The branch, v4-19-test has been updated via 5897f213e11 vfs_zfsacl: Call stat CAP_DAC_OVERRIDE functions via f4d8a3393e7 vfs_aixacl2: Call stat DAC_CAP_OVERRIDE functions via ada585b6c52 nfs4_acls: Make fstat_with_cap_dac_override static via 5f157b23b9f nfs4_acls: Make stat_with_cap_dac_override static via 482e205dfd6 nfs4_acls: Make fstatat_with_cap_dac_override static via 5998e68d3e4 vfs_gpfs: Move vfs_gpfs_fstatat to nfs4_acls.c and rename function via 119586b1926 vfs_gpfs: Move vfs_gpfs_lstat to nfs4_acls.c and rename function via ac17e86baf0 vfs_gpfs: Move vfs_gpfs_fstat to nfs4_acls.c and rename function via af89e07cb65 vfs_gpfs: Move vfs_gpfs_stat to nfs4_acls.c and rename function via dd266ff243a vfs_gpfs: Move stat_with_capability to nfs4_acls.c and rename function via 18373c5d395 vfs_gpfs: Move fstatat_with_cap_dac_override to nfs4_acls.c via cc0416f19b2 nfs4_acls: Implement fstat with DAC_CAP_OVERRIDE via 26d47c66354 vfs_gpfs: Implement CAP_DAC_OVERRIDE for fstatat via 14bb93a4460 vfs_gpfs: Implement CAP_DAC_OVERRIDE for fstat via 9043b07bd2d vfs_gpfs: Move fstatat with DAC_CAP_OVERRIDE to helper function via 98249085895 vfs_gpfs: Use O_PATH for opening dirfd for stat with CAP_DAC_OVERRIDE from b6c13c49153 python:tests: SHA1 is no longer supported by cryptography module
https://git.samba.org/?p=samba.git;a=shortlog;h=v4-19-test - Log ----------------------------------------------------------------- commit 5897f213e11a8b63214547b026c364e3439c236a Author: Christof Schmitt <c...@samba.org> Date: Thu Nov 9 12:44:02 2023 -0700 vfs_zfsacl: Call stat CAP_DAC_OVERRIDE functions BUG: https://bugzilla.samba.org/show_bug.cgi?id=15507 Signed-off-by: Christof Schmitt <c...@samba.org> Reviewed-by: Björn Jacke <bja...@samba.org> Autobuild-User(master): Björn Jacke <bja...@samba.org> Autobuild-Date(master): Wed Nov 15 19:55:07 UTC 2023 on atb-devel-224 (cherry picked from commit 12e5c15a97b45aa01fc3f4274f8ba9cf7d1ddbe9) Autobuild-User(v4-19-test): Jule Anger <jan...@samba.org> Autobuild-Date(v4-19-test): Sat Nov 25 19:40:32 UTC 2023 on atb-devel-224 commit f4d8a3393e7939aff50d55e27e9df22cc93d085f Author: Christof Schmitt <c...@samba.org> Date: Thu Nov 9 12:42:13 2023 -0700 vfs_aixacl2: Call stat DAC_CAP_OVERRIDE functions BUG: https://bugzilla.samba.org/show_bug.cgi?id=15507 Signed-off-by: Christof Schmitt <c...@samba.org> Reviewed-by: Björn Jacke <bja...@samba.org> (cherry picked from commit 9cac91542128888bde79391ca99291a76752f334) commit ada585b6c52f5ef8321980442770c9b09e42582a Author: Christof Schmitt <c...@samba.org> Date: Thu Nov 9 12:39:57 2023 -0700 nfs4_acls: Make fstat_with_cap_dac_override static No other module is calling this function. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15507 Signed-off-by: Christof Schmitt <c...@samba.org> Reviewed-by: Björn Jacke <bja...@samba.org> (cherry picked from commit bffd8bd8c32fea738824b807eb9e5f97a609493e) commit 5f157b23b9f9df9638051bffd20d9f08e1151f77 Author: Christof Schmitt <c...@samba.org> Date: Thu Nov 9 12:38:46 2023 -0700 nfs4_acls: Make stat_with_cap_dac_override static No other module is calling this function. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15507 Signed-off-by: Christof Schmitt <c...@samba.org> Reviewed-by: Björn Jacke <bja...@samba.org> (cherry picked from commit 0f664f016207894e0a156b9e1f4db7677c264205) commit 482e205dfd6adfb3341ae68b756a3a8830ae72a4 Author: Christof Schmitt <c...@samba.org> Date: Thu Nov 9 12:37:25 2023 -0700 nfs4_acls: Make fstatat_with_cap_dac_override static No other module is calling this function. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15507 Signed-off-by: Christof Schmitt <c...@samba.org> Reviewed-by: Björn Jacke <bja...@samba.org> (cherry picked from commit 8831eeca1d70c909e15c86c8af6a7b1d7b0d3b5b) commit 5998e68d3e48e077c644c5ec3c597499d737f692 Author: Christof Schmitt <c...@samba.org> Date: Thu Nov 9 12:35:21 2023 -0700 vfs_gpfs: Move vfs_gpfs_fstatat to nfs4_acls.c and rename function All stat DAC_CAP_OVERRIDE code is being moved to nfs4_acls.c to allow reuse. Move the vfs_gpfs_fstatat function and rename it to the more generic name nfs4_acl_fstat. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15507 Signed-off-by: Christof Schmitt <c...@samba.org> Reviewed-by: Björn Jacke <bja...@samba.org> (cherry picked from commit 5fd73e93af9d015c9e65a6d4d16229476a541cfc) commit 119586b19260b338d20c4f2caeb71717d16eeb20 Author: Christof Schmitt <c...@samba.org> Date: Thu Nov 9 12:30:27 2023 -0700 vfs_gpfs: Move vfs_gpfs_lstat to nfs4_acls.c and rename function All stat CAP_DAC_OVERRIDE code is being moved to nf4_acls.c to allow reuse. Move the vfs_gpfs_lstat function and rename to the more generic name nfs4_acl_lstat. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15507 Signed-off-by: Christof Schmitt <c...@samba.org> Reviewed-by: Björn Jacke <bja...@samba.org> (cherry picked from commit 2c1195678d34516744ba4f8b1c5582f4046cba35) commit ac17e86baf0598c0b66c75eb9643ac5b459a2883 Author: Christof Schmitt <c...@samba.org> Date: Thu Nov 9 12:27:58 2023 -0700 vfs_gpfs: Move vfs_gpfs_fstat to nfs4_acls.c and rename function All stat DAC_CAP_OVERRIDE code is moving to nfs4_acls.c to allow reuse. Move the vfs_gpfs_fstat function and rename to the more generic name nfs4_acl_fstat. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15507 Signed-off-by: Christof Schmitt <c...@samba.org> Reviewed-by: Björn Jacke <bja...@samba.org> (cherry picked from commit f9301871c61b066c1ea464e6e9109bb2cde71598) commit af89e07cb65838c04ce48544d59bfd2906730650 Author: Christof Schmitt <c...@samba.org> Date: Thu Nov 9 12:23:49 2023 -0700 vfs_gpfs: Move vfs_gpfs_stat to nfs4_acls.c and rename function All stat DAC_CAP_OVERRIDE code is moving to nfs4_acls.c to allow reuse by other file system modules. Also rename the function to the more generic name nfs4_acl_stat. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15507 Signed-off-by: Christof Schmitt <c...@samba.org> Reviewed-by: Björn Jacke <bja...@samba.org> (cherry picked from commit f8a23d960e02f783119c2aef38a6e293ee548df3) commit dd266ff243a199598b7f4022beb7853cb7027e32 Author: Christof Schmitt <c...