Context Navigation

source: branches/samba-3.2.x/source/utils/smbcacls.c

Visit:

Last change on this file was 232, checked in by Herwig Bauernfeind, 16 years ago
Update 3.2 branch to 3.2.8
File size: 26.9 KB

Rev	Line
[136]	1	/*
	2	Unix SMB/CIFS implementation.
	3	ACL get/set utility
	4
	5	Copyright (C) Andrew Tridgell 2000
	6	Copyright (C) Tim Potter 2000
	7	Copyright (C) Jeremy Allison 2000
	8	Copyright (C) Jelmer Vernooij 2003
	9
	10	This program is free software; you can redistribute it and/or modify
	11	it under the terms of the GNU General Public License as published by
	12	the Free Software Foundation; either version 3 of the License, or
	13	(at your option) any later version.
	14
	15	This program is distributed in the hope that it will be useful,
	16	but WITHOUT ANY WARRANTY; without even the implied warranty of
	17	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	18	GNU General Public License for more details.
	19
	20	You should have received a copy of the GNU General Public License
	21	along with this program. If not, see <http://www.gnu.org/licenses/>.
	22	*/
	23
	24	#include "includes.h"
	25
[228]	26	static int test_args;
[136]	27
	28	#define CREATE_ACCESS_READ READ_CONTROL_ACCESS
	29
	30	/* numeric is set when the user wants numeric SIDs and ACEs rather
	31	than going via LSA calls to resolve them */
[228]	32	static int numeric;
[136]	33
	34	enum acl_mode {SMB_ACL_SET, SMB_ACL_DELETE, SMB_ACL_MODIFY, SMB_ACL_ADD };
	35	enum chown_mode {REQUEST_NONE, REQUEST_CHOWN, REQUEST_CHGRP};
	36	enum exit_values {EXIT_OK, EXIT_FAILED, EXIT_PARSE_ERROR};
	37
	38	struct perm_value {
	39	const char *perm;
	40	uint32 mask;
	41	};
	42
	43	/* These values discovered by inspection */
	44
	45	static const struct perm_value special_values[] = {
	46	{ "R", 0x00120089 },
	47	{ "W", 0x00120116 },
	48	{ "X", 0x001200a0 },
	49	{ "D", 0x00010000 },
	50	{ "P", 0x00040000 },
	51	{ "O", 0x00080000 },
	52	{ NULL, 0 },
	53	};
	54
	55	static const struct perm_value standard_values[] = {
	56	{ "READ", 0x001200a9 },
	57	{ "CHANGE", 0x001301bf },
	58	{ "FULL", 0x001f01ff },
	59	{ NULL, 0 },
	60	};
	61
	62	/* Open cli connection and policy handle */
	63
	64	static NTSTATUS cli_lsa_lookup_sid(struct cli_state *cli,
	65	const DOM_SID *sid,
	66	TALLOC_CTX *mem_ctx,
	67	enum lsa_SidType *type,
	68	char domain, char name)
	69	{
	70	uint16 orig_cnum = cli->cnum;
	71	struct rpc_pipe_client *p;
	72	struct policy_handle handle;
	73	NTSTATUS status;
	74	TALLOC_CTX *frame = talloc_stackframe();
	75	enum lsa_SidType *types;
	76	char **domains;
	77	char **names;
	78
	79	if (!cli_send_tconX(cli, "IPC$", "?????", "", 0)) {
	80	return cli_nt_error(cli);
	81	}
	82
	83	p = cli_rpc_pipe_open_noauth(cli, PI_LSARPC, &status);
	84	if (p == NULL) {
	85	goto fail;
	86	}
	87
	88	status = rpccli_lsa_open_policy(p, talloc_tos(), True,
	89	GENERIC_EXECUTE_ACCESS, &handle);
	90	if (!NT_STATUS_IS_OK(status)) {
	91	goto fail;
	92	}
	93
	94	status = rpccli_lsa_lookup_sids(p, talloc_tos(), &handle, 1, sid,
	95	&domains, &names, &types);
	96	if (!NT_STATUS_IS_OK(status)) {
	97	goto fail;
	98	}
	99
	100	*type = types[0];
	101	*domain = talloc_move(mem_ctx, &domains[0]);
	102	*name = talloc_move(mem_ctx, &names[0]);
	103
	104	status = NT_STATUS_OK;
	105	fail:
	106	if (p != NULL) {
	107	cli_rpc_pipe_close(p);
	108	}
	109	cli_tdis(cli);
	110	cli->cnum = orig_cnum;
	111	TALLOC_FREE(frame);
	112	return status;
	113	}
	114
	115	static NTSTATUS cli_lsa_lookup_name(struct cli_state *cli,
	116	const char *name,
