1aa015c8eSEdward Tomasz Napierala /*- 24d846d26SWarner Losh * SPDX-License-Identifier: BSD-2-Clause 3d915a14eSPedro F. Giffuni * 4aa015c8eSEdward Tomasz Napierala * Copyright (c) 2008, 2009 Edward Tomasz Napierała <trasz@FreeBSD.org> 5aa015c8eSEdward Tomasz Napierala * 6aa015c8eSEdward Tomasz Napierala * Redistribution and use in source and binary forms, with or without 7aa015c8eSEdward Tomasz Napierala * modification, are permitted provided that the following conditions 8aa015c8eSEdward Tomasz Napierala * are met: 9aa015c8eSEdward Tomasz Napierala * 1. Redistributions of source code must retain the above copyright 10aa015c8eSEdward Tomasz Napierala * notice, this list of conditions and the following disclaimer. 11aa015c8eSEdward Tomasz Napierala * 2. Redistributions in binary form must reproduce the above copyright 12aa015c8eSEdward Tomasz Napierala * notice, this list of conditions and the following disclaimer in the 13aa015c8eSEdward Tomasz Napierala * documentation and/or other materials provided with the distribution. 14aa015c8eSEdward Tomasz Napierala * 15aa015c8eSEdward Tomasz Napierala * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16aa015c8eSEdward Tomasz Napierala * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17aa015c8eSEdward Tomasz Napierala * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18aa015c8eSEdward Tomasz Napierala * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19aa015c8eSEdward Tomasz Napierala * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20aa015c8eSEdward Tomasz Napierala * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21aa015c8eSEdward Tomasz Napierala * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22aa015c8eSEdward Tomasz Napierala * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23aa015c8eSEdward Tomasz Napierala * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24aa015c8eSEdward Tomasz Napierala * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25aa015c8eSEdward Tomasz Napierala * SUCH DAMAGE. 26aa015c8eSEdward Tomasz Napierala */ 27aa015c8eSEdward Tomasz Napierala 28aa015c8eSEdward Tomasz Napierala #include <sys/cdefs.h> 29aa015c8eSEdward Tomasz Napierala __FBSDID("$FreeBSD$"); 30aa015c8eSEdward Tomasz Napierala 31aa015c8eSEdward Tomasz Napierala #include <stdio.h> 32aa015c8eSEdward Tomasz Napierala #include <stdlib.h> 33aa015c8eSEdward Tomasz Napierala #include <unistd.h> 34aa015c8eSEdward Tomasz Napierala #include <errno.h> 35aa015c8eSEdward Tomasz Napierala #include <assert.h> 36aa015c8eSEdward Tomasz Napierala #include <string.h> 37aa015c8eSEdward Tomasz Napierala #include <pwd.h> 38aa015c8eSEdward Tomasz Napierala #include <grp.h> 39aa015c8eSEdward Tomasz Napierala #include <ctype.h> 40aa015c8eSEdward Tomasz Napierala #include <err.h> 41aa015c8eSEdward Tomasz Napierala #include <sys/syscall.h> 42aa015c8eSEdward Tomasz Napierala #include <sys/types.h> 43aa015c8eSEdward Tomasz Napierala #include <sys/acl.h> 44aa015c8eSEdward Tomasz Napierala 45aa015c8eSEdward Tomasz Napierala #include "acl_support.h" 46aa015c8eSEdward Tomasz Napierala 47aa015c8eSEdward Tomasz Napierala #define MAX_ENTRY_LENGTH 512 48aa015c8eSEdward Tomasz Napierala 49aa015c8eSEdward Tomasz Napierala /* 50aa015c8eSEdward Tomasz Napierala * Parse the tag field of ACL entry passed as "str". If qualifier 51aa015c8eSEdward Tomasz Napierala * needs to follow, then the variable referenced by "need_qualifier" 52aa015c8eSEdward Tomasz Napierala * is set to 1, otherwise it's set to 0. 