1aa015c8eSEdward Tomasz Napierala /*-
24d846d26SWarner Losh * SPDX-License-Identifier: BSD-2-Clause
3d915a14eSPedro F. Giffuni *
4aa015c8eSEdward Tomasz Napierala * Copyright (c) 2008, 2009 Edward Tomasz Napierała <trasz@FreeBSD.org>
5aa015c8eSEdward Tomasz Napierala *
6aa015c8eSEdward Tomasz Napierala * Redistribution and use in source and binary forms, with or without
7aa015c8eSEdward Tomasz Napierala * modification, are permitted provided that the following conditions
8aa015c8eSEdward Tomasz Napierala * are met:
9aa015c8eSEdward Tomasz Napierala * 1. Redistributions of source code must retain the above copyright
10aa015c8eSEdward Tomasz Napierala * notice, this list of conditions and the following disclaimer.
11aa015c8eSEdward Tomasz Napierala * 2. Redistributions in binary form must reproduce the above copyright
12aa015c8eSEdward Tomasz Napierala * notice, this list of conditions and the following disclaimer in the
13aa015c8eSEdward Tomasz Napierala * documentation and/or other materials provided with the distribution.
14aa015c8eSEdward Tomasz Napierala *
15aa015c8eSEdward Tomasz Napierala * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16aa015c8eSEdward Tomasz Napierala * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17aa015c8eSEdward Tomasz Napierala * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18aa015c8eSEdward Tomasz Napierala * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19aa015c8eSEdward Tomasz Napierala * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20aa015c8eSEdward Tomasz Napierala * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21aa015c8eSEdward Tomasz Napierala * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22aa015c8eSEdward Tomasz Napierala * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23aa015c8eSEdward Tomasz Napierala * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24aa015c8eSEdward Tomasz Napierala * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25aa015c8eSEdward Tomasz Napierala * SUCH DAMAGE.
26aa015c8eSEdward Tomasz Napierala */
27aa015c8eSEdward Tomasz Napierala
28aa015c8eSEdward Tomasz Napierala #include <stdio.h>
29aa015c8eSEdward Tomasz Napierala #include <stdlib.h>
30aa015c8eSEdward Tomasz Napierala #include <unistd.h>
31aa015c8eSEdward Tomasz Napierala #include <errno.h>
32aa015c8eSEdward Tomasz Napierala #include <assert.h>
33aa015c8eSEdward Tomasz Napierala #include <string.h>
34aa015c8eSEdward Tomasz Napierala #include <pwd.h>
35aa015c8eSEdward Tomasz Napierala #include <grp.h>
36aa015c8eSEdward Tomasz Napierala #include <ctype.h>
37aa015c8eSEdward Tomasz Napierala #include <err.h>
38aa015c8eSEdward Tomasz Napierala #include <sys/syscall.h>
39aa015c8eSEdward Tomasz Napierala #include <sys/types.h>
40aa015c8eSEdward Tomasz Napierala #include <sys/acl.h>
41aa015c8eSEdward Tomasz Napierala
42aa015c8eSEdward Tomasz Napierala #include "acl_support.h"
43aa015c8eSEdward Tomasz Napierala
44aa015c8eSEdward Tomasz Napierala #define MAX_ENTRY_LENGTH 512
45aa015c8eSEdward Tomasz Napierala
46aa015c8eSEdward Tomasz Napierala /*
47aa015c8eSEdward Tomasz Napierala * Parse the tag field of ACL entry passed as "str". If qualifier
48aa015c8eSEdward Tomasz Napierala * needs to follow, then the variable referenced by "need_qualifier"
49aa015c8eSEdward Tomasz Napierala * is set to 1, otherwise it's set to 0.
