/*

   Unix SMB/Netbios implementation.

   VFS module to get and set posix acls

   Copyright (C) Volker Lendecke 2006

   This program is free software; you can redistribute it and/or modify

   it under the terms of the GNU General Public License as published by

   the Free Software Foundation; either version 3 of the License, or

   (at your option) any later version.

   This program is distributed in the hope that it will be useful,

   but WITHOUT ANY WARRANTY; without even the implied warranty of

   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License

   along with this program.  If not, see <http://www.gnu.org/licenses/>.

*/

#include "includes.h"

#include "system/filesys.h"

#include "smbd/smbd.h"

#include "modules/vfs_posixacl.h"

/* prototypes for static functions first - for clarity */

static bool smb_ace_to_internal(acl_entry_t posix_ace,

        struct smb_acl_entry *ace);

static struct smb_acl_t *smb_acl_to_internal(acl_t acl, TALLOC_CTX *mem_ctx);

static int smb_acl_set_mode(acl_entry_t entry, SMB_ACL_PERM_T perm);

static acl_t smb_acl_to_posix(const struct smb_acl_t *acl);

/* public functions - the api */

SMB_ACL_T posixacl_sys_acl_get_fd(vfs_handle_struct *handle,

          files_struct *fsp,

          SMB_ACL_TYPE_T type,

          TALLOC_CTX *mem_ctx)

{

  struct smb_acl_t *result;

  acl_t acl = NULL;

  acl_type_t acl_type;

  switch(type) {

  case SMB_ACL_TYPE_ACCESS:

    acl_type = ACL_TYPE_ACCESS;

    break;

  case SMB_ACL_TYPE_DEFAULT:

    acl_type = ACL_TYPE_DEFAULT;

    break;

  default:

    errno = EINVAL;

    return NULL;

  }

  if (!fsp->fsp_flags.is_pathref && (acl_type == ACL_TYPE_ACCESS)) {

    /* POSIX API only allows ACL_TYPE_ACCESS fetched on fd. */

    acl = acl_get_fd(fsp_get_io_fd(fsp));

  } else if (fsp->fsp_flags.have_proc_fds) {

    int fd = fsp_get_pathref_fd(fsp);

    struct sys_proc_fd_path_buf buf;

    acl = acl_get_file(sys_proc_fd_path(fd, &buf), acl_type);

  } else {

    /*

     * This is no longer a handle based call.

     */

    acl = acl_get_file(fsp->fsp_name->base_name, acl_type);

  }

  if (acl == NULL) {

    return NULL;

  }

  result = smb_acl_to_internal(acl, mem_ctx);

  acl_free(acl);

  return result;

}

int posixacl_sys_acl_set_fd(vfs_handle_struct *handle,

          files_struct *fsp,

          SMB_ACL_TYPE_T type,

          SMB_ACL_T theacl)

{

  int res;

  acl_t acl = smb_acl_to_posix(theacl);

  acl_type_t acl_type;

  int fd = fsp_get_pathref_fd(fsp);

  if (acl == NULL) {

    return -1;

  }

  switch(type) {

  case SMB_ACL_TYPE_ACCESS:

    acl_type = ACL_TYPE_ACCESS;

    break;

  case SMB_ACL_TYPE_DEFAULT:

    acl_type = ACL_TYPE_DEFAULT;

    break;

  default:

    acl_free(acl);

    errno = EINVAL;

    return -1;

  }

  if (!fsp->fsp_flags.is_pathref && type == SMB_ACL_TYPE_ACCESS) {

    res = acl_set_fd(fd, acl);

  } else if (fsp->fsp_flags.have_proc_fds) {

    struct sys_proc_fd_path_buf buf;

    res = acl_set_file(sys_proc_fd_path(fd, &buf), acl_type, acl);

  } else {

    /*

     * This is no longer a handle based call.

     */

    res = acl_set_file(fsp->fsp_name->base_name,

           acl_type,

           acl);

  }

  acl_free(acl);

  return res;

}

int posixacl_sys_acl_delete_def_fd(vfs_handle_struct *handle,

        files_struct *fsp)

{

  if (fsp->fsp_flags.have_proc_fds) {

    int fd = fsp_get_pathref_fd(fsp);

    struct sys_proc_fd_path_buf buf;

    return acl_delete_def_file(sys_proc_fd_path(fd, &buf));

  }

  /*

   * This is no longer a handle based call.

