Secure:$SII. This also determines the first */
|
|
/* available location in $Secure:$SDS, as this stream */
|
|
/* is always appended to and the id's are allocated */
|
|
/* in sequence */
|
|
|
|
securid = const_cpu_to_le32(0);
|
|
xsii = vol->secure_xsii;
|
|
ntfs_index_ctx_reinit(xsii);
|
|
offs = size = 0;
|
|
keyid = const_cpu_to_le32(-1);
|
|
olderrno = errno;
|
|
found = !ntfs_index_lookup((char*)&keyid,
|
|
sizeof(SII_INDEX_KEY), xsii);
|
|
if (!found && (errno != ENOENT)) {
|
|
ntfs_log_perror("Inconsistency in index $SII");
|
|
psii = (struct SII*)NULL;
|
|
} else {
|
|
/* restore errno to avoid misinterpretation */
|
|
errno = olderrno;
|
|
entry = xsii->entry;
|
|
psii = (struct SII*)xsii->entry;
|
|
}
|
|
if (psii) {
|
|
/*
|
|
* Get last entry in block, but must get first one
|
|
* one first, as we should already be beyond the
|
|
* last one. For some reason the search for the last
|
|
* entry sometimes does not return the last block...
|
|
* we assume this can only happen in root block
|
|
*/
|
|
if (xsii->is_in_root)
|
|
entry = ntfs_ie_get_first
|
|
((INDEX_HEADER*)&xsii->ir->index);
|
|
else
|
|
entry = ntfs_ie_get_first
|
|
((INDEX_HEADER*)&xsii->ib->index);
|
|
/*
|
|
* All index blocks should be at least half full
|
|
* so there always is a last entry but one,
|
|
* except when creating the first entry in index root.
|
|
* This was however found not to be true : chkdsk
|
|
* sometimes deletes all the (unused) keys in the last
|
|
* index block without rebalancing the tree.
|
|
* When this happens, a new search is restarted from
|
|
* the smallest key.
|
|
*/
|
|
keyid = const_cpu_to_le32(0);
|
|
retries = 0;
|
|
while (entry) {
|
|
next = ntfs_index_next(entry,xsii);
|
|
if (next) {
|
|
psii = (struct SII*)next;
|
|
/* save last key and */
|
|
/* available position */
|
|
keyid = psii->keysecurid;
|
|
realign.parts.dataoffsh
|
|
= psii->dataoffsh;
|
|
realign.parts.dataoffsl
|
|
= psii->dataoffsl;
|
|
offs = le64_to_cpu(realign.all);
|
|
size = le32_to_cpu(psii->datasize);
|
|
}
|
|
entry = next;
|
|
if (!entry && !keyid && !retries) {
|
|
/* search failed, retry from smallest key */
|
|
ntfs_index_ctx_reinit(xsii);
|
|
found = !ntfs_index_lookup((char*)&keyid,
|
|
sizeof(SII_INDEX_KEY), xsii);
|
|
if (!found && (errno != ENOENT)) {
|
|
ntfs_log_perror("Index $SII is broken");
|
|
} else {
|
|
/* restore errno */
|
|
errno = olderrno;
|
|
entry = xsii->entry;
|
|
}
|
|
retries++;
|
|
}
|
|
}
|
|
}
|
|
if (!keyid) {
|
|
/*
|
|
* could not find any entry, before creating the first
|
|
* entry, make a double check by making sure size of $SII
|
|
* is less than needed for one entry
|
|
*/
|
|
securid = const_cpu_to_le32(0);
|
|
na = ntfs_attr_open(vol->secure_ni,AT_INDEX_ROOT,sii_stream,4);
|
|
if (na) {
|
|
if ((size_t)na->data_size < sizeof(struct SII)) {
|
|
ntfs_log_error("Creating the first security_id\n");
|
|
securid = const_cpu_to_le32(FIRST_SECURITY_ID);
|
|
}
|
|
ntfs_attr_close(na);
|
|
}
|
|
if (!securid) {
|
|
ntfs_log_error("Error creating a security_id\n");
|
|
errno = EIO;
|
|
}
|
|
} else {
|
|
newkey = le32_to_cpu(keyid) + 1;
|
|
securid = cpu_to_le32(newkey);
|
|
}
|
|
/*
|
|
* The security attr has to be written twice 256KB
|
|
* apart. This implies that offsets like
|
|
* 0x40000*odd_integer must be left available for
|
|
* the second copy. So align to next block when
|
|
* the last byte overflows on a wrong block.
|
|
*/
|
|
|
|
if (securid) {
|
|
gap = (-size) & (ALIGN_SDS_ENTRY - 1);
|
|
offs += gap + size;
|
|
if ((offs + attrsz + sizeof(SECURITY_DESCRIPTOR_HEADER) - 1)
|
|
& ALIGN_SDS_BLOCK) {
|
|
offs = ((offs + attrsz
|
|
+ sizeof(SECURITY_DESCRIPTOR_HEADER) - 1)
|
|
| (ALIGN_SDS_BLOCK - 1)) + 1;
|
|
}
|
|
if (!(offs & (ALIGN_SDS_BLOCK - 1)))
|
|
entersecurity_stuff(vol, offs);
|
|
/*
|
|
* now write the security attr to storage :
|
|
* first data, then SII, then SDH
|
|
* If failure occurs while writing SDS, data will never
|
|
* be accessed through indexes, and will be overwritten
|
|
* by the next allocated descriptor
|
|
* If failure occurs while writing SII, the id has not
|
|
* recorded and will be reallocated later
|
|
* If failure occurs while writing SDH, the space allocated
|
|
* in SDS or SII will not be reused, an inconsistency
|
|
* will persist with no significant consequence
|
|
*/
|
|
if (entersecurity_data(vol, attr, attrsz, hash, securid, offs, gap)
|
|
|| entersecurity_indexes(vol, attrsz, hash, securid, offs))
|
|
securid = const_cpu_to_le32(0);
|
|
}
|
|
/* inode now is dirty, synchronize it all */
|
|
ntfs_index_entry_mark_dirty(vol->secure_xsii);
|
|
ntfs_index_ctx_reinit(vol->secure_xsii);
|
|
ntfs_index_entry_mark_dirty(vol->secure_xsdh);
|
|
ntfs_index_ctx_reinit(vol->secure_xsdh);
|
|
NInoSetDirty(vol->secure_ni);
|
|
if (ntfs_inode_sync(vol->secure_ni))
|
|
ntfs_log_perror("Could not sync $Secure\n");
|
|
return (securid);
|
|
}
|
|
|
|
/*
|
|
* Find a matching security descriptor in $Secure,
|
|
* if none, allocate a new id and write the descriptor to storage
|
|
* Returns id of entry, or zero if there is a problem.
|
|
*
|
|
* important : calls have to be serialized, however no locking is
|
|
* needed while fuse is not multithreaded
|
|
*/
|
|
|
|
static le32 setsecurityattr(ntfs_volume *vol,
|
|
const SECURITY_DESCRIPTOR_RELATIVE *attr, s64 attrsz)
|
|
{
|
|
struct SDH *psdh; /* this is an image of index (le) */
|
|
union {
|
|
struct {
|
|
le32 dataoffsl;
|
|
le32 dataoffsh;
|
|
} parts;
|
|
le64 all;
|
|
} realign;
|
|
BOOL found;
|
|
BOOL collision;
|
|
size_t size;
|
|
size_t rdsize;
|
|
s64 offs;
|
|
int res;
|
|
ntfs_index_context *xsdh;
|
|
char *oldattr;
|
|
SDH_INDEX_KEY key;
|
|
INDEX_ENTRY *entry;
|
|
le32 securid;
|
|
le32 hash;
|
|
int olderrno;
|
|
|
|
hash = ntfs_security_hash(attr,attrsz);
|
|
oldattr = (char*)NULL;
|
|
securid = const_cpu_to_le32(0);
|
|
res = 0;
|
|
xsdh = vol->secure_xsdh;
|
|
if (vol->secure_ni && xsdh && !vol->secure_reentry++) {
|
|
ntfs_index_ctx_reinit(xsdh);
|
|
/*
|
|
* find the nearest key as (hash,0)
|
|
* (do not search for partial key : in case of collision,
|
|
* it could return a key which is not the first one which
|
|
* collides)
|
|
*/
|
|
key.hash = hash;
|
|
key.security_id = const_cpu_to_le32(0);
|
|
olderrno = errno;
|
|
found = !ntfs_index_lookup((char*)&key,
|
|
sizeof(SDH_INDEX_KEY), xsdh);
|
|
if (!found && (errno != ENOENT))
|
|
ntfs_log_perror("Inconsistency in index $SDH");
|
|
else {
|
|
/* restore errno to avoid misinterpretation */
|
|
errno = olderrno;
|
|
entry = xsdh->entry;
|
|
found = FALSE;
|
|
/*
|
|
* lookup() may return a node with no data,
|
|
* if so get next
|
|
*/
|
|
if (entry->ie_flags & INDEX_ENTRY_END)
|
|
entry = ntfs_index_next(entry,xsdh);
|
|
do {
|
|
collision = FALSE;
|
|
psdh = (struct SDH*)entry;
|
|
if (psdh)
|
|
size = (size_t) le32_to_cpu(psdh->datasize)
|
|
- sizeof(SECURITY_DESCRIPTOR_HEADER);
|
|
else size = 0;
|
|
/* if hash is not the same, the key is not present */
|
|
if (psdh && (size > 0)
|
|
&& (psdh->keyhash == hash)) {
|
|
/* if hash is the same */
|
|
/* check the whole record */
|
|
realign.parts.dataoffsh = psdh->dataoffsh;
|
|
realign.parts.dataoffsl = psdh->dataoffsl;
|
|
offs = le64_to_cpu(realign.all)
|
|
+ sizeof(SECURITY_DESCRIPTOR_HEADER);
|
|
oldattr = (char*)ntfs_malloc(size);
|
|
if (oldattr) {
|
|
rdsize = ntfs_local_read(
|
|
vol->secure_ni,
|
|
STREAM_SDS, 4,
|
|
oldattr, size, offs);
|
|
found = (rdsize == size)
|
|
&& !memcmp(oldattr,attr,size);
|
|
free(oldattr);
|
|
/* if the records do not compare */
|
|
/* (hash collision), try next one */
|
|
if (!found) {
|
|
entry = ntfs_index_next(
|
|
entry,xsdh);
|
|
collision = TRUE;
|
|
}
|
|
} else
|
|
res = ENOMEM;
|
|
}
|
|
} while (collision && entry);
|
|
if (found)
|
|
securid = psdh->keysecurid;
|
|
else {
|
|
if (res) {
|
|
errno = res;
|
|
securid = const_cpu_to_le32(0);
|
|
} else {
|
|
/*
|
|
* no matching key :
|
|
* have to build a new one
|
|
*/
|
|
securid = entersecurityattr(vol,
|
|
attr, attrsz, hash);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
if (--vol->secure_reentry)
|
|
ntfs_log_perror("Reentry error, check no multithreading\n");
|
|
return (securid);
|
|
}
|
|
|
|
|
|
/*
|
|
* Update the security descriptor of a file
|
|
* Either as an attribute (complying with pre v3.x NTFS version)
|
|
* or, when possible, as an entry in $Secure (for NTFS v3.x)
|
|
*
|
|
* returns 0 if success
|
|
*/
|
|
|
|
static int update_secur_descr(ntfs_volume *vol,
|
|
char *newattr, ntfs_inode *ni)
|
|
{
|
|
int newattrsz;
|
|
int written;
|
|
int res;
|
|
ntfs_attr *na;
|
|
|
|
newattrsz = ntfs_attr_size(newattr);
|
|
|
|
#if !FORCE_FORMAT_v1x
|
|
if ((vol->major_ver < 3) || !vol->secure_ni) {
|
|
#endif
|
|
|
|
/* update for NTFS format v1.x */
|
|
|
|
/* update the old security attribute */
|
|
na = ntfs_attr_open(ni, AT_SECURITY_DESCRIPTOR, AT_UNNAMED, 0);
|
|
if (na) {
|
|
/* resize attribute */
|
|
res = ntfs_attr_truncate(na, (s64) newattrsz);
|
|
/* overwrite value */
|
|
if (!res) {
|
|
written = (int)ntfs_attr_pwrite(na, (s64) 0,
|
|
(s64) newattrsz, newattr);
|
|
if (written != newattrsz) {
|
|
ntfs_log_error("Failed to update "
|
|
"a v1.x security descriptor\n");
|
|
errno = EIO;
|
|
res = -1;
|
|
}
|
|
}
|
|
|
|
ntfs_attr_close(na);
|
|
/* if old security attribute was found, also */
|
|
/* truncate standard information attribute to v1.x */
|
|
/* this is needed when security data is wanted */
|
|
/* as v1.x though volume is formatted for v3.x */
|
|
na = ntfs_attr_open(ni, AT_STANDARD_INFORMATION,
|
|
AT_UNNAMED, 0);
|
|
if (na) {
|
|
clear_nino_flag(ni, v3_Extensions);
|
|
/*
|
|
* Truncating the record does not sweep extensions
|
|
* from copy in memory. Clear security_id to be safe
|
|
*/
|
|
ni->security_id = const_cpu_to_le32(0);
|
|
res = ntfs_attr_truncate(na, (s64)48);
|
|
ntfs_attr_close(na);
|
|
clear_nino_flag(ni, v3_Extensions);
|
|
}
|
|
} else {
|
|
/*
|
|
* insert the new security attribute if there
|
|
* were none
|
|
*/
|
|
res = ntfs_attr_add(ni, AT_SECURITY_DESCRIPTOR,
|
|
AT_UNNAMED, 0, (u8*)newattr,
|
|
(s64) newattrsz);
|
|
}
|
|
#if !FORCE_FORMAT_v1x
|
|
} else {
|
|
|
|
/* update for NTFS format v3.x */
|
|
|
|
le32 securid;
|
|
|
|
securid = setsecurityattr(vol,
|
|
(const SECURITY_DESCRIPTOR_RELATIVE*)newattr,
|
|
(s64)newattrsz);
|
|
if (securid) {
|
|
na = ntfs_attr_open(ni, AT_STANDARD_INFORMATION,
|
|
AT_UNNAMED, 0);
|
|
if (na) {
|
|
res = 0;
|
|
if (!test_nino_flag(ni, v3_Extensions)) {
|
|
/* expand standard information attribute to v3.x */
|
|
res = ntfs_attr_truncate(na,
|
|
(s64)sizeof(STANDARD_INFORMATION));
|
|
ni->owner_id = const_cpu_to_le32(0);
|
|
ni->quota_charged = const_cpu_to_le64(0);
|
|
ni->usn = const_cpu_to_le64(0);
|
|
ntfs_attr_remove(ni,
|
|
AT_SECURITY_DESCRIPTOR,
|
|
AT_UNNAMED, 0);
|
|
}
|
|
set_nino_flag(ni, v3_Extensions);
|
|
ni->security_id = securid;
|
|
ntfs_attr_close(na);
|
|
} else {
|
|
ntfs_log_error("Failed to update "
|
|
"standard informations\n");
|
|
errno = EIO;
|
|
res = -1;
|
|
}
|
|
} else
|
|
res = -1;
|
|
}
|
|
#endif
|
|
|
|
/* mark node as dirty */
|
|
NInoSetDirty(ni);
|
|
return (res);
|
|
}
|
|
|
|
/*
|
|
* Upgrade the security descriptor of a file
|
|
* This is intended to allow graceful upgrades for files which
|
|
* were created in previous versions, with a security attributes
|
|
* and no security id.
|
|
*
|
|
* It will allocate a security id and replace the individual
|
|
* security attribute by a reference to the global one
|
|
*
|
|
* Special files are not upgraded (currently / and files in
|
|
* directories /$*)
|
|
*
|
|
* Though most code is similar to update_secur_desc() it has
|
|
* been kept apart to facilitate the further processing of
|
|
* special cases or even to remove it if found dangerous.
|
|
*
|
|
* returns 0 if success,
|
|
* 1 if not upgradable. This is not an error.
|
|
* -1 if there is a problem
|
|
*/
|
|
|
|
static int upgrade_secur_desc(ntfs_volume *vol,
|
|
const char *attr, ntfs_inode *ni)
|
|
{
|
|
int attrsz;
|
|
int res;
|
|
le32 securid;
|
|
ntfs_attr *na;
|
|
|
|
/*
|
|
* upgrade requires NTFS format v3.x
|
|
* also refuse upgrading for special files
|
|
* whose number is less than FILE_first_user
|
|
*/
|
|
|
|
if ((vol->major_ver >= 3)
|
|
&& (ni->mft_no >= FILE_first_user)) {
|
|
attrsz = ntfs_attr_size(attr);
|
|
securid = setsecurityattr(vol,
|
|
(const SECURITY_DESCRIPTOR_RELATIVE*)attr,
|
|
(s64)attrsz);
|
|
if (securid) {
|
|
na = ntfs_attr_open(ni, AT_STANDARD_INFORMATION,
|
|
AT_UNNAMED, 0);
|
|
if (na) {
|
|
res = 0;
|
|
/* expand standard information attribute to v3.x */
|
|
res = ntfs_attr_truncate(na,
|
|
(s64)sizeof(STANDARD_INFORMATION));
|
|
ni->owner_id = const_cpu_to_le32(0);
|
|
ni->quota_charged = const_cpu_to_le64(0);
|
|
ni->usn = const_cpu_to_le64(0);
|
|
ntfs_attr_remove(ni, AT_SECURITY_DESCRIPTOR,
|
|
AT_UNNAMED, 0);
|
|
set_nino_flag(ni, v3_Extensions);
|
|
ni->security_id = securid;
|
|
ntfs_attr_close(na);
|
|
} else {
|
|
ntfs_log_error("Failed to upgrade "
|
|
"standard informations\n");
|
|
errno = EIO;
|
|
res = -1;
|
|
}
|
|
} else
|
|
res = -1;
|
|
/* mark node as dirty */
|
|
NInoSetDirty(ni);
|
|
} else
|
|
res = 1;
|
|
|
|
return (res);
|
|
}
|
|
|
|
/*
|
|
* Optional simplified checking of group membership
|
|
*
|
|
* This only takes into account the groups defined in
|
|
* /etc/group at initialization time.
|
|
* It does not take into account the groups dynamically set by
|
|
* setgroups() nor the changes in /etc/group since initialization
|
|
*
|
|
* This optional method could be useful if standard checking
|
|
* leads to a performance concern.
|
|
*
|
|
* Should not be called for user root, however the group may be root
|
|
*
|
|
*/
|
|
|
|
static BOOL staticgroupmember(struct SECURITY_CONTEXT *scx, uid_t uid, gid_t gid)
|
|
{
|
|
BOOL ingroup;
|
|
int grcnt;
|
|
gid_t *groups;
|
|
struct MAPPING *user;
|
|
|
|
ingroup = FALSE;
|
|
if (uid) {
|
|
user = scx->mapping[MAPUSERS];
|
|
while (user && ((uid_t)user->xid != uid))
|
|
user = user->next;
|
|
if (user) {
|
|
groups = user->groups;
|
|
grcnt = user->grcnt;
|
|
while ((--grcnt >= 0) && (groups[grcnt] != gid)) { }
|
|
ingroup = (grcnt >= 0);
|
|
}
|
|
}
|
|
return (ingroup);
|
|
}
|
|
|
|
|
|
/*
|
|
* Check whether current thread owner is member of file group
|
|
*
|
|
* Should not be called for user root, however the group may be root
|
|
*
|
|
* As indicated by Miklos Szeredi :
|
|
*
|
|
* The group list is available in
|
|
*
|
|
* /proc/$PID/task/$TID/status
|
|
*
|
|
* and fuse supplies TID in get_fuse_context()->pid. The only problem is
|
|
* finding out PID, for which I have no good solution, except to iterate
|
|
* through all processes. This is rather slow, but may be speeded up
|
|
* with caching and heuristics (for single threaded programs PID = TID).
|
|
*
|
|
* The following implementation gets the group list from
|
|
* /proc/$TID/task/$TID/status which apparently exists and
|
|
* contains the same data.
|
|
*/
|
|
|
|
static BOOL groupmember(struct SECURITY_CONTEXT *scx, uid_t uid, gid_t gid)
|
|
{
|
|
static char key[] = "\nGroups:";
|
|
char buf[BUFSZ+1];
|
|
char filename[64];
|
|
enum { INKEY, INSEP, INNUM, INEND } state;
|
|
int fd;
|
|
char c;
|
|
int matched;
|
|
BOOL ismember;
|
|
int got;
|
|
char *p;
|
|
gid_t grp;
|
|
pid_t tid;
|
|
|
|
if (scx->vol->secure_flags & (1 << SECURITY_STATICGRPS))
|
|
ismember = staticgroupmember(scx, uid, gid);
|
|
else {
|
|
ismember = FALSE; /* default return */
|
|
tid = scx->tid;
|
|
sprintf(filename,"/proc/%u/task/%u/status",tid,tid);
|
|
fd = open(filename,O_RDONLY);
|
|
if (fd >= 0) {
|
|
got = read(fd, buf, BUFSZ);
|
|
buf[got] = 0;
|
|
state = INKEY;
|
|
matched = 0;
|
|
p = buf;
|
|
grp = 0;
|
|
/*
|
|
* A simple automaton to process lines like
|
|
* Groups: 14 500 513
|
|
*/
|
|
do {
|
|
c = *p++;
|
|
if (!c) {
|
|
/* refill buffer */
|
|
got = read(fd, buf, BUFSZ);
|
|
buf[got] = 0;
|
|
p = buf;
|
|
c = *p++; /* 0 at end of file */
|
|
}
|
|
switch (state) {
|
|
case INKEY :
|
|
if (key[matched] == c) {
|
|
if (!key[++matched])
|
|
state = INSEP;
|
|
} else
|
|
if (key[0] == c)
|
|
matched = 1;
|
|
else
|
|
matched = 0;
|
|
break;
|
|
case INSEP :
|
|
if ((c >= '0') && (c <= '9')) {
|
|
grp = c - '0';
|
|
state = INNUM;
|
|
} else
|
|
if ((c != ' ') && (c != '\t'))
|
|
state = INEND;
|
|
break;
|
|
case INNUM :
|
|
if ((c >= '0') && (c <= '9'))
|
|
grp = grp*10 + c - '0';
|
|
else {
|
|
ismember = (grp == gid);
|
|
if ((c != ' ') && (c != '\t'))
|
|
state = INEND;
|
|
else
|
|
state = INSEP;
|
|
}
|
|
default :
|
|
break;
|
|
}
|
|
} while (!ismember && c && (state != INEND));
|
|
close(fd);
|
|
if (!c)
|
|
ntfs_log_error("No group record found in %s\n",filename);
|
|
} else
|
|
ntfs_log_error("Could not open %s\n",filename);
|
|
}
|
|
return (ismember);
|
|
}
|
|
|
|
/*
|
|
* Cacheing is done two-way :
|
|
* - from uid, gid and perm to securid (CACHED_SECURID)
|
|
* - from a securid to uid, gid and perm (CACHED_PERMISSIONS)
|
|
*
|
|
* CACHED_SECURID data is kept in a most-recent-first list
|
|
* which should not be too long to be efficient. Its optimal
|
|
* size is depends on usage and is hard to determine.
