Attachment 16300 Details for Bug 14470 – Patch for 4.12 backported from master

[patch] Patch for 4.12 backported from master

bug14470-v412.patch (text/plain), 12.96 KB, created by Ralph Böhme on 2020-10-22 08:03:31 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ralph Böhme

Created: 2020-10-22 08:03:31 UTC

Size: 12.96 KB

patch

obsolete

>From 84aeeb41653ba3c88543597640f70c7749f1a5fe Mon Sep 17 00:00:00 2001
>From: Ralph Boehme <slow@samba.org>
>Date: Thu, 20 Aug 2020 16:18:35 +0200
>Subject: [PATCH 1/2] vfs_zfsacl: use handle based facl() call to query ZFS
> filesytem ACL
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14470
>
>Pair-Programmed-With: Andrew Walker <awalker@ixsystems.com>
>Signed-off-by: Ralph Boehme <slow@samba.org>
>Signed-off-by: Andrew Walker <awalker@ixsystems.com>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>(backported from commit f763b1e43640082af80c855a4a519f7747a6c87c)
>[slow@samba.org: conflict in zfs_get_nt_acl_common() due to *AT changes in 4.13]
>---
> source3/modules/vfs_zfsacl.c | 156 +++++++++++++++++++++++++++--------
> 1 file changed, 123 insertions(+), 33 deletions(-)
>
>diff --git a/source3/modules/vfs_zfsacl.c b/source3/modules/vfs_zfsacl.c
>index 524881ab4af..d3da7257838 100644
>--- a/source3/modules/vfs_zfsacl.c
>+++ b/source3/modules/vfs_zfsacl.c
>@@ -49,11 +49,12 @@ struct zfsacl_config_data {
> static NTSTATUS zfs_get_nt_acl_common(struct connection_struct *conn,
> 				      TALLOC_CTX *mem_ctx,
> 				      const struct smb_filename *smb_fname,
>+				      const ace_t *acebuf,
>+				      int naces,
> 				      struct SMB4ACL_T **ppacl,
> 				      struct zfsacl_config_data *config)
> {
>-	int naces, i;
>-	ace_t *acebuf;
>+	int i;
> 	struct SMB4ACL_T *pacl;
> 	SMB_STRUCT_STAT sbuf;
> 	const SMB_STRUCT_STAT *psbuf = NULL;
>@@ -76,30 +77,8 @@ static NTSTATUS zfs_get_nt_acl_common(struct connection_struct *conn,
> 	}
> 	is_dir = S_ISDIR(psbuf->st_ex_mode);
> 
>-	/* read the number of file aces */
>-	if((naces = acl(smb_fname->base_name, ACE_GETACLCNT, 0, NULL)) == -1) {
>-		if(errno == ENOSYS) {
>-			DEBUG(9, ("acl(ACE_GETACLCNT, %s): Operation is not "
>-				  "supported on the filesystem where the file "
>-				  "reside\n", smb_fname->base_name));
>-		} else {
>-			DEBUG(9, ("acl(ACE_GETACLCNT, %s): %s ", smb_fname->base_name,
>-					strerror(errno)));
>-		}
>-		return map_nt_error_from_unix(errno);
>-	}
>-	/* allocate the field of ZFS aces */
> 	mem_ctx = talloc_tos();
>-	acebuf = (ace_t *) talloc_size(mem_ctx, sizeof(ace_t)*naces);
>-	if(acebuf == NULL) {
>-		return NT_STATUS_NO_MEMORY;
>-	}
>-	/* read the aces into the field */
>-	if(acl(smb_fname->base_name, ACE_GETACL, naces, acebuf) < 0) {
>-		DEBUG(9, ("acl(ACE_GETACL, %s): %s ", smb_fname->base_name,
>-				strerror(errno)));
>-		return map_nt_error_from_unix(errno);
