JehanneOS/newlib
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

* sec_acl.cc (setacl): Move all permission settings to beginning of

Browse Source 
loop.  Set default rights to same values as in alloc_sd().  Set DELETE
	for owner and default owner only if S_IWOTH is given.

	* sec_acl.cc: Change all  __aclent16_t to  __aclent32_t except in
	wrapper function definitions. Replace call to the aclXYZ functions by
	calls aclXYZ32.
	(searchace): Change type of third argument to __uid32_t and use
	ILLEGAL_UID instead of -1;
	(setacl): Remove some initializations. Only give STANDARD_RIGHTS_WRITE
	for S_IWOTH. Replace -1 by ILLEGAL_UID.
	(getacl): Change type of owner_sid, group_sid and ace_sid to cygpsid.
	In last else clause, suppress second call to ace_sid.get_id and use
	TRUE in first call. Replace EqualSid by ==.
	(acl_access): Call internal_getgroups in USER and GROUP cases.
	(acecmp: Define static.
	(acl32): Create from 16 bit type.
	(facl32): Ditto.
	(lacl32): Ditto.
	(aclcheck32): Ditto.
	(aclsort32): Ditto.
	(acltomode32): Ditto.
	(aclfrommode32): Ditto.
	(acltopbits32): Ditto.
	(aclfrompbits32): Ditto.
	(acltotext32): Ditto.
	(aclfromtext32): Ditto, and use strechr.
	(acl16to32): Create.
	(acl): Make it a wrapper function.
	(facl): Ditto.
	(lacl): Ditto.
	(aclcheck): Ditto.
	(aclsort): Ditto.
	(acltomode): Ditto.
	(aclfrommode): Ditto.
	(acltopbits): Ditto.
	(aclfrompbits): Ditto.
	(acltotext): Ditto.
	(aclfromtext): Ditto.
	* security.cc (write_sd): Call set_process_privilege and check
	ownership.
	(alloc_sd): Remove call to set_process_privilege and the owner check.
This commit is contained in:
Corinna Vinschen 2003-02-05 16:15:22 +00:00
parent 33c7867ef1
commit 62cd433e98
3 changed files with 244 additions and 99 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
winsup/cygwin/ChangeLog
View File

@ -1,3 +1,50 @@
2003-02-05 Corinna Vinschen <corinna@vinschen.de>
* sec_acl.cc (setacl): Move all permission settings to beginning of
loop. Set default rights to same values as in alloc_sd(). Set DELETE
for owner and default owner only if S_IWOTH is given.
2003-02-05 Pierre Humblet <pierre.humblet@ieee.org>
* sec_acl.cc: Change all __aclent16_t to __aclent32_t except in
wrapper function definitions. Replace call to the aclXYZ functions by
calls aclXYZ32.
(searchace): Change type of third argument to __uid32_t and use
ILLEGAL_UID instead of -1;
(setacl): Remove some initializations. Only give STANDARD_RIGHTS_WRITE
for S_IWOTH. Replace -1 by ILLEGAL_UID.
(getacl): Change type of owner_sid, group_sid and ace_sid to cygpsid.
In last else clause, suppress second call to ace_sid.get_id and use
TRUE in first call. Replace EqualSid by ==.
(acl_access): Call internal_getgroups in USER and GROUP cases.
(acecmp: Define static.
(acl32): Create from 16 bit type.
(facl32): Ditto.
(lacl32): Ditto.
(aclcheck32): Ditto.
(aclsort32): Ditto.
(acltomode32): Ditto.
(aclfrommode32): Ditto.
(acltopbits32): Ditto.
(aclfrompbits32): Ditto.
(acltotext32): Ditto.
(aclfromtext32): Ditto, and use strechr.
(acl16to32): Create.
(acl): Make it a wrapper function.
(facl): Ditto.
(lacl): Ditto.
(aclcheck): Ditto.
(aclsort): Ditto.
(acltomode): Ditto.
(aclfrommode): Ditto.
(acltopbits): Ditto.
(aclfrompbits): Ditto.
(acltotext): Ditto.
