diff options
Diffstat (limited to 'source3/utils/smbcacls.c')
| -rw-r--r-- | source3/utils/smbcacls.c | 2614 |
1 files changed, 2614 insertions, 0 deletions
diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c new file mode 100644 index 0000000..ff11ba4 --- /dev/null +++ b/source3/utils/smbcacls.c @@ -0,0 +1,2614 @@ +/* + Unix SMB/CIFS implementation. + ACL get/set utility + + Copyright (C) Andrew Tridgell 2000 + Copyright (C) Tim Potter 2000 + Copyright (C) Jeremy Allison 2000 + Copyright (C) Jelmer Vernooij 2003 + Copyright (C) Noel Power <noel.power@suse.com> 2013 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "lib/cmdline/cmdline.h" +#include "rpc_client/cli_pipe.h" +#include "../librpc/gen_ndr/ndr_lsa.h" +#include "rpc_client/cli_lsarpc.h" +#include "../libcli/security/security.h" +#include "libsmb/libsmb.h" +#include "libsmb/clirap.h" +#include "passdb/machine_sid.h" +#include "../librpc/gen_ndr/ndr_lsa_c.h" +#include "util_sd.h" +#include "lib/param/param.h" + +static char DIRSEP_CHAR = '\\'; + +static int inheritance = 0; +static const char *save_file = NULL; +static const char *restore_file = NULL; +static int recurse; +static int test_args; +static int sddl; +static int query_sec_info = -1; +static int set_sec_info = -1; +static bool want_mxac; + +static const char *domain_sid = NULL; + +enum acl_mode {SMB_ACL_SET, SMB_ACL_DELETE, SMB_ACL_MODIFY, SMB_ACL_ADD }; +enum chown_mode {REQUEST_NONE, REQUEST_CHOWN, REQUEST_CHGRP, REQUEST_INHERIT}; +enum exit_values {EXIT_OK, EXIT_FAILED, EXIT_PARSE_ERROR}; + +struct cacl_callback_state { + struct cli_credentials *creds; + struct cli_state *cli; + struct security_descriptor *aclsd; + struct security_acl *acl_to_add; + enum acl_mode mode; + char *the_acl; + bool acl_no_propagate; + bool numeric; +}; + +static NTSTATUS cli_lsa_lookup_domain_sid(struct cli_state *cli, + struct dom_sid *sid) +{ + union lsa_PolicyInformation *info = NULL; + struct smbXcli_tcon *orig_tcon = NULL; + char *orig_share = NULL; + struct rpc_pipe_client *rpc_pipe = NULL; + struct policy_handle handle; + NTSTATUS status, result; + TALLOC_CTX *frame = talloc_stackframe(); + + if (cli_state_has_tcon(cli)) { + cli_state_save_tcon_share(cli, &orig_tcon, &orig_share); + } + + status = cli_tree_connect(cli, "IPC$", "?????", NULL); + if (!NT_STATUS_IS_OK(status)) { + goto done; + } + + status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc, &rpc_pipe); + if (!NT_STATUS_IS_OK(status)) { + goto tdis; + } + + status = rpccli_lsa_open_policy(rpc_pipe, frame, True, + GENERIC_EXECUTE_ACCESS, &handle); + if (!NT_STATUS_IS_OK(status)) { + goto tdis; + } + + status = dcerpc_lsa_QueryInfoPolicy2(rpc_pipe->binding_handle, + frame, &handle, + LSA_POLICY_INFO_DOMAIN, + &info, &result); + + if (any_nt_status_not_ok(status, result, &status)) { + goto tdis; + } + + *sid = *info->domain.sid; + +tdis: + TALLOC_FREE(rpc_pipe); + cli_tdis(cli); +done: + cli_state_restore_tcon_share(cli, orig_tcon, orig_share); + TALLOC_FREE(frame); + return status; +} + +static struct dom_sid *get_domain_sid(struct cli_state *cli) +{ + NTSTATUS status; + struct dom_sid_buf buf; + + struct dom_sid *sid = talloc(talloc_tos(), struct dom_sid); + if (sid == NULL) { + DEBUG(0, ("Out of memory\n")); + return NULL; + } + + if (domain_sid) { + if (!dom_sid_parse(domain_sid, sid)) { + DEBUG(0,("failed to parse domain sid\n")); + TALLOC_FREE(sid); + } + } else { + status = cli_lsa_lookup_domain_sid(cli, sid); + + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0,("failed to lookup domain sid: %s\n", nt_errstr(status))); + TALLOC_FREE(sid); + } + + } + + DEBUG(2,("Domain SID: %s\n", dom_sid_str_buf(sid, &buf))); + return sid; +} + +/* add an ACE to a list of ACEs in a struct security_acl */ +static bool add_ace_with_ctx(TALLOC_CTX *ctx, struct security_acl **the_acl, + const struct security_ace *ace) + +{ + struct security_acl *acl = *the_acl; + + if (acl == NULL) { + acl = make_sec_acl(ctx, 3, 0, NULL); + if (acl == NULL) { + return false; + } + } + + if (acl->num_aces == UINT32_MAX) { + return false; + } + ADD_TO_ARRAY( + acl, struct security_ace, *ace, &acl->aces, &acl->num_aces); + *the_acl = acl; + return True; +} + +static bool add_ace(struct security_acl **the_acl, struct security_ace *ace) +{ + return add_ace_with_ctx(talloc_tos(), the_acl, ace); +} + +/* parse a ascii version of a security descriptor */ +static struct security_descriptor *sec_desc_parse(TALLOC_CTX *ctx, struct cli_state *cli, char *str) +{ + const char *p = str; + char *tok; + struct security_descriptor *ret = NULL; + size_t sd_size; + struct dom_sid owner_sid = { .num_auths = 0 }; + bool have_owner = false; + struct dom_sid group_sid = { .num_auths = 0 }; + bool have_group = false; + struct security_acl *dacl=NULL; + int revision=1; + + while (next_token_talloc(ctx, &p, &tok, "\t,\r\n")) { + if (strncmp(tok,"REVISION:", 9) == 0) { + revision = strtol(tok+9, NULL, 16); + continue; + } + + if (strncmp(tok,"OWNER:", 6) == 0) { + if (have_owner) { + printf("Only specify owner once\n"); + goto done; + } + if (!StringToSid(cli, &owner_sid, tok+6)) { + printf("Failed to parse owner sid\n"); + goto done; + } + have_owner = true; + continue; + } + + if (strncmp(tok,"GROUP:", 6) == 0) { + if (have_group) { + printf("Only specify group once\n"); + goto done; + } + if (!StringToSid(cli, &group_sid, tok+6)) { + printf("Failed to parse group sid\n"); + goto done; + } + have_group = true; + continue; + } + + if (strncmp(tok,"ACL:", 4) == 0) { + struct security_ace ace; + if (!parse_ace(cli, &ace, tok+4)) { + goto done; + } + if(!add_ace(&dacl, &ace)) { + printf("Failed to add ACL %s\n", tok); + goto done; + } + continue; + } + + printf("Failed to parse token '%s' in security descriptor,\n", tok); + goto done; + } + + ret = make_sec_desc( + ctx, + revision, + SEC_DESC_SELF_RELATIVE, + have_owner ? &owner_sid : NULL, + have_group ? &group_sid : NULL, + NULL, + dacl, + &sd_size); + +done: + return ret; +} + +/***************************************************** +get fileinfo for filename +*******************************************************/ +static uint16_t get_fileinfo(struct cli_state *cli, const char *filename) +{ + uint16_t fnum = (uint16_t)-1; + NTSTATUS status; + struct smb_create_returns cr = {0}; + + /* The desired access below is the only one I could find that works + with NT4, W2KP and Samba */ + + status = cli_ntcreate( + cli, /* cli */ + filename, /* fname */ + 0, /* CreatFlags */ + READ_CONTROL_ACCESS, /* CreatFlags */ + 0, /* FileAttributes */ + FILE_SHARE_READ| + FILE_SHARE_WRITE, /* ShareAccess */ + FILE_OPEN, /* CreateDisposition */ + 0x0, /* CreateOptions */ + 0x0, /* SecurityFlags */ + &fnum, /* pfid */ + &cr); /* cr */ + if (!NT_STATUS_IS_OK(status)) { + printf("Failed to open %s: %s\n", filename, nt_errstr(status)); + return 0; + } + + cli_close(cli, fnum); + return cr.file_attributes; +} + +/***************************************************** +get sec desc for filename +*******************************************************/ +static struct security_descriptor *get_secdesc_with_ctx(TALLOC_CTX *ctx, + struct cli_state *cli, + const char *filename) +{ + uint16_t fnum = (uint16_t)-1; + struct security_descriptor *sd; + NTSTATUS status; + uint32_t sec_info; + uint32_t desired_access = 0; + + if (query_sec_info == -1) { + sec_info = SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL; + } else { + sec_info = query_sec_info; + } + + if (sec_info & (SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL)) { + desired_access |= SEC_STD_READ_CONTROL; + } + if (sec_info & SECINFO_SACL) { + desired_access |= SEC_FLAG_SYSTEM_SECURITY; + } + + if (desired_access == 0) { + desired_access |= SEC_STD_READ_CONTROL; + } + + status = cli_ntcreate(cli, filename, 0, desired_access, + 0, FILE_SHARE_READ|FILE_SHARE_WRITE, + FILE_OPEN, 