
    g"                     t    S r SSKJrJrJrJrJr  SSKrSSKJ	r	  SSK
JrJrJr  SSKJr  S r " S S	\5      rg)
z5Utility methods for security descriptor manipulation.    )FLAG_MOD_REPLACE
SCOPE_BASEDnMessageMessageElementN)security)ndr_deepcopyndr_pack
ndr_unpack)NT_STATUS_OBJECT_NAME_NOT_FOUNDc                 >   ^ SmSR                  U4S jU  5       5      $ )a#  Encode claim attribute names according to [MS-DTYP] 2.5.1 ("attr-char2")

Some characters must be encoded as %hhhh, while others must not be.
Of the optional ones, we encode some control characters.

The   byte is also encoded, which is useful for tests, but it
is forbidden in either form.
z 	
 !"%&()<=>| c              3   R   >#    U  H  nUT;  a  UOS [        U5      S 3v   M     g7f)%04xN)ord).0cescapess     0/usr/lib/python3/dist-packages/samba/sd_utils.py	<genexpr>#escaped_claim_id.<locals>.<genexpr>'   s;      & %q w& CF3<() %s   $')join)claim_idr   s    @r   escaped_claim_idr      s*     .G77 & %& & &    c                   t    \ rS rSrSrS rSS jrSS jrS r  SS jr	SS	 jr
S
 rSS jrSS jrSS jrSrg)SDUtils-   zCSome utilities for manipulation of security descriptors on objects.c                 v    Xl         [        R                  " U R                   R                  5       5      U l        g N)ldbr   dom_sidget_domain_sid
domain_sid)selfsamdbs     r   __init__SDUtils.__init__0   s&    "**488+B+B+DEr   Nc                 "   [        5       n[        U[        5      (       a  Xl        O[        U R                  U5      Ul        [        U[
        5      (       d!  [        U[        R                  5      (       d   e[        U[
        5      (       a*  [        R                  R                  X R                  5      nO![        U[        R                  5      (       a  Un[        [        W5      [        S5      US'   U R                  R                  XC5        g)zRModify security descriptor using either SDDL string
or security.descriptor object
nTSecurityDescriptorN)r   
isinstancer   dnr"   strr   
descriptor	from_sddlr%   r   r
   r   modify)r&   	object_dnsdcontrolsmtmp_descs         r   modify_sd_on_dnSDUtils.modify_sd_on_dn4   s     Ii$$Ddhh	*AD2s##z"h6I6I'J'JKJb#**44RIHH//00H$28H3E3C3I%K
 ! 	$r   c                     U R                   R                  U[        S S/US9nUS   S   S   n[        [        R
                  U5      $ )Nr+   r4   r   )r"   searchr   r   r   r/   )r&   r2   r4   resdescs        r   read_sd_on_dnSDUtils.read_sd_on_dnI   sO    hhooiT56  K1v,-a0(--t44r   c                 ~    U R                   R                  U5      n[        [        R                  US   S   S   5      $ )Nr   	objectSid)r"   r;   r   r   r#   )r&   r2   r<   s      r   get_object_sidSDUtils.get_object_sidO   s5    hhooi((**CF;,?,BCCr   c                 (  ^  Uc  / nUc  / nU 4S jnUc  Uc  S[         R                  -  /nT R                  XS9nUR                  [         R                  -  (       d^  [        UR                  5      nUR                   H9  n	U	R                  [         R                  -  (       d  M'   UR                  U	5        M;     OeUc  / nT R                  R!                  U["        S U/US9n[%        US   U   S   5      n[         R&                  R)                  UT R*                  5      nSn/ n/ n/ nU H  n	[-        U	[$        5      (       a  U" U	5      n	[-        U	[         R.                  5      (       d   eU	R                  [         R                  -  (       a  UR1                  U	5        Mv  XR                  R                  ;  a  UR1                  U	5        M  UR                  U	5        US-  nM     U H  n	Sn[-        U	[2        5      (       a  SU	;   a  U	S   nU	S   n	[-        U	[$        5      (       a  U" U	5      n	[-        U	[         R.                  5      (       d   eU	R                  [         R                  -  (       a  UR1                  U	5        M  XR                  R                  ;   a  UR1                  U	5        M  UR5                  U	U5        US-  nM     US:X  a  XU4$ Uc  T R7                  XUS9  OiUR9                  T R*                  5      n[;        5       nUUl        [?        URA                  S	5      [B        U5      UU'   T R                  RE                  UUS9  XU4$ ! [        R                   a%  n
