From patchwork Thu Sep 26 09:48:08 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve French X-Patchwork-Id: 1167798 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=linux-cifs-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="q3PHbbHF"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 46f9921MXkz9sCJ for ; Thu, 26 Sep 2019 19:48:22 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727313AbfIZJsV (ORCPT ); Thu, 26 Sep 2019 05:48:21 -0400 Received: from mail-io1-f47.google.com ([209.85.166.47]:42790 "EHLO mail-io1-f47.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725980AbfIZJsV (ORCPT ); Thu, 26 Sep 2019 05:48:21 -0400 Received: by mail-io1-f47.google.com with SMTP id n197so4784400iod.9 for ; Thu, 26 Sep 2019 02:48:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=PBz3pj9TaJd47nXYmj5ESk+QVXxEGGtS++jtFVtdLmw=; b=q3PHbbHFUi1UOjwNZUN6+sG/6VvmpjCY7EKJs6TxndW3klC5EHg7IlPrhtsfbYqyRx XwO0P7a5ouZqKaUo4woLVNPmMlVIFc84Ts6SLQBgG4r6m0pUwIs1Z5Ya3b+mRHUSjwTf F/ljUJyAr1OXywH7Wm2EKd0htaEsd2v5UP/QmW4Dt2v+XygcGxxgN7Qk3Q3aoXFBvVyY aoaaBQW+LeOxTZEulUrJVgzZsdPmQuUabhpk5vBpkenQop/6KCtcY8UBTtaaT1wrkW4u 4LPlIo6wE9lt/r4BLwo8Hu7VSW6vt6aVrsR57WdIOUt6RGbFLsLkm60U9I2DATPhNu1p Hf2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=PBz3pj9TaJd47nXYmj5ESk+QVXxEGGtS++jtFVtdLmw=; b=AZeSBi/ODm0x1kwXphRpcBruDKLvUGovQWOr/eBzl2atu5x0rbWuAW+cBmvN3gxAZv FmBjuQT0po7Ofu+f5lFYN3ONs/KulMYcMfOhe4aZW9BRri99OIanxX5LclQI0xlQZr8g 76loIewOyA6LNvz6tWey+Eqxz7HoRsJaXbDj9tortDK08d5Du05k8eC/EtVK8PYdwena 8IkLAuOFHDB0VlpmMAKAtIINcFDBgRn6MWb2MHDgs0jDx9J6zRPo9H4raqi55Ij2OQfA dHAxJORoPUT5IgbEjvqC4+OACLxG5vguV+4ih5DmPhDeinNxikWzpibM1EbAuKJpaXp/ cORg== X-Gm-Message-State: APjAAAUU7DoZR5A3pIBQMYrIIPytXdRCJU7Y+odZITWRen0L/mbsg7+z hTG0YRBK3hc48K+BhfFFbvk2P6dyfx4hQgGLU/nvbdhl X-Google-Smtp-Source: APXvYqxXJKcwQtR+S5+7nw1SNUanIzsfdh0pfbU4zQWdTI1ZxFpmsZJ4DQ8AQ8VZrlA+Q8+qocxFwTS6B8/hPtZRPjA= X-Received: by 2002:a92:c00d:: with SMTP id q13mr1427958ild.169.1569491299763; Thu, 26 Sep 2019 02:48:19 -0700 (PDT) MIME-Version: 1.0 From: Steve French Date: Thu, 26 Sep 2019 04:48:08 -0500 Message-ID: Subject: [SMB3][PATCH] Add missing ACL related defines To: CIFS Sender: linux-cifs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-cifs@vger.kernel.org Various missing defines needed for SMB3 security descriptors (see MS-DTYP) From a370f651cc9997020fac815c7f4442c34f5eea35 Mon Sep 17 00:00:00 2001 From: Steve French Date: Thu, 26 Sep 2019 04:37:18 -0500 Subject: [PATCH] smb3: missing ACL related flags Various SMB3 ACL related flags (for security descriptor and ACEs for example) were missing and some fields are different in SMB3 and CIFS. Update cifsacl.h definitions based on current MS-DTYP specification. Signed-off-by: Steve French --- fs/cifs/cifsacl.h | 81 ++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 80 insertions(+), 1 deletion(-) diff --git a/fs/cifs/cifsacl.h b/fs/cifs/cifsacl.h index eb428349f29a..73fe2f1a16da 100644 --- a/fs/cifs/cifsacl.h +++ b/fs/cifs/cifsacl.h @@ -90,14 +90,93 @@ struct cifs_acl { __le32 num_aces; } __attribute__((packed)); +/* ACE types - see MS-DTYP 2.4.4.1 */ +#define ACCESS_ALLOWED_ACE_TYPE 0x00 +#define ACCESS_DENIED_ACE_TYPE 0x01 +#define SYSTEM_AUDIT_ACE_TYPE 0x02 +#define SYSTEM_ALARM_ACE_TYPE 0x03 +#define ACCESS_ALLOWED_COMPOUND_ACE_TYPE 0x04 +#define ACCESS_ALLOWED_OBJECT_ACE_TYPE 0x05 +#define