samba-mirror/source3/utils/smbcacls.c

/* 
   Unix SMB/Netbios implementation.
   ACL get/set utility
   Version 3.0
   
   Copyright (C) Andrew Tridgell 2000
   Copyright (C) Tim Potter      2000
   Copyright (C) Jeremy Allison  2000
   
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 2 of the License, or
   (at your option) any later version.
   
   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.
   
   You should have received a copy of the GNU General Public License
   along with this program; if not, write to the Free Software
   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/

#include "includes.h"

static fstring password;
static pstring username;
static pstring owner_username;
static fstring server;
static int got_pass;
static int test_args;

/* numeric is set when the user wants numeric SIDs and ACEs rather
   than going via LSA calls to resolve them */
static int numeric;

enum acl_mode {ACL_SET, ACL_DELETE, ACL_MODIFY, ACL_ADD };
enum chown_mode {REQUEST_NONE, REQUEST_CHOWN, REQUEST_CHGRP};

struct perm_value {
	char *perm;
	uint32 mask;
};

/* These values discovered by inspection */

static struct perm_value special_values[] = {
	{ "R", 0x00120089 },
	{ "W", 0x00120116 },
	{ "X", 0x001200a0 },
	{ "D", 0x00010000 },
	{ "P", 0x00040000 },
	{ "O", 0x00080000 },
	{ NULL, 0 },
};

static struct perm_value standard_values[] = {
	{ "READ",   0x001200a9 },
	{ "CHANGE", 0x001301bf },
	{ "FULL",   0x001f01ff },
	{ NULL, 0 },
};

struct cli_state lsa_cli;
POLICY_HND pol;
struct ntuser_creds creds;
BOOL got_policy_hnd;

/* Open cli connection and policy handle */

static BOOL open_policy_hnd(void)
{
	creds.pwd.null_pwd = 1;

	/* Initialise cli LSA connection */

	if (!lsa_cli.initialised && 
	    !cli_lsa_initialise(&lsa_cli, server, &creds)) {
		return False;
	}

	/* Open policy handle */

	if (!got_policy_hnd) {
		if (cli_lsa_open_policy(&lsa_cli, True, 
					SEC_RIGHTS_MAXIMUM_ALLOWED, &pol)
		    != NT_STATUS_NOPROBLEMO) {
			return False;
		}

		got_policy_hnd = True;
	}
	
	return True;
}

/* convert a SID to a string, either numeric or username/group */
static void SidToString(fstring str, DOM_SID *sid)
{
	char **names = NULL;
	uint32 *types = NULL;
	int num_names;

	sid_to_string(str, sid);

	if (numeric) return;

	/* Ask LSA to convert the sid to a name */

	if (!open_policy_hnd() ||
	    cli_lsa_lookup_sids(&lsa_cli, &pol, 1, sid, &names, &types, 
				&num_names) != NT_STATUS_NOPROBLEMO) {
		return;
	}

	/* Converted OK */
	
	fstrcpy(str, names[0]);
	
	safe_free(names[0]);
	safe_free(names);
	safe_free(types);
}

/* convert a string to a SID, either numeric or username/group */
static BOOL StringToSid(DOM_SID *sid, char *str)
{
	uint32 *types = NULL;
	DOM_SID *sids = NULL;
	int num_sids;
	BOOL result = True;
	
	if (strncmp(str, "S-", 2) == 0) {
		return string_to_sid(sid, str);
	}

	if (!open_policy_hnd() ||
	    cli_lsa_lookup_names(&lsa_cli, &pol, 1, &str, &sids, &types, 
				 &num_sids) != NT_STATUS_NOPROBLEMO) {
		result = False;
		goto done;
	}

	sid_copy(sid, &sids[0]);

	safe_free(sids);
	safe_free(types);

 done:

	return result;
}


/* print an ACE on a FILE, using either numeric or ascii representation */
static void print_ace(FILE *f, SEC_ACE *ace)
{
	struct perm_value *v;
	fstring sidstr;
	int do_print = 0;
	uint32 got_mask;

