exerevokeall.c

/*
 * Copyright (c) 2004, 2019, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 only, as
 * published by the Free Software Foundation.
 *
 * This code is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * version 2 for more details (a copy is included in the LICENSE file that
 * accompanied this code).
 *
 * You should have received a copy of the GNU General Public License version
 * 2 along with this work; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 *
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
 * or visit www.oracle.com if you need additional information or have any
 * questions.
 */

#include <stdio.h>
#include <windows.h>
#include <malloc.h>
#include <string.h>

/*
 * Simple Windows utility to remove all non-owner access to a given file.
 */


/*
 * Access mask to represent any file access
 */
#define ANY_ACCESS (FILE_GENERIC_READ | FILE_GENERIC_WRITE | FILE_GENERIC_EXECUTE)


/*
 * Print error message to stderr
 */
static void printLastError(const char* msg) {
    int len;
    char buf[128];
    DWORD errval;

    buf[0] = '\0';
    len = sizeof(buf);

    errval = GetLastError();
    if (errval != 0) {
        int n = FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM|FORMAT_MESSAGE_IGNORE_INSERTS,
                              NULL, errval,
                              0, buf, len, NULL);
        if (n > 3) {
            /* Drop final '.', CR, LF */
            if (buf[n - 1] == '\n') n--;
            if (buf[n - 1] == '\r') n--;
            if (buf[n - 1] == '.') n--;
            buf[n] = '\0';
        }
    }

    if (strlen(buf) > 0) {
        fprintf(stderr, "revokeall %s: %s\n", msg, buf);
    } else {
        fprintf(stderr, "revokeall %s\n", msg);
    }
}



/*
 * Return a string that includes all the components of a given SID.
 * See here for a description of the SID components :-
 * http://msdn.microsoft.com/library/default.asp?url=/library/en-us/security/security/sid_components.asp
 */
static char *getTextualSid(SID* sid) {
    SID_IDENTIFIER_AUTHORITY* sia;
    DWORD i, count;
    DWORD len;
    char* name;

    /*
     * Get the identifier authority and the number of sub-authorities
     */
    sia = GetSidIdentifierAuthority(sid);
    count = *GetSidSubAuthorityCount(sid);

    /*
     * Allocate buffer for the string - buffer is :-
     * S-SID_REVISION- + identifierAuthority- + subauthorities- + NULL
     */
    len=(15 + 12 + (12 * count) + 1) * sizeof(char);
    name = (char*)malloc(len);
    if (name == NULL) {
        return NULL;
    }

    // S-SID_REVISION
    sprintf(name, "S-%lu-", SID_REVISION );

    // Identifier authority
    if ((sia->Value[0] != 0) || (sia->Value[1] != 0))
    {
        sprintf(name + strlen(name), "0x%02hx%02hx%02hx%02hx%02hx%02hx",
                (USHORT)sia->Value[0],
                (USHORT)sia->Value[1],
                (USHORT)sia->Value[2],
                (USHORT)sia->Value[3],
                (USHORT)sia->Value[4],
                (USHORT)sia->Value[5]);
    }
    else
    {
        sprintf(name + strlen(name), "%lu",
                (ULONG)(sia->Value[5]      )   +
                (ULONG)(sia->Value[4] <<  8)   +
                (ULONG)(sia->Value[3] << 16)   +
                (ULONG)(sia->Value[2] << 24)   );
    }

    // finally, the sub-authorities
    for (i=0 ; i<count; i++) {
        sprintf(name + strlen(name), "-%lu",
                *GetSidSubAuthority(sid, i) );
    }

    return name;
}

/*
 * Returns a string to represent the given security identifier (SID).
 * If the account is known to the local computer then the account
 * domain is returned. The format will be \\name or domain\\name depending
 * on if the computer belongs to a domain.
 * If the account name is not known then the textual representation of
 * SID is returned -- eg: S-1-5-21-2818032319-470147023-1036452850-13037.
 */
static char *getSIDString(SID* sid) {
    char domain[255];
    char name[255];
    DWORD domainLen = sizeof(domain);
    DWORD nameLen = sizeof(name);
    SID_NAME_USE use;

    if(!IsValidSid(sid)) {
        return strdup("<Invalid SID>");
    }

    if (LookupAccountSid(NULL, sid, name, &nameLen, domain, &domainLen, &use)) {
        size_t len = strlen(name) + strlen(domain) + 3;
        char* s = (char*)malloc(len);
        if (s != NULL) {
            strcpy(s, domain);
            strcat(s, "\\\\");
            strcat(s, name);
        }
        return s;
    } else {
        return getTextualSid(sid);
    }
}



