Missing AccessMask flags when requesting DACL from security descriptor

[orthose]

Consider the following code inspired by https://gist.github.com/jborean93/c4d8db1db14297de1c9a268084e89d36 to get DACL of file or folder:

import os
import smbclient
from smbprotocol.file_info import (
    InfoType,
)
from smbprotocol.open import (
    Open,
    DirectoryAccessMask,
    FilePipePrinterAccessMask,
    SMB2QueryInfoRequest,
    SMB2QueryInfoResponse,
    InfoAdditionalInformation,
)
from smbprotocol.security_descriptor import (
    SMB2CreateSDBuffer,
)


# Not needed when using Kerberos auth, can also be set as kwargs when calling open_file.
smbclient.ClientConfig(username=os.environ["USER"], password=os.environ["PASSWORD"])


def get_sd(fd: Open, info: int) -> SMB2CreateSDBuffer:
    """ Get the Security Descriptor for the opened file. """
    query_req = SMB2QueryInfoRequest()
    query_req['info_type'] = InfoType.SMB2_0_INFO_SECURITY
    query_req['output_buffer_length'] = 65535
    query_req['additional_information'] = info
    query_req['file_id'] = fd.file_id

    req = fd.connection.send(query_req, sid=fd.tree_connect.session.session_id, tid=fd.tree_connect.tree_connect_id)
    resp = fd.connection.receive(req)
    query_resp = SMB2QueryInfoResponse()
    query_resp.unpack(resp['data'].get_value())

    security_descriptor = SMB2CreateSDBuffer()
    security_descriptor.unpack(query_resp['buffer'].get_value())

    return security_descriptor


# File example
with smbclient.open_file(
    r'\\path\to\nas\file.txt',
    mode='rb',
    buffering=0,
    file_type="file",
    desired_access=FilePipePrinterAccessMask.READ_CONTROL) as file:
    sd = get_sd(file.fd, InfoAdditionalInformation.OWNER_SECURTIY_INFORMATION | InfoAdditionalInformation.DACL_SECURITY_INFORMATION)
          
    for ace in sd.get_dacl()['aces']:
        print(str(ace["mask"]), ace["mask"].flag_type)


# Dir example
with smbclient.open_file(
    r"\\path\to\nas\folder", 
    mode='br',
    buffering=0,
    file_type='dir',
    desired_access=DirectoryAccessMask.READ_CONTROL
) as file:
    sd = get_sd(file.fd, InfoAdditionalInformation.OWNER_SECURTIY_INFORMATION | InfoAdditionalInformation.DACL_SECURITY_INFORMATION)
    
    for ace in sd.get_dacl()['aces']:
        print(str(ace["mask"]), ace["mask"].flag_type)

(1179817) READ_CONTROL, SYNCHRONIZE <class 'smbprotocol.security_descriptor.AccessMask'>
(2032127) DELETE, READ_CONTROL, SYNCHRONIZE, WRITE_DACL, WRITE_OWNER, __firstlineno__ <class 'smbprotocol.security_descriptor.AccessMask'>
(2032127) DELETE, READ_CONTROL, SYNCHRONIZE, WRITE_DACL, WRITE_OWNER, __firstlineno__ <class 'smbprotocol.security_descriptor.AccessMask'>
(1179817) READ_CONTROL, SYNCHRONIZE <class 'smbprotocol.security_descriptor.AccessMask'>
(2032127) DELETE, READ_CONTROL, SYNCHRONIZE, WRITE_DACL, WRITE_OWNER, __firstlineno__ <class 'smbprotocol.security_descriptor.AccessMask'>
(1179817) READ_CONTROL, SYNCHRONIZE <class 'smbprotocol.security_descriptor.AccessMask'>
(1179817) READ_CONTROL, SYNCHRONIZE <class 'smbprotocol.security_descriptor.AccessMask'>
(2032127) DELETE, READ_CONTROL, SYNCHRONIZE, WRITE_DACL, WRITE_OWNER, __firstlineno__ <class 'smbprotocol.security_descriptor.AccessMask'>
(2032127) DELETE, READ_CONTROL, SYNCHRONIZE, WRITE_DACL, WRITE_OWNER, __firstlineno__ <class 'smbprotocol.security_descriptor.AccessMask'>
(2032127) DELETE, READ_CONTROL, SYNCHRONIZE, WRITE_DACL, WRITE_OWNER, __firstlineno__ <class 'smbprotocol.security_descriptor.AccessMask'>

I notice that ACE mask has_flag type AccessMask. Some ACE have a value with some bits undefined in AccessMask. For example, 2032127 is 0x1f01ff or 0b111110000000111111111. There is no mask defined for the right-hand side of this number in AccessMask.

