aboutsummaryrefslogtreecommitdiff
path: root/winsup/cygwin/sec_acl.cc
AgeCommit message (Collapse)AuthorFilesLines
2022-08-05Cygwin: Reorganize cygwin source dirCorinna Vinschen1-1966/+0
Create subdirs and move files accordingly: - DevDocs: doc files - fhandler: fhandler sources, split fhandler.cc into base.cc and null.cc - local_includes: local include files - scripts: scripts called during build - sec: security sources Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2022-05-29Cygwin: simplify some function namesKen Brown1-26/+15
Remove "32" or "64" from each of the following names: acl32, aclcheck32, aclfrommode32, aclfrompbits32, aclfromtext32, aclsort32, acltomode32, acltopbits32, acltotext32, facl32, fchown32, fcntl64, fstat64, _fstat64, _fstat64_r, ftruncate64, getgid32, getgrent32, getgrgid32, getgrnam32, getgroups32, getpwuid32, getpwuid_r32, getuid32, getuid32, initgroups32, lseek64, lstat64, mknod32, mmap64, setegid32, seteuid32, setgid32, setgroups32, setregid32, setreuid32, setuid32, stat64, _stat64_r, truncate64. Remove prototypes and macro definitions of these names. Remove "#ifndef __INSIDE_CYGWIN__" from some headers so that the new names will be available when compiling Cygwin. Remove aliases that are no longer needed. Include <unistd.h> in fhandler_clipboard.cc for the declarations of geteuid and getegid.
2022-05-29Cygwin: remove some 32-bit-only function definitionsKen Brown1-98/+0
Remove the definitions of the following: acl, aclcheck, aclfrommode, aclfrompbits, aclfromtext, aclsort, acltomode, acltopbits, acltotext, chown, fchown, _fcntl, fstat, _fstat_r, ftruncate, getegid, geteuid, getgid, getgrent, getgrgid, getgrnam, getgroups, getpwduid, getpwuid, getpwuid_r, getuid, initgroups, lacl, lacl32, lchown, lseek, lstat, mknod, mmap, setegid, seteuid, setgid, setgroups, setregid, setreuid, setuid, stat, _stat_r, truncate. [For most of these, the corresponding 64-bit entry points are obtained by exporting aliases. For example, acl is an alias for acl32, and truncate is an alias for truncate64.] Remove the following structs and all code using them (which is 32-bit only): __stat32, __group16, __flock32, __aclent16_t. Remove the typedefs of __blkcnt32_t __dev16_t, __ino32_t, which are used only in code that has been removed. Put the typedefs of __uid16_t and __gid16_t in one header, instead of one header if __INSIDE_CYGWIN__ is defined and a different header otherwise.
2022-01-25Cygwin: ACLs: don't set indicator for default ACEs prematurelyCorinna Vinschen1-2/+0
Commit a2bfe7cae61a introduced a change ignoring default ACEs on files to come up with a valid POSIX ACL, reflecting the Windows ACEs actually making sense on files. However, if CREATOR OWNER or CREATOR GROUP ACEs - both only making sense as default ACEs - are found in the ACL, a value indicating the presence of default ACEs gets set, even on files. This in turn breaks a subsequent integrity check and get_posix_access returns EINVAL. The code path handling default ACEs on directories sets this indicator anyway, so don't set it just because one of the above SIDs are found. Fixes: a2bfe7cae61a ("Cygwin: ACLs: ignore *_INHERIT flags in file ACLs") Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2022-01-11Cygwin: ACLs: ignore *_INHERIT flags in file ACLsCorinna Vinschen1-3/+6
get_posix_access() creates DEF_*_OBJ aclent_t entries from Windows ACEs with INHERIT flags set, independent of the file type. These flags only make sense on directory objects, but certain Windows functions don't check the file type and allow INHERIT ACE flags even on non-directories. As a fix, make sure to ignore the INHERIT flags on non-directory ACLs and don't propagate the matching DEF_*_OBJ aclent_t entries to callers. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2021-02-24Cygwin: facl: fail with EBADF on files opened with O_PATHKen Brown1-0/+5
This is in the spirit of the Linux requirement that file operations like fchmod(2), fchown(2), and fgetxattr(2) fail with EBADF on files opened with O_PATH.
2020-08-05Cygwin: Add 'fallthrough' pseudo keyword for switch/case useCorinna Vinschen1-1/+1
This patch has been inspired by the Linux kernel patch 294f69e662d1 compiler_attributes.h: Add 'fallthrough' pseudo keyword for switch/case use written by Joe Perches <joe AT perches DOT com> based on an idea from Dan Carpenter <dan DOT carpenter AT oracle DOT com>. The following text is from the original log message: Reserve the pseudo keyword 'fallthrough' for the ability to convert the various case block /* fallthrough */ style comments to appear to be an actual reserved word with the same gcc case block missing fallthrough warning capability. All switch/case blocks now should end in one of: break; fallthrough; goto <label>; return [expression]; continue; In C mode, GCC supports the __fallthrough__ attribute since 7.1, the same time the warning and the comment parsing were introduced. Cygwin-only: add an explicit -Wimplicit-fallthrough=5 to the build flags.
