Line data Source code
1 : /*
2 : * Unix SMB/Netbios implementation.
3 : * Utility for managing share permissions
4 : *
5 : * Copyright (C) Tim Potter 2000
6 : * Copyright (C) Jeremy Allison 2000
7 : * Copyright (C) Jelmer Vernooij 2003
8 : * Copyright (C) Gerald (Jerry) Carter 2005.
9 : *
10 : * This program is free software; you can redistribute it and/or modify
11 : * it under the terms of the GNU General Public License as published by
12 : * the Free Software Foundation; either version 3 of the License, or
13 : * (at your option) any later version.
14 : *
15 : * This program is distributed in the hope that it will be useful,
16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 : * GNU General Public License for more details.
19 : *
20 : * You should have received a copy of the GNU General Public License
21 : * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 : */
23 :
24 : struct cli_state;
25 :
26 : #include "includes.h"
27 : #include "lib/cmdline/cmdline.h"
28 : #include "../libcli/security/security.h"
29 : #include "passdb/machine_sid.h"
30 : #include "util_sd.h"
31 : #include "cmdline_contexts.h"
32 : #include "lib/util/string_wrappers.h"
33 : #include "lib/param/param.h"
34 :
35 : static TALLOC_CTX *ctx;
36 :
37 : enum acl_mode { SMB_ACL_DELETE,
38 : SMB_ACL_MODIFY,
39 : SMB_ACL_ADD,
40 : SMB_ACL_SET,
41 : SMB_SD_DELETE,
42 : SMB_SD_SETSDDL,
43 : SMB_SD_VIEWSDDL,
44 : SMB_ACL_VIEW,
45 : SMB_ACL_VIEW_ALL };
46 :
47 : /********************************************************************
48 : ********************************************************************/
49 :
50 24 : static struct security_descriptor* parse_acl_string(TALLOC_CTX *mem_ctx, const char *szACL, size_t *sd_size )
51 : {
52 24 : struct security_descriptor *sd = NULL;
53 : struct security_ace *ace;
54 : struct security_acl *theacl;
55 : int num_ace;
56 : const char *pacl;
57 : int i;
58 :
59 24 : if ( !szACL )
60 0 : return NULL;
61 :
62 24 : pacl = szACL;
63 24 : num_ace = count_chars( pacl, ',' ) + 1;
64 :
65 24 : if ( !(ace = talloc_zero_array( mem_ctx, struct security_ace, num_ace )) )
66 0 : return NULL;
67 :
68 48 : for ( i=0; i<num_ace; i++ ) {
69 24 : char *end_acl = strchr_m( pacl, ',' );
70 : fstring acl_string;
71 :
72 24 : strncpy( acl_string, pacl, MIN( PTR_DIFF( end_acl, pacl ), sizeof(fstring)-1) );
73 24 : acl_string[MIN( PTR_DIFF( end_acl, pacl ), sizeof(fstring)-1)] = '\0';
74 :
75 24 : if ( !parse_ace(NULL, &ace[i], acl_string ) )
76 0 : return NULL;
77 :
78 24 : pacl = end_acl;
79 24 : pacl++;
80 : }
81 :
82 24 : if ( !(theacl = make_sec_acl( mem_ctx, NT4_ACL_REVISION, num_ace, ace )) )
83 0 : return NULL;
84 :
85 24 : sd = make_sec_desc( mem_ctx, SD_REVISION, SEC_DESC_SELF_RELATIVE,
86 : NULL, NULL, NULL, theacl, sd_size);
87 :
88 24 : return sd;
89 : }
90 :
91 : /* add an ACE to a list of ACEs in a struct security_acl */
92 10 : static bool add_ace(TALLOC_CTX *mem_ctx, struct security_acl **the_acl, struct security_ace *ace)
93 : {
94 10 : struct security_acl *acl = *the_acl;
95 :
96 10 : if (acl == NULL) {
97 0 : acl = make_sec_acl(mem_ctx, 3, 1, ace);
98 0 : if (acl == NULL) {
99 0 : return false;
100 : }
101 : }
102 :
103 10 : if (acl->num_aces == UINT32_MAX) {
104 0 : return false;
105 : }
106 10 : ADD_TO_ARRAY(
107 : acl, struct security_ace, *ace, &acl->aces, &acl->num_aces);
108 10 : *the_acl = acl;
109 10 : return True;
110 : }
111 :
112 : /* The MSDN is contradictory over the ordering of ACE entries in an ACL.