|
|
*
|
|
* CACHED_PERMISSIONS data is kept in a two-level indexed array. It
|
|
* is optimal at the expense of storage. Use of a most-recent-first
|
|
* list would save memory and provide similar performances for
|
|
* standard usage, but not for file servers with too many file
|
|
* owners
|
|
*
|
|
* CACHED_PERMISSIONS_LEGACY is a special case for CACHED_PERMISSIONS
|
|
* for legacy directories which were not allocated a security_id
|
|
* it is organized in a most-recent-first list.
|
|
*
|
|
* In main caches, data is never invalidated, as the meaning of
|
|
* a security_id only changes when user mapping is changed, which
|
|
* current implies remounting. However returned entries may be
|
|
* overwritten at next update, so data has to be copied elsewhere
|
|
* before another cache update is made.
|
|
* In legacy cache, data has to be invalidated when protection is
|
|
* changed.
|
|
*
|
|
* Though the same data may be found in both list, they
|
|
* must be kept separately : the interpretation of ACL
|
|
* in both direction are approximations which could be non
|
|
* reciprocal for some configuration of the user mapping data
|
|
*
|
|
* During the process of recompiling ntfs-3g from a tgz archive,
|
|
* security processing added 7.6% to the cpu time used by ntfs-3g
|
|
* and 30% if the cache is disabled.
|
|
*/
|
|
|
|
static struct PERMISSIONS_CACHE *create_caches(struct SECURITY_CONTEXT *scx,
|
|
u32 securindex)
|
|
{
|
|
struct PERMISSIONS_CACHE *cache;
|
|
unsigned int index1;
|
|
unsigned int i;
|
|
|
|
cache = (struct PERMISSIONS_CACHE*)NULL;
|
|
/* create the first permissions blocks */
|
|
index1 = securindex >> CACHE_PERMISSIONS_BITS;
|
|
cache = (struct PERMISSIONS_CACHE*)
|
|
ntfs_malloc(sizeof(struct PERMISSIONS_CACHE)
|
|
+ index1*sizeof(struct CACHED_PERMISSIONS*));
|
|
if (cache) {
|
|
cache->head.last = index1;
|
|
cache->head.p_reads = 0;
|
|
cache->head.p_hits = 0;
|
|
cache->head.p_writes = 0;
|
|
*scx->pseccache = cache;
|
|
for (i=0; i<=index1; i++)
|
|
cache->cachetable[i]
|
|
= (struct CACHED_PERMISSIONS*)NULL;
|
|
}
|
|
return (cache);
|
|
}
|
|
|
|
/*
|
|
* Free memory used by caches
|
|
* The only purpose is to facilitate the detection of memory leaks
|
|
*/
|
|
|
|
static void free_caches(struct SECURITY_CONTEXT *scx)
|
|
{
|
|
unsigned int index1;
|
|
struct PERMISSIONS_CACHE *pseccache;
|
|
|
|
pseccache = *scx->pseccache;
|
|
if (pseccache) {
|
|
for (index1=0; index1<=pseccache->head.last; index1++)
|
|
if (pseccache->cachetable[index1]) {
|
|
#if POSIXACLS
|
|
struct CACHED_PERMISSIONS *cacheentry;
|
|
unsigned int index2;
|
|
|
|
for (index2=0; index2<(1<< CACHE_PERMISSIONS_BITS); index2++) {
|
|
cacheentry = &pseccache->cachetable[index1][index2];
|
|
if (cacheentry->valid
|
|
&& cacheentry->pxdesc)
|
|
free(cacheentry->pxdesc);
|
|
}
|
|
#endif
|
|
free(pseccache->cachetable[index1]);
|
|
}
|
|
free(pseccache);
|
|
}
|
|
}
|
|
|
|
static int compare(const struct CACHED_SECURID *cached,
|
|
const struct CACHED_SECURID *item)
|
|
{
|
|
#if POSIXACLS
|
|
size_t csize;
|
|
size_t isize;
|
|
|
|
/* only compare data and sizes */
|
|
csize = (cached->variable ?
|
|
sizeof(struct POSIX_ACL)
|
|
+ (((struct POSIX_SECURITY*)cached->variable)->acccnt
|
|
+ ((struct POSIX_SECURITY*)cached->variable)->defcnt)
|
|
*sizeof(struct POSIX_ACE) :
|
|
0);
|
|
isize = (item->variable ?
|
|
sizeof(struct POSIX_ACL)
|
|
+ (((struct POSIX_SECURITY*)item->variable)->acccnt
|
|
+ ((struct POSIX_SECURITY*)item->variable)->defcnt)
|
|
*sizeof(struct POSIX_ACE) :
|
|
0);
|
|
return ((cached->uid != item->uid)
|
|
|| (cached->gid != item->gid)
|
|
|| (cached->dmode != item->dmode)
|
|
|| (csize != isize)
|
|
|| (csize
|
|
&& isize
|
|
&& memcmp(&((struct POSIX_SECURITY*)cached->variable)->acl,
|
|
&((struct POSIX_SECURITY*)item->variable)->acl, csize)));
|
|
#else
|
|
return ((cached->uid != item->uid)
|
|
|| (cached->gid != item->gid)
|
|
|| (cached->dmode != item->dmode));
|
|
#endif
|
|
}
|
|
|
|
static int leg_compare(const struct CACHED_PERMISSIONS_LEGACY *cached,
|
|
const struct CACHED_PERMISSIONS_LEGACY *item)
|
|
{
|
|
return (cached->mft_no != item->mft_no);
|
|
}
|
|
|
|
/*
|
|
* Resize permission cache table
|
|
* do not call unless resizing is needed
|
|
*
|
|
* If allocation fails, the cache size is not updated
|
|
* Lack of memory is not considered as an error, the cache is left
|
|
* consistent and errno is not set.
|
|
*/
|
|
|
|
static void resize_cache(struct SECURITY_CONTEXT *scx,
|
|
u32 securindex)
|
|
{
|
|
struct PERMISSIONS_CACHE *oldcache;
|
|
struct PERMISSIONS_CACHE *newcache;
|
|
int newcnt;
|
|
int oldcnt;
|
|
unsigned int index1;
|
|
unsigned int i;
|
|
|
|
oldcache = *scx->pseccache;
|
|
index1 = securindex >> CACHE_PERMISSIONS_BITS;
|
|
newcnt = index1 + 1;
|
|
if (newcnt <= ((CACHE_PERMISSIONS_SIZE
|
|
+ (1 << CACHE_PERMISSIONS_BITS)
|
|
- 1) >> CACHE_PERMISSIONS_BITS)) {
|
|
/* expand cache beyond current end, do not use realloc() */
|
|
/* to avoid losing data when there is no more memory */
|
|
oldcnt = oldcache->head.last + 1;
|
|
newcache = (struct PERMISSIONS_CACHE*)
|
|
ntfs_malloc(
|
|
sizeof(struct PERMISSIONS_CACHE)
|
|
+ (newcnt - 1)*sizeof(struct CACHED_PERMISSIONS*));
|
|
if (newcache) {
|
|
memcpy(newcache,oldcache,
|
|
sizeof(struct PERMISSIONS_CACHE)
|
|
+ (oldcnt - 1)*sizeof(struct CACHED_PERMISSIONS*));
|
|
free(oldcache);
|
|
/* mark new entries as not valid */
|
|
for (i=newcache->head.last+1; i<=index1; i++)
|
|
newcache->cachetable[i]
|
|
= (struct CACHED_PERMISSIONS*)NULL;
|
|
newcache->head.last = index1;
|
|
*scx->pseccache = newcache;
|
|
}
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Enter uid, gid and mode into cache, if possible
|
|
*
|
|
* returns the updated or created cache entry,
|
|
* or NULL if not possible (typically if there is no
|
|
* security id associated)
|
|
*/
|
|
|
|
#if POSIXACLS
|
|
static struct CACHED_PERMISSIONS *enter_cache(struct SECURITY_CONTEXT *scx,
|
|
ntfs_inode *ni, uid_t uid, gid_t gid,
|
|
struct POSIX_SECURITY *pxdesc)
|
|
#else
|
|
static struct CACHED_PERMISSIONS *enter_cache(struct SECURITY_CONTEXT *scx,
|
|
ntfs_inode *ni, uid_t uid, gid_t gid, mode_t mode)
|
|
#endif
|
|
{
|
|
struct CACHED_PERMISSIONS *cacheentry;
|
|
struct CACHED_PERMISSIONS *cacheblock;
|
|
struct PERMISSIONS_CACHE *pcache;
|
|
u32 securindex;
|
|
#if POSIXACLS
|
|
int pxsize;
|
|
struct POSIX_SECURITY *pxcached;
|
|
#endif
|
|
unsigned int index1;
|
|
unsigned int index2;
|
|
int i;
|
|
|
|
/* cacheing is only possible if a security_id has been defined */
|
|
if (test_nino_flag(ni, v3_Extensions)
|
|
&& ni->security_id) {
|
|
/*
|
|
* Immediately test the most frequent situation
|
|
* where the entry exists
|
|
*/
|
|
securindex = le32_to_cpu(ni->security_id);
|
|
index1 = securindex >> CACHE_PERMISSIONS_BITS;
|
|
index2 = securindex & ((1 << CACHE_PERMISSIONS_BITS) - 1);
|
|
pcache = *scx->pseccache;
|
|
if (pcache
|
|
&& (pcache->head.last >= index1)
|
|
&& pcache->cachetable[index1]) {
|
|
cacheentry = &pcache->cachetable[index1][index2];
|
|
cacheentry->uid = uid;
|
|
cacheentry->gid = gid;
|
|
#if POSIXACLS
|
|
if (cacheentry->valid && cacheentry->pxdesc)
|
|
free(cacheentry->pxdesc);
|
|
if (pxdesc) {
|
|
pxsize = sizeof(struct POSIX_SECURITY)
|
|
+ (pxdesc->acccnt + pxdesc->defcnt)*sizeof(struct POSIX_ACE);
|
|
pxcached = (struct POSIX_SECURITY*)malloc(pxsize);
|
|
if (pxcached) {
|
|
memcpy(pxcached, pxdesc, pxsize);
|
|
cacheentry->pxdesc = pxcached;
|
|
} else {
|
|
cacheentry->valid = 0;
|
|
cacheentry = (struct CACHED_PERMISSIONS*)NULL;
|
|
}
|
|
cacheentry->mode = pxdesc->mode & 07777;
|
|
} else
|
|
cacheentry->pxdesc = (struct POSIX_SECURITY*)NULL;
|
|
#else
|
|
cacheentry->mode = mode & 07777;
|
|
#endif
|
|
cacheentry->inh_fileid = const_cpu_to_le32(0);
|
|
cacheentry->inh_dirid = const_cpu_to_le32(0);
|
|
cacheentry->valid = 1;
|
|
pcache->head.p_writes++;
|
|
} else {
|
|
if (!pcache) {
|
|
/* create the first cache block */
|
|
pcache = create_caches(scx, securindex);
|
|
} else {
|
|
if (index1 > pcache->head.last) {
|
|
resize_cache(scx, securindex);
|
|
pcache = *scx->pseccache;
|
|
}
|
|
}
|
|
/* allocate block, if cache table was allocated */
|
|
if (pcache && (index1 <= pcache->head.last)) {
|
|
cacheblock = (struct CACHED_PERMISSIONS*)
|
|
malloc(sizeof(struct CACHED_PERMISSIONS)
|
|
<< CACHE_PERMISSIONS_BITS);
|
|
pcache->cachetable[index1] = cacheblock;
|
|
for (i=0; i<(1 << CACHE_PERMISSIONS_BITS); i++)
|
|
cacheblock[i].valid = 0;
|
|
cacheentry = &cacheblock[index2];
|
|
if (cacheentry) {
|
|
cacheentry->uid = uid;
|
|
cacheentry->gid = gid;
|
|
#if POSIXACLS
|
|
if (pxdesc) {
|
|
pxsize = sizeof(struct POSIX_SECURITY)
|
|
+ (pxdesc->acccnt + pxdesc->defcnt)*sizeof(struct POSIX_ACE);
|
|
pxcached = (struct POSIX_SECURITY*)malloc(pxsize);
|
|
if (pxcached) {
|
|
memcpy(pxcached, pxdesc, pxsize);
|
|
cacheentry->pxdesc = pxcached;
|
|
} else {
|
|
cacheentry->valid = 0;
|
|
cacheentry = (struct CACHED_PERMISSIONS*)NULL;
|
|
}
|
|
cacheentry->mode = pxdesc->mode & 07777;
|
|
} else
|
|
cacheentry->pxdesc = (struct POSIX_SECURITY*)NULL;
|
|
#else
|
|
cacheentry->mode = mode & 07777;
|
|
#endif
|
|
cacheentry->inh_fileid = const_cpu_to_le32(0);
|
|
cacheentry->inh_dirid = const_cpu_to_le32(0);
|
|
cacheentry->valid = 1;
|
|
pcache->head.p_writes++;
|
|
}
|
|
} else
|
|
cacheentry = (struct CACHED_PERMISSIONS*)NULL;
|
|
}
|
|
} else {
|
|
cacheentry = (struct CACHED_PERMISSIONS*)NULL;
|
|
#if CACHE_LEGACY_SIZE
|
|
if (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY) {
|
|
struct CACHED_PERMISSIONS_LEGACY wanted;
|
|
struct CACHED_PERMISSIONS_LEGACY *legacy;
|
|
|
|
wanted.perm.uid = uid;
|
|
wanted.perm.gid = gid;
|
|
#if POSIXACLS
|
|
wanted.perm.mode = pxdesc->mode & 07777;
|
|
wanted.perm.inh_fileid = const_cpu_to_le32(0);
|
|
wanted.perm.inh_dirid = const_cpu_to_le32(0);
|
|
wanted.mft_no = ni->mft_no;
|
|
wanted.variable = (void*)pxdesc;
|
|
wanted.varsize = sizeof(struct POSIX_SECURITY)
|
|
+ (pxdesc->acccnt + pxdesc->defcnt)*sizeof(struct POSIX_ACE);
|
|
#else
|
|
wanted.perm.mode = mode & 07777;
|
|
wanted.perm.inh_fileid = const_cpu_to_le32(0);
|
|
wanted.perm.inh_dirid = const_cpu_to_le32(0);
|
|
wanted.mft_no = ni->mft_no;
|
|
wanted.variable = (void*)NULL;
|
|
wanted.varsize = 0;
|
|
#endif
|
|
legacy = (struct CACHED_PERMISSIONS_LEGACY*)ntfs_enter_cache(
|
|
scx->vol->legacy_cache, GENERIC(&wanted),
|
|
(cache_compare)leg_compare);
|
|
if (legacy) {
|
|
cacheentry = &legacy->perm;
|
|
#if POSIXACLS
|
|
/*
|
|
* give direct access to the cached pxdesc
|
|
* in the permissions structure
|
|
*/
|
|
cacheentry->pxdesc = legacy->variable;
|
|
#endif
|
|
}
|
|
}
|
|
#endif
|
|
}
|
|
return (cacheentry);
|
|
}
|
|
|
|
/*
|
|
* Fetch owner, group and permission of a file, if cached
|
|
*
|
|
* Beware : do not use the returned entry after a cache update :
|
|
* the cache may be relocated making the returned entry meaningless
|
|
*
|
|
* returns the cache entry, or NULL if not available
|
|
*/
|
|
|
|
static struct CACHED_PERMISSIONS *fetch_cache(struct SECURITY_CONTEXT *scx,
|
|
ntfs_inode *ni)
|
|
{
|
|
struct CACHED_PERMISSIONS *cacheentry;
|
|
struct PERMISSIONS_CACHE *pcache;
|
|
u32 securindex;
|
|
unsigned int index1;
|
|
unsigned int index2;
|
|
|
|
/* cacheing is only possible if a security_id has been defined */
|
|
cacheentry = (struct CACHED_PERMISSIONS*)NULL;
|
|
if (test_nino_flag(ni, v3_Extensions)
|
|
&& (ni->security_id)) {
|
|
securindex = le32_to_cpu(ni->security_id);
|
|
index1 = securindex >> CACHE_PERMISSIONS_BITS;
|
|
index2 = securindex & ((1 << CACHE_PERMISSIONS_BITS) - 1);
|
|
pcache = *scx->pseccache;
|
|
if (pcache
|
|
&& (pcache->head.last >= index1)
|
|
&& pcache->cachetable[index1]) {
|
|
cacheentry = &pcache->cachetable[index1][index2];
|
|
/* reject if entry is not valid */
|
|
if (!cacheentry->valid)
|
|
cacheentry = (struct CACHED_PERMISSIONS*)NULL;
|
|
else
|
|
pcache->head.p_hits++;
|
|
if (pcache)
|
|
pcache->head.p_reads++;
|
|
}
|
|
}
|
|
#if CACHE_LEGACY_SIZE
|
|
else {
|
|
cacheentry = (struct CACHED_PERMISSIONS*)NULL;
|
|
if (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY) {
|
|
struct CACHED_PERMISSIONS_LEGACY wanted;
|
|
struct CACHED_PERMISSIONS_LEGACY *legacy;
|
|
|
|
wanted.mft_no = ni->mft_no;
|
|
wanted.variable = (void*)NULL;
|
|
wanted.varsize = 0;
|
|
legacy = (struct CACHED_PERMISSIONS_LEGACY*)ntfs_fetch_cache(
|
|
scx->vol->legacy_cache, GENERIC(&wanted),
|
|
(cache_compare)leg_compare);
|
|
if (legacy) cacheentry = &legacy->perm;
|
|
}
|
|
}
|
|
#endif
|
|
#if POSIXACLS
|
|
if (cacheentry && !cacheentry->pxdesc) {
|
|
ntfs_log_error("No Posix descriptor in cache\n");
|
|
cacheentry = (struct CACHED_PERMISSIONS*)NULL;
|
|
}
|
|
#endif
|
|
return (cacheentry);
|
|
}
|
|
|
|
/*
|
|
* Retrieve a security attribute from $Secure
|
|
*/
|
|
|
|
static char *retrievesecurityattr(ntfs_volume *vol, SII_INDEX_KEY id)
|
|
{
|
|
struct SII *psii;
|
|
union {
|
|
struct {
|
|
le32 dataoffsl;
|
|
le32 dataoffsh;
|
|
} parts;
|
|
le64 all;
|
|
} realign;
|
|
int found;
|
|
size_t size;
|
|
size_t rdsize;
|
|
s64 offs;
|
|
ntfs_inode *ni;
|
|
ntfs_index_context *xsii;
|
|
char *securattr;
|
|
|
|
securattr = (char*)NULL;
|
|
ni = vol->secure_ni;
|
|
xsii = vol->secure_xsii;
|
|
if (ni && xsii) {
|
|
ntfs_index_ctx_reinit(xsii);
|
|
found =
|
|
!ntfs_index_lookup((char*)&id,
|
|
sizeof(SII_INDEX_KEY), xsii);
|
|
if (found) {
|
|
psii = (struct SII*)xsii->entry;
|
|
size =
|
|
(size_t) le32_to_cpu(psii->datasize)
|
|
- sizeof(SECURITY_DESCRIPTOR_HEADER);
|
|
/* work around bad alignment problem */
|
|
realign.parts.dataoffsh = psii->dataoffsh;
|
|
realign.parts.dataoffsl = psii->dataoffsl;
|
|
offs = le64_to_cpu(realign.all)
|
|
+ sizeof(SECURITY_DESCRIPTOR_HEADER);
|
|
|
|
securattr = (char*)ntfs_malloc(size);
|
|
if (securattr) {
|
|
rdsize = ntfs_local_read(
|
|
ni, STREAM_SDS, 4,
|
|
securattr, size, offs);
|
|
if ((rdsize != size)
|
|
|| !ntfs_valid_descr(securattr,
|
|
rdsize)) {
|
|
/* error to be logged by caller */
|
|
free(securattr);
|
|
securattr = (char*)NULL;
|
|
}
|
|
}
|
|
} else
|
|
if (errno != ENOENT)
|
|
ntfs_log_perror("Inconsistency in index $SII");
|
|
}
|
|
if (!securattr) {
|
|
ntfs_log_error("Failed to retrieve a security descriptor\n");
|
|
errno = EIO;
|
|
}
|
|
return (securattr);
|
|
}
|
|
|
|
/*
|
|
* Get the security descriptor associated to a file
|
|
*
|
|
* Either :
|
|
* - read the security descriptor attribute (v1.x format)
|
|
* - or find the descriptor in $Secure:$SDS (v3.x format)
|
|
*
|
|
* in both case, sanity checks are done on the attribute and
|
|
* the descriptor can be assumed safe
|
|
*
|
|
* The returned descriptor is dynamically allocated and has to be freed
|
|
*/
|
|
|
|
static char *getsecurityattr(ntfs_volume *vol, ntfs_inode *ni)
|
|
{
|
|
SII_INDEX_KEY securid;
|
|
char *securattr;
|
|
s64 readallsz;
|
|
|
|
/*
|
|
* Warning : in some situations, after fixing by chkdsk,
|
|
* v3_Extensions are marked present (long standard informations)
|
|
* with a default security descriptor inserted in an
|
|
* attribute
|
|
*/
|
|
if (test_nino_flag(ni, v3_Extensions)
|
|
&& vol->secure_ni && ni->security_id) {
|
|
/* get v3.x descriptor in $Secure */
|
|
securid.security_id = ni->security_id;
|
|
securattr = retrievesecurityattr(vol,securid);
|
|
if (!securattr)
|
|
ntfs_log_error("Bad security descriptor for 0x%lx\n",
|
|
(long)le32_to_cpu(ni->security_id));
|
|
} else {
|
|
/* get v1.x security attribute */
|
|
readallsz = 0;
|
|
securattr = ntfs_attr_readall(ni, AT_SECURITY_DESCRIPTOR,
|
|
AT_UNNAMED, 0, &readallsz);
|
|
if (securattr && !ntfs_valid_descr(securattr, readallsz)) {
|
|
ntfs_log_error("Bad security descriptor for inode %lld\n",
|
|
(long long)ni->mft_no);
|
|
free(securattr);
|
|
securattr = (char*)NULL;
|
|
}
|
|
}
|
|
if (!securattr) {
|
|
/*
|
|
* in some situations, there is no security
|
|
* descriptor, and chkdsk does not detect or fix
|
|
* anything. This could be a normal situation.