>-	}
>+
> 	/* create SMB4ACL data */
> 	if((pacl = smb_create_smb4acl(mem_ctx)) == NULL) {
> 		return NT_STATUS_NO_MEMORY;
>@@ -163,7 +142,7 @@ static NTSTATUS zfs_get_nt_acl_common(struct connection_struct *conn,
> static bool zfs_process_smbacl(vfs_handle_struct *handle, files_struct *fsp,
> 			       struct SMB4ACL_T *smbacl)
> {
>-	int naces = smb_get_naces(smbacl), i;
>+	int naces = smb_get_naces(smbacl), i, rv;
> 	ace_t *acebuf;
> 	struct SMB4ACE_T *smbace;
> 	TALLOC_CTX	*mem_ctx;
>@@ -222,7 +201,13 @@ static bool zfs_process_smbacl(vfs_handle_struct *handle, files_struct *fsp,
> 	SMB_ASSERT(i == naces);
> 
> 	/* store acl */
>-	if(acl(fsp->fsp_name->base_name, ACE_SETACL, naces, acebuf)) {
>+	if (fsp->fh->fd != -1) {
>+		rv = facl(fsp->fh->fd, ACE_SETACL, naces, acebuf);
>+	}
>+	else {
>+		rv = acl(fsp->fsp_name->base_name, ACE_SETACL, naces, acebuf);
>+	}
>+	if (rv != 0) {
> 		if(errno == ENOSYS) {
> 			DEBUG(9, ("acl(ACE_SETACL, %s): Operation is not "
> 				  "supported on the filesystem where the file "
>@@ -231,7 +216,7 @@ static bool zfs_process_smbacl(vfs_handle_struct *handle, files_struct *fsp,
> 			DEBUG(9, ("acl(ACE_SETACL, %s): %s ", fsp_str_dbg(fsp),
> 				  strerror(errno)));
> 		}
>-		return 0;
>+		return false;
> 	}
> 
> 	return True;
>@@ -259,6 +244,81 @@ static NTSTATUS zfs_set_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
> 				zfs_process_smbacl);
> }
> 
>+static int get_zfsacl(TALLOC_CTX *mem_ctx,
>+		      const struct smb_filename *smb_fname,
>+		      ace_t **outbuf)
>+{
>+	int naces, rv;
>+	ace_t *acebuf = NULL;
>+
>+	naces = acl(smb_fname->base_name, ACE_GETACLCNT, 0, NULL);
>+	if (naces == -1) {
>+		int dbg_level = 10;
>+
>+		if (errno == ENOSYS) {
>+			dbg_level = 1;
>+		}
>+		DEBUG(dbg_level, ("acl(ACE_GETACLCNT, %s): %s ",
>+				  smb_fname->base_name, strerror(errno)));
>+		return naces;
>+	}
>+	acebuf = talloc_size(mem_ctx, sizeof(ace_t)*naces);
>+	if (acebuf == NULL) {
>+		errno = ENOMEM;
>+		return -1;
>+	}
>+
>+	rv = acl(smb_fname->base_name, ACE_GETACL, naces, acebuf);
>+	if (rv == -1) {
>+		DBG_DEBUG("acl(ACE_GETACL, %s) failed: %s ",
>+			  smb_fname->base_name, strerror(errno));
>+		return -1;
>+	}
>+
>+	*outbuf = acebuf;
>+	return naces;
>+}
>+
>+static int fget_zfsacl(TALLOC_CTX *mem_ctx,
>+		       struct files_struct *fsp,
>+		       ace_t **outbuf)
>+{
>+	int naces, rv;
>+	ace_t *acebuf = NULL;
>+
>+	if (fsp->fh->fd == -1) {
>+		return get_zfsacl(mem_ctx, fsp->fsp_name, outbuf);
>+	}
>+
>+	naces = facl(fsp->fh->fd, ACE_GETACLCNT, 0, NULL);
>+	if (naces == -1) {
>+		int dbg_level = 10;
>+
>+		if (errno == ENOSYS) {
>+			dbg_level = 1;
>+		}
>+		DEBUG(dbg_level, ("facl(ACE_GETACLCNT, %s): %s ",
>+				  fsp_str_dbg(fsp), strerror(errno)));
>+		return naces;
>+	}
>+
>+	acebuf = talloc_size(mem_ctx, sizeof(ace_t)*naces);