   */

  return acl_delete_def_file(fsp->fsp_name->base_name);

}

/* private functions */

static bool smb_ace_to_internal(acl_entry_t posix_ace,

        struct smb_acl_entry *ace)

{

  acl_tag_t tag;

  acl_permset_t permset;

  if (acl_get_tag_type(posix_ace, &tag) != 0) {

    DEBUG(0, ("smb_acl_get_tag_type failed\n"));

    return False;

  }

  switch(tag) {

  case ACL_USER:

    ace->a_type = SMB_ACL_USER;

    break;

  case ACL_USER_OBJ:

    ace->a_type = SMB_ACL_USER_OBJ;

    break;

  case ACL_GROUP:

    ace->a_type = SMB_ACL_GROUP;

    break;

  case ACL_GROUP_OBJ:

    ace->a_type = SMB_ACL_GROUP_OBJ;

    break;

  case ACL_OTHER:

    ace->a_type = SMB_ACL_OTHER;

    break;

  case ACL_MASK:

    ace->a_type = SMB_ACL_MASK;

    break;

#ifdef HAVE_ACL_EVERYONE

  case ACL_EVERYONE:

    DEBUG(1, ("ACL tag type ACL_EVERYONE. FreeBSD with ZFS? Use 'vfs objects = zfsacl'\n"));

    return false;

#endif

  default:

    DEBUG(0, ("unknown tag type %d\n", (unsigned int)tag));

    return False;

  }

  switch(ace->a_type) {

  case SMB_ACL_USER: {

    uid_t *puid = (uid_t *)acl_get_qualifier(posix_ace);

    if (puid == NULL) {

      DEBUG(0, ("smb_acl_get_qualifier failed\n"));

      return False;

    }

    ace->info.user.uid = *puid;

    acl_free(puid);

    break;

  }

  case SMB_ACL_GROUP: {

    gid_t *pgid = (uid_t *)acl_get_qualifier(posix_ace);

    if (pgid == NULL) {

      DEBUG(0, ("smb_acl_get_qualifier failed\n"));

      return False;

    }

    ace->info.group.gid = *pgid;

    acl_free(pgid);

    break;

  }

  default:

    break;

  }

  if (acl_get_permset(posix_ace, &permset) != 0) {

    DEBUG(0, ("smb_acl_get_mode failed\n"));

    return False;

  }

  ace->a_perm = 0;

#ifdef HAVE_ACL_GET_PERM_NP

  ace->a_perm |= (acl_get_perm_np(permset, ACL_READ) ? SMB_ACL_READ : 0);

  ace->a_perm |= (acl_get_perm_np(permset, ACL_WRITE) ? SMB_ACL_WRITE : 0);

  ace->a_perm |= (acl_get_perm_np(permset, ACL_EXECUTE) ? SMB_ACL_EXECUTE : 0);

#else

  ace->a_perm |= (acl_get_perm(permset, ACL_READ) ? SMB_ACL_READ : 0);

  ace->a_perm |= (acl_get_perm(permset, ACL_WRITE) ? SMB_ACL_WRITE : 0);

  ace->a_perm |= (acl_get_perm(permset, ACL_EXECUTE) ? SMB_ACL_EXECUTE : 0);

#endif

  return True;

}

static struct smb_acl_t *smb_acl_to_internal(acl_t acl, TALLOC_CTX *mem_ctx)

{

  struct smb_acl_t *result = sys_acl_init(mem_ctx);

  int entry_id = ACL_FIRST_ENTRY;

  acl_entry_t e;

  if (result == NULL) {

    return NULL;

  }

  while (acl_get_entry(acl, entry_id, &e) == 1) {

    entry_id = ACL_NEXT_ENTRY;

    result->acl = talloc_realloc(result, result->acl,

               struct smb_acl_entry, result->count+1);

    if (result->acl == NULL) {

      TALLOC_FREE(result);

      DEBUG(0, ("talloc_realloc failed\n"));

      errno = ENOMEM;

      return NULL;

