2 * Unix SMB/Netbios implementation.
3 * Utility for managing share permissions
5 * Copyright (C) Tim Potter 2000
6 * Copyright (C) Jeremy Allison 2000
7 * Copyright (C) Jelmer Vernooij 2003
8 * Copyright (C) Gerald (Jerry) Carter 2005.
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 3 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, see <http://www.gnu.org/licenses/>.
27 static TALLOC_CTX
*ctx
;
29 enum acl_mode
{ SMB_ACL_DELETE
,
40 /* These values discovered by inspection */
42 static const struct perm_value special_values
[] = {
43 { "R", SEC_RIGHTS_FILE_READ
},
44 { "W", SEC_RIGHTS_FILE_WRITE
},
45 { "X", SEC_RIGHTS_FILE_EXECUTE
},
46 { "D", SEC_STD_DELETE
},
47 { "P", SEC_STD_WRITE_DAC
},
48 { "O", SEC_STD_WRITE_OWNER
},
52 #define SEC_RIGHTS_DIR_CHANGE ( SEC_RIGHTS_DIR_READ|SEC_STD_DELETE|\
53 SEC_RIGHTS_DIR_WRITE|SEC_DIR_TRAVERSE )
55 static const struct perm_value standard_values
[] = {
56 { "READ", SEC_RIGHTS_DIR_READ
|SEC_DIR_TRAVERSE
},
57 { "CHANGE", SEC_RIGHTS_DIR_CHANGE
},
58 { "FULL", SEC_RIGHTS_DIR_ALL
},
62 /********************************************************************
63 print an ACE on a FILE
64 ********************************************************************/
66 static void print_ace(FILE *f
, SEC_ACE
*ace
)
68 const struct perm_value
*v
;
72 fprintf(f
, "%s:", sid_string_tos(&ace
->trustee
));
76 if (ace
->type
== SEC_ACE_TYPE_ACCESS_ALLOWED
) {
77 fprintf(f
, "ALLOWED");
78 } else if (ace
->type
== SEC_ACE_TYPE_ACCESS_DENIED
) {
81 fprintf(f
, "%d", ace
->type
);
84 /* Not sure what flags can be set in a file ACL */
86 fprintf(f
, "/%d/", ace
->flags
);
88 /* Standard permissions */
90 for (v
= standard_values
; v
->perm
; v
++) {
91 if (ace
->access_mask
== v
->mask
) {
92 fprintf(f
, "%s", v
->perm
);
97 /* Special permissions. Print out a hex value if we have
98 leftover bits in the mask. */
100 got_mask
= ace
->access_mask
;
103 for (v
= special_values
; v
->perm
; v
++) {
104 if ((ace
->access_mask
& v
->mask
) == v
->mask
) {
106 fprintf(f
, "%s", v
->perm
);
108 got_mask
&= ~v
->mask
;
114 fprintf(f
, "0x%08x", ace
->access_mask
);
122 /********************************************************************
123 print an ascii version of a security descriptor on a FILE handle
124 ********************************************************************/
126 static void sec_desc_print(FILE *f
, SEC_DESC
*sd
)
130 fprintf(f
, "REVISION:%d\n", sd
->revision
);
132 /* Print owner and group sid */
134 fprintf(f
, "OWNER:%s\n", sid_string_tos(sd
->owner_sid
));
136 fprintf(f
, "GROUP:%s\n", sid_string_tos(sd
->group_sid
));
139 for (i
= 0; sd
->dacl
&& i
< sd
->dacl
->num_aces
; i
++) {
140 SEC_ACE
*ace
= &sd
->dacl
->aces
[i
];
147 /********************************************************************
148 parse an ACE in the same format as print_ace()
149 ********************************************************************/
151 static bool parse_ace(SEC_ACE
*ace
, const char *orig_str
)
156 unsigned int atype
= 0;
157 unsigned int aflags
= 0;
158 unsigned int amask
= 0;
161 const struct perm_value
