+
    4Ssi"                     v    R t ^ RIHtHtHtHtHt ^ RIt^ RIH	t	 ^ RI
HtHtHt ^ RIHt R t ! R R]4      tR# )	z5Utility methods for security descriptor manipulation.)FLAG_MOD_REPLACE
SCOPE_BASEDnMessageMessageElementN)security)ndr_deepcopyndr_pack
ndr_unpack)NT_STATUS_OBJECT_NAME_NOT_FOUNDc                >   a RoRP                  V3R lV  4       4      # )a#  Encode claim attribute names according to [MS-DTYP] 2.5.1 ("attr-char2")

Some characters must be encoded as %hhhh, while others must not be.
Of the optional ones, we encode some control characters.

The   byte is also encoded, which is useful for tests, but it
is forbidden in either form.
z 	
 !"%&()<=>| c              3   T   <"   T F  pVS9  d   TMR \        V4      R 2x  K  	  R# 5i)%04xN)ord).0cescapess   & 0/usr/lib/python3/dist-packages/samba/sd_utils.py	<genexpr>#escaped_claim_id.<locals>.<genexpr>'   s;      & %q w& CF3<() %s   %()join)claim_idr   s   &@r   escaped_claim_idr      s*     .G77 & %& & &    c                   |   a  ] tR t^-t o RtR tRR ltRR ltR tRR lt	RR lt
R	 tRR
 ltRR ltRR ltRtV tR# )SDUtilszCSome utilities for manipulation of security descriptors on objects.c                x    Wn         \        P                  ! V P                   P                  4       4      V n        R # N)ldbr   dom_sidget_domain_sid
domain_sid)selfsamdbs   &&r   __init__SDUtils.__init__0   s&    "**488+B+B+DEr   Nc                .   \        4       p\        V\        4      '       d   Wn        M\        V P                  V4      Vn        \        V\
        4      '       g#   \        V\        P                  4      '       g   Q h\        V\
        4      '       d+   \        P                  P                  W P                  4      pM"\        V\        P                  4      '       d   Tp\        \        X4      \        R4      VR&   V P                  P                  WC4       R# )zRModify security descriptor using either SDDL string
or security.descriptor object
nTSecurityDescriptorN)r   
isinstancer   dnr    strr   
descriptor	from_sddlr#   r   r	   r   modify)r$   	object_dnsdcontrolsmtmp_descs   &&&&  r   modify_sd_on_dnSDUtils.modify_sd_on_dn4   s     Ii$$Ddhh	*AD2s##z"h6I6I'J'JKJb#**44RIHH//00H$28H3E3C3I%K
 ! 	$r   c                    V P                   P                  V\        R R.VR7      pV^ ,          R,          ^ ,          p\        \        P
                  V4      # )Nr)   r2   )r    searchr   r
   r   r-   )r$   r0   r2   resdescs   &&&  r   read_sd_on_dnSDUtils.read_sd_on_dnI   sO    hhooiT56  K1v,-a0(--t44r   c                    V P                   P                  V4      p\        \        P                  V^ ,          R,          ^ ,          4      # )    	objectSid)r    r9   r
   r   r!   )r$   r0   r:   s   && r   get_object_sidSDUtils.get_object_sidO   s5    hhooi((**CF;,?,BCCr   c                  a  Vf   . pVf   . pV 3R lpVf   Vf   R\         P                  ,          .pS P                  WR7      pVP                  \         P                  ,          '       gd   \        VP                  4      pVP                   F>  p	V	P                  \         P                  ,          '       g   K,   VP                  V	4       K@  	  MuVf   . pS P                  P!                  V\"        R V.VR7      p\%        V^ ,          V,          ^ ,          4      p\         P&                  P)                  VS P*                  4      p^ p. p. p. pV F  p	\-        V	\$        4      '       d	   V! V	4      p	\-        V	\         P.                  4      '       g   Q hV	P                  \         P                  ,          '       d   VP1                  V	4       K}  WP                  P                  9  d   VP1                  V	4       K  VP                  V	4       V^,          pK  	  V F  p	Rp\-        V	\2        4      '       d   RV	9   d
   V	R,          pV	R,          p	\-        V	\$        4      '       d	   V! V	4      p	\-        V	\         P.                  4      '       g   Q hV	P                  \         P                  ,          '       d   VP1                  V	4       K  WP                  P                  9   d   VP1                  V	4       K  VP5                  V	V4       V^,          pK  	  V^ 8X  d   WV3# Vf   S P7                  WVR7       MlVP9                  S P*                  4      p\;        4       pVVn        \?        VPA                  R4      \B        V4      VV&   S P                  PE                  VVR7       WV3#   \        P                   d+   p
T
P                  ^ ,          \        8w  d   T
h R p
?
