source4/lib/policy/gp_filesys.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Group Policy Object Support
   4  *  Copyright (C) Wilco Baan Hofman 2008-2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "includes.h"
  20 #include "system/filesys.h"
  21 #include "lib/policy/policy.h"
  22 #include "libcli/raw/smb.h"
  23 #include "libcli/libcli.h"
  24 #include "param/param.h"
  25 #include "libcli/resolve/resolve.h"
  26 #include "libcli/raw/libcliraw.h"
  27 #include <dirent.h>
  28 #include <errno.h>
  29
  30 #define GP_MAX_DEPTH 25
  31
  32 struct gp_file_entry {
  33         bool is_directory;
  34         const char *rel_path;
  35 };
  36 struct gp_file_list {
  37         uint32_t num_files;
  38         struct gp_file_entry *files;
  39 };
  40 struct gp_list_state {
  41         struct smbcli_tree *tree;
  42         uint8_t depth;
  43         const char *cur_rel_path;
  44         const char *share_path;
  45
  46         struct gp_file_list list;
  47 };
  48
  49 static NTSTATUS gp_do_list(const char *, struct gp_list_state *);
  50
  51 /* Create a temporary policy directory */
  52 static const char *gp_tmpdir(TALLOC_CTX *mem_ctx)
  53 {
  54         char *gp_dir = talloc_asprintf(mem_ctx, "%s/policy", tmpdir());
  55         struct stat st;
  56         int rv;
  57
  58         if (gp_dir == NULL) return NULL;
  59
  60         if (stat(gp_dir, &st) != 0) {
  61                 rv = mkdir(gp_dir, 0755);
  62                 if (rv < 0) {
  63                         DEBUG(0, ("Failed to create directory %s: %s\n",
  64                                         gp_dir, strerror(errno)));
  65                         talloc_free(gp_dir);
  66                         return NULL;
  67                 }
  68         }
  69
  70         return gp_dir;
  71 }
  72
  73 /* This function is called by the smbcli_list function */
  74 static void gp_list_helper (struct clilist_file_info *info, const char *mask,
  75                             void *list_state_ptr)
  76 {
  77         struct gp_list_state *state = list_state_ptr;
  78         const char *rel_path;
  79
  80         /* Ignore . and .. directory entries */
  81         if (strcmp(info->name, ".") == 0 || strcmp(info->name, "..") == 0) {
  82                 return;
  83         }
  84
  85         /* Safety check against ../.. in filenames which may occur on non-POSIX
  86          * platforms */
  87         if (strstr(info->name, "../")) {
  88                 return;
  89         }
  90
  91         rel_path = talloc_asprintf(state, "%s\\%s", state->cur_rel_path, info->name);
  92         if (rel_path == NULL) return;
  93
  94         /* Append entry to file list */
  95         state->list.files = talloc_realloc(state, state->list.files,
  96                         struct gp_file_entry,
  97                         state->list.num_files + 1);
  98         if (state->list.files == NULL) return;
  99
 100         state->list.files[state->list.num_files].rel_path = rel_path;
 101
 102         /* Directory */
 103         if (info->attrib & FILE_ATTRIBUTE_DIRECTORY) {
 104                 state->list.files[state->list.num_files].is_directory = true;
 105                 state->list.num_files++;
 106
 107                 /* Recurse into this directory if the depth is below the maximum */
 108                 if (state->depth < GP_MAX_DEPTH) {
 109                         gp_do_list(rel_path, state);
 110                 }
 111
 112                 return;
 113         }
 114
 115         state->list.files[state->list.num_files].is_directory = false;
 116         state->list.num_files++;
 117
 118         return;
 119 }
 120
 121 static NTSTATUS gp_do_list (const char *rel_path, struct gp_list_state *state)
 122 {
 123         uint16_t attributes;
 124         int rv;
 125         char *mask;
 126         const char *old_rel_path;
 127
 128         attributes = FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN |
 129                      FILE_ATTRIBUTE_DIRECTORY;
 130
 131         /* Update the relative paths, while buffering the parent */
 132         old_rel_path = state->cur_rel_path;
 133         state->cur_rel_path = rel_path;
 134         state->depth++;
 135
 136         /* Get the current mask */
 137         mask = talloc_asprintf(state, "%s%s\\*", state->share_path, rel_path);
 138         NT_STATUS_HAVE_NO_MEMORY(mask);
 139         rv = smbcli_list(state->tree, mask, attributes, gp_list_helper, state);
