1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
samba-mirror/source3/utils/smbcacls.c
Noel Power fa5725cdb0 s3/utils: Add support to smbcacls to restore dacls from file
Allow smbcacls to restore dacls to a directory from file created by
with smbcacls '--save' or icalcs /save

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-15 04:05:34 +00:00

2562 lines
61 KiB
C

/*
Unix SMB/CIFS implementation.
ACL get/set utility
Copyright (C) Andrew Tridgell 2000
Copyright (C) Tim Potter 2000
Copyright (C) Jeremy Allison 2000
Copyright (C) Jelmer Vernooij 2003
Copyright (C) Noel Power <noel.power@suse.com> 2013
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "lib/cmdline/cmdline.h"
#include "rpc_client/cli_pipe.h"
#include "../librpc/gen_ndr/ndr_lsa.h"
#include "rpc_client/cli_lsarpc.h"
#include "../libcli/security/security.h"
#include "libsmb/libsmb.h"
#include "libsmb/clirap.h"
#include "passdb/machine_sid.h"
#include "../librpc/gen_ndr/ndr_lsa_c.h"
#include "util_sd.h"
#include "lib/param/param.h"
static char DIRSEP_CHAR = '\\';
static int inheritance = 0;
static const char *save_file = NULL;
static const char *restore_file = NULL;
static int recurse;
static int test_args;
static int sddl;
static int query_sec_info = -1;
static int set_sec_info = -1;
static bool want_mxac;
static const char *domain_sid = NULL;
enum acl_mode {SMB_ACL_SET, SMB_ACL_DELETE, SMB_ACL_MODIFY, SMB_ACL_ADD };
enum chown_mode {REQUEST_NONE, REQUEST_CHOWN, REQUEST_CHGRP, REQUEST_INHERIT};
enum exit_values {EXIT_OK, EXIT_FAILED, EXIT_PARSE_ERROR};
struct cacl_callback_state {
struct cli_credentials *creds;
struct cli_state *cli;
struct security_descriptor *aclsd;
struct security_acl *acl_to_add;
enum acl_mode mode;
char *the_acl;
bool acl_no_propagate;
bool numeric;
};
static NTSTATUS cli_lsa_lookup_domain_sid(struct cli_state *cli,
struct dom_sid *sid)
{
union lsa_PolicyInformation *info = NULL;
struct smbXcli_tcon *orig_tcon = NULL;
char *orig_share = NULL;
struct rpc_pipe_client *rpc_pipe = NULL;
struct policy_handle handle;
NTSTATUS status, result;
TALLOC_CTX *frame = talloc_stackframe();
if (cli_state_has_tcon(cli)) {
cli_state_save_tcon_share(cli, &orig_tcon, &orig_share);
}
status = cli_tree_connect(cli, "IPC$", "?????", NULL);
if (!NT_STATUS_IS_OK(status)) {
goto done;
}
status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc, &rpc_pipe);
if (!NT_STATUS_IS_OK(status)) {
goto tdis;
}
status = rpccli_lsa_open_policy(rpc_pipe, frame, True,
GENERIC_EXECUTE_ACCESS, &handle);
if (!NT_STATUS_IS_OK(status)) {
goto tdis;
}
status = dcerpc_lsa_QueryInfoPolicy2(rpc_pipe->binding_handle,
frame, &handle,
LSA_POLICY_INFO_DOMAIN,
&info, &result);
if (any_nt_status_not_ok(status, result, &status)) {
goto tdis;
}
*sid = *info->domain.sid;
tdis:
TALLOC_FREE(rpc_pipe);
cli_tdis(cli);
done:
cli_state_restore_tcon_share(cli, orig_tcon, orig_share);
TALLOC_FREE(frame);
return status;
}
static struct dom_sid *get_domain_sid(struct cli_state *cli)
{
NTSTATUS status;
struct dom_sid_buf buf;
struct dom_sid *sid = talloc(talloc_tos(), struct dom_sid);
if (sid == NULL) {
DEBUG(0, ("Out of memory\n"));
return NULL;
}
if (domain_sid) {
if (!dom_sid_parse(domain_sid, sid)) {
DEBUG(0,("failed to parse domain sid\n"));
TALLOC_FREE(sid);
}
} else {
status = cli_lsa_lookup_domain_sid(cli, sid);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(0,("failed to lookup domain sid: %s\n", nt_errstr(status)));
TALLOC_FREE(sid);
}
}
DEBUG(2,("Domain SID: %s\n", dom_sid_str_buf(sid, &buf)));
return sid;
}
/* add an ACE to a list of ACEs in a struct security_acl */
static bool add_ace_with_ctx(TALLOC_CTX *ctx, struct security_acl **the_acl,
const struct security_ace *ace)
{
struct security_acl *acl = *the_acl;
if (acl == NULL) {
acl = make_sec_acl(ctx, 3, 0, NULL);
if (acl == NULL) {
return false;
}
}
if (acl->num_aces == UINT32_MAX) {
return false;
}
ADD_TO_ARRAY(
acl, struct security_ace, *ace, &acl->aces, &acl->num_aces);
*the_acl = acl;
return True;
}
static bool add_ace(struct security_acl **the_acl, struct security_ace *ace)
{
return add_ace_with_ctx(talloc_tos(), the_acl, ace);
}
/* parse a ascii version of a security descriptor */
static struct security_descriptor *sec_desc_parse(TALLOC_CTX *ctx, struct cli_state *cli, char *str)
{
const char *p = str;
char *tok;
struct security_descriptor *ret = NULL;
size_t sd_size;
struct dom_sid owner_sid = { .num_auths = 0 };
bool have_owner = false;
struct dom_sid group_sid = { .num_auths = 0 };
bool have_group = false;
struct security_acl *dacl=NULL;
int revision=1;
while (next_token_talloc(ctx, &p, &tok, "\t,\r\n")) {
if (strncmp(tok,"REVISION:", 9) == 0) {
revision = strtol(tok+9, NULL, 16);
continue;
}
if (strncmp(tok,"OWNER:", 6) == 0) {
if (have_owner) {
printf("Only specify owner once\n");
goto done;
}
if (!StringToSid(cli, &owner_sid, tok+6)) {
printf("Failed to parse owner sid\n");
goto done;
}
have_owner = true;
continue;
}
if (strncmp(tok,"GROUP:", 6) == 0) {
if (have_group) {
printf("Only specify group once\n");
goto done;
}
if (!StringToSid(cli, &group_sid, tok+6)) {
printf("Failed to parse group sid\n");
goto done;
}
have_group = true;
continue;
}
if (strncmp(tok,"ACL:", 4) == 0) {
struct security_ace ace;
if (!parse_ace(cli, &ace, tok+4)) {
goto done;
}
if(!add_ace(&dacl, &ace)) {
printf("Failed to add ACL %s\n", tok);
goto done;
}
continue;
}
printf("Failed to parse token '%s' in security descriptor,\n", tok);
goto done;
}
ret = make_sec_desc(
ctx,
revision,
SEC_DESC_SELF_RELATIVE,
have_owner ? &owner_sid : NULL,
have_group ? &group_sid : NULL,
NULL,
dacl,
&sd_size);
done:
return ret;
}
/*****************************************************
get fileinfo for filename
*******************************************************/
static uint16_t get_fileinfo(struct cli_state *cli, const char *filename)
{
uint16_t fnum = (uint16_t)-1;
NTSTATUS status;
struct smb_create_returns cr = {0};
/* The desired access below is the only one I could find that works
with NT4, W2KP and Samba */
status = cli_ntcreate(
cli, /* cli */
filename, /* fname */
0, /* CreatFlags */
READ_CONTROL_ACCESS, /* CreatFlags */
0, /* FileAttributes */
FILE_SHARE_READ|
FILE_SHARE_WRITE, /* ShareAccess */
FILE_OPEN, /* CreateDisposition */
0x0, /* CreateOptions */
0x0, /* SecurityFlags */
&fnum, /* pfid */
&cr); /* cr */
if (!NT_STATUS_IS_OK(status)) {
printf("Failed to open %s: %s\n", filename, nt_errstr(status));
return 0;
}
cli_close(cli, fnum);
return cr.file_attributes;
}
/*****************************************************
get sec desc for filename
*******************************************************/
static struct security_descriptor *get_secdesc_with_ctx(TALLOC_CTX *ctx,
struct cli_state *cli,
const char *filename)
{
uint16_t fnum = (uint16_t)-1;
struct security_descriptor *sd;
NTSTATUS status;
uint32_t sec_info;
uint32_t desired_access = 0;
if (query_sec_info == -1) {
sec_info = SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL;
} else {
sec_info = query_sec_info;
}
if (sec_info & (SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL)) {
desired_access |= SEC_STD_READ_CONTROL;
}
if (sec_info & SECINFO_SACL) {
desired_access |= SEC_FLAG_SYSTEM_SECURITY;
}
if (desired_access == 0) {
desired_access |= SEC_STD_READ_CONTROL;
}
status = cli_ntcreate(cli, filename, 0, desired_access,
0, FILE_SHARE_READ|FILE_SHARE_WRITE,
FILE_OPEN, 0x0, 0x0, &fnum, NULL);
if (!NT_STATUS_IS_OK(status)) {
printf("Failed to open %s: %s\n", filename, nt_errstr(status));
