source4/samba_tool/gpo.c

   1 /*
   2    Samba Unix/Linux SMB client library
   3    net ads commands for Group Policy
   4
   5    Copyright (C) 2005-2008 Guenther Deschner
   6    Copyright (C) 2009 Wilco Baan Hofman
   7
   8    Based on Guenther's work in net_ads_gpo.h (samba 3)
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "samba_tool/samba_tool.h"
  26 #include "lib/ldb/include/ldb.h"
  27 #include "auth/auth.h"
  28 #include "param/param.h"
  29 #include "libcli/security/sddl.h"
  30 #include "dsdb/samdb/samdb.h"
  31 #include "dsdb/common/util.h"
  32 #include "lib/policy/policy.h"
  33
  34 static int net_gpo_list_all_usage(struct net_context *ctx, int argc, const char **argv)
  35 {
  36         d_printf("Syntax: samba-tool gpo listall [options]\n");
  37         d_printf("For a list of available options, please type samba-tool gpo listall --help\n");
  38         return 0;
  39 }
  40
  41 static int net_gpo_list_all(struct net_context *ctx, int argc, const char **argv)
  42 {
  43         struct gp_context *gp_ctx;
  44         struct gp_object **gpo;
  45         const char **gpo_flags;
  46         unsigned int i, j;
  47         NTSTATUS rv;
  48
  49         rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
  50         if (!NT_STATUS_IS_OK(rv)) {
  51                 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv)));
  52                 return 1;
  53         }
  54
  55         rv = gp_list_all_gpos(gp_ctx, &gpo);
  56         if (!NT_STATUS_IS_OK(rv)) {
  57                 DEBUG(0, ("Failed to list all GPO's: %s\n", get_friendly_nt_error_msg(rv)));
  58                 talloc_free(gp_ctx);
  59                 return 1;
  60         }
  61
  62         for (i = 0; gpo[i] != NULL; i++) {
  63                 gp_get_gpo_flags(gp_ctx, gpo[i]->flags, &gpo_flags);
  64
  65                 d_printf("GPO          : %s\n", gpo[i]->name);
  66                 d_printf("display name : %s\n", gpo[i]->display_name);
  67                 d_printf("path         : %s\n", gpo[i]->file_sys_path);
  68                 d_printf("dn           : %s\n", gpo[i]->dn);
  69                 d_printf("version      : %d\n", gpo[i]->version);
  70                 if (gpo_flags[0] == NULL) {
  71                         d_printf("flags        : NONE\n");
  72                 } else {
  73                         d_printf("flags        : %s\n", gpo_flags[0]);
  74                         for (j = 1; gpo_flags[j] != NULL; j++) {
  75                                 d_printf("               %s\n", gpo_flags[i]);
  76                         }
  77                 }
  78                 d_printf("\n");
  79                 talloc_free(gpo_flags);
  80         }
  81         talloc_free(gp_ctx);
  82
  83         return 0;
  84 }
  85
  86 static int net_gpo_get_gpo_usage(struct net_context *ctx, int argc, const char **argv)
  87 {
  88         d_printf("Syntax: samba-tool gpo show <dn> [options]\n");
  89         d_printf("For a list of available options, please type samba-tool gpo show --help\n");
  90         return 0;
  91 }
  92
  93 static int net_gpo_get_gpo(struct net_context *ctx, int argc, const char **argv)
  94 {
  95         struct gp_context *gp_ctx;
  96         struct gp_object *gpo;
  97         const char **gpo_flags;
  98         char *sddl;
  99         int i;
 100         NTSTATUS rv;
 101
 102         if (argc != 1) {
 103                 return net_gpo_get_gpo_usage(ctx, argc, argv);
 104         }
 105
 106
 107         rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
 108         if (!NT_STATUS_IS_OK(rv)) {
 109                 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv)));
 110                 return 1;
 111         }
 112
 113         rv = gp_get_gpo_info(gp_ctx, argv[0], &gpo);
 114         if (!NT_STATUS_IS_OK(rv)) {
 115                 DEBUG(0, ("Failed to get GPO: %s\n", get_friendly_nt_error_msg(rv)));
 116                 talloc_free(gp_ctx);
 117                 return 1;
 118         }
 119
