1515d7c92SRobert Watson /*- 22de14c39SRobert Watson * Copyright (c) 1999, 2000, 2001 Robert N. M. Watson 3515d7c92SRobert Watson * All rights reserved. 4515d7c92SRobert Watson * 5515d7c92SRobert Watson * Redistribution and use in source and binary forms, with or without 6515d7c92SRobert Watson * modification, are permitted provided that the following conditions 7515d7c92SRobert Watson * are met: 8515d7c92SRobert Watson * 1. Redistributions of source code must retain the above copyright 9515d7c92SRobert Watson * notice, this list of conditions and the following disclaimer. 10515d7c92SRobert Watson * 2. Redistributions in binary form must reproduce the above copyright 11515d7c92SRobert Watson * notice, this list of conditions and the following disclaimer in the 12515d7c92SRobert Watson * documentation and/or other materials provided with the distribution. 13515d7c92SRobert Watson * 14515d7c92SRobert Watson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15515d7c92SRobert Watson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16515d7c92SRobert Watson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17515d7c92SRobert Watson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18515d7c92SRobert Watson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19515d7c92SRobert Watson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20515d7c92SRobert Watson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21515d7c92SRobert Watson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22515d7c92SRobert Watson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23515d7c92SRobert Watson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24515d7c92SRobert Watson * SUCH DAMAGE. 25515d7c92SRobert Watson */ 26515d7c92SRobert Watson /* 27374c6c0fSRobert Watson * acl_from_text: Convert a text-form ACL from a string to an acl_t. 28515d7c92SRobert Watson */ 29515d7c92SRobert Watson 30333fc21eSDavid E. O'Brien #include <sys/cdefs.h> 31333fc21eSDavid E. O'Brien __FBSDID("$FreeBSD$"); 32333fc21eSDavid E. O'Brien 33515d7c92SRobert Watson #include <sys/types.h> 347bd44e92SThomas Moestl #include "namespace.h" 35515d7c92SRobert Watson #include <sys/acl.h> 367bd44e92SThomas Moestl #include "un-namespace.h" 37515d7c92SRobert Watson #include <sys/errno.h> 3848135111STim Kientzle #include <grp.h> 3948135111STim Kientzle #include <pwd.h> 40515d7c92SRobert Watson #include <stdio.h> 41515d7c92SRobert Watson #include <stdlib.h> 42515d7c92SRobert Watson #include <string.h> 43aa015c8eSEdward Tomasz Napierala #include <assert.h> 44515d7c92SRobert Watson 45515d7c92SRobert Watson #include "acl_support.h" 46515d7c92SRobert Watson 47c61eb011SChris D. Faulhaber static acl_tag_t acl_string_to_tag(char *tag, char *qualifier); 48c61eb011SChris D. Faulhaber 49aa015c8eSEdward Tomasz Napierala int _nfs4_acl_entry_from_text(acl_t aclp, char *entry); 50aa015c8eSEdward Tomasz Napierala int _text_could_be_nfs4_acl(const char *entry); 51515d7c92SRobert Watson 52c61eb011SChris D. Faulhaber static acl_tag_t 53515d7c92SRobert Watson acl_string_to_tag(char *tag, char *qualifier) 54515d7c92SRobert Watson { 