|
|
* When this happens, simulate a descriptor with
|
|
* minimum rights, so that a real descriptor can
|
|
* be created by chown or chmod
|
|
*/
|
|
ntfs_log_error("No security descriptor found for inode %lld\n",
|
|
(long long)ni->mft_no);
|
|
securattr = ntfs_build_descr(0, 0, adminsid, adminsid);
|
|
}
|
|
return (securattr);
|
|
}
|
|
|
|
#if POSIXACLS
|
|
|
|
/*
|
|
* Determine which access types to a file are allowed
|
|
* according to the relation of current process to the file
|
|
*
|
|
* Do not call if default_permissions is set
|
|
*/
|
|
|
|
static int access_check_posix(struct SECURITY_CONTEXT *scx,
|
|
struct POSIX_SECURITY *pxdesc, mode_t request,
|
|
uid_t uid, gid_t gid)
|
|
{
|
|
struct POSIX_ACE *pxace;
|
|
int userperms;
|
|
int groupperms;
|
|
int mask;
|
|
BOOL somegroup;
|
|
BOOL needgroups;
|
|
mode_t perms;
|
|
int i;
|
|
|
|
perms = pxdesc->mode;
|
|
/* owner and root access */
|
|
if (!scx->uid || (uid == scx->uid)) {
|
|
if (!scx->uid) {
|
|
/* root access if owner or other execution */
|
|
if (perms & 0101)
|
|
perms = 07777;
|
|
else {
|
|
/* root access if some group execution */
|
|
groupperms = 0;
|
|
mask = 7;
|
|
for (i=pxdesc->acccnt-1; i>=0 ; i--) {
|
|
pxace = &pxdesc->acl.ace[i];
|
|
switch (pxace->tag) {
|
|
case POSIX_ACL_USER_OBJ :
|
|
case POSIX_ACL_GROUP_OBJ :
|
|
case POSIX_ACL_GROUP :
|
|
groupperms |= pxace->perms;
|
|
break;
|
|
case POSIX_ACL_MASK :
|
|
mask = pxace->perms & 7;
|
|
break;
|
|
default :
|
|
break;
|
|
}
|
|
}
|
|
perms = (groupperms & mask & 1) | 6;
|
|
}
|
|
} else
|
|
perms &= 07700;
|
|
} else {
|
|
/*
|
|
* analyze designated users, get mask
|
|
* and identify whether we need to check
|
|
* the group memberships. The groups are
|
|
* not needed when all groups have the
|
|
* same permissions as other for the
|
|
* requested modes.
|
|
*/
|
|
userperms = -1;
|
|
groupperms = -1;
|
|
needgroups = FALSE;
|
|
mask = 7;
|
|
for (i=pxdesc->acccnt-1; i>=0 ; i--) {
|
|
pxace = &pxdesc->acl.ace[i];
|
|
switch (pxace->tag) {
|
|
case POSIX_ACL_USER :
|
|
if ((uid_t)pxace->id == scx->uid)
|
|
userperms = pxace->perms;
|
|
break;
|
|
case POSIX_ACL_MASK :
|
|
mask = pxace->perms & 7;
|
|
break;
|
|
case POSIX_ACL_GROUP_OBJ :
|
|
case POSIX_ACL_GROUP :
|
|
if (((pxace->perms & mask) ^ perms)
|
|
& (request >> 6) & 7)
|
|
needgroups = TRUE;
|
|
break;
|
|
default :
|
|
break;
|
|
}
|
|
}
|
|
/* designated users */
|
|
if (userperms >= 0)
|
|
perms = (perms & 07000) + (userperms & mask);
|
|
else if (!needgroups)
|
|
perms &= 07007;
|
|
else {
|
|
/* owning group */
|
|
if (!(~(perms >> 3) & request & mask)
|
|
&& ((gid == scx->gid)
|
|
|| groupmember(scx, scx->uid, gid)))
|
|
perms &= 07070;
|
|
else {
|
|
/* other groups */
|
|
groupperms = -1;
|
|
somegroup = FALSE;
|
|
for (i=pxdesc->acccnt-1; i>=0 ; i--) {
|
|
pxace = &pxdesc->acl.ace[i];
|
|
if ((pxace->tag == POSIX_ACL_GROUP)
|
|
&& groupmember(scx, uid, pxace->id)) {
|
|
if (!(~pxace->perms & request & mask))
|
|
groupperms = pxace->perms;
|
|
somegroup = TRUE;
|
|
}
|
|
}
|
|
if (groupperms >= 0)
|
|
perms = (perms & 07000) + (groupperms & mask);
|
|
else
|
|
if (somegroup)
|
|
perms = 0;
|
|
else
|
|
perms &= 07007;
|
|
}
|
|
}
|
|
}
|
|
return (perms);
|
|
}
|
|
|
|
/*
|
|
* Get permissions to access a file
|
|
* Takes into account the relation of user to file (owner, group, ...)
|
|
* Do no use as mode of the file
|
|
* Do no call if default_permissions is set
|
|
*
|
|
* returns -1 if there is a problem
|
|
*/
|
|
|
|
static int ntfs_get_perm(struct SECURITY_CONTEXT *scx,
|
|
ntfs_inode * ni, mode_t request)
|
|
{
|
|
const SECURITY_DESCRIPTOR_RELATIVE *phead;
|
|
const struct CACHED_PERMISSIONS *cached;
|
|
char *securattr;
|
|
const SID *usid; /* owner of file/directory */
|
|
const SID *gsid; /* group of file/directory */
|
|
uid_t uid;
|
|
gid_t gid;
|
|
int perm;
|
|
BOOL isdir;
|
|
struct POSIX_SECURITY *pxdesc;
|
|
|
|
if (!scx->mapping[MAPUSERS])
|
|
perm = 07777;
|
|
else {
|
|
/* check whether available in cache */
|
|
cached = fetch_cache(scx,ni);
|
|
if (cached) {
|
|
uid = cached->uid;
|
|
gid = cached->gid;
|
|
perm = access_check_posix(scx,cached->pxdesc,request,uid,gid);
|
|
} else {
|
|
perm = 0; /* default to no permission */
|
|
isdir = (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY)
|
|
!= const_cpu_to_le16(0);
|
|
securattr = getsecurityattr(scx->vol, ni);
|
|
if (securattr) {
|
|
phead = (const SECURITY_DESCRIPTOR_RELATIVE*)
|
|
securattr;
|
|
gsid = (const SID*)&
|
|
securattr[le32_to_cpu(phead->group)];
|
|
gid = ntfs_find_group(scx->mapping[MAPGROUPS],gsid);
|
|
#if OWNERFROMACL
|
|
usid = ntfs_acl_owner(securattr);
|
|
pxdesc = ntfs_build_permissions_posix(scx->mapping,securattr,
|
|
usid, gsid, isdir);
|
|
if (pxdesc)
|
|
perm = pxdesc->mode & 07777;
|
|
else
|
|
perm = -1;
|
|
uid = ntfs_find_user(scx->mapping[MAPUSERS],usid);
|
|
#else
|
|
usid = (const SID*)&
|
|
securattr[le32_to_cpu(phead->owner)];
|
|
pxdesc = ntfs_build_permissions_posix(scx,securattr,
|
|
usid, gsid, isdir);
|
|
if (pxdesc)
|
|
perm = pxdesc->mode & 07777;
|
|
else
|
|
perm = -1;
|
|
if (!perm && ntfs_same_sid(usid, adminsid)) {
|
|
uid = find_tenant(scx, securattr);
|
|
if (uid)
|
|
perm = 0700;
|
|
} else
|
|
uid = ntfs_find_user(scx->mapping[MAPUSERS],usid);
|
|
#endif
|
|
/*
|
|
* Create a security id if there were none
|
|
* and upgrade option is selected
|
|
*/
|
|
if (!test_nino_flag(ni, v3_Extensions)
|
|
&& (perm >= 0)
|
|
&& (scx->vol->secure_flags
|
|
& (1 << SECURITY_ADDSECURIDS))) {
|
|
upgrade_secur_desc(scx->vol,
|
|
securattr, ni);
|
|
/*
|
|
* fetch owner and group for cacheing
|
|
* if there is a securid
|
|
*/
|
|
}
|
|
if (test_nino_flag(ni, v3_Extensions)
|
|
&& (perm >= 0)) {
|
|
enter_cache(scx, ni, uid,
|
|
gid, pxdesc);
|
|
}
|
|
if (pxdesc) {
|
|
perm = access_check_posix(scx,pxdesc,request,uid,gid);
|
|
free(pxdesc);
|
|
}
|
|
free(securattr);
|
|
} else {
|
|
perm = -1;
|
|
uid = gid = 0;
|
|
}
|
|
}
|
|
}
|
|
return (perm);
|
|
}
|
|
|
|
/*
|
|
* Get a Posix ACL
|
|
*
|
|
* returns size or -errno if there is a problem
|
|
* if size was too small, no copy is done and errno is not set,
|
|
* the caller is expected to issue a new call
|
|
*/
|
|
|
|
int ntfs_get_posix_acl(struct SECURITY_CONTEXT *scx, ntfs_inode *ni,
|
|
const char *name, char *value, size_t size)
|
|
{
|
|
const SECURITY_DESCRIPTOR_RELATIVE *phead;
|
|
struct POSIX_SECURITY *pxdesc;
|
|
const struct CACHED_PERMISSIONS *cached;
|
|
char *securattr;
|
|
const SID *usid; /* owner of file/directory */
|
|
const SID *gsid; /* group of file/directory */
|
|
uid_t uid;
|
|
gid_t gid;
|
|
int perm;
|
|
BOOL isdir;
|
|
size_t outsize;
|
|
|
|
outsize = 0; /* default to error */
|
|
if (!scx->mapping[MAPUSERS])
|
|
errno = ENOTSUP;
|
|
else {
|
|
/* check whether available in cache */
|
|
cached = fetch_cache(scx,ni);
|
|
if (cached)
|
|
pxdesc = cached->pxdesc;
|
|
else {
|
|
securattr = getsecurityattr(scx->vol, ni);
|
|
isdir = (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY)
|
|
!= const_cpu_to_le16(0);
|
|
if (securattr) {
|
|
phead =
|
|
(const SECURITY_DESCRIPTOR_RELATIVE*)
|
|
securattr;
|
|
gsid = (const SID*)&
|
|
securattr[le32_to_cpu(phead->group)];
|
|
#if OWNERFROMACL
|
|
usid = ntfs_acl_owner(securattr);
|
|
#else
|
|
usid = (const SID*)&
|
|
securattr[le32_to_cpu(phead->owner)];
|
|
#endif
|
|
pxdesc = ntfs_build_permissions_posix(scx->mapping,securattr,
|
|
usid, gsid, isdir);
|
|
|
|
/*
|
|
* fetch owner and group for cacheing
|
|
*/
|
|
if (pxdesc) {
|
|
perm = pxdesc->mode & 07777;
|
|
/*
|
|
* Create a security id if there were none
|
|
* and upgrade option is selected
|
|
*/
|
|
if (!test_nino_flag(ni, v3_Extensions)
|
|
&& (scx->vol->secure_flags
|
|
& (1 << SECURITY_ADDSECURIDS))) {
|
|
upgrade_secur_desc(scx->vol,
|
|
securattr, ni);
|
|
}
|
|
#if OWNERFROMACL
|
|
uid = ntfs_find_user(scx->mapping[MAPUSERS],usid);
|
|
#else
|
|
if (!perm && ntfs_same_sid(usid, adminsid)) {
|
|
uid = find_tenant(scx,
|
|
securattr);
|
|
if (uid)
|
|
perm = 0700;
|
|
} else
|
|
uid = ntfs_find_user(scx->mapping[MAPUSERS],usid);
|
|
#endif
|
|
gid = ntfs_find_group(scx->mapping[MAPGROUPS],gsid);
|
|
if (pxdesc->tagsset & POSIX_ACL_EXTENSIONS)
|
|
enter_cache(scx, ni, uid,
|
|
gid, pxdesc);
|
|
}
|
|
free(securattr);
|
|
} else
|
|
pxdesc = (struct POSIX_SECURITY*)NULL;
|
|
}
|
|
|
|
if (pxdesc) {
|
|
if (ntfs_valid_posix(pxdesc)) {
|
|
if (!strcmp(name,"system.posix_acl_default")) {
|
|
if (ni->mrec->flags
|
|
& MFT_RECORD_IS_DIRECTORY)
|
|
outsize = sizeof(struct POSIX_ACL)
|
|
+ pxdesc->defcnt*sizeof(struct POSIX_ACE);
|
|
else {
|
|
/*
|
|
* getting default ACL from plain file :
|
|
* return EACCES if size > 0 as
|
|
* indicated in the man, but return ok
|
|
* if size == 0, so that ls does not
|
|
* display an error
|
|
*/
|
|
if (size > 0) {
|
|
outsize = 0;
|
|
errno = EACCES;
|
|
} else
|
|
outsize = sizeof(struct POSIX_ACL);
|
|
}
|
|
if (outsize && (outsize <= size)) {
|
|
memcpy(value,&pxdesc->acl,sizeof(struct POSIX_ACL));
|
|
memcpy(&value[sizeof(struct POSIX_ACL)],
|
|
&pxdesc->acl.ace[pxdesc->firstdef],
|
|
outsize-sizeof(struct POSIX_ACL));
|
|
}
|
|
} else {
|
|
outsize = sizeof(struct POSIX_ACL)
|
|
+ pxdesc->acccnt*sizeof(struct POSIX_ACE);
|
|
if (outsize <= size)
|
|
memcpy(value,&pxdesc->acl,outsize);
|
|
}
|
|
} else {
|
|
outsize = 0;
|
|
errno = EIO;
|
|
ntfs_log_error("Invalid Posix ACL built\n");
|
|
}
|
|
if (!cached)
|
|
free(pxdesc);
|
|
} else
|
|
outsize = 0;
|
|
}
|
|
return (outsize ? (int)outsize : -errno);
|
|
}
|
|
|
|
#else /* POSIXACLS */
|
|
|
|
|
|
/*
|
|
* Get permissions to access a file
|
|
* Takes into account the relation of user to file (owner, group, ...)
|
|
* Do no use as mode of the file
|
|
*
|
|
* returns -1 if there is a problem
|
|
*/
|
|
|
|
static int ntfs_get_perm(struct SECURITY_CONTEXT *scx,
|
|
ntfs_inode *ni, mode_t request)
|
|
{
|
|
const SECURITY_DESCRIPTOR_RELATIVE *phead;
|
|
const struct CACHED_PERMISSIONS *cached;
|
|
char *securattr;
|
|
const SID *usid; /* owner of file/directory */
|
|
const SID *gsid; /* group of file/directory */
|
|
BOOL isdir;
|
|
uid_t uid;
|
|
gid_t gid;
|
|
int perm;
|
|
|
|
if (!scx->mapping[MAPUSERS] || (!scx->uid && !(request & S_IEXEC)))
|
|
perm = 07777;
|
|
else {
|
|
/* check whether available in cache */
|
|
cached = fetch_cache(scx,ni);
|
|
if (cached) {
|
|
perm = cached->mode;
|
|
uid = cached->uid;
|
|
gid = cached->gid;
|
|
} else {
|
|
perm = 0; /* default to no permission */
|
|
isdir = (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY)
|
|
!= const_cpu_to_le16(0);
|
|
securattr = getsecurityattr(scx->vol, ni);
|
|
if (securattr) {
|
|
phead = (const SECURITY_DESCRIPTOR_RELATIVE*)
|
|
securattr;
|
|
gsid = (const SID*)&
|
|
securattr[le32_to_cpu(phead->group)];
|
|
gid = ntfs_find_group(scx->mapping[MAPGROUPS],gsid);
|
|
#if OWNERFROMACL
|
|
usid = ntfs_acl_owner(securattr);
|
|
perm = ntfs_build_permissions(securattr,
|
|
usid, gsid, isdir);
|
|
uid = ntfs_find_user(scx->mapping[MAPUSERS],usid);
|
|
#else
|
|
usid = (const SID*)&
|
|
securattr[le32_to_cpu(phead->owner)];
|
|
perm = ntfs_build_permissions(securattr,
|
|
usid, gsid, isdir);
|
|
if (!perm && ntfs_same_sid(usid, adminsid)) {
|
|
uid = find_tenant(scx, securattr);
|
|
if (uid)
|
|
perm = 0700;
|
|
} else
|
|
uid = ntfs_find_user(scx->mapping[MAPUSERS],usid);
|
|
#endif
|
|
/*
|
|
* Create a security id if there were none
|
|
* and upgrade option is selected
|
|
*/
|
|
if (!test_nino_flag(ni, v3_Extensions)
|
|
&& (perm >= 0)
|
|
&& (scx->vol->secure_flags
|
|
& (1 << SECURITY_ADDSECURIDS))) {
|
|
upgrade_secur_desc(scx->vol,
|
|
securattr, ni);
|
|
/*
|
|
* fetch owner and group for cacheing
|
|
* if there is a securid
|
|
*/
|
|
}
|
|
if (test_nino_flag(ni, v3_Extensions)
|
|
&& (perm >= 0)) {
|
|
enter_cache(scx, ni, uid,
|
|
gid, perm);
|
|
}
|
|
free(securattr);
|
|
} else {
|
|
perm = -1;
|
|
uid = gid = 0;
|
|
}
|
|
}
|
|
if (perm >= 0) {
|
|
if (!scx->uid) {
|
|
/* root access and execution */
|
|
if (perm & 0111)
|
|
perm = 07777;
|
|
else
|
|
perm = 0;
|
|
} else
|
|
if (uid == scx->uid)
|
|
perm &= 07700;
|
|
else
|
|
/*
|
|
* avoid checking group membership
|
|
* when the requested perms for group
|
|
* are the same as perms for other
|
|
*/
|
|
if ((gid == scx->gid)
|
|
|| ((((perm >> 3) ^ perm)
|
|
& (request >> 6) & 7)
|
|
&& groupmember(scx, scx->uid, gid)))
|
|
perm &= 07070;
|
|
else
|
|
perm &= 07007;
|
|
}
|
|
}
|
|
return (perm);
|
|
}
|
|
|
|
#endif /* POSIXACLS */
|
|
|
|
/*
|
|
* Get an NTFS ACL
|
|
*
|
|
* Returns size or -errno if there is a problem
|
|
* if size was too small, no copy is done and errno is not set,
|
|
* the caller is expected to issue a new call
|
|
*/
|
|
|
|
int ntfs_get_ntfs_acl(struct SECURITY_CONTEXT *scx, ntfs_inode *ni,
|
|
char *value, size_t size)
|
|
{
|
|
char *securattr;
|
|
size_t outsize;
|
|
|
|
outsize = 0; /* default to no data and no error */
|
|
securattr = getsecurityattr(scx->vol, ni);
|
|
if (securattr) {
|
|
outsize = ntfs_attr_size(securattr);
|
|
