[SCM] Samba Shared Repository - branch master updated -
9a90e4cecb2ab4afe54d2354fb9b6e985eeb245f
Steven Danneman
sdanneman at samba.org
Mon Dec 29 02:11:49 GMT 2008
The branch, master has been updated
via 9a90e4cecb2ab4afe54d2354fb9b6e985eeb245f (commit)
via fd84ef938b02b43ed2ce41f1fdb195ed6beff0d9 (commit)
via 9affa82ac29a0cc03049c5440370564680cd66b2 (commit)
via 8f84d42f72896170332ade0876fdc9d99350e9f0 (commit)
via 04959a00e40405a00a80d4188d2313edeee72aa0 (commit)
from f308c2f9da7e9901aacb10a8bb19074fcadb056b (commit)
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 9a90e4cecb2ab4afe54d2354fb9b6e985eeb245f
Author: Steven Danneman <steven.danneman at isilon.com>
Date: Sun Dec 28 17:22:28 2008 -0800
Add -D option to sharesec util to delete the entire security descriptor.
* also modified --usage descriptions to be more accurate
commit fd84ef938b02b43ed2ce41f1fdb195ed6beff0d9
Author: Steven Danneman <steven.danneman at isilon.com>
Date: Sun Dec 28 17:21:36 2008 -0800
Change error messages in sharesec util to go to stderr instead of stdout
commit 9affa82ac29a0cc03049c5440370564680cd66b2
Author: Steven Danneman <steven.danneman at isilon.com>
Date: Sun Dec 28 17:16:28 2008 -0800
Make sure share_info.tdb is open before attempting to delete an entry
commit 8f84d42f72896170332ade0876fdc9d99350e9f0
Author: Steven Danneman <steven.danneman at isilon.com>
Date: Fri Dec 26 12:41:29 2008 -0800
Make sharesec utility part of the default binary install.
commit 04959a00e40405a00a80d4188d2313edeee72aa0
Author: Steven Danneman <steven.danneman at isilon.com>
Date: Wed Dec 24 17:03:22 2008 -0800
Cleaned up whitespace issues in sharesec.c
-----------------------------------------------------------------------
Summary of changes:
source3/Makefile.in | 4 +-
source3/lib/sharesec.c | 8 ++-
source3/utils/sharesec.c | 125 ++++++++++++++++++++++++++-------------------
3 files changed, 80 insertions(+), 57 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source3/Makefile.in b/source3/Makefile.in
index f139d73..49f576f 100644
--- a/source3/Makefile.in
+++ b/source3/Makefile.in
@@ -192,7 +192,7 @@ BIN_PROGS2 = bin/smbcontrol at EXEEXT@ bin/smbtree at EXEEXT@ bin/tdbbackup at EXEEXT@ \
bin/nmblookup at EXEEXT@ bin/pdbedit at EXEEXT@ bin/tdbdump at EXEEXT@ \
bin/tdbtool at EXEEXT@
BIN_PROGS3 = bin/smbpasswd at EXEEXT@ bin/rpcclient at EXEEXT@ bin/smbcacls at EXEEXT@ \
- bin/profiles at EXEEXT@ bin/ntlm_auth at EXEEXT@ \
+ bin/profiles at EXEEXT@ bin/ntlm_auth at EXEEXT@ bin/sharesec at EXEEXT@ \
bin/smbcquotas at EXEEXT@ bin/eventlogadm at EXEEXT@
BIN_PROGS4 = bin/ldbedit at EXEEXT@ bin/ldbsearch at EXEEXT@ bin/ldbadd at EXEEXT@ \
bin/ldbdel at EXEEXT@ bin/ldbmodify at EXEEXT@
@@ -209,7 +209,7 @@ BIN_PROGS = @EXTRA_BIN_PROGS@ \
EVERYTHING_PROGS = bin/debug2html at EXEEXT@ bin/smbfilter at EXEEXT@ \