>+	if (acebuf == NULL) {
>+		errno = ENOMEM;
>+		return -1;
>+	}
>+
>+	rv = facl(fsp->fh->fd, ACE_GETACL, naces, acebuf);
>+	if (rv == -1) {
>+		DBG_DEBUG("acl(ACE_GETACL, %s): %s ",
>+			  fsp_str_dbg(fsp), strerror(errno));
>+		return -1;
>+	}
>+
>+	*outbuf = acebuf;
>+	return naces;
>+}
>+
> static NTSTATUS zfsacl_fget_nt_acl(struct vfs_handle_struct *handle,
> 				   struct files_struct *fsp,
> 				   uint32_t security_info,
>@@ -268,6 +328,8 @@ static NTSTATUS zfsacl_fget_nt_acl(struct vfs_handle_struct *handle,
> 	struct SMB4ACL_T *pacl;
> 	NTSTATUS status;
> 	struct zfsacl_config_data *config = NULL;
>+	ace_t *acebuf = NULL;
>+	int naces;
> 
> 	SMB_VFS_HANDLE_GET_DATA(handle, config,
> 				struct zfsacl_config_data,
>@@ -275,9 +337,9 @@ static NTSTATUS zfsacl_fget_nt_acl(struct vfs_handle_struct *handle,
> 
> 	TALLOC_CTX *frame = talloc_stackframe();
> 
>-	status = zfs_get_nt_acl_common(handle->conn, frame,
>-				       fsp->fsp_name, &pacl, config);
>-	if (!NT_STATUS_IS_OK(status)) {
>+	naces = fget_zfsacl(talloc_tos(), fsp, &acebuf);
>+	if (naces == -1) {
>+		status = map_nt_error_from_unix(errno);
> 		TALLOC_FREE(frame);
> 		if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
> 			return status;
>@@ -295,6 +357,18 @@ static NTSTATUS zfsacl_fget_nt_acl(struct vfs_handle_struct *handle,
> 		return NT_STATUS_OK;
> 	}
> 
>+	status = zfs_get_nt_acl_common(handle->conn,
>+				       frame,
>+				       fsp->fsp_name,
>+				       acebuf,
>+				       naces,
>+				       &pacl,
>+				       config);
>+	if (!NT_STATUS_IS_OK(status)) {
>+		TALLOC_FREE(frame);
>+		return status;
>+	}
>+
> 	status = smb_fget_nt_acl_nfs4(fsp, NULL, security_info, mem_ctx,
> 				      ppdesc, pacl);
> 	TALLOC_FREE(frame);
>@@ -310,14 +384,18 @@ static NTSTATUS zfsacl_get_nt_acl(struct vfs_handle_struct *handle,
> 	struct SMB4ACL_T *pacl;
> 	NTSTATUS status;
> 	struct zfsacl_config_data *config = NULL;
>+	int naces;
>+	ace_t *acebuf = NULL;
>+
> 	SMB_VFS_HANDLE_GET_DATA(handle, config,
> 				struct zfsacl_config_data,
> 				return NT_STATUS_INTERNAL_ERROR);
> 
> 	TALLOC_CTX *frame = talloc_stackframe();
> 
>-	status = zfs_get_nt_acl_common(handle->conn, frame, smb_fname, &pacl, config);
>-	if (!NT_STATUS_IS_OK(status)) {
>+	naces = get_zfsacl(frame, smb_fname, &acebuf);
>+	if (naces == -1) {
>+		status = map_nt_error_from_unix(errno);
> 		TALLOC_FREE(frame);
> 		if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
> 			return status;
>@@ -341,6 +419,18 @@ static NTSTATUS zfsacl_get_nt_acl(struct vfs_handle_struct *handle,
> 		return NT_STATUS_OK;
> 	}
> 
>+	status = zfs_get_nt_acl_common(handle->conn,
>+				       frame,
>+				       smb_fname,
>+				       acebuf,
>+				       naces,
>+				       &pacl,
>+				       config);
>+	if (!NT_STATUS_IS_OK(status)) {
>+		TALLOC_FREE(frame);
