1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * CDDL HEADER START 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 7*0Sstevel@tonic-gate * with the License. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 11*0Sstevel@tonic-gate * See the License for the specific language governing permissions 12*0Sstevel@tonic-gate * and limitations under the License. 13*0Sstevel@tonic-gate * 14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 19*0Sstevel@tonic-gate * 20*0Sstevel@tonic-gate * CDDL HEADER END 21*0Sstevel@tonic-gate */ 22*0Sstevel@tonic-gate /* 23*0Sstevel@tonic-gate * Copyright 1994,2001-2003 Sun Microsystems, Inc. 24*0Sstevel@tonic-gate * All rights reserved. 25*0Sstevel@tonic-gate * Use is subject to license terms. 26*0Sstevel@tonic-gate */ 27*0Sstevel@tonic-gate 28*0Sstevel@tonic-gate /* 29*0Sstevel@tonic-gate * ident "%Z%%M% %I% %E% SMI" 30*0Sstevel@tonic-gate */ 31*0Sstevel@tonic-gate 32*0Sstevel@tonic-gate const NFS_ACL_MAX_ENTRIES = 1024; 33*0Sstevel@tonic-gate 34*0Sstevel@tonic-gate typedef int uid; 35*0Sstevel@tonic-gate typedef unsigned short o_mode; 36*0Sstevel@tonic-gate 37*0Sstevel@tonic-gate /* 38*0Sstevel@tonic-gate * This is the format of an ACL which is passed over the network. 39*0Sstevel@tonic-gate */ 40*0Sstevel@tonic-gate struct aclent { 41*0Sstevel@tonic-gate int type; 42*0Sstevel@tonic-gate uid id; 43*0Sstevel@tonic-gate o_mode perm; 44*0Sstevel@tonic-gate }; 45*0Sstevel@tonic-gate 46*0Sstevel@tonic-gate /* 47*0Sstevel@tonic-gate * The values for the type element of the aclent structure. 48*0Sstevel@tonic-gate */ 49*0Sstevel@tonic-gate const NA_USER_OBJ = 0x1; /* object owner */ 50*0Sstevel@tonic-gate const NA_USER = 0x2; /* additional users */ 51*0Sstevel@tonic-gate const NA_GROUP_OBJ = 0x4; /* owning group of the object */ 52*0Sstevel@tonic-gate const NA_GROUP = 0x8; /* additional groups */ 53*0Sstevel@tonic-gate const NA_CLASS_OBJ = 0x10; /* file group class and mask entry */ 54*0Sstevel@tonic-gate const NA_OTHER_OBJ = 0x20; /* other entry for the object */ 55*0Sstevel@tonic-gate const NA_ACL_DEFAULT = 0x1000; /* default flag */ 56*0Sstevel@tonic-gate 57*0Sstevel@tonic-gate /* 58*0Sstevel@tonic-gate * The bit field values for the perm element of the aclent 59*0Sstevel@tonic-gate * structure. The three values can be combined to form any 60*0Sstevel@tonic-gate * of the 8 combinations. 61*0Sstevel@tonic-gate */ 62*0Sstevel@tonic-gate const NA_READ = 0x4; /* read permission */ 63*0Sstevel@tonic-gate const NA_WRITE = 0x2; /* write permission */ 64*0Sstevel@tonic-gate const NA_EXEC = 0x1; /* exec permission */ 65*0Sstevel@tonic-gate 66*0Sstevel@tonic-gate /* 67*0Sstevel@tonic-gate * This is the structure which contains the ACL entries for a 68*0Sstevel@tonic-gate * particular entity. It contains the ACL entries which apply 69*0Sstevel@tonic-gate * to this object plus any default ACL entries which are 70*0Sstevel@tonic-gate * inherited by its children. 