	117	enum lsa_SidType *type,
	118	DOM_SID *sid)
	119	{
	120	uint16 orig_cnum = cli->cnum;
	121	struct rpc_pipe_client *p;
	122	struct policy_handle handle;
	123	NTSTATUS status;
	124	TALLOC_CTX *frame = talloc_stackframe();
	125	DOM_SID *sids;
	126	enum lsa_SidType *types;
	127
	128	if (!cli_send_tconX(cli, "IPC$", "?????", "", 0)) {
	129	return cli_nt_error(cli);
	130	}
	131
	132	p = cli_rpc_pipe_open_noauth(cli, PI_LSARPC, &status);
	133	if (p == NULL) {
	134	goto fail;
	135	}
	136
	137	status = rpccli_lsa_open_policy(p, talloc_tos(), True,
	138	GENERIC_EXECUTE_ACCESS, &handle);
	139	if (!NT_STATUS_IS_OK(status)) {
	140	goto fail;
	141	}
	142
	143	status = rpccli_lsa_lookup_names(p, talloc_tos(), &handle, 1, &name,
	144	NULL, 1, &sids, &types);
	145	if (!NT_STATUS_IS_OK(status)) {
	146	goto fail;
	147	}
	148
	149	*type = types[0];
	150	*sid = sids[0];
	151
	152	status = NT_STATUS_OK;
	153	fail:
	154	if (p != NULL) {
	155	cli_rpc_pipe_close(p);
	156	}
	157	cli_tdis(cli);
	158	cli->cnum = orig_cnum;
	159	TALLOC_FREE(frame);
	160	return status;
	161	}
	162
	163	/* convert a SID to a string, either numeric or username/group */
	164	static void SidToString(struct cli_state cli, fstring str, const DOM_SID sid)
	165	{
	166	char *domain = NULL;
	167	char *name = NULL;
	168	enum lsa_SidType type;
	169	NTSTATUS status;
	170
	171	sid_to_fstring(str, sid);
	172
	173	if (numeric) {
	174	return;
	175	}
	176
	177	status = cli_lsa_lookup_sid(cli, sid, talloc_tos(), &type,
	178	&domain, &name);
	179
	180	if (!NT_STATUS_IS_OK(status)) {
	181	return;
	182	}
	183
[228]	184	if (*domain) {
	185	slprintf(str, sizeof(fstring) - 1, "%s%s%s",
	186	domain, lp_winbind_separator(), name);
	187	} else {
	188	fstrcpy(str, name);
	189	}
[136]	190	}
	191
	192	/* convert a string to a SID, either numeric or username/group */
	193	static bool StringToSid(struct cli_state cli, DOM_SID sid, const char *str)
	194	{
	195	enum lsa_SidType type;
	196
	197	if (strncmp(str, "S-", 2) == 0) {
	198	return string_to_sid(sid, str);
	199	}
	200
	201	return NT_STATUS_IS_OK(cli_lsa_lookup_name(cli, str, &type, sid));
	202	}
	203
[228]	204	static void print_ace_flags(FILE *f, uint8_t flags)
	205	{
	206	char *str = talloc_strdup(NULL, "");
[136]	207
[228]	208	if (!str) {
	209	goto out;
	210	}
	211
	212	if (flags & SEC_ACE_FLAG_OBJECT_INHERIT) {
	213	str = talloc_asprintf(str, "%s%s",
	214	str, "OI\|");
	215	if (!str) {
	216	goto out;
	217	}
	218	}
	219	if (flags & SEC_ACE_FLAG_CONTAINER_INHERIT) {
	220	str = talloc_asprintf(str, "%s%s",
	221	str, "CI\|");
	222	if (!str) {
	223	goto out;
	224	}
	225	}
	226	if (flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
	227	str = talloc_asprintf(str, "%s%s",
	228	str, "NP\|");
	229	if (!str) {
	230	goto out;
	231	}
	232	}
	233	if (flags & SEC_ACE_FLAG_INHERIT_ONLY) {
	234	str = talloc_asprintf(str, "%s%s",
	235	str, "IO\|");
	236	if (!str) {
	237	goto out;
	238	}
	239	}
	240	if (flags & SEC_ACE_FLAG_INHERITED_ACE) {
	241	str = talloc_asprintf(str, "%s%s",
	242	str, "I\|");
	243	if (!str) {
	244	goto out;
	245	}
	246	}
	247	/* Ignore define SEC_ACE_FLAG_SUCCESSFUL_ACCESS ( 0x40 )
	248	and SEC_ACE_FLAG_FAILED_ACCESS ( 0x80 ) as they're
	249	audit ace flags. */
	250
	251	if (str[strlen(str)-1] == '\|') {
	252	str[strlen(str)-1] = '\0';
	253	fprintf(f, "/%s/", str);
	254	} else {
	255	fprintf(f, "/0x%x/", flags);
	256	}
	257	TALLOC_FREE(str);
	258	return;
	259
	260	out:
	261	fprintf(f, "/0x%x/", flags);
	262	}
	263
[136]	264	/* print an ACE on a FILE, using either numeric or ascii representation */