 120         gp_get_gpo_flags(gp_ctx, gpo->flags, &gpo_flags);
 121
 122         d_printf("GPO          : %s\n", gpo->name);
 123         d_printf("display name : %s\n", gpo->display_name);
 124         d_printf("path         : %s\n", gpo->file_sys_path);
 125         d_printf("dn           : %s\n", gpo->dn);
 126         d_printf("version      : %d\n", gpo->version);
 127         if (gpo_flags[0] == NULL) {
 128                 d_printf("flags        : NONE\n");
 129         } else {
 130                 d_printf("flags        : %s\n", gpo_flags[0]);
 131                 for (i = 1; gpo_flags[i] != NULL; i++) {
 132                         d_printf("               %s\n", gpo_flags[i]);
 133                 }
 134         }
 135         sddl = sddl_encode(gp_ctx, gpo->security_descriptor, samdb_domain_sid(gp_ctx->ldb_ctx));
 136         if (sddl != NULL) {
 137                 d_printf("ACL          : %s\n", sddl);
 138         }
 139
 140         d_printf("\n");
 141
 142         talloc_free(gp_ctx);
 143         return 0;
 144 }
 145
 146 static int net_gpo_link_get_usage(struct net_context *ctx, int argc, const char **argv)
 147 {
 148         d_printf("Syntax: samba-tool gpo getlink <dn> [options]\n");
 149         d_printf("For a list of available options, please type samba-tool gpo getlink --help\n");
 150         return 0;
 151 }
 152
 153 static int net_gpo_link_get(struct net_context *ctx, int argc, const char **argv)
 154 {
 155         struct gp_context *gp_ctx;
 156         struct gp_link **links;
 157         NTSTATUS rv;
 158         unsigned int i,j;
 159         const char **options;
 160
 161         if (argc != 1) {
 162                 return net_gpo_link_get_usage(ctx, argc, argv);
 163         }
 164
 165         rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
 166         if (!NT_STATUS_IS_OK(rv)) {
 167                 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv)));
 168                 return 1;
 169         }
 170
 171         rv = gp_get_gplinks(gp_ctx, argv[0], &links);
 172         if (!NT_STATUS_IS_OK(rv)) {
 173                 DEBUG(0, ("Failed to get gplinks: %s\n", get_friendly_nt_error_msg(rv)));
 174                 talloc_free(gp_ctx);
 175                 return 1;
 176         }
 177
 178         for (i = 0; links[i] != NULL; i++) {
 179                 gp_get_gplink_options(gp_ctx, links[i]->options, &options);
 180
 181                 d_printf("GPO DN  : %s\n", links[i]->dn);
 182                 if (options[0] == NULL) {
 183                         d_printf("Options : NONE\n");
 184                 } else {
 185                         d_printf("Options : %s\n", options[0]);
 186                         for (j = 1; options[j] != NULL; j++) {
 187                                 d_printf("        : %s\n", options[j]);
 188                         }
 189                 }
 190                 d_printf("\n");
 191
 192                 talloc_free(options);
 193         }
 194
 195         talloc_free(gp_ctx);
 196
 197         return 0;
 198 }
 199
 200 static int net_gpo_list_usage(struct net_context *ctx, int argc, const char **argv)
 201 {
 202         d_printf("Syntax: samba-tool gpo list <username> [options]\n");
 203         d_printf("For a list of available options, please type samba-tool gpo list --help\n");
 204         return 0;
 205 }
 206
 207 static int net_gpo_list(struct net_context *ctx, int argc, const char **argv)
 208 {
 209         struct gp_context *gp_ctx;
 210         struct ldb_result *result;
 211         struct auth_serversupplied_info *server_info;
 212         struct auth_session_info *session_info;
 213         DATA_BLOB dummy = { NULL, 0 };
 214         const char **gpos;
 215         NTSTATUS status;
 216         int rv;
 217         unsigned int i;
 218         struct auth_context *auth_context;
 219
 220         if (argc != 1) {
 221                 return net_gpo_list_usage(ctx, argc, argv);
 222         }
 223
 224         status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
 225         if (!NT_STATUS_IS_OK(status)) {
