
    g	^                        S r SSKrSSKrSSKrSSKrSSKrSSKrSSKJ	r
  SSKJrJrJr  SSKJrJr  SSKJr  SSKJr  SSKJr  SS	KJr  SS
KJr  SSKJr  \R8                  \R:                  -  \R<                  -  \R>                  -  r \RB                  \RD                  -  \RF                  -  \RH                  -  r% " S S\&5      r'S r(S r)    SS jr*   SS jr+S r,SS jr- " S S5      r. " S S5      r/S r0S r1S r2S r3S r4g) zNT Acls.    N)param)securityxattridmap)ndr_pack
ndr_unpack)smbd)libsmb_samba_internal)get_samba_logger)NTSTATUSError)system_session_unix)safe_tarfilec                       \ rS rSrSrSrg)XattrBackendError3   zA generic xattr backend error. N)__name__
__module____qualname____firstlineno____doc____static_attributes__r       ./usr/lib/python3/dist-packages/samba/ntacls.pyr   r   3   s    (r   r   c                    Uck  U R                  S5      nUb!  [        R                  U R                  S5      4$ U R                  S5      nUb!  [        R                  U R                  S5      4$ gUS:X  a  gUS:X  aq  Ub  [        R                  U4$ [        R                  [        R
                  R                  [        R
                  R                  U R                  S5      S5      5      4$ US:X  au  Ub  [        R                  U4$ U R                  S	5      n[        R
                  R                  [        R
                  R                  US
5      5      n[        R                  U4$ [        SU-  5      e)z$return the path to the eadb, or Nonezxattr_tdb:filez
posix:eadbNNnativeeadbzprivate dirzeadb.tdbtdbzstate directoryz	xattr.tdbzInvalid xattr backend choice %s)	getsamba	xattr_tdb
posix_eadbospathabspathjoinr   )lpbackendeadbfiler"   r#   	state_dirdb_paths          r   checkset_backendr-   7   s4   FF+,	 OORVV,<%=>>VVL)
!$$bff\&:;;	H		F	$$h//$$bggoobggll266-CXZd6e&fgg	E	OOX..01Iggoobggll9k&JKGOOW-- AG KLLr   c                      [         R                  R                  U[        R                  5      n[        [        R                  U5      $ ! [
         a     g f = fN)r!   xattr_nativewrap_getxattrr   XATTR_DOSATTRIB_NAME_S3	Exceptionr   	DOSATTRIB)r(   file	attributes      r   
getdosinfor7   S   sP    &&44T5:5R5RT	
 eooy11  s   .A
 

AAc                    U(       Ga
  [        XU5      u  pxUb"   UR                  X[        R                  5      n	O.[        R                  R                  U[        R                  5      n	[        [        R                  U	5      n
U
R                  S:X  a  U
R                  $ U
R                  S:X  a  U
R                  R                  $ U
R                  S:X  a  U
R                  R                  $ U
R                  S:X  a  U
R                  R                  $ g [        R                  " U[        UUS9$ ! [         a@    [        SU-  5        [        R                  R                  U[        R                  5      n	 GNf = f)NFail to open %s            service)r-   r1   r   XATTR_NTACL_NAMEr3   printr!   r0   r   NTACLversioninfosdr	   
get_nt_aclSECURITY_SECINFO_FLAGS)r(   r5   session_infor)   r*   direct_db_accessr?   backend_objdbnamer6   ntacls              r   getntaclrM   ]   s>     0h GU'55f6;6L6LN	 **889>9O9OQI5;;	2==A::]]a::== ]]a::== ]]a::==    t5+'.0 	0'  U '&01!..<<T=B=S=SU		Us    D. .AE87E8c                    [        U[        5      (       d!  [        U[        R                  5      (       d   e[        U[        5      (       a  [        R                  " U5      nO,[        U[        R                  5      (       a  Un[        U5      n[        U[        5      (       d!  [        U[        R                  5      (       d   e[        U[        5      (       a!  [        R                  R                  UW5      nO2[        U[        R                  5      (       a  UnUR                  W5      nU(       Gd  U(       Ga|  U	R                  WR                  5      u  pU[        R                  :w  GaJ  U[        R                  :w  Ga5  UR                  [        R                  " SU[        R                  4-  5      :X  a  [        R                  " SU[        R                  4-  5      nU	R                  U5      u  nnU[        R                  :X  d  U[        R                  :X  a(  UnUUl        [        R                  " U[         UUU
S9  SnOq[#        SUUU4-  5      e[$        R&                  " USS5        [        R                  " U[        R(                  [        R*                  -  [        R,                  -  UUU
S9  U(       a  [/        XU5      u  nn[0        R2                  " 5       nSUl        WUl        Ub-   UR9                  UU[0        R:                  [=        U5      5        g[B        RD                  R9                  U[0        R:                  [=        U5      5        g[        R                  " U[         WXS	9  g! [>         aI    [A        SU-  5        [B        RD                  R9                  U[0        R:                  [=        U5      5         gf = f)
a  
A wrapper for smbd set_nt_acl api.