	265	static void print_ace(struct cli_state cli, FILE f, SEC_ACE *ace)
	266	{
	267	const struct perm_value *v;
	268	fstring sidstr;
	269	int do_print = 0;
	270	uint32 got_mask;
	271
	272	SidToString(cli, sidstr, &ace->trustee);
	273
	274	fprintf(f, "%s:", sidstr);
	275
	276	if (numeric) {
[228]	277	fprintf(f, "%d/0x%x/0x%08x",
[136]	278	ace->type, ace->flags, ace->access_mask);
	279	return;
	280	}
	281
	282	/* Ace type */
	283
	284	if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED) {
	285	fprintf(f, "ALLOWED");
	286	} else if (ace->type == SEC_ACE_TYPE_ACCESS_DENIED) {
	287	fprintf(f, "DENIED");
	288	} else {
	289	fprintf(f, "%d", ace->type);
	290	}
	291
[228]	292	print_ace_flags(f, ace->flags);
[136]	293
	294	/* Standard permissions */
	295
	296	for (v = standard_values; v->perm; v++) {
	297	if (ace->access_mask == v->mask) {
	298	fprintf(f, "%s", v->perm);
	299	return;
	300	}
	301	}
	302
	303	/* Special permissions. Print out a hex value if we have
	304	leftover bits in the mask. */
	305
	306	got_mask = ace->access_mask;
	307
	308	again:
	309	for (v = special_values; v->perm; v++) {
	310	if ((ace->access_mask & v->mask) == v->mask) {
	311	if (do_print) {
	312	fprintf(f, "%s", v->perm);
	313	}
	314	got_mask &= ~v->mask;
	315	}
	316	}
	317
	318	if (!do_print) {
	319	if (got_mask != 0) {
	320	fprintf(f, "0x%08x", ace->access_mask);
	321	} else {
	322	do_print = 1;
	323	goto again;
	324	}
	325	}
	326	}
	327
[228]	328	static bool parse_ace_flags(const char str, unsigned int pflags)
	329	{
	330	const char *p = str;
	331	*pflags = 0;
[136]	332
[228]	333	while (*p) {
	334	if (strnequal(p, "OI", 2)) {
	335	*pflags \|= SEC_ACE_FLAG_OBJECT_INHERIT;
	336	p += 2;
	337	} else if (strnequal(p, "CI", 2)) {
	338	*pflags \|= SEC_ACE_FLAG_CONTAINER_INHERIT;
	339	p += 2;
	340	} else if (strnequal(p, "NP", 2)) {
	341	*pflags \|= SEC_ACE_FLAG_NO_PROPAGATE_INHERIT;
	342	p += 2;
	343	} else if (strnequal(p, "IO", 2)) {
	344	*pflags \|= SEC_ACE_FLAG_INHERIT_ONLY;
	345	p += 2;
	346	} else if (*p == 'I') {
	347	*pflags \|= SEC_ACE_FLAG_INHERITED_ACE;
	348	p += 1;
	349	} else if (*p) {
	350	return false;
	351	}
	352
	353	if (p != '\|' && p != '\0') {
	354	return false;
	355	}
	356	}
	357	return true;
	358	}
	359
[136]	360	/* parse an ACE in the same format as print_ace() */
	361	static bool parse_ace(struct cli_state cli, SEC_ACE ace,
	362	const char *orig_str)
	363	{
	364	char *p;
	365	const char *cp;
	366	char *tok;
	367	unsigned int atype = 0;
	368	unsigned int aflags = 0;
	369	unsigned int amask = 0;
	370	DOM_SID sid;
	371	SEC_ACCESS mask;
	372	const struct perm_value *v;
	373	char *str = SMB_STRDUP(orig_str);
	374	TALLOC_CTX *frame = talloc_stackframe();
	375
	376	if (!str) {
	377	TALLOC_FREE(frame);
	378	return False;
	379	}
	380
	381	ZERO_STRUCTP(ace);
	382	p = strchr_m(str,':');
	383	if (!p) {
	384	printf("ACE '%s': missing ':'.\n", orig_str);
	385	SAFE_FREE(str);
	386	TALLOC_FREE(frame);
	387	return False;
	388	}
	389	*p = '\0';
	390	p++;
	391	/* Try to parse numeric form */
	392
	393	if (sscanf(p, "%i/%i/%i", &atype, &aflags, &amask) == 3 &&
	394	StringToSid(cli, &sid, str)) {
	395	goto done;
	396	}
	397
	398	/* Try to parse text form */
	399
	400	if (!StringToSid(cli, &sid, str)) {
	401	printf("ACE '%s': failed to convert '%s' to SID\n",
	402	orig_str, str);
	403	SAFE_FREE(str);
	404	TALLOC_FREE(frame);
	405	return False;
	406	}
	407
	408	cp = p;
	409	if (!next_token_talloc(frame, &cp, &tok, "/")) {
	410	printf("ACE '%s': failed to find '/' character.\n",
