<s> import samba . getopt as options <EOL> from samba . dcerpc import security <EOL> from samba . samdb import SamDB <EOL> from samba . ndr import ndr_unpack , ndr_pack <EOL> from samba . dcerpc . security import ( <EOL> GUID_DRS_ALLOCATE_RIDS , GUID_DRS_CHANGE_DOMAIN_MASTER , <EOL> GUID_DRS_CHANGE_INFR_MASTER , GUID_DRS_CHANGE_PDC , <EOL> GUID_DRS_CHANGE_RID_MASTER , GUID_DRS_CHANGE_SCHEMA_MASTER , <EOL> GUID_DRS_GET_CHANGES , GUID_DRS_GET_ALL_CHANGES , <EOL> GUID_DRS_GET_FILTERED_ATTRIBUTES , GUID_DRS_MANAGE_TOPOLOGY , <EOL> GUID_DRS_MONITOR_TOPOLOGY , GUID_DRS_REPL_SYNCRONIZE , <EOL> GUID_DRS_RO_REPL_SECRET_SYNC ) <EOL> import ldb <EOL> from ldb import SCOPE_BASE <EOL> import re <EOL> from samba . auth import system_session <EOL> from samba . netcmd import ( <EOL> Command , <EOL> CommandError , <EOL> SuperCommand , <EOL> Option , <EOL> ) <EOL> class cmd_dsacl_set ( Command ) : <EOL> """<STR_LIT>""" <EOL> synopsis = "<STR_LIT>" <EOL> car_help = """<STR_LIT>""" <EOL> takes_optiongroups = { <EOL> "<STR_LIT>" : options . SambaOptions , <EOL> "<STR_LIT>" : options . CredentialsOptions , <EOL> "<STR_LIT>" : options . VersionOptions , <EOL> } <EOL> takes_options = [ <EOL> Option ( "<STR_LIT>" , "<STR_LIT>" , help = "<STR_LIT>" , <EOL> type = str , metavar = "<STR_LIT>" , dest = "<STR_LIT:H>" ) , <EOL> Option ( "<STR_LIT>" , type = "<STR_LIT>" , choices = [ "<STR_LIT>" , <EOL> "<STR_LIT>" , <EOL> "<STR_LIT>" , <EOL> "<STR_LIT>" , <EOL> "<STR_LIT>" , <EOL> "<STR_LIT>" , <EOL> "<STR_LIT>" , <EOL> "<STR_LIT>" , <EOL> "<STR_LIT>" , <EOL> "<STR_LIT>" , <EOL> "<STR_LIT>" , <EOL> "<STR_LIT>" , <EOL> "<STR_LIT>" ] , <EOL> help = car_help ) , <EOL> Option ( "<STR_LIT>" , type = "<STR_LIT>" , choices = [ "<STR_LIT>" , "<STR_LIT>" ] , <EOL> help = """<STR_LIT>""" ) , <EOL> Option ( "<STR_LIT>" , help = "<STR_LIT>" , <EOL> type = "<STR_LIT:string>" ) , <EOL> Option ( "<STR_LIT>" , help = "<STR_LIT>" , <EOL> type = "<STR_LIT:string>" ) , <EOL> Option ( "<STR_LIT>" , help = "<STR_LIT>" , <EOL> type = "<STR_LIT:string>" ) , <EOL> ] <EOL> def find_trustee_sid ( self , samdb , trusteedn ) : <EOL> res = samdb . search ( base = trusteedn , expression = "<STR_LIT>" , <EOL> scope = SCOPE_BASE ) <EOL> assert ( len ( res ) == <NUM_LIT:1> ) <EOL> return ndr_unpack ( security . dom_sid , res [ <NUM_LIT:0> ] [ "<STR_LIT>" ] [ <NUM_LIT:0> ] ) <EOL> def modify_descriptor ( self , samdb , object_dn , desc , controls = None ) : <EOL> assert ( isinstance ( desc , security . descriptor ) ) <EOL> m = ldb . Message ( ) <EOL> m . dn = ldb . Dn ( samdb , object_dn ) <EOL> m [ "<STR_LIT>" ] = ldb . MessageElement ( <EOL> ( ndr_pack ( desc ) ) , ldb . FLAG_MOD_REPLACE , <EOL> "<STR_LIT>" ) <EOL> samdb . modify ( m ) <EOL> def read_descriptor ( self , samdb , object_dn ) : <EOL> res = samdb . search ( base = object_dn , scope = SCOPE_BASE , <EOL> attrs = [ "<STR_LIT>" ] ) <EOL> assert ( len ( res ) == <NUM_LIT:1> ) <EOL> desc = res [ <NUM_LIT:0> ] [ "<STR_LIT>" ] [ <NUM_LIT:0> ] <EOL> return ndr_unpack ( security . descriptor , desc ) <EOL> def get_domain_sid ( self , samdb ) : <EOL> res = samdb . search ( base = samdb . domain_dn ( ) , <EOL> expression = "<STR_LIT>" , scope = SCOPE_BASE ) <EOL> return ndr_unpack ( security . dom_sid , res [ <NUM_LIT:0> ] [ "<STR_LIT>" ] [ <NUM_LIT:0> ] ) <EOL> def add_ace ( self , samdb , object_dn , new_ace ) : <EOL> """<STR_LIT>""" <EOL> desc = self . read_descriptor ( samdb , object_dn ) <EOL> desc_sddl = desc . as_sddl ( self . get_domain_sid ( samdb ) ) <EOL> desc_aces = re . findall ( "<STR_LIT>" , desc_sddl ) <EOL> for ace in desc_aces : <EOL> if ( "<STR_LIT>" in ace ) : <EOL> desc_sddl = desc_sddl . replace ( ace , "<STR_LIT>" ) <EOL> if new_ace in desc_sddl : <EOL> return <EOL> if desc_sddl . find ( "<STR_LIT:(>" ) >= <NUM_LIT:0> : <EOL> desc_sddl = desc_sddl [ : desc_sddl . index ( "<STR_LIT:(>" ) ] + new_ace + desc_sddl [ desc_sddl . index ( "<STR_LIT:(>" ) : ] <EOL> else : <EOL> desc_sddl = desc_sddl + new_ace <EOL> desc = security . descriptor . from_sddl ( desc_sddl , self . get_domain_sid ( samdb ) ) <EOL> self . modify_descriptor ( samdb , object_dn , desc ) <EOL> def print_new_acl ( self , samdb , object_dn ) : <EOL> desc = self . read_descriptor ( samdb , object_dn ) <EOL> desc_sddl = desc . as_sddl ( self . get_domain_sid ( samdb ) ) <EOL> self . outf . write ( "<STR_LIT>" % object_dn ) <EOL> self . outf . write ( desc_sddl + "<STR_LIT:\n>" ) <EOL> def run ( self , car , action , objectdn , trusteedn , sddl , <EOL> H = None , credopts = None , sambaopts = None , versionopts = None ) : <EOL> lp = sambaopts . get_loadparm ( ) <EOL> creds = credopts . get_credentials ( lp ) <EOL> if sddl is None and ( car is None or action is None <EOL> or objectdn is None or trusteedn is None ) : <EOL> return self . usage ( ) <EOL> samdb = SamDB ( url = H , session_info = system_session ( ) , <EOL> credentials = creds , lp = lp ) <EOL> cars = { '<STR_LIT>' : GUID_DRS_CHANGE_RID_MASTER , <EOL> '<STR_LIT>' : GUID_DRS_CHANGE_PDC , <EOL> '<STR_LIT>' : GUID_DRS_CHANGE_INFR_MASTER , <EOL> '<STR_LIT>' : GUID_DRS_CHANGE_SCHEMA_MASTER , <EOL> '<STR_LIT>' : GUID_DRS_CHANGE_DOMAIN_MASTER , <EOL> '<STR_LIT>' : GUID_DRS_ALLOCATE_RIDS , <EOL> '<STR_LIT>' : GUID_DRS_GET_CHANGES , <EOL> '<STR_LIT>' : GUID_DRS_GET_ALL_CHANGES , <EOL> '<STR_LIT>' : GUID_DRS_GET_FILTERED_ATTRIBUTES , <EOL> '<STR_LIT>' : GUID_DRS_MANAGE_TOPOLOGY , <EOL> '<STR_LIT>' : GUID_DRS_MONITOR_TOPOLOGY , <EOL> '<STR_LIT>' : GUID_DRS_REPL_SYNCRONIZE , <EOL> '<STR_LIT>' : GUID_DRS_RO_REPL_SECRET_SYNC , <EOL> } <EOL> sid = self . find_trustee_sid ( samdb , trusteedn ) <EOL> if sddl : <EOL> new_ace = sddl <EOL> elif action == "<STR_LIT>" : <EOL> new_ace = "<STR_LIT>" % ( cars [ car ] , str ( sid ) ) <EOL> elif action == "<STR_LIT>" : <EOL> new_ace = "<STR_LIT>" % ( cars [ car ] , str ( sid ) ) <EOL> else : <EOL> raise CommandError ( "<STR_LIT>" % action ) <EOL> self . print_new_acl ( samdb , objectdn ) <EOL> self . add_ace ( samdb , objectdn , new_ace ) <EOL> self . print_new_acl ( samdb , objectdn ) <EOL> class cmd_dsacl ( SuperCommand ) : <EOL> """<STR_LIT>""" <EOL> subcommands = { } <EOL> subcommands [ "<STR_LIT>" ] = cmd_dsacl_set ( ) </s>
