
    b@                        d dl mZ d dlmZ d dlmZmZ d dlm	Z	m
Z
mZ d dlmZ d dlmZmZ d dlmZ d dlmZmZ d d	lmZ d d
lmZ d dlZd dlmZ d dlmZmZm Z m!Z! d Z" G d de          Z# G d de          Z$ G d de          Z% G d de          Z& G d de          Z' G d de          Z( G d de           Z)dS )    )DONT_USE_KERBEROSN)securityidmap)setntaclgetntacl
getdosinfo)Ldb)
ndr_unpack	ndr_print)SamDB)parampassdb)	provision)system_session_unix)system_session)CommandCommandErrorSuperCommandOptionc                    d}|                                  }|dk    rd}t          j                    }|                    | j                   |r_	 t          t                      |           }n"# t          $ r}t          d|          d }~ww xY w|	                    dd|j
        z             	 |rt          j        |j                  }nt          j                    }n#  t          d          xY w|S )	NFROLE_ACTIVE_DIRECTORY_DCTsession_infolpUnable to open samdb:passdb backendsamba_dsdb:%sz2Unable to read domain SID from configuration files)server_roles3paramget_contextload
configfiler   r   	Exceptionr   seturlr   dom_sid
domain_sidr   get_domain_sid)r   is_ad_dcr   s3confsamdber'   s          4/usr/lib/python3/dist-packages/samba/netcmd/ntacl.pyget_local_domain_sidr.   (   s   H..""K000 ""F
KK B	;~'7'7! ! !EE 	; 	; 	;6:::	; 	

#_uy%@AAA$ 	1!)%*:;;JJ.00J$ # $ $ 	$s$   A- -
B7BB./C C/c            
           e Zd ZdZdZej        ej        ej        dZ	 e
dddd           e
d	d
dddg           e
ddd           e
ddd           e
ddd           e
ddd          gZddgZ	 	 	 	 ddZdS )cmd_ntacl_setzSet ACLs on a file.z%prog <acl> <file> [options]	sambaoptscredoptsversionoptsz-qz--quietzBe quiet
store_truehelpaction--xattr-backendchoice%xattr backend type (native fs or tdb)nativetdbtyper7   choices--eadb-file0Name of the tdb file where attributes are storedstringr7   r?   --use-ntvfsLSet the ACLs directly to the TDB or xattr for use with the ntvfs file server
--use-s3fsHSet the ACLs for use with the default s3fs file server via the VFS layer	--servicez:Name of the smb.conf service to use when applying the ACLsaclfileFNc                 H   |                                  }|	                                }t          |          }|s|sd|                    d          v }n|rd}t	          |||t          |          t                      ||||	  	         |r|                    d           d S d S )Nsmbserver servicesF	use_ntvfsservicePPlease note that POSIX permissions have NOT been changed, only the stored NT ACL)
get_loggerget_loadparmr.   getr   strr   warning)selfrJ   rK   rP   use_s3fsquietxattr_backend	eadb_filer3   r2   r4   rQ   loggerr   r'   s                  r-   runzcmd_ntacl_set.run]   s     ""##%%)"--
 	 	(9!:!::II 	IZ$&&$ 	" 	" 	" 	"  	oNNmnnnnn	o 	o    	FFFNNNNNN__name__
__module____qualname____doc__synopsisoptionsSambaOptionsCredentialsOptionsVersionOptionstakes_optiongroupsr   takes_options
takes_argsr^    r_   r-   r0   r0   F   s&       -H ).-  	tYZEEE x6] %(	* 	* 	*}#U\deee}#q  {G  	H  	H  	H|"l  vB  	C  	C  	C{!]dlmmmM J7<7;7;o o o o o or_   r0   c                   N    e Zd ZdZdZej        ej        ej        dZ	dgZ
