Copyright (C) Tim Potter 2000
Copyright (C) Jeremy Allison 2000
Copyright (C) Jelmer Vernooij 2003
+ Copyright (C) Noel Power <noel.power@suse.com> 2013
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
*/
#include "includes.h"
-#include "popt_common.h"
+#include "lib/cmdline/cmdline.h"
#include "rpc_client/cli_pipe.h"
#include "../librpc/gen_ndr/ndr_lsa.h"
#include "rpc_client/cli_lsarpc.h"
#include "libsmb/clirap.h"
#include "passdb/machine_sid.h"
#include "../librpc/gen_ndr/ndr_lsa_c.h"
+#include "util_sd.h"
+#include "lib/param/param.h"
+#include "lib/util/util_file.h"
-static int test_args;
-
-#define CREATE_ACCESS_READ READ_CONTROL_ACCESS
-
-/* numeric is set when the user wants numeric SIDs and ACEs rather
- than going via LSA calls to resolve them */
-static int numeric;
+static char DIRSEP_CHAR = '\\';
+static int inheritance = 0;
+static const char *save_file = NULL;
+static const char *restore_file = NULL;
+static int recurse;
+static int test_args;
static int sddl;
static int query_sec_info = -1;
static int set_sec_info = -1;
+static bool want_mxac;
static const char *domain_sid = NULL;
enum chown_mode {REQUEST_NONE, REQUEST_CHOWN, REQUEST_CHGRP, REQUEST_INHERIT};
enum exit_values {EXIT_OK, EXIT_FAILED, EXIT_PARSE_ERROR};
-struct perm_value {
- const char *perm;
- uint32 mask;
-};
-
-/* These values discovered by inspection */
-
-static const struct perm_value special_values[] = {
- { "R", 0x00120089 },
- { "W", 0x00120116 },
- { "X", 0x001200a0 },
- { "D", 0x00010000 },
- { "P", 0x00040000 },
- { "O", 0x00080000 },
- { NULL, 0 },
-};
-
-static const struct perm_value standard_values[] = {
- { "READ", 0x001200a9 },
- { "CHANGE", 0x001301bf },
- { "FULL", 0x001f01ff },
- { NULL, 0 },
+struct cacl_callback_state {
+ struct cli_credentials *creds;
+ struct cli_state *cli;
+ struct security_descriptor *aclsd;
+ struct security_acl *acl_to_add;
+ enum acl_mode mode;
+ char *the_acl;
+ bool acl_no_propagate;
+ bool numeric;
};
-/* Open cli connection and policy handle */
-
-static NTSTATUS cli_lsa_lookup_sid(struct cli_state *cli,
- const struct dom_sid *sid,
- TALLOC_CTX *mem_ctx,
- enum lsa_SidType *type,
- char **domain, char **name)
-{
- uint16 orig_cnum = cli_state_get_tid(cli);
- struct rpc_pipe_client *p = NULL;
- struct policy_handle handle;
- NTSTATUS status;
- TALLOC_CTX *frame = talloc_stackframe();
- enum lsa_SidType *types;
- char **domains;
- char **names;
-
- status = cli_tree_connect(cli, "IPC$", "?????", "", 0);
- if (!NT_STATUS_IS_OK(status)) {
- goto tcon_fail;
- }
-
- status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
- &p);
- if (!NT_STATUS_IS_OK(status)) {
- goto fail;
- }
-
- status = rpccli_lsa_open_policy(p, talloc_tos(), True,
- GENERIC_EXECUTE_ACCESS, &handle);
- if (!NT_STATUS_IS_OK(status)) {
- goto fail;
- }
-
- status = rpccli_lsa_lookup_sids(p, talloc_tos(), &handle, 1, sid,
- &domains, &names, &types);
- if (!NT_STATUS_IS_OK(status)) {
- goto fail;
- }
-
- *type = types[0];
- *domain = talloc_move(mem_ctx, &domains[0]);
- *name = talloc_move(mem_ctx, &names[0]);
-
- status = NT_STATUS_OK;
- fail:
- TALLOC_FREE(p);
- cli_tdis(cli);
- tcon_fail:
- cli_state_set_tid(cli, orig_cnum);
- TALLOC_FREE(frame);
- return status;
-}
-
-static NTSTATUS cli_lsa_lookup_name(struct cli_state *cli,
- const char *name,
- enum lsa_SidType *type,
- struct dom_sid *sid)
-{
- uint16 orig_cnum = cli_state_get_tid(cli);
- struct rpc_pipe_client *p;
- struct policy_handle handle;
- NTSTATUS status;
- TALLOC_CTX *frame = talloc_stackframe();
- struct dom_sid *sids;
- enum lsa_SidType *types;
-
- status = cli_tree_connect(cli, "IPC$", "?????", "", 0);
- if (!NT_STATUS_IS_OK(status)) {
- goto tcon_fail;
- }
-
- status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
- &p);
- if (!NT_STATUS_IS_OK(status)) {
- goto fail;
- }
-
- status = rpccli_lsa_open_policy(p, talloc_tos(), True,
- GENERIC_EXECUTE_ACCESS, &handle);
- if (!NT_STATUS_IS_OK(status)) {
- goto fail;
- }
-
- status = rpccli_lsa_lookup_names(p, talloc_tos(), &handle, 1, &name,
- NULL, 1, &sids, &types);
- if (!NT_STATUS_IS_OK(status)) {
- goto fail;
- }
-
- *type = types[0];
- *sid = sids[0];
-
- status = NT_STATUS_OK;
- fail:
- TALLOC_FREE(p);
- cli_tdis(cli);
- tcon_fail:
- cli_state_set_tid(cli, orig_cnum);
- TALLOC_FREE(frame);
- return status;
-}
-
-
static NTSTATUS cli_lsa_lookup_domain_sid(struct cli_state *cli,
struct dom_sid *sid)
{
union lsa_PolicyInformation *info = NULL;
- uint16 orig_cnum = cli_state_get_tid(cli);
+ struct smbXcli_tcon *orig_tcon = NULL;
+ char *orig_share = NULL;
struct rpc_pipe_client *rpc_pipe = NULL;
struct policy_handle handle;
NTSTATUS status, result;
TALLOC_CTX *frame = talloc_stackframe();
- const struct ndr_syntax_id *lsarpc_syntax = &ndr_table_lsarpc.syntax_id;
- status = cli_tree_connect(cli, "IPC$", "?????", "", 0);
+ if (cli_state_has_tcon(cli)) {
+ cli_state_save_tcon_share(cli, &orig_tcon, &orig_share);
+ }
+
+ status = cli_tree_connect(cli, "IPC$", "?????", NULL);
if (!NT_STATUS_IS_OK(status)) {
goto done;
}
- status = cli_rpc_pipe_open_noauth(cli, lsarpc_syntax, &rpc_pipe);
+ status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc, &rpc_pipe);
if (!NT_STATUS_IS_OK(status)) {
goto tdis;
}
TALLOC_FREE(rpc_pipe);
cli_tdis(cli);
done:
- cli_state_set_tid(cli, orig_cnum);
+ cli_state_restore_tcon_share(cli, orig_tcon, orig_share);
TALLOC_FREE(frame);
return status;
}
static struct dom_sid *get_domain_sid(struct cli_state *cli)
{
NTSTATUS status;
+ struct dom_sid_buf buf;
struct dom_sid *sid = talloc(talloc_tos(), struct dom_sid);
if (sid == NULL) {
}
- DEBUG(2,("Domain SID: %s\n", sid_string_dbg(sid)));
+ DEBUG(2,("Domain SID: %s\n", dom_sid_str_buf(sid, &buf)));
return sid;
}
+/* add an ACE to a list of ACEs in a struct security_acl */
+static bool add_ace_with_ctx(TALLOC_CTX *ctx, struct security_acl **the_acl,
+ const struct security_ace *ace)
-/* convert a SID to a string, either numeric or username/group */
-static void SidToString(struct cli_state *cli, fstring str, const struct dom_sid *sid)
-{
- char *domain = NULL;
- char *name = NULL;
- enum lsa_SidType type;
- NTSTATUS status;
-
- sid_to_fstring(str, sid);
-
- if (numeric) {
- return;
- }
-
- status = cli_lsa_lookup_sid(cli, sid, talloc_tos(), &type,
- &domain, &name);
-
- if (!NT_STATUS_IS_OK(status)) {
- return;
- }
-
- if (*domain) {
- slprintf(str, sizeof(fstring) - 1, "%s%s%s",
- domain, lp_winbind_separator(), name);
- } else {
- fstrcpy(str, name);
- }
-}
-
-/* convert a string to a SID, either numeric or username/group */
-static bool StringToSid(struct cli_state *cli, struct dom_sid *sid, const char *str)
-{
- enum lsa_SidType type;
-
- if (string_to_sid(sid, str)) {
- return true;
- }
-
- return NT_STATUS_IS_OK(cli_lsa_lookup_name(cli, str, &type, sid));
-}
-
-static void print_ace_flags(FILE *f, uint8_t flags)
-{
- char *str = talloc_strdup(NULL, "");
-
- if (!str) {
- goto out;
- }
-
- if (flags & SEC_ACE_FLAG_OBJECT_INHERIT) {
- str = talloc_asprintf(str, "%s%s",
- str, "OI|");
- if (!str) {
- goto out;
- }
- }
- if (flags & SEC_ACE_FLAG_CONTAINER_INHERIT) {
- str = talloc_asprintf(str, "%s%s",
- str, "CI|");
- if (!str) {
- goto out;
- }
- }
- if (flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
- str = talloc_asprintf(str, "%s%s",
- str, "NP|");
- if (!str) {
- goto out;
- }
- }
- if (flags & SEC_ACE_FLAG_INHERIT_ONLY) {
- str = talloc_asprintf(str, "%s%s",
- str, "IO|");
- if (!str) {
- goto out;
- }
- }
- if (flags & SEC_ACE_FLAG_INHERITED_ACE) {
- str = talloc_asprintf(str, "%s%s",
- str, "I|");
- if (!str) {
- goto out;
- }
- }
- /* Ignore define SEC_ACE_FLAG_SUCCESSFUL_ACCESS ( 0x40 )
- and SEC_ACE_FLAG_FAILED_ACCESS ( 0x80 ) as they're
- audit ace flags. */
-
- if (str[strlen(str)-1] == '|') {
- str[strlen(str)-1] = '\0';
- fprintf(f, "/%s/", str);
- } else {
- fprintf(f, "/0x%x/", flags);
- }
- TALLOC_FREE(str);
- return;
-
- out:
- fprintf(f, "/0x%x/", flags);
-}
-
-/* print an ACE on a FILE, using either numeric or ascii representation */
-static void print_ace(struct cli_state *cli, FILE *f, struct security_ace *ace)
-{
- const struct perm_value *v;
- fstring sidstr;
- int do_print = 0;
- uint32 got_mask;
-
- SidToString(cli, sidstr, &ace->trustee);
-
- fprintf(f, "%s:", sidstr);
-
- if (numeric) {
- fprintf(f, "%d/0x%x/0x%08x",
- ace->type, ace->flags, ace->access_mask);
- return;
- }
-
- /* Ace type */
-
- if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED) {
- fprintf(f, "ALLOWED");
- } else if (ace->type == SEC_ACE_TYPE_ACCESS_DENIED) {
- fprintf(f, "DENIED");
- } else {
- fprintf(f, "%d", ace->type);
- }
-
- print_ace_flags(f, ace->flags);
-
- /* Standard permissions */
-
- for (v = standard_values; v->perm; v++) {
- if (ace->access_mask == v->mask) {
- fprintf(f, "%s", v->perm);
- return;
- }
- }
-
- /* Special permissions. Print out a hex value if we have
- leftover bits in the mask. */
-
- got_mask = ace->access_mask;
-
- again:
- for (v = special_values; v->perm; v++) {
- if ((ace->access_mask & v->mask) == v->mask) {
- if (do_print) {
- fprintf(f, "%s", v->perm);
- }
- got_mask &= ~v->mask;
- }
- }
-
- if (!do_print) {
- if (got_mask != 0) {
- fprintf(f, "0x%08x", ace->access_mask);
- } else {
- do_print = 1;
- goto again;
- }
- }
-}
-
-static bool parse_ace_flags(const char *str, unsigned int *pflags)
{
- const char *p = str;
- *pflags = 0;
-
- while (*p) {
- if (strnequal(p, "OI", 2)) {
- *pflags |= SEC_ACE_FLAG_OBJECT_INHERIT;
- p += 2;
- } else if (strnequal(p, "CI", 2)) {
