1aa015c8eSEdward Tomasz Napierala /*- 2aa015c8eSEdward Tomasz Napierala * Copyright (c) 2008, 2009 Edward Tomasz Napierała <trasz@FreeBSD.org> 3aa015c8eSEdward Tomasz Napierala * All rights reserved. 4aa015c8eSEdward Tomasz Napierala * 5aa015c8eSEdward Tomasz Napierala * Redistribution and use in source and binary forms, with or without 6aa015c8eSEdward Tomasz Napierala * modification, are permitted provided that the following conditions 7aa015c8eSEdward Tomasz Napierala * are met: 8aa015c8eSEdward Tomasz Napierala * 1. Redistributions of source code must retain the above copyright 9aa015c8eSEdward Tomasz Napierala * notice, this list of conditions and the following disclaimer. 10aa015c8eSEdward Tomasz Napierala * 2. Redistributions in binary form must reproduce the above copyright 11aa015c8eSEdward Tomasz Napierala * notice, this list of conditions and the following disclaimer in the 12aa015c8eSEdward Tomasz Napierala * documentation and/or other materials provided with the distribution. 13aa015c8eSEdward Tomasz Napierala * 14aa015c8eSEdward Tomasz Napierala * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15aa015c8eSEdward Tomasz Napierala * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16aa015c8eSEdward Tomasz Napierala * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17aa015c8eSEdward Tomasz Napierala * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18aa015c8eSEdward Tomasz Napierala * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19aa015c8eSEdward Tomasz Napierala * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20aa015c8eSEdward Tomasz Napierala * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21aa015c8eSEdward Tomasz Napierala * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22aa015c8eSEdward Tomasz Napierala * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23aa015c8eSEdward Tomasz Napierala * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24aa015c8eSEdward Tomasz Napierala * SUCH DAMAGE. 25aa015c8eSEdward Tomasz Napierala */ 26aa015c8eSEdward Tomasz Napierala 27aa015c8eSEdward Tomasz Napierala #include <sys/cdefs.h> 28aa015c8eSEdward Tomasz Napierala __FBSDID("$FreeBSD$"); 29aa015c8eSEdward Tomasz Napierala 30aa015c8eSEdward Tomasz Napierala #include <stdio.h> 31aa015c8eSEdward Tomasz Napierala #include <stdlib.h> 32aa015c8eSEdward Tomasz Napierala #include <unistd.h> 33aa015c8eSEdward Tomasz Napierala #include <errno.h> 34aa015c8eSEdward Tomasz Napierala #include <assert.h> 35aa015c8eSEdward Tomasz Napierala #include <string.h> 36aa015c8eSEdward Tomasz Napierala #include <pwd.h> 37aa015c8eSEdward Tomasz Napierala #include <grp.h> 38aa015c8eSEdward Tomasz Napierala #include <ctype.h> 39aa015c8eSEdward Tomasz Napierala #include <err.h> 40aa015c8eSEdward Tomasz Napierala #include <sys/syscall.h> 41aa015c8eSEdward Tomasz Napierala #include <sys/types.h> 42aa015c8eSEdward Tomasz Napierala #include <sys/acl.h> 43aa015c8eSEdward Tomasz Napierala 44aa015c8eSEdward Tomasz Napierala #include "acl_support.h" 45aa015c8eSEdward Tomasz Napierala 46aa015c8eSEdward Tomasz Napierala #define MAX_ENTRY_LENGTH 512 47aa015c8eSEdward Tomasz Napierala 48aa015c8eSEdward Tomasz Napierala /* 49aa015c8eSEdward Tomasz Napierala * Parse the tag field of ACL entry passed as "str". If qualifier 50aa015c8eSEdward Tomasz Napierala * needs to follow, then the variable referenced by "need_qualifier" 51aa015c8eSEdward Tomasz Napierala * is set to 1, otherwise it's set to 0. 