2019-08-26Cygwin: get_posix_access: avoid negative subscriptKen Brown1-4/+4
Don't refer to lacl[pos] unless we know that pos >= 0.
2019-03-13Cygwin: acls: allow converting empty acl to textCorinna Vinschen1-2/+2
Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2017-11-27cygwin: convert most #ifndef __x86_64__ to #ifdef __i386__Corinna Vinschen1-14/+14
Address the real offender Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2016-08-19Simplify "Windows-standard-like" permissionsCorinna Vinschen1-16/+15
Commit 97d0449 left a bit to be desired. First, the fact that any new-style ACL couldn't be "standard ACL" anymore was very much over the top. On one hand Admins and SYSTEM ACEs are not supposed to be masked, but on the other hand we *must* create the CLASS_OBJ because otherwise we don't have information about masking the execute perms for both groups. The ACL would also fail aclcheck. And while get_posix_access now returns the "is standard acl" flag, it hasn't been utilized by set_created_file_access. Rather, set_created_file_access has simply continued to check for nentries > MIN_ACL_ENTRIES, which led to all kinds of weird group and CLASS_OBJ perms. The new code now always manipulates CLASS_OBJ perms if a CLASS_OBJ is present, and it always manipulates group perms if the ACL has been marked as "standard" ACL. Another problem (not related to commit 97d0449) is the order get_posix_access adds missing perms. CLASS_OBJ perms are computed *before* missing GROUP_OBJ perms have been added. Thus the CLASS_OBJ perms could be too tight and led to additional, buggy DENY ACEs. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2016-06-23Switching the Cygwin DLL to LGPLv3+, dropping commercial buyout optioncygwin-2_5_2-releaseCorinna Vinschen1-3/+0
Bump GPLv2+ to GPLv3+ for some files, clarify BSD 2-clause. Everything else stays under GPLv3+. New Linking Exception exempts resulting executables from LGPLv3 section 4. Add CONTRIBUTORS file to keep track of licensing. Remove 'Copyright Red Hat Inc' comments. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2016-04-19Disallow S_ISGID on directories without default ACL entriesCorinna Vinschen1-1/+13
We can't handle the S_ISGID bit if the child didn't inherit a NULL SID ACE with the S_ISGID bit set. On directories without default ACL entries we would have to add an inheritable NULL SID ACE and nothing else. This in turn results in permission problems when calling set_file_sd from set_created_file_access. That's fixable, but it would only work for files created from Cygwin while files created from native Windows tools end up with really ugly permissions. This patch only makes sure that the S_ISGID bit is reset for a directory if it has no inheritable ACEs. Still having the 's' bit shown in ls or getfacl output would be misleading. So, calling `setfacl -k' on a dir also removes the S_ISGID bit now. * sec_acl.cc (set_posix_access): Drop S_ISGID bit on directories without inheritable ACEs. Explain why. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2016-04-18Handle permissions a bit closer to POSIX 1003.1eCorinna Vinschen1-5/+8
So far we tweaked ACL_GROUP_OBJ and ACL_MASK values the same way when creating a file. We now do what POSIX requires, namely just change ACL_MASK if it's present, otherwise ACL_GROUP_OBJ. Note that we only do this at creation time. Chmod still tweaks both to create less surprising results for the unsuspecting user. Additionally make sure to take umask only into account if no ACL_MASK value is present. That has been missed so far. * sec_acl.cc (set_posix_access): Perform check for non-existant default ACEs earlier. Ignore umask also if ACL_MASK is present. Only set owner_eq_group if we're actually handling a user entry. Mention chmod in a comment. * security.cc (set_created_file_access): Perform group/mask permission setting as required by POSIX 1003.1e. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2016-04-18Also create NULL SID ACE if special POSIX bits are setCorinna Vinschen1-0/+1
Commit e2ea143 forgot to take special POSIX bits into account. * sec_acl.cc (set_posix_access): Make sure to create NULL SID ACE if any special POSIX permission bits are set. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2016-04-18Fix attempt to create ACLs without NULL SIDCorinna Vinschen1-3/+6
Commit f75114fc was supposed to drop NULL SIDs in case the permissions are simple enough not to require mask values or special POSIX bits (S_ISVTX, etc). The check was incorrect. This patch is supposed to fix the problem. * sec_acl.cc (set_posix_access): Fix condition under which we write a NULL SID. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2016-03-13Don't write NULL SID ACE if it's not necessary.Corinna Vinschen1-4/+17