Args:
    lp (LoadParam): load param from conf
    file (str): a path to file or dir
    sddl (str): ntacl sddl string
    service (str): name of share service, e.g.: sysvol
    session_info (auth_session_info): session info for authentication

Note:
    Get `session_info` with `samba.auth.user_session`, do not use the
    `admin_session` api.

Returns:
    None
z%s-%dr>   TzDUnable to find UID for domain administrator %s, got id %d of type %dr   r:   Nr9   )r?   rH   )#
isinstancestrr   dom_sid
descriptor	from_sddlas_sddl	sid_to_id	owner_sidr   ID_TYPE_UIDID_TYPE_BOTHDOMAIN_RID_ADMINSDOMAIN_RID_ADMINISTRATORr	   
set_nt_aclrG   r   r$   chownSECINFO_GROUPSECINFO_DACLSECINFO_SACLr-   r   rB   rC   rD   wrap_setxattrr@   r   r3   rA   r!   r0   )r(   r5   sddldomsidrH   r)   r*   	use_ntvfsskip_invalid_chownpassdbr?   sidrE   owner_id
owner_typeadministratoradmin_id
admin_typesd2rJ   rK   rL   s                         r   setntaclrm      s$   , fc""j9I9I&J&JKJ&#v&	FH,,	-	-SdC  JtX5H5H$I$IJI$  **45	D(--	.	.zz#+!'!1!1",,!?5,,,:ASAS3S ||x//68C]C]:^0^__ ( 0 0FHDeDe;f1f g)/)9)9-)H&:  5#4#44*HZHZ:Z C$1CMOO4c$ ') !%I+,r  wD  FN  PZ  v[  -[  \  \ q!$**))*))*  #%  0h Gf
B))&*.0F0FQVY ,,T53I3I-5e_> 	("	8  B '&01""00u7M7M19%B	Bs   6+M7 7AO
	O
c                 L   SnSnSnSnSnSnSnSnS	n	Sn
SnSnSnSnSnSnSnSnSnSnSnSnS	nS
nSnSnSnSnSnU U-  nX-  (       a  X-  (       a  UUU-  U-  U-  U
-  U-  -  nX-  (       a  UUU-  U-  U-  U-  U-  U-  -  nX-  (       a  UX-  -  nX-  (       a  UU-  nU$ )zMTakes the access mask of a DS ACE and transform them in a File ACE mask.
    r:   r;   r=             @         i   i   i   i   i   i   r   )ldmRIGHT_DS_CREATE_CHILDRIGHT_DS_DELETE_CHILDRIGHT_DS_LIST_CONTENTSACTRL_DS_SELFRIGHT_DS_READ_PROPERTYRIGHT_DS_WRITE_PROPERTYRIGHT_DS_DELETE_TREERIGHT_DS_LIST_OBJECTRIGHT_DS_CONTROL_ACCESSFILE_READ_DATAFILE_LIST_DIRECTORYFILE_WRITE_DATAFILE_ADD_FILEFILE_APPEND_DATAFILE_ADD_SUBDIRECTORYFILE_CREATE_PIPE_INSTANCEFILE_READ_EAFILE_WRITE_EAFILE_EXECUTEFILE_TRAVERSEFILE_DELETE_CHILDFILE_READ_ATTRIBUTESFILE_WRITE_ATTRIBUTESDELETEREAD_CONTROL	WRITE_DACWRITE_OWNERSYNCHRONIZESTANDARD_RIGHTS_ALLfilemasks                                  r   ldapmask2filemaskr      s_    !+ * * *M * * * * * &N & &O &M & & & &L &M &L &M & & & *F *L *I *K *K *((H$3+G{-@@3 46B C- .0< = > ${_</ 02? @4 57D E  5 5 6
 "4DE
"//Or   c                    [         R                  R                  X5      n[         R                  " 5       nUR                  Ul        UR                  Ul        UR
                  Ul        UR                  Ul        UR                  R                  n[        S[        U5      5       GH  nXV   nUR
                  [         R                  [         R                  4;   d  M8  [        UR                  5      [         R                  :w  d  Ma  UR                   [         R"                  -  [         R$                  -  Ul        [        UR                  5      [         R&                  :X  a"  UR                   [         R(                  -  Ul        [+        UR,                  5      Ul        UR/                  U5        GM     U(       d  U$ UR1                  U5      $ )z