53aa015c8eSEdward Tomasz Napierala */ 54aa015c8eSEdward Tomasz Napierala static int 55aa015c8eSEdward Tomasz Napierala parse_tag(const char *str, acl_entry_t entry, int *need_qualifier) 56aa015c8eSEdward Tomasz Napierala { 57aa015c8eSEdward Tomasz Napierala 58aa015c8eSEdward Tomasz Napierala assert(need_qualifier != NULL); 59aa015c8eSEdward Tomasz Napierala *need_qualifier = 0; 60aa015c8eSEdward Tomasz Napierala 61aa015c8eSEdward Tomasz Napierala if (strcmp(str, "owner@") == 0) 62aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_USER_OBJ)); 63aa015c8eSEdward Tomasz Napierala if (strcmp(str, "group@") == 0) 64aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_GROUP_OBJ)); 65aa015c8eSEdward Tomasz Napierala if (strcmp(str, "everyone@") == 0) 66aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_EVERYONE)); 67aa015c8eSEdward Tomasz Napierala 68aa015c8eSEdward Tomasz Napierala *need_qualifier = 1; 69aa015c8eSEdward Tomasz Napierala 70aa015c8eSEdward Tomasz Napierala if (strcmp(str, "user") == 0 || strcmp(str, "u") == 0) 71aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_USER)); 72aa015c8eSEdward Tomasz Napierala if (strcmp(str, "group") == 0 || strcmp(str, "g") == 0) 73aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_GROUP)); 74aa015c8eSEdward Tomasz Napierala 75aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: invalid \"tag\" field"); 76aa015c8eSEdward Tomasz Napierala 77aa015c8eSEdward Tomasz Napierala return (-1); 78aa015c8eSEdward Tomasz Napierala } 79aa015c8eSEdward Tomasz Napierala 80aa015c8eSEdward Tomasz Napierala /* 81aa015c8eSEdward Tomasz Napierala * Parse the qualifier field of ACL entry passed as "str". 82aa015c8eSEdward Tomasz Napierala * If user or group name cannot be resolved, then the variable 83f59646c2SEdward Tomasz Napierala * referenced by "need_qualifier" is set to 1; it will be checked 84f59646c2SEdward Tomasz Napierala * later to figure out whether the appended_id is required. 85aa015c8eSEdward Tomasz Napierala */ 86aa015c8eSEdward Tomasz Napierala static int 87aa015c8eSEdward Tomasz Napierala parse_qualifier(char *str, acl_entry_t entry, int *need_qualifier) 88aa015c8eSEdward Tomasz Napierala { 89aa015c8eSEdward Tomasz Napierala int qualifier_length, error; 90f59646c2SEdward Tomasz Napierala uid_t id; 91aa015c8eSEdward Tomasz Napierala acl_tag_t tag; 92aa015c8eSEdward Tomasz Napierala 93aa015c8eSEdward Tomasz Napierala assert(need_qualifier != NULL); 94aa015c8eSEdward Tomasz Napierala *need_qualifier = 0; 95aa015c8eSEdward Tomasz Napierala 96aa015c8eSEdward Tomasz Napierala qualifier_length = strlen(str); 97aa015c8eSEdward Tomasz Napierala 98aa015c8eSEdward Tomasz Napierala if (qualifier_length == 0) { 99aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: empty \"qualifier\" field"); 100aa015c8eSEdward Tomasz Napierala return (-1); 101aa015c8eSEdward Tomasz Napierala } 102aa015c8eSEdward Tomasz Napierala 103aa015c8eSEdward Tomasz Napierala error = acl_get_tag_type(entry, &tag); 