bin/talloctort at EXEEXT@ bin/replacetort at EXEEXT@ \
- bin/log2pcap at EXEEXT@ bin/sharesec at EXEEXT@ \
+ bin/log2pcap at EXEEXT@ \
bin/vlp at EXEEXT@ bin/smbiconv at EXEEXT@
PAM_MODULES = @PAM_MODULES@
diff --git a/source3/lib/sharesec.c b/source3/lib/sharesec.c
index 8ea63a5..3866ff0 100644
--- a/source3/lib/sharesec.c
+++ b/source3/lib/sharesec.c
@@ -41,7 +41,7 @@ static bool share_info_db_init(void)
{
const char *vstring = "INFO/version";
int32 vers_id;
-
+
if (share_db != NULL) {
return True;
}
@@ -53,7 +53,7 @@ static bool share_info_db_init(void)
state_path("share_info.tdb"), strerror(errno) ));
return False;
}
-
+
vers_id = dbwrap_fetch_int32(share_db, vstring);
if (vers_id == SHARE_DATABASE_VERSION_V2) {
return true;
@@ -252,6 +252,10 @@ bool delete_share_security(const char *servicename)
char *key;
NTSTATUS status;
+ if (!share_info_db_init()) {
+ return False;
+ }
+
if (!(key = talloc_asprintf(talloc_tos(), "SECDESC/%s",
servicename))) {
return False;
diff --git a/source3/utils/sharesec.c b/source3/utils/sharesec.c
index 3ad949a..ae2a9ad 100644
--- a/source3/utils/sharesec.c
+++ b/source3/utils/sharesec.c
@@ -26,7 +26,12 @@
static TALLOC_CTX *ctx;
-enum acl_mode {SMB_ACL_DELETE, SMB_ACL_MODIFY, SMB_ACL_ADD, SMB_ACL_SET, SMB_ACL_VIEW };
+enum acl_mode { SMB_ACL_DELETE,
+ SMB_ACL_MODIFY,
+ SMB_ACL_ADD,
+ SMB_ACL_SET,
+ SMB_SD_DELETE,
+ SMB_ACL_VIEW };
struct perm_value {
const char *perm;
@@ -45,7 +50,8 @@ static const struct perm_value special_values[] = {
{ NULL, 0 },
};
-#define SEC_RIGHTS_DIR_CHANGE ( SEC_RIGHTS_DIR_READ|SEC_STD_DELETE|SEC_RIGHTS_DIR_WRITE|SEC_DIR_TRAVERSE )
+#define SEC_RIGHTS_DIR_CHANGE ( SEC_RIGHTS_DIR_READ|SEC_STD_DELETE|\
+ SEC_RIGHTS_DIR_WRITE|SEC_DIR_TRAVERSE )
static const struct perm_value standard_values[] = {
{ "READ", SEC_RIGHTS_DIR_READ|SEC_DIR_TRAVERSE },
@@ -115,7 +121,7 @@ static void print_ace(FILE *f, SEC_ACE *ace)
}
/********************************************************************
- print a ascii version of a security descriptor on a FILE handle
+ print an ascii version of a security descriptor on a FILE handle
********************************************************************/
static void sec_desc_print(FILE *f, SEC_DESC *sd)
@@ -137,11 +143,10 @@ static void sec_desc_print(FILE *f, SEC_DESC *sd)
print_ace(f, ace);
fprintf(f, "\n");
}
-
}
/********************************************************************
- parse an ACE in the same format as print_ace()
+ parse an ACE in the same format as print_ace()
********************************************************************/
static bool parse_ace(SEC_ACE *ace, const char *orig_str)
@@ -166,7 +171,7 @@ static bool parse_ace(SEC_ACE *ace, const char *orig_str)
ZERO_STRUCTP(ace);
p = strchr_m(str,':');
if (!p) {
- printf("ACE '%s': missing ':'.\n", orig_str);