This function takes an the SDDL representation of a DS
ACL and return the SDDL representation of this ACL adapted
for files. It's used for Policy object provision
r   )r   rR   rS   rV   	group_sidtyperevisiondaclacesrangelen"SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECTSEC_ACE_TYPE_ACCESS_ALLOWEDrP   trusteeSID_BUILTIN_PREW2KflagsSEC_ACE_FLAG_OBJECT_INHERITSEC_ACE_FLAG_CONTAINER_INHERITSID_CREATOR_OWNERSEC_ACE_FLAG_INHERIT_ONLYr   access_maskdacl_addrT   )dssddlrf   rT   reffdescrr   iaces           r   dsacl2fsaclr   !  s<    


'
'
4C  "F}}F}}F((FKllFO88==D1c$i g88CC <<> >BEckkBRV^VqVqBq		H$H$HH8KrKrrCI3;;8#=#==II(J(JJ	/@COOOC  ! >>#r   c                   x    \ rS rSrSrS r  SS jr SS jrSS jrS r	S	 r
S
 rSS jrSS jrSS jrS rSrg)	SMBHelperiA  zV
A wrapper class for SMB connection

smb_path: path with separator "\" other than "/"
c                     Xl         X l        g r/   )smb_connrQ   )selfr   rQ   s      r   __init__SMBHelper.__init__H  s     r   Nc                     SU;  d   eU R                   R                  UUUS9nU(       a  UR                  U R                  5      $ U$ N/)sinfor   )r   get_aclrT   rQ   )r   smb_pathrT   r   r   ntacl_sds         r   r   SMBHelper.get_aclL  sP    ("""==((/45@ ) B 29x-FhFr   c                 x   SU;  d   e[        U[        5      (       d!  [        U[        R                  5      (       d   e[        U[        5      (       a*  [        R                  R	                  X R
                  5      nO![        U[        R                  5      (       a  UnU R                  R                  UWUUS9  g r   )rO   rP   r   rR   rS   
domain_sidr   set_acl)r   r   r   r   r   tmp_descs         r   r   SMBHelper.set_aclV  s    ("""(C((JxATAT,U,UVUh$$**44XOH("5"566Hh$)*5 	 	7r   c                 N    SU;  d   eU R                   R                  U[        S9$ )z=
List file and dir base names in smb_path without recursive.
r   )attribs)r   listSMB_FILE_ATTRIBUTE_FLAGSr   r   s     r   r   SMBHelper.listd  s-     ("""}}!!(4L!MMr   c                 :    [        U[        R                  -  5      $ )zM
Check whether the attrib value is a directory.