if (outsize <= size) {
|
|
memcpy(value,securattr,outsize);
|
|
}
|
|
free(securattr);
|
|
}
|
|
return (outsize ? (int)outsize : -errno);
|
|
}
|
|
|
|
/*
|
|
* Get owner, group and permissions in an stat structure
|
|
* returns permissions, or -1 if there is a problem
|
|
*/
|
|
|
|
int ntfs_get_owner_mode(struct SECURITY_CONTEXT *scx,
|
|
ntfs_inode * ni, struct stat *stbuf)
|
|
{
|
|
const SECURITY_DESCRIPTOR_RELATIVE *phead;
|
|
char *securattr;
|
|
const SID *usid; /* owner of file/directory */
|
|
const SID *gsid; /* group of file/directory */
|
|
const struct CACHED_PERMISSIONS *cached;
|
|
int perm;
|
|
BOOL isdir;
|
|
#if POSIXACLS
|
|
struct POSIX_SECURITY *pxdesc;
|
|
#endif
|
|
|
|
if (!scx->mapping[MAPUSERS])
|
|
perm = 07777;
|
|
else {
|
|
/* check whether available in cache */
|
|
cached = fetch_cache(scx,ni);
|
|
if (cached) {
|
|
perm = cached->mode;
|
|
stbuf->st_uid = cached->uid;
|
|
stbuf->st_gid = cached->gid;
|
|
stbuf->st_mode = (stbuf->st_mode & ~07777) + perm;
|
|
} else {
|
|
perm = -1; /* default to error */
|
|
isdir = (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY)
|
|
!= const_cpu_to_le16(0);
|
|
securattr = getsecurityattr(scx->vol, ni);
|
|
if (securattr) {
|
|
phead =
|
|
(const SECURITY_DESCRIPTOR_RELATIVE*)
|
|
securattr;
|
|
gsid = (const SID*)&
|
|
securattr[le32_to_cpu(phead->group)];
|
|
#if OWNERFROMACL
|
|
usid = ntfs_acl_owner(securattr);
|
|
#else
|
|
usid = (const SID*)&
|
|
securattr[le32_to_cpu(phead->owner)];
|
|
#endif
|
|
#if POSIXACLS
|
|
pxdesc = ntfs_build_permissions_posix(scx->mapping, securattr,
|
|
usid, gsid, isdir);
|
|
if (pxdesc)
|
|
perm = pxdesc->mode & 07777;
|
|
else
|
|
perm = -1;
|
|
#else
|
|
perm = ntfs_build_permissions(securattr,
|
|
usid, gsid, isdir);
|
|
#endif
|
|
/*
|
|
* fetch owner and group for cacheing
|
|
*/
|
|
if (perm >= 0) {
|
|
/*
|
|
* Create a security id if there were none
|
|
* and upgrade option is selected
|
|
*/
|
|
if (!test_nino_flag(ni, v3_Extensions)
|
|
&& (scx->vol->secure_flags
|
|
& (1 << SECURITY_ADDSECURIDS))) {
|
|
upgrade_secur_desc(scx->vol,
|
|
securattr, ni);
|
|
}
|
|
#if OWNERFROMACL
|
|
stbuf->st_uid = ntfs_find_user(scx->mapping[MAPUSERS],usid);
|
|
#else
|
|
if (!perm && ntfs_same_sid(usid, adminsid)) {
|
|
stbuf->st_uid =
|
|
find_tenant(scx,
|
|
securattr);
|
|
if (stbuf->st_uid)
|
|
perm = 0700;
|
|
} else
|
|
stbuf->st_uid = ntfs_find_user(scx->mapping[MAPUSERS],usid);
|
|
#endif
|
|
stbuf->st_gid = ntfs_find_group(scx->mapping[MAPGROUPS],gsid);
|
|
stbuf->st_mode =
|
|
(stbuf->st_mode & ~07777) + perm;
|
|
#if POSIXACLS
|
|
enter_cache(scx, ni, stbuf->st_uid,
|
|
stbuf->st_gid, pxdesc);
|
|
free(pxdesc);
|
|
#else
|
|
enter_cache(scx, ni, stbuf->st_uid,
|
|
stbuf->st_gid, perm);
|
|
#endif
|
|
}
|
|
free(securattr);
|
|
}
|
|
}
|
|
}
|
|
return (perm);
|
|
}
|
|
|
|
#if POSIXACLS
|
|
|
|
/*
|
|
* Get the base for a Posix inheritance and
|
|
* build an inherited Posix descriptor
|
|
*/
|
|
|
|
static struct POSIX_SECURITY *inherit_posix(struct SECURITY_CONTEXT *scx,
|
|
ntfs_inode *dir_ni, mode_t mode, BOOL isdir)
|
|
{
|
|
const struct CACHED_PERMISSIONS *cached;
|
|
const SECURITY_DESCRIPTOR_RELATIVE *phead;
|
|
struct POSIX_SECURITY *pxdesc;
|
|
struct POSIX_SECURITY *pydesc;
|
|
char *securattr;
|
|
const SID *usid;
|
|
const SID *gsid;
|
|
uid_t uid;
|
|
gid_t gid;
|
|
|
|
pydesc = (struct POSIX_SECURITY*)NULL;
|
|
/* check whether parent directory is available in cache */
|
|
cached = fetch_cache(scx,dir_ni);
|
|
if (cached) {
|
|
uid = cached->uid;
|
|
gid = cached->gid;
|
|
pxdesc = cached->pxdesc;
|
|
if (pxdesc) {
|
|
pydesc = ntfs_build_inherited_posix(pxdesc,mode,
|
|
scx->umask,isdir);
|
|
}
|
|
} else {
|
|
securattr = getsecurityattr(scx->vol, dir_ni);
|
|
if (securattr) {
|
|
phead = (const SECURITY_DESCRIPTOR_RELATIVE*)
|
|
securattr;
|
|
gsid = (const SID*)&
|
|
securattr[le32_to_cpu(phead->group)];
|
|
gid = ntfs_find_group(scx->mapping[MAPGROUPS],gsid);
|
|
#if OWNERFROMACL
|
|
usid = ntfs_acl_owner(securattr);
|
|
pxdesc = ntfs_build_permissions_posix(scx->mapping,securattr,
|
|
usid, gsid, TRUE);
|
|
uid = ntfs_find_user(scx->mapping[MAPUSERS],usid);
|
|
#else
|
|
usid = (const SID*)&
|
|
securattr[le32_to_cpu(phead->owner)];
|
|
pxdesc = ntfs_build_permissions_posix(scx->mapping,securattr,
|
|
usid, gsid, TRUE);
|
|
if (pxdesc && ntfs_same_sid(usid, adminsid)) {
|
|
uid = find_tenant(scx, securattr);
|
|
} else
|
|
uid = ntfs_find_user(scx->mapping[MAPUSERS],usid);
|
|
#endif
|
|
if (pxdesc) {
|
|
/*
|
|
* Create a security id if there were none
|
|
* and upgrade option is selected
|
|
*/
|
|
if (!test_nino_flag(dir_ni, v3_Extensions)
|
|
&& (scx->vol->secure_flags
|
|
& (1 << SECURITY_ADDSECURIDS))) {
|
|
upgrade_secur_desc(scx->vol,
|
|
securattr, dir_ni);
|
|
/*
|
|
* fetch owner and group for cacheing
|
|
* if there is a securid
|
|
*/
|
|
}
|
|
if (test_nino_flag(dir_ni, v3_Extensions)) {
|
|
enter_cache(scx, dir_ni, uid,
|
|
gid, pxdesc);
|
|
}
|
|
pydesc = ntfs_build_inherited_posix(pxdesc,
|
|
mode, scx->umask, isdir);
|
|
free(pxdesc);
|
|
}
|
|
free(securattr);
|
|
}
|
|
}
|
|
return (pydesc);
|
|
}
|
|
|
|
/*
|
|
* Allocate a security_id for a file being created
|
|
*
|
|
* Returns zero if not possible (NTFS v3.x required)
|
|
*/
|
|
|
|
le32 ntfs_alloc_securid(struct SECURITY_CONTEXT *scx,
|
|
uid_t uid, gid_t gid, ntfs_inode *dir_ni,
|
|
mode_t mode, BOOL isdir)
|
|
{
|
|
#if !FORCE_FORMAT_v1x
|
|
const struct CACHED_SECURID *cached;
|
|
struct CACHED_SECURID wanted;
|
|
struct POSIX_SECURITY *pxdesc;
|
|
char *newattr;
|
|
int newattrsz;
|
|
const SID *usid;
|
|
const SID *gsid;
|
|
BIGSID defusid;
|
|
BIGSID defgsid;
|
|
le32 securid;
|
|
#endif
|
|
|
|
securid = const_cpu_to_le32(0);
|
|
|
|
#if !FORCE_FORMAT_v1x
|
|
|
|
pxdesc = inherit_posix(scx, dir_ni, mode, isdir);
|
|
if (pxdesc) {
|
|
/* check whether target securid is known in cache */
|
|
|
|
wanted.uid = uid;
|
|
wanted.gid = gid;
|
|
wanted.dmode = pxdesc->mode & mode & 07777;
|
|
if (isdir) wanted.dmode |= 0x10000;
|
|
wanted.variable = (void*)pxdesc;
|
|
wanted.varsize = sizeof(struct POSIX_SECURITY)
|
|
+ (pxdesc->acccnt + pxdesc->defcnt)*sizeof(struct POSIX_ACE);
|
|
cached = (const struct CACHED_SECURID*)ntfs_fetch_cache(
|
|
scx->vol->securid_cache, GENERIC(&wanted),
|
|
(cache_compare)compare);
|
|
/* quite simple, if we are lucky */
|
|
if (cached)
|
|
securid = cached->securid;
|
|
|
|
/* not in cache : make sure we can create ids */
|
|
|
|
if (!cached && (scx->vol->major_ver >= 3)) {
|
|
usid = ntfs_find_usid(scx->mapping[MAPUSERS],uid,(SID*)&defusid);
|
|
gsid = ntfs_find_gsid(scx->mapping[MAPGROUPS],gid,(SID*)&defgsid);
|
|
if (!usid || !gsid) {
|
|
ntfs_log_error("File created by an unmapped user/group %d/%d\n",
|
|
(int)uid, (int)gid);
|
|
usid = gsid = adminsid;
|
|
}
|
|
newattr = ntfs_build_descr_posix(scx->mapping, pxdesc,
|
|
isdir, usid, gsid);
|
|
if (newattr) {
|
|
newattrsz = ntfs_attr_size(newattr);
|
|
securid = setsecurityattr(scx->vol,
|
|
(const SECURITY_DESCRIPTOR_RELATIVE*)newattr,
|
|
newattrsz);
|
|
if (securid) {
|
|
/* update cache, for subsequent use */
|
|
wanted.securid = securid;
|
|
ntfs_enter_cache(scx->vol->securid_cache,
|
|
GENERIC(&wanted),
|
|
(cache_compare)compare);
|
|
}
|
|
free(newattr);
|
|
} else {
|
|
/*
|
|
* could not build new security attribute
|
|
* errno set by ntfs_build_descr()
|
|
*/
|
|
}
|
|
}
|
|
free(pxdesc);
|
|
}
|
|
#endif
|
|
return (securid);
|
|
}
|
|
|
|
/*
|
|
* Apply Posix inheritance to a newly created file
|
|
* (for NTFS 1.x only : no securid)
|
|
*/
|
|
|
|
int ntfs_set_inherited_posix(struct SECURITY_CONTEXT *scx,
|
|
ntfs_inode *ni, uid_t uid, gid_t gid,
|
|
ntfs_inode *dir_ni, mode_t mode)
|
|
{
|
|
struct POSIX_SECURITY *pxdesc;
|
|
char *newattr;
|
|
const SID *usid;
|
|
const SID *gsid;
|
|
BIGSID defusid;
|
|
BIGSID defgsid;
|
|
BOOL isdir;
|
|
int res;
|
|
|
|
res = -1;
|
|
isdir = (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY) != const_cpu_to_le16(0);
|
|
pxdesc = inherit_posix(scx, dir_ni, mode, isdir);
|
|
if (pxdesc) {
|
|
usid = ntfs_find_usid(scx->mapping[MAPUSERS],uid,(SID*)&defusid);
|
|
gsid = ntfs_find_gsid(scx->mapping[MAPGROUPS],gid,(SID*)&defgsid);
|
|
if (!usid || !gsid) {
|
|
ntfs_log_error("File created by an unmapped user/group %d/%d\n",
|
|
(int)uid, (int)gid);
|
|
usid = gsid = adminsid;
|
|
}
|
|
newattr = ntfs_build_descr_posix(scx->mapping, pxdesc,
|
|
isdir, usid, gsid);
|
|
if (newattr) {
|
|
/* Adjust Windows read-only flag */
|
|
res = update_secur_descr(scx->vol, newattr, ni);
|
|
if (!res && !isdir) {
|
|
if (mode & S_IWUSR)
|
|
ni->flags &= ~FILE_ATTR_READONLY;
|
|
else
|
|
ni->flags |= FILE_ATTR_READONLY;
|
|
}
|
|
#if CACHE_LEGACY_SIZE
|
|
/* also invalidate legacy cache */
|
|
if (isdir && !ni->security_id) {
|
|
struct CACHED_PERMISSIONS_LEGACY legacy;
|
|
|
|
legacy.mft_no = ni->mft_no;
|
|
legacy.variable = pxdesc;
|
|
legacy.varsize = sizeof(struct POSIX_SECURITY)
|
|
+ (pxdesc->acccnt + pxdesc->defcnt)*sizeof(struct POSIX_ACE);
|
|
ntfs_invalidate_cache(scx->vol->legacy_cache,
|
|
GENERIC(&legacy),
|
|
(cache_compare)leg_compare,0);
|
|
}
|
|
#endif
|
|
free(newattr);
|
|
|
|
} else {
|
|
/*
|
|
* could not build new security attribute
|
|
* errno set by ntfs_build_descr()
|
|
*/
|
|
}
|
|
}
|
|
return (res);
|
|
}
|
|
|
|
#else
|
|
|
|
le32 ntfs_alloc_securid(struct SECURITY_CONTEXT *scx,
|
|
uid_t uid, gid_t gid, mode_t mode, BOOL isdir)
|
|
{
|
|
#if !FORCE_FORMAT_v1x
|
|
const struct CACHED_SECURID *cached;
|
|
struct CACHED_SECURID wanted;
|
|
char *newattr;
|
|
int newattrsz;
|
|
const SID *usid;
|
|
const SID *gsid;
|
|
BIGSID defusid;
|
|
BIGSID defgsid;
|
|
le32 securid;
|
|
#endif
|
|
|
|
securid = const_cpu_to_le32(0);
|
|
|
|
#if !FORCE_FORMAT_v1x
|
|
/* check whether target securid is known in cache */
|
|
|
|
wanted.uid = uid;
|
|
wanted.gid = gid;
|
|
wanted.dmode = mode & 07777;
|
|
if (isdir) wanted.dmode |= 0x10000;
|
|
wanted.variable = (void*)NULL;
|
|
wanted.varsize = 0;
|
|
cached = (const struct CACHED_SECURID*)ntfs_fetch_cache(
|
|
scx->vol->securid_cache, GENERIC(&wanted),
|
|
(cache_compare)compare);
|
|
/* quite simple, if we are lucky */
|
|
if (cached)
|
|
securid = cached->securid;
|
|
|
|
/* not in cache : make sure we can create ids */
|
|
|
|
if (!cached && (scx->vol->major_ver >= 3)) {
|
|
usid = ntfs_find_usid(scx->mapping[MAPUSERS],uid,(SID*)&defusid);
|
|
gsid = ntfs_find_gsid(scx->mapping[MAPGROUPS],gid,(SID*)&defgsid);
|
|
if (!usid || !gsid) {
|
|
ntfs_log_error("File created by an unmapped user/group %d/%d\n",
|
|
(int)uid, (int)gid);
|
|
usid = gsid = adminsid;
|
|
}
|
|
newattr = ntfs_build_descr(mode, isdir, usid, gsid);
|
|
if (newattr) {
|
|
newattrsz = ntfs_attr_size(newattr);
|
|
securid = setsecurityattr(scx->vol,
|
|
(const SECURITY_DESCRIPTOR_RELATIVE*)newattr,
|
|
newattrsz);
|
|
if (securid) {
|
|
/* update cache, for subsequent use */
|
|
wanted.securid = securid;
|
|
ntfs_enter_cache(scx->vol->securid_cache,
|
|
GENERIC(&wanted),
|
|
(cache_compare)compare);
|
|
}
|
|
free(newattr);
|
|
} else {
|
|
/*
|
|
* could not build new security attribute
|
|
* errno set by ntfs_build_descr()
|
|
*/
|
|
}
|
|
}
|
|
#endif
|
|
return (securid);
|
|
}
|
|
|
|
#endif
|
|
|
|
/*
|
|
* Update ownership and mode of a file, reusing an existing
|
|
* security descriptor when possible
|
|
*
|
|
* Returns zero if successful
|
|
*/
|
|
|
|
#if POSIXACLS
|
|
int ntfs_set_owner_mode(struct SECURITY_CONTEXT *scx, ntfs_inode *ni,
|
|
uid_t uid, gid_t gid, mode_t mode,
|
|
struct POSIX_SECURITY *pxdesc)
|
|
#else
|
|
int ntfs_set_owner_mode(struct SECURITY_CONTEXT *scx, ntfs_inode *ni,
|
|
uid_t uid, gid_t gid, mode_t mode)
|
|
#endif
|
|
{
|
|
int res;
|
|
const struct CACHED_SECURID *cached;
|
|
struct CACHED_SECURID wanted;
|
|
char *newattr;
|
|
const SID *usid;
|
|
const SID *gsid;
|
|
BIGSID defusid;
|
|
BIGSID defgsid;
|
|
BOOL isdir;
|
|
|
|
res = 0;
|
|
|
|
/* check whether target securid is known in cache */
|
|
|
|
isdir = (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY) != const_cpu_to_le16(0);
|
|
wanted.uid = uid;
|
|
wanted.gid = gid;
|
|
wanted.dmode = mode & 07777;
|
|
if (isdir) wanted.dmode |= 0x10000;
|
|
#if POSIXACLS
|
|
wanted.variable = (void*)pxdesc;
|
|
if (pxdesc)
|
|
wanted.varsize = sizeof(struct POSIX_SECURITY)
|
|
+ (pxdesc->acccnt + pxdesc->defcnt)*sizeof(struct POSIX_ACE);
|
|
else
|
|
wanted.varsize = 0;
|
|
#else
|
|
wanted.variable = (void*)NULL;
|
|
wanted.varsize = 0;
|
|
#endif
|
|
if (test_nino_flag(ni, v3_Extensions)) {
|
|
cached = (const struct CACHED_SECURID*)ntfs_fetch_cache(
|
|
scx->vol->securid_cache, GENERIC(&wanted),
|
|
(cache_compare)compare);
|
|
/* quite simple, if we are lucky */
|
|
if (cached) {
|
|
ni->security_id = cached->securid;
|
|
NInoSetDirty(ni);
|
|
}
|
|
} else cached = (struct CACHED_SECURID*)NULL;
|
|
|
|
if (!cached) {
|
|
/*
|
|
* Do not use usid and gsid from former attributes,
|
|
* but recompute them to get repeatable results
|
|
* which can be kept in cache.