 140         talloc_free(mask);
 141
 142         /* Go back to the state of the parent */
 143         state->cur_rel_path = old_rel_path;
 144         state->depth--;
 145
 146         if (rv == -1)
 147                 return NT_STATUS_UNSUCCESSFUL;
 148
 149         return NT_STATUS_OK;
 150 }
 151
 152 static NTSTATUS gp_cli_connect(struct gp_context *gp_ctx)
 153 {
 154         struct smbcli_options options;
 155         struct smbcli_session_options session_options;
 156
 157         if (gp_ctx->cli != NULL)
 158                 return NT_STATUS_OK;
 159
 160         gp_ctx->cli = smbcli_state_init(gp_ctx);
 161
 162         lpcfg_smbcli_options(gp_ctx->lp_ctx, &options);
 163         lpcfg_smbcli_session_options(gp_ctx->lp_ctx, &session_options);
 164
 165         return smbcli_full_connection(gp_ctx,
 166                         &gp_ctx->cli,
 167                         gp_ctx->active_dc->name,
 168                         lpcfg_smb_ports(gp_ctx->lp_ctx),
 169                         "sysvol",
 170                         NULL,
 171                         lpcfg_socket_options(gp_ctx->lp_ctx),
 172                         gp_ctx->credentials,
 173                         lpcfg_resolve_context(gp_ctx->lp_ctx),
 174                         gp_ctx->ev_ctx,
 175                         &options,
 176                         &session_options,
 177                         lpcfg_gensec_settings(gp_ctx, gp_ctx->lp_ctx));
 178 }
 179
 180 static char * gp_get_share_path(TALLOC_CTX *mem_ctx, const char *file_sys_path)
 181 {
 182         unsigned int i, bkslash_cnt;
 183
 184         /* Get the path from the share down (\\..\..\(this\stuff) */
 185         for (i = 0, bkslash_cnt = 0; file_sys_path[i] != '\0'; i++) {
 186                 if (file_sys_path[i] == '\\')
 187                         bkslash_cnt++;
 188
 189                 if (bkslash_cnt == 4) {
 190                         return talloc_strdup(mem_ctx, &file_sys_path[i]);
 191                 }
 192         }
 193
 194         return NULL;
 195 }
 196
 197 static NTSTATUS gp_get_file (struct smbcli_tree *tree, const char *remote_src,
 198                              const char *local_dst)
 199 {
 200         int fh_remote, fh_local;
 201         uint8_t *buf;
 202         size_t nread = 0;
 203         size_t buf_size = 1024;
 204         size_t file_size;
 205         uint16_t attr;
 206
 207         /* Open the remote file */
 208         fh_remote = smbcli_open(tree, remote_src, O_RDONLY, DENY_NONE);
 209         if (fh_remote == -1) {
 210                 DEBUG(0, ("Failed to open remote file: %s\n", remote_src));
 211                 return NT_STATUS_UNSUCCESSFUL;
 212         }
 213
 214         /* Open the local file */
 215         fh_local = open(local_dst, O_WRONLY | O_CREAT | O_TRUNC, 0644);
 216         if (fh_local == -1) {
 217                 DEBUG(0, ("Failed to open local file: %s\n", local_dst));
 218                 return NT_STATUS_UNSUCCESSFUL;
 219         }
 220
 221         /* Get the remote file size for error checking */
 222         if (NT_STATUS_IS_ERR(smbcli_qfileinfo(tree, fh_remote,
 223                                 &attr, &file_size, NULL, NULL, NULL, NULL, NULL)) &&
 224                         NT_STATUS_IS_ERR(smbcli_getattrE(tree, fh_remote,
 225                                 &attr, &file_size, NULL, NULL, NULL))) {
 226                 DEBUG(0, ("Failed to get remote file size: %s\n", smbcli_errstr(tree)));
 227                 return NT_STATUS_UNSUCCESSFUL;
 228         }
 229
 230         buf = talloc_zero_array(tree, uint8_t, buf_size);
 231         NT_STATUS_HAVE_NO_MEMORY(buf);
 232
 233         /* Copy the contents of the file */
 234         while (1) {
 235                 int n = smbcli_read(tree, fh_remote, buf, nread, buf_size);
 236
 237                 if (n <= 0) {
 238                         break;
 239                 }
 240
 241                 if (write(fh_local, buf, n) != n) {
 242                         DEBUG(0, ("Short write while copying file.\n"));
 243                         talloc_free(buf);
 244                         return NT_STATUS_UNSUCCESSFUL;
 245                 }
 246                 nread += n;
 247         }
 248
 249         /* Bytes read should match the file size, or the copy was incomplete */
 250         if (nread != file_size) {
 251                 DEBUG(0, ("Remote/local file size mismatch after copying file: "
 252                           "%s (remote %zu, local %zu).\n",
