
    b]                        d Z ddlZddlZddlZddlZddlZddlZddlZddl	m
Z ddlmZmZmZ ddlmZmZ ddl	mZ ddl	mZ ddlmZ dd	lmZ dd
lmZ ej        ej        z  ej        z  ej        z  Zej         ej!        z  ej"        z  ej#        z  Z$ G d de%          Z&d Z'd Z(	 	 	 	 ddZ)	 	 	 ddZ*d Z+d dZ, G d d          Z- G d d          Z.d Z/d Z0d Z1d Z2d Z3dS )!zNT Acls.    N)param)securityxattridmap)ndr_pack
ndr_unpack)smbd)libsmb_samba_internal)get_samba_logger)NTSTATUSError)system_session_unixc                       e Zd ZdZdS )XattrBackendErrorzA generic xattr backend error.N)__name__
__module____qualname____doc__     ./usr/lib/python3/dist-packages/samba/ntacls.pyr   r   2   s        ((((r   r   c                    |r|                      d          }|!t          j        |                      d          fS |                      d          }|!t          j        |                      d          fS dS |dk    rdS |dk    rl|t          j        |fS t          j        t          j                            t          j                            |                      d          d                    fS |d	k    rp|t          j        |fS |                      d
          }t          j                            t          j                            |d                    }t          j        |fS t          d|z            )z$return the path to the eadb, or NoneNzxattr_tdb:filez
posix:eadbNNnativeeadbzprivate dirzeadb.tdbtdbzstate directoryz	xattr.tdbzInvalid xattr backend choice %s)	getsamba	xattr_tdb
posix_eadbospathabspathjoinr   )lpbackendeadbfiler   r   	state_dirdb_paths          r   checkset_backendr)   6   sK   FF+,,	 ORVV,<%=%=>>VVL))
!$bff\&:&:;;|	H		|	F		$h//$bgoobgll266-CXCXZd6e6e&f&fgg	E		OX..011Igoobgll9k&J&JKKGOW-- AG KLLLr   c                     	 t           j                            |t          j                  }n# t
          $ r Y d S w xY wt          t          j        |          S N)r   xattr_nativewrap_getxattrr   XATTR_DOSATTRIB_NAME_S3	Exceptionr   	DOSATTRIB)r$   file	attributes      r   
getdosinfor3   R   sa    &44T5:5RT T		    eoy111s   *- 
;;Tc                    |r"t          | ||          \  }}|o	 |                    ||t          j                  }	nv# t          $ r? t          d|z             t          j                            |t          j                  }	Y n.w xY wt          j                            |t          j                  }	t          t          j	        |	          }
|
j
        dk    r|
j        S |
j
        dk    r|
j        j        S |
j
        dk    r|
j        j        S |
j
        dk    r|
j        j        S d S t          j        |t          ||          S )NFail to open %s            service)r)   r-   r   XATTR_NTACL_NAMEr/   printr   r,   r   NTACLversioninfosdr	   
get_nt_aclSECURITY_SECINFO_FLAGS)r$   r1   session_infor%   r&   direct_db_accessr;   backend_objdbnamer2   ntacls              r   getntaclrI   \   si     0 0Wh G GfU'55fd6;6LN N		 U U U '&0111!.<<T=B=SU U				U *889>9OQ QI5;	22=A:]a:= ]a:= ]a:=    t5+'.0 0 0 	0s   != ABBFc                 :   t          |t                    st          |t          j                  sJ t          |t                    rt          j        |          }n+t          |t          j                  r|}t          |          }t          |t                    st          |t          j                  sJ t          |t                    r!t          j                            ||          }n1t          |t          j                  r|}|                    |          }|s[|rX|	                    |j                  \  }}|t          j
        k    r*|t          j        k    r|j        t          j        d|t          j        fz            k    rt          j        d|t          j        fz            }|	                    |          \  }}|t          j
        k    s|t          j        k    r*|}||_        t          j        |t           |||
           d}nht#          d|||fz            t%          j        |dd           t          j        |t          j        t          j        z  t          j        z  |||
           |rt/          | ||          \  }}t1          j                    }d|_        ||_        |	 |                    ||t0          j        t=          |                     dS # t>          $ rN tA          d|z             tB          j"                            |t0          j        t=          |                     Y dS w xY wtB          j"                            |t0          j        t=          |                     dS t          j        |t           ||
|	           dS )
a  
    A wrapper for smbd set_nt_acl api.