 226                 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status)));
 227                 return 1;
 228         }
 229
 230         /* Find the user in the directory. We need extended DN's for group expansion
 231          * in authsam_make_server_info */
 232         rv = dsdb_search(gp_ctx->ldb_ctx,
 233                         gp_ctx,
 234                         &result,
 235                         ldb_get_default_basedn(gp_ctx->ldb_ctx),
 236                         LDB_SCOPE_SUBTREE,
 237                         NULL,
 238                         DSDB_SEARCH_SHOW_EXTENDED_DN,
 239                         "(&(objectClass=user)(sAMAccountName=%s))", argv[0]);
 240         if (rv != LDB_SUCCESS) {
 241                 DEBUG(0, ("LDB search failed: %s\n%s\n", ldb_strerror(rv),ldb_errstring(gp_ctx->ldb_ctx)));
 242                 talloc_free(gp_ctx);
 243                 return 1;
 244         }
 245
 246         /* We expect exactly one record */
 247         if (result->count != 1) {
 248                 DEBUG(0, ("Could not find SAM account with name %s\n", argv[0]));
 249                 talloc_free(gp_ctx);
 250                 return 1;
 251         }
 252
 253         /* We need the server info, as this will contain the groups of this
 254          * user, needed for a token */
 255         status = authsam_make_server_info(gp_ctx,
 256                         gp_ctx->ldb_ctx,
 257                         lpcfg_netbios_name(gp_ctx->lp_ctx),
 258                         lpcfg_sam_name(gp_ctx->lp_ctx),
 259                         ldb_get_default_basedn(gp_ctx->ldb_ctx),
 260                         result->msgs[0],
 261                         dummy,
 262                         dummy,
 263                         &server_info);
 264         if (!NT_STATUS_IS_OK(status)) {
 265                 DEBUG(0, ("Failed to make server information: %s\n", get_friendly_nt_error_msg(status)));
 266                 talloc_free(gp_ctx);
 267                 return 1;
 268         }
 269
 270         /* We do now need an auth context to create a session */
 271         status = auth_context_create_from_ldb(gp_ctx, gp_ctx->ldb_ctx, &auth_context);
 272         if (!NT_STATUS_IS_OK(status)) {
 273                 DEBUG(0, ("Failed to get an auth context: %s\n", get_friendly_nt_error_msg(status)));
 274                 talloc_free(gp_ctx);
 275                 return 1;
 276         }
 277
 278         /* The session info will contain the security token for this user */
 279         status = auth_generate_session_info(gp_ctx, auth_context, server_info, 0, &session_info);
 280         if (!NT_STATUS_IS_OK(status)) {
 281                 DEBUG(0, ("Failed to generate session information: %s\n", get_friendly_nt_error_msg(status)));
 282                 talloc_free(gp_ctx);
 283                 return 1;
 284         }
 285
 286         status = gp_list_gpos(gp_ctx, session_info->security_token, &gpos);
 287         if (!NT_STATUS_IS_OK(status)) {
 288                 DEBUG(0, ("Failed to list gpos for user %s: %s\n", argv[0],
 289                                 get_friendly_nt_error_msg(status)));
 290                 talloc_free(gp_ctx);
 291                 return 1;
 292         }
 293
 294         d_printf("GPO's for user %s:\n", argv[0]);
 295         for (i = 0; gpos[i] != NULL; i++) {
 296                 d_printf("\t%s\n", gpos[i]);
 297         }
 298
 299         talloc_free(gp_ctx);
 300         return 0;
 301 }
 302
 303 static int net_gpo_link_set_usage(struct net_context *ctx, int argc, const char **argv)
 304 {
 305         d_printf("Syntax: samba-tool gpo setlink <container> <gpo> ['disable'] ['enforce'] [options]\n");
 306         d_printf("For a list of available options, please type samba-tool gpo setlink --help\n");
 307         return 0;
 308 }
 309
 310 static int net_gpo_link_set(struct net_context *ctx, int argc, const char **argv)
 311 {
 312         struct gp_link *gplink = talloc_zero(ctx, struct gp_link);
 313         struct gp_context *gp_ctx;
