The branch, master has been updated via 9a90e4cecb2ab4afe54d2354fb9b6e985eeb245f (commit) via fd84ef938b02b43ed2ce41f1fdb195ed6beff0d9 (commit) via 9affa82ac29a0cc03049c5440370564680cd66b2 (commit) via 8f84d42f72896170332ade0876fdc9d99350e9f0 (commit) via 04959a00e40405a00a80d4188d2313edeee72aa0 (commit) from f308c2f9da7e9901aacb10a8bb19074fcadb056b (commit)
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master - Log ----------------------------------------------------------------- commit 9a90e4cecb2ab4afe54d2354fb9b6e985eeb245f Author: Steven Danneman <steven.danne...@isilon.com> Date: Sun Dec 28 17:22:28 2008 -0800 Add -D option to sharesec util to delete the entire security descriptor. * also modified --usage descriptions to be more accurate commit fd84ef938b02b43ed2ce41f1fdb195ed6beff0d9 Author: Steven Danneman <steven.danne...@isilon.com> Date: Sun Dec 28 17:21:36 2008 -0800 Change error messages in sharesec util to go to stderr instead of stdout commit 9affa82ac29a0cc03049c5440370564680cd66b2 Author: Steven Danneman <steven.danne...@isilon.com> Date: Sun Dec 28 17:16:28 2008 -0800 Make sure share_info.tdb is open before attempting to delete an entry commit 8f84d42f72896170332ade0876fdc9d99350e9f0 Author: Steven Danneman <steven.danne...@isilon.com> Date: Fri Dec 26 12:41:29 2008 -0800 Make sharesec utility part of the default binary install. commit 04959a00e40405a00a80d4188d2313edeee72aa0 Author: Steven Danneman <steven.danne...@isilon.com> Date: Wed Dec 24 17:03:22 2008 -0800 Cleaned up whitespace issues in sharesec.c ----------------------------------------------------------------------- Summary of changes: source3/Makefile.in | 4 +- source3/lib/sharesec.c | 8 ++- source3/utils/sharesec.c | 125 ++++++++++++++++++++++++++------------------- 3 files changed, 80 insertions(+), 57 deletions(-) Changeset truncated at 500 lines: diff --git a/source3/Makefile.in b/source3/Makefile.in index f139d73..49f576f 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -192,7 +192,7 @@ BIN_PROGS2 = bin/smbcont...@exeext@ bin/smbt...@exeext@ bin/tdbbac...@exeext@ \ bin/nmbloo...@exeext@ bin/pdbe...@exeext@ bin/tdbd...@exeext@ \ bin/tdbt...@exeext@ BIN_PROGS3 = bin/smbpas...@exeext@ bin/rpccli...@exeext@ bin/smbca...@exeext@ \ - bin/profi...@exeext@ bin/ntlm_a...@exeext@ \ + bin/profi...@exeext@ bin/ntlm_a...@exeext@ bin/share...@exeext@ \ bin/smbcquo...@exeext@ bin/eventlog...@exeext@ BIN_PROGS4 = bin/ldbe...@exeext@ bin/ldbsea...@exeext@ bin/ldb...@exeext@ \ bin/ldb...@exeext@ bin/ldbmod...@exeext@ @@ -209,7 +209,7 @@ BIN_PROGS = @EXTRA_BIN_PROGS@ \ EVERYTHING_PROGS = bin/debug2h...@exeext@ bin/smbfil...@exeext@ \ bin/talloct...@exeext@ bin/replacet...@exeext@ \ - bin/log2p...@exeext@ bin/share...@exeext@ \ + bin/log2p...@exeext@ \ bin/v...@exeext@ bin/smbic...@exeext@ PAM_MODULES = @PAM_MODULES@ diff --git a/source3/lib/sharesec.c b/source3/lib/sharesec.c index 8ea63a5..3866ff0 100644 --- a/source3/lib/sharesec.c +++ b/source3/lib/sharesec.c @@ -41,7 +41,7 @@ static bool share_info_db_init(void) { const char *vstring = "INFO/version"; int32 vers_id; - + if (share_db != NULL) { return True; } @@ -53,7 +53,7 @@ static bool share_info_db_init(void) state_path("share_info.tdb"), strerror(errno) )); return False; } - + vers_id = dbwrap_fetch_int32(share_db, vstring); if (vers_id == SHARE_DATABASE_VERSION_V2) { return true; @@ -252,6 +252,10 @@ bool delete_share_security(const char *servicename) char *key; NTSTATUS status; + if (!share_info_db_init()) { + return False; + } + if (!