X-Git-Url: https://arthur.barton.de/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=etc%2Fafpd%2Facls.c;h=f914c8e4754753e55033f5b77222edd6688808bf;hb=HEAD;hp=6f2abdf30f43b4c22f7d26a0c7ed7f38d54df9cf;hpb=b9a9ac3498b7ae48c11b2bec6be1aff810cd37d2;p=netatalk.git diff --git a/etc/afpd/acls.c b/etc/afpd/acls.c index 6f2abdf3..f914c8e4 100644 --- a/etc/afpd/acls.c +++ b/etc/afpd/acls.c @@ -27,6 +27,9 @@ #ifdef HAVE_SOLARIS_ACLS #include #endif +#ifdef HAVE_FREEBSD_SUNACL +#include +#endif #ifdef HAVE_POSIX_ACLS #include #endif @@ -76,7 +79,7 @@ * Solaris funcs ********************************************************/ -#ifdef HAVE_SOLARIS_ACLS +#ifdef HAVE_NFSV4_ACLS /*! * Compile access rights for a user to one file-system object @@ -87,15 +90,17 @@ * * @param obj (r) handle * @param path (r) path to filesystem object - * @param sb (r) struct stat of path - * @param result (w) resulting Darwin allow ACE + * @param sb (rw) struct stat of path + * @param ma (rw) UARights struct + * @param rights_out (w) mapped Darwin ACL rights * * @returns 0 or -1 on error */ static int solaris_acl_rights(const AFPObj *obj, const char *path, - const struct stat *sb, - uint32_t *result) + struct stat *sb, + struct maccess *ma, + uint32_t *rights_out) { EC_INIT; int i, ace_count, checkgroup; @@ -168,7 +173,28 @@ static int solaris_acl_rights(const AFPObj *obj, darwin_rights |= nfsv4_to_darwin_rights[i].to; } - *result |= darwin_rights; + LOG(log_maxdebug, logtype_afpd, "rights: 0x%08x", darwin_rights); + + if (rights_out) + *rights_out = darwin_rights; + + if (ma && obj->options.flags & OPTION_ACL2MACCESS) { + if (darwin_rights & DARWIN_ACE_READ_DATA) + ma->ma_user |= AR_UREAD; + if (darwin_rights & DARWIN_ACE_WRITE_DATA) + ma->ma_user |= AR_UWRITE; + if (darwin_rights & (DARWIN_ACE_EXECUTE | DARWIN_ACE_SEARCH)) + ma->ma_user |= AR_USEARCH; + } + + if (sb && obj->options.flags & OPTION_ACL2MODE) { + if (darwin_rights & DARWIN_ACE_READ_DATA) + sb->st_mode |= S_IRUSR; + if (darwin_rights & DARWIN_ACE_WRITE_DATA) + sb->st_mode |= S_IWUSR; + if (darwin_rights & (DARWIN_ACE_EXECUTE | DARWIN_ACE_SEARCH)) + sb->st_mode |= S_IXUSR; + } EC_CLEANUP: if (aces) free(aces); @@ -339,7 +365,7 @@ EC_CLEANUP: free(name); EC_EXIT; } -#endif /* HAVE_SOLARIS_ACLS */ +#endif /* HAVE_NFSV4_ACLS */ /******************************************************** * POSIX 1e funcs @@ -607,21 +633,23 @@ static int posix_acls_to_uaperms(const AFPObj *obj, const char *path, struct sta break; } } - /* apply the mask and adjust user and group permissions */ - ma->ma_user |= (acl_rights & mask); - ma->ma_group = (group_rights & mask); - - /* update st_mode to properly reflect group permissions */ - sb->st_mode &= ~S_IRWXG; - if (ma->ma_group & AR_USEARCH) - sb->st_mode |= S_IXGRP; - - if (ma->ma_group & AR_UWRITE) - sb->st_mode |= S_IWGRP; + if (obj->options.flags & OPTION_ACL2MACCESS) { + /* apply