summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--source3/utils/smbcacls.c65
1 files changed, 55 insertions, 10 deletions
diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c
index da190ddda1..39400c8bdd 100644
--- a/source3/utils/smbcacls.c
+++ b/source3/utils/smbcacls.c
@@ -41,6 +41,8 @@ static int test_args;
static int numeric;
static int sddl;
+static int query_sec_info = -1;
+static int set_sec_info = -1;
static const char *domain_sid = NULL;
@@ -835,11 +837,27 @@ static struct security_descriptor *get_secdesc(struct cli_state *cli, const char
uint16_t fnum = (uint16_t)-1;
struct security_descriptor *sd;
NTSTATUS status;
+ uint32_t sec_info;
+ uint32_t desired_access = 0;
- /* The desired access below is the only one I could find that works
- with NT4, W2KP and Samba */
+ if (query_sec_info == -1) {
+ sec_info = SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL;
+ } else {
+ sec_info = query_sec_info;
+ }
- status = cli_ntcreate(cli, filename, 0, CREATE_ACCESS_READ,
+ if (sec_info & (SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL)) {
+ desired_access |= SEC_STD_READ_CONTROL;
+ }
+ if (sec_info & SECINFO_SACL) {
+ desired_access |= SEC_FLAG_SYSTEM_SECURITY;
+ }
+
+ if (desired_access == 0) {
+ desired_access |= SEC_STD_READ_CONTROL;
+ }
+
+ status = cli_ntcreate(cli, filename, 0, desired_access,
0, FILE_SHARE_READ|FILE_SHARE_WRITE,
FILE_OPEN, 0x0, 0x0, &fnum);
if (!NT_STATUS_IS_OK(status)) {
@@ -847,7 +865,8 @@ static struct security_descriptor *get_secdesc(struct cli_state *cli, const char
return NULL;
}
- status = cli_query_secdesc(cli, fnum, talloc_tos(), &sd);
+ status = cli_query_security_descriptor(cli, fnum, sec_info,
+ talloc_tos(), &sd);
cli_close(cli, fnum);
@@ -869,16 +888,36 @@ static bool set_secdesc(struct cli_state *cli, const char *filename,
bool result=true;
NTSTATUS status;
uint32_t desired_access = 0;
+ uint32_t sec_info;
+
+ if (set_sec_info == -1) {
+ sec_info = 0;
+
+ if (sd->dacl || (sd->type & SEC_DESC_DACL_PRESENT)) {
+ sec_info |= SECINFO_DACL;
+ }
+ if (sd->sacl || (sd->type & SEC_DESC_SACL_PRESENT)) {
+ sec_info |= SECINFO_SACL;
+ }
+ if (sd->owner_sid) {
+ sec_info |= SECINFO_OWNER;
+ }
+ if (sd->group_sid) {
+ sec_info |= SECINFO_GROUP;
+ }
+ } else {
+ sec_info = set_sec_info;
+ }
/* Make the desired_access more specific. */
- if (sd->dacl) {
- desired_access |= WRITE_DAC_ACCESS;
+ if (sec_info & SECINFO_DACL) {
+ desired_access |= SEC_STD_WRITE_DAC;
}
- if (sd->sacl) {
+ if (sec_info & SECINFO_SACL) {
desired_access |= SEC_FLAG_SYSTEM_SECURITY;
}
- if (sd->owner_sid || sd->group_sid) {
- desired_access |= WRITE_OWNER_ACCESS;
+ if (sec_info & (SECINFO_OWNER | SECINFO_GROUP)) {
+ desired_access |= SEC_STD_WRITE_OWNER;
}
status = cli_ntcreate(cli, filename, 0,
@@ -890,7 +929,7 @@ static bool set_secdesc(struct cli_state *cli, const char *filename,
return false;
}
- status = cli_set_secdesc(cli, fnum, sd);
+ status = cli_set_security_descriptor(cli, fnum, sec_info, sd);
if (!NT_STATUS_IS_OK(status)) {
printf("ERROR: security description set failed: %s\n",
nt_errstr(status));
@@ -1339,6 +1378,12 @@ static struct cli_state *connect_one(struct user_auth_info *auth_info,
{ "inherit", 'I', POPT_ARG_STRING, NULL, 'I', "Inherit allow|remove|copy" },
{ "numeric", 0, POPT_ARG_NONE, &numeric, 1, "Don't resolve sids or masks to names" },
{ "sddl", 0, POPT_ARG_NONE, &sddl, 1, "Output and input acls in sddl format" },
+ { "query-security-info", 0, POPT_ARG_INT, &query_sec_info, 1,
+ "The security-info flags for queries"
+ },
+ { "set-security-info", 0, POPT_ARG_INT, &set_sec_info, 1,
+ "The security-info flags for modifications"
+ },
{ "test-args", 't', POPT_ARG_NONE, &test_args, 1, "Test arguments"},
{ "domain-sid", 0, POPT_ARG_STRING, &domain_sid, 0, "Domain SID for sddl", "SID"},
POPT_COMMON_SAMBA