source4/scripting/python/samba/sd_utils.py

   1 #!/usr/bin/env python
   2 #
   3 # Utility methods for security descriptor manipulation
   4 #
   5 # Copyright Nadezhda Ivanova 2010 <nivanova@samba.org>
   6 #
   7 # This program is free software; you can redistribute it and/or modify
   8 # it under the terms of the GNU General Public License as published by
   9 # the Free Software Foundation; either version 3 of the License, or
  10 # (at your option) any later version.
  11 #
  12 # This program is distributed in the hope that it will be useful,
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 # GNU General Public License for more details.
  16 #
  17 # You should have received a copy of the GNU General Public License
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 #
  20
  21 """Utility methods for security descriptor manipulation."""
  22
  23 import samba
  24 from ldb import Message, MessageElement, Dn
  25 from ldb import FLAG_MOD_REPLACE, SCOPE_BASE
  26 from samba.ndr import ndr_pack, ndr_unpack
  27 from samba.dcerpc import security
  28
  29
  30 class SDUtils(object):
  31     """Some utilities for manipulation of security descriptors
  32     on objects"""
  33
  34     def __init__(self, samdb):
  35         self.ldb = samdb
  36         self.domain_sid = security.dom_sid(self.ldb.get_domain_sid())
  37
  38     def modify_sd_on_dn(self, object_dn, sd, controls=None):
  39         """ Modify security descriptor using either SDDL string
  40             or security.descriptor object
  41         """
  42         m = Message()
  43         m.dn = Dn(self.ldb, object_dn)
  44         assert(isinstance(sd, str) or isinstance(sd, security.descriptor))
  45         if isinstance(sd, str):
  46             tmp_desc = security.descriptor.from_sddl(sd, self.domain_sid)
  47         elif isinstance(sd, security.descriptor):
  48             tmp_desc = sd
  49
  50         m["nTSecurityDescriptor"] = MessageElement(ndr_pack(tmp_desc),
  51                                                        FLAG_MOD_REPLACE,
  52                                                        "nTSecurityDescriptor")
  53         self.ldb.modify(m, controls)
  54
  55     def read_sd_on_dn(self, object_dn, controls=None):
  56         res = self.ldb.search(object_dn, SCOPE_BASE, None,
  57                               ["nTSecurityDescriptor"], controls=controls)
  58         desc = res[0]["nTSecurityDescriptor"][0]
  59         return ndr_unpack(security.descriptor, desc)
  60
  61     def get_object_sid(self, object_dn):
  62         res = self.ldb.search(object_dn)
  63         return ndr_unpack(security.dom_sid, res[0]["objectSid"][0])
  64
  65     def dacl_add_ace(self, object_dn, ace):
  66         """ Adds an ACE to an objects security descriptor
  67         """
  68         desc = self.read_sd_on_dn(object_dn)
  69         desc_sddl = desc.as_sddl(self.domain_sid)
  70         if ace in desc_sddl:
  71             return
  72         if desc_sddl.find("(") >= 0:
  73             desc_sddl = (desc_sddl[:desc_sddl.index("(")] + ace +
  74                          desc_sddl[desc_sddl.index("("):])
  75         else:
  76             desc_sddl = desc_sddl + ace
  77         self.modify_sd_on_dn(object_dn, desc_sddl)
  78
  79     def get_sd_as_sddl(self, object_dn, controls=None):
  80         """ Return object nTSecutiryDescriptor in SDDL format
  81         """
  82         desc = self.read_sd_on_dn(object_dn, controls=controls)
  83         return desc.as_sddl(self.domain_sid)