?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
script/autobuild.py: remove --rebase-master and --push-master options
[Samba/gebeck_regimport.git] / source3 / utils / sharesec.c
blob641a2ce140e4ae24063cdbad882e39c1abdd8e51
1 /*
2 * Unix SMB/Netbios implementation.
3 * Utility for managing share permissions
4 *
5 * Copyright (C) Tim Potter 2000
6 * Copyright (C) Jeremy Allison 2000
7 * Copyright (C) Jelmer Vernooij 2003
8 * Copyright (C) Gerald (Jerry) Carter 2005.
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 3 of the License, or
13 * (at your option) any later version.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 */
23
24
25 #include "includes.h"
26 #include "popt_common.h"
27 #include "../libcli/security/security.h"
28 #include "passdb/machine_sid.h"
29
30 static TALLOC_CTX *ctx;
31
32 enum acl_mode { SMB_ACL_DELETE,
33 SMB_ACL_MODIFY,
34 SMB_ACL_ADD,
35 SMB_ACL_SET,
36 SMB_SD_DELETE,
37 SMB_SD_SETSDDL,
38 SMB_SD_VIEWSDDL,
39 SMB_ACL_VIEW };
40
41 struct perm_value {
42 const char *perm;
43 uint32 mask;
44 };
45
46 /* These values discovered by inspection */
47
48 static const struct perm_value special_values[] = {
49 { "R", SEC_RIGHTS_FILE_READ },
50 { "W", SEC_RIGHTS_FILE_WRITE },
51 { "X", SEC_RIGHTS_FILE_EXECUTE },
52 { "D", SEC_STD_DELETE },
53 { "P", SEC_STD_WRITE_DAC },
54 { "O", SEC_STD_WRITE_OWNER },
55 { NULL, 0 },
56 };
57
58 #define SEC_RIGHTS_DIR_CHANGE ( SEC_RIGHTS_DIR_READ|SEC_STD_DELETE|\
59 SEC_RIGHTS_DIR_WRITE|SEC_DIR_TRAVERSE )
60
61 static const struct perm_value standard_values[] = {
62 { "READ", SEC_RIGHTS_DIR_READ|SEC_DIR_TRAVERSE },
63 { "CHANGE", SEC_RIGHTS_DIR_CHANGE },
64 { "FULL", SEC_RIGHTS_DIR_ALL },
65 { NULL, 0 },
66 };
67
68 /********************************************************************
69 print an ACE on a FILE
70 ********************************************************************/
71
72 static void print_ace(FILE *f, struct security_ace *ace)
73 {
74 const struct perm_value *v;
75 int do_print = 0;
76 uint32 got_mask;
77
78 fprintf(f, "%s:", sid_string_tos(&ace->trustee));
79
80 /* Ace type */
81
82 if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED) {
83 fprintf(f, "ALLOWED");
84 } else if (ace->type == SEC_ACE_TYPE_ACCESS_DENIED) {
85 fprintf(f, "DENIED");
86 } else {
87 fprintf(f, "%d", ace->type);
88 }
89
90 /* Not sure what flags can be set in a file ACL */
91
92 fprintf(f, "/%d/", ace->flags);
93
94 /* Standard permissions */
95
96 for (v = standard_values; v->perm; v++) {
97 if (ace->access_mask == v->mask) {
98 fprintf(f, "%s", v->perm);
99 return;
100 }
101 }
102
103 /* Special permissions. Print out a hex value if we have
104 leftover bits in the mask. */
105
106 got_mask = ace->access_mask;
107
108 again:
109 for (v = special_values; v->perm; v++) {
110 if ((ace->access_mask & v->mask) == v->mask) {
111 if (do_print) {
112 fprintf(f, "%s", v->perm);
113 }
114 got_mask &= ~v->mask;
115 }
116 }
117
118 if (!do_print) {
119 if (got_mask != 0) {
120 fprintf(f, "0x%08x", ace->access_mask);
121 } else {
122 do_print = 1;
123 goto again;
124 }
125 }
126 }
127
