evin/ms-nfs41-client
3
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

first stab at handling security irp

Browse source 
Basic handling of owner and group security query (no dacl).

Added new upcall for NFS41_ACL_QUERY (driver and daemon code).

Daemon, upon getting NFS41_ACL_QUERY first places a getattr that has
owner, group attribute request. We currently don't cache them!!!

Then, we parse nfs4name format (ie user@domain or group@domain)
into user and domain. We currently ignore domain part!!!

Then, we assume that whatever we are mapping is "known" locally
(ie LookupAccountName() api which retrieves a SID for a given name).
Mapping from name to SID can only be done in the userland. We then
copy the bytes via the upcall pipe to the kernel. If the received
user or group cant be mapped via LookupAccoundName(), we create a
well known null SID as the reply.

Kernel creates a security descriptor in the absolute-format and adds
owner and group sids to it. Important: RtlSetOwner/Group functions only
work with absolute-format security descriptor, however the reply to the
user needs to be in the self-relative format.

The way security query works is that it passes us a buffer to be filled
with the security context. However the user doesn't know how big the
buffer should be so, the user is allowed to pass a null buffer and have
the kernel return how much memory is needed. This leads to 2 security
queries => 2 NFS41_ACL_QUERY upcalls => 2 getattr rpcs... It should be
improved.

TODO:
- need to add caching of owner/group attributes for a file?
- need to add calls to LDAP for more general mapping?
- need to cache reply of the ACL if supplied length is 0?
This commit is contained in:
Olga Kornievskaia 2011-03-15 16:31:52 -04:00 • committed by unknown
parent d2ba08614c
commit ab55e6e8c5
9 changed files with 440 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
daemon/upcall.h
View file

@ -155,6 +155,16 @@ typedef struct __volume_upcall_args {
} info;
} volume_upcall_args;
typedef struct __getacl_upcall_args {
nfs41_root *root;
nfs41_open_state *state;
SECURITY_INFORMATION query;
PSID osid;
DWORD osid_len;
PSID gsid;
DWORD gsid_len;
} getacl_upcall_args;
typedef union __upcall_args {
mount_upcall_args mount;
unmount_upcall_args unmount;
@ -169,6 +179,7 @@ typedef union __upcall_args {
readdir_upcall_args readdir;
symlink_upcall_args symlink;
volume_upcall_args volume;
getacl_upcall_args getacl;
} upcall_args;
typedef struct __nfs41_upcall {