|
|
*/
|
|
usid = ntfs_find_usid(scx->mapping[MAPUSERS],uid,(SID*)&defusid);
|
|
gsid = ntfs_find_gsid(scx->mapping[MAPGROUPS],gid,(SID*)&defgsid);
|
|
if (!usid || !gsid) {
|
|
ntfs_log_error("File made owned by an unmapped user/group %d/%d\n",
|
|
uid, gid);
|
|
usid = gsid = adminsid;
|
|
}
|
|
#if POSIXACLS
|
|
if (pxdesc)
|
|
newattr = ntfs_build_descr_posix(scx->mapping, pxdesc,
|
|
isdir, usid, gsid);
|
|
else
|
|
newattr = ntfs_build_descr(mode,
|
|
isdir, usid, gsid);
|
|
#else
|
|
newattr = ntfs_build_descr(mode,
|
|
isdir, usid, gsid);
|
|
#endif
|
|
if (newattr) {
|
|
res = update_secur_descr(scx->vol, newattr, ni);
|
|
if (!res) {
|
|
/* adjust Windows read-only flag */
|
|
if (!isdir) {
|
|
if (mode & S_IWUSR)
|
|
ni->flags &= ~FILE_ATTR_READONLY;
|
|
else
|
|
ni->flags |= FILE_ATTR_READONLY;
|
|
NInoFileNameSetDirty(ni);
|
|
}
|
|
/* update cache, for subsequent use */
|
|
if (test_nino_flag(ni, v3_Extensions)) {
|
|
wanted.securid = ni->security_id;
|
|
ntfs_enter_cache(scx->vol->securid_cache,
|
|
GENERIC(&wanted),
|
|
(cache_compare)compare);
|
|
}
|
|
#if CACHE_LEGACY_SIZE
|
|
/* also invalidate legacy cache */
|
|
if (isdir && !ni->security_id) {
|
|
struct CACHED_PERMISSIONS_LEGACY legacy;
|
|
|
|
legacy.mft_no = ni->mft_no;
|
|
#if POSIXACLS
|
|
legacy.variable = wanted.variable;
|
|
legacy.varsize = wanted.varsize;
|
|
#else
|
|
legacy.variable = (void*)NULL;
|
|
legacy.varsize = 0;
|
|
#endif
|
|
ntfs_invalidate_cache(scx->vol->legacy_cache,
|
|
GENERIC(&legacy),
|
|
(cache_compare)leg_compare,0);
|
|
}
|
|
#endif
|
|
}
|
|
free(newattr);
|
|
} else {
|
|
/*
|
|
* could not build new security attribute
|
|
* errno set by ntfs_build_descr()
|
|
*/
|
|
res = -1;
|
|
}
|
|
}
|
|
return (res);
|
|
}
|
|
|
|
/*
|
|
* Check whether user has ownership rights on a file
|
|
*
|
|
* Returns TRUE if allowed
|
|
* if not, errno tells why
|
|
*/
|
|
|
|
BOOL ntfs_allowed_as_owner(struct SECURITY_CONTEXT *scx, ntfs_inode *ni)
|
|
{
|
|
const struct CACHED_PERMISSIONS *cached;
|
|
char *oldattr;
|
|
const SID *usid;
|
|
uid_t processuid;
|
|
uid_t uid;
|
|
BOOL gotowner;
|
|
int allowed;
|
|
|
|
processuid = scx->uid;
|
|
/* TODO : use CAP_FOWNER process capability */
|
|
/*
|
|
* Always allow for root
|
|
* Also always allow if no mapping has been defined
|
|
*/
|
|
if (!scx->mapping[MAPUSERS] || !processuid)
|
|
allowed = TRUE;
|
|
else {
|
|
gotowner = FALSE; /* default */
|
|
/* get the owner, either from cache or from old attribute */
|
|
cached = fetch_cache(scx, ni);
|
|
if (cached) {
|
|
uid = cached->uid;
|
|
gotowner = TRUE;
|
|
} else {
|
|
oldattr = getsecurityattr(scx->vol, ni);
|
|
if (oldattr) {
|
|
#if OWNERFROMACL
|
|
usid = ntfs_acl_owner(oldattr);
|
|
#else
|
|
const SECURITY_DESCRIPTOR_RELATIVE *phead;
|
|
|
|
phead = (const SECURITY_DESCRIPTOR_RELATIVE*)
|
|
oldattr;
|
|
usid = (const SID*)&oldattr
|
|
[le32_to_cpu(phead->owner)];
|
|
#endif
|
|
uid = ntfs_find_user(scx->mapping[MAPUSERS],
|
|
usid);
|
|
gotowner = TRUE;
|
|
free(oldattr);
|
|
}
|
|
}
|
|
allowed = FALSE;
|
|
if (gotowner) {
|
|
/* TODO : use CAP_FOWNER process capability */
|
|
if (!processuid || (processuid == uid))
|
|
allowed = TRUE;
|
|
else
|
|
errno = EPERM;
|
|
}
|
|
}
|
|
return (allowed);
|
|
}
|
|
|
|
#ifdef HAVE_SETXATTR /* extended attributes interface required */
|
|
|
|
#if POSIXACLS
|
|
|
|
/*
|
|
* Set a new access or default Posix ACL to a file
|
|
* (or remove ACL if no input data)
|
|
* Validity of input data is checked after merging
|
|
*
|
|
* Returns 0, or -1 if there is a problem which errno describes
|
|
*/
|
|
|
|
int ntfs_set_posix_acl(struct SECURITY_CONTEXT *scx, ntfs_inode *ni,
|
|
const char *name, const char *value, size_t size,
|
|
int flags)
|
|
{
|
|
const SECURITY_DESCRIPTOR_RELATIVE *phead;
|
|
const struct CACHED_PERMISSIONS *cached;
|
|
char *oldattr;
|
|
uid_t processuid;
|
|
const SID *usid;
|
|
const SID *gsid;
|
|
uid_t uid;
|
|
uid_t gid;
|
|
int res;
|
|
mode_t mode;
|
|
BOOL isdir;
|
|
BOOL deflt;
|
|
BOOL exist;
|
|
int count;
|
|
struct POSIX_SECURITY *oldpxdesc;
|
|
struct POSIX_SECURITY *newpxdesc;
|
|
|
|
/* get the current pxsec, either from cache or from old attribute */
|
|
res = -1;
|
|
deflt = !strcmp(name,"system.posix_acl_default");
|
|
if (size)
|
|
count = (size - sizeof(struct POSIX_ACL)) / sizeof(struct POSIX_ACE);
|
|
else
|
|
count = 0;
|
|
isdir = (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY) != const_cpu_to_le16(0);
|
|
newpxdesc = (struct POSIX_SECURITY*)NULL;
|
|
if ((!value
|
|
|| (((const struct POSIX_ACL*)value)->version == POSIX_VERSION))
|
|
&& (!deflt || isdir || (!size && !value))) {
|
|
cached = fetch_cache(scx, ni);
|
|
if (cached) {
|
|
uid = cached->uid;
|
|
gid = cached->gid;
|
|
oldpxdesc = cached->pxdesc;
|
|
if (oldpxdesc) {
|
|
mode = oldpxdesc->mode;
|
|
newpxdesc = ntfs_replace_acl(oldpxdesc,
|
|
(const struct POSIX_ACL*)value,count,deflt);
|
|
}
|
|
} else {
|
|
oldattr = getsecurityattr(scx->vol, ni);
|
|
if (oldattr) {
|
|
phead = (const SECURITY_DESCRIPTOR_RELATIVE*)oldattr;
|
|
#if OWNERFROMACL
|
|
usid = ntfs_acl_owner(oldattr);
|
|
#else
|
|
usid = (const SID*)&oldattr[le32_to_cpu(phead->owner)];
|
|
#endif
|
|
gsid = (const SID*)&oldattr[le32_to_cpu(phead->group)];
|
|
uid = ntfs_find_user(scx->mapping[MAPUSERS],usid);
|
|
gid = ntfs_find_group(scx->mapping[MAPGROUPS],gsid);
|
|
oldpxdesc = ntfs_build_permissions_posix(scx->mapping,
|
|
oldattr, usid, gsid, isdir);
|
|
if (oldpxdesc) {
|
|
if (deflt)
|
|
exist = oldpxdesc->defcnt > 0;
|
|
else
|
|
exist = oldpxdesc->acccnt > 3;
|
|
if ((exist && (flags & XATTR_CREATE))
|
|
|| (!exist && (flags & XATTR_REPLACE))) {
|
|
errno = (exist ? EEXIST : ENODATA);
|
|
} else {
|
|
mode = oldpxdesc->mode;
|
|
newpxdesc = ntfs_replace_acl(oldpxdesc,
|
|
(const struct POSIX_ACL*)value,count,deflt);
|
|
}
|
|
free(oldpxdesc);
|
|
}
|
|
free(oldattr);
|
|
}
|
|
}
|
|
} else
|
|
errno = EINVAL;
|
|
|
|
if (newpxdesc) {
|
|
processuid = scx->uid;
|
|
/* TODO : use CAP_FOWNER process capability */
|
|
if (!processuid || (uid == processuid)) {
|
|
/*
|
|
* clear setgid if file group does
|
|
* not match process group
|
|
*/
|
|
if (processuid && (gid != scx->gid)
|
|
&& !groupmember(scx, scx->uid, gid)) {
|
|
newpxdesc->mode &= ~S_ISGID;
|
|
}
|
|
res = ntfs_set_owner_mode(scx, ni, uid, gid,
|
|
newpxdesc->mode, newpxdesc);
|
|
} else
|
|
errno = EPERM;
|
|
free(newpxdesc);
|
|
}
|
|
return (res ? -1 : 0);
|
|
}
|
|
|
|
/*
|
|
* Remove a default Posix ACL from a file
|
|
*
|
|
* Returns 0, or -1 if there is a problem which errno describes
|
|
*/
|
|
|
|
int ntfs_remove_posix_acl(struct SECURITY_CONTEXT *scx, ntfs_inode *ni,
|
|
const char *name)
|
|
{
|
|
return (ntfs_set_posix_acl(scx, ni, name,
|
|
(const char*)NULL, 0, 0));
|
|
}
|
|
|
|
#endif
|
|
|
|
/*
|
|
* Set a new NTFS ACL to a file
|
|
*
|
|
* Returns 0, or -1 if there is a problem
|
|
*/
|
|
|
|
int ntfs_set_ntfs_acl(struct SECURITY_CONTEXT *scx, ntfs_inode *ni,
|
|
const char *value, size_t size, int flags)
|
|
{
|
|
char *attr;
|
|
int res;
|
|
|
|
res = -1;
|
|
if ((size > 0)
|
|
&& !(flags & XATTR_CREATE)
|
|
&& ntfs_valid_descr(value,size)
|
|
&& (ntfs_attr_size(value) == size)) {
|
|
/* need copying in order to write */
|
|
attr = (char*)ntfs_malloc(size);
|
|
if (attr) {
|
|
memcpy(attr,value,size);
|
|
res = update_secur_descr(scx->vol, attr, ni);
|
|
/*
|
|
* No need to invalidate standard caches :
|
|
* the relation between a securid and
|
|
* the associated protection is unchanged,
|
|
* only the relation between a file and
|
|
* its securid and protection is changed.
|
|
*/
|
|
#if CACHE_LEGACY_SIZE
|
|
/*
|
|
* we must however invalidate the legacy
|
|
* cache, which is based on inode numbers.
|
|
* For safety, invalidate even if updating
|
|
* failed.
|
|
*/
|
|
if ((ni->mrec->flags & MFT_RECORD_IS_DIRECTORY)
|
|
&& !ni->security_id) {
|
|
struct CACHED_PERMISSIONS_LEGACY legacy;
|
|
|
|
legacy.mft_no = ni->mft_no;
|
|
legacy.variable = (char*)NULL;
|
|
legacy.varsize = 0;
|
|
ntfs_invalidate_cache(scx->vol->legacy_cache,
|
|
GENERIC(&legacy),
|
|
(cache_compare)leg_compare,0);
|
|
}
|
|
#endif
|
|
free(attr);
|
|
} else
|
|
errno = ENOMEM;
|
|
} else
|
|
errno = EINVAL;
|
|
return (res ? -1 : 0);
|
|
}
|
|
|
|
#endif /* HAVE_SETXATTR */
|
|
|
|
/*
|
|
* Set new permissions to a file
|
|
* Checks user mapping has been defined before request for setting
|
|
*
|
|
* rejected if request is not originated by owner or root
|
|
*
|
|
* returns 0 on success
|
|
* -1 on failure, with errno = EIO
|
|
*/
|
|
|
|
int ntfs_set_mode(struct SECURITY_CONTEXT *scx, ntfs_inode *ni, mode_t mode)
|
|
{
|
|
const SECURITY_DESCRIPTOR_RELATIVE *phead;
|
|
const struct CACHED_PERMISSIONS *cached;
|
|
char *oldattr;
|
|
const SID *usid;
|
|
const SID *gsid;
|
|
uid_t processuid;
|
|
uid_t uid;
|
|
uid_t gid;
|
|
int res;
|
|
#if POSIXACLS
|
|
BOOL isdir;
|
|
int pxsize;
|
|
const struct POSIX_SECURITY *oldpxdesc;
|
|
struct POSIX_SECURITY *newpxdesc = (struct POSIX_SECURITY*)NULL;
|
|
#endif
|
|
|
|
/* get the current owner, either from cache or from old attribute */
|
|
res = 0;
|
|
cached = fetch_cache(scx, ni);
|
|
if (cached) {
|
|
uid = cached->uid;
|
|
gid = cached->gid;
|
|
#if POSIXACLS
|
|
oldpxdesc = cached->pxdesc;
|
|
if (oldpxdesc) {
|
|
/* must copy before merging */
|
|
pxsize = sizeof(struct POSIX_SECURITY)
|
|
+ (oldpxdesc->acccnt + oldpxdesc->defcnt)*sizeof(struct POSIX_ACE);
|
|
newpxdesc = (struct POSIX_SECURITY*)malloc(pxsize);
|
|
if (newpxdesc) {
|
|
memcpy(newpxdesc, oldpxdesc, pxsize);
|
|
if (ntfs_merge_mode_posix(newpxdesc, mode))
|
|
res = -1;
|
|
} else
|
|
res = -1;
|
|
} else
|
|
newpxdesc = (struct POSIX_SECURITY*)NULL;
|
|
#endif
|
|
} else {
|
|
oldattr = getsecurityattr(scx->vol, ni);
|
|
if (oldattr) {
|
|
phead = (const SECURITY_DESCRIPTOR_RELATIVE*)oldattr;
|
|
#if OWNERFROMACL
|
|
usid = ntfs_acl_owner(oldattr);
|
|
#else
|
|
usid = (const SID*)&oldattr[le32_to_cpu(phead->owner)];
|
|
#endif
|
|
gsid = (const SID*)&oldattr[le32_to_cpu(phead->group)];
|
|
uid = ntfs_find_user(scx->mapping[MAPUSERS],usid);
|
|
gid = ntfs_find_group(scx->mapping[MAPGROUPS],gsid);
|
|
#if POSIXACLS
|
|
isdir = (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY) != const_cpu_to_le16(0);
|
|
newpxdesc = ntfs_build_permissions_posix(scx->mapping,
|
|
oldattr, usid, gsid, isdir);
|
|
if (!newpxdesc || ntfs_merge_mode_posix(newpxdesc, mode))
|
|
res = -1;
|
|
#endif
|
|
free(oldattr);
|
|
} else
|
|
res = -1;
|
|
}
|
|
|
|
if (!res) {
|
|
processuid = scx->uid;
|
|
/* TODO : use CAP_FOWNER process capability */
|
|
if (!processuid || (uid == processuid)) {
|
|
/*
|
|
* clear setgid if file group does
|
|
* not match process group
|
|
*/
|
|
if (processuid && (gid != scx->gid)
|
|
&& !groupmember(scx, scx->uid, gid))
|
|
mode &= ~S_ISGID;
|
|
#if POSIXACLS
|
|
if (newpxdesc) {
|
|
newpxdesc->mode = mode;
|
|
res = ntfs_set_owner_mode(scx, ni, uid, gid,
|
|
mode, newpxdesc);
|
|
} else
|
|
res = ntfs_set_owner_mode(scx, ni, uid, gid,
|
|
mode, newpxdesc);
|
|
#else
|
|
res = ntfs_set_owner_mode(scx, ni, uid, gid, mode);
|
|
#endif
|
|
} else {
|
|
errno = EPERM;
|
|
res = -1; /* neither owner nor root */
|
|
}
|
|
} else {
|
|
/*
|
|
* Should not happen : a default descriptor is generated
|
|
* by getsecurityattr() when there are none
|
|
*/
|
|
ntfs_log_error("File has no security descriptor\n");
|
|
res = -1;
|
|
errno = EIO;
|
|
}
|
|
#if POSIXACLS
|
|
if (newpxdesc) free(newpxdesc);
|
|
#endif
|
|
return (res ? -1 : 0);
|
|
}
|
|
|
|
/*
|
|
* Create a default security descriptor for files whose descriptor
|
|
* cannot be inherited
|
|
*/
|
|
|
|
int ntfs_sd_add_everyone(ntfs_inode *ni)
|
|
{
|
|
/* JPA SECURITY_DESCRIPTOR_ATTR *sd; */
|
|
SECURITY_DESCRIPTOR_RELATIVE *sd;
|
|
ACL *acl;
|
|
ACCESS_ALLOWED_ACE *ace;
|
|
SID *sid;
|
|
int ret, sd_len;
|
|
|
|
/* Create SECURITY_DESCRIPTOR attribute (everyone has full access). */
|
|
/*
|
|
* Calculate security descriptor length. We have 2 sub-authorities in
|
|
* owner and group SIDs, but structure SID contain only one, so add
|
|
* 4 bytes to every SID.
|
|
*/
|
|
sd_len = sizeof(SECURITY_DESCRIPTOR_ATTR) + 2 * (sizeof(SID) + 4) +
|
|
sizeof(ACL) + sizeof(ACCESS_ALLOWED_ACE);
|
|
sd = (SECURITY_DESCRIPTOR_RELATIVE*)ntfs_calloc(sd_len);
|
|
if (!sd)
|
|
return -1;
|
|
|
|
sd->revision = SECURITY_DESCRIPTOR_REVISION;
|
|
sd->control = SE_DACL_PRESENT | SE_SELF_RELATIVE;
|
|
|
|
sid = (SID*)((u8*)sd + sizeof(SECURITY_DESCRIPTOR_ATTR));
|
|
sid->revision = SID_REVISION;
|
|
sid->sub_authority_count = 2;
|
|
sid->sub_authority[0] = const_cpu_to_le32(SECURITY_BUILTIN_DOMAIN_RID);
|
|
sid->sub_authority[1] = const_cpu_to_le32(DOMAIN_ALIAS_RID_ADMINS);
|
|
sid->identifier_authority.value[5] = 5;
|
|
sd->owner = cpu_to_le32((u8*)sid - (u8*)sd);
|
|
|
|
sid = (SID*)((u8*)sid + sizeof(SID) + 4);
|
|
sid->revision = SID_REVISION;
|
|
sid->sub_authority_count = 2;
|
|
sid->sub_authority[0] = const_cpu_to_le32(SECURITY_BUILTIN_DOMAIN_RID);
|
|
sid->sub_authority[1] = const_cpu_to_le32(DOMAIN_ALIAS_RID_ADMINS);
|
|
sid->identifier_authority.value[5] = 5;
|
|
sd->group = cpu_to_le32((u8*)sid - (u8*)sd);
|
|
|
|
acl = (ACL*)((u8*)sid + sizeof(SID) + 4);
|
|
acl->revision = ACL_REVISION;
|
|
acl->size = const_cpu_to_le16(sizeof(ACL) + sizeof(ACCESS_ALLOWED_ACE));
|
|
acl->ace_count = const_cpu_to_le16(1);
|
|
sd->dacl = cpu_to_le32((u8*)acl - (u8*)sd);
|
|
|
|
ace = (ACCESS_ALLOWED_ACE*)((u8*)acl + sizeof(ACL));
|
|
ace->type = ACCESS_ALLOWED_ACE_TYPE;
|
|
ace->flags = OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE;
|
|
ace->size = const_cpu_to_le16(sizeof(ACCESS_ALLOWED_ACE));
|
|
ace->mask = const_cpu_to_le32(0x1f01ff); /* FIXME */
|
|
ace->sid.revision = SID_REVISION;
|
|
ace->sid.sub_authority_count = 1;
|
|
ace->sid.sub_authority[0] = const_cpu_to_le32(0);
|
|
ace->sid.identifier_authority.value[5] = 1;
|
|
|
|
ret = ntfs_attr_add(ni, AT_SECURITY_DESCRIPTOR, AT_UNNAMED, 0, (u8*)sd,
|
|
sd_len);
|
|
if (ret)
|
|
ntfs_log_perror("Failed to add initial SECURITY_DESCRIPTOR");
|
|
|
|
free(sd);
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* Check whether user can access a file in a specific way
|
|
*
|
|
* Returns 1 if access is allowed, including user is root or no
|
|
* user mapping defined
|
|
* 2 if sticky and accesstype is S_IWRITE + S_IEXEC + S_ISVTX
|
|
* 0 and sets errno if there is a problem or if access
|
|
* is not allowed
|
|
*
|
|
* This is used for Posix ACL and checking creation of DOS file names
|
|
*/
|
|
|
|
int ntfs_allowed_access(struct SECURITY_CONTEXT *scx,
|
|
ntfs_inode *ni,
|
|
int accesstype) /* access type required (S_Ixxx values) */
|
|
{
|
|
int perm;
|
|
int res;
|
|
int allow;
|
|
struct stat stbuf;
|
|
|
|
/*
|
|
* Always allow for root unless execution is requested.