- *pflags |= SEC_ACE_FLAG_CONTAINER_INHERIT;
- p += 2;
- } else if (strnequal(p, "NP", 2)) {
- *pflags |= SEC_ACE_FLAG_NO_PROPAGATE_INHERIT;
- p += 2;
- } else if (strnequal(p, "IO", 2)) {
- *pflags |= SEC_ACE_FLAG_INHERIT_ONLY;
- p += 2;
- } else if (*p == 'I') {
- *pflags |= SEC_ACE_FLAG_INHERITED_ACE;
- p += 1;
- } else if (*p) {
- return false;
- }
+ struct security_acl *acl = *the_acl;
- switch (*p) {
- case '|':
- p++;
- case '\0':
- continue;
- default:
+ if (acl == NULL) {
+ acl = make_sec_acl(ctx, 3, 0, NULL);
+ if (acl == NULL) {
return false;
}
}
- return true;
-}
-
-/* parse an ACE in the same format as print_ace() */
-static bool parse_ace(struct cli_state *cli, struct security_ace *ace,
- const char *orig_str)
-{
- char *p;
- const char *cp;
- char *tok;
- unsigned int atype = 0;
- unsigned int aflags = 0;
- unsigned int amask = 0;
- struct dom_sid sid;
- uint32_t mask;
- const struct perm_value *v;
- char *str = SMB_STRDUP(orig_str);
- TALLOC_CTX *frame = talloc_stackframe();
-
- if (!str) {
- TALLOC_FREE(frame);
- return False;
- }
-
- ZERO_STRUCTP(ace);
- p = strchr_m(str,':');
- if (!p) {
- printf("ACE '%s': missing ':'.\n", orig_str);
- SAFE_FREE(str);
- TALLOC_FREE(frame);
- return False;
- }
- *p = '\0';
- p++;
- /* Try to parse numeric form */
-
- if (sscanf(p, "%i/%i/%i", &atype, &aflags, &amask) == 3 &&
- StringToSid(cli, &sid, str)) {
- goto done;
- }
-
- /* Try to parse text form */
-
- if (!StringToSid(cli, &sid, str)) {
- printf("ACE '%s': failed to convert '%s' to SID\n",
- orig_str, str);
- SAFE_FREE(str);
- TALLOC_FREE(frame);
- return False;
- }
-
- cp = p;
- if (!next_token_talloc(frame, &cp, &tok, "/")) {
- printf("ACE '%s': failed to find '/' character.\n",
- orig_str);
- SAFE_FREE(str);
- TALLOC_FREE(frame);
- return False;
- }
-
- if (strncmp(tok, "ALLOWED", strlen("ALLOWED")) == 0) {
- atype = SEC_ACE_TYPE_ACCESS_ALLOWED;
- } else if (strncmp(tok, "DENIED", strlen("DENIED")) == 0) {
- atype = SEC_ACE_TYPE_ACCESS_DENIED;
- } else {
- printf("ACE '%s': missing 'ALLOWED' or 'DENIED' entry at '%s'\n",
- orig_str, tok);
- SAFE_FREE(str);
- TALLOC_FREE(frame);
- return False;
- }
-
- /* Only numeric form accepted for flags at present */
-
- if (!next_token_talloc(frame, &cp, &tok, "/")) {
- printf("ACE '%s': bad flags entry at '%s'\n",
- orig_str, tok);
- SAFE_FREE(str);
- TALLOC_FREE(frame);
- return False;
- }
-
- if (tok[0] < '0' || tok[0] > '9') {
- if (!parse_ace_flags(tok, &aflags)) {
- printf("ACE '%s': bad named flags entry at '%s'\n",
- orig_str, tok);
- SAFE_FREE(str);
- TALLOC_FREE(frame);
- return False;
- }
- } else if (strnequal(tok, "0x", 2)) {
- if (!sscanf(tok, "%x", &aflags)) {
- printf("ACE '%s': bad hex flags entry at '%s'\n",
- orig_str, tok);
- SAFE_FREE(str);
- TALLOC_FREE(frame);
- return False;
- }
- } else {
- if (!sscanf(tok, "%i", &aflags)) {
- printf("ACE '%s': bad integer flags entry at '%s'\n",
- orig_str, tok);
- SAFE_FREE(str);
- TALLOC_FREE(frame);
- return False;
- }
- }
-
- if (!next_token_talloc(frame, &cp, &tok, "/")) {
- printf("ACE '%s': missing / at '%s'\n",
- orig_str, tok);
- SAFE_FREE(str);
- TALLOC_FREE(frame);
- return False;
- }
-
- if (strncmp(tok, "0x", 2) == 0) {
- if (sscanf(tok, "%i", &amask) != 1) {
- printf("ACE '%s': bad hex number at '%s'\n",
- orig_str, tok);
- SAFE_FREE(str);
- TALLOC_FREE(frame);
- return False;
- }
- goto done;
- }
-
- for (v = standard_values; v->perm; v++) {
- if (strcmp(tok, v->perm) == 0) {
- amask = v->mask;
- goto done;
- }
- }
-
- p = tok;
-
- while(*p) {
- bool found = False;
-
- for (v = special_values; v->perm; v++) {
- if (v->perm[0] == *p) {
- amask |= v->mask;
- found = True;
- }
- }
-
- if (!found) {
- printf("ACE '%s': bad permission value at '%s'\n",
- orig_str, p);
- SAFE_FREE(str);
- TALLOC_FREE(frame);
- return False;
- }
- p++;
- }
- if (*p) {
- TALLOC_FREE(frame);
- SAFE_FREE(str);
- return False;
+ if (acl->num_aces == UINT32_MAX) {
+ return false;
}
-
- done:
- mask = amask;
- init_sec_ace(ace, &sid, atype, mask, aflags);
- TALLOC_FREE(frame);
- SAFE_FREE(str);
+ ADD_TO_ARRAY(
+ acl, struct security_ace, *ace, &acl->aces, &acl->num_aces);
+ *the_acl = acl;
return True;
}
-/* add an ACE to a list of ACEs in a struct security_acl */
static bool add_ace(struct security_acl **the_acl, struct security_ace *ace)
{
- struct security_acl *new_ace;
- struct security_ace *aces;
- if (! *the_acl) {
- return (((*the_acl) = make_sec_acl(talloc_tos(), 3, 1, ace))
- != NULL);
- }
-
- if (!(aces = SMB_CALLOC_ARRAY(struct security_ace, 1+(*the_acl)->num_aces))) {
- return False;
- }
- memcpy(aces, (*the_acl)->aces, (*the_acl)->num_aces * sizeof(struct
- security_ace));
- memcpy(aces+(*the_acl)->num_aces, ace, sizeof(struct security_ace));
- new_ace = make_sec_acl(talloc_tos(),(*the_acl)->revision,1+(*the_acl)->num_aces, aces);
- SAFE_FREE(aces);
- (*the_acl) = new_ace;
- return True;
+ return add_ace_with_ctx(talloc_tos(), the_acl, ace);
}
/* parse a ascii version of a security descriptor */
char *tok;
struct security_descriptor *ret = NULL;
size_t sd_size;
- struct dom_sid *grp_sid=NULL, *owner_sid=NULL;
+ struct dom_sid owner_sid = { .num_auths = 0 };
+ bool have_owner = false;
+ struct dom_sid group_sid = { .num_auths = 0 };
+ bool have_group = false;
struct security_acl *dacl=NULL;
int revision=1;
}
if (strncmp(tok,"OWNER:", 6) == 0) {
- if (owner_sid) {
+ if (have_owner) {
printf("Only specify owner once\n");
goto done;
}
- owner_sid = SMB_CALLOC_ARRAY(struct dom_sid, 1);
- if (!owner_sid ||
- !StringToSid(cli, owner_sid, tok+6)) {
+ if (!StringToSid(cli, &owner_sid, tok+6)) {
printf("Failed to parse owner sid\n");
goto done;
}
+ have_owner = true;
continue;
}
if (strncmp(tok,"GROUP:", 6) == 0) {
- if (grp_sid) {
+ if (have_group) {
printf("Only specify group once\n");
goto done;
}
- grp_sid = SMB_CALLOC_ARRAY(struct dom_sid, 1);
- if (!grp_sid ||
- !StringToSid(cli, grp_sid, tok+6)) {
+ if (!StringToSid(cli, &group_sid, tok+6)) {
printf("Failed to parse group sid\n");
goto done;
}
+ have_group = true;
continue;
}
goto done;
}
- ret = make_sec_desc(ctx,revision, SEC_DESC_SELF_RELATIVE, owner_sid, grp_sid,
- NULL, dacl, &sd_size);
-
- done:
- SAFE_FREE(grp_sid);
- SAFE_FREE(owner_sid);
+ ret = make_sec_desc(
+ ctx,
+ revision,
+ SEC_DESC_SELF_RELATIVE,
+ have_owner ? &owner_sid : NULL,
+ have_group ? &group_sid : NULL,
+ NULL,
+ dacl,
+ &sd_size);
+done:
return ret;
}
-static const struct {
- uint16_t mask;
- const char *str;
- const char *desc;
-} sec_desc_ctrl_bits[] = {
- {SEC_DESC_OWNER_DEFAULTED, "OD", "Owner Defaulted"},
- {SEC_DESC_GROUP_DEFAULTED, "GD", "Group Defaulted"},
- {SEC_DESC_DACL_PRESENT, "DP", "DACL Present"},
- {SEC_DESC_DACL_DEFAULTED, "DD", "DACL Defaulted"},
- {SEC_DESC_SACL_PRESENT, "SP", "SACL Present"},
- {SEC_DESC_SACL_DEFAULTED, "SD", "SACL Defaulted"},
- {SEC_DESC_DACL_TRUSTED, "DT", "DACL Trusted"},
- {SEC_DESC_SERVER_SECURITY, "SS", "Server Security"},
- {SEC_DESC_DACL_AUTO_INHERIT_REQ, "DR", "DACL Inheritance Required"},
- {SEC_DESC_SACL_AUTO_INHERIT_REQ, "SR", "SACL Inheritance Required"},
- {SEC_DESC_DACL_AUTO_INHERITED, "DI", "DACL Auto Inherited"},
- {SEC_DESC_SACL_AUTO_INHERITED, "SI", "SACL Auto Inherited"},
- {SEC_DESC_DACL_PROTECTED, "PD", "DACL Protected"},
- {SEC_DESC_SACL_PROTECTED, "PS", "SACL Protected"},
- {SEC_DESC_RM_CONTROL_VALID, "RM", "RM Control Valid"},
- {SEC_DESC_SELF_RELATIVE , "SR", "Self Relative"},
-};
-
-static void print_acl_ctrl(FILE *file, uint16_t ctrl)
-{
- int i;
- const char* separator = "";
-
- fprintf(file, "CONTROL:");
- if (numeric) {
- fprintf(file, "0x%x\n", ctrl);
- return;
- }
-
- for (i = ARRAY_SIZE(sec_desc_ctrl_bits) - 1; i >= 0; i--) {
- if (ctrl & sec_desc_ctrl_bits[i].mask) {
- fprintf(file, "%s%s", separator, sec_desc_ctrl_bits[i].str);
- separator = "|";
- }
- }
- fputc('\n', file);
-}
-
-/* print a ascii version of a security descriptor on a FILE handle */
-static void sec_desc_print(struct cli_state *cli, FILE *f, struct security_descriptor *sd)
-{
- fstring sidstr;
- uint32 i;
-
- fprintf(f, "REVISION:%d\n", sd->revision);
- print_acl_ctrl(f, sd->type);
-
- /* Print owner and group sid */
-
- if (sd->owner_sid) {
- SidToString(cli, sidstr, sd->owner_sid);
- } else {
- fstrcpy(sidstr, "");
- }
-
- fprintf(f, "OWNER:%s\n", sidstr);
-
- if (sd->group_sid) {
- SidToString(cli, sidstr, sd->group_sid);
- } else {
- fstrcpy(sidstr, "");
- }
-
- fprintf(f, "GROUP:%s\n", sidstr);
-
- /* Print aces */
- for (i = 0; sd->dacl && i < sd->dacl->num_aces; i++) {
- struct security_ace *ace = &sd->dacl->aces[i];
- fprintf(f, "ACL:");
- print_ace(cli, f, ace);
- fprintf(f, "\n");
- }
-
-}
-
/*****************************************************
get fileinfo for filename
*******************************************************/
-static uint16 get_fileinfo(struct cli_state *cli, const char *filename)
+static uint16_t get_fileinfo(struct cli_state *cli, const char *filename)
{
uint16_t fnum = (uint16_t)-1;
- uint16 mode = 0;
NTSTATUS status;
+ struct smb_create_returns cr = {0};
/* The desired access below is the only one I could find that works
with NT4, W2KP and Samba */
- status = cli_ntcreate(cli, filename, 0, CREATE_ACCESS_READ,
- 0, FILE_SHARE_READ|FILE_SHARE_WRITE,
- FILE_OPEN, 0x0, 0x0, &fnum);
+ status = cli_ntcreate(
+ cli, /* cli */
+ filename, /* fname */
+ 0, /* CreatFlags */
+ READ_CONTROL_ACCESS, /* CreatFlags */
+ 0, /* FileAttributes */
+ FILE_SHARE_READ|
+ FILE_SHARE_WRITE, /* ShareAccess */
+ FILE_OPEN, /* CreateDisposition */
+ 0x0, /* CreateOptions */