*v
;
162 char *str
= SMB_STRDUP(orig_str
);
163 TALLOC_CTX
*frame
= talloc_stackframe();
171 p
= strchr_m(str
,':');
173 printf("ACE '%s': missing ':'.\n", orig_str
);
180 /* Try to parse numeric form */
182 if (sscanf(p
, "%i/%i/%i", &atype
, &aflags
, &amask
) == 3 &&
183 string_to_sid(&sid
, str
)) {
187 /* Try to parse text form */
189 if (!string_to_sid(&sid
, str
)) {
190 printf("ACE '%s': failed to convert '%s' to SID\n",
198 if (!next_token_talloc(frame
, &cp
, &tok
, "/")) {
199 printf("ACE '%s': failed to find '/' character.\n",
206 if (strncmp(tok
, "ALLOWED", strlen("ALLOWED")) == 0) {
207 atype
= SEC_ACE_TYPE_ACCESS_ALLOWED
;
208 } else if (strncmp(tok
, "DENIED", strlen("DENIED")) == 0) {
209 atype
= SEC_ACE_TYPE_ACCESS_DENIED
;
211 printf("ACE '%s': missing 'ALLOWED' or 'DENIED' entry at '%s'\n",
218 /* Only numeric form accepted for flags at present */
219 /* no flags on share permissions */
221 if (!(next_token_talloc(frame
, &cp
, &tok
, "/") &&
222 sscanf(tok
, "%i", &aflags
) && aflags
== 0)) {
223 printf("ACE '%s': bad integer flags entry at '%s'\n",
230 if (!next_token_talloc(frame
, &cp
, &tok
, "/")) {
231 printf("ACE '%s': missing / at '%s'\n",
238 if (strncmp(tok
, "0x", 2) == 0) {
239 if (sscanf(tok
, "%i", &amask
) != 1) {
240 printf("ACE '%s': bad hex number at '%s'\n",
249 for (v
= standard_values
; v
->perm
; v
++) {
250 if (strcmp(tok
, v
->perm
) == 0) {
261 for (v
= special_values
; v
->perm
; v
++) {
262 if (v
->perm
[0] == *p
) {
269 printf("ACE '%s': bad permission value at '%s'\n",
286 init_sec_ace(ace
, &sid
, atype
, mask
, aflags
);
293 /********************************************************************
294 ********************************************************************/
296 static SEC_DESC
* parse_acl_string(TALLOC_CTX
*mem_ctx
, const char *szACL
, size_t *sd_size
)
309 num_ace
= count_chars( pacl
, ',' ) + 1;
311 if ( !(ace
= TALLOC_ZERO_ARRAY( mem_ctx
, SEC_ACE
, num_ace
)) )
314 for ( i
=0; i
<num_ace
; i
++ ) {
315 char *end_acl
= strchr_m( pacl
, ',' );
318 strncpy( acl_string
, pacl
, MIN( PTR_DIFF( end_acl
, pacl
), sizeof(fstring
)-1) );
319 acl_string
[MIN( PTR_DIFF( end_acl
, pacl
), sizeof(fstring
)-1)] = '\0';
321 if ( !parse_ace( &ace
[i
], acl_string
) )
328 if ( !(acl
= make_sec_acl( mem_ctx
, NT4_ACL_REVISION
, num_ace
, ace
)) )
331 sd
= make_sec_desc( mem_ctx
, SEC_DESC_REVISION
, SEC_DESC_SELF_RELATIVE
,
332 NULL
, NULL
, NULL
, acl
, sd_size
);
337 /* add an ACE to a list of ACEs in a SEC_ACL */
338 static bool add_ace(TALLOC_CTX
*mem_ctx
, SEC_ACL
**the_acl
, SEC_ACE
*ace
)
343 return (((*the_acl
) = make_sec_acl(mem_ctx
, 3, 1, ace
)) != NULL
);
346 if (!(aces
= SMB_CALLOC_ARRAY(SEC_ACE
, 1+(*the_acl
)->num_aces
))) {
349 memcpy(aces
, (*the_acl
)->aces
, (*the_acl
)->num_aces
* sizeof(SEC_ACE
));
350 memcpy(aces
+(*the_acl
)->num_aces
, ace
, sizeof(SEC_ACE
));
351 new_ace
= make_sec_acl(mem_ctx
,(*the_acl
)->revision
,1+(*the_acl
)->num_aces
, aces
);
353 (*the_acl
) = new_ace
;
357 /* The MSDN is contradictory over the ordering of ACE entries in an ACL.
