/* * * Copyright (c) 2007-2008 Jean-Pierre Andre * */ /* * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program (in the main directory of the NTFS-3G * distribution in the file COPYING); if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ #ifndef ACLS_H #define ACLS_H #include "endians.h" /* * JPA configuration modes for security.c / acls.c * should be moved to some config file */ #define BUFSZ 1024 /* buffer size to read mapping file */ #define MAPPINGFILE ".NTFS-3G/UserMapping" /* default mapping file */ #define LINESZ 120 /* maximum useful size of a mapping line */ #define CACHE_PERMISSIONS_BITS 6 /* log2 of unitary allocation of permissions */ #define CACHE_PERMISSIONS_SIZE 262144 /* max cacheable permissions */ /* * Matching of ntfs permissions to Linux permissions * these constants are adapted to endianness * when setting, set them all * when checking, check one is present */ /* flags which are set to mean exec, write or read */ #define FILE_READ (FILE_READ_DATA) #define FILE_WRITE (FILE_WRITE_DATA | FILE_APPEND_DATA \ | READ_CONTROL | FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA) #define FILE_EXEC (FILE_EXECUTE) #define DIR_READ FILE_LIST_DIRECTORY #define DIR_WRITE (FILE_ADD_FILE | FILE_ADD_SUBDIRECTORY | FILE_DELETE_CHILD \ | READ_CONTROL | FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA) #define DIR_EXEC (FILE_TRAVERSE) /* flags tested for meaning exec, write or read */ /* tests for write allow for interpretation of a sticky bit */ #define FILE_GREAD (FILE_READ_DATA | GENERIC_READ) #define FILE_GWRITE (FILE_WRITE_DATA | FILE_APPEND_DATA | GENERIC_WRITE) #define FILE_GEXEC (FILE_EXECUTE | GENERIC_EXECUTE) #define DIR_GREAD (FILE_LIST_DIRECTORY | GENERIC_READ) #define DIR_GWRITE (FILE_ADD_FILE | FILE_ADD_SUBDIRECTORY | GENERIC_WRITE) #define DIR_GEXEC (FILE_TRAVERSE | GENERIC_EXECUTE) /* standard owner (and administrator) rights */ #define OWNER_RIGHTS (DELETE | READ_CONTROL | WRITE_DAC | WRITE_OWNER \ | SYNCHRONIZE \ | FILE_READ_ATTRIBUTES | FILE_WRITE_ATTRIBUTES \ | FILE_READ_EA | FILE_WRITE_EA) /* standard world rights */ #define WORLD_RIGHTS (READ_CONTROL | FILE_READ_ATTRIBUTES | FILE_READ_EA \ | SYNCHRONIZE) /* inheritance flags for files and directories */ #define FILE_INHERITANCE NO_PROPAGATE_INHERIT_ACE #define DIR_INHERITANCE (OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE) /* * To identify NTFS ACL meaning Posix ACL granted to root * we use rights always granted to anybody, so they have no impact * either on Windows or on Linux. */ #define ROOT_OWNER_UNMARK SYNCHRONIZE /* ACL granted to root as owner */ #define ROOT_GROUP_UNMARK FILE_READ_EA /* ACL granted to root as group */ /* * Maximum SID size and a type large enough to hold it */ #define MAX_SID_SIZE (8 + SID_MAX_SUB_AUTHORITIES*4) typedef char BIGSID[MAX_SID_SIZE]; /* * Struct to hold the input mapping file * (private to this module) */ struct MAPLIST { struct MAPLIST *next; char *uidstr; /* uid text from the same record */ char *gidstr; /* gid text from the same record */ char *sidstr; /* sid text from the same record */ char maptext[LINESZ + 1]; }; typedef int (*FILEREADER)(void *fileid, char *buf, size_t size, off_t pos); /* * Constants defined in acls.c */ extern const SID *adminsid; extern const SID *worldsid; /* * Functions defined in acls.c */ BOOL ntfs_valid_descr(const char *securattr, unsigned int attrsz); BOOL ntfs_valid_pattern(const SID *sid); BOOL ntfs_valid_sid(const SID *sid); BOOL ntfs_same_sid(const SID *first, const SID *second); BOOL ntfs_is_user_sid(const SID *usid); int ntfs_sid_size(const SID * sid); unsigned int ntfs_attr_size(const char *attr); const SID *ntfs_find_usid(const struct MAPPING *usermapping, uid_t uid, SID *pdefsid); const SID *ntfs_find_gsid(const struct MAPPING *groupmapping, gid_t gid, SID *pdefsid); uid_t ntfs_find_user(const struct MAPPING *usermapping, const SID *usid); gid_t ntfs_find_group(const struct MAPPING *groupmapping, const SID * gsid); const SID *ntfs_acl_owner(const char *secattr); #if POSIXACLS BOOL ntfs_valid_posix(const struct POSIX_SECURITY *pxdesc); void ntfs_sort_posix(struct POSIX_SECURITY *pxdesc); int ntfs_merge_mode_posix(struct POSIX_SECURITY *pxdesc, mode_t mode); struct POSIX_SECURITY *ntfs_build_inherited_posix( const struct POSIX_SECURITY *pxdesc, mode_t mode, mode_t umask, BOOL isdir); struct POSIX_SECURITY *ntfs_build_basic_posix( const struct POSIX_SECURITY *pxdesc, mode_t mode, mode_t umask, BOOL isdir); struct POSIX_SECURITY *ntfs_replace_acl(const struct POSIX_SECURITY *oldpxdesc, const struct POSIX_ACL *newacl, int count, BOOL deflt); struct POSIX_SECURITY *ntfs_build_permissions_posix( struct MAPPING* const mapping[], const char *securattr, const SID *usid, const SID *gsid, BOOL isdir); struct POSIX_SECURITY *ntfs_merge_descr_posix(const struct POSIX_SECURITY *first, const struct POSIX_SECURITY *second); char *ntfs_build_descr_posix(struct MAPPING* const mapping[], struct POSIX_SECURITY *pxdesc, int isdir, const SID *usid, const SID *gsid); #endif /* POSIXACLS */ int ntfs_inherit_acl(const ACL *oldacl, ACL *newacl, const SID *usid, const SID *gsid, BOOL fordir, le16 inherited); int ntfs_build_permissions(const char *securattr, const SID *usid, const SID *gsid, BOOL isdir); char *ntfs_build_descr(mode_t mode, int isdir, const SID * usid, const SID * gsid); struct MAPLIST *ntfs_read_mapping(FILEREADER reader, void *fileid); struct MAPPING *ntfs_do_user_mapping(struct MAPLIST *firstitem); struct MAPPING *ntfs_do_group_mapping(struct MAPLIST *firstitem); void ntfs_free_mapping(struct MAPPING *mapping[]); #endif /* ACLS_H */