If the ACL is supposed to reflect only standard POSIX permissions, and if the permissions are so that user has more perms than group and group has more perms than other, we don't really need the NULL SID ACE. If the permissions are that simple, get_posix_access will not call AuthZ. * sec_acl.cc (set_posix_perms): Don't write NULL SID ACE if it's not required. Explain why. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2016-03-12Fix typo which might break permission evaluationCorinna Vinschen1-1/+1
* sec_acl.cc (get_posix_access): Fix a typo checking for a_id rather than a_type. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2016-03-12Fix reading/writing Samba ACLs using RFC2307 mappingCorinna Vinschen1-6/+53
When using RFC2307 uid/gid-mapping on Samba shares, the POSIX ACL contains the Windows SIDs. When writing back such an ACL we have to map the Windows SIDs back to the corresponding Samba SIDs representing the UNIX uid/gid value. When reading Samba SIDs, make sure never to evaluate a UNIX user account as group. * sec_acl.cc (set_posix_access): Convert Windows SIDs to RFC2307-mapped Sambe UNIX SIDs. * sec_helper.cc (cygpsid::get_id): Skip UNIX user accounts when trying to evaluate a SID as group. Skip UNIX group accounts when trying to evaluate a SID as user. * cygheap.h (cygheap_ugid_cache::reverse_get): New method to get nfs id from cygwin id. (cygheap_ugid_cache::reverse_get_uid): Wrapper for uids. (cygheap_ugid_cache::reverse_get_gid): Wrapper for gids. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2016-03-08__acltotext: Always append NULCorinna Vinschen1-1/+1
* sec_acl.cc (__acltotext): Append NUL unconditionally. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2016-03-08Implement POSIX.1e ACL functionsCorinna Vinschen1-262/+506
* Makefile.in (DLL_OFILES): Add sec_posixacl.o. (SUBLIBS): Add libacl.a (libacl.a): New rule to create libacl.a. * common.din: Export POSIX ACL functions as well as most libacl.a extensions. * fhandler.h (fhander_base::acl_get): New prototype. (fhander_base::acl_set): Ditto. (fhandler_disk_file::acl_get): Ditto. (fhandler_disk_file::acl_set): Ditto. * include/acl/libacl.h: New file. * include/cygwin/version.h: Bump API minor version. * include/sys/acl.h: Drop including cygwin/acl.h. Accommodate throughout Cygwin. Add POSIX ACL definitions. * sec_acl.cc: Include sec_posixacl.h. Replace ILLEGAL_UID and ILLEGAL_GID with ACL_UNDEFINED_ID where sensible. (__aclcheck): New internal acl check function to be used for Solaris and POSIX ACLs. (aclcheck32): Call __aclcheck. (__aclcalcmask): New function to compute ACL_MASK value. (__aclsort): New internal acl sort function to be used for Solaris and POSIX ACLs. (aclsort32): Call __aclsort. (permtostr): Work directly on provided buffer. (__acltotext): New internal acltotext function to be used for Solaris and POSIX ACLs. (acltotext32): Call __acltotext. (__aclfromtext): New internal aclfromtext function to be used for Solaris and POSIX ACLs. (aclfromtext32): Call __aclfromtext. * sec_posixacl.cc: New file implemeting POSIX ACL functions. * sec_posixacl.h: New internal header. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2016-02-22Fix comments in sec_acl.ccCorinna Vinschen1-7/+7
Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2016-01-28Treat ACLs with extra ACEs for Admins and SYSTEM like a trivial ACLCorinna Vinschen1-4/+14
POSIX.1e requires that chmod changes the MASK rather than the GROUP_OBJ value if the ACL is non-trivial. On Windows, especially on home machines, a standard ACL often consists of entries for the user, maybe the group, and additional entries for SYSTEM and the Administrators group. A user calling chmod on a file with bog standard Windows perms usually expects that chmod changes the GROUP_OBJ perms, but given the rules from POSIX.1e we can't do that. However, since we already treat Admins and SYSTEM special in a ACL (they are not used in MASK computations) we go a step in the Windows direction to follow user expectations. If an ACL only consists of the three POSIX permissions, plus entries for Admins and SYSTEM *only*, then we change the permissions of the GROUP_OBJ entry *and* the MASK entry. * fhandler_disk_file.cc (fhandler_disk_file::chmod): Drop unused code. Add special handling for a "standard" Windows ACL. Add comment to explain. * sec_acl.cc (get_posix_access): Allow to return "standard-ness" of an ACL to the caller. Add preceeding comment to explain a bit. * security.h (get_posix_access): Align prototype. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2016-01-28get_posix_access: Fix primary group handing when multiple ACEs existCorinna Vinschen1-3/+5
Handle additional ACE for primary group only as another GROUP entry if it's an allow ACE. Deny ACEs don't qualify. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2016-01-15get_posix_access: Fix group deny bits leaking into file type attribute bitscygwin-2_4_0-releaseCorinna Vinschen1-1/+1
* sec_acl.cc (get_posix_access): Fix bracketing in expression constructing POSIX group permissions so as not leaking deny bits into POSIX file type bits. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2016-01-07Drop use of not yet available type acl_perm_tCorinna Vinschen1-1/+1
