
    y6hp                       S SK r S SKrS SKJr  S SKrS SKrS SKJs  J	r
  S SKrS SKrS SKJr  S SKJrJrJrJr  S SKJr  S SKJr  S SKJr  S SKJrJr  S SKJr  S SKrS SKrS S	KJrJ r J!r!  S S
K"J#r#  S SKJ$r$  S SK%J&r'  S SKJ(r(  S SK)r)S SK*J+r+  S SKJ,r,  S SK-J.r.  S SK/J0r0J1r1J2r2  S SK3J4r4  S SK5J6r6J7r7J8r8J9r9  S SK:J;r;  S SK<J=r=  S SK>J?r?  S SKJ@r@  S SK"JArA  S SKBJCrCJDrD  S SKEJFrF  S SKGJHrHJIrI  S SKJJKrKJLrL  S SKMrMS SKNrNS SKOJPrP  S SKQJRrRJSrSJTrTJUrUJVrV  S SKWJXrXJYrYJZrZ  S S K[J\r\  S S!K]J^r^  S S"K_J`r`JaraJbrb  S# rcS$ rdS% reS& rfSS' jrgSSS\R                  \R                  -  \R                  -  \R                  -  4S( jrlS) rmS* rnS+ ro\R                  4S, jrqS- rr\'R                  \'R                  -  \'R                  -  \'R                  -  rwS. rx  SS/ jry " S0 S1\5      rz " S2 S3\z5      r{ " S4 S5\z5      r| " S6 S7\z5      r} " S8 S9\z5      r~ " S: S;\z5      r " S< S=\z5      r " S> S?\z5      r " S@ SA\z5      r " SB SC\z5      r " SD SE\z5      r " SF SG\z5      r " SH SI\z5      r " SJ SK\z5      r " SL SM\z5      r " SN SO\5      r " SP SQ\z5      r " SR SS\z5      r " ST SU\5      r " SV SW\z5      r " SX SY\5      r " SZ S[\z5      r " S\ S]\5      r " S^ S_\z5      r " S` Sa\5      r " Sb Sc\5      r " Sd Se\5      r " Sf Sg\z5      r " Sh Si\5      r " Sj Sk\5      r " Sl Sm\z5      r " Sn So\z5      r " Sp Sq\5      r " Sr Ss\5      r " St Su\z5      r " Sv Sw\z5      r " Sx Sy\5      r " Sz S{\5      r " S| S}\z5      r " S~ S\5      r " S S\5      r " S S\z5      r " S S\z5      r " S S\5      r " S S\5      r " S S\5      r " S S\z5      r " S S\5      r " S S\5      r " S S\z5      r " S S\5      r " S S\5      r " S S\z5      r " S S\z5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      rg)    N)system_session)CommandCommandErrorOptionSuperCommand)SamDB)dsdb)security)
ndr_unpackndr_pack)preg) AUTH_SESSION_INFO_DEFAULT_GROUPSAUTH_SESSION_INFO_AUTHENTICATED#AUTH_SESSION_INFO_SIMPLE_PRIVILEGES)netcmd_finddc)policy)libsmb_samba_internal)NTSTATUSError)dsacl2fsacl)nbt)Net)GPParserGPNoParserExceptionGPGeneralizeException)GPPolParser)GPIniParserGPTIniParserGPFDeploy1IniParserGPScriptsIniParser)GPAuditCsvParser)GptTmplInfParser)GPAasParser)param)attr_default)	get_bytes
get_string)ConfigParser)StringIOBytesIO)	calc_modestat_from_mode)str_regtype)NT_STATUS_OBJECT_NAME_INVALIDNT_STATUS_OBJECT_NAME_NOT_FOUNDNT_STATUS_OBJECT_PATH_NOT_FOUNDNT_STATUS_OBJECT_NAME_COLLISIONNT_STATUS_ACCESS_DENIED)create_directory_hiersmb_connection
get_gpo_dn)RegistryGroupPolicies)REG_MULTI_SZ)register_gp_extensionlist_gp_extensionsunregister_gp_extensionc                 j    [         R                  " U 5      nU(       d  SnU$ SR                  U5      nU$ )zreturn gpo flags stringNONE )r   get_gpo_flagsjoin)valueflagsrets      2/usr/lib/python3/dist-packages/samba/netcmd/gpo.pygpo_flags_stringrC   [   s5      'E J hhuoJ    c                 j    [         R                  " U 5      nU(       d  SnU$ SR                  U5      nU$ )zreturn gplink options stringr;   r<   )r   get_gplink_optionsr>   )r?   optionsrA   s      rB   gplink_options_stringrH   e   s6    ''.G J hhwJrD   c                 V   / nU R                  5       S:X  a  U$ U R                  S5      nU Hy  nU(       d  M  UR                  S5      n[        U5      S:w  d  US   R                  S5      (       d  [	        SU-  5      eUR                  US   SS	 [        US
   5      S.5        M{     U$ )z.parse a gPLink into an array of dn and options ];   r   z[LDAP://zBadly formed gPLink '%s'   N   dnrG   )stripsplitlen
startswithRuntimeErrorappendint)gplinkrA   agds        rB   parse_gplinkr]   o   s    
C||~
SAGGCLq6Q;adooj999A=>>

!A$qr(s1Q4y9:  JrD   c                 6    SR                  S U  5       5      nU$ )z4Encode an array of dn and options into gPLink stringrJ   c              3   <   #    U  H  nS US   US   4-  v   M     g7f)z[LDAP://%s;%d]rQ   rG   N ).0r[   s     rB   	<genexpr> encode_gplink.<locals>.<genexpr>   s#     Mf"agq|%<<fs   )r>   )gplistrA   s     rB   encode_gplinkre      s    
''MfM
MCJrD   c                 p    Uc  Uc   [        X5      nSU-   nU$ ! [         a  n[        SU5      eSnAff = f)zfIf URL is not specified, return URL for writable DC.
If dc is provided, use that to construct ldap URLNzCould not find a DC for domainldap://)r   	ExceptionrV   )lpcredsurldces        rB   dc_urlrn      sP     {:H"2- "nJ  H"#CQGGHs    
505c                    U R                  5       nUR                  [        R                  " U S5      5        UnSn[        R                  nUb  S[        R
                  " U5      -  nUb  S[        R
                  " U5      -  nUb  Un[        R                  n U R                  XhU/ SQSU-  /S9n	U	$ ! [         a  n
Ub  S	U-  nOS
n[        X5      eSn
A
ff = f)z0Get GPO information using gpo, displayname or dnzCN=Policies,CN=Systemz"(objectClass=groupPolicyContainer)Nz.(&(objectClass=groupPolicyContainer)(name=%s))z5(&(objectClass=groupPolicyContainer)(displayname=%s)))nTSecurityDescriptorversionNumberr@   namedisplayNamegPCFileSysPathgPCMachineExtensionNamesgPCUserExtensionNamessd_flags:1:%d)basescope
expressionattrscontrolsz!Cannot get information for GPO %szCannot get information for GPOs)
get_default_basedn	add_childldbDnSCOPE_ONELEVELbinary_encode
SCOPE_BASEsearchrh   r   )samdbgpodisplaynamerQ   sd_flagspolicies_dnbase_dnsearch_exprsearch_scopemsgrm   mesgs               rB   get_gpo_infor      s     **,K#&&(?@AG6K%%L
FIZIZ[^I__MPSPaPabmPnn	~~~$ll&1"; &5x%?$@  
B$ J  $?6<D4D4##$s   B3 3
C=CCc                 v    SU-  n U R                  US/S9nU$ ! [         a  n[        SU-  U5      eSnAff = f)z lists dn of containers for a GPOz(&(objectClass=*)(gPLink=*%s*))gPLink)rz   r{   z'Could not find container(s) with GPO %sN)r   rh   r   )r   r   r   r   rm   s        rB   get_gpo_containersr      sV     4c9KOllk(lD J  ODsJANNOs    
838c                 0    U R                  U[        R                  SS/S9S   nSn[        [        X5      5      nSU;   a^  [        [        US   S   5      5      nU H=  nUS   R                  5       UR                  5       :X  d  M*  UR                  U5        S	n  O   O[	        S
5      eU(       d  [	        SU-  5      e[        R                  " 5       n	Xl        U(       a5  [        U5      n
[        R                  " U
[        R                  S5      U	S'   O/[        R                  " US   S   [        R                  S5      U	S'    U R!                  U	5        g! [         a  n[	        SU-  U5      eSnAff = f! [         a  n[	        SU5      eSnAff = f)z!delete GPO link for the container(objectClass=*)r   rx   ry   rz   r{   r   Container '%s' does not existNFrQ   Tz"No GPO(s) linked to this containerz%GPO '%s' not linked to this containerr0d0z!Error removing GPO from container)r   r   r   rh   r   strr4   r]   lowerremoveMessagerQ   re   MessageElementFLAG_MOD_REPLACEFLAG_MOD_DELETEmodify)r   container_dnr   r   rm   foundgpo_dnrd   r[   m
gplink_strs              rB   del_gpo_linkr      s{   NllCNN&7"*  --.0 EE'(F3c#h-"234Aw}}&,,.0a 	  ?@@BSHIIAD"6*
$$Z1E1ExP$$$S]1%5s7J7JHU$CQ5  N:\I1MMN6  C>BBCs/   $E E: 
E7#E22E7:
FFFc                     / nU R                  S5      (       a  U SS R                  SS5      nO+U R                  S5      (       a  U SS R                  SS5      n[        U5      S:w  a  [        SU -  5      eU$ )	z;Parse UNC string into a hostname, a service, and a filepath\\rM   N\z///   zInvalid UNC string: %s)rU   rS   rT   
ValueError)unctmps     rB   	parse_uncr      sr    
C
~~f!"gmmD!$			!"gmmC#
3x1}1C788JrD   c                    [         R                  " SXS9(       a
  [        5       $ [         R                  " SXS9(       a
  [        5       $ [         R                  " SXS9(       a
  [	        5       $ [         R                  " SXS9(       a
  [        5       $ [         R                  " SXS9(       a
  [        5       $ [         R                  " SXS9(       a
  [        5       $ [         R                  " SXS9(       a
  [        5       $ [         R                  " S	XS9(       a
  [        5       $ [         R                  " S
XS9(       a
  [        5       $ [         R                  " SXS9(       a
  [        5       $ [        5       $ )Nzfdeploy1\.ini$r@   zaudit\.csv$zGptTmpl\.inf$z	GPT\.INI$zscripts\.ini$zpsscripts\.ini$z	GPE\.INI$z.*\.ini$z.*\.pol$z.*\.aas$)rematchr   r    r!   r   r   r   r   r   r"   )rr   r@   s     rB   find_parserr     s    	xx!45"$$	xx2!!	xx $4!!	xxd0~	xx $4!##	xx"D6!##	xxd0
 z	xxT/}	xxT/}	xxT/}:rD   c                 F   Sn[         R                  R                  U5      (       d  [         R                  " U5        U/nU/nU(       GaF  UR	                  5       nUR	                  5       nU R                  U[        S9nUR                  S S9  U H  n	US-   U	S   -   n
[         R                  R                  XyS   5      nU	S   [        R                  -  (       a:  UR                  U
5        UR                  U5        [         R                  " U5        M  U R                  U
5      n[        X-   S5       nUR                  U5        S S S 5        [        U	S   5      nUR!                  U5        UR#                  US	-   5        M     U(       a  GME  g g ! , (       d  f       NQ= f)
N.SAMBABACKUPattribsc                     U S   $ Nrr   r`   xs    rB   <lambda>2backup_directory_remote_to_local.<locals>.<lambda>+      AfIrD   keyr   rr   attribwb.xml)ospathisdirmkdirpoplist
attr_flagssortr>   libsmbFILE_ATTRIBUTE_DIRECTORYrW   loadfileopenwriter   parse	write_xml)conn	remotedirlocaldirSUFFIXr_dirsl_dirsr_dirl_dirdirlistrm   r_namel_namedatafparsers                  rB    backup_directory_remote_to_localr      s@   F77==""
]F\F




))E:)6-.AT\AfI-FWW\\%63F{V<<<f%f% }}V,&/40AGGDM 1 %QvY/T"  &1  &  10s   5F
F 	c                    [         R                  R                  U5      (       d  [         R                  " U5        U/nU/nU(       Ga  UR	                  5       nUR	                  5       nU R                  U[        S9nUR                  S S9  U H  nUS-   US   -   n	[         R                  R                  XhS   5      n
US   [        R                  -  (       a:  UR                  U	5        UR                  U
5        [         R                  " U
5        M  U R                  U	5      n[        U
S5      R                  U5        M     U(       a  GM  g g )Nr   c                     U S   $ r   r`   r   s    rB   r   0copy_directory_remote_to_local.<locals>.<lambda>N  r   rD   r   r   rr   r   r   )r   r   r   r   r   r   r   r   r>   r   r   rW   r   r   r   )r   r   r   r   r   r   r   r   rm   r   r   r   s               rB   copy_directory_remote_to_localr   D  s    77==""
[FZF




))E:)6-.AT\AfI-FWW\\%63F{V<<<f%f% }}V,VT"((.  &rD   c                    U R                  U5      (       d  U R                  U5        U/nU/nU(       Ga!  UR                  5       nUR                  5       n[        R                  " U5      n	U	R                  5         U	 H  n
[        R                  R                  Xz5      nUS-   U
-   n[        R                  R                  U5      (       a6  UR                  U5        UR                  U5         U R                  U5        M  U(       a   U R                  U5        M  [        US5      R                  5       nU R                  X5        M     U(       a  GM   g g ! [         a    U(       d  e  M  f = f! [         a     N`f = f)Nr   rb)chkpathr   r   r   listdirr   r   r>   r   rW   r   r   r   readsavefile)r   r   r   ignore_existing_dirkeep_existing_filesr   r   r   r   r   rm   r   r   r   s                 rB   copy_directory_local_to_remoter   \  s5    <<	""

9ZF[F




**U#AWW\\%+FT\A%Fww}}V$$f%f%JJv&
 'f-  FD)..0f++  & % . / ) s$   /E
E1E.-E.1
E>=E>c                        \ rS rSrS rS rSrg)
GPOCommandi  c                    Uc,  [         R                  " 5       n[        SU-  U R                  S9  [        R
                  R                  U5      (       d  [        SU-  5      e[        R
                  R                  US5      n[        R
                  R                  U5      (       d  [        R                  " U5        [        R
                  R                  X25      n[        R
                  R                  U5      (       a  [        SU-  5      e [        R                  " U5        X4$ ! [        [        4 a  n[        SU5      eSnAff = f)a  Ensure that the temporary directory structure used in fetch,
backup, create, and restore is consistent.

If --tmpdir is used the named directory must be present, which may
contain a 'policy' subdirectory, but 'policy' must not itself have
a subdirectory with the gpo name. The policy and gpo directories
will be created.

