1 /* 2 * security.h - Exports for handling security/ACLs in NTFS. 3 * Originated from the Linux-NTFS project. 4 * 5 * Copyright (c) 2004 Anton Altaparmakov 6 * Copyright (c) 2005-2006 Szabolcs Szakacsits 7 * Copyright (c) 2007-2008 Jean-Pierre Andre 8 * 9 * This program/include file is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License as published 11 * by the Free Software Foundation; either version 2 of the License, or 12 * (at your option) any later version. 13 * 14 * This program/include file is distributed in the hope that it will be 15 * useful, but WITHOUT ANY WARRANTY; without even the implied warranty 16 * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 17 * GNU General Public License for more details. 18 * 19 * You should have received a copy of the GNU General Public License 20 * along with this program (in the main directory of the NTFS-3G 21 * distribution in the file COPYING); if not, write to the Free Software 22 * Foundation,Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 23 */ 24 25 #ifndef _NTFS_SECURITY_H 26 #define _NTFS_SECURITY_H 27 28 #include "types.h" 29 #include "layout.h" 30 #include "inode.h" 31 #include "dir.h" 32 33 #ifndef POSIXACLS 34 #define POSIXACLS 0 35 #endif 36 37 typedef u16 be16; 38 typedef u32 be32; 39 40 #if __BYTE_ORDER == __LITTLE_ENDIAN 41 #define const_cpu_to_be16(x) ((((x) & 255L) << 8) + (((x) >> 8) & 255L)) 42 #define const_cpu_to_be32(x) ((((x) & 255L) << 24) + (((x) & 0xff00L) << 8) \ 43 + (((x) >> 8) & 0xff00L) + (((x) >> 24) & 255L)) 44 #else 45 #define const_cpu_to_be16(x) (x) 46 #define const_cpu_to_be32(x) (x) 47 #endif 48 49 /* 50 * item in the mapping list 51 */ 52 53 struct MAPPING { 54 struct MAPPING *next; 55 int xid; /* linux id : uid or gid */ 56 SID *sid; /* Windows id : usid or gsid */ 57 int grcnt; /* group count (for users only) */ 58 gid_t *groups; /* groups which the user is member of */ 59 }; 60 61 /* 62 * Entry in the permissions cache 63 * Note : this cache is not organized as a generic cache 64 */ 65 66 struct CACHED_PERMISSIONS { 67 uid_t uid; 68 gid_t gid; 69 le32 inh_fileid; 70 le32 inh_dirid; 71 #if POSIXACLS 72 struct POSIX_SECURITY *pxdesc; 73 unsigned int pxdescsize:16; 74 #endif 75 unsigned int mode:12; 76 unsigned int valid:1; 77 } ; 78 79 /* 80 * Entry in the permissions cache for directories with no security_id 81 */ 82 83 struct CACHED_PERMISSIONS_LEGACY { 84 struct CACHED_PERMISSIONS_LEGACY *next; 85 struct CACHED_PERMISSIONS_LEGACY *previous; 86 void *variable; 87 size_t varsize; 88 /* above fields must match "struct CACHED_GENERIC" */ 89 u64 mft_no; 90 struct CACHED_PERMISSIONS perm; 91 } ; 92 93 /* 94 * Entry in the securid cache 95 */ 96 97 struct CACHED_SECURID { 98 struct CACHED_SECURID *next; 99 struct CACHED_SECURID *previous; 100 void *variable; 101 size_t varsize; 102 /* above fields must match "struct CACHED_GENERIC" */ 103 uid_t uid; 104 gid_t gid; 105 unsigned int dmode; 106 le32 securid; 107 } ; 108 109 /* 110 * Header of the security cache 111 * (has no cache structure by itself) 112 */ 113 114 struct CACHED_PERMISSIONS_HEADER { 115 unsigned int last; 116 /* statistics for permissions */ 117 unsigned long p_writes; 118 unsigned long p_reads; 119 unsigned long p_hits; 120 } ; 121 122 /* 123 * The whole permissions cache 124 */ 125 126 struct PERMISSIONS_CACHE { 127 struct CACHED_PERMISSIONS_HEADER head; 128 struct CACHED_PERMISSIONS *cachetable[1]; /* array of variable size */ 129 } ; 130 131 /* 132 * Security flags values 133 */ 134 135 enum { 136 SECURITY_DEFAULT, /* rely on fuse for permissions checking */ 137 SECURITY_RAW, /* force