113 : However NT4 gives a "The information may have been modified by a
114 : computer running Windows NT 5.0" if denied ACEs do not appear before
115 : allowed ACEs. */
116 :
117 58 : static int ace_compare(struct security_ace *ace1, struct security_ace *ace2)
118 : {
119 58 : if (security_ace_equal(ace1, ace2))
120 0 : return 0;
121 :
122 58 : if (ace1->type != ace2->type)
123 26 : return NUMERIC_CMP(ace2->type, ace1->type);
124 :
125 32 : if (dom_sid_compare(&ace1->trustee, &ace2->trustee))
126 32 : return dom_sid_compare(&ace1->trustee, &ace2->trustee);
127 :
128 0 : if (ace1->flags != ace2->flags)
129 0 : return NUMERIC_CMP(ace1->flags, ace2->flags);
130 :
131 0 : if (ace1->access_mask != ace2->access_mask)
132 0 : return NUMERIC_CMP(ace1->access_mask, ace2->access_mask);
133 :
134 0 : if (ace1->size != ace2->size)
135 0 : return NUMERIC_CMP(ace1->size, ace2->size);
136 :
137 0 : return memcmp(ace1, ace2, sizeof(struct security_ace));
138 : }
139 :
140 24 : static void sort_acl(struct security_acl *the_acl)
141 : {
142 : uint32_t i;
143 24 : if (!the_acl) return;
144 :
145 24 : TYPESAFE_QSORT(the_acl->aces, the_acl->num_aces, ace_compare);
146 :
147 56 : for (i=1;i<the_acl->num_aces;) {
148 32 : if (security_ace_equal(&the_acl->aces[i-1],
149 32 : &the_acl->aces[i])) {
150 0 : ARRAY_DEL_ELEMENT(
151 : the_acl->aces, i, the_acl->num_aces);
152 0 : the_acl->num_aces--;
153 : } else {
154 32 : i++;
155 : }
156 : }
157 : }
158 :
159 :
160 78 : static int change_share_sec(TALLOC_CTX *mem_ctx, const char *sharename, char *the_acl, enum acl_mode mode)
161 : {
162 78 : struct security_descriptor *sd = NULL;
163 78 : struct security_descriptor *old = NULL;
164 78 : size_t sd_size = 0;
165 : uint32_t i, j;
166 : NTSTATUS status;
167 :
168 78 : if (mode != SMB_ACL_SET && mode != SMB_SD_DELETE) {
169 68 : if (!(old = get_share_security( mem_ctx, sharename, &sd_size )) ) {
170 0 : fprintf(stderr, "Unable to retrieve permissions for share "
171 : "[%s]\n", sharename);
172 0 : return -1;
173 : }
174 : }
175 :
176 102 : if ( (mode != SMB_ACL_VIEW && mode != SMB_SD_DELETE) &&
177 24 : !(sd = parse_acl_string(mem_ctx, the_acl, &sd_size )) ) {
178 0 : fprintf( stderr, "Failed to parse acl\n");
179 0 : return -1;
180 : }
181 :
182 78 : switch (mode) {
183 0 : case SMB_ACL_VIEW_ALL:
184 : /* should not happen */
185 0 : return 0;
186 54 : case SMB_ACL_VIEW:
187 54 : sec_desc_print(NULL, stdout, old, false);
188 54 : return 0;
189 2 : case SMB_ACL_DELETE:
190 4 : for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
191 2 : bool found = False;
192 :
193 8 : for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
194 8 : if (security_ace_equal(&sd->dacl->aces[i],
195 8 : &old->dacl->aces[j])) {
196 : uint32_t k;
197 2 : for (k=j; k<old->dacl->num_aces-1;k++) {
198 0 : old->dacl->aces[k] = old->dacl->aces[k+1];
199 : }
200 2 : old->dacl->num_aces--;
201 2 : found = True;
202 2 : break;
203 : }
204 : }
205 :
206 2 : if (!found) {
207 0 : printf("ACL for ACE:");
208 0 : print_ace(NULL, stdout, &sd->dacl->aces[i], false);
209 0 : printf(" not found\n");
210 : }
211 : }
212 2 : break;
213 2 : case SMB_ACL_MODIFY:
214 4 : for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
215 2 : bool found = False;
216 :
217 6 : for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
218 4 : if (dom_sid_equal(&sd->dacl->aces[i].trustee,
