
    9h                        S SK r S SKrS SKrS SKrS SKrS SKr\ R                  R                  S S5        S SKJ	r	  S SK
Jr  S SKJr  S SKrS SKJr  S SKJrJr  S SKJs  Jr  S SKrS SKJr  S S	KJr  S S
KJr  S SKJ r   S SK!J"r"  S SK#J$r$  S SKJ%r%  S SK&J'r'  S SK(J)r)  S SK*J+r+  S SK,J-r-  S SK.r.S SKJ/r/  S SK0J1r1  S SK2J3r3  S SK4r4S SK5J6r6J7r7J8r8J9r9J:r:  S SK2J;r;J<r<J=r=  S SKJ>r>  S SK?rS S	KJr  S SK@J@r@   S SKAJBrB  \B" SS5      rC " S S5      rE " S S 5      rF " S! S"\G5      rH " S# S$\H5      rI " S% S&\H5      rJ " S' S(\H5      rK " S) S*\G5      rL " S+ S,\L5      rM " S- S.\L5      rN S/ rO S0 rP " S1 S25      rQS3 rRS4 rSS5 rTS6 rUS7 rVS8 rWS9 rXS: rYS; rZS< r[S= r\SKS> jr]S? r^SLS@ jr_SA r`SB raSC rbSD rc SMSE jrdSNSF jreSNSG jrfSH rgSI rhSNSJ jrig! \D a     " S S5      rC Nf = f)O    Nz
bin/python)WERRORError)ConfigParser)StringIO)	get_bytes)ABCMetaabstractmethod)Net)nbt)libsmb_samba_internal)UUID)NamedTemporaryFile)preg)
ndr_unpack)SMB_SIGNING_REQUIREDlog)blake2b)
get_string)SamDB)system_session)UF_WORKSTATION_TRUST_ACCOUNTUF_SERVER_TRUST_ACCOUNTGPLINK_OPT_ENFORCEGPLINK_OPT_DISABLEGPO_BLOCK_INHERITANCE) AUTH_SESSION_INFO_DEFAULT_GROUPSAUTH_SESSION_INFO_AUTHENTICATED#AUTH_SESSION_INFO_SIMPLE_PRIVILEGES)security)datetime)EnumGPOSTATEzAPPLY ENFORCE UNAPPLYc                        \ rS rSrSrSrSrSrg)r"   <             N)__name__
__module____qualname____firstlineno__APPLYENFORCEUNAPPLY__static_attributes__r(       2/usr/lib/python3/dist-packages/samba/gp/gpclass.pyr"   r"   <   s    r1   c                   ^    \ rS rSrSrSS jrS rS rS rS r	S	 r
S
 rS rS rS rS rSrg)gp_logB   aZ  Log settings overwritten by gpo apply
    The gp_log is an xml file that stores a history of gpo changes (and the
    original setting value).

    The log is organized like so:

<gp>
    <user name="KDC-1$">
        <applylog>
            <guid count="0" value="{31B2F340-016D-11D2-945F-00C04FB984F9}" />
        </applylog>
        <guid value="{31B2F340-016D-11D2-945F-00C04FB984F9}">
            <gp_ext name="System Access">
                <attribute name="minPwdAge">-864000000000</attribute>
                <attribute name="maxPwdAge">-36288000000000</attribute>
                <attribute name="minPwdLength">7</attribute>
                <attribute name="pwdProperties">1</attribute>
            </gp_ext>
            <gp_ext name="Kerberos Policy">
                <attribute name="ticket_lifetime">1d</attribute>
                <attribute name="renew_lifetime" />
                <attribute name="clockskew">300</attribute>
            </gp_ext>
        </guid>
    </user>
</gp>

    Each guid value contains a list of extensions, which contain a list of
    attributes. The guid value represents a GPO. The attributes are the values
    of those settings prior to the application of the GPO.
    The list of guids is enclosed within a user name, which represents the user
    the settings were applied to. This user may be the samaccountname of the
    local computer, which implies that these are machine policies.
    The applylog keeps track of the order in which the GPOs were applied, so
    that they can be rolled back in reverse, returning the machine to the state
    prior to policy application.
    Nc                 p   [         R                  U l        X l        Xl        U(       a  [
        R                  " U5      U l        O[
        R                  " S5      U l        Xl	        U R                  R                  SU-  5      nUc0  [
        R                  " U R                  S5      nXR                  S'   gg)a6  Initialize the gp_log
param user          - the username (or machine name) that policies are
                      being applied to
param gpostore      - the GPOStorage obj which references the tdb which
                      contains gp_logs
param db_log        - (optional) a string to initialize the gp_log
gpuser[@name="%s"]Nusername)r"   r-   _stategpostoreusernameetree
fromstringgpdbElementr9   find
SubElementattrib)selfr9   r<   db_loguser_objs        r2   __init__gp_log.__init__h   s     nn ((0DId+DI	99>>"4t";<''		6:H&*OOF# r1   c                    U[         R                  :X  ah  U R                  R                  SU R                  -  5      nUR                  S5      nUb  [        U5      S:X  a  [         R                  U l        gXl        gXl        g)a  Policy application state
param value         - APPLY, ENFORCE, or UNAPPLY

