SuperCommand,
)
from samba.samdb import SamDB
-from samba import drs_utils, nttime2string, dsdb, dcerpc
-from samba.dcerpc import misc
+from samba import dsdb
+from samba.dcerpc import security
from samba.ndr import ndr_unpack
import samba.security
import samba.auth
from samba import policy
from samba import smb
import uuid
+from samba.ntacls import dsacl2fsacl
def samdb_connect(ctx):
try:
dc = netcmd_finddc(lp, creds)
except Exception, e:
- raise RunTimeError("Could not find a DC for domain", e)
+ raise RuntimeError("Could not find a DC for domain", e)
url = 'ldap://' + dc
return url
def parse_unc(unc):
'''Parse UNC string into a hostname, a service, and a filepath'''
if unc.startswith('\\\\') and unc.startswith('//'):
- return []
+ raise ValueError("UNC doesn't start with \\\\ or //")
tmp = unc[2:].split('/', 2)
if len(tmp) == 3:
return tmp
tmp = unc[2:].split('\\', 2)
if len(tmp) == 3:
- return tmp;
- return []
+ return tmp
+ raise ValueError("Invalid UNC string: %s" % unc)
def copy_directory_remote_to_local(conn, remotedir, localdir):
class cmd_listall(Command):
"""list all GPOs"""
- synopsis = "%prog gpo listall [options]"
+ synopsis = "%prog [options]"
takes_options = [
Option("-H", "--URL", help="LDB URL for database or target server", type=str,
msg = get_gpo_info(self.samdb, None)
for m in msg:
- print("GPO : %s" % m['name'][0])
- print("display name : %s" % m['displayName'][0])
- print("path : %s" % m['gPCFileSysPath'][0])
- print("dn : %s" % m.dn)
- print("version : %s" % attr_default(m, 'versionNumber', '0'))
- print("flags : %s" % gpo_flags_string(int(attr_default(m, 'flags', 0))))
- print("")
+ self.outf.write("GPO : %s\n" % m['name'][0])
+ self.outf.write("display name : %s\n" % m['displayName'][0])
+ self.outf.write("path : %s\n" % m['gPCFileSysPath'][0])
+ self.outf.write("dn : %s\n" % m.dn)
+ self.outf.write("version : %s\n" % attr_default(m, 'versionNumber', '0'))
+ self.outf.write("flags : %s\n" % gpo_flags_string(int(attr_default(m, 'flags', 0))))
+ self.outf.write("\n")
class cmd_list(Command):
"""list GPOs for an account"""
- synopsis = "%prog gpo list <username> [options]"
+ synopsis = "%prog <username> [options]"
- takes_args = [ 'username' ]
+ takes_args = ['username']
takes_options = [
- Option("-H", "--URL", help="LDB URL for database or target server", type=str,
- metavar="URL", dest="H")
+ Option("-H", "--URL", help="LDB URL for database or target server",
+ type=str, metavar="URL", dest="H")
]
def run(self, username, H=None, sambaopts=None, credopts=None, versionopts=None):
attrs=['name', 'displayName', 'flags',
'ntSecurityDescriptor'])
except Exception:
- print("Failed to fetch gpo object %s" % g['dn'])
+ self.outf.write("Failed to fetch gpo object %s\n" %
+ g['dn'])
continue
secdesc_ndr = gmsg[0]['ntSecurityDescriptor'][0]
- secdesc = ndr_unpack(dcerpc.security.descriptor, secdesc_ndr)
+ secdesc = ndr_unpack(security.descriptor, secdesc_ndr)
try:
samba.security.access_check(secdesc, token,
- dcerpc.security.SEC_STD_READ_CONTROL |
- dcerpc.security.SEC_ADS_LIST |
- dcerpc.security.SEC_ADS_READ_PROP)
+ security.SEC_STD_READ_CONTROL |
+ security.SEC_ADS_LIST |
+ security.SEC_ADS_READ_PROP)
except RuntimeError:
- print("Failed access check on %s" % msg.dn)
+ self.outf.write("Failed access check on %s\n" % msg.dn)
continue
# check the flags on the GPO
else:
msg_str = 'user'
- print("GPOs for %s %s" % (msg_str, username))
+ self.outf.write("GPOs for %s %s\n" % (msg_str, username))
for g in gpos:
- print(" %s %s" % (g[0], g[1]))
+ self.outf.write(" %s %s\n" % (g[0], g[1]))
class cmd_show(Command):
"""Show information for a GPO"""
- synopsis = "%prog gpo show <gpo> [options]"
+ synopsis = "%prog <gpo> [options]"
takes_optiongroups = {
"sambaopts": options.SambaOptions,
"credopts": options.CredentialsOptions,
}
- takes_args = [ 'gpo' ]