same ownership/permissions on files */ 138 SECURITY_ADDSECURIDS, /* upgrade old security descriptors */ 139 SECURITY_STATICGRPS, /* use static groups for access control */ 140 SECURITY_WANTED /* a security related option was present */ 141 } ; 142 143 /* 144 * Security context, needed by most security functions 145 */ 146 147 enum { MAPUSERS, MAPGROUPS, MAPCOUNT } ; 148 149 struct SECURITY_CONTEXT { 150 ntfs_volume *vol; 151 struct MAPPING *mapping[MAPCOUNT]; 152 struct PERMISSIONS_CACHE **pseccache; 153 uid_t uid; /* uid of user requesting (not the mounter) */ 154 gid_t gid; /* gid of user requesting (not the mounter) */ 155 pid_t tid; /* thread id of thread requesting */ 156 mode_t umask; /* umask of requesting thread */ 157 } ; 158 159 #if POSIXACLS 160 161 /* 162 * Posix ACL structures 163 */ 164 165 struct POSIX_ACE { 166 u16 tag; 167 u16 perms; 168 s32 id; 169 } __attribute__((__packed__)); 170 171 struct POSIX_ACL { 172 u8 version; 173 u8 flags; 174 u16 filler; 175 struct POSIX_ACE ace[0]; 176 } __attribute__((__packed__)); 177 178 struct POSIX_SECURITY { 179 mode_t mode; 180 int acccnt; 181 int defcnt; 182 int firstdef; 183 u16 tagsset; 184 struct POSIX_ACL acl; 185 } ; 186 187 /* 188 * Posix tags, cpu-endian 16 bits 189 */ 190 191 enum { 192 POSIX_ACL_USER_OBJ = 1, 193 POSIX_ACL_USER = 2, 194 POSIX_ACL_GROUP_OBJ = 4, 195 POSIX_ACL_GROUP = 8, 196 POSIX_ACL_MASK = 16, 197 POSIX_ACL_OTHER = 32, 198 POSIX_ACL_SPECIAL = 64 /* internal use only */ 199 } ; 200 201 #define POSIX_ACL_EXTENSIONS (POSIX_ACL_USER | POSIX_ACL_GROUP | POSIX_ACL_MASK) 202 203 /* 204 * Posix permissions, cpu-endian 16 bits 205 */ 206 207 enum { 208 POSIX_PERM_X = 1, 209 POSIX_PERM_W = 2, 210 POSIX_PERM_R = 4, 211 POSIX_PERM_DENIAL = 64 /* internal use only */ 212 } ; 213 214 #define POSIX_VERSION 2 215 216 #endif 217 218 extern BOOL ntfs_guid_is_zero(const GUID *guid); 219 extern char *ntfs_guid_to_mbs(const GUID *guid, char *guid_str); 220 221 /** 222 * ntfs_sid_is_valid - determine if a SID is valid 223 * @sid: SID for which to determine if it is valid 224 * 225 * Determine if the SID pointed to by @sid is valid. 226 * 227 * Return TRUE if it is valid and FALSE otherwise. 228 */ 229 static __inline__ BOOL ntfs_sid_is_valid(const SID *sid) 230 { 231 if (!sid || sid->revision != SID_REVISION || 232 sid->sub_authority_count > SID_MAX_SUB_AUTHORITIES) 233 return FALSE; 234 return TRUE; 235 } 236 237 extern int ntfs_sid_to_mbs_size(const SID *sid); 238 extern char *ntfs_sid_to_mbs(const SID *sid, char *sid_str, 239 size_t sid_str_size); 240 extern void ntfs_generate_guid(GUID *guid); 241 extern int ntfs_sd_add_everyone(ntfs_inode *ni); 242 243 extern le32 ntfs_security_hash(const SECURITY_DESCRIPTOR_RELATIVE *sd, 244 const u32 len); 245 246 int ntfs_build_mapping(struct SECURITY_CONTEXT *scx, const char *usermap_path, 247 BOOL allowdef); 248 int ntfs_get_owner_mode(struct SECURITY_CONTEXT *scx, 249 ntfs_inode *ni, struct stat*); 250 int ntfs_set_mode(struct SECURITY_CONTEXT *scx, ntfs_inode *ni, mode_t mode); 251 BOOL ntfs_allowed_as_owner(struct SECURITY_CONTEXT *scx, ntfs_inode *ni); 252 int ntfs_allowed_access(struct SECURITY_CONTEXT *scx, 253 ntfs_inode *ni, int accesstype); 254 BOOL old_ntfs_allowed_dir_access(struct SECURITY_CONTEXT *scx, 255 const char *path, int accesstype); 256 257 #if POSIXACLS 258 le32 ntfs_alloc_securid(struct SECURITY_CONTEXT *scx, 259 uid_t uid, gid_t gid, ntfs_inode *dir_ni, 260 mode_t mode, BOOL isdir); 261 #else 262 le32 ntfs_alloc_securid(struct SECURITY_CONTEXT *scx, 263 uid_t uid, gid_t gid, mode_t mode, BOOL isdir); 264 #endif 265 int ntfs_set_owner(struct