    Args:
        lp (LoadParam): load param from conf
        file (str): a path to file or dir
        sddl (str): ntacl sddl string
        service (str): name of share service, e.g.: sysvol
        session_info (auth_session_info): session info for authentication

    Note:
        Get `session_info` with `samba.auth.user_session`, do not use the
        `admin_session` api.

    Returns:
        None
    z%s-%dr:   TzDUnable to find UID for domain administrator %s, got id %d of type %dr   r6   Nr5   )r;   rD   )#
isinstancestrr   dom_sid
descriptor	from_sddlas_sddl	sid_to_id	owner_sidr   ID_TYPE_UIDID_TYPE_BOTHDOMAIN_RID_ADMINSDOMAIN_RID_ADMINISTRATORr	   
set_nt_aclrC   r   r    chownSECINFO_GROUPSECINFO_DACLSECINFO_SACLr)   r   r>   r?   r@   wrap_setxattrr<   r   r/   r=   r   r,   )r$   r1   sddldomsidrD   r%   r&   	use_ntvfsskip_invalid_chownpassdbr;   sidrA   owner_id
owner_typeadministratoradmin_id
admin_typesd2rF   rG   rH   s                         r   setntaclri      s   , fc""Kj9I&J&JKKK&# v&&	FH,	-	- SdC  JJtX5H$I$IJJJ$  **455	D(-	.	. zz# )%+ )%!'!1!1",!?!?:5,,,:AS3S3S |x/68C]:^0^____ ( 0FHDe;f1f g g)/)9)9-)H)H&:  5#444*HZ:Z:Z C$1CMO4c$ ') ) ) ) !%II+,r  wD  FN  PZ  v[  -[  \  \  \ q!$$$*)*)*  #% % % %  8 0Wh G Gf
B))&*.0FQVY Y Y Y Y B B B '&0111"00u7M19%B B B B B B	B ,,T53I-5e__> > > > > 	(",	8 	8 	8 	8 	8 	8s   7/K( (AM ?M c                 &   d}d}d}d}d}d}d}d}d	}	d}
d}d}d}d}d}d}d}d}d}d}d}d}d	}d
}d}d}d}d}d}| |z  }| |z  r| |z  r|||z  |z  |z  |
z  |z  z  }| |z  r|||z  |z  |z  |z  |z  |z  z  }| |z  r|||z  z  }| |z  r||z  }|S )zMTakes the access mask of a DS ACE and transform them in a File ACE mask.
    r6   r7   r9             @         i   i   i   i   i   i   r   )ldmRIGHT_DS_CREATE_CHILDRIGHT_DS_DELETE_CHILDRIGHT_DS_LIST_CONTENTSACTRL_DS_SELFRIGHT_DS_READ_PROPERTYRIGHT_DS_WRITE_PROPERTYRIGHT_DS_DELETE_TREERIGHT_DS_LIST_OBJECTRIGHT_DS_CONTROL_ACCESSFILE_READ_DATAFILE_LIST_DIRECTORYFILE_WRITE_DATAFILE_ADD_FILEFILE_APPEND_DATAFILE_ADD_SUBDIRECTORYFILE_CREATE_PIPE_INSTANCEFILE_READ_EAFILE_WRITE_EAFILE_EXECUTEFILE_TRAVERSEFILE_DELETE_CHILDFILE_READ_ATTRIBUTESFILE_WRITE_ATTRIBUTESDELETEREAD_CONTROL	WRITE_DACWRITE_OWNERSYNCHRONIZESTANDARD_RIGHTS_ALLfilemasks                                  r   ldapmask2filemaskr      s    !+ * * *M * * * * * &N & &O &M & & & &L &M &L &M & & & *F *L *I *K *K *((H$$ >31G+G >{-@@3 46B C- .0< = > $$ 6{_</ 02? @4 57D E  5 5 6
 "" F4}DE
"" 0//Or   c                    t           j                            | |          }t          j                    }|j        |_        |j        |_        |j        |_        |j        |_        |j        j        }t          dt          |                    D ]}||         }|j        t           j        t           j        fv rt          |j                  t           j        k    r|j        t           j        z  t           j        z  |_        t          |j                  t           j        k    r|j        t           j        z  |_        t+          |j                  |_        |                    |           |s|S |                    |          S )z