If --tmpdir is not used, a temporary directory is securely created.
Nz5Using temporary directory %s (use --tmpdir to change))filez'Temporary directory '%s' does not existr   z8GPO directory '%s' already exists, refusing to overwritez%Error creating teporary GPO directory)tempfilemkdtempprintoutfr   r   r   r   r>   r   IOErrorOSError)selftmpdirr   r   gpodirrm   s         rB   construct_tmpdirGPOCommand.construct_tmpdir  s    >%%'FIFRyy" ww}}V$$H6QRR77<<1ww}}X&&HHXh,77==  JVSU U	KHHV ~ ! 	KFJJ	Ks   D' 'E7EEc                      [        U R                  [        5       U R                  U R                  S9U l        g! [         a  n[        SU R                  -  U5      eSnAff = f)z$make a ldap connection to the serverrk   session_infocredentialsri   zLDAP connection to %s failed N)r   rk   r   rj   ri   r   rh   r   )r   rm   s     rB   samdb_connectGPOCommand.samdb_connect  sY    	N488,:,<+/::$''CDJ  	N>I1MM	Ns   7: 
A"AA")r   N)__name__
__module____qualname____firstlineno__r   r  __static_attributes__r`   rD   rB   r   r     s    !FNrD   r   c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rSS jrSrg)cmd_listalli  zList all GPOs.%prog [options]	sambaoptsversionoptscredopts-H--URL%LDB URL for database or target serverURLHhelptypemetavardestNc                 @   UR                  5       U l        UR                  U R                  SS9U l        [	        U R                  U R                  U5      U l        U R                  5         [        U R                  S 5      nU GH  nU R                  R                  SUS   S   -  5        U R                  R                  SUS   S   -  5        U R                  R                  SUS	   S   -  5        U R                  R                  S
UR                  -  5        U R                  R                  S[        USS5      -  5        U R                  R                  S[        [        [        USS5      5      5      -  5        U R                  R                  S5        GM     g )NTfallback_machineGPO          : %s
rr   r   display name : %s
rs   path         : %s
rt   dn           : %s
version      : %s
rq   0flags        : %s
r@   
)get_loadparmri   get_credentialsrj   rn   rk   r  r   r   r   r   rQ   r$   rC   rX   )r   r  r  r  r  r   r   s          rB   runcmd_listall.run  sA   ((*--dgg-M
$''4::q14::t,AIIOO1AfIaL@AIIOO1Am4DQ4GGHIIOO1A6F4G4JJKIIOO1ADD89IIOO1LOUX4YYZIIOO14DSVWY`bcIdEe4ffgIIOOD! rD   rj   ri   rk   NNNNr  r  r  r  __doc__synopsisrG   SambaOptionsVersionOptionsCredentialsOptionstakes_optiongroupsr   r   takes_optionsr(  r	  r`   rD   rB   r  r    sT     H ))--.. 	tW#JQT3	(M
"rD   r  c            	           \ rS rSrSrSrS/r\R                  \R                  \R                  S.r\" SSS\S	S
S9/rSS jrSrg)cmd_listi  zList GPOs for an account.z&%prog <username|machinename> [options]accountnamer  r  r  r  r  r  r  Nc                 >
   UR                  5       U l        UR                  U R                  SS9U l        [	        U R                  U R                  U5      U l        U R                  5          U R                  R                  S[        R                  " U5      < S[        R                  " U5      < S3S9nUS   R                  n U R                  R                  U[        R                  S	/S
9S   nSUS	   ;   n[        [         -  n	U R
                  b)  U R
                  R#                  S5      (       a	  U	[$        -  n	[&        R(                  R+                  U R                  U R                  UU	S9n
U
R,                  n/ nSn[        R.                  " U R                  [1        U5      5      R3                  5       n U R                  R                  U[        R                  SS/S
9S   nSU;   Ga  [5        [1        US   S   5      5      nU GH  nU(       d  US   [6        R8                  -  (       d  M(  US   [6        R:                  -  (       a  ME   [<        R>                  [<        R@                  -  [<        RB                  -  nU R                  R                  US   [        R                  / SQSU-  /S9nUS   S   S   n[E        [<        RF                  U5      n [&        R<                  RM                  UU[<        RN                  [<        RP                  -  [<        RR                  -  5        [W        [Y        US   SS5      5      nU(       a  U[6        RZ                  -  (       a  GM]  U(       d  U[6        R\                  -  (       a  GM  UR_                  US   S   S   US   S   S   45        GM     [W        [Y        USS5      5      nU[6        R`                  -  (       a  SnXR                  Rc                  5       :X  a  OUR3                  5       nGM[  U(       a  SnOSnU RH                  RK                  SU< SU< S 35        U H-  nU RH                  RK                  S!US   < SUS"   < S 35        M/     g ! [         a    [        SU-  5      ef = f! [         a    [        SU-  5      ef = f! [         a&    U RH                  RK                  SUS   -  5         GM  f = f! [T         a-    U RH                  RK                  SUR                  -  5         GM  f = f)#NTr  z(&(|(samAccountName=z)(samAccountName=z$))(objectClass=User)))rz   r   zFailed to find account %sobjectClass)rx   ry   r{   computerz!Failed to find objectClass for %sldap)lp_ctxrQ   session_info_flagsr   	gPOptionsrG   rQ   )rr   rs   r@   rp   rw   )rx   ry   r{   r|   rp   z8Failed to fetch gpo object with nTSecurityDescriptor %s
zFailed access check on %s
r@   rs   rr   Fuserz	GPOs for r<   r%  z    rO   )2r&  ri   r'  rj   rn   rk   r  r   r   r   r   rQ   rh   r   r   r   r   rU   r   sambaauthuser_sessionsecurity_tokenr   r   parentr]   r	   GPLINK_OPT_ENFORCEGPLINK_OPT_DISABLEr
   SECINFO_OWNERSECINFO_GROUPSECINFO_DACLr   
descriptorr   r   access_checkSEC_STD_READ_CONTROLSEC_ADS_LISTSEC_ADS_READ_PROPrV   rX   r$   GPO_FLAG_MACHINE_DISABLEGPO_FLAG_USER_DISABLErW   GPO_BLOCK_INHERITANCEr}   )r   r6  r  r  r  r  r   user_dnis_computerr<  sessiontokengposinheritrQ   glistr[   r   gmsgsecdesc_ndrsecdescr@   	gpoptionsmsg_strs                           rB   r(  cmd_list.run  s|   ((*--dgg-M
$''4::q1	J**##%(%6%6{%CSEVEVWbEc0e# fC!fiiG
	R**##}o#^_`aC$M(::K ?=> 88DHH$7$7$?$?"EE**))$**TWW=O * Q &&VVDJJG-446**##3>>(T_I`#abcdC3$SXq)9%:;A"AiL4;R;R,R |d&=&== !$,$:$:$,$:$:%;$,$9$9%:  $zz00agS^^8P;JX;U:V  1  X '+1g.D&Ea&H",X-@-@+"N!33GU4<4Q4Q4<4I4I5J4<4N4N5OP  T!Wgq ABE"0M0M(M &ED4N4N,N KKa!7!:DGFOA<N OPI N Lk1=>I4555ZZ2244Bc f  GG		g{CDAIIOOQqT1Q489 g  	J:[HII	J  	RB[PQQ	RN % !		(c()$)0 1 ! ( !		(E(NO !s?   ,AQ: 5R B
R2AS%:RR/2+S"!S"%2TTr*  r+  )r  r  r  r  r-  r.  
takes_argsrG   r/  r0  r1  r2  r   r   r3  r(  r	  r`   rD   rB   r5  r5    sY    #7HJ))--.. 	tW#JS	2M
a:rD   r5  c                       \ rS rSrSrSr\R                  \R                  \R                  S.r
S/r\" SS\S9/rSS
 jrSrg	)cmd_showiI  zShow information for a GPO.%prog <gpo> [options]r  r   r  r  r  r  Nc                 	   UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        U R                  5          [        U R                  U5      S   n US   S   n[        [        R                  U5      n	U	R!                  5       n
U R"                  R%                  S
US   S   -  5        U R"                  R%                  SUS   S   -  5        U R"                  R%                  SUS   S   -  5        SU;   a$  U R"                  R%                  SUS   S   -  5        SU;   a$  U R"                  R%                  SUS   S   -  5        U R"                  R%                  SUR&                  -  5        U R"                  R%                  S[)        USS5      -  5        U R"                  R%                  S[+        [-        [)        USS5      5      5      -  5        U R"                  R%                  SU
-  5        [/        USU R                  U R                  S9nU R                  R1                  S5      nSR3                  UR5                  5       SUS /5      n/ nS! GH%  n [        [6        R8                  UR;                  X-  5      5      nURH                   H  nURJ                  S#:X  a  M  0 nURL                  US$'   URJ                  US%'   UUS&'   [O        URP                  5      US''   URR                  US('   [Q        US(   5      [T        :X  a]  URP                  [V        :X  a8  US(   RY                  S)5      nUR[                  S*5      R]                  S*5      US('   O[_        US(   5      US('   URa                  U5        M     GM(     U R"                  R%                  S+5        [b        Rd                  " XR"                  S,S-9  U R"                  R%                  S.5        g ! [         a    [        SU-  5      ef = f! [         a    S	n
 GNwf = f! [<         aQ  nUR>                  S   [@        [B        [D        4;   a   S nAGM  UR>                  S   [F        :X  a  [        S"5      ee S nAff = f)/NTr  rg      rl   r   GPO '%s' does not existrp   z<hidden>r  rr   r  rs   r   rt   ru   zMachine Exts : %s
rv   zUser Exts    : %s
r!  r"  rq   r#  r$  r@   zACL          : %s
sysvolri   rj   realmr   Policiesz%s\Registry.pol)MACHINEUSER:The authenticated user does not have sufficient privilegesz
**delvals.keyname	valuenameclassr  r   z	utf-16-le zPolicies     :
   )indentr%  )3r&  ri   r'  rj   rU   rk   r   rn   r  r   r   rh   r   r   r
   rI  as_sddlr   r   rQ   r$   rC   rX   r3   getr>   r   r   r   r   r   argsr-   r.   r/   r1   entriesro  rn  r,   r  r   bytesr6   decoderstriprS   r   rW   jsondump)r   r   r  r  r  r  dc_hostnamer   rY  rZ  secdesc_sddlr   ri  pol_filepolicy_defspolicy_classpol_datarm   entrydefsr   s                        rB   r(  cmd_show.runZ  s6   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH	@tzz3/2C	&45a8K !4!4kBG"??,L 			-FA>?		-M0B10EEF		-4D0Ea0HHI%,IIOO1C8R4STU4VVW"c)IIOO1C8O4PQR4SST		-67		-S/SV0WWX		-0@\RUW^`aEbAc0dde		-<= k&!%$(JJ0
 G$99ekkmZ 24 5/L%dii&*mmH4K&LN "))??l2"'--Y$)OO[! ,W*5::6V$zzVV%.zz\1#F|22;?'+{{6':'@'@'HV'+DL'9V""4(! * 0> 			*+		+yy3		C  	@83>??	@  	&%L	&: ! 66!9!>!@!@!B B 66!9 77& (H I Is<   3Q 2Q' +Q:Q$'Q76Q7:
S"S-#SSr*  r+  r  r  r  r  r-  r.  rG   r/  r0  r1  r2  r^  r   r   r3  r(  r	  r`   rD   rB   r`  r`  I  sT    %&H ))--.. J 	tALMRrD   r`  c                       \ rS rSrSrSr\R                  \R                  \R                  S.r
S/r\" SS\S9\" S	S
\S9\" SSSS/SS9\" SSSS/SS9\" SSSSS9/r    SS jrSrg)cmd_loadi  a  Load policies onto a GPO.

Reads json from standard input until EOF, unless a json formatted
file is provided via --content.

Example json_input:
[
    {
        "keyname": "Software\Policies\Mozilla\Firefox\Homepage",
        "valuename": "StartPage",
        "class": "USER",
        "type": "REG_SZ",
        "data": "homepage"
    },
    {
        "keyname": "Software\Policies\Mozilla\Firefox\Homepage",
        "valuename": "URL",
        "class": "USER",
        "type": "REG_SZ",
        "data": "google.com"
    },
    {
        "keyname": "Software\Microsoft\Internet Explorer\Toolbar",
        "valuename": "IEToolbar",
        "class": "USER",
        "type": "REG_BINARY",
        "data": [0]
    },
    {
        "keyname": "Software\Policies\Microsoft\InputPersonalization",
        "valuename": "RestrictImplicitTextCollection",
        "class": "USER",
        "type": "REG_DWORD",
        "data": 1
    }
]

Valid class attributes: MACHINE|USER|BOTH
Data arrays are interpreted as bytes.

The --machine-ext-name and --user-ext-name options are multi-value inputs
which respectively set the gPCMachineExtensionNames and gPCUserExtensionNames
ldap attributes on the GPO. These attributes must be set to the correct GUID
names for Windows Group Policy to work correctly. These GUIDs represent
the client side extensions to apply on the machine. Linux Group Policy does
not enforce this constraint.
{35378EAC-683F-11D2-A89A-00C04FBBCFA2} is provided by default, which
enables most Registry policies.
ra  r  r   r  r  rb  	--contentJSON file of policy inputs--machine-ext-namerW   machine_exts&{35378EAC-683F-11D2-A89A-00C04FBBCFA2}z;A machine extension name to add to gPCMachineExtensionNames)actionr  defaultr  --user-ext-name	user_extsz5A user extension name to add to gPCUserExtensionNamesz	--replace
store_trueFz8Replace the existing Group Policies, rather than mergingr  r  r  Nc
                    Uc  S/nUc  S/nUc3  [         R                  " [        R                  R	                  5       5      n
O[[
        R                  R                  U5      (       a,  [        US5       n[         R                  " U5      n
S S S 5        O[        S5      eUR                  5       U l        UR                  U R                  SS9U l        [        U R                  U R                  U5      U l        U R#                  5         [%        XR                  U R                  U R&                  U5      nU H  nUR)                  US5        M     U H  nUR)                  US5        M      U(       a  UR+                  W
5        g UR-                  W
5        g ! , (       d  f       GN= f! [.         a(  nUR0                  S   [2        :X  a  [        S	5      ee S nAff = f)
Nr  r   $The JSON content file does not existTr  ru   rv   r   rm  )r{  loadssysstdinr   r   r   existsr   loadr   r&  ri   r'  rj   rn   rk   r  r5   r   register_extension_name	replace_smerge_sr   rv  r1   )r   r   r  contentr  r  replacer  r  r  r  rregext_namerm   s                  rB   r(  cmd_load.run  s    DELABI?**SYY^^%56KWW^^G$$gt$"iil %$ EFF((*--dgg-M
$''4::q1#C$**djj!L$H''2LM %!H''2IJ "
	k*K(% %$&  	vvay33" $D E E 	s*   3F+F( F( 
F%(
G2#GGr*  )NNNNFNNNr  r`   rD   rB   r  r    s    0d 'H ))--.. J 	tAL{!=CH#.=>N	P 	 +=>H	J 	{<N	PM (,FJ#rD   r  c                       \ rS rSrSrSr\R                  \R                  \R                  S.r
S/r\" SS\S9\" S	S
\S9\" SS/ SSS9\" SS/ SSS9/r  SS jrSrg)
cmd_removei!  a  Remove policies from a GPO.

Reads json from standard input until EOF, unless a json formatted
file is provided via --content.

Example json_input:
[
    {
        "keyname": "Software\Policies\Mozilla\Firefox\Homepage",
        "valuename": "StartPage",
        "class": "USER",
    },
    {
        "keyname": "Software\Policies\Mozilla\Firefox\Homepage",
        "valuename": "URL",
        "class": "USER",
    },
    {
        "keyname": "Software\Microsoft\Internet Explorer\Toolbar",
        "valuename": "IEToolbar",
        "class": "USER"
    },
    {
        "keyname": "Software\Policies\Microsoft\InputPersonalization",
        "valuename": "RestrictImplicitTextCollection",
        "class": "USER"
    }
]

Valid class attributes: MACHINE|USER|BOTH
ra  r  r   r  r  rb  r  r  r  rW   r  z@A machine extension name to remove from gPCMachineExtensionNames)r  r  r  r  r  r  z:A user extension name to remove from gPCUserExtensionNamesNc	                    Uc  / nUc  / nUc3  [         R                  " [        R                  R	                  5       5      n	O[[
        R                  R                  U5      (       a,  [        US5       n
[         R                  " U
5      n	S S S 5        O[        S5      eUR                  5       U l        UR                  U R                  SS9U l        [        U R                  U R                  U5      U l        U R#                  5         [%        XR                  U R                  U R&                  U5      nU H  nUR)                  US5        M     U H  nUR)                  US5        M      UR+                  W	5        g ! , (       d  f       N= f! [,         a(  nUR.                  S   [0        :X  a  [        S5      ee S nAff = f)	Nr   r  Tr  ru   rv   r   rm  )r{  r  r  r  r   r   r   r  r   r  r   r&  ri   r'  rj   rn   rk   r  r5   r   unregister_extension_nameremove_sr   rv  r1   )r   r   r  r  r  r  r  r  r  r  r  r  r  rm   s                 rB   r(  cmd_remove.runW  so   LI?**SYY^^%56KWW^^G$$gt$"iil %$ EFF((*--dgg-M
$''4::q1#C$**djj!L$H))(4NO %!H))(4KL "	LL% %$   	vvay33" $D E E 	s$   1E;)F ;
F	
F>#F99F>r*  NNNNNNNr  r`   rD   rB   r  r  !  s    @ 'H ))--.. J 	tAL{!=CH#RnS	U 	 RkM	O	M KO7;rD   r  c                       \ rS rSrSrSr\R                  \R                  \R                  S.r
S/r\" SS\S9/r  SS
 jrSrg	)cmd_getlinkix  zList GPO Links for a container.%prog <container_dn> [options]r  r   r  r  rb  Nc                    UR                  5       U l        UR                  U R                  SS9U l        [	        U R                  U R                  U5      U l        U R                  5          U R                  R                  U[        R                  SS/S9S   nSU;   a  US   (       a  U R                  R                  SU-  5        [        [!        US   S   5      5      nU H  n[#        U R                  US	   S
9nU R                  R                  SUS   S   S   -  5        U R                  R                  SUS   S   S   -  5        U R                  R                  S[%        US   5      -  5        U R                  R                  S5        M     g U R                  R                  SU-  5        g ! [         a    [        SU-  5      ef = f)NTr  r   r   r   r   r   zGPO(s) linked to DN %s
rQ   )rQ   z    GPO     : %s
rr   z    Name    : %s
rs   z    Options : %s
rG   r%  zNo GPO(s) linked to DN=%s
)r&  ri   r'  rj   rn   rk   r  r   r   r   r   rh   r   r   r   r]   r   r   rH   )	r   r   r  r  r  r  r   rd   r[   s	            rB   r(  cmd_getlink.run  s    ((*--dgg-M
$''4::q1	O**##S^^/@+3* $ 6679C s?s8}IIOO6EF!#c(mA&6"78F"4::!D':		 4s1vf~a7H HI		 4s1vm7LQ7O OP		 47LQy\7Z Z[		%  IIOO9LHI  	O>MNN	Os   ,.F5 5Gr*  r+  r  r`   rD   rB   r  r  x  s_    )/H ))--.. !!J 	tALM BFJrD   r  c            
           \ rS rSrSrSr\R                  \R                  \R                  S.r
SS/r\" SS\S	9\" S
SSSSS9\" SSSSSS9/r  SS jrSrg)cmd_setlinki  z(Add or update a GPO link to a container.$%prog <container_dn> <gpo> [options]r  r   r   r  r  rb  z	--disabledisabledFr  zDisable policyr  r  r  r  z	--enforceenforcedzEnforce policyNc	                    UR                  5       U l        UR                  U R                  SS9U l        [	        U R                  U R                  U5      U l        U R                  5         Sn	U(       a  U	[        R                  -  n	U(       a  U	[        R                  -  n	 [        U R                  US9S     [        [        U R                  U5      5      n
 U R                  R!                  U["        R$                  SS/S9S   nS
nSU;   a~  ['        [        US   S   5      5      nSnS
nU H0  nUS   R)                  5       U
R)                  5       :X  d  M*  XS'   Sn  O   U(       a  [        SU-  5      eUR+                  SXS.5        O/ nUR-                  XS.5        [/        U5      n["        R0                  " 5       n["        R2                  " U R                  U5      Ul        U(       a*  ["        R6                  " U["        R8                  S5      US'   O)["        R6                  " U["        R:                  S5      US'    U R                  R=                  U5        U R>                  RA                  S5        [C        5       RE                  XXgU5        g ! [         a    [        SU-  5      ef = f! [         a    [        S	U-  5      ef = f! [         a  n[        SU5      eS nAff = f)NTr  r   r   rf  r   r   r   r   FrQ   rG   z)GPO '%s' already linked to this containerrP   	new_valuezError adding GPO LinkzAdded/Updated GPO link
)#r&  ri   r'  rj   rn   rk   r  r	   rE  rD  r   r   rh   r   r   r4   r   r   r   r]   r   insertrW   re   r   r   rQ   r   r   FLAG_MOD_ADDr   r   r   r  r(  )r   r   r   r  r  r  r  r  r  gplink_optionsr   r   existing_gplinkrd   r   r[   r   r   rm   s                      rB   r(  cmd_setlink.run  s    ((*--dgg-M
$''4::q1d555Nd555N	@-a0 Z

C01	O**##S^^/@+3* $ 6679C  s?!#c(mA&6"78F"OET7==?flln4#1iL E	 
 "#NQT#TUUa!JKFMMCD"6*
KKMvvdjj,/ //
C<P<PRZ[AkN //
C<L<LhWAkN	;JJa  			23,9L_  	@83>??	@  	O>MNN	OD  	;6::	;s0   "J .J1 K J.1K