358 However NT4 gives a "The information may have been modified by a
359 computer running Windows NT 5.0" if denied ACEs do not appear before
362 static int ace_compare(SEC_ACE
*ace1
, SEC_ACE
*ace2
)
364 if (sec_ace_equal(ace1
, ace2
))
367 if (ace1
->type
!= ace2
->type
)
368 return ace2
->type
- ace1
->type
;
370 if (sid_compare(&ace1
->trustee
, &ace2
->trustee
))
371 return sid_compare(&ace1
->trustee
, &ace2
->trustee
);
373 if (ace1
->flags
!= ace2
->flags
)
374 return ace1
->flags
- ace2
->flags
;
376 if (ace1
->access_mask
!= ace2
->access_mask
)
377 return ace1
->access_mask
- ace2
->access_mask
;
379 if (ace1
->size
!= ace2
->size
)
380 return ace1
->size
- ace2
->size
;
382 return memcmp(ace1
, ace2
, sizeof(SEC_ACE
));
385 static void sort_acl(SEC_ACL
*the_acl
)
388 if (!the_acl
) return;
390 qsort(the_acl
->aces
, the_acl
->num_aces
, sizeof(the_acl
->aces
[0]), QSORT_CAST ace_compare
);
392 for (i
=1;i
<the_acl
->num_aces
;) {
393 if (sec_ace_equal(&the_acl
->aces
[i
-1], &the_acl
->aces
[i
])) {
395 for (j
=i
; j
<the_acl
->num_aces
-1; j
++) {
396 the_acl
->aces
[j
] = the_acl
->aces
[j
+1];
406 static int change_share_sec(TALLOC_CTX
*mem_ctx
, const char *sharename
, char *the_acl
, enum acl_mode mode
)
409 SEC_DESC
*old
= NULL
;
413 if (mode
!= SMB_ACL_SET
) {
414 if (!(old
= get_share_security( mem_ctx
, sharename
, &sd_size
)) ) {
415 fprintf(stderr
, "Unable to retrieve permissions for share [%s]\n", sharename
);
420 if ( (mode
!= SMB_ACL_VIEW
) && !(sd
= parse_acl_string(mem_ctx
, the_acl
, &sd_size
)) ) {
421 fprintf( stderr
, "Failed to parse acl\n");
427 sec_desc_print( stdout
, old
);
430 for (i
=0;sd
->dacl
&& i
<sd
->dacl
->num_aces
;i
++) {
433 for (j
=0;old
->dacl
&& j
<old
->dacl
->num_aces
;j
++) {
434 if (sec_ace_equal(&sd
->dacl
->aces
[i
], &old
->dacl
->aces
[j
])) {
436 for (k
=j
; k
<old
->dacl
->num_aces
-1;k
++) {
437 old
->dacl
->aces
[k
] = old
->dacl
->aces
[k
+1];
439 old
->dacl
->num_aces
--;
446 printf("ACL for ACE:");
447 print_ace(stdout
, &sd
->dacl
->aces
[i
]);
448 printf(" not found\n");
454 for (i
=0;sd
->dacl
&& i
<sd
->dacl
->num_aces
;i
++) {
457 for (j
=0;old
->dacl
&& j
<old
->dacl
->num_aces
;j
++) {
458 if (sid_equal(&sd
->dacl
->aces
[i
].trustee
,
459 &old
->dacl
->aces
[j
].trustee
)) {
460 old
->dacl
->aces
[j
] = sd
->dacl
->aces
[i
];
466 printf("ACL for SID %s not found\n",
467 sid_string_tos(&sd
->dacl
->aces
[i
].trustee
));
472 old
->owner_sid
= sd
->owner_sid
;
476 old
->group_sid
= sd
->group_sid
;
480 for (i
=0;sd
->dacl
&& i
<sd
->dacl
->num_aces
;i
++) {
481 add_ace(mem_ctx
, &old
->dacl
, &sd
->dacl
