
    IdI                     \   d dl mZ d dlmZ d dlmZmZ d dlm	Z	m
Z
mZ d dlmZ d dlmZmZ d dlmZ d dlmZmZ d d	lmZ d d
lmZ d dlZd dlmZ d dlmZmZm Z m!Z! d Z" G d de      Z# G d de      Z$ G d de      Z% G d de      Z& G d de      Z' G d de      Z( G d de       Z)y)    )DONT_USE_KERBEROSN)securityidmap)setntaclgetntacl
getdosinfo)Ldb)
ndr_unpack	ndr_print)SamDB)parampassdb)	provision)system_session_unix)system_session)CommandCommandErrorSuperCommandOptionc                    d}| j                         }|dk(  rd}t        j                         }|j                  | j                         |r5	 t        t               |       }|j                  dd|j                  z         	 |r!t        j                  j                        }|S t        j                         }	 |S # t        $ r}t        d|      d }~ww xY w#  t        d      xY w)	NFROLE_ACTIVE_DIRECTORY_DCTsession_infolpUnable to open samdb:passdb backendsamba_dsdb:%sz2Unable to read domain SID from configuration files)server_roles3paramget_contextload
configfiler   r   	Exceptionr   seturlr   dom_sid
domain_sidr   get_domain_sid)r   is_ad_dcr   s3confsamdber'   s          4/usr/lib/python3/dist-packages/samba/netcmd/ntacl.pyget_local_domain_sidr.   (   s    H.."K00  "F
KK	;~'7!E 	

#_uyy%@A$!))%*:*:;J 	  ..0J   	;6::	;$ # $ 	$s*   B; !C $C ;	CCCC%c                   J   e Zd ZdZdZej                  ej                  ej                  dZ	 e
dde
j                  d       e
dd	d
d       e
dddddg       e
ddd       e
ddd       e
ddd       e
ddd       e
ddd       e
ddd      g	Zdd gZ	 	 	 	 d#d"Zy!)$cmd_ntacl_setzSet ACLs on a file.z%prog <acl> <path> [options]	sambaoptscredoptsversionoptsz-qz--quiet
store_truehelpaction-v	--verbose
Be verbose--xattr-backendchoice%xattr backend type (native fs or tdb)nativetdbtyper7   choices--eadb-file0Name of the tdb file where attributes are storedstringr7   rB   --use-ntvfsLSet the ACLs directly to the TDB or xattr for use with the ntvfs file server
--use-s3fsHSet the ACLs for use with the default s3fs file server via the VFS layer--recursive;Set the ACLs for directories and their contents recursively--follow-symlinksFollow symlinks	--servicez:Name of the smb.conf service to use when applying the ACLsaclpathNc                 4     j                         }|
j                         t              s|sdj                  d      v n|rd fd} ||       rt        j
                  j                  |      rzt	        j                  |      D ]`  \  }}}|D ](  } |t        j
                  j                  ||             * |D ](  } |t        j
                  j                  ||             * b r|j                  d       y y )Nsmbserver servicesFc                 l   sNt         j                  j                  |       r/rj                  j	                  d| z         y t        d| z        rt         j                  j                  |       rj                  j	                  d| z         n\t         j                  j                  |       rj                  j	                  d| z         nj                  j	                  d| z         	 t        | t              t               
		      S # t        $ r}t        d| d|      d }~ww xY w)	Nignored symlink: %s
'symlink: %s: requires --follow-symlinkssymlink: %s
dir: %s
	file: %s
