2 * Unix SMB/Netbios implementation.
3 * Utility for managing share permissions
5 * Copyright (C) Tim Potter 2000
6 * Copyright (C) Jeremy Allison 2000
7 * Copyright (C) Jelmer Vernooij 2003
8 * Copyright (C) Gerald (Jerry) Carter 2005.
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 3 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, see <http://www.gnu.org/licenses/>.
27 #include "lib/cmdline/cmdline.h"
28 #include "../libcli/security/security.h"
29 #include "passdb/machine_sid.h"
31 #include "cmdline_contexts.h"
32 #include "lib/util/string_wrappers.h"
33 #include "lib/param/param.h"
35 static TALLOC_CTX *ctx;
37 enum acl_mode { SMB_ACL_DELETE,
47 /********************************************************************
48 ********************************************************************/
50 static struct security_descriptor* parse_acl_string(TALLOC_CTX *mem_ctx, const char *szACL, size_t *sd_size )
52 struct security_descriptor *sd = NULL;
53 struct security_ace *ace;
54 struct security_acl *theacl;
63 num_ace = count_chars( pacl, ',' ) + 1;
65 if ( !(ace = talloc_zero_array( mem_ctx, struct security_ace, num_ace )) )
68 for ( i=0; i<num_ace; i++ ) {
69 char *end_acl = strchr_m( pacl, ',' );
72 strncpy( acl_string, pacl, MIN( PTR_DIFF( end_acl, pacl ), sizeof(fstring)-1) );
73 acl_string[MIN( PTR_DIFF( end_acl, pacl ), sizeof(fstring)-1)] = '\0';
75 if ( !parse_ace(NULL, &ace[i], acl_string ) )
82 if ( !(theacl = make_sec_acl( mem_ctx, NT4_ACL_REVISION, num_ace, ace )) )
85 sd = make_sec_desc( mem_ctx, SD_REVISION, SEC_DESC_SELF_RELATIVE,
86 NULL, NULL, NULL, theacl, sd_size);
91 /* add an ACE to a list of ACEs in a struct security_acl */
92 static bool add_ace(TALLOC_CTX *mem_ctx, struct security_acl **the_acl, struct security_ace *ace)
94 struct security_acl *acl = *the_acl;
97 acl = make_sec_acl(mem_ctx, 3, 1, ace);
103 if (acl->num_aces == UINT32_MAX) {
107 acl, struct security_ace, *ace, &acl->aces, &acl->num_aces);
112 /* The MSDN is contradictory over the ordering of ACE entries in an ACL.
113 However NT4 gives a "The information may have been modified by a
114 computer running Windows NT 5.0" if denied ACEs do not appear before
117 static int ace_compare(struct security_ace *ace1, struct security_ace *ace2)
119 if (security_ace_equal(ace1, ace2))
122 if (ace1->type != ace2->type)
123 return NUMERIC_CMP(ace2->type, ace1->type);
125 if (dom_sid_compare(&ace1->trustee, &ace2->trustee))
126 return dom_sid_compare(&ace1->trustee, &ace2->trustee);
128 if (ace1->flags != ace2->flags)
129 return NUMERIC_CMP(ace1->flags, ace2->flags);
131 if (ace1->access_mask != ace2->access_mask)
132 return NUMERIC_CMP(ace1->access_mask, ace2->access_mask);
134 if (ace1->size != ace2->size)
135 return NUMERIC_CMP(ace1->size, ace2->size);
137 return memcmp(ace1, ace2, sizeof(struct security_ace));
140 static void sort_acl(struct security_acl *the_acl)
143 if (!the_acl) return;
145 TYPESAFE_QSORT(the_acl->aces, the_acl->num_aces, ace_compare);
147 for (i=1;i<the_acl->num_aces;) {
148 if (security_ace_equal(&the_acl->aces[i-1],
149 &the_acl->aces[i])) {
151 the_acl->aces, i, the_acl->num_aces);
160 static int change_share_sec(TALLOC_CTX *mem_ctx, const char *sharename, char *the_acl, enum acl_mode mode)
162 struct security_descriptor *sd = NULL;
163 struct security_descriptor *old = NULL;
