• Shirish Pargaonkar's avatar
    cifs: Add data structures and functions for uid/gid to SID mapping (try #4) · 21fed0d5
    Shirish Pargaonkar authored
    Add data structures and functions necessary to map a uid and gid to SID.
    These functions are very similar to the ones used to map a SID to uid and gid.
    This time, instead of storing sid to id mapping sorted on a sid value,
    id to sid is stored, sorted on an id.
    A cifs upcall sends an id (uid or gid) and expects a SID structure
    in return, if mapping was done successfully.
    
    A failed id to sid mapping to EINVAL.
    
    This patchset aims to enable chown and chgrp commands when
    cifsacl mount option is specified, especially to Windows SMB servers.
    Currently we can't do that.  So now along with chmod command,
    chown and chgrp work.
    
    Winbind is used to map id to a SID.  chown and chgrp use an upcall
    to provide an id to winbind and upcall returns with corrosponding
    SID if any exists. That SID is used to build security descriptor.
    The DACL part of a security descriptor is not changed by either
    chown or chgrp functionality.
    
    cifs client maintains a separate caches for uid to SID and
    gid to SID mapping. This is similar to the one used earlier
    to map SID to id (as part of ID mapping code).
    
    I tested it by mounting shares from a Windows (2003) server by
    authenticating as two users, one at a time, as Administrator and
    as a ordinary user.
    And then attempting to change owner of a file on the share.
    
    Depending on the permissions/privileges at the server for that file,
    chown request fails to either open a file (to change the ownership)
    or to set security descriptor.
    So it all depends on privileges on the file at the server and what
    user you are authenticated as at the server, cifs client is just a
    conduit.
    
    I compared the security descriptor during chown command to that
    what smbcacls sends when it is used with -M OWNNER: option
    and they are similar.
    
    This patchset aim to enable chown and chgrp commands when
    cifsacl mount option is specified, especially to Windows SMB servers.
    Currently we can't do that.  So now along with chmod command,
    chown and chgrp work.
    
    I tested it by mounting shares from a Windows (2003) server by
    authenticating as two users, one at a time, as Administrator and
    as a ordinary user.
    And then attempting to change owner of a file on the share.
    
    Depending on the permissions/privileges at the server for that file,
    chown request fails to either open a file (to change the ownership)
    or to set security descriptor.
    So it all depends on privileges on the file at the server and what
    user you are authenticated as at the server, cifs client is just a
    conduit.
    Signed-off-by: default avatarShirish Pargaonkar <shirishpargaonkar@gmail.com>
    Signed-off-by: default avatarSteve French <smfrench@gmail.com>
    21fed0d5
cifsacl.c 34.6 KB