1
2
3
4
5
6
7
8#ifndef _SMBACL_H
9#define _SMBACL_H
10
11#include <linux/fs.h>
12#include <linux/namei.h>
13#include <linux/posix_acl.h>
14
15#include "mgmt/tree_connect.h"
16
17#define NUM_AUTHS (6)
18#define SID_MAX_SUB_AUTHORITIES (15)
19
20
21
22
23enum {
24 ACCESS_ALLOWED,
25 ACCESS_DENIED,
26};
27
28
29
30
31enum {
32 SIDOWNER = 1,
33 SIDGROUP,
34 SIDCREATOR_OWNER,
35 SIDCREATOR_GROUP,
36 SIDUNIX_USER,
37 SIDUNIX_GROUP,
38 SIDNFS_USER,
39 SIDNFS_GROUP,
40 SIDNFS_MODE,
41};
42
43
44#define SD_REVISION 1
45
46
47#define OWNER_DEFAULTED 0x0001
48#define GROUP_DEFAULTED 0x0002
49#define DACL_PRESENT 0x0004
50#define DACL_DEFAULTED 0x0008
51#define SACL_PRESENT 0x0010
52#define SACL_DEFAULTED 0x0020
53#define DACL_TRUSTED 0x0040
54#define SERVER_SECURITY 0x0080
55#define DACL_AUTO_INHERIT_REQ 0x0100
56#define SACL_AUTO_INHERIT_REQ 0x0200
57#define DACL_AUTO_INHERITED 0x0400
58#define SACL_AUTO_INHERITED 0x0800
59#define DACL_PROTECTED 0x1000
60#define SACL_PROTECTED 0x2000
61#define RM_CONTROL_VALID 0x4000
62#define SELF_RELATIVE 0x8000
63
64
65#define ACCESS_ALLOWED_ACE_TYPE 0x00
66#define ACCESS_DENIED_ACE_TYPE 0x01
67#define SYSTEM_AUDIT_ACE_TYPE 0x02
68#define SYSTEM_ALARM_ACE_TYPE 0x03
69#define ACCESS_ALLOWED_COMPOUND_ACE_TYPE 0x04
70#define ACCESS_ALLOWED_OBJECT_ACE_TYPE 0x05
71#define ACCESS_DENIED_OBJECT_ACE_TYPE 0x06
72#define SYSTEM_AUDIT_OBJECT_ACE_TYPE 0x07
73#define SYSTEM_ALARM_OBJECT_ACE_TYPE 0x08
74#define ACCESS_ALLOWED_CALLBACK_ACE_TYPE 0x09
75#define ACCESS_DENIED_CALLBACK_ACE_TYPE 0x0A
76#define ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE 0x0B
77#define ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE 0x0C
78#define SYSTEM_AUDIT_CALLBACK_ACE_TYPE 0x0D
79#define SYSTEM_ALARM_CALLBACK_ACE_TYPE 0x0E
80#define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE 0x0F
81#define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE 0x10
82#define SYSTEM_MANDATORY_LABEL_ACE_TYPE 0x11
83#define SYSTEM_RESOURCE_ATTRIBUTE_ACE_TYPE 0x12
84#define SYSTEM_SCOPED_POLICY_ID_ACE_TYPE 0x13
85
86
87#define OBJECT_INHERIT_ACE 0x01
88#define CONTAINER_INHERIT_ACE 0x02
89#define NO_PROPAGATE_INHERIT_ACE 0x04
90#define INHERIT_ONLY_ACE 0x08
91#define INHERITED_ACE 0x10
92#define SUCCESSFUL_ACCESS_ACE_FLAG 0x40
93#define FAILED_ACCESS_ACE_FLAG 0x80
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110#define SID_STRING_BASE_SIZE (2 + 3 + 15 + 1)
111#define SID_STRING_SUBAUTH_SIZE (11)
112
113#define DOMAIN_USER_RID_LE cpu_to_le32(513)
114
115struct ksmbd_conn;
116
117struct smb_ntsd {
118 __le16 revision;
119 __le16 type;
120 __le32 osidoffset;
121 __le32 gsidoffset;
122 __le32 sacloffset;
123 __le32 dacloffset;
124} __packed;
125
126struct smb_sid {
127 __u8 revision;
128 __u8 num_subauth;
129 __u8 authority[NUM_AUTHS];
