1 # Utility methods for security descriptor manipulation
3 # Copyright Nadezhda Ivanova 2010 <nivanova@samba.org>
5 # This program is free software; you can redistribute it and/or modify
6 # it under the terms of the GNU General Public License as published by
7 # the Free Software Foundation; either version 3 of the License, or
8 # (at your option) any later version.
10 # This program is distributed in the hope that it will be useful,
11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 # GNU General Public License for more details.
15 # You should have received a copy of the GNU General Public License
16 # along with this program. If not, see <http://www.gnu.org/licenses/>.
19 """Utility methods for security descriptor manipulation."""
22 from ldb
import Message
, MessageElement
, Dn
23 from ldb
import FLAG_MOD_REPLACE
, SCOPE_BASE
24 from samba
.ndr
import ndr_pack
, ndr_unpack
25 from samba
.dcerpc
import security
28 class SDUtils(object):
29 """Some utilities for manipulation of security descriptors
32 def __init__(self
, samdb
):
34 self
.domain_sid
= security
.dom_sid(self
.ldb
.get_domain_sid())
36 def modify_sd_on_dn(self
, object_dn
, sd
, controls
=None):
37 """ Modify security descriptor using either SDDL string
38 or security.descriptor object
41 m
.dn
= Dn(self
.ldb
, object_dn
)
42 assert(isinstance(sd
, str) or isinstance(sd
, security
.descriptor
))
43 if isinstance(sd
, str):
44 tmp_desc
= security
.descriptor
.from_sddl(sd
, self
.domain_sid
)
45 elif isinstance(sd
, security
.descriptor
):
48 m
["nTSecurityDescriptor"] = MessageElement(ndr_pack(tmp_desc
),
50 "nTSecurityDescriptor")
51 self
.ldb
.modify(m
, controls
)
53 def read_sd_on_dn(self
, object_dn
, controls
=None):
54 res
= self
.ldb
.search(object_dn
, SCOPE_BASE
, None,
55 ["nTSecurityDescriptor"], controls
=controls
)
56 desc
= res
[0]["nTSecurityDescriptor"][0]
57 return ndr_unpack(security
.descriptor
, desc
)
59 def get_object_sid(self
, object_dn
):
60 res
= self
.ldb
.search(object_dn
)
61 return ndr_unpack(security
.dom_sid
, res
[0]["objectSid"][0])
63 def dacl_add_ace(self
, object_dn
, ace
):
64 """ Adds an ACE to an objects security descriptor
66 desc
= self
.read_sd_on_dn(object_dn
)
67 desc_sddl
= desc
.as_sddl(self
.domain_sid
)
70 if desc_sddl
.find("(") >= 0:
71 desc_sddl
= (desc_sddl
[:desc_sddl
.index("(")] + ace
+
72 desc_sddl
[desc_sddl
.index("("):])
74 desc_sddl
= desc_sddl
+ ace
75 self
.modify_sd_on_dn(object_dn
, desc_sddl
)
77 def get_sd_as_sddl(self
, object_dn
, controls
=None):
78 """ Return object nTSecutiryDescriptor in SDDL format
80 desc
= self
.read_sd_on_dn(object_dn
, controls
=controls
)
81 return desc
.as_sddl(self
.domain_sid
)