attrib is from list method.
)boollibsmbFILE_ATTRIBUTE_DIRECTORY)r   attribs     r   is_dirSMBHelper.is_dirk  s     FV<<<==r   c                 $    U(       a  US-   U-   $ U$ )z
Join path with '\'
\r   )r   rootnames      r   r'   SMBHelper.joins  s     &*td{T!3t3r   c                 H    SU;  d   eU R                   R                  U5      $ )Nr   )r   loadfiler   s     r   r   SMBHelper.loadfiley  s%    ("""}}%%h//r   c                 P   UR                  5        H  u  p4U R                  X#5      n[        U[        5      (       aL  U R                  R                  U5      (       d  U R                  R                  U5        U R                  XES9  Mw  U R                  R                  XT5        M     g)z!
Create files as defined in tree
r   N)	itemsr'   rO   dictr   chkpathmkdircreate_treesavefile)r   treer   r   contentfullnames         r   r   SMBHelper.create_tree}  s{     "ZZ\MDyy0H'4((}},,X66MM''1   <&&x9 *r   c                     0 nU R                  U5       HX  nUS   nU R                  X5      nU R                  US   5      (       a  U R                  US9X$'   ME  U R	                  U5      X$'   MZ     U$ )a1  
Get the tree structure via smb conn

self.smb_conn.list example:

[
  {
    'attrib': 16,
    'mtime': 1528848309,
    'name': 'dir1',
    'short_name': 'dir1',
    'size': 0L
  }, {
    'attrib': 32,
    'mtime': 1528848309,
    'name': 'file0.txt',
    'short_name': 'file0.txt',
    'size': 10L
  }
]
r   r   r   )r   r'   r   get_treer   )r   r   r   itemr   r   s         r   r   SMBHelper.get_tree  so    , IIh'D<Dyy0H{{4>**!]]H]=
!]]84
 ( r   c                 4   0 nU R                  U5       H  nUS   nU R                  X5      nU R                  US   5      (       a   UR                  U R	                  US95        MR  U R                  U5      nUR                  U R                  5      X%'   M     U$ )z.
Get ntacl for each file and dir via smb conn
r   r   r   )r   r'   r   update
get_ntaclsr   rT   rQ   )r   r   ntaclsr   r   r   r   s          r   r   SMBHelper.get_ntacls  s     IIh'D<Dyy0H{{4>**dooxo@A<<1#+#3#3DLL#A  ( r   c                     U R                  5        HY  nUS   nU R                  US   5      (       a  U R                  R                  U5        M>  U R                  R	                  U5        M[     g )Nr   r   )r   r   r   deltreeunlink)r   r   r   s      r   delete_treeSMBHelper.delete_tree  sR    IIKD<D{{4>**%%d+$$T*  r   )rQ   r   )FNNr   ) )r   r   r   r   r   r   r   r   r   r   r'   r   r   r   r   r   r   r   r   r   r   r   A  sN     ).(,G )-7N>40:@+r   r   c                   *    \ rS rSrS rSS jrS rSrg)NtaclsHelperi  c                     Xl         X0l        [        R                  " 5       U l        U R                  R                  U5        SU R                  R                  S5      ;   U l        g )Nsmbzserver services)r?   rQ   s3paramget_contextr(   loadr    rc   )r   r?   smb_conf_pathrQ   s       r   r   NtaclsHelper.__init__  sH     %%']#$''++.?"@@r   Nc                     Uc  U R                   n[        U R                  XUU R                  S9nU(       a  UR	                  U R
                  5      $ U$ )N)rI   r?   )rc   rM   r(   r?   rT   rQ   )r   r%   rH   rT   rI   r   s         r   rM   NtaclsHelper.getntacl  sM    ##~~GGT-LL"
 29x-FhFr   c           	      X    [        U R                  XU R                  UU R                  S9$ )N)rc   )rm   r(   rQ   rc   )r   r%   r   rH   s       r   rm   NtaclsHelper.setntacl  s&    |"&..2 	2r   )rQ   r(   r?   rc   )FN)r   r   r   r   r   rM   rm   r   r   r   r   r   r     s    A	G2r   r   c                 x    [        U S-   S5       nUR                  U5        S S S 5        g ! , (       d  f       g = f)N.NTACLw)openwrite)dstntacl_sddl_strfs      r   _create_ntacl_filer    s*    	cHnc	"a	 
#	"	"s   +
9c                     U S-   n[         R                  R                  U5      (       d  g [        US5       nUR	                  5       sS S S 5        $ ! , (       d  f       g = f)Nr   r)r$   r%   existsr  read)src
ntacl_filer  s      r   _read_ntacl_filer    sB    xJ77>>*%%	j#	!vvx 
		s   A
Ac           	         [        5       n[        U[        5      (       a  [        R                  " U5      n[        X5      nSn[        R                  " 5       nU/nU/nU(       Ga  UR                  5       n	UR                  5       n
UR                  U	S9 H  nUR                  XS   5      n[        R                  R                  XS   5      nUR                  US   5      (       a9  UR                  U5        UR                  U5        [        R                  " U5        O7UR!                  U5      n[#        US5       nUR%                  U5        SSS5         UR'                  USS9n[)        UU5        M     U(       a  GM  [2        R"                  " USS9 n[        R4                  " U5       H3  n[        R                  R                  UU5      nUR7                  UUS9  M5     SSS5        [8        R:                  " U5        g! , (       d  f       N= f! [*         aI  nUR-                  S	U< S
UR.                  S   < 35        UR1                  SU-  S-   5         SnAGM  SnAff = f! , (       d  f       N= f)aE  
Backup all files and dirs with ntacl for the serive behind smb_conn.