0x0, 0x0, &fnum, NULL); + if (!NT_STATUS_IS_OK(status)) { + printf("Failed to open %s: %s\n", filename, nt_errstr(status)); + return NULL; + } + + status = cli_query_security_descriptor(cli, fnum, sec_info, + ctx, &sd); + + cli_close(cli, fnum); + + if (!NT_STATUS_IS_OK(status)) { + printf("Failed to get security descriptor: %s\n", + nt_errstr(status)); + return NULL; + } + return sd; +} + +static struct security_descriptor *get_secdesc(struct cli_state *cli, + const char *filename) +{ + return get_secdesc_with_ctx(talloc_tos(), cli, filename); +} +/***************************************************** +set sec desc for filename +*******************************************************/ +static bool set_secdesc(struct cli_state *cli, const char *filename, + struct security_descriptor *sd) +{ + uint16_t fnum = (uint16_t)-1; + bool result=true; + NTSTATUS status; + uint32_t desired_access = 0; + uint32_t sec_info; + + if (set_sec_info == -1) { + sec_info = 0; + + if (sd->dacl || (sd->type & SEC_DESC_DACL_PRESENT)) { + sec_info |= SECINFO_DACL; + } + if (sd->sacl || (sd->type & SEC_DESC_SACL_PRESENT)) { + sec_info |= SECINFO_SACL; + } + if (sd->owner_sid) { + sec_info |= SECINFO_OWNER; + } + if (sd->group_sid) { + sec_info |= SECINFO_GROUP; + } + } else { + sec_info = set_sec_info; + } + + /* Make the desired_access more specific. */ + if (sec_info & SECINFO_DACL) { + desired_access |= SEC_STD_WRITE_DAC; + } + if (sec_info & SECINFO_SACL) { + desired_access |= SEC_FLAG_SYSTEM_SECURITY; + } + if (sec_info & (SECINFO_OWNER | SECINFO_GROUP)) { + desired_access |= SEC_STD_WRITE_OWNER; + } + + status = cli_ntcreate(cli, filename, 0, + desired_access, + 0, FILE_SHARE_READ|FILE_SHARE_WRITE, + FILE_OPEN, 0x0, 0x0, &fnum, NULL); + if (!NT_STATUS_IS_OK(status)) { + printf("Failed to open %s: %s\n", filename, nt_errstr(status)); + return false; + } + + status = cli_set_security_descriptor(cli, fnum, sec_info, sd); + if (!NT_STATUS_IS_OK(status)) { + printf("ERROR: security descriptor set failed: %s\n", + nt_errstr(status)); + result=false; + } + + cli_close(cli, fnum); + return result; +} + +/***************************************************** +get maximum access for a file +*******************************************************/ +static int cacl_mxac(struct cli_state *cli, const char *filename) +{ + NTSTATUS status; + uint32_t mxac; + + status = cli_query_mxac(cli, filename, &mxac); + if (!NT_STATUS_IS_OK(status)) { + printf("Failed to get mxac: %s\n", nt_errstr(status)); + return EXIT_FAILED; + } + + printf("Maximum access: 0x%x\n", mxac); + + return EXIT_OK; +} + + +/***************************************************** +dump the acls for a file +*******************************************************/ +static int cacl_dump(struct cli_state *cli, const char *filename, bool numeric) +{ + struct security_descriptor *sd; + int ret; + + if (test_args) { + return EXIT_OK; + } + + sd = get_secdesc(cli, filename); + if (sd == NULL) { + return EXIT_FAILED; + } + + if (sddl) { + char *str = sddl_encode(talloc_tos(), sd, get_domain_sid(cli)); + if (str == NULL) { + return EXIT_FAILED; + } + printf("%s\n", str); + TALLOC_FREE(str); + } else { + sec_desc_print(cli, stdout, sd, numeric); + } + + if (want_mxac) { + ret = cacl_mxac(cli, filename); + if (ret != EXIT_OK) { + return ret; + } + } + + return EXIT_OK; +} + +/***************************************************** +Change the ownership or group ownership of a file. Just +because the NT docs say this can't be done :-). JRA. +*******************************************************/ + +static int owner_set(struct cli_state *cli, enum chown_mode change_mode, + const char *filename, const char *new_username) +{ + struct dom_sid sid; + struct security_descriptor *sd; + size_t sd_size; + + if (!StringToSid(cli, &sid, new_username)) + return EXIT_PARSE_ERROR; + + sd = make_sec_desc(talloc_tos(), + SECURITY_DESCRIPTOR_REVISION_1, + SEC_DESC_SELF_RELATIVE, + (change_mode == REQUEST_CHOWN) ? &sid : NULL, + (change_mode == REQUEST_CHGRP) ? &sid : NULL, + NULL, NULL, &sd_size); + + if (!set_secdesc(cli, filename, sd)) { + return EXIT_FAILED; + } + + return EXIT_OK; +} + + +/* The MSDN is contradictory over the ordering of ACE entries in an + ACL. However NT4 gives a "The information may have been modified + by a computer running Windows NT 5.0" if denied ACEs do not appear + before allowed ACEs. At + http://technet.microsoft.com/en-us/library/cc781716.aspx the + canonical order is specified as "Explicit Deny, Explicit Allow, + Inherited ACEs unchanged" */ + +static int ace_compare(struct security_ace *ace1, struct security_ace *ace2) +{ + if (security_ace_equal(ace1, ace2)) + return 0; + + if ((ace1->flags & SEC_ACE_FLAG_INHERITED_ACE) && + !(ace2->flags & SEC_ACE_FLAG_INHERITED_ACE)) + return 1; + if (!(ace1->flags & SEC_ACE_FLAG_INHERITED_ACE) && + (ace2->flags & SEC_ACE_FLAG_INHERITED_ACE)) + return -1; + if ((ace1->flags & SEC_ACE_FLAG_INHERITED_ACE) && + (ace2->flags & SEC_ACE_FLAG_INHERITED_ACE)) + return ace1 - ace2; + + if (ace1->type != ace2->type) + return ace2->type - ace1->type; + + if (dom_sid_compare(&ace1->trustee, &ace2->trustee)) + return dom_sid_compare(&ace1->trustee, &ace2->trustee); + + if (ace1->flags != ace2->flags) + return ace1->flags - ace2->flags; + + if (ace1->access_mask != ace2->access_mask) + return ace1->access_mask - ace2->access_mask; + + if (ace1->size != ace2->size) + return ace1->size - ace2->size; + + return memcmp(ace1, ace2, sizeof(struct security_ace)); +} + +static void sort_acl(struct security_acl *the_acl) +{ + uint32_t i; + if (!the_acl) return; + + TYPESAFE_QSORT(the_acl->aces, the_acl->num_aces, ace_compare); + + for (i=1;i<the_acl->num_aces;) { + if (security_ace_equal(&the_acl->aces[i-1], + &the_acl->aces[i])) { + ARRAY_DEL_ELEMENT( + the_acl->aces, i, the_acl->num_aces); + the_acl->num_aces--; + } else { + i++; + } + } +} + +/***************************************************** +set the ACLs on a file given a security descriptor +*******************************************************/ + +static int cacl_set_from_sd(struct cli_state *cli, const char *filename, + struct security_descriptor *sd, enum acl_mode mode, + bool numeric) +{ + struct security_descriptor *old = NULL; + uint32_t i, j; + size_t sd_size; + int result = EXIT_OK; + + if (!sd) return EXIT_PARSE_ERROR; + if (test_args) return EXIT_OK; + + if (mode != SMB_ACL_SET) { + /* + * Do not fetch old ACL when it will be overwritten + * completely with a new one. + */ + old = get_secdesc(cli, filename); + + if (!old) { + return EXIT_FAILED; + } + } + + /* the logic here is rather more complex than I would like */ + switch (mode) { + case SMB_ACL_DELETE: + for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) { + bool found = False; + + for (j=0;old->dacl && j<old->dacl->num_aces;j++) { + if (security_ace_equal(&sd->dacl->aces[i], + &old->dacl->aces[j])) { + uint32_t k; + for (k=j; k<old->dacl->num_aces-1;k++) { + old->dacl->aces[k] = old->dacl->aces[k+1]; + } + old->dacl->num_aces--; + found = True; + break; + } + } + + if (!found) { + printf("ACL for ACE:"); + print_ace(cli, stdout, &sd->dacl->aces[i], + numeric); + printf(" not found\n"); + } + } + break; + + case SMB_ACL_MODIFY: + for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) { + bool found = False; + + for (j=0;old->dacl && j<old->dacl->num_aces;j++) { + if (dom_sid_equal(&sd->dacl->aces[i].trustee, + &old->dacl->aces[j].trustee)) { + old->dacl->aces[j] = sd->dacl->aces[i]; + found = True; + } + } + + if (!found) { + fstring str; + + SidToString(cli, str, + &sd->dacl->aces[i].trustee, + numeric); + printf("ACL for SID %s not found\n", str); + } + } + + if (sd->owner_sid) { + old->owner_sid = sd->owner_sid; + } + + if (sd->group_sid) { + old->group_sid = sd->group_sid; + } + + break; + + case