    This function takes an the SDDL representation of a DS
    ACL and return the SDDL representation of this ACL adapted
    for files. It's used for Policy object provision
    r   )r   rN   rO   rR   	group_sidtyperevisiondaclacesrangelen"SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECTSEC_ACE_TYPE_ACCESS_ALLOWEDrL   trusteeSID_BUILTIN_PREW2KflagsSEC_ACE_FLAG_OBJECT_INHERITSEC_ACE_FLAG_CONTAINER_INHERITSID_CREATOR_OWNERSEC_ACE_FLAG_INHERIT_ONLYr   access_maskdacl_addrP   )dssddlrb   rP   reffdescrr   iaces           r   dsacl2fsaclr      s>    

'
'
4
4C ""F}F}F(FKlFO8=D1c$ii   
! 
!1g8C <> > >BEckBRBRV^VqBqBq	H$HH8KrrCI3;8#===I(JJ	/@@COOOC    >>#r   c                   f    e Zd ZdZd Z	 	 ddZ	 ddZddZd	 Zd
 Z	d Z
ddZddZddZd ZdS )	SMBHelperzb
    A wrapper class for SMB connection

    smb_path: path with separator "\" other than "/"
    c                 "    || _         || _        d S r+   )smb_connrM   )selfr   rM   s      r   __init__zSMBHelper.__init__G  s     r   FNc                     d|vsJ | j                             |||          }|r|                    | j                  n|S N/)sinfor   )r   get_aclrP   rM   )r   smb_pathrP   r   r   ntacl_sds         r   r   zSMBHelper.get_aclK  s[    (""""=((/45@ ) B B 29Fx---hFr   c                 ^   d|vsJ t          |t                    st          |t          j                  sJ t          |t                    r&t          j                            || j                  }nt          |t          j                  r|}| j                            ||||           d S r   )rK   rL   r   rN   rO   
domain_sidr   set_acl)r   r   r   r   r   tmp_descs         r   r   zSMBHelper.set_aclU  s    (""""(C((VJxAT,U,UVVVh$$ 	 *44XtOOHH("566 	 Hh$)*5 	 	7 	7 	7 	7 	7r    c                 P    d|vsJ | j                             |t                    S )zM
        List file and dir base names in smb_path without recursive.
        r   )attribs)r   listSMB_FILE_ATTRIBUTE_FLAGSr   r   s     r   r   zSMBHelper.listc  s1     (""""}!!(4L!MMMr   c                 :    t          |t          j        z            S )ze
        Check whether the attrib value is a directory.