return NULL;
}
status = cli_query_security_descriptor(cli, fnum, sec_info,
ctx, &sd);
cli_close(cli, fnum);
if (!NT_STATUS_IS_OK(status)) {
printf("Failed to get security descriptor: %s\n",
nt_errstr(status));
return NULL;
}
return sd;
}
static struct security_descriptor *get_secdesc(struct cli_state *cli,
const char *filename)
{
return get_secdesc_with_ctx(talloc_tos(), cli, filename);
}
/*****************************************************
set sec desc for filename
*******************************************************/
static bool set_secdesc(struct cli_state *cli, const char *filename,
struct security_descriptor *sd)
{
uint16_t fnum = (uint16_t)-1;
bool result=true;
NTSTATUS status;
uint32_t desired_access = 0;
uint32_t sec_info;
if (set_sec_info == -1) {
sec_info = 0;
if (sd->dacl || (sd->type & SEC_DESC_DACL_PRESENT)) {
sec_info |= SECINFO_DACL;
}
if (sd->sacl || (sd->type & SEC_DESC_SACL_PRESENT)) {
sec_info |= SECINFO_SACL;
}
if (sd->owner_sid) {
sec_info |= SECINFO_OWNER;
}
if (sd->group_sid) {
sec_info |= SECINFO_GROUP;
}
} else {
sec_info = set_sec_info;
}
/* Make the desired_access more specific. */
if (sec_info & SECINFO_DACL) {
desired_access |= SEC_STD_WRITE_DAC;
}
if (sec_info & SECINFO_SACL) {
desired_access |= SEC_FLAG_SYSTEM_SECURITY;
}
if (sec_info & (SECINFO_OWNER | SECINFO_GROUP)) {
desired_access |= SEC_STD_WRITE_OWNER;
}
status = cli_ntcreate(cli, filename, 0,
desired_access,
0, FILE_SHARE_READ|FILE_SHARE_WRITE,
FILE_OPEN, 0x0, 0x0, &fnum, NULL);
if (!NT_STATUS_IS_OK(status)) {
printf("Failed to open %s: %s\n", filename, nt_errstr(status));
return false;
}
status = cli_set_security_descriptor(cli, fnum, sec_info, sd);
if (!NT_STATUS_IS_OK(status)) {
printf("ERROR: security descriptor set failed: %s\n",
nt_errstr(status));
result=false;
}
cli_close(cli, fnum);
return result;
}
/*****************************************************
get maximum access for a file
*******************************************************/
static int cacl_mxac(struct cli_state *cli, const char *filename)
{
NTSTATUS status;
uint32_t mxac;
status = cli_query_mxac(cli, filename, &mxac);
if (!NT_STATUS_IS_OK(status)) {
printf("Failed to get mxac: %s\n", nt_errstr(status));
return EXIT_FAILED;
}
printf("Maximum access: 0x%x\n", mxac);
return EXIT_OK;
}
/*****************************************************
dump the acls for a file
*******************************************************/
static int cacl_dump(struct cli_state *cli, const char *filename, bool numeric)
{
struct security_descriptor *sd;
int ret;
if (test_args) {
return EXIT_OK;
}
sd = get_secdesc(cli, filename);
if (sd == NULL) {
return EXIT_FAILED;
}
if (sddl) {
char *str = sddl_encode(talloc_tos(), sd, get_domain_sid(cli));
if (str == NULL) {
return EXIT_FAILED;
}
printf("%s\n", str);
TALLOC_FREE(str);
} else {
sec_desc_print(cli, stdout, sd, numeric);
}
if (want_mxac) {
ret = cacl_mxac(cli, filename);
if (ret != EXIT_OK) {
return ret;
}
}
return EXIT_OK;
}
/*****************************************************
Change the ownership or group ownership of a file. Just
because the NT docs say this can't be done :-). JRA.
*******************************************************/
static int owner_set(struct cli_state *cli, enum chown_mode change_mode,
const char *filename, const char *new_username)
{
struct dom_sid sid;
struct security_descriptor *sd;
size_t sd_size;
if (!StringToSid(cli, &sid, new_username))
return EXIT_PARSE_ERROR;
sd = make_sec_desc(talloc_tos(),
SECURITY_DESCRIPTOR_REVISION_1,
SEC_DESC_SELF_RELATIVE,
(change_mode == REQUEST_CHOWN) ? &sid : NULL,
(change_mode == REQUEST_CHGRP) ? &sid : NULL,
NULL, NULL, &sd_size);
if (!set_secdesc(cli, filename, sd)) {
return EXIT_FAILED;
}
return EXIT_OK;
}
/* The MSDN is contradictory over the ordering of ACE entries in an
ACL. However NT4 gives a "The information may have been modified
by a computer running Windows NT 5.0" if denied ACEs do not appear
before allowed ACEs. At
http://technet.microsoft.com/en-us/library/cc781716.aspx the
canonical order is specified as "Explicit Deny, Explicit Allow,
Inherited ACEs unchanged" */
static int ace_compare(struct security_ace *ace1, struct security_ace *ace2)
{
if (security_ace_equal(ace1, ace2))
return 0;
if ((ace1->flags & SEC_ACE_FLAG_INHERITED_ACE) &&
!(ace2->flags & SEC_ACE_FLAG_INHERITED_ACE))
return 1;
if (!(ace1->flags & SEC_ACE_FLAG_INHERITED_ACE) &&
(ace2->flags & SEC_ACE_FLAG_INHERITED_ACE))
return -1;
if ((ace1->flags & SEC_ACE_FLAG_INHERITED_ACE) &&
(ace2->flags & SEC_ACE_FLAG_INHERITED_ACE))
return ace1 - ace2;
if (ace1->type != ace2->type)
return ace2->type - ace1->type;
if (dom_sid_compare(&ace1->trustee, &ace2->trustee))
return dom_sid_compare(&ace1->trustee, &ace2->trustee);
if (ace1->flags != ace2->flags)
return ace1->flags - ace2->flags;
if (ace1->access_mask != ace2->access_mask)
return ace1->access_mask - ace2->access_mask;
if (ace1->size != ace2->size)
return ace1->size - ace2->size;
return memcmp(ace1, ace2, sizeof(struct security_ace));
}
static void sort_acl(struct security_acl *the_acl)
{
uint32_t i;
if (!the_acl) return;
TYPESAFE_QSORT(the_acl->aces, the_acl->num_aces, ace_compare);
for (i=1;i<the_acl->num_aces;) {
if (security_ace_equal(&the_acl->aces[i-1],
&the_acl->aces[i])) {
ARRAY_DEL_ELEMENT(
the_acl->aces, i, the_acl->num_aces);
the_acl->num_aces--;
} else {
i++;
}
}
}
/*****************************************************
set the ACLs on a file given a security descriptor
*******************************************************/
static int cacl_set_from_sd(struct cli_state *cli, const char *filename,
struct security_descriptor *sd, enum acl_mode mode,
bool numeric)
{
struct security_descriptor *old = NULL;
uint32_t i, j;
size_t sd_size;
int result = EXIT_OK;
if (!sd) return EXIT_PARSE_ERROR;
if (test_args) return EXIT_OK;
if (mode != SMB_ACL_SET) {
/*
* Do not fetch old ACL when it will be overwritten
* completely with a new one.
*/
old = get_secdesc(cli, filename);
if (!old) {
return EXIT_FAILED;
}
}
/* the logic here is rather more complex than I would like */
switch (mode) {
case SMB_ACL_DELETE:
for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
bool found = False;
for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
if (security_ace_equal(&sd->dacl->aces[i],
&old->dacl->aces[j])) {
uint32_t k;
for (k=j; k<old->dacl->num_aces-1;k++) {
old->dacl->aces[k] = old->dacl->aces[k+1];
}
old->dacl->num_aces--;
found = True;
break;
}
}
if (!found) {
printf("ACL for ACE:");
print_ace(cli, stdout, &sd->dacl->aces[i],
numeric);
printf(" not found\n");
}
}
break;
case SMB_ACL_MODIFY:
for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
bool found = False;
for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
if (dom_sid_equal(&sd->dacl->aces[i].trustee,
&old->dacl->aces[j].trustee)) {
old->dacl->aces[j] = sd->dacl->aces[i];
found = True;
}
}
if (!found) {
fstring str;
SidToString(cli, str,
&sd->dacl->aces[i].trustee,
numeric);
printf("ACL for SID %s not found\n", str);
}
}
if (sd->owner_sid) {
old->owner_sid = sd->owner_sid;
}
if (sd->group_sid) {
old->group_sid = sd->group_sid;
}
break;
case SMB_ACL_ADD:
for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
add_ace(&old->dacl, &sd->dacl->aces[i]);
}
break;
case SMB_ACL_SET:
old = sd;
break;
}
/* Denied ACE entries must come before allowed ones */
sort_acl(old->dacl);
/* Create new security descriptor and set it */
/* We used to just have "WRITE_DAC_ACCESS" without WRITE_OWNER.