The behavior of the gp_log depends on whether we are applying policy,
enforcing policy, or unapplying policy. During an apply, old settings
are recorded in the log. During an enforce, settings are being applied
but the gp_log does not change. During an unapply, additions to the log
should be ignored (since function calls to apply settings are actually
reverting policy), but removals from the log are allowed.
r8   applylogNr   )r"   r.   r@   rB   r9   lenr-   r;   )rE   valuerG   	apply_logs       r2   stategp_log.state}   sb     H$$$yy~~&8499&DEH j1I C	Na$7&nn#Kr1   c                     U R                   $ )zCheck the GPOSTATE
        )r;   rE   s    r2   	get_stategp_log.get_state   s     {{r1   c                 "   Xl         U R                  R                  SU R                  -  5      nUR                  SU-  5      nUc%  [        R
                  " US5      nXR                  S'   U R                  [        R                  :X  a  UR                  S5      nUc  [        R
                  " US5      nUR                  SU-  5      nUcD  [        R
                  " US5      nS[        U5      S-
  -  UR                  S	'   XR                  S'   ggg)
zLog to a different GPO guid
param guid          - guid value of the GPO from which we're applying
                      policy
r8   guid[@value="%s"]NguidrM   rK   z%dr%   count)rW   r@   rB   r9   r>   rC   rD   r;   r"   r-   rL   )rE   rW   rG   objrN   previtems          r2   set_guidgp_log.set_guid   s    
 	99>>"4tyy"@Amm/$67;""8V4C"&JJw;;(..( j1I !,,XzB	>>"5"<=D|''	6:'+s9~/A'BG$'+G$  )r1   c                    U R                   [        R                  :X  d  U R                   [        R                  :X  a  gU R                  R                  SU R                  -  5      nUR                  SU R                  -  5      nUc   S5       eUR                  SU-  5      nUc%  [        R                  " US5      nXR                  S'   UR                  SU-  5      nUc,  [        R                  " US	5      nX'R                  S'   X7l        gg)
zStore an attribute in the gp_log
param gp_ext_name   - Name of the extension applying policy
param attribute     - The attribute being modified
param old_val       - The value of the attribute prior to policy
                      application
Nr8   rV   gpo guid was not setgp_ext[@name="%s"]gp_extr:   attribute[@name="%s"]	attribute)r;   r"   r/   r.   r@   rB   r9   rW   r>   rC   rD   text)rE   gp_ext_namerc   old_valrG   guid_objextattrs           r2   storegp_log.store   s     ;;(***dkkX=M=M.M99>>"4tyy"@A==!4tyy!@A#;%;;#mm0;>?;""8X6C!,JJvxx/);<<##C5D"+KKI r1   c                    U R                   R                  SU R                  -  5      nUR                  SU R                  -  5      nUc   S5       eUR                  SU-  5      nUb#  UR                  SU-  5      nUb  UR                  $ g)a  Retrieve a stored attribute from the gp_log
param gp_ext_name   - Name of the extension which applied policy
param attribute     - The attribute being retrieved
return              - The value of the attribute prior to policy
                      application
r8   rV   Nr_   r`   rb   )r@   rB   r9   rW   rd   rE   re   rc   rG   rg   rh   ri   s          r2   retrievegp_log.retrieve   s     99>>"4tyy"@A==!4tyy!@A#;%;;#mm0;>??883i?@Dyy r1   c                 T   U R                   R                  SU R                  -  5      nUR                  SU R                  -  5      nUc   S5       eUR                  SU-  5      nUb;  UR	                  S5      nU Vs0 s H  ofR
                  S   UR                  _M     sn$ 0 $ s  snf )zRetrieve all stored attributes for this user, GPO guid, and CSE
param gp_ext_name   - Name of the extension which applied policy
return              - The values of the attributes prior to policy
                      application
r8   rV   r_   r`   rc   r:   )r@   rB   r9   rW   findallrD   rd   )rE   re   rG   rg   rh   attrsri   s          r2   retrieve_allgp_log.retrieve_all   s     99>>"4tyy"@A==!4tyy!@A#;%;;#mm0;>??KK,E?DEutKK'2uEE	 Fs   =#B%c                 f   / nU R                   R                  SU R                  -  5      nUb~  UR                  S5      nUbj  UR                  S5      nU Vs/ s H%  nUR	                  S5      UR	                  S5      4PM'     nnUR                  SS9  UR                  S U 5       5        U$ s  snf )	zReturn a list of applied ext guids
return              - List of guids for gpos that have applied settings
                      to the system.
r8   rK   zguid[@count]rX   rM   T)reversec              3   *   #    U  H	  u  pUv   M     g 7fNr(   ).0rX   rW   s      r2   	<genexpr>+gp_log.get_applied_guids.<locals>.<genexpr>   s     D^keT^s   )r@   rB   r9   rq   getsortextend)rE   guidsrG   rN   	guid_objsgguids_by_counts          r2   get_applied_guidsgp_log.get_applied_guids   s    
 99>>"4tyy"@A j1I$%--n=	+4"6+4a $%55>155>"B+4  "6##D#1D^DD	"6s   ,B.c                    / nU R                   R                  SU R                  -  5      nU H  nUR                  SU-  5      nUR                  S5      n0 nU HK  n0 n	UR                  S5      n
U
 H  nUR                  XR
                  S   '   M      XUR
                  S   '   MM     UR                  XG45        M     U$ )a@  Return a list of applied ext guids
return              - List of tuples containing the guid of a gpo, then
                      a dictionary of policies and their values prior
                      policy application. These are sorted so that the
                      most recently applied settings are removed first.
r8   rV   ra   rc   r:   )r@   rB   r9   rq   rd   rD   append)rE   r   retrG   rW   guid_settingsextssettingsrh   	attr_dictrr   ri   s               r2   get_applied_settingsgp_log.get_applied_settings   s     99>>"4tyy"@AD$MM*=*DEM ((2DH	K0!D59YYIkk&12 "/8F+,  JJ'(  
r1   c                 h   U R                   R                  SU R                  -  5      nUR                  SU R                  -  5      nUc   S5       eUR                  SU-  5      nUbK  UR                  SU-  5      nUb3  UR	                  U5        [        U5      S:X  a  UR	                  U5        gggg)zRemove an attribute from the gp_log
param gp_ext_name   - name of extension from which to remove the
                      attribute
param attribute     - attribute to remove
r8   rV   Nr_   r`   rb   r   )r@   rB   r9   rW   removerL   rm   s          r2   deletegp_log.delete
  s     99>>"4tyy"@A==!4tyy!@A#;%;;#mm0;>??883i?@D

