
    Id^                        d Z ddlZddlZddlZddlZddlZddlZddlm	Z
 ddlmZmZmZ ddlmZmZ ddlmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZ ej8                  ej:                  z  ej<                  z  ej>                  z  Z ejB                  ejD                  z  ejF                  z  ejH                  z  Z% G d de&      Z'd Z(d Z)	 	 	 	 ddZ*	 	 	 ddZ+d Z,ddZ- G d d      Z. G d d      Z/d Z0d Z1d Z2d Z3d Z4y) zNT Acls.    N)param)securityxattridmap)ndr_pack
ndr_unpack)smbd)libsmb_samba_internal)get_samba_logger)NTSTATUSError)system_session_unix)safe_tarfilec                       e Zd ZdZy)XattrBackendErrorzA generic xattr backend error.N)__name__
__module____qualname____doc__     ./usr/lib/python3/dist-packages/samba/ntacls.pyr   r   3   s    (r   r   c                    |i| j                  d      }|!t        j                  | j                  d      fS | j                  d      }|!t        j                  | j                  d      fS y|dk(  ry|dk(  rp|t        j                  |fS t        j                  t        j
                  j                  t        j
                  j                  | j                  d      d            fS |dk(  rt|t        j                  |fS | j                  d	      }t        j
                  j                  t        j
                  j                  |d
            }t        j                  |fS t        d|z        )z$return the path to the eadb, or Nonezxattr_tdb:filez
posix:eadbNNnativeeadbzprivate dirzeadb.tdbtdbzstate directoryz	xattr.tdbzInvalid xattr backend choice %s)	getsamba	xattr_tdb
posix_eadbospathabspathjoinr   )lpbackendeadbfiler   r    	state_dirdb_paths          r   checkset_backendr*   7   s4   FF+,	 OORVV,<%=>>VVL)
!$$bff\&:;;	H		F	$$h//$$bggoobggll266-CXZd6e&fgg	E	OOX..01Iggoobggll9k&JKGOOW-- AG KLLr   c                     	 t         j                  j                  |t        j                        }t        t        j                  |      S # t
        $ r Y y w xY wN)r   xattr_nativewrap_getxattrr   XATTR_DOSATTRIB_NAME_S3	Exceptionr   	DOSATTRIB)r%   file	attributes      r   
getdosinfor4   S   sP    &&44T5:5R5RT	
 eooy11  s   .A
 
	AAc                    |rt        | ||      \  }}|#	 |j                  ||t        j                        }	n.t        j                  j                  |t        j                        }	t        t        j                  |	      }
|
j                  dk(  r|
j                  S |
j                  dk(  r|
j                  j                  S |
j                  dk(  r|
j                  j                  S |
j                  dk(  r|
j                  j                  S y t        j                  |t        ||      S # t        $ r@ t        d|z         t        j                  j                  |t        j                        }	Y 
w xY w)NFail to open %s            service)r*   r.   r   XATTR_NTACL_NAMEr0   printr   r-   r   NTACLversioninfosdr	   
get_nt_aclSECURITY_SECINFO_FLAGS)r%   r2   session_infor&   r'   direct_db_accessr<   backend_objdbnamer3   ntacls              r   getntaclrJ   ]   sD     0Wh GfU'55fd6;6L6LN	 **889>9O9OQI5;;	2==A::]]a::== ]]a::== ]]a::==    t5+'.0 	0'  U '&01!..<<T=B=S=SU		Us   !D) )AE21E2c                 &   t        |t              st        |t        j                        sJ t        |t              rt        j                  |      }n't        |t        j                        r|}t        |      }t        |t              st        |t        j                        sJ t        |t              r!t        j                  j                  |      }n-t        |t        j                        r|}|j                        }|s||ry|	j                  j                        \  }}|t        j                  k7  rG|t        j                  k7  r3|j                  t        j                  d|t        j                  fz        k(  rt        j                  d|t        j                  fz        }|	j                  |      \  }}|t        j                  k(  s|t        j                  k(  r*|}||_        t        j                  |t         |||
       d}nrt#        d|||fz        t%        j&                  |dd       t        j                  |t        j(                  t        j*                  z  t        j,                  z  |||
       |rt/        | ||      \  }}t1        j2                         }d|_        |_        |-	 |j9                  ||t0        j:                  t=        |             ytB        jD                  j9                  |t0        j:                  t=        |             yt        j                  |t         |
|	       y# t>        $ rI tA        d|z         tB        jD                  j9                  |t0        j:                  t=        |             Y yw xY w)
a  
    A wrapper for smbd set_nt_acl api.