128 /********************************************************************
129 print an ascii version of a security descriptor on a FILE handle
130 ********************************************************************/
131
132 static void sec_desc_print(FILE *f, struct security_descriptor *sd)
133 {
134 uint32 i;
135
136 fprintf(f, "REVISION:%d\n", sd->revision);
137
138 /* Print owner and group sid */
139
140 fprintf(f, "OWNER:%s\n", sid_string_tos(sd->owner_sid));
141
142 fprintf(f, "GROUP:%s\n", sid_string_tos(sd->group_sid));
143
144 /* Print aces */
145 for (i = 0; sd->dacl && i < sd->dacl->num_aces; i++) {
146 struct security_ace *ace = &sd->dacl->aces[i];
147 fprintf(f, "ACL:");
148 print_ace(f, ace);
149 fprintf(f, "\n");
150 }
151 }
152
153 /********************************************************************
154 parse an ACE in the same format as print_ace()
155 ********************************************************************/
156
157 static bool parse_ace(struct security_ace *ace, const char *orig_str)
158 {
159 char *p;
160 const char *cp;
161 char *tok;
162 unsigned int atype = 0;
163 unsigned int aflags = 0;
164 unsigned int amask = 0;
165 struct dom_sid sid;
166 uint32_t mask;
167 const struct perm_value *v;
168 char *str = SMB_STRDUP(orig_str);
169 TALLOC_CTX *frame = talloc_stackframe();
170
171 if (!str) {
172 TALLOC_FREE(frame);
173 return False;
174 }
175
176 ZERO_STRUCTP(ace);
177 p = strchr_m(str,':');
178 if (!p) {
179 fprintf(stderr, "ACE '%s': missing ':'.\n", orig_str);
180 SAFE_FREE(str);
181 TALLOC_FREE(frame);
182 return False;
183 }
184 *p = '\0';
185 p++;
186 /* Try to parse numeric form */
187
188 if (sscanf(p, "%i/%i/%i", &atype, &aflags, &amask) == 3 &&
189 string_to_sid(&sid, str)) {
190 goto done;
191 }
192
193 /* Try to parse text form */
194
195 if (!string_to_sid(&sid, str)) {
196 fprintf(stderr, "ACE '%s': failed to convert '%s' to SID\n",
197 orig_str, str);
198 SAFE_FREE(str);
199 TALLOC_FREE(frame);
200 return False;
201 }
202
203 cp = p;
204 if (!next_token_talloc(frame, &cp, &tok, "/")) {
205 fprintf(stderr, "ACE '%s': failed to find '/' character.\n",
206 orig_str);
207 SAFE_FREE(str);
208 TALLOC_FREE(frame);
209 return False;
210 }
211
212 if (strncmp(tok, "ALLOWED", strlen("ALLOWED")) == 0) {
213 atype = SEC_ACE_TYPE_ACCESS_ALLOWED;
214 } else if (strncmp(tok, "DENIED", strlen("DENIED")) == 0) {
215 atype = SEC_ACE_TYPE_ACCESS_DENIED;
216 } else {
217 fprintf(stderr, "ACE '%s': missing 'ALLOWED' or 'DENIED' "
218 "entry at '%s'\n", orig_str, tok);
219 SAFE_FREE(str);
220 TALLOC_FREE(frame);
221 return False;
222 }
223
224 /* Only numeric form accepted for flags at present */
225 /* no flags on share permissions */
226
227 if (!(next_token_talloc(frame, &cp, &tok, "/") &&
228 sscanf(tok, "%i", &aflags) && aflags == 0)) {
229 fprintf(stderr, "ACE '%s': bad integer flags entry at '%s'\n",
230 orig_str, tok);
231 SAFE_FREE(str);
232 TALLOC_FREE(frame);
233 return False;
234 }
235
236 if (!next_token_talloc(frame, &cp, &tok, "/")) {
237 fprintf(stderr, "ACE '%s': missing / at '%s'\n",
238 orig_str, tok);
239 SAFE_FREE(str);
240 TALLOC_FREE(frame);
241 return False;