	SidToString(sidstr, &ace->sid);

	fprintf(f, "%s:", sidstr);

	if (numeric) {
		fprintf(f, "%d/%d/0x%08x\n", 
			ace->type, ace->flags, ace->info.mask);
		return;
	}

	/* Ace type */

	if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED) {
		fprintf(f, "ALLOWED");
	} else if (ace->type == SEC_ACE_TYPE_ACCESS_DENIED) {
		fprintf(f, "DENIED");
	} else {
		fprintf(f, "%d", ace->type);
	}

	/* Not sure what flags can be set in a file ACL */

	fprintf(f, "/%d/", ace->flags);

	/* Standard permissions */

	for (v = standard_values; v->perm; v++) {
		if (ace->info.mask == v->mask) {
			fprintf(f, "%s\n", v->perm);
			return;
		}
	}

	/* Special permissions.  Print out a hex value if we have
	   leftover bits in the mask. */

	got_mask = ace->info.mask;

 again:
	for (v = special_values; v->perm; v++) {
		if ((ace->info.mask & v->mask) == v->mask) {
			if (do_print) {
				fprintf(f, "%s", v->perm);
			}
			got_mask &= ~v->mask;
		}
	}

	if (!do_print) {
		if (got_mask != 0) {
			fprintf(f, "0x%08x", ace->info.mask);
		} else {
			do_print = 1;
			goto again;
		}
	}

	fprintf(f, "\n");
}


/* parse an ACE in the same format as print_ace() */
static BOOL parse_ace(SEC_ACE *ace, char *str)
{
	char *p;
	fstring tok;
	unsigned atype, aflags, amask;
	DOM_SID sid;
	SEC_ACCESS mask;
	struct perm_value *v;

	ZERO_STRUCTP(ace);
	p = strchr(str,':');
	if (!p) return False;
	*p = '\0';
	p++;

	/* Try to parse numeric form */

	if (sscanf(p, "%i/%i/%i", &atype, &aflags, &amask) == 3 &&
	    StringToSid(&sid, str)) {
		goto done;
	}

	/* Try to parse text form */

	if (!StringToSid(&sid, str)) {
		return False;
	}

	if (!next_token(&p, tok, "/", sizeof(fstring))) {
		return False;
	}

	if (strncmp(tok, "ALLOWED", strlen("ALLOWED")) == 0) {
		atype = SEC_ACE_TYPE_ACCESS_ALLOWED;
	} else if (strncmp(tok, "DENIED", strlen("DENIED")) == 0) {
		atype = SEC_ACE_TYPE_ACCESS_DENIED;
	} else {
		return False;
	}

	/* Only numeric form accepted for flags at present */

	if (!(next_token(NULL, tok, "/", sizeof(fstring)) &&
	      sscanf(tok, "%i", &aflags))) {
		return False;
	}

	if (!next_token(NULL, tok, "/", sizeof(fstring))) {
		return False;
	}

	if (strncmp(tok, "0x", 2) == 0) {
		if (sscanf(tok, "%i", &amask) != 1) {
			return False;
		}
		goto done;
	}

	for (v = standard_values; v->perm; v++) {
		if (strcmp(tok, v->perm) == 0) {
			amask = v->mask;
			goto done;
		}
	}

	p = tok;

	while(*p) {
		BOOL found = False;

		for (v = special_values; v->perm; v++) {
			if (v->perm[0] == *p) {
				amask |= v->mask;
				found = True;
			}
		}

		if (!found) return False;
		p++;
	}

	if (*p) {
		return False;
	}

 done:
	mask.mask = amask;
	init_sec_ace(ace, &sid, atype, mask, aflags);
	return True;
}

/* add an ACE to a list of ACEs in a SEC_ACL */
static BOOL add_ace(SEC_ACL **the_acl, SEC_ACE *ace)
{
	SEC_ACL *new;
	SEC_ACE *aces;
	if (! *the_acl) {
		(*the_acl) = make_sec_acl(3, 1, ace);
		return True;
	}

	aces = calloc(1+(*the_acl)->num_aces,sizeof(SEC_ACE));
	memcpy(aces, (*the_acl)->ace, (*the_acl)->num_aces * sizeof(SEC_ACE));
	memcpy(aces+(*the_acl)->num_aces, ace, sizeof(SEC_ACE));
	new = make_sec_acl((*the_acl)->revision,1+(*the_acl)->num_aces, aces);
	free_sec_acl(the_acl);
	free(aces);
	(*the_acl) = new;
	return True;
}

