Add comprehensive plugin development documentation

- Add complete English plugin development guide (PLUGIN_DEVELOPMENT_GUIDE.md)
- Add complete Russian plugin development guide (PLUGIN_DEVELOPMENT_GUIDE_RU.md)
- Update README.md with current project information and plugin documentation links
- Document plugin architecture, API, translation system, and best practices

PLUGIN_DEVELOPMENT_GUIDE.md

@@ -0,0 +1,332 @@
+# GPOA Plugin Development Guide
+
+## Introduction
+
+GPOA (GPO Applier for Linux) supports a plugin system for extending group policy application functionality.
+Plugins allow adding support for new policy types and system settings without modifying the core code.
+
+## Plugin Architecture
+
+### Base Classes
+
+- **`plugin`** - Abstract base class with final methods `apply()` and `apply_user()`
+- **`FrontendPlugin`** - Simplified class for plugins with logging support
+
+### Plugin Manager
+
+- **`plugin_manager`** - Loads and executes plugins from directories:
+  - `/usr/lib/gpupdate/plugins/` - system plugins
+  - `gpoa/frontend_plugins/` - development plugins
+
+## Creating a Simple Plugin
+
+### Example: Basic Plugin with Logging
+
+```python
+#!/usr/bin/env python3
+#
+# GPOA - GPO Applier for Linux
+#
+# Copyright (C) 2025 BaseALT Ltd.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+from gpoa.plugin.plugin_base import FrontendPlugin
+
+
+class ExampleApplier(FrontendPlugin):
+    """
+    Example simple plugin with logging and registry access.
+    """
+
+    # Domain for translations
+    domain = 'example_applier'
+
+    def __init__(self, dict_dconf_db, username=None, fs_file_cache=None):
+        """
+        Initialize the plugin.
+
+        Args:
+            dict_dconf_db (dict): Dictionary with registry data
+            username (str): Username
+            fs_file_cache: File system cache
+        """
+        super().__init__(dict_dconf_db, username, fs_file_cache)
+
+        # Initialize logging system
+        self._init_plugin_log(
+            message_dict={
+                'i': {  # Informational messages
+                    1: "Example Applier initialized",
+                    2: "Configuration applied successfully"
+                },
+                'w': {  # Warnings
+                    10: "No configuration found in registry"
+                },
+                'e': {  # Errors
+                    20: "Failed to apply configuration"
+                }
+            },
+            domain="example_applier"
+        )
+
+    def run(self):
+        """
+        Main plugin execution method.
+
+        Returns:
+            bool: True if successful, False on error
+        """
+        try:
+            self.log("I1")  # Plugin initialized
+
+            # Get data from registry
+            self.config = self.get_dict_registry('Software/BaseALT/Policies/Example')
+
+            if not self.config:
+                self.log("W10")  # No configuration found in registry
+                return True
+
+            # Log registry data
+            self.log("I2")  # Configuration applied successfully
+
+            return True
+
+        except Exception as e:
+            self.log("E20", {"error": str(e)})
+            return False
+
+
+def create_machine_applier(dict_dconf_db, username=None, fs_file_cache=None):
+    """
+    Factory function for creating plugin instance for machine context.
+
+    Args:
+        dict_dconf_db (dict): Dictionary with registry data
+        username (str): Username
+        fs_file_cache: File system cache
+
+    Returns:
+        ExampleApplier: Plugin instance
+    """
+    return ExampleApplier(dict_dconf_db, username, fs_file_cache)
+
+
+def create_user_applier(dict_dconf_db, username=None, fs_file_cache=None):
+    """
+    Factory function for creating plugin instance for user context.
+
+    Args:
+        dict_dconf_db (dict): Dictionary with registry data
+        username (str): Username
+        fs_file_cache: File system cache
+
+    Returns:
+        ExampleApplier: Plugin instance
+    """
+    return ExampleApplier(dict_dconf_db, username, fs_file_cache)
+```
+
+## Key Plugin Elements
+
+### 1. Log Registration
+
+Plugins use a logging system with message codes:
+
+```python
+self._init_plugin_log(
+    message_dict={
+        'i': {  # Informational messages
+            1: "Example Applier initialized",
+            2: "Configuration applied successfully"
+        },
+        'w': {  # Warnings
+            10: "No configuration found in registry"
+        },
+        'e': {  # Errors
+            20: "Failed to apply configuration"
+        }
+    },
+    domain="example_applier"
+)
+```
+
+### 2. Registry Access
+
+Access registry data through `get_dict_registry()` method:
+
+```python
+self.config = self.get_dict_registry('Software/BaseALT/Policies/Example')
+```
+
+### 3. Logging in run Method
+
+Using registered message codes:
+
+```python
+self.log("I1")  # Simple message
+self.log("E20", {"error": str(e)})  # Message with data
+```
+
+### 4. Factory Functions
+
+Plugins must provide factory functions:
+
+- `create_machine_applier()` - for machine context
+- `create_user_applier()` - for user context
+
+## Translation System
+
+### Localization Support
+
+GPOA supports automatic localization of plugin messages. The system uses standard GNU gettext.
+
+### Translation File Structure
+
+```
+gpoa/locale/
+├── ru/
+│   └── LC_MESSAGES/
+│       ├── gpoa.mo
+│       └── gpoa.po
+└── en/
+    └── LC_MESSAGES/
+        ├── gpoa.mo
+        └── gpoa.po
+```
+
+### Setting Up Translations in Plugin
+
+1. **Define translation domain**:
+```python
+class MyPlugin(FrontendPlugin):
+    domain = 'my_plugin'  # Domain for translation files
+```
+
+2. **Initialize logger with translation support**:
+```python
+self._init_plugin_log(
+    message_dict={
+        'i': {
+            1: "Plugin initialized",
+            2: "Configuration applied successfully"
+        },
+        'e': {
+            10: "Configuration error"
+        }
+    },
+    domain="my_plugin"  # Domain for translation file lookup
+)
+```
+
+3. **Usage in code**:
+```python
+# Messages are automatically translated when logged
+self.log("I1")  # Will be displayed in system language
+```
+
+### Creating Translation Files
+
+1. **Extract strings for translation**:
+```bash
+# Extract strings from plugin code
+xgettext -d my_plugin -o my_plugin.po my_plugin.py
+```
+
+2. **Create translation file**:
+```po
+# my_plugin.po
+msgid "Plugin initialized"
+msgstr ""
+
+msgid "Configuration applied successfully"
+msgstr ""
+```
+
+3. **Compile translations**:
+```bash
+# Compile .po to .mo
+msgfmt my_plugin.po -o my_plugin.mo
+
+# Place in correct directory
+mkdir -p /usr/share/locale/ru/LC_MESSAGES/
+cp my_plugin.mo /usr/share/locale/ru/LC_MESSAGES/
+```
+
+### Best Practices for Translations
+
+1. **Use complete sentences** - don't split strings into parts
+2. **Avoid string concatenation** - this complicates translation
+3. **Provide context** - add comments for translators
+4. **Test translations** - verify display in different languages
+5. **Update translations** - update .po files when messages change
+
+### Example Plugin Structure with Translations
+
+```
+my_plugin/
+├── my_plugin.py          # Main plugin code
+├── locale/
+│   ├── ru/
+│   │   └── LC_MESSAGES/
+│   │       ├── my_plugin.mo
+│   │       └── my_plugin.po
+│   └── en/
+│       └── LC_MESSAGES/
+│           ├── my_plugin.mo
+│           └── my_plugin.po
+└── README.md
+```
+
+## Plugin API
+
+### Core Methods
+
+- **`__init__(dict_dconf_db, username=None, fs_file_cache=None)`** - initialization
+- **`run()`** - main execution method (abstract)
+- **`apply()`** - execute with current privileges (final)
+- **`apply_user(username)`** - execute with user privileges (final)
+- **`get_dict_registry(prefix='')`** - get registry data
+- **`_init_plugin_log(message_dict=None, locale_dir=None, domain=None)`** - initialize logger
+- **`log(message_code, data=None)`** - logging with message codes
+
+### Logging System
+
+Message codes:
+- **I** - Informational messages
+- **W** - Warnings
+- **E** - Errors
+- **D** - Debug messages
+- **F** - Fatal errors
+
+### Data Access
+
+- **`dict_dconf_db`** - dictionary with registry data
+- **`username`** - username (for user context)
+- **`fs_file_cache`** - file system cache for file operations
+
+## Execution Contexts
+
+### Machine Context
+
+- Executed with root privileges
+- Applies system-wide settings
+- Uses factory function `create_machine_applier()`
+
+### User Context
+
+- Executed with specified user privileges
+- Applies user-specific settings
+- Uses factory function `create_user_applier()`
+
+## Best Practices
+
+1. **Security**: Always validate input data
+2. **Idempotence**: Repeated execution should produce the same result
+3. **Logging**: Use message codes for all operations
+4. **Error Handling**: Plugin should not crash on errors
+5. **Transactional**: Changes should be atomic
+6. **Translations**: Support message localization

