3 # Unix SMB/CIFS implementation.
4 # Copyright (C) Matthieu Patou <mat@matws.net> 2009
7 # This program is free software; you can redistribute it and/or modify
8 # it under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # This program is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with this program. If not, see <http://www.gnu.org/licenses/>.
23 from samba
.dcerpc
import security
, xattr
24 from samba
.ndr
import ndr_pack
, ndr_unpack
28 attribute
= samba
.xattr
.wrap_getxattr(file,xattr
.XATTR_NTACL_NAME
)
29 anysid
=security
.dom_sid(security
.SID_NT_SELF
)
30 ntacl
= ndr_unpack(xattr
.NTACL
,attribute
,1)
31 return ntacl
.info
.as_sddl(anysid
)
33 def setntacl(file,sddl
):
36 anysid
=security
.dom_sid(security
.SID_NT_SELF
)
37 sd
= security
.descriptor
.from_sddl(sddl
, anysid
)
39 attribute
= samba
.xattr
.wrap_setxattr(file,xattr
.XATTR_NTACL_NAME
,ndr_pack(ntacl
))
41 # Takes the access mask of a DS ACE and transform them in a File ACE mask
42 def ldapmask2filemask(ldm
):
43 RIGHT_DS_CREATE_CHILD
= 0x00000001
44 RIGHT_DS_DELETE_CHILD
= 0x00000002
45 RIGHT_DS_LIST_CONTENTS
= 0x00000004
46 ACTRL_DS_SELF
= 0x00000008
47 RIGHT_DS_READ_PROPERTY
= 0x00000010
48 RIGHT_DS_WRITE_PROPERTY
= 0x00000020
49 RIGHT_DS_DELETE_TREE
= 0x00000040
50 RIGHT_DS_LIST_OBJECT
= 0x00000080
51 RIGHT_DS_CONTROL_ACCESS
= 0x00000100
52 FILE_READ_DATA
= 0x0001
53 FILE_LIST_DIRECTORY
= 0x0001
54 FILE_WRITE_DATA
= 0x0002
55 FILE_ADD_FILE
= 0x0002
56 FILE_APPEND_DATA
= 0x0004
57 FILE_ADD_SUBDIRECTORY
= 0x0004
58 FILE_CREATE_PIPE_INSTANCE
= 0x0004
60 FILE_WRITE_EA
= 0x0010
62 FILE_TRAVERSE
= 0x0020
63 FILE_DELETE_CHILD
= 0x0040
64 FILE_READ_ATTRIBUTES
= 0x0080
65 FILE_WRITE_ATTRIBUTES
= 0x0100
67 READ_CONTROL
= 0x00020000
68 WRITE_DAC
= 0x00040000
69 WRITE_OWNER
= 0x00080000
70 SYNCHRONIZE
= 0x00100000
71 STANDARD_RIGHTS_ALL
= 0x001F0000
73 filemask
= ldm
& STANDARD_RIGHTS_ALL
76 if( (ldm
& RIGHT_DS_READ_PROPERTY
) and (ldm
& RIGHT_DS_LIST_CONTENTS
) ):
77 filemask
= filemask |
(SYNCHRONIZE | FILE_LIST_DIRECTORY |\
78 FILE_READ_ATTRIBUTES | FILE_READ_EA |\
79 FILE_READ_DATA | FILE_EXECUTE
)
81 if( (ldm
& RIGHT_DS_WRITE_PROPERTY
) ):
82 filemask
= filemask |
(SYNCHRONIZE | FILE_WRITE_DATA |\
83 FILE_APPEND_DATA | FILE_WRITE_EA |\
84 FILE_WRITE_ATTRIBUTES | FILE_ADD_FILE |\
85 FILE_ADD_SUBDIRECTORY
)
87 if( (ldm
& RIGHT_DS_CREATE_CHILD
) ):
88 filemask
= filemask |
(FILE_ADD_SUBDIRECTORY | FILE_ADD_FILE
)
90 if( (ldm
& RIGHT_DS_DELETE_CHILD
) ):
91 filemask
= filemask | FILE_DELETE_CHILD
95 # This function takes an the SDDL representation of a DS
96 # ACL and return the SDDL representation of this ACL adapted
97 # for files. It's used for Policy object provision
99 def dsacl2fsacl(dssddl
):
100 anysid
= security
.dom_sid(security
.SID_NT_SELF
)
101 ref
= security
.descriptor
.from_sddl(dssddl
,anysid
)
102 fdescr
= security
.descriptor()
103 fdescr
.owner_sid
= ref
.owner_sid
104 fdescr
.group_sid
= ref
.group_sid
105 fdescr
.type = ref
.type
106 fdescr
.revision
= ref
.revision
107 fdescr
.sacl
= ref
.sacl
109 for i
in range(0,len(aces
)):
111 if not ace
.type & security
.SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT
and str(ace
.trustee
) != security
.SID_BUILTIN_PREW2K
:
112 # if fdescr.type & security.SEC_DESC_DACL_AUTO_INHERITED:
113 ace
.flags
= ace
.flags | security
.SEC_ACE_FLAG_OBJECT_INHERIT | security
.SEC_ACE_FLAG_CONTAINER_INHERIT
114 if str(ace
.trustee
) == security
.SID_CREATOR_OWNER
:
115 # For Creator/Owner the IO flag is set as this ACE has only a sense for child objects
116 ace
.flags
= ace
.flags | security
.SEC_ACE_FLAG_INHERIT_ONLY
117 ace
.access_mask
= ldapmask2filemask(ace
.access_mask
)
120 return fdescr
.as_sddl(anysid
)