 314         unsigned int i;
 315         NTSTATUS status;
 316
 317         if (argc < 2) {
 318                 return net_gpo_link_set_usage(ctx, argc, argv);
 319         }
 320
 321         if (argc >= 3) {
 322                 for (i = 2; i < argc; i++) {
 323                         if (strcmp(argv[i], "disable") == 0) {
 324                                 gplink->options |= GPLINK_OPT_DISABLE;
 325                         }
 326                         if (strcmp(argv[i], "enforce") == 0) {
 327                                 gplink->options |= GPLINK_OPT_ENFORCE;
 328                         }
 329                 }
 330         }
 331         gplink->dn = argv[1];
 332
 333         status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
 334         if (!NT_STATUS_IS_OK(status)) {
 335                 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status)));
 336                 return 1;
 337         }
 338
 339         status = gp_set_gplink(gp_ctx, argv[0], gplink);
 340         if (!NT_STATUS_IS_OK(status)) {
 341                 DEBUG(0, ("Failed to set GPO link on container: %s\n", get_friendly_nt_error_msg(status)));
 342                 return 1;
 343         }
 344         d_printf("Set link on container.\nCurrent Group Policy links:\n");
 345
 346         /* Display current links */
 347         net_gpo_link_get(ctx, 1, argv);
 348
 349         talloc_free(gp_ctx);
 350         return 0;
 351 }
 352
 353 static int net_gpo_link_del_usage(struct net_context *ctx, int argc, const char **argv)
 354 {
 355         d_printf("Syntax: samba-tool gpo dellink <container> <gpo> [options]\n");
 356         d_printf("For a list of available options, please type samba-tool gpo dellink --help\n");
 357         return 0;
 358 }
 359
 360 static int net_gpo_link_del(struct net_context *ctx, int argc, const char **argv)
 361 {
 362         struct gp_context *gp_ctx;
 363         NTSTATUS status;
 364
 365         if (argc != 2) {
 366                 return net_gpo_link_del_usage(ctx, argc, argv);
 367         }
 368
 369         status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
 370         if (!NT_STATUS_IS_OK(status)) {
 371                 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status)));
 372                 return 1;
 373         }
 374
 375         status = gp_del_gplink(gp_ctx, argv[0], argv[1]);
 376         if (!NT_STATUS_IS_OK(status)) {
 377                 DEBUG(0, ("Failed to delete gplink: %s\n", get_friendly_nt_error_msg(status)));
 378                 talloc_free(gp_ctx);
 379                 return 1;
 380         }
 381         d_printf("Deleted gplink.\nCurrent Group Policy links:\n\n");
 382
 383         /* Display current links */
 384         net_gpo_link_get(ctx, 1, argv);
 385
 386         talloc_free(gp_ctx);
 387         return 0;
 388 }
 389
 390 static int net_gpo_inheritance_get_usage(struct net_context *ctx, int argc, const char **argv)
 391 {
 392         d_printf("Syntax: samba-tool gpo getinheritance <container> [options]\n");
 393         d_printf("For a list of available options, please type samba-tool gpo getinheritance --help\n");
 394         return 0;
 395 }
 396
 397 static int net_gpo_inheritance_get(struct net_context *ctx, int argc, const char **argv)
 398 {
 399         struct gp_context *gp_ctx;
 400         enum gpo_inheritance inheritance;
 401         NTSTATUS status;
 402
 403         if (argc != 1) {
 404                 return net_gpo_inheritance_get_usage(ctx, argc, argv);
 405         }
 406
 407         status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
 408         if (!NT_STATUS_IS_OK(status)) {
 409                 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status)));
 410                 return 1;
 411         }
 412
 413         status = gp_get_inheritance(gp_ctx, argv[0], &inheritance);
 414         if (!NT_STATUS_IS_OK(status)) {
 415                 DEBUG(0, ("Failed to set GPO link on container: %s\n", get_friendly_nt_error_msg(status)));
