+
    4SsiI                     V   ^ RI t ^ RIt^ RIHt ^ RIHt ^ RIHt ^ RI	H
t
 ^ RIHt ^ RIHtHt ^ RIHt ^ RIHtHtHt ^ R	IHtHt ^ R
IHt ^RIHtHtHtH t  R t! ! R R]4      t" ! R R]4      t# ! R R]4      t$ ! R R]4      t% ! R R]4      t& ! R R]4      t' ! R R]4      t(R# )    N)	provision)system_session)system_session_unix)DONT_USE_KERBEROS)securityidmap)	ndr_print)setntaclgetntacl
getdosinfo)parampassdb)SamDB)CommandCommandErrorSuperCommandOptionc                    R pV P                  4       pVR8X  d   Rp\        P                  ! 4       pVP                  V P                  4       V'       d:    \        \        4       V R7      pTP                  RRTP                  ,          4        V'       d#   \        P                  ! XP                  4      pV# \        P                  ! 4       p V#   \         d   p\        RT4      hRp?ii ; i   \        R4      h; i)	FROLE_ACTIVE_DIRECTORY_DCTsession_infolpUnable to open samdb:Npassdb backendsamba_dsdb:%sz2Unable to read domain SID from configuration files)server_roles3paramget_contextload
configfiler   r   	Exceptionr   seturlr   dom_sid
domain_sidr   get_domain_sid)r   is_ad_dcr   s3confsamdber%   s   &      4/usr/lib/python3/dist-packages/samba/netcmd/ntacl.pyget_local_domain_sidr,   $   s    H.."K00  "F
KK	;~'7!E 	

#_uyy%@A$!))%*:*:;J 	  ..0J   	;6::	;$ # $ 	$s0   C C/  C/ 8C/ C,C''C,/C<c                   \  a  ] tR t^Bt o RtRtR]P                  R]P                  R]P                  /t
]! RR]P                  RR	7      ]! R
RRRR	7      ]! RRRRR.R7      ]! RRRR7      ]! RRRR	7      ]! RRRR	7      ]! RRRR	7      ]! RRRR	7      ]! RR RR7      .	tR!R".tR&R$ ltR%tV tR## )'cmd_ntacl_setzSet ACLs on a file.z%prog <acl> <path> [options]	sambaoptscredoptsversionoptsz-qz--quiet
store_truehelpaction-v	--verbose
Be verbose--xattr-backendchoice%xattr backend type (native fs or tdb)nativetdbtyper4   choices--eadb-file0Name of the tdb file where attributes are storedstringr4   r?   --use-ntvfsLSet the ACLs directly to the TDB or xattr for use with the ntvfs file server
--use-s3fsHSet the ACLs for use with the default s3fs file server via the VFS layer--recursive;Set the ACLs for directories and their contents recursively--follow-symlinksFollow symlinks	--servicez:Name of the smb.conf service to use when applying the ACLsaclpathNc                  a aaaaaaaaaa S P                  4       pV
P                  4       o\        S4      oS'       g   V'       g   R SP                  R4      9   oM
V'       d   RoVVVVVVV VVVV3R lpV! V4       S'       d   \        P
                  P                  V4      '       d   \        P                  ! VSR7       Fe  w  pppV F)  pV! \        P
                  P                  VV4      4       K+  	  V F)  pV! \        P
                  P                  VV4      4       K+  	  Kg  	  S'       d   VP                  R4       R# R# )smbserver servicesFc                   < S'       gd   \         P                  P                  V 4      '       d?   S'       d%   SP                  P	                  R V ,          4       R# \        RV ,          4      hS'       d   \         P                  P                  V 4      '       d$   SP                  P	                  RV ,          4       Mj\         P                  P                  V 4      '       d$   SP                  P	                  RV ,          4       M"SP                  P	                  RV ,          4        \        SV S\        S4      \        4       SSS