PLUGIN_DEVELOPMENT_GUIDE_RU.md

@@ -0,0 +1,332 @@
+# Руководство по разработке плагинов GPOA
+
+## Введение
+
+GPOA (GPO Applier for Linux) поддерживает систему плагинов для расширения функциональности применения групповых политик.
+Плагины позволяют добавлять поддержку новых типов политик и системных настроек без изменения основного кода.
+
+## Архитектура плагинов
+
+### Базовые классы
+
+- **`plugin`** - Абстрактный базовый класс с финальными методами `apply()` и `apply_user()`
+- **`FrontendPlugin`** - Упрощенный класс для плагинов с поддержкой логирования
+
+### Менеджер плагинов
+
+- **`plugin_manager`** - Загружает и выполняет плагины из директорий:
+  - `/usr/lib/gpupdate/plugins/` - системные плагины
+  - `gpoa/frontend_plugins/` - плагины разработки
+
+## Создание простого плагина
+
+### Пример: Базовый плагин с логированием
+
+```python
+#!/usr/bin/env python3
+#
+# GPOA - GPO Applier for Linux
+#
+# Copyright (C) 2025 BaseALT Ltd.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+from gpoa.plugin.plugin_base import FrontendPlugin
+
+
+class ExampleApplier(FrontendPlugin):
+    """
+    Пример простого плагина с логированием и работой с реестром.
+    """
+
+    # Домен для переводов
+    domain = 'example_applier'
+
+    def __init__(self, dict_dconf_db, username=None, fs_file_cache=None):
+        """
+        Инициализация плагина.
+
+        Args:
+            dict_dconf_db (dict): Словарь с данными из реестра
+            username (str): Имя пользователя
+            fs_file_cache: Кэш файловой системы
+        """
+        super().__init__(dict_dconf_db, username, fs_file_cache)
+
+        # Инициализация системы логирования
+        self._init_plugin_log(
+            message_dict={
+                'i': {  # Информационные сообщения
+                    1: "Example Applier initialized",
+                    2: "Configuration applied successfully"
+                },
+                'w': {  # Предупреждения
+                    10: "No configuration found in registry"
+                },
+                'e': {  # Ошибки
+                    20: "Failed to apply configuration"
+                }
+            },
+            domain="example_applier"
+        )
+
+    def run(self):
+        """
+        Основной метод выполнения плагина.
+
+        Returns:
+            bool: True если успешно, False при ошибке
+        """
+        try:
+            self.log("I1")  # Плагин инициализирован
+
+            # Получение данных из реестра
+            self.config = self.get_dict_registry('Software/BaseALT/Policies/Example')
+
+            if not self.config:
+                self.log("W10")  # Конфигурация не найдена в реестре
+                return True
+
+            # Логирование данных из реестра
+            self.log("I2")  # Конфигурация успешно применена
+
+            return True
+
+        except Exception as e:
+            self.log("E20", {"error": str(e)})
+            return False
+
+
+def create_machine_applier(dict_dconf_db, username=None, fs_file_cache=None):
+    """
+    Фабричная функция для создания экземпляра плагина для машинного контекста.
+
+    Args:
+        dict_dconf_db (dict): Словарь с данными из реестра
+        username (str): Имя пользователя
+        fs_file_cache: Кэш файловой системы
+
+    Returns:
+        ExampleApplier: Экземпляр плагина
+    """
+    return ExampleApplier(dict_dconf_db, username, fs_file_cache)
+
+
+def create_user_applier(dict_dconf_db, username=None, fs_file_cache=None):
+    """
+    Фабричная функция для создания экземпляра плагина для пользовательского контекста.
+
+    Args:
+        dict_dconf_db (dict): Словарь с данными из реестра
+        username (str): Имя пользователя
+        fs_file_cache: Кэш файловой системы
+
+    Returns:
+        ExampleApplier: Экземпляр плагина
+    """
+    return ExampleApplier(dict_dconf_db, username, fs_file_cache)
+```
+
+## Ключевые элементы плагина
+
+### 1. Регистрация логов
+
+Плагины используют систему логирования с кодами сообщений:
+
+```python
+self._init_plugin_log(
+    message_dict={
+        'i': {  # Информационные сообщения
+            1: "Example Applier initialized",
+            2: "Configuration applied successfully"
+        },
+        'w': {  # Предупреждения
+            10: "No configuration found in registry"
+        },
+        'e': {  # Ошибки
+            20: "Failed to apply configuration"
+        }
+    },
+    domain="example_applier"
+)
+```
+
+### 2. Работа с реестром
+
+Доступ к данным из реестра через метод `get_dict_registry()`:
+
+```python
+self.config = self.get_dict_registry('Software/BaseALT/Policies/Example')
+```
+
+### 3. Вывод логов в методе run
+
+Использование зарегистрированных кодов сообщений:
+
+```python
+self.log("I1")  # Простое сообщение
+self.log("E20", {"error": str(e)})  # Сообщение с данными
+```
+
+### 4. Фабричные функции
+
+Плагины должны предоставлять фабричные функции:
+
+- `create_machine_applier()` - для машинного контекста
+- `create_user_applier()` - для пользовательского контекста
+
+## Система переводов
+
+### Поддержка локализации
+
+GPOA поддерживает автоматическую локализацию сообщений плагинов. Система использует стандарт GNU gettext.
+
+### Структура файлов переводов
+
+```
+gpoa/locale/
+├── ru/
+│   └── LC_MESSAGES/
+│       ├── gpoa.mo
+│       └── gpoa.po
+└── en/
+    └── LC_MESSAGES/
+        ├── gpoa.mo
+        └── gpoa.po
+```
+
+### Настройка переводов в плагине
+
+1. **Определение домена переводов**:
+```python
+class MyPlugin(FrontendPlugin):
+    domain = 'my_plugin'  # Домен для файлов перевода
+```
+
+2. **Инициализация логгера с поддержкой переводов**:
+```python
+self._init_plugin_log(
+    message_dict={
+        'i': {
+            1: "Plugin initialized",
+            2: "Configuration applied successfully"
+        },
+        'e': {
+            10: "Configuration error"
+        }
+    },
+    domain="my_plugin"  # Домен для поиска файлов перевода
+)
+```
+
+3. **Использование в коде**:
+```python
+# Сообщения автоматически переводятся при логировании
+self.log("I1")  # Будет показано на языке системы
+```
+
+### Создание файлов перевода
+
+1. **Извлечение строк для перевода**:
+```bash
+# Извлечь строки из кода плагина
+xgettext -d my_plugin -o my_plugin.po my_plugin.py
+```
+
+2. **Создание файла перевода**:
+```po
+# my_plugin.po
+msgid "Plugin initialized"
+msgstr "Плагин инициализирован"
+
+msgid "Configuration applied successfully"
+msgstr "Конфигурация успешно применена"
+```
+
+3. **Компиляция переводов**:
+```bash
+# Скомпилировать .po в .mo
+msgfmt my_plugin.po -o my_plugin.mo
+
+# Разместить в правильной директории
+mkdir -p /usr/share/locale/ru/LC_MESSAGES/
+cp my_plugin.mo /usr/share/locale/ru/LC_MESSAGES/
+```
+
+### Лучшие практики для переводов
+
+1. **Используйте полные предложения** - не разбивайте строки на части
+2. **Избегайте конкатенации строк** - это затрудняет перевод
+3. **Указывайте контекст** - добавляйте комментарии для переводчиков
+4. **Тестируйте переводы** - проверяйте отображение на разных языках
+5. **Обновляйте переводы** - при изменении сообщений обновляйте файлы .po
+
+### Пример структуры плагина с переводами
+
+```
+my_plugin/
+├── my_plugin.py          # Основной код плагина
+├── locale/
+│   ├── ru/
+│   │   └── LC_MESSAGES/
+│   │       ├── my_plugin.mo
+│   │       └── my_plugin.po
+│   └── en/
+│       └── LC_MESSAGES/
+│           ├── my_plugin.mo
+│           └── my_plugin.po
+└── README.md
+```
+
+## API плагинов
+
+### Основные методы
+
+- **`__init__(dict_dconf_db, username=None, fs_file_cache=None)`** - инициализация
+- **`run()`** - основной метод выполнения (абстрактный)
+- **`apply()`** - выполнение с текущими привилегиями (финальный)
+- **`apply_user(username)`** - выполнение с привилегиями пользователя (финальный)
+- **`get_dict_registry(prefix='')`** - получение данных из реестра
+- **`_init_plugin_log(message_dict=None, locale_dir=None, domain=None)`** - инициализация логгера
+- **`log(message_code, data=None)`** - логирование с кодами сообщений
+
+### Система логирования
+
+Коды сообщений:
+- **I** - Информационные сообщения
+- **W** - Предупреждения
+- **E** - Ошибки
+- **D** - Отладочные сообщения
+- **F** - Фатальные ошибки
+
+### Доступ к данным
+
+- **`dict_dconf_db`** - словарь данных из реестра
+- **`username`** - имя пользователя (для пользовательского контекста)
+- **`fs_file_cache`** - кэш файловой системы для работы с файлами
+
+## Контексты выполнения
+
+### Машинный контекст
+
+- Выполняется с правами root
+- Применяет системные настройки
+- Использует фабричную функцию `create_machine_applier()`
+
+### Пользовательский контекст
+
+- Выполняется с правами указанного пользователя
+- Применяет пользовательские настройки
+- Использует фабричную функцию `create_user_applier()`
+
+## Лучшие практики
+
+1. **Безопасность**: Всегда валидируйте входные данные
+2. **Идемпотентность**: Повторное выполнение должно давать тот же результат
+3. **Логирование**: Используйте коды сообщений для всех операций
+4. **Обработка ошибок**: Плагин не должен "падать" при ошибках
+5. **Транзакционность**: Изменения должны быть атомарными
+6. **Переводы**: Поддерживайте локализацию сообщений

README.md

@@ -1,9 +1,13 @@
-# GPOA - GPO Applier
+# GPOA - GPO Applier for Linux
 
 ## Contents
 
 * [Introduction](#introduction)
-* [Development](#development)
+* [Features](#features)
+* [Architecture](#architecture)
+* [Installation](#installation)
+* [Usage](#usage)
+* [Plugin Development](#plugin-development)
 * [Contributing](#contributing)
 * [License](#license)
 
@@ -11,38 +15,137 @@
 
 ## Introduction
 
-GPOA is a facility to fetch, reinterpret and apply GPOs from Windows
-Active Directory domains in UNIX environments.
+GPOA (GPO Applier for Linux) is a comprehensive facility to fetch, reinterpret and apply Group Policy Objects (GPOs) from Windows Active Directory domains in Linux environments. Developed by ALT Linux team, it enables seamless integration of Linux machines into corporate Windows infrastructure.
 
-## Development
 
-This project needs some additional dependencies for development
-purposes (static analisys):
+## Features
 
-* python3-module-setuptools
-* python3-module-pip
-* python3-module-pylint
+### Core Functionality
+- **Multi-backend Support**: Samba, FreeIPA, and no-domain backends
+- **Policy Types**: Registry settings, files, folders, environment variables, scripts, services, and more
+- **Display Manager Integration**: LightDM, GDM with background and theme support
+- **Plugin System**: Extensible architecture for custom policy types
+- **Privilege Separation**: Secure execution with proper privilege contexts
 
-And then you may install prospector like:
+### Supported Policy Areas
+- **System Configuration**: Environment variables, services
+- **Desktop Settings**: GSettings, KDE configuration, browser policies
+- **Security**: Polkit policies
+- **Network**: Network shares
+- **Applications**: Firefox, Chrome, Thunderbird, Yandex Browser
+- **Files and Folders**: File deployment, folder redirection
 