(key = talloc_asprintf(talloc_tos(), "SECDESC/%s", servicename))) { return False; diff --git a/source3/utils/sharesec.c b/source3/utils/sharesec.c index 3ad949a..ae2a9ad 100644 --- a/source3/utils/sharesec.c +++ b/source3/utils/sharesec.c @@ -26,7 +26,12 @@ static TALLOC_CTX *ctx; -enum acl_mode {SMB_ACL_DELETE, SMB_ACL_MODIFY, SMB_ACL_ADD, SMB_ACL_SET, SMB_ACL_VIEW }; +enum acl_mode { SMB_ACL_DELETE, + SMB_ACL_MODIFY, + SMB_ACL_ADD, + SMB_ACL_SET, + SMB_SD_DELETE, + SMB_ACL_VIEW }; struct perm_value { const char *perm; @@ -45,7 +50,8 @@ static const struct perm_value special_values[] = { { NULL, 0 }, }; -#define SEC_RIGHTS_DIR_CHANGE ( SEC_RIGHTS_DIR_READ|SEC_STD_DELETE|SEC_RIGHTS_DIR_WRITE|SEC_DIR_TRAVERSE ) +#define SEC_RIGHTS_DIR_CHANGE ( SEC_RIGHTS_DIR_READ|SEC_STD_DELETE|\ + SEC_RIGHTS_DIR_WRITE|SEC_DIR_TRAVERSE ) static const struct perm_value standard_values[] = { { "READ", SEC_RIGHTS_DIR_READ|SEC_DIR_TRAVERSE }, @@ -115,7 +121,7 @@ static void print_ace(FILE *f, SEC_ACE *ace) } /******************************************************************** - print a ascii version of a security descriptor on a FILE handle + print an ascii version of a security descriptor on a FILE handle ********************************************************************/ static void sec_desc_print(FILE *f, SEC_DESC *sd) @@ -137,11 +143,10 @@ static void sec_desc_print(FILE *f, SEC_DESC *sd) print_ace(f, ace); fprintf(f, "\n"); } - } /******************************************************************** - parse an ACE in the same format as print_ace() + parse an ACE in the same format as print_ace() ********************************************************************/ static bool parse_ace(SEC_ACE *ace, const char *orig_str) @@ -166,7 +171,7 @@ static bool parse_ace(SEC_ACE *ace, const char *orig_str) ZERO_STRUCTP(ace); p = strchr_m(str,':'); if (!p) { - printf("ACE '%s': missing ':'.\n", orig_str); + fprintf(stderr, "ACE '%s': missing ':'.\n", orig_str); SAFE_FREE(str); TALLOC_FREE(frame); return False; @@ -183,7 +188,7 @@ static bool parse_ace(SEC_ACE *ace, const char *orig_str) /* Try to parse text form */ if (!string_to_sid(&sid, str)) { - printf("ACE '%s': failed to convert '%s' to SID\n", + fprintf(stderr, "ACE '%s': failed to convert '%s' to SID\n", orig_str, str); SAFE_FREE(str); TALLOC_FREE(frame); @@ -192,7 +197,7 @@ static bool parse_ace(SEC_ACE *ace, const char *orig_str) cp = p; if (!next_token_talloc(frame, &cp, &tok, "/")) { - printf("ACE '%s': failed to find '/' character.\n", + fprintf(stderr, "ACE '%s': failed to find '/' character.\n", orig_str); SAFE_FREE(str); TALLOC_FREE(frame); @@ -204,8 +209,8 @@ static bool parse_ace(SEC_ACE *ace, const char *orig_str) } else if (strncmp(tok, "DENIED", strlen("DENIED")) == 0) { atype = SEC_ACE_TYPE_ACCESS_DENIED; } else { - printf("ACE '%s': missing 'ALLOWED' or 'DENIED' entry at '%s'\n", - orig_str, tok); + fprintf(stderr, "ACE '%s': missing 'ALLOWED' or 'DENIED' " + "entry at '%s'\n", orig_str, tok); SAFE_FREE(str); TALLOC_FREE(frame); return False; @@ -216,7 +221,7 @@ static bool parse_ace(SEC_ACE *ace, const char *orig_str) if (!