source3/utils/smbcacls.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    ACL get/set utility
   4
   5    Copyright (C) Andrew Tridgell 2000
   6    Copyright (C) Tim Potter      2000
   7    Copyright (C) Jeremy Allison  2000
   8    Copyright (C) Jelmer Vernooij 2003
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "popt_common.h"
  26 #include "rpc_client/cli_pipe.h"
  27 #include "../librpc/gen_ndr/ndr_lsa.h"
  28 #include "rpc_client/cli_lsarpc.h"
  29 #include "../libcli/security/security.h"
  30 #include "libsmb/libsmb.h"
  31 #include "libsmb/clirap.h"
  32 #include "passdb/machine_sid.h"
  33 #include "../librpc/gen_ndr/ndr_lsa_c.h"
  34 #include "util_sd.h"
  35
  36 static int test_args;
  37
  38 #define CREATE_ACCESS_READ READ_CONTROL_ACCESS
  39
  40 static int sddl;
  41 static int query_sec_info = -1;
  42 static int set_sec_info = -1;
  43
  44 static const char *domain_sid = NULL;
  45
  46 enum acl_mode {SMB_ACL_SET, SMB_ACL_DELETE, SMB_ACL_MODIFY, SMB_ACL_ADD };
  47 enum chown_mode {REQUEST_NONE, REQUEST_CHOWN, REQUEST_CHGRP, REQUEST_INHERIT};
  48 enum exit_values {EXIT_OK, EXIT_FAILED, EXIT_PARSE_ERROR};
  49
  50 static NTSTATUS cli_lsa_lookup_domain_sid(struct cli_state *cli,
  51                                           struct dom_sid *sid)
  52 {
  53         union lsa_PolicyInformation *info = NULL;
  54         struct smbXcli_tcon *orig_tcon = NULL;
  55         struct rpc_pipe_client *rpc_pipe = NULL;
  56         struct policy_handle handle;
  57         NTSTATUS status, result;
  58         TALLOC_CTX *frame = talloc_stackframe();
  59
  60         if (cli_state_has_tcon(cli)) {
  61                 orig_tcon = cli_state_save_tcon(cli);
  62                 if (orig_tcon == NULL) {
  63                         status = NT_STATUS_NO_MEMORY;
  64                         goto done;
  65                 }
  66         }
  67
  68         status = cli_tree_connect(cli, "IPC$", "?????", NULL);
  69         if (!NT_STATUS_IS_OK(status)) {
  70                 goto done;
  71         }
  72
  73         status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc, &rpc_pipe);
  74         if (!NT_STATUS_IS_OK(status)) {
  75                 goto tdis;
  76         }
  77
  78         status = rpccli_lsa_open_policy(rpc_pipe, frame, True,
  79                                         GENERIC_EXECUTE_ACCESS, &handle);
  80         if (!NT_STATUS_IS_OK(status)) {
  81                 goto tdis;
  82         }
  83
  84         status = dcerpc_lsa_QueryInfoPolicy2(rpc_pipe->binding_handle,
  85                                              frame, &handle,
  86                                              LSA_POLICY_INFO_DOMAIN,
  87                                              &info, &result);
  88
  89         if (any_nt_status_not_ok(status, result, &status)) {
  90                 goto tdis;
  91         }
  92
  93         *sid = *info->domain.sid;
  94
  95 tdis:
  96         TALLOC_FREE(rpc_pipe);
  97         cli_tdis(cli);
  98 done:
  99         cli_state_restore_tcon(cli, orig_tcon);
 100         TALLOC_FREE(frame);
 101         return status;
 102 }
 103
 104 static struct dom_sid *get_domain_sid(struct cli_state *cli)
 105 {
 106         NTSTATUS status;
 107
 108         struct dom_sid *sid = talloc(talloc_tos(), struct dom_sid);
 109         if (sid == NULL) {
 110                 DEBUG(0, ("Out of memory\n"));
 111                 return NULL;
 112         }
 113
 114         if (domain_sid) {
 115                 if (!dom_sid_parse(domain_sid, sid)) {
 116                         DEBUG(0,("failed to parse domain sid\n"));
 117                         TALLOC_FREE(sid);
 118                 }
 119         } else {
 120                 status = cli_lsa_lookup_domain_sid(cli, sid);
 121
 122                 if (!NT_STATUS_IS_OK(status)) {
 123                         DEBUG(0,("failed to lookup domain sid: %s\n", nt_errstr(status)));
 124                         TALLOC_FREE(sid);
 125                 }
 126
 127         }
 128
 129         DEBUG(2,("Domain SID: %s\n", sid_string_dbg(sid)));
 130         return sid;
 131 }
 132
 133 /* add an ACE to a list of ACEs in a struct security_acl */
 134 static bool add_ace(struct security_acl **the_acl, struct security_ace *ace)
 135 {
 136         struct security_acl *new_ace;
 137         struct security_ace *aces;
 138         if (! *the_acl) {
 139                 return (((*the_acl) = make_sec_acl(talloc_tos(), 3, 1, ace))
 140                         != NULL);
 141         }
 142
 143         if (!(aces = SMB_CALLOC_ARRAY(struct security_ace, 1+(*the_acl)->num_aces))) {
 144                 return False;
 145         }
 146         memcpy(aces, (*the_acl)->aces, (*the_acl)->num_aces * sizeof(struct
 147         security_ace));
 148         memcpy(aces+(*the_acl)->num_aces, ace, sizeof(struct security_ace));