 416                 talloc_free(gp_ctx);
 417                 return 1;
 418         }
 419
 420         if (inheritance == GPO_BLOCK_INHERITANCE) {
 421                 d_printf("container has GPO_BLOCK_INHERITANCE\n");
 422         } else {
 423                 d_printf("container has GPO_INHERIT\n");
 424         }
 425
 426         talloc_free(gp_ctx);
 427         return 0;
 428 }
 429
 430 static int net_gpo_inheritance_set_usage(struct net_context *ctx, int argc, const char **argv)
 431 {
 432         d_printf("Syntax: samba-tool gpo setinheritance <container> <\"block\"|\"inherit\"> [options]\n");
 433         d_printf("For a list of available options, please type samba-tool gpo setinheritance --help\n");
 434         return 0;
 435 }
 436
 437 static int net_gpo_inheritance_set(struct net_context *ctx, int argc, const char **argv)
 438 {
 439         struct gp_context *gp_ctx;
 440         enum gpo_inheritance inheritance;
 441         NTSTATUS status;
 442
 443         if (argc != 2) {
 444                 return net_gpo_inheritance_set_usage(ctx, argc, argv);
 445         }
 446
 447         if (strcmp(argv[1], "inherit") == 0) {
 448                 inheritance = GPO_INHERIT;
 449         } else if (strcmp(argv[1], "block") == 0) {
 450                 inheritance = GPO_BLOCK_INHERITANCE;
 451         } else {
 452                 return net_gpo_inheritance_set_usage(ctx, argc, argv);
 453         }
 454
 455         status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
 456         if (!NT_STATUS_IS_OK(status)) {
 457                 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status)));
 458                 return 1;
 459         }
 460
 461         status = gp_set_inheritance(gp_ctx, argv[0], inheritance);
 462         if (!NT_STATUS_IS_OK(status)) {
 463                 DEBUG(0, ("Failed to set GPO link on container: %s\n", get_friendly_nt_error_msg(status)));
 464                 talloc_free(gp_ctx);
 465                 return 1;
 466         }
 467
 468         /* Display current links */
 469         net_gpo_inheritance_get(ctx, 1, argv);
 470
 471         return 0;
 472 }
 473
 474 static int net_gpo_fetch_usage(struct net_context *ctx, int argc, const char **argv)
 475 {
 476         d_printf("Syntax: samba-tool gpo fetch <container> [options]\n");
 477         d_printf("For a list of available options, please type samba-tool gpo fetch --help\n");
 478         return 0;
 479 }
 480
 481 static int net_gpo_fetch(struct net_context *ctx, int argc, const char **argv)
 482 {
 483         struct gp_context *gp_ctx;
 484         struct gp_object *gpo;
 485         const char *path;
 486         NTSTATUS rv;
 487
 488         if (argc != 1) {
 489                 return net_gpo_fetch_usage(ctx, argc, argv);
 490         }
 491
 492         rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
 493         if (!NT_STATUS_IS_OK(rv)) {
 494                 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv)));
 495                 return 1;
 496         }
 497
 498         rv = gp_get_gpo_info(gp_ctx, argv[0], &gpo);
 499         if (!NT_STATUS_IS_OK(rv)) {
 500                 DEBUG(0, ("Failed to get GPO: %s\n", get_friendly_nt_error_msg(rv)));
 501                 talloc_free(gp_ctx);
 502                 return 1;
 503         }
 504
 505         rv = gp_fetch_gpt(gp_ctx, gpo, &path);
 506         if (!NT_STATUS_IS_OK(rv)) {
 507                 DEBUG(0, ("Failed to fetch GPO: %s\n", get_friendly_nt_error_msg(rv)));
 508                 talloc_free(gp_ctx);
 509                 return 1;
 510         }
 511         d_printf("%s\n", path);
 512
 513         return 0;
 514 }
 515 static int net_gpo_create_usage(struct net_context *ctx, int argc, const char **argv)
 516 {
 517         d_printf("Syntax: samba-tool gpo create <displayname> [options]\n");
 518         d_printf("For a list of available options, please type samba-tool gpo create --help\n");
 519         return 0;
 520 }
 521
 522 static int net_gpo_create(struct net_context *ctx, int argc, const char **argv)