@samba.org> Date: Thu Nov 9 12:20:38 2023 -0700 vfs_gpfs: Move stat_with_capability to nfs4_acls.c and rename function All stat CAP_DAC_OVERRIDE code is moving to nfs4_acls.c to allow reuse by other filesystem modules. Also rename the function to the slightly more precise name stat_with_cap_dac_overide. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15507 Signed-off-by: Christof Schmitt <c...@samba.org> Reviewed-by: Björn Jacke <bja...@samba.org> (cherry picked from commit 6b1e066c4f354f297fbf99ad93acfaf44e3b89cb) commit 18373c5d3951c2bc0e46f81e053d69cc33e80b56 Author: Christof Schmitt <c...@samba.org> Date: Thu Nov 9 12:17:21 2023 -0700 vfs_gpfs: Move fstatat_with_cap_dac_override to nfs4_acls.c All stat DAC_CAP_OVERRIDE code is being moved to nfs4_acls.c to allow reuse by other filesystem modules. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15507 Signed-off-by: Christof Schmitt <c...@samba.org> Reviewed-by: Björn Jacke <bja...@samba.org> (cherry picked from commit 316c96ea83a7b70d35879e4743193bb1e9cb566c) commit cc0416f19b2dfdf95d8998ad1d645842e93c6082 Author: Christof Schmitt <c...@samba.org> Date: Thu Nov 9 12:01:56 2023 -0700 nfs4_acls: Implement fstat with DAC_CAP_OVERRIDE AT_EMTPY_PATH does not exist on AIX. Address this by implementing an override for fstat. Implement the new override function in nfs4_acls.c since all stat functions with DAC_CAP_OVERRIDE will be moved there to allow reuse by other filesystems. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15507 Signed-off-by: Christof Schmitt <c...@samba.org> Reviewed-by: Björn Jacke <bja...@samba.org> (cherry picked from commit 05f1ee1ae2d8439af0ac9baf64ebba1a3374ea83) commit 26d47c66354ac390f67e6c6c99397d0e9cafcbf2 Author: Christof Schmitt <c...@samba.org> Date: Thu Oct 26 15:51:02 2023 -0700 vfs_gpfs: Implement CAP_DAC_OVERRIDE for fstatat BUG: https://bugzilla.samba.org/show_bug.cgi?id=15507 Signed-off-by: Christof Schmitt <c...@samba.org> Reviewed-by: Ralph Boehme <s...@samba.org> Autobuild-User(master): Ralph Böhme <s...@samba.org> Autobuild-Date(master): Wed Nov 8 18:42:13 UTC 2023 on atb-devel-224 (cherry picked from commit 963fc353e70b940f4009ca2764e966682400e2dc) commit 14bb93a446025adf70af741a6f46e3fbb8728467 Author: Christof Schmitt <c...@samba.org> Date: Thu Oct 26 14:45:34 2023 -0700 vfs_gpfs: Implement CAP_DAC_OVERRIDE for fstat BUG: https://bugzilla.samba.org/show_bug.cgi?id=15507 Signed-off-by: Christof Schmitt <c...@samba.org> Reviewed-by: Ralph Boehme <s...@samba.org> (cherry picked from commit cbdc16a7cfa225d1cf9109fafe85e9d14729700e) commit 9043b07bd2dfbe0ffeab91906c3ca8d6a8e06916 Author: Christof Schmitt <c...@samba.org> Date: Thu Oct 26 14:39:46 2023 -0700 vfs_gpfs: Move fstatat with DAC_CAP_OVERRIDE to helper function Allow reuse of this code. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15507 Signed-off-by: Christof Schmitt <c...@samba.org> Reviewed-by: Ralph Boehme <s...@samba.org> (cherry picked from commit 95319351e37b8b968b798eee66c93852d9ad2d81) commit 982490858957956c2213f37806a8cec70e01df00 Author: Christof Schmitt <c...