SMB_ACL_ADD: + for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) { + add_ace(&old->dacl, &sd->dacl->aces[i]); + } + break; + + case SMB_ACL_SET: + old = sd; + break; + } + + /* Denied ACE entries must come before allowed ones */ + sort_acl(old->dacl); + + /* Create new security descriptor and set it */ + + /* We used to just have "WRITE_DAC_ACCESS" without WRITE_OWNER. + But if we're sending an owner, even if it's the same as the one + that already exists then W2K3 insists we open with WRITE_OWNER access. + I need to check that setting a SD with no owner set works against WNT + and W2K. JRA. + */ + + sd = make_sec_desc(talloc_tos(),old->revision, old->type, + old->owner_sid, old->group_sid, + NULL, old->dacl, &sd_size); + + if (!set_secdesc(cli, filename, sd)) { + result = EXIT_FAILED; + } + + return result; +} + +/***************************************************** +set the ACLs on a file given an ascii description +*******************************************************/ + +static int cacl_set(struct cli_state *cli, const char *filename, + char *the_acl, enum acl_mode mode, bool numeric) +{ + struct security_descriptor *sd = NULL; + + if (sddl) { + const char *msg = NULL; + size_t msg_offset = 0; + enum ace_condition_flags flags = + ACE_CONDITION_FLAG_ALLOW_DEVICE; + sd = sddl_decode_err_msg(talloc_tos(), + the_acl, + get_domain_sid(cli), + flags, + &msg, + &msg_offset); + if (sd == NULL) { + DBG_ERR("could not decode '%s'\n", the_acl); + if (msg != NULL) { + DBG_ERR(" %*c\n", + (int)msg_offset, '^'); + DBG_ERR("error '%s'\n", msg); + } + } + } else { + sd = sec_desc_parse(talloc_tos(), cli, the_acl); + } + + if (sd == NULL) { + return EXIT_PARSE_ERROR; + } + if (test_args) { + return EXIT_OK; + } + return cacl_set_from_sd(cli, filename, sd, mode, numeric); +} + +/***************************************************** +set the inherit on a file +*******************************************************/ +static int inherit(struct cli_state *cli, const char *filename, + const char *type) +{ + struct security_descriptor *old,*sd; + uint32_t oldattr; + size_t sd_size; + int result = EXIT_OK; + + old = get_secdesc(cli, filename); + + if (!old) { + return EXIT_FAILED; + } + + oldattr = get_fileinfo(cli,filename); + + if (strcmp(type,"allow")==0) { + if ((old->type & SEC_DESC_DACL_PROTECTED) == + SEC_DESC_DACL_PROTECTED) { + uint32_t i; + char *parentname,*temp; + struct security_descriptor *parent; + temp = talloc_strdup(talloc_tos(), filename); + + old->type=old->type & (~SEC_DESC_DACL_PROTECTED); + + /* look at parent and copy in all its inheritable ACL's. */ + string_replace(temp, '\\', '/'); + if (!parent_dirname(talloc_tos(),temp,&parentname,NULL)) { + return EXIT_FAILED; + } + string_replace(parentname, '/', '\\'); + parent = get_secdesc(cli,parentname); + if (parent == NULL) { + return EXIT_FAILED; + } + for (i=0;i<parent->dacl->num_aces;i++) { + struct security_ace *ace=&parent->dacl->aces[i]; + /* Add inherited flag to all aces */ + ace->flags=ace->flags| + SEC_ACE_FLAG_INHERITED_ACE; + if ((oldattr & FILE_ATTRIBUTE_DIRECTORY) == FILE_ATTRIBUTE_DIRECTORY) { + if ((ace->flags & SEC_ACE_FLAG_CONTAINER_INHERIT) == + SEC_ACE_FLAG_CONTAINER_INHERIT) { + add_ace(&old->dacl, ace); + } + } else { + if ((ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT) == + SEC_ACE_FLAG_OBJECT_INHERIT) { + /* clear flags for files */ + ace->flags=0; + add_ace(&old->dacl, ace); + } + } + } + } else { + printf("Already set to inheritable permissions.\n"); + return EXIT_FAILED; + } + } else if (strcmp(type,"remove")==0) { + if ((old->type & SEC_DESC_DACL_PROTECTED) != + SEC_DESC_DACL_PROTECTED) { + old->type=old->type | SEC_DESC_DACL_PROTECTED; + + /* remove all inherited ACL's. */ + if (old->dacl) { + int i; + struct security_acl *temp=old->dacl; + old->dacl=make_sec_acl(talloc_tos(), 3, 0, NULL); + for (i=temp->num_aces-1;i>=0;i--) { + struct security_ace *ace=&temp->aces[i]; + /* Remove all ace with INHERITED flag set */ + if ((ace->flags & SEC_ACE_FLAG_INHERITED_ACE) != + SEC_ACE_FLAG_INHERITED_ACE) { + add_ace(&old->dacl,ace); + } + } + } + } else { + printf("Already set to no inheritable permissions.\n"); + return EXIT_FAILED; + } + } else if (strcmp(type,"copy")==0) { + if ((old->type & SEC_DESC_DACL_PROTECTED) != + SEC_DESC_DACL_PROTECTED) { + old->type=old->type | SEC_DESC_DACL_PROTECTED; + + /* + * convert all inherited ACL's to non + * inherited ACL's. + */ + if (old->dacl) { + uint32_t i; + for (i=0;i<old->dacl->num_aces;i++) { + struct security_ace *ace=&old->dacl->aces[i]; + /* Remove INHERITED FLAG from all aces */ + ace->flags=ace->flags&(~SEC_ACE_FLAG_INHERITED_ACE); + } + } + } else { + printf("Already set to no inheritable permissions.\n"); + return EXIT_FAILED; + } + } + + /* Denied ACE entries must come before allowed ones */ + sort_acl(old->dacl); + + sd = make_sec_desc(talloc_tos(),old->revision, old->type, + old->owner_sid, old->group_sid, + NULL, old->dacl, &sd_size); + + if (!set_secdesc(cli, filename, sd)) { + result = EXIT_FAILED; + } + + return result; +} + +/***************************************************** + Return a connection to a server. +*******************************************************/ +static struct cli_state *connect_one(struct cli_credentials *creds, + const char *server, const char *share) +{ + struct cli_state *c = NULL; + NTSTATUS nt_status; + uint32_t flags = 0; + + nt_status = cli_full_connection_creds(&c, lp_netbios_name(), server, + NULL, 0, + share, "?????", + creds, + flags); + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status))); + return NULL; + } + + return c; +} + +/* + * Process resulting combination of mask & fname ensuring + * terminated with wildcard + */ +static char *build_dirname(TALLOC_CTX *ctx, + const char *mask, char *dir, char *fname) +{ + char *mask2 = NULL; + char *p = NULL; + + mask2 = talloc_strdup(ctx, mask); + if (!mask2) { + return NULL; + } + p = strrchr_m(mask2, DIRSEP_CHAR); + if (p) { + p[1] = 0; + } else { + mask2[0] = '\0'; + } + mask2 = talloc_asprintf_append(mask2, + "%s\\*", + fname); + return mask2; +} + +/* + * Returns a copy of the ACL flags in ace modified according + * to some inheritance rules. + * a) SEC_ACE_FLAG_INHERITED_ACE is propagated to children + * b) SEC_ACE_FLAG_INHERIT_ONLY is set on container children for OI (only) + * c) SEC_ACE_FLAG_OBJECT_INHERIT & SEC_ACE_FLAG_CONTAINER_INHERIT are + * stripped from flags to be propagated to non-container children + * d) SEC_ACE_FLAG_OBJECT_INHERIT & SEC_ACE_FLAG_CONTAINER_INHERIT are + * stripped from flags to be propagated if the NP flag + * SEC_ACE_FLAG_NO_PROPAGATE_INHERIT is present + */ + +static uint8_t get_flags_to_propagate(bool is_container, + struct security_ace *ace) +{ + uint8_t newflags = ace->flags; + /* OBJECT inheritance */ + bool acl_objinherit = (ace->flags & + SEC_ACE_FLAG_OBJECT_INHERIT) == SEC_ACE_FLAG_OBJECT_INHERIT; + /* CONTAINER inheritance */ + bool acl_cntrinherit = (ace->flags & + SEC_ACE_FLAG_CONTAINER_INHERIT) == + SEC_ACE_FLAG_CONTAINER_INHERIT; + /* PROHIBIT inheritance */ + bool prohibit_inheritance = ((ace->flags & + SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) == + SEC_ACE_FLAG_NO_PROPAGATE_INHERIT); + + /* Assume we are not propagating the ACE */ + + newflags &= ~SEC_ACE_FLAG_INHERITED_ACE; + /* all children need to have the SEC_ACE_FLAG_INHERITED_ACE set */ + if (acl_cntrinherit || acl_objinherit) { + /* + * object inherit ( alone ) on a container needs + * SEC_ACE_FLAG_INHERIT_ONLY + */ + if (is_container) { + if (acl_objinherit && !acl_cntrinherit) { + newflags |= SEC_ACE_FLAG_INHERIT_ONLY; + } + /* + * this is tricky, the only time we would not + * propagate the ace for a container is if + * prohibit_inheritance is set and object inheritance + * alone is set + */ + if ((prohibit_inheritance + && acl_objinherit + && !acl_cntrinherit) == false) { + newflags |= SEC_ACE_FLAG_INHERITED_ACE; + } + } else { + /* + * don't apply object/container inheritance flags to + * non dirs + */ + newflags &= ~(SEC_ACE_FLAG_OBJECT_INHERIT + | SEC_ACE_FLAG_CONTAINER_INHERIT + | SEC_ACE_FLAG_INHERIT_ONLY); + /* + * only apply ace to file if object inherit + */ + if (acl_objinherit) { + newflags |= SEC_ACE_FLAG_INHERITED_ACE; + } + } + + /* if NP is specified strip NP and all OI/CI INHERIT flags */ + if (prohibit_inheritance) { + newflags &= ~(SEC_ACE_FLAG_OBJECT_INHERIT + | SEC_ACE_FLAG_CONTAINER_INHERIT + | SEC_ACE_FLAG_INHERIT_ONLY + | SEC_ACE_FLAG_NO_PROPAGATE_INHERIT); + } + } + return newflags; +} + +/* + * This function builds a new acl for 'caclfile', first it removes any + * existing inheritable ace(s) from the current acl of caclfile, secondly it + * applies any inheritable acls of the parent of caclfile ( inheritable acls of + * caclfile's parent are passed via acl_to_add member of cbstate ) + * + */ +static NTSTATUS propagate_inherited_aces(char *caclfile, + struct cacl_callback_state *cbstate) +{ + TALLOC_CTX *aclctx = NULL; + NTSTATUS status; + int result; + int fileattr; + struct security_descriptor *old = NULL; + bool is_container = false; + struct security_acl *acl_to_add = cbstate->acl_to_add; + struct security_acl *acl_to_remove = NULL; + uint32_t i, j; + + aclctx = talloc_new(NULL); + if (aclctx == NULL) { + return NT_STATUS_NO_MEMORY; + } + old = get_secdesc_with_ctx(aclctx, cbstate->cli, caclfile); + + if (!old) { + status = NT_STATUS_UNSUCCESSFUL; + goto out; + } + + /* inhibit propagation? */ + if ((old->type & SEC_DESC_DACL_PROTECTED) == + SEC_DESC_DACL_PROTECTED){ + status = NT_STATUS_OK; + goto out; + } + + fileattr = get_fileinfo(cbstate->cli, caclfile); + is_container = (fileattr & FILE_ATTRIBUTE_DIRECTORY); + + /* find acl(s) that are inherited */ + for (j = 0; old->dacl && j < old->dacl->num_aces; j++) { + + if (old->dacl->aces[j].flags & SEC_ACE_FLAG_INHERITED_ACE) { + if (!add_ace_with_ctx(aclctx, &acl_to_remove, + &old->dacl->aces[j])) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + } + } + + /* remove any acl(s) that are inherited */ + if (acl_to_remove) { + for (i = 0; i < acl_to_remove->num_aces; i++) { + struct security_ace ace = acl_to_remove->aces[i]; + for (j = 0; old->dacl && j < old->dacl->num_aces; j++) { + + if (security_ace_equal(&ace, + &old->dacl->aces[j])) { + uint32_t k; + for (k = j; k < old->dacl->num_aces-1; + k++) { + old->dacl->aces[k] = + old->dacl->aces[k+1]; + } + old->dacl->num_aces--; + break; + } + } + } + } + /* propagate any inheritable ace to be added */ + if (acl_to_add) { + for (i = 0; i < acl_to_add->num_aces; i++) { + struct security_ace ace = acl_to_add->aces[i]; + bool is_objectinherit = (ace.flags & + SEC_ACE_FLAG_OBJECT_INHERIT) == + SEC_ACE_FLAG_OBJECT_INHERIT; + bool is_inherited; + /* don't propagate flags to a file unless OI */ + if (!is_objectinherit && !is_container) { + continue; + } + /* + * adjust flags according to inheritance + * rules + */ + ace.flags = get_flags_to_propagate(is_container, &ace); + is_inherited = (ace.flags & + SEC_ACE_FLAG_INHERITED_ACE) == + SEC_ACE_FLAG_INHERITED_ACE; + /* don't propagate non inherited flags */ + if (!is_inherited) { + continue; + } + if (!add_ace_with_ctx(aclctx, &old->dacl, &ace)) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + } + } + + result = cacl_set_from_sd(cbstate->cli, caclfile, + old, + SMB_ACL_SET, cbstate->numeric); + if (result != EXIT_OK) { + status = NT_STATUS_UNSUCCESSFUL; + goto out; + } + + status = NT_STATUS_OK; +out: + TALLOC_FREE(aclctx); + return status; +} + +/* + * Returns true if 'ace' contains SEC_ACE_FLAG_OBJECT_INHERIT or + * SEC_ACE_FLAG_CONTAINER_INHERIT + */ +static bool is_inheritable_ace(struct security_ace *ace) +{ + uint8_t flags = ace->flags; + if (flags & (SEC_ACE_FLAG_OBJECT_INHERIT + | SEC_ACE_FLAG_CONTAINER_INHERIT)) { + return true; + } + return false; +} + +/* This method does some basic sanity checking with respect to automatic + * inheritance. e.g. it checks if it is possible to do a set, it detects illegal + * attempts to set inherited permissions directly. Additionally this method + * does some basic initialisation for instance it parses the ACL passed on the + * command line. + */ +static NTSTATUS prepare_inheritance_propagation(TALLOC_CTX *ctx, char *filename, + struct cacl_callback_state *cbstate) +{ + NTSTATUS result; + char *the_acl = cbstate->the_acl; + struct cli_state *cli = cbstate->cli; + enum acl_mode mode = cbstate->mode; + struct security_descriptor *sd = NULL; + struct security_descriptor *old = NULL; + uint32_t j; + bool propagate = false; + + old = get_secdesc_with_ctx(ctx, cli, filename); + if (old == NULL) { + return NT_STATUS_NO_MEMORY; + } + + /* parse acl passed on the command line */ + if (sddl) { + const char *msg = NULL; + size_t msg_offset = 0; + enum ace_condition_flags flags = + ACE_CONDITION_FLAG_ALLOW_DEVICE; + + cbstate->aclsd = sddl_decode_err_msg(ctx, + the_acl, + get_domain_sid(cli), + flags, + &msg, + &msg_offset); + if (cbstate->aclsd == NULL) { + DBG_ERR("could not decode '%s'\n", the_acl); + if (msg != NULL) { + DBG_ERR(" %*c\n", + (int)msg_offset, '^'); + DBG_ERR("error '%s'\n", msg); + } + } + } else { + cbstate->aclsd = sec_desc_parse(ctx, cli, the_acl); + } + + if (!cbstate->aclsd) { + result = NT_STATUS_UNSUCCESSFUL; + goto out; + } + + sd = cbstate->aclsd; + + /* set operation if inheritance is enabled doesn't make sense */ + if (mode == SMB_ACL_SET && ((old->type & SEC_DESC_DACL_PROTECTED) != + SEC_DESC_DACL_PROTECTED)){ + d_printf("Inheritance enabled at %s, can't apply set operation\n",filename); + result = NT_STATUS_UNSUCCESSFUL; + goto out; + + } + + /* + * search command line acl for any illegal SEC_ACE_FLAG_INHERITED_ACE + * flags that are set + */ + for (j = 0; sd->dacl && j < sd->dacl->num_aces; j++) { + struct security_ace *ace = &sd->dacl->aces[j]; + if (ace->flags & SEC_ACE_FLAG_INHERITED_ACE) { + d_printf("Illegal parameter %s\n", the_acl); + result = NT_STATUS_UNSUCCESSFUL; + goto out; + } + if (!propagate) { + if (is_inheritable_ace(ace)) { + propagate = true; + } + } + } + + result = NT_STATUS_OK; +out: + cbstate->acl_no_propagate = !propagate; + return result; +} + +/* + * This method builds inheritable ace(s) from filename (which should be + * a container) that need propagating to children in order to provide + * automatic inheritance. Those inheritable ace(s) are stored in + * acl_to_add member of cbstate for later processing + * (see propagate_inherited_aces) + */ +static NTSTATUS get_inheritable_aces(TALLOC_CTX *ctx, char *filename, + struct cacl_callback_state *cbstate) +{ + NTSTATUS result; + struct cli_state *cli = NULL; + struct security_descriptor *sd = NULL; + struct security_acl *acl_to_add = NULL; + uint32_t j; + + cli = cbstate->cli; + sd = get_secdesc_with_ctx(ctx, cli, filename); + + if (sd == NULL) { + return NT_STATUS_NO_MEMORY; + } + + /* + * Check if any inheritance related flags are used, if not then + * nothing to do. At the same time populate acls for inheritance + * related ace(s) that need to be added to or deleted from children as + * a result of inheritance propagation. + */ + + for (j = 0; sd->dacl && j < sd->dacl->num_aces; j++) { + struct security_ace *ace = &sd->dacl->aces[j]; + if (is_inheritable_ace(ace)) { + bool added = add_ace_with_ctx(ctx, &acl_to_add, ace); + if (!added) { + result = NT_STATUS_NO_MEMORY; + goto out; + } + } + } + cbstate->acl_to_add = acl_to_add; + result = NT_STATUS_OK; +out: + return result; +} + +/* + * Callback handler to handle child elements processed by cli_list, we attempt + * to propagate inheritable ace(s) to each child via the function + * propagate_inherited_aces. Children that are themselves directories are passed + * to cli_list again ( to descend the directory structure ) + */ +static NTSTATUS cacl_set_cb(struct file_info *f, + const char *mask, void *state) +{ + struct cacl_callback_state *cbstate = + (struct cacl_callback_state *)state; + struct cli_state *cli = NULL; + struct cli_credentials *creds = NULL; + + TALLOC_CTX *dirctx = NULL; + NTSTATUS status; + struct cli_state *targetcli = NULL; + + char *dir = NULL; + char *dir_end = NULL; + char *mask2 = NULL; + char *targetpath = NULL; + char *caclfile = NULL; + + dirctx = talloc_new(NULL); + if (!dirctx) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + + cli = cbstate->cli; + creds = cbstate->creds; + + /* Work out the directory. */ + dir = talloc_strdup(dirctx, mask); + if (!dir) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + + dir_end = strrchr(dir, DIRSEP_CHAR); + if (dir_end != NULL) { + *dir_end = '\0'; + } + + if (!f->name || !f->name[0]) { + d_printf("Empty dir name returned. Possible server misconfiguration.