71*0Sstevel@tonic-gate * 72*0Sstevel@tonic-gate * The values for the mask field are defined below. 73*0Sstevel@tonic-gate */ 74*0Sstevel@tonic-gate struct secattr { 75*0Sstevel@tonic-gate u_int mask; 76*0Sstevel@tonic-gate int aclcnt; 77*0Sstevel@tonic-gate aclent aclent<NFS_ACL_MAX_ENTRIES>; 78*0Sstevel@tonic-gate int dfaclcnt; 79*0Sstevel@tonic-gate aclent dfaclent<NFS_ACL_MAX_ENTRIES>; 80*0Sstevel@tonic-gate }; 81*0Sstevel@tonic-gate 82*0Sstevel@tonic-gate /* 83*0Sstevel@tonic-gate * The values for the mask element of the secattr struct as well 84*0Sstevel@tonic-gate * as for the mask element in the arguments in the GETACL2 and 85*0Sstevel@tonic-gate * GETACL3 procedures. 86*0Sstevel@tonic-gate */ 87*0Sstevel@tonic-gate const NA_ACL = 0x1; /* aclent contains a valid list */ 88*0Sstevel@tonic-gate const NA_ACLCNT = 0x2; /* the number of entries in the aclent list */ 89*0Sstevel@tonic-gate const NA_DFACL = 0x4; /* dfaclent contains a valid list */ 90*0Sstevel@tonic-gate const NA_DFACLCNT = 0x8; /* the number of entries in the dfaclent list */ 91*0Sstevel@tonic-gate 92*0Sstevel@tonic-gate /* 93*0Sstevel@tonic-gate * This the definition for the GETACL procedure which applies to 94*0Sstevel@tonic-gate * NFS Version 2. 95*0Sstevel@tonic-gate */ 96*0Sstevel@tonic-gate struct GETACL2args { 97*0Sstevel@tonic-gate fhandle_t fh; 98*0Sstevel@tonic-gate u_int mask; 99*0Sstevel@tonic-gate }; 100*0Sstevel@tonic-gate 101*0Sstevel@tonic-gate struct GETACL2resok { 102*0Sstevel@tonic-gate struct nfsfattr attr; 103*0Sstevel@tonic-gate secattr acl; 104*0Sstevel@tonic-gate }; 105*0Sstevel@tonic-gate 106*0Sstevel@tonic-gate union GETACL2res switch (enum nfsstat status) { 107*0Sstevel@tonic-gate case ACL2_OK: 108*0Sstevel@tonic-gate GETACL2resok resok; 109*0Sstevel@tonic-gate default: 110*0Sstevel@tonic-gate void; 111*0Sstevel@tonic-gate }; 112*0Sstevel@tonic-gate 113*0Sstevel@tonic-gate /* 114*0Sstevel@tonic-gate * This is the definition for the SETACL procedure which applies 115*0Sstevel@tonic-gate * NFS Version 2. 116*0Sstevel@tonic-gate */ 117*0Sstevel@tonic-gate struct SETACL2args { 118*0Sstevel@tonic-gate fhandle_t fh; 119*0Sstevel@tonic-gate secattr acl; 120*0Sstevel@tonic-gate }; 121*0Sstevel@tonic-gate 122*0Sstevel@tonic-gate struct SETACL2resok { 123*0Sstevel@tonic-gate struct nfsfattr attr; 124*0Sstevel@tonic-gate }; 125*0Sstevel@tonic-gate 126*0Sstevel@tonic-gate union SETACL2res switch (enum nfsstat status) { 127*0Sstevel@tonic-gate case ACL2_OK: 128*0Sstevel@tonic-gate