@samba.org> Date: Thu Oct 26 14:37:15 2023 -0700 vfs_gpfs: Use O_PATH for opening dirfd for stat with CAP_DAC_OVERRIDE Use O_PATH when available; this avoids the need for READ/LIST access on that directory. Keep using O_RDONLY if the system does not have O_PATH. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15507 Signed-off-by: Christof Schmitt <c...@samba.org> Reviewed-by: Ralph Boehme <s...@samba.org> (cherry picked from commit b317622a8fed0ee195ffe40129eb5bcad28dd985) ----------------------------------------------------------------------- Summary of changes: source3/modules/nfs4_acls.c | 149 ++++++++++++++++++++++++++++++++++++++++++ source3/modules/nfs4_acls.h | 16 +++++ source3/modules/vfs_aixacl2.c | 4 ++ source3/modules/vfs_gpfs.c | 76 ++------------------- source3/modules/vfs_zfsacl.c | 4 ++ 5 files changed, 177 insertions(+), 72 deletions(-) Changeset truncated at 500 lines: diff --git a/source3/modules/nfs4_acls.c b/source3/modules/nfs4_acls.c index 2daae990042..4a1caa36d3c 100644 --- a/source3/modules/nfs4_acls.c +++ b/source3/modules/nfs4_acls.c @@ -116,6 +116,155 @@ int smbacl4_get_vfs_params(struct connection_struct *conn, return 0; } +static int fstatat_with_cap_dac_override(int fd, + const char *pathname, + SMB_STRUCT_STAT *sbuf, + int flags, + bool fake_dir_create_times) +{ + int ret; + + set_effective_capability(DAC_OVERRIDE_CAPABILITY); + ret = sys_fstatat(fd, + pathname, + sbuf, + flags, + fake_dir_create_times); + drop_effective_capability(DAC_OVERRIDE_CAPABILITY); + + return ret; +} + +static int stat_with_cap_dac_override(struct vfs_handle_struct *handle, + struct smb_filename *smb_fname, int flag) +{ + bool fake_dctime = lp_fake_directory_create_times(SNUM(handle->conn)); + int fd = -1; + NTSTATUS status; + struct smb_filename *dir_name = NULL; + struct smb_filename *rel_name = NULL; + int ret = -1; +#ifdef O_PATH + int open_flags = O_PATH; +#else + int open_flags = O_RDONLY; +#endif + + status = SMB_VFS_PARENT_PATHNAME(handle->conn, + talloc_tos(), + smb_fname, + &dir_name, + &rel_name); + if (!NT_STATUS_IS_OK(status)) { + errno = map_errno_from_nt_status(status); + return -1; + } + + fd = open(dir_name->base_name, open_flags, 0); + if (fd == -1) { + TALLOC_FREE(dir_name); + return -1; + } + + ret = fstatat_with_cap_dac_override(fd, + rel_name->base_name, + &smb_fname->st, + flag, + fake_dctime); + + TALLOC_FREE(dir_name); + close(fd); + + return ret; +} + +int nfs4_acl_stat(struct vfs_handle_struct *handle, + struct smb_filename *smb_fname) +{ + int ret; + + ret = SMB_VFS_NEXT_STAT(handle, smb_fname); + if (ret == -1 && errno == EACCES) { + DEBUG(10, ("Trying stat with capability for %s\n", + smb_fname->base_name)); + ret = stat_with_cap_dac_override(handle, smb_fname, 0); + } + return ret; +} + +static int fstat_with_cap_dac_override(int fd, SMB_STRUCT_STAT *sbuf, + bool fake_dir_create_times) +{ + int ret; + + set_effective_capability(DAC_OVERRIDE_CAPABILITY); + ret = sys_fstat(fd, sbuf, fake_dir_create_times); + drop_effective_capability(DAC_OVERRIDE_CAPABILITY); + + return ret; +} + +int nfs4_acl_fstat(struct vfs_handle_struct *handle, + struct files_struct *fsp, + SMB_STRUCT_STAT *sbuf) +{ + int ret; + + ret = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf); + if (ret == -1 && errno == EACCES) { + bool fake_dctime = + lp_fake_directory_create_times(SNUM(handle->conn)); + + DBG_DEBUG("fstat for %s failed with EACCES. Trying with " + "CAP_DAC_OVERRIDE.