\n"); + status = NT_STATUS_UNSUCCESSFUL; + goto out; + } + + if (f->attr & FILE_ATTRIBUTE_DIRECTORY) { + struct cacl_callback_state dir_cbstate; + uint16_t attribute = FILE_ATTRIBUTE_DIRECTORY + | FILE_ATTRIBUTE_SYSTEM + | FILE_ATTRIBUTE_HIDDEN; + dir_end = NULL; + + /* ignore special '.' & '..' */ + if ((f->name == NULL) || ISDOT(f->name) || ISDOTDOT(f->name)) { + status = NT_STATUS_OK; + goto out; + } + + mask2 = build_dirname(dirctx, mask, dir, f->name); + if (mask2 == NULL) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + + /* check for dfs */ + status = cli_resolve_path(dirctx, "", creds, cli, + mask2, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + goto out; + } + + /* + * prepare path to caclfile, remove any existing wildcard + * chars and convert path separators. + */ + + caclfile = talloc_strdup(dirctx, targetpath); + if (!caclfile) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + dir_end = strrchr(caclfile, '*'); + if (dir_end != NULL) { + *dir_end = '\0'; + } + + string_replace(caclfile, '/', '\\'); + /* + * make directory specific copy of cbstate here + * (for this directory level) to be available as + * the parent cbstate for the children of this directory. + * Note: cbstate is overwritten for the current file being + * processed. + */ + dir_cbstate = *cbstate; + dir_cbstate.cli = targetcli; + + /* + * propagate any inherited ace from our parent + */ + status = propagate_inherited_aces(caclfile, &dir_cbstate); + if (!NT_STATUS_IS_OK(status)) { + goto out; + } + + /* + * get inheritable ace(s) for this dir/container + * that will be propagated to its children + */ + status = get_inheritable_aces(dirctx, caclfile, + &dir_cbstate); + if (!NT_STATUS_IS_OK(status)) { + goto out; + } + + /* + * ensure cacl_set_cb gets called for children + * of this directory (targetpath) + */ + status = cli_list(targetcli, targetpath, + attribute, cacl_set_cb, + (void *)&dir_cbstate); + + if (!NT_STATUS_IS_OK(status)) { + goto out; + } + + } else { + /* + * build full path to caclfile and replace '/' with '\' so + * other utility functions can deal with it + */ + + targetpath = talloc_asprintf(dirctx, "%s/%s", dir, f->name); + if (!targetpath) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + string_replace(targetpath, '/', '\\'); + + /* attempt to propagate any inherited ace to file caclfile */ + status = propagate_inherited_aces(targetpath, cbstate); + + if (!NT_STATUS_IS_OK(status)) { + goto out; + } + } + status = NT_STATUS_OK; +out: + if (!NT_STATUS_IS_OK(status)) { + d_printf("error %s: processing %s\n", + nt_errstr(status), + targetpath); + } + TALLOC_FREE(dirctx); + return status; +} + + +/* + * Wrapper around cl_list to descend the directory tree pointed to by 'filename', + * helper callback function 'cacl_set_cb' handles the child elements processed + * by cli_list. + */ +static int inheritance_cacl_set(char *filename, + struct cacl_callback_state *cbstate) +{ + int result; + NTSTATUS ntstatus; + int fileattr; + char *mask = NULL; + struct cli_state *cli = cbstate->cli; + TALLOC_CTX *ctx = NULL; + bool isdirectory = false; + uint16_t attribute = FILE_ATTRIBUTE_DIRECTORY | FILE_ATTRIBUTE_SYSTEM + | FILE_ATTRIBUTE_HIDDEN; + ctx = talloc_init("inherit_set"); + if (ctx == NULL) { + d_printf("out of memory\n"); + result = EXIT_FAILED; + goto out; + } + + /* ensure we have a filename that starts with '\' */ + if (!filename || *filename != DIRSEP_CHAR) { + /* illegal or no filename */ + result = EXIT_FAILED; + d_printf("illegal or missing name '%s'\n", filename); + goto out; + } + + + fileattr = get_fileinfo(cli, filename); + isdirectory = (fileattr & FILE_ATTRIBUTE_DIRECTORY) + == FILE_ATTRIBUTE_DIRECTORY; + + /* + * if we've got as far as here then we have already evaluated + * the args. + */ + if (test_args) { + result = EXIT_OK; + goto out; + } + + mask = NULL; + /* make sure we have a trailing '\*' for directory */ + if (!isdirectory) { + mask = talloc_strdup(ctx, filename); + } else if (strlen(filename) > 1) { + /* + * if the passed file name doesn't have a trailing '\' + * append it. + */ + char *name_end = strrchr(filename, DIRSEP_CHAR); + if (name_end != filename + strlen(filename) + 1) { + mask = talloc_asprintf(ctx, "%s\\*", filename); + } else { + mask = talloc_strdup(ctx, filename); + } + } else { + /* filename is a single '\', just append '*' */ + mask = talloc_asprintf_append(mask, "%s*", filename); + } + + if (!mask) { + result = EXIT_FAILED; + goto out; + } + + /* + * prepare for automatic propagation of the acl passed on the + * cmdline. + */ + + ntstatus = prepare_inheritance_propagation(ctx, filename, + cbstate); + if (!NT_STATUS_IS_OK(ntstatus)) { + d_printf("error: %s processing %s\n", + nt_errstr(ntstatus), filename); + result = EXIT_FAILED; + goto out; + } + + result = cacl_set_from_sd(cli, filename, cbstate->aclsd, + cbstate->mode, cbstate->numeric); + + /* + * strictly speaking it could be considered an error if a file was + * specified with '--propagate-inheritance'. However we really want + * to eventually get rid of '--propagate-inheritance' so we will be + * more forgiving here and instead just exit early. + */ + if (!isdirectory || (result != EXIT_OK)) { + goto out; + } + + /* check if there is actually any need to propagate */ + if (cbstate->acl_no_propagate) { + goto out; + } + /* get inheritable attributes this parent container (e.g. filename) */ + ntstatus = get_inheritable_aces(ctx, filename, cbstate); + if (NT_STATUS_IS_OK(ntstatus)) { + /* process children */ + ntstatus = cli_list(cli, mask, attribute, + cacl_set_cb, + (void *)cbstate); + } + + if (!NT_STATUS_IS_OK(ntstatus)) { + d_printf("error: %s processing %s\n", + nt_errstr(ntstatus), filename); + result = EXIT_FAILED; + goto out; + } + +out: + TALLOC_FREE(ctx); + return result; +} + +struct diritem { + struct diritem *prev, *next; + /* + * dirname and targetpath below are sanitized, + * e.g. + * + start and end with '\' + * + have no trailing '*' + * + all '/' have been converted to '\' + */ + char *dirname; + char *targetpath; + struct cli_state *targetcli; +}; + +struct save_restore_stats +{ + int success; + int failure; +}; + +struct dump_context { + struct diritem *list; + struct cli_credentials *creds; + struct cli_state *cli; + struct save_restore_stats *stats; + int save_fd; + struct diritem *dir; + NTSTATUS status; +}; + +static int write_dacl(struct dump_context *ctx, + struct cli_state *cli, + const char *filename, + const char *origfname) +{ + struct security_descriptor *sd = NULL; + char *str = NULL; + const char *output_fmt = "%s\r\n%s\r\n"; + const char *tmp = NULL; + char *out_str = NULL; + uint8_t *dest = NULL; + ssize_t s_len; + size_t d_len; + bool ok; + int result; + TALLOC_CTX *frame = talloc_stackframe(); + + if (test_args) { + return