/* parse a ascii version of a security descriptor */
static SEC_DESC *sec_desc_parse(char *str)
{
	char *p = str;
	fstring tok;
	SEC_DESC *ret;
	unsigned sd_size;
	DOM_SID *grp_sid=NULL, *owner_sid=NULL;
	SEC_ACL *dacl=NULL;
	int revision=1;

	while (next_token(&p, tok, "\t,\r\n", sizeof(tok))) {

		if (strncmp(tok,"REVISION:", 9) == 0) {
			revision = strtol(tok+9, NULL, 16);
			continue;
		}

		if (strncmp(tok,"OWNER:", 6) == 0) {
			owner_sid = (DOM_SID *)calloc(1, sizeof(DOM_SID));
			if (!owner_sid ||
			    !StringToSid(owner_sid, tok+6)) {
				printf("Failed to parse owner sid\n");
				return NULL;
			}
			continue;
		}

		if (strncmp(tok,"GROUP:", 6) == 0) {
			grp_sid = (DOM_SID *)calloc(1, sizeof(DOM_SID));
			if (!grp_sid ||
			    !StringToSid(grp_sid, tok+6)) {
				printf("Failed to parse group sid\n");
				return NULL;
			}
			continue;
		}

		if (strncmp(tok,"ACL:", 4) == 0) {
			SEC_ACE ace;
			if (!parse_ace(&ace, tok+4)) {
				printf("Failed to parse ACL %s\n", tok);
				return NULL;
			}
			if(!add_ace(&dacl, &ace)) {
				printf("Failed to add ACL %s\n", tok);
				return NULL;
			}
			continue;
		}

		printf("Failed to parse security descriptor\n");
		return NULL;
	}

	ret = make_sec_desc(revision, owner_sid, grp_sid, 
			    NULL, dacl, &sd_size);

	free_sec_acl(&dacl);

	if (grp_sid) free(grp_sid);
	if (owner_sid) free(owner_sid);

	return ret;
}


/* print a ascii version of a security descriptor on a FILE handle */
static void sec_desc_print(FILE *f, SEC_DESC *sd)
{
	fstring sidstr;
	int i;

	printf("REVISION:%d\n", sd->revision);

	/* Print owner and group sid */

	if (sd->owner_sid) {
		SidToString(sidstr, sd->owner_sid);
	} else {
		fstrcpy(sidstr, "");
	}

	printf("OWNER:%s\n", sidstr);

	if (sd->grp_sid) {
		SidToString(sidstr, sd->grp_sid);
	} else {
		fstrcpy(sidstr, "");
	}

	fprintf(f, "GROUP:%s\n", sidstr);

	/* Print aces */
	for (i = 0; sd->dacl && i < sd->dacl->num_aces; i++) {
		SEC_ACE *ace = &sd->dacl->ace[i];
		fprintf(f, "ACL:");
		print_ace(f, ace);
	}

}

/* Some systems seem to require unicode pathnames for the ntcreate&x call
   despite Samba negotiating ascii filenames.  Try with unicode pathname if
   the ascii version fails. */

int do_cli_nt_create(struct cli_state *cli, char *fname, uint32 DesiredAccess)
{
	int result;

	result = cli_nt_create(cli, fname, DesiredAccess);

	if (result == -1) {
		uint32 errnum, nt_rpc_error;
		uint8 errclass;

		cli_error(cli, &errclass, &errnum, &nt_rpc_error);

		if (errclass == ERRDOS && errnum == ERRbadpath) {
			result = cli_nt_create_uni(cli, fname, DesiredAccess);
		}
	}

	return result;
}

/***************************************************** 
dump the acls for a file
*******************************************************/
static void cacl_dump(struct cli_state *cli, char *filename)
{
	int fnum;
	SEC_DESC *sd;

