3 # Manipulate file NT ACLs
5 # Copyright Matthieu Patou 2010 <mat@matws.net>
6 # Copyright Giampaolo Lauria 2011 <lauria2@yahoo.com>
8 # This program is free software; you can redistribute it and/or modify
9 # it under the terms of the GNU General Public License as published by
10 # the Free Software Foundation; either version 3 of the License, or
11 # (at your option) any later version.
13 # This program is distributed in the hope that it will be useful,
14 # but WITHOUT ANY WARRANTY; without even the implied warranty of
15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 # GNU General Public License for more details.
18 # You should have received a copy of the GNU General Public License
19 # along with this program. If not, see <http://www.gnu.org/licenses/>.
22 from samba
.credentials
import DONT_USE_KERBEROS
23 import samba
.getopt
as options
24 from samba
.dcerpc
import security
25 from samba
.ntacls
import setntacl
, getntacl
27 from samba
.ndr
import ndr_unpack
29 from ldb
import SCOPE_BASE
32 from samba
.auth
import system_session
33 from samba
.netcmd
import (
42 class cmd_ntacl_set(Command
):
43 """Set ACLs on a file"""
45 synopsis
= "%prog <acl> <file> [options]"
48 Option("--quiet", help="Be quiet", action
="store_true"),
49 Option("--xattr-backend", type="choice", help="xattr backend type (native fs or tdb)",
50 choices
=["native","tdb"]),
51 Option("--eadb-file", help="Name of the tdb file where attributes are stored", type="string"),
54 takes_args
= ["acl","file"]
56 def run(self
, acl
, file, quiet
=False,xattr_backend
=None,eadb_file
=None,
57 credopts
=None, sambaopts
=None, versionopts
=None):
58 lp
= sambaopts
.get_loadparm()
59 path
= os
.path
.join(lp
.get("private dir"), lp
.get("secrets database") or "secrets.ldb")
60 creds
= credopts
.get_credentials(lp
)
61 creds
.set_kerberos_state(DONT_USE_KERBEROS
)
63 ldb
= Ldb(path
, session_info
=system_session(), credentials
=creds
,
66 raise CommandError("Unable to read domain SID from configuration files", e
)
68 res
= ldb
.search(expression
="(objectClass=*)",
69 base
="flatname=%s,cn=Primary Domains" % lp
.get("workgroup"),
70 scope
=SCOPE_BASE
, attrs
=attrs
)
72 domainsid
= ndr_unpack(security
.dom_sid
, res
[0]["objectSid"][0])
73 setntacl(lp
, file, acl
, str(domainsid
), xattr_backend
, eadb_file
)
75 raise CommandError("Unable to read domain SID from configuration files")
79 class cmd_ntacl_get(Command
):
80 """Set ACLs on a file"""
81 synopsis
= "%prog <file> [options]"
84 Option("--as-sddl", help="Output ACL in the SDDL format", action
="store_true"),
85 Option("--xattr-backend", type="choice", help="xattr backend type (native fs or tdb)",
86 choices
=["native","tdb"]),
87 Option("--eadb-file", help="Name of the tdb file where attributes are stored", type="string"),
92 def run(self
, file, as_sddl
=False, xattr_backend
=None, eadb_file
=None,
93 credopts
=None, sambaopts
=None, versionopts
=None):
94 lp
= sambaopts
.get_loadparm()
95 acl
= getntacl(lp
, file, xattr_backend
, eadb_file
)
97 anysid
= security
.dom_sid(security
.SID_NT_SELF
)
98 self
.outf
.write(acl
.info
.as_sddl(anysid
)+"\n")
103 class cmd_ntacl(SuperCommand
):
104 """NT ACLs manipulation"""
107 subcommands
["set"] = cmd_ntacl_set()
108 subcommands
["get"] = cmd_ntacl_get()