|
|
* (was checked by fuse until kernel 2.6.29)
|
|
* Also always allow if no mapping has been defined
|
|
*/
|
|
if (!scx->mapping[MAPUSERS]
|
|
|| (!scx->uid
|
|
&& (!(accesstype & S_IEXEC)
|
|
|| (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY))))
|
|
allow = 1;
|
|
else {
|
|
perm = ntfs_get_perm(scx, ni, accesstype);
|
|
if (perm >= 0) {
|
|
res = EACCES;
|
|
switch (accesstype) {
|
|
case S_IEXEC:
|
|
allow = (perm & (S_IXUSR | S_IXGRP | S_IXOTH)) != 0;
|
|
break;
|
|
case S_IWRITE:
|
|
allow = (perm & (S_IWUSR | S_IWGRP | S_IWOTH)) != 0;
|
|
break;
|
|
case S_IWRITE + S_IEXEC:
|
|
allow = ((perm & (S_IWUSR | S_IWGRP | S_IWOTH)) != 0)
|
|
&& ((perm & (S_IXUSR | S_IXGRP | S_IXOTH)) != 0);
|
|
break;
|
|
case S_IREAD:
|
|
allow = (perm & (S_IRUSR | S_IRGRP | S_IROTH)) != 0;
|
|
break;
|
|
case S_IREAD + S_IEXEC:
|
|
allow = ((perm & (S_IRUSR | S_IRGRP | S_IROTH)) != 0)
|
|
&& ((perm & (S_IXUSR | S_IXGRP | S_IXOTH)) != 0);
|
|
break;
|
|
case S_IREAD + S_IWRITE:
|
|
allow = ((perm & (S_IRUSR | S_IRGRP | S_IROTH)) != 0)
|
|
&& ((perm & (S_IWUSR | S_IWGRP | S_IWOTH)) != 0);
|
|
break;
|
|
case S_IWRITE + S_IEXEC + S_ISVTX:
|
|
if (perm & S_ISVTX) {
|
|
if ((ntfs_get_owner_mode(scx,ni,&stbuf) >= 0)
|
|
&& (stbuf.st_uid == scx->uid))
|
|
allow = 1;
|
|
else
|
|
allow = 2;
|
|
} else
|
|
allow = ((perm & (S_IWUSR | S_IWGRP | S_IWOTH)) != 0)
|
|
&& ((perm & (S_IXUSR | S_IXGRP | S_IXOTH)) != 0);
|
|
break;
|
|
case S_IREAD + S_IWRITE + S_IEXEC:
|
|
allow = ((perm & (S_IRUSR | S_IRGRP | S_IROTH)) != 0)
|
|
&& ((perm & (S_IWUSR | S_IWGRP | S_IWOTH)) != 0)
|
|
&& ((perm & (S_IXUSR | S_IXGRP | S_IXOTH)) != 0);
|
|
break;
|
|
default :
|
|
res = EINVAL;
|
|
allow = 0;
|
|
break;
|
|
}
|
|
if (!allow)
|
|
errno = res;
|
|
} else
|
|
allow = 0;
|
|
}
|
|
return (allow);
|
|
}
|
|
|
|
#if 0 /* not needed any more */
|
|
|
|
/*
|
|
* Check whether user can access the parent directory
|
|
* of a file in a specific way
|
|
*
|
|
* Returns true if access is allowed, including user is root and
|
|
* no user mapping defined
|
|
*
|
|
* Sets errno if there is a problem or if not allowed
|
|
*
|
|
* This is used for Posix ACL and checking creation of DOS file names
|
|
*/
|
|
|
|
BOOL old_ntfs_allowed_dir_access(struct SECURITY_CONTEXT *scx,
|
|
const char *path, int accesstype)
|
|
{
|
|
int allow;
|
|
char *dirpath;
|
|
char *name;
|
|
ntfs_inode *ni;
|
|
ntfs_inode *dir_ni;
|
|
struct stat stbuf;
|
|
|
|
allow = 0;
|
|
dirpath = strdup(path);
|
|
if (dirpath) {
|
|
/* the root of file system is seen as a parent of itself */
|
|
/* is that correct ? */
|
|
name = strrchr(dirpath, '/');
|
|
*name = 0;
|
|
dir_ni = ntfs_pathname_to_inode(scx->vol, NULL, dirpath);
|
|
if (dir_ni) {
|
|
allow = ntfs_allowed_access(scx,
|
|
dir_ni, accesstype);
|
|
ntfs_inode_close(dir_ni);
|
|
/*
|
|
* for an not-owned sticky directory, have to
|
|
* check whether file itself is owned
|
|
*/
|
|
if ((accesstype == (S_IWRITE + S_IEXEC + S_ISVTX))
|
|
&& (allow == 2)) {
|
|
ni = ntfs_pathname_to_inode(scx->vol, NULL,
|
|
path);
|
|
allow = FALSE;
|
|
if (ni) {
|
|
allow = (ntfs_get_owner_mode(scx,ni,&stbuf) >= 0)
|
|
&& (stbuf.st_uid == scx->uid);
|
|
ntfs_inode_close(ni);
|
|
}
|
|
}
|
|
}
|
|
free(dirpath);
|
|
}
|
|
return (allow); /* errno is set if not allowed */
|
|
}
|
|
|
|
#endif
|
|
|
|
/*
|
|
* Define a new owner/group to a file
|
|
*
|
|
* returns zero if successful
|
|
*/
|
|
|
|
int ntfs_set_owner(struct SECURITY_CONTEXT *scx, ntfs_inode *ni,
|
|
uid_t uid, gid_t gid)
|
|
{
|
|
const SECURITY_DESCRIPTOR_RELATIVE *phead;
|
|
const struct CACHED_PERMISSIONS *cached;
|
|
char *oldattr;
|
|
const SID *usid;
|
|
const SID *gsid;
|
|
uid_t fileuid;
|
|
uid_t filegid;
|
|
mode_t mode;
|
|
int perm;
|
|
BOOL isdir;
|
|
int res;
|
|
#if POSIXACLS
|
|
struct POSIX_SECURITY *pxdesc;
|
|
BOOL pxdescbuilt = FALSE;
|
|
#endif
|
|
|
|
res = 0;
|
|
/* get the current owner and mode from cache or security attributes */
|
|
oldattr = (char*)NULL;
|
|
cached = fetch_cache(scx,ni);
|
|
if (cached) {
|
|
fileuid = cached->uid;
|
|
filegid = cached->gid;
|
|
mode = cached->mode;
|
|
#if POSIXACLS
|
|
pxdesc = cached->pxdesc;
|
|
if (!pxdesc)
|
|
res = -1;
|
|
#endif
|
|
} else {
|
|
fileuid = 0;
|
|
filegid = 0;
|
|
mode = 0;
|
|
oldattr = getsecurityattr(scx->vol, ni);
|
|
if (oldattr) {
|
|
isdir = (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY)
|
|
!= const_cpu_to_le16(0);
|
|
phead = (const SECURITY_DESCRIPTOR_RELATIVE*)
|
|
oldattr;
|
|
gsid = (const SID*)
|
|
&oldattr[le32_to_cpu(phead->group)];
|
|
#if OWNERFROMACL
|
|
usid = ntfs_acl_owner(oldattr);
|
|
#else
|
|
usid = (const SID*)
|
|
&oldattr[le32_to_cpu(phead->owner)];
|
|
#endif
|
|
#if POSIXACLS
|
|
pxdesc = ntfs_build_permissions_posix(scx->mapping, oldattr,
|
|
usid, gsid, isdir);
|
|
if (pxdesc) {
|
|
pxdescbuilt = TRUE;
|
|
fileuid = ntfs_find_user(scx->mapping[MAPUSERS],usid);
|
|
filegid = ntfs_find_group(scx->mapping[MAPGROUPS],gsid);
|
|
mode = perm = pxdesc->mode;
|
|
} else
|
|
res = -1;
|
|
#else
|
|
mode = perm = ntfs_build_permissions(oldattr,
|
|
usid, gsid, isdir);
|
|
if (perm >= 0) {
|
|
fileuid = ntfs_find_user(scx->mapping[MAPUSERS],usid);
|
|
filegid = ntfs_find_group(scx->mapping[MAPGROUPS],gsid);
|
|
} else
|
|
res = -1;
|
|
#endif
|
|
free(oldattr);
|
|
} else
|
|
res = -1;
|
|
}
|
|
if (!res) {
|
|
/* check requested by root */
|
|
/* or chgrp requested by owner to an owned group */
|
|
if (!scx->uid
|
|
|| ((((int)uid < 0) || (uid == fileuid))
|
|
&& ((gid == scx->gid) || groupmember(scx, scx->uid, gid))
|
|
&& (fileuid == scx->uid))) {
|
|
/* replace by the new usid and gsid */
|
|
/* or reuse old gid and sid for cacheing */
|
|
if ((int)uid < 0)
|
|
uid = fileuid;
|
|
if ((int)gid < 0)
|
|
gid = filegid;
|
|
/* clear setuid and setgid if owner has changed */
|
|
/* unless request originated by root */
|
|
if (uid && (fileuid != uid))
|
|
mode &= 01777;
|
|
#if POSIXACLS
|
|
res = ntfs_set_owner_mode(scx, ni, uid, gid,
|
|
mode, pxdesc);
|
|
#else
|
|
res = ntfs_set_owner_mode(scx, ni, uid, gid, mode);
|
|
#endif
|
|
} else {
|
|
res = -1; /* neither owner nor root */
|
|
errno = EPERM;
|
|
}
|
|
#if POSIXACLS
|
|
if (pxdescbuilt)
|
|
free(pxdesc);
|
|
#endif
|
|
} else {
|
|
/*
|
|
* Should not happen : a default descriptor is generated
|
|
* by getsecurityattr() when there are none
|
|
*/
|
|
ntfs_log_error("File has no security descriptor\n");
|
|
res = -1;
|
|
errno = EIO;
|
|
}
|
|
return (res ? -1 : 0);
|
|
}
|
|
|
|
/*
|
|
* Define new owner/group and mode to a file
|
|
*
|
|
* returns zero if successful
|
|
*/
|
|
|
|
int ntfs_set_ownmod(struct SECURITY_CONTEXT *scx, ntfs_inode *ni,
|
|
uid_t uid, gid_t gid, const mode_t mode)
|
|
{
|
|
const SECURITY_DESCRIPTOR_RELATIVE *phead;
|
|
const struct CACHED_PERMISSIONS *cached;
|
|
char *oldattr;
|
|
const SID *usid;
|
|
const SID *gsid;
|
|
uid_t fileuid;
|
|
uid_t filegid;
|
|
BOOL isdir;
|
|
int res;
|
|
#if POSIXACLS
|
|
const struct POSIX_SECURITY *oldpxdesc;
|
|
struct POSIX_SECURITY *newpxdesc = (struct POSIX_SECURITY*)NULL;
|
|
int pxsize;
|
|
#endif
|
|
|
|
res = 0;
|
|
/* get the current owner and mode from cache or security attributes */
|
|
oldattr = (char*)NULL;
|
|
cached = fetch_cache(scx,ni);
|
|
if (cached) {
|
|
fileuid = cached->uid;
|
|
filegid = cached->gid;
|
|
#if POSIXACLS
|
|
oldpxdesc = cached->pxdesc;
|
|
if (oldpxdesc) {
|
|
/* must copy before merging */
|
|
pxsize = sizeof(struct POSIX_SECURITY)
|
|
+ (oldpxdesc->acccnt + oldpxdesc->defcnt)*sizeof(struct POSIX_ACE);
|
|
newpxdesc = (struct POSIX_SECURITY*)malloc(pxsize);
|
|
if (newpxdesc) {
|
|
memcpy(newpxdesc, oldpxdesc, pxsize);
|
|
if (ntfs_merge_mode_posix(newpxdesc, mode))
|
|
res = -1;
|
|
} else
|
|
res = -1;
|
|
}
|
|
#endif
|
|
} else {
|
|
fileuid = 0;
|
|
filegid = 0;
|
|
oldattr = getsecurityattr(scx->vol, ni);
|
|
if (oldattr) {
|
|
isdir = (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY)
|
|
!= const_cpu_to_le16(0);
|
|
phead = (const SECURITY_DESCRIPTOR_RELATIVE*)
|
|
oldattr;
|
|
gsid = (const SID*)
|
|
&oldattr[le32_to_cpu(phead->group)];
|
|
#if OWNERFROMACL
|
|
usid = ntfs_acl_owner(oldattr);
|
|
#else
|
|
usid = (const SID*)
|
|
&oldattr[le32_to_cpu(phead->owner)];
|
|
#endif
|
|
#if POSIXACLS
|
|
newpxdesc = ntfs_build_permissions_posix(scx->mapping, oldattr,
|
|
usid, gsid, isdir);
|
|
if (!newpxdesc || ntfs_merge_mode_posix(newpxdesc, mode))
|
|
res = -1;
|
|
else {
|
|
fileuid = ntfs_find_user(scx->mapping[MAPUSERS],usid);
|
|
filegid = ntfs_find_group(scx->mapping[MAPGROUPS],gsid);
|
|
}
|
|
#endif
|
|
free(oldattr);
|
|
} else
|
|
res = -1;
|
|
}
|
|
if (!res) {
|
|
/* check requested by root */
|
|
/* or chgrp requested by owner to an owned group */
|
|
if (!scx->uid
|
|
|| ((((int)uid < 0) || (uid == fileuid))
|
|
&& ((gid == scx->gid) || groupmember(scx, scx->uid, gid))
|
|
&& (fileuid == scx->uid))) {
|
|
/* replace by the new usid and gsid */
|
|
/* or reuse old gid and sid for cacheing */
|
|
if ((int)uid < 0)
|
|
uid = fileuid;
|
|
if ((int)gid < 0)
|
|
gid = filegid;
|
|
#if POSIXACLS
|
|
res = ntfs_set_owner_mode(scx, ni, uid, gid,
|
|
mode, newpxdesc);
|
|
#else
|
|
res = ntfs_set_owner_mode(scx, ni, uid, gid, mode);
|
|
#endif
|
|
} else {
|
|
res = -1; /* neither owner nor root */
|
|
errno = EPERM;
|
|
}
|
|
} else {
|
|
/*
|
|
* Should not happen : a default descriptor is generated
|
|
* by getsecurityattr() when there are none
|
|
*/
|
|
ntfs_log_error("File has no security descriptor\n");
|
|
res = -1;
|
|
errno = EIO;
|
|
}
|
|
#if POSIXACLS
|
|
free(newpxdesc);
|
|
#endif
|
|
return (res ? -1 : 0);
|
|
}
|
|
|
|
/*
|
|
* Build a security id for a descriptor inherited from
|
|
* parent directory the Windows way
|
|
*/
|
|
|
|
static le32 build_inherited_id(struct SECURITY_CONTEXT *scx,
|
|
const char *parentattr, BOOL fordir)
|
|
{
|
|
const SECURITY_DESCRIPTOR_RELATIVE *pphead;
|
|
const ACL *ppacl;
|
|
const SID *usid;
|
|
const SID *gsid;
|
|
BIGSID defusid;
|
|
BIGSID defgsid;
|
|
int offpacl;
|
|
int offowner;
|
|
int offgroup;
|
|
SECURITY_DESCRIPTOR_RELATIVE *pnhead;
|
|
ACL *pnacl;
|
|
int parentattrsz;
|
|
char *newattr;
|
|
int newattrsz;
|
|
int aclsz;
|
|
int usidsz;
|
|
int gsidsz;
|
|
int pos;
|
|
le32 securid;
|
|
|
|
parentattrsz = ntfs_attr_size(parentattr);
|
|
pphead = (const SECURITY_DESCRIPTOR_RELATIVE*)parentattr;
|
|
if (scx->mapping[MAPUSERS]) {
|
|
usid = ntfs_find_usid(scx->mapping[MAPUSERS], scx->uid, (SID*)&defusid);
|
|
gsid = ntfs_find_gsid(scx->mapping[MAPGROUPS], scx->gid, (SID*)&defgsid);
|
|
if (!usid)
|
|
usid = adminsid;
|
|
if (!gsid)
|
|
gsid = adminsid;
|
|
} else {
|
|
/*
|
|
* If there is no user mapping, we have to copy owner
|
|
* and group from parent directory.
|
|
* Windows never has to do that, because it can always
|
|
* rely on a user mapping
|
|
*/
|
|
offowner = le32_to_cpu(pphead->owner);
|
|
usid = (const SID*)&parentattr[offowner];
|
|
offgroup = le32_to_cpu(pphead->group);
|
|
gsid = (const SID*)&parentattr[offgroup];
|
|
}
|
|
/*
|
|
* new attribute is smaller than parent's
|
|
* except for differences in SIDs which appear in
|
|
* owner, group and possible grants and denials in
|
|
* generic creator-owner and creator-group ACEs.
|
|
* For directories, an ACE may be duplicated for
|
|
* access and inheritance, so we double the count.
|
|
*/
|
|
usidsz = ntfs_sid_size(usid);
|
|
gsidsz = ntfs_sid_size(gsid);
|
|
newattrsz = parentattrsz + 3*usidsz + 3*gsidsz;
|
|
if (fordir)
|
|
newattrsz *= 2;
|
|
newattr = (char*)ntfs_malloc(newattrsz);
|
|
if (newattr) {
|
|
pnhead = (SECURITY_DESCRIPTOR_RELATIVE*)newattr;
|
|
pnhead->revision = SECURITY_DESCRIPTOR_REVISION;
|
|
pnhead->alignment = 0;
|
|
pnhead->control = SE_SELF_RELATIVE;
|
|
pos = sizeof(SECURITY_DESCRIPTOR_RELATIVE);
|
|
/*
|
|
* locate and inherit DACL
|
|
* do not test SE_DACL_PRESENT (wrong for "DR Watson")
|
|
*/
|
|
pnhead->dacl = const_cpu_to_le32(0);
|
|
if (pphead->dacl) {
|
|
offpacl = le32_to_cpu(pphead->dacl);
|
|
ppacl = (const ACL*)&parentattr[offpacl];
|
|
pnacl = (ACL*)&newattr[pos];
|
|
aclsz = ntfs_inherit_acl(ppacl, pnacl, usid, gsid, fordir);
|
|
if (aclsz) {
|
|
pnhead->dacl = cpu_to_le32(pos);
|
|
pos += aclsz;
|
|
pnhead->control |= SE_DACL_PRESENT;
|
|
}
|
|
}
|
|
/*
|
|
* locate and inherit SACL
|
|
*/
|
|
pnhead->sacl = const_cpu_to_le32(0);
|
|
if (pphead->sacl) {
|
|
offpacl = le32_to_cpu(pphead->sacl);
|
|
ppacl = (const ACL*)&parentattr[offpacl];
|
|
pnacl = (ACL*)&newattr[pos];
|
|
aclsz = ntfs_inherit_acl(ppacl, pnacl, usid, gsid, fordir);
|
|
if (aclsz) {
|
|
pnhead->sacl = cpu_to_le32(pos);
|
|
pos += aclsz;
|
|
pnhead->control |= SE_SACL_PRESENT;
|
|
}
|
|
}
|
|
/*
|
|
* inherit or redefine owner
|
|
*/
|
|
memcpy(&newattr[pos],usid,usidsz);
|
|
pnhead->owner = cpu_to_le32(pos);
|
|
pos += usidsz;
|
|
/*
|
|
* inherit or redefine group
|
|
*/
|
|
memcpy(&newattr[pos],gsid,gsidsz);
|
|
pnhead->group = cpu_to_le32(pos);
|
|
pos += usidsz;
|
|
securid = setsecurityattr(scx->vol,
|
|
(SECURITY_DESCRIPTOR_RELATIVE*)newattr, pos);
|
|
free(newattr);
|
|
} else
|
|
securid = const_cpu_to_le32(0);
|
|
return (securid);
|
|
}
|
|
|
|
/*
|
|
* Get an inherited security id
|
|
*
|
|
* For Windows compatibility, the normal initial permission setting
|
|
* may be inherited from the parent directory instead of being
|
|
* defined by the creation arguments.
|
|
*
|
|
* The following creates an inherited id for that purpose.
|
|
*
|
|
* Note : the owner and group of parent directory are also
|
|
* inherited (which is not the case on Windows) if no user mapping
|
|
* is defined.
|
|
*
|
|
* Returns the inherited id, or zero if not possible (eg on NTFS 1.x)
|
|
*/
|
|
|
|
le32 ntfs_inherited_id(struct SECURITY_CONTEXT *scx,
|
|
ntfs_inode *dir_ni, BOOL fordir)
|
|
{
|
|
struct CACHED_PERMISSIONS *cached;
|
|
char *parentattr;
|
|
le32 securid;
|
|
|
|
securid = const_cpu_to_le32(0);
|
|
cached = (struct CACHED_PERMISSIONS*)NULL;
|
|
/*
|
|
* Try to get inherited id from cache
|
|
*/
|
|
if (test_nino_flag(dir_ni, v3_Extensions)
|
|
&& dir_ni->security_id) {
|
|
cached = fetch_cache(scx, dir_ni);
|
|
if (cached)
|
|
securid = (fordir ? cached->inh_dirid
|
|
: cached->inh_fileid);
|
|
}
|
|
/*
|
|
* Not cached or not available in cache, compute it all
|
|
* Note : if parent directory has no id, it is not cacheable
|
|
*/
|
|
if (!securid) {
|
|
parentattr = getsecurityattr(scx->vol, dir_ni);
|
|
if (parentattr) {
|
|
securid = build_inherited_id(scx,
|
|
parentattr, fordir);
|
|
free(parentattr);
|
|
/*
|
|
* Store the result into cache for further use
|
|
*/
|
|
if (securid) {
|
|
cached = fetch_cache(scx, dir_ni);
|
|
if (cached) {
|
|
if (fordir)
|
|
cached->inh_dirid = securid;
|
|
else
|
|
cached->inh_fileid = securid;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
return (securid);
|
|
}
|
|
|
|
/*
|
|
* Link a group to a member of group
|
|
*
|
|
* Returns 0 if OK, -1 (and errno set) if error
|
|
*/
|
|
|
|
static int link_single_group(struct MAPPING *usermapping, struct passwd *user,
|
|
gid_t gid)
|
|
{
|
|
struct group *group;
|
|
char **grmem;
|
|
int grcnt;
|
|
gid_t *groups;
|
|
int res;
|
|
|
|
res = 0;
|
|
group = getgrgid(gid);
|
|
if (group && group->gr_mem) {
|
|
grcnt = usermapping->grcnt;
|
|
groups = usermapping->groups;
|
|
grmem = group->gr_mem;
|
|
while (*grmem && strcmp(user->pw_name, *grmem))
|
|
grmem++;
|
|
if (*grmem) {
|
|
if (!grcnt)
|
|
groups = (gid_t*)malloc(sizeof(gid_t));
|
|
else
|
|
groups = (gid_t*)realloc(groups,
|
|
(grcnt+1)*sizeof(gid_t));
|
|
if (groups)
|
|
groups[grcnt++] = gid;
|
|
else {
|
|
res = -1;
|
|
errno = ENOMEM;
|
|
}
|
|
}
|
|
usermapping->grcnt = grcnt;
|
|
usermapping->groups = groups;
|
|
}
|
|
return (res);
|
|
}
|
|
|
|
|
|
/*
|
|
* Statically link group to users
|
|
* This is based on groups defined in /etc/group and does not take
|
|
* the groups dynamically set by setgroups() nor any changes in
|
|
* /etc/group into account
|
|
*
|
|
* Only mapped groups and root group are linked to mapped users
|
|
*
|
|
* Returns 0 if OK, -1 (and errno set) if error
|
|
*
|
|
*/
|
|
|
|
static int link_group_members(struct SECURITY_CONTEXT *scx)
|
|
{
|
|
struct MAPPING *usermapping;
|
|
struct MAPPING *groupmapping;
|
|
struct passwd *user;
|
|
int res;
|
|
|
|
res = 0;
|
|
for (usermapping=scx->mapping[MAPUSERS]; usermapping && !res;
|
|
usermapping=usermapping->next) {
|
|
usermapping->grcnt = 0;
|
|
usermapping->groups = (gid_t*)NULL;
|
|
user = getpwuid(usermapping->xid);
|
|
if (user && user->pw_name) {
|
|
for (groupmapping=scx->mapping[MAPGROUPS];
|
|
groupmapping && !res;
|
|
groupmapping=groupmapping->next) {
|
|
if (link_single_group(usermapping, user,
|
|
groupmapping->xid))
|
|
res = -1;
|
|
}
|
|
if (!res && link_single_group(usermapping,
|
|
user, (gid_t)0))
|
|
res = -1;
|
|
}
|
|
}
|
|
return (res);
|
|
}
|
|
|
|
/*
|
|
* Apply default single user mapping
|
|
* returns zero if successful
|
|
*/
|
|
|
|
static int ntfs_do_default_mapping(struct SECURITY_CONTEXT *scx,
|
|
uid_t uid, gid_t gid, const SID *usid)
|
|
{
|
|
struct MAPPING *usermapping;
|
|
struct MAPPING *groupmapping;
|
|
SID *sid;
|
|
int sidsz;
|
|
int res;
|
|
|
|
res = -1;
|
|
sidsz = ntfs_sid_size(usid);
|
|