50aa015c8eSEdward Tomasz Napierala */
51aa015c8eSEdward Tomasz Napierala static int
parse_tag(const char * str,acl_entry_t entry,int * need_qualifier)52aa015c8eSEdward Tomasz Napierala parse_tag(const char *str, acl_entry_t entry, int *need_qualifier)
53aa015c8eSEdward Tomasz Napierala {
54aa015c8eSEdward Tomasz Napierala
55aa015c8eSEdward Tomasz Napierala assert(need_qualifier != NULL);
56aa015c8eSEdward Tomasz Napierala *need_qualifier = 0;
57aa015c8eSEdward Tomasz Napierala
58aa015c8eSEdward Tomasz Napierala if (strcmp(str, "owner@") == 0)
59aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_USER_OBJ));
60aa015c8eSEdward Tomasz Napierala if (strcmp(str, "group@") == 0)
61aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_GROUP_OBJ));
62aa015c8eSEdward Tomasz Napierala if (strcmp(str, "everyone@") == 0)
63aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_EVERYONE));
64aa015c8eSEdward Tomasz Napierala
65aa015c8eSEdward Tomasz Napierala *need_qualifier = 1;
66aa015c8eSEdward Tomasz Napierala
67aa015c8eSEdward Tomasz Napierala if (strcmp(str, "user") == 0 || strcmp(str, "u") == 0)
68aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_USER));
69aa015c8eSEdward Tomasz Napierala if (strcmp(str, "group") == 0 || strcmp(str, "g") == 0)
70aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_GROUP));
71aa015c8eSEdward Tomasz Napierala
72aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: invalid \"tag\" field");
73aa015c8eSEdward Tomasz Napierala
74aa015c8eSEdward Tomasz Napierala return (-1);
75aa015c8eSEdward Tomasz Napierala }
76aa015c8eSEdward Tomasz Napierala
77aa015c8eSEdward Tomasz Napierala /*
78aa015c8eSEdward Tomasz Napierala * Parse the qualifier field of ACL entry passed as "str".
79aa015c8eSEdward Tomasz Napierala * If user or group name cannot be resolved, then the variable
80f59646c2SEdward Tomasz Napierala * referenced by "need_qualifier" is set to 1; it will be checked
81f59646c2SEdward Tomasz Napierala * later to figure out whether the appended_id is required.
82aa015c8eSEdward Tomasz Napierala */
83aa015c8eSEdward Tomasz Napierala static int
parse_qualifier(char * str,acl_entry_t entry,int * need_qualifier)84aa015c8eSEdward Tomasz Napierala parse_qualifier(char *str, acl_entry_t entry, int *need_qualifier)
85aa015c8eSEdward Tomasz Napierala {
86aa015c8eSEdward Tomasz Napierala int qualifier_length, error;
87f59646c2SEdward Tomasz Napierala uid_t id;
88aa015c8eSEdward Tomasz Napierala acl_tag_t tag;
89aa015c8eSEdward Tomasz Napierala
90aa015c8eSEdward Tomasz Napierala assert(need_qualifier != NULL);
91aa015c8eSEdward Tomasz Napierala *need_qualifier = 0;
92aa015c8eSEdward Tomasz Napierala
93aa015c8eSEdward Tomasz Napierala qualifier_length = strlen(str);
94aa015c8eSEdward Tomasz Napierala
95aa015c8eSEdward Tomasz Napierala if (qualifier_length == 0) {
96aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: empty \"qualifier\" field");
97aa015c8eSEdward Tomasz Napierala return (-1);
98aa015c8eSEdward Tomasz Napierala }
99aa015c8eSEdward Tomasz Napierala
100aa015c8eSEdward Tomasz Napierala error = acl_get_tag_type(entry, &tag);
101aa015c8eSEdward Tomasz Napierala if (error)
102aa015c8eSEdward Tomasz Napierala return (error);
103aa015c8eSEdward Tomasz Napierala