	411	orig_str);
	412	SAFE_FREE(str);
	413	TALLOC_FREE(frame);
	414	return False;
	415	}
	416
	417	if (strncmp(tok, "ALLOWED", strlen("ALLOWED")) == 0) {
	418	atype = SEC_ACE_TYPE_ACCESS_ALLOWED;
	419	} else if (strncmp(tok, "DENIED", strlen("DENIED")) == 0) {
	420	atype = SEC_ACE_TYPE_ACCESS_DENIED;
	421	} else {
	422	printf("ACE '%s': missing 'ALLOWED' or 'DENIED' entry at '%s'\n",
	423	orig_str, tok);
	424	SAFE_FREE(str);
	425	TALLOC_FREE(frame);
	426	return False;
	427	}
	428
	429	/* Only numeric form accepted for flags at present */
	430
[228]	431	if (!next_token_talloc(frame, &cp, &tok, "/")) {
	432	printf("ACE '%s': bad flags entry at '%s'\n",
[136]	433	orig_str, tok);
	434	SAFE_FREE(str);
	435	TALLOC_FREE(frame);
	436	return False;
	437	}
	438
[228]	439	if (tok[0] < '0' \|\| tok[0] > '9') {
	440	if (!parse_ace_flags(tok, &aflags)) {
	441	printf("ACE '%s': bad named flags entry at '%s'\n",
	442	orig_str, tok);
	443	SAFE_FREE(str);
	444	TALLOC_FREE(frame);
	445	return False;
	446	}
	447	} else if (strnequal(tok, "0x", 2)) {
	448	if (!sscanf(tok, "%x", &aflags)) {
	449	printf("ACE '%s': bad hex flags entry at '%s'\n",
	450	orig_str, tok);
	451	SAFE_FREE(str);
	452	TALLOC_FREE(frame);
	453	return False;
	454	}
	455	} else {
	456	if (!sscanf(tok, "%i", &aflags)) {
	457	printf("ACE '%s': bad integer flags entry at '%s'\n",
	458	orig_str, tok);
	459	SAFE_FREE(str);
	460	TALLOC_FREE(frame);
	461	return False;
	462	}
	463	}
	464
[136]	465	if (!next_token_talloc(frame, &cp, &tok, "/")) {
	466	printf("ACE '%s': missing / at '%s'\n",
	467	orig_str, tok);
	468	SAFE_FREE(str);
	469	TALLOC_FREE(frame);
	470	return False;
	471	}
	472
	473	if (strncmp(tok, "0x", 2) == 0) {
	474	if (sscanf(tok, "%i", &amask) != 1) {
	475	printf("ACE '%s': bad hex number at '%s'\n",
	476	orig_str, tok);
	477	SAFE_FREE(str);
	478	TALLOC_FREE(frame);
	479	return False;
	480	}
	481	goto done;
	482	}
	483
	484	for (v = standard_values; v->perm; v++) {
	485	if (strcmp(tok, v->perm) == 0) {
	486	amask = v->mask;
	487	goto done;
	488	}
	489	}
	490
	491	p = tok;
	492
	493	while(*p) {
	494	bool found = False;
	495
	496	for (v = special_values; v->perm; v++) {
	497	if (v->perm[0] == *p) {
	498	amask \|= v->mask;
	499	found = True;
	500	}
	501	}
	502
	503	if (!found) {
	504	printf("ACE '%s': bad permission value at '%s'\n",
	505	orig_str, p);
	506	SAFE_FREE(str);
	507	TALLOC_FREE(frame);
	508	return False;
	509	}
	510	p++;
	511	}
	512
	513	if (*p) {
	514	TALLOC_FREE(frame);
	515	SAFE_FREE(str);
	516	return False;
	517	}
	518
	519	done:
	520	mask = amask;
	521	init_sec_ace(ace, &sid, atype, mask, aflags);
	522	TALLOC_FREE(frame);
	523	SAFE_FREE(str);
	524	return True;
	525	}
	526
	527	/* add an ACE to a list of ACEs in a SEC_ACL */
	528	static bool add_ace(SEC_ACL *the_acl, SEC_ACE ace)
	529	{
	530	SEC_ACL *new_ace;
	531	SEC_ACE *aces;
	532	if (! *the_acl) {
	533	return (((*the_acl) = make_sec_acl(talloc_tos(), 3, 1, ace))
	534	!= NULL);
	535	}
	536
	537	if (!(aces = SMB_CALLOC_ARRAY(SEC_ACE, 1+(*the_acl)->num_aces))) {
	538	return False;
	539	}
	540	memcpy(aces, (the_acl)->aces, (the_acl)->num_aces * sizeof(SEC_ACE));
	541	memcpy(aces+(*the_acl)->num_aces, ace, sizeof(SEC_ACE));
	542	new_ace = make_sec_acl(talloc_tos(),(the_acl)->revision,1+(the_acl)->num_aces, aces);
	543	SAFE_FREE(aces);
	544	(*the_acl) = new_ace;
	545	return True;
	546	}
	547
	548	/* parse a ascii version of a security descriptor */
	549	static SEC_DESC sec_desc_parse(TALLOC_CTX ctx, struct cli_state cli, char str)
	550	{
	551	const char *p = str;