(next_token_talloc(frame, &cp, &tok, "/") && sscanf(tok, "%i", &aflags) && aflags == 0)) { - printf("ACE '%s': bad integer flags entry at '%s'\n", + fprintf(stderr, "ACE '%s': bad integer flags entry at '%s'\n", orig_str, tok); SAFE_FREE(str); TALLOC_FREE(frame); @@ -224,7 +229,7 @@ static bool parse_ace(SEC_ACE *ace, const char *orig_str) } if (!next_token_talloc(frame, &cp, &tok, "/")) { - printf("ACE '%s': missing / at '%s'\n", + fprintf(stderr, "ACE '%s': missing / at '%s'\n", orig_str, tok); SAFE_FREE(str); TALLOC_FREE(frame); @@ -233,7 +238,7 @@ static bool parse_ace(SEC_ACE *ace, const char *orig_str) if (strncmp(tok, "0x", 2) == 0) { if (sscanf(tok, "%i", &amask) != 1) { - printf("ACE '%s': bad hex number at '%s'\n", + fprintf(stderr, "ACE '%s': bad hex number at '%s'\n", orig_str, tok); TALLOC_FREE(frame); SAFE_FREE(str); @@ -262,11 +267,11 @@ static bool parse_ace(SEC_ACE *ace, const char *orig_str) } if (!found) { - printf("ACE '%s': bad permission value at '%s'\n", - orig_str, p); + fprintf(stderr, "ACE '%s': bad permission value at " + "'%s'\n", orig_str, p); TALLOC_FREE(frame); SAFE_FREE(str); - return False; + return False; } p++; } @@ -297,34 +302,34 @@ static SEC_DESC* parse_acl_string(TALLOC_CTX *mem_ctx, const char *szACL, size_t int num_ace; const char *pacl; int i; - + if ( !szACL ) return NULL; pacl = szACL; num_ace = count_chars( pacl, ',' ) + 1; - - if ( !(ace = TALLOC_ZERO_ARRAY( mem_ctx, SEC_ACE, num_ace )) ) + + if ( !(ace = TALLOC_ZERO_ARRAY( mem_ctx, SEC_ACE, num_ace )) ) return NULL; - + for ( i=0; i<num_ace; i++ ) { char *end_acl = strchr_m( pacl, ',' ); fstring acl_string; strncpy( acl_string, pacl, MIN( PTR_DIFF( end_acl, pacl ), sizeof(fstring)-1) ); acl_string[MIN( PTR_DIFF( end_acl, pacl ), sizeof(fstring)-1)] = '\0'; - + if ( !parse_ace( &ace[i], acl_string ) ) return NULL; pacl = end_acl; pacl++; } - + if ( !(acl = make_sec_acl( mem_ctx, NT4_ACL_REVISION, num_ace, ace )) ) return NULL; - - sd = make_sec_desc( mem_ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, + + sd = make_sec_desc( mem_ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL, acl, sd_size); return sd; @@ -357,22 +362,22 @@ static bool add_ace(TALLOC_CTX *mem_ctx, SEC_ACL **the_acl, SEC_ACE *ace) static int ace_compare(SEC_ACE *ace1, SEC_ACE *ace2) { - if (sec_ace_equal(ace1, ace2)) + if (sec_ace_equal(ace1, ace2)) return 0; - if (ace1->type != ace2->type) + if (ace1->type != ace2->type) return ace2->type - ace1->type; - if (sid_compare(&ace1->trustee, &ace2->trustee)) + if (sid_compare(&ace1->trustee, &ace2->trustee)) return sid_compare(&ace1->trustee, &ace2->trustee); - if (ace1->flags != ace2->flags) + if (ace1->flags != ace2->flags) return ace1->flags - ace2->flags; - if (ace1->access_mask != ace2->access_mask) + if (ace1->access_mask != ace2->access_mask) return ace1->access_mask - ace2->access_mask; - if (ace1->size != ace2->size) + if (ace1->size != ace2->size) return ace1->size - ace2->size; return memcmp(ace1, ace2, sizeof(SEC_ACE)); @@ -405,19 +410,21 @@ static int change_share_sec(TALLOC_CTX *mem_ctx, const char *sharename, char *th SEC_DESC *old = NULL; size_t sd_size = 0; uint32 i, j; - - if (mode != SMB_ACL_SET) { + + if (mode != SMB_ACL_SET && mode != SMB_SD_DELETE) { if (!(old = get_share_security( mem_ctx, sharename, &sd_size )) ) { - fprintf(stderr, "Unable to retrieve permissions for share [%s]\n", sharename); + fprintf(stderr, "Unable to retrieve permissions for share " + "[%s]\n", sharename); return -1; } } - if ( (mode != SMB_ACL_VIEW) && !(sd = parse_acl_string(mem_ctx, the_acl, &sd_size )) ) { + if ( (mode != SMB_ACL_VIEW && mode != SMB_SD_DELETE) && + !