	use_ntvfsserviceCould not set acl for : )osrR   islinkoutfwriter   isdirr   strr   r#   )_pathr,   rQ   r'   	eadb_filefollow_symlinksr   	recursiveselfr^   r]   verbosexattr_backends     r-   _setntacl_pathz)cmd_ntacl_set.run.<locals>._setntacl_pathn   s    "rww~~e'<IIOO$;e$CD"#LPU#VWW77>>%(IIOOOe$;<WW]]5)IIOOK%$78IIOOL5$89P % # #J 3 5 - )*3(/1 1  P"UA#NOOPs   /$D 	D3D..D3followlinksPPlease note that POSIX permissions have NOT been changed, only the stored NT ACL)

get_loggerget_loadparmr.   getra   rR   re   walkjoinwarning)rk   rQ   rR   r]   use_s3fsquietrl   rm   rh   r3   r2   r4   rj   ri   r^   loggerrn   rootdirsfilesnamer'   r   s   `` `  ```   ```      @@r-   runzcmd_ntacl_set.runa   s     "##%)"-
(9!::II	P 	P6 	tt,%'WWT%O =!dE! =D"277<<d#;<=  =D"277<<d#;<== NNmn     )FFFFNNNNNFFN)__name__
__module____qualname____doc__synopsisoptionsSambaOptionsCredentialsOptionsVersionOptionstakes_optiongroupsr   SUPPRESS_HELPtakes_options
takes_argsr    r   r-   r0   r0   F   s    -H ))..-- 	tYV%9%9,Ot[|LI x6] %(	*}#U\de}#q  {G  	H|"l  vB  	C}#`iuv"):<P{!]dlmM J7<FJ7;<@2or   r0   c                   j    e Zd ZdZdZej                  ej                  ej                  dZ	dgZ
ddZy)cmd_dosinfo_getz"Get DOS info of a file from xattr.%prog <file> [options]r1   fileNc                     |j                         }t        j                         }|j                  |j                         t        ||      }|r%| j                  j                  t        |             y y )N)	rs   r   r    r!   r"   r   rc   rd   r   )rk   r   r3   r2   r4   r   r*   dosinfos           r-   r   zcmd_dosinfo_get.run   sW    ##%$$&BMM"R&IIOOIg./ r   NNN)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r-   r   r      s=    ,'H ))..-- J0r   r   c            
           e Zd ZdZdZej                  ej                  ej                  dZ	 e
ddd       e
dd	d
ddg       e
ddd       e
ddd       e
ddd       e
ddd      gZdgZ	 	 	 	 ddZy)cmd_ntacl_getzGet ACLs of a file.r   r1   z	--as-sddlzOutput ACL in the SDDL formatr5   r6   r<   r=   r>   r?   r@   rA   rD   rE   rF   rG   rH   zKGet the ACLs directly from the TDB or xattr used with the ntvfs file serverrJ   zKGet the ACLs for use via the VFS layer used by the default s3fs file serverrP   z9Name of the smb.conf service to use when getting the ACLsr   Nc           	      N   |j                         }t        |      }|s|sd|j                  d      v }n|rd}t        ||t	               ||||
      }|r.| j
                  j                  |j                  |      dz          y | j
                  j                  t        |             y )NrT   rU   Fdirect_db_accessr^   
)	rs   r.   rt   r   r   rc   rd   as_sddlr   )rk   r   r]   rx   r   rm   rh   r3   r2   r4   r^   r   r'   rQ   s                 r-   r   zcmd_ntacl_get.run   s     ##%)"-
(9!::IIr*,$ (1&( IIOOCKK
3d:;IIOOIcN+r   )	FFFNNNNNN)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r-   r   r      s    'H ))..-- 	{!@V x6] %(	*}#U\de}#p  zF  	G|"o  yE  	F{!\cklM J279=7;,r   r   c                       e Zd ZdZdZdej                  iZ eddd       edd	d
       eddd
       eddd       edddddg       edddd
       eddd
       edddd
      gZ	g dZ
	 	 	 	 	 	 	 	 	 d!d Zy)"cmd_ntacl_changedomsidzChange the domain SID for ACLsz9%prog <Orig-Domain-SID> <New-Domain-SID> <file> [options]r2   rP   z#Name of the smb.conf service to userF   rG   rH   rI   r5   r6   rJ   rK   rD   rE   r<   r=   r>   r?   r@   rA   z-rrL   rM   rN   rO   r9   r:   r;   )old_domain_sidnew_domain_sidrR   Nc                 `   