>+		return status;
>+	}
>+
> 	status = smb_get_nt_acl_nfs4(handle->conn,
> 					smb_fname,
> 					NULL,
>-- 
>2.26.2
>
>
>From eeeb9a3342adbea3c7db349e1517b460f159392d Mon Sep 17 00:00:00 2001
>From: Andrew Walker <awalker@ixsystems.com>
>Date: Thu, 24 Sep 2020 11:42:16 -0400
>Subject: [PATCH 2/2] vfs_zfsacl: Add new parameter to stop automatic addition
> of special entries
>
>Prevent ZFS from automatically adding NFSv4 special entries (owner@, group@,
>everyone@). ZFS will automatically add these these entries when calculating the
>inherited ACL of new files if the ACL of the parent directory lacks an
>inheriting special entry. This may result in user confusion and unexpected
>change in permissions of files and directories as the inherited ACL is
>generated. Blocking this behavior is achieved by setting an inheriting
>everyone@ that grants no permissions and not adding the entry to the file's
>Security Descriptor.
>
>This change also updates behavior so that the fd-based syscall facl() is
>used where possible.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14470
>RN: vfs_zfsacl: Add new parameter to stop automatic addition of special entries
>
>Signed-off-by: Andrew Walker <awalker@ixsystems.com>
>Reviewed-by: Ralph Boehme <slow@samba.org>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>(cherry picked from commit c10ae30c1185463eb937f69c1fc9914558087167)
>---
> docs-xml/manpages/vfs_zfsacl.8.xml | 20 ++++++++++++++++++++
> source3/modules/vfs_zfsacl.c       | 24 ++++++++++++++++++++++++
> 2 files changed, 44 insertions(+)
>
>diff --git a/docs-xml/manpages/vfs_zfsacl.8.xml b/docs-xml/manpages/vfs_zfsacl.8.xml
>index ae583409fe1..1ac954b9429 100644
>--- a/docs-xml/manpages/vfs_zfsacl.8.xml
>+++ b/docs-xml/manpages/vfs_zfsacl.8.xml
>@@ -140,6 +140,26 @@
> 		</listitem>
> 		</varlistentry>
> 
>+		<varlistentry>
>+		<term>zfsacl:block_special = [yes|no]</term>
>+		<listitem>
>+		<para>Prevent ZFS from automatically adding NFSv4 special
>+		entries (owner@, group@, everyone@).  ZFS will automatically
>+		generate these these entries when calculating the inherited ACL
>+		of new files if the ACL of the parent directory lacks an
>+		inheriting special entry. This may result in user confusion and
>+		unexpected change in permissions of files and directories as the
>+		inherited ACL is generated. Blocking this behavior is achieved
>+		by setting an inheriting everyone@ that grants no permissions
>+		and not adding the entry to the file's Security
>+		Descriptor</para>
>+		<itemizedlist>
>+		<listitem><para><command>yes (default)</command></para></listitem>
>+		<listitem><para><command>no</command></para></listitem>
>+		</itemizedlist>
>+		</listitem>
>+		</varlistentry>
>+
> 		<varlistentry>
> 		<term>zfsacl:map_dacl_protected = [yes|no]</term>
> 		<listitem>
