1aa015c8eSEdward Tomasz Napierala /*- 2d915a14eSPedro F. Giffuni * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3d915a14eSPedro F. Giffuni * 4aa015c8eSEdward Tomasz Napierala * Copyright (c) 2008, 2009 Edward Tomasz Napierała <trasz@FreeBSD.org> 5aa015c8eSEdward Tomasz Napierala * All rights reserved. 6aa015c8eSEdward Tomasz Napierala * 7aa015c8eSEdward Tomasz Napierala * Redistribution and use in source and binary forms, with or without 8aa015c8eSEdward Tomasz Napierala * modification, are permitted provided that the following conditions 9aa015c8eSEdward Tomasz Napierala * are met: 10aa015c8eSEdward Tomasz Napierala * 1. Redistributions of source code must retain the above copyright 11aa015c8eSEdward Tomasz Napierala * notice, this list of conditions and the following disclaimer. 12aa015c8eSEdward Tomasz Napierala * 2. Redistributions in binary form must reproduce the above copyright 13aa015c8eSEdward Tomasz Napierala * notice, this list of conditions and the following disclaimer in the 14aa015c8eSEdward Tomasz Napierala * documentation and/or other materials provided with the distribution. 15aa015c8eSEdward Tomasz Napierala * 16aa015c8eSEdward Tomasz Napierala * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17aa015c8eSEdward Tomasz Napierala * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18aa015c8eSEdward Tomasz Napierala * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19aa015c8eSEdward Tomasz Napierala * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20aa015c8eSEdward Tomasz Napierala * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21aa015c8eSEdward Tomasz Napierala * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22aa015c8eSEdward Tomasz Napierala * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23aa015c8eSEdward Tomasz Napierala * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24aa015c8eSEdward Tomasz Napierala * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25aa015c8eSEdward Tomasz Napierala * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26aa015c8eSEdward Tomasz Napierala * SUCH DAMAGE. 27aa015c8eSEdward Tomasz Napierala */ 28aa015c8eSEdward Tomasz Napierala 29aa015c8eSEdward Tomasz Napierala #include <sys/cdefs.h> 30aa015c8eSEdward Tomasz Napierala __FBSDID("$FreeBSD$"); 31aa015c8eSEdward Tomasz Napierala 32aa015c8eSEdward Tomasz Napierala #include <stdio.h> 33aa015c8eSEdward Tomasz Napierala #include <stdlib.h> 34aa015c8eSEdward Tomasz Napierala #include <unistd.h> 35aa015c8eSEdward Tomasz Napierala #include <errno.h> 36aa015c8eSEdward Tomasz Napierala #include <assert.h> 37aa015c8eSEdward Tomasz Napierala #include <string.h> 38aa015c8eSEdward Tomasz Napierala #include <pwd.h> 39aa015c8eSEdward Tomasz Napierala #include <grp.h> 40aa015c8eSEdward Tomasz Napierala #include <ctype.h> 41aa015c8eSEdward Tomasz Napierala #include <err.h> 42aa015c8eSEdward Tomasz Napierala #include <sys/syscall.h> 43aa015c8eSEdward Tomasz Napierala #include <sys/types.h> 44aa015c8eSEdward Tomasz Napierala #include <sys/acl.h> 45aa015c8eSEdward Tomasz Napierala 46aa015c8eSEdward Tomasz Napierala #include "acl_support.h" 47aa015c8eSEdward Tomasz Napierala 48aa015c8eSEdward Tomasz Napierala #define MAX_ENTRY_LENGTH 512 49aa015c8eSEdward Tomasz Napierala 50aa015c8eSEdward Tomasz Napierala /* 51aa015c8eSEdward Tomasz Napierala * Parse the tag field of ACL entry passed as "str". If qualifier 52aa015c8eSEdward Tomasz Napierala * needs to follow, then the variable referenced by "need_qualifier" 53aa015c8eSEdward Tomasz Napierala * is set to 1, otherwise it's set to 0. 