SETACL2resok resok; 129*0Sstevel@tonic-gate default: 130*0Sstevel@tonic-gate void; 131*0Sstevel@tonic-gate }; 132*0Sstevel@tonic-gate 133*0Sstevel@tonic-gate /* 134*0Sstevel@tonic-gate * This is the definition for the GETATTR procedure which can be 135*0Sstevel@tonic-gate * used as an alternative to the GETATTR in NFS Version 2. The 136*0Sstevel@tonic-gate * main difference between this GETATTR and the NFS GETATTR is 137*0Sstevel@tonic-gate * that this GETATTR returns the mode of the file without it being 138*0Sstevel@tonic-gate * changed to match the min/max permissions mapping that the NFS 139*0Sstevel@tonic-gate * Version 2 server does. 140*0Sstevel@tonic-gate */ 141*0Sstevel@tonic-gate struct GETATTR2args { 142*0Sstevel@tonic-gate fhandle_t fh; 143*0Sstevel@tonic-gate }; 144*0Sstevel@tonic-gate 145*0Sstevel@tonic-gate struct GETATTR2resok { 146*0Sstevel@tonic-gate struct nfsfattr attr; 147*0Sstevel@tonic-gate }; 148*0Sstevel@tonic-gate 149*0Sstevel@tonic-gate union GETATTR2res switch (enum nfsstat status) { 150*0Sstevel@tonic-gate case ACL2_OK: 151*0Sstevel@tonic-gate GETATTR2resok resok; 152*0Sstevel@tonic-gate default: 153*0Sstevel@tonic-gate void; 154*0Sstevel@tonic-gate }; 155*0Sstevel@tonic-gate 156*0Sstevel@tonic-gate /* 157*0Sstevel@tonic-gate * This is the definition for the ACCESS procedure which applies 158*0Sstevel@tonic-gate * to NFS Version 2. 159*0Sstevel@tonic-gate */ 160*0Sstevel@tonic-gate struct ACCESS2args { 161*0Sstevel@tonic-gate fhandle_t fh; 162*0Sstevel@tonic-gate uint32 access; 163*0Sstevel@tonic-gate }; 164*0Sstevel@tonic-gate 165*0Sstevel@tonic-gate /* 166*0Sstevel@tonic-gate * The following access permissions may be requested: 167*0Sstevel@tonic-gate */ 168*0Sstevel@tonic-gate const ACCESS2_READ = 0x1; /* read data or readdir a directory */ 169*0Sstevel@tonic-gate const ACCESS2_LOOKUP = 0x2; /* lookup a name in a directory */ 170*0Sstevel@tonic-gate const ACCESS2_MODIFY = 0x4; /* rewrite existing file data or */ 171*0Sstevel@tonic-gate /* modify existing directory entries */ 172*0Sstevel@tonic-gate const ACCESS2_EXTEND = 0x8; /* write new data or add directory entries */ 173*0Sstevel@tonic-gate const ACCESS2_DELETE = 0x10; /* delete existing directory entry */ 174*0Sstevel@tonic-gate const ACCESS2_EXECUTE = 0x20; /* execute file (no meaning for a directory) */ 175*0Sstevel@tonic-gate 176*0Sstevel@tonic-gate struct ACCESS2resok { 177*0Sstevel@tonic-gate struct nfsfattr attr; 178*0Sstevel@tonic-gate uint32 access; 179*0Sstevel@tonic-gate }; 180*0Sstevel@tonic-gate 181*0Sstevel@tonic-gate union ACCESS2res switch (enum nfsstat status) { 182*0Sstevel@tonic-gate case ACL2_OK: 183*0Sstevel@tonic-gate ACCESS2resok resok; 184*0Sstevel@tonic-gate default: 185*0Sstevel@tonic-gate void; 186*0Sstevel@tonic-gate }; 187*0Sstevel@tonic-gate 188*0Sstevel@tonic-gate /* 189*0Sstevel@tonic-gate * This is the definition for the GETXATTRDIR procedure which applies 190*0Sstevel@tonic-gate * to NFS Version 2 files. 