55515d7c92SRobert Watson 56515d7c92SRobert Watson if (*qualifier == '\0') { 57515d7c92SRobert Watson if ((!strcmp(tag, "user")) || (!strcmp(tag, "u"))) { 58515d7c92SRobert Watson return (ACL_USER_OBJ); 59515d7c92SRobert Watson } else 60515d7c92SRobert Watson if ((!strcmp(tag, "group")) || (!strcmp(tag, "g"))) { 61515d7c92SRobert Watson return (ACL_GROUP_OBJ); 62515d7c92SRobert Watson } else 63515d7c92SRobert Watson if ((!strcmp(tag, "mask")) || (!strcmp(tag, "m"))) { 64515d7c92SRobert Watson return (ACL_MASK); 65515d7c92SRobert Watson } else 66515d7c92SRobert Watson if ((!strcmp(tag, "other")) || (!strcmp(tag, "o"))) { 67515d7c92SRobert Watson return (ACL_OTHER); 68515d7c92SRobert Watson } else 69515d7c92SRobert Watson return(-1); 70515d7c92SRobert Watson } else { 71515d7c92SRobert Watson if ((!strcmp(tag, "user")) || (!strcmp(tag, "u"))) { 72515d7c92SRobert Watson return(ACL_USER); 73515d7c92SRobert Watson } else 74515d7c92SRobert Watson if ((!strcmp(tag, "group")) || (!strcmp(tag, "g"))) { 75515d7c92SRobert Watson return(ACL_GROUP); 76515d7c92SRobert Watson } else 77515d7c92SRobert Watson return(-1); 78515d7c92SRobert Watson } 79515d7c92SRobert Watson } 80515d7c92SRobert Watson 81aa015c8eSEdward Tomasz Napierala static int 82aa015c8eSEdward Tomasz Napierala _posix1e_acl_entry_from_text(acl_t aclp, char *entry) 83aa015c8eSEdward Tomasz Napierala { 84aa015c8eSEdward Tomasz Napierala acl_tag_t t; 85aa015c8eSEdward Tomasz Napierala acl_perm_t p; 86aa015c8eSEdward Tomasz Napierala char *tag, *qualifier, *permission; 87aa015c8eSEdward Tomasz Napierala uid_t id; 88aa015c8eSEdward Tomasz Napierala int error; 89aa015c8eSEdward Tomasz Napierala 90aa015c8eSEdward Tomasz Napierala assert(_acl_brand(aclp) == ACL_BRAND_POSIX); 91aa015c8eSEdward Tomasz Napierala 92aa015c8eSEdward Tomasz Napierala /* Split into three ':' delimited fields. */ 93aa015c8eSEdward Tomasz Napierala tag = strsep(&entry, ":"); 94aa015c8eSEdward Tomasz Napierala if (tag == NULL) { 95aa015c8eSEdward Tomasz Napierala errno = EINVAL; 96aa015c8eSEdward Tomasz Napierala return (-1); 97aa015c8eSEdward Tomasz Napierala } 98aa015c8eSEdward Tomasz Napierala tag = string_skip_whitespace(tag); 99aa015c8eSEdward Tomasz Napierala if ((*tag == '\0') && (!entry)) { 100aa015c8eSEdward Tomasz Napierala /* 101aa015c8eSEdward Tomasz Napierala * Is an entirely comment line, skip to next 102aa015c8eSEdward Tomasz Napierala * comma. 103aa015c8eSEdward Tomasz Napierala */ 104aa015c8eSEdward Tomasz Napierala return (0); 105aa015c8eSEdward Tomasz Napierala } 106aa015c8eSEdward Tomasz Napierala string_trim_trailing_whitespace(tag); 107aa015c8eSEdward Tomasz Napierala 108aa015c8eSEdward Tomasz Napierala qualifier = strsep(&entry, ":"); 109aa015c8eSEdward Tomasz Napierala if (qualifier == NULL) { 110aa015c8eSEdward Tomasz Napierala errno = EINVAL; 111aa015c8eSEdward Tomasz Napierala return (-1); 112aa015c8eSEdward Tomasz Napierala } 113aa015c8eSEdward Tomasz Napierala qualifier = string_skip_whitespace(qualifier); 114aa015c8eSEdward Tomasz Napierala string_trim_trailing_whitespace(qualifier); 115aa015c8eSEdward Tomasz Napierala 