But if we're sending an owner, even if it's the same as the one
that already exists then W2K3 insists we open with WRITE_OWNER access.
I need to check that setting a SD with no owner set works against WNT
and W2K. JRA.
*/
sd = make_sec_desc(talloc_tos(),old->revision, old->type,
old->owner_sid, old->group_sid,
NULL, old->dacl, &sd_size);
if (!set_secdesc(cli, filename, sd)) {
result = EXIT_FAILED;
}
return result;
}
/*****************************************************
set the ACLs on a file given an ascii description
*******************************************************/
static int cacl_set(struct cli_state *cli, const char *filename,
char *the_acl, enum acl_mode mode, bool numeric)
{
struct security_descriptor *sd = NULL;
if (sddl) {
sd = sddl_decode(talloc_tos(), the_acl, get_domain_sid(cli));
} else {
sd = sec_desc_parse(talloc_tos(), cli, the_acl);
}
if (sd == NULL) {
return EXIT_PARSE_ERROR;
}
if (test_args) {
return EXIT_OK;
}
return cacl_set_from_sd(cli, filename, sd, mode, numeric);
}
/*****************************************************
set the inherit on a file
*******************************************************/
static int inherit(struct cli_state *cli, const char *filename,
const char *type)
{
struct security_descriptor *old,*sd;
uint32_t oldattr;
size_t sd_size;
int result = EXIT_OK;
old = get_secdesc(cli, filename);
if (!old) {
return EXIT_FAILED;
}
oldattr = get_fileinfo(cli,filename);
if (strcmp(type,"allow")==0) {
if ((old->type & SEC_DESC_DACL_PROTECTED) ==
SEC_DESC_DACL_PROTECTED) {
uint32_t i;
char *parentname,*temp;
struct security_descriptor *parent;
temp = talloc_strdup(talloc_tos(), filename);
old->type=old->type & (~SEC_DESC_DACL_PROTECTED);
/* look at parent and copy in all its inheritable ACL's. */
string_replace(temp, '\\', '/');
if (!parent_dirname(talloc_tos(),temp,&parentname,NULL)) {
return EXIT_FAILED;
}
string_replace(parentname, '/', '\\');
parent = get_secdesc(cli,parentname);
if (parent == NULL) {
return EXIT_FAILED;
}
for (i=0;i<parent->dacl->num_aces;i++) {
struct security_ace *ace=&parent->dacl->aces[i];
/* Add inherited flag to all aces */
ace->flags=ace->flags|
SEC_ACE_FLAG_INHERITED_ACE;
if ((oldattr & FILE_ATTRIBUTE_DIRECTORY) == FILE_ATTRIBUTE_DIRECTORY) {
if ((ace->flags & SEC_ACE_FLAG_CONTAINER_INHERIT) ==
SEC_ACE_FLAG_CONTAINER_INHERIT) {
add_ace(&old->dacl, ace);
}
} else {
if ((ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT) ==
SEC_ACE_FLAG_OBJECT_INHERIT) {
/* clear flags for files */
ace->flags=0;
add_ace(&old->dacl, ace);
}
}
}
} else {
printf("Already set to inheritable permissions.\n");
return EXIT_FAILED;
}
} else if (strcmp(type,"remove")==0) {
if ((old->type & SEC_DESC_DACL_PROTECTED) !=
SEC_DESC_DACL_PROTECTED) {
old->type=old->type | SEC_DESC_DACL_PROTECTED;
/* remove all inherited ACL's. */
if (old->dacl) {
int i;
struct security_acl *temp=old->dacl;
old->dacl=make_sec_acl(talloc_tos(), 3, 0, NULL);
for (i=temp->num_aces-1;i>=0;i--) {
struct security_ace *ace=&temp->aces[i];
/* Remove all ace with INHERITED flag set */
if ((ace->flags & SEC_ACE_FLAG_INHERITED_ACE) !=
SEC_ACE_FLAG_INHERITED_ACE) {
add_ace(&old->dacl,ace);
}
}
}
} else {
printf("Already set to no inheritable permissions.\n");
return EXIT_FAILED;
}
} else if (strcmp(type,"copy")==0) {
if ((old->type & SEC_DESC_DACL_PROTECTED) !=
SEC_DESC_DACL_PROTECTED) {
old->type=old->type | SEC_DESC_DACL_PROTECTED;
/*
* convert all inherited ACL's to non
* inherited ACL's.
*/
if (old->dacl) {
uint32_t i;
for (i=0;i<old->dacl->num_aces;i++) {
struct security_ace *ace=&old->dacl->aces[i];
/* Remove INHERITED FLAG from all aces */
ace->flags=ace->flags&(~SEC_ACE_FLAG_INHERITED_ACE);
}
}
} else {
printf("Already set to no inheritable permissions.\n");
return EXIT_FAILED;
}
}
/* Denied ACE entries must come before allowed ones */
sort_acl(old->dacl);
sd = make_sec_desc(talloc_tos(),old->revision, old->type,
old->owner_sid, old->group_sid,
NULL, old->dacl, &sd_size);
if (!set_secdesc(cli, filename, sd)) {
result = EXIT_FAILED;
}
return result;
}
/*****************************************************
Return a connection to a server.
*******************************************************/
static struct cli_state *connect_one(struct cli_credentials *creds,
const char *server, const char *share)
{
struct cli_state *c = NULL;
NTSTATUS nt_status;
uint32_t flags = 0;
nt_status = cli_full_connection_creds(&c, lp_netbios_name(), server,
NULL, 0,
share, "?????",
creds,
flags);
if (!NT_STATUS_IS_OK(nt_status)) {
DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status)));
return NULL;
}
return c;
}
/*
* Process resulting combination of mask & fname ensuring
* terminated with wildcard
*/
static char *build_dirname(TALLOC_CTX *ctx,
const char *mask, char *dir, char *fname)
{
char *mask2 = NULL;
char *p = NULL;
mask2 = talloc_strdup(ctx, mask);
if (!mask2) {
return NULL;
}
p = strrchr_m(mask2, DIRSEP_CHAR);
if (p) {
p[1] = 0;
} else {
mask2[0] = '\0';
}
mask2 = talloc_asprintf_append(mask2,
"%s\\*",
fname);
return mask2;
}
/*
* Returns a copy of the ACL flags in ace modified according
* to some inheritance rules.