	if (test_args) return;

	fnum = do_cli_nt_create(cli, filename, 0x20000);
	if (fnum == -1) {
		printf("Failed to open %s: %s\n", filename, cli_errstr(cli));
		return;
	}

	sd = cli_query_secdesc(cli, fnum);

	if (!sd) {
		printf("ERROR: secdesc query failed: %s\n", cli_errstr(cli));
		return;
	}

	sec_desc_print(stdout, sd);

	free_sec_desc(&sd);

	cli_close(cli, fnum);
}

/***************************************************** 
Change the ownership or group ownership of a file. Just
because the NT docs say this can't be done :-). JRA.
*******************************************************/

static void owner_set(struct cli_state *cli, enum chown_mode change_mode, char *filename, char *new_username)
{
	int fnum;
	DOM_SID sid;
	SEC_DESC *sd, *old;
	size_t sd_size;

	fnum = do_cli_nt_create(cli, filename, 
				READ_CONTROL_ACCESS | WRITE_DAC_ACCESS
				| WRITE_OWNER_ACCESS);

	if (fnum == -1) {
		printf("Failed to open %s: %s\n", filename, cli_errstr(cli));
		return;
	}

	if (!StringToSid(&sid, new_username))
		return;

	old = cli_query_secdesc(cli, fnum);

	sd = make_sec_desc(old->revision,
				(change_mode == REQUEST_CHOWN) ? &sid : old->owner_sid,
				(change_mode == REQUEST_CHGRP) ? &sid : old->grp_sid,
			   NULL, old->dacl, &sd_size);

	if (!cli_set_secdesc(cli, fnum, sd)) {
		printf("ERROR: secdesc set failed: %s\n", cli_errstr(cli));
	}

	free_sec_desc(&sd);
	free_sec_desc(&old);

	cli_close(cli, fnum);
}

/* The MSDN is contradictory over the ordering of ACE entries in an ACL.
   However NT4 gives a "The information may have been modified by a
   computer running Windows NT 5.0" if denied ACEs do not appear before
   allowed ACEs. */

static void sort_acl(SEC_ACL *the_acl)
{
	SEC_ACE *tmp_ace;
	int i, ace_ndx = 0;
	BOOL do_denied = True;

	tmp_ace = (SEC_ACE *)malloc(sizeof(SEC_ACE) * the_acl->num_aces);

	if (!tmp_ace) return;

 copy_aces:
	
	for (i = 0; i < the_acl->num_aces; i++) {

		/* Copy denied ACEs */

		if (do_denied &&
		    the_acl->ace[i].type == SEC_ACE_TYPE_ACCESS_DENIED) {
			tmp_ace[ace_ndx] = the_acl->ace[i];
			ace_ndx++;
		}

		/* Copy other ACEs */

		if (!do_denied &&
		    the_acl->ace[i].type != SEC_ACE_TYPE_ACCESS_DENIED) {
			tmp_ace[ace_ndx] = the_acl->ace[i];
			ace_ndx++;
		}
	}

	if (do_denied) {
		do_denied = False;
		goto copy_aces;
	}

	free(the_acl->ace);
	the_acl->ace = tmp_ace;
}

/***************************************************** 
set the ACLs on a file given an ascii description
*******************************************************/
static void cacl_set(struct cli_state *cli, char *filename, 
		     char *the_acl, enum acl_mode mode)
{
	int fnum;
	SEC_DESC *sd, *old;
	int i, j;
	size_t sd_size;

	sd = sec_desc_parse(the_acl);

	if (!sd) return;
	if (test_args) return;

	/* The desired access below is the only one I could find that works
	   with NT4, W2KP and Samba */

	fnum = do_cli_nt_create(cli, filename, 
				MAXIMUM_ALLOWED_ACCESS | 0x60000);

	if (fnum == -1) {
		printf("Failed to open %s: %s\n", filename, cli_errstr(cli));
		return;
	}

	old = cli_query_secdesc(cli, fnum);