4 s8q=OOC( !   r1   c                     U R                   R                  U R                  [        R                  " U R
                  S5      5        g)zWrite gp_log changes to disk utf-8N)r<   rj   r=   r>   tostringr@   rR   s    r2   commitgp_log.commit  s)    DMM5>>$))W+MNr1   )r;   r@   r<   rW   r9   r=   rx   )r)   r*   r+   r,   __doc__rH   rO   rS   r\   rj   rn   rs   r   r   r   r   r0   r(   r1   r2   r4   r4   B   s@    $J+* ,
,* ,"",)"Or1   r4   c                   P    \ rS rSrS rS rS rS rS rS r	S r
S	 rS
 rS rSrg)
GPOStoragei   c                    [         R                  R                  U5      (       a  [        R                  " U5      U l        g [        R                  " US[        R                  [         R                  [         R                  -  5      U l        g )Nr   )
ospathisfiletdbopenr   TdbDEFAULTO_CREATO_RDWR)rE   log_files     r2   rH   GPOStorage.__init__!  sL    77>>(##xx)DHwwxCKKbii9OPDHr1   c                 8    U R                   R                  5         g rx   )r   transaction_startrR   s    r2   startGPOStorage.start'  s    ""$r1   c                 ~     [        U R                  R                  [        U5      5      5      $ ! [         a     g f = frx   )intr   r|   r   	TypeErrorrE   keys     r2   get_intGPOStorage.get_int*  s5    	txx||IcN344 		s   ,/ 
<<c                 J    U R                   R                  [        U5      5      $ rx   )r   r|   r   r   s     r2   r|   GPOStorage.get0  s    xx||IcN++r1   c           	      ^    [        XU R                  R                  [        U5      5      5      $ rx   )r4   r   r|   r   )rE   r9   s     r2   	get_gplogGPOStorage.get_gplog3  s     d$((,,y"?@@r1   c                 `    U R                   R                  [        U5      [        U5      5        g rx   )r   rj   r   )rE   r   vals      r2   rj   GPOStorage.store6  s    y~y~6r1   c                 8    U R                   R                  5         g rx   )r   transaction_cancelrR   s    r2   cancelGPOStorage.cancel9      ##%r1   c                 L    U R                   R                  [        U5      5        g rx   )r   r   r   r   s     r2   r   GPOStorage.delete<  s    	#'r1   c                 8    U R                   R                  5         g rx   )r   transaction_commitrR   s    r2   r   GPOStorage.commit?  r   r1   c                 8    U R                   R                  5         g rx   )r   closerR   s    r2   __del__GPOStorage.__del__B  s    r1   r   N)r)   r*   r+   r,   rH   r   r   r|   r   rj   r   r   r   r   r0   r(   r1   r2   r   r      s6    Q%,A7&(&r1   r   c                   d    \ rS rSr\rS r\S 5       r\S 5       r	S r
\S 5       r\S 5       rSrg	)
ra   iF  c                 T    Xl         X l        X0l        UR                  U5      U l        g rx   )lpcredsr=   r   gp_db)rE   r   r   r=   rj   s        r2   rH   gp_ext.__init__I  s!    
 __X.
r1   c                     g rx   r(   )rE   deleted_gpo_listchanged_gpo_lists      r2   process_group_policygp_ext.process_group_policyO      r1   c                     g rx   r(   )rE   policys     r2   readgp_ext.readS  r   r1   c                    U R                   R                  S5      n[        R                  R	                  U[        U5      R                  5       5      n[        R                  R                  U5      (       a  U R                  U5      $ g )N	gpo_cache)	r   
cache_pathr   r   joincheck_safe_pathupperexistsr   )rE   afile
local_path	data_files       r2   parsegp_ext.parseW  s]    WW''4
GGLL_U-C-I-I-KL	77>>)$$99Y''r1   c                     g rx   r(   rR   s    r2   __str__gp_ext.__str__^  r   r1   c                     0 $ rx   r(   )rE   gpos     r2   rsopgp_ext.rsopb  s    	r1   )r   r   r   r=   N)r)   r*   r+   r,   r   __metaclass__rH   r   r   r   r   r   r   r0   r(   r1   r2   ra   ra   F  sa    M/        r1   ra   c                       \ rS rSrS rSrg)
gp_inf_extig  c                 `   [        US5       nUR                  5       nS S S 5        [        S S9n[        Ul         UR                  [        WR                  5       5      5        U$ ! , (       d  f       NM= f! [         a-    UR                  [        WR                  S5      5      5         U$ f = f)Nrbinterpolationutf-16)	r   r   r   stroptionxform	read_filer   decodeUnicodeDecodeError)rE   r   fr   inf_confs        r2   r   gp_inf_ext.readh  s    )T"aVVXF #d3"	Bx89  #" " 	Bxh(?@A	Bs   A%(A6 %
A363B-,B-r(   Nr)   r*   r+   r,   r   r0   r(   r1   r2   r   r   g  s    	r1   r   c                       \ rS rSrS rSrg)
gp_pol_extit  c                     [        US5       nUR                  5       nS S S 5        [        [        R                  W5      $ ! , (       d  f       N(= f)Nr   )r   r   r   r   filerE   r   r   raws       r2   r   gp_pol_ext.readu  s8    )T"a&&(C #$))S)) #"s   A  
Ar(   Nr   r(   r1   r2   r   r   t  s    *r1   r   c                       \ rS rSrS rSrg)
gp_xml_exti{  c                 "   [        US5       nUR                  5       nS S S 5         [        R                  " WR	                  5       5      $ ! , (       d  f       N3= f! [
         a(    [        R                  " WR	                  S5      5      s $ f = f)Nr   r   )r   r   r>   r?   r   r   r   s       r2   r   gp_xml_ext.read|  sm    )T"a&&(C #	:##CJJL11 #" " 	:##CJJx$899	:s   A#A 
A/BBr(   Nr   r(   r1   r2   r  r  {  s    :r1   r  c                   p    \ rS rSrSr\rS rS rS r	S r
S rS rS	 r\S
 5       r\S 5       rSS jrSrg)
gp_applieri  zGroup Policy Applier/Unapplier/Modifier
The applier defines functions for monitoring policy application,
removal, and modification. It must be a multi-derived class paired
with a subclass of gp_ext.
c                     U R                   R                  U5        U R                   R                  [        U 5      X#5        U R                   R	                  5         g)a$  Add an attribute and value to the Group Policy cache
guid        - The GPO guid which applies this policy
attribute   - The attribute name of the policy being applied
value       - The value of the policy being applied

Normally called by the subclass apply() function after applying policy.
N)r   r\   rj   r   r   rE   rW   rc   rM   s       r2   cache_add_attributegp_applier.cache_add_attribute  s>     	

D!

TI5

r1   c                     U R                   R                  U5        U R                   R                  [        U 5      U5        U R                   R	                  5         g)zRemove an attribute from the Group Policy cache
guid        - The GPO guid which applies this policy
attribute   - The attribute name of the policy being unapplied

Normally called by the subclass unapply() function when removing old
policy.
N)r   r\   r   r   r   rE   rW   rc   s      r2   cache_remove_attribute!gp_applier.cache_remove_attribute  s>     	

D!

#d)Y/

r1   c                     U R                   R                  U5        U R                   R                  [        U 5      U5      $ )zRetrieve the value stored in the cache for the given attribute
guid        - The GPO guid which applies this policy
attribute   - The attribute name of the policy
)r   r\   rn   r   r  s      r2   cache_get_attribute_value$gp_applier.cache_get_attribute_value  s1    
 	

D!zz""3t9i88r1   c                     U R                   R                  U5        U R                   R                  [        U 5      5      $ )zxRetrieve all attribute/values currently stored for this gpo+policy
guid        - The GPO guid which applies this policy
)r   r\   rs   r   )rE   rW   s     r2   cache_get_all_attribute_values)gp_applier.cache_get_all_attribute_values  s/     	

D!zz&&s4y11r1   c                 6    U R                   R                  5       $ )zCReturn the current apply state
return      - APPLY|ENFORCE|UNAPPLY
)r   rS   rR   s    r2   cache_get_apply_state gp_applier.cache_get_apply_state  s     zz##%%r1   c                     SR                  / UQ Vs/ s H  n[        U5      PM     sn5      n[        [        U5      U-   5      R                  5       $ s  snf )a  Generate an attribute name from arbitrary data
name            - A name to ensure uniqueness
args            - Any arbitrary set of args, str or bytes
return          - A blake2b digest of the data, the attribute

The importance here is the digest of the data makes the attribute
reproducible and uniquely identifies it. Hashing the name with
the data ensures we don't falsely identify a match which is the same
text in a different file. Using this attribute generator is optional.
r1   r   r   r   	hexdigest)rE   r:   argsargdatas        r2   generate_attributegp_applier.generate_attribute  sK     xx7T7;7C37;<yt+,6688 <s   Ac                     SR                  / UQ Vs/ s H  n[        U5      PM     sn5      n[        U5      R                  5       $ s  snf )zGenerate a unique value which identifies value changes
args            - Any arbitrary set of args, str or bytes
return          - A blake2b digest of the data, the value represented
r1   r  )rE   r  r  r  s       r2   generate_value_hashgp_applier.generate_value_hash  sA    
 xx7T7;7C37;<t}&&(( <s   Ac                     g)zGroup Policy Unapply
guid            - The GPO guid which applies this policy
attribute       - The attribute name of the policy being unapplied
value           - The value of the policy being unapplied
Nr(   r	  s       r2   unapplygp_applier.unapply  s     	r1   c                     g)aQ  Group Policy Apply
guid            - The GPO guid which applies this policy
attribute       - The attribute name of the policy being applied
applier_func    - An applier function which takes variable args
args            - The variable arguments to pass to applier_func