-```sh
-# pip install prospector[with_pyroma]
+## Architecture
+
+### Backend System
+- **Samba Backend**: Traditional Active Directory integration
+- **FreeIPA Backend**: Enhanced FreeIPA/IdM integration
+- **No-domain Backend**: Local policy application
+
+### Frontend System
+- **Policy Appliers**: Specialized modules for different policy types
+- **Plugin Framework**: Extensible plugin system with logging and translations
+
+### Plugin System
+- **Machine Context**: Root-privileged system-wide changes
+- **User Context**: User-specific configuration application
+- **Message Codes**: Structured logging with translation support
+- **Registry Access**: Secure access to policy registry data
+
+## Installation
+
+### From Source
+```bash
+# Clone the repository
+git clone https://github.com/altlinux/gpupdate.git
+cd gpupdate
+
+# Build RPM package
+rpmbuild -ba gpupdate.spec
+
+# Install the package
+rpm -ivh ~/rpmbuild/RPMS/noarch/gpupdate-*.rpm
+```
+
+### Dependencies
+- Python 3.6+
+- Samba client tools
+- FreeIPA client (optional)
+- Systemd
+- D-Bus
+
+## Usage
+
+### Apply Policies for Machine
+```bash
+# Run as root for system-wide policies
+sudo gpoa
+```
+
+### Apply Policies for User
+```bash
+# Run as root for user-specific policies
+sudo gpoa username
+```
+
+### Force Policy Refresh
+```bash
+# Can be run as regular user
+gpupdate --force
+```
+
+### Plugin Management
+Plugins are automatically discovered from:
+- `/usr/lib/gpupdate/plugins/` (system plugins)
+- `gpoa/frontend_plugins/` (development plugins)
+
+## Plugin Development
+
+GPOA features a comprehensive plugin system. See documentation for detailed information:
+
+- [PLUGIN_DEVELOPMENT_GUIDE.md](PLUGIN_DEVELOPMENT_GUIDE.md) - English version
+- [PLUGIN_DEVELOPMENT_GUIDE_RU.md](PLUGIN_DEVELOPMENT_GUIDE_RU.md) - Russian version
+
+Documentation covers:
+- Plugin architecture and API
+- Creating custom plugins
+- Logging and message codes
+- Translation support
+- Best practices
+
+### Quick Plugin Example
+```python
+from gpoa.plugin.plugin_base import FrontendPlugin
+
+class MyPlugin(FrontendPlugin):
+    domain = 'my_plugin'
+
+    def __init__(self, dict_dconf_db, username=None, fs_file_cache=None):
+        super().__init__(dict_dconf_db, username, fs_file_cache)
+        self._init_plugin_log(message_dict={
+            'i': {1: "Plugin initialized"},
+            'e': {1: "Plugin failed"}
+        }, domain="my_plugin")
+
+    def run(self):
+        self.log("I1")
+        return True
+
+def create_machine_applier(dict_dconf_db, username=None, fs_file_cache=None):
+    return MyPlugin(dict_dconf_db, username, fs_file_cache)
 ```
 
 
 ## Contributing
 
-The main communication channel for GPOA is
-[Samba@ALT Linux mailing lists](https://lists.altlinux.org/mailman/listinfo/samba).
-The mailing list is in Russian but you may also send e-mail in English
-or German.
+The main communication channel for GPOA is [Samba@ALT Linux mailing lists](https://lists.altlinux.org/mailman/listinfo/samba). The mailing list is in Russian but you may also send e-mail in English or German.
 
 
 ## License
 
 GPOA - GPO Applier for Linux
 
-Copyright (C) 2019-2020 BaseALT Ltd.
+Copyright (C) 2019-2025 BaseALT Ltd.
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by

dist/gpupdate.service

@@ -1,6 +1,7 @@
 [Unit]
 Description=Group policy update for machine
 After=syslog.target network-online.target sssd.service
+Before=systemd-logind.service
 
 [Service]
 Environment=PATH=/bin:/sbin:/usr/bin:/usr/sbin

doc/gpoa.1

@@ -20,12 +20,15 @@
 gpoa \- utility to update and apply group policy settings
 .
 .SH SYNOPSYS
-.B gpoa
+.B gpoa [user][options]
 .
 .SH DESCRIPTION
 .B gpoa
 Fetches GPT files for designated user from AD instance and transforms
 them into UNIX system settings.
+
+If no user argument is specified, gpoa applies machine policies.
+If a user name is given, gpoa applies user policies for that domain account.
 .SS Options
 .TP
 \fB-h\fP
@@ -35,7 +38,11 @@ Show help.
 Specify domain controller hostname FQDN to replicate GPTs from. May be
 useful in case of default DC problems.
 .TP
-\fB--target \fITARGET\fP
+\fB--list-backends\fP
+Show a list of available backends for applying policies.
+.TP
+\fB--nodomain\fP
+Operate without a domain controller. Apply only local policy.
 .TP
 \fB--noupdate\fP
 Don't update settings.

gpoa/backend/__init__.py

@@ -17,14 +17,21 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 
-from util.windows import smbcreds
-from .samba_backend import samba_backend
-from .nodomain_backend import nodomain_backend
-from util.logging import log
+from storage.dconf_registry import (
+    Dconf_registry,
+    add_preferences_to_global_registry_dict,
+    create_dconf_ini_file,
+)
 from util.config import GPConfig
-from util.util import get_uid_by_username, touch_file
+from util.logging import log
 from util.paths import get_dconf_config_file
-from storage.dconf_registry import Dconf_registry, create_dconf_ini_file, add_preferences_to_global_registry_dict
+from util.util import get_uid_by_username, touch_file
+from util.windows import smbcreds
+from util.ipacreds import ipacreds
+
+from .nodomain_backend import nodomain_backend
+from .samba_backend import samba_backend
+from .freeipa_backend import freeipa_backend
 
 def backend_factory(dc, username, is_machine, no_domain = False):
     '''
@@ -52,6 +59,20 @@ def backend_factory(dc, username, is_machine, no_domain = False):
             logdata = dict({'error': str(exc)})
             log('E7', logdata)
 
+    if config.get_backend() == 'freeipa' and not no_domain:
+        try:
+            if not dc:
+                dc = config.get_dc()
+                if dc:
+                    ld = {'dc': dc}
+                    log('D52', ld)
+            ipac = ipacreds()
+            domain = ipac.get_domain()
+            back = freeipa_backend(ipac, username, domain, is_machine)
+        except Exception as exc:
+            logdata = {'error': str(exc)}
+            log('E79', logdata)
+
     if config.get_backend() == 'local' or no_domain:
         log('D8')
         try:

gpoa/backend/applier_backend.py

@@ -18,6 +18,7 @@
 
 from abc import ABC
 
+
 class applier_backend(ABC):
     @classmethod
     def __init__(self):

gpoa/backend/freeipa_backend.py

@@ -1,7 +1,7 @@
 #
 # GPOA - GPO Applier for Linux
 #
-# Copyright (C) 2019-2020 BaseALT Ltd.
+# Copyright (C) 2019-2025 BaseALT Ltd.
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -16,10 +16,232 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+import os
+import smbc
+import re
 
 from .applier_backend import applier_backend
+from pathlib import Path
+from gpt.gpt import gpt, get_local_gpt
+from gpt.gpo_dconf_mapping import GpoInfoDconf
+from storage import registry_factory
+from storage.dconf_registry import Dconf_registry, extract_display_name_version
+from storage.fs_file_cache import fs_file_cache
+from util.logging import log
+from util.util import get_uid_by_username
+from util.kerberos import (
+      machine_kinit
+    , machine_kdestroy
+)
+
 
 class freeipa_backend(applier_backend):
-    def __init__(self):
-        pass
+    def __init__(self, ipacreds, username, domain, is_machine):
+        self.ipacreds = ipacreds
+        self.cache_path = '/var/cache/gpupdate/creds/krb5cc_{}'.format(os.getpid())
+        self.__kinit_successful = machine_kinit(self.cache_path, "freeipa")
+        if not self.__kinit_successful:
+            raise Exception('kinit is not successful')
+
+        self.storage = registry_factory()
+        self.storage.set_info('domain', domain)
+
+        machine_name = self.ipacreds.get_machine_name()
+        self.storage.set_info('machine_name', machine_name)
+        self.username = machine_name if is_machine else username
+        self._is_machine_username = is_machine
+
+        self.cache_dir = self.ipacreds.get_cache_dir()
+        self.gpo_cache_part = 'gpo_cache'
+        self.gpo_cache_dir = os.path.join(self.cache_dir, self.gpo_cache_part)
+        self.storage.set_info('cache_dir', self.gpo_cache_dir)
+        self.file_cache = fs_file_cache("freeipa_gpo", username)
+        logdata = {'cachedir': self.cache_dir}
+        log('D7', logdata)
+
+    def __del__(self):
+        if self.__kinit_successful:
+            machine_kdestroy()
+
+    def retrieve_and_store(self):
+        '''
+        Retrieve settings and store it in a database - FreeIPA version
+        '''
+        try:
+            if self._is_machine_username:
+                dconf_dict = Dconf_registry.get_dictionary_from_dconf_file_db(save_dconf_db=True)
+            else:
+                uid = get_uid_by_username(self.username)
+                dconf_dict = Dconf_registry.get_dictionary_from_dconf_file_db(uid, save_dconf_db=True)
+        except Exception as e:
+            logdata = {'msg': str(e)}
+            log('E72', logdata)
+
+        if self._is_machine_username:
+            machine_gpts = []
+
+            try:
+                machine_name = self.storage.get_info('machine_name')
+                machine_gpts = self._get_gpts(machine_name)
+                machine_gpts.reverse()
+
+            except Exception as exc:
+                logdata = {'msg': str(exc)}
+                log('E17', logdata)
+
+            for i, gptobj in enumerate(machine_gpts):
+                try:
+                    gptobj.merge_machine()
+                except Exception as exc:
+                    logdata = {'msg': str(exc)}
+                    log('E26', logdata)
+        else:
+            user_gpts = []
+            try:
+                user_gpts = self._get_gpts(self.username)
+                user_gpts.reverse()
+            except Exception as exc:
+                logdata = {'msg': str(exc)}
+                log('E17', logdata)
+            for i, gptobj in enumerate(user_gpts):
+                try:
+                    gptobj.merge_user()
+                except Exception as exc:
+                    logdata = {'msg': str(exc)}
+                    log('E27', logdata)
+
+    def _get_gpts(self, username):
+        gpts = []
+        gpos, server = self.ipacreds.update_gpos(username)
+        if not gpos:
+            return gpts
+        if not server:
+            return gpts
+
+        cached_gpos = []
+        download_gpos = []
+
+        for i, gpo in enumerate(gpos):
+            if gpo.file_sys_path.startswith('/'):
+                if os.path.exists(gpo.file_sys_path):
+                    logdata = {'gpo_name': gpo.display_name, 'path': gpo.file_sys_path}
+                    log('D11', logdata)
+                    cached_gpos.append(gpo)
+                else:
+                    download_gpos.append(gpo)
+            else:
+                if self._check_sysvol_present(gpo):
+                    download_gpos.append(gpo)
+                else:
+                    logdata = {'gpo_name': gpo.display_name}
+                    log('W4', logdata)
+
+        if download_gpos:
+            try:
+                self._download_gpos(download_gpos, server)
+                logdata = {'count': len(download_gpos)}
+                log('D50', logdata)
+            except Exception as e:
+                logdata = {'msg': str(e), 'count': len(download_gpos)}
+                log('E35', logdata)
+        else:
+            log('D211', {})
+
+        all_gpos = cached_gpos + download_gpos
+        for gpo in all_gpos:
+            gpt_abspath = gpo.file_sys_path
+            if not os.path.exists(gpt_abspath):
+                logdata = {'path': gpt_abspath, 'gpo_name': gpo.display_name}
+                log('W12', logdata)
+                continue
+
+            if self._is_machine_username:
+                obj = gpt(gpt_abspath, None, GpoInfoDconf(gpo))
+            else:
+                obj = gpt(gpt_abspath, self.username, GpoInfoDconf(gpo))
+
+            obj.set_name(gpo.display_name)
+            gpts.append(obj)
+
+        local_gpt = get_local_gpt()
+        gpts.append(local_gpt)
+        logdata = {'total_count': len(gpts), 'downloaded_count': len(download_gpos)}
+        log('I2', logdata)
+        return gpts
+
+    def _check_sysvol_present(self, gpo):
+        if not gpo.file_sys_path:
+            if getattr(gpo, 'name', '') != 'Local Policy':
+                logdata = {'gponame': getattr(gpo, 'name', 'Unknown')}
+                log('W4', logdata)
+            return False
+
+        if gpo.file_sys_path.startswith('\\\\'):
+            return True
+