54aa015c8eSEdward Tomasz Napierala */ 55aa015c8eSEdward Tomasz Napierala static int 56aa015c8eSEdward Tomasz Napierala parse_tag(const char *str, acl_entry_t entry, int *need_qualifier) 57aa015c8eSEdward Tomasz Napierala { 58aa015c8eSEdward Tomasz Napierala 59aa015c8eSEdward Tomasz Napierala assert(need_qualifier != NULL); 60aa015c8eSEdward Tomasz Napierala *need_qualifier = 0; 61aa015c8eSEdward Tomasz Napierala 62aa015c8eSEdward Tomasz Napierala if (strcmp(str, "owner@") == 0) 63aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_USER_OBJ)); 64aa015c8eSEdward Tomasz Napierala if (strcmp(str, "group@") == 0) 65aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_GROUP_OBJ)); 66aa015c8eSEdward Tomasz Napierala if (strcmp(str, "everyone@") == 0) 67aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_EVERYONE)); 68aa015c8eSEdward Tomasz Napierala 69aa015c8eSEdward Tomasz Napierala *need_qualifier = 1; 70aa015c8eSEdward Tomasz Napierala 71aa015c8eSEdward Tomasz Napierala if (strcmp(str, "user") == 0 || strcmp(str, "u") == 0) 72aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_USER)); 73aa015c8eSEdward Tomasz Napierala if (strcmp(str, "group") == 0 || strcmp(str, "g") == 0) 74aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_GROUP)); 75aa015c8eSEdward Tomasz Napierala 76aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: invalid \"tag\" field"); 77aa015c8eSEdward Tomasz Napierala 78aa015c8eSEdward Tomasz Napierala return (-1); 79aa015c8eSEdward Tomasz Napierala } 80aa015c8eSEdward Tomasz Napierala 81aa015c8eSEdward Tomasz Napierala /* 82aa015c8eSEdward Tomasz Napierala * Parse the qualifier field of ACL entry passed as "str". 83aa015c8eSEdward Tomasz Napierala * If user or group name cannot be resolved, then the variable 84f59646c2SEdward Tomasz Napierala * referenced by "need_qualifier" is set to 1; it will be checked 85f59646c2SEdward Tomasz Napierala * later to figure out whether the appended_id is required. 86aa015c8eSEdward Tomasz Napierala */ 87aa015c8eSEdward Tomasz Napierala static int 88aa015c8eSEdward Tomasz Napierala parse_qualifier(char *str, acl_entry_t entry, int *need_qualifier) 89aa015c8eSEdward Tomasz Napierala { 90aa015c8eSEdward Tomasz Napierala int qualifier_length, error; 91f59646c2SEdward Tomasz Napierala uid_t id; 92aa015c8eSEdward Tomasz Napierala acl_tag_t tag; 93aa015c8eSEdward Tomasz Napierala 94aa015c8eSEdward Tomasz Napierala assert(need_qualifier != NULL); 95aa015c8eSEdward Tomasz Napierala *need_qualifier = 0; 96aa015c8eSEdward Tomasz Napierala 97aa015c8eSEdward Tomasz Napierala qualifier_length = strlen(str); 98aa015c8eSEdward Tomasz Napierala 99aa015c8eSEdward Tomasz Napierala if (qualifier_length == 0) { 100aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: empty \"qualifier\" field"); 101aa015c8eSEdward Tomasz Napierala return (-1); 102aa015c8eSEdward Tomasz Napierala } 103aa015c8eSEdward Tomasz Napierala 104aa015c8eSEdward