ACCESS_DENIED_OBJECT_ACE_TYPE 0x06 +#define SYSTEM_AUDIT_OBJECT_ACE_TYPE 0x07 +#define SYSTEM_ALARM_OBJECT_ACE_TYPE 0x08 +#define ACCESS_ALLOWED_CALLBACK_ACE_TYPE 0x09 +#define ACCESS_DENIED_CALLBACK_ACE_TYPE 0x0A +#define ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE 0x0B +#define ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE 0x0C +#define SYSTEM_AUDIT_CALLBACK_ACE_TYPE 0x0D +#define SYSTEM_ALARM_CALLBACK_ACE_TYPE 0x0E /* Reserved */ +#define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE 0x0F +#define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE 0x10 /* reserved */ +#define SYSTEM_MANDATORY_LABEL_ACE_TYPE 0x11 +#define SYSTEM_RESOURCE_ATTRIBUTE_ACE_TYPE 0x12 +#define SYSTEM_SCOPED_POLICY_ID_ACE_TYPE 0x13 + +/* ACE flags */ +#define OBJECT_INHERIT_ACE 0x01 +#define CONTAINER_INHERIT_ACE 0x02 +#define NO_PROPAGATE_INHERIT_ACE 0x04 +#define INHERIT_ONLY_ACE 0x08 +#define INHERITED_ACE 0x10 +#define SUCCESSFUL_ACCESS_ACE_FLAG 0x40 +#define FAILED_ACCESS_ACE_FLAG 0x80 + struct cifs_ace { - __u8 type; + __u8 type; /* see above and MS-DTYP 2.4.4.1 */ __u8 flags; __le16 size; __le32 access_req; struct cifs_sid sid; /* ie UUID of user or group who gets these perms */ } __attribute__((packed)); +/* + * The current SMB3 form of security descriptor is similar to what was used for + * cifs (see above) but some fields are split, and fields in the struct below + * matches names of fields to the the spec, MS-DTYP (see sections 2.4.5 and + * 2.4.6). Note that "CamelCase" fields are used in this struct in order to + * match the MS-DTYP and MS-SMB2 specs which define the wire format. + */ +struct smb3_sd { + __u8 Revision; /* revision level, MUST be one */ + __u8 Sbz1; /* only meaningful if 'RM' flag set below */ + __le16 Control; + __le32 OffsetOwner; + __le32 OffsetGroup; + __le32 OffsetSacl; + __le32 OffsetDacl; +} __packed; + +/* Meaning of 'Control' field flags */ +#define ACL_CONTROL_SR 0x0001 /* Self relative */ +#define ACL_CONTROL_RM 0x0002 /* Resource manager control bits */ +#define ACL_CONTROL_PS 0x0004 /* SACL protected from inherits */ +#define ACL_CONTROL_PD 0x0008 /* DACL protected from inherits */ +#define ACL_CONTROL_SI 0x0010 /* SACL Auto-Inherited */ +#define ACL_CONTROL_DI 0x0020 /* DACL Auto-Inherited */ +#define ACL_CONTROL_SC 0x0040 /* SACL computed through inheritance */ +#define ACL_CONTROL_DC 0x0080 /* DACL computed through inheritence */ +#define ACL_CONTROL_SS 0x0100 /* Create server ACL */ +#define ACL_CONTROL_DT 0x0200 /* DACL provided by trusteed source */ +#define ACL_CONTROL_SD 0x0400 /* SACL defaulted */ +#define ACL_CONTROL_SP 0x0800 /* SACL is present on object */ +#define ACL_CONTROL_DD 0x1000 /* DACL defaulted */ +#define ACL_CONTROL_DP 0x2000 /* DACL is present on object */ +#define ACL_CONTROL_GD 0x4000 /* Group was defaulted */ +#define ACL_CONTROL_OD 0x8000 /* User was defaulted */ + +/* Meaning of AclRevision flags */ +#define ACL_REVISION 0x02 /* See section 2.4.4.1 of MS-DTYP */ +#define ACL_REVISION_DS 0x04 /* Additional AceTypes allowed */ + +struct smb3_acl { + u8 AclRevision; /* revision level */ + u8 Sbz1; /* MBZ */ + __le16 AclSize; + __le16 AceCount; + __le16 Sbz2; /* MBZ */ +} __packed; + + /* * Minimum security identifier can be one for system defined Users * and Groups such as NULL SID and World or Built-in accounts such -- 2.20.1