+ takes_args = ['gpo']
takes_options = [
Option("-H", help="LDB URL for database or target server", type=str)
raise CommandError("GPO %s does not exist" % gpo, e)
secdesc_ndr = msg['ntSecurityDescriptor'][0]
- secdesc = ndr_unpack(dcerpc.security.descriptor, secdesc_ndr)
+ secdesc = ndr_unpack(security.descriptor, secdesc_ndr)
- print("GPO : %s" % msg['name'][0])
- print("display name : %s" % msg['displayName'][0])
- print("path : %s" % msg['gPCFileSysPath'][0])
- print("dn : %s" % msg.dn)
- print("version : %s" % attr_default(msg, 'versionNumber', '0'))
- print("flags : %s" % gpo_flags_string(int(attr_default(msg, 'flags', 0))))
- print("ACL : %s" % secdesc.as_sddl())
- print("")
+ self.outf.write("GPO : %s\n" % msg['name'][0])
+ self.outf.write("display name : %s\n" % msg['displayName'][0])
+ self.outf.write("path : %s\n" % msg['gPCFileSysPath'][0])
+ self.outf.write("dn : %s\n" % msg.dn)
+ self.outf.write("version : %s\n" % attr_default(msg, 'versionNumber', '0'))
+ self.outf.write("flags : %s\n" % gpo_flags_string(int(attr_default(msg, 'flags', 0))))
+ self.outf.write("ACL : %s\n" % secdesc.as_sddl())
+ self.outf.write("\n")
class cmd_getlink(Command):
"""List GPO Links for a container"""
- synopsis = "%prog gpo getlink <container_dn> [options]"
+ synopsis = "%prog <container_dn> [options]"
takes_optiongroups = {
"sambaopts": options.SambaOptions,
"credopts": options.CredentialsOptions,
}
- takes_args = [ 'container_dn' ]
+ takes_args = ['container_dn']
takes_options = [
Option("-H", help="LDB URL for database or target server", type=str)
raise CommandError("Could not find Container DN %s (%s)" % container_dn, e)
if 'gPLink' in msg:
- print("GPO(s) linked to DN %s" % container_dn)
+ self.outf.write("GPO(s) linked to DN %s\n" % container_dn)
gplist = parse_gplink(msg['gPLink'][0])
for g in gplist:
msg = get_gpo_info(self.samdb, dn=g['dn'])
- print(" GPO : %s" % msg[0]['name'][0])
- print(" Name : %s" % msg[0]['displayName'][0])
- print(" Options : %s" % gplink_options_string(g['options']))
- print("")
+ self.outf.write(" GPO : %s\n" % msg[0]['name'][0])
+ self.outf.write(" Name : %s\n" % msg[0]['displayName'][0])
+ self.outf.write(" Options : %s\n" % gplink_options_string(g['options']))
+ self.outf.write("\n")
else:
- print("No GPO(s) linked to DN=%s" % container_dn)
+ self.outf.write("No GPO(s) linked to DN=%s\n" % container_dn)
class cmd_setlink(Command):
"""Add or Update a GPO link to a container"""
- synopsis = "%prog gpo setlink <container_dn> <gpo> [options]"
+ synopsis = "%prog <container_dn> <gpo> [options]"
takes_optiongroups = {
"sambaopts": options.SambaOptions,
"credopts": options.CredentialsOptions,
}
- takes_args = [ 'container_dn', 'gpo' ]
+ takes_args = ['container_dn', 'gpo']
takes_options = [
Option("-H", help="LDB URL for database or target server", type=str),
except Exception, e:
raise CommandError("Error adding GPO Link", e)
- print("Added/Updated GPO link")
+ self.outf.write("Added/Updated GPO link\n")
cmd_getlink().run(container_dn, H, sambaopts, credopts, versionopts)
class cmd_dellink(Command):
"""Delete GPO link from a container"""
- synopsis = "%prog gpo dellink <container_dn> <gpo> [options]"
+ synopsis = "%prog <container_dn> <gpo> [options]"
takes_optiongroups = {
"sambaopts": options.SambaOptions,
"credopts": options.CredentialsOptions,
}
- takes_args = [ 'container_dn', 'gpo' ]
+ takes_args = ['container_dn', 'gpo']
takes_options = [
Option("-H", help="LDB URL for database or target server", type=str),
gplist.remove(g)
break
else:
- raise CommandError("Specified GPO is not linked to this container");
+ raise CommandError("Specified GPO is not linked to this container")
m = ldb.Message()
m.dn = ldb.Dn(self.samdb, container_dn)
except Exception, e:
raise CommandError("Error Removing GPO Link (%s)" % e)
- print("Deleted GPO link.")