ddZdS )cmd_dosinfo_getz"Get DOS info of a file from xattr.%prog <file> [options]r1   rK   Nc                     |                                 }t          j                    }|                    |j                   t          ||          }|r)| j                            t          |                     d S d S )N)	rT   r   r    r!   r"   r   outfwriter   )rX   rK   r3   r2   r4   r   r*   dosinfos           r-   r^   zcmd_dosinfo_get.run   sx    ##%%$&&BM"""R&& 	0IOOIg../////	0 	0r_   NNN)rb   rc   rd   re   rf   rg   rh   ri   rj   rk   rm   r^   rn   r_   r-   rp   rp   x   s]        ,,'H ).-  J0 0 0 0 0 0r_   rp   c            
           e Zd ZdZdZej        ej        ej        dZ	 e
ddd           e
dd	d
ddg           e
ddd           e
ddd           e
ddd           e
ddd          gZdgZ	 	 	 	 ddZdS )cmd_ntacl_getzGet ACLs of a file.rq   r1   z	--as-sddlzOutput ACL in the SDDL formatr5   r6   r9   r:   r;   r<   r=   r>   rA   rB   rC   rD   rE   zKGet the ACLs directly from the TDB or xattr used with the ntvfs file serverrG   zKGet the ACLs for use via the VFS layer used by the default s3fs file serverrI   z9Name of the smb.conf service to use when getting the ACLsrK   FNc           	         |                                 }t          |          }|s|sd|                    d          v }n|rd}t          ||t	                      ||||
          }|r2| j                            |                    |          dz              d S | j                            t          |                     d S )NrM   rN   Fdirect_db_accessrQ   
)	rT   r.   rU   r   r   rs   rt   as_sddlr   )rX   rK   rP   rY   r}   r[   r\   r3   r2   r4   rQ   r   r'   rJ   s                 r-   r^   zcmd_ntacl_get.run   s     ##%%)"--
 	 	(9!:!::II 	Ir*,,$ (1&( ( (  	,IOOCKK
33d:;;;;;IOOIcNN+++++r_   r`   ra   rn   r_   r-   rx   rx      s       'H ).-  	{!@VVV x6] %(	* 	* 	*}#U\deee}#p  zF  	G  	G  	G|"o  yE  	F  	F  	F{!\cklllM J279=7;, , , , , ,r_   rx   c                   (   e Zd ZdZdZdej        iZ eddd           edd	d
           eddd
           eddd           edddddg           edddd
           eddd
           edddd
          gZ	g dZ
	 	 	 	 	 	 	 	 	 d"d!Zd S )#cmd_ntacl_changedomsidzChange the domain SID for ACLsz9%prog <Orig-Domain-SID> <New-Domain-SID> <file> [options]r2   rI   z#Name of the smb.conf service to userC   rD   rE   rF   r5   r6   rG   rH   rA   rB   r9   r:   r;   r<   r=   r>   z-rz--recursivez;Set the ACLs for directories and their contents recursivelyz--follow-symlinkszFollow symlinksz-vz	--verbosez
Be verbose)old_domain_sidnew_domain_sidrK   FNc           
                                            }|	                                t                    s|sd                    d          v n|rdsst	          d          	 t          j        |          n'# t          $ r}t	          d|d|          d }~ww xY w	 t          j        |          n'# t          $ r}t	          d|d|          d }~ww xY w f
dfd} |           |
r*t          j	        
                    |          r ||           r|                    d	           d S d S )
NrM   rN   Fz0Must provide a share name with --service=<share>zCould not parse old sid : c                   
 rj                             d| z             	 t          	| t                                }n'# t          $ r}t          d| d|          d }~ww xY w|                              }rj                             d|z             
fd} ||j                  |_         ||j                  |_        |j	        r$|j	        j
        D ]} ||j                  |_        |j        r$|j        j
        D ]} ||j                  |_        |                              }rj                             d|z             ||k    rrj                             d           d	S 	 t          	| |