+        elif gpo.file_sys_path.startswith('/'):
+            if os.path.exists(gpo.file_sys_path):
+                return True
+            else:
+                return False
+
+        else:
+            return False
+
+    def _download_gpos(self, gpos, server):
+        cache_dir = self.ipacreds.get_cache_dir()
+        domain = self.ipacreds.get_domain().upper()
+        gpo_cache_dir = os.path.join(cache_dir, domain, 'POLICIES')
+        os.makedirs(gpo_cache_dir, exist_ok=True)
+
+        for gpo in gpos:
+            if not gpo.file_sys_path:
+                continue
+            smb_remote_path = None
+            try:
+                smb_remote_path = self._convert_to_smb_path(gpo.file_sys_path, server)
+                local_gpo_path = os.path.join(gpo_cache_dir, gpo.name)
+
+                self._download_gpo_directory(smb_remote_path, local_gpo_path)
+                gpo.file_sys_path = local_gpo_path
+
+            except Exception as e:
+                logdata = {
+                    'msg': str(e),
+                    'gpo_name': gpo.display_name,
+                    'smb_path': smb_remote_path,
+                }
+                log('E38', logdata)
+
+    def _convert_to_smb_path(self, windows_path, server):
+        match = re.search(r'\\\\[^\\]+\\(.+)', windows_path)
+        if not match:
+            raise Exception(f"Invalid Windows path format: {windows_path}")
+        relative_path = match.group(1).replace('\\', '/').lower()
+        smb_url = f"smb://{server}/{relative_path}"
+
+        return smb_url
+
+    def _download_gpo_directory(self, remote_smb_path, local_path):
+        os.makedirs(local_path, exist_ok=True)
+        try:
+            entries = self.file_cache.samba_context.opendir(remote_smb_path).getdents()
+            for entry in entries:
+                if entry.name in [".", ".."]:
+                    continue
+                remote_entry_path = f"{remote_smb_path}/{entry.name}"
+                local_entry_path = os.path.join(local_path, entry.name)
+                if entry.smbc_type == smbc.DIR:
+                    self._download_gpo_directory(remote_entry_path, local_entry_path)
+                elif entry.smbc_type == smbc.FILE:
+                    try:
+                        os.makedirs(os.path.dirname(local_entry_path), exist_ok=True)
+                        self.file_cache.store(remote_entry_path, Path(local_entry_path))
+                    except Exception as e:
+                        logdata = {'exception': str(e), 'file': entry.name}
+                        log('W30', logdata)
+        except Exception as e:
+            logdata = {'exception': str(e), 'remote_folder_path': remote_smb_path}
+            log('W31', logdata)
+
 

gpoa/backend/nodomain_backend.py

@@ -17,9 +17,10 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 
-from .applier_backend import applier_backend
-from storage import registry_factory
 from gpt.gpt import get_local_gpt
+from storage import registry_factory
+
+from .applier_backend import applier_backend
 
 
 class nodomain_backend(applier_backend):

gpoa/backend/samba_backend.py

@@ -17,25 +17,23 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import os
+
 # Facility to determine GPTs for user
 try:
     from samba.gpclass import check_safe_path
 except ImportError:
     from samba.gp.gpclass import check_safe_path
 
-from .applier_backend import applier_backend
-from storage import registry_factory
-from gpt.gpt import gpt, get_local_gpt
 from gpt.gpo_dconf_mapping import GpoInfoDconf
-from util.util import (
-    get_machine_name
-)
-from util.kerberos import (
-      machine_kinit
-    , machine_kdestroy
-)
-from util.sid import get_sid
+from gpt.gpt import get_local_gpt, gpt
+from storage import registry_factory
+from util.kerberos import machine_kdestroy, machine_kinit
 from util.logging import log
+from util.sid import get_sid
+from util.util import get_machine_name
+
+from .applier_backend import applier_backend
+
 
 class samba_backend(applier_backend):
     __user_policy_mode_key = '/SOFTWARE/Policies/Microsoft/Windows/System/UserPolicyMode'
@@ -118,6 +116,7 @@ class samba_backend(applier_backend):
         # This is a buggy implementation and should be tested more
         else:
             user_gpts = []
+            user_path_gpts = set()
             try:
                 user_gpts = self._get_gpts(self.username)
             except Exception as exc:
@@ -134,13 +133,15 @@ class samba_backend(applier_backend):
                 for gptobj in user_gpts:
                     try:
                         gptobj.merge_user()
+                        user_path_gpts.add(gptobj.path)
                     except Exception as exc:
                         logdata = {}
                         logdata['msg'] = str(exc)
                         log('E27', logdata)
-
+            filtered_machine_gpts = [gpt for gpt in machine_gpts
+                                    if gpt.path not in user_path_gpts]
             if policy_mode > 0:
-                for gptobj in machine_gpts:
+                for gptobj in filtered_machine_gpts:
                     try:
                         gptobj.merge_user()
                     except Exception as exc:

gpoa/frontend/__init__.py

@@ -16,7 +16,4 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-from .frontend_manager import (
-    frontend_manager as applier
-)
-
+from .frontend_manager import frontend_manager as applier

gpoa/frontend/appliers/file_cp.py

@@ -26,7 +26,7 @@ from util.logging import log
 import shutil
 from pathlib import Path
 from util.windows import expand_windows_var
-from util.util import get_homedir
+from util.util import get_homedir, get_user_info
 from util.exceptions import NotUNCPathError
 from util.paths import UNCPath
 import fnmatch
@@ -51,7 +51,7 @@ class Files_cp:
         self.suppress = str2bool(file_obj.suppress)
         self.executable = str2bool(file_obj.executable)
         self.username = username
-        self.pw = pwd.getpwnam(username) if username else None
+        self.pw = get_user_info(username) if username else None
         self.fromPathFiles = []
         if self.fromPath:
             if targetPath[-1] == '/' or self.is_pattern(Path(self.fromPath).name):

gpoa/frontend/appliers/systemd.py

@@ -72,3 +72,19 @@ class systemd_unit:
         '''
         return self.unit_properties.Get('org.freedesktop.systemd1.Unit', 'ActiveState')
 
+    def restart(self):
+        """
+        Restarts the specified unit, if available
+        """
+        logdata = {'unit': self.unit_name, 'action': 'restart'}
+        try:
+            self.unit = self.manager.LoadUnit(dbus.String(self.unit_name))
+            self.manager.RestartUnit(self.unit_name, 'replace')
+            log('I13', logdata)
+            service_state = self._get_state()
+            if service_state not in ('active', 'activating'):
+                log('E77', logdata)
+
+        except dbus.DBusException as exc:
+            log('E77', {**logdata, 'error': str(exc)})
+

gpoa/frontend/chromium_applier.py

@@ -16,16 +16,15 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-)
-
 import json
 import os
+
 from util.logging import log
 from util.util import is_machine_name, string_to_literal_eval
 
+from .applier_frontend import applier_frontend, check_enabled
+
+
 class chromium_applier(applier_frontend):
     __module_name = 'ChromiumApplier'
     __module_enabled = True

gpoa/frontend/cifs_applier.py

@@ -16,19 +16,18 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import jinja2
 import os
-import pwd
-import subprocess
 from pathlib import Path
+import pwd
 import string
+import subprocess
 
-from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-)
-from util.util import get_homedir, get_uid_by_username, get_machine_name
+import jinja2
 from util.logging import log
+from util.util import get_homedir, get_machine_name, get_uid_by_username, get_user_info
+
+from .applier_frontend import applier_frontend, check_enabled
+
 
 def storage_get_drives(storage):
     drives = storage.get_drives()
@@ -299,7 +298,7 @@ class cifs_applier_user(applier_frontend):
         self.auto_master_d.mkdir(parents=True, exist_ok=True)
         # Create user's destination mount directory
         self.mount_dir.mkdir(parents=True, exist_ok=True)
-        uid = pwd.getpwnam(self.username).pw_uid if self.username else None
+        uid = get_user_info(self.username).pw_uid if self.username else None
         if uid:
             os.chown(self.mount_dir, uid=uid, gid=-1)
             self.mount_dir.chmod(0o700)
@@ -319,7 +318,7 @@ class cifs_applier_user(applier_frontend):
             drive_settings['action'] = drv.action
             drive_settings['thisDrive'] = drv.thisDrive
             drive_settings['allDrives'] = drv.allDrives
-            drive_settings['label'] = remove_escaped_quotes(drv.label)
+            drive_settings['label'] = remove_escaped_quotes(drv.label) if drv.persistent == '1' else None
             drive_settings['persistent'] = drv.persistent
             drive_settings['useLetter'] = drv.useLetter
             drive_settings['username'] = self.username

gpoa/frontend/control_applier.py

@@ -16,13 +16,11 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-)
-from .appliers.control import control
 from util.logging import log
 
+from .applier_frontend import applier_frontend, check_enabled
+from .appliers.control import control
+
 
 class control_applier(applier_frontend):
     __module_name = 'ControlApplier'

gpoa/frontend/cups_applier.py

@@ -17,14 +17,14 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import json
+
 import cups
-from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-)
 from gpt.printers import json2printer
-from util.rpm import is_rpm_installed
 from util.logging import log
+from util.rpm import is_rpm_installed
+
+from .applier_frontend import applier_frontend, check_enabled
+
 
 def storage_get_printers(storage):
     '''

gpoa/frontend/envvar_applier.py

@@ -16,13 +16,11 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-)
-from .appliers.envvar import Envvar
 from util.logging import log
 
+from .applier_frontend import applier_frontend, check_enabled
+from .appliers.envvar import Envvar
+
 
 class envvar_applier(applier_frontend):
     __module_name = 'EnvvarsApplier'

gpoa/frontend/file_applier.py

@@ -17,13 +17,10 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 
-from .appliers.file_cp import Files_cp, Execution_check
-from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-)
 from util.logging import log
 
+from .applier_frontend import applier_frontend, check_enabled
+from .appliers.file_cp import Execution_check, Files_cp
 
 
 class file_applier(applier_frontend):

gpoa/frontend/firefox_applier.py

@@ -28,13 +28,12 @@
 import json
 import os
 
-from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-)
 from util.logging import log
 from util.util import is_machine_name, try_dict_to_literal_eval
 
+from .applier_frontend import applier_frontend, check_enabled
+
+
 class firefox_applier(applier_frontend):
     __module_name = 'FirefoxApplier'
     __module_experimental = False

gpoa/frontend/firewall_applier.py

@@ -17,15 +17,15 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 
+import os
 import subprocess
 
 from util.logging import log
-from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-)
+
+from .applier_frontend import applier_frontend, check_enabled
 from .appliers.firewall_rule import FirewallRule
 
+
 class firewall_applier(applier_frontend):
     __module_name = 'FirewallApplier'
     __module_experimental = True
@@ -33,6 +33,7 @@ class firewall_applier(applier_frontend):
     __firewall_branch = 'SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\FirewallRules'
     __firewall_switch = 'SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\EnableFirewall'
     __firewall_reset_cmd = ['/usr/bin/alterator-net-iptables', 'reset']
+    __firewall_reset_cmd_path = '/usr/bin/alterator-net-iptables'
 
     def __init__(self, storage):
         self.storage = storage
@@ -50,6 +51,9 @@ class firewall_applier(applier_frontend):
             rule.apply()
 
     def apply(self):
+        if not os.path.exists(self.__firewall_reset_cmd_path):
+            log('D120', {'not_found_cmd': self.__firewall_reset_cmd_path})
+            return
         if self.__module_enabled:
             log('D117')
             if '1' == self.firewall_enabled:

gpoa/frontend/folder_applier.py

