3 # Utility methods for security descriptor manipulation
5 # Copyright Nadezhda Ivanova 2010 <nivanova@samba.org>
7 # This program is free software; you can redistribute it and/or modify
8 # it under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # This program is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with this program. If not, see <http://www.gnu.org/licenses/>.
21 """Utility methods for security descriptor manipulation."""
24 from ldb import Message, MessageElement, Dn
25 from ldb import FLAG_MOD_REPLACE, SCOPE_BASE
26 from samba.ndr import ndr_pack, ndr_unpack
27 from samba.dcerpc import security
29 class SDUtils(object):
30 """Some utilities for manipulation of security descriptors
33 def __init__(self, samdb):
35 self.domain_sid = security.dom_sid(self.ldb.get_domain_sid())
37 def modify_sd_on_dn(self, object_dn, sd, controls=None):
38 """ Modify security descriptor using either SDDL string
39 or security.descriptor object
42 m.dn = Dn(self.ldb, object_dn)
43 assert(isinstance(sd, str) or isinstance(sd, security.descriptor))
44 if isinstance(sd, str):
45 tmp_desc = security.descriptor.from_sddl(sd, self.domain_sid)
46 elif isinstance(sd, security.descriptor):
49 m["nTSecurityDescriptor"] = MessageElement(ndr_pack(tmp_desc),
51 "nTSecurityDescriptor")
52 self.ldb.modify(m, controls)
54 def read_sd_on_dn(self, object_dn, controls=None):
55 res = self.ldb.search(object_dn, SCOPE_BASE, None,
56 ["nTSecurityDescriptor"], controls=controls)
57 desc = res[0]["nTSecurityDescriptor"][0]
58 return ndr_unpack(security.descriptor, desc)
60 def get_object_sid(self, object_dn):
61 res = self.ldb.search(object_dn)
62 return ndr_unpack(security.dom_sid, res[0]["objectSid"][0])
64 def dacl_add_ace(self, object_dn, ace):
65 """ Adds an ACE to an objects security descriptor
67 desc = self.read_sd_on_dn(object_dn)
68 desc_sddl = desc.as_sddl(self.domain_sid)
71 if desc_sddl.find("(") >= 0:
72 desc_sddl = desc_sddl[:desc_sddl.index("(")] + ace + desc_sddl[desc_sddl.index("("):]
74 desc_sddl = desc_sddl + ace
75 self.modify_sd_on_dn(object_dn, desc_sddl)
77 def get_sd_as_sddl(self, object_dn, controls=None):
78 """ Return object nTSecutiryDescriptor in SDDL format
80 desc = self.read_sd_on_dn(object_dn, controls=controls)
81 return desc.as_sddl(self.domain_sid)