* sec_acl.cc (__aclcalcmask): Use mode_t instead of acl_perm_t Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-12-24aclsort: Honor calclass argument and allow recalculating ACL mask.Corinna Vinschen1-1/+21
* sec_acl.cc (__aclcalcmask): New function to recalculate ACL masks. (aclsort32): Honor calclass argument. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-12-24aclfromtext: Actually return aclcnt parameterCorinna Vinschen1-2/+6
* sec_acl.cc (aclfromtext32): Return missing aclcnt parameter. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-12-24Use TLS buffer in ACL<->text conversionCorinna Vinschen1-4/+6
* sec_acl.cc (acltotext32): Use tmp_pathbuf rather than stack buffer. (aclfromtext32): Ditto. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-12-24sec_acl.cc: Cosmetic changesCorinna Vinschen1-14/+14
Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-11-29Use correct gid value for Microsoft Account when /etc/group is in useCorinna Vinschen1-2/+12
* sec_acl.cc (get_posix_access): In case owner SID == group SID, when encountering the group entry, change the value of `id' accordingly. Explain why. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-11-18get_posix_access: Skip merging permissions if user can't get more permissionsCorinna Vinschen1-2/+11
* sec_acl.cc (get_posix_access): Skip merging permissions if current user has rwx permissions anywa, or if the sum of all group and other permissions is less than or equal to the user's permissions. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-11-18get_posix_access: Fix computation of effective user permissionsCorinna Vinschen1-2/+2
* sec_acl.cc (get_posix_access): Fix computation of effective user permissions to handle current user, not only the file owner. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-11-18Fix permission evaluation for !new_style ACLsCorinna Vinschen1-44/+47
* security.h (authz_get_user_attribute): Declare bool. * sec_helper.cc (authz_ctx::get_user_attribute): Make bool method. Set S_IxOTH bits in returned attributes rather than S_IxUSR bits. (authz_get_user_attribute): Make bool function. * sec_acl.cc (get_posix_access): Introduce cygsid array to keep track of all SIDs in the ACL. Move AuthZ calls into !new_style permission post processing. When not using AuthZ, use CheckTokenMembership to collect group permissions. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-11-18Fix up POSIX permission handlingCorinna Vinschen1-9/+45
* fhandler_disk_file.cc (fhandler_disk_file::fchmod): Disable deviation from POSIX 1003.1e in terms of GROUP_OBJ/CLASS_OBJ permissions. Follow POSIX 1003.1e again. Keep old code in for future reference. * sec_acl.cc: Accommodate changes in ACE creation in leading comment. (set_posix_access): Fix user deny ACE creation. Split group deny ACE creation into two steps, one to reflect CLASS_OBJ, the other to reflect OTHER_OBJ. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-11-18Use Authz to fetch correct user permissions.Corinna Vinschen1-2/+24
* sec_acl.cc (getacl): Use Authz to fetch correct user permissions. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-11-18* sec_acl.cc (get_posix_access): Fix class_perm in !new_style case.Corinna Vinschen1-1/+2
Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-11-18Reapply POSIX ACL changes.Corinna Vinschen1-377/+818
- New, unified implementation of POSIX permission and ACL handling. The new ACLs now store the POSIX ACL MASK/CLASS_OBJ permission mask, and they allow to inherit the S_ISGID bit. ACL inheritance now really works as desired, in a limited, but theoretically equivalent fashion even for non-Cygwin processes. To accommodate Windows default ACLs, the new code ignores SYSTEM and Administrators group permissions when computing the MASK/CLASS_OBJ permission mask on old ACLs, and it doesn't deny access to SYSTEM and Administrators group based on the value of MASK/CLASS_OBJ when creating the new ACLs. The new code now handles the S_ISGID bit on directories as on Linux: Setting S_ISGID on a directory causes new files and subdirs created within to inherit its group, rather than the primary group of the user who created the file. This only works for files and directories created by Cygwin processes. 