116aa015c8eSEdward Tomasz Napierala permission = strsep(&entry, ":"); 117aa015c8eSEdward Tomasz Napierala if (permission == NULL || entry) { 118aa015c8eSEdward Tomasz Napierala errno = EINVAL; 119aa015c8eSEdward Tomasz Napierala return (-1); 120aa015c8eSEdward Tomasz Napierala } 121aa015c8eSEdward Tomasz Napierala permission = string_skip_whitespace(permission); 122aa015c8eSEdward Tomasz Napierala string_trim_trailing_whitespace(permission); 123aa015c8eSEdward Tomasz Napierala 124aa015c8eSEdward Tomasz Napierala t = acl_string_to_tag(tag, qualifier); 125aa015c8eSEdward Tomasz Napierala if (t == -1) { 126aa015c8eSEdward Tomasz Napierala errno = EINVAL; 127aa015c8eSEdward Tomasz Napierala return (-1); 128aa015c8eSEdward Tomasz Napierala } 129aa015c8eSEdward Tomasz Napierala 130aa015c8eSEdward Tomasz Napierala error = _posix1e_acl_string_to_perm(permission, &p); 131aa015c8eSEdward Tomasz Napierala if (error == -1) { 132aa015c8eSEdward Tomasz Napierala errno = EINVAL; 133aa015c8eSEdward Tomasz Napierala return (-1); 134aa015c8eSEdward Tomasz Napierala } 135aa015c8eSEdward Tomasz Napierala 136aa015c8eSEdward Tomasz Napierala switch(t) { 137aa015c8eSEdward Tomasz Napierala case ACL_USER_OBJ: 138aa015c8eSEdward Tomasz Napierala case ACL_GROUP_OBJ: 139aa015c8eSEdward Tomasz Napierala case ACL_MASK: 140aa015c8eSEdward Tomasz Napierala case ACL_OTHER: 141aa015c8eSEdward Tomasz Napierala if (*qualifier != '\0') { 142aa015c8eSEdward Tomasz Napierala errno = EINVAL; 143aa015c8eSEdward Tomasz Napierala return (-1); 144aa015c8eSEdward Tomasz Napierala } 145aa015c8eSEdward Tomasz Napierala id = 0; 146aa015c8eSEdward Tomasz Napierala break; 147aa015c8eSEdward Tomasz Napierala 148aa015c8eSEdward Tomasz Napierala case ACL_USER: 149aa015c8eSEdward Tomasz Napierala case ACL_GROUP: 150f59646c2SEdward Tomasz Napierala error = _acl_name_to_id(t, qualifier, &id); 151aa015c8eSEdward Tomasz Napierala if (error == -1) 152aa015c8eSEdward Tomasz Napierala return (-1); 153aa015c8eSEdward Tomasz Napierala break; 154aa015c8eSEdward Tomasz Napierala 155aa015c8eSEdward Tomasz Napierala default: 156aa015c8eSEdward Tomasz Napierala errno = EINVAL; 157aa015c8eSEdward Tomasz Napierala return (-1); 158aa015c8eSEdward Tomasz Napierala } 159aa015c8eSEdward Tomasz Napierala 160aa015c8eSEdward Tomasz Napierala error = _posix1e_acl_add_entry(aclp, t, id, p); 161aa015c8eSEdward Tomasz Napierala if (error == -1) 162aa015c8eSEdward Tomasz Napierala return (-1); 163aa015c8eSEdward Tomasz Napierala 164aa015c8eSEdward Tomasz Napierala return (0); 165aa015c8eSEdward Tomasz Napierala } 166aa015c8eSEdward Tomasz Napierala 167aa015c8eSEdward Tomasz Napierala static int 168aa015c8eSEdward Tomasz Napierala _text_is_nfs4_entry(const char *entry) 169aa015c8eSEdward Tomasz Napierala { 170aa015c8eSEdward Tomasz Napierala int count = 0; 171aa015c8eSEdward Tomasz Napierala 172aa015c8eSEdward Tomasz Napierala assert(strlen(entry) > 0); 173aa015c8eSEdward Tomasz Napierala 174aa015c8eSEdward Tomasz Napierala while (*entry != '\0') { 175aa015c8eSEdward Tomasz Napierala if (*entry == ':' || *entry == '@') 176aa015c8eSEdward Tomasz