K(K##K(r*  )NFFNNNr  r`   rD   rB   r  r    s    25H ))--.. !%(J 	tAL{U<$	&{U<$	&	M GL7;BMrD   r  c                       \ rS rSrSrSr\R                  \R                  \R                  S.r
SS/r\" SS\S	9/r  SS jrSrg
)cmd_dellinki  z!Delete GPO link from a container.r  r  	containerr   r  r  rb  Nc                    UR                  5       U l        UR                  U R                  SS9U l        [	        U R                  U R                  U5      U l        U R                  5          [        U R                  US9S     [        R                  " U R                  U5      n[        U R                  Xr5        U R                  R                  S5        [!        5       R#                  XsXEU5        g ! [         a    [        SU-  5      ef = f)NTr  r  r   rf  zDeleted GPO link.
)r&  ri   r'  rj   rn   rk   r  r   r   rh   r   r   r   r   r   r   r  r(  )r   r  r   r  r  r  r  r   s           rB   r(  cmd_dellink.run  s     ((*--dgg-M
$''4::q1	@-a0 vvdjj)4TZZ3		-.,9L  	@83>??	@s   ,C1 1D
r*  r+  r  r`   rD   rB   r  r    sa    +5H ))--.. u%J 	tALM DHMrD   r  c                       \ rS rSrSrSr\R                  \R                  \R                  S.r
S/r\" SS\S9/r  SS
 jrSrg	)cmd_listcontainersi(  z%List all linked containers for a GPO.ra  r  r   r  r  rb  Nc                    UR                  5       U l        UR                  U R                  SS9U l        [	        U R                  U R                  U5      U l        U R                  5         [        U R                  U5      n[        U5      (       aI  U R                  R                  SU-  5        U H$  nU R                  R                  SUS   -  5        M&     g U R                  R                  SU-  5        g )NTr  zContainer(s) using GPO %s
z    DN: %s
rQ   zNo Containers using GPO %s
)r&  ri   r'  rj   rn   rk   r  r   r   rT   r   r   )r   r   r  r  r  r  r   r   s           rB   r(  cmd_listcontainers.run9  s     ((*--dgg-M
$''4::q1 S1s88IIOO9C?@		4 89  IIOO:S@ArD   r*  r+  r  r`   rD   rB   r  r  (  s\    /&H ))--.. J 	tALM 9=BrD   r  c                       \ rS rSrSrSr\R                  \R                  \R                  S.r
S/r\" SS\S9/r  SS
 jrSrg	)cmd_getinheritanceiL  z%Get inheritance flag for a container.r  r  r   r  r  rb  Nc                 6   UR                  5       U l        UR                  U R                  SS9U l        [	        U R                  U R                  U5      U l        U R                  5          U R                  R                  U[        R                  SS/S9S   nSnSU;   a  [        US   S   5      nU[        R                  :X  a  U R                   R#                  S5        g U R                   R#                  S	5        g ! [         a    [        SU-  5      ef = f)
NTr  r   r=  r   r   r   z$Container has GPO_BLOCK_INHERITANCE
zContainer has GPO_INHERIT
)r&  ri   r'  rj   rn   rk   r  r   r   r   r   rh   r   rX   r	   rP  r   r   )r   r   r  r  r  r  r   inheritances           rB   r(  cmd_getinheritance.run]  s    ((*--dgg-M
$''4::q1	O**##S^^/@+6- $ 99:<C #c+.q12K$444IIOOCDIIOO9:  	O>MNN	Os   ,.C? ?Dr*  r+  r  r`   rD   rB   r  r  L  s^    //H ))--.. !!J 	tALM BF;rD   r  c                       \ rS rSrSrSr\R                  \R                  \R                  S.r
SS/r\" SS\S	9/r  SS jrSrg
)cmd_setinheritanceix  z$Set inheritance flag on a container.z.%prog <container_dn> <block|inherit> [options]r  r   inherit_stater  r  rb  Nc                    UR                  5       S:X  a  [        R                  nO3UR                  5       S:X  a  [        R                  nO[	        SU-  5      eUR                  5       U l        UR                  U R                  SS9U l        [        U R                  U R                  U5      U l
        U R                  5          U R                  R                  U[        R                  SS/S9S	   n[        R"                  " 5       n	[        R$                  " U R                  U5      U	l        SU;   a3  [        R(                  " [+        U5      [        R,                  S5      U	S'   O2[        R(                  " [+        U5      [        R.                  S5      U	S'    U R                  R1                  U	5        g ! [          a    [	        S
U-  5      ef = f! [          a  n
[	        SU-  U
5      eS n
A
ff = f)NblockrV  zUnknown inheritance state (%s)Tr  r   r=  r   r   r   r  z"Error setting inheritance state %s)r   r	   rP  GPO_INHERITr   r&  ri   r'  rj   rn   rk   r  r   r   r   r   rh   r   r   rQ   r   r   r   r  r   )r   r   r  r  r  r  r  r  r   r   rm   s              rB   r(  cmd_setinheritance.run  s     G+44K  "i/**K?-OPP((*--dgg-M
$''4::q1	O**##S^^/@+6- $ 99:<C KKMvvdjj,/# //K0@#BVBVXcdAkN //K0@#BRBRT_`AkN	XJJa   	O>MNN	O  	XCmSUVWW	Xs$   .F5 G 5G
G/G**G/r*  r+  r  r`   rD   rB   r  r  x  sa    .?H ))--.. !/2J 	tALM QU"XrD   r  c                       \ rS rSrSrSr\R                  \R                  \R                  S.r
S/r\" SS\S9\" S	S
\S9/rSS jrSrg)	cmd_fetchi  zDownload a GPO.ra  r  r   r  r  rb  --tmpdir,Temporary directory for copying policy filesNc                 @   UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        U R                  5          [        U R                  U5      S   n[        US   S   5      n	 [        U	5      u  pn[!        X{U R                  U R                  S
9nU R#                  X15      u  p> [%        XU5        U R&                  R)                  SU-  5        g ! [         a    [        SU-  5      ef = f! [         a    [        S	U	-  5      ef = f! [         a  n[        SU5      eS nAff = f)NTr  rg   rd  re  r   rf  rt   Invalid GPO path (%s)rh  Error copying GPO from DCGPO copied to %s
)r&  ri   r'  rj   rU   rk   r   rn   r  r   r   rh   r   r   r   r   r3   r   r   r   r   )r   r   r  r   r  r  r  r}  r   r   dom_nameservice	sharepathr   r   rm   s                   rB   r(  cmd_fetch.run  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH	@tzz3/2C
 #&'*+	>-6s^*X	
 ktww$(JJ0 ..v;	?*4FC 			,v56-  	@83>??	@  	>6<==	>  	?:A>>	?s0   3E
 E& F 
E#&E?
FFFr*  NNNNNr  r`   rD   rB   r  r    sa    &H ))--.. J 	tALz NUXYM
&7rD   r  c            
           \ rS rSrSrSr\R                  \R                  \R                  S.r
S/r\" SS\S9\" S	S
\S9\" SSSSS9\" SSS\S9/r  SS jr\S 5       rSrg)
cmd_backupi  zBackup a GPO.ra  r  r   r  r  rb  r  r  z--generalizez"Generalize XML entities to restoreFr  r  r  r  
--entitiesz4File to export defining XML entities for the restoreent_file)r  r  r  Nc	                 |   UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  n	X l        OD[        U R                  U R                  5      n	[        U R                  U R                  U	S9U l        U R                  5          [        U R                  U5      S   n
[        U
S   S   5      n [        U5      u  pn[!        XU R                  U R                  S
9nU R#                  X15      u  nn [%        XU5        U R&                  R)                  SU-  5        U(       Ga  U R&                  R)                  S5        [*        R-                  U R&                  UU5      nUR/                  5        VVs/ s H
  u  nnUU4PM     nnnUR1                  5         SR3                  S U 5       5      nU(       aE  [5        US5       nUR)                  U5        S S S 5        U R&                  R)                  SU-  5        O6U R&                  R)                  S5        U R&                  R)                  U5        S HX  nUU
;   d  M  [5        [6        R8                  R3                  UUS-   5      S5       nUR)                  U
U   S   5        S S S 5        MZ     g ! [         a    [        SU-  5      ef = f! [         a    [        S	U-  5      ef = f! [         a  n[        SU5      eS nAff = fs  snnf ! , (       d  f       GN= f! , (       d  f       M  = f)NTr  rg   rd  re  r   rf  rt   r  rh  r  r  z(
Attempting to generalize XML entities:
rJ   c              3   V   #    U  H  u  pS UR                  S5       SU S3v   M!     g7f)z	<!ENTITY z&;z "z">
N)rR   )ra   entvals      rB   rb   !cmd_backup.run.<locals>.<genexpr>0  s1      5+3xs 'syy&7r#dC+3s   ')wz$Entities successfully written to %s
z
Entities:
ru   rv   	.SAMBAEXTr   )r&  ri   r'  rj   rU   rk   r   rn   r  r   r   rh   r   r   r   r   r3   r   r   r   r   r  generalize_xml_entitiesitemsr   r>   r   r   r   )r   r   r  r   
generalizer  r  r  r  r}  r   r   r  r  r  r   r   rm   entitieskvent_listentsr   exts                            rB   r(  cmd_backup.run  s    ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH	@tzz3/2C
 #&'*+	>-6s^*X	
 ktww$(JJ0 ..v;	?,TfE
 			,v56IIOOHI!99$))V:@BH ,4>>+;<+;41aA+;H<MMO77 5+35 5D (C(AGGDM )		 G (!) * 		0		% ICcz"'',,vs[/@A4HAGGCHQK( IH I[  	@83>??	@  	>6<==	>  	?:A>>	? = )( IHsN   3J> K  K6 !L0LL,>KK36
L LL
L),
L;	c                    0 n[         R                  R                  U5      (       d  [         R                  " U5        U/nU/nU(       Ga  UR	                  5       nUR	                  5       n[         R
                  " U5      nUR                  5         U GH  n	[         R                  R                  Xi5      n
[         R                  R                  Xy5      n[         R                  R                  U
5      (       a`  UR                  U
5        UR                  U5        [         R                  R                  U5      (       d  [         R                  " U5        M  M  U
R                  S5      (       a~  [         R                  R                  U
5      S S n[        U5      n [        U
S5       nUR                  5       nS S S 5        [        R                   " W5      nUR#                  UX5      nGMZ  [         R                  R)                  X5      (       a  GM  [*        R,                  " X5        GM     U(       a  GM  U$ ! , (       d  f       N= f! [$         a    U R'                  SU-  5         GM  f = f)Nr   r  z%SKIPPING: Generalizing failed for %s
)r   r   r  r   r   r   r   r>   r   rW   endswithbasenamer   r   r   ET
fromstringgeneralize_xmlr   r   samefileshutilcopy2)r   	sourcedir	targetdirr  r   r   r   r   r   rm   r   r   to_parser   ltempr   concrete_xmlfound_entitiess                     rB   r  "cmd_backup.generalize_xml_entitiesB  s   ww~~i((HHYJJLEJJLEjj'GLLNe/e/77==((MM&)MM&)77>>&11( 2 v.. $&77#3#3F#;CR#@!,X!6\!%fc!2e',zz| "3 ,.==+>L-3-B-B<QW-bN  "ww//??"LL8C  fR # "3!2
  5 \ JJ'ORZ'Z[[\s*   I)H;:0I;
I		II/.I/r*  )NNFNNNN)r  r  r  r  r-  r.  rG   r/  r0  r1  r2  r^  r   r   r3  r(  staticmethodr  r	  r`   rD   rB   r  r    s    &H ))--.. J 	tALz NUXY~$H\	3|"XS	*M IM6:A)F 1 1rD   r  c                       \ rS rSrSrSr\R                  \R                  \R                  S.r
S/r\" SS\S9\" S	S
\S9/r  SS jrSrg)
cmd_createiw  zCreate an empty GPO.z%prog <displayname> [options]r  r   r  r  rb  r  r  Nc                    UR                  5       U l        UR                  U R                  SS9U l        [	        U R                  U R                  S9nU(       ac  UR                  S5      (       aM  USS  nX l        [        R                  [        R                  -  [        R                  -  n	UR                  XS9n
O[        R                  [        R                  -  [        R                  -  n	UR                  U R                  R                  S5      U	S9n
U
R                  n[        U R                  U R                  US	9U l        U R                  5         [!        U R"                  US
9nUR$                  S:  a  ['        SU-  5      e[)        [*        R,                  " 5       5      nSUR/                  5       -  nXl        U
R2                  nSU< SU< SU< 3nU R5                  X=5      u  U l        nUU l         [:        R<                  " [:        R>                  RA                  US5      5        [:        R<                  " [:        R>                  RA                  US5      5        Sn[C        [:        R>                  RA                  US5      S5      RE                  U5        [I        U5      u  nnnUU l%        [M        UUU R                  U R                  S9nUU l'        U R"                  RQ                  5          [S        U R"                  U5      n[T        RV                  " 5       nUUl,        [T        RZ                  " S[T        R\                  S5      US'   U R"                  R_                  U5        [T        RV                  " 5       n[T        R`                  " U R"                  S[)        U5      -  5      Ul,        [T        RZ                  " S[T        R\                  S5      US'   U R"                  R_                  U5        [T        RV                  " 5       n[T        R`                  " U R"                  S[)        U5      -  5      Ul,        [T        RZ                  " S[T        R\                  S5      US'   U R"                  R_                  U5        [b        Rd                  [b        Rf                  -  [b        Rh                  -  n[!        U R"                  UUS9S   nUS   S   n[k        [b        Rl                  U5      Ro                  5       n[b        Rp                  " U R"                  Rs                  5       5      n[u        UU5      n[b        Rl                  Rw                  UU5      n[y        UU5        [b        Rd                  [b        Rf                  -  [b        Rh                  -  [b        Rz                  -  nUR}                  UUU5        [        UUU5        [T        RV                  " 5       nUUl,        [T        RZ                  " U[T        R                  S 5      US!'   [T        RZ                  " U[T        R                  S"5      US#'   [T        RZ                  " S$[T        R                  S%5      US&'   [T        RZ                  " S'[T        R                  S(5      US)'   [T        RZ                  " S$[T        R                  S*5      US+'   S,/n U R"                  R                  UU S-9  U R"                  R                  5         Uc   [        R                  " U R6                  5        U R                  RE                  S.U< S/U< S035        g ! [F         a  n['        SU5      eS nAff = f! [F         a    U R"                  R                  5         e f = f)1NTr  )rj   ri   rg   rd  )addressr@   ri  )domainr@   re  )r   r   z%A GPO already existing with name '%s'{%s}r   z\sysvol\z
\Policies\MachineUserz[General]
Version=0
zGPT.INIr  zError Creating GPO filesrh  groupPolicyContainerr8  a01
CN=User,%sr  CN=Machine,%s)r   r   rp   rs   a02rt   a03r#  rq   a052gpcFunctionalityVersiona07r@   a04zpermissive_modify:0)r|   zGPO 'z' created as r%  )Gr&  ri   r'  rj   r   rU   rk   r   NBT_SERVER_LDAPNBT_SERVER_DSNBT_SERVER_WRITABLEfinddcru  pdc_dns_namern   r  r   r   countr   r   uuiduuid4uppergpo_name
dns_domainr   r   r   r   r   r   r>   r   r   rh   r   r  r3   r   transaction_startr4   r   r   rQ   r   r  addr   r
   rF  rG  rH  r   rI  rt  dom_sidget_domain_sidr   	from_sddlr2   SECINFO_PROTECTED_DACLset_aclr   r   r   transaction_committransaction_cancelr  rmtreer   )!r   r   r  r   r  r  r  netr}  r@   	cldap_retr   guidr   ri  unc_pathr   gpt_contentsrm   r  r  r  r   r   r   ds_sd_flags	ds_sd_ndrds_sd
domain_sidsddlfs_sdsior|   s!                                    rB   r(  cmd_create.run  s    ((*--dgg-M


tww/ i((AB%KH((&&',,-E 

;
DI((&&',,-E 

$''++g*>e
LI#00KdggtzzkBDH4::;?99q=FTUU DJJL!tzz|#$$9>sK #33F@V	>HHRWW\\&)45HHRWW\\&&127Lfi0#6<<\J
 *38)<&7I"k7tww$(JJ0 	