the mask and adjust user and group permissions */ + ma->ma_user |= (acl_rights & mask); + ma->ma_group = (group_rights & mask); + } - if (ma->ma_group & AR_UREAD) - sb->st_mode |= S_IRGRP; + if (obj->options.flags & OPTION_ACL2MODE) { + /* update st_mode to properly reflect group permissions */ + sb->st_mode &= ~S_IRWXG; + if (ma->ma_group & AR_USEARCH) + sb->st_mode |= S_IXGRP; + if (ma->ma_group & AR_UWRITE) + sb->st_mode |= S_IWGRP; + if (ma->ma_group & AR_UREAD) + sb->st_mode |= S_IRGRP; + } EC_CLEANUP: if (acl) acl_free(acl); @@ -950,7 +978,7 @@ static int map_acl(int type, void *acl, darwin_ace_t *buf, int ace_count) switch (type & MAP_MASK) { -#ifdef HAVE_SOLARIS_ACLS +#ifdef HAVE_NFSV4_ACLS case SOLARIS_2_DARWIN: mapped_aces = map_aces_solaris_to_darwin( acl, buf, ace_count); break; @@ -958,7 +986,7 @@ static int map_acl(int type, void *acl, darwin_ace_t *buf, int ace_count) case DARWIN_2_SOLARIS: mapped_aces = map_aces_darwin_to_solaris( buf, acl, ace_count); break; -#endif /* HAVE_SOLARIS_ACLS */ +#endif /* HAVE_NFSV4_ACLS */ #ifdef HAVE_POSIX_ACLS case POSIX_DEFAULT_2_DARWIN: @@ -994,7 +1022,7 @@ static int get_and_map_acl(char *name, char *rbuf, size_t *rbuflen) int mapped_aces = 0; int dirflag; char *darwin_ace_count = rbuf; -#ifdef HAVE_SOLARIS_ACLS +#ifdef HAVE_NFSV4_ACLS int ace_count = 0; ace_t *aces = NULL; #endif @@ -1008,10 +1036,10 @@ static int get_and_map_acl(char *name, char *rbuf, size_t *rbuflen) *rbuf = 0; rbuf += 4; -#ifdef HAVE_SOLARIS_ACLS +#ifdef HAVE_NFSV4_ACLS EC_NEG1(ace_count = get_nfsv4_acl(name, &aces)); EC_NEG1(mapped_aces = map_acl(SOLARIS_2_DARWIN, aces, (darwin_ace_t *)rbuf, ace_count)); -#endif /* HAVE_SOLARIS_ACLS */ +#endif /* HAVE_NFSV4_ACLS */ #ifdef HAVE_POSIX_ACLS acl_t defacl = NULL , accacl = NULL; @@ -1049,7 +1077,7 @@ static int get_and_map_acl(char *name, char *rbuf, size_t *rbuflen) EC_STATUS(0); EC_CLEANUP: -#ifdef HAVE_SOLARIS_ACLS +#ifdef HAVE_NFSV4_ACLS if (aces) free(aces); #endif #ifdef HAVE_POSIX_ACLS @@ -1067,7 +1095,7 @@ static int remove_acl(const struct vol *vol,const char *path, int dir) { int ret = AFP_OK; -#if (defined HAVE_SOLARIS_ACLS || defined HAVE_POSIX_ACLS) +#if (defined HAVE_NFSV4_ACLS || defined HAVE_POSIX_ACLS) /* Ressource etc. first */ if ((ret = vol->vfs->vfs_remove_acl(vol, path, dir)) != AFP_OK) return ret; @@ -1085,7 +1113,7 @@ static int remove_acl(const struct vol *vol,const char *path, int dir) We will store inherited ACEs first, which is Darwins canonical order. - returns AFPerror code */ -#ifdef HAVE_SOLARIS_ACLS +#ifdef HAVE_NFSV4_ACLS static int set_acl(const struct vol *vol, char *name, int inherit, @@ -1161,28 +1189,27 @@ static int set_acl(const struct vol *vol, if ((ret = (vol->vfs->vfs_acl(vol, name, ACE_SETACL, new_aces_count, new_aces))) != 0) { LOG(log_debug, logtype_afpd, "set_acl: error setting acl: %s", strerror(errno)); switch (errno) { - case EACCES: - case EPERM: - EC_STATUS(AFPERR_ACCESS); - break; case ENOENT: - EC_STATUS(AFP_OK); break; + case EACCES: + case EPERM: + EC_EXIT_STATUS(AFPERR_ACCESS); default: - EC_STATUS(AFPERR_MISC); - break; + EC_EXIT_STATUS(AFPERR_MISC); } - goto EC_CLEANUP; } + if ((ret = (acl(name, ACE_SETACL, new_aces_count, new_aces))) != 0) { LOG(log_error, logtype_afpd, "set_acl: error setting acl: %s", strerror(errno)); - if (errno == (EACCES | EPERM)) - EC_STATUS(AFPERR_ACCESS); - else if (errno == ENOENT) - EC_STATUS(AFPERR_NOITEM); - else - EC_STATUS(AFPERR_MISC); - goto EC_CLEANUP; + switch (errno) { + case EACCES: + case EPERM: + EC_EXIT_STATUS(AFPERR_ACCESS); + case ENOENT: + EC_EXIT_STATUS(AFPERR_NOITEM); + default: + EC_EXIT_STATUS(AFPERR_MISC); + } } EC_STATUS(AFP_OK); @@ -1194,7 +1221,7 @@ EC_CLEANUP: LOG(log_debug9, logtype_afpd, "set_acl: END"); EC_EXIT; } -#endif /* HAVE_SOLARIS_ACLS */ +#endif /* HAVE_NFSV4_ACLS */ #ifdef HAVE_POSIX_ACLS #ifndef HAVE_ACL_FROM_MODE @@ -1395,8 +1422,8 @@ static int check_acl_access(const AFPObj *obj, allowed_rights = curdir->d_rights_cache; LOG(log_debug, logtype_afpd, "check_access: allowed rights from dircache: 0x%08x", allowed_rights); } else { -#ifdef HAVE_SOLARIS_ACLS - EC_ZERO_LOG(solaris_acl_rights(obj, path, &st, &allowed_rights)); +#ifdef HAVE_NFSV4_ACLS + EC_ZERO_LOG(solaris_acl_rights(obj, path, &st, NULL, &allowed_rights)); #endif #ifdef HAVE_POSIX_ACLS EC_ZERO_LOG(posix_acl_rights(obj, path, &st, &allowed_rights)); @@ -1428,8 +1455,8 @@ static int check_acl_access(const AFPObj *obj, LOG(log_debug, logtype_afpd,"parent: %s", cfrombstr(parent)); EC_ZERO_LOG_ERR(lstat(cfrombstr(parent), &st), AFPERR_MISC); -#ifdef HAVE_SOLARIS_ACLS - EC_ZERO_LOG(solaris_acl_rights(obj, cfrombstr(parent), &st, &parent_rights)); +#ifdef HAVE_NFSV4_ACLS + EC_ZERO_LOG(solaris_acl_rights(obj, cfrombstr(parent), &st, NULL, &parent_rights)); #endif #ifdef HAVE_POSIX_ACLS EC_ZERO_LOG(posix_acl_rights(obj, path, &st, &parent_rights)); @@ -1734,25 +1761,15 @@ int acltoownermode(const AFPObj *obj, const struct vol *vol, char *path, struct { EC_INIT; - if ( ! (obj->options.flags & OPTION_ACL2MACCESS) + if ( ! (obj->options.flags & (OPTION_ACL2MACCESS | OPTION_ACL2MODE)) || ! (vol->v_flags & AFPVOL_ACLS)) return 0; LOG(log_maxdebug, logtype_afpd, "acltoownermode(\"%s/%s\", 0x%02x)", getcwdpath(), path, ma->ma_user); -#ifdef HAVE_SOLARIS_ACLS - uint32_t rights = 0; - EC_ZERO_LOG(solaris_acl_rights(obj, path, st, &rights)); - - LOG(log_maxdebug, logtype_afpd, "rights: 0x%08x", rights); - - if (rights & DARWIN_ACE_READ_DATA) - ma->ma_user |= AR_UREAD; - if (rights & DARWIN_ACE_WRITE_DATA) - ma->ma_user |= AR_UWRITE; - if (rights & (DARWIN_ACE_EXECUTE | DARWIN_ACE_SEARCH)) - ma->ma_user |= AR_USEARCH; +#ifdef HAVE_NFSV4_ACLS + EC_ZERO_LOG(solaris_acl_rights(obj, path, st, ma, NULL)); #endif #ifdef HAVE_POSIX_ACLS