Home
My Posts

Archive
Login
Signup

Recent Posts

Free subdomains

Want your own xyz.kpaste.net sub-domain for your community? Just type the address into your browser address bar (foo.xyz.kpaste.net is also supported).

Suggestions/Bugs?

Email us at . Try to include as much info as possible.

About

Pastebin is a tool for collaborative debugging or editing.

 

msnfs41client: Patches for default ACLs, 2024-03-14
Posted by Anonymous on Thu 14th Mar 2024 19:02
raw | new post

Submit a correction or amendment below (click here to make a fresh posting)
After submitting an amendment, you'll be able to view the differences between the old and new posts easily.

Syntax highlighting: None Bash C C++ CSS Diff HTML mIRC Script Perl PHP Python Smarty XML ---------------------------- ABAP Actionscript ADA Apache Log AppleScript APT sources.list ASM ASP AutoIT Bash C C# C++ C++ (with QT) CSS Diff HTML INI (Config Files) Java Javascript Lua Make mIRC Script MySQL NSIS Perl PHP Python Q(uick)BASIC robots Ruby Ruby on Rails SDLBasic Smarty SQL TCL Text VB.NET Visual BASIC Visual Fox Pro Visual Prolog Windows Registry Files XML Xorg.conf

To highlight particular lines, prefix each line with {%HIGHLIGHT}
From ae1cc2fa2fb885ba445d4606d40f81fe2123e1b6 Mon Sep 17 00:00:00 2001 From: Roland Mainz <roland.mainz@nrubsig.org> Date: Thu, 14 Mar 2024 18:02:34 +0100 Subject: [PATCH 1/2] daemon: Add more debugging output to set/get ACL codepath+cleanup Add more debugging output to set/get ACL codepath, and rename |map_acemask()| to |map_winaccessmask2nfs4acemask()| and |map_aceflags()| to |map_winace2nfs4aceflags()| to indicate the mapping direction. Signed-off-by: Cedric Blancher <cedric.blancher@gmail.com> --- daemon/acl.c | 34 +++++++++++++++++++++++++--------- 1 file changed, 25 insertions(+), 9 deletions(-) diff --git a/daemon/acl.c b/daemon/acl.c index 47aa5ba..f7fb870 100644 --- a/daemon/acl.c +++ b/daemon/acl.c @@ -106,6 +106,9 @@ static int convert_nfs4acl_2_dacl(nfs41_daemon_globals *nfs41dg, LPSTR domain = NULL; BOOLEAN flag; + DPRINTF(ACLLVL, ("--> convert_nfs4acl_2_dacl(acl=0x%p,file_type=%d)\n", + acl, file_type)); + sids = malloc(acl->count * sizeof(PSID)); if (sids == NULL) { status = GetLastError(); @@ -113,7 +116,7 @@ static int convert_nfs4acl_2_dacl(nfs41_daemon_globals *nfs41dg, } for (i = 0; i < acl->count; i++) { convert_nfs4name_2_user_domain(acl->aces[i].who, &domain); - DPRINTF(ACLLVL, ("handle_getacl: for user='%s' domain='%s'\n", + DPRINTF(ACLLVL, ("convert_nfs4acl_2_dacl: for user='%s' domain='%s'\n", acl->aces[i].who, domain?domain:"<null>")); status = check_4_special_identifiers(acl->aces[i].who, &sids[i], &sid_len, &flag); @@ -178,6 +181,8 @@ static int convert_nfs4acl_2_dacl(nfs41_daemon_globals *nfs41dg, *sids_out = sids; *dacl_out = dacl; out: + DPRINTF(ACLLVL, ("<-- convert_nfs4acl_2_dacl(acl=0x%p,file_type=%d) returning %d\n", + acl, file_type, status)); return status; out_free_dacl: free(dacl); @@ -203,6 +208,8 @@ static int handle_getacl(void *daemon_context, nfs41_upcall *upcall) char owner[NFS4_OPAQUE_LIMIT+1], group[NFS4_OPAQUE_LIMIT+1]; nfsacl41 acl = { 0 }; + DPRINTF(ACLLVL, ("--> handle_getacl()\n")); + if (args->query & DACL_SECURITY_INFORMATION) { use_nfs41_getattr: bitmap4 attr_request = { 0 }; @@ -354,6 +361,9 @@ out: free(dacl); nfsacl41_free(info.acl); } + + DPRINTF(ACLLVL, ("<-- handle_getacl() returning %d\n", status)); + return status; } @@ -449,7 +459,7 @@ static int is_well_known_sid(PSID sid, char *who) return FALSE; } -static void map_aceflags(BYTE win_aceflags, uint32_t *nfs4_aceflags) +static void map_winace2nfs4aceflags(BYTE win_aceflags, uint32_t *nfs4_aceflags) { if (win_aceflags & OBJECT_INHERIT_ACE) *nfs4_aceflags |= ACE4_FILE_INHERIT_ACE; @@ -461,13 +471,16 @@ static void map_aceflags(BYTE win_aceflags, uint32_t *nfs4_aceflags) *nfs4_aceflags |= ACE4_INHERIT_ONLY_ACE; if (win_aceflags & INHERITED_ACE) *nfs4_aceflags |= ACE4_INHERITED_ACE; - DPRINTF(ACLLVL, ("ACE FLAGS: %x nfs4 aceflags %x\n", - win_aceflags, *nfs4_aceflags)); + DPRINTF(ACLLVL, + ("map_winace2nfs4aceflags: win_aceflags=0x%x nfs4_aceflags=0x%x\n", + (int)win_aceflags, (int)*nfs4_aceflags)); } -static void map_acemask(ACCESS_MASK mask, int file_type, uint32_t *nfs4_mask) +static void map_winaccessmask2nfs4acemask(ACCESS_MASK mask, int file_type, uint32_t *nfs4_mask) { - DPRINTF(ACLLVL, ("ACE MASK: %x\n", mask)); + DPRINTF(ACLLVL, + ("--> map_winaccessmask2nfs4acemask(mask=0x%x)\n", + (int)mask)); print_windows_access_mask(ACLLVL, mask); /* check if any GENERIC bits set */ if (mask & 0xf000000) { @@ -488,6 +501,9 @@ static void map_acemask(ACCESS_MASK mask, int file_type, uint32_t *nfs4_mask) else /* ignoring generic and reserved bits */ *nfs4_mask = mask & 0x00ffffff; print_nfs_access_mask(ACLLVL, *nfs4_mask); + DPRINTF(ACLLVL, + ("<-- map_winaccessmask2nfs4acemask(mask=0x%x, *nfs4_mask=0x%x)\n", + (int)mask, (int)*nfs4_mask)); } static int map_nfs4ace_who(PSID sid, PSID owner_sid, PSID group_sid, char *who_out, char *domain, SID_NAME_USE *sid_type_out) @@ -686,9 +702,9 @@ static int map_dacl_2_nfs4acl(PACL acl, PSID sid, PSID gsid, nfsacl41 *nfs4_acl, goto out_free; } - map_aceflags(ace->AceFlags, &nfs4_acl->aces[i].aceflag); - map_acemask(*(PACCESS_MASK)(ace + 1), file_type, - &nfs4_acl->aces[i].acemask); + map_winace2nfs4aceflags(ace->AceFlags, &nfs4_acl->aces[i].aceflag); + map_winaccessmask2nfs4acemask(*(PACCESS_MASK)(ace + 1), + file_type, &nfs4_acl->aces[i].acemask); tmp_pointer += sizeof(ACCESS_MASK) + sizeof(ACE_HEADER); -- 2.43.0 From fa4dc2ddb4c65b34eec6bab2a78190f0c3d49881 Mon Sep 17 00:00:00 2001 From: Roland Mainz <roland.mainz@nrubsig.org> Date: Thu, 14 Mar 2024 19:49:21 +0100 Subject: [PATCH 2/2] daemon: Return default ACLs Fix getting the default ACLs. Testcase: ---- snip ---- $ mkdir d1 $ setfacl -m u::rwx,g::rwx,o::rwx,d:u::rwx,d:g::rwx,d:o::rwx d1 $ getfacl d1 user::rwx group::rwx other::rwx default:user::rwx default:group::rwx default:other::rwx ---- snip ---- Reported-by: Dan Shelton <dan.f.shelton@gmail.com> Signed-off-by: Cedric Blancher <cedric.blancher@gmail.com> --- daemon/acl.c | 72 ++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 59 insertions(+), 13 deletions(-) diff --git a/daemon/acl.c b/daemon/acl.c index f7fb870..10c6f77 100644 --- a/daemon/acl.c +++ b/daemon/acl.c @@ -38,6 +38,11 @@ #define ACLLVL 2 /* dprintf level for acl logging */ +/* Local prototypes */ +static void map_winace2nfs4aceflags(BYTE win_aceflags, uint32_t *nfs4_aceflags); +static void map_nfs4aceflags2winaceflags(uint32_t nfs4_aceflags, DWORD *win_aceflags); + + static int parse_getacl(unsigned char *buffer, uint32_t length, nfs41_upcall *upcall) { @@ -125,8 +130,17 @@ static int convert_nfs4acl_2_dacl(nfs41_daemon_globals *nfs41dg, goto out; } if (!flag) { + bool isgroupacl = (acl->aces[i].aceflag & ACE4_IDENTIFIER_GROUP)?true:false; + + if (isgroupacl) { + DPRINTF(ACLLVL, + ("convert_nfs4acl_2_dacl: aces[%d].who='%s': " + "Setting group flag\n", + i, acl->aces[i].who)); + } + status = map_nfs4servername_2_sid(nfs41dg, - 0xFFFF /* fixme: Unknown whether user or group */, + (isgroupacl?GROUP_SECURITY_INFORMATION:OWNER_SECURITY_INFORMATION), &sid_len, &sids[i], acl->aces[i].who); if (status) { free_sids(sids, i); @@ -143,24 +157,39 @@ static int convert_nfs4acl_2_dacl(nfs41_daemon_globals *nfs41dg, if (InitializeAcl(dacl, size, ACL_REVISION)) { ACCESS_MASK mask; + DWORD win_aceflags; + for (i = 0; i < acl->count; i++) { + win_aceflags = 0; + // nfs4 acemask should be exactly the same as file access mask mask = acl->aces[i].acemask; - DPRINTF(ACLLVL, ("access mask %x ace type '%s'\n", mask, - acl->aces[i].acetype?"DENIED ACE":"ALLOWED ACE")); + map_nfs4aceflags2winaceflags(acl->aces[i].aceflag, &win_aceflags); + + DPRINTF(ACLLVL, ("aces[%d].who='%s': " + "access mask=0x%x, acetype='%s', win_aceflags=0x%x\n", + i, acl->aces[i].who, + (int)mask, + acl->aces[i].acetype?"DENIED ACE":"ALLOWED ACE", + (int)win_aceflags)); + if (acl->aces[i].acetype == ACE4_ACCESS_ALLOWED_ACE_TYPE) { - status = AddAccessAllowedAce(dacl, ACL_REVISION, mask, sids[i]); + status = AddAccessAllowedAceEx(dacl, ACL_REVISION, win_aceflags, mask, sids[i]); if (!status) { - eprintf("convert_nfs4acl_2_dacl: AddAccessAllowedAce failed " - "with %d\n", status); + eprintf("convert_nfs4acl_2_dacl: " + "AddAccessAllowedAceEx(dacl=0x%p,win_aceflags=0x%x,mask=0x%x) failed " + "with status=%d\n", + dacl, (int)win_aceflags, (int)mask, status); goto out_free_dacl; } else status = ERROR_SUCCESS; } else if (acl->aces[i].acetype == ACE4_ACCESS_DENIED_ACE_TYPE) { - status = AddAccessDeniedAce(dacl, ACL_REVISION, mask, sids[i]); + status = AddAccessDeniedAceEx(dacl, ACL_REVISION, win_aceflags, mask, sids[i]); if (!status) { - eprintf("convert_nfs4acl_2_dacl: AddAccessDeniedAce failed " - "with %d\n", status); + eprintf("convert_nfs4acl_2_dacl: " + "AddAccessDeniedAceEx(dacl=0x%p,win_aceflags=0x%x,mask=0x%x) failed " + "with status=%d\n", + dacl, (int)win_aceflags, (int)mask, status); goto out_free_dacl; } else status = ERROR_SUCCESS; @@ -476,6 +505,23 @@ static void map_winace2nfs4aceflags(BYTE win_aceflags, uint32_t *nfs4_aceflags) (int)win_aceflags, (int)*nfs4_aceflags)); } +static void map_nfs4aceflags2winaceflags(uint32_t nfs4_aceflags, DWORD *win_aceflags) +{ + if (nfs4_aceflags & ACE4_FILE_INHERIT_ACE) + *win_aceflags |= OBJECT_INHERIT_ACE; + if (nfs4_aceflags & ACE4_DIRECTORY_INHERIT_ACE) + *win_aceflags |= CONTAINER_INHERIT_ACE; + if (nfs4_aceflags & ACE4_NO_PROPAGATE_INHERIT_ACE) + *win_aceflags |= NO_PROPAGATE_INHERIT_ACE; + if (nfs4_aceflags & ACE4_INHERIT_ONLY_ACE) + *win_aceflags |= INHERIT_ONLY_ACE; + if (nfs4_aceflags & ACE4_INHERITED_ACE) + *win_aceflags |= INHERITED_ACE; + DPRINTF(ACLLVL, + ("map_nfs4aceflags2winace: nfs4_aceflags=0x%x win_aceflags=0x%x\n", + (int)nfs4_aceflags, (int)*win_aceflags)); +} + static void map_winaccessmask2nfs4acemask(ACCESS_MASK mask, int file_type, uint32_t *nfs4_mask) { DPRINTF(ACLLVL, @@ -725,13 +771,13 @@ static int map_dacl_2_nfs4acl(PACL acl, PSID sid, PSID gsid, nfsacl41 *nfs4_acl, */ if ((who_sid_type == SidTypeGroup) || (who_sid_type == SidTypeAlias)) { - DPRINTF(ACLLVL, ("map_dacl_2_nfs4acl: " - "who_sid_type=%d, setting group flag for '%s'\n", + DPRINTF(ACLLVL, ("map_dacl_2_nfs4acl: who_sid_type=%d: " + "aces[%d].who='%s': " + "setting group flag\n", (int)who_sid_type, - nfs4_acl->aces[i].who)); + i, nfs4_acl->aces[i].who)); nfs4_acl->aces[i].aceflag |= ACE4_IDENTIFIER_GROUP; } - } } status = ERROR_SUCCESS; -- 2.43.0

Title:

Privacy: Public Private

How long should your post be retained?

15 mins an hour a day a week a month forever

All content is user-submitted.
The administrators of this site (kpaste.net) are not responsible for their content.
Abuse reports should be emailed to us at