        attrib is from list method.
        )boollibsmbFILE_ATTRIBUTE_DIRECTORY)r   attribs     r   is_dirzSMBHelper.is_dirj  s     FV<<===r   c                     |r|dz   |z   n|S )z$
        Join path with '\'
        \r   )r   rootnames      r   r#   zSMBHelper.joinr  s     &*3td{T!!t3r   c                 B    d|vsJ | j                             |          S )Nr   )r   loadfiler   s     r   r   zSMBHelper.loadfilex  s)    (""""}%%h///r   c                 ^   |                                 D ]\  }}|                     ||          }t          |t                    rL| j                            |          s| j                            |           |                     ||           || j                            ||           dS )z1
        Create files as defined in tree
        r   N)	itemsr#   rK   dictr   chkpathmkdircreate_treesavefile)r   treer   r   contentfullnames         r   r   zSMBHelper.create_tree|  s     "ZZ\\ 	: 	:MD'yy400H'4(( :},,X66 2M''111  8 <<<<&&x9999	: 	:r   c                    i }|                      |          D ]m}|d         }|                     ||          }|                     |d                   r|                     |          ||<   U|                     |          ||<   n|S )a  
        Get the tree structure via smb conn

        self.smb_conn.list example:

        [
          {
            'attrib': 16,
            'mtime': 1528848309,
            'name': 'dir1',
            'short_name': 'dir1',
            'size': 0L
          }, {
            'attrib': 32,
            'mtime': 1528848309,
            'name': 'file0.txt',
            'short_name': 'file0.txt',
            'size': 10L
          }
        ]
        r   r   r   )r   r#   r   get_treer   )r   r   r   itemr   r   s         r   r   zSMBHelper.get_tree  s    , IIh'' 	5 	5D<Dyy400H{{4>** 5!]]H]==T

!]]844T

r   c                 d   i }|                      |          D ]}|d         }|                     ||          }|                     |d                   r*|                    |                     |                     e|                     |          }|                    | j                  ||<   |S )z>
        Get ntacl for each file and dir via smb conn
        r   r   r   )r   r#   r   update
get_ntaclsr   rP   rM   )r   r   ntaclsr   r   r   r   s          r   r   zSMBHelper.get_ntacls  s     IIh'' 	B 	BD<Dyy400H{{4>** Bdooxo@@AAAA<<11#+#3#3DL#A#Ax  r   c                     |                                  D ]Z}|d         }|                     |d                   r| j                            |           @| j                            |           [d S )Nr   r   )r   r   r   deltreeunlink)r   r   r   s      r   delete_treezSMBHelper.delete_tree  sv    IIKK 	+ 	+D<D{{4>** +%%d++++$$T****	+ 	+r   )FNNr   )r   )r   r   r   r   r   r   r   r   r   r#   r   r   r   r   r   r   r   r   r   r   @  s            ).(,G G G G )-7 7 7 7N N N N> > >4 4 40 0 0: : : :   @   + + + + +r   r   c                   "    e Zd Zd ZddZd ZdS )NtaclsHelperc                     || _         || _        t          j                    | _        | j                            |           d| j                            d          v | _        d S )Nsmbzserver services)r;   rM   s3paramget_contextr$   loadr   r_   )r   r;   smb_conf_pathrM   s       r   r   zNtaclsHelper.__init__  sU     %'']###$'++.?"@"@@r   FNc                     || j         }t          | j        |||| j                  }|r|                    | j                  n|S )N)rE   r;   )r_   rI   r$   r;   rP   rM   )r   r!   rD   rP   rE   r   s         r   rI   zNtaclsHelper.getntacl  sW    ##~GT<-L" " "
 29Fx---hFr   c                 J    t          | j        ||| j        || j                  S )N)r_   )ri   r$   rM   r_   )r   r!   r   rD   s       r   ri   zNtaclsHelper.setntacl  s,    x|"&.2 2 2 	2r   )FN)r   r   r   r   rI   ri   r   r   r   r   r     sM        A A A	G 	G 	G 	G2 2 2 2 2r   r   c                     t          | dz   d          5 }|                    |           d d d            d S # 1 swxY w Y   d S )N.NTACLw)openwrite)dstntacl_sddl_strfs      r   _create_ntacl_filer     s    	cHnc	"	"  a	                                   s   7;;c                     | dz   }t           j                            |          sd S t          |d          5 }|                                cd d d            S # 1 swxY w Y   d S )Nr   r)r    r!   existsr   read)src
ntacl_filer   s      r   _read_ntacl_filer     s    xJ7>>*%% t	j#		 !vvxx                 s   AAAc           	      \   t                      }t          |t                    rt          j        |          }t          | |          }d}t          j                    }|g}|g}|r|                                }	|                                }
|	                    |	          D ]r}|
                    |	|d                   }t          j        
                    |
|d                   }|                    |d                   r?|                    |           |                    |           t          j        |           nR|                    |          }t#          |d          5 }|                    |           ddd           n# 1 swxY w Y   	 |                    |d          }t)          ||           # t*          $ rL}|                    d	|d
|j        d                    |                    d|z  dz              Y d}~ld}~ww xY w|t3          j        |d          5 }t          j        |          D ]9}t          j        
                    ||          }|                    ||           :	 ddd           n# 1 swxY w Y   t9          j        |           dS )aa  
    Backup all files and dirs with ntacl for the serive behind smb_conn.