	552	char *tok;
	553	SEC_DESC *ret = NULL;
	554	size_t sd_size;
	555	DOM_SID grp_sid=NULL, owner_sid=NULL;
	556	SEC_ACL *dacl=NULL;
	557	int revision=1;
	558
	559	while (next_token_talloc(ctx, &p, &tok, "\t,\r\n")) {
	560	if (strncmp(tok,"REVISION:", 9) == 0) {
	561	revision = strtol(tok+9, NULL, 16);
	562	continue;
	563	}
	564
	565	if (strncmp(tok,"OWNER:", 6) == 0) {
	566	if (owner_sid) {
	567	printf("Only specify owner once\n");
	568	goto done;
	569	}
	570	owner_sid = SMB_CALLOC_ARRAY(DOM_SID, 1);
	571	if (!owner_sid \|\|
	572	!StringToSid(cli, owner_sid, tok+6)) {
	573	printf("Failed to parse owner sid\n");
	574	goto done;
	575	}
	576	continue;
	577	}
	578
	579	if (strncmp(tok,"GROUP:", 6) == 0) {
	580	if (grp_sid) {
	581	printf("Only specify group once\n");
	582	goto done;
	583	}
	584	grp_sid = SMB_CALLOC_ARRAY(DOM_SID, 1);
	585	if (!grp_sid \|\|
	586	!StringToSid(cli, grp_sid, tok+6)) {
	587	printf("Failed to parse group sid\n");
	588	goto done;
	589	}
	590	continue;
	591	}
	592
	593	if (strncmp(tok,"ACL:", 4) == 0) {
	594	SEC_ACE ace;
	595	if (!parse_ace(cli, &ace, tok+4)) {
	596	goto done;
	597	}
	598	if(!add_ace(&dacl, &ace)) {
	599	printf("Failed to add ACL %s\n", tok);
	600	goto done;
	601	}
	602	continue;
	603	}
	604
	605	printf("Failed to parse token '%s' in security descriptor,\n", tok);
	606	goto done;
	607	}
	608
	609	ret = make_sec_desc(ctx,revision, SEC_DESC_SELF_RELATIVE, owner_sid, grp_sid,
	610	NULL, dacl, &sd_size);
	611
	612	done:
	613	SAFE_FREE(grp_sid);
	614	SAFE_FREE(owner_sid);
	615
	616	return ret;
	617	}
	618
	619
	620	/* print a ascii version of a security descriptor on a FILE handle */
	621	static void sec_desc_print(struct cli_state cli, FILE f, SEC_DESC *sd)
	622	{
	623	fstring sidstr;
	624	uint32 i;
	625
	626	fprintf(f, "REVISION:%d\n", sd->revision);
[228]	627	fprintf(f, "CONTROL:0x%x\n", sd->type);
[136]	628
	629	/* Print owner and group sid */
	630
	631	if (sd->owner_sid) {
	632	SidToString(cli, sidstr, sd->owner_sid);
	633	} else {
	634	fstrcpy(sidstr, "");
	635	}
	636
	637	fprintf(f, "OWNER:%s\n", sidstr);
	638
	639	if (sd->group_sid) {
	640	SidToString(cli, sidstr, sd->group_sid);
	641	} else {
	642	fstrcpy(sidstr, "");
	643	}
	644
	645	fprintf(f, "GROUP:%s\n", sidstr);
	646
	647	/* Print aces */
	648	for (i = 0; sd->dacl && i < sd->dacl->num_aces; i++) {
	649	SEC_ACE *ace = &sd->dacl->aces[i];
	650	fprintf(f, "ACL:");
	651	print_ace(cli, f, ace);
	652	fprintf(f, "\n");
	653	}
	654
	655	}
	656
	657	/*****************************************************
	658	dump the acls for a file
	659	*******************************************************/
	660	static int cacl_dump(struct cli_state cli, char filename)
	661	{
	662	int result = EXIT_FAILED;
	663	int fnum = -1;
	664	SEC_DESC *sd;
	665
	666	if (test_args)
	667	return EXIT_OK;
	668
	669	fnum = cli_nt_create(cli, filename, CREATE_ACCESS_READ);
	670
	671	if (fnum == -1) {
	672	printf("Failed to open %s: %s\n", filename, cli_errstr(cli));
	673	goto done;
	674	}
	675
	676	sd = cli_query_secdesc(cli, fnum, talloc_tos());
	677
	678	if (!sd) {
	679	printf("ERROR: secdesc query failed: %s\n", cli_errstr(cli));
	680	goto done;
	681	}
	682
	683	sec_desc_print(cli, stdout, sd);
	684
	685	result = EXIT_OK;
	686
	687	done:
	688	if (fnum != -1)
	689	cli_close(cli, fnum);
	690
	691	return result;
	692	}
	693
	694	/*****************************************************
	695	Change the ownership or group ownership of a file. Just
	696	because the NT docs say this can't be done :-). JRA.