 253                           remote_src, file_size, nread));
 254                 close(fh_local);
 255                 talloc_free(buf);
 256                 return NT_STATUS_UNSUCCESSFUL;
 257         }
 258
 259         /* Close the files */
 260         smbcli_close(tree, fh_remote);
 261         close(fh_local);
 262
 263         talloc_free(buf);
 264         return NT_STATUS_OK;
 265 }
 266
 267 static NTSTATUS gp_get_files(struct smbcli_tree *tree, const char *share_path,
 268                              const char *local_path, struct gp_file_list *list)
 269 {
 270         uint32_t i;
 271         int rv;
 272         char *local_rel_path, *full_local_path, *full_remote_path;
 273         TALLOC_CTX *mem_ctx;
 274         NTSTATUS status;
 275
 276         mem_ctx = talloc_new(tree);
 277         NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
 278
 279         for (i = 0; i < list->num_files; i++) {
 280
 281                 /* Get local path by replacing backslashes with slashes */
 282                 local_rel_path = talloc_strdup(mem_ctx, list->files[i].rel_path);
 283                 if (local_rel_path == NULL) {
 284                         TALLOC_FREE(mem_ctx);
 285                         return NT_STATUS_NO_MEMORY;
 286                 }
 287                 string_replace(local_rel_path, '\\', '/');
 288
 289                 full_local_path = talloc_asprintf(mem_ctx, "%s%s", local_path,
 290                                 local_rel_path);
 291                 if (full_local_path == NULL) {
 292                         TALLOC_FREE(mem_ctx);
 293                         return NT_STATUS_NO_MEMORY;
 294                 }
 295
 296                 /* If the entry is a directory, create it. */
 297                 if (list->files[i].is_directory == true) {
 298                         rv = mkdir(full_local_path, 0755);
 299                         if (rv < 0) {
 300                                 DEBUG(0, ("Failed to create directory %s: %s\n",
 301                                                 full_local_path, strerror(errno)));
 302                                 talloc_free(mem_ctx);
 303                                 return NT_STATUS_UNSUCCESSFUL;
 304                         }
 305                         continue;
 306                 }
 307
 308                 full_remote_path = talloc_asprintf(mem_ctx, "%s%s", share_path,
 309                                 list->files[i].rel_path);
 310                 if (full_remote_path == NULL) {
 311                         TALLOC_FREE(mem_ctx);
 312                         return NT_STATUS_NO_MEMORY;
 313                 }
 314
 315                 /* Get the file */
 316                 status = gp_get_file(tree, full_remote_path, full_local_path);
 317                 if (!NT_STATUS_IS_OK(status)) {
 318                         DEBUG(0, ("Error getting file.\n"));
 319                         talloc_free(mem_ctx);
 320                         return status;
 321                 }
 322         }
 323
 324         return NT_STATUS_OK;
 325 }
 326
 327 NTSTATUS gp_fetch_gpt (struct gp_context *gp_ctx, struct gp_object *gpo,
 328                        const char **ret_local_path)
 329 {
 330         TALLOC_CTX *mem_ctx;
 331         struct gp_list_state *state;
 332         NTSTATUS status;
 333         struct stat st;
 334         int rv;
 335         const char *local_path, *share_path;
 336
 337         /* Create a forked memory context, as a base for everything here */
 338         mem_ctx = talloc_new(gp_ctx);
 339         NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
 340
 341         if (gp_ctx->cli == NULL) {
 342                 status = gp_cli_connect(gp_ctx);
 343                 if (!NT_STATUS_IS_OK(status)) {
 344                         DEBUG(0, ("Failed to create cli connection to DC\n"));
 345                         talloc_free(mem_ctx);
 346                         return status;
 347                 }
 348         }
 349
 350         /* Get the remote path to copy from */
 351         share_path = gp_get_share_path(mem_ctx, gpo->file_sys_path);
 352         if (share_path == NULL) {
 353                 TALLOC_FREE(mem_ctx);
 354                 return NT_STATUS_NO_MEMORY;
 355         }
 356
 357         /* Get the local path to copy to */
 358         local_path = talloc_asprintf(gp_ctx, "%s/%s", gp_tmpdir(mem_ctx), gpo->name);
 359         if (local_path == NULL) {
 360                 TALLOC_FREE(mem_ctx);