>diff --git a/source3/modules/vfs_zfsacl.c b/source3/modules/vfs_zfsacl.c
>index d3da7257838..f5deeb11cc6 100644
>--- a/source3/modules/vfs_zfsacl.c
>+++ b/source3/modules/vfs_zfsacl.c
>@@ -40,6 +40,7 @@ struct zfsacl_config_data {
> 	struct smbacl4_vfs_params nfs4_params;
> 	bool zfsacl_map_dacl_protected;
> 	bool zfsacl_denymissingspecial;
>+	bool zfsacl_block_special;
> };
> 
> /* zfs_get_nt_acl()
>@@ -57,6 +58,7 @@ static NTSTATUS zfs_get_nt_acl_common(struct connection_struct *conn,
> 	int i;
> 	struct SMB4ACL_T *pacl;
> 	SMB_STRUCT_STAT sbuf;
>+	SMB_ACE4PROP_T blocking_ace;
> 	const SMB_STRUCT_STAT *psbuf = NULL;
> 	int ret;
> 	bool inherited_is_present = false;
>@@ -91,6 +93,13 @@ static NTSTATUS zfs_get_nt_acl_common(struct connection_struct *conn,
> 		aceprop.aceMask  = (uint32_t) acebuf[i].a_access_mask;
> 		aceprop.who.id   = (uint32_t) acebuf[i].a_who;
> 
>+		if (config->zfsacl_block_special &&
>+		    (aceprop.aceMask == 0) &&
>+		    (aceprop.aceFlags & ACE_EVERYONE) &&
>+		    (aceprop.aceFlags & ACE_INHERITED_ACE))
>+		{
>+			continue;
>+		}
> 		/*
> 		 * Windows clients expect SYNC on acls to correctly allow
> 		 * rename, cf bug #7909. But not on DENY ace entries, cf bug
>@@ -147,12 +156,17 @@ static bool zfs_process_smbacl(vfs_handle_struct *handle, files_struct *fsp,
> 	struct SMB4ACE_T *smbace;
> 	TALLOC_CTX	*mem_ctx;
> 	bool have_special_id = false;
>+	bool must_add_empty_ace = false;
> 	struct zfsacl_config_data *config = NULL;
> 
> 	SMB_VFS_HANDLE_GET_DATA(handle, config,
> 				struct zfsacl_config_data,
> 				return False);
> 
>+	if (config->zfsacl_block_special && S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
>+		naces++;
>+		must_add_empty_ace = true;
>+	}
> 	/* allocate the field of ZFS aces */
> 	mem_ctx = talloc_tos();
> 	acebuf = (ace_t *) talloc_size(mem_ctx, sizeof(ace_t)*naces);
>@@ -192,6 +206,13 @@ static bool zfs_process_smbacl(vfs_handle_struct *handle, files_struct *fsp,
> 			have_special_id = true;
> 		}
> 	}
>+	if (must_add_empty_ace) {
>+		acebuf[i].a_type = SMB_ACE4_ACCESS_ALLOWED_ACE_TYPE;
>+		acebuf[i].a_flags = SMB_ACE4_DIRECTORY_INHERIT_ACE| \
>+				    SMB_ACE4_FILE_INHERIT_ACE|ACE_EVERYONE;
>+		acebuf[i].a_access_mask = 0;
>+		i++;
>+	}
> 
> 	if (!have_special_id && config->zfsacl_denymissingspecial) {
> 		errno = EACCES;
>@@ -555,6 +576,9 @@ static int zfsacl_connect(struct vfs_handle_struct *handle,
> 	config->zfsacl_denymissingspecial = lp_parm_bool(SNUM(handle->conn),
> 				"zfsacl", "denymissingspecial", false);
> 
>+	config->zfsacl_block_special = lp_parm_bool(SNUM(handle->conn),
>+				"zfsacl", "block_special", true);
>+
> 	ret = smbacl4_get_vfs_params(handle->conn, &config->nfs4_params);
> 	if (ret < 0) {
> 		TALLOC_FREE(config);
>-- 
>2.26.2
>

Flags:

jra: review+

Actions: View

Attachments on bug 14470: 16300 | 16301