Tomasz Napierala error = acl_get_tag_type(entry, &tag); 105aa015c8eSEdward Tomasz Napierala if (error) 106aa015c8eSEdward Tomasz Napierala return (error); 107aa015c8eSEdward Tomasz Napierala 108f59646c2SEdward Tomasz Napierala error = _acl_name_to_id(tag, str, &id); 109f59646c2SEdward Tomasz Napierala if (error) { 110aa015c8eSEdward Tomasz Napierala *need_qualifier = 1; 111aa015c8eSEdward Tomasz Napierala return (0); 112aa015c8eSEdward Tomasz Napierala } 113aa015c8eSEdward Tomasz Napierala 114f59646c2SEdward Tomasz Napierala return (acl_set_qualifier(entry, &id)); 115aa015c8eSEdward Tomasz Napierala } 116aa015c8eSEdward Tomasz Napierala 117aa015c8eSEdward Tomasz Napierala static int 118aa015c8eSEdward Tomasz Napierala parse_access_mask(char *str, acl_entry_t entry) 119aa015c8eSEdward Tomasz Napierala { 120aa015c8eSEdward Tomasz Napierala int error; 121aa015c8eSEdward Tomasz Napierala acl_perm_t perm; 122aa015c8eSEdward Tomasz Napierala 123aa015c8eSEdward Tomasz Napierala error = _nfs4_parse_access_mask(str, &perm); 124aa015c8eSEdward Tomasz Napierala if (error) 125aa015c8eSEdward Tomasz Napierala return (error); 126aa015c8eSEdward Tomasz Napierala 127aa015c8eSEdward Tomasz Napierala error = acl_set_permset(entry, &perm); 128aa015c8eSEdward Tomasz Napierala 129aa015c8eSEdward Tomasz Napierala return (error); 130aa015c8eSEdward Tomasz Napierala } 131aa015c8eSEdward Tomasz Napierala 132aa015c8eSEdward Tomasz Napierala static int 133aa015c8eSEdward Tomasz Napierala parse_flags(char *str, acl_entry_t entry) 134aa015c8eSEdward Tomasz Napierala { 135aa015c8eSEdward Tomasz Napierala int error; 136aa015c8eSEdward Tomasz Napierala acl_flag_t flags; 137aa015c8eSEdward Tomasz Napierala 138aa015c8eSEdward Tomasz Napierala error = _nfs4_parse_flags(str, &flags); 139aa015c8eSEdward Tomasz Napierala if (error) 140aa015c8eSEdward Tomasz Napierala return (error); 141aa015c8eSEdward Tomasz Napierala 142aa015c8eSEdward Tomasz Napierala error = acl_set_flagset_np(entry, &flags); 143aa015c8eSEdward Tomasz Napierala 144aa015c8eSEdward Tomasz Napierala return (error); 145aa015c8eSEdward Tomasz Napierala } 146aa015c8eSEdward Tomasz Napierala 147aa015c8eSEdward Tomasz Napierala static int 148aa015c8eSEdward Tomasz Napierala parse_entry_type(const char *str, acl_entry_t entry) 149aa015c8eSEdward Tomasz Napierala { 150aa015c8eSEdward Tomasz Napierala 151aa015c8eSEdward Tomasz Napierala if (strcmp(str, "allow") == 0) 152aa015c8eSEdward Tomasz Napierala return (acl_set_entry_type_np(entry, ACL_ENTRY_TYPE_ALLOW)); 153aa015c8eSEdward Tomasz Napierala if (strcmp(str, "deny") == 0) 154aa015c8eSEdward Tomasz Napierala return (acl_set_entry_type_np(entry, ACL_ENTRY_TYPE_DENY)); 155aa015c8eSEdward Tomasz Napierala if (strcmp(str, "audit") == 0) 156aa015c8eSEdward Tomasz Napierala return (acl_set_entry_type_np(entry, ACL_ENTRY_TYPE_AUDIT)); 157aa015c8eSEdward Tomasz Napierala if (strcmp(str, "alarm") == 0) 158aa015c8eSEdward Tomasz Napierala return (acl_set_entry_type_np(entry, ACL_ENTRY_TYPE_ALARM)); 159aa015c8eSEdward Tomasz Napierala 160aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: invalid \"type\" field"); 161aa015c8eSEdward Tomasz Napierala 162aa015c8eSEdward Tomasz Napierala return (-1); 163aa015c8eSEdward Tomasz