\n", fsp->fsp_name->base_name); + ret = fstat_with_cap_dac_override(fsp_get_pathref_fd(fsp), + sbuf, + fake_dctime); + } + + return ret; +} + +int nfs4_acl_lstat(struct vfs_handle_struct *handle, + struct smb_filename *smb_fname) +{ + int ret; + + ret = SMB_VFS_NEXT_LSTAT(handle, smb_fname); + if (ret == -1 && errno == EACCES) { + DEBUG(10, ("Trying lstat with capability for %s\n", + smb_fname->base_name)); + ret = stat_with_cap_dac_override(handle, smb_fname, + AT_SYMLINK_NOFOLLOW); + } + return ret; +} + +int nfs4_acl_fstatat(struct vfs_handle_struct *handle, + const struct files_struct *dirfsp, + const struct smb_filename *smb_fname, + SMB_STRUCT_STAT *sbuf, + int flags) +{ + int ret; + + ret = SMB_VFS_NEXT_FSTATAT(handle, dirfsp, smb_fname, sbuf, flags); + if (ret == -1 && errno == EACCES) { + bool fake_dctime = + lp_fake_directory_create_times(SNUM(handle->conn)); + + DBG_DEBUG("fstatat for %s failed with EACCES. Trying with " + "CAP_DAC_OVERRIDE.\n", dirfsp->fsp_name->base_name); + ret = fstatat_with_cap_dac_override(fsp_get_pathref_fd(dirfsp), + smb_fname->base_name, + sbuf, + flags, + fake_dctime); + } + + return ret; +} + /************************************************ Split the ACE flag mapping between nfs4 and Windows into two separate functions rather than trying to do diff --git a/source3/modules/nfs4_acls.h b/source3/modules/nfs4_acls.h index c9fcf6d250b..011b9da5554 100644 --- a/source3/modules/nfs4_acls.h +++ b/source3/modules/nfs4_acls.h @@ -118,6 +118,22 @@ struct smbacl4_vfs_params { int smbacl4_get_vfs_params(struct connection_struct *conn, struct smbacl4_vfs_params *params); +int nfs4_acl_stat(struct vfs_handle_struct *handle, + struct smb_filename *smb_fname); + +int nfs4_acl_fstat(struct vfs_handle_struct *handle, + struct files_struct *fsp, + SMB_STRUCT_STAT *sbuf); + +int nfs4_acl_lstat(struct vfs_handle_struct *handle, + struct smb_filename *smb_fname); + +int nfs4_acl_fstatat(struct vfs_handle_struct *handle, + const struct files_struct *dirfsp, + const struct smb_filename *smb_fname, + SMB_STRUCT_STAT *sbuf, + int flags); + struct SMB4ACL_T *smb_create_smb4acl(TALLOC_CTX *mem_ctx); /* prop's contents are copied */ diff --git a/source3/modules/vfs_aixacl2.c b/source3/modules/vfs_aixacl2.c index 26d2a566907..8a9ae314cdb 100644 --- a/source3/modules/vfs_aixacl2.c +++ b/source3/modules/vfs_aixacl2.c @@ -460,6 +460,10 @@ int aixjfs2_sys_acl_delete_def_fd(vfs_handle_struct *handle, } static struct vfs_fn_pointers vfs_aixacl2_fns = { + .stat_fn = nfs4_acl_stat, + .fstat_fn = nfs4_acl_fstat, + .lstat_fn = nfs4_acl_lstat, + .fstatat_fn = nfs4_acl_fstatat, .fget_nt_acl_fn = aixjfs2_fget_nt_acl, .fset_nt_acl_fn = aixjfs2_fset_nt_acl, .sys_acl_get_fd_fn = aixjfs2_sys_acl_get_fd, diff --git