a
    Wa@                     @   s8  d dl mZ d dlmZ d dlmZmZ d dlm	Z	m
Z
mZ d dlmZ d dlmZmZ d dlmZ d dlmZmZmZ d d	lmZ d d
lmZ d dlZd dlmZ d dlmZm Z m!Z!m"Z" dd Z#G dd deZ$G dd deZ%G dd deZ&G dd deZ'G dd deZ(G dd deZ)G dd de!Z*dS )    )DONT_USE_KERBEROSN)securityidmap)setntaclgetntacl
getdosinfo)Ldb)
ndr_unpack	ndr_print)SamDB)parampassdbsmbd)	provision)system_session_unix)system_session)CommandCommandErrorSuperCommandOptionc              
   C   s   d}|   }|dkrd}t }|| j |rztt | d}W n. typ } ztd|W Y d }~n
d }~0 0 |	dd|j
  z|rt|j}nt }W n   tdY n0 |S )	NFZROLE_ACTIVE_DIRECTORY_DCTZsession_infolpUnable to open samdb:passdb backendsamba_dsdb:%sz2Unable to read domain SID from configuration files)server_roles3paramget_contextload
configfiler   r   	Exceptionr   seturlr   dom_sid
domain_sidr   Zget_domain_sid)r   Zis_ad_dcr   s3confsamdber$    r(   4/usr/lib/python3/dist-packages/samba/netcmd/ntacl.pyget_local_domain_sid(   s*    
 r*   c                
   @   s   e Zd ZdZdZejejejdZ	e
ddddde
d	d
dddgde
dddde
dddde
dddde
ddddgZddgZdddZdS ) cmd_ntacl_setzSet ACLs on a file.z%prog <acl> <file> [options]	sambaoptscredoptsversionoptsz-qz--quietzBe quiet
store_truehelpaction--xattr-backendchoice%xattr backend type (native fs or tdb)nativetdbtyper2   choices--eadb-file0Name of the tdb file where attributes are storedstringr2   r:   --use-ntvfsLSet the ACLs directly to the TDB or xattr for use with the ntvfs file server
--use-s3fsHSet the ACLs for use with the default s3fs file server via the VFS layer	--servicez:Name of the smb.conf service to use when applying the ACLsaclfileFNc                 C   sj   |   }|	 }t|}|s0|s0d|dv }n|r8d}t|||t|t ||||d	 |rf|d d S )Nsmbserver servicesF	use_ntvfsservicePPlease note that POSIX permissions have NOT been changed, only the stored NT ACL)
get_loggerget_loadparmr*   getr   strr   warning)selfrE   rF   rJ   use_s3fsquietxattr_backend	eadb_filer.   r-   r/   rK   loggerr   r$   r(   r(   r)   run]   s&    
zcmd_ntacl_set.run)	FFFNNNNNN__name__
__module____qualname____doc__synopsisoptionsSambaOptionsCredentialsOptionsVersionOptionstakes_optiongroupsr   takes_options
takes_argsrX   r(   r(   r(   r)   r+   F   s*   
    r+   c                   @   s6   e Zd ZdZdZejejejdZ	dgZ
dddZdS )	cmd_dosinfo_getz"Get DOS info of a file from xattr.%prog <file> [options]r,   rF   Nc                 C   s>   |  }t }||j t||}|r:| jt| d S )N)	rN   r   r   r   r   r   outfwriter
   )rR   rF   r.   r-   r/   r   r%   Zdosinfor(   r(   r)   rX      s    
zcmd_dosinfo_get.run)NNN)rZ   r[   r\   r]   r^   r_   r`   ra   rb   rc   re   rX   r(   r(   r(   r)   rf   x   s   rf   c                
   @   s   e Zd ZdZdZejejejdZ	e
dddde
dd	d
ddgde
dddde
dddde
dddde
ddddgZdgZdddZdS )cmd_ntacl_getzGet ACLs of a file.rg   r,   z	--as-sddlzOutput ACL in the SDDL formatr0   r1   r4   r5   r6   r7   r8   r9   r<   r=   r>   r?   r@   zKGet the ACLs directly from the TDB or xattr used with the ntvfs file serverrB   zKGet the ACLs for use via the VFS layer used by the default s3fs file serverrD   z9Name of the smb.conf service to use when getting the ACLsrF   FNc              	   C   sx   |  }t|}|s(|s(d|dv }n|r0d}t||t ||||
d}|rd| j||d  n| jt| d S )NrG   rH   FZdirect_db_accessrK   
)	rN   r*   rO   r   r   rh   ri   as_sddlr
   )rR   rF   rJ   rS   rm   rU   rV   r.   r-   r/   rK   r   r$   rE   r(   r(   r)   rX      s"    zcmd_ntacl_get.run)	FFFNNNNNNrY   r(   r(   r(   r)   rj      s*   
    rj   c                   @   s   e Zd ZdZdZdejiZeddddedd	d
deddd
deddddedddddgdedddd
deddd
dedddd
dgZ	g dZ
d#d!d"Zd S )$cmd_ntacl_changedomsidzChange the domain SID for ACLsz9%prog <Orig-Domain-SID> <New-Domain-SID> <file> [options]r-   rD   z#Name of the smb.conf service to user>   r?   r@   rA   r0   r1   rB   rC   r<   r=   r4   r5   r6   r7   r8   r9   z-rz--recursivez;Set the ACLs for directories and their contents recursivelyz--follow-symlinkszFollow symlinksz-vz	--verbosez
Be verbose)old_domain_sidnew_domain_sidrF   FNc              
      s4    }|	 t	s0|s0ddv 	n|r8d		sHsHtdzt|W n4 ty } ztd||f W Y d }~n
d }~0 0 zt|W n4 ty } ztd||f W Y d }~n
d }~0 0 	
f
dd  fdd	} | |
r tj	
|r || 	r0|d
 d S )NrG   rH   Fz0Must provide a share name with --service=<share>zCould not parse old sid %s: %sc                    s  rj d|   zt| t 	d}W n4 tyd } ztd| |f W Y d }~n
d }~0 0 | }rj d|  fdd}||j|_||j|_|j	r|j	j
D ]}||j|_q|jr|jj
D ]}||j|_q| }r
j d|  ||kr*r&j d d	S z t| |t 	d
	 W n6 ty } ztd| |f W Y d }~n
d }~0 0 d S )Nz	file: %s
rk   zCould not get acl for %s: %szbefore:
%s
c                    s*   |   \}}|kr&td |f S | S )Nz%s-%i)splitr   r#   )ZsidZdomZrid)rp   ro   r(   r)   replace_domain_sid(  s    zNcmd_ntacl_changedomsid.run.<locals>.changedom_sids.<locals>.replace_domain_sidz
after:
%s
znothing to do
TrI   zCould not set acl for %s: %s)rh   ri   r   r   r    r   rm   Z	owner_sidZ	group_sidZsaclZacesZtrusteeZdaclr   )rF   rE   r'   Z	orig_sddlrr   ZaceZnew_sddl)
r$   rV   r   rp   ro   rR   rK   rJ   verboserU   r(   r)   changedom_sids  sZ    
&