Napierala } 164aa015c8eSEdward Tomasz Napierala 165aa015c8eSEdward Tomasz Napierala static int 166aa015c8eSEdward Tomasz Napierala parse_appended_id(char *str, acl_entry_t entry) 167aa015c8eSEdward Tomasz Napierala { 168aa015c8eSEdward Tomasz Napierala int qualifier_length; 169aa015c8eSEdward Tomasz Napierala char *end; 170aa015c8eSEdward Tomasz Napierala id_t id; 171aa015c8eSEdward Tomasz Napierala 172aa015c8eSEdward Tomasz Napierala qualifier_length = strlen(str); 173aa015c8eSEdward Tomasz Napierala if (qualifier_length == 0) { 174aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: \"appended id\" field present, " 175aa015c8eSEdward Tomasz Napierala "but empty"); 176aa015c8eSEdward Tomasz Napierala return (-1); 177aa015c8eSEdward Tomasz Napierala } 178aa015c8eSEdward Tomasz Napierala 179aa015c8eSEdward Tomasz Napierala id = strtod(str, &end); 180aa015c8eSEdward Tomasz Napierala if (end - str != qualifier_length) { 181aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: appended id is not a number"); 182aa015c8eSEdward Tomasz Napierala return (-1); 183aa015c8eSEdward Tomasz Napierala } 184aa015c8eSEdward Tomasz Napierala 185aa015c8eSEdward Tomasz Napierala return (acl_set_qualifier(entry, &id)); 186aa015c8eSEdward Tomasz Napierala } 187aa015c8eSEdward Tomasz Napierala 188aa015c8eSEdward Tomasz Napierala static int 189aa015c8eSEdward Tomasz Napierala number_of_colons(const char *str) 190aa015c8eSEdward Tomasz Napierala { 191aa015c8eSEdward Tomasz Napierala int count = 0; 192aa015c8eSEdward Tomasz Napierala 193aa015c8eSEdward Tomasz Napierala while (*str != '\0') { 194aa015c8eSEdward Tomasz Napierala if (*str == ':') 195aa015c8eSEdward Tomasz Napierala count++; 196aa015c8eSEdward Tomasz Napierala 197aa015c8eSEdward Tomasz Napierala str++; 198aa015c8eSEdward Tomasz Napierala } 199aa015c8eSEdward Tomasz Napierala 200aa015c8eSEdward Tomasz Napierala return (count); 201aa015c8eSEdward Tomasz Napierala } 202aa015c8eSEdward Tomasz Napierala 203aa015c8eSEdward Tomasz Napierala int 204aa015c8eSEdward Tomasz Napierala _nfs4_acl_entry_from_text(acl_t aclp, char *str) 205aa015c8eSEdward Tomasz Napierala { 206aa015c8eSEdward Tomasz Napierala int error, need_qualifier; 207aa015c8eSEdward Tomasz Napierala acl_entry_t entry; 208aa015c8eSEdward Tomasz Napierala char *field, *qualifier_field; 209aa015c8eSEdward Tomasz Napierala 210aa015c8eSEdward Tomasz Napierala error = acl_create_entry(&aclp, &entry); 211aa015c8eSEdward Tomasz Napierala if (error) 212aa015c8eSEdward Tomasz Napierala return (error); 213aa015c8eSEdward Tomasz Napierala 214aa015c8eSEdward Tomasz Napierala assert(_entry_brand(entry) == ACL_BRAND_NFS4); 215aa015c8eSEdward Tomasz Napierala 216aa015c8eSEdward Tomasz Napierala if (str == NULL) 217aa015c8eSEdward Tomasz Napierala goto truncated_entry; 218aa015c8eSEdward Tomasz Napierala field = strsep(&str, ":"); 219aa015c8eSEdward Tomasz Napierala 220aa015c8eSEdward Tomasz Napierala field = string_skip_whitespace(field); 221aa015c8eSEdward Tomasz Napierala if ((*field == '\0') && (!str)) { 222aa015c8eSEdward Tomasz Napierala /* 223aa015c8eSEdward Tomasz Napierala * Is an entirely comment line, skip to next 224aa015c8eSEdward Tomasz Napierala * comma. 