S	R7	       R#   \         d   p\        RT : RT: 24      hRp?ii ; i)	ignored symlink: %s
N'symlink: %s: requires --follow-symlinkssymlink: %s
dir: %s
	file: %s
	use_ntvfsserviceCould not set acl for : )osrO   islinkoutfwriter   isdirr
   strr   r!   )_pathr*   rN   r%   	eadb_filefollow_symlinksr   	recursiveselfr[   rZ   verbosexattr_backends   & r+   _setntacl_path)cmd_ntacl_set.run.<locals>._setntacl_pathj   s   "rww~~e'<'<IIOO$;e$CD"#LPU#VWW77>>%((IIOOOe$;<WW]]5))IIOOK%$78IIOOL5$89PZ,.&"#,!(*  P"UA#NOOPs   (%E E2E--E2followlinksPPlease note that POSIX permissions have NOT been changed, only the stored NT ACLN)

get_loggerget_loadparmr,   getr^   rO   rb   walkjoinwarning)rh   rN   rO   rZ   use_s3fsquietri   rj   re   r0   r/   r1   rg   rf   r[   loggerrk   rootdirsfilesnamer%   r   s   ff&f&&fff&&&fff      @@r+   runcmd_ntacl_set.run]   s     "##%)"-
(9!::II	P 	P6 	tt,,%'WWT%O!dE!D"277<<d#;< " D"277<<d#;< ! &P NNmn      )FFFFNNNNNFFN)__name__
__module____qualname____firstlineno____doc__synopsisoptionsSambaOptionsCredentialsOptionsVersionOptionstakes_optiongroupsr   optparseSUPPRESS_HELPtakes_options
takes_argsr}   __static_attributes____classdictcell____classdict__s   @r+   r.   r.   B   s     -H 	W))G..w-- 	tYX%;%;LQt[|LI x6] %(	*}#U\de}#q  {G  	H|"l  vB  	C}#`iuv"):<P{!]dlmM J2o 2or   r.   c                      a  ] tR t^t o RtRtR]P                  R]P                  R]P                  /t
R.tR
R ltR	tV tR# )cmd_dosinfo_getz"Get DOS info of a file from xattr.%prog <file> [options]r/   r0   r1   fileNc                    VP                  4       p\        P                  ! 4       pVP                  VP                  4       \        WQ4      pV'       d'   V P                  P                  \        V4      4       R # R # )N)	rq   r   r   r   r    r   r`   ra   r	   )rh   r   r0   r/   r1   r   r(   dosinfos   &&&&&   r+   r}   cmd_dosinfo_get.run   sU    ##%$$&BMM"R&IIOOIg./ r   r   NNN)r   r   r   r   r   r   r   r   r   r   r   r   r}   r   r   r   s   @r+   r   r      sK     ,'H 	W))G..w-- J0 0r   r   c                     a  ] tR t^t o RtRtR]P                  R]P                  R]P                  /t
]! RRRR	7      ]! R
RRRR.R7      ]! RRRR7      ]! RRRR	7      ]! RRRR	7      ]! RRRR7      .tR.tRR ltRtV tR# )cmd_ntacl_getzGet ACLs of a file.r   r/   r0   r1   z	--as-sddlzOutput ACL in the SDDL formatr2   r3   r9   r:   r;   r<   r=   r>   rA   rB   rC   rD   rE   zKGet the ACLs directly from the TDB or xattr used with the ntvfs file serverrG   zKGet the ACLs for use via the VFS layer used by the default s3fs file serverrM   z9Name of the smb.conf service to use when getting the ACLsr   Nc           
        VP                  4       p\        V4      pV'       g   V'       g   R VP                  R4      9   pM
V'       d   Rp\        VV\	        4       VVVV
R7      pV'       d4   V P
                  P                  VP                  V4      R,           4       R# V P
                  P                  \        V4      4       R# )rQ   rR   Fdirect_db_accessr[   
N)	rq   r,   rr   r   r   r`   ra   as_sddlr	   )rh   r   rZ   rv   r   rj   re   r0   r/   r1   r[   r   r%   rN   s   &&&&&&&&&&&   r+   r}   cmd_ntacl_get.run   s     ##%)"-
(9!::IIr*,$ (1&( IIOOCKK
3d:;IIOOIcN+r   r   )	FFFNNNNNN)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r}   r   r   r   s   @r+   r   r      s     'H 	W))G..w-- 	{!@V x6] %(	*}#U\de}#p  zF  	G|"o  yE  	F{!\cklM J, ,r   r   c                     a  ] tR t^t o RtRtR]P                  /t]	! RRRR7      ]	! RR	R
R7      ]	! RRR
R7      ]	! RRRR7      ]	! RRRRR.R7      ]	! RRRR
R7      ]	! RRR
R7      ]	! RRRR
R7      .t
. R!OtR"R ltR tV tR# )#cmd_ntacl_changedomsidzChange the domain SID for ACLsz9%prog <Orig-Domain-SID> <New-Domain-SID> <file> [options]r/   rM   z#Name of the smb.conf service to userC   rD   rE   rF   r2   r3   rG   rH   rA   rB   r9   r:   r;   r<   r=   r>   z-rrI   rJ   rK   rL   r6   r7   r8   Nc                  a aaaaa
aaaaaaa S P                  4       pV	P                  4       o\        S4      oS'       g   V'       g   R SP                  R4      9   oM
V'       d   RoS'       g   S'       g   \	        R4      h \
        P                  ! V4      o \
        P                  ! T4      oTTTTTTT
T TTTT3R loTT3R lpS! T4       S
'       d.   \        P                  P                  T4      '       d	   T! T4       S'       d   TP                  R	4       R# R#   \         d   p\	        RT: RT: 24      hRp?ii ; i  \         d   p\	        RT: RT: 24      hRp?ii ; i)
rQ   rR   Fz0Must provide a share name with --service=<share>zCould not parse old sid r]   Nc                   < S	'       gd   \         P                  P                  V 4      '       d?   S'       d%   SP                  P	                  R V ,          4       R# \        RV ,          4      hS'       d   \         P                  P                  V 4      '       d$   SP                  P	                  RV ,          4       Mj\         P                  P                  V 4      '       d$   SP                  P	                  RV ,          4       M"SP                  P	                  RV ,          4        \        S
V \        4       SSSSR7      pTP                  S4      pS'       d#   SP                  P	                  R	T,          4       TT3R
 lpT! TP                  4      Tn        T! TP                  4      Tn        TP                  '       d5   TP                  P                   F  pT! TP                  4      Tn        K  	  TP                   '       d5   TP                   P                   F  pT! TP                  4      Tn        K  	  TP                  S4      pS'       d#   SP                  P	                  RT,          4       Y68X  d&   S'       d   SP                  P	                  R4       R#  \#        S
T TS\        4       SSSSR7	       R#   \         d   p\        RT : RT: 24      hRp?ii ; i  \         d   p\        RT : RT: 24      hRp?ii ; i)rT   NrU   rV   rW   rX   r   zCould not get acl for r]   zbefore:
%s
c                 x   < V P                  4       w  rVS8X  d    \        P                  ! R SV3,          4      # V # )z%s-%i)splitr   r$   )siddomridnew_domain_sidold_domain_sids   &  r+   replace_domain_sidNcmd_ntacl_changedomsid.run.<locals>.changedom_sids.<locals>.replace_domain_sidM  s8     YY[