	697	*******************************************************/
	698
	699	static int owner_set(struct cli_state *cli, enum chown_mode change_mode,
	700	const char filename, const char new_username)
	701	{
	702	int fnum;
	703	DOM_SID sid;
	704	SEC_DESC sd, old;
	705	size_t sd_size;
	706
	707	fnum = cli_nt_create(cli, filename, CREATE_ACCESS_READ);
	708
	709	if (fnum == -1) {
	710	printf("Failed to open %s: %s\n", filename, cli_errstr(cli));
	711	return EXIT_FAILED;
	712	}
	713
	714	if (!StringToSid(cli, &sid, new_username))
	715	return EXIT_PARSE_ERROR;
	716
	717	old = cli_query_secdesc(cli, fnum, talloc_tos());
	718
	719	cli_close(cli, fnum);
	720
	721	if (!old) {
	722	printf("owner_set: Failed to query old descriptor\n");
	723	return EXIT_FAILED;
	724	}
	725
	726	sd = make_sec_desc(talloc_tos(),old->revision, old->type,
	727	(change_mode == REQUEST_CHOWN) ? &sid : NULL,
	728	(change_mode == REQUEST_CHGRP) ? &sid : NULL,
	729	NULL, NULL, &sd_size);
	730
	731	fnum = cli_nt_create(cli, filename, WRITE_OWNER_ACCESS);
	732
	733	if (fnum == -1) {
	734	printf("Failed to open %s: %s\n", filename, cli_errstr(cli));
	735	return EXIT_FAILED;
	736	}
	737
	738	if (!cli_set_secdesc(cli, fnum, sd)) {
	739	printf("ERROR: secdesc set failed: %s\n", cli_errstr(cli));
[232]	740	cli_close(cli, fnum);
	741	return EXIT_FAILED;
[136]	742	}
	743
	744	cli_close(cli, fnum);
	745
	746	return EXIT_OK;
	747	}
	748
	749
[228]	750	/* The MSDN is contradictory over the ordering of ACE entries in an
	751	ACL. However NT4 gives a "The information may have been modified
	752	by a computer running Windows NT 5.0" if denied ACEs do not appear
	753	before allowed ACEs. At
	754	http://technet.microsoft.com/en-us/library/cc781716.aspx the
	755	canonical order is specified as "Explicit Deny, Explicit Allow,
	756	Inherited ACEs unchanged" */
[136]	757
	758	static int ace_compare(SEC_ACE ace1, SEC_ACE ace2)
	759	{
[228]	760	if (sec_ace_equal(ace1, ace2))
[136]	761	return 0;
	762
[228]	763	if ((ace1->flags & SEC_ACE_FLAG_INHERITED_ACE) &&
	764	!(ace2->flags & SEC_ACE_FLAG_INHERITED_ACE))
	765	return 1;
	766	if (!(ace1->flags & SEC_ACE_FLAG_INHERITED_ACE) &&
	767	(ace2->flags & SEC_ACE_FLAG_INHERITED_ACE))
	768	return -1;
	769	if ((ace1->flags & SEC_ACE_FLAG_INHERITED_ACE) &&
	770	(ace2->flags & SEC_ACE_FLAG_INHERITED_ACE))
	771	return ace1 - ace2;
	772
	773	if (ace1->type != ace2->type)
[136]	774	return ace2->type - ace1->type;
	775
[228]	776	if (sid_compare(&ace1->trustee, &ace2->trustee))
[136]	777	return sid_compare(&ace1->trustee, &ace2->trustee);
	778
[228]	779	if (ace1->flags != ace2->flags)
[136]	780	return ace1->flags - ace2->flags;
	781
[228]	782	if (ace1->access_mask != ace2->access_mask)
[136]	783	return ace1->access_mask - ace2->access_mask;
	784
[228]	785	if (ace1->size != ace2->size)
[136]	786	return ace1->size - ace2->size;
	787
	788	return memcmp(ace1, ace2, sizeof(SEC_ACE));
	789	}
	790
	791	static void sort_acl(SEC_ACL *the_acl)
	792	{
	793	uint32 i;
	794	if (!the_acl) return;
	795
	796	qsort(the_acl->aces, the_acl->num_aces, sizeof(the_acl->aces[0]), QSORT_CAST ace_compare);
	797
	798	for (i=1;i<the_acl->num_aces;) {
	799	if (sec_ace_equal(&the_acl->aces[i-1], &the_acl->aces[i])) {
	800	int j;
	801	for (j=i; j<the_acl->num_aces-1; j++) {
	802	the_acl->aces[j] = the_acl->aces[j+1];
	803	}
	804	the_acl->num_aces--;
	805	} else {
	806	i++;
	807	}
	808	}
	809	}
	810
	811	/*****************************************************
	812	set the ACLs on a file given an ascii description
	813	*******************************************************/
[228]	814
[136]	815	static int cacl_set(struct cli_state cli, char filename,
	816	char *the_acl, enum acl_mode mode)
	817	{
	818	int fnum;
	819	SEC_DESC sd, old;
	820	uint32 i, j;
	821	size_t sd_size;
	822	int result = EXIT_OK;
	823
	824	sd = sec_desc_parse(talloc_tos(), cli, the_acl);
	825
	826	if (!sd) return EXIT_PARSE_ERROR;
	827	if (test_args) return EXIT_OK;
	828
	829	/* The desired access below is the only one I could find that works
	830	with NT4, W2KP and Samba */
	831
	832	fnum = cli_nt_create(cli, filename, CREATE_ACCESS_READ);
	833
	834	if (fnum == -1) {
	835	printf("cacl_set failed to open %s: %s\n", filename, cli_errstr(cli));
	836	return EXIT_FAILED;
	837	}
	838
	839	old = cli_query_secdesc(cli, fnum, talloc_tos());
	840
	841	if (!old) {
	842	printf("calc_set: Failed to query old descriptor\n");
	843	return EXIT_FAILED;
	844	}
	845
	846	cli_close(cli, fnum);
	847
	848	/* the logic here is rather more complex than I would like */
	849	switch (mode) {
	850	case SMB_ACL_DELETE:
	851	for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
	852	bool found = False;
	853
	854	for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
	855	if (sec_ace_equal(&sd->dacl->aces[i],
	856	&old->dacl->aces[j])) {
	857	uint32 k;
	858	for (k=j; k<old->dacl->num_aces-1;k++) {
	859	old->dacl->aces[k] = old->dacl->aces[k+1];
	860	}
	861	old->dacl->num_aces--;
	862	found = True;
	863	break;
	864	}
	865	}
	866
	867	if (!found) {
[228]	868	printf("ACL for ACE:");
[136]	869	print_ace(cli, stdout, &sd->dacl->aces[i]);
	870	printf(" not found\n");
	871	}
	872	}
	873	break;
	874
	875	case SMB_ACL_MODIFY:
	876	for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
	877	bool found = False;
	878
	879	for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
	880	if (sid_equal(&sd->dacl->aces[i].trustee,
	881	&old->dacl->aces[j].trustee)) {
	882	old->dacl->aces[j] = sd->dacl->aces[i];
	883	found = True;
	884	}
	885	}
	886
	887	if (!found) {
	888	fstring str;
	889
	890	SidToString(cli, str,
	891	&sd->dacl->aces[i].trustee);
	892	printf("ACL for SID %s not found\n", str);
	893	}
	894	}
	895
	896	if (sd->owner_sid) {
	897	old->owner_sid = sd->owner_sid;
	898	}
	899
[228]	900	if (sd->group_sid) {
[136]	901	old->group_sid = sd->group_sid;
	902	}
	903
	904	break;
	905
	906	case SMB_ACL_ADD:
	907	for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
	908	add_ace(&old->dacl, &sd->dacl->aces[i]);
	909	}
	910	break;
	911
	912	case SMB_ACL_SET:
	913	old = sd;
	914	break;
	915	}
	916
	917	/* Denied ACE entries must come before allowed ones */
	918	sort_acl(old->dacl);
	919
	920	/* Create new security descriptor and set it */
	921
	922	/* We used to just have "WRITE_DAC_ACCESS" without WRITE_OWNER.