a/source3/modules/vfs_gpfs.c b/source3/modules/vfs_gpfs.c index 3398879c900..a5339ab41d1 100644 --- a/source3/modules/vfs_gpfs.c +++ b/source3/modules/vfs_gpfs.c @@ -1594,76 +1594,6 @@ static NTSTATUS vfs_gpfs_fset_dos_attributes(struct vfs_handle_struct *handle, return NT_STATUS_OK; } -static int stat_with_capability(struct vfs_handle_struct *handle, - struct smb_filename *smb_fname, int flag) -{ - bool fake_dctime = lp_fake_directory_create_times(SNUM(handle->conn)); - int fd = -1; - NTSTATUS status; - struct smb_filename *dir_name = NULL; - struct smb_filename *rel_name = NULL; - int ret = -1; - - status = SMB_VFS_PARENT_PATHNAME(handle->conn, - talloc_tos(), - smb_fname, - &dir_name, - &rel_name); - if (!NT_STATUS_IS_OK(status)) { - errno = map_errno_from_nt_status(status); - return -1; - } - - fd = open(dir_name->base_name, O_RDONLY, 0); - if (fd == -1) { - TALLOC_FREE(dir_name); - return -1; - } - - set_effective_capability(DAC_OVERRIDE_CAPABILITY); - ret = sys_fstatat(fd, - rel_name->base_name, - &smb_fname->st, - flag, - fake_dctime); - - drop_effective_capability(DAC_OVERRIDE_CAPABILITY); - - TALLOC_FREE(dir_name); - close(fd); - - return ret; -} - -static int vfs_gpfs_stat(struct vfs_handle_struct *handle, - struct smb_filename *smb_fname) -{ - int ret; - - ret = SMB_VFS_NEXT_STAT(handle, smb_fname); - if (ret == -1 && errno == EACCES) { - DEBUG(10, ("Trying stat with capability for %s\n", - smb_fname->base_name)); - ret = stat_with_capability(handle, smb_fname, 0); - } - return ret; -} - -static int vfs_gpfs_lstat(struct vfs_handle_struct *handle, - struct smb_filename *smb_fname) -{ - int ret; - - ret = SMB_VFS_NEXT_LSTAT(handle, smb_fname); - if (ret == -1 && errno == EACCES) { - DEBUG(10, ("Trying lstat with capability for %s\n", - smb_fname->base_name)); - ret = stat_with_capability(handle, smb_fname, - AT_SYMLINK_NOFOLLOW); - } - return ret; -} - static int timespec_to_gpfs_time( struct timespec ts, gpfs_timestruc_t *gt, int idx, int *flags) { @@ -2603,8 +2533,10 @@ static struct vfs_fn_pointers vfs_gpfs_fns = { .sys_acl_delete_def_fd_fn = gpfsacl_sys_acl_delete_def_fd, .fchmod_fn = vfs_gpfs_fchmod, .close_fn = vfs_gpfs_close, - .stat_fn = vfs_gpfs_stat, - .lstat_fn = vfs_gpfs_lstat, + .stat_fn = nfs4_acl_stat, + .fstat_fn = nfs4_acl_fstat, + .lstat_fn = nfs4_acl_lstat, + .fstatat_fn = nfs4_acl_fstatat, .fntimes_fn = vfs_gpfs_fntimes, .aio_force_fn = vfs_gpfs_aio_force, .sendfile_fn = vfs_gpfs_sendfile, diff --git a/source3/modules/vfs_zfsacl.c b/source3/modules/vfs_zfsacl.c index d69d7003110..2bc0d1c8c6e 100644 --- a/source3/modules/vfs_zfsacl.c +++ b/source3/modules/vfs_zfsacl.c @@ -487,6 +487,10 @@ static int zfsacl_connect(struct vfs_handle_struct *handle, static struct vfs_fn_pointers zfsacl_fns = { .connect_fn = zfsacl_connect, + .stat_fn = nfs4_acl_stat, + .fstat_fn = nfs4_acl_fstat, + .lstat_fn = nfs4_acl_lstat, + .fstatat_fn = nfs4_acl_fstatat, .sys_acl_get_fd_fn = zfsacl_fail__sys_acl_get_fd, .sys_acl_blob_get_fd_fn = zfsacl_fail__sys_acl_blob_get_fd, .sys_acl_set_fd_fn = zfsacl_fail__sys_acl_set_fd, -- Samba Shared Repository