52aa015c8eSEdward Tomasz Napierala */ 53aa015c8eSEdward Tomasz Napierala static int 54aa015c8eSEdward Tomasz Napierala parse_tag(const char *str, acl_entry_t entry, int *need_qualifier) 55aa015c8eSEdward Tomasz Napierala { 56aa015c8eSEdward Tomasz Napierala 57aa015c8eSEdward Tomasz Napierala assert(need_qualifier != NULL); 58aa015c8eSEdward Tomasz Napierala *need_qualifier = 0; 59aa015c8eSEdward Tomasz Napierala 60aa015c8eSEdward Tomasz Napierala if (strcmp(str, "owner@") == 0) 61aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_USER_OBJ)); 62aa015c8eSEdward Tomasz Napierala if (strcmp(str, "group@") == 0) 63aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_GROUP_OBJ)); 64aa015c8eSEdward Tomasz Napierala if (strcmp(str, "everyone@") == 0) 65aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_EVERYONE)); 66aa015c8eSEdward Tomasz Napierala 67aa015c8eSEdward Tomasz Napierala *need_qualifier = 1; 68aa015c8eSEdward Tomasz Napierala 69aa015c8eSEdward Tomasz Napierala if (strcmp(str, "user") == 0 || strcmp(str, "u") == 0) 70aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_USER)); 71aa015c8eSEdward Tomasz Napierala if (strcmp(str, "group") == 0 || strcmp(str, "g") == 0) 72aa015c8eSEdward Tomasz Napierala return (acl_set_tag_type(entry, ACL_GROUP)); 73aa015c8eSEdward Tomasz Napierala 74aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: invalid \"tag\" field"); 75aa015c8eSEdward Tomasz Napierala 76aa015c8eSEdward Tomasz Napierala return (-1); 77aa015c8eSEdward Tomasz Napierala } 78aa015c8eSEdward Tomasz Napierala 79aa015c8eSEdward Tomasz Napierala /* 80aa015c8eSEdward Tomasz Napierala * Parse the qualifier field of ACL entry passed as "str". 81aa015c8eSEdward Tomasz Napierala * If user or group name cannot be resolved, then the variable 82f59646c2SEdward Tomasz Napierala * referenced by "need_qualifier" is set to 1; it will be checked 83f59646c2SEdward Tomasz Napierala * later to figure out whether the appended_id is required. 84aa015c8eSEdward Tomasz Napierala */ 85aa015c8eSEdward Tomasz Napierala static int 86aa015c8eSEdward Tomasz Napierala parse_qualifier(char *str, acl_entry_t entry, int *need_qualifier) 87aa015c8eSEdward Tomasz Napierala { 88aa015c8eSEdward Tomasz Napierala int qualifier_length, error; 89f59646c2SEdward Tomasz Napierala uid_t id; 90aa015c8eSEdward Tomasz Napierala acl_tag_t tag; 91aa015c8eSEdward Tomasz Napierala 92aa015c8eSEdward Tomasz Napierala assert(need_qualifier != NULL); 93aa015c8eSEdward Tomasz Napierala *need_qualifier = 0; 94aa015c8eSEdward Tomasz Napierala 95aa015c8eSEdward Tomasz Napierala qualifier_length = strlen(str); 96aa015c8eSEdward Tomasz Napierala 97aa015c8eSEdward Tomasz Napierala if (qualifier_length == 0) { 98aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: empty \"qualifier\" field"); 99aa015c8eSEdward Tomasz Napierala return (-1); 100aa015c8eSEdward Tomasz Napierala } 101aa015c8eSEdward Tomasz Napierala 102aa015c8eSEdward Tomasz Napierala error = acl_get_tag_type(entry, &tag); 