1. Create a temp dir as container dir
2. Backup all files with dir structure into container dir
3. Generate file.NTACL files for each file and dir in container dir
4. Create a tar file from container dir(without top level folder)
5. Delete container dir
r   r   r   r   wbNTrT   zFailed to get the ntacl for z: r:   z!The permissions for %s may not bez restored correctlyw:gzr   modearcname)r   rO   rP   r   rQ   r   tempfilemkdtemppopr   r'   r$   r%   r   appendr   r   r  r  r   r  r   errorargswarningtarfilelistdiraddshutilrmtree)r   dest_tarfile_pathrQ   logger
smb_helper	remotedirlocaldirr_dirsl_dirsr_dirl_direr_namel_namedatar  r  tarr   r%   s                       r   backup_onliner1    s    F'3""7+8-JI!H[FZF




%0A__UfI6FWW\\%63F  8--f%f% !**62&$'1GGDM (6!+!3!3FD!3!I"6>:! 1	 &6 
,6	:cJJx(D77<<$/DGGD$G' ) 
;
 MM(% (' ! 6$affQi1 2BVK4 5 6 66 
;	:s1   =HHAI+
H	
I(=I##I(+
I9c           	      L   U R                  S5      R                  SS5      S   n[        R                  " 5       n[	        5       n[        XBU5      n[        R                  " U 5       GH  u  pn
[        R                  R                  XS9n[        R                  R                  X[5      nU	 Ht  n[        R                  R                  X5      n[        R                  R                  X5      n[        R                  " XU5        UR                  XSS9n[        UU5        Mv     U
 H  n[        R                  R                  UU5      n[        R                  R                  UU5      n[        R                  " XU5        UR                  XSS9n[        UU5        [!        US5       nUR#                  5       n[!        US5       nUR%                  U5        S	S	S	5        S	S	S	5        M     GM     [&        R                   " US
S9 n[        R(                  " U5       H3  n[        R                  R                  UU5      nUR+                  UUS9  M5     S	S	S	5        [,        R.                  " U5        g	! , (       d  f       N= f! , (       d  f       GMm  = f! , (       d  f       NI= f)z4
Backup files and ntacls to a tarfile for a service
r   r:   startTr  rbr  Nr  r  r  )rstriprsplitr  r  r   r   r$   walkr%   relpathr'   r	   r   rM   r  create_filer  r  r  r  r  r   r!  r"  )src_service_pathr#  r   rQ   r?   tempdirrH   ntacls_helperdirpathdirnames	filenamesrel_dirpathdst_dirpathdirnamer  r  r  filenamesrc_filer/  dst_filer0  r   r%   s                           r   backup_offlinerH  *  s    %%c*11#q9"=G G&(L AM(*0@(A$9ggoogoFggll78  G'',,w0C'',,{4CJJs'2*33Ct3TNsN3   "H'',,w1C'',,{H5CS8*33Ct3TNsN3 c4H}}#t_NN4( % ! " )B< 
,6	:cJJw'D77<<.DGGD$G' ( 
;
 MM' %_ ! 
;	:s1   'JI1	JAJ1
I?;J
J