    1. Create a temp dir as container dir
    2. Backup all files with dir structure into container dir
    3. Generate file.NTACL files for each file and dir in contianer dir
    4. Create a tar file from container dir(without top level folder)
    5. Delete contianer dir
    r   r   r   r   wbNTrP   zFailed to get the ntacl for z: r6   z!The permissions for %s may not bez restored correctlyw:gzr   modearcname)r   rK   rL   r   rM   r   tempfilemkdtemppopr   r#   r    r!   r   appendr   r   r   r   r   r   r   errorargswarningtarfilelistdiraddshutilrmtree)r   dest_tarfile_pathrM   logger
smb_helper	remotedirlocaldirr_dirsl_dirsr_dirl_direr_namel_namedatar   r   tarr   r!   s                       r   backup_onliner    s9    F'3 ,"7++8W--JI!!H[FZF
 6



%00 	6 	6A__UAfI66FW\\%633F  8-- "f%%%f%%%    !**622&$'' "1GGDMMM" " " " " " " " " " " " " " "6!+!3!3FD!3!I!I"6>::::  6 6 6$ffafQii1 2 2 2BVK4 5 6 6 6 6 6 6 6 66+  66 
,6	:	:	: (cJx(( 	( 	(D7<<$//DGGD$G''''	(( ( ( ( ( ( ( ( ( ( ( ( ( ( (
 M(s>   (F