191*0Sstevel@tonic-gate */ 192*0Sstevel@tonic-gate struct GETXATTRDIR2args { 193*0Sstevel@tonic-gate fhandle_t fh; 194*0Sstevel@tonic-gate bool create; 195*0Sstevel@tonic-gate }; 196*0Sstevel@tonic-gate 197*0Sstevel@tonic-gate struct GETXATTRDIR2resok { 198*0Sstevel@tonic-gate fhandle_t fh; 199*0Sstevel@tonic-gate struct nfsfattr attr; 200*0Sstevel@tonic-gate }; 201*0Sstevel@tonic-gate 202*0Sstevel@tonic-gate union GETXATTRDIR2res switch (enum nfsstat status) { 203*0Sstevel@tonic-gate case ACL2_OK: 204*0Sstevel@tonic-gate GETXATTRDIR2resok resok; 205*0Sstevel@tonic-gate default: 206*0Sstevel@tonic-gate void; 207*0Sstevel@tonic-gate }; 208*0Sstevel@tonic-gate 209*0Sstevel@tonic-gate /* 210*0Sstevel@tonic-gate * This is the definition for the GETACL procedure which applies 211*0Sstevel@tonic-gate * to NFS Version 3 files. 212*0Sstevel@tonic-gate */ 213*0Sstevel@tonic-gate struct GETACL3args { 214*0Sstevel@tonic-gate nfs_fh3 fh; 215*0Sstevel@tonic-gate u_int mask; 216*0Sstevel@tonic-gate }; 217*0Sstevel@tonic-gate 218*0Sstevel@tonic-gate struct GETACL3resok { 219*0Sstevel@tonic-gate post_op_attr attr; 220*0Sstevel@tonic-gate secattr acl; 221*0Sstevel@tonic-gate }; 222*0Sstevel@tonic-gate 223*0Sstevel@tonic-gate struct GETACL3resfail { 224*0Sstevel@tonic-gate post_op_attr attr; 225*0Sstevel@tonic-gate }; 226*0Sstevel@tonic-gate 227*0Sstevel@tonic-gate union GETACL3res switch (nfsstat3 status) { 228*0Sstevel@tonic-gate case ACL3_OK: 229*0Sstevel@tonic-gate GETACL3resok resok; 230*0Sstevel@tonic-gate default: 231*0Sstevel@tonic-gate GETACL3resfail resfail; 232*0Sstevel@tonic-gate }; 233*0Sstevel@tonic-gate 234*0Sstevel@tonic-gate /* 235*0Sstevel@tonic-gate * This is the definition for the SETACL procedure which applies 236*0Sstevel@tonic-gate * to NFS Version 3 files. 237*0Sstevel@tonic-gate */ 238*0Sstevel@tonic-gate struct SETACL3args { 239*0Sstevel@tonic-gate nfs_fh3 fh; 240*0Sstevel@tonic-gate secattr acl; 241*0Sstevel@tonic-gate }; 242*0Sstevel@tonic-gate 243*0Sstevel@tonic-gate struct SETACL3resok { 244*0Sstevel@tonic-gate post_op_attr attr; 245*0Sstevel@tonic-gate }; 246*0Sstevel@tonic-gate 247*0Sstevel@tonic-gate struct SETACL3resfail { 248*0Sstevel@tonic-gate post_op_attr attr; 249*0Sstevel@tonic-gate }; 250*0Sstevel@tonic-gate 251*0Sstevel@tonic-gate union SETACL3res switch (nfsstat3 status) { 252*0Sstevel@tonic-gate case ACL3_OK: 253*0Sstevel@tonic-gate SETACL3resok resok; 254*0Sstevel@tonic-gate default: 255*0Sstevel@tonic-gate SETACL3resfail resfail; 256*0Sstevel@tonic-gate }; 257*0Sstevel@tonic-gate 258*0Sstevel@tonic-gate /* 259*0Sstevel@tonic-gate * This is the definition for the GETXATTRDIR procedure which applies 260*0Sstevel@tonic-gate * to NFS Version 3 files. 