* a) SEC_ACE_FLAG_INHERITED_ACE is propagated to children
* b) SEC_ACE_FLAG_INHERIT_ONLY is set on container children for OI (only)
* c) SEC_ACE_FLAG_OBJECT_INHERIT & SEC_ACE_FLAG_CONTAINER_INHERIT are
* stripped from flags to be propagated to non-container children
* d) SEC_ACE_FLAG_OBJECT_INHERIT & SEC_ACE_FLAG_CONTAINER_INHERIT are
* stripped from flags to be propagated if the NP flag
* SEC_ACE_FLAG_NO_PROPAGATE_INHERIT is present
*/
static uint8_t get_flags_to_propagate(bool is_container,
struct security_ace *ace)
{
uint8_t newflags = ace->flags;
/* OBJECT inheritance */
bool acl_objinherit = (ace->flags &
SEC_ACE_FLAG_OBJECT_INHERIT) == SEC_ACE_FLAG_OBJECT_INHERIT;
/* CONTAINER inheritance */
bool acl_cntrinherit = (ace->flags &
SEC_ACE_FLAG_CONTAINER_INHERIT) ==
SEC_ACE_FLAG_CONTAINER_INHERIT;
/* PROHIBIT inheritance */
bool prohibit_inheritance = ((ace->flags &
SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) ==
SEC_ACE_FLAG_NO_PROPAGATE_INHERIT);
/* Assume we are not propagating the ACE */
newflags &= ~SEC_ACE_FLAG_INHERITED_ACE;
/* all children need to have the SEC_ACE_FLAG_INHERITED_ACE set */
if (acl_cntrinherit || acl_objinherit) {
/*
* object inherit ( alone ) on a container needs
* SEC_ACE_FLAG_INHERIT_ONLY
*/
if (is_container) {
if (acl_objinherit && !acl_cntrinherit) {
newflags |= SEC_ACE_FLAG_INHERIT_ONLY;
}
/*
* this is tricky, the only time we would not
* propagate the ace for a container is if
* prohibit_inheritance is set and object inheritance
* alone is set
*/
if ((prohibit_inheritance
&& acl_objinherit
&& !acl_cntrinherit) == false) {
newflags |= SEC_ACE_FLAG_INHERITED_ACE;
}
} else {
/*
* don't apply object/container inheritance flags to
* non dirs
*/
newflags &= ~(SEC_ACE_FLAG_OBJECT_INHERIT
| SEC_ACE_FLAG_CONTAINER_INHERIT
| SEC_ACE_FLAG_INHERIT_ONLY);
/*
* only apply ace to file if object inherit
*/
if (acl_objinherit) {
newflags |= SEC_ACE_FLAG_INHERITED_ACE;
}
}
/* if NP is specified strip NP and all OI/CI INHERIT flags */
if (prohibit_inheritance) {
newflags &= ~(SEC_ACE_FLAG_OBJECT_INHERIT
| SEC_ACE_FLAG_CONTAINER_INHERIT
| SEC_ACE_FLAG_INHERIT_ONLY
| SEC_ACE_FLAG_NO_PROPAGATE_INHERIT);
}
}
return newflags;
}
/*
* This function builds a new acl for 'caclfile', first it removes any
* existing inheritable ace(s) from the current acl of caclfile, secondly it
* applies any inheritable acls of the parent of caclfile ( inheritable acls of
* caclfile's parent are passed via acl_to_add member of cbstate )
*
*/
static NTSTATUS propagate_inherited_aces(char *caclfile,
struct cacl_callback_state *cbstate)
{
TALLOC_CTX *aclctx = NULL;
NTSTATUS status;
int result;
int fileattr;
struct security_descriptor *old = NULL;
bool is_container = false;
struct security_acl *acl_to_add = cbstate->acl_to_add;
struct security_acl *acl_to_remove = NULL;
uint32_t i, j;
aclctx = talloc_new(NULL);
if (aclctx == NULL) {
return NT_STATUS_NO_MEMORY;
}
old = get_secdesc_with_ctx(aclctx, cbstate->cli, caclfile);
if (!old) {
status = NT_STATUS_UNSUCCESSFUL;
goto out;
}
/* inhibit propagation? */
if ((old->type & SEC_DESC_DACL_PROTECTED) ==
SEC_DESC_DACL_PROTECTED){
status = NT_STATUS_OK;
goto out;
}
fileattr = get_fileinfo(cbstate->cli, caclfile);
is_container = (fileattr & FILE_ATTRIBUTE_DIRECTORY);
/* find acl(s) that are inherited */
for (j = 0; old->dacl && j < old->dacl->num_aces; j++) {
if (old->dacl->aces[j].flags & SEC_ACE_FLAG_INHERITED_ACE) {
if (!add_ace_with_ctx(aclctx, &acl_to_remove,
&old->dacl->aces[j])) {
status = NT_STATUS_NO_MEMORY;
goto out;
}
}
}
/* remove any acl(s) that are inherited */
if (acl_to_remove) {
for (i = 0; i < acl_to_remove->num_aces; i++) {
struct security_ace ace = acl_to_remove->aces[i];
for (j = 0; old->dacl && j < old->dacl->num_aces; j++) {
if (security_ace_equal(&ace,
&old->dacl->aces[j])) {
uint32_t k;
for (k = j; k < old->dacl->num_aces-1;
k++) {
old->dacl->aces[k] =
old->dacl->aces[k+1];
}
old->dacl->num_aces--;
break;
}
}
}
}
/* propagate any inheritable ace to be added */
if (acl_to_add) {
for (i = 0; i < acl_to_add->num_aces; i++) {
struct security_ace ace = acl_to_add->aces[i];
bool is_objectinherit = (ace.flags &
SEC_ACE_FLAG_OBJECT_INHERIT) ==
SEC_ACE_FLAG_OBJECT_INHERIT;
bool is_inherited;
/* don't propagate flags to a file unless OI */
if (!is_objectinherit && !is_container) {
continue;
}
/*
* adjust flags according to inheritance
* rules
*/
ace.flags = get_flags_to_propagate(is_container, &ace);
is_inherited = (ace.flags &
SEC_ACE_FLAG_INHERITED_ACE) ==
SEC_ACE_FLAG_INHERITED_ACE;
/* don't propagate non inherited flags */
if (!is_inherited) {
continue;
}
if (!add_ace_with_ctx(aclctx, &old->dacl, &ace)) {
status = NT_STATUS_NO_MEMORY;
goto out;
}
}
}
result = cacl_set_from_sd(cbstate->cli, caclfile,
old,
SMB_ACL_SET, cbstate->numeric);
if (result != EXIT_OK) {
status = NT_STATUS_UNSUCCESSFUL;
goto out;
}
status = NT_STATUS_OK;
out:
TALLOC_FREE(aclctx);
return status;
}
/*
* Returns true if 'ace' contains SEC_ACE_FLAG_OBJECT_INHERIT or
* SEC_ACE_FLAG_CONTAINER_INHERIT
*/
static bool is_inheritable_ace(struct security_ace *ace)
{
uint8_t flags = ace->flags;
if (flags & (SEC_ACE_FLAG_OBJECT_INHERIT
| SEC_ACE_FLAG_CONTAINER_INHERIT)) {
return true;
}
return false;
}
/* This method does some basic sanity checking with respect to automatic
* inheritance. e.g. it checks if it is possible to do a set, it detects illegal
* attempts to set inherited permissions directly. Additionally this method
* does some basic initialisation for instance it parses the ACL passed on the
* command line.
*/
static NTSTATUS prepare_inheritance_propagation(TALLOC_CTX *ctx, char *filename,
struct cacl_callback_state *cbstate)
{
NTSTATUS result;
char *the_acl = cbstate->the_acl;
struct cli_state *cli = cbstate->cli;
enum acl_mode mode = cbstate->mode;
struct security_descriptor *sd = NULL;
struct security_descriptor *old = NULL;
uint32_t j;
bool propagate = false;
old = get_secdesc_with_ctx(ctx, cli, filename);
if (old == NULL) {
return NT_STATUS_NO_MEMORY;
}
/* parse acl passed on the command line */
if (sddl) {
cbstate->aclsd = sddl_decode(ctx, the_acl,
get_domain_sid(cli));
} else {
cbstate->aclsd = sec_desc_parse(ctx, cli, the_acl);
}
if (!cbstate->aclsd) {
result = NT_STATUS_UNSUCCESSFUL;
goto out;
}
sd = cbstate->aclsd;
/* set operation if inheritance is enabled doesn't make sense */
if (mode == SMB_ACL_SET && ((old->type & SEC_DESC_DACL_PROTECTED) !=
SEC_DESC_DACL_PROTECTED)){
d_printf("Inheritance enabled at %s, can't apply set operation\n",filename);
result = NT_STATUS_UNSUCCESSFUL;
goto out;
}
/*
* search command line acl for any illegal SEC_ACE_FLAG_INHERITED_ACE
* flags that are set
*/
for (j = 0; sd->dacl && j < sd->dacl->num_aces; j++) {
struct security_ace *ace = &sd->dacl->aces[j];
if (ace->flags & SEC_ACE_FLAG_INHERITED_ACE) {
d_printf("Illegal parameter %s\n", the_acl);
result = NT_STATUS_UNSUCCESSFUL;
goto out;
}
if (!propagate) {
if (is_inheritable_ace(ace)) {
propagate = true;
}
}
}
result = NT_STATUS_OK;
out:
cbstate->acl_no_propagate = !propagate;
return result;
}
/*
* This method builds inheritable ace(s) from filename (which should be
* a container) that need propagating to children in order to provide
* automatic inheritance. Those inheritable ace(s) are stored in
* acl_to_add member of cbstate for later processing
* (see propagate_inherited_aces)
*/
static NTSTATUS get_inheritable_aces(TALLOC_CTX *ctx, char *filename,
struct cacl_callback_state *cbstate)
{
NTSTATUS result;
struct cli_state *cli = NULL;
struct security_descriptor *sd = NULL;
struct security_acl *acl_to_add = NULL;
uint32_t j;
cli = cbstate->cli;
sd = get_secdesc_with_ctx(ctx, cli, filename);
if (sd == NULL) {
return NT_STATUS_NO_MEMORY;
}
/*
* Check if any inheritance related flags are used, if not then
* nothing to do. At the same time populate acls for inheritance
* related ace(s) that need to be added to or deleted from children as
* a result of inheritance propagation.