The docstring of AccessMask says:

32-bit set of flags that are used to encode the user rights to an object.
This is just a generic setup of access mask flags to set an can vary
from the object being set. When setting the AccessMask on an ACE packet,
any 32-bit value can be used and this is just as a guideline.

But, I wonder if the flag_type of ace["mask"] shouldn't be instead FilePipePrinterAccessMask for a file and DirectoryAccessMask for a directory? These appear to be a subset of AccessMask but define more flags.

smbprotocol/src/smbprotocol/security_descriptor.py

Lines 18 to 39 in d857cbf

	class AccessMask:
	"""
	[MS-DTYP]
	2.4.3 ACCESS_MASK
	32-bit set of flags that are used to encode the user rights to an object.
	This is just a generic setup of access mask flags to set an can vary
	from the object being set. When setting the AccessMask on an ACE packet,
	any 32-bit value can be used and this is just as a guideline.
	"""
	GENERIC_READ = 0x80000000
	GENERIC_WRITE = 0x40000000
	GENERIC_EXECUTE = 0x20000000
	GENERIC_ALL = 0x10000000
	MAXIMUM_ALLOWED = 0x02000000
	ACCESS_SYSTEM_SECURITY = 0x01000000
	SYNCHRONIZE = 0x00100000
	WRITE_OWNER = 0x00080000
	WRITE_DACL = 0x00040000
	READ_CONTROL = 0x00020000
	DELETE = 0x00010000

[jborean93]

The access mask just shows some of the baseline masks used on Windows whereas each object type can have their own specific mask values. I don't think we should be changing these types as we cannot easily derive whether the mask is for a file or directory as part of the structure definition so keeping it generic is good enough. I would highly recommend avoiding using the structure field objects as they are not the easiest to use and have foot guns like this. What I would recommend is to define a flags enum yourself and build the value from that like:

import enum

class FileAccessMask(enum.IntFlag):
    FILE_READ_DATA = 0x00000001
    FILE_WRITE_DATA = 0x00000002
    FILE_APPEND_DATA = 0x00000004
    FILE_READ_EA = 0x00000008
    FILE_WRITE_EA = 0x00000010
    FILE_EXECUTE = 0x00000020
    FILE_DELETE_CHILD = 0x00000040
    FILE_READ_ATTRIBUTES = 0x00000080
    FILE_WRITE_ATTRIBUTES = 0x00000100
    DELETE = 0x00010000
    READ_CONTROL = 0x00020000
    WRITE_DAC = 0x00040000
    WRITE_OWNER = 0x00080000
    SYNCHRONIZE = 0x00100000
    ACCESS_SYSTEM_SECURITY = 0x01000000
    MAXIMUM_ALLOWED = 0x02000000
    GENERIC_ALL = 0x10000000
    GENERIC_EXECUTE = 0x20000000
    GENERIC_WRITE = 0x40000000
    GENERIC_READ = 0x80000000

...
mask = FileAccessMask(ace["mask"].get_value())
print(mask)
....

This way you can selectively cast it to the proper enum (file vs dir) based on the context of the object it was from. You can do your standard enum operations like you normally would in Python.

Ultimately my goal would be to move away from the classes defined in structure.py and add a shim for backwards compatibility so I'm reluctant on making too many changes there when alternatives exist.

[orthose]

Thank you very much for these very clear explanations. Using enum.IntFlag does indeed solve my problem.

mask = FileAccessMask(0b111110000000111111111)
print(mask.name)

FILE_READ_DATA|FILE_WRITE_DATA|FILE_APPEND_DATA|FILE_READ_EA|FILE_WRITE_EA|FILE_EXECUTE|FILE_DELETE_CHILD|FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES|DELETE|READ_CONTROL|WRITE_DAC|WRITE_OWNER|SYNCHRONIZE

I understand the limitation of SMB2CreateSDBuffer, which cannot automatically infer at its level whether it is dealing with a file or a directory. However, if this feature were to be added to smbclient (see #349), I suppose the selection of the mask based on the file_type could be automated.

[jborean93]

Yea definitely if there was a generic method to get the SD implemented here I would say accepting a kwarg or infering an automatic one to map the object type to type specific enum would be ideal.