	923	But if we're sending an owner, even if it's the same as the one
	924	that already exists then W2K3 insists we open with WRITE_OWNER access.
	925	I need to check that setting a SD with no owner set works against WNT
	926	and W2K. JRA.
	927	*/
	928
	929	sd = make_sec_desc(talloc_tos(),old->revision, old->type,
	930	old->owner_sid, old->group_sid,
	931	NULL, old->dacl, &sd_size);
	932
	933	fnum = cli_nt_create(cli, filename, WRITE_DAC_ACCESS\|WRITE_OWNER_ACCESS);
	934
	935	if (fnum == -1) {
	936	printf("cacl_set failed to open %s: %s\n", filename, cli_errstr(cli));
	937	return EXIT_FAILED;
	938	}
	939
	940	if (!cli_set_secdesc(cli, fnum, sd)) {
	941	printf("ERROR: secdesc set failed: %s\n", cli_errstr(cli));
	942	result = EXIT_FAILED;
	943	}
	944
	945	/* Clean up */
	946
	947	cli_close(cli, fnum);
	948
	949	return result;
	950	}
	951
	952
	953	/*****************************************************
	954	Return a connection to a server.
	955	*******************************************************/
	956	static struct cli_state connect_one(const char server, const char *share)
	957	{
	958	struct cli_state *c = NULL;
	959	struct sockaddr_storage ss;
	960	NTSTATUS nt_status;
	961	uint32_t flags = 0;
	962
[228]	963	zero_sockaddr(&ss);
[136]	964
	965	if (get_cmdline_auth_info_use_kerberos()) {
	966	flags \|= CLI_FULL_CONNECTION_USE_KERBEROS \|
	967	CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS;
	968	}
	969
	970	if (get_cmdline_auth_info_use_machine_account() &&
	971	!set_cmdline_auth_info_machine_account_creds()) {
	972	return NULL;
	973	}
	974
	975	if (!get_cmdline_auth_info_got_pass()) {
	976	char *pass = getpass("Password: ");
	977	if (pass) {
	978	set_cmdline_auth_info_password(pass);
	979	}
	980	}
	981
	982	nt_status = cli_full_connection(&c, global_myname(), server,
	983	&ss, 0,
	984	share, "?????",
	985	get_cmdline_auth_info_username(),
	986	lp_workgroup(),
	987	get_cmdline_auth_info_password(),
	988	flags,
	989	get_cmdline_auth_info_signing_state(),
	990	NULL);
	991	if (!NT_STATUS_IS_OK(nt_status)) {
	992	DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status)));
	993	return NULL;
	994	}
	995
	996	if (get_cmdline_auth_info_smb_encrypt()) {
	997	nt_status = cli_cm_force_encryption(c,
	998	get_cmdline_auth_info_username(),
	999	get_cmdline_auth_info_password(),
	1000	lp_workgroup(),
	1001	share);
	1002	if (!NT_STATUS_IS_OK(nt_status)) {
	1003	cli_shutdown(c);
	1004	c = NULL;
	1005	}
	1006	}
	1007
	1008	return c;
	1009	}
	1010
	1011	/****************************************************************************
	1012	main program
	1013	****************************************************************************/
	1014	int main(int argc, const char *argv[])
	1015	{
	1016	char *share;
	1017	int opt;
	1018	enum acl_mode mode = SMB_ACL_SET;
	1019	static char *the_acl = NULL;
	1020	enum chown_mode change_mode = REQUEST_NONE;
	1021	int result;
	1022	char *path;
	1023	char *filename = NULL;
	1024	poptContext pc;
	1025	struct poptOption long_options[] = {
	1026	POPT_AUTOHELP
	1027	{ "delete", 'D', POPT_ARG_STRING, NULL, 'D', "Delete an acl", "ACL" },
	1028	{ "modify", 'M', POPT_ARG_STRING, NULL, 'M', "Modify an acl", "ACL" },
	1029	{ "add", 'a', POPT_ARG_STRING, NULL, 'a', "Add an acl", "ACL" },
	1030	{ "set", 'S', POPT_ARG_STRING, NULL, 'S', "Set acls", "ACLS" },
	1031	{ "chown", 'C', POPT_ARG_STRING, NULL, 'C', "Change ownership of a file", "USERNAME" },