+ self.outf.write("Deleted GPO link.\n")
cmd_getlink().run(container_dn, H, sambaopts, credopts, versionopts)
class cmd_getinheritance(Command):
"""Get inheritance flag for a container"""
- synopsis = "%prog gpo getinheritance <container_dn> [options]"
+ synopsis = "%prog <container_dn> [options]"
takes_optiongroups = {
"sambaopts": options.SambaOptions,
"credopts": options.CredentialsOptions,
}
- takes_args = [ 'container_dn' ]
+ takes_args = ['container_dn']
takes_options = [
Option("-H", help="LDB URL for database or target server", type=str)
inheritance = 0
if 'gPOptions' in msg:
- inheritance = int(msg['gPOptions'][0]);
+ inheritance = int(msg['gPOptions'][0])
if inheritance == dsdb.GPO_BLOCK_INHERITANCE:
- print("Container has GPO_BLOCK_INHERITANCE")
+ self.outf.write("Container has GPO_BLOCK_INHERITANCE\n")
else:
- print("Container has GPO_INHERIT")
+ self.outf.write("Container has GPO_INHERIT\n")
class cmd_setinheritance(Command):
"""Set inheritance flag on a container"""
- synopsis = "%prog gpo setinheritance <container_dn> <block|inherit> [options]"
+ synopsis = "%prog <container_dn> <block|inherit> [options]"
takes_optiongroups = {
"sambaopts": options.SambaOptions,
if 'gPOptions' in msg:
m['new_value'] = ldb.MessageElement(str(inheritance), ldb.FLAG_MOD_REPLACE, 'gPOptions')
else:
- m['new_value'] = ldb.MessageElement(str(inheritance), ldb.FLAG_MOD_ADD, 'gPOptions');
+ m['new_value'] = ldb.MessageElement(str(inheritance), ldb.FLAG_MOD_ADD, 'gPOptions')
try:
self.samdb.modify(m)
class cmd_fetch(Command):
"""Download a GPO"""
- synopsis = "%prog gpo fetch <gpo> [options]"
+ synopsis = "%prog <gpo> [options]"
takes_optiongroups = {
"sambaopts": options.SambaOptions,
"credopts": options.CredentialsOptions,
}
- takes_args = [ 'gpo' ]
+ takes_args = ['gpo']
takes_options = [
Option("-H", help="LDB URL for database or target server", type=str),
unc = msg['gPCFileSysPath'][0]
try:
[dom_name, service, sharepath] = parse_unc(unc)
- except:
+ except ValueError:
raise CommandError("Invalid GPO path (%s)" % unc)
# SMB connect to DC
os.mkdir(gpodir)
copy_directory_remote_to_local(conn, sharepath, gpodir)
except Exception, e:
+ # FIXME: Catch more specific exception
raise CommandError("Error copying GPO from DC", e)
- print('GPO copied to %s' % gpodir)
+ self.outf.write('GPO copied to %s\n' % gpodir)
class cmd_create(Command):
"""Create an empty GPO"""
- synopsis = "%prog gpo create <displayname> [options]"
+ synopsis = "%prog <displayname> [options]"
takes_optiongroups = {
"sambaopts": options.SambaOptions,
"credopts": options.CredentialsOptions,
}
- takes_args = [ 'displayname' ]
+ takes_args = ['displayname']
takes_options = [
Option("-H", help="LDB URL for database or target server", type=str),
self.lp = sambaopts.get_loadparm()
self.creds = credopts.get_credentials(self.lp, fallback_machine=True)
- self.url = dc_url(self.lp, self.creds, H)
+ self.url = dc_url(self.lp, self.creds, url=H)
dc_hostname = netcmd_finddc(self.lp, self.creds)
samdb_connect(self)
except Exception, e:
raise CommandError("Error Creating GPO files", e)
- # Add cn=<guid>
- gpo_dn = self.samdb.get_default_basedn()