2015-05-29 Corinna Vinschen <corinna@vinschen.de> Reapply POSIX ACL changes. * utils.xml (setfacl): Show new option output. (getfacl): Show new option output. * sec_acl.cc (get_posix_access): Check for Cygwin "standard" ACL. Apply umask, if so. Align comments. * security.cc (set_created_file_access): Fix permission masking by incoming requested file mode. * sec_acl.cc (set_posix_access): Apply mask only in terms of execute bit for SYSTEM and Admins group. * sec_acl.cc (set_posix_access): Don't create DENY ACEs for USER and GROUP entries if they are the same as USER_OBJ or GROUP_OBJ. * fhandler.h (fhandler_pty_slave::facl): Add prototype. * fhandler_tty.cc (fhandler_pty_slave::facl): New method. (fhandler_pty_slave::fchown): Fix uid/gid handling. * sec_acl.cc (set_posix_access): Drop superfluous class_idx variable. Simplify and move around code in a few places. To improve ACL readability, add r/w permissions to Admins ACE appended to pty ACL. Add comment to explain Windows ACE Mask filtering being in the way of creating a real CLASS_OBJ. (get_posix_access): Fake CLASS_OBJ for ptys. Explain why. * security.cc (get_object_attribute): Add S_IFCHR flag to attributes when calling get_posix_access. * sec_acl.cc (set_posix_access): Move merging group perms into owner perms in case of owner == group after mask has been computed. Take mask into account when doing so to avoid unnecessary ACCESS_DENIED_ACE. * sec_acl.cc (get_posix_access): Only set saw_group_obj flag if we saw the ACCESS_ALLOWED_ACE. * fhandler_disk_file.cc (fhandler_disk_file::fchmod): Deliberatly set GROUP_OBJ and CLASS_OBJ perms to new group perms. Add comment to explain why. * security.cc (set_created_file_access): Ditto. * sec_acl.cc (set_posix_access): Replace previous patch. Return EINVAL if uid and/or guid is invalid and not backed by an actual Windows account. * sec_acl.cc (set_posix_access): Workaround owner/group SIDs being NULL. * sec_acl.cc (set_posix_access): Handle files with owner == group. Rephrase switch statement checking against unfiltered a_type value. (get_posix_access): Handle files with owner == group. * sec_acl.cc (get_posix_access): Don't use GROUP_OBJ access to fix up CLASS_OBJ mask on old-style ACLs. Fix a comment. * sec_acl.cc (set_posix_access): Always make sure Admins have WRITE_DAC and WRITE_OWNER permissions. * security.h (create_object_sd_from_attribute): Drop handle parameter from prototype. * security.cc (create_object_sd_from_attribute): Drop handle parameter. Just create the standard POSIXy security descriptor. (set_object_attribute): Accommodate dropped paramter in call to create_object_sd_from_attribute. * fhandler_tty.cc: Ditto, throughout. * fhandler_disk_file.cc (fhandler_disk_file::fchmod): Fix typo in mask computation. * fhandler.cc (fhandler_base::open_with_arch): Call open with mode not umasked. (fhandler_base::open): Explicitely umask mode on NFS here. Call new set_created_file_access rather than set_file_attribute. * fhandler_disk_file.cc (fhandler_disk_file::fchmod): Reimplement setting permissions on filesystems supporting ACLs using the new set_posix_access call. (fhandler_disk_file::fchown): Ditto. (fhandler_disk_file::mkdir): Call new set_created_file_access rather than set_file_attribute. * fhandler_socket.cc (fhandler_socket::bind): Don't umask here. Add WRITE_OWNER access to allow writing group in case of SGID bit set. Call new set_created_file_access rather than set_file_attribute. * path.cc (symlink_worker): Call new set_created_file_access rather than set_file_attribute. * sec_acl.cc (searchace): Un-staticize. (set_posix_access): New, complementary functionality to get_posix_access. (setacl): Implement in terms of get_posix_access/set_posix_access. (get_posix_access): Add handling for just created files requiring their first Cygwin ACL. Fix new_style recognition. Handle SGID bit. For old-style ACLs, ignore SYSTEM and Administrators when computing the {DEF_}CLASS_OBJ perms. * security.cc (get_file_sd): Revamp comment. Change and (hopefully) speed up inheritance processing for just created files. (alloc_sd): Remove. (set_security_attribute): Call set_posix_access instead of alloc_sd. (get_object_attribute): Fix return value. (create_object_sd_from_attribute): Call set_posix_access instead of alloc_sd. (set_file_attribute): Remove. (set_created_file_access): New function implemented in terms of get_posix_access/set_posix_access. * security.h (set_file_attribute): Remove prototype. (set_created_file_access): Add prototype. (searchace): Ditto. (set_posix_access): Ditto. * syscalls.cc (open): Call open_with_arch with mode not umasked. * sec_acl.cc: Change preceeding comment explaining new-style ACLs. Describe how to generate deny ACEs in more detail. Accommodate the fact that a NULL deny ACE is used for {DEF_}CLASS_OBJ, rather than a special Cygwin ACE. Improve further comments. (CYG_ACE_NEW_STYLE): Define. (get_posix_access): Change from Cygwin ACE to NULL deny ACE. Fix CLASS_OBJ handling to generate CLASS_OBJ and DEF_CLASS_OBJ from a single NULL deny ACE if the inheritance flags say so. * sec_helper.cc (well_known_cygwin_sid): Remove. * security.h (well_known_cygwin_sid): Drop declaration. * sec_acl.cc (CYG_ACE_ISBITS_TO_WIN): Fix typo. (get_posix_access): Rename index variable from i to idx. Define only once at top level. * security.cc (add_access_allowed_ace): Drop unused parameter "offset". Accommodate throughout. (add_access_denied_ace): Ditto. * sec_acl.cc: Accommodate above change throughout. * security.h (add_access_allowed_ace): Adjust prototype to above change. (add_access_denied_ace): Ditto. * sec_acl.cc (get_posix_access): Handle multiple ACEs for the owner and primary group of