/*
 * Returns 1 if the specified file is on a file system that supports
 * persistent ACLs (On NTFS file systems returns true, on FAT32 file systems
 * returns false), otherwise 0. Returns -1 if error.
 */
static int isSecuritySupported(const char* path) {
    char* root;
    char* p;
    BOOL res;
    DWORD dwMaxComponentLength;
    DWORD dwFlags;
    char fsName[128];
    DWORD fsNameLength;

    /*
     * Get root directory. For UNCs the slash after the share name is required.
     */
    root = strdup(path);
    if (*root == '\\') {
        /*
         * \\server\share\file ==> \\server\share\
         */
        int slashskip = 3;
        p = root;
        while ((*p == '\\') && (slashskip > 0)) {
            char* p2;
            p++;
            p2 = strchr(p, '\\');
            if ((p2 == NULL) || (*p2 != '\\')) {
                free(root);
                fprintf(stderr, "Malformed UNC");
                return -1;
            }
            p = p2;
            slashskip--;
        }
        if (slashskip != 0) {
            free(root);
            fprintf(stderr, "Malformed UNC");
            return -1;
        }
        p++;
        *p = '\0';

    } else {
        p = strchr(root, '\\');

        /*
         * Relative path so use current directory
         */
        if (p == NULL) {
            free(root);
            root = malloc(255);
            if (GetCurrentDirectory(255, root) == 0) {
                printLastError("GetCurrentDirectory failed");
                return -1;
            }
            p = strchr(root, '\\');
            if (p == NULL) {
                fprintf(stderr, "GetCurrentDirectory doesn't include drive letter!!!!\n");
                return -1;
            }
        }
        p++;
        *p = '\0';
    }

    /*
     * Get the volume information - this gives us the file system file and
     * also tells us if the file system supports persistent ACLs.
     */
    fsNameLength = sizeof(fsName)-1;
    res = GetVolumeInformation(root,
                               NULL,        // address of name of the volume, can be NULL
                               0,           // length of volume name
                               NULL,        // address of volume serial number, can be NULL
                               &dwMaxComponentLength,
                               &dwFlags,
                               fsName,
                               fsNameLength);
    if (res == 0) {
        printLastError("GetVolumeInformation failed");
        free(root);
        return -1;
    }

    free(root);
    return (dwFlags & FS_PERSISTENT_ACLS) ? 1 : 0;
}


/*
 * Returns the security descriptor for a file.
 */
static SECURITY_DESCRIPTOR* getFileSecurityDescriptor(const char* path) {
    SECURITY_DESCRIPTOR* sd;
    DWORD len = 0;
    SECURITY_INFORMATION info =
        OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION;

    GetFileSecurity(path, info , 0, 0, &len);
    if (GetLastError() != ERROR_INSUFFICIENT_BUFFER) {
        printLastError("GetFileSecurity failed");
        return NULL;
    }
    sd = (SECURITY_DESCRIPTOR *)malloc(len);
    if (sd == NULL) {
        fprintf(stderr, "Out of memory");
    } else {
        if (!GetFileSecurity(path, info, sd, len, &len)) {
            printLastError("GetFileSecurity failed");
            free(sd);
            return NULL;
        }
    }
    return sd;
}


/*
 * Revoke all access to the specific file
 */
static int revokeAll(const char* path) {
    SECURITY_DESCRIPTOR* sd;
    SID* owner;
    ACL *acl;
    BOOL defaulted, present;
    ACL_SIZE_INFORMATION acl_size_info;
    DWORD i, count;
    char* str;