$$&<	,

C0FAAD))*@#BRBRTabAeHJJNN1 A66$**lS[&@AAD))+s7G7GWAeHJJNN1 A66$**oF&CDAD))+s7G7GWAeHJJNN1 $11#112#001K tzzs[I!LC23A6Ix22I>FFHE "))$***C*C*EFJuj1D''11$
CE "$	2 ))))*(() 223C LLE3/ +4CAAD))+s7K7K][AeH))(C4H4HJZ[AeH))#s/C/C_UAeH))#s/C/CE^_AeH))#s/C/CWMAeH-.HJJa(3
 JJ))+>MM$++&		k3GH]  	>91==	>H  	JJ))+	s&   <B#\. 7O] .
]	8]]	&]2)r   rj   r%  r   ri   r  r   rk   r  r  r`   rD   rB   r
  r
  w  sm    .H ))--..  J 	tALz NUXYM
 NR~IrD   r
  c            
          ^  \ rS rSrSrSr\R                  \R                  \R                  S.r
SS/r\" SS\S	9\" S
S\S	9\" SS\S	9\" SSSSS9/rSS jr  SU 4S jjrSrU =r$ )cmd_restorei
  z!Restore a GPO to a new container.z/%prog <displayname> <backup location> [options]r  r   backupr  r  rb  r  r  r  z8File defining XML entities to insert into DOCTYPE headerz--restore-metadataz7Keep the old GPT.INI file and associated version numberFr  r  c                    Sn[         R                  R                  U5      (       d  [         R                  " U5        U/nU/nU(       Ga  UR	                  5       nUR	                  5       n[         R
                  " U5      n	U	R                  5         U	 GH  n
[         R                  R                  Xz5      n[         R                  R                  X5      n[         R                  R                  U5      (       a`  UR                  U5        UR                  U5        [         R                  R                  U5      (       d  [         R                  " U5        M  M  UR                  S5      (       d  M  [         R                  R                  U5      S S n[        U5      n [        US5       nUR                  5       nSnUR                  U5      (       a:  U[!        U5      S  nUR#                  [$        R&                  " UU-   U-   5      5        O(UR#                  [$        R&                  " UU-   5      5        UR)                  US S 5        S S S 5        GM     U(       a  GM  g g ! , (       d  f       GM  = f! [*         a`    US S U-   n[,        R.                  " UUS S 5        U R0                  R3                  SU-  5        U R0                  R3                  S5         GML    SS KnUR7                  5         US S U-   n[,        R.                  " UUS S 5        U R0                  R3                  S	U-  5        U R0                  R3                  S5         GM  = f)
Nr   r   r  r  z&<?xml version="1.0" encoding="utf-8"?>zWARNING: No such parser for %s
z.WARNING: Falling back to simple copy-restore.
r   z%WARNING: Error during parsing for %s
)r   r   r  r   r   r   r   r>   r   rW   r  r  r   r   r   rU   rT   load_xmlr  r  write_binaryr   r  r   r   r   	traceback	print_exc)r   r  r  
dtd_headerr   r   r   r   r   r   rm   r   r   r  r   r  r   xml_headoriginal_filerD  s                       rB    restore_from_backup_to_local_dir,cmd_restore.restore_from_backup_to_local_dir  s   ww~~i((HHYJJLEJJLEjj'GLLNe/e/77==((MM&)MM&)77>>&11( 2 v.. $&77#3#3F#;CR#@!,X!6#_!%fc!2e',zz|+S#'??8#<#< ,0H+?D %+OOBMM(ZBWZ^B^4_$`$*OOBMM*tBS4T$U !' 3 3F3BK @! "3!2%  f0 "3!2$  3 _,23BK&,@M"LLsD IIOO,NQY,YZ IIOO,]^^	_,%//1 -33BK&,@M"LLsD IIOO,TW],]^ IIOO,]^^s3   I6+BI#
I6#
I3	-I63I66A%MA0Mc
                   > Sn
[         R                  R                  U5      (       d  [        SU-  5      eUb  Sn
[         R                  R                  U5      (       d  [        SU-  5      e[	        US5       nUR                  5       n[        R                  " SU[        R                  [        R                  -  S9 c  [        S5      eXR                  5       -  n
S S S 5        U
S	-  n
[        TU ]1  XXFXx5         Uc)  U R                  X@R                  5      u  U l        nXl        U R#                  X R                   U
5        U	(       + n[%        U R&                  U R                   U R(                  S
US9  [+        U R,                  U R                  5      nS H  n[         R                  R/                  UUS-   5      n[         R                  R                  U5      (       d  ML  [	        US5       nUR                  5       nS S S 5        [0        R2                  " 5       nUUl        [0        R6                  " W[0        R8                  U5      UU'   U R,                  R;                  U5        M     Uc!  [<        R>                  " U R                  5        g g ! , (       d  f       GN= f! , (       d  f       N= f! [@         a  nSS K!nURE                  5         U RF                  RI                  [K        U5      S-   5        U RF                  RI                  S5        [M        5       nUR                  U R                  X6Xx5        [        SU-  5      eS nAff = f)NrJ   z"Backup directory does not exist %sz<!DOCTYPE foobar [
zEntities file does not exist %sr  z*(\s*<!ENTITY\s+[a-zA-Z0-9_]+\s+.*?>)+\s*\Zr   zPEntities file does not appear to conform to format
e.g. <!ENTITY entity "value">z
]>
T)r   r   r  r  r   r   r%  z%Failed to restore GPO -- deleting...
zFailed to restore: %s)'r   r   r  r   r   r   r   r   	MULTILINEDOTALLrR   superr(  r   r%  r   r   rI  r   r   r  r4   r   r>   r   r   rQ   r   r   r   r  r0  rh   rD  rE  r   r   r   cmd_del)r   r   r@  r  r   r  r  r  r  restore_metadatarF  entities_fileentities_contentr   keep_new_filesr   r  ext_filer   r   r   rm   rD  cmd	__class__s                           rB   r(  cmd_restore.runc  s    
ww~~f%%CfLMM 0J77>>(++"#D#+$, - -h$#0#5#5#7  88I,BLL4JLOST& (G H H 4466
 % ("JKFxM/	<~&*&;&;FMM&R#V$ 11&++2<> "21N +499dkk+/>>?C?MO
  

DMM:F M77<<k0AB77>>(++h- vvx . A!AD //c6J6J035AcF JJ%%a( M ~dkk* c %$N .-  		<!IIOOCFTM*IIOODE)CGGDMM1G6:;;		<sF   9A%J=C$J6 %J6 1J%BJ6 
J"%
J3	/J6 6
M BMM)r   r   )rJ   r  )r  r  r  r  r-  r.  rG   r/  r0  r1  r2  r^  r   r   r3  rI  r(  r	  __classcell__)rV  s   @rB   r?  r?  
  s    +@H ))--..  *J 	tALz NUXY|"\cfg#*c\	3	MB_H ei/3O< O<rD   r?  c                       \ rS rSrSrSr\R                  \R                  \R                  S.r
S/r\" SS\S9/r  SS
 jrSrg	)rO  i  zDelete a GPO.ra  r  r   r  r  rb  Nc           	         UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        U R                  5          [        U R                  US9S   n[        US   S   5      n[        U5      u  pn[        XjU R                  U R                  S
9nU R                  R!                  5          [#        U R                  U5      n[%        U5      (       ab  U R&                  R)                  SU-  5        U H>  n[+        U R                  US   U5        U R&                  R)                  SUS   -  5        M@     [-        U R                  U5      nU R                  R/                  [0        R2                  " U R                  S[        U5      -  5      S/5        U R                  R/                  [0        R2                  " U R                  S[        U5      -  5      S/5        U R                  R/                  U5        UR5                  U5        U R                  R7                  5         U R&                  R)                  SU-  5        g ! [         a    [        S	U-  5      ef = f! [         a    U R                  R9                  5         e f = f)NTr  rg   rd  re  r  r   rt   rf  rh  zGPO %s is linked to containers
rQ   z    Removed link from %s.
r  ztree_delete:1r  zGPO %s deleted.
)r&  ri   r'  rj   rU   rk   r   rn   r  r   r   r   rh   r   r   r3   r'  r   rT   r   r   r   r4   deleter   r   deltreer.  r/  )r   r   r  r  r  r  r}  r   r4  r  r  r  r   r   r   s                  rB   r(  cmd_del.run  sc    ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH	@tzzs3A6C3/034H
 *38)<&Iktww$(JJ0 	

$$&	,$TZZ5C3xx		 BS HIA QtWc:IIOO$AAdG$KL 
  

C0FJJcffTZZF1KLN_`JJcffTZZ3v;1NORaQbcJJf% LL# JJ))+		+c12E  	@83>??	@8  	JJ))+	s   3(J6 #EK 6K&K8r*  r+  r  r`   rD   rB   rO  rO    s[    &H ))--.. J 	tALM 9=63rD   rO  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rSS jrSrg)cmd_aclchecki  z.Check all GPOs have matching LDAP and DS ACLs.r  r  r  r  r  r  r  r  Nc           	         UR                  5       U l        UR                  U R                  SS9U l        [	        U R                  U R                  U5      U l        U(       a"  UR                  S5      (       a  USS  nXl        OD[        U R                  U R                  5      n[	        U R                  U R                  US9U l        U R                  5         [        U R                  S 5      nU GHJ  n[        US   S   5      n [        U5      u  pn[        XZU R                  U R                  S	9nUR!                  U["        R$                  ["        R&                  -  ["        R(                  -  ["        R*                  5      nS
U;  a  [        S5      eUS
   S   n[-        ["        R.                  U5      R1                  5       n["        R2                  " U R                  R5                  5       5      n[7        UU5      nUR1                  U5      U:w  d  GM'  [        SUR1                  U5      < SU< SU< 35      e   g ! [         a    [        SU-  5      ef = f)NTr  rg   rd  re  rt   r   r  rh  rp   zKCould not read nTSecurityDescriptor. This requires an Administrator accountzInvalid GPO ACL z
 on path (z), should be )r&  ri   r'  rj   rn   rk   rU   r   r  r   r   r   r   r   r   r3   get_aclr
   rF  rG  rH  SEC_FLAG_MAXIMUM_ALLOWEDr   rI  rt  r)  r*  r   )r   r  r  r  r  r}  r   r   r   r  r  r  r   r;  r7  r8  r9  expected_fs_sddls                     rB   r(  cmd_aclcheck.run  s   ((*--dgg-M
$''4::q1 i((AB%KH'<KdggtzzkBDH4::t,Aa()!,-CB1:3.I
 "+477(,

4D LLH,B,BXE[E[,[^f^s^s,su}  vW  vW  XE%Q." $L M M 01!4Ix22I>FFHE "))$***C*C*EFJ*5*=j)-=="V[VcVcdnVoqz  }M  $N  O  O5 
  B"#:S#@AABs   I  Ir*  r+  r,  r`   rD   rB   r_  r_    sU    8 H ))--.. 	tW#JQT3	(M
-OrD   r_  c            
           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9\" SS\\R                  R                  \R"                  " 5       S5      S9/r  SS jrSrg)cmd_admxloadi>  z Loads samba admx files to sysvolr  r  r  r  r  r  r  r  z
--admx-dirz)Directory where admx templates are storedz
samba/admx)r  r  r  Nc                    UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nXl        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9nSR                  U R                  R                  S	5      R                  5       S
S/5      n UR                  U5        [$        R&                  " U5       H  u  pnU H  nU
R)                  US5      n[$        R*                  R                  X5      nSR                  X/5      R)                  SS5      nSR                  UU/5      n [-        UU5        [/        US5       n UR1                  UUR3                  5       5        S S S 5        M     M     U R4                  R7                  S5        g ! [         aE  n	U	R                  S   [        :X  a  [!        S5      eU	R                  S   ["        :w  a  e  S n	A	GN8S n	A	ff = f! [         aD  n	U	R                  S   [        :X  a  [!        S5      eU	R                  S   ["        :w  a  e  S n	A	NS n	A	ff = f! [         a-  n	U	R                  S   [        :X  a  [!        S5      e S n	A	GNS n	A	ff = f! , (       d  f       GM  = f)NTr  rg   rd  re  rg  rh  r   ri  rj  PolicyDefinitionsr   rm  rJ   r   r   a  Installing ADMX templates to the Central Store prevents Windows from displaying its own templates in the Group Policy Management Console. You will need to install these templates from https://www.microsoft.com/en-us/download/102157 to continue using Windows Administrative Templates.
)r&  ri   r'  rj   rU   rk   r   rn   r3   r>   ru  r   r   r   rv  r1   r   r0   r   walkr  r   r2   r   r   r   r   r   )r   r  r  r  r  admx_dirr}  r   smb_dirrm   dirnamedirsfilesfnamepath_in_admx	full_pathsub_dirsmb_pathr   s                      rB   r(  cmd_admxload.runP  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 ))TWW[[1779')<> ?	JJw %'GGH$5 G5&x<GGLL8	))W$;<DDS$O99gu%56)$8 )T*aQh9 +*  %6* 			 P 	Q9  	vvay33" $D E E== >		 % vvay$;;* ,L M M&EE F	 ) Q66!9(??". 0P #Q Q @Q +*s`   >G= I/K1 J =
I:II
J:JJ 
K	*"K	KK	K
K*r*  r  )r  r  r  r  r-  r.  rG   r/  r0  r1  r2  r   r   r   r   r>   r#   data_dirr3  r(  r	  r`   rD   rB   rf  rf  >  s    * H ))--.. 	tW#JQTC	)|"M"'',,u~~/?"N	PM FJ8QrD   rf  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9\" SSSSS9/r/ SQr  SS jrSrg)cmd_add_sudoersi  a  Adds a Samba Sudoers Group Policy to the sysvol

This command adds a sudo rule to the sysvol for applying to winbind clients.

The command argument indicates the final field in the sudo rule.
The user argument indicates the user specified in the parentheses.
The users and groups arguments are comma separated lists, which are combined to
form the first field in the sudo rule.
The --passwd argument specifies whether the sudo entry will require a password
be specified. The default is False, meaning the NOPASSWD field will be
specified in the sudo entry.

Example:
samba-tool gpo manage sudoers add {31B2F340-016D-11D2-945F-00C04FB984F9} ALL ALL fakeu fakeg

The example command will generate the following sudoers entry:
fakeu,fakeg% ALL=(ALL) NOPASSWD: ALL
    z7%prog <gpo> <command> <user> <users> [groups] [options]r  r  r  r  r  r  r  z--passwdr  Fz;Specify to indicate that sudo entry must provide a passwordr  )r   commandr>  userszgroups?Nc                 	   UR                  5       U l        U	R                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nXpl        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9nU R                  5         [        XR                  U R                  U R                  U5      nU R                  R                  S5      nS	R                  UR                  5       S
USS/5      nS	R                  US/5      n [        R                   " [        R"                  " UR%                  U5      5      5      nUR'                  5       R)                  S5      nUR)                  S5      n[        R6                  " US5      nU(       a  [        R6                  " US5        [        R6                  " US5      nUUl        [        R6                  " US 5      nUUl        [        R6                  " US!5      nUR?                  S"5       H0  n[        R6                  " US#5      nUUl        S UR@                  S$'   M2     UbD  UR?                  5        H0  n [        R6                  " US#5      nU Ul        S%UR@                  S$'   M2     [C        5       n!URE                  U!S&SS'9  U!RG                  S5         [I        X5        URK                  UU!RM                  5       5        URO                  SS(9  g ! [*         GaM  nUR,                  S   [.        [0        [2        4;   Ga  [        R                   " [        R4                  " S5      5      n[        R6                  " UR'                  5       S5      n[        R6                  " US5      nSUl        [        R6                  " US5      nSUl        [        R6                  " US5      nSUl        [        R6                  " US5      nSUl        [        R6                  " US5      n[        R6                  " US5      nSUl         S nAGNUR,                  S   [:        :X  a  [=        S5      ee S nAff = f! [*         a(  nUR,                  S   [:        :X  a  [=        S5      ee S nAff = f))NTr  rg   rd  re  rg  rh  ri  r   rj  MACHINE\VGP\VTLA\SudoSudoersConfigurationmanifest.xmlpolicysettingr   r   	vgppolicyversion1rr   zSudo Policydescriptionz!Sudoers File Configuration Policy
apply_modemergeload_plugintruerm  sudoers_entrypasswordrx  r>  listelement,	principalr  groupUTF-8encodingxml_declarationmachine_changed)(r&  ri   r'  rj   rU   rk   r   rn   r3   r  r5   r   ru  r>   r   r  ElementTreer  r   getrootfindr   rv  r-   r.   r/   Element
SubElementtextr1   r   rS   r   r)   r   seekr2   r   r   increment_gpt_ini)"r   r   rx  r>  ry  groupspasswdr  r  r  r  r}  r   r  ri  vgp_dirvgp_xmlxml_datar~  r   rm   pvrr   r  r  r  r  command_elmuser_elmr  ur  r[   outs"                                     rB   r(  cmd_add_sudoers.run  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 	#C$**djj!LG$))U[[]J735 6 ))Wn56	~~bmmDMM'4J&KLH$,,.33ODM %%f-D4 dO<MM-4mmM9="==7mmM=AS!Ak;?IIN'-IV$ " \\^MM+{C	!"	+2	  ( $
 isWdC	!$0MM'388:.!!$!7c  	vvay:<<> > >>"**[*AB "h.>.>.@.=!?]]=)<}}]F;)	 mmM=I#F ]]=,G
")
}}]F; mmD-@#)  55" $D E E /	d  	vvay33" $D E E		s8   A)L6 ;:R 6RDR	&#R		R
S#R>>Sr*  )NNNNNNr  r  r  r  r-  r.  rG   r/  r0  r1  r2  r   r   r3  r^  r(  r	  r`   rD   rB   rw  rw    sz    & IH ))--.. 	tW#JQTC	)z,Q	SM @JAE?CUrD   rw  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rS/rSS jrSrg)cmd_list_sudoersi  zList Samba Sudoers Group Policy from the sysvol

This command lists sudo rules from the sysvol that will be applied to winbind clients.

Example:
samba-tool gpo manage sudoers list {31B2F340-016D-11D2-945F-00C04FB984F9}
    ra  r  r  r  r  r  r  r  r   Nc                 .   UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9nU R                  R                  S5      nS	R                  UR                  5       S
USS/5      n	 [        R                  " UR                  U	5      5      n
U
Gb\  U
R-                  S5      nUR,                  " S5      nUR/                  S5       GH#  nUR-                  S5      R0                  nUR-                  S5      R0                  nUR/                  S5      n/ nU H#  nUR3                  UR/                  S5      5        M%     [5        U5      S:  aO  SR                  U Vs/ s H1  nUR6                  S   S:X  a  UR0                  OSUR0                  -  PM3     sn5      nOSnUR-                  S5      S L nU(       a  SOSnU< SU< SU< SU< 3nU R8                  R;                  S U-  5        GM&     S	R                  UR                  5       S
US!/5      n [=        [>        R@                  UR                  U5      5      nS"nURB                   Hp  n[E        URF                  5      U:X  d  M  [I        URJ                  5      RM                  5       (       d  MH  U R8                  R;                  S URJ                  -  5        Mr     g ! [         aR  nUR                   S   ["        [$        [&        4;   a  S n
 S nAGNdUR                   S   [(        :X  a  [+        S5      ee S nAff = fs  snf ! [         aO  nUR                   S   ["        [$        [&        4;   a   S nAg UR                   S   [(        :X  a  [+        S5      ee S nAff = f)#NTr  rg   rd  re  rg  rh  ri  r   rj  r{  z!SudoersConfiguration\manifest.xmlr   rm  r~  r   r  rx  r>  r  r  r  r  %s%%ALLr  
 NOPASSWD:rJ    ALL=()r<   %s
MACHINE\Registry.pols1   Software\Policies\Samba\Unix Settings\Sudo Rights)'r&  ri   r'  rj   rU   rk   r   rn   r3   ru  r>   r   r  r  r   r   rv  r-   r.   r/   r1   r   r  findallr  extendrT   r   r   r   r   r   r   rw  r%   rn  r&   r   rR   )r   r   r  r  r  r  r}  r   ri  r  r  rm   r   r   r  rx  r>  listelements
principalsr  r  uname
nopasswordnp_entrypr  r  rn  s                               rB   r(  cmd_list_sudoers.run  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 G$))U[[]J : DF G	}}T]]7%;<H ]]?3F;;v&Do6**Y/44zz&)..$}}];
#/K%%k&9&9+&FG $0z?Q&HH6@&B6@ 120@F0Jaff#aff_'-6@&B CE "E"ZZ
3t;
+5<2*/xI		
+ 7" 99ekkmZ57 8
	!$))T]]8-DEH K%%E'72uzz*0022		 34 &a  
	vvay:<<> >  55" $D E E 
	.&B  	vvay:<<> > vvay33" $D E E	sB   %M 38N6
+)N; 
N3!$N.#N..N3;
P"P,#PPr*  r+  r  r`   rD   rB   r  r    sb     'H ))--.. 	tW#JQTC	)M
 JK5rD   r  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rSS/rSS jrSrg)cmd_remove_sudoersik  a  Removes a Samba Sudoers Group Policy from the sysvol

This command removes a sudo rule from the sysvol from applying to winbind clients.

