s3:smbcacls: add switch "--sddl" to output acls as sddl encoded strings

[amitay/samba.git] / source3 / utils / smbcacls.c

diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c
index c12778f8c71f820c1badf1af1828bb771e76739d..122e641a016039ad10d5d89f98d3ca74f574a1be 100644 (file)
--- a/source3/utils/smbcacls.c
+++ b/source3/utils/smbcacls.c
@@ -23,6 +23,8 @@
 
 #include "includes.h"
 
+extern bool AllowDebugChange;
+
 static int test_args;
 
 #define CREATE_ACCESS_READ READ_CONTROL_ACCESS
@@ -31,6 +33,8 @@ static int test_args;
    than going via LSA calls to resolve them */
 static int numeric;
 
+static int sddl;
+
 enum acl_mode {SMB_ACL_SET, SMB_ACL_DELETE, SMB_ACL_MODIFY, SMB_ACL_ADD };
 enum chown_mode {REQUEST_NONE, REQUEST_CHOWN, REQUEST_CHGRP};
 enum exit_values {EXIT_OK, EXIT_FAILED, EXIT_PARSE_ERROR};
@@ -68,7 +72,7 @@ static NTSTATUS cli_lsa_lookup_sid(struct cli_state *cli,
                                   char **domain, char **name)
 {
        uint16 orig_cnum = cli->cnum;
-       struct rpc_pipe_client *p;
+       struct rpc_pipe_client *p = NULL;
        struct policy_handle handle;
        NTSTATUS status;
        TALLOC_CTX *frame = talloc_stackframe();
@@ -660,15 +664,14 @@ dump the acls for a file
 static int cacl_dump(struct cli_state *cli, char *filename)
 {
        int result = EXIT_FAILED;
-       int fnum = -1;
+       uint16_t fnum = (uint16_t)-1;
        SEC_DESC *sd;
 
        if (test_args) 
                return EXIT_OK;
 
-       fnum = cli_nt_create(cli, filename, CREATE_ACCESS_READ);
-
-       if (fnum == -1) {
+       if (!NT_STATUS_IS_OK(cli_ntcreate(cli, filename, 0, CREATE_ACCESS_READ, 0,
+                               FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN, 0x0, 0x0, &fnum))) {
                printf("Failed to open %s: %s\n", filename, cli_errstr(cli));
                goto done;
        }
@@ -680,12 +683,17 @@ static int cacl_dump(struct cli_state *cli, char *filename)
                goto done;
        }
 
-       sec_desc_print(cli, stdout, sd);
+       if (sddl) {
+               printf("%s\n", sddl_encode(talloc_tos(), sd,
+                                          get_global_sam_sid()));
+       } else {
+               sec_desc_print(cli, stdout, sd);
+       }
 
        result = EXIT_OK;
 
 done:
-       if (fnum != -1)
+       if (fnum != (uint16_t)-1)
                cli_close(cli, fnum);
 
        return result;
@@ -699,14 +707,13 @@ because the NT docs say this can't be done :-). JRA.
 static int owner_set(struct cli_state *cli, enum chown_mode change_mode, 
                        const char *filename, const char *new_username)
 {
-       int fnum;
+       uint16_t fnum;
        DOM_SID sid;
        SEC_DESC *sd, *old;
        size_t sd_size;
 
-       fnum = cli_nt_create(cli, filename, CREATE_ACCESS_READ);
-
-       if (fnum == -1) {
+       if (!NT_STATUS_IS_OK(cli_ntcreate(cli, filename, 0, CREATE_ACCESS_READ, 0,
+                               FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN, 0x0, 0x0, &fnum))) {
                printf("Failed to open %s: %s\n", filename, cli_errstr(cli));
                return EXIT_FAILED;
        }
@@ -728,9 +735,8 @@ static int owner_set(struct cli_state *cli, enum chown_mode change_mode,
                                (change_mode == REQUEST_CHGRP) ? &sid : NULL,
                           NULL, NULL, &sd_size);
 