(aclfromtext): Ditto.
* security.cc (write_sd): Call set_process_privilege and check
ownership.
(alloc_sd): Remove call to set_process_privilege and the owner check.
2003-02-05 Christopher Faylor <cgf@redhat.com> 2003-02-05 Christopher Faylor <cgf@redhat.com>
* include/sys/cygwin.h: Use C-style comments. * include/sys/cygwin.h: Use C-style comments.

248
winsup/cygwin/sec_acl.cc
View File

@ -32,23 +32,23 @@ details. */
#include "cygheap.h" #include "cygheap.h"
#include "pwdgrp.h" #include "pwdgrp.h"
extern "C" int aclsort (int nentries, int, __aclent16_t *aclbufp); extern "C" int aclsort32 (int nentries, int, __aclent32_t *aclbufp);
extern "C" int acl (const char *path, int cmd, int nentries, __aclent16_t *aclbufp); extern "C" int acl32 (const char *path, int cmd, int nentries, __aclent32_t *aclbufp);
static int static int
searchace (__aclent16_t *aclp, int nentries, int type, int id = -1) searchace (__aclent32_t *aclp, int nentries, int type, __uid32_t id = ILLEGAL_UID)
{ {
int i; int i;
for (i = 0; i < nentries; ++i) for (i = 0; i < nentries; ++i)
if ((aclp[i].a_type == type && (id == -1 || aclp[i].a_id == id)) if ((aclp[i].a_type == type && (id == ILLEGAL_UID || aclp[i].a_id == id))
|| !aclp[i].a_type) || !aclp[i].a_type)
return i; return i;
return -1; return -1;
} }
static int static int
setacl (const char *file, int nentries, __aclent16_t *aclbufp) setacl (const char *file, int nentries, __aclent32_t *aclbufp)
{ {
DWORD sd_size = 4096; DWORD sd_size = 4096;
char sd_buf[4096]; char sd_buf[4096];
@ -63,7 +63,7 @@ setacl (const char *file, int nentries, __aclent16_t *aclbufp)
BOOL dummy; BOOL dummy;
/* Get owner SID. */ /* Get owner SID. */
PSID owner_sid = NULL; PSID owner_sid;
if (!GetSecurityDescriptorOwner (psd, &owner_sid, &dummy)) if (!GetSecurityDescriptorOwner (psd, &owner_sid, &dummy))
{ {
__seterrno (); __seterrno ();
@ -72,7 +72,7 @@ setacl (const char *file, int nentries, __aclent16_t *aclbufp)
cygsid owner (owner_sid); cygsid owner (owner_sid);
/* Get group SID. */ /* Get group SID. */
PSID group_sid = NULL; PSID group_sid;
if (!GetSecurityDescriptorGroup (psd, &group_sid, &dummy)) if (!GetSecurityDescriptorGroup (psd, &group_sid, &dummy))
{ {
__seterrno (); __seterrno ();
@ -92,8 +92,7 @@ setacl (const char *file, int nentries, __aclent16_t *aclbufp)
__seterrno (); __seterrno ();
return -1; return -1;
} }
if (group if (!SetSecurityDescriptorGroup (&sd, group, FALSE))
&& !SetSecurityDescriptorGroup (&sd, group, FALSE))
{ {
__seterrno (); __seterrno ();
return -1; return -1;
@ -117,12 +116,22 @@ setacl (const char *file, int nentries, __aclent16_t *aclbufp)
} }
for (int i = 0; i < nentries; ++i) for (int i = 0; i < nentries; ++i)
{ {
DWORD allow = STANDARD_RIGHTS_READ DWORD allow;
| FILE_READ_ATTRIBUTES | FILE_READ_EA; /* Owner has more standard rights set. */
if ((aclbufp[i].a_type & ~ACL_DEFAULT) == USER_OBJ)
allow = (STANDARD_RIGHTS_ALL & ~DELETE)
| FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA;
else
allow = STANDARD_RIGHTS_READ | FILE_READ_ATTRIBUTES | FILE_READ_EA;
if (aclbufp[i].a_perm & S_IROTH) if (aclbufp[i].a_perm & S_IROTH)
allow |= FILE_GENERIC_READ; allow |= FILE_GENERIC_READ;
if (aclbufp[i].a_perm & S_IWOTH) if (aclbufp[i].a_perm & S_IWOTH)
allow |= STANDARD_RIGHTS_ALL | FILE_GENERIC_WRITE; {
allow |= STANDARD_RIGHTS_WRITE | FILE_GENERIC_WRITE;
/* Owner gets DELETE right, too. */
if ((aclbufp[i].a_type & ~ACL_DEFAULT) == USER_OBJ)
allow |= DELETE;
}
if (aclbufp[i].a_perm & S_IXOTH) if (aclbufp[i].a_perm & S_IXOTH)
allow |= FILE_GENERIC_EXECUTE; allow |= FILE_GENERIC_EXECUTE;
if ((aclbufp[i].a_perm & (S_IWOTH | S_IXOTH)) == (S_IWOTH | S_IXOTH)) if ((aclbufp[i].a_perm & (S_IWOTH | S_IXOTH)) == (S_IWOTH | S_IXOTH))
@ -141,7 +150,7 @@ setacl (const char *file, int nentries, __aclent16_t *aclbufp)
&& (pos = searchace (aclbufp + i + 1, nentries - i - 1, && (pos = searchace (aclbufp + i + 1, nentries - i - 1,
aclbufp[i].a_type | ACL_DEFAULT, aclbufp[i].a_type | ACL_DEFAULT,
(aclbufp[i].a_type & (USER|GROUP)) (aclbufp[i].a_type & (USER|GROUP))
? aclbufp[i].a_id : -1)) >= 0 ? aclbufp[i].a_id : ILLEGAL_UID)) >= 0
&& aclbufp[i].a_perm == aclbufp[pos].a_perm) && aclbufp[i].a_perm == aclbufp[pos].a_perm)
{ {
inheritance = SUB_CONTAINERS_AND_OBJECTS_INHERIT; inheritance = SUB_CONTAINERS_AND_OBJECTS_INHERIT;
@ -151,13 +160,11 @@ setacl (const char *file, int nentries, __aclent16_t *aclbufp)
switch (aclbufp[i].a_type) switch (aclbufp[i].a_type)
{ {
case USER_OBJ: case USER_OBJ:
allow |= STANDARD_RIGHTS_ALL & ~DELETE;
if (!add_access_allowed_ace (acl, ace_off++, allow, if (!add_access_allowed_ace (acl, ace_off++, allow,
owner, acl_len, inheritance)) owner, acl_len, inheritance))
return -1; return -1;
break; break;
case DEF_USER_OBJ: case DEF_USER_OBJ:
allow |= STANDARD_RIGHTS_ALL & ~DELETE;
if (!add_access_allowed_ace (acl, ace_off++, allow, if (!add_access_allowed_ace (acl, ace_off++, allow,
well_known_creator_owner_sid, acl_len, inheritance)) well_known_creator_owner_sid, acl_len, inheritance))
return -1; return -1;
@ -229,7 +236,7 @@ setacl (const char *file, int nentries, __aclent16_t *aclbufp)
#define DENY_X 010000 #define DENY_X 010000
static void static void
getace (__aclent16_t &acl, int type, int id, DWORD win_ace_mask, getace (__aclent32_t &acl, int type, int id, DWORD win_ace_mask,
DWORD win_ace_type) DWORD win_ace_type)
{ {
acl.a_type = type; acl.a_type = type;
@ -255,7 +262,7 @@ getace (__aclent16_t &acl, int type, int id, DWORD win_ace_mask,
} }
static int static int
getacl (const char *file, DWORD attr, int nentries, __aclent16_t *aclbufp) getacl (const char *file, DWORD attr, int nentries, __aclent32_t *aclbufp)
{ {
DWORD sd_size = 4096; DWORD sd_size = 4096;
char sd_buf[4096]; char sd_buf[4096];
@ -268,30 +275,30 @@ getacl (const char *file, DWORD attr, int nentries, __aclent16_t *aclbufp)
return ret; return ret;