+ fprintf(stderr, "ACE '%s': missing ':'.\n", orig_str);
SAFE_FREE(str);
TALLOC_FREE(frame);
return False;
@@ -183,7 +188,7 @@ static bool parse_ace(SEC_ACE *ace, const char *orig_str)
/* Try to parse text form */
if (!string_to_sid(&sid, str)) {
- printf("ACE '%s': failed to convert '%s' to SID\n",
+ fprintf(stderr, "ACE '%s': failed to convert '%s' to SID\n",
orig_str, str);
SAFE_FREE(str);
TALLOC_FREE(frame);
@@ -192,7 +197,7 @@ static bool parse_ace(SEC_ACE *ace, const char *orig_str)
cp = p;
if (!next_token_talloc(frame, &cp, &tok, "/")) {
- printf("ACE '%s': failed to find '/' character.\n",
+ fprintf(stderr, "ACE '%s': failed to find '/' character.\n",
orig_str);
SAFE_FREE(str);
TALLOC_FREE(frame);
@@ -204,8 +209,8 @@ static bool parse_ace(SEC_ACE *ace, const char *orig_str)
} else if (strncmp(tok, "DENIED", strlen("DENIED")) == 0) {
atype = SEC_ACE_TYPE_ACCESS_DENIED;
} else {
- printf("ACE '%s': missing 'ALLOWED' or 'DENIED' entry at '%s'\n",
- orig_str, tok);
+ fprintf(stderr, "ACE '%s': missing 'ALLOWED' or 'DENIED' "
+ "entry at '%s'\n", orig_str, tok);
SAFE_FREE(str);
TALLOC_FREE(frame);
return False;
@@ -216,7 +221,7 @@ static bool parse_ace(SEC_ACE *ace, const char *orig_str)
if (!(next_token_talloc(frame, &cp, &tok, "/") &&
sscanf(tok, "%i", &aflags) && aflags == 0)) {
- printf("ACE '%s': bad integer flags entry at '%s'\n",
+ fprintf(stderr, "ACE '%s': bad integer flags entry at '%s'\n",
orig_str, tok);
SAFE_FREE(str);
TALLOC_FREE(frame);
@@ -224,7 +229,7 @@ static bool parse_ace(SEC_ACE *ace, const char *orig_str)
}
if (!next_token_talloc(frame, &cp, &tok, "/")) {
- printf("ACE '%s': missing / at '%s'\n",
+ fprintf(stderr, "ACE '%s': missing / at '%s'\n",
orig_str, tok);
SAFE_FREE(str);
TALLOC_FREE(frame);
@@ -233,7 +238,7 @@ static bool parse_ace(SEC_ACE *ace, const char *orig_str)
if (strncmp(tok, "0x", 2) == 0) {
if (sscanf(tok, "%i", &amask) != 1) {
- printf("ACE '%s': bad hex number at '%s'\n",
+ fprintf(stderr, "ACE '%s': bad hex number at '%s'\n",
orig_str, tok);
TALLOC_FREE(frame);
SAFE_FREE(str);
@@ -262,11 +267,11 @@ static bool parse_ace(SEC_ACE *ace, const char *orig_str)
}
if (!found) {
- printf("ACE '%s': bad permission value at '%s'\n",
- orig_str, p);
+ fprintf(stderr, "ACE '%s': bad permission value at "
+ "'%s'\n", orig_str, p);
TALLOC_FREE(frame);
SAFE_FREE(str);
- return False;
+ return False;
}
p++;
}
@@ -297,34 +302,34 @@ static SEC_DESC* parse_acl_string(TALLOC_CTX *mem_ctx, const char *szACL, size_t
int num_ace;
const char *pacl;
int i;
-
+
if ( !szACL )
return NULL;
pacl = szACL;
num_ace = count_chars( pacl, ',' ) + 1;
-
- if ( !(ace = TALLOC_ZERO_ARRAY( mem_ctx, SEC_ACE, num_ace )) )
+
+ if ( !(ace = TALLOC_ZERO_ARRAY( mem_ctx, SEC_ACE, num_ace )) )
return NULL;
-
+
for ( i=0; i<num_ace; i++ ) {
char *end_acl = strchr_m( pacl, ',' );