the file. Handle the default primary group ACE as DEF_GROUP_OBJ entry if the directory has the S_ISGID bit set. Add comments. Minor code rearrangements. Preliminary read side implementation of new permission handling. * acl.h (MAX_ACL_ENTRIES): Raise to 2730. Add comment to explain. * sec_acl.cc: Add leading comment to explain new ACL style. Add definitions and macros to use for bits in new Cygwin ACL. (DENY_RWX): New mask value for all temporary deny bits. (getace): Add bool parameter to decide when leaving all bits intact, rather than filtering them per the already set bits. (get_posix_access): New function, taking over functionality to read POSIX ACL from SECURITY_DESCRIPTOR. (getacl): Just call get_posix_access. * sec_helper.cc (well_known_cygwin_sid): Define. * security.cc (get_attribute_from_acl): Remove. (get_info_from_sd): Remove. (get_reg_sd): Call get_posix_access instead of get_info_from_sd. (get_file_attribute): Ditto. (get_object_attribute): Ditto. * security.h (well_known_cygwin_sid): Declare. (get_posix_access): Add prototype. * Throughout, use simpler ACE macros from Windows' accctrl.h. * getfacl.c (main): Special-case SYSTEM and Admins group. Add comments. * setfacl.c: Align more to Linux tool. (delacl): New function to delete acl entries only. (modacl): Drop delete functionality. Add handling of recomputing the mask and default mask values. (delallacl): Rename from delacl. (setfacl): Call delacl in Delete case. Call delallacl in DeleteAll and DeleteDef case. (usage): Accommodate new options. Rearrange and rephrase slightly. (longopts): Emit 'x' in --delete case. Add --no-mask and --mask options. (opts): Add -x and -n options. (main): Handle -d and -x the same. Handle -n and --mask options. Drop handling for -r option. * getfacl.c (usage): Align more closely to Linux version. Add new options -c, -e, -E. Change formatting to accommodate longer options. (longopts): Rename --noname to --numeric. Keep --noname for backward compatibility. Add --omit-header, --all-effective and --no-effective options. (opts): Add -c, -e and -E option. (main): Handle new -c, -e, and -E options. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-04-23Remove __acl16 from official headerCorinna Vinschen1-0/+6
* include/cyggwin/acl.h (struct __acl16): Move from here... * sec_acl.cc: ...to here. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-02-27 * sec_acl.cc (getacl): Add mask even if all group and secondary accountCorinna Vinschen1-4/+12
permissions are 0.
2015-02-27 * sec_acl.cc (setacl): Fix bug which leads to ACE duplication inCorinna Vinschen1-24/+31
case owner SID == group SID. (getacl): Reverse order of SID test against group or owner sid to prefer owner attributes over group attributes. Disable setting group permissions equivalent to owner permissions if owner == group. Add comment to explain why. Fix indentation. * security.cc (get_attribute_from_acl): Change type of local variables containing permission to mode_t. Apply deny mask to group if group SID == owner SID to avoid Everyone permissions to spill over into group permissions. Disable setting group permissions equivalent to owner permissions if owner == group. Add comment to explain why. * uinfo.cc (pwdgrp::fetch_account_from_windows): Allow user SID as group account if user is a "Microsoft Account". Explain why. Drop workaround enforcing primary group "Users" for "Microsoft Accounts".
2015-02-25 * sec_acl.cc (setacl): Always grant default owner entryCorinna Vinschen1-0/+2
STANDARD_RIGHTS_ALL and FILE_WRITE_ATTRIBUTES access, too.
2015-02-19 * sec_acl.cc (setacl): Always grant owner FILE_WRITE_ATTRIBUTES access.Corinna Vinschen1-2/+3
2015-02-12 * sec_acl.cc (setacl): Introduce bool array "invalid" to note theCorinna Vinschen1-3/+6
invalidation of incoming acl entries while iterating over them.
2014-09-03 * sec_acl.cc (aclcheck32): Check for required default entries as well.Corinna Vinschen1-8/+8
Enable check for missing CLASS_OBJ entries, now that setfacl creates them.
2014-09-02 * sec_acl.cc (aclsort32): Set errno to EINVAL if aclcheck32 failed.Corinna Vinschen1-1/+4
2014-08-31 * sec_acl.cc (setacl): Add comment. Handle NULL ACE for SUID, SGID,Corinna Vinschen1-26/+126
and VTX bits. Create owner, group, other and NULL entries in the same way and in the same order as alloc_sd. (getacl): Skip NULL ACE.
2014-08-28 * fhandler.cc (fhandler_base::facl): Drop CLASS_OBJ entry.Corinna Vinschen1-17/+46
* fhandler_disk_file.cc (fhandler_disk_file::facl): Ditto in noacl case. * sec_acl.cc (getacl): Compute useful fake CLASS_OBJ and DEF_CLASS_OBJ permission bits based on how these values are generated on Linux. Add commants to explain what the code is doing. * security.cc (get_attribute_from_acl): Compute group permission based on the actual primary group permissions and all secondary user and group ACCESS_ALLOWED_ACEs to emulate Linux' behaviour more closely. (check_access): Fix typos im comment. * include/cygwin/acl.h (MIN_ACL_ENTRIES): Redefine as 3.