242 }
243
244 if (strncmp(tok, "0x", 2) == 0) {
245 if (sscanf(tok, "%i", &amask) != 1) {
246 fprintf(stderr, "ACE '%s': bad hex number at '%s'\n",
247 orig_str, tok);
248 TALLOC_FREE(frame);
249 SAFE_FREE(str);
250 return False;
251 }
252 goto done;
253 }
254
255 for (v = standard_values; v->perm; v++) {
256 if (strcmp(tok, v->perm) == 0) {
257 amask = v->mask;
258 goto done;
259 }
260 }
261
262 p = tok;
263
264 while(*p) {
265 bool found = False;
266
267 for (v = special_values; v->perm; v++) {
268 if (v->perm[0] == *p) {
269 amask |= v->mask;
270 found = True;
271 }
272 }
273
274 if (!found) {
275 fprintf(stderr, "ACE '%s': bad permission value at "
276 "'%s'\n", orig_str, p);
277 TALLOC_FREE(frame);
278 SAFE_FREE(str);
279 return False;
280 }
281 p++;
282 }
283
284 if (*p) {
285 TALLOC_FREE(frame);
286 SAFE_FREE(str);
287 return False;
288 }
289
290 done:
291 mask = amask;
292 init_sec_ace(ace, &sid, atype, mask, aflags);
293 SAFE_FREE(str);
294 TALLOC_FREE(frame);
295 return True;
296 }
297
298
299 /********************************************************************
300 ********************************************************************/
301
302 static struct security_descriptor* parse_acl_string(TALLOC_CTX *mem_ctx, const char *szACL, size_t *sd_size )
303 {
304 struct security_descriptor *sd = NULL;
305 struct security_ace *ace;
306 struct security_acl *theacl;
307 int num_ace;
308 const char *pacl;
309 int i;
310
311 if ( !szACL )
312 return NULL;
313
314 pacl = szACL;
315 num_ace = count_chars( pacl, ',' ) + 1;
316
317 if ( !(ace = talloc_zero_array( mem_ctx, struct security_ace, num_ace )) )
318 return NULL;
319
320 for ( i=0; i<num_ace; i++ ) {
321 char *end_acl = strchr_m( pacl, ',' );
322 fstring acl_string;
323
324 strncpy( acl_string, pacl, MIN( PTR_DIFF( end_acl, pacl ), sizeof(fstring)-1) );
325 acl_string[MIN( PTR_DIFF( end_acl, pacl ), sizeof(fstring)-1)] = '\0';
326
327 if ( !parse_ace( &ace[i], acl_string ) )
328 return NULL;
329
330 pacl = end_acl;
331 pacl++;
332 }
333
334 if ( !(theacl = make_sec_acl( mem_ctx, NT4_ACL_REVISION, num_ace, ace )) )
335 return NULL;
336
337 sd = make_sec_desc( mem_ctx, SD_REVISION, SEC_DESC_SELF_RELATIVE,
338 NULL, NULL, NULL, theacl, sd_size);
339
340 return sd;
341 }
342
343 /* add an ACE to a list of ACEs in a struct security_acl */
344 static bool add_ace(TALLOC_CTX *mem_ctx, struct security_acl **the_acl, struct security_ace *ace)
345 {
346 struct security_acl *new_ace;
347 struct security_ace *aces;
348 if (! *the_acl) {
349 return (((*the_acl) = make_sec_acl(mem_ctx, 3, 1, ace)) != NULL);
350 }
351
352 if (!(aces = SMB_CALLOC_ARRAY(struct security_ace, 1+(*the_acl)->num_aces))) {
353 return False;
354 }
355 memcpy(aces, (*the_acl)->aces, (*the_acl)->num_aces * sizeof(struct
356 security_ace));
357 memcpy(aces+(*the_acl)->num_aces, ace, sizeof(struct security_ace));
358 new_ace = make_sec_acl(mem_ctx,(*the_acl)->revision,1+(*the_acl)->num_aces, aces);
359 SAFE_FREE(aces);
360 (*the_acl) = new_ace;
361 return True;
362 }
363
364 /* The MSDN is contradictory over the ordering of ACE entries in an ACL.
