File: //lib/python3/dist-packages/samba/netcmd/__pycache__/ntacl.cpython-310.pyc
o
�/a@ � @ s4 d dl mZ d dlmZ d dlmZmZ d dlm Z m
Z
m Z d dl m
Z
d dlmZmZ d dlmZ d dlmZmZ d d l mZ d d
lmZ d dlZd d lm Z d d l m Z m Z m Z m!Z! d
d� Z"G dd� de �Z#G dd� de �Z$G dd� de �Z%G dd� de �Z&G dd� de �Z'G dd� de �Z(G dd � d e �Z)dS ) � )�DONT_USE_KERBEROSN)�security�idmap)�setntacl�getntacl�
getdosinfo)�Ldb)�
ndr_unpack� ndr_print)�SamDB)�param�passdb)� provision)�system_session_unix)�system_session)�Command� CommandError� SuperCommand�Optionc
C s� d}| � � }|dkr d}t�� }|�| j� |r<z tt� | d�}W n ty2 } ztd|��d }~ww |� dd|j
� z|rHt � |j
�}W |S t�� }W |S td��) NF�ROLE_ACTIVE_DIRECTORY_DCT�� session_info�lp�Unable to open samdb:�passdb backend�
samba_dsdb:%sz2Unable to read domain SID from configuration files)� server_role�s3param� get_context�load�
configfiler r � Exceptionr �set�urlr �dom_sid�
domain_sidr
�get_domain_sid)r �is_ad_dcr �s3conf�samdb�er% � r+ �4/usr/lib/python3/dist-packages/samba/netcmd/ntacl.py�get_local_domain_sid( s0
�
��
��r- c
@ s� e Zd ZdZdZejejejd�Z e
ddddd�e
d d
d d d
gd�e
dddd�e
dddd�e
dddd�e
dddd�gZ ddgZ d d d �Z
d S ) �
cmd_ntacl_setzSet ACLs on a file.z %prog <acl> <file> [options]�� sambaopts�credopts� versionoptsz-qz--quietzBe quiet�
store_true��help�action�--xattr-backend�choice�%xattr backend type (native fs or tdb)�native�tdb��typer5 �choices� --eadb-file�0Name of the tdb file where attributes are stored�string�r5 r= � --use-ntvfs�LSet the ACLs directly to the TDB or xattr for use with the ntvfs file server�
--use-s3fs�HSet the ACLs for use with the default s3fs file server via the VFS layer� --servicez:Name of the smb.conf service to use when applying the ACLs�acl�fileFNc C sn | � � } | �� }
t|
�}|s|sd|
�d�v }n|r d}t|
||t|�t� |||| d� |r5| �d� d S d S )N�smb�server servicesF�� use_ntvfs�service�PPlease note that POSIX permissions have NOT been changed, only the stored NT ACL)�
get_logger� get_loadparmr- �getr �strr �warning)�selfrH rI rM �use_s3fs�quiet�
xattr_backend� eadb_filer1 r0 r2 rN �loggerr r% r+ r+ r, �run] s( �
�zcmd_ntacl_set.run� FFFNNNNNN��__name__�
__module__� __qualname__�__doc__�synopsis�options� SambaOptions�CredentialsOptions�VersionOptions�takes_optiongroupsr �
takes_options�
takes_argsr[ r+ r+ r+ r, r. F s, �� �
�r. c @ s6 e Zd ZdZdZejejejd�Z dgZ
ddd�Z dS ) �cmd_dosinfo_getz"Get DOS info of a file from xattr.�%prog <file> [options]r/ rI Nc C sB |� � }t�� }|�|j� t||�}|r | j�t|�� d S d S )N) rQ r r r r r �outf�writer