*/
for (j = 0; sd->dacl && j < sd->dacl->num_aces; j++) {
struct security_ace *ace = &sd->dacl->aces[j];
if (is_inheritable_ace(ace)) {
bool added = add_ace_with_ctx(ctx, &acl_to_add, ace);
if (!added) {
result = NT_STATUS_NO_MEMORY;
goto out;
}
}
}
cbstate->acl_to_add = acl_to_add;
result = NT_STATUS_OK;
out:
return result;
}
/*
* Callback handler to handle child elements processed by cli_list, we attempt
* to propagate inheritable ace(s) to each child via the function
* propagate_inherited_aces. Children that are themselves directories are passed
* to cli_list again ( to descend the directory structure )
*/
static NTSTATUS cacl_set_cb(struct file_info *f,
const char *mask, void *state)
{
struct cacl_callback_state *cbstate =
(struct cacl_callback_state *)state;
struct cli_state *cli = NULL;
struct cli_credentials *creds = NULL;
TALLOC_CTX *dirctx = NULL;
NTSTATUS status;
struct cli_state *targetcli = NULL;
char *dir = NULL;
char *dir_end = NULL;
char *mask2 = NULL;
char *targetpath = NULL;
char *caclfile = NULL;
dirctx = talloc_new(NULL);
if (!dirctx) {
status = NT_STATUS_NO_MEMORY;
goto out;
}
cli = cbstate->cli;
creds = cbstate->creds;
/* Work out the directory. */
dir = talloc_strdup(dirctx, mask);
if (!dir) {
status = NT_STATUS_NO_MEMORY;
goto out;
}
dir_end = strrchr(dir, DIRSEP_CHAR);
if (dir_end != NULL) {
*dir_end = '\0';
}
if (!f->name || !f->name[0]) {
d_printf("Empty dir name returned. Possible server misconfiguration.\n");
status = NT_STATUS_UNSUCCESSFUL;
goto out;
}
if (f->attr & FILE_ATTRIBUTE_DIRECTORY) {
struct cacl_callback_state dir_cbstate;
uint16_t attribute = FILE_ATTRIBUTE_DIRECTORY
| FILE_ATTRIBUTE_SYSTEM
| FILE_ATTRIBUTE_HIDDEN;
dir_end = NULL;
/* ignore special '.' & '..' */
if ((f->name == NULL) || ISDOT(f->name) || ISDOTDOT(f->name)) {
status = NT_STATUS_OK;
goto out;
}
mask2 = build_dirname(dirctx, mask, dir, f->name);
if (mask2 == NULL) {
status = NT_STATUS_NO_MEMORY;
goto out;
}
/* check for dfs */
status = cli_resolve_path(dirctx, "", creds, cli,
mask2, &targetcli, &targetpath);
if (!NT_STATUS_IS_OK(status)) {
goto out;
}
/*
* prepare path to caclfile, remove any existing wildcard
* chars and convert path separators.
*/
caclfile = talloc_strdup(dirctx, targetpath);
if (!caclfile) {
status = NT_STATUS_NO_MEMORY;
goto out;
}
dir_end = strrchr(caclfile, '*');
if (dir_end != NULL) {
*dir_end = '\0';
}
string_replace(caclfile, '/', '\\');
/*
* make directory specific copy of cbstate here
* (for this directory level) to be available as
* the parent cbstate for the children of this directory.
* Note: cbstate is overwritten for the current file being
* processed.
*/
dir_cbstate = *cbstate;
dir_cbstate.cli = targetcli;
/*
* propagate any inherited ace from our parent
*/
status = propagate_inherited_aces(caclfile, &dir_cbstate);
if (!NT_STATUS_IS_OK(status)) {
goto out;
}
/*
* get inheritable ace(s) for this dir/container
* that will be propagated to its children
*/
status = get_inheritable_aces(dirctx, caclfile,
&dir_cbstate);
if (!NT_STATUS_IS_OK(status)) {
goto out;
}
/*
* ensure cacl_set_cb gets called for children
* of this directory (targetpath)
*/
status = cli_list(targetcli, targetpath,
attribute, cacl_set_cb,
(void *)&dir_cbstate);
if (!NT_STATUS_IS_OK(status)) {
goto out;
}
} else {
/*
* build full path to caclfile and replace '/' with '\' so
* other utility functions can deal with it
*/
targetpath = talloc_asprintf(dirctx, "%s/%s", dir, f->name);
if (!targetpath) {
status = NT_STATUS_NO_MEMORY;
goto out;
}
string_replace(targetpath, '/', '\\');
/* attempt to propagate any inherited ace to file caclfile */
status = propagate_inherited_aces(targetpath, cbstate);
if (!NT_STATUS_IS_OK(status)) {
goto out;
}
}
status = NT_STATUS_OK;
out:
if (!NT_STATUS_IS_OK(status)) {
d_printf("error %s: processing %s\n",
nt_errstr(status),
targetpath);
}
TALLOC_FREE(dirctx);
return status;
}
/*
* Wrapper around cl_list to descend the directory tree pointed to by 'filename',
* helper callback function 'cacl_set_cb' handles the child elements processed
* by cli_list.
*/
static int inheritance_cacl_set(char *filename,
struct cacl_callback_state *cbstate)
{
int result;
NTSTATUS ntstatus;
int fileattr;
char *mask = NULL;
struct cli_state *cli = cbstate->cli;
TALLOC_CTX *ctx = NULL;
bool isdirectory = false;
uint16_t attribute = FILE_ATTRIBUTE_DIRECTORY | FILE_ATTRIBUTE_SYSTEM
| FILE_ATTRIBUTE_HIDDEN;
ctx = talloc_init("inherit_set");
if (ctx == NULL) {
d_printf("out of memory\n");
result = EXIT_FAILED;
goto out;
}
/* ensure we have a filename that starts with '\' */
if (!filename || *filename != DIRSEP_CHAR) {
/* illegal or no filename */
result = EXIT_FAILED;
d_printf("illegal or missing name '%s'\n", filename);
goto out;
}
fileattr = get_fileinfo(cli, filename);
isdirectory = (fileattr & FILE_ATTRIBUTE_DIRECTORY)
== FILE_ATTRIBUTE_DIRECTORY;
/*
* if we've got as far as here then we have already evaluated
* the args.
*/
if (test_args) {
result = EXIT_OK;
goto out;
}
mask = NULL;
/* make sure we have a trailing '\*' for directory */
if (!isdirectory) {
mask = talloc_strdup(ctx, filename);
} else if (strlen(filename) > 1) {
/*
* if the passed file name doesn't have a trailing '\'
* append it.
*/
char *name_end = strrchr(filename, DIRSEP_CHAR);
if (name_end != filename + strlen(filename) + 1) {
mask = talloc_asprintf(ctx, "%s\\*", filename);
} else {
mask = talloc_strdup(ctx, filename);
}
} else {
/* filename is a single '\', just append '*' */
mask = talloc_asprintf_append(mask, "%s*", filename);
}
if (!mask) {
result = EXIT_FAILED;
goto out;
}
/*
* prepare for automatic propagation of the acl passed on the
* cmdline.
*/
ntstatus = prepare_inheritance_propagation(ctx, filename,
cbstate);
if (!NT_STATUS_IS_OK(ntstatus)) {
d_printf("error: %s processing %s\n",
nt_errstr(ntstatus), filename);
result = EXIT_FAILED;
goto out;
}
result = cacl_set_from_sd(cli, filename, cbstate->aclsd,
cbstate->mode, cbstate->numeric);
/*
* strictly speaking it could be considered an error if a file was
* specified with '--propagate-inheritance'. However we really want
* to eventually get rid of '--propagate-inheritance' so we will be
* more forgiving here and instead just exit early.
*/
if (!isdirectory || (result != EXIT_OK)) {
goto out;
}
/* check if there is actually any need to propagate */
if (cbstate->acl_no_propagate) {
goto out;
}
/* get inheritable attributes this parent container (e.g. filename) */
ntstatus = get_inheritable_aces(ctx, filename, cbstate);
if (NT_STATUS_IS_OK(ntstatus)) {
/* process children */
ntstatus = cli_list(cli, mask, attribute,
cacl_set_cb,
(void *)cbstate);
}
if (!NT_STATUS_IS_OK(ntstatus)) {
d_printf("error: %s processing %s\n",
nt_errstr(ntstatus), filename);
result = EXIT_FAILED;
goto out;
}
out:
TALLOC_FREE(ctx);
return result;
}
struct diritem {
struct diritem *prev, *next;
/*
* dirname and targetpath below are sanitized,
* e.g.
* + start and end with '\'
* + have no trailing '*'
* + all '/' have been converted to '\'
*/
char *dirname;
char *targetpath;
struct cli_state *targetcli;
};
struct save_restore_stats
{
int success;
int failure;
};
struct dump_context {
struct diritem *list;
struct cli_credentials *creds;
struct cli_state *cli;
struct save_restore_stats *stats;
int save_fd;
struct diritem *dir;
NTSTATUS status;
};
static int write_dacl(struct dump_context *ctx,
struct cli_state *cli,
const char *filename,
const char *origfname)
{
struct security_descriptor *sd = NULL;
char *str = NULL;
const char *output_fmt = "%s\r\n%s\r\n";
const char *tmp = NULL;
char *out_str = NULL;
uint8_t *dest = NULL;
ssize_t s_len;
size_t d_len;
bool ok;
int result;
TALLOC_CTX *frame = talloc_stackframe();
if (test_args) {
return EXIT_OK;
}
if (ctx->save_fd < 0) {
DBG_ERR("error processing %s no file descriptor\n", filename);
result = EXIT_FAILED;
goto out;
}
sd = get_secdesc(cli, filename);
if (sd == NULL) {
result = EXIT_FAILED;
goto out;
}
sd->owner_sid = NULL;
sd->group_sid = NULL;
str = sddl_encode(frame, sd, get_domain_sid(cli));
if (str == NULL) {
DBG_ERR("error processing %s couldn't encode DACL\n", filename);
result = EXIT_FAILED;
goto out;
}
/*
* format of icacls save file is
* a line containing the path of the file/dir
* followed by a line containing the sddl format
* of the dacl.