    /*
     * Get security descriptor for file; From security descriptor get the
     * owner SID, and the DACL.
     */
    sd = getFileSecurityDescriptor(path);
    if (sd == NULL) {
        return -1;      /* error already reported */
    }
    if (!GetSecurityDescriptorOwner(sd, &owner, &defaulted)) {
        printLastError("GetSecurityDescriptorOwner failed");
        return -1;
    }
    str = getSIDString(owner);
    if (str != NULL) {
        printf("owner: %s\n", str);
        free(str);
    }
    if (!GetSecurityDescriptorDacl(sd, &present, &acl, &defaulted)) {
        printLastError("GetSecurityDescriptorDacl failed");
        return -1;
    }
    if (!present) {
        fprintf(stderr, "Security descriptor does not contain a DACL");
        return -1;
    }

    /*
     * If DACL is NULL there is no access to the file - we are done
     */
    if (acl == NULL) {
        return 1;
    }

    /*
     * Iterate over the ACEs. For each "allow" type check that the SID
     * matches the owner - if not we remove the ACE from the ACL
     */
    if (!GetAclInformation(acl, (void *) &acl_size_info, sizeof(acl_size_info),
                                  AclSizeInformation)) {
        printLastError("GetAclInformation failed");
        return -1;
    }
    count = acl_size_info.AceCount;
    i = 0;
    while (count > 0) {
        void* ace;
        ACCESS_ALLOWED_ACE *access;
        SID* sid;
        BOOL deleted;

        if (!GetAce(acl, i, &ace)) {
            printLastError("GetAce failed");
            return -1;
        }
        if (((ACCESS_ALLOWED_ACE *)ace)->Header.AceType != ACCESS_ALLOWED_ACE_TYPE) {
            i++;
            count--;
            continue;
        }
        access = (ACCESS_ALLOWED_ACE *)ace;
        sid = (SID *) &access->SidStart;


        deleted = FALSE;
        if (!EqualSid(owner, sid)) {
            /*
             * If the ACE allows any access then the file then we
             * delete it.
             */
            if (access->Mask & ANY_ACCESS) {
                str = getSIDString(sid);
                if (str != NULL) {
                    printf("remove ALLOW %s\n", str);
                    free(str);
                }
                if (DeleteAce(acl, i) == 0) {
                    printLastError("DeleteAce failed");
                    return -1;
                }
                deleted = TRUE;
            }
        }

        if (!deleted) {
            str = getSIDString(sid);
            if (str != NULL) {
                printf("ALLOW %s (access mask=%x)\n", str, access->Mask);
                free(str);
            }

            /* onto the next ACE */
            i++;
        }
        count--;
    }

    /*
     * No changes - only owner has access
     */
    if (i == acl_size_info.AceCount) {
        printf("No changes.\n");
        return 1;
    }

    /*
     * Create security descriptor and set its DACL to the version
     * that we just edited
     */
    if (!InitializeSecurityDescriptor(sd, SECURITY_DESCRIPTOR_REVISION)) {
        printLastError("InitializeSecurityDescriptor failed");
        return -1;
    }
    if (!SetSecurityDescriptorDacl(sd, present, acl, defaulted)) {
        printLastError("SetSecurityDescriptorDacl failed");
        return -1;
    }
    if (!SetFileSecurity(path, DACL_SECURITY_INFORMATION, sd)) {
        printLastError("SetFileSecurity failed");
        return -1;
    }

    printf("File updated.\n");

    return 1;
}

/*
 * Convert slashes in the pathname to backslashes if needed.
 */
static char* convert_path(const char* p) {
   int i = 0;
   char* path = strdup(p);
   while (p[i] != '\0') {
       if (p[i] == '/') {
           path[i] = '\\';
       }
       i++;
   }
   return path;
}

/*
 * Usage: revokeall file
 */
int main( int argc, char *argv[])
{
    int rc;
    const char* path;

    if (argc != 2) {
        fprintf(stderr, "Usage: %s file\n", argv[0]);
        return -1;
    }
    path = convert_path(argv[1]);
    printf("Revoking all non-owner access to %s\n", path);
    rc = isSecuritySupported(path);
    if (rc != 1) {
        if (rc == 0) {
            printf("File security not supported on this file system\n");
        }
        return rc;
    } else {
        return revokeAll(path);
    }
}