(sd = parse_acl_string(mem_ctx, the_acl, &sd_size )) ) { fprintf( stderr, "Failed to parse acl\n"); return -1; } - + switch (mode) { case SMB_ACL_VIEW: sec_desc_print( stdout, old); @@ -444,7 +451,6 @@ static int change_share_sec(TALLOC_CTX *mem_ctx, const char *sharename, char *th printf(" not found\n"); } } - break; case SMB_ACL_MODIFY: for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) { @@ -480,6 +486,13 @@ static int change_share_sec(TALLOC_CTX *mem_ctx, const char *sharename, char *th case SMB_ACL_SET: old = sd; break; + case SMB_SD_DELETE: + if (!delete_share_security(sharename)) { + fprintf( stderr, "Failed to delete security descriptor for " + "share [%s]\n", sharename ); + return -1; + } + return 0; } /* Denied ACE entries must come before allowed ones */ @@ -509,10 +522,11 @@ int main(int argc, const char *argv[]) bool initialize_sid = False; struct poptOption long_options[] = { POPT_AUTOHELP - { "remove", 'r', POPT_ARG_STRING, &the_acl, 'r', "Delete an ACE", "ACL" }, - { "modify", 'm', POPT_ARG_STRING, &the_acl, 'm', "Modify an acl", "ACL" }, - { "add", 'a', POPT_ARG_STRING, &the_acl, 'a', "Add an ACE", "ACL" }, - { "replace", 'R', POPT_ARG_STRING, &the_acl, 'R', "Set share mission ACL", "ACLS" }, + { "remove", 'r', POPT_ARG_STRING, &the_acl, 'r', "Remove ACEs", "ACL" }, + { "modify", 'm', POPT_ARG_STRING, &the_acl, 'm', "Modify existing ACEs", "ACL" }, + { "add", 'a', POPT_ARG_STRING, &the_acl, 'a', "Add ACEs", "ACL" }, + { "replace", 'R', POPT_ARG_STRING, &the_acl, 'R', "Overwrite share permission ACL", "ACLS" }, + { "delete", 'D', POPT_ARG_NONE, NULL, 'D', "Delete the entire security descriptor" }, { "view", 'v', POPT_ARG_NONE, NULL, 'v', "View current share permissions" }, { "machine-sid", 'M', POPT_ARG_NONE, NULL, 'M', "Initialize the machine SID" }, { "force", 'F', POPT_ARG_NONE, NULL, 'F', "Force storing the ACL", "ACLS" }, @@ -532,7 +546,7 @@ int main(int argc, const char *argv[]) x_setbuf( x_stderr, NULL ); pc = poptGetContext("sharesec", argc, argv, long_options, 0); - + poptSetOtherOptionHelp(pc, "sharename\n"); while ((opt = poptGetNextOpt(pc)) != -1) { @@ -551,11 +565,16 @@ int main(int argc, const char *argv[]) the_acl = smb_xstrdup(poptGetOptArg(pc)); mode = SMB_ACL_ADD; break; + case 'R': the_acl = smb_xstrdup(poptGetOptArg(pc)); mode = SMB_ACL_SET; break; + case 'D': + mode = SMB_SD_DELETE; + break; + case 'v': mode = SMB_ACL_VIEW; break; @@ -563,13 +582,13 @@ int main(int argc, const char *argv[]) case 'F': force_acl = True; break; - + case 'M': initialize_sid = True; break; } } - + setlinebuf(stdout); load_case_tables(); @@ -577,15 +596,15 @@ int main(int argc, const char *argv[]) lp_load( get_dyn_CONFIGFILE(), False, False, False, True ); /* check for initializing secrets.tdb first */ - + if ( initialize_sid ) { DOM_SID *sid = get_global_sam_sid(); - + if ( !sid ) { fprintf( stderr, "Failed to retrieve Machine SID!\n"); return 3; } - + printf ("%s\n", sid_string_tos( sid ) ); return 0; } @@ -597,22 +616,22 @@ int main(int argc, const char *argv[]) /* get the sharename */ - if(!poptPeekArg(pc)) { - poptPrintUsage(pc, stderr, 0); + if(!poptPeekArg(pc)) { + poptPrintUsage(pc, stderr, 0); return -1; } - + fstrcpy(sharename, poptGetArg(pc)); - + snum = lp_servicenumber( sharename ); - + if ( snum == -1 && !force_acl ) { fprintf( stderr, "Invalid sharename: %s\n", sharename); return -1; } - + retval = change_share_sec(ctx, sharename, the_acl, mode); - + talloc_destroy(ctx); return retval; -- Samba Shared Repository