* The format of the strings are null terminated
* 16-bit Unicode. Each line is terminated by "\r\n"
*/
tmp = origfname;
/* skip leading '\' */
if (tmp[0] == '\\') {
tmp++;
}
out_str = talloc_asprintf(frame, output_fmt, tmp, str);
if (out_str == NULL) {
result = EXIT_FAILED;
goto out;
}
s_len = strlen(out_str);
ok = convert_string_talloc(out_str,
CH_UNIX,
CH_UTF16,
out_str,
s_len, (void **)(void *)&dest, &d_len);
if (!ok) {
DBG_ERR("error processing %s out of memory\n", tmp);
result = EXIT_FAILED;
goto out;
}
if (write(ctx->save_fd, dest, d_len) != d_len) {
DBG_ERR("error processing %s failed to write to file.\n", tmp);
result = EXIT_FAILED;
goto out;
}
fsync(ctx->save_fd);
result = EXIT_OK;
ctx->stats->success += 1;
fprintf(stdout, "Successfully processed file: %s\n", tmp);
out:
TALLOC_FREE(frame);
if (result != EXIT_OK) {
ctx->stats->failure += 1;
}
return result;
}
/*
* Sanitize directory name.
* Given a directory name 'dir' ensure it;
* o starts with '\'
* o ends with '\'
* o doesn't end with trailing '*'
* o ensure all '/' are converted to '\'
*/
static char *sanitize_dirname(TALLOC_CTX *ctx,
const char *dir)
{
char *mask = NULL;
char *name_end = NULL;
mask = talloc_strdup(ctx, dir);
name_end = strrchr(mask, '*');
if (name_end) {
*name_end = '\0';
}
name_end = strrchr(mask, DIRSEP_CHAR);
if (strlen(mask) > 0 && name_end != mask + (strlen(mask) - 1)) {
mask = talloc_asprintf(ctx, "%s\\", mask);
}
string_replace(mask, '/', '\\');
return mask;
}
/*
* Process each entry (child) of a directory.
* Each entry, regardless of whether it is itself a file or directory
* has it's dacl written to the restore/save file.
* Each directory is saved to context->list (for further processing)
* write_dacl will update the stats (success/fail)
*/
static NTSTATUS cacl_dump_dacl_cb(struct file_info *f,
const char *mask, void *state)
{
struct dump_context *ctx = talloc_get_type_abort(state,
struct dump_context);
NTSTATUS status;
char *mask2 = NULL;
char *targetpath = NULL;
char *unresolved = NULL;
/*
* if we have already encountered an error
* bail out
*/
if (!NT_STATUS_IS_OK(ctx->status)) {
return ctx->status;
}
if (!f->name || !f->name[0]) {
DBG_ERR("Empty dir name returned. Possible server "
"misconfiguration.\n");
status = NT_STATUS_UNSUCCESSFUL;
goto out;
}
mask2 = sanitize_dirname(ctx, mask);
if (!mask2) {
status = NT_STATUS_NO_MEMORY;
goto out;
}
if (f->attr & FILE_ATTRIBUTE_DIRECTORY) {
struct diritem *item = NULL;
/* ignore special '.' & '..' */
if ((f->name == NULL) || ISDOT(f->name) || ISDOTDOT(f->name)) {
status = NT_STATUS_OK;
goto out;
}
/* Work out the directory. */
unresolved = sanitize_dirname(ctx, ctx->dir->dirname);
if (!unresolved) {
status = NT_STATUS_NO_MEMORY;
goto out;
}
unresolved = talloc_asprintf(ctx, "%s%s", unresolved, f->name);
if (unresolved == NULL) {
status = NT_STATUS_NO_MEMORY;
goto out;
}
item = talloc_zero(ctx, struct diritem);
if (item == NULL) {
status = NT_STATUS_NO_MEMORY;
goto out;
}
item->dirname = unresolved;
mask2 = talloc_asprintf(ctx, "%s%s", mask2, f->name);
if (!mask2) {
status = NT_STATUS_NO_MEMORY;
goto out;
}
status = cli_resolve_path(ctx, "", ctx->creds, ctx->cli,
mask2, &item->targetcli, &targetpath);
if (!NT_STATUS_IS_OK(status)) {
DBG_ERR("error failed to resolve: %s\n",
nt_errstr(status));
goto out;
}
item->targetpath = sanitize_dirname(ctx, targetpath);
if (!item->targetpath) {
status = NT_STATUS_NO_MEMORY;
goto out;
}
if (write_dacl(ctx,
item->targetcli,
item->targetpath, unresolved) != EXIT_OK) {
status = NT_STATUS_UNSUCCESSFUL;
/*
* cli_list happily ignores error encountered
* when processing the callback so we need
* to save any error status encountered while
* processing directories (so we can stop recursing
* those as soon as possible).
* Changing the current behaviour of the callback
* handling by cli_list would be I think be too
* risky.
*/
ctx->status = status;
goto out;
}
DLIST_ADD_END(ctx->list, item);
} else {
unresolved = sanitize_dirname(ctx, ctx->dir->dirname);
if (!unresolved) {
status = NT_STATUS_NO_MEMORY;
goto out;
}
unresolved = talloc_asprintf(ctx, "%s%s", unresolved, f->name);
if (!unresolved) {
status = NT_STATUS_NO_MEMORY;
goto out;
}
/*
* build full path to the file and replace '/' with '\' so
* other utility functions can deal with it
*/
targetpath = talloc_asprintf(ctx, "%s%s", mask2, f->name);
if (!targetpath) {
status = NT_STATUS_NO_MEMORY;
goto out;
}
if (write_dacl(ctx,
ctx->dir->targetcli,
targetpath, unresolved) != EXIT_OK) {
status = NT_STATUS_UNSUCCESSFUL;
/*
* cli_list happily ignores error encountered
* when processing the callback so we need
* to save any error status encountered while
* processing directories (so we can stop recursing
* those as soon as possible).
* Changing the current behaviour of the callback
* handling by cli_list would be I think be too
* risky.