+ 0x0, /* SecurityFlags */
+ &fnum, /* pfid */
+ &cr); /* cr */
if (!NT_STATUS_IS_OK(status)) {
printf("Failed to open %s: %s\n", filename, nt_errstr(status));
return 0;
}
- status = cli_qfileinfo_basic(cli, fnum, &mode, NULL, NULL, NULL,
- NULL, NULL, NULL);
- if (!NT_STATUS_IS_OK(status)) {
- printf("Failed to file info %s: %s\n", filename,
- nt_errstr(status));
- }
-
cli_close(cli, fnum);
-
- return mode;
+ return cr.file_attributes;
}
/*****************************************************
get sec desc for filename
*******************************************************/
-static struct security_descriptor *get_secdesc(struct cli_state *cli, const char *filename)
+static struct security_descriptor *get_secdesc_with_ctx(TALLOC_CTX *ctx,
+ struct cli_state *cli,
+ const char *filename)
{
uint16_t fnum = (uint16_t)-1;
struct security_descriptor *sd;
status = cli_ntcreate(cli, filename, 0, desired_access,
0, FILE_SHARE_READ|FILE_SHARE_WRITE,
- FILE_OPEN, 0x0, 0x0, &fnum);
+ FILE_OPEN, 0x0, 0x0, &fnum, NULL);
if (!NT_STATUS_IS_OK(status)) {
printf("Failed to open %s: %s\n", filename, nt_errstr(status));
return NULL;
}
status = cli_query_security_descriptor(cli, fnum, sec_info,
- talloc_tos(), &sd);
+ ctx, &sd);
cli_close(cli, fnum);
return sd;
}
+static struct security_descriptor *get_secdesc(struct cli_state *cli,
+ const char *filename)
+{
+ return get_secdesc_with_ctx(talloc_tos(), cli, filename);
+}
/*****************************************************
set sec desc for filename
*******************************************************/
status = cli_ntcreate(cli, filename, 0,
desired_access,
0, FILE_SHARE_READ|FILE_SHARE_WRITE,
- FILE_OPEN, 0x0, 0x0, &fnum);
+ FILE_OPEN, 0x0, 0x0, &fnum, NULL);
if (!NT_STATUS_IS_OK(status)) {
printf("Failed to open %s: %s\n", filename, nt_errstr(status));
return false;
status = cli_set_security_descriptor(cli, fnum, sec_info, sd);
if (!NT_STATUS_IS_OK(status)) {
- printf("ERROR: security description set failed: %s\n",
+ printf("ERROR: security descriptor set failed: %s\n",
nt_errstr(status));
result=false;
}
return result;
}
+/*****************************************************
+get maximum access for a file
+*******************************************************/
+static int cacl_mxac(struct cli_state *cli, const char *filename)
+{
+ NTSTATUS status;
+ uint32_t mxac;
+
+ status = cli_query_mxac(cli, filename, &mxac);
+ if (!NT_STATUS_IS_OK(status)) {
+ printf("Failed to get mxac: %s\n", nt_errstr(status));
+ return EXIT_FAILED;
+ }
+
+ printf("Maximum access: 0x%x\n", mxac);
+
+ return EXIT_OK;
+}
+
+
/*****************************************************
dump the acls for a file
*******************************************************/
-static int cacl_dump(struct cli_state *cli, const char *filename)
+static int cacl_dump(struct cli_state *cli, const char *filename, bool numeric)
{
struct security_descriptor *sd;
+ int ret;
if (test_args) {
return EXIT_OK;
printf("%s\n", str);
TALLOC_FREE(str);
} else {
- sec_desc_print(cli, stdout, sd);
+ sec_desc_print(cli, stdout, sd, numeric);
+ }
+
+ if (want_mxac) {
+ ret = cacl_mxac(cli, filename);
+ if (ret != EXIT_OK) {
+ return ret;
+ }
}
return EXIT_OK;
}
-/*****************************************************
+/*****************************************************
Change the ownership or group ownership of a file. Just
because the NT docs say this can't be done :-). JRA.
*******************************************************/
-static int owner_set(struct cli_state *cli, enum chown_mode change_mode,
+static int owner_set(struct cli_state *cli, enum chown_mode change_mode,
const char *filename, const char *new_username)
{
struct dom_sid sid;
- struct security_descriptor *sd, *old;
+ struct security_descriptor *sd;
size_t sd_size;
if (!StringToSid(cli, &sid, new_username))
return EXIT_PARSE_ERROR;
- old = get_secdesc(cli, filename);
-
- if (!old) {
- return EXIT_FAILED;
- }
-
- sd = make_sec_desc(talloc_tos(),old->revision, old->type,
- (change_mode == REQUEST_CHOWN) ? &sid : NULL,
- (change_mode == REQUEST_CHGRP) ? &sid : NULL,
+ sd = make_sec_desc(talloc_tos(),
+ SECURITY_DESCRIPTOR_REVISION_1,
+ SEC_DESC_SELF_RELATIVE,
+ (change_mode == REQUEST_CHOWN) ? &sid : NULL,
+ (change_mode == REQUEST_CHGRP) ? &sid : NULL,
NULL, NULL, &sd_size);
if (!set_secdesc(cli, filename, sd)) {
static int ace_compare(struct security_ace *ace1, struct security_ace *ace2)
{
- if (sec_ace_equal(ace1, ace2))
+ if (security_ace_equal(ace1, ace2))
return 0;
if ((ace1->flags & SEC_ACE_FLAG_INHERITED_ACE) &&
return -1;
if ((ace1->flags & SEC_ACE_FLAG_INHERITED_ACE) &&
(ace2->flags & SEC_ACE_FLAG_INHERITED_ACE))
- return ace1 - ace2;
-
- if (ace1->type != ace2->type)
- return ace2->type - ace1->type;
+ return NUMERIC_CMP(ace1, ace2);
+ if (ace1->type != ace2->type) {
+ /* note the reverse order */
+ return NUMERIC_CMP(ace2->type, ace1->type);
+ }
if (dom_sid_compare(&ace1->trustee, &ace2->trustee))
return dom_sid_compare(&ace1->trustee, &ace2->trustee);
if (ace1->flags != ace2->flags)
- return ace1->flags - ace2->flags;
+ return NUMERIC_CMP(ace1->flags, ace2->flags);
if (ace1->access_mask != ace2->access_mask)
- return ace1->access_mask - ace2->access_mask;
+ return NUMERIC_CMP(ace1->access_mask, ace2->access_mask);
if (ace1->size != ace2->size)
- return ace1->size - ace2->size;
+ return NUMERIC_CMP(ace1->size, ace2->size);
return memcmp(ace1, ace2, sizeof(struct security_ace));
}
static void sort_acl(struct security_acl *the_acl)
{
- uint32 i;
+ uint32_t i;
if (!the_acl) return;
TYPESAFE_QSORT(the_acl->aces, the_acl->num_aces, ace_compare);
for (i=1;i<the_acl->num_aces;) {
- if (sec_ace_equal(&the_acl->aces[i-1], &the_acl->aces[i])) {
- int j;
- for (j=i; j<the_acl->num_aces-1; j++) {
- the_acl->aces[j] = the_acl->aces[j+1];
- }
+ if (security_ace_equal(&the_acl->aces[i-1],
+ &the_acl->aces[i])) {
+ ARRAY_DEL_ELEMENT(
+ the_acl->aces, i, the_acl->num_aces);
the_acl->num_aces--;
} else {
i++;
}
}
-/*****************************************************
-set the ACLs on a file given an ascii description
+/*****************************************************
+set the ACLs on a file given a security descriptor
*******************************************************/
-static int cacl_set(struct cli_state *cli, const char *filename,
- char *the_acl, enum acl_mode mode)
+static int cacl_set_from_sd(struct cli_state *cli, const char *filename,
+ struct security_descriptor *sd, enum acl_mode mode,
+ bool numeric)
{
- struct security_descriptor *sd, *old;
- uint32 i, j;
+ struct security_descriptor *old = NULL;
+ uint32_t i, j;
size_t sd_size;
int result = EXIT_OK;
- if (sddl) {
- sd = sddl_decode(talloc_tos(), the_acl, get_domain_sid(cli));
- } else {
- sd = sec_desc_parse(talloc_tos(), cli, the_acl);
- }
-
if (!sd) return EXIT_PARSE_ERROR;
if (test_args) return EXIT_OK;
- old = get_secdesc(cli, filename);
+ if (mode != SMB_ACL_SET) {
+ /*
+ * Do not fetch old ACL when it will be overwritten
+ * completely with a new one.
+ */
+ old = get_secdesc(cli, filename);
- if (!old) {
- return EXIT_FAILED;
+ if (!old) {
+ return EXIT_FAILED;
+ }
}
/* the logic here is rather more complex than I would like */
bool found = False;
for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
- if (sec_ace_equal(&sd->dacl->aces[i],
- &old->dacl->aces[j])) {
- uint32 k;
+ if (security_ace_equal(&sd->dacl->aces[i],
+ &old->dacl->aces[j])) {
+ uint32_t k;
for (k=j; k<old->dacl->num_aces-1;k++) {
old->dacl->aces[k] = old->dacl->aces[k+1];
}
if (!found) {
printf("ACL for ACE:");
- print_ace(cli, stdout, &sd->dacl->aces[i]);
+ print_ace(cli, stdout, &sd->dacl->aces[i],
+ numeric);
printf(" not found\n");
}
}
fstring str;
SidToString(cli, str,
- &sd->dacl->aces[i].trustee);
+ &sd->dacl->aces[i].trustee,
+ numeric);
printf("ACL for SID %s not found\n", str);
}
}
return result;
}
+/*****************************************************
+set the ACLs on a file given an ascii description
+*******************************************************/
+
+static int cacl_set(struct cli_state *cli, const char *filename,
+ char *the_acl, enum acl_mode mode, bool numeric)
+{
+ struct security_descriptor *sd = NULL;
+
+ if (sddl) {
+ const char *msg = NULL;
+ size_t msg_offset = 0;
+ enum ace_condition_flags flags =
+ ACE_CONDITION_FLAG_ALLOW_DEVICE;
+ sd = sddl_decode_err_msg(talloc_tos(),
+ the_acl,
+ get_domain_sid(cli),
+ flags,
+ &msg,
+ &msg_offset);
+ if (sd == NULL) {
+ DBG_ERR("could not decode '%s'\n", the_acl);
+ if (msg != NULL) {
+ DBG_ERR(" %*c\n",
+ (int)msg_offset, '^');
+ DBG_ERR("error '%s'\n", msg);
+ }
+ }
+ } else {
+ sd = sec_desc_parse(talloc_tos(), cli, the_acl);
+ }
+
+ if (sd == NULL) {
+ return EXIT_PARSE_ERROR;
+ }
+ if (test_args) {
+ return EXIT_OK;
+ }
+ return cacl_set_from_sd(cli, filename, sd, mode, numeric);
+}
+
/*****************************************************
set the inherit on a file
*******************************************************/
const char *type)
{
struct security_descriptor *old,*sd;
- uint32 oldattr;
+ uint32_t oldattr;
size_t sd_size;
int result = EXIT_OK;
if (strcmp(type,"allow")==0) {
if ((old->type & SEC_DESC_DACL_PROTECTED) ==
SEC_DESC_DACL_PROTECTED) {
- int i;
+ uint32_t i;
char *parentname,*temp;
struct security_descriptor *parent;
temp = talloc_strdup(talloc_tos(), filename);
SEC_DESC_DACL_PROTECTED) {
old->type=old->type | SEC_DESC_DACL_PROTECTED;
- /* convert all inherited ACL's to non inherated ACL's. */
+ /*
+ * convert all inherited ACL's to non
+ * inherited ACL's.