Example:
samba-tool gpo manage sudoers remove {31B2F340-016D-11D2-945F-00C04FB984F9} 'fakeu ALL=(ALL) NOPASSWD: ALL'
    %prog <gpo> <entry> [options]r  r  r  r  r  r  r  r   r  Nc                 X   UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX0l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9nU R                  5         [        XR                  U R                  U R                  U5      n	U R                  R                  S5      n
S	R                  U
R                  5       S
USS/5      nS	R                  US/5      n [        R                   " [        R"                  " UR%                  U5      5      5      nUR'                  5       R)                  S5      nUR)                  S5      nS	R                  U
R                  5       S
US/5      n [9        [:        R<                  UR%                  U5      5      n0 nU(       a  UR?                  S5      O/  GH
  nUR)                  S5      R@                  nUR)                  S5      R@                  nUR?                  S5      n/ nU H#  nURC                  UR?                  S5      5        M%     [E        U5      S:  aO  SR                  U Vs/ s H1  nURF                  S   S:X  a  UR@                  OSUR@                  -  PM3     sn5      nOSnUR)                  S5      S L nU(       a  SOSnU< SU< S U< S!U< 3nUUU'   GM     UURI                  5       ;   a|  URK                  UU   5        [M        5       nWRO                  US"SS#9  URQ                  S5         [S        X5        URU                  UURW                  5       5        U	RY                  SS$9  g UU(       a'  URZ                   Vs/ s H  nUR\                  PM     snO/ ;   aq  URZ                   Vs/ s H  nUR\                  U:w  d  M  UPM     nn[E        U5      Ul/        UUl-         URU                  U[a        U5      5        U	RY                  SS$9  g [7        S%U-  5      e! [*         aR  nUR,                  S   [.        [0        [2        4;   a  S n S nAGNUR,                  S   [4        :X  a  [7        S5      ee S nAff = f! [*         aR  nUR,                  S   [.        [0        [2        4;   a  S n S nAGNUR,                  S   [4        :X  a  [7        S5      ee S nAff = fs  snf ! [*         a(  nUR,                  S   [4        :X  a  [7        S5      ee S nAff = fs  snf s  snf ! [*         a(  nUR,                  S   [4        :X  a  [7        S5      ee S nAff = f)&NTr  rg   rd  re  rg  rh  ri  r   rj  r{  r|  r}  r~  r   r   rm  r  r  rx  r>  r  r  r  r  r  r  r  r  rJ   r  r  r<   r  r  r  ,Cannot remove '%s' because it does not exist)1r&  ri   r'  rj   rU   rk   r   rn   r3   r  r5   r   ru  r>   r   r  r  r  r   r  r  r   rv  r-   r.   r/   r1   r   r   r   r   r  r  r  rT   r   keysr   r)   r   r  r2   r   r   r  rw  r   num_entriesr   )r   r   r  r  r  r  r  r}  r   r  ri  r  r  r  r~  r   rm   r  r  rw  rx  r>  r  r  r  r  r  r  r  r  r  s                                  rB   r(  cmd_remove_sudoers.run  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 	#C$**djj!LG$))U[[]J735 6 ))Wn56	~~bmmDMM'4J&KLH$,,.33ODM %%f-D 99ekkmZ57 8	!$))T]]8-DEH 26o.B>AffY',,G66&>&&D99]3LJ+!!+"5"5k"BC  ,:"2<">2<Q -.HHV,<,F!&&!&&#)2<"> ? 
+t3J'1|rH&+T8WEAGAJ ?" GLLN"KK')CNN3$NGHHQK%d4gsxxz2%%d%; X(8(89(81(892N"*"2"2F"2Qaffoq"2GF#&w<H &Hh(:;%%d%; M$ % & &S  		vvay:<<> > 55" $D E E 		  		vvay:<<> >  55" $D E E 		(">& ! 66!9 77& (H I I	
 :F ! 66!9 77& (H I I	s   A)Q5 )S 78T3
:T8 U-U2U2<*U7 5
S?$S)#SS
T0$T+#T++T08
U*#U%%U*7
V)#V$$V)r*  r+  r  r`   rD   rB   r  r  k  se     /H ))--.. 	tW#JQTC	)M
 !Jh&rD   r  c                   X    \ rS rSrSr0 r\" 5       \S'   \" 5       \S'   \" 5       \S'   Sr	g)cmd_sudoersi  z#Manage Sudoers Group Policy Objectsr(  r   r   r`   N)
r  r  r  r  r-  subcommandsrw  r  r  r	  r`   rD   rB   r  r    s1    -K(*K*,K.0KrD   r  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/r/ SQr  SS jrSrg)cmd_set_securityi  a  Set Samba Security Group Policy to the sysvol

This command sets a security setting to the sysvol for applying to winbind
clients. Not providing a value will unset the policy.
These settings only apply to the ADDC.

Example:
samba-tool gpo manage security set {31B2F340-016D-11D2-945F-00C04FB984F9} MaxTicketAge 10

Possible policies:
MaxTicketAge            Maximum lifetime for user ticket
                        Defined in hours

MaxServiceAge           Maximum lifetime for service ticket
                        Defined in minutes

MaxRenewAge             Maximum lifetime for user ticket renewal
                        Defined in minutes

MinimumPasswordAge      Minimum password age
                        Defined in days

MaximumPasswordAge      Maximum password age
                        Defined in days

MinimumPasswordLength   Minimum password length
                        Defined in characters

PasswordComplexity      Password must meet complexity requirements
                        1 is Enabled, 0 is Disabled
    ra  r  r  r  r  r  r  r  )r   r   value?Nc                    UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX@l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9n	U R                  5         [        XR                  U R                  U R                  U5      n
U R                  R                  S5      nS	R                  UR                  5       S
US/5      nS	R                  US/5      n [        S S9n[         Ul        U	R%                  U5      n UR'                  [)        UR+                  5       5      5        SSSSSSSS.nUU   nWR=                  U5      (       d  UR?                  U5        Ub  URA                  UX#5        OAURC                  UU5        [E        URG                  U5      5      S:X  a  URI                  U5        [)        5       nURK                  U5         [M        X5        U	RO                  U[Q        URS                  5       5      5        U
RU                  SS9  g ! [,         a-    UR'                  [)        UR+                  S5      5      5         GN#f = f! [.         aP  nUR0                  S   [2        :X  a  [5        S5      eUR0                  S   [6        [8        [:        4;  a  e  S nAGN|S nAff = f! [.         a(  nUR0                  S   [2        :X  a  [5        S5      ee S nAff = f)NTr  rg   rd  re  rg  rh  ri  r   rj  z$MACHINE\Microsoft\Windows NT\SecEditzGptTmpl.infinterpolationutf-16r   rm  Kerberos PolicySystem Access)MaxTicketAgeMaxServiceAgeMaxRenewAgeMinimumPasswordAgeMaximumPasswordAgeMinimumPasswordLengthPasswordComplexityr  )+r&  ri   r'  rj   rU   rk   r   rn   r3   r  r5   r   ru  r>   r   r'   r   optionxformr   	read_filer(   ry  UnicodeDecodeErrorr   rv  r1   r   r-   r.   r/   has_sectionadd_sectionsetremove_optionrT   rG   remove_sectionr   r2   r   r%   getvaluer  )r   r   r   r?   r  r  r  r  r}  r   r  ri  inf_dirinf_fileinf_datarawrm   section_mapsectionr  s                       rB   r(  cmd_set_security.run$	  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 	#C$**djj!LG$))U[[]J57 899g}56	#$7H!$H --)CC""8CJJL#9: *;*;(9/>/>2A/> f%##G,,  )LL&0""7F38##G,-2''0js		!$0MM(Iclln$=>!!$!7G & C""8CJJx,@#ABC 	vvay33" $D E Evvay!>!@!@!B B B		D  	vvay33" $D E E 	sP   %K 6(J AL" 3K>K KK 
LALL"
M,#MMr*  r  r  r`   rD   rB   r  r    sg    @ 'H ))--.. 	tW#JQTC	)M
 -J=A'+IrD   r  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rS/rSS jrSrg)cmd_list_securityio	  a  List Samba Security Group Policy from the sysvol

This command lists security settings from the sysvol that will be applied to winbind clients.
These settings only apply to the ADDC.

Example:
samba-tool gpo manage security list {31B2F340-016D-11D2-945F-00C04FB984F9}
    ra  r  r  r  r  r  r  r  r   Nc                    UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9nU R                  R                  S5      nS	R                  UR                  5       S
US/5      n	 [        S S9n
[        U
l        UR                  U	5      n U
R!                  [#        UR%                  5       5      5        U
R7                  5        HH  nUS;  a  M  U
R9                  U5       H(  u  pU R:                  R=                  U< SU< S35        M*     MJ     g ! [&         a,    U
R!                  [#        UR%                  S5      5      5         Nf = f! [(         aO  nUR*                  S   [,        [.        [0        4;   a   S nAg UR*                  S   [2        :X  a  [5        S5      ee S nAff = f)NTr  rg   rd  re  rg  rh  ri  r   rj  z0MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.infr  r  r   rm  )r  r   = r%  )r&  ri   r'  rj   rU   rk   r   rn   r3   ru  r>   r   r'   r   r  r   r  r(   ry  r  r   rv  r-   r.   r/   r1   r   sectionsr  r   r   )r   r   r  r  r  r  r}  r   ri  r  r  r  rm   r  r   r?   s                   rB   r(  cmd_list_security.run	  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 G$99ekkmZBD E	#$7H!$H --)CC""8CJJL#9:  ((*GBB&nnW5
		sE :; 6 + & C""8CJJx,@#ABC 	vvay:<<> > vvay33" $D E E	s<   %G% '(F, ,3G"G% !G""G% %
H>/"H9#H99H>r*  r+  r  r`   rD   rB   r  r  o	  sa     'H ))--.. 	tW#JQTC	)M
 J+<rD   r  c                   D    \ rS rSrSr0 r\" 5       \S'   \" 5       \S'   Srg)cmd_securityi	  z$Manage Security Group Policy Objectsr  r   r`   N)	r  r  r  r  r-  r  r  r  r	  r`   rD   rB   r  r  	  s$    .K)+K+-KrD   r  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rS/rSS jrSrg)cmd_list_smb_confi	  zList Samba smb.conf Group Policy from the sysvol

This command lists smb.conf settings from the sysvol that will be applied to winbind clients.

Example:
samba-tool gpo manage smb_conf list {31B2F340-016D-11D2-945F-00C04FB984F9}
    ra  r  r  r  r  r  r  r  r   Nc                    UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9nU R                  R                  S5      nS	R                  UR                  5       S
US/5      n	 [        [        R                  UR                  U	5      5      n
Sn[.        R0                  " 5       nU
R2                   H  n[5        UR6                  5      U:X  d  M  UR9                  UR:                  [=        UR>                  5      5        UR                  UR:                  5      nU R@                  RC                  UR:                  < SU< S35        M     g ! [          aO  nUR"                  S   [$        [&        [(        4;   a   S nAg UR"                  S   [*        :X  a  [-        S5      ee S nAff = f)NTr  rg   rd  re  rg  rh  ri  r   rj  r  r   rm      Software\Policies\Samba\smb_confr  r%  )"r&  ri   r'  rj   rU   rk   r   rn   r3   ru  r>   r   r   r   r   r   r   rv  r-   r.   r/   r1   r   r#   LoadParmrw  r%   rn  r  ro  r   r   r   r   )r   r   r  r  r  r  r}  r   ri  r  r  rm   rn  ri   r  r  s                   rB   r(  cmd_list_smb_conf.run	  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 G$99ekkmZ 79 :
	!$))T]]8-DEH 9^^%%E'72uEJJ8ffU__-		u DE	 &  	vvay:<<> > vvay33" $D E E	s   )G' '
I 1"H;#H;;I r*  r+  r  r`   rD   rB   r  r  	  sb     'H ))--.. 	tW#JQTC	)M
 J'FrD   r  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/r/ SQr  SS jrSrg)cmd_set_smb_confi	  a%  Sets a Samba smb.conf Group Policy to the sysvol

This command sets an smb.conf setting to the sysvol for applying to winbind
clients. Not providing a value will unset the policy.

Example:
samba-tool gpo manage smb_conf set {31B2F340-016D-11D2-945F-00C04FB984F9} 'apply gpo policies' yes
    r  r  r  r  r  r  r  r  r   settingr  Nc                    UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX@l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9n	U R                  5         [        XR                  U R                  U R                  U5      n
U R                  R                  S5      nS	R                  UR                  5       S
US/5      nS	R                  US/5      n [        [         R"                  U	R%                  U5      5      nUc}  X.R4                   Vs/ s H  oR6                  PM     sn;  a  [3        SU-  5      eUR4                   Vs/ s H  nUR6                  U:w  d  M  UPM     nnUUl        [9        U5      Ul        O[=        U5      R                  5       S;   a  SnSnOd[=        U5      R                  5       S;   a  SnSnOB[=        U5      R?                  5       (       a  Sn[A        [=        U5      5      nOSn[C        U5      n[         RD                  " 5       nSUl#        [C        U5      Ul        UUl$        UUl%        [M        UR4                  5      nURO                  U5        UUl        [9        U5      Ul         [Q        X5        U	RS                  U[U        U5      5        U
RW                  SS9  g ! [&         ae  nUR(                  S   [*        [,        [.        4;   a  [         R"                  " 5       n S nAGNUR(                  S   [0        :X  a  [3        S5      ee S nAff = fs  snf s  snf ! [&         a(  nUR(                  S   [0        :X  a  [3        S5      ee S nAff = f)NTr  rg   rd  re  rg  rh  ri  r   rj  rk  zRegistry.polr   rm  r  )yesr  r  rr  rO   )nofalser#  r  r  ),r&  ri   r'  rj   rU   rk   r   rn   r3   r  r5   r   ru  r>   r   r   r   r   r   r   rv  r-   r.   r/   r1   r   rw  ro  rT   r  r&   	isnumericrX   r%   r  rn  r  r   r   rW   r2   r   r   r  )r   r   r  r?   r  r  r  r  r}  r   r  ri  pol_dirr  r  rm   rw  etyper  s                      rB   r(  cmd_set_smb_conf.run
  s\   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 	#C$**djj!LG$))U[[]JYGH99g~67	!$))T]]8-DEH =4D4DE4Dq{{4DEE" $029$: ; ;"*"2"2 +"2Q;;') "2G +&H#&w<H % &&(,@@E"((*.BBE",,..*U+,&

A>AI#G,AKAFAF8++,GNN1&H#&w<H 	!$0MM(HX$67!!$!7[  		vvay:<<> >  99;55" $D E E 		 F+>  	vvay33" $D E E		sH   )L- 
NN$N$75N) -
N77N4#NN)
O3#OOr*  r  r  r`   rD   rB   r  r  	  sf     /H ))--.. 	tW#JQTC	)M
 .JMQMrD   r  c                   D    \ rS rSrSr0 r\" 5       \S'   \" 5       \S'   Srg)cmd_smb_confid
  z$Manage smb.conf Group Policy Objectsr   r  r`   N)	r  r  r  r  r-  r  r  r  r	  r`   rD   rB   r   r   d
  s$    .K+-K)+KrD   r   c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rS/rSS jrSrg)cmd_list_symlinkij
  zList VGP Symbolic Link Group Policy from the sysvol

This command lists symlink settings from the sysvol that will be applied to winbind clients.

Example:
samba-tool gpo manage symlink list {31B2F340-016D-11D2-945F-00C04FB984F9}
    ra  r  r  r  r  r  r  r  r   Nc                 2   UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9nU R                  R                  S5      nS	R                  UR                  5       S
USS/5      n	 [        R                  " UR                  U	5      5      n
U
R-                  S5      nUR,                  " S5      nUR/                  S5       H]  nUR-                  S5      nUR-                  S5      nU R0                  R3                  SUR4                  < SUR4                  < S35        M_     g ! [         aO  nUR                   S   ["        [$        [&        4;   a   S nAg UR                   S   [(        :X  a  [+        S5      ee S nAff = f)NTr  rg   rd  re  rg  rh  ri  r   rj  MACHINE\VGP\VTLA\UnixzSymlink\manifest.xmlr   rm  r~  r   file_propertiessourcetargetzln -s r<   r%  r&  ri   r'  rj   rU   rk   r   rn   r3   ru  r>   r   r  r  r   r   rv  r-   r.   r/   r1   r   r  r  r   r   r  )r   r   r  r  r  r  r}  r   ri  r  r  rm   r   r   r  r  r  s                    rB   r(  cmd_list_symlink.run
  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 G$))U[[]J : 79 :
	}}T]]7%;<H /{{6"#||,=>O$))(3F$))(3FIIOOv{{FKKHI  ?  	vvay:<<> > vvay33" $D E E	s   %F= =
H"H.#HHr*  r+  r  r`   rD   rB   r  r  j
  sb     'H ))--.. 	tW#JQTC	)M
 J'JrD   r  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/r/ SQr  SS jrSrg)cmd_add_symlinki
  zAdds a VGP Symbolic Link Group Policy to the sysvol

This command adds a symlink setting to the sysvol that will be applied to winbind clients.

Example:
samba-tool gpo manage symlink add {31B2F340-016D-11D2-945F-00C04FB984F9} /tmp/source /tmp/target
    '%prog <gpo> <source> <target> [options]r  r  r  r  r  r  r  r   r  r  Nc                    UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX@l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9n	U R                  5         [        XR                  U R                  U R                  U5      n
U R                  R                  S5      nS	R                  UR                  5       S
US/5      nS	R                  US/5      n [        R                   " [        R"                  " U	R%                  U5      5      5      nUR'                  5       R)                  S5      nUR(                  " S5      n[        R6                  " US5      n[        R6                  " US5      nUUl        [        R6                  " US5      nUUl        [?        5       nURA                  USSS9  URC                  S5         [E        X5        U	RG                  UURI                  5       5        U
RK                  SS9  g ! [*         Ga  nUR,                  S   [.        [0        [2        4;   a  [        R                   " [        R4                  " S5      5      n[        R6                  " UR'                  5       S5      n[        R6                  " US5      nSUl        [        R6                  " US5      nSUl        [        R6                  " US5      nSUl        [        R6                  " US5      n S nAGNUR,                  S   [:        :X  a  [=        S5      ee S nAff = f! [*         a(  nUR,                  S   [:        :X  a  [=        S5      ee S nAff = f)NTr  rg   rd  re  rg  rh  ri  r   rj  MACHINE\VGP\VTLA\Unix\Symlinkr}  r~  r   r   r  r  r  rr   zSymlink Policyr  zSpecifies symbolic link datarm  r  r  r  r  r  r  )&r&  ri   r'  rj   rU   rk   r   rn   r3   r  r5   r   ru  r>   r   r  r  r  r   r  r  r   rv  r-   r.   r/   r  r  r  r1   r   r)   r   r  r2   r   r   r  )r   r   r  r  r  r  r  r  r}  r   r  ri  r  r  r  r   r   rm   r~  r  rr   r  r  
source_elm
target_elmr  s                             rB   r(  cmd_add_symlink.run
  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 	#C$**djj!LG$))U[[]J@B C))Wn56	~~bmmDMM'4J&KLH%%',,_=F;;v&D, --.?@]]?H=
 
]]?H=
 
isWdC	!$0MM'388:.!!$!7C  	vvay:<<> > >>"**[*AB "h.>.>.@.=!?]]=)<}}]F;,	 mmM=I#A }}]F;55" $D E E '	D  	vvay33" $D E E		s8   A*I5 ::N 5N C"N(#NN
O#O  Or*  r+  r  r`   rD   rB   r  r  
  sf     9H ))--.. 	tW#JQTC	)M
 -JHLDrD   r  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/r/ SQr  SS jrSrg)cmd_remove_symlinki	  a  Removes a VGP Symbolic Link Group Policy from the sysvol

This command removes a symlink setting from the sysvol from applying to winbind
clients.