Napierala count++; 177aa015c8eSEdward Tomasz Napierala entry++; 178aa015c8eSEdward Tomasz Napierala } 179aa015c8eSEdward Tomasz Napierala 180aa015c8eSEdward Tomasz Napierala if (count <= 2) 181aa015c8eSEdward Tomasz Napierala return (0); 182aa015c8eSEdward Tomasz Napierala 183aa015c8eSEdward Tomasz Napierala return (1); 184aa015c8eSEdward Tomasz Napierala } 185aa015c8eSEdward Tomasz Napierala 186515d7c92SRobert Watson /* 187374c6c0fSRobert Watson * acl_from_text -- Convert a string into an ACL. 188374c6c0fSRobert Watson * Postpone most validity checking until the end and call acl_valid() to do 189515d7c92SRobert Watson * that. 190515d7c92SRobert Watson */ 191515d7c92SRobert Watson acl_t 192515d7c92SRobert Watson acl_from_text(const char *buf_p) 193515d7c92SRobert Watson { 194515d7c92SRobert Watson acl_t acl; 195515d7c92SRobert Watson char *mybuf_p, *line, *cur, *notcomment, *comment, *entry; 196515d7c92SRobert Watson int error; 197515d7c92SRobert Watson 198374c6c0fSRobert Watson /* Local copy we can mess up. */ 199515d7c92SRobert Watson mybuf_p = strdup(buf_p); 2009fd46b02SChris D. Faulhaber if (mybuf_p == NULL) 201f0078215SRobert Watson return(NULL); 202515d7c92SRobert Watson 203aa015c8eSEdward Tomasz Napierala acl = acl_init(3); /* XXX: WTF, 3? */ 2049fd46b02SChris D. Faulhaber if (acl == NULL) { 205515d7c92SRobert Watson free(mybuf_p); 206f0078215SRobert Watson return(NULL); 207515d7c92SRobert Watson } 208515d7c92SRobert Watson 209374c6c0fSRobert Watson /* Outer loop: delimit at \n boundaries. */ 210515d7c92SRobert Watson cur = mybuf_p; 211515d7c92SRobert Watson while ((line = strsep(&cur, "\n"))) { 212374c6c0fSRobert Watson /* Now split the line on the first # to strip out comments. */ 213515d7c92SRobert Watson comment = line; 214515d7c92SRobert Watson notcomment = strsep(&comment, "#"); 215515d7c92SRobert Watson 216374c6c0fSRobert Watson /* Inner loop: delimit at ',' boundaries. */ 217515d7c92SRobert Watson while ((entry = strsep(¬comment, ","))) { 218aa015c8eSEdward Tomasz Napierala 219aa015c8eSEdward Tomasz Napierala /* Skip empty lines. */ 220aa015c8eSEdward Tomasz Napierala if (strlen(string_skip_whitespace(entry)) == 0) 221515d7c92SRobert Watson continue; 222515d7c92SRobert Watson 223aa015c8eSEdward Tomasz Napierala if (_acl_brand(acl) == ACL_BRAND_UNKNOWN) { 224aa015c8eSEdward Tomasz Napierala if (_text_is_nfs4_entry(entry)) 225aa015c8eSEdward Tomasz Napierala _acl_brand_as(acl, ACL_BRAND_NFS4); 226aa015c8eSEdward Tomasz Napierala else 227aa015c8eSEdward Tomasz Napierala _acl_brand_as(acl, ACL_BRAND_POSIX); 228515d7c92SRobert Watson } 229515d7c92SRobert Watson 230aa015c8eSEdward Tomasz Napierala switch (_acl_brand(acl)) { 231aa015c8eSEdward Tomasz Napierala case ACL_BRAND_NFS4: 232aa015c8eSEdward Tomasz Napierala error = _nfs4_acl_entry_from_text(acl, entry); 233515d7c92SRobert Watson break; 234515d7c92SRobert Watson 235aa015c8eSEdward Tomasz Napierala case ACL_BRAND_POSIX: 236aa015c8eSEdward Tomasz Napierala error = _posix1e_acl_entry_from_text(acl, entry); 237515d7c92SRobert Watson break; 238515d7c92SRobert Watson 239515d7c92SRobert Watson default: 