 149         new_ace = make_sec_acl(talloc_tos(),(*the_acl)->revision,1+(*the_acl)->num_aces, aces);
 150         SAFE_FREE(aces);
 151         (*the_acl) = new_ace;
 152         return True;
 153 }
 154
 155 /* parse a ascii version of a security descriptor */
 156 static struct security_descriptor *sec_desc_parse(TALLOC_CTX *ctx, struct cli_state *cli, char *str)
 157 {
 158         const char *p = str;
 159         char *tok;
 160         struct security_descriptor *ret = NULL;
 161         size_t sd_size;
 162         struct dom_sid *grp_sid=NULL, *owner_sid=NULL;
 163         struct security_acl *dacl=NULL;
 164         int revision=1;
 165
 166         while (next_token_talloc(ctx, &p, &tok, "\t,\r\n")) {
 167                 if (strncmp(tok,"REVISION:", 9) == 0) {
 168                         revision = strtol(tok+9, NULL, 16);
 169                         continue;
 170                 }
 171
 172                 if (strncmp(tok,"OWNER:", 6) == 0) {
 173                         if (owner_sid) {
 174                                 printf("Only specify owner once\n");
 175                                 goto done;
 176                         }
 177                         owner_sid = SMB_CALLOC_ARRAY(struct dom_sid, 1);
 178                         if (!owner_sid ||
 179                             !StringToSid(cli, owner_sid, tok+6)) {
 180                                 printf("Failed to parse owner sid\n");
 181                                 goto done;
 182                         }
 183                         continue;
 184                 }
 185
 186                 if (strncmp(tok,"GROUP:", 6) == 0) {
 187                         if (grp_sid) {
 188                                 printf("Only specify group once\n");
 189                                 goto done;
 190                         }
 191                         grp_sid = SMB_CALLOC_ARRAY(struct dom_sid, 1);
 192                         if (!grp_sid ||
 193                             !StringToSid(cli, grp_sid, tok+6)) {
 194                                 printf("Failed to parse group sid\n");
 195                                 goto done;
 196                         }
 197                         continue;
 198                 }
 199
 200                 if (strncmp(tok,"ACL:", 4) == 0) {
 201                         struct security_ace ace;
 202                         if (!parse_ace(cli, &ace, tok+4)) {
 203                                 goto done;
 204                         }
 205                         if(!add_ace(&dacl, &ace)) {
 206                                 printf("Failed to add ACL %s\n", tok);
 207                                 goto done;
 208                         }
 209                         continue;
 210                 }
 211
 212                 printf("Failed to parse token '%s' in security descriptor,\n", tok);
 213                 goto done;
 214         }
 215
 216         ret = make_sec_desc(ctx,revision, SEC_DESC_SELF_RELATIVE, owner_sid, grp_sid,
 217                             NULL, dacl, &sd_size);
 218
 219   done:
 220         SAFE_FREE(grp_sid);
 221         SAFE_FREE(owner_sid);
 222
 223         return ret;
 224 }
 225
 226 /*****************************************************
 227 get fileinfo for filename
 228 *******************************************************/
 229 static uint16_t get_fileinfo(struct cli_state *cli, const char *filename)
 230 {
 231         uint16_t fnum = (uint16_t)-1;
 232         NTSTATUS status;
 233         struct smb_create_returns cr = {0};
 234
 235         /* The desired access below is the only one I could find that works
 236            with NT4, W2KP and Samba */
 237
 238         status = cli_ntcreate(cli, filename, 0, CREATE_ACCESS_READ,
 239                               0, FILE_SHARE_READ|FILE_SHARE_WRITE,
 240                               FILE_OPEN, 0x0, 0x0, &fnum, &cr);
 241         if (!NT_STATUS_IS_OK(status)) {
 242                 printf("Failed to open %s: %s\n", filename, nt_errstr(status));
 243                 return 0;
 244         }
 245
 246         cli_close(cli, fnum);
 247         return cr.file_attributes;
 248 }
 249
 250 /*****************************************************
 251 get sec desc for filename
 252 *******************************************************/
 253 static struct security_descriptor *get_secdesc(struct cli_state *cli, const char *filename)
 254 {
 255         uint16_t fnum = (uint16_t)-1;
 256         struct security_descriptor *sd;
 257         NTSTATUS status;
 258         uint32_t sec_info;
 259         uint32_t desired_access = 0;
 260
 261         if (query_sec_info == -1) {
 262                 sec_info = SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL;
 263         } else {
 264                 sec_info = query_sec_info;