Example:
samba-tool gpo manage symlink remove {31B2F340-016D-11D2-945F-00C04FB984F9} /tmp/source /tmp/target
    r  r  r  r  r  r  r  r  r  Nc                 v   UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX@l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9n	U R                  5         [        XR                  U R                  U R                  U5      n
U R                  R                  S5      nS	R                  UR                  5       S
US/5      nS	R                  US/5      n [        R                   " [        R"                  " U	R%                  U5      5      5      nUR'                  5       R)                  S5      nUR(                  " S5      nUR9                  S5       HZ  nUR)                  S5      nUR)                  S5      nUR:                  U:X  d  M7  UR:                  U:X  d  MI  UR=                  U5          O   [5        SU-  U5      e[?        5       nURA                  USSS9  URC                  S5         [E        X5        U	RG                  UURI                  5       5        U
RK                  SS9  g ! [*         aY  nUR,                  S   [.        [0        [2        4;   a  [5        SU-  U5      eUR,                  S   [6        :X  a  [5        S5      ee S nAff = f! [*         a(  nUR,                  S   [6        :X  a  [5        S5      ee S nAff = f)NTr  rg   rd  re  rg  rh  ri  r   rj  r  r}  r~  r   r   z>Cannot remove link from '%s' to '%s' because it does not existrm  r  r  r  r  r  r  )&r&  ri   r'  rj   rU   rk   r   rn   r3   r  r5   r   ru  r>   r   r  r  r  r   r  r  r   rv  r-   r.   r/   r   r1   r  r  r   r)   r   r  r2   r   r   r  )r   r   r  r  r  r  r  r  r}  r   r  ri  r  r  r  r   r   rm   r  r  r  r  s                         rB   r(  cmd_remove_symlink.run"  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 	#C$**djj!LG$))U[[]J@B C))Wn56	~~bmmDMM'4J&KLH%%',,_=F;;v&D  $||,=>O(--h7J(--h7J&(Z__-FO,  ?   ;=C DEKM M isWdC	!$0MM'388:.!!$!7;  
	vvay:<<> > # $028$9:@B B55" $D E E 
	<  	vvay33" $D E E		s2   A*J  %:L  
L*AK>>L
L8#L33L8r*  r+  r  r`   rD   rB   r  r  	  sf     9H ))--.. 	tW#JQTC	)M
 -JHL@rD   r  c                   X    \ rS rSrSr0 r\" 5       \S'   \" 5       \S'   \" 5       \S'   Sr	g)cmd_symlinkid  z#Manage symlink Group Policy Objectsr   r(  r   r`   N)
r  r  r  r  r-  r  r  r  r  r	  r`   rD   rB   r  r  d  s1    -K*,K(*K.0KrD   r  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rS/rSS jrSrg)cmd_list_filesik  zList VGP Files Group Policy from the sysvol

This command lists files which will be copied from the sysvol and applied to winbind clients.

Example:
samba-tool gpo manage files list {31B2F340-016D-11D2-945F-00C04FB984F9}
    ra  r  r  r  r  r  r  r  r   Nc           
         UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9nU R                  R                  S5      nS	R                  UR                  5       S
USS/5      n	 [        R                  " UR                  U	5      5      n
U
R-                  S5      nUR,                  " S5      nUR/                  S5       H  nUR-                  S5      R0                  nUR-                  S5      R0                  nUR-                  S5      R0                  nUR-                  S5      R0                  n[3        U5      n[5        U5      < SU< SU< SU< SU< 3	nU R6                  R9                  SU-  5        M     g ! [         aO  nUR                   S   ["        [$        [&        4;   a   S nAg UR                   S   [(        :X  a  [+        S5      ee S nAff = f)NTr  rg   rd  re  rg  rh  ri  r   rj  r  zFiles\manifest.xmlr   rm  r~  r   r  r  r  r>  r  	z -> r  )r&  ri   r'  rj   rU   rk   r   rn   r3   ru  r>   r   r  r  r   r   rv  r-   r.   r/   r1   r   r  r  r  r*   r+   r   r   )r   r   r  r  r  r  r}  r   ri  r  r  rm   r   r   r  r  r  r>  r  moder  s                        rB   r(  cmd_list_files.run  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 G$))U[[]J : 57 8
	}}T]]7%;<H /{{6"\\"34EZZ)..FZZ)..F::f%**DJJw',,EU#D#D)4HAIIOOFQJ' 5  	vvay:<<> > vvay33" $D E E	s   %H 
I/ "I*#I**I/r*  r+  r  r`   rD   rB   r  r  k  sa     'H ))--.. 	tW#JQTC	)M
 J,(rD   r  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/r/ SQr  SS jrSrg)cmd_add_filesi  a  Add VGP Files Group Policy to the sysvol

This command adds files which will be copied from the sysvol and applied to winbind clients.

Example:
samba-tool gpo manage files add {31B2F340-016D-11D2-945F-00C04FB984F9} ./source.txt /usr/share/doc/target.txt root root 600
    z=%prog <gpo> <source> <target> <user> <group> <mode> [options]r  r  r  r  r  r  r  )r   r  r  r>  r  r  Nc                 
   UR                  5       U l        U	R                  U R                  SS9U l        [        R
                  R                  U5      (       d  [        SU-  5      eU(       a"  UR                  S5      (       a  USS  nXpl	        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l	        [        USU R                  U R                  S9nU R                  5         [        XR                  U R                  U R                  U5      nU R                  R!                  S	5      nS
R#                  UR%                  5       SUS/5      nS
R#                  US/5      n [&        R(                  " [&        R*                  " UR-                  U5      5      5      nUR/                  5       R1                  S5      nUR0                  " S5      n[&        R>                  " US5      n[&        R>                  " US5      n[        R
                  RE                  U5      Ul         [&        R>                  " US5      nUUl         [&        R>                  " US5      nUUl         [&        R>                  " US5      nUUl         S H  u  nn[&        R>                  " US5      n U RG                  S U5        [I        US!5      S"U-  -  (       a  [&        R>                  " U S#5        [I        US!5      S$U-  -  (       a  [&        R>                  " U S%5        [I        US!5      S&U-  -  (       d  M  [&        R>                  " U S'5        M     [K        5       n!URM                  U!S(SS)9  U!RO                  S5        [Q        US*5      RS                  5       n"S
R#                  U[        R
                  RE                  U5      /5      n# [U        X5        URW                  UU!RS                  5       5        URW                  U#U"5        URY                  SS+9  g ! [2         Ga  nUR4                  S   [6        [8        [:        4;   a  [&        R(                  " [&        R<                  " S5      5      n[&        R>                  " UR/                  5       S5      n[&        R>                  " US5      nSUl         [&        R>                  " US5      nSUl         [&        R>                  " US5      nSUl         [&        R>                  " US5      n S nAGN$UR4                  S   [B        :X  a  [        S5      ee S nAff = f! [2         a(  nUR4                  S   [B        :X  a  [        S5      ee S nAff = f),NTr  zSource '%s' does not existrg   rd  re  rg  rh  ri  r   rj  MACHINE\VGP\VTLA\Unix\Filesr}  r~  r   r   r  r  r  rr   Filesr  z+Represents file data to set/copy on clientsrm  r  r  r  r>  r  ))r>     )r  r   )otherr   permissionsr  rN   rr  r   rM   r   rO   executer  r  r   r  )-r&  ri   r'  rj   r   r   r  r   rU   rk   r   rn   r3   r  r5   r   ru  r>   r   r  r  r  r   r  r  r   rv  r-   r.   r/   r  r  r  r1   r  r  rX   r)   r   r  r   r   r2   r   r  )$r   r   r  r  r>  r  r  r  r  r  r  r}  r   r  ri  r  r  r  r   r   rm   r~  r  rr   r  r  r  r  r  	group_elmptypeshiftr&  r  source_datasysvol_sources$                                       rB   r(  cmd_add_files.run  sK   ((*--dgg-M
ww~~f%%;fDEE i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 	#C$**djj!LG$))U[[]J>@ A))Wn56	~~bmmDMM'4J&KLH%%',,_=F;;v&D, --.?@]]?H=
''**62
]]?H=
 
==&9MM/7;		ELE5--GKOOFE*4|se|,k624|se|,k734|se|,,k95 F isWdC64(--/		7BGG,<,<V,D"EF		!$0MM'388:.MM-5!!$!7c  	vvay:<<> > >>"**[*AB "h.>.>.@.=!?]]=)<}}]F;#	 mmM=I#P }}]F;55" $D E E '	d  	vvay33" $D E E		s9   A*P AT; T8(C"T3#T33T8;
U-#U((U-r*  r+  r  r`   rD   rB   r   r     sh     OH ))--.. 	tW#JQTC	)M
 FJ<@7;WrD   r   c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rSS/r  SS jrSrg)cmd_remove_filesi"  a  Remove VGP Files Group Policy from the sysvol

This command removes files which would be copied from the sysvol and applied to winbind clients.

Example:
samba-tool gpo manage files remove {31B2F340-016D-11D2-945F-00C04FB984F9} /usr/share/doc/target.txt
    z%prog <gpo> <target> [options]r  r  r  r  r  r  r  r   r  Nc                    UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX0l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9nU R                  5         [        XR                  U R                  U R                  U5      n	U R                  R                  S5      n
S	R                  U
R                  5       S
US/5      nS	R                  US/5      n [        R                   " [        R"                  " UR%                  U5      5      5      nUR'                  5       R)                  S5      nUR(                  " S5      nUR9                  S5       Hv  nUR)                  S5      nUR)                  S5      nUR:                  U:X  d  M7  S	R                  UUR:                  /5      nUR=                  U5        UR?                  U5          O   [5        SU-  5      e[A        5       nURC                  USSS9  URE                  S5         [G        X5        URI                  UURK                  5       5        U	RM                  SS9  g ! [*         aX  nUR,                  S   [.        [0        [2        4;   a  [5        SU-  5      eUR,                  S   [6        :X  a  [5        S5      ee S nAff = f! [*         a(  nUR,                  S   [6        :X  a  [5        S5      ee S nAff = f)NTr  rg   rd  re  rg  rh  ri  r   rj  r"  r}  r~  r   r   z1Cannot remove file '%s' because it does not existrm  r  r  r  r  r  r  )'r&  ri   r'  rj   rU   rk   r   rn   r3   r  r5   r   ru  r>   r   r  r  r  r   r  r  r   rv  r-   r.   r/   r   r1   r  r  unlinkr   r)   r   r  r2   r   r   r  )r   r   r  r  r  r  r  r}  r   r  ri  r  r  r  r   r   rm   r  r  r  r  r  s                         rB   r(  cmd_remove_files.run:  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 	#C$**djj!LG$))U[[]J>@ A))Wn56	~~bmmDMM'4J&KLH%%',,_=F;;v&D  $||,=>O(--h7J(--h7J&(GZ__#=>F#O,  ?   ;=C D E E isWdC	!$0MM'388:.!!$!7?  
	vvay:<<> > # $028$9 : :55" $D E E 
	@  	vvay33" $D E E		s2   A*J;  :L  ;
LALL 
M*#MMr*  r+  r  r`   rD   rB   r/  r/  "  sk     0H ))--.. 	tW#JQTC	)M
 "J@DBrD   r/  c                   X    \ rS rSrSr0 r\" 5       \S'   \" 5       \S'   \" 5       \S'   Sr	g)	cmd_filesi~  z!Manage Files Group Policy Objectsr   r(  r   r`   N)
r  r  r  r  r-  r  r  r   r/  r	  r`   rD   rB   r4  r4  ~  s0    +K(*K&K,.KrD   r4  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rS/rSS jrSrg)cmd_list_opensshi  zList VGP OpenSSH Group Policy from the sysvol

This command lists openssh options from the sysvol that will be applied to winbind clients.

Example:
samba-tool gpo manage openssh list {31B2F340-016D-11D2-945F-00C04FB984F9}
    ra  r  r  r  r  r  r  r  r   Nc           	         UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9nU R                  R                  S5      nS	R                  UR                  5       S
USS/5      n	 [        R                  " UR                  U	5      5      n
U
R-                  S5      nUR,                  " S5      nUR-                  S5      nUR/                  S5       H  nUR-                  S5      R0                  (       a  M%  UR/                  S5       HX  nU R2                  R5                  UR-                  S5      R0                  < SUR-                  S5      R0                  < S35        MZ     M     g ! [         aO  nUR                   S   ["        [$        [&        4;   a   S nAg UR                   S   [(        :X  a  [+        S5      ee S nAff = f)NTr  rg   rd  re  rg  rh  ri  r   rj  zMACHINE\VGP\VTLA\SshCfgzSshD\manifest.xmlr   rm  r~  r   
configfileconfigsectionsectionnamekeyvaluepairr   r<   r?   r%  r&  ri   r'  rj   rU   rk   r   rn   r3   ru  r>   r   r  r  r   r   rv  r-   r.   r/   r1   r   r  r  r  r   r   )r   r   r  r  r  r  r}  r   ri  r  r  rm   r   r   r8  r9  kvs                    rB   r(  cmd_list_openssh.run  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 G$))U[[]J < 46 7
	}}T]]7%;<H /{{6"YY|,
'//@M!!-055#++N;		RWWU^-@-@-/WWW-=-B-B!D E < A  	vvay:<<> > vvay33" $D E E	s   %H 
I"I4#IIr*  r+  r  r`   rD   rB   r6  r6    sb     'H ))--.. 	tW#JQTC	)M
 J*ErD   r6  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/r/ SQr  SS jrSrg)cmd_set_opensshi  a"  Sets a VGP OpenSSH Group Policy to the sysvol

This command sets an openssh setting to the sysvol for applying to winbind
clients. Not providing a value will unset the policy.

Example:
samba-tool gpo manage openssh set {31B2F340-016D-11D2-945F-00C04FB984F9} KerberosAuthentication Yes
    z'%prog <gpo> <setting> [value] [options]r  r  r  r  r  r  r  r  Nc                 
   UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX@l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9n	U R                  5         [        XR                  U R                  U R                  U5      n
U R                  R                  S5      nS	R                  UR                  5       S
US/5      nS	R                  US/5      n [        R                   " [        R"                  " U	R%                  U5      5      5      nUR'                  5       R)                  S5      nUR(                  " S5      nUR)                  S5      nUb  UR?                  S5       H  nUR)                  S5      R8                  (       a  M%  0 nUR?                  S5       H  nUUUR)                  S5      '   M     UURA                  5       ;   a  UUU   l        Ms  [        R6                  " US5      n[        R6                  " US5      nUUl        [        R6                  " US5      nUUl        M     OUR?                  S5       H  nUR)                  S5      R8                  (       a  M%  0 nUR?                  S5       H!  nUUUR)                  S5      R8                  '   M#     UURA                  5       ;   a  URC                  UU   5        M  [=        S U-  5      e   [E        5       nURG                  US!SS"9  URI                  S5         [K        X5        U	RM                  UURO                  5       5        U
RQ                  SS#9  g ! [*         Gat  nUR,                  S   [.        [0        [2        4;   Ga)  [        R                   " [        R4                  " S5      5      n[        R6                  " UR'                  5       S5      n[        R6                  " US5      nSUl        [        R6                  " US5      nSUl        [        R6                  " US5      nSUl        [        R6                  " US5      nSUl        [        R6                  " US5      n[        R6                  " US5      n[        R6                  " US5      n[        R6                  " US5         S nAGNFUR,                  S   [:        :X  a  [=        S5      ee S nAff = f! [*         a(  nUR,                  S   [:        :X  a  [=        S5      ee S nAff = f)$NTr  rg   rd  re  rg  rh  ri  r   rj  zMACHINE\VGP\VTLA\SshCfg\SshDr}  r~  r   r8  r   r  r  r  rr   zConfiguration Filer  z+Represents Unix configuration file settingsr  r  r9  r:  rm  r;  r   r?   r  r  r  r  ))r&  ri   r'  rj   rU   rk   r   rn   r3   r  r5   r   ru  r>   r   r  r  r  r   r  r  r   rv  r-   r.   r/   r  r  r  r1   r   r  r  r   r)   r   r  r2   r   r   r  )r   r   r  r?   r  r  r  r  r}  r   r  ri  r  r  r  r   r   r8  rm   r~  r  rr   r  r  r9  settingsr=  r;  r   dvaluer  s                                  rB   r(  cmd_set_openssh.run  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 	#C$**djj!LG$))U[[]J?A B))Wn56	~~bmmDMM'4J&KLH%%',,_=F;;v&D<0J6 !+!3!3O!D %%m499'//?B/1HRWWU^, @hmmo--2HW%*#%==#OL--e<C&CH]]<AF"'FK "E ",!3!3O!D %%m499'//?B46HRWWU^001 @hmmo-!(('):;& (35<(= > > "E isWdC	!$0MM'388:.!!$!7y  	vvay:<<> > >>"**[*AB "h.>.>.@.=!?]]=)<}}]F;0	 mmM=I#P ]]=,G
")
}}]F;]]4>
 "j/ Jm];;55" $D E E 1	z  	vvay33" $D E E		s8   A;N: ?:T< :T9ET4#T44T9<
U.#U))U.r*  r  r  r`   rD   rB   r@  r@    sf     9H ))--.. 	tW#JQTC	)M
 .J>B'+`rD   r@  c                   D    \ rS rSrSr0 r\" 5       \S'   \" 5       \S'   Srg)cmd_opensshiD  z#Manage OpenSSH Group Policy Objectsr   r  r`   N)	r  r  r  r  r-  r  r6  r@  r	  r`   rD   rB   rF  rF  D  s$    -K*,K(*KrD   rF  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rS/rSS jrSrg)cmd_list_startupiJ  zList VGP Startup Script Group Policy from the sysvol

This command lists the startup script policies currently set on the sysvol.

