X-Git-Url: http://git.samba.org/?a=blobdiff_plain;f=source4%2Fscripting%2Fpython%2Fsamba%2Fnetcmd%2Fgpo.py;h=07842c29e6ecc86058e41b557789fb28afaf1872;hb=a8e330a5cd16f5dd2263bbd34a7371ce4125448a;hp=f8067e316ecd7072d0666427a0ad7a88975a9450;hpb=1e3667934b777034d6460f938ba5093f3c913144;p=metze%2Fsamba%2Fwip.git diff --git a/source4/scripting/python/samba/netcmd/gpo.py b/source4/scripting/python/samba/netcmd/gpo.py index f8067e316ecd..07842c29e6ec 100644 --- a/source4/scripting/python/samba/netcmd/gpo.py +++ b/source4/scripting/python/samba/netcmd/gpo.py @@ -43,6 +43,7 @@ from samba.auth import AUTH_SESSION_INFO_DEFAULT_GROUPS, AUTH_SESSION_INFO_AUTHE from samba.netcmd.common import netcmd_finddc from samba import policy from samba import smb +import uuid def samdb_connect(ctx): @@ -179,7 +180,7 @@ def parse_unc(unc): return [] -def copy_directory_recurse(conn, remotedir, localdir): +def copy_directory_remote_to_local(conn, remotedir, localdir): if not os.path.isdir(localdir): os.mkdir(localdir) r_dirs = [ remotedir ] @@ -191,17 +192,49 @@ def copy_directory_recurse(conn, remotedir, localdir): dirlist = conn.list(r_dir) for e in dirlist: r_name = r_dir + '\\' + e['name'] - l_name = l_dir + os.path.sep + e['name'] + l_name = os.path.join(l_dir, e['name']) if e['attrib'] & smb.FILE_ATTRIBUTE_DIRECTORY: r_dirs.append(r_name) l_dirs.append(l_name) os.mkdir(l_name) - elif e['attrib'] & smb.FILE_ATTRIBUTE_ARCHIVE: + else: data = conn.loadfile(r_name) file(l_name, 'w').write(data) +def copy_directory_local_to_remote(conn, localdir, remotedir): + if not conn.chkpath(remotedir): + conn.mkdir(remotedir) + l_dirs = [ localdir ] + r_dirs = [ remotedir ] + while l_dirs: + l_dir = l_dirs.pop() + r_dir = r_dirs.pop() + + dirlist = os.listdir(l_dir) + for e in dirlist: + l_name = os.path.join(l_dir, e) + r_name = r_dir + '\\' + e + + if os.path.isdir(l_name): + l_dirs.append(l_name) + r_dirs.append(r_name) + conn.mkdir(r_name) + else: + data = file(l_name, 'r').read() + conn.savefile(r_name, data) + + +def create_directory_hier(conn, remotedir): + elems = remotedir.replace('/', '\\').split('\\') + path = "" + for e in elems: + path = path + '\\' + e + if not conn.chkpath(path): + conn.mkdir(path) + + class cmd_listall(Command): """list all GPOs""" @@ -720,35 +753,207 @@ class cmd_fetch(Command): except Exception, e: raise CommandError("GPO %s does not exist" % gpo) + # verify UNC path unc = msg['gPCFileSysPath'][0] try: [dom_name, service, sharepath] = parse_unc(unc) except: raise CommandError("Invalid GPO path (%s)" % unc) + # SMB connect to DC try: conn = smb.SMB(dc_hostname, service, lp=self.lp, creds=self.creds) except Exception, e: raise CommandError("Error connecting to '%s' using SMB" % dc_hostname, e) + # Copy GPT if tmpdir is None: tmpdir = "/tmp" + if not os.path.isdir(tmpdir): + raise CommandError("Temoprary directory '%s' does not exist" % tmpdir) + + localdir = os.path.join(tmpdir, "policy") + if not os.path.isdir(localdir): + os.mkdir(localdir) + + gpodir = os.path.join(localdir, gpo) + if os.path.isdir(gpodir): + raise CommandError("GPO