+ */
if (old->dacl) {
- int i;
+ uint32_t i;
for (i=0;i<old->dacl->num_aces;i++) {
struct security_ace *ace=&old->dacl->aces[i];
/* Remove INHERITED FLAG from all aces */
/*****************************************************
Return a connection to a server.
*******************************************************/
-static struct cli_state *connect_one(struct user_auth_info *auth_info,
+static struct cli_state *connect_one(struct cli_credentials *creds,
const char *server, const char *share)
{
struct cli_state *c = NULL;
NTSTATUS nt_status;
uint32_t flags = 0;
- if (get_cmdline_auth_info_use_kerberos(auth_info)) {
- flags |= CLI_FULL_CONNECTION_USE_KERBEROS |
- CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS;
- }
-
- if (get_cmdline_auth_info_use_machine_account(auth_info) &&
- !set_cmdline_auth_info_machine_account_creds(auth_info)) {
+ nt_status = cli_full_connection_creds(talloc_tos(),
+ &c,
+ lp_netbios_name(),
+ server,
+ NULL,
+ 0,
+ share,
+ "?????",
+ creds,
+ flags);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status)));
return NULL;
}
- set_cmdline_auth_info_getpass(auth_info);
+ return c;
+}
- nt_status = cli_full_connection(&c, lp_netbios_name(), server,
- NULL, 0,
- share, "?????",
- get_cmdline_auth_info_username(auth_info),
- lp_workgroup(),
- get_cmdline_auth_info_password(auth_info),
- flags,
- get_cmdline_auth_info_signing_state(auth_info));
- if (!NT_STATUS_IS_OK(nt_status)) {
- DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status)));
+/*
+ * Process resulting combination of mask & fname ensuring
+ * terminated with wildcard
+ */
+static char *build_dirname(TALLOC_CTX *ctx,
+ const char *mask, char *dir, char *fname)
+{
+ char *mask2 = NULL;
+ char *p = NULL;
+
+ mask2 = talloc_strdup(ctx, mask);
+ if (!mask2) {
return NULL;
}
-
- if (get_cmdline_auth_info_smb_encrypt(auth_info)) {
- nt_status = cli_cm_force_encryption(c,
- get_cmdline_auth_info_username(auth_info),
- get_cmdline_auth_info_password(auth_info),
- lp_workgroup(),
- share);
- if (!NT_STATUS_IS_OK(nt_status)) {
- cli_shutdown(c);
- c = NULL;
- }
+ p = strrchr_m(mask2, DIRSEP_CHAR);
+ if (p) {
+ p[1] = 0;
+ } else {
+ mask2[0] = '\0';
}
+ mask2 = talloc_asprintf_append(mask2,
+ "%s\\*",
+ fname);
+ return mask2;
+}
- return c;
+/*
+ * Returns a copy of the ACL flags in ace modified according
+ * to some inheritance rules.
+ * a) SEC_ACE_FLAG_INHERITED_ACE is propagated to children
+ * b) SEC_ACE_FLAG_INHERIT_ONLY is set on container children for OI (only)
+ * c) SEC_ACE_FLAG_OBJECT_INHERIT & SEC_ACE_FLAG_CONTAINER_INHERIT are
+ * stripped from flags to be propagated to non-container children
+ * d) SEC_ACE_FLAG_OBJECT_INHERIT & SEC_ACE_FLAG_CONTAINER_INHERIT are
+ * stripped from flags to be propagated if the NP flag
+ * SEC_ACE_FLAG_NO_PROPAGATE_INHERIT is present
+ */
+
+static uint8_t get_flags_to_propagate(bool is_container,
+ struct security_ace *ace)
+{
+ uint8_t newflags = ace->flags;
+ /* OBJECT inheritance */
+ bool acl_objinherit = (ace->flags &
+ SEC_ACE_FLAG_OBJECT_INHERIT) == SEC_ACE_FLAG_OBJECT_INHERIT;
+ /* CONTAINER inheritance */
+ bool acl_cntrinherit = (ace->flags &
+ SEC_ACE_FLAG_CONTAINER_INHERIT) ==
+ SEC_ACE_FLAG_CONTAINER_INHERIT;
+ /* PROHIBIT inheritance */
+ bool prohibit_inheritance = ((ace->flags &
+ SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) ==
+ SEC_ACE_FLAG_NO_PROPAGATE_INHERIT);
+
+ /* Assume we are not propagating the ACE */
+
+ newflags &= ~SEC_ACE_FLAG_INHERITED_ACE;
+
+ /* Inherit-only flag is not propagated to children */
+
+ newflags &= ~SEC_ACE_FLAG_INHERIT_ONLY;
+ /* all children need to have the SEC_ACE_FLAG_INHERITED_ACE set */
+ if (acl_cntrinherit || acl_objinherit) {
+ /*
+ * object inherit ( alone ) on a container needs
+ * SEC_ACE_FLAG_INHERIT_ONLY
+ */
+ if (is_container) {
+ if (acl_objinherit && !acl_cntrinherit) {
+ newflags |= SEC_ACE_FLAG_INHERIT_ONLY;
+ }
+ /*
+ * this is tricky, the only time we would not
+ * propagate the ace for a container is if
+ * prohibit_inheritance is set and object inheritance
+ * alone is set
+ */
+ if ((prohibit_inheritance
+ && acl_objinherit
+ && !acl_cntrinherit) == false) {
+ newflags |= SEC_ACE_FLAG_INHERITED_ACE;
+ }
+ } else {
+ /*
+ * don't apply object/container inheritance flags to
+ * non dirs
+ */
+ newflags &= ~(SEC_ACE_FLAG_OBJECT_INHERIT
+ | SEC_ACE_FLAG_CONTAINER_INHERIT
+ | SEC_ACE_FLAG_INHERIT_ONLY);
+ /*
+ * only apply ace to file if object inherit
+ */
+ if (acl_objinherit) {
+ newflags |= SEC_ACE_FLAG_INHERITED_ACE;
+ }
+ }
+
+ /* if NP is specified strip NP and all OI/CI INHERIT flags */
+ if (prohibit_inheritance) {
+ newflags &= ~(SEC_ACE_FLAG_OBJECT_INHERIT
+ | SEC_ACE_FLAG_CONTAINER_INHERIT
+ | SEC_ACE_FLAG_INHERIT_ONLY
+ | SEC_ACE_FLAG_NO_PROPAGATE_INHERIT);
+ }
+ }
+ return newflags;
}
-/****************************************************************************
- main program
-****************************************************************************/
- int main(int argc, const char *argv[])
+/*
+ * This function builds a new acl for 'caclfile', first it removes any
+ * existing inheritable ace(s) from the current acl of caclfile, secondly it
+ * applies any inheritable acls of the parent of caclfile ( inheritable acls of
+ * caclfile's parent are passed via acl_to_add member of cbstate )
+ *
+ */
+static NTSTATUS propagate_inherited_aces(char *caclfile,
+ struct cacl_callback_state *cbstate)
{
- char *share;
- int opt;
- enum acl_mode mode = SMB_ACL_SET;
- static char *the_acl = NULL;
- enum chown_mode change_mode = REQUEST_NONE;
+ TALLOC_CTX *aclctx = NULL;
+ NTSTATUS status;
int result;
- char *path;
- char *filename = NULL;
- poptContext pc;
- struct poptOption long_options[] = {
- POPT_AUTOHELP
- { "delete", 'D', POPT_ARG_STRING, NULL, 'D', "Delete an acl", "ACL" },
- { "modify", 'M', POPT_ARG_STRING, NULL, 'M', "Modify an acl", "ACL" },
- { "add", 'a', POPT_ARG_STRING, NULL, 'a', "Add an acl", "ACL" },
- { "set", 'S', POPT_ARG_STRING, NULL, 'S', "Set acls", "ACLS" },
- { "chown", 'C', POPT_ARG_STRING, NULL, 'C', "Change ownership of a file", "USERNAME" },
- { "chgrp", 'G', POPT_ARG_STRING, NULL, 'G', "Change group ownership of a file", "GROUPNAME" },
- { "inherit", 'I', POPT_ARG_STRING, NULL, 'I', "Inherit allow|remove|copy" },
- { "numeric", 0, POPT_ARG_NONE, &numeric, 1, "Don't resolve sids or masks to names" },
- { "sddl", 0, POPT_ARG_NONE, &sddl, 1, "Output and input acls in sddl format" },
- { "query-security-info", 0, POPT_ARG_INT, &query_sec_info, 1,
- "The security-info flags for queries"
- },
- { "set-security-info", 0, POPT_ARG_INT, &set_sec_info, 1,
- "The security-info flags for modifications"
- },
- { "test-args", 't', POPT_ARG_NONE, &test_args, 1, "Test arguments"},
- { "domain-sid", 0, POPT_ARG_STRING, &domain_sid, 0, "Domain SID for sddl", "SID"},
- POPT_COMMON_SAMBA
- POPT_COMMON_CONNECTION
- POPT_COMMON_CREDENTIALS
- POPT_TABLEEND
- };
+ int fileattr;
+ struct security_descriptor *old = NULL;
+ bool is_container = false;
+ struct security_acl *acl_to_add = cbstate->acl_to_add;
+ struct security_acl *acl_to_remove = NULL;
+ uint32_t i, j;
- struct cli_state *cli;
- TALLOC_CTX *frame = talloc_stackframe();
- const char *owner_username = "";
- char *server;
- struct user_auth_info *auth_info;
+ aclctx = talloc_new(NULL);
+ if (aclctx == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ old = get_secdesc_with_ctx(aclctx, cbstate->cli, caclfile);
- load_case_tables();
+ if (!old) {
+ status = NT_STATUS_UNSUCCESSFUL;
+ goto out;
+ }
- /* set default debug level to 1 regardless of what smb.conf sets */
- setup_logging( "smbcacls", DEBUG_STDERR);
- lp_set_cmdline("log level", "1");
+ /* inhibit propagation? */
+ if ((old->type & SEC_DESC_DACL_PROTECTED) ==
+ SEC_DESC_DACL_PROTECTED){
+ status = NT_STATUS_OK;
+ goto out;
+ }
- setlinebuf(stdout);
+ fileattr = get_fileinfo(cbstate->cli, caclfile);
+ is_container = (fileattr & FILE_ATTRIBUTE_DIRECTORY);
- lp_load_global(get_dyn_CONFIGFILE());
- load_interfaces();
+ /* find acl(s) that are inherited */
+ for (j = 0; old->dacl && j < old->dacl->num_aces; j++) {
- auth_info = user_auth_info_init(frame);
- if (auth_info == NULL) {
- exit(1);
+ if (old->dacl->aces[j].flags & SEC_ACE_FLAG_INHERITED_ACE) {
+ if (!add_ace_with_ctx(aclctx, &acl_to_remove,
+ &old->dacl->aces[j])) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
+ }
}
- popt_common_set_auth_info(auth_info);
- pc = poptGetContext("smbcacls", argc, argv, long_options, 0);
-
- poptSetOtherOptionHelp(pc, "//server1/share1 filename\nACLs look like: "
- "'ACL:user:[ALLOWED|DENIED]/flags/permissions'");
+ /* remove any acl(s) that are inherited */
+ if (acl_to_remove) {
+ for (i = 0; i < acl_to_remove->num_aces; i++) {
+ struct security_ace ace = acl_to_remove->aces[i];
+ for (j = 0; old->dacl && j < old->dacl->num_aces; j++) {
- while ((opt = poptGetNextOpt(pc)) != -1) {
- switch (opt) {
- case 'S':
- the_acl = smb_xstrdup(poptGetOptArg(pc));
- mode = SMB_ACL_SET;
- break;
+ if (security_ace_equal(&ace,
+ &old->dacl->aces[j])) {
+ uint32_t k;
+ for (k = j; k < old->dacl->num_aces-1;
+ k++) {
+ old->dacl->aces[k] =
+ old->dacl->aces[k+1];
+ }
+ old->dacl->num_aces--;
+ break;
+ }
+ }
+ }
+ }
+ /* propagate any inheritable ace to be added */
+ if (acl_to_add) {
+ for (i = 0; i < acl_to_add->num_aces; i++) {
+ struct security_ace ace = acl_to_add->aces[i];
+ bool is_objectinherit = (ace.flags &
+ SEC_ACE_FLAG_OBJECT_INHERIT) ==
+ SEC_ACE_FLAG_OBJECT_INHERIT;
+ bool is_inherited;
+ /* don't propagate flags to a file unless OI */
+ if (!is_objectinherit && !is_container) {
+ continue;
+ }
+ /*
+ * adjust flags according to inheritance
+ * rules
+ */
+ ace.flags = get_flags_to_propagate(is_container, &ace);
+ is_inherited = (ace.flags &
+ SEC_ACE_FLAG_INHERITED_ACE) ==
+ SEC_ACE_FLAG_INHERITED_ACE;
+ /* don't propagate non inherited flags */
+ if (!is_inherited) {
+ continue;
+ }
+ if (!add_ace_with_ctx(aclctx, &old->dacl, &ace)) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
+ }
+ }
- case 'D':
- the_acl = smb_xstrdup(poptGetOptArg(pc));
- mode = SMB_ACL_DELETE;
- break;
+ result = cacl_set_from_sd(cbstate->cli, caclfile,
+ old,
+ SMB_ACL_SET, cbstate->numeric);
+ if (result != EXIT_OK) {
+ status = NT_STATUS_UNSUCCESSFUL;
+ goto out;
+ }
- case 'M':
- the_acl = smb_xstrdup(poptGetOptArg(pc));
- mode = SMB_ACL_MODIFY;
- break;
+ status = NT_STATUS_OK;
+out:
+ TALLOC_FREE(aclctx);
+ return status;
+}
- case 'a':
- the_acl = smb_xstrdup(poptGetOptArg(pc));
- mode = SMB_ACL_ADD;
- break;
+/*
+ * Returns true if 'ace' contains SEC_ACE_FLAG_OBJECT_INHERIT or
+ * SEC_ACE_FLAG_CONTAINER_INHERIT
+ */
+static bool is_inheritable_ace(struct security_ace *ace)
+{
+ uint8_t flags = ace->flags;
+ if (flags & (SEC_ACE_FLAG_OBJECT_INHERIT
+ | SEC_ACE_FLAG_CONTAINER_INHERIT)) {
+ return true;
+ }
+ return false;
+}
- case 'C':
- owner_username = poptGetOptArg(pc);
- change_mode = REQUEST_CHOWN;
- break;
+/* This method does some basic sanity checking with respect to automatic
+ * inheritance. e.g. it checks if it is possible to do a set, it detects illegal
+ * attempts to set inherited permissions directly. Additionally this method
+ * does some basic initialisation for instance it parses the ACL passed on the
+ * command line.