t                      
	  	         d S # t          $ r}t          d| d|          d }~ww xY w)Nz	file: %s
rz   zCould not get acl for r   zbefore:
%s
c                 t    |                                  \  }}|k    rt          j        d|fz            S | S )Nz%s-%i)splitr   r&   )siddomridr   r   s      r-   replace_domain_sidzNcmd_ntacl_changedomsid.run.<locals>.changedom_sids.<locals>.replace_domain_sid(  s?     YY[[
c.((#+G~s6K,KLLL
r_   z
after:
%s
znothing to do
TrO   zCould not set acl for )rs   rt   r   r   r#   r   r}   	owner_sid	group_sidsaclacestrusteedaclr   )rK   rJ   r,   	orig_sddlr   acenew_sddlr'   r\   r   r   r   rX   rQ   rP   verboser[   s          r-   changedom_sidsz2cmd_ntacl_changedomsid.run.<locals>.changedom_sids  sh    5	t 3444	Or#244,(09'.0 0 0  O O O"lTTT11#MNNNO J//I =	) ;<<<      /.s}==CM..s}==CMx B8= B BC"4"4S["A"ACKKx B8= B BC"4"4S["A"ACKK{{:..H ;	 9:::H$$ 7IOO$5666tO',..&"#,!(* * * * * *  O O O"lTTT11#MNNNOs/   "A 
A)A$$A)?$F% %
G	/GG	c                     t          j        |           D ]b\  }}}|D ]+} t           j                            ||                     ,|D ]+} t           j                            ||                     ,cd S )N)followlinks)oswalkpathjoin)rK   rootdirsfilesfdr   follow_symlinkss         r-   recursive_changedom_sidsz<cmd_ntacl_changedomsid.run.<locals>.recursive_changedom_sidsN  s    %'WT%O%O%O : :!dE : :A"N27<<a#8#89999 : :A"N27<<a#8#89999:	: :r_   zQPlease note that POSIX permissions have NOT been changed, only the stored NT ACL.)rS   rT   r.   rU   r   r   r&   r#   r   r   isdirrW   )rX   old_domain_sid_strnew_domain_sid_strrK   rP   rY   rQ   r[   r\   r2   	recursiver   r   r]   r,   r   r   r'   r   r   r   s   `   ` ```  ``   @@@@@r-   r^   zcmd_ntacl_changedomsid.run   s?    ""##%%)"--
 	 	(9!:!::II 	I 	D 	DBD D D	8%-.@AANN 	8 	8 	8, 2 2 2AA 7 8 8 8	8	8%-.@AANN 	8 	8 	8, 2 2 2AA 7 8 8 8	87	O 7	O 7	O 7	O 7	O 7	O 7	O 7	O 7	O 7	O 7	O 7	O 7	O 7	Or	: 	: 	: 	: 	: 	: 	t 	+t,, 	+$$T*** 	?NN > ? ? ? ? ?	? 	?s0   8B 
B1B,,B15C
 

C.C))C.)	FFNNNNFFF)rb   rc   rd   re   rf   rg   rh   rk   r   rl   rm   r^   rn   r_   r-   r   r      s       ((JH 	W)
 	6	 	 	 	&		! 	! 	!
 	"		! 	! 	!
 	C	 	 	 	8u%		' 	' 	'
 	N		! 	! 	!
 	"	! 	! 	! 			! 	! 	!C&MP >==J !m? m? m? m? m? m?r_   r   c                       e Zd ZdZdZej        ej        ej        dZ	 e
ddd           e
dd	d          gZ	 	 ddZdS )cmd_ntacl_sysvolresetz?Reset sysvol ACLs to defaults (including correct ACLs on GPOs).rq   r1   rE   z/Set the ACLs for use with the ntvfs file serverr5   r6   rG   z6Set the ACLs for use with the default s3fs file serverFNc                    |                                 }|                    |          }|                    t                     |                                 }|                    dd          }	|                    dd          }
	 t          t                      |          }n"# t          $ r}t          d|          d }~ww xY w|s|sd|                    d          v }n|rd}t          j        |j                  }t          j                    }|                    |j                   |                    d	d
|j        z             t          j        t'          |          dz   t'          t          j                  z             }t          j        t          j                  }t-          j        |                    d	                    }|                    |          \  }}|t2          j        k    r"|t2          j        k    rt          d|z            |                    |          \  }}|t2          j        k    r"|t2          j        k    rt          d|z            |r|                    d           t=          j        ||	|