fstring acl_string;
strncpy( acl_string, pacl, MIN( PTR_DIFF( end_acl, pacl ), sizeof(fstring)-1) );
acl_string[MIN( PTR_DIFF( end_acl, pacl ), sizeof(fstring)-1)] = '\0';
-
+
if ( !parse_ace( &ace[i], acl_string ) )
return NULL;
pacl = end_acl;
pacl++;
}
-
+
if ( !(acl = make_sec_acl( mem_ctx, NT4_ACL_REVISION, num_ace, ace )) )
return NULL;
-
- sd = make_sec_desc( mem_ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE,
+
+ sd = make_sec_desc( mem_ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE,
NULL, NULL, NULL, acl, sd_size);
return sd;
@@ -357,22 +362,22 @@ static bool add_ace(TALLOC_CTX *mem_ctx, SEC_ACL **the_acl, SEC_ACE *ace)
static int ace_compare(SEC_ACE *ace1, SEC_ACE *ace2)
{
- if (sec_ace_equal(ace1, ace2))
+ if (sec_ace_equal(ace1, ace2))
return 0;
- if (ace1->type != ace2->type)
+ if (ace1->type != ace2->type)
return ace2->type - ace1->type;
- if (sid_compare(&ace1->trustee, &ace2->trustee))
+ if (sid_compare(&ace1->trustee, &ace2->trustee))
return sid_compare(&ace1->trustee, &ace2->trustee);
- if (ace1->flags != ace2->flags)
+ if (ace1->flags != ace2->flags)
return ace1->flags - ace2->flags;
- if (ace1->access_mask != ace2->access_mask)
+ if (ace1->access_mask != ace2->access_mask)
return ace1->access_mask - ace2->access_mask;
- if (ace1->size != ace2->size)
+ if (ace1->size != ace2->size)
return ace1->size - ace2->size;
return memcmp(ace1, ace2, sizeof(SEC_ACE));
@@ -405,19 +410,21 @@ static int change_share_sec(TALLOC_CTX *mem_ctx, const char *sharename, char *th
SEC_DESC *old = NULL;
size_t sd_size = 0;
uint32 i, j;
-
- if (mode != SMB_ACL_SET) {
+
+ if (mode != SMB_ACL_SET && mode != SMB_SD_DELETE) {
if (!(old = get_share_security( mem_ctx, sharename, &sd_size )) ) {
- fprintf(stderr, "Unable to retrieve permissions for share [%s]\n", sharename);
+ fprintf(stderr, "Unable to retrieve permissions for share "
+ "[%s]\n", sharename);
return -1;
}
}
- if ( (mode != SMB_ACL_VIEW) && !(sd = parse_acl_string(mem_ctx, the_acl, &sd_size )) ) {
+ if ( (mode != SMB_ACL_VIEW && mode != SMB_SD_DELETE) &&
+ !(sd = parse_acl_string(mem_ctx, the_acl, &sd_size )) ) {
fprintf( stderr, "Failed to parse acl\n");
return -1;
}
-
+
switch (mode) {
case SMB_ACL_VIEW:
sec_desc_print( stdout, old);
@@ -444,7 +451,6 @@ static int change_share_sec(TALLOC_CTX *mem_ctx, const char *sharename, char *th
printf(" not found\n");
}
}
-
break;
case SMB_ACL_MODIFY:
for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
@@ -480,6 +486,13 @@ static int change_share_sec(TALLOC_CTX *mem_ctx, const char *sharename, char *th
case SMB_ACL_SET:
old = sd;
break;
+ case SMB_SD_DELETE:
+ if (!delete_share_security(sharename)) {
+ fprintf( stderr, "Failed to delete security descriptor for "
+ "share [%s]\n", sharename );
+ return -1;
+ }
+ return 0;
}