219 4 : &old->dacl->aces[j].trustee)) {
220 2 : old->dacl->aces[j] = sd->dacl->aces[i];
221 2 : found = True;
222 : }
223 : }
224 :
225 2 : if (!found) {
226 : struct dom_sid_buf buf;
227 0 : printf("ACL for SID %s not found\n",
228 0 : dom_sid_str_buf(&sd->dacl->aces[i].trustee, &buf));
229 : }
230 : }
231 :
232 2 : if (sd->owner_sid) {
233 0 : old->owner_sid = sd->owner_sid;
234 : }
235 :
236 2 : if (sd->group_sid) {
237 0 : old->group_sid = sd->group_sid;
238 : }
239 2 : break;
240 10 : case SMB_ACL_ADD:
241 20 : for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
242 10 : add_ace(mem_ctx, &old->dacl, &sd->dacl->aces[i]);
243 : }
244 10 : break;
245 10 : case SMB_ACL_SET:
246 10 : old = sd;
247 10 : break;
248 0 : case SMB_SD_DELETE:
249 0 : status = delete_share_security(sharename);
250 0 : if (!NT_STATUS_IS_OK(status)) {
251 0 : fprintf( stderr, "Failed to delete security descriptor for "
252 : "share [%s]\n", sharename );
253 0 : return -1;
254 : }
255 0 : return 0;
256 0 : default:
257 0 : fprintf(stderr, "invalid command\n");
258 0 : return -1;
259 : }
260 :
261 : /* Denied ACE entries must come before allowed ones */
262 24 : sort_acl(old->dacl);
263 :
264 24 : status = set_share_security(sharename, old);
265 24 : if (!NT_STATUS_IS_OK(status)) {
266 0 : fprintf( stderr, "Failed to store acl for share [%s]\n", sharename );
267 0 : return 2;
268 : }
269 24 : return 0;
270 : }
271 :
272 0 : static int set_sharesec_sddl(const char *sharename, const char *sddl)
273 : {
274 : struct security_descriptor *sd;
275 : NTSTATUS status;
276 :
277 0 : sd = sddl_decode(talloc_tos(), sddl, get_global_sam_sid());
278 0 : if (sd == NULL) {
279 0 : fprintf(stderr, "Failed to parse acl\n");
280 0 : return -1;
281 : }
282 :
283 0 : status = set_share_security(sharename, sd);
284 0 : TALLOC_FREE(sd);
285 0 : if (!NT_STATUS_IS_OK(status)) {
286 0 : fprintf(stderr, "Failed to store acl for share [%s]\n",
287 : sharename);
288 0 : return -1;
289 : }
290 :
291 0 : return 0;
292 : }
293 :
294 0 : static int view_sharesec_sddl(const char *sharename)
295 : {
296 : struct security_descriptor *sd;
297 : size_t sd_size;
298 : char *acl;
299 :
300 0 : sd = get_share_security(talloc_tos(), sharename, &sd_size);
301 0 : if (sd == NULL) {
302 0 : fprintf(stderr, "Unable to retrieve permissions for share "
303 : "[%s]\n", sharename);
304 0 : return -1;
305 : }
306 :
307 0 : acl = sddl_encode(talloc_tos(), sd, get_global_sam_sid());
308 0 : TALLOC_FREE(sd);
309 0 : if (acl == NULL) {
310 0 : fprintf(stderr, "Unable to sddl-encode permissions for share "
311 : "[%s]\n", sharename);
312 0 : return -1;
313 : }
314 0 : printf("%s\n", acl);
315 0 : TALLOC_FREE(acl);
316 0 : return 0;
317 : }
318 :
319 : /********************************************************************
320 : main program
321 : ********************************************************************/
322 :
323 : enum {
324 : OPT_VIEW_ALL = 1000,
325 : OPT_VIEW_SDDL,
326 : };
327 :
328 78 : int main(int argc, const char *argv[])
329 : {
330 : int opt;
331 78 : int retval = 0;
332 78 : enum acl_mode mode = SMB_ACL_SET;
333 : static char *the_acl = NULL;
334 : fstring sharename;
335 78 : bool force_acl = False;
336 : int snum;
337 : poptContext pc;
338 78 : bool initialize_sid = False;
339 : bool ok;
340 78 : struct loadparm_context *lp_ctx = NULL;