	z2cmd_ntacl_changedomsid.run.<locals>.changedom_sidsc                    sV   t j| dD ]B\}}}|D ]} t j|| q|D ]} t j|| q8qd S )N)followlinks)oswalkpathjoin)rF   rootdirsfilesfd)rt   follow_symlinksr(   r)   recursive_changedom_sidsN  s
    z<cmd_ntacl_changedomsid.run.<locals>.recursive_changedom_sidszQPlease note that POSIX permissions have NOT been changed, only the stored NT ACL.)rM   rN   r*   rO   r   r   r#   r    rv   rx   isdirrQ   )rR   Zold_domain_sid_strZnew_domain_sid_strrF   rJ   rS   rK   rU   rV   r-   	recursiver   rs   rW   r'   r   r(   )rt   r$   rV   r   r   rp   ro   rR   rK   rJ   rs   rU   r)   rX      s<    9zcmd_ntacl_changedomsid.run)	FFNNNNFFF)rZ   r[   r\   r]   r^   r_   r`   rc   r   rd   re   rX   r(   r(   r(   r)   rn      sv   (         rn   c                   @   sL   e Zd ZdZdZejejejdZ	e
dddde
dd	ddgZdddZdS )cmd_ntacl_sysvolresetz?Reset sysvol ACLs to defaults (including correct ACLs on GPOs).rg   r,   r@   z/Set the ACLs for use with the ntvfs file serverr0   r1   rB   z6Set the ACLs for use with the default s3fs file serverFNc                 C   s  |  }||}|t |  }|dd}	|dd}
ztt |d}W n. ty| } zt	d|W Y d }~n
d }~0 0 |s|sd|dv }n|rd}t
|j}t }||j |d	d
|j  t
t|d tt
j }t
t
j}t|d	}||\}}|tjkr:|tjkr:t	d| ||\}}|tjkrl|tjkrlt	d| |r||d tj||	|
||||d  |! ||d
 d S )Nrx   netlogonsysvolr   r   rG   rH   Fr   r   -zSID %s is not mapped to a UIDzSID %s is not mapped to a GIDrL   realm)rJ   )"rN   get_credentialsset_kerberos_stater   rM   rO   r   r   r    r   r   r#   r$   r   r   r   r   r!   r"   rP   ZDOMAIN_RID_ADMINISTRATORZSID_BUILTIN_ADMINISTRATORSr   ZPDBZ	sid_to_idr   ZID_TYPE_UIDZID_TYPE_BOTHZID_TYPE_GIDrQ   r   Zsetsysvolacllower	domain_dn)rR   rJ   rS   r.   r-   r/   r   credsrW   r   r   r&   r'   r$   r%   ZLA_sidZBA_sidZ	s4_passdbZLA_uidZLA_typeZBA_gidZBA_typer(   r(   r)   rX   n  sP    