 361                 return NT_STATUS_NO_MEMORY;
 362         }
 363
 364         /* Prepare the state structure */
 365         state = talloc_zero(mem_ctx, struct gp_list_state);
 366         if (state == NULL) {
 367                 TALLOC_FREE(mem_ctx);
 368                 return NT_STATUS_NO_MEMORY;
 369         }
 370
 371         state->tree = gp_ctx->cli->tree;
 372         state->share_path = share_path;
 373
 374         /* Create the GPO dir if it does not exist */
 375         if (stat(local_path, &st) != 0) {
 376                 rv = mkdir(local_path, 0755);
 377                 if (rv < 0) {
 378                         DEBUG(0, ("Could not create local path\n"));
 379                         talloc_free(mem_ctx);
 380                         return NT_STATUS_UNSUCCESSFUL;
 381                 }
 382         }
 383
 384         /* Get the file list */
 385         status = gp_do_list("", state);
 386         if (!NT_STATUS_IS_OK(status)) {
 387                 DEBUG(0, ("Could not list GPO files on remote server\n"));
 388                 talloc_free(mem_ctx);
 389                 return status;
 390         }
 391
 392         /* If the list has no entries there is a problem. */
 393         if (state->list.num_files == 0) {
 394                 DEBUG(0, ("File list is has no entries. Is the GPT directory empty?\n"));
 395                 talloc_free(mem_ctx);
 396                 return NT_STATUS_UNSUCCESSFUL;
 397         }
 398
 399         /* Fetch the files */
 400         status = gp_get_files(gp_ctx->cli->tree, share_path, local_path, &state->list);
 401
 402         /* Return the local path to the gpo */
 403         *ret_local_path = local_path;
 404
 405         talloc_free(mem_ctx);
 406         return NT_STATUS_OK;
 407 }
 408
 409 static NTSTATUS push_recursive (struct gp_context *gp_ctx, const char *local_path,
 410                                 const char *remote_path, int depth)
 411 {
 412         DIR *dir;
 413         struct dirent *dirent;
 414         char *entry_local_path = NULL;
 415         char *entry_remote_path = NULL;
 416         int local_fd, remote_fd;
 417         int buf[1024];
 418         int nread, total_read;
 419         struct stat s;
 420         NTSTATUS status;
 421
 422         dir = opendir(local_path);
 423         while ((dirent = readdir(dir)) != NULL) {
 424                 if (strcmp(dirent->d_name, ".") == 0 ||
 425                                 strcmp(dirent->d_name, "..") == 0) {
 426                         continue;
 427                 }
 428
 429                 entry_local_path = talloc_asprintf(gp_ctx, "%s/%s", local_path,
 430                                                    dirent->d_name);
 431                 if (entry_local_path == NULL) {
 432                         status = NT_STATUS_NO_MEMORY;
 433                         goto done;
 434                 }
 435
 436                 entry_remote_path = talloc_asprintf(gp_ctx, "%s\\%s",
 437                                                     remote_path, dirent->d_name);
 438                 if (entry_remote_path == NULL) {
 439                         status = NT_STATUS_NO_MEMORY;
 440                         goto done;
 441                 }
 442
 443                 if (stat(entry_local_path, &s) != 0) {
 444                         status = NT_STATUS_UNSUCCESSFUL;
 445                         goto done;
 446                 }
 447                 if (s.st_mode & S_IFDIR) {
 448                         DEBUG(6, ("Pushing directory %s to %s on sysvol\n",
 449                                   entry_local_path, entry_remote_path));
 450                         smbcli_mkdir(gp_ctx->cli->tree, entry_remote_path);
 451                         if (depth < GP_MAX_DEPTH) {
 452                                 push_recursive(gp_ctx, entry_local_path,
 453                                                entry_remote_path, depth+1);
 454                         }
 455                 } else {
 456                         DEBUG(6, ("Pushing file %s to %s on sysvol\n",
 457                                   entry_local_path, entry_remote_path));
 458                         remote_fd = smbcli_open(gp_ctx->cli->tree,
 459                                                 entry_remote_path,
 460                                                 O_WRONLY | O_CREAT,
 461                                                 0);
 462                         if (remote_fd < 0) {
