
    gI                     T   S SK r S SKrS SKJr  S SKJr  S SKJr  S SK	J
r
  S SKJr  S SKJrJr  S SKJr  S SKJrJrJr  S S	KJrJr  S S
KJr  SSKJrJrJrJ r   S r! " S S\5      r" " S S\5      r# " S S\5      r$ " S S\5      r% " S S\5      r& " S S\5      r' " S S\5      r(g)    N)	provision)system_session)system_session_unix)DONT_USE_KERBEROS)securityidmap)	ndr_print)setntaclgetntacl
getdosinfo)parampassdb)SamDB   )CommandCommandErrorSuperCommandOptionc                    SnU R                  5       nUS:X  a  Sn[        R                  " 5       nUR                  U R                  5        U(       a2   [        [        5       U S9nUR                  SSUR                  -  5         U(       a"  [        R                  " WR                  5      nU$ [        R                  " 5       n U$ ! [         a  n[        SU5      eS nAff = f!   [        S5      e= f)	NFROLE_ACTIVE_DIRECTORY_DCTsession_infolpUnable to open samdb:passdb backendsamba_dsdb:%sz2Unable to read domain SID from configuration files)server_roles3paramget_contextload
configfiler   r   	Exceptionr   seturlr   dom_sid
domain_sidr   get_domain_sid)r   is_ad_dcr   s3confsamdber&   s          4/usr/lib/python3/dist-packages/samba/netcmd/ntacl.pyget_local_domain_sidr-   $   s    H.."K00  "F
KK	;~'7!E 	

#_uyy%@A$!))%*:*:;J 	  ..0J   	;6::	;$ # $ 	$s*   C 'C$ .C$ 
C!CC!$C1c                      \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SS\R                  SS9\" S	S
SSS9\" SSSSS/S9\" SSSS9\" SSSS9\" SSSS9\" SSSS9\" SSSS9\" SSSS9/	rS S!/r    S%S# jrS$rg")&cmd_ntacl_setB   zSet ACLs on a file.z%prog <acl> <path> [options]	sambaoptscredoptsversionoptsz-qz--quiet
store_truehelpaction-v	--verbose
Be verbose--xattr-backendchoice%xattr backend type (native fs or tdb)nativetdbtyper7   choices--eadb-file0Name of the tdb file where attributes are storedstringr7   rB   --use-ntvfsLSet the ACLs directly to the TDB or xattr for use with the ntvfs file server
--use-s3fsHSet the ACLs for use with the default s3fs file server via the VFS layer--recursive;Set the ACLs for directories and their contents recursively--follow-symlinksFollow symlinks	--servicez:Name of the smb.conf service to use when applying the ACLsaclpathNc                 |  ^ ^^^^^^^^^^ T R                  5       nU
R                  5       m[        T5      mT(       d  U(       d  STR                  S5      ;   mO	U(       a  SmUUUUUUU UUUU4S jnU" U5        T(       a  [        R
                  R                  U5      (       a~  [        R                  " UTS9 He  u  nnnU H)  nU" [        R
                  R                  UU5      5        M+     U H)  nU" [        R
                  R                  UU5      5        M+     Mg     T(       a  UR                  S5        g g )Nsmbserver servicesFc                   > T(       dX  [         R                  R                  U 5      (       a4  T(       a  TR                  R	                  SU -  5        g [        SU -  5      eT(       a  [         R                  R                  U 5      (       a  TR                  R	                  SU -  5        Oa[         R                  R                  U 5      (       a  TR                  R	                  SU -  5        OTR                  R	                  SU -  5         [        TU T[        T5      [        5       TTT
T	S9	  g ! [         a  n[        SU < SU< 35      eS nAff = f)	Nignored symlink: %s
'symlink: %s: requires --follow-symlinkssymlink: %s
dir: %s
	file: %s
	use_ntvfsserviceCould not set acl for : )osrR   islinkoutfwriter   isdirr
   strr   r"   )_pathr+   rQ   r&   	eadb_filefollow_symlinksr   	recursiveselfr^   r]   verbosexattr_backends     r,   _setntacl_path)cmd_ntacl_set.run.<locals>._setntacl_pathj   s   "rww~~e'<'<IIOO$;e$CD"#LPU#VWW77>>%((IIOOOe$;<WW]]5))IIOOK%$78IIOOL5$89PZ,.&"#,!(*  P"UA#NOOPs   "D0 0
E:EEfollowlinksPPlease note that POSIX permissions have NOT been changed, only the stored NT ACL)

get_loggerget_loadparmr-   getra   rR   re   walkjoinwarning)rk   rQ   rR   r]   use_s3fsquietrl   rm   rh   r3   r2   r4   rj   ri   r^   loggerrn   rootdirsfilesnamer&   r   s   `` `  ```   ```      @@r,   runcmd_ntacl_set.run]   s     "##%)"-
(9!::II	P 	P6 	tt,,%'WWT%O!dE!D"277<<d#;< " D"277<<d#;< ! &P NNmn      )FFFFNNNNNFFN)__name__
__module____qualname____firstlineno____doc__synopsisoptionsSambaOptionsCredentialsOptionsVersionOptionstakes_optiongroupsr   optparseSUPPRESS_HELPtakes_options
takes_argsr   __static_attributes__r   r   r,   r/   r/   B   s    -H ))..-- 	tYX%;%;LQt[|LI x6] %(	*}#U\de}#q  {G  	H|"l  vB  	C}#`iuv"):<P{!]dlmM J7<FJ7;<@2or   r/   c                   t    \ rS rSrSrSr\R                  \R                  \R                  S.r
S/rS	S jrSrg)
cmd_dosinfo_get   z"Get DOS info of a file from xattr.%prog <file> [options]r1   fileNc                     UR                  5       n[        R                  " 5       nUR                  UR                  5        [        XQ5      nU(       a%  U R                  R                  [        U5      5        g g )N)	rt   r   r   r    r!   r   rc   rd   r	   )rk   r   r3   r2   r4   r   r)   dosinfos           r,   r   cmd_dosinfo_get.run   sU    ##%$$&BMM"R&IIOOIg./ r   r   NNN)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r,   r   r      s=    ,'H ))..-- J0r   r   c                       \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSSS9\" S	S
SSS/S9\" SSSS9\" SSSS9\" SSSS9\" SSSS9/rS/r    SS jrSrg)cmd_ntacl_get   zGet ACLs of a file.r   r1   z	--as-sddlzOutput ACL in the SDDL formatr5   r6   r<   r=   r>   r?   r@   rA   rD   rE   rF   rG   rH   zKGet the ACLs directly from the TDB or xattr used with the ntvfs file serverrJ   zKGet the ACLs for use via the VFS layer used by the default s3fs file serverrP   z9Name of the smb.conf service to use when getting the ACLsr   Nc           
      r   UR                  5       n[        U5      nU(       d  U(       d  SUR                  S5      ;   nO	U(       a  Sn[        UU[	        5       UUUU
S9nU(       a.  U R
                  R                  UR                  U5      S-   5        g U R
                  R                  [        U5      5        g )NrT   rU   Fdirect_db_accessr^   
)	rt   r-   ru   r   r   rc   rd   as_sddlr	   )rk   r   r]   ry   r   rm   rh   r3   r2   r4   r^   r   r&   rQ   s                 r,   r   cmd_ntacl_get.run   s     ##%)"-
(9!::IIr*,$ (1&( IIOOCKK
3d:;IIOOIcN+r   r   )	FFFNNNNNN)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r,   r   r      s    'H ))..-- 	{!@V x6] %(	*}#U\de}#p  zF  	G|"o  yE  	F{!\cklM J279=7;,r   r   c                       \ rS rSrSrSrS\R                  0r\	" SSSS9\	" S	S
SS9\	" SSSS9\	" SSSS9\	" SSSSS/S9\	" SSSSS9\	" SSSS9\	" SSSSS9/r
/ SQr         S#S! jrS"rg )$cmd_ntacl_changedomsid   zChange the domain SID for ACLsz9%prog <Orig-Domain-SID> <New-Domain-SID> <file> [options]r2   rP   z#Name of the smb.conf service to userF   rG   rH   rI   r5   r6   rJ   rK   rD   rE   r<   r=   r>   r?   r@   rA   z-rrL   rM   rN   rO   r9   r:   r;   )old_domain_sidnew_domain_sidrR   Nc                   ^ ^^^^^
^^^^^^^ T R                  5       nU	R                  5       m[        T5      mT(       d  U(       d  STR                  S5      ;   mO	U(       a  SmT(       d  T(       d  [	        S5      e [
        R                  " U5      m [