225aa015c8eSEdward Tomasz Napierala */ 226aa015c8eSEdward Tomasz Napierala return (0); 227aa015c8eSEdward Tomasz Napierala } 228aa015c8eSEdward Tomasz Napierala 229aa015c8eSEdward Tomasz Napierala error = parse_tag(field, entry, &need_qualifier); 230aa015c8eSEdward Tomasz Napierala if (error) 231aa015c8eSEdward Tomasz Napierala goto malformed_field; 232aa015c8eSEdward Tomasz Napierala 233aa015c8eSEdward Tomasz Napierala if (need_qualifier) { 234aa015c8eSEdward Tomasz Napierala if (str == NULL) 235aa015c8eSEdward Tomasz Napierala goto truncated_entry; 236aa015c8eSEdward Tomasz Napierala qualifier_field = field = strsep(&str, ":"); 237aa015c8eSEdward Tomasz Napierala error = parse_qualifier(field, entry, &need_qualifier); 238aa015c8eSEdward Tomasz Napierala if (error) 239aa015c8eSEdward Tomasz Napierala goto malformed_field; 240aa015c8eSEdward Tomasz Napierala } 241aa015c8eSEdward Tomasz Napierala 242aa015c8eSEdward Tomasz Napierala if (str == NULL) 243aa015c8eSEdward Tomasz Napierala goto truncated_entry; 244aa015c8eSEdward Tomasz Napierala field = strsep(&str, ":"); 245aa015c8eSEdward Tomasz Napierala error = parse_access_mask(field, entry); 246aa015c8eSEdward Tomasz Napierala if (error) 247aa015c8eSEdward Tomasz Napierala goto malformed_field; 248aa015c8eSEdward Tomasz Napierala 249aa015c8eSEdward Tomasz Napierala if (str == NULL) 250aa015c8eSEdward Tomasz Napierala goto truncated_entry; 251aa015c8eSEdward Tomasz Napierala /* Do we have "flags" field? */ 252aa015c8eSEdward Tomasz Napierala if (number_of_colons(str) > 0) { 253aa015c8eSEdward Tomasz Napierala field = strsep(&str, ":"); 254aa015c8eSEdward Tomasz Napierala error = parse_flags(field, entry); 255aa015c8eSEdward Tomasz Napierala if (error) 256aa015c8eSEdward Tomasz Napierala goto malformed_field; 257aa015c8eSEdward Tomasz Napierala } 258aa015c8eSEdward Tomasz Napierala 259aa015c8eSEdward Tomasz Napierala if (str == NULL) 260aa015c8eSEdward Tomasz Napierala goto truncated_entry; 261aa015c8eSEdward Tomasz Napierala field = strsep(&str, ":"); 262aa015c8eSEdward Tomasz Napierala error = parse_entry_type(field, entry); 263aa015c8eSEdward Tomasz Napierala if (error) 264aa015c8eSEdward Tomasz Napierala goto malformed_field; 265aa015c8eSEdward Tomasz Napierala 266aa015c8eSEdward Tomasz Napierala if (need_qualifier) { 267aa015c8eSEdward Tomasz Napierala if (str == NULL) { 268aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: unknown user or group name " 269aa015c8eSEdward Tomasz Napierala "\"%s\"", qualifier_field); 270aa015c8eSEdward Tomasz Napierala goto truncated_entry; 271aa015c8eSEdward Tomasz Napierala } 272aa015c8eSEdward Tomasz Napierala 273aa015c8eSEdward Tomasz Napierala error = parse_appended_id(str, entry); 274aa015c8eSEdward Tomasz Napierala if (error) 275aa015c8eSEdward Tomasz Napierala goto malformed_field; 276aa015c8eSEdward Tomasz Napierala } 277aa015c8eSEdward Tomasz Napierala 278aa015c8eSEdward Tomasz Napierala return (0); 279aa015c8eSEdward Tomasz Napierala 280aa015c8eSEdward Tomasz Napierala truncated_entry: 281aa015c8eSEdward Tomasz Napierala malformed_field: 282aa015c8eSEdward Tomasz Napierala acl_delete_entry(aclp, entry); 283aa015c8eSEdward Tomasz Napierala errno = EINVAL; 284aa015c8eSEdward Tomasz Napierala return (-1); 285aa015c8eSEdward Tomasz Napierala } 286