240aa015c8eSEdward Tomasz Napierala error = EINVAL; 241aa015c8eSEdward Tomasz Napierala break; 242515d7c92SRobert Watson } 243515d7c92SRobert Watson 244aa015c8eSEdward Tomasz Napierala if (error) 245515d7c92SRobert Watson goto error_label; 246515d7c92SRobert Watson } 247515d7c92SRobert Watson } 248515d7c92SRobert Watson 249515d7c92SRobert Watson #if 0 250374c6c0fSRobert Watson /* XXX Should we only return ACLs valid according to acl_valid? */ 251374c6c0fSRobert Watson /* Verify validity of the ACL we read in. */ 252515d7c92SRobert Watson if (acl_valid(acl) == -1) { 253515d7c92SRobert Watson errno = EINVAL; 254515d7c92SRobert Watson goto error_label; 255515d7c92SRobert Watson } 256515d7c92SRobert Watson #endif 257515d7c92SRobert Watson 2584f6d5fdaSChristian Brueffer free(mybuf_p); 259515d7c92SRobert Watson return(acl); 260515d7c92SRobert Watson 261515d7c92SRobert Watson error_label: 262515d7c92SRobert Watson acl_free(acl); 263515d7c92SRobert Watson free(mybuf_p); 264f0078215SRobert Watson return(NULL); 265515d7c92SRobert Watson } 266515d7c92SRobert Watson 26748135111STim Kientzle /* 26848135111STim Kientzle * Given a username/groupname from a text form of an ACL, return the uid/gid 26948135111STim Kientzle * XXX NOT THREAD SAFE, RELIES ON GETPWNAM, GETGRNAM 27048135111STim Kientzle * XXX USES *PW* AND *GR* WHICH ARE STATEFUL AND THEREFORE THIS ROUTINE 27148135111STim Kientzle * MAY HAVE SIDE-EFFECTS 27248135111STim Kientzle */ 273f59646c2SEdward Tomasz Napierala int 274f59646c2SEdward Tomasz Napierala _acl_name_to_id(acl_tag_t tag, char *name, uid_t *id) 27548135111STim Kientzle { 27648135111STim Kientzle struct group *g; 27748135111STim Kientzle struct passwd *p; 27848135111STim Kientzle unsigned long l; 27948135111STim Kientzle char *endp; 280515d7c92SRobert Watson 28148135111STim Kientzle switch(tag) { 28248135111STim Kientzle case ACL_USER: 28348135111STim Kientzle p = getpwnam(name); 28448135111STim Kientzle if (p == NULL) { 28548135111STim Kientzle l = strtoul(name, &endp, 0); 28648135111STim Kientzle if (*endp != '\0' || l != (unsigned long)(uid_t)l) { 28748135111STim Kientzle errno = EINVAL; 28848135111STim Kientzle return (-1); 28948135111STim Kientzle } 29048135111STim Kientzle *id = (uid_t)l; 29148135111STim Kientzle return (0); 29248135111STim Kientzle } 29348135111STim Kientzle *id = p->pw_uid; 29448135111STim Kientzle return (0); 295515d7c92SRobert Watson 29648135111STim Kientzle case ACL_GROUP: 29748135111STim Kientzle g = getgrnam(name); 29848135111STim Kientzle if (g == NULL) { 29948135111STim Kientzle l = strtoul(name, &endp, 0); 30048135111STim Kientzle if (*endp != '\0' || l != (unsigned long)(gid_t)l) { 30148135111STim Kientzle errno = EINVAL; 30248135111STim Kientzle return (-1); 30348135111STim Kientzle } 30448135111STim Kientzle *id = (gid_t)l; 30548135111STim Kientzle return (0); 30648135111STim Kientzle } 30748135111STim Kientzle *id = g->gr_gid; 30848135111STim Kientzle return (0); 30948135111STim Kientzle 31048135111STim Kientzle default: 31148135111STim Kientzle return (EINVAL); 31248135111STim Kientzle } 31348135111STim Kientzle } 314