 265         }
 266
 267         if (sec_info & (SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL)) {
 268                 desired_access |= SEC_STD_READ_CONTROL;
 269         }
 270         if (sec_info & SECINFO_SACL) {
 271                 desired_access |= SEC_FLAG_SYSTEM_SECURITY;
 272         }
 273
 274         if (desired_access == 0) {
 275                 desired_access |= SEC_STD_READ_CONTROL;
 276         }
 277
 278         status = cli_ntcreate(cli, filename, 0, desired_access,
 279                               0, FILE_SHARE_READ|FILE_SHARE_WRITE,
 280                               FILE_OPEN, 0x0, 0x0, &fnum, NULL);
 281         if (!NT_STATUS_IS_OK(status)) {
 282                 printf("Failed to open %s: %s\n", filename, nt_errstr(status));
 283                 return NULL;
 284         }
 285
 286         status = cli_query_security_descriptor(cli, fnum, sec_info,
 287                                                talloc_tos(), &sd);
 288
 289         cli_close(cli, fnum);
 290
 291         if (!NT_STATUS_IS_OK(status)) {
 292                 printf("Failed to get security descriptor: %s\n",
 293                        nt_errstr(status));
 294                 return NULL;
 295         }
 296         return sd;
 297 }
 298
 299 /*****************************************************
 300 set sec desc for filename
 301 *******************************************************/
 302 static bool set_secdesc(struct cli_state *cli, const char *filename,
 303                         struct security_descriptor *sd)
 304 {
 305         uint16_t fnum = (uint16_t)-1;
 306         bool result=true;
 307         NTSTATUS status;
 308         uint32_t desired_access = 0;
 309         uint32_t sec_info;
 310
 311         if (set_sec_info == -1) {
 312                 sec_info = 0;
 313
 314                 if (sd->dacl || (sd->type & SEC_DESC_DACL_PRESENT)) {
 315                         sec_info |= SECINFO_DACL;
 316                 }
 317                 if (sd->sacl || (sd->type & SEC_DESC_SACL_PRESENT)) {
 318                         sec_info |= SECINFO_SACL;
 319                 }
 320                 if (sd->owner_sid) {
 321                         sec_info |= SECINFO_OWNER;
 322                 }
 323                 if (sd->group_sid) {
 324                         sec_info |= SECINFO_GROUP;
 325                 }
 326         } else {
 327                 sec_info = set_sec_info;
 328         }
 329
 330         /* Make the desired_access more specific. */
 331         if (sec_info & SECINFO_DACL) {
 332                 desired_access |= SEC_STD_WRITE_DAC;
 333         }
 334         if (sec_info & SECINFO_SACL) {
 335                 desired_access |= SEC_FLAG_SYSTEM_SECURITY;
 336         }
 337         if (sec_info & (SECINFO_OWNER | SECINFO_GROUP)) {
 338                 desired_access |= SEC_STD_WRITE_OWNER;
 339         }
 340
 341         status = cli_ntcreate(cli, filename, 0,
 342                               desired_access,
 343                               0, FILE_SHARE_READ|FILE_SHARE_WRITE,
 344                               FILE_OPEN, 0x0, 0x0, &fnum, NULL);
 345         if (!NT_STATUS_IS_OK(status)) {
 346                 printf("Failed to open %s: %s\n", filename, nt_errstr(status));
 347                 return false;
 348         }
 349
 350         status = cli_set_security_descriptor(cli, fnum, sec_info, sd);
 351         if (!NT_STATUS_IS_OK(status)) {
 352                 printf("ERROR: security descriptor set failed: %s\n",
 353                        nt_errstr(status));
 354                 result=false;
 355         }
 356
 357         cli_close(cli, fnum);
 358         return result;
 359 }
 360
 361 /*****************************************************
 362 dump the acls for a file
 363 *******************************************************/
 364 static int cacl_dump(struct cli_state *cli, const char *filename, bool numeric)
 365 {
 366         struct security_descriptor *sd;
 367
 368         if (test_args) {
 369                 return EXIT_OK;
 370         }
 371
 372         sd = get_secdesc(cli, filename);
 373         if (sd == NULL) {
 374                 return EXIT_FAILED;
 375         }
 376
 377         if (sddl) {
 378                 char *str = sddl_encode(talloc_tos(), sd, get_domain_sid(cli));
 379                 if (str == NULL) {
 380                         return EXIT_FAILED;
 381                 }
 382                 printf("%s\n", str);
 383                 TALLOC_FREE(str);
 384         } else {
 385                 sec_desc_print(cli, stdout, sd, numeric);
 386         }
 387
 388         return EXIT_OK;
 389 }
 390
 391 /*****************************************************
 392 Change the ownership or group ownership of a file. Just
 393 because the NT docs say this can't be done :-). JRA.