+ */
+static NTSTATUS prepare_inheritance_propagation(TALLOC_CTX *ctx, char *filename,
+ struct cacl_callback_state *cbstate)
+{
+ NTSTATUS result;
+ char *the_acl = cbstate->the_acl;
+ struct cli_state *cli = cbstate->cli;
+ enum acl_mode mode = cbstate->mode;
+ struct security_descriptor *sd = NULL;
+ struct security_descriptor *old = NULL;
+ uint32_t j;
+ bool propagate = false;
- case 'G':
- owner_username = poptGetOptArg(pc);
- change_mode = REQUEST_CHGRP;
- break;
+ old = get_secdesc_with_ctx(ctx, cli, filename);
+ if (old == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
- case 'I':
- owner_username = poptGetOptArg(pc);
- change_mode = REQUEST_INHERIT;
- break;
+ /* parse acl passed on the command line */
+ if (sddl) {
+ const char *msg = NULL;
+ size_t msg_offset = 0;
+ enum ace_condition_flags flags =
+ ACE_CONDITION_FLAG_ALLOW_DEVICE;
+
+ cbstate->aclsd = sddl_decode_err_msg(ctx,
+ the_acl,
+ get_domain_sid(cli),
+ flags,
+ &msg,
+ &msg_offset);
+ if (cbstate->aclsd == NULL) {
+ DBG_ERR("could not decode '%s'\n", the_acl);
+ if (msg != NULL) {
+ DBG_ERR(" %*c\n",
+ (int)msg_offset, '^');
+ DBG_ERR("error '%s'\n", msg);
+ }
}
+ } else {
+ cbstate->aclsd = sec_desc_parse(ctx, cli, the_acl);
}
- /* Make connection to server */
- if(!poptPeekArg(pc)) {
- poptPrintUsage(pc, stderr, 0);
- return -1;
+ if (!cbstate->aclsd) {
+ result = NT_STATUS_UNSUCCESSFUL;
+ goto out;
}
- path = talloc_strdup(frame, poptGetArg(pc));
- if (!path) {
- return -1;
+ sd = cbstate->aclsd;
+
+ /* set operation if inheritance is enabled doesn't make sense */
+ if (mode == SMB_ACL_SET && ((old->type & SEC_DESC_DACL_PROTECTED) !=
+ SEC_DESC_DACL_PROTECTED)){
+ d_printf("Inheritance enabled at %s, can't apply set operation\n",filename);
+ result = NT_STATUS_UNSUCCESSFUL;
+ goto out;
+
}
- if(!poptPeekArg(pc)) {
- poptPrintUsage(pc, stderr, 0);
- return -1;
+ /*
+ * search command line acl for any illegal SEC_ACE_FLAG_INHERITED_ACE
+ * flags that are set
+ */
+ for (j = 0; sd->dacl && j < sd->dacl->num_aces; j++) {
+ struct security_ace *ace = &sd->dacl->aces[j];
+ if (ace->flags & SEC_ACE_FLAG_INHERITED_ACE) {
+ d_printf("Illegal parameter %s\n", the_acl);
+ result = NT_STATUS_UNSUCCESSFUL;
+ goto out;
+ }
+ if (!propagate) {
+ if (is_inheritable_ace(ace)) {
+ propagate = true;
+ }
+ }
}
- filename = talloc_strdup(frame, poptGetArg(pc));
- if (!filename) {
- return -1;
+ result = NT_STATUS_OK;
+out:
+ cbstate->acl_no_propagate = !propagate;
+ return result;
+}
+
+/*
+ * This method builds inheritable ace(s) from filename (which should be
+ * a container) that need propagating to children in order to provide
+ * automatic inheritance. Those inheritable ace(s) are stored in
+ * acl_to_add member of cbstate for later processing
+ * (see propagate_inherited_aces)
+ */
+static NTSTATUS get_inheritable_aces(TALLOC_CTX *ctx, char *filename,
+ struct cacl_callback_state *cbstate)
+{
+ NTSTATUS result;
+ struct cli_state *cli = NULL;
+ struct security_descriptor *sd = NULL;
+ struct security_acl *acl_to_add = NULL;
+ uint32_t j;
+
+ cli = cbstate->cli;
+ sd = get_secdesc_with_ctx(ctx, cli, filename);
+
+ if (sd == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /*
+ * Check if any inheritance related flags are used, if not then
+ * nothing to do. At the same time populate acls for inheritance
+ * related ace(s) that need to be added to or deleted from children as
+ * a result of inheritance propagation.
+ */
+
+ for (j = 0; sd->dacl && j < sd->dacl->num_aces; j++) {
+ struct security_ace *ace = &sd->dacl->aces[j];
+ if (is_inheritable_ace(ace)) {
+ bool added = add_ace_with_ctx(ctx, &acl_to_add, ace);
+ if (!added) {
+ result = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
+ }
}
+ cbstate->acl_to_add = acl_to_add;
+ result = NT_STATUS_OK;
+out:
+ return result;
+}
- poptFreeContext(pc);
- popt_burn_cmdline_password(argc, argv);
+/*
+ * Callback handler to handle child elements processed by cli_list, we attempt
+ * to propagate inheritable ace(s) to each child via the function
+ * propagate_inherited_aces. Children that are themselves directories are passed
+ * to cli_list again ( to descend the directory structure )
+ */
+static NTSTATUS cacl_set_cb(struct file_info *f,
+ const char *mask, void *state)
+{
+ struct cacl_callback_state *cbstate =
+ (struct cacl_callback_state *)state;
+ struct cli_state *cli = NULL;
+ struct cli_credentials *creds = NULL;
- string_replace(path,'/','\\');
+ TALLOC_CTX *dirctx = NULL;
+ NTSTATUS status;
+ struct cli_state *targetcli = NULL;
- server = talloc_strdup(frame, path+2);
- if (!server) {
- return -1;
+ char *dir = NULL;
+ char *dir_end = NULL;
+ char *mask2 = NULL;
+ char *targetpath = NULL;
+ char *caclfile = NULL;
+
+ dirctx = talloc_new(NULL);
+ if (!dirctx) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
}
- share = strchr_m(server,'\\');
- if (!share) {
- printf("Invalid argument: %s\n", share);
- return -1;
+
+ cli = cbstate->cli;
+ creds = cbstate->creds;
+
+ /* Work out the directory. */
+ dir = talloc_strdup(dirctx, mask);
+ if (!dir) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
}
- *share = 0;
- share++;
+ dir_end = strrchr(dir, DIRSEP_CHAR);
+ if (dir_end != NULL) {
+ *dir_end = '\0';
+ }
- if (!test_args) {
- cli = connect_one(auth_info, server, share);
- if (!cli) {
- exit(EXIT_FAILED);
- }
- } else {
- exit(0);
+ if (!f->name || !f->name[0]) {
+ d_printf("Empty dir name returned. Possible server misconfiguration.\n");
+ status = NT_STATUS_UNSUCCESSFUL;
+ goto out;
}
- string_replace(filename, '/', '\\');
- if (filename[0] != '\\') {
- filename = talloc_asprintf(frame,
- "\\%s",
- filename);
- if (!filename) {
- return -1;
+ if (f->attr & FILE_ATTRIBUTE_DIRECTORY) {
+ struct cacl_callback_state dir_cbstate;
+ uint16_t attribute = FILE_ATTRIBUTE_DIRECTORY
+ | FILE_ATTRIBUTE_SYSTEM
+ | FILE_ATTRIBUTE_HIDDEN;
+ dir_end = NULL;
+
+ /* ignore special '.' & '..' */
+ if ((f->name == NULL) || ISDOT(f->name) || ISDOTDOT(f->name)) {
+ status = NT_STATUS_OK;
+ goto out;
}
- }
- /* Perform requested action */
+ mask2 = build_dirname(dirctx, mask, dir, f->name);
+ if (mask2 == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
- if (change_mode == REQUEST_INHERIT) {
- result = inherit(cli, filename, owner_username);
- } else if (change_mode != REQUEST_NONE) {
- result = owner_set(cli, change_mode, filename, owner_username);
- } else if (the_acl) {
- result = cacl_set(cli, filename, the_acl, mode);
- } else {
- result = cacl_dump(cli, filename);
+ /* check for dfs */
+ status = cli_resolve_path(dirctx, "", creds, cli,
+ mask2, &targetcli, &targetpath);
+ if (!NT_STATUS_IS_OK(status)) {
+ goto out;
+ }
+
+ /*
+ * prepare path to caclfile, remove any existing wildcard
+ * chars and convert path separators.
+ */
+
+ caclfile = talloc_strdup(dirctx, targetpath);
+ if (!caclfile) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
+ dir_end = strrchr(caclfile, '*');
+ if (dir_end != NULL) {
+ *dir_end = '\0';
+ }
+
+ string_replace(caclfile, '/', '\\');
+ /*
+ * make directory specific copy of cbstate here
+ * (for this directory level) to be available as
+ * the parent cbstate for the children of this directory.
+ * Note: cbstate is overwritten for the current file being
+ * processed.