168 if (mode != SMB_ACL_SET && mode != SMB_SD_DELETE) {
169 if (!(old = get_share_security( mem_ctx, sharename, &sd_size )) ) {
170 fprintf(stderr, "Unable to retrieve permissions for share "
171 "[%s]\n", sharename);
176 if ( (mode != SMB_ACL_VIEW && mode != SMB_SD_DELETE) &&
177 !(sd = parse_acl_string(mem_ctx, the_acl, &sd_size )) ) {
178 fprintf( stderr, "Failed to parse acl\n");
183 case SMB_ACL_VIEW_ALL:
184 /* should not happen */
187 sec_desc_print(NULL, stdout, old, false);
190 for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
193 for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
194 if (security_ace_equal(&sd->dacl->aces[i],
195 &old->dacl->aces[j])) {
197 for (k=j; k<old->dacl->num_aces-1;k++) {
198 old->dacl->aces[k] = old->dacl->aces[k+1];
200 old->dacl->num_aces--;
207 printf("ACL for ACE:");
208 print_ace(NULL, stdout, &sd->dacl->aces[i], false);
209 printf(" not found\n");
214 for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
217 for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
218 if (dom_sid_equal(&sd->dacl->aces[i].trustee,
219 &old->dacl->aces[j].trustee)) {
220 old->dacl->aces[j] = sd->dacl->aces[i];
226 struct dom_sid_buf buf;
227 printf("ACL for SID %s not found\n",
228 dom_sid_str_buf(&sd->dacl->aces[i].trustee, &buf));
233 old->owner_sid = sd->owner_sid;
237 old->group_sid = sd->group_sid;
241 for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
242 add_ace(mem_ctx, &old->dacl, &sd->dacl->aces[i]);
249 status = delete_share_security(sharename);
250 if (!NT_STATUS_IS_OK(status)) {
251 fprintf( stderr, "Failed to delete security descriptor for "
252 "share [%s]\n", sharename );
257 fprintf(stderr, "invalid command\n");
261 /* Denied ACE entries must come before allowed ones */
264 status = set_share_security(sharename, old);
265 if (!NT_STATUS_IS_OK(status)) {
266 fprintf( stderr, "Failed to store acl for share [%s]\n", sharename );
272 static int set_sharesec_sddl(const char *sharename, const char *sddl)
274 struct security_descriptor *sd;
277 sd = sddl_decode(talloc_tos(), sddl, get_global_sam_sid());
279 fprintf(stderr, "Failed to parse acl\n");
283 status = set_share_security(sharename, sd);
285 if (!NT_STATUS_IS_OK(status)) {
286 fprintf(stderr, "Failed to store acl for share [%s]\n",
294 static int view_sharesec_sddl(const char *sharename)
296 struct security_descriptor *sd;
300 sd = get_share_security(talloc_tos(), sharename, &sd_size);
302 fprintf(stderr, "Unable to retrieve permissions for share "
303 "[%s]\n", sharename);
307 acl = sddl_encode(talloc_tos(), sd, get_global_sam_sid());
310 fprintf(stderr, "Unable to sddl-encode permissions for share "
311 "[%s]\n", sharename);
319 /********************************************************************
321 ********************************************************************/
328 int main(int argc, const char *argv[])
332 enum acl_mode mode = SMB_ACL_SET;
333 static char *the_acl = NULL;
335 bool force_acl = False;
338 bool initialize_sid = False;
340 struct loadparm_context *lp_ctx = NULL;
341 struct poptOption long_options[] = {
344 .longName = "remove",
346 .argInfo = POPT_ARG_STRING,
349 .descrip = "Remove ACEs",
353 .longName = "modify",
355 .argInfo = POPT_ARG_STRING,
358 .descrip = "Modify existing ACEs",
364 .argInfo = POPT_ARG_STRING,