 


zcmd_ntacl_sysvolreset.run)FFNNN)rZ   r[   r\   r]   r^   r_   r`   ra   rb   rc   r   rd   rX   r(   r(   r(   r)   r   _  s     r   c                   @   s0   e Zd ZdZdZejejejdZ	dddZ
dS )cmd_ntacl_sysvolcheckzBCheck sysvol ACLs match defaults (including correct ACLs on GPOs).rg   r,   Nc              
   C   s   |  }||}|t |  }|dd}|dd}ztt |d}	W n. ty| }
 zt	d|
W Y d }
~
n
d }
~
0 0 t
|	j}t|	||||d |	 | d S )Nrx   r   r   r   r   r   )rN   r   r   r   rM   rO   r   r   r    r   r   r#   r$   r   Zchecksysvolaclr   r   )rR   r.   r-   r/   r   r   rW   r   r   r&   r'   r$   r(   r(   r)   rX     s     

 
zcmd_ntacl_sysvolcheck.run)NNN)rZ   r[   r\   r]   r^   r_   r`   ra   rb   rc   rX   r(   r(   r(   r)   r     s   r   c                   @   sP   e Zd ZdZi Ze ed< e ed< e ed< e ed< e	 ed< e
 ed< dS )		cmd_ntaclzNT ACLs manipulation.r!   rO   ZchangedomsidZsysvolresetZsysvolcheckr   N)rZ   r[   r\   r]   Zsubcommandsr+   rj   rn   r   r   rf   r(   r(   r(   r)   r     s   




r   )+Zsamba.credentialsr   Zsamba.getoptZgetoptr_   Zsamba.dcerpcr   r   Zsamba.ntaclsr   r   r   Zsambar   Z	samba.ndrr	   r
   Zsamba.samdbr   Zsamba.samba3r   r   r   r   r   Zsamba.auth_utilr   rv   Z
samba.authr   Zsamba.netcmdr   r   r   r   r*   r+   rf   rj   rn   r   r   r   r(   r(   r(   r)   <module>   s*   2/ #C