@@ -17,14 +17,14 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 
-from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-)
-from .appliers.folder import Folder
+import re
+
 from util.logging import log
 from util.windows import expand_windows_var
-import re
+
+from .applier_frontend import applier_frontend, check_enabled
+from .appliers.folder import Folder
+
 
 class folder_applier(applier_frontend):
     __module_name = 'FoldersApplier'

gpoa/frontend/frontend_manager.py

@@ -18,73 +18,36 @@
 
 from storage import registry_factory
 from storage.fs_file_cache import fs_file_cache
-
-from .control_applier import control_applier
-from .polkit_applier import (
-      polkit_applier
-    , polkit_applier_user
-)
-from .systemd_applier import systemd_applier
-from .firefox_applier import firefox_applier
-from .thunderbird_applier import thunderbird_applier
-from .chromium_applier import chromium_applier
-from .cups_applier import cups_applier
-from .package_applier import (
-      package_applier
-    , package_applier_user
-)
-from .shortcut_applier import (
-    shortcut_applier,
-    shortcut_applier_user
-)
-from .gsettings_applier import (
-    gsettings_applier,
-    gsettings_applier_user
-)
-from .firewall_applier import firewall_applier
-from .folder_applier import (
-      folder_applier
-    , folder_applier_user
-)
-from .cifs_applier import (
-      cifs_applier_user
-    , cifs_applier)
-from .ntp_applier import ntp_applier
-from .envvar_applier import (
-      envvar_applier
-    , envvar_applier_user
-)
-from .scripts_applier import (
-      scripts_applier
-    , scripts_applier_user
-)
-
-from .file_applier import (
-      file_applier
-    , file_applier_user
-)
-
-from .ini_applier import (
-      ini_applier
-    , ini_applier_user
-)
-
-from .kde_applier import (
-      kde_applier
-    , kde_applier_user
-)
-from .laps_applier import laps_applier
-
-from .networkshare_applier import networkshare_applier
-from .yandex_browser_applier import yandex_browser_applier
-
-from util.users import (
-    is_root,
-    get_process_user,
-    username_match_uid,
-)
 from util.logging import log
 from util.system import with_privileges
+from util.users import (
+    get_process_user,
+    is_root,
+    username_match_uid,
+)
+
+from .chromium_applier import chromium_applier
+from .cifs_applier import cifs_applier, cifs_applier_user
+from .control_applier import control_applier
+from .cups_applier import cups_applier
+from .envvar_applier import envvar_applier, envvar_applier_user
+from .file_applier import file_applier, file_applier_user
+from .firefox_applier import firefox_applier
+from .firewall_applier import firewall_applier
+from .folder_applier import folder_applier, folder_applier_user
+from .gsettings_applier import gsettings_applier, gsettings_applier_user
+from .ini_applier import ini_applier, ini_applier_user
+from .kde_applier import kde_applier, kde_applier_user
+from .laps_applier import laps_applier
+from .networkshare_applier import networkshare_applier
+from .ntp_applier import ntp_applier
+from .package_applier import package_applier, package_applier_user
+from .polkit_applier import polkit_applier, polkit_applier_user
+from .scripts_applier import scripts_applier, scripts_applier_user
+from .shortcut_applier import shortcut_applier, shortcut_applier_user
+from .systemd_applier import systemd_applier
+from .thunderbird_applier import thunderbird_applier
+from .yandex_browser_applier import yandex_browser_applier
 
 
 def determine_username(username=None):

gpoa/frontend/gsettings_applier.py

@@ -16,24 +16,22 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-from util.exceptions import NotUNCPathError
 import os
 import pwd
 import subprocess
 
 from gi.repository import Gio
 from storage.dconf_registry import Dconf_registry
+from util.exceptions import NotUNCPathError
+from util.logging import log
 
 from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-    , check_windows_mapping_enabled
+    applier_frontend,
+    check_enabled,
+    check_windows_mapping_enabled,
 )
-from .appliers.gsettings import (
-    system_gsettings,
-    user_gsettings
-)
-from util.logging import log
+from .appliers.gsettings import system_gsettings, user_gsettings
+
 
 def uri_fetch(schema, path, value, cache):
     '''

gpoa/frontend/ini_applier.py

@@ -17,13 +17,12 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 
-from .appliers.ini_file import Ini_file
-from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-)
 from util.logging import log
 
+from .applier_frontend import applier_frontend, check_enabled
+from .appliers.ini_file import Ini_file
+
+
 class ini_applier(applier_frontend):
     __module_name = 'InifilesApplier'
     __module_experimental = False

gpoa/frontend/kde_applier.py

@@ -16,15 +16,18 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-from .applier_frontend import applier_frontend, check_enabled
+import os
+import re
+import shutil
+import subprocess
+
+import dbus
+from util.exceptions import NotUNCPathError
 from util.logging import log
 from util.util import get_homedir
-from util.exceptions import NotUNCPathError
-import os
-import subprocess
-import re
-import dbus
-import shutil
+
+from .applier_frontend import applier_frontend, check_enabled
+
 
 class kde_applier(applier_frontend):
     __module_name = 'KdeApplier'

gpoa/frontend/laps_applier.py

@@ -16,26 +16,31 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-from .applier_frontend import (
-    applier_frontend,
-    check_enabled
-)
-import struct
-from datetime import datetime, timedelta
-import dpapi_ng
-from util.util import remove_prefix_from_keys, check_local_user_exists
-from util.sid import WellKnown21RID
-import subprocess
-import ldb
-import string
-import secrets
+from datetime import datetime, timedelta, timezone
+import logging
 import os
+import re
+import secrets
+import string
+import struct
+import subprocess
+
+from dateutil import tz
+import ldb
 import psutil
 from util.logging import log
-import logging
-import re
-from datetime import timezone
-from dateutil import tz
+from util.sid import WellKnown21RID
+from util.util import check_local_user_exists, remove_prefix_from_keys, get_machine_name
+from util.windows import get_kerberos_domain_info
+
+from .applier_frontend import applier_frontend, check_enabled
+
+from libcng_dpapi import (
+    create_protection_descriptor,
+    protect_secret,
+    unprotect_secret,
+    NcryptError
+)
 
 _DATEUTIL_AVAILABLE = False
 try:
@@ -427,10 +432,28 @@ class laps_applier(applier_frontend):
         old_level = logger.level
         logger.setLevel(logging.ERROR)
         # Encrypt the password
-        dpapi_blob = dpapi_ng.ncrypt_protect_secret(
-            password_bytes,
-            self.encryption_principal,
-            auth_protocol='kerberos'
+        descriptor_string = f"SID={self.encryption_principal}"
+        descriptor_handle = create_protection_descriptor(descriptor_string)
+        secret_message = password_bytes
+        # Resolve DPAPI-NG parameters dynamically using single Kerberos info fetch
+        info = get_kerberos_domain_info()
+        domain_realm = self._get_windows_realm(info)
+        dc_fqdn = self._get_domain_controller_fqdn(info)
+        machine_username = self._get_machine_account_username()
+        if not domain_realm or not dc_fqdn or not machine_username:
+            logdata = {
+                'realm': bool(domain_realm),
+                'dc_fqdn': bool(dc_fqdn),
+                'machine_username': bool(machine_username)
+            }
+            log('E78', logdata)
+            return None
+        dpapi_blob = protect_secret(
+            descriptor_handle,
+            secret_message,
+            domain=domain_realm,
+            server=dc_fqdn,
+            username=machine_username
         )
         # Restoreloglevel
         logger.setLevel(old_level)
@@ -457,6 +480,41 @@ class laps_applier(applier_frontend):
         # Combine metadata and encrypted blob
         return prefix + dpapi_blob
 
+    def _get_windows_realm(self, info):
+        """Return Kerberos/Windows realm in FQDN upper-case form (e.g., EXAMPLE.COM)."""
+        try:
+            realm = info.get('principal')
+            # If principal like 'HOST/NAME@REALM', extract realm
+            if isinstance(realm, str) and '@' in realm:
+                realm = realm.rsplit('@', 1)[-1]
+            if isinstance(realm, str) and realm:
+                return realm.upper()
+        except Exception:
+            pass
+        return None
+
+    def _get_domain_controller_fqdn(self, info):
+        """Determine a domain controller FQDN using Kerberos info only."""
+        try:
+            pdc = info.get('pdc_dns_name')
+            if isinstance(pdc, str) and pdc:
+                return pdc
+        except Exception:
+            pass
+        return None
+
+    def _get_machine_account_username(self):
+        """Return machine account username with trailing '$' (e.g., HOSTNAME$)."""
+        try:
+            name = get_machine_name()
+            if not isinstance(name, str):
+                name = str(name)
+            if not name:
+                return None
+            return name if name.endswith('$') else f'{name}$'
+        except Exception:
+            return None
+
     def _change_user_password(self, new_password):
         """
         Change the password for the target user.
@@ -632,6 +690,9 @@ class laps_applier(applier_frontend):
 
         # Create encrypted password blob
         encrypted_blob = self._create_password_blob(password)
+        if not encrypted_blob:
+            log('E78')
+            return False
 
         # Update password in LDAP
         ldap_success = self._update_ldap_password(encrypted_blob)

gpoa/frontend/networkshare_applier.py

@@ -16,13 +16,12 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-from .appliers.netshare import Networkshare
-from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-)
 from util.logging import log
 
+from .applier_frontend import applier_frontend, check_enabled
+from .appliers.netshare import Networkshare
+
+
 class networkshare_applier(applier_frontend):
     __module_name = 'NetworksharesApplier'
     __module_name_user = 'NetworksharesApplierUser'

gpoa/frontend/ntp_applier.py

@@ -18,16 +18,13 @@
 
 
 
-import subprocess
 from enum import Enum
+import subprocess
 
-
-from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-)
 from util.logging import log
 
+from .applier_frontend import applier_frontend, check_enabled
+
 
 class NTPServerType(Enum):
     NTP = 'NTP'

gpoa/frontend/package_applier.py

@@ -18,12 +18,11 @@
 
 import logging
 import subprocess
+
 from util.logging import log
 
-from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-)
+from .applier_frontend import applier_frontend, check_enabled
+
 
 class package_applier(applier_frontend):
     __module_name = 'PackagesApplier'

gpoa/frontend/polkit_applier.py

@@ -16,13 +16,15 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+from util.logging import log
+
 from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-    , check_windows_mapping_enabled
+    applier_frontend,
+    check_enabled,
+    check_windows_mapping_enabled,
 )
 from .appliers.polkit import polkit
-from util.logging import log
+
 
 class polkit_applier(applier_frontend):
     __module_name = 'PolkitApplier'

gpoa/frontend/scripts_applier.py

@@ -17,15 +17,14 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import os
-import shutil
 from pathlib import Path
+import shutil
 
 from util.logging import log
+
+from .applier_frontend import applier_frontend, check_enabled
 from .appliers.folder import remove_dir_tree
-from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-)
+
 
 class scripts_applier(applier_frontend):
     __module_name = 'ScriptsApplier'

gpoa/frontend/shortcut_applier.py

@@ -18,18 +18,13 @@
 
 import subprocess
 
-from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-)
-from util.windows import expand_windows_var
+from gpt.shortcuts import get_ttype, shortcut
 from util.logging import log
-from util.util import (
-        get_homedir,
-        homedir_exists,
-        string_to_literal_eval
-)
-from gpt.shortcuts import shortcut, get_ttype
+from util.util import get_homedir, homedir_exists, string_to_literal_eval
+from util.windows import expand_windows_var
+
+from .applier_frontend import applier_frontend, check_enabled
+
 