} }
PSID owner_sid; cygpsid owner_sid;
PSID group_sid; cygpsid group_sid;
BOOL dummy; BOOL dummy;
__uid32_t uid; __uid32_t uid;
__gid32_t gid; __gid32_t gid;
if (!GetSecurityDescriptorOwner (psd, &owner_sid, &dummy)) if (!GetSecurityDescriptorOwner (psd, (PSID *) &owner_sid, &dummy))
{ {
debug_printf ("GetSecurityDescriptorOwner %E"); debug_printf ("GetSecurityDescriptorOwner %E");
__seterrno (); __seterrno ();
return -1; return -1;
} }
uid = cygsid (owner_sid).get_uid (); uid = owner_sid.get_uid ();
if (!GetSecurityDescriptorGroup (psd, &group_sid, &dummy)) if (!GetSecurityDescriptorGroup (psd, (PSID *) &group_sid, &dummy))
{ {
debug_printf ("GetSecurityDescriptorGroup %E"); debug_printf ("GetSecurityDescriptorGroup %E");
__seterrno (); __seterrno ();
return -1; return -1;
} }
gid = cygsid (group_sid).get_gid (); gid = group_sid.get_gid ();
__aclent16_t lacl[MAX_ACL_ENTRIES]; __aclent32_t lacl[MAX_ACL_ENTRIES];
memset (&lacl, 0, MAX_ACL_ENTRIES * sizeof (__aclent16_t)); memset (&lacl, 0, MAX_ACL_ENTRIES * sizeof (__aclent32_t));
lacl[0].a_type = USER_OBJ; lacl[0].a_type = USER_OBJ;
lacl[0].a_id = uid; lacl[0].a_id = uid;
lacl[1].a_type = GROUP_OBJ; lacl[1].a_type = GROUP_OBJ;
@ -326,7 +333,7 @@ getacl (const char *file, DWORD attr, int nentries, __aclent16_t *aclbufp)
if (!GetAce (acl, i, (PVOID *) &ace)) if (!GetAce (acl, i, (PVOID *) &ace))
continue; continue;
cygsid ace_sid ((PSID) &ace->SidStart); cygpsid ace_sid ((PSID) &ace->SidStart);
int id; int id;
int type = 0; int type = 0;
@ -356,19 +363,8 @@ getacl (const char *file, DWORD attr, int nentries, __aclent16_t *aclbufp)
id = ILLEGAL_GID; id = ILLEGAL_GID;
} }
else else
{ id = ace_sid.get_id (TRUE, &type);
id = ace_sid.get_id (FALSE, &type);
if (type != GROUP)
{
int type2 = 0;
int id2 = ace_sid.get_id (TRUE, &type2);
if (type2 == GROUP)
{
id = id2;
type = GROUP;
}
}
}
if (!type) if (!type)
continue; continue;
if (!(ace->Header.AceFlags & INHERIT_ONLY || type & ACL_DEFAULT)) if (!(ace->Header.AceFlags & INHERIT_ONLY || type & ACL_DEFAULT))
@ -401,17 +397,17 @@ getacl (const char *file, DWORD attr, int nentries, __aclent16_t *aclbufp)
if ((pos = searchace (lacl, MAX_ACL_ENTRIES, 0)) < 0) if ((pos = searchace (lacl, MAX_ACL_ENTRIES, 0)) < 0)
pos = MAX_ACL_ENTRIES; pos = MAX_ACL_ENTRIES;
if (aclbufp) { if (aclbufp) {
if (EqualSid (owner_sid, group_sid)) if (owner_sid == group_sid)
lacl[0].a_perm = lacl[1].a_perm; lacl[0].a_perm = lacl[1].a_perm;
if (pos > nentries) if (pos > nentries)
{ {
set_errno (ENOSPC); set_errno (ENOSPC);
return -1; return -1;
} }
memcpy (aclbufp, lacl, pos * sizeof (__aclent16_t)); memcpy (aclbufp, lacl, pos * sizeof (__aclent32_t));
for (i = 0; i < pos; ++i) for (i = 0; i < pos; ++i)
aclbufp[i].a_perm &= ~(DENY_R | DENY_W | DENY_X); aclbufp[i].a_perm &= ~(DENY_R | DENY_W | DENY_X);
aclsort (pos, 0, aclbufp); aclsort32 (pos, 0, aclbufp);
} }
syscall_printf ("%d = getacl (%s)", pos, file); syscall_printf ("%d = getacl (%s)", pos, file);