104aa015c8eSEdward Tomasz Napierala if (error) 105aa015c8eSEdward Tomasz Napierala return (error); 106aa015c8eSEdward Tomasz Napierala 107f59646c2SEdward Tomasz Napierala error = _acl_name_to_id(tag, str, &id); 108f59646c2SEdward Tomasz Napierala if (error) { 109aa015c8eSEdward Tomasz Napierala *need_qualifier = 1; 110aa015c8eSEdward Tomasz Napierala return (0); 111aa015c8eSEdward Tomasz Napierala } 112aa015c8eSEdward Tomasz Napierala 113f59646c2SEdward Tomasz Napierala return (acl_set_qualifier(entry, &id)); 114aa015c8eSEdward Tomasz Napierala } 115aa015c8eSEdward Tomasz Napierala 116aa015c8eSEdward Tomasz Napierala static int 117aa015c8eSEdward Tomasz Napierala parse_access_mask(char *str, acl_entry_t entry) 118aa015c8eSEdward Tomasz Napierala { 119aa015c8eSEdward Tomasz Napierala int error; 120aa015c8eSEdward Tomasz Napierala acl_perm_t perm; 121aa015c8eSEdward Tomasz Napierala 122aa015c8eSEdward Tomasz Napierala error = _nfs4_parse_access_mask(str, &perm); 123aa015c8eSEdward Tomasz Napierala if (error) 124aa015c8eSEdward Tomasz Napierala return (error); 125aa015c8eSEdward Tomasz Napierala 126aa015c8eSEdward Tomasz Napierala error = acl_set_permset(entry, &perm); 127aa015c8eSEdward Tomasz Napierala 128aa015c8eSEdward Tomasz Napierala return (error); 129aa015c8eSEdward Tomasz Napierala } 130aa015c8eSEdward Tomasz Napierala 131aa015c8eSEdward Tomasz Napierala static int 132aa015c8eSEdward Tomasz Napierala parse_flags(char *str, acl_entry_t entry) 133aa015c8eSEdward Tomasz Napierala { 134aa015c8eSEdward Tomasz Napierala int error; 135aa015c8eSEdward Tomasz Napierala acl_flag_t flags; 136aa015c8eSEdward Tomasz Napierala 137aa015c8eSEdward Tomasz Napierala error = _nfs4_parse_flags(str, &flags); 138aa015c8eSEdward Tomasz Napierala if (error) 139aa015c8eSEdward Tomasz Napierala return (error); 140aa015c8eSEdward Tomasz Napierala 141aa015c8eSEdward Tomasz Napierala error = acl_set_flagset_np(entry, &flags); 142aa015c8eSEdward Tomasz Napierala 143aa015c8eSEdward Tomasz Napierala return (error); 144aa015c8eSEdward Tomasz Napierala } 145aa015c8eSEdward Tomasz Napierala 146aa015c8eSEdward Tomasz Napierala static int 147aa015c8eSEdward Tomasz Napierala parse_entry_type(const char *str, acl_entry_t entry) 148aa015c8eSEdward Tomasz Napierala { 149aa015c8eSEdward Tomasz Napierala 150aa015c8eSEdward Tomasz Napierala if (strcmp(str, "allow") == 0) 151aa015c8eSEdward Tomasz Napierala return (acl_set_entry_type_np(entry, ACL_ENTRY_TYPE_ALLOW)); 152aa015c8eSEdward Tomasz Napierala if (strcmp(str, "deny") == 0) 153aa015c8eSEdward Tomasz Napierala return (acl_set_entry_type_np(entry, ACL_ENTRY_TYPE_DENY)); 154aa015c8eSEdward Tomasz Napierala if (strcmp(str, "audit") == 0) 155aa015c8eSEdward Tomasz Napierala return (acl_set_entry_type_np(entry, ACL_ENTRY_TYPE_AUDIT)); 156aa015c8eSEdward Tomasz Napierala if (strcmp(str, "alarm") == 0) 157aa015c8eSEdward Tomasz Napierala return (acl_set_entry_type_np(entry, ACL_ENTRY_TYPE_ALARM)); 158aa015c8eSEdward Tomasz Napierala 159aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: invalid \"type\" field"); 160aa015c8eSEdward Tomasz Napierala 161aa015c8eSEdward Tomasz Napierala return (-1); 162aa015c8eSEdward Tomasz Napierala } 163aa015c8eSEdward Tomasz