130 __le32 sub_auth[SID_MAX_SUB_AUTHORITIES];
131} __packed;
132
133
134#define CIFS_SID_BASE_SIZE (1 + 1 + NUM_AUTHS)
135
136struct smb_acl {
137 __le16 revision;
138 __le16 size;
139 __le32 num_aces;
140} __packed;
141
142struct smb_ace {
143 __u8 type;
144 __u8 flags;
145 __le16 size;
146 __le32 access_req;
147 struct smb_sid sid;
148} __packed;
149
150struct smb_fattr {
151 kuid_t cf_uid;
152 kgid_t cf_gid;
153 umode_t cf_mode;
154 __le32 daccess;
155 struct posix_acl *cf_acls;
156 struct posix_acl *cf_dacls;
157};
158
159struct posix_ace_state {
160 u32 allow;
161 u32 deny;
162};
163
164struct posix_user_ace_state {
165 union {
166 kuid_t uid;
167 kgid_t gid;
168 };
169 struct posix_ace_state perms;
170};
171
172struct posix_ace_state_array {
173 int n;
174 struct posix_user_ace_state aces[];
175};
176
177
178
179
180
181
182struct posix_acl_state {
183 struct posix_ace_state owner;
184 struct posix_ace_state group;
185 struct posix_ace_state other;
186 struct posix_ace_state everyone;
187 struct posix_ace_state mask;
188 struct posix_ace_state_array *users;
189 struct posix_ace_state_array *groups;
190};
191
192int parse_sec_desc(struct user_namespace *user_ns, struct smb_ntsd *pntsd,
193 int acl_len, struct smb_fattr *fattr);
194int build_sec_desc(struct user_namespace *user_ns, struct smb_ntsd *pntsd,
195 struct smb_ntsd *ppntsd, int addition_info,
196 __u32 *secdesclen, struct smb_fattr *fattr);
197int init_acl_state(struct posix_acl_state *state, int cnt);
198void free_acl_state(struct posix_acl_state *state);
199void posix_state_to_acl(struct posix_acl_state *state,
200 struct posix_acl_entry *pace);
201int compare_sids(const struct smb_sid *ctsid, const struct smb_sid *cwsid);
202bool smb_inherit_flags(int flags, bool is_dir);
203int smb_inherit_dacl(struct ksmbd_conn *conn, struct path *path,
204 unsigned int uid, unsigned int gid);
205int smb_check_perm_dacl(struct ksmbd_conn *conn, struct path *path,
206 __le32 *pdaccess, int uid);
207int set_info_sec(struct ksmbd_conn *conn, struct ksmbd_tree_connect *tcon,
208 struct path *path, struct smb_ntsd *pntsd, int ntsd_len,
209 bool type_check);
210void id_to_sid(unsigned int cid, uint sidtype, struct smb_sid *ssid);
211void ksmbd_init_domain(u32 *sub_auth);
212
213static inline uid_t posix_acl_uid_translate(struct user_namespace *mnt_userns,
214 struct posix_acl_entry *pace)
215{
216 kuid_t kuid;
217
218
219 kuid = kuid_into_mnt(mnt_userns, pace->e_uid);
220
221
222 return from_kuid(&init_user_ns, kuid);
223}
224
225static inline gid_t posix_acl_gid_translate(struct user_namespace *mnt_userns,
226 struct posix_acl_entry *pace)
227{
228 kgid_t kgid;
229
230
231 kgid = kgid_into_mnt(mnt_userns, pace->e_gid);
232
233
234 return from_kgid(&init_user_ns, kgid);
235}
236
237#endif
238