return pos; return pos;
@ -420,13 +416,13 @@ getacl (const char *file, DWORD attr, int nentries, __aclent16_t *aclbufp)
int int
acl_access (const char *path, int flags) acl_access (const char *path, int flags)
{ {
__aclent16_t acls[MAX_ACL_ENTRIES]; __aclent32_t acls[MAX_ACL_ENTRIES];
int cnt; int cnt;
if ((cnt = acl (path, GETACL, MAX_ACL_ENTRIES, acls)) < 1) if ((cnt = acl32 (path, GETACL, MAX_ACL_ENTRIES, acls)) < 1)
return -1; return -1;
/* Only check existance. */ /* Only check existence. */
if (!(flags & (R_OK | W_OK | X_OK))) if (!(flags & (R_OK | W_OK | X_OK)))
return 0; return 0;
@ -440,25 +436,31 @@ acl_access (const char *path, int flags)
{ {
/* /*
* Check if user is a NT group: * Check if user is a NT group:
* Take SID from passwd, search SID in group, check is_grp_member. * Take SID from passwd, search SID in token groups
*/ */
cygsid owner; cygsid owner;
struct passwd *pw; struct passwd *pw;
struct __group32 *gr = NULL;
if ((pw = internal_getpwuid (acls[i].a_id)) != NULL if ((pw = internal_getpwuid (acls[i].a_id)) != NULL
&& owner.getfrompw (pw) && owner.getfrompw (pw)
&& (gr = internal_getgrsid (owner)) && internal_getgroups (0, NULL, &owner) > 0)
&& is_grp_member (myself->uid, gr->gr_gid))
break; break;
continue; continue;
} }
break; break;
case GROUP_OBJ: case GROUP_OBJ:
case GROUP: case GROUP:
if (acls[i].a_id != myself->gid && if (acls[i].a_id != myself->gid)
!is_grp_member (myself->uid, acls[i].a_id)) {
cygsid group;
struct __group32 *gr = NULL;
if ((gr = internal_getgrgid (acls[i].a_id)) != NULL
&& group.getfromgr (gr)
&& internal_getgroups (0, NULL, &group) > 0)
break;
continue; continue;
}
break; break;
case OTHER_OBJ: case OTHER_OBJ:
break; break;
@ -476,7 +478,7 @@ acl_access (const char *path, int flags)
static static
int int
acl_worker (const char *path, int cmd, int nentries, __aclent16_t *aclbufp, acl_worker (const char *path, int cmd, int nentries, __aclent32_t *aclbufp,
int nofollow) int nofollow)
{ {
extern suffix_info stat_suffixes[]; extern suffix_info stat_suffixes[];
@ -530,7 +532,7 @@ acl_worker (const char *path, int cmd, int nentries, __aclent16_t *aclbufp,
switch (cmd) switch (cmd)
{ {
case SETACL: case SETACL:
if (!aclsort (nentries, 0, aclbufp)) if (!aclsort32 (nentries, 0, aclbufp))
return setacl (real_path.get_win32 (), return setacl (real_path.get_win32 (),
nentries, aclbufp); nentries, aclbufp);
break; break;
@ -556,21 +558,21 @@ acl_worker (const char *path, int cmd, int nentries, __aclent16_t *aclbufp,
extern "C" extern "C"
int int
acl (const char *path, int cmd, int nentries, __aclent16_t *aclbufp) acl32 (const char *path, int cmd, int nentries, __aclent32_t *aclbufp)
{ {
return acl_worker (path, cmd, nentries, aclbufp, 0); return acl_worker (path, cmd, nentries, aclbufp, 0);
} }
extern "C" extern "C"
int int
lacl (const char *path, int cmd, int nentries, __aclent16_t *aclbufp) lacl32 (const char *path, int cmd, int nentries, __aclent32_t *aclbufp)