341 234 : struct poptOption long_options[] = {
342 : POPT_AUTOHELP
343 : {
344 : .longName = "remove",
345 : .shortName = 'r',
346 : .argInfo = POPT_ARG_STRING,
347 : .arg = &the_acl,
348 : .val = 'r',
349 : .descrip = "Remove ACEs",
350 : .argDescrip = "ACL",
351 : },
352 : {
353 : .longName = "modify",
354 : .shortName = 'm',
355 : .argInfo = POPT_ARG_STRING,
356 : .arg = &the_acl,
357 : .val = 'm',
358 : .descrip = "Modify existing ACEs",
359 : .argDescrip = "ACL",
360 : },
361 : {
362 : .longName = "add",
363 : .shortName = 'a',
364 : .argInfo = POPT_ARG_STRING,
365 : .arg = &the_acl,
366 : .val = 'a',
367 : .descrip = "Add ACEs",
368 : .argDescrip = "ACL",
369 : },
370 : {
371 : .longName = "replace",
372 : .shortName = 'R',
373 : .argInfo = POPT_ARG_STRING,
374 : .arg = &the_acl,
375 : .val = 'R',
376 : .descrip = "Overwrite share permission ACL",
377 : .argDescrip = "ACLS",
378 : },
379 : {
380 : .longName = "delete",
381 : .shortName = 'D',
382 : .argInfo = POPT_ARG_NONE,
383 : .arg = NULL,
384 : .val = 'D',
385 : .descrip = "Delete the entire security descriptor",
386 : },
387 : {
388 : .longName = "setsddl",
389 : .shortName = 'S',
390 : .argInfo = POPT_ARG_STRING,
391 : .arg = the_acl,
392 : .val = 'S',
393 : .descrip = "Set the SD in sddl format",
394 : },
395 : {
396 : .longName = "viewsddl",
397 : .argInfo = POPT_ARG_NONE,
398 : .arg = the_acl,
399 : .val = OPT_VIEW_SDDL,
400 : .descrip = "View the SD in sddl format",
401 : },
402 : {
403 : .longName = "view",
404 : .shortName = 'v',
405 : .argInfo = POPT_ARG_NONE,
406 : .arg = NULL,
407 : .val = 'v',
408 : .descrip = "View current share permissions",
409 : },
410 : {
411 : .longName = "view-all",
412 : .shortName = 0,
413 : .argInfo = POPT_ARG_NONE,
414 : .arg = NULL,
415 : .val = OPT_VIEW_ALL,
416 : .descrip = "View all current share permissions",
417 : },
418 : {
419 : .longName = "machine-sid",
420 : .shortName = 'M',
421 : .argInfo = POPT_ARG_NONE,
422 : .arg = NULL,
423 : .val = 'M',
424 : .descrip = "Initialize the machine SID",
425 : },
426 : {
427 : .longName = "force",
428 : .shortName = 'F',
429 : .argInfo = POPT_ARG_NONE,
430 : .arg = NULL,
431 : .val = 'F',
432 : .descrip = "Force storing the ACL",
433 : .argDescrip = "ACLS",
434 : },
435 78 : POPT_COMMON_SAMBA
436 78 : POPT_COMMON_VERSION
437 : POPT_TABLEEND
438 : };
439 :
440 78 : if ( !(ctx = talloc_stackframe()) ) {
441 0 : fprintf( stderr, "Failed to initialize talloc context!\n");
442 0 : return -1;
443 : }
444 :
445 78 : smb_init_locale();
446 :
447 78 : ok = samba_cmdline_init(ctx,
448 : SAMBA_CMDLINE_CONFIG_NONE,
449 : false /* require_smbconf */);
450 78 : if (!ok) {
451 0 : DBG_ERR("Failed to init cmdline parser!\n");
452 0 : TALLOC_FREE(ctx);
453 0 : exit(1);
454 : }
455 78 : lp_ctx = samba_cmdline_get_lp_ctx();
456 : /* set default debug level to 1 regardless of what smb.conf sets */
457 78 : lpcfg_set_cmdline(lp_ctx, "log level", "1");
458 :
459 78 : pc = samba_popt_get_context(getprogname(),
460 : argc,
461 : argv,
462 : long_options,
463 : 0);
464 78 : if (pc == NULL) {
465 0 : DBG_ERR("Failed to setup popt context!\n");
466 0 : TALLOC_FREE(ctx);
467 0 : exit(1);
468 : }
469 :
470 78 : poptSetOtherOptionHelp(pc, "sharename\n");
471 :
472 156 : while ((opt = poptGetNextOpt(pc)) != -1) {
473 78 : switch (opt) {
474 2 : case 'r':
475 2 : the_acl = smb_xstrdup(poptGetOptArg(pc));
