source3/libads/disp_sec.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Samba utility functions. ADS stuff
   4    Copyright (C) Alexey Kotovich 2002
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21
  22 static struct perm_mask_str {
  23         uint32  mask;
  24         const char   *str;
  25 } perms[] = {
  26         {SEC_RIGHTS_FULL_CTRL,          "[Full Control]"},
  27
  28         {SEC_RIGHTS_LIST_CONTENTS,      "[List Contents]"},
  29         {SEC_RIGHTS_LIST_OBJECT,        "[List Object]"},
  30
  31         {SEC_RIGHTS_READ_ALL_PROP,      "[Read All Properties]"},
  32         {SEC_RIGHTS_READ_PERMS,         "[Read Permissions]"},
  33
  34         {SEC_RIGHTS_WRITE_ALL_VALID,    "[All validate writes]"},
  35         {SEC_RIGHTS_WRITE_ALL_PROP,     "[Write All Properties]"},
  36
  37         {SEC_RIGHTS_MODIFY_PERMS,       "[Modify Permissions]"},
  38         {SEC_RIGHTS_MODIFY_OWNER,       "[Modify Owner]"},
  39
  40         {SEC_RIGHTS_CREATE_CHILD,       "[Create All Child Objects]"},
  41
  42         {SEC_RIGHTS_DELETE,             "[Delete]"},
  43         {SEC_RIGHTS_DELETE_SUBTREE,     "[Delete Subtree]"},
  44         {SEC_RIGHTS_DELETE_CHILD,       "[Delete All Child Objects]"},
  45
  46         {SEC_RIGHTS_CHANGE_PASSWD,      "[Change Password]"},
  47         {SEC_RIGHTS_RESET_PASSWD,       "[Reset Password]"},
  48
  49         {SEC_RIGHTS_APPLY_GROUP_POLICY, "[Apply Group Policy]"},
  50
  51         {0,                             0}
  52 };
  53
  54 /* convert a security permissions into a string */
  55 static void ads_disp_perms(uint32 type)
  56 {
  57         int i = 0;
  58         int j = 0;
  59
  60         printf("Permissions: ");
  61
  62         if (type == SEC_RIGHTS_FULL_CTRL) {
  63                 printf("%s\n", perms[j].str);
  64                 return;
  65         }
  66
  67         for (i = 0; i < 32; i++) {
  68                 if (type & (1 << i)) {
  69                         for (j = 1; perms[j].str; j ++) {
  70                                 if (perms[j].mask == (((unsigned) 1) << i)) {
  71                                         printf("\n\t%s (0x%08x)", perms[j].str, perms[j].mask);
  72                                 }
  73                         }
  74                         type &= ~(1 << i);
  75                 }
  76         }
  77
  78         /* remaining bits get added on as-is */
  79         if (type != 0) {
  80                 printf("[%08x]", type);
  81         }
  82         puts("");
  83 }
  84
  85 static void ads_disp_sec_ace_object(struct security_ace_object *object)
  86 {
  87         if (object->flags & SEC_ACE_OBJECT_PRESENT) {
  88                 printf("Object type: SEC_ACE_OBJECT_PRESENT\n");
  89                 printf("Object GUID: %s\n", smb_uuid_string_static(
  90                         object->type.type));
  91         }
  92         if (object->flags & SEC_ACE_OBJECT_INHERITED_PRESENT) {
  93                 printf("Object type: SEC_ACE_OBJECT_INHERITED_PRESENT\n");
  94                 printf("Object GUID: %s\n", smb_uuid_string_static(
  95                         object->inherited_type.inherited_type));
  96         }
  97 }
  98
  99 /* display ACE */
 100 static void ads_disp_ace(SEC_ACE *sec_ace)
 101 {
 102         const char *access_type = "UNKNOWN";
 103
 104         if (!sec_ace_object(sec_ace->type)) {
 105                 printf("------- ACE (type: 0x%02x, flags: 0x%02x, size: 0x%02x, mask: 0x%x)\n",
 106                   sec_ace->type,
 107                   sec_ace->flags,
 108                   sec_ace->size,
 109                   sec_ace->access_mask);
 110         } else {
 111                 printf("------- ACE (type: 0x%02x, flags: 0x%02x, size: 0x%02x, mask: 0x%x, object flags: 0x%x)\n",
 112                   sec_ace->type,
 113                   sec_ace->flags,
 114                   sec_ace->size,
 115                   sec_ace->access_mask,
 116                   sec_ace->object.object.flags);
 117         }
 118
 119         if (sec_ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED) {
 120                 access_type = "ALLOWED";
 121         } else if (sec_ace->type == SEC_ACE_TYPE_ACCESS_DENIED) {
 122                 access_type = "DENIED";
 123         } else if (sec_ace->type == SEC_ACE_TYPE_SYSTEM_AUDIT) {
 124                 access_type = "SYSTEM AUDIT";
 125         } else if (sec_ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT) {
 126                 access_type = "ALLOWED OBJECT";
 127         } else if (sec_ace->type == SEC_ACE_TYPE_ACCESS_DENIED_OBJECT) {
 128                 access_type = "DENIED OBJECT";
 129         } else if (sec_ace->type == SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT) {
 130                 access_type = "AUDIT OBJECT";
 131         }
 132
 133         printf("access SID:  %s\naccess type: %s\n",
 134                sid_string_static(&sec_ace->trustee), access_type);
 135
 136         if (sec_ace_object(sec_ace->type)) {
 137                 ads_disp_sec_ace_object(&sec_ace->object.object);
 138         }
 139
 140         ads_disp_perms(sec_ace->access_mask);
 141 }
 142
 143 /* display ACL */
 144 static void ads_disp_acl(SEC_ACL *sec_acl, const char *type)
 145 {
 146         if (!sec_acl)
 147                 printf("------- (%s) ACL not present\n", type);
 148         else {
 149                 printf("------- (%s) ACL (revision: %d, size: %d, number of ACEs: %d)\n",
 150                        type,
 151                        sec_acl->revision,
 152                        sec_acl->size,
 153                        sec_acl->num_aces);
 154         }
 155 }
 156
 157 /* display SD */
 158 void ads_disp_sd(SEC_DESC *sd)
 159 {
 160         int i;
 161
 162         printf("-------------- Security Descriptor (revision: %d, type: 0x%02x)\n",
 163                sd->revision,
 164                sd->type);
 165         printf("owner SID: %s\n", sid_string_static(sd->owner_sid));
 166         printf("group SID: %s\n", sid_string_static(sd->group_sid));
 167
 168         ads_disp_acl(sd->sacl, "system");
 169         for (i = 0; i < sd->sacl->num_aces; i ++)
 170                 ads_disp_ace(&sd->sacl->aces[i]);
 171
 172         ads_disp_acl(sd->dacl, "user");
 173         for (i = 0; i < sd->dacl->num_aces; i ++)
 174                 ads_disp_ace(&sd->dacl->aces[i]);
 175
 176         printf("-------------- End Of Security Descriptor\n");
 177 }
 178
 179