 523 {
 524         struct gp_context *gp_ctx;
 525         struct gp_object *gpo;
 526         NTSTATUS rv;
 527
 528         if (argc != 1) {
 529                 return net_gpo_create_usage(ctx, argc, argv);
 530         }
 531
 532         rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
 533         if (!NT_STATUS_IS_OK(rv)) {
 534                 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv)));
 535                 return 1;
 536         }
 537
 538         rv = gp_create_gpo(gp_ctx, argv[0], &gpo);
 539         if (!NT_STATUS_IS_OK(rv)) {
 540                 DEBUG(0, ("Failed to create GPO: %s\n", get_friendly_nt_error_msg(rv)));
 541                 talloc_free(gp_ctx);
 542                 return 1;
 543         }
 544
 545
 546         return 0;
 547 }
 548
 549 static int net_gpo_set_acl_usage(struct net_context *ctx, int argc, const char **argv)
 550 {
 551         d_printf("Syntax: samba-tool gpo setacl <dn> <sddl> [options]\n");
 552         d_printf("For a list of available options, please type samba-tool gpo setacl --help\n");
 553         return 0;
 554 }
 555
 556 static int net_gpo_set_acl(struct net_context *ctx, int argc, const char **argv)
 557 {
 558         struct gp_context *gp_ctx;
 559         struct security_descriptor *sd;
 560         NTSTATUS rv;
 561
 562         if (argc != 2) {
 563                 return net_gpo_set_acl_usage(ctx, argc, argv);
 564         }
 565
 566         rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
 567         if (!NT_STATUS_IS_OK(rv)) {
 568                 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv)));
 569                 return 1;
 570         }
 571
 572         /* Convert sddl to security descriptor */
 573         sd = sddl_decode(gp_ctx, argv[1], samdb_domain_sid(gp_ctx->ldb_ctx));
 574         if (sd == NULL) {
 575                 DEBUG(0, ("Invalid SDDL\n"));
 576                 talloc_free(gp_ctx);
 577                 return 1;
 578         }
 579
 580         rv = gp_set_acl(gp_ctx, argv[0], sd);
 581         if (!NT_STATUS_IS_OK(rv)) {
 582                 DEBUG(0, ("Failed to set ACL on GPO: %s\n", get_friendly_nt_error_msg(rv)));
 583                 talloc_free(gp_ctx);
 584                 return 1;
 585         }
 586
 587         talloc_free(gp_ctx);
 588         return 0;
 589 }
 590
 591
 592
 593 static const struct net_functable net_gpo_functable[] = {
 594         { "listall", "List all GPO's on a DC\n", net_gpo_list_all, net_gpo_list_all_usage },
 595         { "list", "List all active GPO's for a machine/user\n", net_gpo_list, net_gpo_list_usage },
 596         { "show", "Show information for a GPO\n", net_gpo_get_gpo, net_gpo_get_gpo_usage },
 597         { "getlink", "List gPLink of container\n", net_gpo_link_get, net_gpo_link_get_usage },
 598         { "setlink", "Link a GPO to a container\n", net_gpo_link_set, net_gpo_link_set_usage },
 599         { "dellink", "Delete GPO link from a container\n", net_gpo_link_del, net_gpo_link_del_usage },
 600         { "getinheritance", "Get inheritance flag from a container\n", net_gpo_inheritance_get, net_gpo_inheritance_get_usage },
 601         { "setinheritance", "Set inheritance flag on a container\n", net_gpo_inheritance_set, net_gpo_inheritance_set_usage },
 602         { "fetch", "Download a GPO\n", net_gpo_fetch, net_gpo_fetch_usage },
 603         { "create", "Create a GPO\n", net_gpo_create, net_gpo_create_usage },
 604         { "setacl", "Set ACL on a GPO\n", net_gpo_set_acl, net_gpo_set_acl_usage },
 605         { NULL, NULL }
 606 };
 607
 608 int net_gpo_usage(struct net_context *ctx, int argc, const char **argv)
 609 {
 610         d_printf("Syntax: samba-tool gpo <command> [options]\n");
 611         d_printf("For available commands, please type samba-tool gpo help\n");
 612         return 0;
 613 }
 614
 615 int net_gpo(struct net_context *ctx, int argc, const char **argv)
 616 {
 617         return net_run_function(ctx, argc, argv, net_gpo_functable, net_gpo_usage);
 618 }