sid = (SID*)ntfs_malloc(sidsz);
|
|
if (sid) {
|
|
memcpy(sid,usid,sidsz);
|
|
usermapping = (struct MAPPING*)ntfs_malloc(sizeof(struct MAPPING));
|
|
if (usermapping) {
|
|
groupmapping = (struct MAPPING*)ntfs_malloc(sizeof(struct MAPPING));
|
|
if (groupmapping) {
|
|
usermapping->sid = sid;
|
|
usermapping->xid = uid;
|
|
usermapping->next = (struct MAPPING*)NULL;
|
|
groupmapping->sid = sid;
|
|
groupmapping->xid = gid;
|
|
groupmapping->next = (struct MAPPING*)NULL;
|
|
scx->mapping[MAPUSERS] = usermapping;
|
|
scx->mapping[MAPGROUPS] = groupmapping;
|
|
res = 0;
|
|
}
|
|
}
|
|
}
|
|
return (res);
|
|
}
|
|
|
|
/*
|
|
* Make sure there are no ambiguous mapping
|
|
* Ambiguous mapping may lead to undesired configurations and
|
|
* we had rather be safe until the consequences are understood
|
|
*/
|
|
|
|
#if 0 /* not activated for now */
|
|
|
|
static BOOL check_mapping(const struct MAPPING *usermapping,
|
|
const struct MAPPING *groupmapping)
|
|
{
|
|
const struct MAPPING *mapping1;
|
|
const struct MAPPING *mapping2;
|
|
BOOL ambiguous;
|
|
|
|
ambiguous = FALSE;
|
|
for (mapping1=usermapping; mapping1; mapping1=mapping1->next)
|
|
for (mapping2=mapping1->next; mapping2; mapping1=mapping2->next)
|
|
if (ntfs_same_sid(mapping1->sid,mapping2->sid)) {
|
|
if (mapping1->xid != mapping2->xid)
|
|
ambiguous = TRUE;
|
|
} else {
|
|
if (mapping1->xid == mapping2->xid)
|
|
ambiguous = TRUE;
|
|
}
|
|
for (mapping1=groupmapping; mapping1; mapping1=mapping1->next)
|
|
for (mapping2=mapping1->next; mapping2; mapping1=mapping2->next)
|
|
if (ntfs_same_sid(mapping1->sid,mapping2->sid)) {
|
|
if (mapping1->xid != mapping2->xid)
|
|
ambiguous = TRUE;
|
|
} else {
|
|
if (mapping1->xid == mapping2->xid)
|
|
ambiguous = TRUE;
|
|
}
|
|
return (ambiguous);
|
|
}
|
|
|
|
#endif
|
|
|
|
#if 0 /* not used any more */
|
|
|
|
/*
|
|
* Try and apply default single user mapping
|
|
* returns zero if successful
|
|
*/
|
|
|
|
static int ntfs_default_mapping(struct SECURITY_CONTEXT *scx)
|
|
{
|
|
const SECURITY_DESCRIPTOR_RELATIVE *phead;
|
|
ntfs_inode *ni;
|
|
char *securattr;
|
|
const SID *usid;
|
|
int res;
|
|
|
|
res = -1;
|
|
ni = ntfs_pathname_to_inode(scx->vol, NULL, "/.");
|
|
if (ni) {
|
|
securattr = getsecurityattr(scx->vol, ni);
|
|
if (securattr) {
|
|
phead = (const SECURITY_DESCRIPTOR_RELATIVE*)securattr;
|
|
usid = (SID*)&securattr[le32_to_cpu(phead->owner)];
|
|
if (ntfs_is_user_sid(usid))
|
|
res = ntfs_do_default_mapping(scx,
|
|
scx->uid, scx->gid, usid);
|
|
free(securattr);
|
|
}
|
|
ntfs_inode_close(ni);
|
|
}
|
|
return (res);
|
|
}
|
|
|
|
#endif
|
|
|
|
/*
|
|
* Basic read from a user mapping file on another volume
|
|
*/
|
|
|
|
static int basicread(void *fileid, char *buf, size_t size, off_t offs __attribute__((unused)))
|
|
{
|
|
return (read(*(int*)fileid, buf, size));
|
|
}
|
|
|
|
|
|
/*
|
|
* Read from a user mapping file on current NTFS partition
|
|
*/
|
|
|
|
static int localread(void *fileid, char *buf, size_t size, off_t offs)
|
|
{
|
|
return (ntfs_local_read((ntfs_inode*)fileid,
|
|
AT_UNNAMED, 0, buf, size, offs));
|
|
}
|
|
|
|
/*
|
|
* Build the user mapping
|
|
* - according to a mapping file if defined (or default present),
|
|
* - or try default single user mapping if possible
|
|
*
|
|
* The mapping is specific to a mounted device
|
|
* No locking done, mounting assumed non multithreaded
|
|
*
|
|
* returns zero if mapping is successful
|
|
* (failure should not be interpreted as an error)
|
|
*/
|
|
|
|
int ntfs_build_mapping(struct SECURITY_CONTEXT *scx, const char *usermap_path,
|
|
BOOL allowdef)
|
|
{
|
|
struct MAPLIST *item;
|
|
struct MAPLIST *firstitem;
|
|
struct MAPPING *usermapping;
|
|
struct MAPPING *groupmapping;
|
|
ntfs_inode *ni;
|
|
int fd;
|
|
static struct {
|
|
u8 revision;
|
|
u8 levels;
|
|
be16 highbase;
|
|
be32 lowbase;
|
|
le32 level1;
|
|
le32 level2;
|
|
le32 level3;
|
|
le32 level4;
|
|
le32 level5;
|
|
} defmap = {
|
|
1, 5, const_cpu_to_be16(0), const_cpu_to_be32(5),
|
|
const_cpu_to_le32(21),
|
|
const_cpu_to_le32(DEFSECAUTH1), const_cpu_to_le32(DEFSECAUTH2),
|
|
const_cpu_to_le32(DEFSECAUTH3), const_cpu_to_le32(DEFSECBASE)
|
|
} ;
|
|
|
|
/* be sure not to map anything until done */
|
|
scx->mapping[MAPUSERS] = (struct MAPPING*)NULL;
|
|
scx->mapping[MAPGROUPS] = (struct MAPPING*)NULL;
|
|
|
|
if (!usermap_path) usermap_path = MAPPINGFILE;
|
|
if (usermap_path[0] == '/') {
|
|
fd = open(usermap_path,O_RDONLY);
|
|
if (fd > 0) {
|
|
firstitem = ntfs_read_mapping(basicread, (void*)&fd);
|
|
close(fd);
|
|
} else
|
|
firstitem = (struct MAPLIST*)NULL;
|
|
} else {
|
|
ni = ntfs_pathname_to_inode(scx->vol, NULL, usermap_path);
|
|
if (ni) {
|
|
firstitem = ntfs_read_mapping(localread, ni);
|
|
ntfs_inode_close(ni);
|
|
} else
|
|
firstitem = (struct MAPLIST*)NULL;
|
|
}
|
|
|
|
|
|
if (firstitem) {
|
|
usermapping = ntfs_do_user_mapping(firstitem);
|
|
groupmapping = ntfs_do_group_mapping(firstitem);
|
|
if (usermapping && groupmapping) {
|
|
scx->mapping[MAPUSERS] = usermapping;
|
|
scx->mapping[MAPGROUPS] = groupmapping;
|
|
} else
|
|
ntfs_log_error("There were no valid user or no valid group\n");
|
|
/* now we can free the memory copy of input text */
|
|
/* and rely on internal representation */
|
|
while (firstitem) {
|
|
item = firstitem->next;
|
|
free(firstitem);
|
|
firstitem = item;
|
|
}
|
|
} else {
|
|
/* no mapping file, try a default mapping */
|
|
if (allowdef) {
|
|
if (!ntfs_do_default_mapping(scx,
|
|
0, 0, (const SID*)&defmap))
|
|
ntfs_log_info("Using default user mapping\n");
|
|
}
|
|
}
|
|
return (!scx->mapping[MAPUSERS] || link_group_members(scx));
|
|
}
|
|
|
|
#ifdef HAVE_SETXATTR /* extended attributes interface required */
|
|
|
|
/*
|
|
* Get the ntfs attribute into an extended attribute
|
|
* The attribute is returned according to cpu endianness
|
|
*/
|
|
|
|
int ntfs_get_ntfs_attrib(ntfs_inode *ni, char *value, size_t size)
|
|
{
|
|
u32 attrib;
|
|
size_t outsize;
|
|
|
|
outsize = 0; /* default to no data and no error */
|
|
if (ni) {
|
|
attrib = le32_to_cpu(ni->flags);
|
|
if (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY)
|
|
attrib |= const_le32_to_cpu(FILE_ATTR_DIRECTORY);
|
|
else
|
|
attrib &= ~const_le32_to_cpu(FILE_ATTR_DIRECTORY);
|
|
if (!attrib)
|
|
attrib |= const_le32_to_cpu(FILE_ATTR_NORMAL);
|
|
outsize = sizeof(FILE_ATTR_FLAGS);
|
|
if (size >= outsize) {
|
|
if (value)
|
|
memcpy(value,&attrib,outsize);
|
|
else
|
|
errno = EINVAL;
|
|
}
|
|
}
|
|
return (outsize ? (int)outsize : -errno);
|
|
}
|
|
|
|
/*
|
|
* Return the ntfs attribute into an extended attribute
|
|
* The attribute is expected according to cpu endianness
|
|
*
|
|
* Returns 0, or -1 if there is a problem
|
|
*/
|
|
|
|
int ntfs_set_ntfs_attrib(ntfs_inode *ni,
|
|
const char *value, size_t size, int flags)
|
|
{
|
|
u32 attrib;
|
|
le32 settable;
|
|
ATTR_FLAGS dirflags;
|
|
int res;
|
|
|
|
res = -1;
|
|
if (ni && value && (size >= sizeof(FILE_ATTR_FLAGS))) {
|
|
if (!(flags & XATTR_CREATE)) {
|
|
/* copy to avoid alignment problems */
|
|
memcpy(&attrib,value,sizeof(FILE_ATTR_FLAGS));
|
|
settable = FILE_ATTR_SETTABLE;
|
|
res = 0;
|
|
if (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY) {
|
|
/*
|
|
* Accept changing compression for a directory
|
|
* and set index root accordingly
|
|
*/
|
|
settable |= FILE_ATTR_COMPRESSED;
|
|
if ((ni->flags ^ cpu_to_le32(attrib))
|
|
& FILE_ATTR_COMPRESSED) {
|
|
if (ni->flags & FILE_ATTR_COMPRESSED)
|
|
dirflags = const_cpu_to_le16(0);
|
|
else
|
|
dirflags = ATTR_IS_COMPRESSED;
|
|
res = ntfs_attr_set_flags(ni,
|
|
AT_INDEX_ROOT,
|
|
NTFS_INDEX_I30, 4,
|
|
dirflags,
|
|
ATTR_COMPRESSION_MASK);
|
|
}
|
|
}
|
|
if (!res) {
|
|
ni->flags = (ni->flags & ~settable)
|
|
| (cpu_to_le32(attrib) & settable);
|
|
NInoFileNameSetDirty(ni);
|
|
NInoSetDirty(ni);
|
|
}
|
|
} else
|
|
errno = EEXIST;
|
|
} else
|
|
errno = EINVAL;
|
|
return (res ? -1 : 0);
|
|
}
|
|
|
|
#endif /* HAVE_SETXATTR */
|
|
|
|
/*
|
|
* Open $Secure once for all
|
|
* returns zero if it succeeds
|
|
* non-zero if it fails. This is not an error (on NTFS v1.x)
|
|
*/
|
|
|
|
|
|
int ntfs_open_secure(ntfs_volume *vol)
|
|
{
|
|
ntfs_inode *ni;
|
|
int res;
|
|
|
|
res = -1;
|
|
vol->secure_ni = (ntfs_inode*)NULL;
|
|
vol->secure_xsii = (ntfs_index_context*)NULL;
|
|
vol->secure_xsdh = (ntfs_index_context*)NULL;
|
|
if (vol->major_ver >= 3) {
|
|
/* make sure this is a genuine $Secure inode 9 */
|
|
ni = ntfs_pathname_to_inode(vol, NULL, "$Secure");
|
|
if (ni && (ni->mft_no == 9)) {
|
|
vol->secure_reentry = 0;
|
|
vol->secure_xsii = ntfs_index_ctx_get(ni,
|
|
sii_stream, 4);
|
|
vol->secure_xsdh = ntfs_index_ctx_get(ni,
|
|
sdh_stream, 4);
|
|
if (ni && vol->secure_xsii && vol->secure_xsdh) {
|
|
vol->secure_ni = ni;
|
|
res = 0;
|
|
}
|
|
}
|
|
}
|
|
return (res);
|
|
}
|
|
|
|
/*
|
|
* Final cleaning
|
|
* Allocated memory is freed to facilitate the detection of memory leaks
|
|
*/
|
|
|
|
void ntfs_close_secure(struct SECURITY_CONTEXT *scx)
|
|
{
|
|
ntfs_volume *vol;
|
|
|
|
vol = scx->vol;
|
|
if (vol->secure_ni) {
|
|
ntfs_index_ctx_put(vol->secure_xsii);
|
|
ntfs_index_ctx_put(vol->secure_xsdh);
|
|
ntfs_inode_close(vol->secure_ni);
|
|
|
|
}
|
|
ntfs_free_mapping(scx->mapping);
|
|
free_caches(scx);
|
|
}
|
|
|
|
/*
|
|
* API for direct access to security descriptors
|
|
* based on Win32 API
|
|
*/
|
|
|
|
|
|
/*
|
|
* Selective feeding of a security descriptor into user buffer
|
|
*
|
|
* Returns TRUE if successful
|
|
*/
|
|
|
|
static BOOL feedsecurityattr(const char *attr, u32 selection,
|
|
char *buf, u32 buflen, u32 *psize)
|
|
{
|
|
const SECURITY_DESCRIPTOR_RELATIVE *phead;
|
|
SECURITY_DESCRIPTOR_RELATIVE *pnhead;
|
|
const ACL *pdacl;
|
|
const ACL *psacl;
|
|
const SID *pusid;
|
|
const SID *pgsid;
|
|
unsigned int offdacl;
|
|
unsigned int offsacl;
|
|
unsigned int offowner;
|
|
unsigned int offgroup;
|
|
unsigned int daclsz;
|
|
unsigned int saclsz;
|
|
unsigned int usidsz;
|
|
unsigned int gsidsz;
|
|
unsigned int size; /* size of requested attributes */
|
|
BOOL ok;
|
|
unsigned int pos;
|
|
unsigned int avail;
|
|
le16 control;
|
|
|
|
avail = 0;
|
|
control = SE_SELF_RELATIVE;
|
|
phead = (const SECURITY_DESCRIPTOR_RELATIVE*)attr;
|
|
size = sizeof(SECURITY_DESCRIPTOR_RELATIVE);
|
|
|
|
/* locate DACL if requested and available */
|
|
if (phead->dacl && (selection & DACL_SECURITY_INFORMATION)) {
|
|
offdacl = le32_to_cpu(phead->dacl);
|
|
pdacl = (const ACL*)&attr[offdacl];
|
|
daclsz = le16_to_cpu(pdacl->size);
|
|
size += daclsz;
|
|
avail |= DACL_SECURITY_INFORMATION;
|
|
} else
|
|
offdacl = daclsz = 0;
|
|
|
|
/* locate owner if requested and available */
|
|
offowner = le32_to_cpu(phead->owner);
|
|
if (offowner && (selection & OWNER_SECURITY_INFORMATION)) {
|
|
/* find end of USID */
|
|
pusid = (const SID*)&attr[offowner];
|
|
usidsz = ntfs_sid_size(pusid);
|
|
size += usidsz;
|
|
avail |= OWNER_SECURITY_INFORMATION;
|
|
} else
|
|
offowner = usidsz = 0;
|
|
|
|
/* locate group if requested and available */
|
|
offgroup = le32_to_cpu(phead->group);
|
|
if (offgroup && (selection & GROUP_SECURITY_INFORMATION)) {
|
|
/* find end of GSID */
|
|
pgsid = (const SID*)&attr[offgroup];
|
|
gsidsz = ntfs_sid_size(pgsid);
|
|
size += gsidsz;
|
|
avail |= GROUP_SECURITY_INFORMATION;
|
|
} else
|
|
offgroup = gsidsz = 0;
|
|
|
|
/* locate SACL if requested and available */
|
|
if (phead->sacl && (selection & SACL_SECURITY_INFORMATION)) {
|
|
/* find end of SACL */
|
|
offsacl = le32_to_cpu(phead->sacl);
|
|
psacl = (const ACL*)&attr[offsacl];
|
|
saclsz = le16_to_cpu(psacl->size);
|
|
size += saclsz;
|
|
avail |= SACL_SECURITY_INFORMATION;
|
|
} else
|
|
offsacl = saclsz = 0;
|
|
|
|
/*
|
|
* Check having enough size in destination buffer
|
|
* (required size is returned nevertheless so that
|
|
* the request can be reissued with adequate size)
|
|
*/
|
|
if (size > buflen) {
|
|
*psize = size;
|
|
errno = EINVAL;
|
|
ok = FALSE;
|
|
} else {
|
|
if (selection & OWNER_SECURITY_INFORMATION)
|
|
control |= phead->control & SE_OWNER_DEFAULTED;
|
|
if (selection & GROUP_SECURITY_INFORMATION)
|
|
control |= phead->control & SE_GROUP_DEFAULTED;
|
|
if (selection & DACL_SECURITY_INFORMATION)
|
|
control |= phead->control
|
|
& (SE_DACL_PRESENT
|
|
| SE_DACL_DEFAULTED
|
|
| SE_DACL_AUTO_INHERITED
|
|
| SE_DACL_PROTECTED);
|
|
if (selection & SACL_SECURITY_INFORMATION)
|
|
control |= phead->control
|
|
& (SE_SACL_PRESENT
|
|
| SE_SACL_DEFAULTED
|
|
| SE_SACL_AUTO_INHERITED
|
|
| SE_SACL_PROTECTED);
|
|
/*
|
|
* copy header and feed new flags, even if no detailed data
|
|
*/
|
|
memcpy(buf,attr,sizeof(SECURITY_DESCRIPTOR_RELATIVE));
|
|
pnhead = (SECURITY_DESCRIPTOR_RELATIVE*)buf;
|
|
pnhead->control = control;
|
|
pos = sizeof(SECURITY_DESCRIPTOR_RELATIVE);
|
|
|
|
/* copy DACL if requested and available */
|
|
if (selection & avail & DACL_SECURITY_INFORMATION) {
|
|
pnhead->dacl = cpu_to_le32(pos);
|
|
memcpy(&buf[pos],&attr[offdacl],daclsz);
|
|
pos += daclsz;
|
|
} else
|
|
pnhead->dacl = const_cpu_to_le32(0);
|
|
|
|
/* copy SACL if requested and available */
|
|
if (selection & avail & SACL_SECURITY_INFORMATION) {
|
|
pnhead->sacl = cpu_to_le32(pos);
|
|
memcpy(&buf[pos],&attr[offsacl],saclsz);
|
|
pos += saclsz;
|
|
} else
|
|
pnhead->sacl = const_cpu_to_le32(0);
|
|
|
|
/* copy owner if requested and available */
|
|
if (selection & avail & OWNER_SECURITY_INFORMATION) {
|
|
pnhead->owner = cpu_to_le32(pos);
|
|
memcpy(&buf[pos],&attr[offowner],usidsz);
|
|
pos += usidsz;
|
|
} else
|
|
pnhead->owner = const_cpu_to_le32(0);
|
|
|
|
/* copy group if requested and available */
|
|
if (selection & avail & GROUP_SECURITY_INFORMATION) {
|
|
pnhead->group = cpu_to_le32(pos);
|
|
memcpy(&buf[pos],&attr[offgroup],gsidsz);
|
|
pos += gsidsz;
|
|
} else
|
|
pnhead->group = const_cpu_to_le32(0);
|
|
if (pos != size)
|
|
ntfs_log_error("Error in security descriptor size\n");
|
|
*psize = size;
|
|
ok = TRUE;
|
|
}
|
|
|
|
return (ok);
|
|
}
|
|
|
|
/*
|
|
* Merge a new security descriptor into the old one
|
|
* and assign to designated file
|
|
*
|
|
* Returns TRUE if successful
|
|
*/
|
|
|
|
static BOOL mergesecurityattr(ntfs_volume *vol, const char *oldattr,
|
|
const char *newattr, u32 selection, ntfs_inode *ni)
|
|
{
|
|
const SECURITY_DESCRIPTOR_RELATIVE *oldhead;
|
|
const SECURITY_DESCRIPTOR_RELATIVE *newhead;
|
|
SECURITY_DESCRIPTOR_RELATIVE *targhead;
|
|
const ACL *pdacl;
|
|
const ACL *psacl;
|
|
const SID *powner;
|
|
const SID *pgroup;
|
|
int offdacl;
|
|
int offsacl;
|
|
int offowner;
|
|
int offgroup;
|
|
unsigned int size;
|
|
le16 control;
|
|
char *target;
|
|
int pos;
|
|
int oldattrsz;
|
|
int newattrsz;
|
|
BOOL ok;
|
|
|
|
ok = FALSE; /* default return */
|
|
oldhead = (const SECURITY_DESCRIPTOR_RELATIVE*)oldattr;
|
|
newhead = (const SECURITY_DESCRIPTOR_RELATIVE*)newattr;
|
|
oldattrsz = ntfs_attr_size(oldattr);
|
|
newattrsz = ntfs_attr_size(newattr);
|
|
target = (char*)ntfs_malloc(oldattrsz + newattrsz);
|
|
if (target) {
|
|
targhead = (SECURITY_DESCRIPTOR_RELATIVE*)target;
|
|
pos = sizeof(SECURITY_DESCRIPTOR_RELATIVE);
|
|
control = SE_SELF_RELATIVE;
|
|
/*
|
|
* copy new DACL if selected
|
|
* or keep old DACL if any
|
|
*/
|
|
if ((selection & DACL_SECURITY_INFORMATION) ?
|
|
newhead->dacl : oldhead->dacl) {
|
|
if (selection & DACL_SECURITY_INFORMATION) {
|
|
offdacl = le32_to_cpu(newhead->dacl);
|
|
pdacl = (const ACL*)&newattr[offdacl];
|
|
} else {
|
|
offdacl = le32_to_cpu(oldhead->dacl);
|
|
pdacl = (const ACL*)&oldattr[offdacl];
|
|
}
|
|
size = le16_to_cpu(pdacl->size);
|
|
memcpy(&target[pos], pdacl, size);
|
|
targhead->dacl = cpu_to_le32(pos);
|
|
pos += size;
|
|
} else
|
|
targhead->dacl = const_cpu_to_le32(0);
|
|
if (selection & DACL_SECURITY_INFORMATION) {
|
|
control |= newhead->control
|
|
& (SE_DACL_PRESENT
|
|
| SE_DACL_DEFAULTED
|
|
| SE_DACL_PROTECTED);
|
|
if (newhead->control & SE_DACL_AUTO_INHERIT_REQ)
|
|
control |= SE_DACL_AUTO_INHERITED;
|
|
} else
|
|
control |= oldhead->control
|
|
& (SE_DACL_PRESENT
|
|
| SE_DACL_DEFAULTED
|
|
| SE_DACL_AUTO_INHERITED
|
|
| SE_DACL_PROTECTED);
|
|
/*
|
|
* copy new SACL if selected
|
|
* or keep old SACL if any
|
|
*/
|
|
if ((selection & SACL_SECURITY_INFORMATION) ?
|
|
newhead->sacl : oldhead->sacl) {
|
|
if (selection & SACL_SECURITY_INFORMATION) {
|
|
offsacl = le32_to_cpu(newhead->sacl);
|
|
psacl = (const ACL*)&newattr[offsacl];
|
|
} else {
|
|
offsacl = le32_to_cpu(oldhead->sacl);
|
|
psacl = (const ACL*)&oldattr[offsacl];
|
|
}
|
|
size = le16_to_cpu(psacl->size);
|
|
memcpy(&target[pos], psacl, size);
|
|
targhead->sacl = cpu_to_le32(pos);
|
|
pos += size;
|
|
} else
|
|
targhead->sacl = const_cpu_to_le32(0);
|
|
if (selection & SACL_SECURITY_INFORMATION) {
|
|
control |= newhead->control
|
|
& (SE_SACL_PRESENT
|
|
| SE_SACL_DEFAULTED
|
|
| SE_SACL_PROTECTED);
|
|
if (newhead->control & SE_SACL_AUTO_INHERIT_REQ)
|
|
control |= SE_SACL_AUTO_INHERITED;
|
|
} else
|
|
control |= oldhead->control
|
|
& (SE_SACL_PRESENT
|
|
| SE_SACL_DEFAULTED
|
|
| SE_SACL_AUTO_INHERITED
|
|
| SE_SACL_PROTECTED);
|
|
/*
|
|
* copy new OWNER if selected
|
|
* or keep old OWNER if any
|
|
*/
|
|
if ((selection & OWNER_SECURITY_INFORMATION) ?