261*0Sstevel@tonic-gate */ 262*0Sstevel@tonic-gate struct GETXATTRDIR3args { 263*0Sstevel@tonic-gate nfs_fh3 fh; 264*0Sstevel@tonic-gate bool create; 265*0Sstevel@tonic-gate }; 266*0Sstevel@tonic-gate 267*0Sstevel@tonic-gate struct GETXATTRDIR3resok { 268*0Sstevel@tonic-gate nfs_fh3 fh; 269*0Sstevel@tonic-gate post_op_attr attr; 270*0Sstevel@tonic-gate }; 271*0Sstevel@tonic-gate 272*0Sstevel@tonic-gate union GETXATTRDIR3res switch (nfsstat3 status) { 273*0Sstevel@tonic-gate case ACL3_OK: 274*0Sstevel@tonic-gate GETXATTRDIR3resok resok; 275*0Sstevel@tonic-gate default: 276*0Sstevel@tonic-gate void; 277*0Sstevel@tonic-gate }; 278*0Sstevel@tonic-gate 279*0Sstevel@tonic-gate /* 280*0Sstevel@tonic-gate * XXX { 281*0Sstevel@tonic-gate * This is a transitional interface to enable Solaris NFSv4 282*0Sstevel@tonic-gate * clients to manipulate ACLs on Solaris servers until the 283*0Sstevel@tonic-gate * spec is complete enough to implement this inside the 284*0Sstevel@tonic-gate * NFSv4 protocol itself. NFSv4 does handle extended 285*0Sstevel@tonic-gate * attributes in-band. 286*0Sstevel@tonic-gate */ 287*0Sstevel@tonic-gate 288*0Sstevel@tonic-gate /* 289*0Sstevel@tonic-gate * This is the definition for the GETACL procedure which applies 290*0Sstevel@tonic-gate * to NFS Version 4 files. 291*0Sstevel@tonic-gate */ 292*0Sstevel@tonic-gate struct GETACL4args { 293*0Sstevel@tonic-gate nfs_fh4 fh; 294*0Sstevel@tonic-gate u_int mask; 295*0Sstevel@tonic-gate }; 296*0Sstevel@tonic-gate 297*0Sstevel@tonic-gate struct GETACL4resok { 298*0Sstevel@tonic-gate post_op_attr attr; 299*0Sstevel@tonic-gate secattr acl; 300*0Sstevel@tonic-gate }; 301*0Sstevel@tonic-gate 302*0Sstevel@tonic-gate struct GETACL4resfail { 303*0Sstevel@tonic-gate post_op_attr attr; 304*0Sstevel@tonic-gate }; 305*0Sstevel@tonic-gate 306*0Sstevel@tonic-gate union GETACL4res switch (nfsstat3 status) { 307*0Sstevel@tonic-gate case ACL4_OK: 308*0Sstevel@tonic-gate GETACL4resok resok; 309*0Sstevel@tonic-gate default: 310*0Sstevel@tonic-gate GETACL4resfail resfail; 311*0Sstevel@tonic-gate }; 312*0Sstevel@tonic-gate 313*0Sstevel@tonic-gate /* 314*0Sstevel@tonic-gate * This is the definition for the SETACL procedure which applies 315*0Sstevel@tonic-gate * to NFS Version 4 files. 