 394 *******************************************************/
 395
 396 static int owner_set(struct cli_state *cli, enum chown_mode change_mode,
 397                         const char *filename, const char *new_username)
 398 {
 399         struct dom_sid sid;
 400         struct security_descriptor *sd, *old;
 401         size_t sd_size;
 402
 403         if (!StringToSid(cli, &sid, new_username))
 404                 return EXIT_PARSE_ERROR;
 405
 406         old = get_secdesc(cli, filename);
 407
 408         if (!old) {
 409                 return EXIT_FAILED;
 410         }
 411
 412         sd = make_sec_desc(talloc_tos(),old->revision, SEC_DESC_SELF_RELATIVE,
 413                                 (change_mode == REQUEST_CHOWN) ? &sid : NULL,
 414                                 (change_mode == REQUEST_CHGRP) ? &sid : NULL,
 415                            NULL, NULL, &sd_size);
 416
 417         if (!set_secdesc(cli, filename, sd)) {
 418                 return EXIT_FAILED;
 419         }
 420
 421         return EXIT_OK;
 422 }
 423
 424
 425 /* The MSDN is contradictory over the ordering of ACE entries in an
 426    ACL.  However NT4 gives a "The information may have been modified
 427    by a computer running Windows NT 5.0" if denied ACEs do not appear
 428    before allowed ACEs. At
 429    http://technet.microsoft.com/en-us/library/cc781716.aspx the
 430    canonical order is specified as "Explicit Deny, Explicit Allow,
 431    Inherited ACEs unchanged" */
 432
 433 static int ace_compare(struct security_ace *ace1, struct security_ace *ace2)
 434 {
 435         if (security_ace_equal(ace1, ace2))
 436                 return 0;
 437
 438         if ((ace1->flags & SEC_ACE_FLAG_INHERITED_ACE) &&
 439                         !(ace2->flags & SEC_ACE_FLAG_INHERITED_ACE))
 440                 return 1;
 441         if (!(ace1->flags & SEC_ACE_FLAG_INHERITED_ACE) &&
 442                         (ace2->flags & SEC_ACE_FLAG_INHERITED_ACE))
 443                 return -1;
 444         if ((ace1->flags & SEC_ACE_FLAG_INHERITED_ACE) &&
 445                         (ace2->flags & SEC_ACE_FLAG_INHERITED_ACE))
 446                 return ace1 - ace2;
 447
 448         if (ace1->type != ace2->type)
 449                 return ace2->type - ace1->type;
 450
 451         if (dom_sid_compare(&ace1->trustee, &ace2->trustee))
 452                 return dom_sid_compare(&ace1->trustee, &ace2->trustee);
 453
 454         if (ace1->flags != ace2->flags)
 455                 return ace1->flags - ace2->flags;
 456
 457         if (ace1->access_mask != ace2->access_mask)
 458                 return ace1->access_mask - ace2->access_mask;
 459
 460         if (ace1->size != ace2->size)
 461                 return ace1->size - ace2->size;
 462
 463         return memcmp(ace1, ace2, sizeof(struct security_ace));
 464 }
 465
 466 static void sort_acl(struct security_acl *the_acl)
 467 {
 468         uint32_t i;
 469         if (!the_acl) return;
 470
 471         TYPESAFE_QSORT(the_acl->aces, the_acl->num_aces, ace_compare);
 472
 473         for (i=1;i<the_acl->num_aces;) {
 474                 if (security_ace_equal(&the_acl->aces[i-1],
 475                                        &the_acl->aces[i])) {
 476                         int j;
 477                         for (j=i; j<the_acl->num_aces-1; j++) {
 478                                 the_acl->aces[j] = the_acl->aces[j+1];
 479                         }
 480                         the_acl->num_aces--;
 481                 } else {
 482                         i++;
 483                 }
 484         }
 485 }
 486
 487 /*****************************************************
 488 set the ACLs on a file given an ascii description
 489 *******************************************************/
 490
 491 static int cacl_set(struct cli_state *cli, const char *filename,
 492                     char *the_acl, enum acl_mode mode, bool numeric)
 493 {
 494         struct security_descriptor *sd, *old;
 495         uint32_t i, j;
 496         size_t sd_size;
 497         int result = EXIT_OK;
 498
 499         if (sddl) {
 500                 sd = sddl_decode(talloc_tos(), the_acl, get_domain_sid(cli));
 501         } else {
 502                 sd = sec_desc_parse(talloc_tos(), cli, the_acl);
 503         }
 504
 505         if (!sd) return EXIT_PARSE_ERROR;
 506         if (test_args) return EXIT_OK;
 507
 508         if (mode != SMB_ACL_SET) {
 509                 /*
 510                  * Do not fetch old ACL when it will be overwritten
 511                  * completely with a new one.