 463                                 DEBUG(0, ("Failed to create remote file: %s\n",
 464                                           entry_remote_path));
 465                                 status = NT_STATUS_UNSUCCESSFUL;
 466                                 goto done;
 467                         }
 468                         local_fd = open(entry_local_path, O_RDONLY);
 469                         if (local_fd < 0) {
 470                                 DEBUG(0, ("Failed to open local file: %s\n",
 471                                           entry_local_path));
 472                                 status = NT_STATUS_UNSUCCESSFUL;
 473                                 goto done;
 474                         }
 475                         total_read = 0;
 476                         while ((nread = read(local_fd, &buf, sizeof(buf)))) {
 477                                 smbcli_write(gp_ctx->cli->tree, remote_fd, 0,
 478                                                 &buf, total_read, nread);
 479                                 total_read += nread;
 480                         }
 481
 482                         close(local_fd);
 483                         smbcli_close(gp_ctx->cli->tree, remote_fd);
 484                 }
 485                 TALLOC_FREE(entry_local_path);
 486                 TALLOC_FREE(entry_remote_path);
 487         }
 488
 489         status = NT_STATUS_OK;
 490 done:
 491         talloc_free(entry_local_path);
 492         talloc_free(entry_remote_path);
 493
 494         closedir(dir);
 495
 496         return status;
 497 }
 498
 499
 500
 501 NTSTATUS gp_push_gpt(struct gp_context *gp_ctx, const char *local_path,
 502                      const char *file_sys_path)
 503 {
 504         NTSTATUS status;
 505         char *share_path;
 506
 507         if (gp_ctx->cli == NULL) {
 508                 status = gp_cli_connect(gp_ctx);
 509                 if (!NT_STATUS_IS_OK(status)) {
 510                         DEBUG(0, ("Failed to create cli connection to DC\n"));
 511                         return status;
 512                 }
 513         }
 514         share_path = gp_get_share_path(gp_ctx, file_sys_path);
 515
 516         DEBUG(5, ("Copying %s to %s on sysvol\n", local_path, share_path));
 517
 518         smbcli_mkdir(gp_ctx->cli->tree, share_path);
 519
 520         status = push_recursive(gp_ctx, local_path, share_path, 0);
 521
 522         talloc_free(share_path);
 523         return status;
 524 }
 525
 526 NTSTATUS gp_create_gpt(struct gp_context *gp_ctx, const char *name,
 527                        const char *file_sys_path)
 528 {
 529         TALLOC_CTX *mem_ctx;
 530         const char *tmp_dir, *policy_dir, *tmp_str;
 531         int rv;
 532         int fd;
 533         NTSTATUS status;
 534         const char *file_content = "[General]\r\nVersion=0\r\n";
 535
 536         /* Create a forked memory context, as a base for everything here */
 537         mem_ctx = talloc_new(gp_ctx);
 538         NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
 539
 540         tmp_dir = gp_tmpdir(mem_ctx);
 541         NT_STATUS_HAVE_NO_MEMORY(tmp_dir);
 542         policy_dir = talloc_asprintf(mem_ctx, "%s/%s", tmp_dir, name);
 543         NT_STATUS_HAVE_NO_MEMORY(policy_dir);
 544
 545         /* Create the directories */
 546
 547         rv = mkdir(policy_dir, 0755);
 548         if (rv < 0) {
 549                 DEBUG(0, ("Could not create the policy dir: %s\n", policy_dir));
 550                 talloc_free(mem_ctx);
 551                 return NT_STATUS_UNSUCCESSFUL;
 552         }
 553
 554         tmp_str = talloc_asprintf(mem_ctx, "%s/User", policy_dir);
 555         NT_STATUS_HAVE_NO_MEMORY(tmp_str);
 556         rv = mkdir(tmp_str, 0755);
 557         if (rv < 0) {
 558                 DEBUG(0, ("Could not create the User dir: %s\n", tmp_str));
 559                 talloc_free(mem_ctx);
 560                 return NT_STATUS_UNSUCCESSFUL;
 561         }
 562
 563         tmp_str = talloc_asprintf(mem_ctx, "%s/Machine", policy_dir);
 564         NT_STATUS_HAVE_NO_MEMORY(tmp_str);
 565         rv = mkdir(tmp_str, 0755);
 566         if (rv < 0) {
 567                 DEBUG(0, ("Could not create the Machine dir: %s\n", tmp_str));
 568                 talloc_free(mem_ctx);
 569                 return NT_STATUS_UNSUCCESSFUL;
 570         }
 571
 572         /* Create a GPT.INI with version 0 */
 573
 574         tmp_str = talloc_asprintf(mem_ctx, "%s/GPT.INI", policy_dir);
