/* SPDX-License-Identifier: LGPL-2.1+ */ /* * Copyright (c) International Business Machines Corp., 2007 * Author(s): Steve French ([email protected]) * Modified by Namjae Jeon ([email protected]) */ #ifndef _SMBACL_H #define _SMBACL_H #include <linux/fs.h> #include <linux/namei.h> #include <linux/posix_acl.h> #include <linux/mnt_idmapping.h> #include "mgmt/tree_connect.h" #define NUM_AUTHS … #define SID_MAX_SUB_AUTHORITIES … /* * ACE types - see MS-DTYP 2.4.4.1 */ enum { … }; /* * Security ID types */ enum { … }; /* Revision for ACLs */ #define SD_REVISION … /* Control flags for Security Descriptor */ #define OWNER_DEFAULTED … #define GROUP_DEFAULTED … #define DACL_PRESENT … #define DACL_DEFAULTED … #define SACL_PRESENT … #define SACL_DEFAULTED … #define DACL_TRUSTED … #define SERVER_SECURITY … #define DACL_AUTO_INHERIT_REQ … #define SACL_AUTO_INHERIT_REQ … #define DACL_AUTO_INHERITED … #define SACL_AUTO_INHERITED … #define DACL_PROTECTED … #define SACL_PROTECTED … #define RM_CONTROL_VALID … #define SELF_RELATIVE … /* ACE types - see MS-DTYP 2.4.4.1 */ #define ACCESS_ALLOWED_ACE_TYPE … #define ACCESS_DENIED_ACE_TYPE … #define SYSTEM_AUDIT_ACE_TYPE … #define SYSTEM_ALARM_ACE_TYPE … #define ACCESS_ALLOWED_COMPOUND_ACE_TYPE … #define ACCESS_ALLOWED_OBJECT_ACE_TYPE … #define ACCESS_DENIED_OBJECT_ACE_TYPE … #define SYSTEM_AUDIT_OBJECT_ACE_TYPE … #define SYSTEM_ALARM_OBJECT_ACE_TYPE … #define ACCESS_ALLOWED_CALLBACK_ACE_TYPE … #define ACCESS_DENIED_CALLBACK_ACE_TYPE … #define ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE … #define ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE … #define SYSTEM_AUDIT_CALLBACK_ACE_TYPE … #define SYSTEM_ALARM_CALLBACK_ACE_TYPE … #define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE … #define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE … #define SYSTEM_MANDATORY_LABEL_ACE_TYPE … #define SYSTEM_RESOURCE_ATTRIBUTE_ACE_TYPE … #define SYSTEM_SCOPED_POLICY_ID_ACE_TYPE … /* ACE flags */ #define OBJECT_INHERIT_ACE … #define CONTAINER_INHERIT_ACE … #define NO_PROPAGATE_INHERIT_ACE … #define INHERIT_ONLY_ACE … #define INHERITED_ACE … #define SUCCESSFUL_ACCESS_ACE_FLAG … #define FAILED_ACCESS_ACE_FLAG … /* * Maximum size of a string representation of a SID: * * The fields are unsigned values in decimal. So: * * u8: max 3 bytes in decimal * u32: max 10 bytes in decimal * * "S-" + 3 bytes for version field + 15 for authority field + NULL terminator * * For authority field, max is when all 6 values are non-zero and it must be * represented in hex. So "-0x" + 12 hex digits. * * Add 11 bytes for each subauthority field (10 bytes each + 1 for '-') */ #define SID_STRING_BASE_SIZE … #define SID_STRING_SUBAUTH_SIZE … #define DOMAIN_USER_RID_LE … struct ksmbd_conn; struct smb_ntsd { … } __packed; struct smb_sid { … } __packed; /* size of a struct cifs_sid, sans sub_auth array */ #define CIFS_SID_BASE_SIZE … struct smb_acl { … } __packed; struct smb_ace { … } __packed; struct smb_fattr { … }; struct posix_ace_state { … }; struct posix_user_ace_state { … }; struct posix_ace_state_array { … }; /* * while processing the nfsv4 ace, this maintains the partial permissions * calculated so far: */ struct posix_acl_state { … }; int parse_sec_desc(struct mnt_idmap *idmap, struct smb_ntsd *pntsd, int acl_len, struct smb_fattr *fattr); int build_sec_desc(struct mnt_idmap *idmap, struct smb_ntsd *pntsd, struct smb_ntsd *ppntsd, int ppntsd_size, int addition_info, __u32 *secdesclen, struct smb_fattr *fattr); int init_acl_state(struct posix_acl_state *state, int cnt); void free_acl_state(struct posix_acl_state *state); void posix_state_to_acl(struct posix_acl_state *state, struct posix_acl_entry *pace); int compare_sids(const struct smb_sid *ctsid, const struct smb_sid *cwsid); bool smb_inherit_flags(int flags, bool is_dir); int smb_inherit_dacl(struct ksmbd_conn *conn, const struct path *path, unsigned int uid, unsigned int gid); int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path, __le32 *pdaccess, int uid); int set_info_sec(struct ksmbd_conn *conn, struct ksmbd_tree_connect *tcon, const struct path *path, struct smb_ntsd *pntsd, int ntsd_len, bool type_check, bool get_write); void id_to_sid(unsigned int cid, uint sidtype, struct smb_sid *ssid); void ksmbd_init_domain(u32 *sub_auth); static inline uid_t posix_acl_uid_translate(struct mnt_idmap *idmap, struct posix_acl_entry *pace) { … } static inline gid_t posix_acl_gid_translate(struct mnt_idmap *idmap, struct posix_acl_entry *pace) { … } #endif /* _SMBACL_H */
Codebase Browser
linux