PEP8: add spaces after operators
[nivanova/samba-autobuild/.git] / python / samba / sd_utils.py
1 # Utility methods for security descriptor manipulation
2 #
3 # Copyright Nadezhda Ivanova 2010 <nivanova@samba.org>
4 #
5 # This program is free software; you can redistribute it and/or modify
6 # it under the terms of the GNU General Public License as published by
7 # the Free Software Foundation; either version 3 of the License, or
8 # (at your option) any later version.
9 #
10 # This program is distributed in the hope that it will be useful,
11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13 # GNU General Public License for more details.
14 #
15 # You should have received a copy of the GNU General Public License
16 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
17 #
18
19 """Utility methods for security descriptor manipulation."""
20
21 import samba
22 from ldb import Message, MessageElement, Dn
23 from ldb import FLAG_MOD_REPLACE, SCOPE_BASE
24 from samba.ndr import ndr_pack, ndr_unpack
25 from samba.dcerpc import security
26
27
28 class SDUtils(object):
29     """Some utilities for manipulation of security descriptors on objects."""
30
31     def __init__(self, samdb):
32         self.ldb = samdb
33         self.domain_sid = security.dom_sid(self.ldb.get_domain_sid())
34
35     def modify_sd_on_dn(self, object_dn, sd, controls=None):
36         """Modify security descriptor using either SDDL string
37             or security.descriptor object
38         """
39         m = Message()
40         if isinstance(object_dn, Dn):
41             m.dn = object_dn
42         else:
43             m.dn = Dn(self.ldb, object_dn)
44
45         assert(isinstance(sd, str) or isinstance(sd, security.descriptor))
46         if isinstance(sd, str):
47             tmp_desc = security.descriptor.from_sddl(sd, self.domain_sid)
48         elif isinstance(sd, security.descriptor):
49             tmp_desc = sd
50
51         m["nTSecurityDescriptor"] = MessageElement(ndr_pack(tmp_desc),
52                                                    FLAG_MOD_REPLACE,
53                                                    "nTSecurityDescriptor")
54         self.ldb.modify(m, controls)
55
56     def read_sd_on_dn(self, object_dn, controls=None):
57         res = self.ldb.search(object_dn, SCOPE_BASE, None,
58                               ["nTSecurityDescriptor"], controls=controls)
59         desc = res[0]["nTSecurityDescriptor"][0]
60         return ndr_unpack(security.descriptor, desc)
61
62     def get_object_sid(self, object_dn):
63         res = self.ldb.search(object_dn)
64         return ndr_unpack(security.dom_sid, res[0]["objectSid"][0])
65
66     def dacl_add_ace(self, object_dn, ace):
67         """Add an ACE to an objects security descriptor
68         """
69         desc = self.read_sd_on_dn(object_dn, ["show_deleted:1"])
70         desc_sddl = desc.as_sddl(self.domain_sid)
71         if ace in desc_sddl:
72             return
73         if desc_sddl.find("(") >= 0:
74             desc_sddl = (desc_sddl[:desc_sddl.index("(")] + ace +
75                          desc_sddl[desc_sddl.index("("):])
76         else:
77             desc_sddl = desc_sddl + ace
78         self.modify_sd_on_dn(object_dn, desc_sddl, ["show_deleted:1"])
79
80     def get_sd_as_sddl(self, object_dn, controls=[]):
81         """Return object nTSecutiryDescriptor in SDDL format
82         """
83         desc = self.read_sd_on_dn(object_dn, controls + ["show_deleted:1"])
84         return desc.as_sddl(self.domain_sid)