103aa015c8eSEdward Tomasz Napierala if (error) 104aa015c8eSEdward Tomasz Napierala return (error); 105aa015c8eSEdward Tomasz Napierala 106f59646c2SEdward Tomasz Napierala error = _acl_name_to_id(tag, str, &id); 107f59646c2SEdward Tomasz Napierala if (error) { 108aa015c8eSEdward Tomasz Napierala *need_qualifier = 1; 109aa015c8eSEdward Tomasz Napierala return (0); 110aa015c8eSEdward Tomasz Napierala } 111aa015c8eSEdward Tomasz Napierala 112f59646c2SEdward Tomasz Napierala return (acl_set_qualifier(entry, &id)); 113aa015c8eSEdward Tomasz Napierala } 114aa015c8eSEdward Tomasz Napierala 115aa015c8eSEdward Tomasz Napierala static int 116aa015c8eSEdward Tomasz Napierala parse_access_mask(char *str, acl_entry_t entry) 117aa015c8eSEdward Tomasz Napierala { 118aa015c8eSEdward Tomasz Napierala int error; 119aa015c8eSEdward Tomasz Napierala acl_perm_t perm; 120aa015c8eSEdward Tomasz Napierala 121aa015c8eSEdward Tomasz Napierala error = _nfs4_parse_access_mask(str, &perm); 122aa015c8eSEdward Tomasz Napierala if (error) 123aa015c8eSEdward Tomasz Napierala return (error); 124aa015c8eSEdward Tomasz Napierala 125aa015c8eSEdward Tomasz Napierala error = acl_set_permset(entry, &perm); 126aa015c8eSEdward Tomasz Napierala 127aa015c8eSEdward Tomasz Napierala return (error); 128aa015c8eSEdward Tomasz Napierala } 129aa015c8eSEdward Tomasz Napierala 130aa015c8eSEdward Tomasz Napierala static int 131aa015c8eSEdward Tomasz Napierala parse_flags(char *str, acl_entry_t entry) 132aa015c8eSEdward Tomasz Napierala { 133aa015c8eSEdward Tomasz Napierala int error; 134aa015c8eSEdward Tomasz Napierala acl_flag_t flags; 135aa015c8eSEdward Tomasz Napierala 136aa015c8eSEdward Tomasz Napierala error = _nfs4_parse_flags(str, &flags); 137aa015c8eSEdward Tomasz Napierala if (error) 138aa015c8eSEdward Tomasz Napierala return (error); 139aa015c8eSEdward Tomasz Napierala 140aa015c8eSEdward Tomasz Napierala error = acl_set_flagset_np(entry, &flags); 141aa015c8eSEdward Tomasz Napierala 142aa015c8eSEdward Tomasz Napierala return (error); 143aa015c8eSEdward Tomasz Napierala } 144aa015c8eSEdward Tomasz Napierala 145aa015c8eSEdward Tomasz Napierala static int 146aa015c8eSEdward Tomasz Napierala parse_entry_type(const char *str, acl_entry_t entry) 147aa015c8eSEdward Tomasz Napierala { 148aa015c8eSEdward Tomasz Napierala 149aa015c8eSEdward Tomasz Napierala if (strcmp(str, "allow") == 0) 150aa015c8eSEdward Tomasz Napierala return (acl_set_entry_type_np(entry, ACL_ENTRY_TYPE_ALLOW)); 151aa015c8eSEdward Tomasz Napierala if (strcmp(str, "deny") == 0) 152aa015c8eSEdward Tomasz Napierala return (acl_set_entry_type_np(entry, ACL_ENTRY_TYPE_DENY)); 153aa015c8eSEdward Tomasz Napierala if (strcmp(str, "audit") == 0) 154aa015c8eSEdward Tomasz Napierala return (acl_set_entry_type_np(entry, ACL_ENTRY_TYPE_AUDIT)); 155aa015c8eSEdward Tomasz Napierala if (strcmp(str, "alarm") == 0) 156aa015c8eSEdward Tomasz Napierala return (acl_set_entry_type_np(entry, ACL_ENTRY_TYPE_ALARM)); 157aa015c8eSEdward Tomasz Napierala 158aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: invalid \"type\" field"); 159aa015c8eSEdward Tomasz Napierala 160aa015c8eSEdward Tomasz Napierala return (-1); 161aa015c8eSEdward Tomasz Napierala } 162aa015c8eSEdward Tomasz Napierala 