Example:
samba-tool gpo manage scripts startup list {31B2F340-016D-11D2-945F-00C04FB984F9}
    ra  r  r  r  r  r  r  r  r   Nc           
         UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9nU R                  R                  S5      nS	R                  UR                  5       S
USS/5      n	 [        R                  " UR                  U	5      5      n
U
R-                  S5      nUR,                  " S5      nUR/                  S5       H  nUR-                  S5      nS	R                  S	UR                  5       S
USSUR0                  /5      nUR-                  S5      nUR-                  S5      nUb  UR0                  nOSnUb  UR0                  nOSnU R2                  R5                  SU< SU< SU< S35        M     g ! [         aO  nUR                   S   ["        [$        [&        4;   a   S nAg UR                   S   [(        :X  a  [+        S5      ee S nAff = f)NTr  rg   rd  re  rg  rh  ri  r   rj  r  zScripts\Startup\manifest.xmlr   rm  r~  r   r  scriptzMACHINE\VGP\VTLA\Unix\ScriptsStartup
parametersrun_asrootrJ   z@reboot r<   r%  r<  )r   r   r  r  r  r  r}  r   ri  r  r  rm   r   r   r  rJ  script_pathrL  rM  s                      rB   r(  cmd_list_startup.runb  s$   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 G$))U[[]J : @B C
	}}T]]7%;<H /{{6"<<6K %%h/F))T5;;=*c%H%.%= >K %)),7J %%h/F!%'__

IIOOFK2<> ? 7  	vvay:<<> > vvay33" $D E E	s   %H 
I+"I&#I&&I+r*  r+  r  r`   rD   rB   rH  rH  J  sa     'H ))--.. 	tW#JQTC	)M
 J4?rD   rH  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9\" SSSSSS9/r/ SQr  SS jrSrg)cmd_add_startupi  zAdds VGP Startup Script Group Policy to the sysvol

This command adds a startup script policy to the sysvol.

Example:
samba-tool gpo manage scripts startup add {31B2F340-016D-11D2-945F-00C04FB984F9} test_script.sh '\-n \-p all'
    z.%prog <gpo> <script> [args] [run_as] [options]r  r  r  r  r  r  r  z
--run-oncerun_onceFr  z#Whether to run the script only oncer  )r   rJ  zargs?zrun_as?Nc
                 b
   UR                  5       U l        UR                  U R                  SS9U l        [        R
                  R                  U5      (       d  [        SU-  5      eU(       a"  UR                  S5      (       a  USS  n
X`l	        OD[        U R                  U R                  5      n
[        U R                  U R                  U
S9U l	        [        U
SU R                  U R                  S9nU R                  5         [        XR                  U R                  U R                  U5      nU R                  R!                  S	5      nS
R#                  UR%                  5       SUS/5      nS
R#                  US/5      n [&        R(                  " [&        R*                  " UR-                  U5      5      5      nUR/                  5       R1                  S5      nUR0                  " S5      n[E        US5      RG                  5       n[&        R>                  " US5      n[&        R>                  " US5      n[        R
                  RI                  U5      Ul         [&        R>                  " US5      n[J        RL                  " U5      RO                  5       RQ                  5       Ul         UbL  [&        R>                  " US5      nURS                  S5      RS                  S5      RU                  S S!5      Ul         Ub  [&        R>                  " US"5      nUUl         U(       a  [&        R>                  " US#5        [W        5       nURY                  US$SS%9  UR[                  S5        S
R#                  U[        R
                  RI                  U5      /5      n []        X5        UR_                  UURG                  5       5        UR_                  UU5        URa                  SS&9  g ! [2         Ga  nUR4                  S   [6        [8        [:        4;   a  [&        R(                  " [&        R<                  " S5      5      n[&        R>                  " UR/                  5       S5      n[&        R>                  " US5      nSUl         [&        R>                  " US5      nSUl         [&        R>                  " US5      nSUl         [&        R>                  " US5      n S nAGNUR4                  S   [B        :X  a  [        S5      ee S nAff = f! [2         a(  nUR4                  S   [B        :X  a  [        S5      ee S nAff = f)'NTr  zScript '%s' does not existrg   rd  re  rg  rh  ri  r   rj  %MACHINE\VGP\VTLA\Unix\Scripts\Startupr}  r~  r   r   r  r  r  rr   zUnix Scriptsr  z6Represents Unix scripts to run on Group Policy clientsrm  r   r  rJ  hashrL  "'z\--rM  rS  r  r  r  )1r&  ri   r'  rj   r   r   r  r   rU   rk   r   rn   r3   r  r5   r   ru  r>   r   r  r  r  r   r  r  r   rv  r-   r.   r/   r  r  r  r1   r   r   r  hashlibmd5	hexdigestr$  rR   r  r)   r   r  r2   r   r  ) r   r   rJ  rv  rM  rS  r  r  r  r  r}  r   r  ri  r  r  r  r   r   rm   r~  r  rr   r  script_datar  
script_elmrV  rL  
run_as_elmr  sysvol_scripts                                    rB   r(  cmd_add_startup.run  s   ((*--dgg-M
ww~~f%%;fDEE i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 	#C$**djj!LG$))U[[]JIK L))Wn56	~~bmmDMM'4J&KLH%%',,_=F;;v&D. 64(--/mmD-8]];9
''**62
}}[&1KK,668>>@	{LAJ"jjo33C8@@LJO{H=J$JOMM+z2isWdC		7BGG,<,<V,D"EF		!$0MM'388:.MM-5!!$!7[  	vvay:<<> > >>"**[*AB "h.>.>.@.=!?]]=)<}}]F;*	 mmM=IL  }}]F;55" $D E E )	\  	vvay33" $D E E		s9   A*O AS< S9)C"S4#S44S9<
T.#T))T.r*  r  r  r`   rD   rB   rR  rR    sz     @H ))--.. 	tW#JQTC	)|*eL9	;M 7J@D?CSrD   rR  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rSS/r  SS jrSrg)cmd_remove_startupi  zRemoves VGP Startup Script Group Policy from the sysvol

This command removes a startup script policy from the sysvol.

Example:
samba-tool gpo manage scripts startup remove {31B2F340-016D-11D2-945F-00C04FB984F9} test_script.sh
    z%prog <gpo> <script> [options]r  r  r  r  r  r  r  r   rJ  Nc                    UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX0l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9nU R                  5         [        XR                  U R                  U R                  U5      n	U R                  R                  S5      n
S	R                  U
R                  5       S
US/5      nS	R                  US/5      n [        R                   " [        R"                  " UR%                  U5      5      5      nUR'                  5       R)                  S5      nUR(                  " S5      nUR9                  S5       Hd  nUR)                  S5      nUR:                  [<        R>                  RA                  URC                  S	S5      5      :X  d  MS  URE                  U5          O   [5        SU-  5      e[G        5       nURI                  USSS9  URK                  S5         [M        X5        URO                  UURQ                  5       5        U	RS                  SS9  g ! [*         aX  nUR,                  S   [.        [0        [2        4;   a  [5        SU-  5      eUR,                  S   [6        :X  a  [5        S5      ee S nAff = f! [*         a(  nUR,                  S   [6        :X  a  [5        S5      ee S nAff = f)NTr  rg   rd  re  rg  rh  ri  r   rj  rU  r}  r~  r   r   z3Cannot remove script '%s' because it does not existrm  r  rJ  r   r  r  r  )*r&  ri   r'  rj   rU   rk   r   rn   r3   r  r5   r   ru  r>   r   r  r  r  r   r  r  r   rv  r-   r.   r/   r   r1   r  r  r   r   r  r  r   r)   r   r  r2   r   r   r  )r   r   rJ  r  r  r  r  r}  r   r  ri  r  r  r  r   r   rm   r  r^  r  s                       rB   r(  cmd_remove_startup.run  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 	#C$**djj!LG$))U[[]JIK L))Wn56	~~bmmDMM'4J&KLH%%',,_=F;;v&D  <<6K$))(3J"''"2"26>>$3L"MMK(	 7   ,.4 5 6 6 isWdC	!$0MM'388:.!!$!77  
	vvay:<<> > # $028$9 : :55" $D E E 
	8  	vvay33" $D E E		s2   A*J) .:L )
L3ALL
M #L;;M r*  r+  r  r`   rD   rB   rc  rc    sj     0H ))--.. 	tW#JQTC	)M
 "J@D>rD   rc  c                   X    \ rS rSrSr0 r\" 5       \S'   \" 5       \S'   \" 5       \S'   Sr	g)cmd_startupi_  z+Manage Startup Scripts Group Policy Objectsr   r(  r   r`   N)
r  r  r  r  r-  r  rH  rR  rc  r	  r`   rD   rB   rg  rg  _  s1    5K*,K(*K.0KrD   rg  c                   0    \ rS rSrSr0 r\" 5       \S'   Srg)cmd_scriptsif  z#Manage Scripts Group Policy Objectsstartupr`   N)r  r  r  r  r-  r  rg  r	  r`   rD   rB   ri  ri  f  s    -K(]K	rD   ri  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rS/rSS jrSrg)cmd_list_motdik  zList VGP MOTD Group Policy from the sysvol

This command lists the Message of the Day from the sysvol that will be applied
to winbind clients.

Example:
samba-tool gpo manage motd list {31B2F340-016D-11D2-945F-00C04FB984F9}
    ra  r  r  r  r  r  r  r  r   Nc                    UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9nU R                  R                  S5      nS	R                  UR                  5       S
USS/5      n	 [        R                  " UR                  U	5      5      n
U
R-                  S5      nUR,                  " S5      nUR-                  S5      nU R.                  R1                  UR2                  5        g ! [         aO  nUR                   S   ["        [$        [&        4;   a   S nAg UR                   S   [(        :X  a  [+        S5      ee S nAff = f)NTr  rg   rd  re  rg  rh  ri  r   rj  r  zMOTD\manifest.xmlr   rm  r~  r   r  r&  ri   r'  rj   rU   rk   r   rn   r3   ru  r>   r   r  r  r   r   rv  r-   r.   r/   r1   r   r  r   r   r  r   r   r  r  r  r  r}  r   ri  r  r  rm   r   r   r  s                  rB   r(  cmd_list_motd.run  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 G$))U[[]J : 46 7
	}}T]]7%;<H /{{6"yy 				"  	vvay:<<> > vvay33" $D E E	   %F 
G"G2#GGr*  r+  r  r`   rD   rB   rl  rl  k  a     'H ))--.. 	tW#JQTC	)M
 J%#rD   rl  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rSS/r  SS jrSrg)cmd_set_motdi  a  Sets a VGP MOTD Group Policy to the sysvol

This command sets the Message of the Day to the sysvol for applying to winbind
clients. Not providing a value will unset the policy.

Example:
samba-tool gpo manage motd set {31B2F340-016D-11D2-945F-00C04FB984F9} "Message for today"
    %prog <gpo> [value] [options]r  r  r  r  r  r  r  r   r  Nc                    UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX0l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9nU R                  5         [        XR                  U R                  U R                  U5      n	U R                  R                  S5      n
S	R                  U
R                  5       S
US/5      nS	R                  US/5      nUc!  UR                  U5        U	R!                  SS9  g  ["        R$                  " ["        R&                  " UR)                  U5      5      5      nUR+                  5       R-                  S5      nUR-                  S5      nUR-                  S5      nUc  ["        R:                  " US5      nUUl        [C        5       nURE                  USSS9  URG                  S5         [I        X5        URK                  UURM                  5       5        U	R!                  SS9  g ! [.         GaM  nUR0                  S   [2        [4        [6        4;   Ga  ["        R$                  " ["        R8                  " S5      5      n["        R:                  " UR+                  5       S5      n["        R:                  " US5      nSUl        ["        R:                  " US5      nSUl        ["        R:                  " US5      nSUl        ["        R:                  " US5      nSUl        ["        R:                  " US5      n["        R:                  " US5      nSUl         S nAGNUR0                  S   [>        :X  a  [A        S5      ee S nAff = f! [.         a(  nUR0                  S   [>        :X  a  [A        S5      ee S nAff = f) NTr  rg   rd  re  rg  rh  ri  r   rj  zMACHINE\VGP\VTLA\Unix\MOTDr}  r  r~  r   r   r  r  r  rr   	Text Filer  Represents a Generic Text Filer  r  filenamemotdrm  r  r  r  )'r&  ri   r'  rj   rU   rk   r   rn   r3   r  r5   r   ru  r>   r   r1  r  r  r  r  r   r  r  r   rv  r-   r.   r/   r  r  r  r1   r   r)   r   r  r2   r   r   )r   r   r?   r  r  r  r  r}  r   r  ri  r  r  r  r~  r   rm   r  rr   r  r  ry  r  r  s                           rB   r(  cmd_set_motd.run  sT   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 	#C$**djj!LG$))U[[]J=? @))Wn56=KK !!$!7	~~bmmDMM'4J&KLH$,,.33ODM %%f-D4 yy <==v.D	isWdC	!$0MM'388:.!!$!7I  	vvay:<<> > >>"**[*AB "h.>.>.@.=!?]]=)<}}]F;'	 mmM=I#C ]]=,G
"+
}}]F;==z: &55" $D E E /	J  	vvay33" $D E E		s8   4A)I7 <:O 7ODO
'#O

O
P#O??Pr*  r  r  r`   rD   rB   rt  rt    sk     /H ))--.. 	tW#JQTC	)M
 "JDHMrD   rt  c                   D    \ rS rSrSr0 r\" 5       \S'   \" 5       \S'   Srg)cmd_motdi  z.Manage Message of the Day Group Policy Objectsr   r  r`   N)	r  r  r  r  r-  r  rl  rt  r	  r`   rD   rB   r}  r}    s"    8K'/K%KrD   r}  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rS/rSS jrSrg)cmd_list_issuei  zList VGP Issue Group Policy from the sysvol

This command lists the Prelogin Message from the sysvol that will be applied
to winbind clients.

Example:
samba-tool gpo manage issue list {31B2F340-016D-11D2-945F-00C04FB984F9}
    ra  r  r  r  r  r  r  r  r   Nc                    UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9nU R                  R                  S5      nS	R                  UR                  5       S
USS/5      n	 [        R                  " UR                  U	5      5      n
U
R-                  S5      nUR,                  " S5      nUR-                  S5      nU R.                  R1                  UR2                  5        g ! [         aO  nUR                   S   ["        [$        [&        4;   a   S nAg UR                   S   [(        :X  a  [+        S5      ee S nAff = f)NTr  rg   rd  re  rg  rh  ri  r   rj  r  zIssue\manifest.xmlr   rm  r~  r   r  rn  ro  s                  rB   r(  cmd_list_issue.run2  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 G$))U[[]J : 57 8
	}}T]]7%;<H /{{6"yy 				"  	vvay:<<> > vvay33" $D E E	rq  r*  r+  r  r`   rD   rB   r  r    rr  rD   r  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rSS/r  SS jrSrg)cmd_set_issueiY  a  Sets a VGP Issue Group Policy to the sysvol

This command sets the Prelogin Message to the sysvol for applying to winbind
clients. Not providing a value will unset the policy.

Example:
samba-tool gpo manage issue set {31B2F340-016D-11D2-945F-00C04FB984F9} "Welcome to Samba!"
    ru  r  r  r  r  r  r  r  r   r  Nc                 ^   UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX0l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9nU R                  5         [        XR                  U R                  U R                  U5      n	U R                  R                  S5      n
S	R                  U
R                  5       S
US/5      nS	R                  US/5      nUc!  UR                  U5        U	R!                  SS9  g  ["        R$                  " UR'                  U5      5      n["        R6                  " WS5      nUUl        [A        5       nURC                  USSS9  URE                  S5         [G        X5        URI                  UURK                  5       5        U	R!                  SS9  g ! [(         GaM  nUR*                  S   [,        [.        [0        4;   Ga  ["        R2                  " ["        R4                  " S5      5      n["        R6                  " UR9                  5       S5      n["        R6                  " US5      nSUl        ["        R6                  " US5      nSUl        ["        R6                  " US5      nSUl        ["        R6                  " US5      nSUl        ["        R6                  " US5      n["        R6                  " US5      nSUl         S nAGNUR*                  S   [<        :X  a  [?        S5      ee S nAff = f! [(         a(  nUR*                  S   [<        :X  a  [?        S5      ee S nAff = f) NTr  rg   rd  re  rg  rh  ri  r   rj  zMACHINE\VGP\VTLA\Unix\Issuer}  r  r   r  r~  r  r  rr   rw  r  rx  r  r  r   ry  issuerm  r  r  r  )&r&  ri   r'  rj   rU   rk   r   rn   r3   r  r5   r   ru  r>   r   r1  r  r  r  r   r   rv  r-   r.   r/   r  r  r  r  r  r1   r   r)   r   r  r2   r   r   )r   r   r?   r  r  r  r  r}  r   r  ri  r  r  r  rm   r~  r  rr   r  r  r   ry  r  r  s                           rB   r(  cmd_set_issue.runr  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 	#C$**djj!LG$))U[[]J>@ A))Wn56=KK !!$!7	}}T]]7%;<H4 }}T6*	isWdC	!$0MM'388:.!!$!7E  	vvay:<<> > >>"**[*AB "h.>.>.@.=!?]]=)<}}]F;'	 mmM=I#C ]]=,G
"+
}}]F;==z: '55" $D E E /	F  	vvay33" $D E E		s7   4%H $:M: M7*DM2#M22M7:
N,#N''N,r*  r  r  r`   rD   rB   r  r  Y  sk     /H ))--.. 	tW#JQTC	)M
 "JDHIrD   r  c                   D    \ rS rSrSr0 r\" 5       \S'   \" 5       \S'   Srg)	cmd_issuei  z!Manage Issue Group Policy Objectsr   r  r`   N)	r  r  r  r  r-  r  r  r  r	  r`   rD   rB   r  r    s#    +K(*K&KrD   r  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rS/rSS jrSrg)cmd_list_accessi  zList VGP Host Access Group Policy from the sysvol

This command lists host access rules from the sysvol that will be applied to winbind clients.