.(#++G~s6K,KLL
r   z
after:
%s
znothing to do
TrY   r\   )r^   rO   r_   r`   ra   r   rb   r   r   r!   r   	owner_sid	group_sidsaclacestrusteedaclr
   )rd   rN   r*   	orig_sddlr   acenew_sddlr%   re   rf   r   r   r   rg   rh   r[   rZ   ri   rj   s   &      r+   changedom_sids2cmd_ntacl_changedomsid.run.<locals>.changedom_sids/  s3   "rww~~e'<'<IIOO$;e$CD"#LPU#VWW77>>%((IIOOOe$;<WW]]5))IIOOK%$78IIOOL5$89	Pr$24,(09'.0 J/I		) ;< /s}}=CM.s}}=CMxxx88==C"4S[["ACK )xxx88==C"4S[["ACK ) {{:.H		 9:$IIOO$56P',.&"#,!(*C  P"UA#NOOPT  P"UA#NOOPs0   (K %K) K&K!!K&)L4LLc                   < \         P                  ! V SR 7       Fb  w  rpV F(  pS! \         P                  P                  W4      4       K*  	  V F(  pS! \         P                  P                  W4      4       K*  	  Kd  	  R# )rm   N)r^   rs   rO   rt   )rd   ry   rz   r{   fdr   rf   s   &     r+   recursive_changedom_sids<cmd_ntacl_changedomsid.run.<locals>.recursive_changedom_sidss  s^    %'WWU%P!EA"277<<#89  A"277<<#89 	 &Qr   zQPlease note that POSIX permissions have NOT been changed, only the stored NT ACL.)rp   rq   r,   rr   r   r   r$   r!   r^   rO   rb   ru   )rh   old_domain_sid_strnew_domain_sid_strrO   rZ   rv   r[   rj   re   r/   rg   rf   ri   rx   r*   r   r   r%   r   r   r   s   f&&&f&fff&fff   @@@@@r+   r}   cmd_ntacl_changedomsid.run	  s;    "##%)"-
(9!::IIBD D	8%--.@AN
	8%--.@AN
B	P B	P B	PH	: 	tt,,$T*NN > ? u  	8 2A 7 8 8	8  	8 2A 7 8 8	8s0   D# E	 #E.EE	E,E''E,r   )r   r   rO   )	FFNNNNFFF)r   r   r   r   r   r   r   r   r   r   r   r   r}   r   r   r   s   @r+   r   r      s     (JH 	W))
 	6	 	&		!
 	"		!
 	C	 	8u%		'
 	N		!
 	"	! 			!C&MP >Jx? x?r   r   c                      a  ] tR tRt o RtRtR]P                  R]P                  R]P                  /t
]! RRR	R
7      ]! RRR	R
7      .tRR ltRtV tR# )cmd_ntacl_sysvolreseti  z?Reset sysvol ACLs to defaults (including correct ACLs on GPOs).r   r/   r0   r1   rE   z/Set the ACLs for use with the ntvfs file serverr2   r3   rG   z6Set the ACLs for use with the default s3fs file serverNc                   VP                  4       pVP                  V4      pVP                  \        4       V P	                  4       pVP                  R R4      p	 \        \        4       VR7      p
T'       g   T'       g   RTP                  R4      9   pM
T'       d   Rp\        P                  ! T
P                  4      p\        P                  ! 4       pTP                  TP                   4       TP#                  RR	T
P$                  ,          4       \        P                  ! \'        T4      R
,           \'        \        P(                  4      ,           4      p\        P                  ! \        P*                  4      p\,        P.                  ! TP                  R4      4      pTP1                  T4      w  ppT\2        P4                  8w  d(   T\2        P6                  8w  d   \        RT,          4      hTP1                  T4      w  ppT\2        P8                  8w  d(   T\2        P6                  8w  d   \        RT,          4      hT'       d   TP;                  R4        \<        P>                  ! YTTTTP                  R4      PA                  4       T