        R                  " U5      mUUUUUUU
U UUUU4S jmUU4S jnT" U5        T
(       a,  [        R                  R                  U5      (       a  U" U5        T(       a  UR                  S	5        g g ! [         a  n[	        SU< SU< 35      eS nAff = f! [         a  n[	        SU< SU< 35      eS nAff = f)
NrT   rU   Fz0Must provide a share name with --service=<share>zCould not parse old sid r`   c                   > T	(       dX  [         R                  R                  U 5      (       a4  T(       a  TR                  R	                  SU -  5        g [        SU -  5      eT(       a  [         R                  R                  U 5      (       a  TR                  R	                  SU -  5        Oa[         R                  R                  U 5      (       a  TR                  R	                  SU -  5        OTR                  R	                  SU -  5         [        T
U [        5       TTTTS9nUR                  T5      nT(       a  TR                  R	                  S	U-  5        UU4S
 jnU" UR                  5      Ul        U" UR                  5      Ul        UR                  (       a4  UR                  R                   H  nU" UR                  5      Ul        M     UR                   (       a4  UR                   R                   H  nU" UR                  5      Ul        M     UR                  T5      nT(       a  TR                  R	                  SU-  5        X6:X  a#  T(       a  TR                  R	                  S5        g [#        T
U UT[        5       TTTTS9	  g ! [         a  n[        SU < SU< 35      eS nAff = f! [         a  n[        SU < SU< 35      eS nAff = f)NrW   rX   rY   rZ   r[   r   zCould not get acl for r`   zbefore:
%s
c                 n   > U R                  5       u  pUT:X  a  [        R                  " STU4-  5      $ U $ )Nz%s-%i)splitr   r%   )siddomridr   r   s      r,   replace_domain_sidNcmd_ntacl_changedomsid.run.<locals>.changedom_sids.<locals>.replace_domain_sidM  s8     YY[
.(#++G~s6K,KLL
r   z
after:
%s
znothing to do
Tr\   r_   )ra   rR   rb   rc   rd   r   re   r   r   r"   r   	owner_sid	group_sidsaclacestrusteedaclr
   )rg   rQ   r+   	orig_sddlr   acenew_sddlr&   rh   ri   r   r   r   rj   rk   r^   r]   rl   rm   s          r,   changedom_sids2cmd_ntacl_changedomsid.run.<locals>.changedom_sids/  s/   "rww~~e'<'<IIOO$;e$CD"#LPU#VWW77>>%((IIOOOe$;<WW]]5))IIOOK%$78IIOOL5$89	Pr$24,(09'.0 J/I		) ;< /s}}=CM.s}}=CMxx88==C"4S[["ACK )xx88==C"4S[["ACK ) {{:.H		 9:$IIOO$56P',.&"#,!(*C  P"UA#NOOPT  P"UA#NOOPs0   J 8J7 
J4J//J47
KKKc                    > [         R                  " U TS9 Hb  u  pnU H(  nT" [         R                  R                  X5      5        M*     U H(  nT" [         R                  R                  X5      5        M*     Md     g )Nrp   )ra   rv   rR   rw   )rg   r|   r}   r~   fdr   ri   s         r,   recursive_changedom_sids<cmd_ntacl_changedomsid.run.<locals>.recursive_changedom_sidss  s^    %'WWU%P!EA"277<<#89  A"277<<#89 	 &Qr   zQPlease note that POSIX permissions have NOT been changed, only the stored NT ACL.)rs   rt   r-   ru   r   r   r%   r"   ra   rR   re   rx   )rk   old_domain_sid_strnew_domain_sid_strrR   r]   ry   r^   rm   rh   r2   rj   ri   rl   r{   r+   r   r   r&   r   r   r   s   `   ` ``` ```   @@@@@r,   r   cmd_ntacl_changedomsid.run	  s;    "##%)"-
(9!::IIBD D	8%--.@AN
	8%--.@AN
B	P B	P B	PH	: 	tt,,$T*NN > ? u  	8 2A 7 8 8	8  	8 2A 7 8 8	8s0   ?D D> 
D;#D66D;>
E EE r   )	FFNNNNFFF)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r,   r   r      s    (JH 	W))
 	6	 	&		!
 	"		!
 	C	 	8u%		'
 	N		!