104f59646c2SEdward Tomasz Napierala error = _acl_name_to_id(tag, str, &id);
105f59646c2SEdward Tomasz Napierala if (error) {
106aa015c8eSEdward Tomasz Napierala *need_qualifier = 1;
107aa015c8eSEdward Tomasz Napierala return (0);
108aa015c8eSEdward Tomasz Napierala }
109aa015c8eSEdward Tomasz Napierala
110f59646c2SEdward Tomasz Napierala return (acl_set_qualifier(entry, &id));
111aa015c8eSEdward Tomasz Napierala }
112aa015c8eSEdward Tomasz Napierala
113aa015c8eSEdward Tomasz Napierala static int
parse_access_mask(char * str,acl_entry_t entry)114aa015c8eSEdward Tomasz Napierala parse_access_mask(char *str, acl_entry_t entry)
115aa015c8eSEdward Tomasz Napierala {
116aa015c8eSEdward Tomasz Napierala int error;
117aa015c8eSEdward Tomasz Napierala acl_perm_t perm;
118aa015c8eSEdward Tomasz Napierala
119aa015c8eSEdward Tomasz Napierala error = _nfs4_parse_access_mask(str, &perm);
120aa015c8eSEdward Tomasz Napierala if (error)
121aa015c8eSEdward Tomasz Napierala return (error);
122aa015c8eSEdward Tomasz Napierala
123aa015c8eSEdward Tomasz Napierala error = acl_set_permset(entry, &perm);
124aa015c8eSEdward Tomasz Napierala
125aa015c8eSEdward Tomasz Napierala return (error);
126aa015c8eSEdward Tomasz Napierala }
127aa015c8eSEdward Tomasz Napierala
128aa015c8eSEdward Tomasz Napierala static int
parse_flags(char * str,acl_entry_t entry)129aa015c8eSEdward Tomasz Napierala parse_flags(char *str, acl_entry_t entry)
130aa015c8eSEdward Tomasz Napierala {
131aa015c8eSEdward Tomasz Napierala int error;
132aa015c8eSEdward Tomasz Napierala acl_flag_t flags;
133aa015c8eSEdward Tomasz Napierala
134aa015c8eSEdward Tomasz Napierala error = _nfs4_parse_flags(str, &flags);
135aa015c8eSEdward Tomasz Napierala if (error)
136aa015c8eSEdward Tomasz Napierala return (error);
137aa015c8eSEdward Tomasz Napierala
138aa015c8eSEdward Tomasz Napierala error = acl_set_flagset_np(entry, &flags);
139aa015c8eSEdward Tomasz Napierala
140aa015c8eSEdward Tomasz Napierala return (error);
141aa015c8eSEdward Tomasz Napierala }
142aa015c8eSEdward Tomasz Napierala
143aa015c8eSEdward Tomasz Napierala static int
parse_entry_type(const char * str,acl_entry_t entry)144aa015c8eSEdward Tomasz Napierala parse_entry_type(const char *str, acl_entry_t entry)
145aa015c8eSEdward Tomasz Napierala {
146aa015c8eSEdward Tomasz Napierala
147aa015c8eSEdward Tomasz Napierala if (strcmp(str, "allow") == 0)
148aa015c8eSEdward Tomasz Napierala return (acl_set_entry_type_np(entry, ACL_ENTRY_TYPE_ALLOW));
149aa015c8eSEdward Tomasz Napierala if (strcmp(str, "deny") == 0)
150aa015c8eSEdward Tomasz Napierala return (acl_set_entry_type_np(entry, ACL_ENTRY_TYPE_DENY));
151aa015c8eSEdward Tomasz Napierala if (strcmp(str, "audit") == 0)
152aa015c8eSEdward Tomasz Napierala return (acl_set_entry_type_np(entry, ACL_ENTRY_TYPE_AUDIT));
153aa015c8eSEdward Tomasz Napierala if (strcmp(str, "alarm") == 0)
154aa015c8eSEdward Tomasz Napierala return (acl_set_entry_type_np(entry, ACL_ENTRY_TYPE_ALARM));
155aa015c8eSEdward Tomasz Napierala
156aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: invalid \"type\" field");
157aa015c8eSEdward Tomasz Napierala
158aa015c8eSEdward Tomasz Napierala return (-1);
159aa015c8eSEdward Tomasz Napierala }
160aa015c8eSEdward Tomasz Napierala
161aa015c8eSEdward Tomasz Napierala static int