)rU rI r1 r0 r2 r r( �dosinfor+ r+ r, r[ � s
�zcmd_dosinfo_get.run�NNN) r^ r_ r` ra rb rc rd re rf rg ri r[ r+ r+ r+ r, rj x s �rj c
@ s� e Zd ZdZdZejejejd�Z e
dddd�e
dd d
d d gd
�e
dddd�e
dddd�e
dddd�e
dddd�gZ dgZ d dd �Z
dS ) �
cmd_ntacl_getzGet ACLs of a file.rk r/ z --as-sddlz Output ACL in the SDDL formatr3 r4 r7 r8 r9 r: r; r< r? r@ rA rB rC zKGet the ACLs directly from the TDB or xattr used with the ntvfs file serverrE zKGet the ACLs for use via the VFS layer used by the default s3fs file serverrG z9Name of the smb.conf service to use when getting the ACLsrI FNc C sz |� � } t| �} |s|sd| �d�v }n|rd}t| |t� ||||
d�}
|r3| j�|
�| �d � d S | j�t|
�� d S )NrJ rK F��direct_db_accessrN �
) rQ r- rR r r rl rm �as_sddlr
)rU rI rM rV rt rX rY r1 r0 r2 rN r r% rH r+ r+ r, r[ � s" �zcmd_ntacl_get.runr\ r] r+ r+ r+ r, rp � s, � � �
�rp c
@ s� e Zd ZdZdZdejiZedddd�edd d
d �ed d
d
d �edddd�edddddgd�edddd
d �eddd
d �edd d d
d �gZ g d �Z
d#d!d"�Z d S )$�cmd_ntacl_changedomsidz Change the domain SID for ACLsz9%prog <Orig-Domain-SID> <New-Domain-SID> <file> [options]r0 rG z#Name of the smb.conf service to userA rB rC rD r3 r4 rE rF r? r@ r7 r8 r9 r: r; r< z-rz --recursivez;Set the ACLs for directories and their contents recursivelyz--follow-symlinkszFollow symlinksz-vz --verbosez
Be verbose)�old_domain_sid�new_domain_sidrI FNc
s �� � }
| �� �t���� s|sd��d�v � n|r d� � s$�s$td��zt�|��W n ty? } ztd||f ��d }~ww zt�|��W n ty[ } ztd||f ��d }~ww �������� �
� f
dd�� � �fdd �}� |� |
r�tj �
|�r�||� � r�|
� d
� d S d S ) NrJ rK Fz0Must provide a share name with --service=<share>z Could not parse old sid %s: %sc sd �r
�j �d| � zt�| t� � ���d�}W n ty, } ztd| |f ��d }~ww |�� �}�r<�j �d| � ��fdd�}||j�|_||j�|_|j r_|j j
D ]}||j �|_ qV|j ro|j j
D ]}||j �|_ qf|�� �}�r~�j �d| � ||kr��r��j �d� d S zt
�| |�t� � ���d
� W d S ty� } ztd | |f ��d }~ww ) Nz file: %s
rq z Could not get acl for %s: %sz before:
%s
c s* | � � \}}|�krt�d� |f �S | S )Nz%s-%i)�splitr r$ )�sid�dom�rid)rw rv r+ r, �replace_domain_sid( s zNcmd_ntacl_changedomsid.run.<locals>.changedom_sids.<locals>.replace_domain_sidz
after:
%s
znothing to do
TrL z Could not set acl for %s: %s)rl rm r r r! r rt � owner_sid� group_sid�sacl�aces�trustee�daclr )rI rH r* � orig_sddlr| �ace�new_sddl)
r% rY r rw rv rU rN rM �verboserX r+ r, �changedom_sids sb
���
� ��z2cmd_ntacl_changedomsid.run.<locals>.changedom_sidsc sV t j| �d�D ]!\}}}|D ] }� t j�||�� q|D ] }� t j�||�� q qd S )N)� followlinks)�os�walk�path�join)rI �root�dirs�files�f�d)r� �follow_symlinksr+ r, �recursive_changedom_sidsN s ��z<cmd_ntacl_changedomsid.run.<locals>.recursive_changedom_sidszQPlease note that POSIX permissions have NOT been changed, only the stored NT ACL.) rP rQ r- rR r r r$ r! r� r� �isdirrT )rU �old_domain_sid_str�new_domain_sid_strrI rM rV rN rX rY r0 � recursiver� r� rZ r* r� r+ ) r� r% rY r� r rw rv rU rN rM r� rX r, r[ � sF
������� 9�zcmd_ntacl_changedomsid.run) FFNNNNFFF) r^ r_ r` ra rb rc rd rg r rh ri r[ r+ r+ r+ r, ru � sx ����������(�ru c @ sP e Zd ZdZdZejejejd�Z e
dddd�e
dd dd�gZ
dd d
�Z d S )�cmd_ntacl_sysvolresetz?Reset sysvol ACLs to defaults (including correct ACLs on GPOs).rk r/ rC z/Set the ACLs for use with the ntvfs file serverr3 r4 rE z6Set the ACLs for use with the default s3fs file serverFNc C s� |� � }|�|�}|�t� | �� }|�dd�} |�dd�}
z tt� |d�} W n ty8 } zt d| ��d } ~ ww |sE|sEd|�d�v }n|rId}t
� | j �}
t
�� }|�|j� |�d d
| j � t
� t|
�d tt
j� �}t
� t
j�}t�|�d ��}|�|�\}}|tjkr�|tjkr�t d | ��|�|�\}}|tj kr�|tjkr�t d
| ��|r�|� d� t j | | |
|||
|�d�� � | �!� ||d�
d S )Nr� �netlogon�sysvolr r rJ rK Fr r �-z SID %s is not mapped to a UIDz SID %s is not mapped to a GIDrO �realm)rM )"rQ �get_credentials�set_kerberos_stater rP rR r r r! r r r$ r% r r r r r" r# rS �DOMAIN_RID_ADMINISTRATOR�SID_BUILTIN_ADMINISTRATORSr
�PDB� sid_to_idr � ID_TYPE_UID� ID_TYPE_BOTH� ID_TYPE_GIDrT r � setsysvolacl�lower� domain_dn)rU rM rV r1 r0 r2 r �credsrZ r� r� r) r* r% r( �LA_sid�BA_sid� s4_passdb�LA_uid�LA_type�BA_gid�BA_typer+ r+ r, r[ n sT
�
��
��
�zcmd_ntacl_sysvolreset.run)FFNNN)
r^ r_ r` ra rb rc rd re rf rg r rh r[ r+ r+ r+ r, r� _ s � ��r� c @ s0 e Zd ZdZdZejejejd�Z ddd�Z
dS )�cmd_ntacl_sysvolcheckzBCheck sysvol ACLs match defaults (including correct ACLs on GPOs).rk r/ Nc
C s� |� � }|�|�}|�t� | �� }|�dd�}|�dd�}z tt� |d�} W n ty8 }
zt d|
��d }
~
ww t
� | j �} t
�| ||| |�d��� | �� |� d S )Nr� r� r� r r r� )rQ r� r� r rP rR r r r! r r r$ r% r �checksysvolaclr� r� ) rU r1 r0 r2 r r� rZ r� r� r) r* r% r+ r+ r, r[ � s$
��
�zcmd_ntacl_sysvolcheck.runro ) r^ r_ r` ra rb rc rd re rf rg r[ r+ r+ r+ r, r� � s �r� c @ sP e Zd ZdZi Ze� ed< e� ed< e� ed< e� ed< e � ed< e
� ed< dS ) � cmd_ntaclzNT ACLs manipulation.r" rR � changedomsid� sysvolreset� sysvolcheckr N) r^ r_ r` ra � subcommandsr. rp ru r� r� rj r+ r+ r+ r, r� � s
r� )*�samba.credentialsr � samba.getopt�getoptrc � samba.dcerpcr r � samba.ntaclsr r r �sambar � samba.ndrr r
� samba.samdbr � samba.samba3r r r
r �samba.auth_utilr r� �
samba.authr � samba.netcmdr r r r r- r. rj rp ru r� r� r� r+ r+ r+ r, �<module> s, 2/ #C