	/* the logic here is rather more complex than I would like */
	switch (mode) {
	case ACL_DELETE:
		for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
			BOOL found = False;

			for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
				if (sec_ace_equal(&sd->dacl->ace[i],
						  &old->dacl->ace[j])) {
					if (j != old->dacl->num_aces-1) {
						old->dacl->ace[j] = old->dacl->ace[j+1];
					}
					old->dacl->num_aces--;
					if (old->dacl->num_aces == 0) {
						free(old->dacl->ace);
						old->dacl->ace=NULL;
						free(old->dacl);
						old->dacl = NULL;
						old->off_dacl = 0;
					}
					found = True;
					break;
				}
			}

			if (!found) {
				fstring str;

				SidToString(str, &sd->dacl->ace[i].sid);
				printf("ACL for SID %s not found\n", str);
			}
		}
		break;

	case ACL_MODIFY:
		for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
			BOOL found = False;

			for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
				if (sid_equal(&sd->dacl->ace[i].sid,
					      &old->dacl->ace[j].sid)) {
					old->dacl->ace[j] = sd->dacl->ace[i];
					found = True;
				}
			}

			if (!found) {
				fstring str;

				SidToString(str, &sd->dacl->ace[i].sid);
				printf("ACL for SID %s not found\n", str);
			}
		}

		break;

	case ACL_ADD:
		for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
			add_ace(&old->dacl, &sd->dacl->ace[i]);
		}
		break;

	case ACL_SET:
 		free_sec_desc(&old);
 		old = sd;
		break;
	}

	if (sd != old) {
		free_sec_desc(&sd);
	}

	/* Denied ACE entries must come before allowed ones */

	sort_acl(old->dacl);

	/* Create new security descriptor and set it */

	sd = make_sec_desc(old->revision, old->owner_sid, old->grp_sid, 
			   NULL, old->dacl, &sd_size);

	if (!cli_set_secdesc(cli, fnum, sd)) {
		printf("ERROR: secdesc set failed: %s\n", cli_errstr(cli));
	}

	/* Clean up */

	free_sec_desc(&sd);
	free_sec_desc(&old);

	cli_close(cli, fnum);
}


/***************************************************** 
return a connection to a server
*******************************************************/
struct cli_state *connect_one(char *share)
{
	struct cli_state *c;
	struct nmb_name called, calling;
	char *server_n;
	struct in_addr ip;
	extern struct in_addr ipzero;
	extern pstring global_myname;

	fstrcpy(server,share+2);
	share = strchr(server,'\\');
	if (!share) return NULL;
	*share = 0;
	share++;

	server_n = server;
	
	ip = ipzero;

	make_nmb_name(&calling, global_myname, 0x0);
	make_nmb_name(&called , server, 0x20);

 again:
	ip = ipzero;

	/* have to open a new connection */
	if (!(c=cli_initialise(NULL)) || (cli_set_port(c, 139) == 0) ||
	    !cli_connect(c, server_n, &ip)) {
		DEBUG(0,("Connection to %s failed\n", server_n));
		cli_shutdown(c);
		safe_free(c);
		return NULL;
	}

	if (!cli_session_request(c, &calling, &called)) {
		DEBUG(0,("session request to %s failed\n", called.name));
		cli_shutdown(c);
		safe_free(c);
		if (strcmp(called.name, "*SMBSERVER")) {
			make_nmb_name(&called , "*SMBSERVER", 0x20);
			goto again;
		}
		return NULL;
	}

	DEBUG(4,(" session request ok\n"));

	if (!cli_negprot(c)) {
		DEBUG(0,("protocol negotiation failed\n"));
		cli_shutdown(c);
		safe_free(c);
		return NULL;
	}

	if (!got_pass) {
		char *pass = getpass("Password: ");
		if (pass) {
			pstrcpy(password, pass);
		}
	}

	if (!cli_session_setup(c, username, 
			       password, strlen(password),
			       password, strlen(password),
			       lp_workgroup())) {
		DEBUG(0,("session setup failed: %s\n", cli_errstr(c)));
		cli_shutdown(c);
		safe_free(c);
		return NULL;
	}