365 However NT4 gives a "The information may have been modified by a
366 computer running Windows NT 5.0" if denied ACEs do not appear before
367 allowed ACEs. */
368
369 static int ace_compare(struct security_ace *ace1, struct security_ace *ace2)
370 {
371 if (sec_ace_equal(ace1, ace2))
372 return 0;
373
374 if (ace1->type != ace2->type)
375 return ace2->type - ace1->type;
376
377 if (dom_sid_compare(&ace1->trustee, &ace2->trustee))
378 return dom_sid_compare(&ace1->trustee, &ace2->trustee);
379
380 if (ace1->flags != ace2->flags)
381 return ace1->flags - ace2->flags;
382
383 if (ace1->access_mask != ace2->access_mask)
384 return ace1->access_mask - ace2->access_mask;
385
386 if (ace1->size != ace2->size)
387 return ace1->size - ace2->size;
388
389 return memcmp(ace1, ace2, sizeof(struct security_ace));
390 }
391
392 static void sort_acl(struct security_acl *the_acl)
393 {
394 uint32 i;
395 if (!the_acl) return;
396
397 TYPESAFE_QSORT(the_acl->aces, the_acl->num_aces, ace_compare);
398
399 for (i=1;i<the_acl->num_aces;) {
400 if (sec_ace_equal(&the_acl->aces[i-1], &the_acl->aces[i])) {
401 int j;
402 for (j=i; j<the_acl->num_aces-1; j++) {
403 the_acl->aces[j] = the_acl->aces[j+1];
404 }
405 the_acl->num_aces--;
406 } else {
407 i++;
408 }
409 }
410 }
411
412
413 static int change_share_sec(TALLOC_CTX *mem_ctx, const char *sharename, char *the_acl, enum acl_mode mode)
414 {
415 struct security_descriptor *sd = NULL;
416 struct security_descriptor *old = NULL;
417 size_t sd_size = 0;
418 uint32 i, j;
419
420 if (mode != SMB_ACL_SET && mode != SMB_SD_DELETE) {
421 if (!(old = get_share_security( mem_ctx, sharename, &sd_size )) ) {
422 fprintf(stderr, "Unable to retrieve permissions for share "
423 "[%s]\n", sharename);
424 return -1;
425 }
426 }
427
428 if ( (mode != SMB_ACL_VIEW && mode != SMB_SD_DELETE) &&
429 !(sd = parse_acl_string(mem_ctx, the_acl, &sd_size )) ) {
430 fprintf( stderr, "Failed to parse acl\n");
431 return -1;
432 }
433
434 switch (mode) {
435 case SMB_ACL_VIEW:
436 sec_desc_print( stdout, old);
437 return 0;
438 case SMB_ACL_DELETE:
439 for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
440 bool found = False;
441
442 for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
443 if (sec_ace_equal(&sd->dacl->aces[i], &old->dacl->aces[j])) {
444 uint32 k;
445 for (k=j; k<old->dacl->num_aces-1;k++) {
446 old->dacl->aces[k] = old->dacl->aces[k+1];
447 }
448 old->dacl->num_aces--;
449 found = True;
450 break;
451 }
452 }
453
454 if (!found) {
455 printf("ACL for ACE:");
456 print_ace(stdout, &sd->dacl->aces[i]);
457 printf(" not found\n");
458 }
459 }
460 break;
461 case SMB_ACL_MODIFY:
462 for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
463 bool found = False;
464
465 for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
466 if (dom_sid_equal(&sd->dacl->aces[i].trustee,
467 &old->dacl->aces[j].trustee)) {
468 old->dacl->aces[j] = sd->dacl->aces[i];
469 found = True;
470 }
471 }
472
473 if (!found) {
474 printf("ACL for SID %s not found\n",