EKS  R p
?
ii ; i)Nc                    < \         P                  P                  R V ,           SP                  4      p\	        VP
                  P                  4      ^8X  g   Q hVP
                  P                  ^ ,          # )D:)r   r-   r.   r#   lendaclaces)ace_sddlace_sdr$   s   & r   ace_from_sddl2SDUtils.update_aces_in_dacl.<locals>.ace_from_sddlZ   sU    ((224(?DOOTFv{{''(A---;;##A&&r   zsd_flags:1:%dr8   idxaceascii)#r   SECINFO_DACLr<   typeSEC_DESC_DACL_PROTECTEDr   rG   rH   flagsSEC_ACE_FLAG_INHERITED_ACEdacl_del_acesambaNTSTATUSErrorargsr   r    r9   r   r,   r-   r.   r#   r*   rN   appenddictdacl_addr5   as_sddlr   r+   r   encoder   r/   )r$   r+   del_acesadd_aces	sddl_attrr2   rK   r1   	dacl_copyrN   errr:   old_sddlnum_changesdel_ignoredadd_ignoredinherited_ignoredadd_idxnew_sddlr3   s   f&&&&&              r   update_aces_in_daclSDUtils.update_aces_in_daclS   s@   HH	'
 +h.C.CCD##B#:B77X==== )1	$>>Cyy8#F#FFF!OOC0 * ((//"j$#,+ " BC3q6),Q/0H$$..xIBC#s###C(c8<<0000yy8>>>>!((-'',,&""3'OOC 1K   CG#t$$C<!%jG%j#s###C(c8<<0000yy8>>>>!((-ggll"""3'KKW%1K' * !->>>  ( ;zz$//2H	AAD)(//'*B*:*35AiL HHOOAO1):::M  %22 !"xx{.MM&)	 !!s   ;N''O&<O!!O&c                   \         P                  P                  RV,           V P                  4      p. p^ pVP                  P
                   F!  pVP                  RVRV/4       V^,          pK#  	  V P                  WVR7      w  rp
W3# )zCPrepend an ACE (or more) to an objects security descriptor
        rE   rM   rN   r`   r2   r   r-   r.   r#   rG   rH   rZ   rk   )r$   r0   rH   r2   rJ   r`   ri   rN   _aiiis   &&&&       r   dacl_prepend_acesSDUtils.dacl_prepend_aces   s     $$..td{DOOL;;##COOUGUC89qLG $ ,,Y6> - @	rvr   c                4    V P                  WR.R7      w   pR# )z?Add an ACE (or more) to an objects security descriptor
        show_deleted:1r8   N)rs   )r$   r0   rN   rp   s   &&& r   dacl_add_aceSDUtils.dacl_add_ace   s&     %%i0@/A & C1r   c                    \         P                  P                  RV,           V P                  4      p. pVP                  P
                   F  pVP                  V4       K  	  V P                  WVR7      w  rxp	W3# )zBAppend an ACE (or more) to an objects security descriptor
        rE   rn   ro   )
r$   r0   rH   r2   rJ   r`   rN   rp   rq   rr   s
   &&&&      r   dacl_append_acesSDUtils.dacl_append_aces   so     $$..td{DOOL;;##COOC  $,,Y6> - @	rvr   c                    \         P                  P                  RV,           V P                  4      p. pVP                  P
                   F  pVP                  V4       K  	  V P                  WVR7      w  rxp	Wy3# )zBDelete an ACE (or more) to an objects security descriptor
        rE   )r_   r2   ro   )
r$   r0   rH   r2   del_sdr_   rN   dirp   rr   s
   &&&&      r   dacl_delete_acesSDUtils.dacl_delete_aces   so     $$..td{DOOL;;##COOC  $,,Y6> - @	rvr   c                v    Vf   . pV P                  WR.,           4      pVP                  V P                  4      # )z:Return object nTSecurityDescriptor in SDDL format
        rv   )r<   r]   r#   )r$   r0   r2   r;   s   &&& r   get_sd_as_sddlSDUtils.get_sd_as_sddl   s;     H!!)9I8J-JK||DOO,,r   )r#   r    r   )NNNN)__name__
__module____qualname____firstlineno____doc__r&   r5   r<   rA   rk   rs   rw   rz   r   r   __static_attributes____classdictcell__)__classdict__s   @r   r   r   -   sD     MF%*5Da;FC		- -r   r   )r   r    r   r   r   r   r   rW   samba.dcerpcr   	samba.ndrr   r	   r
   samba.ntstatusr   r   objectr    r   r   <module>r      s2   & < I I  ! 8 8 :& x-f x-r   