  j                         }|	j                         t              s|sdj                  d      v n|rdsst	        d      	 t        j                  |      	 t        j                  |      
 fdfd} |       
r't        j                  j                  |      r ||       r|j                  d	       y y # t        $ r}t	        d|d|      d }~ww xY w# t        $ r}t	        d|d|      d }~ww xY w)
NrT   rU   Fz0Must provide a share name with --service=<share>zCould not parse old sid r`   c                 @   	sNt         j                  j                  |       r/rj                  j	                  d| z         y t        d| z        rt         j                  j                  |       rj                  j	                  d| z         n\t         j                  j                  |       rj                  j	                  d| z         nj                  j	                  d| z         	 t        
| t                     }|j                        }rj                  j	                  d	|z         fd
} ||j                        |_         ||j                        |_        |j                  r2|j                  j                  D ]  } ||j                        |_         |j                   r2|j                   j                  D ]  } ||j                        |_         |j                        }rj                  j	                  d|z         ||k(  rrj                  j	                  d       y	 t#        
| |t               	       y # t        $ r}t        d| d|      d }~ww xY w# t        $ r}t        d| d|      d }~ww xY w)NrW   rX   rY   rZ   r[   r   zCould not get acl for r`   zbefore:
%s
c                 l    | j                         \  }}|k(  rt        j                  d|fz        S | S )Nz%s-%i)splitr   r&   )siddomridr   r   s      r-   replace_domain_sidzNcmd_ntacl_changedomsid.run.<locals>.changedom_sids.<locals>.replace_domain_sidQ  s:     YY[
c.(#++G~s6K,KLL
r   z
after:
%s
znothing to do
Tr\   r_   )ra   rR   rb   rc   rd   r   re   r   r   r#   r   	owner_sid	group_sidsaclacestrusteedaclr   )rg   rQ   r,   	orig_sddlr   acenew_sddlr'   rh   ri   r   r   r   rj   rk   r^   r]   rl   rm   s          r-   changedom_sidsz2cmd_ntacl_changedomsid.run.<locals>.changedom_sids3  s6   "rww~~e'<IIOO$;e$CD"#LPU#VWW77>>%(IIOOOe$;<WW]]5)IIOOK%$78IIOOL5$89	Pr$24,(09'.0 J/I		) ;< /s}}=CM.s}}=CMxx88== BC"4S[["ACKBxx88== BC"4S[["ACKB {{:.H		 9:H$IIOO$56P',.&"#,!(*C  P"UA#NOOPT  P"UA#NOOPs0   /I ?I> 	I;%I66I;>	JJJc                     t        j                  |       D ]`  \  }}}|D ](  } t         j                  j                  ||             * |D ](  } t         j                  j                  ||             * b y )Nro   )ra   ru   rR   rv   )rg   r{   r|   r}   fdr   ri   s         r-   recursive_changedom_sidsz<cmd_ntacl_changedomsid.run.<locals>.recursive_changedom_sidsw  sr    %'WWU%P :!dE :A"277<<a#89:  :A"277<<a#89:	:r   zQPlease note that POSIX permissions have NOT been changed, only the stored NT ACL.)rr   rs   r.   rt   r   r   r&   r#   ra   rR   re   rw   )rk   old_domain_sid_strnew_domain_sid_strrR   r]   rx   r^   rm   rh   r2   rj   ri   rl   rz   r,   r   r   r'   r   r   r   s   `   ` ``` ```   @@@@@r-   r   zcmd_ntacl_changedomsid.run  s1    "##%)"-
(9!::IIBD D	8%--.@AN
	8%--.@AN
B	P B	PH	: 	tt,$T*NN > ? u  	8 2A 7 8 8	8  	8 2A 7 8 8	8s0   %C, ;D ,	D5DD	D-D((D-)	FFNNNNFFF)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r-   r   r      s    (JH 	W))
 	6	 	&		!
 	"		!
 	C	 	8u%		'
 	N		!