{ {
return acl_worker (path, cmd, nentries, aclbufp, 1); return acl_worker (path, cmd, nentries, aclbufp, 1);
} }
extern "C" extern "C"
int int
facl (int fd, int cmd, int nentries, __aclent16_t *aclbufp) facl32 (int fd, int cmd, int nentries, __aclent32_t *aclbufp)
{ {
cygheap_fdget cfd (fd); cygheap_fdget cfd (fd);
if (cfd < 0) if (cfd < 0)
@ -591,7 +593,7 @@ facl (int fd, int cmd, int nentries, __aclent16_t *aclbufp)
extern "C" extern "C"
int int
aclcheck (__aclent16_t *aclbufp, int nentries, int *which) aclcheck32 (__aclent32_t *aclbufp, int nentries, int *which)
{ {
BOOL has_user_obj = FALSE; BOOL has_user_obj = FALSE;
BOOL has_group_obj = FALSE; BOOL has_group_obj = FALSE;
@ -722,10 +724,10 @@ aclcheck (__aclent16_t *aclbufp, int nentries, int *which)
return 0; return 0;
} }
extern "C" static
int acecmp (const void *a1, const void *a2) int acecmp (const void *a1, const void *a2)
{ {
#define ace(i) ((const __aclent16_t *) a##i) #define ace(i) ((const __aclent32_t *) a##i)
int ret = ace (1)->a_type - ace (2)->a_type; int ret = ace (1)->a_type - ace (2)->a_type;
if (!ret) if (!ret)
ret = ace (1)->a_id - ace (2)->a_id; ret = ace (1)->a_id - ace (2)->a_id;
@ -735,22 +737,22 @@ int acecmp (const void *a1, const void *a2)
extern "C" extern "C"
int int
aclsort (int nentries, int, __aclent16_t *aclbufp) aclsort32 (int nentries, int, __aclent32_t *aclbufp)
{ {
if (aclcheck (aclbufp, nentries, NULL)) if (aclcheck32 (aclbufp, nentries, NULL))
return -1; return -1;
if (!aclbufp || nentries < 1) if (!aclbufp || nentries < 1)
{ {
set_errno (EINVAL); set_errno (EINVAL);
return -1; return -1;
} }
qsort ((void *) aclbufp, nentries, sizeof (__aclent16_t), acecmp); qsort ((void *) aclbufp, nentries, sizeof (__aclent32_t), acecmp);
return 0; return 0;
} }
extern "C" extern "C"
int int
acltomode (__aclent16_t *aclbufp, int nentries, mode_t *modep) acltomode32 (__aclent32_t *aclbufp, int nentries, mode_t *modep)
{ {
int pos; int pos;
@ -790,7 +792,7 @@ acltomode (__aclent16_t *aclbufp, int nentries, mode_t *modep)
extern "C" extern "C"
int int
aclfrommode (__aclent16_t *aclbufp, int nentries, mode_t *modep) aclfrommode32 (__aclent32_t *aclbufp, int nentries, mode_t *modep)
{ {
int pos; int pos;
@ -828,16 +830,16 @@ aclfrommode (__aclent16_t *aclbufp, int nentries, mode_t *modep)
extern "C" extern "C"
int int
acltopbits (__aclent16_t *aclbufp, int nentries, mode_t *pbitsp) acltopbits32 (__aclent32_t *aclbufp, int nentries, mode_t *pbitsp)
{ {
return acltomode (aclbufp, nentries, pbitsp); return acltomode32 (aclbufp, nentries, pbitsp);
} }
extern "C" extern "C"
int int
aclfrompbits (__aclent16_t *aclbufp, int nentries, mode_t *pbitsp) aclfrompbits32 (__aclent32_t *aclbufp, int nentries, mode_t *pbitsp)
{ {
return aclfrommode (aclbufp, nentries, pbitsp); return aclfrommode32 (aclbufp, nentries, pbitsp);
} }
static char * static char *