+ */
+ dir_cbstate = *cbstate;
+ dir_cbstate.cli = targetcli;
+
+ /*
+ * propagate any inherited ace from our parent
+ */
+ status = propagate_inherited_aces(caclfile, &dir_cbstate);
+ if (!NT_STATUS_IS_OK(status)) {
+ goto out;
+ }
+
+ /*
+ * get inheritable ace(s) for this dir/container
+ * that will be propagated to its children
+ */
+ status = get_inheritable_aces(dirctx, caclfile,
+ &dir_cbstate);
+ if (!NT_STATUS_IS_OK(status)) {
+ goto out;
+ }
+
+ /*
+ * ensure cacl_set_cb gets called for children
+ * of this directory (targetpath)
+ */
+ status = cli_list(targetcli, targetpath,
+ attribute, cacl_set_cb,
+ (void *)&dir_cbstate);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ goto out;
+ }
+
+ } else {
+ /*
+ * build full path to caclfile and replace '/' with '\' so
+ * other utility functions can deal with it
+ */
+
+ targetpath = talloc_asprintf(dirctx, "%s/%s", dir, f->name);
+ if (!targetpath) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
+ string_replace(targetpath, '/', '\\');
+
+ /* attempt to propagate any inherited ace to file caclfile */
+ status = propagate_inherited_aces(targetpath, cbstate);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ goto out;
+ }
+ }
+ status = NT_STATUS_OK;
+out:
+ if (!NT_STATUS_IS_OK(status)) {
+ d_printf("error %s: processing %s\n",
+ nt_errstr(status),
+ targetpath);
+ }
+ TALLOC_FREE(dirctx);
+ return status;
+}
+
+
+/*
+ * Wrapper around cl_list to descend the directory tree pointed to by 'filename',
+ * helper callback function 'cacl_set_cb' handles the child elements processed
+ * by cli_list.
+ */
+static int inheritance_cacl_set(char *filename,
+ struct cacl_callback_state *cbstate)
+{
+ int result;
+ NTSTATUS ntstatus;
+ int fileattr;
+ char *mask = NULL;
+ struct cli_state *cli = cbstate->cli;
+ TALLOC_CTX *ctx = NULL;
+ bool isdirectory = false;
+ uint16_t attribute = FILE_ATTRIBUTE_DIRECTORY | FILE_ATTRIBUTE_SYSTEM
+ | FILE_ATTRIBUTE_HIDDEN;
+ ctx = talloc_init("inherit_set");
+ if (ctx == NULL) {
+ d_printf("out of memory\n");
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+ /* ensure we have a filename that starts with '\' */
+ if (!filename || *filename != DIRSEP_CHAR) {
+ /* illegal or no filename */
+ result = EXIT_FAILED;
+ d_printf("illegal or missing name '%s'\n", filename);
+ goto out;
+ }
+
+
+ fileattr = get_fileinfo(cli, filename);
+ isdirectory = (fileattr & FILE_ATTRIBUTE_DIRECTORY)
+ == FILE_ATTRIBUTE_DIRECTORY;
+
+ /*
+ * if we've got as far as here then we have already evaluated
+ * the args.
+ */
+ if (test_args) {
+ result = EXIT_OK;
+ goto out;
+ }
+
+ mask = NULL;
+ /* make sure we have a trailing '\*' for directory */
+ if (!isdirectory) {
+ mask = talloc_strdup(ctx, filename);
+ } else if (strlen(filename) > 1) {
+ /*
+ * if the passed file name doesn't have a trailing '\'
+ * append it.
+ */
+ char *name_end = strrchr(filename, DIRSEP_CHAR);
+ if (name_end != filename + strlen(filename) + 1) {
+ mask = talloc_asprintf(ctx, "%s\\*", filename);
+ } else {
+ mask = talloc_strdup(ctx, filename);
+ }
+ } else {
+ /* filename is a single '\', just append '*' */
+ mask = talloc_asprintf_append(mask, "%s*", filename);
+ }
+
+ if (!mask) {
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+ /*
+ * prepare for automatic propagation of the acl passed on the
+ * cmdline.
+ */
+
+ ntstatus = prepare_inheritance_propagation(ctx, filename,
+ cbstate);
+ if (!NT_STATUS_IS_OK(ntstatus)) {
+ d_printf("error: %s processing %s\n",
+ nt_errstr(ntstatus), filename);
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+ result = cacl_set_from_sd(cli, filename, cbstate->aclsd,
+ cbstate->mode, cbstate->numeric);
+
+ /*
+ * strictly speaking it could be considered an error if a file was
+ * specified with '--propagate-inheritance'. However we really want
+ * to eventually get rid of '--propagate-inheritance' so we will be
+ * more forgiving here and instead just exit early.
+ */
+ if (!isdirectory || (result != EXIT_OK)) {
+ goto out;
+ }
+
+ /* check if there is actually any need to propagate */
+ if (cbstate->acl_no_propagate) {
+ goto out;
+ }
+ /* get inheritable attributes this parent container (e.g. filename) */
+ ntstatus = get_inheritable_aces(ctx, filename, cbstate);
+ if (NT_STATUS_IS_OK(ntstatus)) {
+ /* process children */
+ ntstatus = cli_list(cli, mask, attribute,
+ cacl_set_cb,
+ (void *)cbstate);
+ }
+
+ if (!NT_STATUS_IS_OK(ntstatus)) {
+ d_printf("error: %s processing %s\n",
+ nt_errstr(ntstatus), filename);
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+out:
+ TALLOC_FREE(ctx);
+ return result;
+}
+
+struct diritem {
+ struct diritem *prev, *next;
+ /*
+ * dirname and targetpath below are sanitized,
+ * e.g.
+ * + start and end with '\'
+ * + have no trailing '*'
+ * + all '/' have been converted to '\'
+ */
+ char *dirname;
+ char *targetpath;
+ struct cli_state *targetcli;
+};
+
+struct save_restore_stats
+{
+ int success;
+ int failure;
+};
+
+struct dump_context {
+ struct diritem *list;
+ struct cli_credentials *creds;
+ struct cli_state *cli;
+ struct save_restore_stats *stats;
+ int save_fd;
+ struct diritem *dir;
+ NTSTATUS status;
+};
+
+static int write_dacl(struct dump_context *ctx,
+ struct cli_state *cli,
+ const char *filename,
+ const char *origfname)
+{
+ struct security_descriptor *sd = NULL;
+ char *str = NULL;
+ const char *output_fmt = "%s\r\n%s\r\n";
+ const char *tmp = NULL;
+ char *out_str = NULL;
+ uint8_t *dest = NULL;
+ ssize_t s_len;
+ size_t d_len;
+ bool ok;
+ int result;
+ TALLOC_CTX *frame = talloc_stackframe();
+
+ if (test_args) {
+ return EXIT_OK;
+ }
+
+ if (ctx->save_fd < 0) {
+ DBG_ERR("error processing %s no file descriptor\n", filename);
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+ sd = get_secdesc(cli, filename);
+ if (sd == NULL) {
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+ sd->owner_sid = NULL;
+ sd->group_sid = NULL;
+
+ str = sddl_encode(frame, sd, get_domain_sid(cli));
+ if (str == NULL) {
+ DBG_ERR("error processing %s couldn't encode DACL\n", filename);
+ result = EXIT_FAILED;
+ goto out;
+ }
+ /*
+ * format of icacls save file is
+ * a line containing the path of the file/dir
+ * followed by a line containing the sddl format
+ * of the dacl.
+ * The format of the strings are null terminated
+ * 16-bit Unicode. Each line is terminated by "\r\n"
+ */
+
+ tmp = origfname;
+ /* skip leading '\' */
+ if (tmp[0] == '\\') {
+ tmp++;
+ }
+ out_str = talloc_asprintf(frame, output_fmt, tmp, str);
+
+ if (out_str == NULL) {
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+ s_len = strlen(out_str);
+
+ ok = convert_string_talloc(out_str,
+ CH_UNIX,
+ CH_UTF16,
+ out_str,
+ s_len, (void **)(void *)&dest, &d_len);
+ if (!ok) {
+ DBG_ERR("error processing %s out of memory\n", tmp);
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+ if (write(ctx->save_fd, dest, d_len) != d_len) {
+ DBG_ERR("error processing %s failed to write to file.\n", tmp);
+ result = EXIT_FAILED;
+ goto out;
+ }
+ fsync(ctx->save_fd);
+
+ result = EXIT_OK;
+ ctx->stats->success += 1;
+ fprintf(stdout, "Successfully processed file: %s\n", tmp);
+out:
+ TALLOC_FREE(frame);
+ if (result != EXIT_OK) {
+ ctx->stats->failure += 1;
+ }
+ return result;
+}
+
+/*
+ * Sanitize directory name.
+ * Given a directory name 'dir' ensure it;
+ * o starts with '\'
+ * o ends with '\'
+ * o doesn't end with trailing '*'
+ * o ensure all '/' are converted to '\'
+ */
+
+static char *sanitize_dirname(TALLOC_CTX *ctx,
+ const char *dir)
+{
+ char *mask = NULL;
+ char *name_end = NULL;
+
+ mask = talloc_strdup(ctx, dir);
+ name_end = strrchr(mask, '*');
+ if (name_end) {
+ *name_end = '\0';
+ }
+
+ name_end = strrchr(mask, DIRSEP_CHAR);
+
+ if (strlen(mask) > 0 && name_end != mask + (strlen(mask) - 1)) {
+ mask = talloc_asprintf(ctx, "%s\\", mask);
+ }
+
+ string_replace(mask, '/', '\\');
+ return mask;
+}
+
+/*
+ * Process each entry (child) of a directory.
+ * Each entry, regardless of whether it is itself a file or directory
+ * has it's dacl written to the restore/save file.
+ * Each directory is saved to context->list (for further processing)
+ * write_dacl will update the stats (success/fail)
+ */
+static NTSTATUS cacl_dump_dacl_cb(struct file_info *f,
+ const char *mask, void *state)
+{
+ struct dump_context *ctx = talloc_get_type_abort(state,
+ struct dump_context);
+
+ NTSTATUS status;
+
+ char *mask2 = NULL;
+ char *targetpath = NULL;
+ char *unresolved = NULL;
+
+ /*
+ * if we have already encountered an error
+ * bail out
+ */
+ if (!NT_STATUS_IS_OK(ctx->status)) {
+ return ctx->status;
+ }
+
+ if (!f->name || !f->name[0]) {
+ DBG_ERR("Empty dir name returned. Possible server "
+ "misconfiguration.\n");
+ status = NT_STATUS_UNSUCCESSFUL;
+ goto out;
+ }
+
+ mask2 = sanitize_dirname(ctx, mask);
+ if (!mask2) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
+ if (f->attr & FILE_ATTRIBUTE_DIRECTORY) {
+ struct diritem *item = NULL;
+
+ /* ignore special '.' & '..' */
+ if ((f->name == NULL) || ISDOT(f->name) || ISDOTDOT(f->name)) {
+ status = NT_STATUS_OK;
+ goto out;
+ }
+
+ /* Work out the directory. */
+ unresolved = sanitize_dirname(ctx, ctx->dir->dirname);
+ if (!unresolved) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
+
+ unresolved = talloc_asprintf(ctx, "%s%s", unresolved, f->name);
+
+ if (unresolved == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
+
+ item = talloc_zero(ctx, struct diritem);
+ if (item == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
+
+ item->dirname = unresolved;
+
+ mask2 = talloc_asprintf(ctx, "%s%s", mask2, f->name);
+ if (!mask2) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
+
+ status = cli_resolve_path(ctx, "", ctx->creds, ctx->cli,
+ mask2, &item->targetcli, &targetpath);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ DBG_ERR("error failed to resolve: %s\n",
+ nt_errstr(status));
+ goto out;
+ }
+
+ item->targetpath = sanitize_dirname(ctx, targetpath);
+ if (!item->targetpath) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
+
+ if (write_dacl(ctx,
+ item->targetcli,
+ item->targetpath, unresolved) != EXIT_OK) {
+ status = NT_STATUS_UNSUCCESSFUL;
+ /*
+ * cli_list happily ignores error encountered
+ * when processing the callback so we need
+ * to save any error status encountered while
+ * processing directories (so we can stop recursing
+ * those as soon as possible).