 512                  */
 513                 old = get_secdesc(cli, filename);
 514
 515                 if (!old) {
 516                         return EXIT_FAILED;
 517                 }
 518         }
 519
 520         /* the logic here is rather more complex than I would like */
 521         switch (mode) {
 522         case SMB_ACL_DELETE:
 523                 for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
 524                         bool found = False;
 525
 526                         for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
 527                                 if (security_ace_equal(&sd->dacl->aces[i],
 528                                                        &old->dacl->aces[j])) {
 529                                         uint32_t k;
 530                                         for (k=j; k<old->dacl->num_aces-1;k++) {
 531                                                 old->dacl->aces[k] = old->dacl->aces[k+1];
 532                                         }
 533                                         old->dacl->num_aces--;
 534                                         found = True;
 535                                         break;
 536                                 }
 537                         }
 538
 539                         if (!found) {
 540                                 printf("ACL for ACE:");
 541                                 print_ace(cli, stdout, &sd->dacl->aces[i],
 542                                           numeric);
 543                                 printf(" not found\n");
 544                         }
 545                 }
 546                 break;
 547
 548         case SMB_ACL_MODIFY:
 549                 for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
 550                         bool found = False;
 551
 552                         for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
 553                                 if (dom_sid_equal(&sd->dacl->aces[i].trustee,
 554                                               &old->dacl->aces[j].trustee)) {
 555                                         old->dacl->aces[j] = sd->dacl->aces[i];
 556                                         found = True;
 557                                 }
 558                         }
 559
 560                         if (!found) {
 561                                 fstring str;
 562
 563                                 SidToString(cli, str,
 564                                             &sd->dacl->aces[i].trustee,
 565                                             numeric);
 566                                 printf("ACL for SID %s not found\n", str);
 567                         }
 568                 }
 569
 570                 if (sd->owner_sid) {
 571                         old->owner_sid = sd->owner_sid;
 572                 }
 573
 574                 if (sd->group_sid) {
 575                         old->group_sid = sd->group_sid;
 576                 }
 577
 578                 break;
 579
 580         case SMB_ACL_ADD:
 581                 for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
 582                         add_ace(&old->dacl, &sd->dacl->aces[i]);
 583                 }
 584                 break;
 585
 586         case SMB_ACL_SET:
 587                 old = sd;
 588                 break;
 589         }
 590
 591         /* Denied ACE entries must come before allowed ones */
 592         sort_acl(old->dacl);
 593
 594         /* Create new security descriptor and set it */
 595
 596         /* We used to just have "WRITE_DAC_ACCESS" without WRITE_OWNER.
 597            But if we're sending an owner, even if it's the same as the one
 598            that already exists then W2K3 insists we open with WRITE_OWNER access.
 599            I need to check that setting a SD with no owner set works against WNT
 600            and W2K. JRA.