-       fnum = cli_nt_create(cli, filename, WRITE_OWNER_ACCESS);
-
-       if (fnum == -1) {
+       if (!NT_STATUS_IS_OK(cli_ntcreate(cli, filename, 0, WRITE_OWNER_ACCESS, 0,
+                       FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN, 0x0, 0x0, &fnum))) {
                printf("Failed to open %s: %s\n", filename, cli_errstr(cli));
                return EXIT_FAILED;
        }
@@ -793,7 +799,7 @@ static void sort_acl(SEC_ACL *the_acl)
        uint32 i;
        if (!the_acl) return;
 
-       qsort(the_acl->aces, the_acl->num_aces, sizeof(the_acl->aces[0]), QSORT_CAST ace_compare);
+       TYPESAFE_QSORT(the_acl->aces, the_acl->num_aces, ace_compare);
 
        for (i=1;i<the_acl->num_aces;) {
                if (sec_ace_equal(&the_acl->aces[i-1], &the_acl->aces[i])) {
@@ -815,7 +821,7 @@ set the ACLs on a file given an ascii description
 static int cacl_set(struct cli_state *cli, char *filename, 
                    char *the_acl, enum acl_mode mode)
 {
-       int fnum;
+       uint16_t fnum;
        SEC_DESC *sd, *old;
        uint32 i, j;
        size_t sd_size;
@@ -829,9 +835,8 @@ static int cacl_set(struct cli_state *cli, char *filename,
        /* The desired access below is the only one I could find that works
           with NT4, W2KP and Samba */
 
-       fnum = cli_nt_create(cli, filename, CREATE_ACCESS_READ);
-
-       if (fnum == -1) {
+       if (!NT_STATUS_IS_OK(cli_ntcreate(cli, filename, 0, CREATE_ACCESS_READ, 0,
+                               FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN, 0x0, 0x0, &fnum))) {
                printf("cacl_set failed to open %s: %s\n", filename, cli_errstr(cli));
                return EXIT_FAILED;
        }
@@ -930,9 +935,8 @@ static int cacl_set(struct cli_state *cli, char *filename,
                           old->owner_sid, old->group_sid,
                           NULL, old->dacl, &sd_size);
 
-       fnum = cli_nt_create(cli, filename, WRITE_DAC_ACCESS|WRITE_OWNER_ACCESS);
-
-       if (fnum == -1) {
+       if (!NT_STATUS_IS_OK(cli_ntcreate(cli, filename, 0, WRITE_DAC_ACCESS|WRITE_OWNER_ACCESS, 0,
+                       FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN, 0x0, 0x0, &fnum))) {
                printf("cacl_set failed to open %s: %s\n", filename, cli_errstr(cli));
                return EXIT_FAILED;
        }
@@ -973,12 +977,7 @@ static struct cli_state *connect_one(struct user_auth_info *auth_info,
                return NULL;
        }
 
-       if (!get_cmdline_auth_info_got_pass(auth_info)) {
-               char *pass = getpass("Password: ");
-               if (pass) {
-                       set_cmdline_auth_info_password(auth_info, pass);
-               }
-       }
+       set_cmdline_auth_info_getpass(auth_info);
 
        nt_status = cli_full_connection(&c, global_myname(), server, 
                                &ss, 0,
@@ -1032,6 +1031,7 @@ static struct cli_state *connect_one(struct user_auth_info *auth_info,
                { "chown", 'C', POPT_ARG_STRING, NULL, 'C', "Change ownership of a file", "USERNAME" },
                { "chgrp", 'G', POPT_ARG_STRING, NULL, 'G', "Change group ownership of a file", "GROUPNAME" },
                { "numeric", 0, POPT_ARG_NONE, &numeric, 1, "Don't resolve sids or masks to names" },
+               { "sddl", 0, POPT_ARG_NONE, &sddl, 1, "Output acls in sddl format" },
                { "test-args", 't', POPT_ARG_NONE, &test_args, 1, "Test arguments"},
                POPT_COMMON_SAMBA
                POPT_COMMON_CONNECTION
@@ -1053,6 +1053,7 @@ static struct cli_state *connect_one(struct user_auth_info *auth_info,
        DEBUGLEVEL_CLASS[DBGC_ALL] = 1;
        dbf = x_stderr;
        x_setbuf( x_stderr, NULL );
+       AllowDebugChange = false;
 
        setlinebuf(stdout);