+ * Changing the current behaviour of the callback
+ * handling by cli_list would be I think be too
+ * risky.
+ */
+ ctx->status = status;
+ goto out;
+ }
+
+ DLIST_ADD_END(ctx->list, item);
+
+ } else {
+ unresolved = sanitize_dirname(ctx, ctx->dir->dirname);
+ if (!unresolved) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
+
+ unresolved = talloc_asprintf(ctx, "%s%s", unresolved, f->name);
+
+ if (!unresolved) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
+ /*
+ * build full path to the file and replace '/' with '\' so
+ * other utility functions can deal with it
+ */
+
+ targetpath = talloc_asprintf(ctx, "%s%s", mask2, f->name);
+
+ if (!targetpath) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
+
+ if (write_dacl(ctx,
+ ctx->dir->targetcli,
+ targetpath, unresolved) != EXIT_OK) {
+ status = NT_STATUS_UNSUCCESSFUL;
+ /*
+ * cli_list happily ignores error encountered
+ * when processing the callback so we need
+ * to save any error status encountered while
+ * processing directories (so we can stop recursing
+ * those as soon as possible).
+ * Changing the current behaviour of the callback
+ * handling by cli_list would be I think be too
+ * risky.
+ */
+ ctx->status = status;
+ goto out;
+ }
+ }
+ status = NT_STATUS_OK;
+out:
+ if (!NT_STATUS_IS_OK(status)) {
+ DBG_ERR("error %s: processing %s\n",
+ nt_errstr(status), targetpath);
+ }
+ return status;
+}
+
+/*
+ * dump_ctx contains a list of directories to be processed
+ * + each directory 'dir' is scanned by cli_list, the cli_list
+ * callback 'cacl_dump_dacl_cb' writes out the dacl of each
+ * child of 'dir' (regardless of whether it is a dir or file)
+ * to the restore/save file. Additionally any directories encountered
+ * are returned in the passed in dump_ctx->list member
+ * + the directory list returned from cli_list is passed and processed
+ * by recursively calling dump_dacl_dirtree
+ *
+ */
+static int dump_dacl_dirtree(struct dump_context *dump_ctx)
+{
+ struct diritem *item = NULL;
+ struct dump_context *new_dump_ctx = NULL;
+ int result;
+ for (item = dump_ctx->list; item; item = item->next) {
+ uint16_t attribute = FILE_ATTRIBUTE_DIRECTORY
+ | FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN;
+ NTSTATUS status;
+ char *mask = NULL;
+
+ new_dump_ctx = talloc_zero(dump_ctx, struct dump_context);
+
+ if (new_dump_ctx == NULL) {
+ DBG_ERR("out of memory\n");
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+ if (item->targetcli == NULL) {
+ status = cli_resolve_path(new_dump_ctx,
+ "",
+ dump_ctx->creds,
+ dump_ctx->cli,
+ item->dirname,
+ &item->targetcli,
+ &item->targetpath);
+ if (!NT_STATUS_IS_OK(status)) {
+ DBG_ERR("failed to resolve path %s "
+ "error: %s\n",
+ item->dirname, nt_errstr(status));
+ result = EXIT_FAILED;
+ goto out;
+ }
+ }
+ new_dump_ctx->creds = dump_ctx->creds;
+ new_dump_ctx->save_fd = dump_ctx->save_fd;
+ new_dump_ctx->stats = dump_ctx->stats;
+ new_dump_ctx->dir = item;
+ new_dump_ctx->cli = item->targetcli;
+
+ mask = talloc_asprintf(new_dump_ctx, "%s*",
+ new_dump_ctx->dir->targetpath);
+ status = cli_list(new_dump_ctx->dir->targetcli,
+ mask,
+ attribute, cacl_dump_dacl_cb, new_dump_ctx);
+
+ if (!NT_STATUS_IS_OK(status) ||
+ !NT_STATUS_IS_OK(new_dump_ctx->status)) {
+ NTSTATUS tmpstatus;
+ if (!NT_STATUS_IS_OK(status)) {
+ /*
+ * cli_list failed for some reason
+ * so we need to update the failure stat
+ */
+ new_dump_ctx->stats->failure += 1;
+ tmpstatus = status;
+ } else {
+ /* cacl_dump_dacl_cb should have updated stat */
+ tmpstatus = new_dump_ctx->status;
+ }
+ DBG_ERR("error %s: processing %s\n",
+ nt_errstr(tmpstatus), item->dirname);
+ result = EXIT_FAILED;
+ goto out;
+ }
+ result = dump_dacl_dirtree(new_dump_ctx);
+ if (result != EXIT_OK) {
+ goto out;
+ }
+ }
+
+ result = EXIT_OK;
+out:
+ TALLOC_FREE(new_dump_ctx);
+ return result;
+}
+
+static int cacl_dump_dacl(struct cli_state *cli,
+ struct cli_credentials *creds,
+ char *filename)
+{
+ int fileattr;
+ char *mask = NULL;
+ TALLOC_CTX *ctx = NULL;
+ bool isdirectory = false;
+ int result;
+ struct dump_context *dump_ctx = NULL;
+ struct save_restore_stats stats = {0};
+ struct diritem *item = NULL;
+ struct cli_state *targetcli = NULL;
+ char *targetpath = NULL;
+ NTSTATUS status;
+
+ ctx = talloc_init("cacl_dump");
+ if (ctx == NULL) {
+ DBG_ERR("out of memory\n");
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+ dump_ctx = talloc_zero(ctx, struct dump_context);
+ if (dump_ctx == NULL) {
+ DBG_ERR("out of memory\n");
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+ dump_ctx->save_fd = open(save_file,
+ O_CREAT | O_RDWR | O_TRUNC, S_IRUSR | S_IWUSR);
+
+ if (dump_ctx->save_fd < 0) {
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+ dump_ctx->creds = creds;
+ dump_ctx->cli = cli;
+ dump_ctx->stats = &stats;
+
+ /* ensure we have a filename that starts with '\' */
+ if (!filename || *filename != DIRSEP_CHAR) {
+ /* illegal or no filename */
+ result = EXIT_FAILED;
+ DBG_ERR("illegal or missing name '%s'\n", filename);
+ goto out;
+ }
+
+ status = cli_resolve_path(dump_ctx, "",
+ dump_ctx->creds,
+ dump_ctx->cli,
+ filename, &targetcli, &targetpath);
+ if (!NT_STATUS_IS_OK(status)) {
+ DBG_ERR("failed resolve %s\n", filename);
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+ fileattr = get_fileinfo(targetcli, targetpath);
+ isdirectory = (fileattr & FILE_ATTRIBUTE_DIRECTORY)
+ == FILE_ATTRIBUTE_DIRECTORY;
+
+ /*
+ * if we've got as far as here then we have already evaluated
+ * the args.
+ */
+ if (test_args) {
+ result = EXIT_OK;
+ goto out;
+ }
+
+ mask = NULL;
+ /* make sure we have a trailing '\*' for directory */
+ if (!isdirectory) {
+ mask = talloc_strdup(ctx, filename);
+ } else if (strlen(filename) > 1) {
+ mask = sanitize_dirname(ctx, filename);
+ } else {
+ /* filename is a single '\' */
+ mask = talloc_strdup(ctx, filename);
+ }
+ if (!mask) {
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+ write_dacl(dump_ctx, targetcli, targetpath, filename);
+ if (isdirectory && recurse) {
+ item = talloc_zero(dump_ctx, struct diritem);
+ if (!item) {
+ result = EXIT_FAILED;
+ goto out;
+ }
+ item->dirname = mask;
+ DLIST_ADD_END(dump_ctx->list, item);
+ dump_dacl_dirtree(dump_ctx);
+ }
+
+ fprintf(stdout, "Successfully processed %d files: "
+ "Failed processing %d files\n",
+ dump_ctx->stats->success, dump_ctx->stats->failure);
+ result = EXIT_OK;
+out:
+ if (dump_ctx && dump_ctx->save_fd > 0) {
+ close(dump_ctx->save_fd);
+ }
+ TALLOC_FREE(ctx);
+ return result;
+}
+
+struct restore_dacl {
+ const char *path;
+ struct security_descriptor *sd;
+};
+
+/*
+ * Restore dacls from 'savefile' produced by
+ * 'icacls name /save' or 'smbcacls --save'
+ */
+static int cacl_restore(struct cli_state *cli,
+ struct cli_credentials *creds,
+ bool numeric, const char *restorefile)
+{
+ int restore_fd;
+ int result;
+ struct save_restore_stats stats = { 0 };
+
+ char **lines = NULL;
+ char *content = NULL;
+ char *convert_content = NULL;
+ size_t content_size;
+ struct restore_dacl *entries = NULL;
+ int numlines, i = 0;
+ bool ok;
+ struct dom_sid *sid = NULL;
+
+ if (restorefile == NULL) {
+ DBG_ERR("No restore file specified\n");
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+ if (test_args) {
+ result = EXIT_OK;
+ goto out;
+ }
+
+ restore_fd = open(restorefile, O_RDONLY, S_IRUSR | S_IWUSR);
+ if (restore_fd < 0) {
+ DBG_ERR("Failed to open %s.\n", restorefile);
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+ content = fd_load(restore_fd, &content_size, 0, talloc_tos());
+
+ close(restore_fd);
+
+ if (content == NULL) {
+ DBG_ERR("Failed to load content from %s.\n", restorefile);
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+ ok = convert_string_talloc(talloc_tos(),
+ CH_UTF16,
+ CH_UNIX,
+ content,
+ utf16_len_n(content, content_size),
+ (void **)(void *)&convert_content,
+ &content_size);
+
+ TALLOC_FREE(content);
+
+ if (!ok) {
+ DBG_ERR("Failed to convert content from %s "
+ "to CH_UNIX.\n", restorefile);
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+ lines = file_lines_parse(convert_content,
+ content_size, &numlines, talloc_tos());
+
+ if (lines == NULL) {
+ DBG_ERR("Failed to parse lines from content of %s.",
+ restorefile);
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+ entries = talloc_zero_array(lines, struct restore_dacl, numlines / 2);
+
+ if (entries == NULL) {
+ DBG_ERR("error processing %s, out of memory\n", restorefile);
+ result = EXIT_FAILED;
+ goto out;
+ }
+
+ sid = get_domain_sid(cli);
+
+ while (i < numlines) {
+ int index = i / 2;
+ int first_line = (i % 2) == 0;
+
+ if (first_line) {
+ char *tmp = NULL;
+ tmp = lines[i];
+ /* line can be blank if root of share */
+ if (strlen(tmp) == 0) {
+ entries[index].path = talloc_strdup(lines,
+ "\\");
+ } else {
+ entries[index].path = lines[i];
+ }
+ } else {
+ const char *msg = NULL;
+ size_t msg_offset = 0;
+ enum ace_condition_flags flags =
+ ACE_CONDITION_FLAG_ALLOW_DEVICE;
+ entries[index].sd = sddl_decode_err_msg(lines,
+ lines[i],
+ sid,
+ flags,
+ &msg,
+ &msg_offset);
+ if(entries[index].sd == NULL) {
+ DBG_ERR("could not decode '%s'\n", lines[i]);
+ if (msg != NULL) {
+ DBG_ERR(" %*c\n",
+ (int)msg_offset, '^');
+ DBG_ERR("error '%s'\n", msg);
+ }
+ result = EXIT_FAILED;
+ goto out;
+ }
+ entries[index].sd->type |=
+ SEC_DESC_DACL_AUTO_INHERIT_REQ;
+ entries[index].sd->type |= SEC_DESC_SACL_AUTO_INHERITED;
+ }
+ i++;
+ }
+ for (i = 0; i < (numlines / 2); i++) {