 575         NT_STATUS_HAVE_NO_MEMORY(tmp_str);
 576         fd = open(tmp_str, O_CREAT | O_WRONLY, 0644);
 577         if (fd < 0) {
 578                 DEBUG(0, ("Could not create the GPT.INI: %s\n", tmp_str));
 579                 talloc_free(mem_ctx);
 580                 return NT_STATUS_UNSUCCESSFUL;
 581         }
 582
 583         rv = write(fd, file_content, strlen(file_content));
 584         close(fd);
 585         if (rv != strlen(file_content)) {
 586                 DEBUG(0, ("Short write in GPT.INI\n"));
 587                 talloc_free(mem_ctx);
 588                 return NT_STATUS_UNSUCCESSFUL;
 589         }
 590
 591         /* Upload the GPT to the sysvol share on a DC */
 592         status = gp_push_gpt(gp_ctx, policy_dir, file_sys_path);
 593         if (!NT_STATUS_IS_OK(status)) {
 594                 talloc_free(mem_ctx);
 595                 return status;
 596         }
 597
 598         talloc_free(mem_ctx);
 599         return NT_STATUS_OK;
 600 }
 601
 602 NTSTATUS gp_set_gpt_security_descriptor(struct gp_context *gp_ctx,
 603                                         struct gp_object *gpo,
 604                                         struct security_descriptor *sd)
 605 {
 606         TALLOC_CTX *mem_ctx;
 607         NTSTATUS status;
 608         union smb_setfileinfo fileinfo;
 609         union smb_open io;
 610         union smb_close io_close;
 611
 612         /* Create a connection to sysvol if it is not already there */
 613         if (gp_ctx->cli == NULL) {
 614                 status = gp_cli_connect(gp_ctx);
 615                 if (!NT_STATUS_IS_OK(status)) {
 616                         DEBUG(0, ("Failed to create cli connection to DC\n"));
 617                         return status;
 618                 }
 619         }
 620
 621         /* Create a forked memory context which can be freed easily */
 622         mem_ctx = talloc_new(gp_ctx);
 623         NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
 624
 625         /* Open the directory with NTCreate AndX call */
 626         io.generic.level = RAW_OPEN_NTCREATEX;
 627         io.ntcreatex.in.root_fid.fnum = 0;
 628         io.ntcreatex.in.flags = 0;
 629         io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 630         io.ntcreatex.in.create_options = 0;
 631         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 632         io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ |
 633                                        NTCREATEX_SHARE_ACCESS_WRITE;
 634         io.ntcreatex.in.alloc_size = 0;
 635         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
 636         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 637         io.ntcreatex.in.security_flags = 0;
 638         io.ntcreatex.in.fname = gp_get_share_path(mem_ctx, gpo->file_sys_path);
 639         status = smb_raw_open(gp_ctx->cli->tree, mem_ctx, &io);
 640         if (!NT_STATUS_IS_OK(status)) {
 641                 DEBUG(0, ("Can't open GPT directory\n"));
 642                 talloc_free(mem_ctx);
 643                 return status;
 644         }
 645
 646         /* Set the security descriptor on the directory */
 647         fileinfo.generic.level = RAW_FILEINFO_SEC_DESC;
 648         fileinfo.set_secdesc.in.file.fnum = io.ntcreatex.out.file.fnum;
 649         fileinfo.set_secdesc.in.secinfo_flags = SECINFO_PROTECTED_DACL |
 650                                                 SECINFO_OWNER |
 651                                                 SECINFO_GROUP |
 652                                                 SECINFO_DACL;
 653         fileinfo.set_secdesc.in.sd = sd;
 654         status = smb_raw_setfileinfo(gp_ctx->cli->tree, &fileinfo);
 655         if (!NT_STATUS_IS_OK(status)) {
 656                 DEBUG(0, ("Failed to set security descriptor on the GPT\n"));
 657                 talloc_free(mem_ctx);
 658                 return status;
 659         }
 660
 661         /* Close the directory */
 662         io_close.close.level = RAW_CLOSE_CLOSE;
 663         io_close.close.in.file.fnum = io.ntcreatex.out.file.fnum;
 664         io_close.close.in.write_time = 0;
 665         status = smb_raw_close(gp_ctx->cli->tree, &io_close);
 666         if (!NT_STATUS_IS_OK(status)) {
 667                 DEBUG(0, ("Failed to close directory\n"));
 668                 talloc_free(mem_ctx);
 669                 return status;
 670         }
 671
 672         talloc_free(mem_ctx);
 673         return NT_STATUS_OK;
 674 }