SECURITY_CONTEXT *scx, ntfs_inode *ni, 266 uid_t uid, gid_t gid); 267 int ntfs_set_ownmod(struct SECURITY_CONTEXT *scx, 268 ntfs_inode *ni, uid_t uid, gid_t gid, mode_t mode); 269 #if POSIXACLS 270 int ntfs_set_owner_mode(struct SECURITY_CONTEXT *scx, 271 ntfs_inode *ni, uid_t uid, gid_t gid, 272 mode_t mode, struct POSIX_SECURITY *pxdesc); 273 #else 274 int ntfs_set_owner_mode(struct SECURITY_CONTEXT *scx, 275 ntfs_inode *ni, uid_t uid, gid_t gid, mode_t mode); 276 #endif 277 le32 ntfs_inherited_id(struct SECURITY_CONTEXT *scx, 278 ntfs_inode *dir_ni, BOOL fordir); 279 int ntfs_open_secure(ntfs_volume *vol); 280 void ntfs_close_secure(struct SECURITY_CONTEXT *scx); 281 282 #if POSIXACLS 283 284 int ntfs_set_inherited_posix(struct SECURITY_CONTEXT *scx, 285 ntfs_inode *ni, uid_t uid, gid_t gid, 286 ntfs_inode *dir_ni, mode_t mode); 287 int ntfs_get_posix_acl(struct SECURITY_CONTEXT *scx, ntfs_inode *ni, 288 const char *name, char *value, size_t size); 289 int ntfs_set_posix_acl(struct SECURITY_CONTEXT *scx, ntfs_inode *ni, 290 const char *name, const char *value, size_t size, 291 int flags); 292 int ntfs_remove_posix_acl(struct SECURITY_CONTEXT *scx, ntfs_inode *ni, 293 const char *name); 294 #endif 295 296 int ntfs_get_ntfs_acl(struct SECURITY_CONTEXT *scx, ntfs_inode *ni, 297 char *value, size_t size); 298 int ntfs_set_ntfs_acl(struct SECURITY_CONTEXT *scx, ntfs_inode *ni, 299 const char *value, size_t size, int flags); 300 301 int ntfs_get_ntfs_attrib(ntfs_inode *ni, char *value, size_t size); 302 int ntfs_set_ntfs_attrib(ntfs_inode *ni, 303 const char *value, size_t size, int flags); 304 305 306 /* 307 * Security API for direct access to security descriptors 308 * based on Win32 API 309 */ 310 311 #define MAGIC_API 0x09042009 312 313 struct SECURITY_API { 314 u32 magic; 315 struct SECURITY_CONTEXT security; 316 struct PERMISSIONS_CACHE *seccache; 317 } ; 318 319 /* 320 * The following constants are used in interfacing external programs. 321 * They are not to be stored on disk and must be defined in their 322 * native cpu representation. 323 * When disk representation (le) is needed, use SE_DACL_PRESENT, etc. 324 */ 325 enum { OWNER_SECURITY_INFORMATION = 1, 326 GROUP_SECURITY_INFORMATION = 2, 327 DACL_SECURITY_INFORMATION = 4, 328 SACL_SECURITY_INFORMATION = 8 329 } ; 330 331 int ntfs_get_file_security(struct SECURITY_API *scapi, 332 const char *path, u32 selection, 333 char *buf, u32 buflen, u32 *psize); 334 int ntfs_set_file_security(struct SECURITY_API *scapi, 335 const char *path, u32 selection, const char *attr); 336 int ntfs_get_file_attributes(struct SECURITY_API *scapi, 337 const char *path); 338 BOOL ntfs_set_file_attributes(struct SECURITY_API *scapi, 339 const char *path, s32 attrib); 340 BOOL ntfs_read_directory(struct SECURITY_API *scapi, 341 const char *path, ntfs_filldir_t callback, void *context); 342 int ntfs_read_sds(struct SECURITY_API *scapi, 343 char *buf, u32 size, u32 offset); 344 INDEX_ENTRY *ntfs_read_sii(struct SECURITY_API *scapi, 345 INDEX_ENTRY *entry); 346 INDEX_ENTRY *ntfs_read_sdh(struct SECURITY_API *scapi, 347 INDEX_ENTRY *entry); 348 struct SECURITY_API *ntfs_initialize_file_security(const char *device, 349 int flags); 350 BOOL ntfs_leave_file_security(struct SECURITY_API *scx); 351 352 int ntfs_get_usid(struct SECURITY_API *scapi, uid_t uid, char *buf); 353 int ntfs_get_gsid(struct SECURITY_API *scapi, gid_t gid, char *buf); 354 int ntfs_get_user(struct SECURITY_API *scapi, const SID *usid); 355 int ntfs_get_group(struct SECURITY_API *scapi, const SID *gsid); 356 357 #endif /* defined _NTFS_SECURITY_H */ 358