F	F	'F??
H	AHH1AJJJc           	         |                      d                              dd          d         }t          j                    }t	                      }t          |||          }t          j        |           D ]\  }}	}
t          j        	                    ||           }t          j        
                    ||          }|	D ]}t          j        
                    ||          }t          j        
                    ||          }t          j        |||           |                    ||d          }t          ||           |
D ]}t          j        
                    ||          }t          j        
                    ||          }t          j        |||           |                    ||d          }t          ||           t!          |d          5 }|                                }t!          |d          5 }|                    |           d	d	d	           n# 1 swxY w Y   d	d	d	           n# 1 swxY w Y   t'          j        |d
          5 }t          j        |          D ]9}t          j        
                    ||          }|                    ||           :	 d	d	d	           n# 1 swxY w Y   t-          j        |           d	S )z<
    Backup files and ntacls to a tarfile for a service
    r   r6   startTr   rbr   Nr   r  r  )rstriprsplitr  r  r   r   r    walkr!   relpathr#   r	   r   rI   r   create_filer   r   r   r  r  r  r  r  )src_service_pathr  r   rM   r;   tempdirrD   ntacls_helperdirpathdirnames	filenamesrel_dirpathdst_dirpathdirnamer   r   r   filenamesrc_filer  dst_filer  r   r!   s                           r   backup_offliner6  )  sO    %%c**11#q99"=G  G&((L -AAM(*0@(A(A ) )$9goog5EoFFgll7K88   	4 	4G',,w00C',,{G44CJsL'222*33Ct3TTNsN3333 " 	) 	)H',,w11C',,{H55CS,888*33Ct3TTNsN333 c4 )H}}#t__ )NN4((() ) ) ) ) ) ) ) ) ) ) ) ) ) )) ) ) ) ) ) ) ) ) ) ) ) ) ) )	) 
,6	:	:	: (cJw'' 	( 	(D7<<..DGGD$G''''	(( ( ( ( ( ( ( ( ( ( ( ( ( ( (
 M'sI   %H18H	H1HH1!H"H11H58H5AJ11J58J5c           	         t                      }|                    d                              dd          d         }t          j                    }|                                }t          j        |          }t          |||          }	t                      }
t          j        |           5 }|                    |           ddd           n# 1 swxY w Y   t          j        |          D ]\  }}}t          j                            ||          }t          j                            t          j                            ||                    }|D ]}|                    d          st          j                            ||          }t          j                            ||          }t          j                            |          st+          j        ||
|           t/          |          }|r|	                    |||
           |                    d|z  d	z              |D ]K}|                    d          s2t          j                            ||          }t          j                            ||          }t          j                            |          st+          j        ||
|           t/          |          }|r|	                    |||
           n|                    d
|z  d	z              t          |d          5 }|                                }t          |d          5 }|                    |           ddd           n# 1 swxY w Y   ddd           n# 1 swxY w Y   Mt=          j        |           dS )z>
    Restore files and ntacls from a tarfile to a service
    r   r6   r!  )r!   Nr"  r   z)Failed to restore ntacl for directory %s.z) Please check the permissions are correctz$Failed to restore ntacl for file %s.r$  r   ) r   r%  r&  r  r  get_domain_sidr   rM   r   r   r  r   
extractallr    r'  r!   r(  normpathr#   endswithisdirr	   r   r   ri   r  isfiler)  r   r   r  r  )src_tarfile_pathdst_service_path
samdb_connr   r  r;   r+  dom_sid_strrM   r,  rD   r   r-  r.  r/  r0  r1  r2  r   r   r   r3  r4  r  r5  s                            r   backup_restorerB  Y  s    F%%c**11#q99"=G  G++--K{++G -AAM&((L	&	'	' #1	'"""# # # # # # # # # # # # # # # )+(8(8 (- (-$9googWo==g&&GLL);779 9   	G 	GG##H-- Ggll7G44gll;88w}}S)) ;JsL':::!1#!6!6! G!**3MMMMNNCcIEFG G G " 	- 	-H$$X.. -gll7H55gll;99w~~c** A$S,@@@!1#!6!6! P!**3MMMMNN#IC#O#N$O P P P #t__ -#==??Dc4 -H t,,,- - - - - - - - - - - - - - -- - - - - - - - - - - - - - -!	-* M'sH   ,CCC
%M(/M	M(MM(MM((M,/M,)NNTN)NNTFNN)T)4r   r    r  r  r  samba.xattr_nativer   samba.xattr_tdbsamba.posix_eadbsamba.samba3r   r   samba.dcerpcr   r   r   	samba.ndrr   r   r	   r
   r   samba.loggerr   r   samba.auth_utilr   FILE_ATTRIBUTE_SYSTEMr   FILE_ATTRIBUTE_ARCHIVEFILE_ATTRIBUTE_HIDDENr   SECINFO_OWNERrY   rZ   r[   rC   r/   r   r)   r3   rI   ri   r   r   r   r   r   r   r  r6  rB  r   r   r   <module>rO     s  $  
			                ) ) ) ) ) ) / / / / / / / / / / * * * * * * * *       8 8 8 8 8 8 ) ) ) ) ) )       / / / / / / "7!:;!89 "78  "/!/0!./ "./ 
) ) ) ) )	 ) ) )M M M82 2 2 "#0 #0 #0 #0N %)05"&d8 d8 d8 d8N4 4 4n   @~+ ~+ ~+ ~+ ~+ ~+ ~+ ~+B2 2 2 2 2 2 2 2:     
  9 9 9x- - -`< < < < <r   