EXIT_OK; + } + + if (ctx->save_fd < 0) { + DBG_ERR("error processing %s no file descriptor\n", filename); + result = EXIT_FAILED; + goto out; + } + + sd = get_secdesc(cli, filename); + if (sd == NULL) { + result = EXIT_FAILED; + goto out; + } + + sd->owner_sid = NULL; + sd->group_sid = NULL; + + str = sddl_encode(frame, sd, get_domain_sid(cli)); + if (str == NULL) { + DBG_ERR("error processing %s couldn't encode DACL\n", filename); + result = EXIT_FAILED; + goto out; + } + /* + * format of icacls save file is + * a line containing the path of the file/dir + * followed by a line containing the sddl format + * of the dacl. + * The format of the strings are null terminated + * 16-bit Unicode. Each line is terminated by "\r\n" + */ + + tmp = origfname; + /* skip leading '\' */ + if (tmp[0] == '\\') { + tmp++; + } + out_str = talloc_asprintf(frame, output_fmt, tmp, str); + + if (out_str == NULL) { + result = EXIT_FAILED; + goto out; + } + + s_len = strlen(out_str); + + ok = convert_string_talloc(out_str, + CH_UNIX, + CH_UTF16, + out_str, + s_len, (void **)(void *)&dest, &d_len); + if (!ok) { + DBG_ERR("error processing %s out of memory\n", tmp); + result = EXIT_FAILED; + goto out; + } + + if (write(ctx->save_fd, dest, d_len) != d_len) { + DBG_ERR("error processing %s failed to write to file.\n", tmp); + result = EXIT_FAILED; + goto out; + } + fsync(ctx->save_fd); + + result = EXIT_OK; + ctx->stats->success += 1; + fprintf(stdout, "Successfully processed file: %s\n", tmp); +out: + TALLOC_FREE(frame); + if (result != EXIT_OK) { + ctx->stats->failure += 1; + } + return result; +} + +/* + * Sanitize directory name. + * Given a directory name 'dir' ensure it; + * o starts with '\' + * o ends with '\' + * o doesn't end with trailing '*' + * o ensure all '/' are converted to '\' + */ + +static char *sanitize_dirname(TALLOC_CTX *ctx, + const char *dir) +{ + char *mask = NULL; + char *name_end = NULL; + + mask = talloc_strdup(ctx, dir); + name_end = strrchr(mask, '*'); + if (name_end) { + *name_end = '\0'; + } + + name_end = strrchr(mask, DIRSEP_CHAR); + + if (strlen(mask) > 0 && name_end != mask + (strlen(mask) - 1)) { + mask = talloc_asprintf(ctx, "%s\\", mask); + } + + string_replace(mask, '/', '\\'); + return mask; +} + +/* + * Process each entry (child) of a directory. + * Each entry, regardless of whether it is itself a file or directory + * has it's dacl written to the restore/save file. + * Each directory is saved to context->list (for further processing) + * write_dacl will update the stats (success/fail) + */ +static NTSTATUS cacl_dump_dacl_cb(struct file_info *f, + const char *mask, void *state) +{ + struct dump_context *ctx = talloc_get_type_abort(state, + struct dump_context); + + NTSTATUS status; + + char *mask2 = NULL; + char *targetpath = NULL; + char *unresolved = NULL; + + /* + * if we have already encountered an error + * bail out + */ + if (!NT_STATUS_IS_OK(ctx->status)) { + return ctx->status; + } + + if (!f->name || !f->name[0]) { + DBG_ERR("Empty dir name returned. Possible server " + "misconfiguration.\n"); + status = NT_STATUS_UNSUCCESSFUL; + goto out; + } + + mask2 = sanitize_dirname(ctx, mask); + if (!mask2) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + if (f->attr & FILE_ATTRIBUTE_DIRECTORY) { + struct diritem *item = NULL; + + /* ignore special '.' & '..' */ + if ((f->name == NULL) || ISDOT(f->name) || ISDOTDOT(f->name)) { + status = NT_STATUS_OK; + goto out; + } + + /* Work out the directory. */ + unresolved = sanitize_dirname(ctx, ctx->dir->dirname); + if (!unresolved) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + + unresolved = talloc_asprintf(ctx, "%s%s", unresolved, f->name); + + if (unresolved == NULL) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + + item = talloc_zero(ctx, struct diritem); + if (item == NULL) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + + item->dirname = unresolved; + + mask2 = talloc_asprintf(ctx, "%s%s", mask2, f->name); + if (!mask2) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + + status = cli_resolve_path(ctx, "", ctx->creds, ctx->cli, + mask2, &item->targetcli, &targetpath); + + if (!NT_STATUS_IS_OK(status)) { + DBG_ERR("error failed to resolve: %s\n", + nt_errstr(status)); + goto out; + } + + item->targetpath = sanitize_dirname(ctx, targetpath); + if (!item->targetpath) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + + if (write_dacl(ctx, + item->targetcli, + item->targetpath, unresolved) != EXIT_OK) { + status = NT_STATUS_UNSUCCESSFUL; + /* + * cli_list happily ignores error encountered + * when processing the callback so we need + * to save any error status encountered while + * processing directories (so we can stop recursing + * those as soon as possible). + * Changing the current behaviour of the callback + * handling by cli_list would be I think be too + * risky. + */ + ctx->status = status; + goto out; + } + + DLIST_ADD_END(ctx->list, item); + + } else { + unresolved = sanitize_dirname(ctx, ctx->dir->dirname); + if (!unresolved) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + + unresolved = talloc_asprintf(ctx, "%s%s", unresolved, f->name); + + if (!unresolved) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + /* + * build full path to the file and replace '/' with '\' so + * other utility functions can deal with it + */ + + targetpath = talloc_asprintf(ctx, "%s%s", mask2, f->name); + + if (!targetpath) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + + if (write_dacl(ctx, + ctx->dir->targetcli, + targetpath, unresolved) != EXIT_OK) { + status = NT_STATUS_UNSUCCESSFUL; + /* + * cli_list happily ignores error encountered + * when processing the callback so we need + * to save any error status encountered while + * processing directories (so we can stop recursing + * those as soon as possible). + * Changing the current behaviour of the callback + * handling by cli_list would be I think be too + * risky. + */ + ctx->status = status; + goto out; + } + } + status = NT_STATUS_OK; +out: + if (!NT_STATUS_IS_OK(status)) { + DBG_ERR("error %s: processing %s\n", + nt_errstr(status), targetpath); + } + return status; +} + +/* + * dump_ctx contains a list of directories to be processed + * + each directory 'dir' is scanned by cli_list, the cli_list + * callback 'cacl_dump_dacl_cb' writes out the dacl of each + * child of 'dir' (regardless of whether it is a dir or file) + * to the restore/save file. Additionally any directories encountered + * are returned in the passed in dump_ctx->list member + * + the directory list returned from cli_list is passed and processed + * by recursively calling dump_dacl_dirtree + * + */ +static int dump_dacl_dirtree(struct dump_context *dump_ctx) +{ + struct diritem *item = NULL; + struct dump_context *new_dump_ctx = NULL; + int result; + for (item = dump_ctx->list; item; item = item->next) { + uint16_t attribute = FILE_ATTRIBUTE_DIRECTORY + | FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN; + NTSTATUS status; + char *mask = NULL; + + new_dump_ctx = talloc_zero(dump_ctx, struct dump_context); + + if (new_dump_ctx == NULL) { + DBG_ERR("out of memory\n"); + result = EXIT_FAILED; + goto out; + } + + if (item->targetcli == NULL) { + status = cli_resolve_path(new_dump_ctx, + "", + dump_ctx->creds, + dump_ctx->cli, + item->dirname, + &item->targetcli, + &item->targetpath); + if (!NT_STATUS_IS_OK(status)) { + DBG_ERR("failed to resolve path %s " + "error: %s\n", + item->dirname, nt_errstr(status)); + result = EXIT_FAILED; + goto out; + } + } + new_dump_ctx->creds = dump_ctx->creds; + new_dump_ctx->save_fd = dump_ctx->save_fd; + new_dump_ctx->stats = dump_ctx->stats; + new_dump_ctx->dir = item; + new_dump_ctx->cli = item->targetcli; + + mask = talloc_asprintf(new_dump_ctx, "%s*", + new_dump_ctx->dir->targetpath); + status = cli_list(new_dump_ctx->dir->targetcli, + mask, + attribute, cacl_dump_dacl_cb, new_dump_ctx); + + if (!NT_STATUS_IS_OK(status) || + !NT_STATUS_IS_OK(new_dump_ctx->status)) { + NTSTATUS tmpstatus; + if (!NT_STATUS_IS_OK(status)) { + /* + * cli_list failed for some reason + * so we need to update the failure stat + */ + new_dump_ctx->stats->failure += 1; + tmpstatus = status; + } else { + /* cacl_dump_dacl_cb should have updated stat */ + tmpstatus = new_dump_ctx->status; + } + DBG_ERR("error %s: processing %s\n", + nt_errstr(tmpstatus), item->dirname); + result = EXIT_FAILED; + goto out; + } + result = dump_dacl_dirtree(new_dump_ctx); + if (result != EXIT_OK) { + goto out; + } + } + + result = EXIT_OK; +out: + TALLOC_FREE(new_dump_ctx); + return result; +} + +static int cacl_dump_dacl(struct cli_state *cli, + struct cli_credentials *creds, + char *filename) +{ + int fileattr; + char *mask = NULL; + TALLOC_CTX *ctx = NULL; + bool isdirectory = false; + int result; + struct dump_context *dump_ctx = NULL; + struct save_restore_stats stats = {0}; + struct diritem *item = NULL; + struct cli_state *targetcli = NULL; + char *targetpath = NULL; + NTSTATUS status; + + ctx = talloc_init("cacl_dump"); + if (ctx == NULL) { + DBG_ERR("out of memory\n"); + result = EXIT_FAILED; + goto out; + } + + dump_ctx = talloc_zero(ctx, struct dump_context); + if (dump_ctx == NULL) { + DBG_ERR("out of memory\n"); + result = EXIT_FAILED; + goto out; + } + + dump_ctx->save_fd = open(save_file, + O_CREAT | O_RDWR | O_TRUNC, S_IRUSR | S_IWUSR); + + if (dump_ctx->save_fd < 0) { + result = EXIT_FAILED; + goto out; + } + + dump_ctx->creds = creds; + dump_ctx->cli = cli; + dump_ctx->stats = &stats; + + /* ensure we have a filename that starts with '\' */ + if (!filename || *filename != DIRSEP_CHAR) { + /* illegal or no filename */ + result = EXIT_FAILED; + DBG_ERR("illegal or missing name '%s'\n", filename); + goto out; + } + + status = cli_resolve_path(dump_ctx, "", + dump_ctx->creds, + dump_ctx->cli, + filename, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + DBG_ERR("failed resolve %s\n", filename); + result = EXIT_FAILED; + goto out; + } + + fileattr = get_fileinfo(targetcli, targetpath); + isdirectory = (fileattr & FILE_ATTRIBUTE_DIRECTORY) + == FILE_ATTRIBUTE_DIRECTORY; + + /* + * if we've got as far as here then we have already evaluated + * the args. + */ + if (test_args) { + result = EXIT_OK; + goto out; + } + + mask = NULL; + /* make sure we have a trailing '\*' for directory */ + if (!isdirectory) { + mask = talloc_strdup(ctx, filename); + } else if (strlen(filename) > 1) { + mask = sanitize_dirname(ctx, filename); + } else { + /* filename is a single '\' */ + mask = talloc_strdup(ctx, filename); + } + if (!mask) { + result = EXIT_FAILED; + goto out; + } + + write_dacl(dump_ctx, targetcli, targetpath, filename); + if (isdirectory && recurse) { + item = talloc_zero(dump_ctx, struct diritem); + if (!item) { + result = EXIT_FAILED; + goto out; + } + item->dirname = mask; + DLIST_ADD_END(dump_ctx->list, item); + dump_dacl_dirtree(dump_ctx); + } + + fprintf(stdout, "Successfully processed %d files: " + "Failed processing %d files\n", + dump_ctx->stats->success, dump_ctx->stats->failure); + result = EXIT_OK; +out: + if (dump_ctx && dump_ctx->save_fd > 0) { + close(dump_ctx->save_fd); + } + TALLOC_FREE(ctx); + return result; +} + +struct restore_dacl { + const char *path; + struct security_descriptor *sd; +}; + +/* + * Restore dacls from 'savefile' produced by + * 'icacls name /save' or 'smbcacls --save' + */ +static int cacl_restore(struct cli_state *cli, + struct cli_credentials *creds, + bool numeric, const char *restorefile) +{ + int restore_fd; + int result; + struct save_restore_stats stats = { 0 }; + + char **lines = NULL; + char *content = NULL; + char *convert_content = NULL; + size_t content_size; + struct restore_dacl *entries = NULL; + int numlines, i = 0; + bool ok; + struct dom_sid *sid = NULL; + + if (restorefile == NULL) { + DBG_ERR("No restore file specified\n"); + result = EXIT_FAILED; + goto out; + } + + if (test_args) { + result = EXIT_OK; + goto out; + } + + restore_fd = open(restorefile, O_RDONLY, S_IRUSR | S_IWUSR); + if (restore_fd < 0) { + DBG_ERR("Failed to open %s.\n", restorefile); + result = EXIT_FAILED; + goto out; + } + + content = fd_load(restore_fd, &content_size, 0, talloc_tos()); + + close(restore_fd); + + if (content == NULL) { + DBG_ERR("Failed to load content from %s.\n", restorefile); + result = EXIT_FAILED; + goto out; + } + + ok = convert_string_talloc(talloc_tos(), + CH_UTF16, + CH_UNIX, + content, + utf16_len_n(content, content_size), + (void **)(void *)&convert_content, + &content_size); + + TALLOC_FREE(content); + + if (!ok) { + DBG_ERR("Failed to convert content from %s " + "to CH_UNIX.\n", restorefile); + result = EXIT_FAILED; + goto out; + } + + lines = file_lines_parse(convert_content, + content_size, &numlines, talloc_tos()); + + if (lines == NULL) { + DBG_ERR("Failed to parse lines from content of %s.", + restorefile); + result = EXIT_FAILED; + goto out; + } + + entries = talloc_zero_array(lines, struct restore_dacl, numlines / 2); + + if (entries == NULL) { + DBG_ERR("error processing %s, out of memory\n", restorefile); + result = EXIT_FAILED; + goto out; + } + + sid = get_domain_sid(cli); + + while (i < numlines) { + int index = i / 2; + int first_line = (i % 2) == 0; + + if (first_line) { + char *tmp = NULL; + tmp = lines[i]; + /* line can be blank if root of share */ + if (strlen(tmp) == 0) { + entries[index].path = talloc_strdup(lines, + "\\"); + } else { + entries[index].path = lines[i]; + } + } else { + const char *msg = NULL; + size_t msg_offset = 0; + enum ace_condition_flags flags = + ACE_CONDITION_FLAG_ALLOW_DEVICE; + entries[index].sd = sddl_decode_err_msg(lines, + lines[i], + sid, + flags, + &msg, + &msg_offset); + if(entries[index].sd == NULL) { + DBG_ERR("could not decode '%s'\n", lines[i]); + if (msg != NULL) { + DBG_ERR(" %*c\n", + (int)msg_offset, '^'); + DBG_ERR("error '%s'\n", msg); + } + result = EXIT_FAILED; + goto out; + } + entries[index].sd->type |= + SEC_DESC_DACL_AUTO_INHERIT_REQ; + entries[index].sd->type |= SEC_DESC_SACL_AUTO_INHERITED; + } + i++; + } + for (i = 0; i < (numlines / 2); i++) { + int mode = SMB_ACL_SET; + int set_result; + struct cli_state *targetcli = NULL; + char *targetpath = NULL; + NTSTATUS status; + + /* check for dfs */ + status = cli_resolve_path(talloc_tos(), + "", + creds, + cli, + entries[i].path, + &targetcli, &targetpath); + + if (!NT_STATUS_IS_OK(status)) { + printf("Error failed to process file: %s\n", + entries[i].path); + stats.failure += 1; + continue; + } + + set_result = cacl_set_from_sd(targetcli, + targetpath, + entries[i].sd, mode, numeric); + + if (set_result == EXIT_OK) { + printf("Successfully processed file: %s\n", + entries[i].path); + stats.success += 1; + } else { + printf("Error failed to process file: %s\n", + entries[i].path); + stats.failure += 1; + } + } + + result = EXIT_OK; +out: + TALLOC_FREE(lines); + fprintf(stdout, "Successfully processed %d files: " + "Failed processing %d files\n", stats.success, stats.failure); + return result; +} + +/**************************************************************************** + main program +****************************************************************************/ +int main(int argc, char *argv[]) +{ + const char **argv_const = discard_const_p(const char *, argv); + char *share; + int opt; + enum acl_mode mode = SMB_ACL_SET; + static char *the_acl = NULL; + enum chown_mode change_mode = REQUEST_NONE; + int result; + char *path; + char *filename = NULL; + poptContext pc; + /* numeric is set when the user wants numeric SIDs and ACEs rather + than going via LSA calls to resolve them */ + int numeric = 0; + struct cli_state *targetcli = NULL; + struct cli_credentials *creds = NULL; + char *targetfile = NULL; + NTSTATUS status; + bool ok; + struct loadparm_context *lp_ctx = NULL; + + struct poptOption long_options[] = { + POPT_AUTOHELP + { + .longName = "delete", + .shortName = 'D', + .argInfo = POPT_ARG_STRING, + .arg = NULL, + .val = 'D', + .descrip = "Delete an acl", + .argDescrip = "ACL", + }, + { + .longName = "modify", + .shortName = 'M', + .argInfo = POPT_ARG_STRING, + .arg = NULL, + .val = 'M', + .descrip = "Modify an acl", + .argDescrip = "ACL", + }, + { + .longName = "add", + .shortName = 'a', + .argInfo = POPT_ARG_STRING, + .arg = NULL, + .val = 'a', + .descrip = "Add an acl", + .argDescrip = "ACL", + }, + { + .longName = "set", + .shortName = 'S', + .argInfo = POPT_ARG_STRING, + .arg = NULL, + .val = 'S', + .descrip = "Set acls", + .argDescrip = "ACLS", + }, + { + .longName = "chown", + .shortName = 'C', + .argInfo = POPT_ARG_STRING, + .arg = NULL, + .val = 'C', + .descrip = "Change ownership of a file", + .argDescrip = "USERNAME", + }, + { + .longName = "chgrp", + .shortName = 'G', + .argInfo = POPT_ARG_STRING, + .arg = NULL, + .val = 'G', + .descrip = "Change group ownership of a file", + .argDescrip = "GROUPNAME", + }, + { + .longName = "inherit", + .shortName = 'I', + .argInfo = POPT_ARG_STRING, + .arg = NULL, + .val = 'I', + .descrip = "Inherit allow|remove|copy", + }, + { + .longName = "propagate-inheritance", + .shortName = 0, + .argInfo = POPT_ARG_NONE, + .arg = &inheritance, + .val = 1, + .descrip = "Supports propagation of inheritable ACE(s) when used in conjunction with add, delete, set or modify", + }, + { + .longName = "save", + .shortName = 0, + .argInfo = POPT_ARG_STRING, + .arg = &save_file, + .val = 1, + .descrip = "stores the DACLs in sddl format of the " + "specified file or folder for later use " + "with restore. SACLS, owner or integrity" + " labels are not stored", + }, + { + .longName = "restore", + .shortName = 0, + .argInfo = POPT_ARG_STRING, + .arg = &restore_file, + .val = 1, + .descrip = "applies the stored DACLS to files in " + "directory.", + }, + { + .longName = "recurse", + .shortName = 0, + .argInfo = POPT_ARG_NONE, + .arg = &recurse, + .val = 1, + .descrip = "indicates the operation is performed " + "on directory and all files/directories" + " below. (only applies to save option)", + }, + { + .longName = "numeric", + .shortName = 0, + .argInfo = POPT_ARG_NONE, + .arg = &numeric, + .val = 1, + .descrip = "Don't resolve sids or masks to names", + }, + { + .longName = "sddl", + .shortName = 0, + .argInfo = POPT_ARG_NONE, + .arg = &sddl, + .val = 1, + .descrip = "Output and input acls in sddl format", + }, + { + .longName = "query-security-info", + .shortName = 0, + .argInfo = POPT_ARG_INT, + .arg = &query_sec_info, + .val = 1, + .descrip = "The security-info flags for queries" + }, + { + .longName = "set-security-info", + .shortName = 0, + .argInfo = POPT_ARG_INT, + .arg = &set_sec_info, + .val = 1, + .descrip = "The security-info flags for modifications" + }, + { + .longName = "test-args", + .shortName = 't', + .argInfo = POPT_ARG_NONE, + .arg = &test_args, + .val = 1, + .descrip = "Test arguments" + }, + { + .longName = "domain-sid", + .shortName = 0, + .argInfo = POPT_ARG_STRING, + .arg = &domain_sid, + .val = 0, + .descrip = "Domain SID for sddl", + .argDescrip = "SID"}, + { + .longName = "maximum-access", + .shortName = 'x', + .argInfo = POPT_ARG_NONE, + .arg = NULL, + .val = 'x', + .descrip = "Query maximum permissions", + }, + POPT_COMMON_SAMBA + POPT_COMMON_CONNECTION + POPT_COMMON_CREDENTIALS + POPT_LEGACY_S3 + POPT_COMMON_VERSION + POPT_TABLEEND + }; + + struct cli_state *cli; + TALLOC_CTX *frame = talloc_stackframe(); + const char *owner_username = ""; + char *server; + + smb_init_locale(); + + ok = samba_cmdline_init(frame, + SAMBA_CMDLINE_CONFIG_CLIENT, + false /* require_smbconf */); + if (!ok) { + DBG_ERR("Failed to init cmdline parser!\n"); + TALLOC_FREE(frame); + exit(1); + } + lp_ctx = samba_cmdline_get_lp_ctx(); + /* set default debug level to 1 regardless of what smb.conf sets */ + lpcfg_set_cmdline(lp_ctx, "log level", "1"); + + setlinebuf(stdout); + + pc = samba_popt_get_context(getprogname(), + argc, + argv_const, + long_options, + 0); + if (pc == NULL) { + DBG_ERR("Failed to setup popt context!\n"); + TALLOC_FREE(frame); + exit(1); + } + + poptSetOtherOptionHelp(pc, "//server1/share1 filename\nACLs look like: " + "'ACL:user:[ALLOWED|DENIED]/flags/permissions'"); + + while ((opt = poptGetNextOpt(pc)) != -1) { + switch (opt) { + case 'S': + the_acl = smb_xstrdup(poptGetOptArg(pc)); + mode = SMB_ACL_SET; + break; + + case 'D': + the_acl = smb_xstrdup(poptGetOptArg(pc)); + mode = SMB_ACL_DELETE; + break; + + case 'M': + the_acl = smb_xstrdup(poptGetOptArg(pc)); + mode = SMB_ACL_MODIFY; + break; + + case 'a': + the_acl = smb_xstrdup(poptGetOptArg(pc)); + mode = SMB_ACL_ADD; + break; + + case 'C': + owner_username = poptGetOptArg(pc); + change_mode = REQUEST_CHOWN; + break; + + case 'G': + owner_username = poptGetOptArg(pc); + change_mode = REQUEST_CHGRP; + break; + + case 'I': + owner_username = poptGetOptArg(pc); + change_mode = REQUEST_INHERIT; + break; + case 'm': + lpcfg_set_cmdline(lp_ctx, "client max protocol", poptGetOptArg(pc)); + break; + case 'x': + want_mxac = true; + break; + case POPT_ERROR_BADOPT: + fprintf(stderr, "\nInvalid option %s: %s\n\n", + poptBadOption(pc, 0), poptStrerror(opt)); + poptPrintUsage(pc, stderr, 0); + exit(1); + } + } + if (inheritance && !the_acl) { + poptPrintUsage(pc, stderr, 0); + return -1; + } + + if(!poptPeekArg(pc)) { + poptPrintUsage(pc, stderr, 0); + return -1; + } + + path = talloc_strdup(frame, poptGetArg(pc)); + if (!path) { + return -1; + } + + if (strncmp(path, "\\\\", 2) && strncmp(path, "//", 2)) { + printf("Invalid argument: %s\n", path); + return -1; + } + + if(!poptPeekArg(pc)) { + poptPrintUsage(pc, stderr, 0); + return -1; + } + + filename = talloc_strdup(frame, poptGetArg(pc)); + if (!filename) { + return -1; + } + + poptFreeContext(pc); + samba_cmdline_burn(argc, argv); + + string_replace(path,'/','\\'); + + server = talloc_strdup(frame, path+2); + if (!server) { + return -1; + } + share = strchr_m(server,'\\'); + if (share == NULL) { + printf("Invalid argument\n"); + return -1; + } + + *share = 0; + share++; + + creds = samba_cmdline_get_creds(); + + /* Make connection to server */ + if (!test_args) { + cli = connect_one(creds, server, share); + if (!cli) { + exit(EXIT_FAILED); + } + } else { + exit(0); + } + + string_replace(filename, '/', '\\'); + if (filename[0] != '\\') { + filename = talloc_asprintf(frame, + "\\%s", + filename); + if (!filename) { + return -1; + } + } + + status = cli_resolve_path(frame, + "", + creds, + cli, + filename, + &targetcli, + &targetfile); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0,("cli_resolve_path failed for %s! (%s)\n", filename, nt_errstr(status))); + return -1; + } + + /* Perform requested action */ + + if (change_mode == REQUEST_INHERIT) { + result = inherit(targetcli, targetfile, owner_username); + } else if (change_mode != REQUEST_NONE) { + result = owner_set(targetcli, change_mode, targetfile, owner_username); + } else if (the_acl) { + if (inheritance) { + struct cacl_callback_state cbstate = { + .creds = creds, + .cli = targetcli, + .mode = mode, + .the_acl = the_acl, + .numeric = numeric, + }; + result = inheritance_cacl_set(targetfile, &cbstate); + } else { + result = cacl_set(targetcli, + targetfile, + the_acl, + mode, + numeric); + } + } else { + if (save_file || restore_file) { + sddl = 1; + if (save_file) { + result = cacl_dump_dacl(cli, creds, filename); + } else { + result = cacl_restore(targetcli, + creds, + numeric, restore_file); + } + } else { + result = cacl_dump(targetcli, targetfile, numeric); + } + } + + gfree_all(); + TALLOC_FREE(frame); + + return result; +} |