	DEBUG(4,(" session setup ok\n"));

	if (!cli_send_tconX(c, share, "?????",
			    password, strlen(password)+1)) {
		DEBUG(0,("tree connect failed: %s\n", cli_errstr(c)));
		cli_shutdown(c);
		safe_free(c);
		return NULL;
	}

	DEBUG(4,(" tconx ok\n"));

	return c;
}


static void usage(void)
{
	printf(
"Usage: smbcacls //server1/share1 filename [options]\n\
\n\
\t-D <acls>               delete an acl\n\
\t-M <acls>               modify an acl\n\
\t-A <acls>               add an acl\n\
\t-S <acls>               set acls\n\
\t-C username             change ownership of a file\n\
\t-G username             change group ownership of a file\n\
\t-n                      don't resolve sids or masks to names\n\
\t-h                      print help\n\
\n\
The username can be of the form username%%password or\n\
workgroup\\username%%password.\n\n\
An acl is of the form ACL:<SID>:type/flags/mask\n\
You can string acls together with spaces, commas or newlines\n\
");
}

/****************************************************************************
  main program
****************************************************************************/
 int main(int argc,char *argv[])
{
	char *share;
	char *filename;
	extern char *optarg;
	extern int optind;
	extern FILE *dbf;
	int opt;
	char *p;
	int seed;
	static pstring servicesf = CONFIGFILE;
	struct cli_state *cli;
	enum acl_mode mode;
	char *the_acl = NULL;
	enum chown_mode change_mode = REQUEST_NONE;

	setlinebuf(stdout);

	dbf = stderr;

	if (argc < 3 || argv[1][0] == '-') {
		usage();
		exit(1);
	}

	setup_logging(argv[0],True);

	share = argv[1];
	filename = argv[2];
	all_string_sub(share,"/","\\",0);

	argc -= 2;
	argv += 2;

	TimeInit();
	charset_initialise();

	lp_load(servicesf,True,False,False);
	codepage_initialise(lp_client_code_page());
	load_interfaces();

	if (getenv("USER")) {
		pstrcpy(username,getenv("USER"));

		if ((p=strchr(username,'%'))) {
			*p = 0;
			pstrcpy(password,p+1);
			got_pass = True;
			memset(strchr(getenv("USER"), '%') + 1, 'X',
			       strlen(password));
		}
	}

	seed = time(NULL);

	while ((opt = getopt(argc, argv, "U:nhS:D:A:M:C:G:t")) != EOF) {
		switch (opt) {
		case 'U':
			pstrcpy(username,optarg);
			p = strchr(username,'%');
			if (p) {
				*p = 0;
				pstrcpy(password, p+1);
				got_pass = 1;
			}
			break;

		case 'S':
			the_acl = optarg;
			mode = ACL_SET;
			break;

		case 'D':
			the_acl = optarg;
			mode = ACL_DELETE;
			break;

		case 'M':
			the_acl = optarg;
			mode = ACL_MODIFY;
			break;

		case 'A':
			the_acl = optarg;
			mode = ACL_ADD;
			break;

		case 'C':
			pstrcpy(owner_username,optarg);
			change_mode = REQUEST_CHOWN;
			break;

		case 'G':
			pstrcpy(owner_username,optarg);
			change_mode = REQUEST_CHGRP;
			break;

		case 'n':
			numeric = 1;
			break;

		case 't':
			test_args = 1;
			break;

		case 'h':
			usage();
			exit(1);

		default:
			printf("Unknown option %c (%d)\n", (char)opt, opt);
			exit(1);
		}
	}

	argc -= optind;
	argv += optind;
	
	if (argc > 0) {
		usage();
		exit(1);
	}

	/* Make connection to server */

	if (!test_args) {
		cli = connect_one(share);
		if (!cli) exit(1);
	}


	{
		char *s;

		s = filename;
		while(*s) {
			if (*s == '/') *s = '\\';
			s++;
		}
	}

	/* Perform requested action */

	if (change_mode != REQUEST_NONE) {
		owner_set(cli, change_mode, filename, owner_username);
	} else if (the_acl) {
		cacl_set(cli, filename, the_acl, mode);
	} else {
		cacl_dump(cli, filename);
	}

	return(0);
}