 	"	! 			!C&MP >J !x?r   r   c                       e Zd ZdZdZej                  ej                  ej                  dZ	 e
ddd       e
dd	d      gZ	 	 ddZy
)cmd_ntacl_sysvolresetz?Reset sysvol ACLs to defaults (including correct ACLs on GPOs).r   r1   rH   z/Set the ACLs for use with the ntvfs file serverr5   r6   rJ   z6Set the ACLs for use with the default s3fs file serverNc                    |j                         }|j                  |      }|j                  t               | j	                         }|j                  dd      }	|j                  dd      }
	 t        t               |      }|s|sd|j                  d      v }n|rd}t        j                  |j                        }t        j                         }|j                  |j                          |j#                  d	d
|j$                  z         t        j                  t'        |      dz   t'        t        j(                        z         }t        j                  t        j*                        }t-        j.                  |j                  d	            }|j1                  |      \  }}|t2        j4                  k7  r!|t2        j6                  k7  rt        d|z        |j1                  |      \  }}|t2        j8                  k7  r!|t2        j6                  k7  rt        d|z        |r|j;                  d       	 t=        j>                  ||	|
||||j                  d      jA                         |jC                         ||
       y # t        $ r}t        d|      d }~ww xY w# tD        $ r8}|jF                  s t        d|jF                   d|jH                   |      d }~ww xY w)NrR   netlogonsysvolr   r   rT   rU   Fr   r   -zSID %s is not mapped to a UIDzSID %s is not mapped to a GIDrq   realm)r]   Could not access r`   )%rs   get_credentialsset_kerberos_stater   rr   rt   r   r   r#   r   r   r&   r'   r   r    r!   r"   r$   r%   rf   DOMAIN_RID_ADMINISTRATORSID_BUILTIN_ADMINISTRATORSr   PDB	sid_to_idr   ID_TYPE_UIDID_TYPE_BOTHID_TYPE_GIDrw   r   setsysvolacllower	domain_dnOSErrorfilenamestrerror)rk   r]   rx   r3   r2   r4   r   credsrz   r   r   r+   r,   r'   r*   LA_sidBA_sid	s4_passdbLA_uidLA_typeBA_gidBA_types                         r-   r   zcmd_ntacl_sysvolreset.run  s{   ##%((,  !23"66&*-)	;~'7!E
 (9!::II%%e&6&67
$$&BMM"

#_uyy%@A!!#j/$'#(*-h.O.O*P#Q R!!("E"EFJJvzz*:;<	
 &//7u(((W8J8J-J>GHH%//7u(((W8J8J-J>GHHNNmn	R""5(F#)6:#%66'?#8#8#:EOO<M#%<G  	;6::	;N  	R::!21::,bMqQQ	Rs1   ,I; 0A
J ;	JJJ	K!3KK)FFNNN)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r-   r   r     sb    I'H ))..-- 	}#T]ij|"ZcopM
 -27;6Rr   r   c                   d    e Zd ZdZdZej                  ej                  ej                  dZ	ddZ
y)cmd_ntacl_sysvolcheckzBCheck sysvol ACLs match defaults (including correct ACLs on GPOs).r   r1   Nc           	         |j                         }|j                  |      }|j                  t               | j	                         }|j                  dd      }|j                  dd      }	 t        t               |      }	t        j                  |	j                        }	 t        j                  |	||||j                  d      j                         |	j!                         |       y # t        $ r}
t        d|
      d }
~
ww xY w# t"        $ r8}
|
j$                  s t        d|
j$                   d|
j&                   |
      d }
~
ww xY w)	NrR   r   r   r   r   r   r   r`   )rs   r   r   r   rr   rt   r   r   r#   r   r   r&   r'   r   checksysvolaclr   r   r   r   r   )rk   r3   r2   r4   r   r   rz   r   r   r+   r,   r'   s               r-   r   zcmd_ntacl_sysvolcheck.run  s$   ##%((,  !23"66&*-)	;~'7B?E %%e&6&67
	R$$UHf%/%'VVG_%:%:%<eoo>O%')  	;6::	;  	R::!21::,bMqQQ	Rs1   ,C( !AD (	D1C==D	E3EEr   )r   r   r   r   r   r   r   r   r   r   r   r   r   r-   r   r     s5    L'H ))..--Rr   r   c                       e Zd ZdZi Z e       ed<    e       ed<    e       ed<    e       ed<    e	       ed<    e
       ed<   y)		cmd_ntaclzNT ACLs manipulation.r$   rt   changedomsidsysvolresetsysvolcheckr   N)r   r   r   r   subcommandsr0   r   r   r   r   r   r   r   r-   r   r     sV    K&K&K"8":K!6!8K!6!8K / 1Kr   r   )*samba.credentialsr   samba.getoptgetoptr   samba.dcerpcr   r   samba.ntaclsr   r   r   sambar	   	samba.ndrr
   r   samba.samdbr   samba.samba3r   r   r   r   samba.auth_utilr   ra   
samba.authr   samba.netcmdr   r   r   r   r.   r0   r   r   r   r   r   r   r   r   r-   <module>r      s   & 0  ( 7 7  +  1  / 	 % <MoG Mo`0g 0,,,G ,,^j?W j?ZERG ERP!RG !RH	2 	2r   