2014-02-27 * autoload.cc (CheckTokenMembership): Import.Corinna Vinschen1-7/+10
* external.cc (cygwin_internal): Call get_uid/get_gid instead of get_id. * grp.cc (internal_getgrsid): Take additional cyg_ldap pointer. Forward to pwdgrp::add_group_from_windows. (internal_getgrnam): Ditto. (internal_getgrgid): Ditto. (gr_ent::enumerate_local): Drop ugid_caching bool from call to pwdgrp::fetch_account_from_windows. (getgroups32): Rename from internal_getgroups and drop getgroups32 stub. Drop srchsid parameter and code handling it. Add local cyg_ldap instance and forward to internal_getgrXXX. (getgroups): Call getgroups32. (get_groups): Add local cyg_ldap instance and forward to internal_getgrXXX. (getgrouplist): Ditto. (setgroups32): Ditto. * ldap.cc (cyg_ldap::open): Don't call close. Return true if connection is already open. (cyg_ldap::remap_uid): Forward this to internal_getpwsid. (cyg_ldap::remap_gid): Forward this to internal_getgrsid. * passwd.cc (internal_getpwsid): Take additional cyg_ldap pointer. Forward to pwdgrp::add_user_from_windows. (internal_getpwnam): Ditto. (internal_getpwuid): Ditto. (pg_ent::enumerate_builtin): Drop ugid_caching bool from call to pwdgrp::fetch_account_from_windows. (pg_ent::enumerate_sam): Ditto. (pg_ent::enumerate_ad): Ditto. Forward local cldap instead. * pwdgrp.h (internal_getpwsid): Align declaration to above change. (internal_getpwnam): Ditto. (internal_getpwuid): Ditto. (internal_getgrsid): Ditto. (internal_getgrgid): Ditto. (internal_getgrnam): Ditto. (internal_getgroups): Drop declaration. (pwdgrp::add_account_from_windows): Align declaration to below change. (pwdgrp::add_user_from_windows): Ditto. (pwdgrp::add_group_from_windows): Ditto. * sec_acl.cc (setacl): Add local cyg_ldap instance and forward to internal_getpwuid and internal_getgrgid. (getacl): Add local cyg_ldap instance and forward to cygpsid::get_id. (aclfromtext32): Add local cyg_ldap instance and forward to internal_getpwnam and internal_getgrnam. * sec_helper.cc (cygpsid::get_id): Take additional cyg_ldap pointer. Forward to internal_getgrsid and internal_getpwsid. (get_sids_info): Drop ldap_open. Forward local cldap to internal_getpwsid and internal_getgrXXX. Call CheckTokenMembership rather than internal_getgroups. * security.h (cygpsid::get_id): Add cyg_ldap pointer, drop default parameter. (cygpsid::get_uid): Add cyg_ldap pointer. Call get_id accordingly. (cygpsid::get_gid): Ditto. * uinfo.cc (internal_getlogin): Add local cyg_ldap instance and forward to internal_getpwXXX and internal_getgrXXX calls. (pwdgrp::add_account_from_windows): Take additional cyg_ldap pointer. Forward to pwdgrp::fetch_account_from_windows. (fetch_posix_offset): Drop ldap_open argument and handling. Get cyg_ldap instance as pointer. (pwdgrp::fetch_account_from_windows): Take additional cyg_ldap pointer. Use it if it's not NULL, local instance otherwise. Drop ldap_open. Drop fetching extended group arguments from AD for speed.
2014-02-09 Introduce reading passwd/group entries from SAM/AD. IntroduceCorinna Vinschen1-2/+1
/etc/nsswitch.conf file to configure it. * Makefile.in (DLL_OFILES): Add ldap.o. * autoload.cc: Import ldap functions from wldap32.dll. (DsEnumerateDomainTrustsW): Import. (NetGroupGetInfo): Import. * cygheap.h (class cygheap_domain_info): New class to keep global domain info. (class cygheap_pwdgrp): New class to keep passwd/group caches and configuration info from /etc/nssswitch.conf. (struct init_cygheap): Add cygheap_domain_info member "dom" and cygheap_pwdgrp member "pg". * cygtls.h (struct _local_storage): Remove unused member "res". Rearrange slightly, Add members pwbuf and grbuf to implement non-caching passwd/group fetching from SAM/AD. Make pw_pos and pw_pos unsigned. * fhandler_disk_file.cc (fhandler_base::fstat_by_nfs_ea): Add RFC 2307 uid/gid mapping. * fhandler_process.cc: Drop including pwdgrp.h. * fhandler_procsysvipc.cc: Ditto. * fhandler_registry.cc (fhandler_registry::fstat): Set key uid/gid to ILLEGAL_UID/ILLEGAL_GID rather than UNKNOWN_UID/UNKNOWN_GID. * grp.cc (group_buf): Drop. (gr): Drop. (pwdgrp::parse_group): Fill pg_grp. (pwdgrp::read_group): Remove. (pwdgrp::init_grp): New method. (pwdgrp::prep_tls_grbuf): New method. (pwdgrp::find_group): New methods. (internal_getgrsid): Convert to call new pwdgrp