3 # Manipulate file NT ACLs
5 # Copyright Matthieu Patou 2010 <mat@matws.net>
7 # This program is free software; you can redistribute it and/or modify
8 # it under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # This program is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with this program. If not, see <http://www.gnu.org/licenses/>.
21 from samba.credentials import DONT_USE_KERBEROS
22 import samba.getopt as options
23 from samba.dcerpc import security
24 from samba.ntacls import setntacl, getntacl
26 from samba.ndr import ndr_unpack
28 from ldb import SCOPE_BASE
31 from samba.auth import system_session
32 from samba.netcmd import (
39 class cmd_acl_set(Command):
40 """Set ACLs on a file"""
41 synopsis = "%prog set <acl> <file> [--xattr-backend=native|tdb] [--eadb-file=file] [options]"
43 takes_optiongroups = {
44 "sambaopts": options.SambaOptions,
45 "credopts": options.CredentialsOptions,
46 "versionopts": options.VersionOptions,
50 Option("--quiet", help="Be quiet", action="store_true"),
51 Option("--xattr-backend", type="choice", help="xattr backend type (native fs or tdb)",
52 choices=["native","tdb"]),
53 Option("--eadb-file", help="Name of the tdb file where attributes are stored", type="string"),
56 takes_args = ["acl","file"]
58 def run(self, acl, file, quiet=False,xattr_backend=None,eadb_file=None,
59 credopts=None, sambaopts=None, versionopts=None):
60 lp = sambaopts.get_loadparm()
61 creds = credopts.get_credentials(lp)
62 path = os.path.join(lp.get("private dir"), lp.get("secrets database") or "secrets.ldb")
63 creds = credopts.get_credentials(lp)
64 creds.set_kerberos_state(DONT_USE_KERBEROS)
66 ldb = Ldb(path, session_info=system_session(), credentials=creds,
69 # XXX: Should catch a particular exception type
70 raise CommandError("Unable to read domain SID from configuration files")
73 res = ldb.search(expression="(objectClass=*)",
74 base="flatname=%s,cn=Primary Domains" % lp.get("workgroup"),
75 scope=SCOPE_BASE, attrs=attrs)
77 domainsid = ndr_unpack(security.dom_sid, res[0]["objectSid"][0])
78 setntacl(lp, file, acl, str(domainsid), xattr_backend, eadb_file)
80 raise CommandError("Unable to read domain SID from configuration files")
83 class cmd_acl_get(Command):
84 """Set ACLs on a file"""
85 synopsis = "%prog get <file> [--as-sddl] [--xattr-backend=native|tdb] [--eadb-file=file] [options]"
87 takes_optiongroups = {
88 "sambaopts": options.SambaOptions,
89 "credopts": options.CredentialsOptions,
90 "versionopts": options.VersionOptions,
94 Option("--as-sddl", help="Output ACL in the SDDL format", action="store_true"),
95 Option("--xattr-backend", type="choice", help="xattr backend type (native fs or tdb)",
96 choices=["native","tdb"]),
97 Option("--eadb-file", help="Name of the tdb file where attributes are stored", type="string"),
100 takes_args = ["file"]
102 def run(self, file, as_sddl=False, xattr_backend=None, eadb_file=None,
103 credopts=None, sambaopts=None, versionopts=None):
104 lp = sambaopts.get_loadparm()
105 creds = credopts.get_credentials(lp)
106 acl = getntacl(lp, file, xattr_backend, eadb_file)
108 anysid = security.dom_sid(security.SID_NT_SELF)
109 print acl.info.as_sddl(anysid)
114 class cmd_nt_acl(SuperCommand):
115 """NT ACLs manipulation"""
118 subcommands["set"] = cmd_acl_set()
119 subcommands["get"] = cmd_acl_get()