    Args:
        lp (LoadParam): load param from conf
        file (str): a path to file or dir
        sddl (str): ntacl sddl string
        service (str): name of share service, e.g.: sysvol
        session_info (auth_session_info): session info for authentication

    Note:
        Get `session_info` with `samba.auth.user_session`, do not use the
        `admin_session` api.

    Returns:
        None
    z%s-%dr;   TzDUnable to find UID for domain administrator %s, got id %d of type %dr   r7   Nr6   )r<   rE   )#
isinstancestrr   dom_sid
descriptor	from_sddlas_sddl	sid_to_id	owner_sidr   ID_TYPE_UIDID_TYPE_BOTHDOMAIN_RID_ADMINSDOMAIN_RID_ADMINISTRATORr	   
set_nt_aclrD   r   r!   chownSECINFO_GROUPSECINFO_DACLSECINFO_SACLr*   r   r?   r@   rA   wrap_setxattrr=   r   r0   r>   r   r-   )r%   r2   sddldomsidrE   r&   r'   	use_ntvfsskip_invalid_chownpassdbr<   sidrB   owner_id
owner_typeadministratoradmin_id
admin_typesd2rG   rH   rI   s                         r   setntaclrj      s   , fc"j9I9I&JKJ&#v&	FH,,	-SdC JtX5H5H$IJI$  **45	D(--	.zz#+!'!1!1",,!?:5,,,:ASAS3S ||x//68C]C]:^0^__ ( 0 0FHDeDe;f1f g)/)9)9-)H&:  5#4#44*HZHZ:Z C$1CMOO4c$ ') !%I+,r  wD  FN  PZ  v[  -[  \  \ q!$**))*))*  #%  0Wh Gf
B))&*.0F0FQVY ,,T53I3I-5e_> 	(",	8  B '&01""00u7M7M19%B	Bs   :+L> >ANNc                 &   d}d}d}d}d}d}d}d}d	}	d}
d}d}d}d}d}d}d}d}d}d}d}d}d	}d
}d}d}d}d}d}| |z  }| |z  r| |z  r|||z  |z  |z  |
z  |z  z  }| |z  r|||z  |z  |z  |z  |z  |z  z  }| |z  r|||z  z  }| |z  r||z  }|S )zMTakes the access mask of a DS ACE and transform them in a File ACE mask.
    r7   r8   r:             @         i   i   i   i   i   i   r   )ldmRIGHT_DS_CREATE_CHILDRIGHT_DS_DELETE_CHILDRIGHT_DS_LIST_CONTENTSACTRL_DS_SELFRIGHT_DS_READ_PROPERTYRIGHT_DS_WRITE_PROPERTYRIGHT_DS_DELETE_TREERIGHT_DS_LIST_OBJECTRIGHT_DS_CONTROL_ACCESSFILE_READ_DATAFILE_LIST_DIRECTORYFILE_WRITE_DATAFILE_ADD_FILEFILE_APPEND_DATAFILE_ADD_SUBDIRECTORYFILE_CREATE_PIPE_INSTANCEFILE_READ_EAFILE_WRITE_EAFILE_EXECUTEFILE_TRAVERSEFILE_DELETE_CHILDFILE_READ_ATTRIBUTESFILE_WRITE_ATTRIBUTESDELETEREAD_CONTROL	WRITE_DACWRITE_OWNERSYNCHRONIZESTANDARD_RIGHTS_ALLfilemasks                                  r   ldapmask2filemaskr      sp    !+ * * *M * * * * * &N & &O &M & & & &L &M &L &M & & & *F *L *I *K *K *((H$$31G+G{-@@3 46B C- .0< = > $${_</ 02? @4 57D E  5 5 6
 ""4}DE
""//Or   c                 ~   t         j                  j                  | |      }t        j                         }|j                  |_        |j                  |_        |j
                  |_        |j                  |_        |j                  j                  }t        dt        |            D ]  }||   }|j
                  t         j                  t         j                  fv s6t        |j                        t         j                  k7  s]|j                   t         j"                  z  t         j$                  z  |_        t        |j                        t         j&                  k(  r"|j                   t         j(                  z  |_        t+        |j,                        |_        |j/                  |        |s|S |j1                  |      S )z