475 sid_string_tos(&sd->dacl->aces[i].trustee));
476 }
477 }
478
479 if (sd->owner_sid) {
480 old->owner_sid = sd->owner_sid;
481 }
482
483 if (sd->group_sid) {
484 old->group_sid = sd->group_sid;
485 }
486 break;
487 case SMB_ACL_ADD:
488 for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
489 add_ace(mem_ctx, &old->dacl, &sd->dacl->aces[i]);
490 }
491 break;
492 case SMB_ACL_SET:
493 old = sd;
494 break;
495 case SMB_SD_DELETE:
496 if (!delete_share_security(sharename)) {
497 fprintf( stderr, "Failed to delete security descriptor for "
498 "share [%s]\n", sharename );
499 return -1;
500 }
501 return 0;
502 default:
503 fprintf(stderr, "invalid command\n");
504 return -1;
505 }
506
507 /* Denied ACE entries must come before allowed ones */
508 sort_acl(old->dacl);
509
510 if ( !set_share_security( sharename, old ) ) {
511 fprintf( stderr, "Failed to store acl for share [%s]\n", sharename );
512 return 2;
513 }
514 return 0;
515 }
516
517 static int set_sharesec_sddl(const char *sharename, const char *sddl)
518 {
519 struct security_descriptor *sd;
520 bool ret;
521
522 sd = sddl_decode(talloc_tos(), sddl, get_global_sam_sid());
523 if (sd == NULL) {
524 fprintf(stderr, "Failed to parse acl\n");
525 return -1;
526 }
527
528 ret = set_share_security(sharename, sd);
529 TALLOC_FREE(sd);
530 if (!ret) {
531 fprintf(stderr, "Failed to store acl for share [%s]\n",
532 sharename);
533 return -1;
534 }
535
536 return 0;
537 }
538
539 static int view_sharesec_sddl(const char *sharename)
540 {
541 struct security_descriptor *sd;
542 size_t sd_size;
543 char *acl;
544
545 sd = get_share_security(talloc_tos(), sharename, &sd_size);
546 if (sd == NULL) {
547 fprintf(stderr, "Unable to retrieve permissions for share "
548 "[%s]\n", sharename);
549 return -1;
550 }
551
552 acl = sddl_encode(talloc_tos(), sd, get_global_sam_sid());
553 TALLOC_FREE(sd);
554 if (acl == NULL) {
555 fprintf(stderr, "Unable to sddl-encode permissions for share "
556 "[%s]\n", sharename);
557 return -1;
558 }
559 printf("%s\n", acl);
560 TALLOC_FREE(acl);
561 return 0;
562 }
563
564 /********************************************************************
565 main program
566 ********************************************************************/
567
568 int main(int argc, const char *argv[])
569 {
570 int opt;
571 int retval = 0;
572 enum acl_mode mode = SMB_ACL_SET;
573 static char *the_acl = NULL;
574 fstring sharename;
575 bool force_acl = False;
576 int snum;
577 poptContext pc;
578 bool initialize_sid = False;
579 struct poptOption long_options[] = {
580 POPT_AUTOHELP
581 { "remove", 'r', POPT_ARG_STRING, &the_acl, 'r', "Remove ACEs", "ACL" },
582 { "modify", 'm', POPT_ARG_STRING, &the_acl, 'm', "Modify existing ACEs", "ACL" },
583 { "add", 'a', POPT_ARG_STRING, &the_acl, 'a', "Add ACEs", "ACL" },
584 { "replace", 'R', POPT_ARG_STRING, &the_acl, 'R', "Overwrite share permission ACL", "ACLS" },
585 { "delete", 'D', POPT_ARG_NONE, NULL, 'D', "Delete the entire security descriptor" },