 def storage_get_shortcuts(storage, username=None, shortcuts_machine=None):
     '''

gpoa/frontend/systemd_applier.py

@@ -16,13 +16,11 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-)
-from .appliers.systemd import systemd_unit
 from util.logging import log
 
+from .applier_frontend import applier_frontend, check_enabled
+from .appliers.systemd import systemd_unit
+
 
 class systemd_applier(applier_frontend):
     __module_name = 'SystemdApplier'

gpoa/frontend/thunderbird_applier.py

@@ -17,14 +17,13 @@
 import json
 import os
 
-from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-)
 from util.logging import log
 from util.util import is_machine_name
+
+from .applier_frontend import applier_frontend, check_enabled
 from .firefox_applier import create_dict
 
+
 class thunderbird_applier(applier_frontend):
     __module_name = 'ThunderbirdApplier'
     __module_experimental = False

gpoa/frontend/yandex_browser_applier.py

@@ -16,16 +16,15 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-from .applier_frontend import (
-      applier_frontend
-    , check_enabled
-)
-
 import json
 import os
+
 from util.logging import log
 from util.util import is_machine_name, string_to_literal_eval
 
+from .applier_frontend import applier_frontend, check_enabled
+
+
 class yandex_browser_applier(applier_frontend):
     __module_name = 'YandexBrowserApplier'
     __module_enabled = True

gpoa/frontend_plugins/__init__.py

@@ -0,0 +1,24 @@
+#
+# GPOA - GPO Applier for Linux
+#
+# Copyright (C) 2025 BaseALT Ltd.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+"""
+Frontend plugins package for GPOA.
+
+This package contains display policy and other frontend-related plugins
+that can be dynamically loaded by the plugin manager.
+"""

gpoa/frontend_plugins/dm_applier.py

@@ -0,0 +1,747 @@
+#
+# GPOA - GPO Applier for Linux
+#
+# Copyright (C) 2025 BaseALT Ltd.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import shutil
+import subprocess
+import re
+
+# Import only what's absolutely necessary
+try:
+    from gpoa.frontend.appliers.systemd import systemd_unit
+except ImportError:
+    # Fallback for testing
+    systemd_unit = None
+
+try:
+    from gpoa.util.gpoa_ini_parsing import GpoaConfigObj
+except ImportError:
+    # Fallback for testing
+    GpoaConfigObj = None
+
+from gpoa.plugin.plugin_base import FrontendPlugin
+
+
+class DMApplier(FrontendPlugin):
+    """
+    Display Manager Applier - handles loading of display manager policy keys
+    from registry (machine/user) and user preferences.
+
+    Also includes DMConfigGenerator functionality for display manager configuration.
+    """
+
+    __registry_path = 'Software/BaseALT/Policies/DisplayManager'
+    domain = 'dm_applier'
+
+    def __init__(self, dict_dconf_db, username=None, fs_file_cache=None):
+        super().__init__(dict_dconf_db, username, fs_file_cache)
+
+        # Initialize plugin-specific logger - locale_dir will be set by plugin_manager
+        self._init_plugin_log(
+            message_dict={
+                'i': {
+                    1: "Display Manager Applier initialized",
+                    2: "Display manager configuration generated successfully",
+                    3: "Display Manager Applier execution started",
+                    4: "Display manager configuration completed successfully",
+                    5: "LightDM greeter configuration generated successfully",
+                    6: "GDM theme modified successfully",
+                    7: "GDM backup restored successfully"
+                },
+                'w': {
+                    10: "No display managers detected",
+                    11: "No background configuration to apply",
+                    12: "GDM backup file not found",
+                    13: "Backup mode only supported for GDM"
+                },
+                'e': {
+                    20: "Configuration file path is invalid or inaccessible",
+                    21: "Failed to generate display manager configuration",
+                    22: "Unknown display manager config directory",
+                    23: "Failed to generate display manager configuration",
+                    24: "Display Manager Applier execution failed",
+                    25: "GDM theme gresource not found",
+                    26: "Failed to extract GDM gresource",
+                    27: "Failed to modify GDM background",
+                    28: "Failed to recompile GDM gresource",
+                    29: "Failed to restore GDM backup"
+                },
+                'd': {
+                    30: "Display manager detection details",
+                    31: "Display manager configuration details",
+                    32: "Removed empty configuration value",
+                    33: "GDM background modification details",
+                    34: "GDM backup operation details"
+                }
+            },
+            # locale_dir will be set by plugin_manager during plugin loading
+            domain="dm_applier"
+        )
+
+        self.config = self.get_dict_registry(self.__registry_path)
+
+        # DMConfigGenerator configuration - only background settings
+        background_path = self.config.get("Greeter.Background", None)
+        self.backup = background_path == 'backup'
+        if background_path and not self.backup:
+            normalized_path = background_path.replace('\\', '/')
+            fs_file_cache.store(normalized_path)
+            self.dm_config = {
+                "Greeter.Background": fs_file_cache.get(normalized_path)
+            }
+        else:
+            self.dm_config = {
+                "Greeter.Background": ''
+            }
+
+        self.log("I1")  # Display Manager Applier initialized
+
+    @classmethod
+    def _get_plugin_prefix(cls):
+        """Return plugin prefix for translation lookup."""
+        return "dm_applier"
+
+    def _prepare_conf(self, path):
+        """
+        Load existing file or create new, preserving all comments and structure.
+        """
+        try:
+            conf = GpoaConfigObj(path, encoding="utf-8", create_empty=True)
+            return conf
+        except Exception as exc:
+            self.log("E20", {"path": path, "error": str(exc)})
+            return None
+
+    def _clean_empty_values(self, section):
+        """
+        Remove keys with empty values from configuration section.
+        Avoids writing empty values to config files.
+        """
+        if not section:
+            return
+
+        # Create list of keys to remove (can't modify dict during iteration)
+        keys_to_remove = []
+        for key, value in section.items():
+            # Remove keys with empty strings, None, or whitespace-only values
+            if value is None or (isinstance(value, str) and not value.strip()):
+                keys_to_remove.append(key)
+
+        # Remove the identified keys
+        for key in keys_to_remove:
+            del section[key]
+            self.log("D32", {"key": key, "section": str(section)})
+
+    def generate_lightdm(self, path):
+        if not path or not os.path.isabs(path):
+            self.log("E20", {"path": path})  # Configuration file path is invalid or inaccessible
+            return None
+
+        conf = self._prepare_conf(path)
+        if conf is None:
+            return None
+        section = conf.setdefault("Seat:*", {})
+
+        # Set values only if they have meaningful content (avoid writing empty values)
+        if self.dm_config["Greeter.Background"]:
+            section["greeter-background"] = self.dm_config["Greeter.Background"]
+
+        # Remove any existing empty values that might have been set previously
+        self._clean_empty_values(section)
+
+        # Comments example:
+        conf.initial_comment = ["# LightDM custom config"]
+        try:
+            conf.write()
+            self.log("I2", {"path": path, "dm": "lightdm"})
+            return conf
+        except Exception as exc:
+            self.log("E21", {"path": path, "error": str(exc)})
+            return None
+
+
+    def generate_gdm(self, path):
+        """Generate GDM configuration by modifying gnome-shell-theme.gresource"""
+        # Check if we need to restore from backup
+        if self.backup:
+            return self._restore_gdm_backup()
+
+        if not self.dm_config["Greeter.Background"]:
+            return None
+
+        background_path = self.dm_config["Greeter.Background"]
+
+        try:
+            # Find gnome-shell-theme.gresource
+            gresource_path = self._find_gnome_shell_gresource()
+            if not gresource_path:
+                self.log("E25", {"path": "gnome-shell-theme.gresource"})
+                return None
+
+            # Create backup if it doesn't exist
+            backup_path = gresource_path + '.backup'
+            if not os.path.exists(backup_path):
+                shutil.copy2(gresource_path, backup_path)
+                self.log("D34", {"action": "backup_created", "backup": backup_path})
+
+            # Extract gresource to temporary directory
+            temp_dir = self._extract_gresource(gresource_path)
+            if not temp_dir:
+                return None
+
+            # Modify background in theme files
+            modified = self._modify_gdm_background(temp_dir, background_path)
+            if not modified:
+                shutil.rmtree(temp_dir)
+                return None
+
+            # Recompile gresource
+            success = self._recompile_gresource(temp_dir, gresource_path)
+
+            # Clean up temporary directory
+            shutil.rmtree(temp_dir)
+
+            if success:
+                self.log("I6", {"path": gresource_path, "background": background_path})
+                return True
+            else:
+                self.log("E28", {"path": gresource_path})
+                return None
+
+        except Exception as exc:
+            self.log("E21", {"path": "gnome-shell-theme.gresource", "error": str(exc), "dm": "gdm"})
+            return None
+
+    def _find_gnome_shell_gresource(self):
+        """Find gnome-shell-theme.gresource file"""
+        possible_paths = [
+            "/usr/share/gnome-shell/gnome-shell-theme.gresource",
+            "/usr/share/gnome-shell/theme/gnome-shell-theme.gresource",
+            "/usr/share/gdm/gnome-shell-theme.gresource",
+            "/usr/local/share/gnome-shell/gnome-shell-theme.gresource"
+        ]
+
+        for path in possible_paths:
+            if os.path.exists(path):
+                return path
+        return None
+
+    def _restore_gdm_backup(self):
+        """Restore GDM gresource from backup if available"""
+        try:
+            # Find gnome-shell-theme.gresource
+            gresource_path = self._find_gnome_shell_gresource()
+            if not gresource_path:
+                self.log("E25", {"path": "gnome-shell-theme.gresource"})
+                return None
+
+            backup_path = gresource_path + '.backup'
+            if not os.path.exists(backup_path):
+                self.log("W12", {"backup": backup_path})
+                return None
+
+            # Restore from backup
+            shutil.copy2(backup_path, gresource_path)
+            self.log("I7", {"path": gresource_path})
+            return True
+
+        except Exception as exc:
+            self.log("E29", {"path": "gnome-shell-theme.gresource", "error": str(exc)})
+            return None
+
+    def _extract_gresource(self, gresource_path):
+        """Extract gresource file to temporary directory by creating XML from gresource list"""
+        try:
+            temp_dir = "/tmp/gdm_theme_" + str(os.getpid())
+            os.makedirs(temp_dir, exist_ok=True)
+
+            # Get list of resources from gresource file
+            cmd_list = ["gresource", "list", gresource_path]
+            result_list = subprocess.run(cmd_list, capture_output=True, text=True)
+
+            if result_list.returncode != 0:
+                self.log("E26", {"path": gresource_path, "error": result_list.stderr})
+                shutil.rmtree(temp_dir)
+                return None
+
+            resource_paths = result_list.stdout.strip().split('\n')
+            if not resource_paths or not resource_paths[0]:
+                self.log("E26", {"path": gresource_path, "error": "No resources found in gresource file"})
+                shutil.rmtree(temp_dir)
+                return None
+