    This function takes an the SDDL representation of a DS
    ACL and return the SDDL representation of this ACL adapted
    for files. It's used for Policy object provision
    r   )r   rO   rP   rS   	group_sidtyperevisiondaclacesrangelen"SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECTSEC_ACE_TYPE_ACCESS_ALLOWEDrM   trusteeSID_BUILTIN_PREW2KflagsSEC_ACE_FLAG_OBJECT_INHERITSEC_ACE_FLAG_CONTAINER_INHERITSID_CREATOR_OWNERSEC_ACE_FLAG_INHERIT_ONLYr   access_maskdacl_addrQ   )dssddlrc   rQ   reffdescrr   iaces           r   dsacl2fsaclr   !  sE    


'
'
4C  "F}}F}}F((FKllFO88==D1c$i  
!1g88CC <<> >BEckkBRV^VqVqBq		H$H$HH8KrKrrCI3;;8#=#==II(J(JJ	/@COOOC 
! >>#r   c                   d    e Zd ZdZd Z	 	 ddZ	 ddZddZd Zd Z	d	 Z
dd
ZddZddZd Zy)	SMBHelperzb
    A wrapper class for SMB connection

    smb_path: path with separator "\" other than "/"
    c                      || _         || _        y r,   )smb_connrN   )selfr   rN   s      r   __init__zSMBHelper.__init__H  s     r   Nc                     d|vsJ | j                   j                  |||      }|r|j                  | j                        S |S N/)sinfor   )r   get_aclrQ   rN   )r   smb_pathrQ   r   r   ntacl_sds         r   r   zSMBHelper.get_aclL  sP    ("""==((/45@ ) B 29x-FhFr   c                 T   d|vsJ t        |t              st        |t        j                        sJ t        |t              r+t        j                  j	                  || j
                        }nt        |t        j                        r|}| j                  j                  |||       y r   )rL   rM   r   rO   rP   
domain_sidr   set_acl)r   r   r   r   r   tmp_descs         r   r   zSMBHelper.set_aclV  s    ("""(C(JxATAT,UVUh$**44XtOH("5"56Hh$)*5 	 	7r   c                 P    d|vsJ | j                   j                  |t              S )zM
        List file and dir base names in smb_path without recursive.
        r   )attribs)r   listSMB_FILE_ATTRIBUTE_FLAGSr   r   s     r   r   zSMBHelper.listd  s-     ("""}}!!(4L!MMr   c                 :    t        |t        j                  z        S )ze
        Check whether the attrib value is a directory.

        attrib is from list method.
        )boollibsmbFILE_ATTRIBUTE_DIRECTORY)r   attribs     r   is_dirzSMBHelper.is_dirk  s     FV<<<==r   c                     |r|dz   |z   S |S )z$
        Join path with '\'
        \r   )r   rootnames      r   r$   zSMBHelper.joins  s     &*td{T!3t3r   c                 D    d|vsJ | j                   j                  |      S )Nr   )r   loadfiler   s     r   r   zSMBHelper.loadfiley  s%    ("""}}%%h//r   c                 D   |j                         D ]  \  }}| j                  ||      }t        |t              rJ| j                  j                  |      s| j                  j                  |       | j                  ||       r| j                  j                  ||        y)z1
        Create files as defined in tree
        r   N)	itemsr$   rL   dictr   chkpathmkdircreate_treesavefile)r   treer   r   contentfullnames         r   r   zSMBHelper.create_tree}  s     "ZZ\ 	:MD'yy40H'4(}},,X6MM''1  8 <&&x9	:r   c                     i }| j                  |      D ]W  }|d   }| j                  ||      }| j                  |d         r| j                  |      ||<   D| j	                  |      ||<   Y |S )a  
        Get the tree structure via smb conn

        self.smb_conn.list example:

        [
          {
            'attrib': 16,
            'mtime': 1528848309,
            'name': 'dir1',
            'short_name': 'dir1',
            'size': 0L
          }, {
            'attrib': 32,
            'mtime': 1528848309,
            'name': 'file0.txt',
            'short_name': 'file0.txt',
            'size': 10L
          }
        ]
        r   r   r   )r   r$   r   get_treer   )r   r   r   itemr   r   s         r   r   zSMBHelper.get_tree  sw    , IIh' 	5D<Dyy40H{{4>*!]]H]=T
!]]84T
	5 r   c                 .   i }| j                  |      D ]~  }|d   }| j                  ||      }| j                  |d         r"|j                  | j	                  |             P| j                  |      }|j                  | j                        ||<    |S )z>
        Get ntacl for each file and dir via smb conn
        r   r   r   )r   r$   r   update
get_ntaclsr   rQ   rN   )r   r   ntaclsr   r   r   r   s          r   r   zSMBHelper.get_ntacls  s     IIh' 	BD<Dyy40H{{4>*dooxo@A<<1#+#3#3DLL#Ax 	B r   c                     | j                         D ]R  }|d   }| j                  |d         r| j                  j                  |       8| j                  j	                  |       T y )Nr   r   )r   r   r   deltreeunlink)r   r   r   s      r   delete_treezSMBHelper.delete_tree  sT    IIK 	+D<D{{4>*%%d+$$T*	+r   )FNNr   ) )r   r   r   r   r   r   r   r   r   r$   r   r   r   r   r   r   r   r   r   r   A  sN     ).(,G )-7N>40:@+r   r   c                        e Zd Zd ZddZd Zy)NtaclsHelperc                     || _         || _        t        j                         | _        | j                  j                  |       d| j                  j                  d      v | _        y )Nsmbzserver services)r<   rN   s3paramget_contextr%   loadr   r`   )r   r<   smb_conf_pathrN   s       r   r   zNtaclsHelper.__init__  sL     %%']#$''++.?"@@r   Nc                     || j                   }t        | j                  |||| j                        }|r|j	                  | j
                        S |S )N)rF   r<   )r`   rJ   r%   r<   rQ   rN   )r   r"   rE   rQ   rF   r   s         r   rJ   zNtaclsHelper.getntacl  sO    ##~~GGT<-LL"
 29x-FhFr   c                 `    t        | j                  ||| j                  || j                        S )N)r`   )rj   r%   rN   r`   )r   r"   r   rE   s       r   rj   zNtaclsHelper.setntacl  s(    x|"&..2 	2r   )FN)r   r   r   r   rJ   rj   r   r   r   r   r     s    A	G2r   r   c                 n    t        | dz   d      5 }|j                  |       d d d        y # 1 sw Y   y xY w)N.NTACLw)openwrite)dstntacl_sddl_strfs      r   _create_ntacl_filer     s3    	cHnc	"  a	     s   +4c                     | dz   }t         j                  j                  |      sy t        |d      5 }|j	                         cd d d        S # 1 sw Y   y xY w)Nr   r)r!   r"   existsr   read)src
ntacl_filer   s      r   _read_ntacl_filer     sH    xJ77>>*%	j#	 !vvx  s   AAc           	         t               }t        |t              rt        j                  |      }t        | |      }d}t        j                         }|g}|g}|r|j                         }	|j                         }
|j                  |	      D ]  }|j                  |	|d         }t        j                  j                  |
|d         }|j                  |d         r8|j                  |       |j                  |       t        j                  |       n7|j!                  |      }t#        |d      5 }|j%                  |       ddd       	 |j'                  |d      }t)        ||        |rt3        j"                  |d      5 }t        j4                  |      D ]5  }t        j                  j                  ||      }|j7                  ||       7 	 ddd       t9        j:                  |       y# 1 sw Y   xY w# t*        $ rF}|j-                  d	|d
|j.                  d          |j1                  d|z  dz          Y d}~d}~ww xY w# 1 sw Y   }xY w)aa  
    Backup all files and dirs with ntacl for the serive behind smb_conn.

    1. Create a temp dir as container dir
    2. Backup all files with dir structure into container dir
    3. Generate file.NTACL files for each file and dir in container dir
    4. Create a tar file from container dir(without top level folder)
    5. Delete container dir
    r   r   r   r   wbNTrQ   zFailed to get the ntacl for z: r7   z!The permissions for %s may not bez restored correctlyw:gzr   modearcname)r   rL   rM   r   rN   r   tempfilemkdtemppopr   r$   r!   r"   r   appendr   r   r   r   r   r   r   errorargswarningtarfilelistdiraddshutilrmtree)r   dest_tarfile_pathrN   logger
smb_helper	remotedirlocaldirr_dirsl_dirsr_dirl_direr_namel_namedatar   r   tarr   r"   s                       r   backup_onliner     s    F'3""7+8W-JI!H[FZF