    }

    if (!smb_ace_to_internal(e, &result->acl[result->count])) {

      TALLOC_FREE(result);

      return NULL;

    }

    result->count += 1;

  }

  return result;

}

static int smb_acl_set_mode(acl_entry_t entry, SMB_ACL_PERM_T perm)

{

        int ret;

        acl_permset_t permset;

  if ((ret = acl_get_permset(entry, &permset)) != 0) {

    return ret;

  }

        if ((ret = acl_clear_perms(permset)) != 0) {

                return ret;

  }

        if ((perm & SMB_ACL_READ) &&

      ((ret = acl_add_perm(permset, ACL_READ)) != 0)) {

    return ret;

  }

        if ((perm & SMB_ACL_WRITE) &&

      ((ret = acl_add_perm(permset, ACL_WRITE)) != 0)) {

    return ret;

  }

        if ((perm & SMB_ACL_EXECUTE) &&

      ((ret = acl_add_perm(permset, ACL_EXECUTE)) != 0)) {

    return ret;

  }

  return 0;

}

static acl_t smb_acl_to_posix(const struct smb_acl_t *acl)

{

  acl_t result;

  int i;

  result = acl_init(acl->count);

  if (result == NULL) {

    DEBUG(10, ("acl_init failed\n"));

    return NULL;

  }

  for (i=0; i<acl->count; i++) {

    const struct smb_acl_entry *entry = &acl->acl[i];

    acl_entry_t e;

    acl_tag_t tag;

    if (acl_create_entry(&result, &e) != 0) {

      DEBUG(1, ("acl_create_entry failed: %s\n",

          strerror(errno)));

      goto fail;

    }

    switch (entry->a_type) {

    case SMB_ACL_USER:

      tag = ACL_USER;

      break;

    case SMB_ACL_USER_OBJ:

      tag = ACL_USER_OBJ;

      break;

    case SMB_ACL_GROUP:

      tag = ACL_GROUP;

      break;

    case SMB_ACL_GROUP_OBJ:

      tag = ACL_GROUP_OBJ;

      break;

    case SMB_ACL_OTHER:

      tag = ACL_OTHER;

      break;

    case SMB_ACL_MASK:

      tag = ACL_MASK;

      break;

    default:

      DEBUG(1, ("Unknown tag value %d\n", entry->a_type));

      goto fail;

    }

    if (acl_set_tag_type(e, tag) != 0) {

      DEBUG(10, ("acl_set_tag_type(%d) failed: %s\n",

           tag, strerror(errno)));

      goto fail;

    }

    switch (entry->a_type) {

    case SMB_ACL_USER:

      if (acl_set_qualifier(e, &entry->info.user.uid) != 0) {

        DEBUG(1, ("acl_set_qualifier failed: %s\n",

            strerror(errno)));

        goto fail;

      }

      break;

    case SMB_ACL_GROUP:

      if (acl_set_qualifier(e, &entry->info.group.gid) != 0) {

        DEBUG(1, ("acl_set_qualifier failed: %s\n",

            strerror(errno)));

        goto fail;

      }

      break;

    default:  /* Shut up, compiler! :-) */

      break;

    }

    if (smb_acl_set_mode(e, entry->a_perm) != 0) {

      goto fail;

    }

  }

  if (acl_valid(result) != 0) {

    char *acl_string = sys_acl_to_text(talloc_tos(), acl);

    DBG_WARNING("ACL %s is invalid for set (%s)\n",

          acl_string,

          strerror(errno));

    TALLOC_FREE(acl_string);

    goto fail;

  }

  return result;

 fail:

  if (result != NULL) {

    acl_free(result);

  }

  return NULL;

}

/* VFS operations structure */

static struct vfs_fn_pointers posixacl_fns = {

  .sys_acl_get_fd_fn = posixacl_sys_acl_get_fd,

  .sys_acl_blob_get_fd_fn = posix_sys_acl_blob_get_fd,

  .sys_acl_set_fd_fn = posixacl_sys_acl_set_fd,

  .sys_acl_delete_def_fd_fn = posixacl_sys_acl_delete_def_fd,

};

static_decl_vfs;

NTSTATUS vfs_posixacl_init(TALLOC_CTX *ctx)

{

  return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "posixacl",

        &posixacl_fns);

}