@ -854,10 +856,10 @@ permtostr (mode_t perm)
extern "C" extern "C"
char * char *
acltotext (__aclent16_t *aclbufp, int aclcnt) acltotext32 (__aclent32_t *aclbufp, int aclcnt)
{ {
if (!aclbufp || aclcnt < 1 || aclcnt > MAX_ACL_ENTRIES if (!aclbufp || aclcnt < 1 || aclcnt > MAX_ACL_ENTRIES
|| aclcheck (aclbufp, aclcnt, NULL)) || aclcheck32 (aclbufp, aclcnt, NULL))
{ {
set_errno (EINVAL); set_errno (EINVAL);
return NULL; return NULL;
@ -930,8 +932,8 @@ permfromstr (char *perm)
} }
extern "C" extern "C"
__aclent16_t * __aclent32_t *
aclfromtext (char *acltextp, int *) aclfromtext32 (char *acltextp, int *)
{ {
if (!acltextp) if (!acltextp)
{ {
@ -939,7 +941,7 @@ aclfromtext (char *acltextp, int *)
return NULL; return NULL;
} }
char buf[strlen (acltextp) + 1]; char buf[strlen (acltextp) + 1];
__aclent16_t lacl[MAX_ACL_ENTRIES]; __aclent32_t lacl[MAX_ACL_ENTRIES];
memset (lacl, 0, sizeof lacl); memset (lacl, 0, sizeof lacl);
int pos = 0; int pos = 0;
strcpy (buf, acltextp); strcpy (buf, acltextp);
@ -970,11 +972,11 @@ aclfromtext (char *acltextp, int *)
return NULL; return NULL;
} }
lacl[pos].a_id = pw->pw_uid; lacl[pos].a_id = pw->pw_uid;
c = strchr (c, ':'); c = strechr (c, ':');
} }
else if (isdigit (*c)) else if (isdigit (*c))
lacl[pos].a_id = strtol (c, &c, 10); lacl[pos].a_id = strtol (c, &c, 10);
if (!c || *c != ':') if (*c != ':')
{ {
set_errno (EINVAL); set_errno (EINVAL);
return NULL; return NULL;
@ -998,11 +1000,11 @@ aclfromtext (char *acltextp, int *)
return NULL; return NULL;
} }
lacl[pos].a_id = gr->gr_gid; lacl[pos].a_id = gr->gr_gid;
c = strchr (c, ':'); c = strechr (c, ':');
} }
else if (isdigit (*c)) else if (isdigit (*c))
lacl[pos].a_id = strtol (c, &c, 10); lacl[pos].a_id = strtol (c, &c, 10);
if (!c || *c != ':') if (*c != ':')
{ {
set_errno (EINVAL); set_errno (EINVAL);
return NULL; return NULL;
@ -1036,9 +1038,97 @@ aclfromtext (char *acltextp, int *)
} }
++pos; ++pos;
} }
__aclent16_t *aclp = (__aclent16_t *) malloc (pos * sizeof (__aclent16_t)); __aclent32_t *aclp = (__aclent32_t *) malloc (pos * sizeof (__aclent32_t));
if (aclp) if (aclp)
memcpy (aclp, lacl, pos * sizeof (__aclent16_t)); memcpy (aclp, lacl, pos * sizeof (__aclent32_t));
return aclp; return aclp;
} }
/* __aclent16_t and __aclent32_t have same size and same member offsets */
static __aclent32_t *
acl16to32 (__aclent16_t *aclbufp, int nentries)
{
__aclent32_t *aclbufp32 = (__aclent32_t *) aclbufp;
if (aclbufp32)
for (int i = 0; i < nentries; i++)
aclbufp32[i].a_id &= USHRT_MAX;
return aclbufp32;
}
extern "C"
int
acl (const char *path, int cmd, int nentries, __aclent16_t *aclbufp)
{
return acl32 (path, cmd, nentries, acl16to32 (aclbufp, nentries));
}
extern "C"
int
facl (int fd, int cmd, int nentries, __aclent16_t *aclbufp)
{
return facl32 (fd, cmd, nentries, acl16to32 (aclbufp, nentries));
}
extern "C"
int
lacl (const char *path, int cmd, int nentries, __aclent16_t *aclbufp)
{