%0 	6A__UAfI6FWW\\%63F  8-f%f% !**62&$' "1GGDM"6!+!3!3FD!3!I"6>:!	6	 6 
,6	: (cJJx( 	(D77<<$/DGGD$G'	((
 MM(%" " ! 6$affQi1 2BVK4 5 6 66( (s1   1G5HAI5G>		I
;IIIc           	      B   | j                  d      j                  dd      d   }t        j                         }t	               }t        |||      }t        j                  |       D ]  \  }}	}
t        j                  j                  ||       }t        j                  j                  ||      }|	D ]y  }t        j                  j                  ||      }t        j                  j                  ||      }t        j                  |||       |j                  ||d      }t        ||       { |
D ]  }t        j                  j                  ||      }t        j                  j                  ||      }t        j                  |||       |j                  ||d      }t        ||       t!        |d      5 }|j#                         }t!        |d      5 }|j%                  |       d	d	d	       d	d	d	         t'        j                   |d
      5 }t        j(                  |      D ]5  }t        j                  j                  ||      }|j+                  ||       7 	 d	d	d	       t-        j.                  |       y	# 1 sw Y   xY w# 1 sw Y   dxY w# 1 sw Y   8xY w)z<
    Backup files and ntacls to a tarfile for a service
    r   r7   startTr   rbr   Nr  r  r  )rstriprsplitr  r  r   r   r!   walkr"   relpathr$   r	   r   rJ   r   create_filer   r   r   r  r  r  r  r  )src_service_pathr  r   rN   r<   tempdirrE   ntacls_helperdirpathdirnames	filenamesrel_dirpathdst_dirpathdirnamer   r   r   filenamesrc_filer  dst_filer  r   r"   s                           r   backup_offliner7  *  s;    %%c*11#q9"=G G&(L -AM(*0@(A )$9ggoog5EoFggll7K8   	4G'',,w0C'',,{G4CJJsL'2*33Ct3TNsN3	4 " 	)H'',,w1C'',,{H5CS,8*33Ct3TNsN3 c4 )H}}#t_ )NN4()) )	))< 
,6	: (cJJw' 	(D77<<.DGGD$G'	((
 MM') )) )( (s1   4JI<	#JAJ<JJJJc           	         t               }|j                  d      j                  dd      d   }t        j                         }|j                         }t        j                  |      }t        |||      }	t               }
t        j                  |       5 }|j                  |       ddd       t        j                  |      D ]@  \  }}}t        j                  j!                  ||      }t        j                  j#                  t        j                  j%                  ||            }|D ]  }|j'                  d      rt        j                  j%                  ||      }t        j                  j%                  ||      }t        j                  j)                  |      st+        j,                  ||
|       t/        |      }|r|	j1                  |||
       |j3                  d|z  d	z           |D ]  }|j'                  d      rt        j                  j%                  ||      }t        j                  j%                  ||      }t        j                  j5                  |      st+        j6                  ||
|       t/        |      }|r|	j1                  |||
       n|j3                  d
|z  d	z          t        |d      5 }|j9                         }t        |d      5 }|j;                  |       ddd       ddd        C t=        j>                  |       y# 1 sw Y   yxY w# 1 sw Y   :xY w# 1 sw Y   NxY w)z>
    Restore files and ntacls from a tarfile to a service
    r   r7   r"  )r"   Nr#  r   z)Failed to restore ntacl for directory %s.z) Please check the permissions are correctz$Failed to restore ntacl for file %s.r%  r   ) r   r&  r'  r  r  get_domain_sidr   rN   r   r   r  r   
extractallr!   r(  r"   r)  normpathr$   endswithisdirr	   r   r   rj   r  isfiler*  r   r   r  r  )src_tarfile_pathdst_service_path
samdb_connr   r  r<   r,  dom_sid_strrN   r-  rE   r   r.  r/  r0  r1  r2  r3  r   r   r   r4  r5  r  r6  s                            r   backup_restorerC  Z  s    F%%c*11#q9"=G G++-K{+G -AM&(L	&	' #1	'"# )+(8 (-$9ggoogWo=gg&&GGLL);79   	GG##H-ggll7G4ggll;8ww}}S)JJsL':!1#!6!!**3MNNCcIEFG	G  " 	-H$$X.ggll7H5ggll;9ww~~c*$$S,@!1#!6!!**3MNN#IC#O#N$O P #t_ -#==?Dc4 -H t,-- -!	-+(-T MM']# #V- -- -s0   LL7 L+	2L7L(+L40L77M)NNTN)NNTFNN)T)5r   r!   r  r  samba.xattr_nativer   samba.xattr_tdbsamba.posix_eadbsamba.samba3r   r   samba.dcerpcr   r   r   	samba.ndrr   r   r	   r
   r   samba.loggerr   r   samba.auth_utilr   r   r  FILE_ATTRIBUTE_SYSTEMr   FILE_ATTRIBUTE_ARCHIVEFILE_ATTRIBUTE_HIDDENr   SECINFO_OWNERrZ   r[   r\   rD   r0   r   r*   r4   rJ   rj   r   r   r   r   r   r   r   r7  rC  r   r   r   <module>rP     s+  $  
      ) / / *  8 )  / ) "77!::;!889 "778  "//!//0!../ "../ 
)	 )M82 "#0N %)05"&d8N4n@~+ ~+B2 2: 
9x-`<r   