Example:
samba-tool gpo manage access list {31B2F340-016D-11D2-945F-00C04FB984F9}
    ra  r  r  r  r  r  r  r  r   Nc                    UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  nX l        OD[        U R                  U R                  5      n[        U R                  U R                  US9U l        [        USU R                  U R                  S9nU R                  R                  S5      nS	R                  UR                  5       S
USS/5      n	 [        R                  " UR                  U	5      5      n
U
b  U
R-                  S5      nUR,                  " S5      nUR/                  S5       Hn  nUR-                  S5      nUR-                  S5      nUR-                  S5      nU R0                  R3                  SUR4                  < S	UR4                  < S35        Mp     S	R                  UR                  5       S
USS/5      n	 [        R                  " UR                  U	5      5      nUb  UR-                  S5      nUR,                  " S5      nUR/                  S5       Hn  nUR-                  S5      nUR-                  S5      nUR-                  S5      nU R0                  R3                  SUR4                  < S	UR4                  < S35        Mp     g g ! [         aR  nUR                   S   ["        [$        [&        4;   a  S n
 S nAGNUR                   S   [(        :X  a  [+        S5      ee S nAff = f! [         aR  nUR                   S   ["        [$        [&        4;   a  S n S nAGN>UR                   S   [(        :X  a  [+        S5      ee S nAff = f)NTr  rg   rd  re  rg  rh  ri  r   rj  MACHINE\VGP\VTLA\VASz$HostAccessControl\Allow\manifest.xmlr   rm  r~  r   r  adobjectrr   r  z+:z:ALL
z#HostAccessControl\Deny\manifest.xmlz-:r  )r   r   r  r  r  r  r}  r   ri  r  allowrm   r   r   r  r  rr   r  denys                      rB   r(  cmd_list_access.run  s    ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 G$))U[[]J6EG H	MM$--"89E ZZ0F;;v&D#||M:&++J7}}V,!x0		FKK KL	  ; ))U[[]J6DF G	==w!78D YY/F;;v&D#||M:&++J7}}V,!x0		FKK KL	  ; I  		vvay:<<> > 55" $D E E 		2  		vvay:<<> > 55" $D E E 		s<   %K 5%L$ 
L!$L9#LL!$
N .$M;#M;;N r*  r+  r  r`   rD   rB   r  r    sc     'H ))--.. 	tW#JQTC	)M
 JCMrD   r  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/r/ SQr  SS jrSrg)cmd_add_accessi   aS  Adds a VGP Host Access Group Policy to the sysvol

This command adds a host access setting to the sysvol for applying to winbind
clients. Any time an allow entry is detected by the client, an implicit deny
ALL will be assumed.

Example:
samba-tool gpo manage access add {31B2F340-016D-11D2-945F-00C04FB984F9} allow goodguy example.com
    z0%prog <gpo> <allow/deny> <cn> <domain> [options]r  r  r  r  r  r  r  )r   r  cnr  Nc	                    UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  n	XPl        OD[        U R                  U R                  5      n	[        U R                  U R                  U	S9U l        [        U	SU R                  U R                  S9n
U R                  5         [        XR                  U R                  U R                  U5      nU R                  R                  S5      nUS	:X  a%  S
R                  UR                  5       SUSS/5      nO9US:X  a%  S
R                  UR                  5       SUSS/5      nO[        SU-  5      eS
R                  US/5      n [         R"                  " [         R$                  " U
R'                  U5      5      5      nUR)                  5       R+                  S5      nUR*                  " S5      n[        U R                  U R                  US9n[?        U[A        5       U R                  U R                  S9nURC                  URE                  5       [F        RH                  S U-  / S!QS"9n[K        U5      S:X  a  [        S#U-  5      e[M        US   S$   S%   5      nUS&;  a  [        S'U-  5      e[         R8                  " US(5      n[         R8                  " US)5      nURO                  5       Ul        [         R8                  " US*5      nURQ                  5       < S
[M        US   S+   S%   5      < 3Ul        US,:X  a  [         R8                  " US-5      nS.Ul        [         R8                  " US/5      n[         R8                  " US5      n[M        US   S+   S%   5      Ul        [         R8                  " US05      n UU l        [         R8                  " US)5      nUUl        [S        5       n!URU                  U!S1SS29  U!RW                  S5         [Y        X5        U
R[                  UU!R]                  5       5        UR_                  SS39  g ! [,         Ga.  nUR.                  S   [0        [2        [4        4;   a  [         R"                  " [         R6                  " S5      5      n[         R8                  " UR)                  5       S5      n[         R8                  " US5      nSUl        [         R8                  " US5      nSUl        [         R8                  " US5      nSUl        [         R8                  " US5      nSUl        [         R8                  " US5      n S nAGNgUR.                  S   [<        :X  a  [        S5      ee S nAff = f! [,         a(  nUR.                  S   [<        :X  a  [        S5      ee S nAff = f)4NTr  rg   rd  re  rg  rh  ri  r  r   rj  r  HostAccessControl\Allowr  HostAccessControl\DenyBThe entry type must be either 'allow' or 'deny'. Unknown type '%s'r}  r~  r   r   r  r  r  rr   zHost Access Controlr  z0Represents host access control data (pam_access)r  r  rm  r   z(cn=%s))userPrincipalNamesamaccountnamer8  r   z!Unable to find user or group "%s"r8  )r>  r  z%s is not a user or groupr  r  r  r  r  	groupattrsamAccountNamer  r  r  r  r  )0r&  ri   r'  rj   rU   rk   r   rn   r3   r  r5   r   ru  r>   r   r   r  r  r  r   r  r  r   rv  r-   r.   r/   r  r  r  r1   r   r   r   	domain_dnr   SCOPE_SUBTREErT   r&   r$  domain_netbios_namer)   r   r  r2   r   r   r  )"r   r   r  r  r  r  r  r  r  r}  r   r  ri  r  r  r  r   r   rm   r~  r  rr   r  r  rk   r   resobjectclassr  r  r  r  
domain_elmr  s"                                     rB   r(  cmd_add_access.run:  s   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 	#C$**djj!LG$Gii
C!:!;!= >G f_ii
C!:!:!< =G   ;=B C D D))Wn56	~~bmmDMM'4J&KLH%%',,_=F;;v&D0 TWWdjjV4#N,<"&**: ll 1!$!2!2&/"n"1  2 s8q=BRGHH Q!6r!:;//:R?@@mmD-8k62 &&(
k73!&!:!:!<!+CF3C,DR,H!IK
'!dK8I-IN==j9}}Xv.s1v&67;<	]]8X6
 
h/ 
isWdC	!$0MM'388:.!!$!7  	vvay:<<> > >>"**[*AB "h.>.>.@.=!?]]=)<}}]F;1	 mmM=I#U ]]=,G
")
}}]F;55" $D E E +	@  	vvay33" $D E E		s8   A*Q :V V
D V"#VV

V?#V::V?r*  r+  r  r`   rD   rB   r  r     sg     BH ))--.. 	tW#JQTC	)M
 2J<@'+krD   r  c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/r/ SQr  SS jrSrg)cmd_remove_accessi  a  Remove a VGP Host Access Group Policy from the sysvol

This command removes a host access setting from the sysvol for applying to
winbind clients.

Example:
samba-tool gpo manage access remove {31B2F340-016D-11D2-945F-00C04FB984F9} allow goodguy example.com
    z2%prog <gpo> <allow/deny> <name> <domain> [options]r  r  r  r  r  r  r  )r   r  rr   r  Nc	                 *   UR                  5       U l        UR                  U R                  SS9U l        U(       a"  UR	                  S5      (       a  USS  n	XPl        OD[        U R                  U R                  5      n	[        U R                  U R                  U	S9U l        [        U	SU R                  U R                  S9n
U R                  5         [        XR                  U R                  U R                  U5      nU R                  R                  S5      nUS	:X  a%  S
R                  UR                  5       SUSS/5      nO9US:X  a%  S
R                  UR                  5       SUSS/5      nO[        SU-  5      eS
R                  US/5      n [         R"                  " [         R$                  " U
R'                  U5      5      5      nUR)                  5       R+                  S5      nUR*                  " S5      nUR9                  S5       Hu  nUR+                  S5      nUR+                  S5      nUR+                  S5      nUc  M;  UR:                  U:X  d  MM  Uc  MR  UR:                  U:X  d  Md  UR=                  U5          O   [        SU-  5      e[?        5       nURA                  USSS9  URC                  S5         [E        X5        U
RG                  UURI                  5       5        URK                  SS9  g ! [,         aX  nUR.                  S   [0        [2        [4        4;   a  [        SU-  5      eUR.                  S   [6        :X  a  [        S5      ee S nAff = f! [,         a(  nUR.                  S   [6        :X  a  [        S5      ee S nAff = f)NTr  rg   rd  re  rg  rh  ri  r  r   rj  r  r  r  r  r  r}  r~  r   r   z0Cannot remove %s entry because it does not existrm  r  r  rr   r  r  r  r  )&r&  ri   r'  rj   rU   rk   r   rn   r3   r  r5   r   ru  r>   r   r   r  r  r  r   r  r  r   rv  r-   r.   r/   r1   r  r  r   r)   r   r  r2   r   r   r  )r   r   r  rr   r  r  r  r  r  r}  r   r  ri  r  r  r  r   r   rm   r  r  name_elmr  r  s                           rB   r(  cmd_remove_access.run  sG   ((*--dgg-M
 i((AB%KH'<KdggtzzkBDH k&!%$(JJ0
 	#C$**djj!LG$Gii
C!:!;!= >G f_ii
C!:!:!< =G   ;=B C D D))Wn56	~~bmmDMM'4J&KLH%%',,_=F;;v&D  <<6K"''
3H}}V,H!x0J#(=%*//V*CK( 7   /16 7 8 8 isWdC	!$0MM'388:.!!$!7=  
	vvay:<<> > # $/16$7 8 855" $D E E 
	>  	vvay33" $D E E		s2   A*K;  :M  ;
MAMM 
N*#NNr*  r+  r  r`   rD   rB   r  r    sg     DH ))--.. 	tW#JQTC	)M
 4J>B'+JrD   r  c                       \ rS rSrSrSr\R                  \R                  S.r	\
" SSSSS	9\
" S
SSSS	9/rSS/r  SS jrSrg)cmd_cse_registeri  a  Register a Client Side Extension (CSE) on the current host

This command takes a CSE filename as an argument, and registers it for
applying policy on the current host. This is not necessary for CSEs which
are distributed with the current version of Samba, but is useful for installing
experimental CSEs or custom built CSEs.
The <cse_file> argument MUST be a permanent location for the CSE. The register
command does not copy the file to some other directory. The samba-gpupdate
command will execute the CSE from the exact location specified from this
command.

Example:
samba-tool gpo cse register ./gp_chromium_ext.py gp_chromium_ext --machine
    z%%prog <cse_file> <cse_name> [options]r  r  z	--machineFr  z-Whether to register the CSE as Machine policy)r  r  r  z--userz*Whether to register the CSE as User policycse_filecse_nameNc           	      F   UR                  5       U l        US:X  a  US:X  a  [        S5      eS[        [        R
                  " 5       5      -  n[        R                  R                  U5      n[        XrUU R                  R                  X4S9n	U	(       d  [        SU-  5      eg )NFz+Either --machine or --user must be selectedr  )smb_confmachiner>  zFailed to register CSE "%s")r&  ri   r   r   r"  r#  r   r   realpathr7   r8  )
r   r  r  r  r>  r  r  ext_guidext_pathrA   s
             rB   r(  cmd_cse_register.run,  s    ((*eLMMC

--77##H-#H-1WW-?-?,3@ <xGHH rD   ri   )FFNN)r  r  r  r  r-  r.  rG   r/  r0  r2  r   r3  r^  r(  r	  r`   rD   rB   r  r    so     7H ))-- 	{E,C	Ex|@	BM j)J:?(,IrD   r  c                   X    \ rS rSrSrSr\R                  \R                  S.r	SS jr
Srg)	cmd_cse_listi;  zList the registered Client Side Extensions (CSEs) on the current host

This command lists the currently registered CSEs on the host.

Example:
samba-tool gpo cse list
    r  r  Nc                    UR                  5       U l        [        U R                  R                  5      nUR	                  5        H  u  pEU R
                  R                  SU-  5        U R
                  R                  SUS   -  5        U R
                  R                  SUS   -  5        U R
                  R                  S[        US   5      -  5        U R
                  R                  S[        US	   5      -  5        M     g )
NzUniqueGUID         : %s
zFileName           : %s
DllNamezProcessGroupPolicy : %s
ProcessGroupPolicyzMachinePolicy      : %s
MachinePolicyzUserPolicy         : %s


UserPolicy)r&  ri   r8   r8  r  r   r   r   )r   r  r  csesr3  gp_exts         rB   r(  cmd_cse_list.runK  s    ((*!$''"4"45 JJLLDIIOO7$>?IIOO7&:KKLIIOO7/01 2IIOO7/01 2IIOO9|,-. / )rD   r  NN)r  r  r  r  r-  r.  rG   r/  r0  r2  r(  r	  r`   rD   rB   r  r  ;  s/     !H ))--
/rD   r  c                   ^    \ rS rSrSrSr\R                  \R                  S.r	S/r
S	S jrSrg)
cmd_cse_unregisteriY  aq  Unregister a Client Side Extension (CSE) from the current host

This command takes a unique GUID as an argument (representing a registered
CSE), and unregisters it for applying policy on the current host. Use the
`samba-tool gpo cse list` command to determine the unique GUIDs of CSEs.

Example:
samba-tool gpo cse unregister {3F60F344-92BF-11ED-A1EB-0242AC120002}
    z%prog <guid> [options]r  r3  Nc                     UR                  5       U l        [        XR                  R                  5      nU(       d  [	        SU-  5      eg )NzFailed to unregister CSE "%s")r&  ri   r9   r8  r   )r   r3  r  r  rA   s        rB   r(  cmd_cse_unregister.runm  s?    ((*%dGG,>,>?>EFF rD   r  r  )r  r  r  r  r-  r.  rG   r/  r0  r2  r^  r(  r	  r`   rD   rB   r  r  Y  s9     (H ))--
 JGrD   r  c                   X    \ rS rSrSr0 r\" 5       \S'   \" 5       \S'   \" 5       \S'   Sr	g)cmd_cseit  zManage Client Side Extensionsregisterr   
unregisterr`   N)
r  r  r  r  r-  r  r  r  r  r	  r`   rD   rB   r  r  t  s0    'K.0K
&.K 2 4KrD   r  c                   X    \ rS rSrSr0 r\" 5       \S'   \" 5       \S'   \" 5       \S'   Sr	g)
cmd_accessi{  z'Manage Host Access Group Policy Objectsr   r(  r   r`   N)
r  r  r  r  r-  r  r  r  r  r	  r`   rD   rB   r  r  {  s1    1K)+K')K-/KrD   r  c                       \ rS rSrSr0 r\" 5       \S'   \" 5       \S'   \" 5       \S'   \	" 5       \S'   \
" 5       \S'   \" 5       \S'   \" 5       \S	'   \" 5       \S
'   \" 5       \S'   \" 5       \S'   Srg)
cmd_managei  zManage Group Policy Objectssudoersr
   r  symlinkrn  opensshscriptsrz  r  accessr`   N)r  r  r  r  r-  r  r  r  r   r  r4  rF  ri  r}  r  r  r	  r`   rD   rB   r  r    s    %K(]K	*nK
*nK
(]K	$;K(]K	(]K	"*K$;K&LKrD   r  c                      \ rS rSrSr0 r\" 5       \S'   \" 5       \S'   \" 5       \S'   \	" 5       \S'   \
" 5       \S'   \" 5       \S'   \" 5       \S	'   \" 5       \S
'   \" 5       \S'   \" 5       \S'   \" 5       \S'   \" 5       \S'   \" 5       \S'   \" 5       \S'   \" 5       \S'   \" 5       \S'   \" 5       \S'   \" 5       \S'   \" 5       \S'   \" 5       \S'   Srg)cmd_gpoi  z%Group Policy Object (GPO) management.listallr   showr  r   getlinksetlinkdellinklistcontainersgetinheritancesetinheritancefetchcreatedelaclcheckr@  restoreadmxloadmanagecser`   N)r  r  r  r  r-  r  r  r5  r`  r  r  r  r  r  r  r  r  r  r
  rO  r_  r  r?  rf  r  r  r	  r`   rD   rB   r  r    s    /K(]K	"*K"*K"*K&LK(]K	(]K	(]K	$6$8K !$6$8K !$6$8K !$;K&LK K*nK
&LK(]K	*nK
&LK KrD   r  r  )FF)r   r  samba.getoptgetoptrG   r   r   xml.etree.ElementTreeetreer  r  r  r   
samba.authr   samba.netcmdr   r   r   r   samba.samdbr   r?  r	   samba.dcerpcr
   	samba.ndrr   r   r   samba.securityr   r   r   samba.netcmd.commonr   r   samba.samba3r   r   r   r"  samba.ntaclsr   r   	samba.netr   samba.gp_parser   r   r   samba.gp_parse.gp_polr   samba.gp_parse.gp_inir   r   r   r   samba.gp_parse.gp_csvr    samba.gp_parse.gp_infr!   samba.gp_parse.gp_aasr"   r#   r$   samba.commonr%   r&   configparserr'   ior(   r)   samba.gp.vgp_files_extr*   r+   rZ  r{  samba.registryr,   samba.ntstatusr-   r.   r/   r0   r1   samba.netcmd.gpcommonr2   r3   r4   samba.policiesr5   samba.dcerpc.miscr6   samba.gp.gpclassr7   r8   r9   rC   rH   r]   re   rn   rF  rG  rH  SECINFO_SACLr   r   r   r   
IGNORECASEr   r   FILE_ATTRIBUTE_SYSTEMr   FILE_ATTRIBUTE_ARCHIVEFILE_ATTRIBUTE_HIDDENr   r   r   r   r  r5  r`  r  r  r  r  r  r  r  r  r  r  r
  r?  rO  r_  rf  rw  r  r  r  r  r  r  r  r  r   r  r  r  r  r  r   r/  r4  r6  r@  rF  rH  rR  rc  rg  ri  rl  rt  r}  r  r  r  r  r  r  r  r  r  r  r  r  r  r`   rD   rB   <module>r     s  * 
 
  
 	 " "   %    ! *    } } -  8   $   O O -  3 2 -  , . %   <   &  
 1 * $ !dt#11#112#001 $001+\	#CL MM :2< )),,-**+ ))*
/2 8=7<",J+N +N\""* ""Jr:z r:jcz cLoz odT Tn,J* ,J^WM* WMt$M* $MN!B !BH); );X3X 3Xl87
 87vK K\PI PIfh<* h<VG3j G3T=O: =O~JQ7 JQXzj zxc5w c5J@& @&D1, 1yz yvD< D<L.< .?F ?FBfz fP,< ,?Jw ?JB\j \|Y Yv1, 1D(W D(LoJ obZz Zx/ /BEw BEHyj yv+, +L?w L?\mj m^V Vp1, 1+, +
>#G >#@f: fP(| (>#W >#@bJ bH) )[Mg [MzEZ ENc
 cJ-Iw -I^/7 /<G G65l 50 0) )#l #rD   