+ int mode = SMB_ACL_SET;
+ int set_result;
+ struct cli_state *targetcli = NULL;
+ char *targetpath = NULL;
+ NTSTATUS status;
+
+ /* check for dfs */
+ status = cli_resolve_path(talloc_tos(),
+ "",
+ creds,
+ cli,
+ entries[i].path,
+ &targetcli, &targetpath);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ printf("Error failed to process file: %s\n",
+ entries[i].path);
+ stats.failure += 1;
+ continue;
+ }
+
+ set_result = cacl_set_from_sd(targetcli,
+ targetpath,
+ entries[i].sd, mode, numeric);
+
+ if (set_result == EXIT_OK) {
+ printf("Successfully processed file: %s\n",
+ entries[i].path);
+ stats.success += 1;
+ } else {
+ printf("Error failed to process file: %s\n",
+ entries[i].path);
+ stats.failure += 1;
+ }
+ }
+
+ result = EXIT_OK;
+out:
+ TALLOC_FREE(lines);
+ fprintf(stdout, "Successfully processed %d files: "
+ "Failed processing %d files\n", stats.success, stats.failure);
+ return result;
+}
+
+/****************************************************************************
+ main program
+****************************************************************************/
+int main(int argc, char *argv[])
+{
+ const char **argv_const = discard_const_p(const char *, argv);
+ char *share;
+ int opt;
+ enum acl_mode mode = SMB_ACL_SET;
+ static char *the_acl = NULL;
+ enum chown_mode change_mode = REQUEST_NONE;
+ int result;
+ char *path;
+ char *filename = NULL;
+ poptContext pc;
+ /* numeric is set when the user wants numeric SIDs and ACEs rather
+ than going via LSA calls to resolve them */
+ int numeric = 0;
+ struct cli_state *targetcli = NULL;
+ struct cli_credentials *creds = NULL;
+ char *targetfile = NULL;
+ NTSTATUS status;
+ bool ok;
+ struct loadparm_context *lp_ctx = NULL;
+
+ struct poptOption long_options[] = {
+ POPT_AUTOHELP
+ {
+ .longName = "delete",
+ .shortName = 'D',
+ .argInfo = POPT_ARG_STRING,
+ .arg = NULL,
+ .val = 'D',
+ .descrip = "Delete an acl",
+ .argDescrip = "ACL",
+ },
+ {
+ .longName = "modify",
+ .shortName = 'M',
+ .argInfo = POPT_ARG_STRING,
+ .arg = NULL,
+ .val = 'M',
+ .descrip = "Modify an acl",
+ .argDescrip = "ACL",
+ },
+ {
+ .longName = "add",
+ .shortName = 'a',
+ .argInfo = POPT_ARG_STRING,
+ .arg = NULL,
+ .val = 'a',
+ .descrip = "Add an acl",
+ .argDescrip = "ACL",
+ },
+ {
+ .longName = "set",
+ .shortName = 'S',
+ .argInfo = POPT_ARG_STRING,
+ .arg = NULL,
+ .val = 'S',
+ .descrip = "Set acls",
+ .argDescrip = "ACLS",
+ },
+ {
+ .longName = "chown",
+ .shortName = 'C',
+ .argInfo = POPT_ARG_STRING,
+ .arg = NULL,
+ .val = 'C',
+ .descrip = "Change ownership of a file",
+ .argDescrip = "USERNAME",
+ },
+ {
+ .longName = "chgrp",
+ .shortName = 'G',
+ .argInfo = POPT_ARG_STRING,
+ .arg = NULL,
+ .val = 'G',
+ .descrip = "Change group ownership of a file",
+ .argDescrip = "GROUPNAME",
+ },
+ {
+ .longName = "inherit",
+ .shortName = 'I',
+ .argInfo = POPT_ARG_STRING,
+ .arg = NULL,
+ .val = 'I',
+ .descrip = "Inherit allow|remove|copy",
+ },
+ {
+ .longName = "propagate-inheritance",
+ .shortName = 0,
+ .argInfo = POPT_ARG_NONE,
+ .arg = &inheritance,
+ .val = 1,
+ .descrip = "Supports propagation of inheritable ACE(s) when used in conjunction with add, delete, set or modify",
+ },
+ {
+ .longName = "save",
+ .shortName = 0,
+ .argInfo = POPT_ARG_STRING,
+ .arg = &save_file,
+ .val = 1,
+ .descrip = "stores the DACLs in sddl format of the "
+ "specified file or folder for later use "
+ "with restore. SACLS, owner or integrity"
+ " labels are not stored",
+ },
+ {
+ .longName = "restore",
+ .shortName = 0,
+ .argInfo = POPT_ARG_STRING,
+ .arg = &restore_file,
+ .val = 1,
+ .descrip = "applies the stored DACLS to files in "
+ "directory.",
+ },
+ {
+ .longName = "recurse",
+ .shortName = 0,
+ .argInfo = POPT_ARG_NONE,
+ .arg = &recurse,
+ .val = 1,
+ .descrip = "indicates the operation is performed "
+ "on directory and all files/directories"
+ " below. (only applies to save option)",
+ },
+ {
+ .longName = "numeric",
+ .shortName = 0,
+ .argInfo = POPT_ARG_NONE,
+ .arg = &numeric,
+ .val = 1,
+ .descrip = "Don't resolve sids or masks to names",
+ },
+ {
+ .longName = "sddl",
+ .shortName = 0,
+ .argInfo = POPT_ARG_NONE,
+ .arg = &sddl,
+ .val = 1,
+ .descrip = "Output and input acls in sddl format",
+ },
+ {
+ .longName = "query-security-info",
+ .shortName = 0,
+ .argInfo = POPT_ARG_INT,
+ .arg = &query_sec_info,
+ .val = 1,
+ .descrip = "The security-info flags for queries"
+ },
+ {
+ .longName = "set-security-info",
+ .shortName = 0,
+ .argInfo = POPT_ARG_INT,
+ .arg = &set_sec_info,
+ .val = 1,
+ .descrip = "The security-info flags for modifications"
+ },
+ {
+ .longName = "test-args",
+ .shortName = 't',
+ .argInfo = POPT_ARG_NONE,
+ .arg = &test_args,
+ .val = 1,
+ .descrip = "Test arguments"
+ },
+ {
+ .longName = "domain-sid",
+ .shortName = 0,
+ .argInfo = POPT_ARG_STRING,
+ .arg = &domain_sid,
+ .val = 0,
+ .descrip = "Domain SID for sddl",
+ .argDescrip = "SID"},
+ {
+ .longName = "maximum-access",
+ .shortName = 'x',
+ .argInfo = POPT_ARG_NONE,
+ .arg = NULL,
+ .val = 'x',
+ .descrip = "Query maximum permissions",
+ },
+ POPT_COMMON_SAMBA
+ POPT_COMMON_CONNECTION
+ POPT_COMMON_CREDENTIALS
+ POPT_LEGACY_S3
+ POPT_COMMON_VERSION
+ POPT_TABLEEND
+ };
+
+ struct cli_state *cli;
+ TALLOC_CTX *frame = talloc_stackframe();
+ const char *owner_username = "";
+ char *server;
+
+ smb_init_locale();
+
+ ok = samba_cmdline_init(frame,
+ SAMBA_CMDLINE_CONFIG_CLIENT,
+ false /* require_smbconf */);
+ if (!ok) {
+ DBG_ERR("Failed to init cmdline parser!\n");
+ TALLOC_FREE(frame);
+ exit(1);
+ }
+ lp_ctx = samba_cmdline_get_lp_ctx();
+ /* set default debug level to 1 regardless of what smb.conf sets */
+ lpcfg_set_cmdline(lp_ctx, "log level", "1");
+
+ setlinebuf(stdout);
+
+ pc = samba_popt_get_context(getprogname(),
+ argc,
+ argv_const,
+ long_options,
+ 0);
+ if (pc == NULL) {
+ DBG_ERR("Failed to setup popt context!\n");
+ TALLOC_FREE(frame);
+ exit(1);
+ }
+
+ poptSetOtherOptionHelp(pc, "//server1/share1 filename\nACLs look like: "
+ "'ACL:user:[ALLOWED|DENIED]/flags/permissions'");
+
+ while ((opt = poptGetNextOpt(pc)) != -1) {
+ switch (opt) {
+ case 'S':
+ the_acl = smb_xstrdup(poptGetOptArg(pc));
+ mode = SMB_ACL_SET;
+ break;
+
+ case 'D':
+ the_acl = smb_xstrdup(poptGetOptArg(pc));
+ mode = SMB_ACL_DELETE;
+ break;
+
+ case 'M':
+ the_acl = smb_xstrdup(poptGetOptArg(pc));
+ mode = SMB_ACL_MODIFY;
+ break;
+
+ case 'a':
+ the_acl = smb_xstrdup(poptGetOptArg(pc));
+ mode = SMB_ACL_ADD;
+ break;
+
+ case 'C':
+ owner_username = poptGetOptArg(pc);
+ change_mode = REQUEST_CHOWN;
+ break;
+
+ case 'G':
+ owner_username = poptGetOptArg(pc);
+ change_mode = REQUEST_CHGRP;
+ break;
+
+ case 'I':
+ owner_username = poptGetOptArg(pc);
+ change_mode = REQUEST_INHERIT;
+ break;
+ case 'm':
+ lpcfg_set_cmdline(lp_ctx, "client max protocol", poptGetOptArg(pc));
+ break;
+ case 'x':
+ want_mxac = true;
+ break;
+ case POPT_ERROR_BADOPT:
+ fprintf(stderr, "\nInvalid option %s: %s\n\n",
+ poptBadOption(pc, 0), poptStrerror(opt));
+ poptPrintUsage(pc, stderr, 0);
+ exit(1);
+ }
+ }
+ if (inheritance && !the_acl) {
+ poptPrintUsage(pc, stderr, 0);
+ return -1;
+ }
+
+ if(!poptPeekArg(pc)) {
+ poptPrintUsage(pc, stderr, 0);
+ return -1;
+ }
+
+ path = talloc_strdup(frame, poptGetArg(pc));
+ if (!path) {
+ return -1;
+ }
+
+ if (strncmp(path, "\\\\", 2) && strncmp(path, "//", 2)) {
+ printf("Invalid argument: %s\n", path);
+ return -1;
+ }
+
+ if(!poptPeekArg(pc)) {
+ poptPrintUsage(pc, stderr, 0);
+ return -1;
+ }
+
+ filename = talloc_strdup(frame, poptGetArg(pc));
+ if (!filename) {
+ return -1;
+ }
+
+ poptFreeContext(pc);
+ samba_cmdline_burn(argc, argv);
+
+ string_replace(path,'/','\\');
+
+ server = talloc_strdup(frame, path+2);
+ if (!server) {
+ return -1;
+ }
+ share = strchr_m(server,'\\');
+ if (share == NULL) {
+ printf("Invalid argument\n");
+ return -1;
+ }
+
+ *share = 0;
+ share++;
+
+ creds = samba_cmdline_get_creds();
+
+ /* Make connection to server */
+ if (!test_args) {
+ cli = connect_one(creds, server, share);
+ if (!cli) {
+ exit(EXIT_FAILED);
+ }
+ } else {
+ exit(0);
+ }
+
+ string_replace(filename, '/', '\\');
+ if (filename[0] != '\\') {
+ filename = talloc_asprintf(frame,
+ "\\%s",
+ filename);
+ if (!filename) {
+ return -1;
+ }
+ }
+
+ status = cli_resolve_path(frame,
+ "",
+ creds,
+ cli,
+ filename,
+ &targetcli,
+ &targetfile);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(0,("cli_resolve_path failed for %s! (%s)\n", filename, nt_errstr(status)));
+ return -1;
+ }
+
+ /* Perform requested action */
+
+ if (change_mode == REQUEST_INHERIT) {
+ result = inherit(targetcli, targetfile, owner_username);
+ } else if (change_mode != REQUEST_NONE) {
+ result = owner_set(targetcli, change_mode, targetfile, owner_username);
+ } else if (the_acl) {
+ if (inheritance) {
+ struct cacl_callback_state cbstate = {
+ .creds = creds,
+ .cli = targetcli,
+ .mode = mode,
+ .the_acl = the_acl,
+ .numeric = numeric,
+ };
+ result = inheritance_cacl_set(targetfile, &cbstate);
+ } else {
+ result = cacl_set(targetcli,
+ targetfile,
+ the_acl,
+ mode,
+ numeric);
+ }
+ } else {
+ if (save_file || restore_file) {
+ sddl = 1;
+ if (save_file) {
+ result = cacl_dump_dacl(cli, creds, filename);
+ } else {
+ result = cacl_restore(targetcli,
+ creds,
+ numeric, restore_file);
+ }
+ } else {
+ result = cacl_dump(targetcli, targetfile, numeric);
+ }
}
+ gfree_all();
TALLOC_FREE(frame);
return result;