Napierala 164aa015c8eSEdward Tomasz Napierala static int 165aa015c8eSEdward Tomasz Napierala parse_appended_id(char *str, acl_entry_t entry) 166aa015c8eSEdward Tomasz Napierala { 167aa015c8eSEdward Tomasz Napierala int qualifier_length; 168aa015c8eSEdward Tomasz Napierala char *end; 169aa015c8eSEdward Tomasz Napierala id_t id; 170aa015c8eSEdward Tomasz Napierala 171aa015c8eSEdward Tomasz Napierala qualifier_length = strlen(str); 172aa015c8eSEdward Tomasz Napierala if (qualifier_length == 0) { 173aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: \"appended id\" field present, " 174aa015c8eSEdward Tomasz Napierala "but empty"); 175aa015c8eSEdward Tomasz Napierala return (-1); 176aa015c8eSEdward Tomasz Napierala } 177aa015c8eSEdward Tomasz Napierala 178aa015c8eSEdward Tomasz Napierala id = strtod(str, &end); 179aa015c8eSEdward Tomasz Napierala if (end - str != qualifier_length) { 180aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: appended id is not a number"); 181aa015c8eSEdward Tomasz Napierala return (-1); 182aa015c8eSEdward Tomasz Napierala } 183aa015c8eSEdward Tomasz Napierala 184aa015c8eSEdward Tomasz Napierala return (acl_set_qualifier(entry, &id)); 185aa015c8eSEdward Tomasz Napierala } 186aa015c8eSEdward Tomasz Napierala 187aa015c8eSEdward Tomasz Napierala static int 188aa015c8eSEdward Tomasz Napierala number_of_colons(const char *str) 189aa015c8eSEdward Tomasz Napierala { 190aa015c8eSEdward Tomasz Napierala int count = 0; 191aa015c8eSEdward Tomasz Napierala 192aa015c8eSEdward Tomasz Napierala while (*str != '\0') { 193aa015c8eSEdward Tomasz Napierala if (*str == ':') 194aa015c8eSEdward Tomasz Napierala count++; 195aa015c8eSEdward Tomasz Napierala 196aa015c8eSEdward Tomasz Napierala str++; 197aa015c8eSEdward Tomasz Napierala } 198aa015c8eSEdward Tomasz Napierala 199aa015c8eSEdward Tomasz Napierala return (count); 200aa015c8eSEdward Tomasz Napierala } 201aa015c8eSEdward Tomasz Napierala 202aa015c8eSEdward Tomasz Napierala int 203aa015c8eSEdward Tomasz Napierala _nfs4_acl_entry_from_text(acl_t aclp, char *str) 204aa015c8eSEdward Tomasz Napierala { 205aa015c8eSEdward Tomasz Napierala int error, need_qualifier; 206aa015c8eSEdward Tomasz Napierala acl_entry_t entry; 207aa015c8eSEdward Tomasz Napierala char *field, *qualifier_field; 208aa015c8eSEdward Tomasz Napierala 209aa015c8eSEdward Tomasz Napierala error = acl_create_entry(&aclp, &entry); 210aa015c8eSEdward Tomasz Napierala if (error) 211aa015c8eSEdward Tomasz Napierala return (error); 212aa015c8eSEdward Tomasz Napierala 213aa015c8eSEdward Tomasz Napierala assert(_entry_brand(entry) == ACL_BRAND_NFS4); 214aa015c8eSEdward Tomasz Napierala 215aa015c8eSEdward Tomasz Napierala if (str == NULL) 216aa015c8eSEdward Tomasz Napierala goto truncated_entry; 217aa015c8eSEdward Tomasz Napierala field = strsep(&str, ":"); 218aa015c8eSEdward Tomasz Napierala 219aa015c8eSEdward Tomasz Napierala field = string_skip_whitespace(field); 220aa015c8eSEdward Tomasz Napierala if ((*field == '\0') && (!str)) { 221aa015c8eSEdward Tomasz Napierala /* 222aa015c8eSEdward Tomasz Napierala * Is an entirely comment line, skip to next 223aa015c8eSEdward Tomasz Napierala * comma. 