316*0Sstevel@tonic-gate */ 317*0Sstevel@tonic-gate struct SETACL4args { 318*0Sstevel@tonic-gate nfs_fh4 fh; 319*0Sstevel@tonic-gate secattr acl; 320*0Sstevel@tonic-gate }; 321*0Sstevel@tonic-gate 322*0Sstevel@tonic-gate struct SETACL4resok { 323*0Sstevel@tonic-gate post_op_attr attr; 324*0Sstevel@tonic-gate }; 325*0Sstevel@tonic-gate 326*0Sstevel@tonic-gate struct SETACL4resfail { 327*0Sstevel@tonic-gate post_op_attr attr; 328*0Sstevel@tonic-gate }; 329*0Sstevel@tonic-gate 330*0Sstevel@tonic-gate union SETACL4res switch (nfsstat3 status) { 331*0Sstevel@tonic-gate case ACL4_OK: 332*0Sstevel@tonic-gate SETACL4resok resok; 333*0Sstevel@tonic-gate default: 334*0Sstevel@tonic-gate SETACL4resfail resfail; 335*0Sstevel@tonic-gate }; 336*0Sstevel@tonic-gate 337*0Sstevel@tonic-gate /* XXX } */ 338*0Sstevel@tonic-gate 339*0Sstevel@tonic-gate /* 340*0Sstevel@tonic-gate * Share the port with the NFS service. NFS has to be running 341*0Sstevel@tonic-gate * in order for this service to be useful anyway. 342*0Sstevel@tonic-gate */ 343*0Sstevel@tonic-gate const NFS_ACL_PORT = 2049; 344*0Sstevel@tonic-gate 345*0Sstevel@tonic-gate /* 346*0Sstevel@tonic-gate * This is the definition for the ACL network protocol which is used 347*0Sstevel@tonic-gate * to provide support for Solaris ACLs for files which are accessed 348*0Sstevel@tonic-gate * via NFS Version 2 and NFS Version 3. 349*0Sstevel@tonic-gate */ 350*0Sstevel@tonic-gate program NFS_ACL_PROGRAM { 351*0Sstevel@tonic-gate version NFS_ACL_V2 { 352*0Sstevel@tonic-gate void 353*0Sstevel@tonic-gate ACLPROC2_NULL(void) = 0; 354*0Sstevel@tonic-gate GETACL2res 355*0Sstevel@tonic-gate ACLPROC2_GETACL(GETACL2args) = 1; 356*0Sstevel@tonic-gate SETACL2res 357*0Sstevel@tonic-gate ACLPROC2_SETACL(SETACL2args) = 2; 358*0Sstevel@tonic-gate GETATTR2res 359*0Sstevel@tonic-gate ACLPROC2_GETATTR(GETATTR2args) = 3; 360*0Sstevel@tonic-gate ACCESS2res 361*0Sstevel@tonic-gate ACLPROC2_ACCESS(ACCESS2args) = 4; 362*0Sstevel@tonic-gate GETXATTRDIR2res 363*0Sstevel@tonic-gate ACLPROC2_GETXATTRDIR(GETXATTRDIR2args) = 5; 364*0Sstevel@tonic-gate } = 2; 365*0Sstevel@tonic-gate version NFS_ACL_V3 { 366*0Sstevel@tonic-gate void 367*0Sstevel@tonic-gate ACLPROC3_NULL(void) = 0; 368*0Sstevel@tonic-gate GETACL3res 369*0Sstevel@tonic-gate ACLPROC3_GETACL(GETACL3args) = 1; 370*0Sstevel@tonic-gate SETACL3res 371*0Sstevel@tonic-gate ACLPROC3_SETACL(SETACL3args) = 2; 372*0Sstevel@tonic-gate GETXATTRDIR3res 373*0Sstevel@tonic-gate ACLPROC3_GETXATTRDIR(GETXATTRDIR3args) = 3; 374*0Sstevel@tonic-gate } = 3; 375*0Sstevel@tonic-gate version NFS_ACL_V4 { 376*0Sstevel@tonic-gate void 377*0Sstevel@tonic-gate ACLPROC4_NULL(void) = 0; 378*0Sstevel@tonic-gate GETACL4res 379*0Sstevel@tonic-gate ACLPROC4_GETACL(GETACL4args) = 1; 380*0Sstevel@tonic-gate SETACL4res 381*0Sstevel@tonic-gate ACLPROC4_SETACL(SETACL4args) = 2; 382*0Sstevel@tonic-gate } = 4; 383*0Sstevel@tonic-gate } = 100227; 384