*/
ctx->status = status;
goto out;
}
}
status = NT_STATUS_OK;
out:
if (!NT_STATUS_IS_OK(status)) {
DBG_ERR("error %s: processing %s\n",
nt_errstr(status), targetpath);
}
return status;
}
/*
* dump_ctx contains a list of directories to be processed
* + each directory 'dir' is scanned by cli_list, the cli_list
* callback 'cacl_dump_dacl_cb' writes out the dacl of each
* child of 'dir' (regardless of whether it is a dir or file)
* to the restore/save file. Additionally any directories encountered
* are returned in the passed in dump_ctx->list member
* + the directory list returned from cli_list is passed and processed
* by recursively calling dump_dacl_dirtree
*
*/
static int dump_dacl_dirtree(struct dump_context *dump_ctx)
{
struct diritem *item = NULL;
struct dump_context *new_dump_ctx = NULL;
int result;
for (item = dump_ctx->list; item; item = item->next) {
uint16_t attribute = FILE_ATTRIBUTE_DIRECTORY
| FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN;
NTSTATUS status;
char *mask = NULL;
new_dump_ctx = talloc_zero(dump_ctx, struct dump_context);
if (new_dump_ctx == NULL) {
DBG_ERR("out of memory\n");
result = EXIT_FAILED;
goto out;
}
if (item->targetcli == NULL) {
status = cli_resolve_path(new_dump_ctx,
"",
dump_ctx->creds,
dump_ctx->cli,
item->dirname,
&item->targetcli,
&item->targetpath);
if (!NT_STATUS_IS_OK(status)) {
DBG_ERR("failed to resolve path %s "
"error: %s\n",
item->dirname, nt_errstr(status));
result = EXIT_FAILED;
goto out;
}
}
new_dump_ctx->creds = dump_ctx->creds;
new_dump_ctx->save_fd = dump_ctx->save_fd;
new_dump_ctx->stats = dump_ctx->stats;
new_dump_ctx->dir = item;
new_dump_ctx->cli = item->targetcli;
mask = talloc_asprintf(new_dump_ctx, "%s*",
new_dump_ctx->dir->targetpath);
status = cli_list(new_dump_ctx->dir->targetcli,
mask,
attribute, cacl_dump_dacl_cb, new_dump_ctx);
if (!NT_STATUS_IS_OK(status) ||
!NT_STATUS_IS_OK(new_dump_ctx->status)) {
NTSTATUS tmpstatus;
if (!NT_STATUS_IS_OK(status)) {
/*
* cli_list failed for some reason
* so we need to update the failure stat
*/
new_dump_ctx->stats->failure += 1;
tmpstatus = status;
} else {
/* cacl_dump_dacl_cb should have updated stat */
tmpstatus = new_dump_ctx->status;
}
DBG_ERR("error %s: processing %s\n",
nt_errstr(tmpstatus), item->dirname);
result = EXIT_FAILED;
goto out;
}
result = dump_dacl_dirtree(new_dump_ctx);
if (result != EXIT_OK) {
goto out;
}
}
result = EXIT_OK;
out:
TALLOC_FREE(new_dump_ctx);
return result;
}
static int cacl_dump_dacl(struct cli_state *cli,
struct cli_credentials *creds,
char *filename)
{
int fileattr;
char *mask = NULL;
TALLOC_CTX *ctx = NULL;
bool isdirectory = false;
int result;
struct dump_context *dump_ctx = NULL;
struct save_restore_stats stats = {0};
struct diritem *item = NULL;
struct cli_state *targetcli = NULL;
char *targetpath = NULL;
NTSTATUS status;
ctx = talloc_init("cacl_dump");
if (ctx == NULL) {
DBG_ERR("out of memory\n");
result = EXIT_FAILED;
goto out;
}
dump_ctx = talloc_zero(ctx, struct dump_context);
if (dump_ctx == NULL) {
DBG_ERR("out of memory\n");
result = EXIT_FAILED;
goto out;
}
dump_ctx->save_fd = open(save_file,
O_CREAT | O_RDWR | O_TRUNC, S_IRUSR | S_IWUSR);
if (dump_ctx->save_fd < 0) {
result = EXIT_FAILED;
goto out;
}
dump_ctx->creds = creds;
dump_ctx->cli = cli;
dump_ctx->stats = &stats;
/* ensure we have a filename that starts with '\' */
if (!filename || *filename != DIRSEP_CHAR) {
/* illegal or no filename */
result = EXIT_FAILED;
DBG_ERR("illegal or missing name '%s'\n", filename);
goto out;
}
status = cli_resolve_path(dump_ctx, "",
dump_ctx->creds,
dump_ctx->cli,
filename, &targetcli, &targetpath);
if (!NT_STATUS_IS_OK(status)) {
DBG_ERR("failed resolve %s\n", filename);
result = EXIT_FAILED;
goto out;
}
fileattr = get_fileinfo(targetcli, targetpath);
isdirectory = (fileattr & FILE_ATTRIBUTE_DIRECTORY)
== FILE_ATTRIBUTE_DIRECTORY;
/*
* if we've got as far as here then we have already evaluated
* the args.
*/
if (test_args) {
result = EXIT_OK;
goto out;
}
mask = NULL;
/* make sure we have a trailing '\*' for directory */
if (!isdirectory) {
mask = talloc_strdup(ctx, filename);
} else if (strlen(filename) > 1) {
mask = sanitize_dirname(ctx, filename);
} else {
/* filename is a single '\' */
mask = talloc_strdup(ctx, filename);
}
if (!mask) {
result = EXIT_FAILED;
goto out;
}
write_dacl(dump_ctx, targetcli, targetpath, filename);
if (isdirectory && recurse) {
item = talloc_zero(dump_ctx, struct diritem);
if (!item) {
result = EXIT_FAILED;
goto out;
}
item->dirname = mask;
DLIST_ADD_END(dump_ctx->list, item);
dump_dacl_dirtree(dump_ctx);
}
fprintf(stdout, "Successfully processed %d files: "
"Failed processing %d files\n",
dump_ctx->stats->success, dump_ctx->stats->failure);
result = EXIT_OK;
out:
if (dump_ctx && dump_ctx->save_fd) {
close(dump_ctx->save_fd);
}
TALLOC_FREE(ctx);
return result;
}
struct restore_dacl {
const char *path;
struct security_descriptor *sd;
};
/*
* Restore dacls from 'savefile' produced by
* 'icacls name /save' or 'smbcacls --save'
*/
static int cacl_restore(struct cli_state *cli,
struct cli_credentials *creds,
bool numeric, const char *restorefile)
{
int restore_fd;
int result;
struct save_restore_stats stats = { 0 };
char **lines = NULL;
char *content = NULL;
char *convert_content = NULL;
size_t content_size;
struct restore_dacl *entries = NULL;
int numlines, i = 0;
bool ok;
struct dom_sid *sid = NULL;
if (restorefile == NULL) {
DBG_ERR("No restore file specified\n");
result = EXIT_FAILED;
goto out;
}
if (test_args) {
result = EXIT_OK;
goto out;
}
restore_fd = open(restorefile, O_RDONLY, S_IRUSR | S_IWUSR);
if (restore_fd < 0) {
DBG_ERR("Failed to open %s.\n", restorefile);
result = EXIT_FAILED;
goto out;
}
content = fd_load(restore_fd, &content_size, 0, talloc_tos());
close(restore_fd);
if (content == NULL) {
DBG_ERR("Failed to load content from %s.\n", restorefile);
result = EXIT_FAILED;
goto out;
}
ok = convert_string_talloc(talloc_tos(),
CH_UTF16,
CH_UNIX,
content,
utf16_len_n(content, content_size),
(void **)(void *)&convert_content,
&content_size);
TALLOC_FREE(content);
if (!ok) {
DBG_ERR("Failed to convert content from %s "
"to CH_UNIX.\n", restorefile);
result = EXIT_FAILED;
goto out;
}
lines = file_lines_parse(convert_content,
content_size, &numlines, talloc_tos());
if (lines == NULL) {
DBG_ERR("Failed to parse lines from content of %s.",
restorefile);
result = EXIT_FAILED;
goto out;
}
entries = talloc_zero_array(lines, struct restore_dacl, numlines / 2);
if (entries == NULL) {
DBG_ERR("error processing %s, out of memory\n", restorefile);
result = EXIT_FAILED;
goto out;
}
sid = get_domain_sid(cli);
while (i < numlines) {
int index = i / 2;
int first_line = (i % 2) == 0;
if (first_line) {
char *tmp = NULL;
tmp = lines[i];
/* line can be blank if root of share */
if (strlen(tmp) == 0) {
entries[index].path = talloc_strdup(lines,
"\\");
} else {
entries[index].path = lines[i];
}
} else {
entries[index].sd = sddl_decode(lines, lines[i], sid);
entries[index].sd->type |=
SEC_DESC_DACL_AUTO_INHERIT_REQ;
entries[index].sd->type |= SEC_DESC_SACL_AUTO_INHERITED;
}
i++;
}
for (i = 0; i < (numlines / 2); i++) {
int mode = SMB_ACL_SET;
int set_result;
struct cli_state *targetcli = NULL;
char *targetpath = NULL;
NTSTATUS status;
/* check for dfs */
status = cli_resolve_path(talloc_tos(),
"",
creds,
cli,
entries[i].path,
&targetcli, &targetpath);
if (!NT_STATUS_IS_OK(status)) {
printf("Error failed to process file: %s\n",
entries[i].path);
stats.failure += 1;
continue;
}
set_result = cacl_set_from_sd(targetcli,
targetpath,
entries[i].sd, mode, numeric);
if (set_result == EXIT_OK) {
printf("Successfully processed file: %s\n",
entries[i].path);
stats.success += 1;
} else {
printf("Error failed to process file: %s\n",
entries[i].path);
stats.failure += 1;
}
}
result = EXIT_OK;
out:
TALLOC_FREE(lines);