 601         */
 602
 603         sd = make_sec_desc(talloc_tos(),old->revision, old->type,
 604                            old->owner_sid, old->group_sid,
 605                            NULL, old->dacl, &sd_size);
 606
 607         if (!set_secdesc(cli, filename, sd)) {
 608                 result = EXIT_FAILED;
 609         }
 610
 611         return result;
 612 }
 613
 614 /*****************************************************
 615 set the inherit on a file
 616 *******************************************************/
 617 static int inherit(struct cli_state *cli, const char *filename,
 618                    const char *type)
 619 {
 620         struct security_descriptor *old,*sd;
 621         uint32_t oldattr;
 622         size_t sd_size;
 623         int result = EXIT_OK;
 624
 625         old = get_secdesc(cli, filename);
 626
 627         if (!old) {
 628                 return EXIT_FAILED;
 629         }
 630
 631         oldattr = get_fileinfo(cli,filename);
 632
 633         if (strcmp(type,"allow")==0) {
 634                 if ((old->type & SEC_DESC_DACL_PROTECTED) ==
 635                     SEC_DESC_DACL_PROTECTED) {
 636                         int i;
 637                         char *parentname,*temp;
 638                         struct security_descriptor *parent;
 639                         temp = talloc_strdup(talloc_tos(), filename);
 640
 641                         old->type=old->type & (~SEC_DESC_DACL_PROTECTED);
 642
 643                         /* look at parent and copy in all its inheritable ACL's. */
 644                         string_replace(temp, '\\', '/');
 645                         if (!parent_dirname(talloc_tos(),temp,&parentname,NULL)) {
 646                                 return EXIT_FAILED;
 647                         }
 648                         string_replace(parentname, '/', '\\');
 649                         parent = get_secdesc(cli,parentname);
 650                         if (parent == NULL) {
 651                                 return EXIT_FAILED;
 652                         }
 653                         for (i=0;i<parent->dacl->num_aces;i++) {
 654                                 struct security_ace *ace=&parent->dacl->aces[i];
 655                                 /* Add inherited flag to all aces */
 656                                 ace->flags=ace->flags|
 657                                            SEC_ACE_FLAG_INHERITED_ACE;
 658                                 if ((oldattr & FILE_ATTRIBUTE_DIRECTORY) == FILE_ATTRIBUTE_DIRECTORY) {
 659                                         if ((ace->flags & SEC_ACE_FLAG_CONTAINER_INHERIT) ==
 660                                             SEC_ACE_FLAG_CONTAINER_INHERIT) {
 661                                                 add_ace(&old->dacl, ace);
 662                                         }
 663                                 } else {
 664                                         if ((ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT) ==
 665                                             SEC_ACE_FLAG_OBJECT_INHERIT) {
 666                                                 /* clear flags for files */
 667                                                 ace->flags=0;
 668                                                 add_ace(&old->dacl, ace);
 669                                         }
 670                                 }
 671                         }
 672                 } else {
 673                         printf("Already set to inheritable permissions.\n");
 674                         return EXIT_FAILED;
 675                 }
 676         } else if (strcmp(type,"remove")==0) {
 677                 if ((old->type & SEC_DESC_DACL_PROTECTED) !=
 678                     SEC_DESC_DACL_PROTECTED) {
 679                         old->type=old->type | SEC_DESC_DACL_PROTECTED;
 680
 681                         /* remove all inherited ACL's. */
 682                         if (old->dacl) {
 683                                 int i;
 684                                 struct security_acl *temp=old->dacl;
 685                                 old->dacl=make_sec_acl(talloc_tos(), 3, 0, NULL);
 686                                 for (i=temp->num_aces-1;i>=0;i--) {
 687                                         struct security_ace *ace=&temp->aces[i];
 688                                         /* Remove all ace with INHERITED flag set */
 689                                         if ((ace->flags & SEC_ACE_FLAG_INHERITED_ACE) !=
 690                                             SEC_ACE_FLAG_INHERITED_ACE) {
 691                                                 add_ace(&old->dacl,ace);
 692                                         }
 693                                 }
 694                         }
 695                 } else {
 696                         printf("Already set to no inheritable permissions.\n");
 697                         return EXIT_FAILED;
 698                 }
 699         } else if (strcmp(type,"copy")==0) {
 700                 if ((old->type & SEC_DESC_DACL_PROTECTED) !=
 701                     SEC_DESC_DACL_PROTECTED) {
 702                         old->type=old->type | SEC_DESC_DACL_PROTECTED;
 703
 704                         /* convert all inherited ACL's to non inherated ACL's. */
 705                         if (old->dacl) {
 706                                 int i;
 707                                 for (i=0;i<old->dacl->num_aces;i++) {
 708                                         struct security_ace *ace=&old->dacl->aces[i];
 709                                         /* Remove INHERITED FLAG from all aces */
 710                                         ace->flags=ace->flags&(~SEC_ACE_FLAG_INHERITED_ACE);
 711                                 }
 712                         }
 713                 } else {
 714                         printf("Already set to no inheritable permissions.\n");
 715                         return EXIT_FAILED;
 716                 }
 717         }
 718
 719         /* Denied ACE entries must come before allowed ones */
 720         sort_acl(old->dacl);
 721
 722         sd = make_sec_desc(talloc_tos(),old->revision, old->type,
 723                            old->owner_sid, old->group_sid,
 724                            NULL, old->dacl, &sd_size);
 725
 726         if (!set_secdesc(cli, filename, sd)) {
 727                 result = EXIT_FAILED;
 728         }
 729
 730         return result;