||||                    d                                           |!                                ||
  
         d S )Nr   netlogonsysvolr   r   rM   rN   Fr   r   -zSID %s is not mapped to a UIDzSID %s is not mapped to a GIDrR   realm)rP   )"rT   get_credentialsset_kerberos_stater   rS   rU   r   r   r#   r   r   r&   r'   r   r    r!   r"   r$   r%   rV   DOMAIN_RID_ADMINISTRATORSID_BUILTIN_ADMINISTRATORSr   PDB	sid_to_idr   ID_TYPE_UIDID_TYPE_BOTHID_TYPE_GIDrW   r   setsysvolacllower	domain_dn)rX   rP   rY   r3   r2   r4   r   credsr]   r   r   r+   r,   r'   r*   LA_sidBA_sid	s4_passdbLA_uidLA_typeBA_gidBA_types                         r-   r^   zcmd_ntacl_sysvolreset.runn  s   ##%%((,,  !2333""66&*--))	;~'7'7! ! !EE 	; 	; 	;6:::	;  	 	(9!:!::II 	I%e&677
$&&BM"""

#_uy%@AAA!#j//$'#(*-h.O*P*P#Q R R!("EFFJvzz*:;;<<	
 &//77u(((W8J-J-J>GHHH%//77u(((W8J-J-J>GHHH 	oNNmnnnuh%vz!vvg44668I8I!Y	8 	8 	8 	8 	8 	8   B# #
C-B==C)FFNNN)rb   rc   rd   re   rf   rg   rh   ri   rj   rk   r   rl   r^   rn   r_   r-   r   r   _  s        II'H ).-  	}#T]ijjj|"ZcopppM
 -27;18 18 18 18 18 18r_   r   c                   H    e Zd ZdZdZej        ej        ej        dZ	ddZ
dS )cmd_ntacl_sysvolcheckzBCheck sysvol ACLs match defaults (including correct ACLs on GPOs).rq   r1   Nc           	      b   |                                 }|                    |          }|                    t                     |                                 }|                    dd          }|                    dd          }	 t          t                      |          }	n"# t          $ r}
t          d|
          d }
~
ww xY wt          j        |	j                  }t          j        |	||||                    d                                          |	                                |           d S )Nr   r   r   r   r   r   )rT   r   r   r   rS   rU   r   r   r#   r   r   r&   r'   r   checksysvolaclr   r   )rX   r3   r2   r4   r   r   r]   r   r   r+   r,   r'   s               r-   r^   zcmd_ntacl_sysvolcheck.run  s$   ##%%((,,  !2333""66&*--))	;~'7'7B???EE 	; 	; 	;6:::	; %e&677
 &!+!#!6!6!8!8%//:K:K!#	% 	% 	% 	% 	%r   rv   )rb   rc   rd   re   rf   rg   rh   ri   rj   rk   r^   rn   r_   r-   r   r     sT        LL'H ).- % % % % % %r_   r   c                       e Zd ZdZi Z e            ed<    e            ed<    e            ed<    e            ed<    e	            ed<    e
            ed<   dS )		cmd_ntaclzNT ACLs manipulation.r$   rU   changedomsidsysvolresetsysvolcheckr   N)rb   rc   rd   re   subcommandsr0   rx   r   r   r   rp   rn   r_   r-   r   r     s        K&K&K"8"8":":K!6!6!8!8K!6!6!8!8K / 1 1Kr_   r   )*samba.credentialsr   samba.getoptgetoptrg   samba.dcerpcr   r   samba.ntaclsr   r   r   sambar	   	samba.ndrr
   r   samba.samdbr   samba.samba3r   r   r   r   samba.auth_utilr   r   
samba.authr   samba.netcmdr   r   r   r   r.   r0   rp   rx   r   r   r   r   rn   r_   r-   <module>r      s  & 0 / / / / /       ( ( ( ( ( ( ( ( 7 7 7 7 7 7 7 7 7 7       + + + + + + + +       1 1 1 1 1 1 1 1       / / / / / / 				 % % % % % %             </o /o /o /o /oG /o /o /od0 0 0 0 0g 0 0 0,,, ,, ,, ,, ,,G ,, ,, ,,^_? _? _? _? _?W _? _? _?D@8 @8 @8 @8 @8G @8 @8 @8F% % % % %G % % %>	2 	2 	2 	2 	2 	2 	2 	2 	2 	2r_   