fprintf(stdout, "Successfully processed %d files: "
"Failed processing %d files\n", stats.success, stats.failure);
return result;
}
/****************************************************************************
main program
****************************************************************************/
int main(int argc, char *argv[])
{
const char **argv_const = discard_const_p(const char *, argv);
char *share;
int opt;
enum acl_mode mode = SMB_ACL_SET;
static char *the_acl = NULL;
enum chown_mode change_mode = REQUEST_NONE;
int result;
char *path;
char *filename = NULL;
poptContext pc;
/* numeric is set when the user wants numeric SIDs and ACEs rather
than going via LSA calls to resolve them */
int numeric = 0;
struct cli_state *targetcli = NULL;
struct cli_credentials *creds = NULL;
char *targetfile = NULL;
NTSTATUS status;
bool ok;
struct loadparm_context *lp_ctx = NULL;
struct poptOption long_options[] = {
POPT_AUTOHELP
{
.longName = "delete",
.shortName = 'D',
.argInfo = POPT_ARG_STRING,
.arg = NULL,
.val = 'D',
.descrip = "Delete an acl",
.argDescrip = "ACL",
},
{
.longName = "modify",
.shortName = 'M',
.argInfo = POPT_ARG_STRING,
.arg = NULL,
.val = 'M',
.descrip = "Modify an acl",
.argDescrip = "ACL",
},
{
.longName = "add",
.shortName = 'a',
.argInfo = POPT_ARG_STRING,
.arg = NULL,
.val = 'a',
.descrip = "Add an acl",
.argDescrip = "ACL",
},
{
.longName = "set",
.shortName = 'S',
.argInfo = POPT_ARG_STRING,
.arg = NULL,
.val = 'S',
.descrip = "Set acls",
.argDescrip = "ACLS",
},
{
.longName = "chown",
.shortName = 'C',
.argInfo = POPT_ARG_STRING,
.arg = NULL,
.val = 'C',
.descrip = "Change ownership of a file",
.argDescrip = "USERNAME",
},
{
.longName = "chgrp",
.shortName = 'G',
.argInfo = POPT_ARG_STRING,
.arg = NULL,
.val = 'G',
.descrip = "Change group ownership of a file",
.argDescrip = "GROUPNAME",
},
{
.longName = "inherit",
.shortName = 'I',
.argInfo = POPT_ARG_STRING,
.arg = NULL,
.val = 'I',
.descrip = "Inherit allow|remove|copy",
},
{
.longName = "propagate-inheritance",
.shortName = 0,
.argInfo = POPT_ARG_NONE,
.arg = &inheritance,
.val = 1,
.descrip = "Supports propagation of inheritable ACE(s) when used in conjunction with add, delete, set or modify",
},
{
.longName = "save",
.shortName = 0,
.argInfo = POPT_ARG_STRING,
.arg = &save_file,
.val = 1,
.descrip = "stores the DACLs in sddl format of the "
"specified file or folder for later use "
"with restore. SACLS, owner or integrity"
" labels are not stored",
},
{
.longName = "restore",
.shortName = 0,
.argInfo = POPT_ARG_STRING,
.arg = &restore_file,
.val = 1,
.descrip = "applies the stored DACLS to files in "
"directory.",
},
{
.longName = "recurse",
.shortName = 0,
.argInfo = POPT_ARG_NONE,
.arg = &recurse,
.val = 1,
.descrip = "indicates the operation is performed "
"on directory and all files/directories"
" below. (only applies to save option)",
},
{
.longName = "numeric",
.shortName = 0,
.argInfo = POPT_ARG_NONE,
.arg = &numeric,
.val = 1,
.descrip = "Don't resolve sids or masks to names",
},
{
.longName = "sddl",
.shortName = 0,
.argInfo = POPT_ARG_NONE,
.arg = &sddl,
.val = 1,
.descrip = "Output and input acls in sddl format",
},
{
.longName = "query-security-info",
.shortName = 0,
.argInfo = POPT_ARG_INT,
.arg = &query_sec_info,
.val = 1,
.descrip = "The security-info flags for queries"
},
{
.longName = "set-security-info",
.shortName = 0,
.argInfo = POPT_ARG_INT,
.arg = &set_sec_info,
.val = 1,
.descrip = "The security-info flags for modifications"
},
{
.longName = "test-args",
.shortName = 't',
.argInfo = POPT_ARG_NONE,
.arg = &test_args,
.val = 1,
.descrip = "Test arguments"
},
{
.longName = "domain-sid",
.shortName = 0,
.argInfo = POPT_ARG_STRING,
.arg = &domain_sid,
.val = 0,
.descrip = "Domain SID for sddl",
.argDescrip = "SID"},
{
.longName = "maximum-access",
.shortName = 'x',
.argInfo = POPT_ARG_NONE,
.arg = NULL,
.val = 'x',
.descrip = "Query maximum permissions",
},
POPT_COMMON_SAMBA
POPT_COMMON_CONNECTION
POPT_COMMON_CREDENTIALS
POPT_LEGACY_S3
POPT_COMMON_VERSION
POPT_TABLEEND
};
struct cli_state *cli;
TALLOC_CTX *frame = talloc_stackframe();
const char *owner_username = "";
char *server;
smb_init_locale();
ok = samba_cmdline_init(frame,
SAMBA_CMDLINE_CONFIG_CLIENT,
false /* require_smbconf */);
if (!ok) {
DBG_ERR("Failed to init cmdline parser!\n");
TALLOC_FREE(frame);
exit(1);
}
lp_ctx = samba_cmdline_get_lp_ctx();
/* set default debug level to 1 regardless of what smb.conf sets */
lpcfg_set_cmdline(lp_ctx, "log level", "1");
setlinebuf(stdout);
pc = samba_popt_get_context(getprogname(),
argc,
argv_const,
long_options,
0);
if (pc == NULL) {
DBG_ERR("Failed to setup popt context!\n");
TALLOC_FREE(frame);
exit(1);
}
poptSetOtherOptionHelp(pc, "//server1/share1 filename\nACLs look like: "
"'ACL:user:[ALLOWED|DENIED]/flags/permissions'");
while ((opt = poptGetNextOpt(pc)) != -1) {
switch (opt) {
case 'S':
the_acl = smb_xstrdup(poptGetOptArg(pc));
mode = SMB_ACL_SET;
break;
case 'D':
the_acl = smb_xstrdup(poptGetOptArg(pc));
mode = SMB_ACL_DELETE;
break;
case 'M':
the_acl = smb_xstrdup(poptGetOptArg(pc));
mode = SMB_ACL_MODIFY;
break;
case 'a':
the_acl = smb_xstrdup(poptGetOptArg(pc));
mode = SMB_ACL_ADD;
break;
case 'C':
owner_username = poptGetOptArg(pc);
change_mode = REQUEST_CHOWN;
break;
case 'G':
owner_username = poptGetOptArg(pc);
change_mode = REQUEST_CHGRP;
break;
case 'I':
owner_username = poptGetOptArg(pc);
change_mode = REQUEST_INHERIT;
break;
case 'm':
lpcfg_set_cmdline(lp_ctx, "client max protocol", poptGetOptArg(pc));
break;
case 'x':
want_mxac = true;
break;
case POPT_ERROR_BADOPT:
fprintf(stderr, "\nInvalid option %s: %s\n\n",
poptBadOption(pc, 0), poptStrerror(opt));
poptPrintUsage(pc, stderr, 0);
exit(1);
}
}
if (inheritance && !the_acl) {
poptPrintUsage(pc, stderr, 0);
return -1;
}
if(!poptPeekArg(pc)) {
poptPrintUsage(pc, stderr, 0);
return -1;
}
path = talloc_strdup(frame, poptGetArg(pc));
if (!path) {
return -1;
}
if (strncmp(path, "\\\\", 2) && strncmp(path, "//", 2)) {
printf("Invalid argument: %s\n", path);
return -1;
}
if(!poptPeekArg(pc)) {
poptPrintUsage(pc, stderr, 0);
return -1;
}
filename = talloc_strdup(frame, poptGetArg(pc));
if (!filename) {
return -1;
}
poptFreeContext(pc);
samba_cmdline_burn(argc, argv);
string_replace(path,'/','\\');
server = talloc_strdup(frame, path+2);
if (!server) {
return -1;
}
share = strchr_m(server,'\\');
if (share == NULL) {
printf("Invalid argument\n");
return -1;
}
*share = 0;
share++;
creds = samba_cmdline_get_creds();
/* Make connection to server */
if (!test_args) {
cli = connect_one(creds, server, share);
if (!cli) {
exit(EXIT_FAILED);
}
} else {
exit(0);
}
string_replace(filename, '/', '\\');
if (filename[0] != '\\') {
filename = talloc_asprintf(frame,
"\\%s",
filename);
if (!filename) {
return -1;
}
}
status = cli_resolve_path(frame,
"",
creds,
cli,
filename,
&targetcli,
&targetfile);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(0,("cli_resolve_path failed for %s! (%s)\n", filename, nt_errstr(status)));
return -1;
}
/* Perform requested action */
if (change_mode == REQUEST_INHERIT) {
result = inherit(targetcli, targetfile, owner_username);
} else if (change_mode != REQUEST_NONE) {
result = owner_set(targetcli, change_mode, targetfile, owner_username);
} else if (the_acl) {
if (inheritance) {
struct cacl_callback_state cbstate = {
.creds = creds,
.cli = targetcli,
.mode = mode,
.the_acl = the_acl,
.numeric = numeric,
};
result = inheritance_cacl_set(targetfile, &cbstate);
} else {
result = cacl_set(targetcli,
targetfile,
the_acl,
mode,
numeric);
}
} else {
if (save_file || restore_file) {
sddl = 1;
if (save_file) {
result = cacl_dump_dacl(cli, creds, filename);
} else {
result = cacl_restore(targetcli,
creds,
numeric, restore_file);
}
} else {
result = cacl_dump(targetcli, targetfile, numeric);
}
}
gfree_all();
TALLOC_FREE(frame);
return result;
}