s3: Make sharesec optionally use sddl

diff --git a/source3/utils/sharesec.c b/source3/utils/sharesec.c
index ab52e4727a25f7015fe2e3769be40441f710ca72..641a2ce140e4ae24063cdbad882e39c1abdd8e51 100644 (file)
--- a/source3/utils/sharesec.c
+++ b/source3/utils/sharesec.c
@@ -34,6 +34,8 @@ enum acl_mode { SMB_ACL_DELETE,
                SMB_ACL_ADD,
                SMB_ACL_SET,
                SMB_SD_DELETE,
+               SMB_SD_SETSDDL,
+               SMB_SD_VIEWSDDL,
                SMB_ACL_VIEW };
 
 struct perm_value {
@@ -497,6 +499,9 @@ static int change_share_sec(TALLOC_CTX *mem_ctx, const char *sharename, char *th
                return -1;
            }
            return 0;
+       default:
+               fprintf(stderr, "invalid command\n");
+               return -1;
        }
 
        /* Denied ACE entries must come before allowed ones */
@@ -509,6 +514,53 @@ static int change_share_sec(TALLOC_CTX *mem_ctx, const char *sharename, char *th
        return 0;
 }
 
+static int set_sharesec_sddl(const char *sharename, const char *sddl)
+{
+       struct security_descriptor *sd;
+       bool ret;
+
+       sd = sddl_decode(talloc_tos(), sddl, get_global_sam_sid());
+       if (sd == NULL) {
+               fprintf(stderr, "Failed to parse acl\n");
+               return -1;
+       }
+
+       ret = set_share_security(sharename, sd);
+       TALLOC_FREE(sd);
+       if (!ret) {
+               fprintf(stderr, "Failed to store acl for share [%s]\n",
+                       sharename);
+               return -1;
+       }
+
+       return 0;
+}
+
+static int view_sharesec_sddl(const char *sharename)
+{
+       struct security_descriptor *sd;
+       size_t sd_size;
+       char *acl;
+
+       sd = get_share_security(talloc_tos(), sharename, &sd_size);
+       if (sd == NULL) {
+               fprintf(stderr, "Unable to retrieve permissions for share "
+                       "[%s]\n", sharename);
+               return -1;
+       }
+
+       acl = sddl_encode(talloc_tos(), sd, get_global_sam_sid());
+       TALLOC_FREE(sd);
+       if (acl == NULL) {
+               fprintf(stderr, "Unable to sddl-encode permissions for share "
+                       "[%s]\n", sharename);
+               return -1;
+       }
+       printf("%s\n", acl);
+       TALLOC_FREE(acl);
+       return 0;
+}
+
 /********************************************************************
   main program
 ********************************************************************/
@@ -531,6 +583,10 @@ int main(int argc, const char *argv[])
                { "add", 'a', POPT_ARG_STRING, &the_acl, 'a', "Add ACEs", "ACL" },
                { "replace", 'R', POPT_ARG_STRING, &the_acl, 'R', "Overwrite share permission ACL", "ACLS" },
                { "delete", 'D', POPT_ARG_NONE, NULL, 'D', "Delete the entire security descriptor" },
+               { "setsddl", 'S', POPT_ARG_STRING, the_acl, 'S',
+                 "Set the SD in sddl format" },
+               { "viewsddl", 'V', POPT_ARG_NONE, the_acl, 'V',
+                 "View the SD in sddl format" },
                { "view", 'v', POPT_ARG_NONE, NULL, 'v', "View current share permissions" },
                { "machine-sid", 'M', POPT_ARG_NONE, NULL, 'M', "Initialize the machine SID" },
                { "force", 'F', POPT_ARG_NONE, NULL, 'F', "Force storing the ACL", "ACLS" },
@@ -580,6 +636,15 @@ int main(int argc, const char *argv[])
                        mode = SMB_SD_DELETE;
                        break;
 
+               case 'S':
+                       mode = SMB_SD_SETSDDL;
+                       the_acl = smb_xstrdup(poptGetOptArg(pc));
+                       break;
+
+               case 'V':
+                       mode = SMB_SD_VIEWSDDL;
+                       break;
+
                case 'v':
                        mode = SMB_ACL_VIEW;
                        break;
@@ -634,7 +699,17 @@ int main(int argc, const char *argv[])
                return -1;
        }
 
-       retval = change_share_sec(ctx, sharename, the_acl, mode);
+       switch (mode) {
+       case SMB_SD_SETSDDL:
+               retval = set_sharesec_sddl(sharename, the_acl);
+               break;
+       case SMB_SD_VIEWSDDL:
+               retval = view_sharesec_sddl(sharename);
+               break;
+       default:
+               retval = change_share_sec(ctx, sharename, the_acl, mode);
+               break;
+       }
 
        talloc_destroy(ctx);