diff --git a/src/secaudit.c b/src/secaudit.c index a34fbf4b..dfd198c2 100644 --- a/src/secaudit.c +++ b/src/secaudit.c @@ -209,6 +209,7 @@ * * - decoded GENERIC_ALL permissions * - decoded more "well-known" and generic SIDs + * - showed Windows ownership in verbose situations */ /* @@ -425,6 +426,8 @@ type_leave_file_security ntfs_leave_file_security; #endif /* USESTUBS | defined(STSC) */ #endif /* WIN32 */ +#define ACCOUNTSIZE 256 /* maximum size of an account name */ + /* * Prototypes for local functions */ @@ -455,6 +458,7 @@ BOOL guess_dir(const char*); void showsid(const char*, int, const char*, int); void showusid(const char*, int); void showgsid(const char*, int); +void showownership(const char*); void showheader(const char*, int); void showace(const char*, int, int, int); void showacl(const char*, int, int, int); @@ -1594,6 +1598,74 @@ void showgsid(const char *attr, int level) showsid(attr,off,"G:",level+4); } +void showownership(const char *attr) +{ +#ifdef WIN32 + char account[ACCOUNTSIZE]; + BIGSID sidcopy; + SID_NAME_USE use; + unsigned long accountsz; + unsigned long domainsz; +#endif + enum { SHOWOWN, SHOWGRP, SHOWINT } shown; + const char *sid; + const char *prefix; + u64 auth; + int cnt; + int off; + int i; + + for (shown=SHOWOWN; shown<=SHOWINT; shown++) { + switch (shown) { + case SHOWOWN : + off = get4l(attr,4); + sid = &attr[off]; + prefix = "Windows owner"; + break; + case SHOWGRP : + off = get4l(attr,8); + sid = &attr[off]; + prefix = "Windows group"; + break; +#if OWNERFROMACL + case SHOWINT : + off = get4l(attr,4); + prefix = "Interpreted owner"; + sid = (const char*)ntfs_acl_owner((const char*)attr); + if (ntfs_same_sid((const SID*)sid, + (const SID*)&attr[off])) + sid = (const char*)NULL; + break; +#endif + default : + sid = (const char*)NULL; + prefix = (const char*)NULL; + break; + } + if (sid) { + cnt = sid[1] & 255; + auth = get6h(sid,2); + if (opt_b) + printf("# %s S-%d-",prefix,sid[0] & 255); + else + printf("%s S-%d-",prefix,sid[0] & 255); + printf("%llu",auth); + for (i=0; i