- gpo_dn.add_child(ldb.Dn(self.samdb, "CN=Policies,CN=System"))
- gpo_dn.add_child(ldb.Dn(self.samdb, "CN=%s" % gpo))
-
- m = ldb.Message()
- m.dn = ldb.Dn(self.samdb, gpo_dn.get_linearized())
- m['a01'] = ldb.MessageElement("groupPolicyContainer", ldb.FLAG_MOD_ADD, "objectClass")
- m['a02'] = ldb.MessageElement(displayname, ldb.FLAG_MOD_ADD, "displayName")
- m['a03'] = ldb.MessageElement(unc_path, ldb.FLAG_MOD_ADD, "gPCFileSysPath")
- m['a04'] = ldb.MessageElement("0", ldb.FLAG_MOD_ADD, "flags")
- m['a05'] = ldb.MessageElement("0", ldb.FLAG_MOD_ADD, "versionNumber")
- m['a06'] = ldb.MessageElement("TRUE", ldb.FLAG_MOD_ADD, "showInAdvancedViewOnly")
- m['a07'] = ldb.MessageElement("2", ldb.FLAG_MOD_ADD, "gpcFunctionalityVersion")
+ # Connect to DC over SMB
+ [dom_name, service, sharepath] = parse_unc(unc_path)
try:
- self.samdb.add(m)
+ conn = smb.SMB(dc_hostname, service, lp=self.lp, creds=self.creds)
except Exception, e:
- raise CommandError("Error adding GPO in AD", e)
-
- # Add cn=User,cn=<guid>
- child_dn = gpo_dn
- child_dn.add_child(ldb.Dn(self.samdb, "CN=User"))
+ raise CommandError("Error connecting to '%s' using SMB" % dc_hostname, e)
- m = ldb.Message()
- m.dn = ldb.Dn(self.samdb, child_dn.get_linearized())
- m['a01'] = ldb.MessageElement("container", ldb.FLAG_MOD_ADD, "objectClass")
- m['a02'] = ldb.MessageElement("TRUE", ldb.FLAG_MOD_ADD, "showInAdvancedViewOnly")
+ self.samdb.transaction_start()
try:
+ # Add cn=<guid>
+ gpo_dn = self.samdb.get_default_basedn()
+ gpo_dn.add_child(ldb.Dn(self.samdb, "CN=Policies,CN=System"))
+ gpo_dn.add_child(ldb.Dn(self.samdb, "CN=%s" % gpo))
+
+ m = ldb.Message()
+ m.dn = ldb.Dn(self.samdb, gpo_dn.get_linearized())
+ m['a01'] = ldb.MessageElement("groupPolicyContainer", ldb.FLAG_MOD_ADD, "objectClass")
+ m['a02'] = ldb.MessageElement(displayname, ldb.FLAG_MOD_ADD, "displayName")
+ m['a03'] = ldb.MessageElement(unc_path, ldb.FLAG_MOD_ADD, "gPCFileSysPath")
+ m['a04'] = ldb.MessageElement("0", ldb.FLAG_MOD_ADD, "flags")
+ m['a05'] = ldb.MessageElement("0", ldb.FLAG_MOD_ADD, "versionNumber")
+ m['a06'] = ldb.MessageElement("TRUE", ldb.FLAG_MOD_ADD, "showInAdvancedViewOnly")
+ m['a07'] = ldb.MessageElement("2", ldb.FLAG_MOD_ADD, "gpcFunctionalityVersion")
self.samdb.add(m)
- except Exception, e:
- raise CommandError("Error adding GPO in AD", e)
- # Add cn=User,cn=<guid>
- child_dn = gpo_dn
- child_dn.add_child(ldb.Dn(self.samdb, "CN=Machine"))
-
- m = ldb.Message()
- m.dn = ldb.Dn(self.samdb, child_dn.get_linearized())
- m['a01'] = ldb.MessageElement("container", ldb.FLAG_MOD_ADD, "objectClass")
- m['a02'] = ldb.MessageElement("TRUE", ldb.FLAG_MOD_ADD, "showInAdvancedViewOnly")
- try:
+ # Add cn=User,cn=<guid>
+ m = ldb.Message()
+ m.dn = ldb.Dn(self.samdb, "CN=User,%s" % str(gpo_dn))
+ m['a01'] = ldb.MessageElement("container", ldb.FLAG_MOD_ADD, "objectClass")
+ m['a02'] = ldb.MessageElement("TRUE", ldb.FLAG_MOD_ADD, "showInAdvancedViewOnly")
self.samdb.add(m)
- except Exception, e:
- raise CommandError("Error adding GPO in AD", e)
- # Copy GPO files over SMB
- [dom_name, service, sharepath] = parse_unc(unc_path)
- try:
- conn = smb.SMB(dc_hostname, service, lp=self.lp, creds=self.creds)
- except Exception, e:
- raise CommandError("Error connecting to '%s' using SMB" % dc_hostname, e)
+ # Add cn=Machine,cn=<guid>
+ m = ldb.Message()
+ m.dn = ldb.Dn(self.samdb, "CN=Machine,%s" % str(gpo_dn))
+ m['a01'] = ldb.MessageElement("container", ldb.FLAG_MOD_ADD, "objectClass")
+ m['a02'] = ldb.MessageElement("TRUE", ldb.FLAG_MOD_ADD, "showInAdvancedViewOnly")
+ self.samdb.add(m)
- try:
+ # Copy GPO files over SMB
create_directory_hier(conn, sharepath)
copy_directory_local_to_remote(conn, gpodir, sharepath)
- except Exception, e:
- raise CommandError("Error Copying GPO to DC", e)
-
- # Get new security descriptor
- msg = get_gpo_info(self.samdb, gpo=gpo)[0]
- ds_sd_ndr = msg['ntSecurityDescriptor'][0]
- ds_sd = ndr_unpack(dcerpc.security.descriptor, ds_sd_ndr)
-
- # Create a file system security descriptor
- fs_sd = dcerpc.security.descriptor()
- fs_sd.owner_sid = ds_sd.owner_sid
- fs_sd.group_sid = ds_sd.group_sid
- fs_sd.type = ds_sd.type
- fs_sd.revision = ds_sd.revision
-
- # Copy sacl
- fs_sd.sacl = ds_sd.sacl
-
- # Copy dacl
- dacl = ds_sd.dacl
- for ace in dacl.aces:
- # Don't add the allow for SID_BUILTIN_PREW2K
- if (not (ace.type & dcerpc.security.SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT) and
- ace.trustee == dcerpc.security.SID_BUILTIN_PREW2K):
- continue
-
- # Copy the ace from the directory server security descriptor
- new_ace = ace
-
- # Set specific inheritance flags for within the GPO
- new_ace.flags |= (dcerpc.security.SEC_ACE_FLAG_OBJECT_INHERIT |
- dcerpc.security.SEC_ACE_FLAG_CONTAINER_INHERIT)
- if ace.trustee == dcerpc.security.SID_CREATOR_OWNER:
- new_ace.flags |= dcerpc.security.SEC_ACE_FLAG_INHERIT_ONLY
-
- # Get a directory access mask from the assigned access mask on the ldap object
- new_ace.access_mask = policy.ads_to_dir_access_mask(ace.access_mask)
-
- # Add the ace to DACL
- fs_sd.dacl_add(new_ace)
-
- # Set ACL
- try:
- conn.set_acl(sharepath, fs_sd)
- except Exception, e:
- raise CommandError("Error setting ACL on GPT", e)
- print "GPO '%s' created as %s" % (displayname, gpo)
+ # Get new security descriptor
+ msg = get_gpo_info(self.samdb, gpo=gpo)[0]
+ ds_sd_ndr = msg['ntSecurityDescriptor'][0]
+ ds_sd = ndr_unpack(security.descriptor, ds_sd_ndr).as_sddl()
+
+ # Create a file system security descriptor
+ fs_sd = security.descriptor(dsacl2fsacl(ds_sd, self.samdb.get_domain_sid()))
+
+ # Set ACL
+ conn.set_acl(sharepath, fs_sd)
+ self.samdb.transaction_commit()
+ except Exception, e:
+ self.samdb.transaction_cancel()
+ raise RuntimeError("Error adding GPO to AD", e)
-class cmd_setacl(Command):
- """Set ACL on a GPO"""
+ self.outf.write("GPO '%s' created as %s\n" % (displayname, gpo))
class cmd_gpo(SuperCommand):
- """Group Policy Object (GPO) commands"""
+ """Group Policy Object (GPO) management"""
subcommands = {}
subcommands["listall"] = cmd_listall()
subcommands["setinheritance"] = cmd_setinheritance()
subcommands["fetch"] = cmd_fetch()
subcommands["create"] = cmd_create()
- subcommands["setacl"] = cmd_setacl()
git.samba.org / mat / samba.git / blobdiff