|
|
newhead->owner : oldhead->owner) {
|
|
if (selection & OWNER_SECURITY_INFORMATION) {
|
|
offowner = le32_to_cpu(newhead->owner);
|
|
powner = (const SID*)&newattr[offowner];
|
|
} else {
|
|
offowner = le32_to_cpu(oldhead->owner);
|
|
powner = (const SID*)&oldattr[offowner];
|
|
}
|
|
size = ntfs_sid_size(powner);
|
|
memcpy(&target[pos], powner, size);
|
|
targhead->owner = cpu_to_le32(pos);
|
|
pos += size;
|
|
} else
|
|
targhead->owner = const_cpu_to_le32(0);
|
|
if (selection & OWNER_SECURITY_INFORMATION)
|
|
control |= newhead->control & SE_OWNER_DEFAULTED;
|
|
else
|
|
control |= oldhead->control & SE_OWNER_DEFAULTED;
|
|
/*
|
|
* copy new GROUP if selected
|
|
* or keep old GROUP if any
|
|
*/
|
|
if ((selection & GROUP_SECURITY_INFORMATION) ?
|
|
newhead->group : oldhead->group) {
|
|
if (selection & GROUP_SECURITY_INFORMATION) {
|
|
offgroup = le32_to_cpu(newhead->group);
|
|
pgroup = (const SID*)&newattr[offgroup];
|
|
control |= newhead->control
|
|
& SE_GROUP_DEFAULTED;
|
|
} else {
|
|
offgroup = le32_to_cpu(oldhead->group);
|
|
pgroup = (const SID*)&oldattr[offgroup];
|
|
control |= oldhead->control
|
|
& SE_GROUP_DEFAULTED;
|
|
}
|
|
size = ntfs_sid_size(pgroup);
|
|
memcpy(&target[pos], pgroup, size);
|
|
targhead->group = cpu_to_le32(pos);
|
|
pos += size;
|
|
} else
|
|
targhead->group = const_cpu_to_le32(0);
|
|
if (selection & GROUP_SECURITY_INFORMATION)
|
|
control |= newhead->control & SE_GROUP_DEFAULTED;
|
|
else
|
|
control |= oldhead->control & SE_GROUP_DEFAULTED;
|
|
targhead->revision = SECURITY_DESCRIPTOR_REVISION;
|
|
targhead->alignment = 0;
|
|
targhead->control = control;
|
|
ok = !update_secur_descr(vol, target, ni);
|
|
free(target);
|
|
}
|
|
return (ok);
|
|
}
|
|
|
|
/*
|
|
* Return the security descriptor of a file
|
|
* This is intended to be similar to GetFileSecurity() from Win32
|
|
* in order to facilitate the development of portable tools
|
|
*
|
|
* returns zero if unsuccessful (following Win32 conventions)
|
|
* -1 if no securid
|
|
* the securid if any
|
|
*
|
|
* The Win32 API is :
|
|
*
|
|
* BOOL WINAPI GetFileSecurity(
|
|
* __in LPCTSTR lpFileName,
|
|
* __in SECURITY_INFORMATION RequestedInformation,
|
|
* __out_opt PSECURITY_DESCRIPTOR pSecurityDescriptor,
|
|
* __in DWORD nLength,
|
|
* __out LPDWORD lpnLengthNeeded
|
|
* );
|
|
*
|
|
*/
|
|
|
|
int ntfs_get_file_security(struct SECURITY_API *scapi,
|
|
const char *path, u32 selection,
|
|
char *buf, u32 buflen, u32 *psize)
|
|
{
|
|
ntfs_inode *ni;
|
|
char *attr;
|
|
int res;
|
|
|
|
res = 0; /* default return */
|
|
if (scapi && (scapi->magic == MAGIC_API)) {
|
|
ni = ntfs_pathname_to_inode(scapi->security.vol, NULL, path);
|
|
if (ni) {
|
|
attr = getsecurityattr(scapi->security.vol, ni);
|
|
if (attr) {
|
|
if (feedsecurityattr(attr,selection,
|
|
buf,buflen,psize)) {
|
|
if (test_nino_flag(ni, v3_Extensions)
|
|
&& ni->security_id)
|
|
res = le32_to_cpu(
|
|
ni->security_id);
|
|
else
|
|
res = -1;
|
|
}
|
|
free(attr);
|
|
}
|
|
ntfs_inode_close(ni);
|
|
} else
|
|
errno = ENOENT;
|
|
if (!res) *psize = 0;
|
|
} else
|
|
errno = EINVAL; /* do not clear *psize */
|
|
return (res);
|
|
}
|
|
|
|
|
|
/*
|
|
* Set the security descriptor of a file or directory
|
|
* This is intended to be similar to SetFileSecurity() from Win32
|
|
* in order to facilitate the development of portable tools
|
|
*
|
|
* returns zero if unsuccessful (following Win32 conventions)
|
|
* -1 if no securid
|
|
* the securid if any
|
|
*
|
|
* The Win32 API is :
|
|
*
|
|
* BOOL WINAPI SetFileSecurity(
|
|
* __in LPCTSTR lpFileName,
|
|
* __in SECURITY_INFORMATION SecurityInformation,
|
|
* __in PSECURITY_DESCRIPTOR pSecurityDescriptor
|
|
* );
|
|
*/
|
|
|
|
int ntfs_set_file_security(struct SECURITY_API *scapi,
|
|
const char *path, u32 selection, const char *attr)
|
|
{
|
|
const SECURITY_DESCRIPTOR_RELATIVE *phead;
|
|
ntfs_inode *ni;
|
|
int attrsz;
|
|
BOOL missing;
|
|
char *oldattr;
|
|
int res;
|
|
|
|
res = 0; /* default return */
|
|
if (scapi && (scapi->magic == MAGIC_API) && attr) {
|
|
phead = (const SECURITY_DESCRIPTOR_RELATIVE*)attr;
|
|
attrsz = ntfs_attr_size(attr);
|
|
/* if selected, owner and group must be present or defaulted */
|
|
missing = ((selection & OWNER_SECURITY_INFORMATION)
|
|
&& !phead->owner
|
|
&& !(phead->control & SE_OWNER_DEFAULTED))
|
|
|| ((selection & GROUP_SECURITY_INFORMATION)
|
|
&& !phead->group
|
|
&& !(phead->control & SE_GROUP_DEFAULTED));
|
|
if (!missing
|
|
&& (phead->control & SE_SELF_RELATIVE)
|
|
&& ntfs_valid_descr(attr, attrsz)) {
|
|
ni = ntfs_pathname_to_inode(scapi->security.vol,
|
|
NULL, path);
|
|
if (ni) {
|
|
oldattr = getsecurityattr(scapi->security.vol,
|
|
ni);
|
|
if (oldattr) {
|
|
if (mergesecurityattr(
|
|
scapi->security.vol,
|
|
oldattr, attr,
|
|
selection, ni)) {
|
|
if (test_nino_flag(ni,
|
|
v3_Extensions))
|
|
res = le32_to_cpu(
|
|
ni->security_id);
|
|
else
|
|
res = -1;
|
|
}
|
|
free(oldattr);
|
|
}
|
|
ntfs_inode_close(ni);
|
|
}
|
|
} else
|
|
errno = EINVAL;
|
|
} else
|
|
errno = EINVAL;
|
|
return (res);
|
|
}
|
|
|
|
|
|
/*
|
|
* Return the attributes of a file
|
|
* This is intended to be similar to GetFileAttributes() from Win32
|
|
* in order to facilitate the development of portable tools
|
|
*
|
|
* returns -1 if unsuccessful (Win32 : INVALID_FILE_ATTRIBUTES)
|
|
*
|
|
* The Win32 API is :
|
|
*
|
|
* DWORD WINAPI GetFileAttributes(
|
|
* __in LPCTSTR lpFileName
|
|
* );
|
|
*/
|
|
|
|
int ntfs_get_file_attributes(struct SECURITY_API *scapi, const char *path)
|
|
{
|
|
ntfs_inode *ni;
|
|
s32 attrib;
|
|
|
|
attrib = -1; /* default return */
|
|
if (scapi && (scapi->magic == MAGIC_API) && path) {
|
|
ni = ntfs_pathname_to_inode(scapi->security.vol, NULL, path);
|
|
if (ni) {
|
|
attrib = le32_to_cpu(ni->flags);
|
|
if (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY)
|
|
attrib |= const_le32_to_cpu(FILE_ATTR_DIRECTORY);
|
|
else
|
|
attrib &= ~const_le32_to_cpu(FILE_ATTR_DIRECTORY);
|
|
if (!attrib)
|
|
attrib |= const_le32_to_cpu(FILE_ATTR_NORMAL);
|
|
|
|
ntfs_inode_close(ni);
|
|
} else
|
|
errno = ENOENT;
|
|
} else
|
|
errno = EINVAL; /* do not clear *psize */
|
|
return (attrib);
|
|
}
|
|
|
|
|
|
/*
|
|
* Set attributes to a file or directory
|
|
* This is intended to be similar to SetFileAttributes() from Win32
|
|
* in order to facilitate the development of portable tools
|
|
*
|
|
* Only a few flags can be set (same list as Win32)
|
|
*
|
|
* returns zero if unsuccessful (following Win32 conventions)
|
|
* nonzero if successful
|
|
*
|
|
* The Win32 API is :
|
|
*
|
|
* BOOL WINAPI SetFileAttributes(
|
|
* __in LPCTSTR lpFileName,
|
|
* __in DWORD dwFileAttributes
|
|
* );
|
|
*/
|
|
|
|
BOOL ntfs_set_file_attributes(struct SECURITY_API *scapi,
|
|
const char *path, s32 attrib)
|
|
{
|
|
ntfs_inode *ni;
|
|
le32 settable;
|
|
ATTR_FLAGS dirflags;
|
|
int res;
|
|
|
|
res = 0; /* default return */
|
|
if (scapi && (scapi->magic == MAGIC_API) && path) {
|
|
ni = ntfs_pathname_to_inode(scapi->security.vol, NULL, path);
|
|
if (ni) {
|
|
settable = FILE_ATTR_SETTABLE;
|
|
if (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY) {
|
|
/*
|
|
* Accept changing compression for a directory
|
|
* and set index root accordingly
|
|
*/
|
|
settable |= FILE_ATTR_COMPRESSED;
|
|
if ((ni->flags ^ cpu_to_le32(attrib))
|
|
& FILE_ATTR_COMPRESSED) {
|
|
if (ni->flags & FILE_ATTR_COMPRESSED)
|
|
dirflags = const_cpu_to_le16(0);
|
|
else
|
|
dirflags = ATTR_IS_COMPRESSED;
|
|
res = ntfs_attr_set_flags(ni,
|
|
AT_INDEX_ROOT,
|
|
NTFS_INDEX_I30, 4,
|
|
dirflags,
|
|
ATTR_COMPRESSION_MASK);
|
|
}
|
|
}
|
|
if (!res) {
|
|
ni->flags = (ni->flags & ~settable)
|
|
| (cpu_to_le32(attrib) & settable);
|
|
NInoSetDirty(ni);
|
|
}
|
|
if (!ntfs_inode_close(ni))
|
|
res = -1;
|
|
} else
|
|
errno = ENOENT;
|
|
}
|
|
return (res);
|
|
}
|
|
|
|
|
|
BOOL ntfs_read_directory(struct SECURITY_API *scapi,
|
|
const char *path, ntfs_filldir_t callback, void *context)
|
|
{
|
|
ntfs_inode *ni;
|
|
BOOL ok;
|
|
s64 pos;
|
|
|
|
ok = FALSE; /* default return */
|
|
if (scapi && (scapi->magic == MAGIC_API) && callback) {
|
|
ni = ntfs_pathname_to_inode(scapi->security.vol, NULL, path);
|
|
if (ni) {
|
|
if (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY) {
|
|
pos = 0;
|
|
ntfs_readdir(ni,&pos,context,callback);
|
|
ok = !ntfs_inode_close(ni);
|
|
} else {
|
|
ntfs_inode_close(ni);
|
|
errno = ENOTDIR;
|
|
}
|
|
} else
|
|
errno = ENOENT;
|
|
} else
|
|
errno = EINVAL; /* do not clear *psize */
|
|
return (ok);
|
|
}
|
|
|
|
/*
|
|
* read $SDS (for auditing security data)
|
|
*
|
|
* Returns the number or read bytes, or -1 if there is an error
|
|
*/
|
|
|
|
int ntfs_read_sds(struct SECURITY_API *scapi,
|
|
char *buf, u32 size, u32 offset)
|
|
{
|
|
int got;
|
|
|
|
got = -1; /* default return */
|
|
if (scapi && (scapi->magic == MAGIC_API)) {
|
|
if (scapi->security.vol->secure_ni)
|
|
got = ntfs_local_read(scapi->security.vol->secure_ni,
|
|
STREAM_SDS, 4, buf, size, offset);
|
|
else
|
|
errno = EOPNOTSUPP;
|
|
} else
|
|
errno = EINVAL;
|
|
return (got);
|
|
}
|
|
|
|
/*
|
|
* read $SII (for auditing security data)
|
|
*
|
|
* Returns next entry, or NULL if there is an error
|
|
*/
|
|
|
|
INDEX_ENTRY *ntfs_read_sii(struct SECURITY_API *scapi,
|
|
INDEX_ENTRY *entry)
|
|
{
|
|
SII_INDEX_KEY key;
|
|
INDEX_ENTRY *ret;
|
|
BOOL found;
|
|
ntfs_index_context *xsii;
|
|
|
|
ret = (INDEX_ENTRY*)NULL; /* default return */
|
|
if (scapi && (scapi->magic == MAGIC_API)) {
|
|
xsii = scapi->security.vol->secure_xsii;
|
|
if (xsii) {
|
|
if (!entry) {
|
|
key.security_id = const_cpu_to_le32(0);
|
|
found = !ntfs_index_lookup((char*)&key,
|
|
sizeof(SII_INDEX_KEY), xsii);
|
|
/* not supposed to find */
|
|
if (!found && (errno == ENOENT))
|
|
ret = xsii->entry;
|
|
} else
|
|
ret = ntfs_index_next(entry,xsii);
|
|
if (!ret)
|
|
errno = ENODATA;
|
|
} else
|
|
errno = EOPNOTSUPP;
|
|
} else
|
|
errno = EINVAL;
|
|
return (ret);
|
|
}
|
|
|
|
/*
|
|
* read $SDH (for auditing security data)
|
|
*
|
|
* Returns next entry, or NULL if there is an error
|
|
*/
|
|
|
|
INDEX_ENTRY *ntfs_read_sdh(struct SECURITY_API *scapi,
|
|
INDEX_ENTRY *entry)
|
|
{
|
|
SDH_INDEX_KEY key;
|
|
INDEX_ENTRY *ret;
|
|
BOOL found;
|
|
ntfs_index_context *xsdh;
|
|
|
|
ret = (INDEX_ENTRY*)NULL; /* default return */
|
|
if (scapi && (scapi->magic == MAGIC_API)) {
|
|
xsdh = scapi->security.vol->secure_xsdh;
|
|
if (xsdh) {
|
|
if (!entry) {
|
|
key.hash = const_cpu_to_le32(0);
|
|
key.security_id = const_cpu_to_le32(0);
|
|
found = !ntfs_index_lookup((char*)&key,
|
|
sizeof(SDH_INDEX_KEY), xsdh);
|
|
/* not supposed to find */
|
|
if (!found && (errno == ENOENT))
|
|
ret = xsdh->entry;
|
|
} else
|
|
ret = ntfs_index_next(entry,xsdh);
|
|
if (!ret)
|
|
errno = ENODATA;
|
|
} else errno = ENOTSUP;
|
|
} else
|
|
errno = EINVAL;
|
|
return (ret);
|
|
}
|
|
|
|
/*
|
|
* Get the mapped user SID
|
|
* A buffer of 40 bytes has to be supplied
|
|
*
|
|
* returns the size of the SID, or zero and errno set if not found
|
|
*/
|
|
|
|
int ntfs_get_usid(struct SECURITY_API *scapi, uid_t uid, char *buf)
|
|
{
|
|
const SID *usid;
|
|
BIGSID defusid;
|
|
int size;
|
|
|
|
size = 0;
|
|
if (scapi && (scapi->magic == MAGIC_API)) {
|
|
usid = ntfs_find_usid(scapi->security.mapping[MAPUSERS], uid, (SID*)&defusid);
|
|
if (usid) {
|
|
size = ntfs_sid_size(usid);
|
|
memcpy(buf,usid,size);
|
|
} else
|
|
errno = ENODATA;
|
|
} else
|
|
errno = EINVAL;
|
|
return (size);
|
|
}
|
|
|
|
/*
|
|
* Get the mapped group SID
|
|
* A buffer of 40 bytes has to be supplied
|
|
*
|
|
* returns the size of the SID, or zero and errno set if not found
|
|
*/
|
|
|
|
int ntfs_get_gsid(struct SECURITY_API *scapi, gid_t gid, char *buf)
|
|
{
|
|
const SID *gsid;
|
|
BIGSID defgsid;
|
|
int size;
|
|
|
|
size = 0;
|
|
if (scapi && (scapi->magic == MAGIC_API)) {
|
|
gsid = ntfs_find_gsid(scapi->security.mapping[MAPGROUPS], gid, (SID*)&defgsid);
|
|
if (gsid) {
|
|
size = ntfs_sid_size(gsid);
|
|
memcpy(buf,gsid,size);
|
|
} else
|
|
errno = ENODATA;
|
|
} else
|
|
errno = EINVAL;
|
|
return (size);
|
|
}
|
|
|
|
/*
|
|
* Get the user mapped to a SID
|
|
*
|
|
* returns the uid, or -1 if not found
|
|
*/
|
|
|
|
int ntfs_get_user(struct SECURITY_API *scapi, const SID *usid)
|
|
{
|
|
int uid;
|
|
|
|
uid = -1;
|
|
if (scapi && (scapi->magic == MAGIC_API) && ntfs_valid_sid(usid)) {
|
|
if (ntfs_same_sid(usid,adminsid))
|
|
uid = 0;
|
|
else {
|
|
uid = ntfs_find_user(scapi->security.mapping[MAPUSERS], usid);
|
|
if (!uid) {
|
|
uid = -1;
|
|
errno = ENODATA;
|
|
}
|
|
}
|
|
} else
|
|
errno = EINVAL;
|
|
return (uid);
|
|
}
|
|
|
|
/*
|
|
* Get the group mapped to a SID
|
|
*
|
|
* returns the uid, or -1 if not found
|
|
*/
|
|
|
|
int ntfs_get_group(struct SECURITY_API *scapi, const SID *gsid)
|
|
{
|
|
int gid;
|
|
|
|
gid = -1;
|
|
if (scapi && (scapi->magic == MAGIC_API) && ntfs_valid_sid(gsid)) {
|
|
if (ntfs_same_sid(gsid,adminsid))
|
|
gid = 0;
|
|
else {
|
|
gid = ntfs_find_group(scapi->security.mapping[MAPGROUPS], gsid);
|
|
if (!gid) {
|
|
gid = -1;
|
|
errno = ENODATA;
|
|
}
|
|
}
|
|
} else
|
|
errno = EINVAL;
|
|
return (gid);
|
|
}
|
|
|
|
/*
|
|
* Initializations before calling ntfs_get_file_security()
|
|
* ntfs_set_file_security() and ntfs_read_directory()
|
|
*
|
|
* Only allowed for root
|
|
*
|
|
* Returns an (obscured) struct SECURITY_API* needed for further calls
|
|
* NULL if not root (EPERM) or device is mounted (EBUSY)
|
|
*/
|
|
|
|
struct SECURITY_API *ntfs_initialize_file_security(const char *device,
|
|
int flags)
|
|
{
|
|
ntfs_volume *vol;
|
|
unsigned long mntflag;
|
|
int mnt;
|
|
struct SECURITY_API *scapi;
|
|
struct SECURITY_CONTEXT *scx;
|
|
|
|
scapi = (struct SECURITY_API*)NULL;
|
|
mnt = ntfs_check_if_mounted(device, &mntflag);
|
|
if (!mnt && !(mntflag & NTFS_MF_MOUNTED) && !getuid()) {
|
|
vol = ntfs_mount(device, flags);
|
|
if (vol) {
|
|
scapi = (struct SECURITY_API*)
|
|
ntfs_malloc(sizeof(struct SECURITY_API));
|
|
if (!ntfs_volume_get_free_space(vol)
|
|
&& scapi) {
|
|
scapi->magic = MAGIC_API;
|
|
scapi->seccache = (struct PERMISSIONS_CACHE*)NULL;
|
|
scx = &scapi->security;
|
|
scx->vol = vol;
|
|
scx->uid = getuid();
|
|
scx->gid = getgid();
|
|
scx->pseccache = &scapi->seccache;
|
|
scx->vol->secure_flags = 0;
|
|
/* accept no mapping and no $Secure */
|
|
ntfs_build_mapping(scx,(const char*)NULL,TRUE);
|
|
ntfs_open_secure(vol);
|
|
} else {
|
|
if (scapi)
|
|
free(scapi);
|
|
else
|
|
errno = ENOMEM;
|
|
mnt = ntfs_umount(vol,FALSE);
|
|
scapi = (struct SECURITY_API*)NULL;
|
|
}
|
|
}
|
|
} else
|
|
if (getuid())
|
|
errno = EPERM;
|
|
else
|
|
errno = EBUSY;
|
|
return (scapi);
|
|
}
|
|
|
|
/*
|
|
* Leaving after ntfs_initialize_file_security()
|
|
*
|
|
* Returns FALSE if FAILED
|
|
*/
|
|
|
|
BOOL ntfs_leave_file_security(struct SECURITY_API *scapi)
|
|
{
|
|
int ok;
|
|
ntfs_volume *vol;
|
|
|
|
ok = FALSE;
|
|
if (scapi && (scapi->magic == MAGIC_API) && scapi->security.vol) {
|
|
vol = scapi->security.vol;
|
|
ntfs_close_secure(&scapi->security);
|
|
free(scapi);
|
|
if (!ntfs_umount(vol, 0))
|
|
ok = TRUE;
|
|
}
|
|
return (ok);
|
|
}
|
|
|