The applier_func function MUST return the value of the policy being
applied. It's important that implementations of `apply` check for and
first unapply any changed policy. See for example calls to
`cache_get_all_attribute_values()` which searches for all policies
applied by this GPO for this Client Side Extension (CSE).
Nr(   )rE   rW   rc   applier_funcr  s        r2   applygp_applier.apply  s     	r1   Nc                 f   Uc  / nUc  / n[        U5      [        :w  a*  U R                  X5      nUb  U R                  " XU40 UD6  ggU R	                  U5      nUR                  5        HE  u  pu[        U5      S:  a  Xs;   d  [        U5      S:  d  M*  Xr;  d  M1  U R                  " XU40 UD6  MG     g)a4  Cleanup old removed attributes
keep    - A list of attributes to keep
remove  - A single attribute to remove, or a list of attributes to
          remove
kwargs  - Additional keyword args required by the subclass unapply
          function

This is only necessary for CSEs which provide multiple attributes.
Nr   )typelistr  r%  r  itemsrL   )rE   rW   keepr   kwargsrM   old_valsrc   s           r2   cleangp_applier.clean  s     <D>F<4224@E T5;F; ! ::4@H$,NN$4 	K!O	(;IMi&;LL%B6B %5r1   r(   )NN)r)   r*   r+   r,   r   r   r   r
  r  r  r  r  r  r"  r   r%  r)  r2  r0   r(   r1   r2   r  r    s_    
 M

92&9)    Cr1   r  c                   $    \ rS rSrSrS rS rSrg)gp_misc_applieri  z:Group Policy Miscellaneous Applier/Unapplier/Modifier
    c                     [         R                  " S5      nUR                  5        H+  u  p4[         R                  " X#5      n[	        U5      Ul        M-     [	        [         R                  " US5      5      $ )Nr  r   )r>   rA   r.  rC   r   rd   r   )rE   r0  r  kvr  s         r2   generate_valuegp_misc_applier.generate_value
  sU    }}V$LLNDA""4+C!!}CH # %..w788r1   c                    0 n [         R                  " U5      nUR	                  5       n[        U5        U H  nUR                  X%R                  '   M     U$ ! [         R                   a    SU0s $ [         a    0 s $ f = f)Nrf   )r>   r?   
ParseErrorr   iternextrd   tag)rE   rM   valsr  itrr[   s         r2   parse_valuegp_misc_applier.parse_value  s}    	##E*D iikS	D!YYDN   	&u%% 	I	s   A B 2B ?B r(   N)r)   r*   r+   r,   r   r9  rB  r0   r(   r1   r2   r5  r5    s    9r1   r5  c                   <    \ rS rSrSrS rS rSS jrSS.S jrS	r	g
)gp_file_applieri!  z}Group Policy File Applier/Unapplier/Modifier
Subclass of abstract class gp_applier for monitoring policy applied
via a file.
c                 L    U/nUR                  U5        UR                  U5      $ rx   )r~   r   )rE   
value_hashfilessepr  s        r2   __generate_value gp_file_applier.__generate_value'  s#    |Exx~r1   c                     Uc  S/ 4$ UR                  U5      nSUS   ;   a  SU4$ US   [        U5      S:  a  USS 4$ / 4$ )zIParse a value
return          - A unique HASH, followed by the file list
N/r   r%   )splitrL   )rE   rM   rI  r  s       r2   __parse_valuegp_file_applier.__parse_value,  s^     =8O{{3$q'> :7D	ADH==2==r1   :c                     [        U5      [        :w  a  U R                  X45      u  pSU H?  n[        R                  R                  U5      (       d  M)  [        R                  " U5        MA     U R                  X5        g rx   )r,  r-  _gp_file_applier__parse_valuer   r   r   unlinkr  )rE   rW   rc   rH  rI  _r   s          r2   r%  gp_file_applier.unapply:  sX    ;$))%5HADww~~d##		$  	##D4r1   )rI  c                   U R                  X5      nU R                  Xu5      u  pX:w  d`  U R                  5       [        R                  :X  d>  [        U	 V
s/ s H"  n
[        R                  R                  U
5      PM$     sn
5      (       d  U R                  XU	5        OgU" U6 nU R                  X;U5      nU R                  XU5        gs  sn
f )a   
applier_func MUST return a list of files created by the applier.

This applier is for policies which only apply to a single file (with
a couple small exceptions). This applier will remove any policy applied
by this GPO which doesn't match the new policy.
N)r  rS  r  r"   r.   allr   r   r   r%   _gp_file_applier__generate_valuer
  )rE   rW   rc   rG  r(  rI  r  rf   old_val_hashold_val_filesr   rH  	new_values                r2   r)  gp_file_applier.applyC  s     00A&*&8&8&F#&**,0@0@@MBMq*MBCCLL-8  d#))*SA	  )< Cs   )Cr(   N)rQ  )
r)   r*   r+   r,   r   rY  rS  r%  r)  r0   r(   r1   r2   rE  rE  !  s'    

>5 KN = =r1   rE  c                     [        XS9nUR                  UR                  S5      [        R                  [        R
                  -  S9nUR                  $ )N)r   r   realm)domainflags)r	   finddcr|   r
   NBT_SERVER_LDAPNBT_SERVER_DSpdc_dns_name)r   r   net	cldap_rets       r2   get_dc_hostnamerh  `  sJ    
E
!C