 	"	! 			!C&MP >J !x?r   r   c                       \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSSS9\" S	S
SS9/r  SS jrSrg)cmd_ntacl_sysvolreseti  z?Reset sysvol ACLs to defaults (including correct ACLs on GPOs).r   r1   rH   z/Set the ACLs for use with the ntvfs file serverr5   r6   rJ   z6Set the ACLs for use with the default s3fs file serverNc                    UR                  5       nUR                  U5      nUR                  [        5        U R	                  5       nUR                  SS5      n	 [        [        5       US9n
U(       d  U(       d  SUR                  S5      ;   nO	U(       a  Sn[        R                  " U
R                  5      n[        R                  " 5       nUR                  UR                   5        UR#                  SS	U
R$                  -  5        [        R                  " ['        U5      S
-   ['        [        R(                  5      -   5      n[        R                  " [        R*                  5      n[,        R.                  " UR                  S5      5      nUR1                  U5      u  nnU[2        R4                  :w  a"  U[2        R6                  :w  a  [        SU-  5      eUR1                  U5      u  nnU[2        R8                  :w  a"  U[2        R6                  :w  a  [        SU-  5      eU(       a  UR;                  S5         [<        R>                  " XUUUUR                  S5      RA                  5       U
RC                  5       XaS9	  g ! [         a  n[        SU5      eS nAff = f! [D         a=  nURF                  (       d  e [        SURF                   SURH                   3U5      eS nAff = f)NrR   sysvolr   r   rT   rU   Fr   r   -zSID %s is not mapped to a UIDzSID %s is not mapped to a GIDrr   realm)r]   Could not access r`   )%rt   get_credentialsset_kerberos_stater   rs   ru   r   r   r"   r   r   r%   r&   r   r   r    r!   r#   r$   rf   DOMAIN_RID_ADMINISTRATORSID_BUILTIN_ADMINISTRATORSr   PDB	sid_to_idr   ID_TYPE_UIDID_TYPE_BOTHID_TYPE_GIDrx   r   setsysvolacllower	domain_dnOSErrorfilenamestrerror)rk   r]   ry   r3   r2   r4   r   credsr{   r   r*   r+   r&   r)   LA_sidBA_sid	s4_passdbLA_uidLA_typeBA_gidBA_types                        r,   r   cmd_ntacl_sysvolreset.run  se   ##%((,  !23")	;~'7!E
 (9!::II%%e&6&67
$$&BMM"

#_uyy%@A!!#j/$'#(*-h.O.O*P#Q R!!("E"EFJJvzz*:;<	
 &//7u(((W8J8J-J>GHH%//7u(((W8J8J-J>GHHNNmn	R""5#)6:#%66'?#8#8#:EOO<M#%<G  	;6::	;N  	R::!21::,bMqQQ	Rs1   I? 9AJ ?
J	JJ
K$'8KK$r   )FFNNN)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r,   r   r     sb    I'H ))..-- 	}#T]ij|"ZcopM
 -27;5Rr   r   c                   n    \ rS rSrSrSr\R                  \R                  \R                  S.r
SS jrSrg)	cmd_ntacl_sysvolchecki  zBCheck sysvol ACLs match defaults (including correct ACLs on GPOs).r   r1   Nc           	      |   UR                  5       nUR                  U5      nUR                  [        5        UR	                  SS5      nUR	                  SS5      n [        [        5       US9n[        R                  " UR                  5      n
 [        R                  " XUU
UR	                  S5      R                  5       UR                  5       U5        g ! [         a  n	[        SU	5      eS n	A	ff = f! [          a=  n	U	R"                  (       d  e [        SU	R"                   SU	R$                   3U	5      eS n	A	ff = f)	NrR   netlogonr   r   r   r   r   r`   )rt   r   r   r   ru   r   r   r"   r   r   r%   r&   r   checksysvolaclr   r   r   r   r   )rk   r3   r2   r4   r   r   r   r   r*   r+   r&   s              r,   r   cmd_ntacl_sysvolcheck.run  s   ##%((,  !2366&*-)	;~'7B?E %%e&6&67
	R$$Uf%/%'VVG_%:%:%<eoo>O%')  	;6::	;  	R::!21::,bMqQQ	Rs1   C AC4 
C1 C,,C14
D;>8D66D;r   r   )r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r,   r   r     s5    L'H ))..--Rr   r   c                       \ rS rSrSr0 r\" 5       \S'   \" 5       \S'   \" 5       \S'   \	" 5       \S'   \
" 5       \S'   \" 5       \S'   S	rg
)	cmd_ntacli  zNT ACLs manipulation.r#   ru   changedomsidsysvolresetsysvolcheckr   r   N)r   r   r   r   r   subcommandsr/   r   r   r   r   r   r   r   r   r,   r   r     sV    K&K&K"8":K!6!8K!6!8K / 1Kr   r   ))r   ra   samba.getoptgetoptr   sambar   
samba.authr   samba.auth_utilr   samba.credentialsr   samba.dcerpcr   r   	samba.ndrr	   samba.ntaclsr
   r   r   samba.samba3r   r   r   samba.samdbr    r   r   r   r   r-   r/   r   r   r   r   r   r   r   r   r,   <module>r      s   &  	   % / / (  7 7 1  9 9<MoG Mo`0g 0,,,G ,,^j?W j?ZDRG DRN RG  RF	2 	2r   