586 { "setsddl", 'S', POPT_ARG_STRING, the_acl, 'S',
587 "Set the SD in sddl format" },
588 { "viewsddl", 'V', POPT_ARG_NONE, the_acl, 'V',
589 "View the SD in sddl format" },
590 { "view", 'v', POPT_ARG_NONE, NULL, 'v', "View current share permissions" },
591 { "machine-sid", 'M', POPT_ARG_NONE, NULL, 'M', "Initialize the machine SID" },
592 { "force", 'F', POPT_ARG_NONE, NULL, 'F', "Force storing the ACL", "ACLS" },
593 POPT_COMMON_SAMBA
594 { NULL }
595 };
596
597 if ( !(ctx = talloc_stackframe()) ) {
598 fprintf( stderr, "Failed to initialize talloc context!\n");
599 return -1;
600 }
601
602 /* set default debug level to 1 regardless of what smb.conf sets */
603 setup_logging( "sharesec", DEBUG_STDERR);
604
605 load_case_tables();
606
607 lp_set_cmdline("log level", "1");
608
609 pc = poptGetContext("sharesec", argc, argv, long_options, 0);
610
611 poptSetOtherOptionHelp(pc, "sharename\n");
612
613 while ((opt = poptGetNextOpt(pc)) != -1) {
614 switch (opt) {
615 case 'r':
616 the_acl = smb_xstrdup(poptGetOptArg(pc));
617 mode = SMB_ACL_DELETE;
618 break;
619
620 case 'm':
621 the_acl = smb_xstrdup(poptGetOptArg(pc));
622 mode = SMB_ACL_MODIFY;
623 break;
624
625 case 'a':
626 the_acl = smb_xstrdup(poptGetOptArg(pc));
627 mode = SMB_ACL_ADD;
628 break;
629
630 case 'R':
631 the_acl = smb_xstrdup(poptGetOptArg(pc));
632 mode = SMB_ACL_SET;
633 break;
634
635 case 'D':
636 mode = SMB_SD_DELETE;
637 break;
638
639 case 'S':
640 mode = SMB_SD_SETSDDL;
641 the_acl = smb_xstrdup(poptGetOptArg(pc));
642 break;
643
644 case 'V':
645 mode = SMB_SD_VIEWSDDL;
646 break;
647
648 case 'v':
649 mode = SMB_ACL_VIEW;
650 break;
651
652 case 'F':
653 force_acl = True;
654 break;
655
656 case 'M':
657 initialize_sid = True;
658 break;
659 }
660 }
661
662 setlinebuf(stdout);
663
664 lp_load_with_registry_shares( get_dyn_CONFIGFILE(), False, False, False,
665 True );
666
667 /* check for initializing secrets.tdb first */
668
669 if ( initialize_sid ) {
670 struct dom_sid *sid = get_global_sam_sid();
671
672 if ( !sid ) {
673 fprintf( stderr, "Failed to retrieve Machine SID!\n");
674 return 3;
675 }
676
677 printf ("%s\n", sid_string_tos( sid ) );
678 return 0;
679 }
680
681 if ( mode == SMB_ACL_VIEW && force_acl ) {
682 fprintf( stderr, "Invalid combination of -F and -v\n");
683 return -1;
684 }
685
686 /* get the sharename */
687
688 if(!poptPeekArg(pc)) {
689 poptPrintUsage(pc, stderr, 0);
690 return -1;
691 }
692
693 fstrcpy(sharename, poptGetArg(pc));
694
695 snum = lp_servicenumber( sharename );
696
697 if ( snum == -1 && !force_acl ) {
698 fprintf( stderr, "Invalid sharename: %s\n", sharename);
699 return -1;
700 }
701
702 switch (mode) {
703 case SMB_SD_SETSDDL:
704 retval = set_sharesec_sddl(sharename, the_acl);
705 break;
706 case SMB_SD_VIEWSDDL:
707 retval = view_sharesec_sddl(sharename);
708 break;
709 default:
710 retval = change_share_sec(ctx, sharename, the_acl, mode);
711 break;
712 }
713
714 talloc_destroy(ctx);
715
716 return retval;
717 }
reg import