methods. (internal_getgrnam): Ditto. (internal_getgrgid): Ditto. (getgrgid_r): Drop 2nd parameter from internal_getgrgid call. (getgrgid32): Ditto. (getgrnam_r): Ditto for internal_getgrnam. (getgrnam32): Ditto. (getgrent32): Convert to call new pwdgrp methods. (internal_getgrent): Remove. (internal_getgroups): Simplify, especially drop calls to internal_getgrent. * ldap.cc: New file implementing cyg_ldap class for LDAP access to AD and RFC 2307 server. * ldap.h: New header, declaring cyg_ldap class. * passwd.cc (passwd_buf): Drop. (pr): Drop. (pwdgrp::parse_passwd): Fill pg_pwd. (pwdgrp::read_passwd): Remove. (pwdgrp::init_pwd): New method. (pwdgrp::prep_tls_pwbuf): New method. (find_user): New methods. (internal_getpwsid): Convert to call new pwdgrp methods. (internal_getpwnam): Ditto. (internal_getpwuid): Ditto. (getpwuid32): Drop 2nd parameter from internal_getpwuid call. (getpwuid_r): Ditto. (getpwnam): Ditto for internal_getpwnam. (getpwnam_r): Ditto. (getpwent): Convert to call new pwdgrp methods. * path.cc (class etc): Remove all methods. * path.h (class etc): Drop. * pinfo.cc (pinfo_basic::pinfo_basic): Set gid to ILLEGAL_GID rather than UNKNOWN_GID. (pinfo_init): Ditto. * pwdgrp.h (internal_getpwnam): Drop 2nd parameter from declaration. (internal_getpwuid): Ditto. (internal_getgrgid): Ditto. (internal_getgrnam): Ditto. (internal_getgrent): Drop declaration. (enum fetch_user_arg_type_t): New type. (struct fetch_user_arg_t): New type. (struct pg_pwd): New type. (struct pg_grp): New type. (class pwdgrp): Rework to provide functions for file and db requests and caching. (class ugid_cache_t): New class to provide RFC 2307 uid map caching. (ugid_cache): Declare. * sec_acl.cc: Drop including pwdgrp.h. * sec_auth.cc: Drop including dsgetdc.h and pwdgrp.h. (get_logon_server): Convert third parameter to ULONG flags argument to allow arbitrary flags values in DsGetDcNameW call and change calls to this function throughout. Use cached account domain name rather than calling GetComputerNameW. (get_unix_group_sidlist): Remove. (get_server_groups): Drop call to get_unix_group_sidlist. (verify_token): Rework token group check without calling internal_getgrent. * sec_helper.cc (cygpsid::pstring): New methods, like string() but return pointer to end of string. (cygsid::getfromstr): Add wide character implementation. (get_sids_info): Add RFC 2307 uid/gid mapping for Samba shares. * security.cc: Drop including pwdgrp.h. * security.h (DEFAULT_UID): Remove. (UNKNOWN_UID): Remove. (UNKNOWN_GID): Remove. (uinfo_init): Move here from winsup.h. (ILLEGAL_UID): Ditto. (ILLEGAL_GID): Ditto. (UNIX_POSIX_OFFSET): Define. Add lengthy comment. (UNIX_POSIX_MASK): Ditto. (MAP_UNIX_TO_CYGWIN_ID): Ditto. (ILLEGAL_UID16): Move here from winsup.h. (ILLEGAL_GID16): Ditto. (uid16touid32): Ditto. (gid16togid32): Ditto. (sid_id_auth): New convenience macro for SID component access. (sid_sub_auth_count): Ditto. (sid_sub_auth): Ditto. (sid_sub_auth_rid): Ditto. (cygpsid::pstring): Declare. (cygsid::getfromstr): Declare wide character variant. (cygsid::operator=): Ditto. (cygsid::operator*=): Ditto. (get_logon_server): Change declaration according to source code. * setlsapwd.cc (setlsapwd): Drop 2nd parameter from internal_getpwnam call. * shared.cc (memory_init): Call cygheap->pg.init in first process. * syscalls.cc: Drop including pwdgrp.h. * tlsoffsets.h: Regenerate. * tlsoffsets64.h: Ditto. * uinfo.cc (internal_getlogin): Drop gratuitious internal_getpwuid call. Fix debug output. Overwrite user gid in border case of a missing passwd file while a group file exists. (pwdgrp::add_line): Allocate memory on cygheap. (pwdgrp::load): Remove. (ugid_cache): Define. (cygheap_pwdgrp::init): New method. (cygheap_pwdgrp::nss_init_line): New method. (cygheap_pwdgrp::_nss_init): New method. (cygheap_domain_info::init): New method. (logon_sid): Define. (get_logon_sid): New function. (pwdgrp::add_account_post_fetch): New method. (pwdgrp::add_account_from_file): New methods. (pwdgrp::add_account_from_windows): New methods. (pwdgrp::check_file): New method. (pwdgrp::fetch_account_from_line): New method. (pwdgrp::fetch_account_from_file): New method. (pwdgrp::fetch_account_from_windows): New method. * winsup.h: Move aforementioned macros and declarations to security.h.
generated by cgit v1.1 at 2024-10-20 10:28:04 +0000