sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Code

s3: Make sharesec optionally use sddl

Browse Source
This commit is contained in:
Volker Lendecke 2011-09-15 19:27:07 +02:00 committed by Volker Lendecke
parent 4117c29138
commit d68ed1b9c6
1 changed files with 76 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

77
source3/utils/sharesec.c
View File

@ -34,6 +34,8 @@ enum acl_mode { SMB_ACL_DELETE,
SMB_ACL_ADD,
SMB_ACL_SET,
SMB_SD_DELETE,
SMB_SD_SETSDDL,
SMB_SD_VIEWSDDL,
SMB_ACL_VIEW };
struct perm_value {
@ -497,6 +499,9 @@ static int change_share_sec(TALLOC_CTX *mem_ctx, const char *sharename, char *th
return -1;
}
return 0;
default:
fprintf(stderr, "invalid command\n");
return -1;
}
/* Denied ACE entries must come before allowed ones */
@ -509,6 +514,53 @@ static int change_share_sec(TALLOC_CTX *mem_ctx, const char *sharename, char *th
return 0;
}
static int set_sharesec_sddl(const char *sharename, const char *sddl)
{
struct security_descriptor *sd;
bool ret;
sd = sddl_decode(talloc_tos(), sddl, get_global_sam_sid());
if (sd == NULL) {
fprintf(stderr, "Failed to parse acl\n");
return -1;
}
ret = set_share_security(sharename, sd);
TALLOC_FREE(sd);
if (!ret) {
fprintf(stderr, "Failed to store acl for share [%s]\n",
sharename);
return -1;
}
return 0;
}
static int view_sharesec_sddl(const char *sharename)
{
struct security_descriptor *sd;
size_t sd_size;
char *acl;
sd = get_share_security(talloc_tos(), sharename, &sd_size);
if (sd == NULL) {
fprintf(stderr, "Unable to retrieve permissions for share "
"[%s]\n", sharename);
return -1;
}
acl = sddl_encode(talloc_tos(), sd, get_global_sam_sid());
TALLOC_FREE(sd);
if (acl == NULL) {
fprintf(stderr, "Unable to sddl-encode permissions for share "
"[%s]\n", sharename);
return -1;
}
printf("%s\n", acl);
TALLOC_FREE(acl);
return 0;
}
/********************************************************************
main program
********************************************************************/
@ -531,6 +583,10 @@ int main(int argc, const char *argv[])
{ "add", 'a', POPT_ARG_STRING, &the_acl, 'a', "Add ACEs", "ACL" },
{ "replace", 'R', POPT_ARG_STRING, &the_acl, 'R', "Overwrite share permission ACL", "ACLS" },
{ "delete", 'D', POPT_ARG_NONE, NULL, 'D', "Delete the entire security descriptor" },
{ "setsddl", 'S', POPT_ARG_STRING, the_acl, 'S',
"Set the SD in sddl format" },
{ "viewsddl", 'V', POPT_ARG_NONE, the_acl, 'V',
"View the SD in sddl format" },
{ "view", 'v', POPT_ARG_NONE, NULL, 'v', "View current share permissions" },
{ "machine-sid", 'M', POPT_ARG_NONE, NULL, 'M', "Initialize the machine SID" },
{ "force", 'F', POPT_ARG_NONE, NULL, 'F', "Force storing the ACL", "ACLS" },
@ -580,6 +636,15 @@ int main(int argc, const char *argv[])
mode = SMB_SD_DELETE;
break;
case 'S':
mode = SMB_SD_SETSDDL;
the_acl = smb_xstrdup(poptGetOptArg(pc));
break;
case 'V':
mode = SMB_SD_VIEWSDDL;
break;
case 'v':
mode = SMB_ACL_VIEW;
break;
@ -634,7 +699,17 @@ int main(int argc, const char *argv[])
return -1;
}
retval = change_share_sec(ctx, sharename, the_acl, mode);
switch (mode) {
case SMB_SD_SETSDDL:
retval = set_sharesec_sddl(sharename, the_acl);
break;
case SMB_SD_VIEWSDDL:
retval = view_sharesec_sddl(sharename);
break;
default:
retval = change_share_sec(ctx, sharename, the_acl, mode);
break;
}
talloc_destroy(ctx);