 731 }
 732
 733 /*****************************************************
 734  Return a connection to a server.
 735 *******************************************************/
 736 static struct cli_state *connect_one(const struct user_auth_info *auth_info,
 737                                      const char *server, const char *share)
 738 {
 739         struct cli_state *c = NULL;
 740         NTSTATUS nt_status;
 741         uint32_t flags = 0;
 742
 743         if (get_cmdline_auth_info_use_kerberos(auth_info)) {
 744                 flags |= CLI_FULL_CONNECTION_USE_KERBEROS |
 745                          CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS;
 746         }
 747
 748         nt_status = cli_full_connection(&c, lp_netbios_name(), server,
 749                                 NULL, 0,
 750                                 share, "?????",
 751                                 get_cmdline_auth_info_username(auth_info),
 752                                 lp_workgroup(),
 753                                 get_cmdline_auth_info_password(auth_info),
 754                                 flags,
 755                                 get_cmdline_auth_info_signing_state(auth_info));
 756         if (!NT_STATUS_IS_OK(nt_status)) {
 757                 DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status)));
 758                 return NULL;
 759         }
 760
 761         if (get_cmdline_auth_info_smb_encrypt(auth_info)) {
 762                 nt_status = cli_cm_force_encryption(c,
 763                                         get_cmdline_auth_info_username(auth_info),
 764                                         get_cmdline_auth_info_password(auth_info),
 765                                         lp_workgroup(),
 766                                         share);
 767                 if (!NT_STATUS_IS_OK(nt_status)) {
 768                         cli_shutdown(c);
 769                         c = NULL;
 770                 }
 771         }
 772
 773         return c;
 774 }
 775
 776 /****************************************************************************
 777   main program
 778 ****************************************************************************/
 779 int main(int argc, char *argv[])
 780 {
 781         const char **argv_const = discard_const_p(const char *, argv);
 782         char *share;
 783         int opt;
 784         enum acl_mode mode = SMB_ACL_SET;
 785         static char *the_acl = NULL;
 786         enum chown_mode change_mode = REQUEST_NONE;
 787         int result;
 788         char *path;
 789         char *filename = NULL;
 790         poptContext pc;
 791         /* numeric is set when the user wants numeric SIDs and ACEs rather
 792            than going via LSA calls to resolve them */
 793         int numeric = 0;
 794
 795         struct poptOption long_options[] = {
 796                 POPT_AUTOHELP
 797                 { "delete", 'D', POPT_ARG_STRING, NULL, 'D', "Delete an acl", "ACL" },
 798                 { "modify", 'M', POPT_ARG_STRING, NULL, 'M', "Modify an acl", "ACL" },
 799                 { "add", 'a', POPT_ARG_STRING, NULL, 'a', "Add an acl", "ACL" },
 800                 { "set", 'S', POPT_ARG_STRING, NULL, 'S', "Set acls", "ACLS" },
 801                 { "chown", 'C', POPT_ARG_STRING, NULL, 'C', "Change ownership of a file", "USERNAME" },
 802                 { "chgrp", 'G', POPT_ARG_STRING, NULL, 'G', "Change group ownership of a file", "GROUPNAME" },
 803                 { "inherit", 'I', POPT_ARG_STRING, NULL, 'I', "Inherit allow|remove|copy" },
 804                 { "numeric", 0, POPT_ARG_NONE, &numeric, 1, "Don't resolve sids or masks to names" },
 805                 { "sddl", 0, POPT_ARG_NONE, &sddl, 1, "Output and input acls in sddl format" },
 806                 { "query-security-info", 0, POPT_ARG_INT, &query_sec_info, 1,
 807                   "The security-info flags for queries"
 808                 },
 809                 { "set-security-info", 0, POPT_ARG_INT, &set_sec_info, 1,
 810                   "The security-info flags for modifications"
 811                 },
 812                 { "test-args", 't', POPT_ARG_NONE, &test_args, 1, "Test arguments"},
 813                 { "domain-sid", 0, POPT_ARG_STRING, &domain_sid, 0, "Domain SID for sddl", "SID"},
 814                 { "max-protocol", 'm', POPT_ARG_STRING, NULL, 'm', "Set the max protocol level", "LEVEL" },
 815                 POPT_COMMON_SAMBA
 816                 POPT_COMMON_CONNECTION
 817                 POPT_COMMON_CREDENTIALS
 818                 POPT_TABLEEND
 819         };
 820
 821         struct cli_state *cli;
 822         TALLOC_CTX *frame = talloc_stackframe();
 823         const char *owner_username = "";