163aa015c8eSEdward Tomasz Napierala static int 164aa015c8eSEdward Tomasz Napierala parse_appended_id(char *str, acl_entry_t entry) 165aa015c8eSEdward Tomasz Napierala { 166aa015c8eSEdward Tomasz Napierala int qualifier_length; 167aa015c8eSEdward Tomasz Napierala char *end; 168aa015c8eSEdward Tomasz Napierala id_t id; 169aa015c8eSEdward Tomasz Napierala 170aa015c8eSEdward Tomasz Napierala qualifier_length = strlen(str); 171aa015c8eSEdward Tomasz Napierala if (qualifier_length == 0) { 172aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: \"appended id\" field present, " 173aa015c8eSEdward Tomasz Napierala "but empty"); 174aa015c8eSEdward Tomasz Napierala return (-1); 175aa015c8eSEdward Tomasz Napierala } 176aa015c8eSEdward Tomasz Napierala 177aa015c8eSEdward Tomasz Napierala id = strtod(str, &end); 178aa015c8eSEdward Tomasz Napierala if (end - str != qualifier_length) { 179aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: appended id is not a number"); 180aa015c8eSEdward Tomasz Napierala return (-1); 181aa015c8eSEdward Tomasz Napierala } 182aa015c8eSEdward Tomasz Napierala 183aa015c8eSEdward Tomasz Napierala return (acl_set_qualifier(entry, &id)); 184aa015c8eSEdward Tomasz Napierala } 185aa015c8eSEdward Tomasz Napierala 186aa015c8eSEdward Tomasz Napierala static int 187aa015c8eSEdward Tomasz Napierala number_of_colons(const char *str) 188aa015c8eSEdward Tomasz Napierala { 189aa015c8eSEdward Tomasz Napierala int count = 0; 190aa015c8eSEdward Tomasz Napierala 191aa015c8eSEdward Tomasz Napierala while (*str != '\0') { 192aa015c8eSEdward Tomasz Napierala if (*str == ':') 193aa015c8eSEdward Tomasz Napierala count++; 194aa015c8eSEdward Tomasz Napierala 195aa015c8eSEdward Tomasz Napierala str++; 196aa015c8eSEdward Tomasz Napierala } 197aa015c8eSEdward Tomasz Napierala 198aa015c8eSEdward Tomasz Napierala return (count); 199aa015c8eSEdward Tomasz Napierala } 200aa015c8eSEdward Tomasz Napierala 201aa015c8eSEdward Tomasz Napierala int 202aa015c8eSEdward Tomasz Napierala _nfs4_acl_entry_from_text(acl_t aclp, char *str) 203aa015c8eSEdward Tomasz Napierala { 204aa015c8eSEdward Tomasz Napierala int error, need_qualifier; 205aa015c8eSEdward Tomasz Napierala acl_entry_t entry; 206aa015c8eSEdward Tomasz Napierala char *field, *qualifier_field; 207aa015c8eSEdward Tomasz Napierala 208aa015c8eSEdward Tomasz Napierala error = acl_create_entry(&aclp, &entry); 209aa015c8eSEdward Tomasz Napierala if (error) 210aa015c8eSEdward Tomasz Napierala return (error); 211aa015c8eSEdward Tomasz Napierala 212aa015c8eSEdward Tomasz Napierala assert(_entry_brand(entry) == ACL_BRAND_NFS4); 213aa015c8eSEdward Tomasz Napierala 214aa015c8eSEdward Tomasz Napierala if (str == NULL) 215aa015c8eSEdward Tomasz Napierala goto truncated_entry; 216aa015c8eSEdward Tomasz Napierala field = strsep(&str, ":"); 217aa015c8eSEdward Tomasz Napierala 218aa015c8eSEdward Tomasz Napierala field = string_skip_whitespace(field); 219aa015c8eSEdward Tomasz Napierala if ((*field == '\0') && (!str)) { 220aa015c8eSEdward Tomasz Napierala /* 221aa015c8eSEdward Tomasz Napierala * Is an entirely comment line, skip to next 222aa015c8eSEdward Tomasz Napierala * comma. 223aa015c8eSEdward Tomasz Napierala */ 224aa015c8eSEdward Tomasz Napierala return (0); 225aa015c8eSEdward Tomasz Napierala } 226aa015c8eSEdward Tomasz Napierala 227aa015c8eSEdward Tomasz Napierala error = parse_tag(field, entry, &need_qualifier); 228aa015c8eSEdward Tomasz Napierala if (error) 229aa015c8eSEdward Tomasz Napierala goto malformed_field; 230aa015c8eSEdward Tomasz Napierala 231aa015c8eSEdward Tomasz Napierala if (need_qualifier) { 232aa015c8eSEdward Tomasz Napierala if (str == NULL) 233aa015c8eSEdward Tomasz Napierala goto truncated_entry; 234aa015c8eSEdward Tomasz Napierala qualifier_field = field = strsep(&str, ":"); 235aa015c8eSEdward Tomasz Napierala error = parse_qualifier(field, entry, &need_qualifier); 236aa015c8eSEdward Tomasz Napierala if (error) 237aa015c8eSEdward Tomasz Napierala goto malformed_field; 238aa015c8eSEdward Tomasz Napierala } 239aa015c8eSEdward Tomasz Napierala 240aa015c8eSEdward Tomasz Napierala if (str == NULL) 241aa015c8eSEdward Tomasz Napierala goto truncated_entry; 242aa015c8eSEdward Tomasz Napierala field = strsep(&str, ":"); 243aa015c8eSEdward Tomasz Napierala error = parse_access_mask(field, entry); 244aa015c8eSEdward Tomasz Napierala if (error) 245aa015c8eSEdward Tomasz Napierala goto malformed_field; 246aa015c8eSEdward Tomasz Napierala 247aa015c8eSEdward Tomasz Napierala if (str == NULL) 248aa015c8eSEdward Tomasz Napierala goto truncated_entry; 249aa015c8eSEdward Tomasz Napierala /* Do we have "flags" field? */ 250aa015c8eSEdward Tomasz Napierala if (number_of_colons(str) > 0) { 251aa015c8eSEdward Tomasz Napierala field = strsep(&str, ":"); 252aa015c8eSEdward Tomasz Napierala error = parse_flags(field, entry); 253aa015c8eSEdward Tomasz Napierala if (error) 254aa015c8eSEdward Tomasz Napierala goto malformed_field; 255aa015c8eSEdward Tomasz Napierala } 256aa015c8eSEdward Tomasz Napierala 257aa015c8eSEdward Tomasz Napierala if (str == NULL) 258aa015c8eSEdward Tomasz Napierala goto truncated_entry; 259aa015c8eSEdward Tomasz Napierala field = strsep(&str, ":"); 260aa015c8eSEdward Tomasz Napierala error = parse_entry_type(field, entry); 261aa015c8eSEdward Tomasz Napierala if (error) 262aa015c8eSEdward Tomasz Napierala goto malformed_field; 263aa015c8eSEdward Tomasz Napierala 264aa015c8eSEdward Tomasz Napierala if (need_qualifier) { 265aa015c8eSEdward Tomasz Napierala if (str == NULL) { 266aa015c8eSEdward Tomasz Napierala warnx("malformed ACL: unknown user or group name " 267aa015c8eSEdward Tomasz Napierala "\"%s\"", qualifier_field); 268aa015c8eSEdward Tomasz Napierala goto truncated_entry; 269aa015c8eSEdward Tomasz Napierala } 270aa015c8eSEdward Tomasz Napierala 271aa015c8eSEdward Tomasz Napierala error = parse_appended_id(str, entry); 272aa015c8eSEdward Tomasz Napierala if (error) 273aa015c8eSEdward Tomasz Napierala goto malformed_field; 274aa015c8eSEdward Tomasz Napierala } 275aa015c8eSEdward Tomasz Napierala 276aa015c8eSEdward Tomasz Napierala return (0); 277aa015c8eSEdward Tomasz Napierala 278aa015c8eSEdward Tomasz Napierala truncated_entry: 279aa015c8eSEdward Tomasz Napierala malformed_field: 280aa015c8eSEdward Tomasz Napierala acl_delete_entry(aclp, entry); 281aa015c8eSEdward Tomasz Napierala errno = EINVAL; 282aa015c8eSEdward Tomasz Napierala return (-1); 283aa015c8eSEdward Tomasz Napierala } 284