U
R                  S   [        :w  a  U
e S n
A
GM  S n
A
ff = f)
Nc                    > [         R                  R                  SU -   TR                  5      n[	        UR
                  R                  5      S:X  d   eUR
                  R                  S   $ )ND:   r   )r   r/   r0   r%   lendaclaces)ace_sddlace_sdr&   s     r   ace_from_sddl2SDUtils.update_aces_in_dacl.<locals>.ace_from_sddlZ   sU    ((224(?DOOTFv{{''(A---;;##A&&r   zsd_flags:1:%dr:   r   rG   idxaceascii)#r   SECINFO_DACLr>   typeSEC_DESC_DACL_PROTECTEDr	   rI   rJ   flagsSEC_ACE_FLAG_INHERITED_ACEdacl_del_acesambaNTSTATUSErrorargsr   r"   r;   r   r.   r/   r0   r%   r,   rQ   appenddictdacl_addr7   as_sddlr   r-   r   encoder   r1   )r&   r-   del_acesadd_aces	sddl_attrr4   rM   r3   	dacl_copyrQ   errr<   old_sddlnum_changesdel_ignoredadd_ignoredinherited_ignoredadd_idxnew_sddlr5   s   `                   r   update_aces_in_daclSDUtils.update_aces_in_daclS   s7   HH	'
 +h.C.CCD##B#:B77X=== )1	$>>Cyy8#F#FFF!OOC0 * ((//"j$#,+ " BC3q6),Q/0H$$..xIBC#s###C(c8<<0000yy8>>>!((-'',,&""3'OOC 1K   CG#t$$C<!%jG%j#s###C(c8<<0000yy8>>>!((-ggll"""3'KKW%1K' * !->>>  ( ;zz$//2H	AAD)(//'*B*:*35AiL HHOOAO1):::M  %22 !"xx{.MM&)	 !!s   &MN,NNc                     [         R                  R                  SU-   U R                  5      n/ nSnUR                  R
                   H  nUR                  XgS.5        US-  nM     U R                  XUS9u  pn
X4$ )zCPrepend an ACE (or more) to an objects security descriptor
        rF   r   )rP   rQ   rG   rb   r4   r   r/   r0   r%   rI   rJ   r\   rm   )r&   r2   rJ   r4   rL   rb   rk   rQ   _aiiis              r   dacl_prepend_acesSDUtils.dacl_prepend_aces   s     $$..td{DOOL;;##COOG89qLG $ ,,Y6> - @	rvr   c                 ,    U R                  XS/S9u    ng)z?Add an ACE (or more) to an objects security descriptor
        show_deleted:1r:   N)ru   )r&   r2   rQ   rr   s       r   dacl_add_aceSDUtils.dacl_add_ace   s&     %%i0@/A & C1r   c                     [         R                  R                  SU-   U R                  5      n/ nUR                  R
                   H  nUR                  U5        M     U R                  XUS9u  pxn	X4$ )zBAppend an ACE (or more) to an objects security descriptor
        rF   rp   rq   )
r&   r2   rJ   r4   rL   rb   rQ   rr   rs   rt   s
             r   dacl_append_acesSDUtils.dacl_append_aces   so     $$..td{DOOL;;##COOC  $,,Y6> - @	rvr   c                     [         R                  R                  SU-   U R                  5      n/ nUR                  R
                   H  nUR                  U5        M     U R                  XUS9u  pxn	Xy4$ )zBDelete an ACE (or more) to an objects security descriptor
        rF   )ra   r4   rq   )
r&   r2   rJ   r4   del_sdra   rQ   dirr   rt   s
             r   dacl_delete_acesSDUtils.dacl_delete_aces   so     $$..td{DOOL;;##COOC  $,,Y6> - @	rvr   c                 l    Uc  / nU R                  XS/-   5      nUR                  U R                  5      $ )z:Return object nTSecurityDescriptor in SDDL format
        rx   )r>   r_   r%   )r&   r2   r4   r=   s       r   get_sd_as_sddlSDUtils.get_sd_as_sddl   s;     H!!)9I8J-JK||DOO,,r   )r%   r"   r!   )NNNN)__name__
__module____qualname____firstlineno____doc__r(   r7   r>   rB   rm   ru   ry   r|   r   r   __static_attributes__ r   r   r   r   -   sE    MF%*5D ?C59a;FC		-r   r   )r   r"   r   r   r   r   r   rY   samba.dcerpcr   	samba.ndrr	   r
   r   samba.ntstatusr   r   objectr   r   r   r   <module>r      s2   & < I I  ! 8 8 :& x-f x-r   