PC                  4       YaR7	       R#   \         d   p\        RT4      hRp?ii ; i  \D         d?   pTPF                  '       g   h \        RTPF                   RTPH                   2T4      hRp?ii ; i)rO   sysvolr   r   NrQ   rR   Fr   r   -zSID %s is not mapped to a UIDzSID %s is not mapped to a GIDro   realm)rZ   Could not access r]   )%rq   get_credentialsset_kerberos_stater   rp   rr   r   r   r!   r   r   r$   r%   r   r   r   r    r"   r#   rc   DOMAIN_RID_ADMINISTRATORSID_BUILTIN_ADMINISTRATORSr   PDB	sid_to_idr   ID_TYPE_UIDID_TYPE_BOTHID_TYPE_GIDru   r   setsysvolacllower	domain_dnOSErrorfilenamestrerror)rh   rZ   rv   r0   r/   r1   r   credsrx   r   r)   r*   r%   r(   LA_sidBA_sid	s4_passdbLA_uidLA_typeBA_gidBA_types   &&&&&&               r+   r}   cmd_ntacl_sysvolreset.run  sg   ##%((,  !23")	;~'7!E
 (9!::II%%e&6&67
$$&BMM"

#_uyy%@A!!#j/$'#(*-h.O.O*P#Q R!!("E"EFJJvzz*:;<	
 &//7u(((W8J8J-J>GHH%//7u(((W8J8J-J>GHHNNmn	R""5#)6:#%66'?#8#8#:EOO<M#%<G  	;6::	;N  	R:::!21::,bMqQQ	Rs1   J" AK "J>-J99J>L
9LL
r   )FFNNN)r   r   r   r   r   r   r   r   r   r   r   r   r   r}   r   r   r   s   @r+   r   r     si     I'H 	W))G..w-- 	}#T]ij|"ZcopM
5R 5Rr   r   c                   ~   a  ] tR tRt o RtRtR]P                  R]P                  R]P                  /t
R
R ltR	tV tR# )cmd_ntacl_sysvolchecki  zBCheck sysvol ACLs match defaults (including correct ACLs on GPOs).r   r/   r0   r1   Nc           	        VP                  4       pVP                  V4      pVP                  \        4       VP	                  R R4      pVP	                  R R4      p \        \        4       VR7      p\        P                  ! TP                  4      p
 \        P                  ! YTT
TP	                  R4      P                  4       TP                  4       T4       R#   \         d   p	\        RT	4      hRp	?	ii ; i  \          d?   p	T	P"                  '       g   h \        RT	P"                   RT	P$                   2T	4      hRp	?	ii ; i)	rO   netlogonr   r   r   Nr   r   r]   )rq   r   r   r   rr   r   r   r!   r   r   r$   r%   r   checksysvolaclr   r   r   r   r   )rh   r0   r/   r1   r   r   r   r   r)   r*   r%   s   &&&&       r+   r}   cmd_ntacl_sysvolcheck.run  s   ##%((,  !2366&*-)	;~'7B?E %%e&6&67
	R$$Uf%/%'VVG_%:%:%<eoo>O%')  	;6::	;  	R:::!21::,bMqQQ	Rs1   C AC9 C6%C11C69E9D==Er   r   )r   r   r   r   r   r   r   r   r   r   r   r}   r   r   r   s   @r+   r   r     sD     L'H 	W))G..w--R Rr   r   c                       ] tR tRtRt/ t]! 4       ]R&   ]! 4       ]R&   ]! 4       ]R&   ]	! 4       ]R&   ]
! 4       ]R&   ]! 4       ]R&   R	tR
# )	cmd_ntacli  zNT ACLs manipulation.r"   rr   changedomsidsysvolresetsysvolcheckr   r   N)r   r   r   r   r   subcommandsr.   r   r   r   r   r   r   r   r   r+   r   r     sV    K&K&K"8":K!6!8K!6!8K / 1Kr   r   ))r   r^   samba.getoptgetoptr   sambar   
samba.authr   samba.auth_utilr   samba.credentialsr   samba.dcerpcr   r   	samba.ndrr	   samba.ntaclsr
   r   r   samba.samba3r   r   r   samba.samdbr    r   r   r   r   r,   r.   r   r   r   r   r   r   r   r   r+   <module>r      s   &  	   % / / (  7 7 1  9 9<MoG Mo`0g 0,,,G ,,^j?W j?ZDRG DRN RG  RF	2 	2r   