	1032	{ "chgrp", 'G', POPT_ARG_STRING, NULL, 'G', "Change group ownership of a file", "GROUPNAME" },
[228]	1033	{ "numeric", 0, POPT_ARG_NONE, &numeric, 1, "Don't resolve sids or masks to names" },
	1034	{ "test-args", 't', POPT_ARG_NONE, &test_args, 1, "Test arguments"},
[136]	1035	POPT_COMMON_SAMBA
[141]	1036	POPT_COMMON_CONNECTION
[136]	1037	POPT_COMMON_CREDENTIALS
[141]	1038	POPT_TABLEEND
[136]	1039	};
	1040
	1041	struct cli_state *cli;
	1042	TALLOC_CTX *frame = talloc_stackframe();
	1043	const char *owner_username = "";
	1044	char *server;
	1045
	1046	load_case_tables();
	1047
	1048
	1049	/* set default debug level to 1 regardless of what smb.conf sets */
	1050	setup_logging( "smbcacls", True );
	1051	DEBUGLEVEL_CLASS[DBGC_ALL] = 1;
	1052	dbf = x_stderr;
	1053	x_setbuf( x_stderr, NULL );
	1054
	1055	setlinebuf(stdout);
	1056
	1057	lp_load(get_dyn_CONFIGFILE(),True,False,False,True);
	1058	load_interfaces();
	1059
	1060	pc = poptGetContext("smbcacls", argc, argv, long_options, 0);
	1061
	1062	poptSetOtherOptionHelp(pc, "//server1/share1 filename\nACLs look like: "
	1063	"'ACL:user:[ALLOWED\|DENIED]/flags/permissions'");
	1064
	1065	while ((opt = poptGetNextOpt(pc)) != -1) {
	1066	switch (opt) {
	1067	case 'S':
	1068	the_acl = smb_xstrdup(poptGetOptArg(pc));
	1069	mode = SMB_ACL_SET;
	1070	break;
	1071
	1072	case 'D':
	1073	the_acl = smb_xstrdup(poptGetOptArg(pc));
	1074	mode = SMB_ACL_DELETE;
	1075	break;
	1076
	1077	case 'M':
	1078	the_acl = smb_xstrdup(poptGetOptArg(pc));
	1079	mode = SMB_ACL_MODIFY;
	1080	break;
	1081
	1082	case 'a':
	1083	the_acl = smb_xstrdup(poptGetOptArg(pc));
	1084	mode = SMB_ACL_ADD;
	1085	break;
	1086
	1087	case 'C':
	1088	owner_username = poptGetOptArg(pc);
	1089	change_mode = REQUEST_CHOWN;
	1090	break;
	1091
	1092	case 'G':
	1093	owner_username = poptGetOptArg(pc);
	1094	change_mode = REQUEST_CHGRP;
	1095	break;
	1096	}
	1097	}
	1098
	1099	/* Make connection to server */
	1100	if(!poptPeekArg(pc)) {
	1101	poptPrintUsage(pc, stderr, 0);
	1102	return -1;
	1103	}
	1104
	1105	path = talloc_strdup(frame, poptGetArg(pc));
	1106	if (!path) {
	1107	return -1;
	1108	}
	1109
	1110	if(!poptPeekArg(pc)) {
	1111	poptPrintUsage(pc, stderr, 0);
	1112	return -1;
	1113	}
	1114
	1115	filename = talloc_strdup(frame, poptGetArg(pc));
	1116	if (!filename) {
	1117	return -1;
	1118	}
	1119
	1120	string_replace(path,'/','\\');
	1121
	1122	server = talloc_strdup(frame, path+2);
	1123	if (!server) {
	1124	return -1;
	1125	}
	1126	share = strchr_m(server,'\\');
	1127	if (!share) {
	1128	printf("Invalid argument: %s\n", share);
	1129	return -1;
	1130	}
	1131
	1132	*share = 0;
	1133	share++;
	1134
	1135	if (!test_args) {
	1136	cli = connect_one(server, share);
	1137	if (!cli) {
	1138	exit(EXIT_FAILED);
	1139	}
	1140	} else {
	1141	exit(0);
	1142	}
	1143
	1144	string_replace(filename, '/', '\\');
	1145	if (filename[0] != '\\') {
	1146	filename = talloc_asprintf(frame,
	1147	"\\%s",
	1148	filename);
	1149	if (!filename) {
	1150	return -1;
	1151	}
	1152	}
	1153
	1154	/* Perform requested action */
	1155
	1156	if (change_mode != REQUEST_NONE) {
	1157	result = owner_set(cli, change_mode, filename, owner_username);
	1158	} else if (the_acl) {
	1159	result = cacl_set(cli, filename, the_acl, mode);
	1160	} else {
	1161	result = cacl_dump(cli, filename);
	1162	}
	1163
	1164	TALLOC_FREE(frame);
	1165
	1166	return result;
	1167	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: