Given Jeremy's positive response, and a lack of one from tpot, I'll commit
[kai/samba.git] / source3 / utils / smbcacls.c
1 /* 
2    Unix SMB/CIFS implementation.
3    ACL get/set utility
4    
5    Copyright (C) Andrew Tridgell 2000
6    Copyright (C) Tim Potter      2000
7    Copyright (C) Jeremy Allison  2000
8    
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 2 of the License, or
12    (at your option) any later version.
13    
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18    
19    You should have received a copy of the GNU General Public License
20    along with this program; if not, write to the Free Software
21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 */
23
24 #include "includes.h"
25
26 static fstring password;
27 static pstring username;
28 static pstring owner_username;
29 static fstring server;
30 static int got_pass;
31 static int test_args;
32 TALLOC_CTX *ctx;
33
34 #define CREATE_ACCESS_READ READ_CONTROL_ACCESS
35 #define CREATE_ACCESS_WRITE (WRITE_DAC_ACCESS | WRITE_OWNER_ACCESS)
36
37 /* numeric is set when the user wants numeric SIDs and ACEs rather
38    than going via LSA calls to resolve them */
39 static int numeric;
40
41 enum acl_mode {SMB_ACL_SET, SMB_ACL_DELETE, SMB_ACL_MODIFY, SMB_ACL_ADD };
42 enum chown_mode {REQUEST_NONE, REQUEST_CHOWN, REQUEST_CHGRP};
43 enum exit_values {EXIT_OK, EXIT_FAILED, EXIT_PARSE_ERROR};
44
45 extern pstring global_myname;
46 extern fstring global_myworkgroup;
47
48 struct perm_value {
49         char *perm;
50         uint32 mask;
51 };
52
53 /* These values discovered by inspection */
54
55 static struct perm_value special_values[] = {
56         { "R", 0x00120089 },
57         { "W", 0x00120116 },
58         { "X", 0x001200a0 },
59         { "D", 0x00010000 },
60         { "P", 0x00040000 },
61         { "O", 0x00080000 },
62         { NULL, 0 },
63 };
64
65 static struct perm_value standard_values[] = {
66         { "READ",   0x001200a9 },
67         { "CHANGE", 0x001301bf },
68         { "FULL",   0x001f01ff },
69         { NULL, 0 },
70 };
71
72 static struct cli_state *global_hack_cli;
73 static POLICY_HND pol;
74 static BOOL got_policy_hnd;
75
76 static struct cli_state *connect_one(char *share);
77
78 /* Open cli connection and policy handle */
79
80 static BOOL cacls_open_policy_hnd(void)
81 {
82         /* Initialise cli LSA connection */
83
84         if (!global_hack_cli) {
85                 global_hack_cli = connect_one("IPC$");
86                 if (!cli_nt_session_open (global_hack_cli, PIPE_LSARPC)) {
87                                 return False;
88                 }
89         }
90         
91         /* Open policy handle */
92
93         if (!got_policy_hnd) {
94
95                 /* Some systems don't support SEC_RIGHTS_MAXIMUM_ALLOWED,
96                    but NT sends 0x2000000 so we might as well do it too. */
97
98                 if (!NT_STATUS_IS_OK(cli_lsa_open_policy(global_hack_cli, global_hack_cli->mem_ctx, True, 
99                                                          GENERIC_EXECUTE_ACCESS, &pol))) {
100                         return False;
101                 }
102
103                 got_policy_hnd = True;
104         }
105         
106         return True;
107 }
108
109 /* convert a SID to a string, either numeric or username/group */
110 static void SidToString(fstring str, DOM_SID *sid)
111 {
112         char **domains = NULL;
113         char **names = NULL;
114         uint32 *types = NULL;
115
116         sid_to_string(str, sid);
117
118         if (numeric) return;
119
120         /* Ask LSA to convert the sid to a name */
121
122         if (!cacls_open_policy_hnd() ||
123             !NT_STATUS_IS_OK(cli_lsa_lookup_sids(global_hack_cli, global_hack_cli->mem_ctx,  
124                                                  &pol, 1, sid, &domains, 
125                                                  &names, &types)) ||
126             !domains || !domains[0] || !names || !names[0]) {
127                 return;
128         }
129
130         /* Converted OK */
131
132         slprintf(str, sizeof(fstring) - 1, "%s%s%s",
133                  domains[0], lp_winbind_separator(),
134                  names[0]);
135         
136 }
137
138 /* convert a string to a SID, either numeric or username/group */
139 static BOOL StringToSid(DOM_SID *sid, const char *str)
140 {
141         uint32 *types = NULL;
142         DOM_SID *sids = NULL;
143         BOOL result = True;
144
145         if (strncmp(str, "S-", 2) == 0) {
146                 return string_to_sid(sid, str);
147         }
148
149         if (!cacls_open_policy_hnd() ||
150             !NT_STATUS_IS_OK(cli_lsa_lookup_names(global_hack_cli, global_hack_cli->mem_ctx, 
151                                                   &pol, 1, &str, &sids, 
152                                                   &types))) {
153                 result = False;
154                 goto done;
155         }
156
157         sid_copy(sid, &sids[0]);
158
159  done:
160
161         return result;
162 }
163
164
165 /* print an ACE on a FILE, using either numeric or ascii representation */
166 static void print_ace(FILE *f, SEC_ACE *ace)
167 {
168         struct perm_value *v;
169         fstring sidstr;
170         int do_print = 0;
171         uint32 got_mask;
172
173         SidToString(sidstr, &ace->trustee);
174
175         fprintf(f, "%s:", sidstr);
176
177         if (numeric) {
178                 fprintf(f, "%d/%d/0x%08x", 
179                         ace->type, ace->flags, ace->info.mask);
180                 return;
181         }
182
183         /* Ace type */
184
185         if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED) {
186                 fprintf(f, "ALLOWED");
187         } else if (ace->type == SEC_ACE_TYPE_ACCESS_DENIED) {
188                 fprintf(f, "DENIED");
189         } else {
190                 fprintf(f, "%d", ace->type);
191         }
192
193         /* Not sure what flags can be set in a file ACL */
194
195         fprintf(f, "/%d/", ace->flags);
196
197         /* Standard permissions */
198
199         for (v = standard_values; v->perm; v++) {
200                 if (ace->info.mask == v->mask) {
201                         fprintf(f, "%s", v->perm);
202                         return;
203                 }
204         }
205
206         /* Special permissions.  Print out a hex value if we have
207            leftover bits in the mask. */
208
209         got_mask = ace->info.mask;
210
211  again:
212         for (v = special_values; v->perm; v++) {
213                 if ((ace->info.mask & v->mask) == v->mask) {
214                         if (do_print) {
215                                 fprintf(f, "%s", v->perm);
216                         }
217                         got_mask &= ~v->mask;
218                 }
219         }
220
221         if (!do_print) {
222                 if (got_mask != 0) {
223                         fprintf(f, "0x%08x", ace->info.mask);
224                 } else {
225                         do_print = 1;
226                         goto again;
227                 }
228         }
229 }
230
231
232 /* parse an ACE in the same format as print_ace() */
233 static BOOL parse_ace(SEC_ACE *ace, char *str)
234 {
235         char *p;
236         fstring tok;
237         unsigned atype, aflags, amask;
238         DOM_SID sid;
239         SEC_ACCESS mask;
240         struct perm_value *v;
241
242         ZERO_STRUCTP(ace);
243         p = strchr_m(str,':');
244         if (!p) return False;
245         *p = '\0';
246         p++;
247
248         /* Try to parse numeric form */
249
250         if (sscanf(p, "%i/%i/%i", &atype, &aflags, &amask) == 3 &&
251             StringToSid(&sid, str)) {
252                 goto done;
253         }
254
255         /* Try to parse text form */
256
257         if (!StringToSid(&sid, str)) {
258                 return False;
259         }
260
261         if (!next_token(&p, tok, "/", sizeof(fstring))) {
262                 return False;
263         }
264
265         if (strncmp(tok, "ALLOWED", strlen("ALLOWED")) == 0) {
266                 atype = SEC_ACE_TYPE_ACCESS_ALLOWED;
267         } else if (strncmp(tok, "DENIED", strlen("DENIED")) == 0) {
268                 atype = SEC_ACE_TYPE_ACCESS_DENIED;
269         } else {
270                 return False;
271         }
272
273         /* Only numeric form accepted for flags at present */
274
275         if (!(next_token(&p, tok, "/", sizeof(fstring)) &&
276               sscanf(tok, "%i", &aflags))) {
277                 return False;
278         }
279
280         if (!next_token(&p, tok, "/", sizeof(fstring))) {
281                 return False;
282         }
283
284         if (strncmp(tok, "0x", 2) == 0) {
285                 if (sscanf(tok, "%i", &amask) != 1) {
286                         return False;
287                 }
288                 goto done;
289         }
290
291         for (v = standard_values; v->perm; v++) {
292                 if (strcmp(tok, v->perm) == 0) {
293                         amask = v->mask;
294                         goto done;
295                 }
296         }
297
298         p = tok;
299
300         while(*p) {
301                 BOOL found = False;
302
303                 for (v = special_values; v->perm; v++) {
304                         if (v->perm[0] == *p) {
305                                 amask |= v->mask;
306                                 found = True;
307                         }
308                 }
309
310                 if (!found) return False;
311                 p++;
312         }
313
314         if (*p) {
315                 return False;
316         }
317
318  done:
319         mask.mask = amask;
320         init_sec_ace(ace, &sid, atype, mask, aflags);
321         return True;
322 }
323
324 /* add an ACE to a list of ACEs in a SEC_ACL */
325 static BOOL add_ace(SEC_ACL **the_acl, SEC_ACE *ace)
326 {
327         SEC_ACL *new;
328         SEC_ACE *aces;
329         if (! *the_acl) {
330                 (*the_acl) = make_sec_acl(ctx, 3, 1, ace);
331                 return True;
332         }
333
334         aces = calloc(1+(*the_acl)->num_aces,sizeof(SEC_ACE));
335         memcpy(aces, (*the_acl)->ace, (*the_acl)->num_aces * sizeof(SEC_ACE));
336         memcpy(aces+(*the_acl)->num_aces, ace, sizeof(SEC_ACE));
337         new = make_sec_acl(ctx,(*the_acl)->revision,1+(*the_acl)->num_aces, aces);
338         SAFE_FREE(aces);
339         (*the_acl) = new;
340         return True;
341 }
342
343 /* parse a ascii version of a security descriptor */
344 static SEC_DESC *sec_desc_parse(char *str)
345 {
346         char *p = str;
347         fstring tok;
348         SEC_DESC *ret;
349         size_t sd_size;
350         DOM_SID *grp_sid=NULL, *owner_sid=NULL;
351         SEC_ACL *dacl=NULL;
352         int revision=1;
353
354         while (next_token(&p, tok, "\t,\r\n", sizeof(tok))) {
355
356                 if (strncmp(tok,"REVISION:", 9) == 0) {
357                         revision = strtol(tok+9, NULL, 16);
358                         continue;
359                 }
360
361                 if (strncmp(tok,"OWNER:", 6) == 0) {
362                         owner_sid = (DOM_SID *)calloc(1, sizeof(DOM_SID));
363                         if (!owner_sid ||
364                             !StringToSid(owner_sid, tok+6)) {
365                                 printf("Failed to parse owner sid\n");
366                                 return NULL;
367                         }
368                         continue;
369                 }
370
371                 if (strncmp(tok,"GROUP:", 6) == 0) {
372                         grp_sid = (DOM_SID *)calloc(1, sizeof(DOM_SID));
373                         if (!grp_sid ||
374                             !StringToSid(grp_sid, tok+6)) {
375                                 printf("Failed to parse group sid\n");
376                                 return NULL;
377                         }
378                         continue;
379                 }
380
381                 if (strncmp(tok,"ACL:", 4) == 0) {
382                         SEC_ACE ace;
383                         if (!parse_ace(&ace, tok+4)) {
384                                 printf("Failed to parse ACL %s\n", tok);
385                                 return NULL;
386                         }
387                         if(!add_ace(&dacl, &ace)) {
388                                 printf("Failed to add ACL %s\n", tok);
389                                 return NULL;
390                         }
391                         continue;
392                 }
393
394                 printf("Failed to parse security descriptor\n");
395                 return NULL;
396         }
397
398         ret = make_sec_desc(ctx,revision, owner_sid, grp_sid, 
399                             NULL, dacl, &sd_size);
400
401         SAFE_FREE(grp_sid);
402         SAFE_FREE(owner_sid);
403
404         return ret;
405 }
406
407
408 /* print a ascii version of a security descriptor on a FILE handle */
409 static void sec_desc_print(FILE *f, SEC_DESC *sd)
410 {
411         fstring sidstr;
412         uint32 i;
413
414         printf("REVISION:%d\n", sd->revision);
415
416         /* Print owner and group sid */
417
418         if (sd->owner_sid) {
419                 SidToString(sidstr, sd->owner_sid);
420         } else {
421                 fstrcpy(sidstr, "");
422         }
423
424         printf("OWNER:%s\n", sidstr);
425
426         if (sd->grp_sid) {
427                 SidToString(sidstr, sd->grp_sid);
428         } else {
429                 fstrcpy(sidstr, "");
430         }
431
432         fprintf(f, "GROUP:%s\n", sidstr);
433
434         /* Print aces */
435         for (i = 0; sd->dacl && i < sd->dacl->num_aces; i++) {
436                 SEC_ACE *ace = &sd->dacl->ace[i];
437                 fprintf(f, "ACL:");
438                 print_ace(f, ace);
439                 fprintf(f, "\n");
440         }
441
442 }
443
444 /***************************************************** 
445 dump the acls for a file
446 *******************************************************/
447 static int cacl_dump(struct cli_state *cli, char *filename)
448 {
449         int fnum;
450         SEC_DESC *sd;
451
452         if (test_args) return EXIT_OK;
453
454         fnum = cli_nt_create(cli, filename, CREATE_ACCESS_READ);
455         if (fnum == -1) {
456                 printf("Failed to open %s: %s\n", filename, cli_errstr(cli));
457                 return EXIT_FAILED;
458         }
459
460         sd = cli_query_secdesc(cli, fnum, ctx);
461
462         if (!sd) {
463                 printf("ERROR: secdesc query failed: %s\n", cli_errstr(cli));
464                 return EXIT_FAILED;
465         }
466
467         sec_desc_print(stdout, sd);
468
469         cli_close(cli, fnum);
470
471         return EXIT_OK;
472 }
473
474 /***************************************************** 
475 Change the ownership or group ownership of a file. Just
476 because the NT docs say this can't be done :-). JRA.
477 *******************************************************/
478
479 static int owner_set(struct cli_state *cli, enum chown_mode change_mode, 
480                      char *filename, char *new_username)
481 {
482         int fnum;
483         DOM_SID sid;
484         SEC_DESC *sd, *old;
485         size_t sd_size;
486
487         fnum = cli_nt_create(cli, filename, CREATE_ACCESS_READ);
488
489         if (fnum == -1) {
490                 printf("Failed to open %s: %s\n", filename, cli_errstr(cli));
491                 return EXIT_FAILED;
492         }
493
494         if (!StringToSid(&sid, new_username))
495                 return EXIT_PARSE_ERROR;
496
497         old = cli_query_secdesc(cli, fnum, ctx);
498
499         cli_close(cli, fnum);
500
501         if (!old) {
502                 printf("owner_set: Failed to query old descriptor\n");
503                 return EXIT_FAILED;
504         }
505
506         sd = make_sec_desc(ctx,old->revision,
507                                 (change_mode == REQUEST_CHOWN) ? &sid : old->owner_sid,
508                                 (change_mode == REQUEST_CHGRP) ? &sid : old->grp_sid,
509                            NULL, old->dacl, &sd_size);
510
511         fnum = cli_nt_create(cli, filename, CREATE_ACCESS_WRITE);
512
513         if (fnum == -1) {
514                 printf("Failed to open %s: %s\n", filename, cli_errstr(cli));
515                 return EXIT_FAILED;
516         }
517
518         if (!cli_set_secdesc(cli, fnum, sd)) {
519                 printf("ERROR: secdesc set failed: %s\n", cli_errstr(cli));
520         }
521
522         cli_close(cli, fnum);
523
524         return EXIT_OK;
525 }
526
527
528 /* The MSDN is contradictory over the ordering of ACE entries in an ACL.
529    However NT4 gives a "The information may have been modified by a
530    computer running Windows NT 5.0" if denied ACEs do not appear before
531    allowed ACEs. */
532
533 static int ace_compare(SEC_ACE *ace1, SEC_ACE *ace2)
534 {
535         if (sec_ace_equal(ace1, ace2)) 
536                 return 0;
537
538         if (ace1->type != ace2->type) 
539                 return ace2->type - ace1->type;
540
541         if (sid_compare(&ace1->trustee, &ace2->trustee)) 
542                 return sid_compare(&ace1->trustee, &ace2->trustee);
543
544         if (ace1->flags != ace2->flags) 
545                 return ace1->flags - ace2->flags;
546
547         if (ace1->info.mask != ace2->info.mask) 
548                 return ace1->info.mask - ace2->info.mask;
549
550         if (ace1->size != ace2->size) 
551                 return ace1->size - ace2->size;
552
553         return memcmp(ace1, ace2, sizeof(SEC_ACE));
554 }
555
556 static void sort_acl(SEC_ACL *the_acl)
557 {
558         uint32 i;
559         if (!the_acl) return;
560
561         qsort(the_acl->ace, the_acl->num_aces, sizeof(the_acl->ace[0]), QSORT_CAST ace_compare);
562
563         for (i=1;i<the_acl->num_aces;) {
564                 if (sec_ace_equal(&the_acl->ace[i-1], &the_acl->ace[i])) {
565                         int j;
566                         for (j=i; j<the_acl->num_aces-1; j++) {
567                                 the_acl->ace[j] = the_acl->ace[j+1];
568                         }
569                         the_acl->num_aces--;
570                 } else {
571                         i++;
572                 }
573         }
574 }
575
576 /***************************************************** 
577 set the ACLs on a file given an ascii description
578 *******************************************************/
579 static int cacl_set(struct cli_state *cli, char *filename, 
580                     char *the_acl, enum acl_mode mode)
581 {
582         int fnum;
583         SEC_DESC *sd, *old;
584         uint32 i, j;
585         size_t sd_size;
586         int result = EXIT_OK;
587
588         sd = sec_desc_parse(the_acl);
589
590         if (!sd) return EXIT_PARSE_ERROR;
591         if (test_args) return EXIT_OK;
592
593         /* The desired access below is the only one I could find that works
594            with NT4, W2KP and Samba */
595
596         fnum = cli_nt_create(cli, filename, CREATE_ACCESS_READ);
597
598         if (fnum == -1) {
599                 printf("cacl_set failed to open %s: %s\n", filename, cli_errstr(cli));
600                 return EXIT_FAILED;
601         }
602
603         old = cli_query_secdesc(cli, fnum, ctx);
604
605         if (!old) {
606                 printf("calc_set: Failed to query old descriptor\n");
607                 return EXIT_FAILED;
608         }
609
610         cli_close(cli, fnum);
611
612         /* the logic here is rather more complex than I would like */
613         switch (mode) {
614         case SMB_ACL_DELETE:
615                 for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
616                         BOOL found = False;
617
618                         for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
619                                 if (sec_ace_equal(&sd->dacl->ace[i],
620                                                   &old->dacl->ace[j])) {
621                                         uint32 k;
622                                         for (k=j; k<old->dacl->num_aces-1;k++) {
623                                                 old->dacl->ace[k] = old->dacl->ace[k+1];
624                                         }
625                                         old->dacl->num_aces--;
626                                         if (old->dacl->num_aces == 0) {
627                                                 SAFE_FREE(old->dacl->ace);
628                                                 SAFE_FREE(old->dacl);
629                                                 old->off_dacl = 0;
630                                         }
631                                         found = True;
632                                         break;
633                                 }
634                         }
635
636                         if (!found) {
637                                 printf("ACL for ACE:"); 
638                                 print_ace(stdout, &sd->dacl->ace[i]);
639                                 printf(" not found\n");
640                         }
641                 }
642                 break;
643
644         case SMB_ACL_MODIFY:
645                 for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
646                         BOOL found = False;
647
648                         for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
649                                 if (sid_equal(&sd->dacl->ace[i].trustee,
650                                               &old->dacl->ace[j].trustee)) {
651                                         old->dacl->ace[j] = sd->dacl->ace[i];
652                                         found = True;
653                                 }
654                         }
655
656                         if (!found) {
657                                 fstring str;
658
659                                 SidToString(str, &sd->dacl->ace[i].trustee);
660                                 printf("ACL for SID %s not found\n", str);
661                         }
662                 }
663
664                 break;
665
666         case SMB_ACL_ADD:
667                 for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
668                         add_ace(&old->dacl, &sd->dacl->ace[i]);
669                 }
670                 break;
671
672         case SMB_ACL_SET:
673                 old = sd;
674                 break;
675         }
676
677         /* Denied ACE entries must come before allowed ones */
678         sort_acl(old->dacl);
679
680         /* Create new security descriptor and set it */
681         sd = make_sec_desc(ctx,old->revision, old->owner_sid, old->grp_sid, 
682                            NULL, old->dacl, &sd_size);
683
684         fnum = cli_nt_create(cli, filename, CREATE_ACCESS_WRITE);
685
686         if (fnum == -1) {
687                 printf("cacl_set failed to open %s: %s\n", filename, cli_errstr(cli));
688                 return EXIT_FAILED;
689         }
690
691         if (!cli_set_secdesc(cli, fnum, sd)) {
692                 printf("ERROR: secdesc set failed: %s\n", cli_errstr(cli));
693                 result = EXIT_FAILED;
694         }
695
696         /* Clean up */
697
698         cli_close(cli, fnum);
699
700         return result;
701 }
702
703
704 /***************************************************** 
705 return a connection to a server
706 *******************************************************/
707 static struct cli_state *connect_one(char *share)
708 {
709         struct cli_state *c;
710         struct in_addr ip;
711         zero_ip(&ip);
712         
713         if (!got_pass) {
714                 char *pass = getpass("Password: ");
715                 if (pass) {
716                         pstrcpy(password, pass);
717                         got_pass = True;
718                 }
719         }
720
721         if (NT_STATUS_IS_OK(cli_full_connection(&c, global_myname, server, 
722                                                 &ip, 0,
723                                                 share, "?????",  
724                                                 username, global_myworkgroup,
725                                                 password, strlen(password)))) {
726                 return c;
727         } else {
728                 return NULL;
729         }
730 }
731
732
733 static void usage(void)
734 {
735         printf(
736 "Usage: smbcacls //server1/share1 filename [options]\n\
737 \n\
738 \t-D <acls>               delete an acl\n\
739 \t-M <acls>               modify an acl\n\
740 \t-A <acls>               add an acl\n\
741 \t-S <acls>               set acls\n\
742 \t-C username             change ownership of a file\n\
743 \t-G username             change group ownership of a file\n\
744 \t-n                      don't resolve sids or masks to names\n\
745 \t-h                      print help\n\
746 \t-d debuglevel           set debug output level\n\
747 \t-U username             user to autheticate as\n\
748 \n\
749 The username can be of the form username%%password or\n\
750 workgroup\\username%%password.\n\n\
751 An acl is of the form ACL:<SID>:type/flags/mask\n\
752 You can string acls together with spaces, commas or newlines\n\
753 ");
754 }
755
756 /****************************************************************************
757   main program
758 ****************************************************************************/
759  int main(int argc,char *argv[])
760 {
761         char *share;
762         pstring filename;
763         extern char *optarg;
764         extern int optind;
765         int opt;
766         char *p;
767         enum acl_mode mode = SMB_ACL_SET;
768         char *the_acl = NULL;
769         enum chown_mode change_mode = REQUEST_NONE;
770         int result;
771
772         struct cli_state *cli;
773
774         ctx=talloc_init();
775
776         setlinebuf(stdout);
777
778         dbf = x_stderr;
779
780         if (argc < 3 || argv[1][0] == '-') {
781                 usage();
782                 talloc_destroy(ctx);
783                 exit(EXIT_PARSE_ERROR);
784         }
785
786         setup_logging(argv[0],True);
787
788         share = argv[1];
789         pstrcpy(filename, argv[2]);
790         all_string_sub(share,"/","\\",0);
791
792         argc -= 2;
793         argv += 2;
794
795         lp_load(dyn_CONFIGFILE,True,False,False);
796         load_interfaces();
797
798         if (getenv("USER")) {
799                 pstrcpy(username,getenv("USER"));
800
801                 if ((p=strchr_m(username,'%'))) {
802                         *p = 0;
803                         pstrcpy(password,p+1);
804                         got_pass = True;
805                         memset(strchr_m(getenv("USER"), '%') + 1, 'X',
806                                strlen(password));
807                 }
808         }
809
810         while ((opt = getopt(argc, argv, "U:nhS:D:A:M:C:G:td:")) != EOF) {
811                 switch (opt) {
812                 case 'U':
813                         pstrcpy(username,optarg);
814                         p = strchr_m(username,'%');
815                         if (p) {
816                                 *p = 0;
817                                 pstrcpy(password, p+1);
818                                 got_pass = 1;
819                         }
820                         break;
821
822                 case 'S':
823                         the_acl = optarg;
824                         mode = SMB_ACL_SET;
825                         break;
826
827                 case 'D':
828                         the_acl = optarg;
829                         mode = SMB_ACL_DELETE;
830                         break;
831
832                 case 'M':
833                         the_acl = optarg;
834                         mode = SMB_ACL_MODIFY;
835                         break;
836
837                 case 'A':
838                         the_acl = optarg;
839                         mode = SMB_ACL_ADD;
840                         break;
841
842                 case 'C':
843                         pstrcpy(owner_username,optarg);
844                         change_mode = REQUEST_CHOWN;
845                         break;
846
847                 case 'G':
848                         pstrcpy(owner_username,optarg);
849                         change_mode = REQUEST_CHGRP;
850                         break;
851
852                 case 'n':
853                         numeric = 1;
854                         break;
855
856                 case 't':
857                         test_args = 1;
858                         break;
859
860                 case 'h':
861                         usage();
862                         talloc_destroy(ctx);
863                         exit(EXIT_PARSE_ERROR);
864
865                 case 'd':
866                         DEBUGLEVEL = atoi(optarg);
867                         break;
868
869                 default:
870                         printf("Unknown option %c (%d)\n", (char)opt, opt);
871                         talloc_destroy(ctx);
872                         exit(EXIT_PARSE_ERROR);
873                 }
874         }
875
876         argc -= optind;
877         argv += optind;
878         
879         if (argc > 0) {
880                 usage();
881                 talloc_destroy(ctx);
882                 exit(EXIT_PARSE_ERROR);
883         }
884
885         /* Make connection to server */
886
887         fstrcpy(server,share+2);
888         share = strchr_m(server,'\\');
889         if (!share) return -1;
890         *share = 0;
891         share++;
892
893         if (!test_args) {
894                 cli = connect_one(share);
895                 if (!cli) {
896                         talloc_destroy(ctx);
897                         exit(EXIT_FAILED);
898                 }
899         } else {
900                 exit(0);
901         }
902
903         all_string_sub(filename, "/", "\\", 0);
904         if (filename[0] != '\\') {
905                 pstring s;
906                 s[0] = '\\';
907                 safe_strcpy(&s[1], filename, sizeof(pstring)-1);
908                 pstrcpy(filename, s);
909         }
910
911         /* Perform requested action */
912
913         if (change_mode != REQUEST_NONE) {
914                 result = owner_set(cli, change_mode, filename, owner_username);
915         } else if (the_acl) {
916                 result = cacl_set(cli, filename, the_acl, mode);
917         } else {
918                 result = cacl_dump(cli, filename);
919         }
920
921         talloc_destroy(ctx);
922
923         return result;
924 }
925