"&&/#:M:M:=:K:K;L
 NI!!!r1   c                 h   [         R                  " 5       n/ SQnUR                  S5      (       a  UR                  S5      n[        R
                  [        R                  -  [        R                  -  n U R                  U[        R                  SUSU-  /S9nUR                  S:w  a%  [        R                  " [        R                   S5      eXl        S	UR$                  S
   R'                  5       ;   a#  [)        UR$                  S
   S	   S
   5      Ul        SUR$                  S
   R'                  5       ;   a#  [)        UR$                  S
   S   S
   5      Ul        SUR$                  S
   R'                  5       ;   a(  UR$                  S
   S   S
   R/                  5       Ul        SUR$                  S
   R'                  5       ;   a(  UR$                  S
   S   S
   R/                  5       Ul        SUR$                  S
   R'                  5       ;   a(  UR$                  S
   S   S
   R/                  5       Ul        SUR$                  S
   R'                  5       ;   a#  [7        UR$                  S
   S   S
   5      Ul        SUR$                  S
   R'                  5       ;   a#  [7        UR$                  S
   S   S
   5      Ul        SUR$                  S
   R'                  5       ;   a-  UR=                  [?        UR$                  S
   S   S
   5      5        U$ ! [         a    [        R                  " S5        e f = f)N)cndisplayNamera  gPCFileSysPathgPCFunctionalityVersiongPCMachineExtensionNamesgPCUserExtensionNamesgPCWQLFilterr:   nTSecurityDescriptorversionNumberzLDAP://(objectclass=*)zsd_flags:1:%d)controlsz4Failed to fetch gpo object with nTSecurityDescriptorr%   zget_gpo: search failedrr  r   ra  rl  rk  r:   rn  ro  rq  ) r   GROUP_POLICY_OBJECT
startswithlstripr   SECINFO_OWNERSECINFO_GROUPSECINFO_DACLsearchldb
SCOPE_BASE	Exceptionr   errorrX   LdbErrorERR_NO_SUCH_OBJECTds_pathmsgskeysr   versionoptionsr   file_sys_pathdisplay_namer:   r   machine_extensionsuser_extensionsset_sec_descbytes)samdbgpo_dnr   rr   sd_flagsress         r2   get_gpor  j  s   !AE ##y)&&&&'%%&Hll63>>3De%4x%?$@  B
 yyA~ll31135 	5 I#((1+**,,O4Q78	#((1+""$$G,Q/0	388A;++--((1+&67:AAC((**!]3A6==?!!!##!V$Q'..0!SXXa[%5%5%77"388A;/I#J1#MN#((1+"2"2"44,C DQ GH!!1!1!33	uSXXa[)?@CDEH1  		HIs   4%L "L1c                   &    \ rS rSrS rS rS rSrg)GP_LINKi  c                 b    / U l         / U l        U R                  U5        [        U5      U l        g rx   )
link_names	link_optsgpo_parse_gplinkr   gp_opts)rE   gPLink	gPOptionss      r2   rH   GP_LINK.__init__  s)    f%9~r1   c                    UR                  5       R                  S5       H  nU(       a  SU;  a  M  [        R                  " S5        UR	                  S5      nUR                  S5      u  p4[        R                  " SR                  U5      5        [        R                  " SR                  U5      5        U R                  R                  U5        U R                  R                  [        U5      5        M     g )N];z!gpo_parse_gplink: processing link[zgpo_parse_gplink: link: {}zgpo_parse_gplink: opt: {})
r   rN  r   debugrw  formatr  r   r  r   )rE   r  p	link_namelink_opts        r2   r  GP_LINK.gpo_parse_gplink  s     &&s+A1II9:A"#''#,III299)DEII188BCOO""9-NN!!#h-0 ,r1   c                     [        U R                  5      [        U R                  5      :w  a  [        S5      e[        U R                  5      $ )NzLink names and opts mismatch)rL   r  r  RuntimeErrorrR   s    r2   	num_linksGP_LINK.num_links  s7    t3t~~#66=>>4??##r1   )r  r  r  N)r)   r*   r+   r,   rH   r  r  r0   r(   r1   r2   r  r    s    &1$r1   r  c                    SS/nU R                  U R                  5       [        R                  SR	                  U5      U5      nUR
                  S:w  a4  [        R                  " [        R                  SR	                  U5      5      e[        UR                  S   S   S   5      nUR                  S   S   n[        R                  " SR	                  XQ5      5        XE4$ )NdnuserAccountControlz(sAMAccountName={})r%   z"Failed to find samAccountName '{}'r   z!Found dn {} for samaccountname {})r{  get_default_basednr|  SCOPE_SUBTREEr  rX   r  r  r   r  r   info)r  samaccountnamerr   r  uacr  s         r2   find_samaccountr    s    '(E
,,u//133D3D,33NCULC
yyA~ll311077G
 	
 chhqk./2
3C	!T	BHH077KL7Nr1   c                    U R                  U[        R                  SSS/5      nUR                  S:w  a%  [        R                  " [        R
                  S5      eSUR                  S   ;  a4  [        R                  " [        R                  SR                  U5      5      eUR                  S   S   S   nSnSUR                  S   ;   a  UR                  S   S   S   nO[        R                  " S5        [        X45      $ )	Nrs  r  r  r%   zget_gpo_link: no resultr   z2get_gpo_link: no 'gPLink' attribute found for '{}'z,get_gpo_link: no 'gPOptions' attribute found)r{  r|  r}  rX   r  r  r  ERR_NO_SUCH_ATTRIBUTEr  r   r  r  )r  link_dnr  r  r  s        r2   get_gpo_linkr    s    
,,w(8[*ACC
yyA~ll3113LMMsxx{"ll344@GGP
 	