224aa015c8eSEdward Tomasz Napierala */ 225aa015c8eSEdward Tomasz Napierala return (0); 226aa015c8eSEdward Tomasz Napierala } 227aa015c8eSEdward Tomasz Napierala 228aa015c8eSEdward Tomasz Napierala error = parse_tag(field, entry, &need_qualifier); 229aa015c8eSEdward Tomasz Napierala if (error) 230aa015c8eSEdward Tomasz Napierala goto malformed_field; 231aa015c8eSEdward Tomasz Napierala 232aa015c8eSEdward Tomasz Napierala if (need_qualifier) { 233aa015c8eSEdward Tomasz Napierala if (str == NULL) 234aa015c8eSEdward Tomasz Napierala goto truncated_entry; 235aa015c8eSEdward Tomasz Napierala qualifier_field = field = strsep(&str, ":"); 236aa015c8eSEdward Tomasz Napierala error = parse_qualifier(field, entry, &need_qualifier); 237aa015c8eSEdward Tomasz Napierala if (error) 238aa015c8eSEdward Tomasz Napierala goto malformed_field; 239aa015c8eSEdward Tomasz Napierala } 240aa015c8eSEdward Tomasz Napierala 241aa015c8eSEdward Tomasz Napierala if (str == NULL) 242aa015c8eSEdward Tomasz Napierala goto truncated_entry; 243aa015c8eSEdward Tomasz Napierala field = strsep(&str, ":"); 244aa015c8eSEdward Tomasz Napierala error = parse_access_mask(field, entry); 245aa015c8eSEdward Tomasz Napierala if (error) 246aa015c8eSEdward Tomasz Napierala goto malformed_field; 247aa015c8eSEdward Tomasz Napierala 248aa015c8eSEdward Tomasz Napierala if (str == NULL) 249aa015c8eSEdward Tomasz Napierala goto truncated_entry; 250aa015c8eSEdward Tomasz Napierala /* Do we have "flags" field? */ 251aa015c8eSEdward Tomasz Napierala if (number_of_colons(str) > 0) { 252aa015c8eSEdward Tomasz Napierala field = strsep(&str, ":"); 253aa015c8eSEdward Tomasz Napierala error = parse_flags(field, entry); 254aa015c8eSEdward Tomasz Napierala if (error) 255aa015c8eSEdward Tomasz Napierala goto malformed_field; 256aa015c8eSEdward Tomasz Napierala } 257aa015c8eSEdward Tomasz Napierala 258aa015c8eSEdward Tomasz Napierala if (str == NULL) 259aa015c8eSEdward Tomasz Napierala goto truncated_entry; 260aa015c8eSEdward Tomasz Napierala field = strsep(&str, ":"); 261aa015c8eSEdward Tomasz Napierala error = parse_entry_type(field, entry); 262aa015c8eSEdward Tomasz Napierala if (error) 263aa015c8eSEdward Tomasz Napierala goto malformed_field; 264aa015c8eSEdward Tomasz Napierala 265aa015c8eSEdward Tomasz Napierala if (need_qualifier) { 266aa015c8eSEdward Tomasz Napierala if (str == NULL) { 267aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: unknown user or group name " 268aa015c8eSEdward Tomasz Napierala "\"%s\"", qualifier_field); 269aa015c8eSEdward Tomasz Napierala goto truncated_entry; 270aa015c8eSEdward Tomasz Napierala } 271aa015c8eSEdward Tomasz Napierala 272aa015c8eSEdward Tomasz Napierala error = parse_appended_id(str, entry); 273aa015c8eSEdward Tomasz Napierala if (error) 274aa015c8eSEdward Tomasz Napierala goto malformed_field; 275aa015c8eSEdward Tomasz Napierala } 276aa015c8eSEdward Tomasz Napierala 277aa015c8eSEdward Tomasz Napierala return (0); 278aa015c8eSEdward Tomasz Napierala 279aa015c8eSEdward Tomasz Napierala truncated_entry: 280aa015c8eSEdward Tomasz Napierala malformed_field: 281aa015c8eSEdward Tomasz Napierala acl_delete_entry(aclp, entry); 282aa015c8eSEdward Tomasz Napierala errno = EINVAL; 283aa015c8eSEdward Tomasz Napierala return (-1); 284aa015c8eSEdward Tomasz Napierala } 285