parse_appended_id(char * str,acl_entry_t entry)162aa015c8eSEdward Tomasz Napierala parse_appended_id(char *str, acl_entry_t entry)
163aa015c8eSEdward Tomasz Napierala {
164aa015c8eSEdward Tomasz Napierala int qualifier_length;
165aa015c8eSEdward Tomasz Napierala char *end;
166aa015c8eSEdward Tomasz Napierala id_t id;
167aa015c8eSEdward Tomasz Napierala
168aa015c8eSEdward Tomasz Napierala qualifier_length = strlen(str);
169aa015c8eSEdward Tomasz Napierala if (qualifier_length == 0) {
170aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: \"appended id\" field present, "
171aa015c8eSEdward Tomasz Napierala "but empty");
172aa015c8eSEdward Tomasz Napierala return (-1);
173aa015c8eSEdward Tomasz Napierala }
174aa015c8eSEdward Tomasz Napierala
175aa015c8eSEdward Tomasz Napierala id = strtod(str, &end);
176aa015c8eSEdward Tomasz Napierala if (end - str != qualifier_length) {
177aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: appended id is not a number");
178aa015c8eSEdward Tomasz Napierala return (-1);
179aa015c8eSEdward Tomasz Napierala }
180aa015c8eSEdward Tomasz Napierala
181aa015c8eSEdward Tomasz Napierala return (acl_set_qualifier(entry, &id));
182aa015c8eSEdward Tomasz Napierala }
183aa015c8eSEdward Tomasz Napierala
184aa015c8eSEdward Tomasz Napierala static int
number_of_colons(const char * str)185aa015c8eSEdward Tomasz Napierala number_of_colons(const char *str)
186aa015c8eSEdward Tomasz Napierala {
187aa015c8eSEdward Tomasz Napierala int count = 0;
188aa015c8eSEdward Tomasz Napierala
189aa015c8eSEdward Tomasz Napierala while (*str != '\0') {
190aa015c8eSEdward Tomasz Napierala if (*str == ':')
191aa015c8eSEdward Tomasz Napierala count++;
192aa015c8eSEdward Tomasz Napierala
193aa015c8eSEdward Tomasz Napierala str++;
194aa015c8eSEdward Tomasz Napierala }
195aa015c8eSEdward Tomasz Napierala
196aa015c8eSEdward Tomasz Napierala return (count);
197aa015c8eSEdward Tomasz Napierala }
198aa015c8eSEdward Tomasz Napierala
199aa015c8eSEdward Tomasz Napierala int
_nfs4_acl_entry_from_text(acl_t aclp,char * str)200aa015c8eSEdward Tomasz Napierala _nfs4_acl_entry_from_text(acl_t aclp, char *str)
201aa015c8eSEdward Tomasz Napierala {
202aa015c8eSEdward Tomasz Napierala int error, need_qualifier;
203aa015c8eSEdward Tomasz Napierala acl_entry_t entry;
204aa015c8eSEdward Tomasz Napierala char *field, *qualifier_field;
205aa015c8eSEdward Tomasz Napierala
206aa015c8eSEdward Tomasz Napierala error = acl_create_entry(&aclp, &entry);
207aa015c8eSEdward Tomasz Napierala if (error)
208aa015c8eSEdward Tomasz Napierala return (error);
209aa015c8eSEdward Tomasz Napierala
210aa015c8eSEdward Tomasz Napierala assert(_entry_brand(entry) == ACL_BRAND_NFS4);
211aa015c8eSEdward Tomasz Napierala
212aa015c8eSEdward Tomasz Napierala if (str == NULL)
213aa015c8eSEdward Tomasz Napierala goto truncated_entry;
214aa015c8eSEdward Tomasz Napierala field = strsep(&str, ":");
215aa015c8eSEdward Tomasz Napierala
216aa015c8eSEdward Tomasz Napierala field = string_skip_whitespace(field);
217aa015c8eSEdward Tomasz Napierala if ((*field == '\0') && (!str)) {
218aa015c8eSEdward Tomasz Napierala /*
219aa015c8eSEdward Tomasz Napierala * Is an entirely comment line, skip to next
220aa015c8eSEdward Tomasz Napierala * comma.