 XXa["1%FIchhqk!HHQK,Q/			@A6%%r1   c                    [        UR                  5       S-
  SS5       GH  nUR                  U   [        -  S:g  n	UR                  U   [        -  (       a  [
        R                  " S5        MP  U(       a5  U	(       d  [
        R                  " S5        Mv  [
        R                  " S5         [        XR                  U   5      n
 [        [        R                  U
R                  5       5      n[        R                  R                  X[        R                  [        R                   -  [        R"                  -  5        [)        U5      U
l        XZl        U	(       a  UR/                  SU
5        OUR/                  SU
5        [
        R                  " SXR                  U   4-  5        GM     g ! [$         a/  n[
        R                  " SU
R&                  -  5         S nAGM  S nAff = f! [0        R2                   a  nUR4                  u  p[
        R                  " S	UR                  U   -  5        U[0        R6                  :X  a-  [
        R                  " S
UR                  U   -  5         S nAGMR   S nA  g S nAff = f)Nr%   r   zskipping disabled GPOzNskipping nonenforced GPO link because GPOPTIONS_BLOCK_INHERITANCE has been setzNadding enforced GPO link although the GPOPTIONS_BLOCK_INHERITANCE has been setz/skipping GPO "%s" as object has no access to itz7add_gplink_to_gpo_list: added GPLINK #%d %s to GPO listzfailed to get gpo: %szskipping empty gpo: %s)ranger  r  r   r   r   r  r  r  r   r   
descriptorget_sec_desc_bufsambaaccess_checkSEC_STD_READ_CONTROLSEC_ADS_LISTSEC_ADS_READ_PROPr~  r  r   link	link_typeinsertr|  r  r  r  )r  gpo_listforced_gpo_listr  gp_linkr  only_add_forced_gpostokeni	is_forcednew_gposec_desceenumestrs                  r2   add_gplink_to_gpo_listr    s   7$$&q("b1&&q),>>1D	Q"44II-.		 ) * 		 ) *	Be%7%7%:;G
%h&9&9&-&>&>&@B++H,4,I,I,4,A,A-B,4,F,F-GH w<GL )&&q'27+II $'(*<*<Q*?&@A B_ 2D  		 0292F2FG H || 	66LTII-0B0B10EEFs---		2W5G5G5JJK	s2   ,G(A8F,,
G%6#G  G%(I<<A.I77I<c                    U R                   n[        5       R                  nUR                  UR                   5        Xl         U =R                  UR                  -  sl        U =R
                  UR
                  -  sl        U $ rx   )sidsr   security_tokenr~   rights_maskprivilege_mask)token_1r  system_tokens      r2   merge_with_system_tokenr    sc    <<D!#22LKK!!"L<333l999Nr1   c                    SU R                  5       < SU< S3nU R                  S[        R                  US/S9nUR                  S:w  a  [        S5      e[        [        R                  [        UR                  S	   S   S	   5      5      nUR                  [        R                  -  (       d  [        S
5      e[        R                  Ul        UR                  nSn	UR                  (       a%  [        UR                  5      S:  a  UR                  n	U R!                  5       n
U
R#                  S5        U
R#                  SU	-  5        U
$ )Nz(&(DnsDomain=z.)(User=z)(NtVer=\14\00\00\20)) Netlogon)basescope
expressionrr   r%   zsite_dn_for_machine: No resultr   z@site_dn_for_machine: Invalid NtVer in netlogon_samlogon_responsezDefault-First-Site-NamezCN=SiteszCN=%s)domain_dns_namer{  r|  r}  rX   r  r   r
   netlogon_samlogon_responser  r  ntverNETLOGON_NT_VERSION_5EXr  client_siterL   get_config_basedn	add_child)r  dc_hostnamer   r   hostnameexprr  samlogon_responsesamlogon_response_exr  site_dns              r2   site_dn_for_machiner    s,    	D ,,nnl	  C
 yyA~;<<"3#A#A#(!Z)@)C#DF##c&A&AA : ; 	; "99,11+K(((4459*66%%'Gj!g-.Nr1   c           
         / n/ nSU -   n[        U[        5       XS9n[        XsR                  S5      S   5      u  pSn
[        [
        -  nUR                  S5      (       a	  U[        -  n[        R                  R                  XrU	US9nSnU[        -  (       d  U[        -  (       a  Sn[        UR                  5      nOUR                  nU	R                  5       n [!        U5      [!        UR#                  5       R                  5       5      :X  a  OUR%                  S	5      S
:X  a]   [&        R(                  " SU-  5        [+        X5      n[-        XtUUU[.        R0                  X5        UR2                  [4        -  (       a  Sn
UR                  5       nM  U	R                  5       n [!        U5      [!        UR#                  5       R                  5       5      :X  a  OUR%                  S	5      S:X  a]   [&        R(                  " SU-  5        [+        X5      n[-        XtUUU[.        R<                  X5        UR2                  [4        -  (       a  Sn
UR                  5       nM  U(       aR   [?        XpX!U5      n [&        R(                  " SU-  5        [+        UU5      n[-        XtUUU[.        R@                  X5        URC                  S	[.        RD                  " SS[.        RF                  5      5        XE-   $ ! [6        R8                   a0  nUR:                  u  nn[&        R(                  " U5         SnAGNSnAff = f! [6        R8                   a0  nUR:                  u  nn[&        R(                  " U5         SnAGN+SnAff = f! [6        R8                   a0  nUR:                  u  nn[&        R(                  " U5         SnAGNSnAff = f! [6        R8                   a     GN&f = f)a  Get the full list of GROUP_POLICY_OBJECTs for a given username.
Push GPOs to gpo_list so that the traversal order of the list matches
the order of application:
(L)ocal (S)ite (D)omain (O)rganizational(U)nit
For different domains and OUs: parent-to-child.
Within same level of domains and OUs: Link order.
Since GPOs are pushed to the front of gpo_list, GPOs have to be
pushed in the opposite order of application (OUs first, local last,
child-to-parent).
Forced GPOs are appended in the end since they override all others.
zldap://)urlsession_infocredentialsr   \r  Fldap)lp_ctxr  session_info_flagsTr   OUz%get_gpo_list: query OU: [%s] for GPOsNDCz%get_gpo_list: query DC: [%s] for GPOsz'get_gpo_list: query SITE: [%s] for GPOsLocal Policy)$r   r   r  rN  r   r   rv  r   r  authuser_sessionr   r   r  r  parentr   r  get_component_namer   r  r  r  r   
GP_LINK_OUr  r   r|  r  r  GP_LINK_DOMAINr  GP_LINK_SITEr  ru  GP_LINK_LOCAL)r  r   r   r=   r  r  r  r  r  r  add_only_forced_gposr  sessiongpo_list_machiner  	parent_dnr  r  r  r  r  s                        r2   get_gpo_listr  ?  su    HO
k
!Cc-/#,E e^^D%9"%=>GC  ;9:
~~fAAjj%%e29K & MG
))S3J-J'(>(>?&& 		I
y>S!9!9!;!B!B!DEE ''*d20		AIMN&u8
 'u'0''*~~';D ??%::+/($$&	- 2 		I
y>S!9!9!;!B!B!DEE ''*d20		AIMN&u8
 'u'0''*'9'9';D ??%::+/($$&	- 2 	)%bRG
D		CgMN&ug6
 'u'.'*'7'7';D OOAs..~/=/2/@/@B C ##M <<   vvt		$ 4 <<   vvt		$ . <<   vvt		$  || 	 		sl   '$K2 1$L9 'O 5%N  O 2L6%L11L69M=%M88M= O%N?9O ?OO OOc           
      <   UR                  5       n[        R                  R                  X5      n [        R                  " USS9  U R                  U5       GH
  nUS   [        R                  -  (       a.  [        X[        R                  R                  X&S   5      5        MM  US   R                  5       n[        SUS9n[        R                  R                  X&S   5      R                  SS5      n	UR                  U R                  U	5      5        UR!                  5         [        R"                  " UR$                  [        R                  R                  XG5      5        GM     g ! [