->aces
[i
]);
489 /* Denied ACE entries must come before allowed ones */
492 if ( !set_share_security( sharename
, old
) ) {
493 fprintf( stderr
, "Failed to store acl for share [%s]\n", sharename
);
499 /********************************************************************
501 ********************************************************************/
503 int main(int argc
, const char *argv
[])
507 enum acl_mode mode
= SMB_ACL_SET
;
508 static char *the_acl
= NULL
;
510 bool force_acl
= False
;
513 bool initialize_sid
= False
;
514 struct poptOption long_options
[] = {
516 { "remove", 'r', POPT_ARG_STRING
, &the_acl
, 'r', "Delete an ACE", "ACL" },
517 { "modify", 'm', POPT_ARG_STRING
, &the_acl
, 'm', "Modify an acl", "ACL" },
518 { "add", 'a', POPT_ARG_STRING
, &the_acl
, 'a', "Add an ACE", "ACL" },
519 { "replace", 'R', POPT_ARG_STRING
, &the_acl
, 'R', "Set share mission ACL", "ACLS" },
520 { "view", 'v', POPT_ARG_NONE
, NULL
, 'v', "View current share permissions" },
521 { "machine-sid", 'M', POPT_ARG_NONE
, NULL
, 'M', "Initialize the machine SID" },
522 { "force", 'F', POPT_ARG_NONE
, NULL
, 'F', "Force storing the ACL", "ACLS" },
527 if ( !(ctx
= talloc_stackframe()) ) {
528 fprintf( stderr
, "Failed to initialize talloc context!\n");
532 /* set default debug level to 1 regardless of what smb.conf sets */
533 setup_logging( "sharesec", True
);
534 DEBUGLEVEL_CLASS
[DBGC_ALL
] = 1;
536 x_setbuf( x_stderr
, NULL
);
538 pc
= poptGetContext("sharesec", argc
, argv
, long_options
, 0);
540 poptSetOtherOptionHelp(pc
, "sharename\n");
542 while ((opt
= poptGetNextOpt(pc
)) != -1) {
545 the_acl
= smb_xstrdup(poptGetOptArg(pc
));
546 mode
= SMB_ACL_DELETE
;
550 the_acl
= smb_xstrdup(poptGetOptArg(pc
));
551 mode
= SMB_ACL_MODIFY
;
555 the_acl
= smb_xstrdup(poptGetOptArg(pc
));
559 the_acl
= smb_xstrdup(poptGetOptArg(pc
));
572 initialize_sid
= True
;
581 lp_load( get_dyn_CONFIGFILE(), False
, False
, False
, True
);
583 /* check for initializing secrets.tdb first */
585 if ( initialize_sid
) {
586 DOM_SID
*sid
= get_global_sam_sid();
589 fprintf( stderr
, "Failed to retrieve Machine SID!\n");
593 printf ("%s\n", sid_string_tos( sid
) );
597 if ( mode
== SMB_ACL_VIEW
&& force_acl
) {
598 fprintf( stderr
, "Invalid combination of -F and -v\n");
602 /* get the sharename */
604 if(!poptPeekArg(pc
)) {
605 poptPrintUsage(pc
, stderr
, 0);
609 fstrcpy(sharename
, poptGetArg(pc
));
611 snum
= lp_servicenumber( sharename
);
613 if ( snum
== -1 && !force_acl
) {
614 fprintf( stderr
, "Invalid sharename: %s\n", sharename
);
618 retval
= change_share_sec(ctx
, sharename
, the_acl
, mode
);