directory '%s' already exists, refusing to overwrite" % gpodir) try: - localdir = tmpdir + os.path.sep + "policy" - if not os.path.isdir(localdir): - os.mkdir(localdir) - gpodir = localdir + os.path.sep + gpo - if not os.path.isdir(gpodir): - os.mkdir(gpodir) - copy_directory_recurse(conn, sharepath, gpodir) + os.mkdir(gpodir) + copy_directory_remote_to_local(conn, sharepath, gpodir) except Exception, e: - raise CommandError("Error copying GPO", e) + raise CommandError("Error copying GPO from DC", e) print('GPO copied to %s' % gpodir) class cmd_create(Command): - """Create a GPO""" + """Create an empty GPO""" + + synopsis = "%prog gpo create [options]" + + takes_optiongroups = { + "sambaopts": options.SambaOptions, + "versionopts": options.VersionOptions, + "credopts": options.CredentialsOptions, + } + + takes_args = [ 'displayname' ] + + takes_options = [ + Option("-H", help="LDB URL for database or target server", type=str), + Option("--tmpdir", help="Temporary directory for copying policy files", type=str) + ] + + def run(self, displayname, H=None, tmpdir=None, sambaopts=None, credopts=None, + versionopts=None): + + self.lp = sambaopts.get_loadparm() + self.creds = credopts.get_credentials(self.lp, fallback_machine=True) + + self.url = dc_url(self.lp, self.creds, H) + + dc_hostname = netcmd_finddc(self.lp, self.creds) + samdb_connect(self) + + msg = get_gpo_info(self.samdb, displayname=displayname) + if msg.count > 0: + raise CommandError("A GPO already existing with name '%s'" % displayname) + + # Create new GUID + guid = str(uuid.uuid4()) + gpo = "{%s}" % guid.upper() + realm = self.lp.get('realm') + unc_path = "\\\\%s\\sysvol\\%s\\Policies\\%s" % (realm, realm, gpo) + + # Create GPT + if tmpdir is None: + tmpdir = "/tmp" + if not os.path.isdir(tmpdir): + raise CommandError("Temporary directory '%s' does not exist" % tmpdir) + + localdir = os.path.join(tmpdir, "policy") + if not os.path.isdir(localdir): + os.mkdir(localdir) + + gpodir = os.path.join(localdir, gpo) + if os.path.isdir(gpodir): + raise CommandError("GPO directory '%s' already exists, refusing to overwrite" % gpodir) + + try: + os.mkdir(gpodir) + os.mkdir(os.path.join(gpodir, "Machine")) + os.mkdir(os.path.join(gpodir, "User")) + gpt_contents = "[General]\r\nVersion=0\r\n" + file(os.path.join(gpodir, "GPT.INI"), "w").write(gpt_contents) + except Exception, e: + raise CommandError("Error Creating GPO files", e) + + # Add cn= + gpo_dn = self.samdb.get_default_basedn() + gpo_dn.add_child(ldb.Dn(self.samdb, "CN=Policies,CN=System")) + gpo_dn.add_child(ldb.Dn(self.samdb, "CN=%s" % gpo)) + + m = ldb.Message() + m.dn = ldb.Dn(self.samdb, gpo_dn.get_linearized()) + m['a01'] = ldb.MessageElement("groupPolicyContainer", ldb.FLAG_MOD_ADD, "objectClass") + m['a02'] = ldb.MessageElement(displayname, ldb.FLAG_MOD_ADD, "displayName") + m['a03'] = ldb.MessageElement(unc_path, ldb.FLAG_MOD_ADD, "gPCFileSysPath") + m['a04'] = ldb.MessageElement("0", ldb.FLAG_MOD_ADD, "flags") + m['a05'] = ldb.MessageElement("0", ldb.FLAG_MOD_ADD, "versionNumber") + m['a06'] = ldb.MessageElement("TRUE", ldb.FLAG_MOD_ADD, "showInAdvancedViewOnly") + m['a07'] = ldb.MessageElement("2", ldb.FLAG_MOD_ADD, "gpcFunctionalityVersion") + try: + self.samdb.add(m) + except Exception, e: + raise CommandError("Error adding GPO in AD", e) + + # Add cn=User,cn= + child_dn = gpo_dn + child_dn.add_child(ldb.Dn(self.samdb, "CN=User")) + + m = ldb.Message() + m.dn = ldb.Dn(self.samdb, child_dn.get_linearized()) + m['a01'] = ldb.MessageElement("container", ldb.FLAG_MOD_ADD, "objectClass") + m['a02'] = ldb.MessageElement("TRUE", ldb.FLAG_MOD_ADD, "showInAdvancedViewOnly") + try: + self.samdb.add(m) + except Exception, e: + raise CommandError("Error adding GPO in AD", e) + + # Add cn=User,cn= + child_dn = gpo_dn + child_dn.add_child(ldb.Dn(self.samdb, "CN=Machine")) + + m = ldb.Message() + m.dn = ldb.Dn(self.samdb, child_dn.get_linearized()) + m['a01'] = ldb.MessageElement("container", ldb.FLAG_MOD_ADD, "objectClass") + m['a02'] = ldb.MessageElement("TRUE", ldb.FLAG_MOD_ADD, "showInAdvancedViewOnly") + try: + self.samdb.add(m) + except Exception, e: + raise CommandError("Error adding GPO in AD", e) + + # Copy GPO files over SMB + [dom_name, service, sharepath] = parse_unc(unc_path) + try: + conn = smb.SMB(dc_hostname, service, lp=self.lp, creds=self.creds) + except Exception, e: + raise CommandError("Error connecting to '%s' using SMB" % dc_hostname, e) + + try: + create_directory_hier(conn, sharepath) + copy_directory_local_to_remote(conn, gpodir, sharepath) + except Exception, e: + raise CommandError("Error Copying GPO to DC", e) + + # Get new security descriptor + msg = get_gpo_info(self.samdb, gpo=gpo)[0] + ds_sd_ndr = msg['ntSecurityDescriptor'][0] + ds_sd = ndr_unpack(dcerpc.security.descriptor, ds_sd_ndr) + + # Create a file system security descriptor + fs_sd = dcerpc.security.descriptor() + fs_sd.owner_sid = ds_sd.owner_sid + fs_sd.group_sid = ds_sd.group_sid + fs_sd.type = ds_sd.type + fs_sd.revision = ds_sd.revision + + # Copy sacl + fs_sd.sacl = ds_sd.sacl + + # Copy dacl + dacl = ds_sd.dacl + for ace in dacl.aces: + # Don't add the allow for SID_BUILTIN_PREW2K + if (not (ace.type & dcerpc.security.SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT) and + ace.trustee == dcerpc.security.SID_BUILTIN_PREW2K): + continue + + # Copy the ace from the directory server security descriptor + new_ace = ace + + # Set specific inheritance flags for within the GPO + new_ace.flags |= (dcerpc.security.SEC_ACE_FLAG_OBJECT_INHERIT | + dcerpc.security.SEC_ACE_FLAG_CONTAINER_INHERIT) + if ace.trustee == dcerpc.security.SID_CREATOR_OWNER: + new_ace.flags |= dcerpc.security.SEC_ACE_FLAG_INHERIT_ONLY + + # Get a directory access mask from the assigned access mask on the ldap object + new_ace.access_mask = policy.ads_to_dir_access_mask(ace.access_mask) + + # Add the ace to DACL + fs_sd.dacl_add(new_ace) + + # Set ACL + try: + conn.set_acl(sharepath, fs_sd) + except Exception, e: + raise CommandError("Error setting ACL on GPT", e) + + print "GPO '%s' created as %s" % (displayname, gpo) + class cmd_setacl(Command): """Set ACL on a GPO"""