 824         char *server;
 825
 826         smb_init_locale();
 827
 828         /* set default debug level to 1 regardless of what smb.conf sets */
 829         setup_logging( "smbcacls", DEBUG_STDERR);
 830         lp_set_cmdline("log level", "1");
 831
 832         setlinebuf(stdout);
 833
 834         popt_common_credentials_set_ignore_missing_conf();
 835
 836         pc = poptGetContext("smbcacls", argc, argv_const, long_options, 0);
 837
 838         poptSetOtherOptionHelp(pc, "//server1/share1 filename\nACLs look like: "
 839                 "'ACL:user:[ALLOWED|DENIED]/flags/permissions'");
 840
 841         while ((opt = poptGetNextOpt(pc)) != -1) {
 842                 switch (opt) {
 843                 case 'S':
 844                         the_acl = smb_xstrdup(poptGetOptArg(pc));
 845                         mode = SMB_ACL_SET;
 846                         break;
 847
 848                 case 'D':
 849                         the_acl = smb_xstrdup(poptGetOptArg(pc));
 850                         mode = SMB_ACL_DELETE;
 851                         break;
 852
 853                 case 'M':
 854                         the_acl = smb_xstrdup(poptGetOptArg(pc));
 855                         mode = SMB_ACL_MODIFY;
 856                         break;
 857
 858                 case 'a':
 859                         the_acl = smb_xstrdup(poptGetOptArg(pc));
 860                         mode = SMB_ACL_ADD;
 861                         break;
 862
 863                 case 'C':
 864                         owner_username = poptGetOptArg(pc);
 865                         change_mode = REQUEST_CHOWN;
 866                         break;
 867
 868                 case 'G':
 869                         owner_username = poptGetOptArg(pc);
 870                         change_mode = REQUEST_CHGRP;
 871                         break;
 872
 873                 case 'I':
 874                         owner_username = poptGetOptArg(pc);
 875                         change_mode = REQUEST_INHERIT;
 876                         break;
 877                 case 'm':
 878                         lp_set_cmdline("client max protocol", poptGetOptArg(pc));
 879                         break;
 880                 }
 881         }
 882
 883         /* Make connection to server */
 884         if(!poptPeekArg(pc)) {
 885                 poptPrintUsage(pc, stderr, 0);
 886                 return -1;
 887         }
 888
 889         path = talloc_strdup(frame, poptGetArg(pc));
 890         if (!path) {
 891                 return -1;
 892         }
 893
 894         if(!poptPeekArg(pc)) {
 895                 poptPrintUsage(pc, stderr, 0);
 896                 return -1;
 897         }
 898
 899         filename = talloc_strdup(frame, poptGetArg(pc));
 900         if (!filename) {
 901                 return -1;
 902         }
 903
 904         poptFreeContext(pc);
 905         popt_burn_cmdline_password(argc, argv);
 906         popt_common_credentials_post();
 907
 908         string_replace(path,'/','\\');
 909
 910         server = talloc_strdup(frame, path+2);
 911         if (!server) {
 912                 return -1;
 913         }
 914         share = strchr_m(server,'\\');
 915         if (!share) {
 916                 printf("Invalid argument: %s\n", share);
 917                 return -1;
 918         }
 919
 920         *share = 0;
 921         share++;
 922
 923         if (!test_args) {
 924                 cli = connect_one(popt_get_cmdline_auth_info(), server, share);
 925                 if (!cli) {
 926                         exit(EXIT_FAILED);
 927                 }
 928         } else {
 929                 popt_free_cmdline_auth_info();
 930                 exit(0);
 931         }
 932
 933         string_replace(filename, '/', '\\');
 934         if (filename[0] != '\\') {
 935                 filename = talloc_asprintf(frame,
 936                                 "\\%s",
 937                                 filename);
 938                 if (!filename) {
 939                         return -1;
 940                 }
 941         }
 942
 943         /* Perform requested action */
 944
 945         if (change_mode == REQUEST_INHERIT) {
 946                 result = inherit(cli, filename, owner_username);
 947         } else if (change_mode != REQUEST_NONE) {
 948                 result = owner_set(cli, change_mode, filename, owner_username);
 949         } else if (the_acl) {
 950                 result = cacl_set(cli, filename, the_acl, mode, numeric);
 951         } else {
 952                 result = cacl_dump(cli, filename, numeric);
 953         }
 954
 955         popt_free_cmdline_auth_info();
 956         TALLOC_FREE(frame);
 957
 958         return result;
 959 }