367 .descrip = "Add ACEs",
371 .longName = "replace",
373 .argInfo = POPT_ARG_STRING,
376 .descrip = "Overwrite share permission ACL",
377 .argDescrip = "ACLS",
380 .longName = "delete",
382 .argInfo = POPT_ARG_NONE,
385 .descrip = "Delete the entire security descriptor",
388 .longName = "setsddl",
390 .argInfo = POPT_ARG_STRING,
393 .descrip = "Set the SD in sddl format",
396 .longName = "viewsddl",
397 .argInfo = POPT_ARG_NONE,
399 .val = OPT_VIEW_SDDL,
400 .descrip = "View the SD in sddl format",
405 .argInfo = POPT_ARG_NONE,
408 .descrip = "View current share permissions",
411 .longName = "view-all",
413 .argInfo = POPT_ARG_NONE,
416 .descrip = "View all current share permissions",
419 .longName = "machine-sid",
421 .argInfo = POPT_ARG_NONE,
424 .descrip = "Initialize the machine SID",
429 .argInfo = POPT_ARG_NONE,
432 .descrip = "Force storing the ACL",
433 .argDescrip = "ACLS",
440 if ( !(ctx = talloc_stackframe()) ) {
441 fprintf( stderr, "Failed to initialize talloc context!\n");
447 ok = samba_cmdline_init(ctx,
448 SAMBA_CMDLINE_CONFIG_NONE,
449 false /* require_smbconf */);
451 DBG_ERR("Failed to init cmdline parser!\n");
455 lp_ctx = samba_cmdline_get_lp_ctx();
456 /* set default debug level to 1 regardless of what smb.conf sets */
457 lpcfg_set_cmdline(lp_ctx, "log level", "1");
459 pc = samba_popt_get_context(getprogname(),
465 DBG_ERR("Failed to setup popt context!\n");
470 poptSetOtherOptionHelp(pc, "sharename\n");
472 while ((opt = poptGetNextOpt(pc)) != -1) {
475 the_acl = smb_xstrdup(poptGetOptArg(pc));
476 mode = SMB_ACL_DELETE;
480 the_acl = smb_xstrdup(poptGetOptArg(pc));
481 mode = SMB_ACL_MODIFY;
485 the_acl = smb_xstrdup(poptGetOptArg(pc));
490 the_acl = smb_xstrdup(poptGetOptArg(pc));
495 mode = SMB_SD_DELETE;
499 mode = SMB_SD_SETSDDL;
500 the_acl = smb_xstrdup(poptGetOptArg(pc));
504 mode = SMB_SD_VIEWSDDL;
516 initialize_sid = True;
519 mode = SMB_ACL_VIEW_ALL;
521 case POPT_ERROR_BADOPT:
522 fprintf(stderr, "\nInvalid option %s: %s\n\n",
523 poptBadOption(pc, 0), poptStrerror(opt));
524 poptPrintUsage(pc, stderr, 0);
531 lp_load_with_registry_shares(get_dyn_CONFIGFILE());
533 /* check for initializing secrets.tdb first */
535 if ( initialize_sid ) {
536 struct dom_sid *sid = get_global_sam_sid();
537 struct dom_sid_buf buf;
540 fprintf( stderr, "Failed to retrieve Machine SID!\n");
545 printf ("%s\n", dom_sid_str_buf(sid, &buf) );
550 if ( mode == SMB_ACL_VIEW && force_acl ) {
551 fprintf( stderr, "Invalid combination of -F and -v\n");
556 if (mode == SMB_ACL_VIEW_ALL) {
559 for (i=0; i<lp_numservices(); i++) {
560 TALLOC_CTX *frame = talloc_stackframe();
561 const struct loadparm_substitution *lp_sub =
562 loadparm_s3_global_substitution();
563 const char *service = lp_servicename(frame, lp_sub, i);
565 if (service == NULL) {
569 printf("[%s]\n", service);
570 change_share_sec(frame, service, NULL, SMB_ACL_VIEW);
577 /* get the sharename */
579 if(!poptPeekArg(pc)) {
580 poptPrintUsage(pc, stderr, 0);
585 fstrcpy(sharename, poptGetArg(pc));
587 snum = lp_servicenumber( sharename );
589 if ( snum == -1 && !force_acl ) {
590 fprintf( stderr, "Invalid sharename: %s\n", sharename);
597 retval = set_sharesec_sddl(sharename, the_acl);
599 case SMB_SD_VIEWSDDL:
600 retval = view_sharesec_sddl(sharename);
603 retval = change_share_sec(ctx, sharename, the_acl, mode);