/* Denied ACE entries must come before allowed ones */
@@ -509,10 +522,11 @@ int main(int argc, const char *argv[])
bool initialize_sid = False;
struct poptOption long_options[] = {
POPT_AUTOHELP
- { "remove", 'r', POPT_ARG_STRING, &the_acl, 'r', "Delete an ACE", "ACL" },
- { "modify", 'm', POPT_ARG_STRING, &the_acl, 'm', "Modify an acl", "ACL" },
- { "add", 'a', POPT_ARG_STRING, &the_acl, 'a', "Add an ACE", "ACL" },
- { "replace", 'R', POPT_ARG_STRING, &the_acl, 'R', "Set share mission ACL", "ACLS" },
+ { "remove", 'r', POPT_ARG_STRING, &the_acl, 'r', "Remove ACEs", "ACL" },
+ { "modify", 'm', POPT_ARG_STRING, &the_acl, 'm', "Modify existing ACEs", "ACL" },
+ { "add", 'a', POPT_ARG_STRING, &the_acl, 'a', "Add ACEs", "ACL" },
+ { "replace", 'R', POPT_ARG_STRING, &the_acl, 'R', "Overwrite share permission ACL", "ACLS" },
+ { "delete", 'D', POPT_ARG_NONE, NULL, 'D', "Delete the entire security descriptor" },
{ "view", 'v', POPT_ARG_NONE, NULL, 'v', "View current share permissions" },
{ "machine-sid", 'M', POPT_ARG_NONE, NULL, 'M', "Initialize the machine SID" },
{ "force", 'F', POPT_ARG_NONE, NULL, 'F', "Force storing the ACL", "ACLS" },
@@ -532,7 +546,7 @@ int main(int argc, const char *argv[])
x_setbuf( x_stderr, NULL );
pc = poptGetContext("sharesec", argc, argv, long_options, 0);
-
+
poptSetOtherOptionHelp(pc, "sharename\n");
while ((opt = poptGetNextOpt(pc)) != -1) {
@@ -551,11 +565,16 @@ int main(int argc, const char *argv[])
the_acl = smb_xstrdup(poptGetOptArg(pc));
mode = SMB_ACL_ADD;
break;
+
case 'R':
the_acl = smb_xstrdup(poptGetOptArg(pc));
mode = SMB_ACL_SET;
break;
+ case 'D':
+ mode = SMB_SD_DELETE;
+ break;
+
case 'v':
mode = SMB_ACL_VIEW;
break;
@@ -563,13 +582,13 @@ int main(int argc, const char *argv[])
case 'F':
force_acl = True;
break;
-
+
case 'M':
initialize_sid = True;
break;
}
}
-
+
setlinebuf(stdout);
load_case_tables();
@@ -577,15 +596,15 @@ int main(int argc, const char *argv[])
lp_load( get_dyn_CONFIGFILE(), False, False, False, True );
/* check for initializing secrets.tdb first */
-
+
if ( initialize_sid ) {
DOM_SID *sid = get_global_sam_sid();
-
+
if ( !sid ) {
fprintf( stderr, "Failed to retrieve Machine SID!\n");
return 3;
}
-
+
printf ("%s\n", sid_string_tos( sid ) );
return 0;
}
@@ -597,22 +616,22 @@ int main(int argc, const char *argv[])
/* get the sharename */
- if(!poptPeekArg(pc)) {
- poptPrintUsage(pc, stderr, 0);
+ if(!poptPeekArg(pc)) {
+ poptPrintUsage(pc, stderr, 0);
return -1;
}
-
+
fstrcpy(sharename, poptGetArg(pc));
-
+
snum = lp_servicenumber( sharename );
-
+
if ( snum == -1 && !force_acl ) {
fprintf( stderr, "Invalid sharename: %s\n", sharename);
return -1;
}
-
+
retval = change_share_sec(ctx, sharename, the_acl, mode);
-
+
talloc_destroy(ctx);
return retval;
--
Samba Shared Repository
More information about the samba-cvs
mailing list