         a*  nUR                  [        R                  :w  a  e  S nAGNPS nAff = f)	Ni  )moderD   r:   F)r   dirrM  r  )r   r   r   r   makedirsOSErrorerrnoEEXISTr-  libsmbFILE_ATTRIBUTE_DIRECTORYcache_gpo_dirr   replacewriteloadfiler   renamer:   )
conncachesub_dirloc_sub_dir	local_dirr  fdata
local_namer   fnames
             r2   r  r    s   --/KU0I
IE* 7#?V<<<$rww||G6]'KLv,,.J"%Y?AGGLL-8@@dKEGGDMM%()GGIIIaffbggll9AB $  77ell" #s   E' '
F1FFc                 *   [         R                  " SU 5      nSU R                  5       ;   a;  [         R                  " SU R                  5       5      nXR                  S5      S-   S  nSU;  a  [        R
                  R                  " U6 $ [        U 5      e)Nz/|\\sysvolr%   z..)rerN  lowerindexr   r   r   r	  )r   dirsldirss      r2   r   r     st    88Hd#D4::<4::<0KK)A-./4ww||T""
$-r1   c                 4   UR                  5       nUR                  [        5        [        R                  " U SXS9nUR                  U5        UR                  S5      nU H5  nUR                  (       d  M  [        XV[        UR                  5      5        M7     g )Nr  )r   r   r   )	get_smb_signingset_smb_signingr   r  Connr   r  r  r   )r  r   r   gpossaved_signing_stater  r   gpo_objs           r2   check_refresh_gpo_listr)    sz    //1	./;;{HAD	-.{+J$$d8M8M(NO r1   c                     U R                  5       n[        U Vs/ s H  o3R                  PM     sn5      nU Vs/ s H  oUU;  d  M
  UPM     nnU R                  U5      $ s  snf s  snf rx   )r   setr:   r   )r   r&  applied_gposr  current_guidsrW   deleted_gposs          r2   get_deleted_gpos_listr/    s]    **,L.A./M%1O\T5ND\LO%%l33 /Os   A 	A%A%c                     U R                  [        R                  R                  SU5      5      n[	        [
        R                  " U5      S   5      $ )Nr   r%   )r   r   r   r   r   r   gpo_get_sysvol_gpt_version)r   r   gpt_paths      r2   gpo_versionr3    s<     }}RWW\\+t<=Hs--h7:;;r1   c                 v   UR                  U5      n[        X5      n[        XX5      n	[        Xy5      n
 [	        XX5        U(       a"  U	nUR                  [        R                  5        O/ nU	 H  nUR                  (       d  M  UR                  n[        UR                  5      R                  5       n[        X5      nXR                  U5      :w  d  Mf  [
        R                   " SU-  5        UR#                  U5        M     UR                  [        R$                  5        UR'                  5         U H=  n U" XXB5      nUS:X  a  UR)                  X5        M&  [+        UUR(                  X5        M?     U	 He  nUR                  (       d  M  UR                  n[        UR                  5      R                  5       n[        X5      nUR=                  USU-  5        Mg     UR?                  5         g !   [
        R                  " SU-  5         g = f! [,         a  n[
        R                  " S[/        U5      -  5        [0        R2                  " 5       u    nn[4        R6                  " U5      S   u  nn  n[
        R                  " SUU[9        U5      R:                  [/        U5      4-  5         S nAGM  S nAff = f)Nz0Failed downloading gpt cache from '%s' using SMBzGPO %s has changedComputerzFailed to apply extension  %sr  z%s:%d: %s: %sz%i) r   rh  r  r/  r)  r   r  rO   r"   r.   r  r:   r   r   r3  r   r  r   r-   r   r   drop_privilegesr~  r   sysexc_info	traceback
extract_tbr,  r)   rj   r   )r   r   rj   gp_extensionsr=   targetforcer   r  r&  del_gposchanged_gposr(  rW   r   r  rh   r  rU  tbfilenameline_numbers                         r2   apply_gprC    s@   OOH%E!%,KB9D$U1H{< H$$%G((<<D"7#8#89??AD!"+G-----45##G,  	HNN#	KKM	b1C#((@#*B*B (8  $$||w445;;=b'D$.)  
LLNY		F  	!6  	II5C@A||~HAq"*3*>*>r*B2*F'Hk1aIIo;)-a)9)93q6)C C D	s*   G0 7 HH0H
J8BJ33J8c                 "   UR                  U5      nUR                  [        R                  5        UR	                  UR                  5       5      nUR                  5         U H>  n U" XXB5      nUS:X  a  UR                  U/ 5        M'  [        XHR                  U/ 5        M@     UR                  5         g ! [         aO  n	[        R                  " S[        U5      -  5        [        R                  " S[        U	5      -   5         S n	A	M  S n	A	ff = f)Nr5  zFailed to unapply extension  %szMessage was: )r   rO   r"   r/   r   r   r   r   r6  r~  r   r  r   r   )
r   r   rj   r;  r=   r<  r   r>  rh   r  s
             r2   
unapply_gprE  &  s    OOH%E	KK  !))%*A*A*CDH	KKM
	b1C#((26*B*B (".  
LLN	  	II7#c(BCIIoA./	s   &!B5	B55
D?AD		Dc                    [        U 5      [        :X  aR  U R                  5        VVs/ s H!  u  p#SU-  SU< S[        X1S-   5      < 3-   PM#     nnnSSR	                  U5      -   $ [        U 5      [
        :X  a;  U  Vs/ s H  nSU-  S[        X1S-   5      -  -   PM     nnSSR	                  U5      -   $ [        U [        R                  5      (       a  SUS-   -  [        U 5      -   $ SUS-   -  [        U 5      -   $ s  snnf s  snf )N z[ z ] = r&   
z[ %s ])r,  dictr.  __rsop_valsr   r-  
isinstancenumbersNumberr   r   )r@  levelr7  r8  r   s        r2   rJ  rJ  ;  s    DzT JJL*(DA 5yA{1Ag/FGG( 	 *diin$$	dt	GKLt!s5y8k!1W&===tLdiin$$dGNN++a=3t9,,a=:d#333* Ms   (C;=!Dc                 (   [        X5      n[        XaX5      n[        X`X5        [        S5        [        SU-  5        [        R
                  " SS9S   nU GH  n	U	R                  R                  5       S:X  a  M$  [        SU	R                  -  5        [        SU-  5        U GHV  n
U
" XXB5      n
[        R                  " S	[        [        U
5      5      5      n[        U5      S:  a  US
   R                  S5      S
   nOU
R                  R                  S5      S
   n[        SU-  5        [        SS[        US-  5      -  -   5        U
R!                  U	5      R#                  5        Hp  u  p[        SU-  5        [        SS[        US-  5      -  -   5        [        [%        U5      R'                  S5      5        [        SS[        US-  5      -  -   5        Mr     [        SS[        US-  5      -  -   5        GMY     [        SSU-  -  5        GM     g )NzResultant Set of Policyz
%s Policy
)x   2   )fallbackr   r  zGPO: %s=z'([\w\.]+)'r  .z	  CSE: %sz  -r&   z    Policy Type: %sz    rH  z%s
)rh  r  r)  printshutilget_terminal_sizer  stripr  rq   r   r,  rL   rN  r*   r   r   r.  rJ  rw  )r   r   rj   r;  r=   r<  r  r&  
term_widthr(  rh   
cse_name_mcse_namesectionr   s                  r2   r   r   I  s   !%,KB9D;E8	
#$	-&
 !))9=a@J%%'>9i'.../c*n Cb1CNCS	NCJ:"%b>//4R8>>//4R8+()$#c*Q,//01%(XXg%6%<%<%>!+g56fC
1$5 567k(+22489fC
1$5 567	 &?
 $#c*Q,//01 ! 	fJ'() r1   c                     SSK Jn  UR                  5       nU b  UR                  U 5        OUR	                  5         UR                  S5      n[        S S9nUR                  U5        X$4$ )Nr   )param
gpext.confr   )samba.samba3r_  get_contextloadload_default
state_pathr   r   )smb_confs3paramr   ext_confparsers        r2   parse_gpext_confrj  h  s[    -				B