476 2 : mode = SMB_ACL_DELETE;
477 2 : break;
478 :
479 2 : case 'm':
480 2 : the_acl = smb_xstrdup(poptGetOptArg(pc));
481 2 : mode = SMB_ACL_MODIFY;
482 2 : break;
483 :
484 10 : case 'a':
485 10 : the_acl = smb_xstrdup(poptGetOptArg(pc));
486 10 : mode = SMB_ACL_ADD;
487 10 : break;
488 :
489 10 : case 'R':
490 10 : the_acl = smb_xstrdup(poptGetOptArg(pc));
491 10 : mode = SMB_ACL_SET;
492 10 : break;
493 :
494 0 : case 'D':
495 0 : mode = SMB_SD_DELETE;
496 0 : break;
497 :
498 0 : case 'S':
499 0 : mode = SMB_SD_SETSDDL;
500 0 : the_acl = smb_xstrdup(poptGetOptArg(pc));
501 0 : break;
502 :
503 0 : case OPT_VIEW_SDDL:
504 0 : mode = SMB_SD_VIEWSDDL;
505 0 : break;
506 :
507 54 : case 'v':
508 54 : mode = SMB_ACL_VIEW;
509 54 : break;
510 :
511 0 : case 'F':
512 0 : force_acl = True;
513 0 : break;
514 :
515 0 : case 'M':
516 0 : initialize_sid = True;
517 0 : break;
518 0 : case OPT_VIEW_ALL:
519 0 : mode = SMB_ACL_VIEW_ALL;
520 0 : break;
521 0 : case POPT_ERROR_BADOPT:
522 0 : fprintf(stderr, "\nInvalid option %s: %s\n\n",
523 : poptBadOption(pc, 0), poptStrerror(opt));
524 0 : poptPrintUsage(pc, stderr, 0);
525 0 : exit(1);
526 : }
527 : }
528 :
529 78 : setlinebuf(stdout);
530 :
531 78 : lp_load_with_registry_shares(get_dyn_CONFIGFILE());
532 :
533 : /* check for initializing secrets.tdb first */
534 :
535 78 : if ( initialize_sid ) {
536 0 : struct dom_sid *sid = get_global_sam_sid();
537 : struct dom_sid_buf buf;
538 :
539 0 : if ( !sid ) {
540 0 : fprintf( stderr, "Failed to retrieve Machine SID!\n");
541 0 : retval = 3;
542 0 : goto done;
543 : }
544 :
545 0 : printf ("%s\n", dom_sid_str_buf(sid, &buf) );
546 0 : retval = 0;
547 0 : goto done;
548 : }
549 :
550 78 : if ( mode == SMB_ACL_VIEW && force_acl ) {
551 0 : fprintf( stderr, "Invalid combination of -F and -v\n");
552 0 : retval = -1;
553 0 : goto done;
554 : }
555 :
556 78 : if (mode == SMB_ACL_VIEW_ALL) {
557 : int i;
558 :
559 0 : for (i=0; i<lp_numservices(); i++) {
560 0 : TALLOC_CTX *frame = talloc_stackframe();
561 : const struct loadparm_substitution *lp_sub =
562 0 : loadparm_s3_global_substitution();
563 0 : const char *service = lp_servicename(frame, lp_sub, i);
564 :
565 0 : if (service == NULL) {
566 0 : continue;
567 : }
568 :
569 0 : printf("[%s]\n", service);
570 0 : change_share_sec(frame, service, NULL, SMB_ACL_VIEW);
571 0 : printf("\n");
572 0 : TALLOC_FREE(frame);
573 : }
574 0 : goto done;
575 : }
576 :
577 : /* get the sharename */
578 :
579 78 : if(!poptPeekArg(pc)) {
580 0 : poptPrintUsage(pc, stderr, 0);
581 0 : retval = -1;
582 0 : goto done;
583 : }
584 :
585 78 : fstrcpy(sharename, poptGetArg(pc));
586 :
587 78 : snum = lp_servicenumber( sharename );
588 :
589 78 : if ( snum == -1 && !force_acl ) {
590 0 : fprintf( stderr, "Invalid sharename: %s\n", sharename);
591 0 : retval = -1;
592 0 : goto done;
593 : }
594 :
595 78 : switch (mode) {
596 0 : case SMB_SD_SETSDDL:
597 0 : retval = set_sharesec_sddl(sharename, the_acl);
598 0 : break;
599 0 : case SMB_SD_VIEWSDDL:
600 0 : retval = view_sharesec_sddl(sharename);
601 0 : break;
602 78 : default:
603 78 : retval = change_share_sec(ctx, sharename, the_acl, mode);
604 78 : break;
605 : }
606 :
607 78 : done:
608 78 : gfree_all();
609 78 : poptFreeContext(pc);
610 78 : talloc_destroy(ctx);
611 :
612 78 : return retval;
613 : }
|