J#c           	         [        5       nUR                  S5      R                  SS5      S   n[        R                  " 5       nUR                  5       n[        R                  " U5      n[        XSU5      n	[        5       n
[        R                  " U 5       nUR                  US9  SSS5        [        R                  " U5       GH`  u  pn[        R                  R!                  XS9n[        R                  R#                  [        R                  R%                  X5      5      nU H  nUR'                  S5      (       a  M  [        R                  R%                  UU5      n[        R                  R%                  UU5      n[        R                  R)                  U5      (       d  [*        R,                  " UX5        [/        U5      nU(       a  U	R1                  UUU
5        M  UR3                  SU-  S	-   5        M     U GH  nUR'                  S5      (       a  M  [        R                  R%                  UU5      n[        R                  R%                  UU5      n[        R                  R5                  U5      (       d  [*        R6                  " UX5        [/        U5      nU(       a  U	R1                  UUU
5        OUR3                  S
U-  S	-   5        [        US5       nUR9                  5       n[        US5       nUR;                  U5        SSS5        SSS5        GM"     GMc     [<        R>                  " U5        g! , (       d  f       GN= f! , (       d  f       NI= f! , (       d  f       GMs  = f)z6
Restore files and ntacls from a tarfile to a service
r   r:   r3  )r%   Nr4  r   z)Failed to restore ntacl for directory %s.z) Please check the permissions are correctz$Failed to restore ntacl for file %s.r6  r  ) r   r7  r8  r  r  get_domain_sidr   rQ   r   r   r  r  
extractallr$   r9  r%   r:  normpathr'   endswithisdirr	   r   r  rm   r  isfiler;  r  r  r!  r"  )src_tarfile_pathdst_service_path
samdb_connr   r$  r?   r=  dom_sid_strrQ   r>  rH   r  r?  r@  rA  rB  rC  rD  r  r  r  rE  rF  r/  rG  s                            r   backup_restorerT  Z  s    F%%c*11#q9"=G G++-K{+G AM&(L	&	'1	'" 
( )+(8$9ggoogo=gg&&GGLL)79  G##H--ggll7G4ggll;8ww}}S))JJsL:!1#!6!!**3MNNCcIEFG    "H$$X..ggll7H5ggll;9ww~~c**$$S,@!1#!6!!**3MNN#IC#O#N$O P #t_#==?Dc4H t, ) %_! "+ )9T MM'] 
(	'V ) %_s0   M  M#=M	M# 
M
M M##
M3)NNTN)NNTFNN)T)5r   r$   r  r!  samba.xattr_nativer!   samba.xattr_tdbsamba.posix_eadbsamba.samba3r   r   samba.dcerpcr   r   r   	samba.ndrr   r   r	   r
   r   samba.loggerr   r   samba.auth_utilr   r   r  FILE_ATTRIBUTE_SYSTEMr   FILE_ATTRIBUTE_ARCHIVEFILE_ATTRIBUTE_HIDDENr   SECINFO_OWNERr]   r^   r_   rG   r3   r   r-   r7   rM   rm   r   r   r   r   r  r  r1  rH  rT  r   r   r   <module>ra     s+  $  
      ) / / *  8 )  / ) "77!::;!889 "778  "//!//0!../ "../ 
)	 )M82 "#0N %)05"&d8N4n@~+ ~+B2 2: 
9x-`<r   