return lacl32 (path, cmd, nentries, acl16to32 (aclbufp, nentries));
}
extern "C"
int
aclcheck (__aclent16_t *aclbufp, int nentries, int *which)
{
return aclcheck32 (acl16to32 (aclbufp, nentries), nentries, which);
}
extern "C"
int
aclsort (int nentries, int i, __aclent16_t *aclbufp)
{
return aclsort32 (nentries, i, acl16to32 (aclbufp, nentries));
}
extern "C"
int
acltomode (__aclent16_t *aclbufp, int nentries, mode_t *modep)
{
return acltomode32 (acl16to32 (aclbufp, nentries), nentries, modep);
}
extern "C"
int
aclfrommode (__aclent16_t *aclbufp, int nentries, mode_t *modep)
{
return aclfrommode32 ((__aclent32_t *)aclbufp, nentries, modep);
}
extern "C"
int
acltopbits (__aclent16_t *aclbufp, int nentries, mode_t *pbitsp)
{
return acltopbits32 (acl16to32 (aclbufp, nentries), nentries, pbitsp);
}
extern "C"
int
aclfrompbits (__aclent16_t *aclbufp, int nentries, mode_t *pbitsp)
{
return aclfrompbits32 ((__aclent32_t *)aclbufp, nentries, pbitsp);
}
extern "C"
char *
acltotext (__aclent16_t *aclbufp, int aclcnt)
{
return acltotext32 (acl16to32 (aclbufp, aclcnt), aclcnt);
}
extern "C"
__aclent16_t *
aclfromtext (char *acltextp, int * aclcnt)
{
return (__aclent16_t *) aclfromtext32 (acltextp, aclcnt);
}

40
winsup/cygwin/security.cc
View File

@ -1140,6 +1140,30 @@ write_sd (const char *file, PSECURITY_DESCRIPTOR sd_buf, DWORD sd_size)
return -1; return -1;
} }
BOOL dummy;
cygpsid owner;
if (!GetSecurityDescriptorOwner (sd_buf, (PSID *) &owner, &dummy))
{
__seterrno ();
return -1;
}
/* Try turning privilege on, may not have WRITE_OWNER or WRITE_DAC access.
Must have privilege to set different owner, else BackupWrite misbehaves */
static int NO_COPY saved_res; /* 0: never, 1: failed, 2 & 3: OK */
int res;
if (!saved_res || cygheap->user.issetuid ())
{
res = 2 + set_process_privilege (SE_RESTORE_NAME, true,
cygheap->user.issetuid ());
if (!cygheap->user.issetuid ())
saved_res = res;
}
else
res = saved_res;
if (res == 1 && owner != cygheap->user.sid ())
return -1;
HANDLE fh; HANDLE fh;
fh = CreateFile (file, fh = CreateFile (file,
WRITE_OWNER | WRITE_DAC, WRITE_OWNER | WRITE_DAC,
@ -1561,22 +1585,6 @@ alloc_sd (__uid32_t uid, __gid32_t gid, int attribute,
} }
owner_sid.debug_print ("alloc_sd: owner SID ="); owner_sid.debug_print ("alloc_sd: owner SID =");
/* Try turning privilege on, may not have WRITE_OWNER or WRITE_DAC access.
Must have privilege to set different owner, else BackupWrite misbehaves */
static int NO_COPY saved_res; /* 0: never, 1: failed, 2 & 3: OK */
int res;
if (!saved_res || cygheap->user.issetuid ())
{
res = 2 + set_process_privilege (SE_RESTORE_NAME, true,
cygheap->user.issetuid ());
if (!cygheap->user.issetuid ())
saved_res = res;
}
else
res = saved_res;
if (res == 1 && owner_sid != cygheap->user.sid ())
return NULL;
/* Get SID of new group. */ /* Get SID of new group. */
cygsid group_sid; cygsid group_sid;
/* Check for current user first */ /* Check for current user first */