}}\*H-F
KK:r1   c                    U R                  S5      n[        SS[        R                  R	                  U5      S9 nUR                  U5        [        R                  " UR                  U5        S S S 5        g ! , (       d  f       g = f)Nr`  zw+F)r  r   r  )re  r   r   r   dirnamer  r  r:   )r   ri  rh  r   s       r2   atomic_write_confrm  u  sV    }}\*H	e9R	SWXQ
		!&&(# 
T	S	Ss   3A66
Bc                 ~    U S   S:w  d  U S   S:w  d  [        U 5      S:w  a  g [        U SS9  g	! [         a     gf = f)
Nr   {r  }&   F   )r  T)rL   r   
ValueError)rW   s    r2   
check_guidrt  |  sL    Aw#~bSCIOT1   s   
/ 
<<c                    [         R                  R                  U5      (       d  g[        U 5      (       d  g[	        U5      u  pgXR                  5       ;  a  UR                  U 5        UR                  U SU5        UR                  U SU5        UR                  U SU(       a  SOS5        UR                  U SU(       a  SOS5        [        Xg5        g)	NFDllNameProcessGroupPolicyNoMachinePolicy01NoUserPolicyT)	r   r   r   rt  rj  sectionsadd_sectionr+  rm  )rW   r:   r   rf  machiner9   r   ri  s           r2   register_gp_extensionr    s     77>>$d!(+JB??$$4 
JJtY%
JJt)40
JJt&wC@
JJt^DSc:b!r1   c                 J   [        U 5      u  p0 nUR                  5        H  n0 X4'   UR                  US5      X4   S'   UR                  US5      X4   S'   [        UR                  US5      5      (       + X4   S'   [        UR                  US5      5      (       + X4   S'   M     U$ )Nrv  rw  rx  MachinePolicyr{  
UserPolicy)rj  r|  r|   r   )rf  rU  ri  resultsrW   s        r2   list_gp_extensionsr    s     *IAG!#)::dI#>i JJt12 	*+ FJJt%6788 	o&*-fjj~.N*O&Ol# " Nr1   c                     [        U 5      (       d  g[        U5      u  p#XR                  5       ;   a  UR                  U 5        [	        X#5        g)NFT)rt  rj  r|  remove_sectionrm  )rW   rf  r   ri  s       r2   unregister_gp_extensionr    sB    d!(+JB  d#b!r1   c                 \    [         R                  " U5        [         R                  " U5        g)z 
Set current process privileges
N)r   setegidseteuid)r=   uidgids      r2   set_privilegesr    s    
 JJsOJJsOr1   c                 \   [         R                  " 5       nUS:X  d  [        S5      e[        R                  " U 5      R
                  n[        R                  " U 5      R                  n[        XU5        SnSn U" U6 n[        SUS5        U(       a  UeU$ ! [         a  nUn SnAN)SnAff = f)z?
Run supplied function with privileges for specified username.
r   z)Not enough permissions to drop privilegesNroot)r   getuidr~  pwdgetpwnampw_uidpw_gidr  )	r=   funcr  current_uiduser_uiduser_gidoutexcr  s	            r2   r6  r6    s     ))+K!CDD||H%,,H||H%,,H 8x0 C
CDk
 6;*
	J  s   8B 
B+B&&B+c                    [         R                  " 5       n[         R                  " 5       nUR                  [        R
                  R                  S5      5      n0 S[        R
                  R                  S5      _SS _SS _SS _SS _SS _S	S _S
S _SUR                  S5      _SS _SS _SUR                  S5      _S[        U5      _S[        R
                  R                  S5      _SUR                  S5      _SS _SS _0 S[        R
                  R                  U[        U5      R                  5       5      _SS _SS _SS _SS _SS _SS _SUR                  S 5      _S!UR                  S"5      _S#UR                  S5      _S$S _S%U_S&S _S'S _S(S _S)S _S*S _ES S S S S S S S S S S+S,[        [         R                  " U5      5      S S S-.EnUR                  5        H3  u  pS.U-  n
X;   d  M  U	c  [        S/U-  5      eU R!                  X5      n M5     U $ )0Nr   
AppDataDirz	~/.configBinaryComputerSidBinaryUserSidCommonAppdataDirCommonDesktopDirCommonFavoritesDirCommonProgramsDirCommonStartUpDirComputerNameznetbios nameCurrentProccessIdCurrentThreadIdDateTimez%Y-%m-%d %H:%M:%S UTC
DateTimeEx
DesktopDirz	~/Desktop
DomainNamer_  FavoritesDirGphPathGptPathGroupPolicyVersionLastDriveMapped	LastErrorLastErrorTextLdapComputerSidLdapUserSid	LocalTimez%H:%M:%SLocalTimeExz%H:%M:%S.%fLogonDomainLogonServer	LogonUserLogonUserSid
MacAddressNetPlacesDir	OsVersionProgramFilesDirrM  z/tmp)ProgramsDirRecentDocumentsDir
ResultCode
ResultTextReversedComputerSidReversedUserSid	SendToDirStartMenuDir
StartUpDir	SystemDirSystemDriveTempDir	TimeStamp	TraceFile
WindowsDirz%%%s%%z"Expansion variable %s is undefined)r    utcnownowr   r   r   r   
expanduserr|   strftimer   r   r   	timestampr.  	NameErrorr  )rd   r2  r   r=   utc_dtdtr   	variablesexp_varr   exp_var_fmts              r2   expand_pref_variablesr    s   __F	Brww||K89J2, 2 2; ? 2%t2!42 %d2 %d	2
 '2 &t2 %d2 !"&&"82 &t2 $T2 foo.EF2 F2  2 2; ?2 w2 !$2  T!2" RWW\\**9(*C*I*I*KM#2& ''2( $T)2* t+2, "4-2. $T/20  122 r{{:6324  ]!;526  728  92: x;2< !$=2> ?2@ !$A2B tC2D $TE2F "&(, $ $)-%)#"& $#!$#"8#5#5b#9:# $c2If ")({ Dw NOO<<1D * Kr1   )F)rr  )NTTrx   )jr7  r   rW  r
  r   r  r   r  r  r   configparserr   ior   r9  samba.commonr   abcr   r   xml.etree.ElementTreer>   ElementTreer  	samba.netr	   samba.dcerpcr
   ra  r   r  	samba.gpor   uuidr   tempfiler   r   	samba.ndrr   samba.credentialsr   samba.gp.util.loggingr   hashlibr   rL  r   samba.samdbr   
samba.authr   r|  
samba.dsdbr   r   r   r   r   r   r   r   r   samba.securityr    r  r!   r"   ImportErrorr4   r   objectra   r   r   r  r  r5  rE  rh  r  r  r  r  r  r  r  r  r  r   r)  r/  r3  rC  rE  rJ  r   rj  rm  rt  r  r  r  r  r6  r  r(   r1   r2   <module>r     s  $    
 
 <    %   " ' % % 	   8   '    2 %   #  % 
 L  L } } !   J 78H[O [O|# #LV B
 
* *: :~C ~CBj 69=j 9=x ," 20d$ $4&"2Bh(Xu$pC(P4<3l*4)>
$ =A*
@@K%   s   1G	 	GG