221aa015c8eSEdward Tomasz Napierala */
222aa015c8eSEdward Tomasz Napierala return (0);
223aa015c8eSEdward Tomasz Napierala }
224aa015c8eSEdward Tomasz Napierala
225aa015c8eSEdward Tomasz Napierala error = parse_tag(field, entry, &need_qualifier);
226aa015c8eSEdward Tomasz Napierala if (error)
227aa015c8eSEdward Tomasz Napierala goto malformed_field;
228aa015c8eSEdward Tomasz Napierala
229aa015c8eSEdward Tomasz Napierala if (need_qualifier) {
230aa015c8eSEdward Tomasz Napierala if (str == NULL)
231aa015c8eSEdward Tomasz Napierala goto truncated_entry;
232aa015c8eSEdward Tomasz Napierala qualifier_field = field = strsep(&str, ":");
233aa015c8eSEdward Tomasz Napierala error = parse_qualifier(field, entry, &need_qualifier);
234aa015c8eSEdward Tomasz Napierala if (error)
235aa015c8eSEdward Tomasz Napierala goto malformed_field;
236aa015c8eSEdward Tomasz Napierala }
237aa015c8eSEdward Tomasz Napierala
238aa015c8eSEdward Tomasz Napierala if (str == NULL)
239aa015c8eSEdward Tomasz Napierala goto truncated_entry;
240aa015c8eSEdward Tomasz Napierala field = strsep(&str, ":");
241aa015c8eSEdward Tomasz Napierala error = parse_access_mask(field, entry);
242aa015c8eSEdward Tomasz Napierala if (error)
243aa015c8eSEdward Tomasz Napierala goto malformed_field;
244aa015c8eSEdward Tomasz Napierala
245aa015c8eSEdward Tomasz Napierala if (str == NULL)
246aa015c8eSEdward Tomasz Napierala goto truncated_entry;
247aa015c8eSEdward Tomasz Napierala /* Do we have "flags" field? */
248aa015c8eSEdward Tomasz Napierala if (number_of_colons(str) > 0) {
249aa015c8eSEdward Tomasz Napierala field = strsep(&str, ":");
250aa015c8eSEdward Tomasz Napierala error = parse_flags(field, entry);
251aa015c8eSEdward Tomasz Napierala if (error)
252aa015c8eSEdward Tomasz Napierala goto malformed_field;
253aa015c8eSEdward Tomasz Napierala }
254aa015c8eSEdward Tomasz Napierala
255aa015c8eSEdward Tomasz Napierala if (str == NULL)
256aa015c8eSEdward Tomasz Napierala goto truncated_entry;
257aa015c8eSEdward Tomasz Napierala field = strsep(&str, ":");
258aa015c8eSEdward Tomasz Napierala error = parse_entry_type(field, entry);
259aa015c8eSEdward Tomasz Napierala if (error)
260aa015c8eSEdward Tomasz Napierala goto malformed_field;
261aa015c8eSEdward Tomasz Napierala
262aa015c8eSEdward Tomasz Napierala if (need_qualifier) {
263aa015c8eSEdward Tomasz Napierala if (str == NULL) {
264aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: unknown user or group name "
265aa015c8eSEdward Tomasz Napierala "\"%s\"", qualifier_field);
266aa015c8eSEdward Tomasz Napierala goto truncated_entry;
267aa015c8eSEdward Tomasz Napierala }
268aa015c8eSEdward Tomasz Napierala
269aa015c8eSEdward Tomasz Napierala error = parse_appended_id(str, entry);
270aa015c8eSEdward Tomasz Napierala if (error)
271aa015c8eSEdward Tomasz Napierala goto malformed_field;
272aa015c8eSEdward Tomasz Napierala }
273aa015c8eSEdward Tomasz Napierala
274aa015c8eSEdward Tomasz Napierala return (0);
275aa015c8eSEdward Tomasz Napierala
276aa015c8eSEdward Tomasz Napierala truncated_entry:
277aa015c8eSEdward Tomasz Napierala malformed_field:
278aa015c8eSEdward Tomasz Napierala acl_delete_entry(aclp, entry);
279aa015c8eSEdward Tomasz Napierala errno = EINVAL;
280aa015c8eSEdward Tomasz Napierala return (-1);
281aa015c8eSEdward Tomasz Napierala }
282