+            # Extract prefix from resource paths (remove filename from first path)
+            first_resource = resource_paths[0]
+            prefix = os.path.dirname(first_resource)
+
+            # Create temporary XML file using proper XML generation
+            import xml.etree.ElementTree as ET
+
+            # Create root element
+            gresources = ET.Element('gresources')
+            gresource = ET.SubElement(gresources, 'gresource', prefix=prefix)
+
+            for resource_path in resource_paths:
+                # Extract filename from resource path
+                filename = os.path.basename(resource_path)
+                ET.SubElement(gresource, 'file').text = filename
+
+                # Extract the resource to temporary directory
+                cmd_extract = ["gresource", "extract", gresource_path, resource_path]
+                result_extract = subprocess.run(cmd_extract, capture_output=True, text=True)
+
+                if result_extract.returncode == 0:
+                    # Write extracted content to file
+                    output_path = os.path.join(temp_dir, filename)
+                    with open(output_path, 'w') as f:
+                        f.write(result_extract.stdout)
+                else:
+                    self.log("E26", {"path": gresource_path, "error": f"Failed to extract {resource_path}: {result_extract.stderr}"})
+
+            # Write XML file with proper formatting
+            xml_file = os.path.join(temp_dir, "gnome-shell-theme.gresource.xml")
+            tree = ET.ElementTree(gresources)
+            tree.write(xml_file, encoding='utf-8', xml_declaration=True)
+
+            return temp_dir
+
+        except Exception as exc:
+            self.log("E26", {"path": gresource_path, "error": str(exc)})
+            return None
+
+
+
+    def _modify_gdm_background(self, temp_dir, background_path):
+        """Modify background in GDM theme files - specifically target gnome-shell-dark.css and gnome-shell-light.css"""
+        try:
+            # Target specific CSS files that contain GDM background definitions
+            target_css_files = ["gnome-shell-dark.css", "gnome-shell-light.css"]
+
+            modified = False
+            for css_filename in target_css_files:
+                css_file = os.path.join(temp_dir, css_filename)
+                if not os.path.exists(css_file):
+                    continue
+
+                with open(css_file, 'r') as f:
+                    content = f.read()
+
+                # Look for background-related CSS rules
+                patterns = [
+                    # Handle only #lockDialogGroup background with file://// (4 slashes)
+                    r'(#lockDialogGroup\s*{[^}]*background:\s*[^;]*)url\(file:////[^)]+\)',
+                    # Handle only #lockDialogGroup background with file:/// (3 slashes)
+                    r'(#lockDialogGroup\s*{[^}]*background:\s*[^;]*)url\(file:///[^)]+\)'
+                ]
+
+                for pattern in patterns:
+                    # Use lambda function to handle optional groups gracefully
+                    def replace_url(match):
+                        groups = match.groups()
+                        return f'{groups[0]}url(file:///{background_path})'
+
+                    new_content = re.sub(pattern, replace_url, content)
+                    if new_content != content:
+                        with open(css_file, 'w') as f:
+                            f.write(new_content)
+                        modified = True
+                        self.log("D33", {"file": css_filename, "background": background_path})
+                        break
+
+            return modified
+
+        except Exception as exc:
+            self.log("E27", {"path": temp_dir, "error": str(exc)})
+            return False
+
+    def _recompile_gresource(self, temp_dir, gresource_path):
+        """Recompile gresource from modified files using temporary XML"""
+        try:
+            # Use the temporary XML file created during extraction
+            xml_file = os.path.join(temp_dir, "gnome-shell-theme.gresource.xml")
+            if not os.path.exists(xml_file):
+                self.log("E28", {"path": gresource_path, "error": "Temporary XML file not found"})
+                return False
+
+            # Recompile gresource - run from temp directory where files are located
+            original_cwd = os.getcwd()
+            try:
+                os.chdir(temp_dir)
+                cmd = ["glib-compile-resources", "--target", gresource_path, "gnome-shell-theme.gresource.xml"]
+                result = subprocess.run(cmd, capture_output=True, text=True)
+
+                if result.returncode == 0:
+                    return True
+                else:
+                    self.log("E28", {"path": gresource_path, "error": result.stderr})
+                    return False
+            finally:
+                os.chdir(original_cwd)
+
+        except Exception as exc:
+            self.log("E28", {"path": gresource_path, "error": str(exc)})
+            return False
+
+    def generate_sddm(self, path):
+        conf = self._prepare_conf(path)
+        if conf is None:
+            return None
+
+        # Set values only if they have meaningful content
+        if self.dm_config["Greeter.Background"]:
+            theme = conf.setdefault("Theme", {})
+            theme["Background"] = self.dm_config["Greeter.Background"]
+
+        # Clean up empty values from all sections
+        self._clean_empty_values(theme)
+
+        conf.write()
+        return conf
+
+    def write_config(self, dm_name, directory):
+        if self.backup and dm_name!='gdm':
+            self.log("W13", {"dm": dm_name})
+            return
+
+        os.makedirs(directory, exist_ok=True)
+        filename = os.path.join(directory, "50-custom.conf")
+        gen = {
+            "lightdm": self.generate_lightdm,
+            "gdm": self.generate_gdm,
+            "sddm": self.generate_sddm
+        }.get(dm_name)
+        if not gen:
+            raise ValueError("Unknown DM: {}".format(dm_name))
+
+        result = gen(filename)
+
+        # For LightDM, always generate greeter configuration if needed
+        if dm_name == "lightdm":
+            self._generate_lightdm_greeter_config()
+
+        # Return True if configuration was created or if we have background settings
+        return result is not None or self.dm_config["Greeter.Background"]
+
+    def _detect_lightdm_greeter(self):
+        """Detect which LightDM greeter is being used"""
+
+        # Check main lightdm.conf
+        lightdm_conf_path = "/etc/lightdm/lightdm.conf"
+        if os.path.exists(lightdm_conf_path):
+            with open(lightdm_conf_path, 'r') as f:
+                for line in f:
+                    if line.strip().startswith("greeter-session") and not line.strip().startswith('#'):
+                        greeter = line.split('=')[1].strip()
+                        self.log("D30", {"greeter": greeter, "source": "lightdm.conf"})  # Greeter detection details
+                        return greeter
+
+        # Check lightdm.conf.d directory
+        lightdm_conf_d = "/etc/lightdm/lightdm.conf.d"
+        if os.path.exists(lightdm_conf_d):
+            for file in sorted(os.listdir(lightdm_conf_d)):
+                if file.endswith('.conf'):
+                    file_path = os.path.join(lightdm_conf_d, file)
+                    with open(file_path, 'r') as f:
+                        for line in f:
+                            if line.strip().startswith("greeter-session") and not line.strip().startswith('#'):
+                                greeter = line.split('=')[1].strip()
+                                self.log("D30", {"greeter": greeter, "source": file})  # Greeter detection details
+                                return greeter
+
+        # Check default greeter
+        default_greeter_path = "/usr/share/xgreeters/lightdm-default-greeter.desktop"
+        if os.path.exists(default_greeter_path):
+            with open(default_greeter_path, 'r') as f:
+                for line in f:
+                    if line.strip().startswith("Exec=") and not line.strip().startswith('#'):
+                        greeter_exec = line.split('=')[1].strip()
+                        # Extract greeter name from exec path
+                        greeter_name = os.path.basename(greeter_exec)
+                        self.log("D30", {"greeter": greeter_name, "source": "default-greeter"})  # Greeter detection details
+                        return greeter_name
+
+        # Fallback to gtk-greeter (most common)
+        self.log("D30", {"greeter": "lightdm-gtk-greeter", "source": "fallback"})  # Greeter detection details
+        return "lightdm-gtk-greeter"
+
+    def _generate_lightdm_greeter_config(self):
+        """Generate configuration for the detected LightDM greeter"""
+
+        # Only generate if we have background settings
+        if not self.dm_config["Greeter.Background"]:
+            return
+
+        greeter_name = self._detect_lightdm_greeter()
+
+        # Map greeter names to configuration files and settings
+        greeter_configs = {
+            "lightdm-gtk-greeter": {
+                "config_path": "/etc/lightdm/lightdm-gtk-greeter.conf",
+                "section": "greeter",
+                "background_key": "background",
+                "theme_key": "theme-name"
+            },
+            "lightdm-webkit2-greeter": {
+                "config_path": "/etc/lightdm/lightdm-webkit2-greeter.conf",
+                "section": "greeter",
+                "background_key": "background",
+                "theme_key": "theme"
+            },
+            "lightdm-unity-greeter": {
+                "config_path": "/etc/lightdm/lightdm-unity-greeter.conf",
+                "section": "greeter",
+                "background_key": "background",
+                "theme_key": "theme-name"
+            },
+            "lightdm-slick-greeter": {
+                "config_path": "/etc/lightdm/lightdm-slick-greeter.conf",
+                "section": "greeter",
+                "background_key": "background",
+                "theme_key": "theme-name"
+            },
+            "lightdm-kde-greeter": {
+                "config_path": "/etc/lightdm/lightdm-kde-greeter.conf",
+                "section": "greeter",
+                "background_key": "background",
+                "theme_key": "theme"
+            }
+        }
+
+        config_info = greeter_configs.get(greeter_name)
+        if not config_info:
+            self.log("E22", {"greeter": greeter_name})  # Unknown greeter type
+            return
+
+        conf = self._prepare_conf(config_info["config_path"])
+
+        # Get or create the greeter section
+        greeter_section = conf.setdefault(config_info["section"], {})
+
+        # Apply background setting only if it has meaningful content
+        if self.dm_config["Greeter.Background"]:
+            greeter_section[config_info["background_key"]] = self.dm_config["Greeter.Background"]
+
+        # Clean up any empty values in the greeter section
+        self._clean_empty_values(greeter_section)
+
+        conf.initial_comment = [f"# {greeter_name} custom config"]
+        try:
+            conf.write()
+            self.log("I5", {"path": config_info["config_path"], "greeter": greeter_name})
+        except Exception as exc:
+            self.log("E21", {"path": config_info["config_path"], "error": str(exc)})
+
+    def detect_dm(self):
+        """Detect available and active display managers with fallback methods"""
+        result = {"available": [], "active": None}
+
+        # Check for available DMs using multiple methods
+        available_dms = self._detect_available_dms()
+        result["available"] = available_dms
+
+        # Check active DM with fallbacks
+        active_dm = self._detect_active_dm_with_fallback(available_dms)
+        if active_dm:
+            result["active"] = active_dm
+
+        return result
+
+    def _detect_available_dms(self):
+        """Detect available display managers using multiple reliable methods"""
+        available = []
+
+        # Method 1: Check systemd unit files
+        systemd_units = [
+            ("lightdm", "lightdm.service"),
+            ("gdm", "gdm.service"),
+            ("gdm", "gdm3.service"),
+            ("sddm", "sddm.service")
+        ]
+
+        for dm_name, unit_name in systemd_units:
+            if self._check_systemd_unit_exists(unit_name):
+                if dm_name not in available:
+                    available.append(dm_name)
+
+        # Method 2: Check binary availability as fallback
+        binary_checks = [
+            ("lightdm", ["lightdm"]),
+            ("gdm", ["gdm", "gdm3"]),
+            ("sddm", ["sddm"])
+        ]
+
+        for dm_name, binaries in binary_checks:
+            if dm_name not in available:
+                if any(shutil.which(binary) for binary in binaries):
+                    available.append(dm_name)
+
+        return available
+
+    def _detect_active_dm_with_fallback(self, available_dms):
+        """Detect active DM with multiple fallback methods"""
+        # Primary method: systemd D-Bus
+        active_dm = self._check_systemd_dm()
+        if active_dm:
+            return active_dm
+
+        # Fallback 1: Check running processes
+        active_dm = self._check_running_processes(available_dms)
+        if active_dm:
+            return active_dm
+
+        # Fallback 2: Check display manager symlink
+        active_dm = self._check_display_manager_symlink()
+        if active_dm:
+            return active_dm
+
+        return None
+
+    def _check_systemd_unit_exists(self, unit_name):
+        """Check if systemd unit exists without requiring D-Bus"""
+        unit_paths = [
+            f"/etc/systemd/system/{unit_name}",
+            f"/usr/lib/systemd/system/{unit_name}",
+            f"/lib/systemd/system/{unit_name}"
+        ]
+        return any(os.path.exists(path) for path in unit_paths)
+
+    def _check_running_processes(self, available_dms):
+        """Check running processes for display manager indicators"""
+        try:
+            import psutil
+            for proc in psutil.process_iter(['name']):
+                proc_name = proc.info['name'].lower()
+                for dm in available_dms:
+                    if dm in proc_name:
+                        return dm
+        except (ImportError, psutil.NoSuchProcess):
+            pass
+        return None
+
+    def _check_display_manager_symlink(self):
+        """Check /etc/systemd/system/display-manager.service symlink"""
+        symlink_path = "/etc/systemd/system/display-manager.service"
+        if os.path.islink(symlink_path):
+            target = os.readlink(symlink_path)
+            for dm in ["lightdm", "gdm", "sddm"]:
+                if dm in target:
+                    return dm
+        return None
+
+    def _check_systemd_dm(self):
+        """
+        Check active display manager via systemd D-Bus API with improved error handling.
+        Returns dm name (lightdm/gdm/sddm) or None if not active.
+        """
+        try:
+            dm_unit = systemd_unit("display-manager.service", 1)
+            state = dm_unit._get_state()
+            if state in ("active", "activating"):
+                unit_path = str(dm_unit.unit)  # D-Bus object path, e.g. /org/.../lightdm_2eservice
+                # More robust DM name extraction
+                dm_mapping = {
+                    "lightdm": "lightdm",
+                    "gdm": "gdm",
+                    "sddm": "sddm"
+                }
+                for key, dm_name in dm_mapping.items():
+                    if key in unit_path.lower():
+                        return dm_name
+        except Exception as exc:
+            self.log("D30", {"unit": "display-manager.service", "error": str(exc)})
+        return None
+
+    def run(self):
+        """
+        Main plugin execution method with improved error handling and validation.
+        Detects active display manager and applies configuration.
+        """
+        self.log("I3")
+
+        try:
+            # Validate configuration before proceeding
+            if not self._validate_configuration():
+                self.log("W11")
+                if not self.backup:
+                    return False
+
+            # Detect available and active display managers
+            dm_info = self.detect_dm()
+            self.log("D30", {"dm_info": dm_info})
+
+            if not dm_info["available"]:
+                self.log("W10")
+                return False
+
+            # Use active DM or first available
+            target_dm = dm_info["active"] or (dm_info["available"][0] if dm_info["available"] else None)
+
+            if not target_dm:
+                self.log("W10")
+                return False
+
+            # Determine config directory based on DM
+            config_dir = self._get_config_directory(target_dm)
+            if not config_dir:
+                self.log("E22", {"dm": target_dm})
+                return False
+
+            # Generate configuration
+            result = self.write_config(target_dm, config_dir)
+
+            if result:
+                self.log("I4", {"dm": target_dm, "config_dir": config_dir})
+                return True
+            else:
+                self.log("E23", {"dm": target_dm, "config_dir": config_dir})
+                return False
+
+        except Exception as exc:
+            self.log("E24", {"error": str(exc)})
+            return False
+
+    def _validate_configuration(self):
+        """Validate DM configuration before applying"""
+        # Check if we have background configuration to apply
+        return bool(self.dm_config["Greeter.Background"])
+
+    def _get_config_directory(self, dm_name):
+        """Get configuration directory for display manager with fallbacks"""
+        config_dirs = {
+            "lightdm": ["/etc/lightdm/lightdm.conf.d", "/etc/lightdm"],
+            "gdm": ["/etc/gdm/custom.conf.d", "/etc/gdm"],
+            "sddm": ["/etc/sddm.conf.d", "/etc/sddm"]
+        }
+
+        dirs = config_dirs.get(dm_name, [])
+        for config_dir in dirs:
+            if os.path.exists(config_dir):
+                return config_dir
+
+        # If no existing directory, use the primary one
+        return dirs[0] if dirs else None
+
+
+def create_machine_applier(dict_dconf_db, username=None, fs_file_cache=None):
+    """Factory function to create DMApplier instance"""
+    return DMApplier(dict_dconf_db, username, fs_file_cache)
+
+
+def create_user_applier(dict_dconf_db, username=None, fs_file_cache=None):
+    """Factory function to create DMApplier instance"""
+    pass

gpoa/frontend_plugins/locale/ru_RU/LC_MESSAGES/dm_applier.po

@@ -0,0 +1,93 @@
+# Russian translations for dm_applier plugin.
+# Copyright (C) 2025 BaseALT Ltd.
+# This file is distributed under the same license as the dm_applier plugin.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: dm_applier\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2025-01-18 12:00+0000\n"
+"PO-Revision-Date: 2025-01-18 12:00+0000\n"
+"Last-Translator: Automatically generated\n"
+"Language-Team: Russian\n"
+"Language: ru_RU\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
+
+# DM Applier messages
+msgid "Display Manager Applier initialized"
+msgstr "Инициализирован апплаер дисплей менеджера"
+
+msgid "Display manager configuration generated successfully"
+msgstr "Конфигурация дисплей менеджера успешно сгенерирована"
+
+msgid "Display Manager Applier execution started"
+msgstr "Запущено выполнение апплаера дисплей менеджера"
+
+msgid "Display manager configuration completed successfully"
+msgstr "Конфигурация дисплей менеджера успешно завершена"
+
+msgid "LightDM greeter configuration generated successfully"
+msgstr "Конфигурация LightDM greeter успешно сгенерирована"
+
+msgid "GDM theme modified successfully"
+msgstr "Тема GDM успешно изменена"
+
+msgid "GDM backup restored successfully"
+msgstr "Резервная копия GDM успешно восстановлена"
+
+msgid "No display managers detected"
+msgstr "Дисплей менеджеры не обнаружены"
+
+msgid "No background configuration to apply"
+msgstr "Нет конфигурации фона для применения"
+
+msgid "GDM backup file not found"
+msgstr "Резервная копия GDM не найдена"
+
+msgid "Backup mode only supported for GDM"
+msgstr "Режим восстановления поддерживается только для GDM"
+
+msgid "Configuration file path is invalid or inaccessible"
+msgstr "Путь к файлу конфигурации недействителен или недоступен"
+
+msgid "Failed to generate display manager configuration"
+msgstr "Не удалось сгенерировать конфигурацию дисплей менеджера"
+
+msgid "Unknown display manager config directory"
+msgstr "Неизвестный каталог конфигурации дисплей менеджера"
+
+msgid "Display Manager Applier execution failed"
+msgstr "Выполнение апплаера дисплей менеджера завершилось ошибкой"
+
+msgid "GDM theme gresource not found"
+msgstr "GDM тема gresource не найдена"
+
+msgid "Failed to extract GDM gresource"
+msgstr "Не удалось извлечь GDM gresource"
+
+msgid "Failed to modify GDM background"
+msgstr "Не удалось изменить фон GDM"
+
+msgid "Failed to recompile GDM gresource"
+msgstr "Не удалось перекомпилировать GDM gresource"
+
+msgid "Failed to restore GDM backup"
+msgstr "Не удалось восстановить резервную копию GDM"
+
+msgid "Display manager detection details"
+msgstr "Детали обнаружения дисплей менеджера"
+
+msgid "Display manager configuration details"
+msgstr "Детали конфигурации дисплей менеджера"
+
+msgid "Removed empty configuration value"
+msgstr "Удалено пустое значение конфигурации"
+
+msgid "GDM background modification details"
+msgstr "Детали изменения фона GDM"
+
+msgid "GDM backup operation details"
+msgstr "Детали операции резервного копирования GDM"

gpoa/gpoa

@@ -25,7 +25,7 @@ import locale
 
 from backend import backend_factory, save_dconf
 from frontend.frontend_manager import frontend_manager, determine_username
-from plugin import plugin_manager
+from gpoa.plugin import plugin_manager
 from messages import message_with_code
 from storage import Dconf_registry
 
@@ -125,7 +125,6 @@ class gpoa_controller:
             print('samba')
             return
         Dconf_registry._force = self.__args.force
-        self.start_plugins()
         self.start_backend()
 
     def start_backend(self):
@@ -165,6 +164,7 @@ class gpoa_controller:
                         einfo = geterr()
                         logdata.update(einfo)
                         log('E3', logdata)
+                    self.start_plugins(self.is_machine, self.username)
 
     def start_frontend(self):
         '''
@@ -180,12 +180,12 @@ class gpoa_controller:
             logdata.update(einfo)
             log('E4', logdata)
 
-    def start_plugins(self):
+    def start_plugins(self, is_machine, username):
         '''
         Function to start supplementary facilities
         '''
         if not self.__args.noplugins:
-            pm = plugin_manager()
+            pm = plugin_manager(is_machine, username)
             pm.run()
 
 def main():

gpoa/gpt/drives.py

@@ -16,12 +16,15 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import json
 from base64 import b64decode
+import json
+
 from Crypto.Cipher import AES
-from .dynamic_attributes import DynamicAttributes
 from util.xml import get_xml_root
 
+from .dynamic_attributes import DynamicAttributes
+
+
 def decrypt_pass(cpassword):
     '''
     AES key for cpassword decryption: http://msdn.microsoft.com/en-us/library/2c15cbf0-f086-4c74-8b70-1f2fa45dd4be%28v=PROT.13%29#endNote2

gpoa/gpt/dynamic_attributes.py

@@ -17,6 +17,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 from enum import Enum
 
+
 class DynamicAttributes:
     def __init__(self, **kwargs):
         self.policy_name = None

gpoa/gpt/envvars.py

@@ -17,6 +17,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 from util.xml import get_xml_root
+
 from .dynamic_attributes import DynamicAttributes
 
 

gpoa/gpt/files.py

@@ -17,8 +17,10 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 from util.xml import get_xml_root
+
 from .dynamic_attributes import DynamicAttributes
 
+
 def read_files(filesxml):
     files = []
 

gpoa/gpt/folders.py

@@ -17,10 +17,9 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 
-from .dynamic_attributes import DynamicAttributes
-
 from util.xml import get_xml_root
 
+from .dynamic_attributes import DynamicAttributes
 
 
 def action_enum2letter(enumitem):

gpoa/gpt/gpo_dconf_mapping.py

@@ -18,6 +18,7 @@
 
 from .dynamic_attributes import DynamicAttributes
 
+
 class GpoInfoDconf(DynamicAttributes):
     _counter = 0
     def __init__(self, gpo) -> None:

gpoa/gpt/gpt.py

@@ -16,71 +16,30 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+from enum import Enum, unique
 import os
 from pathlib import Path
-from enum import Enum, unique
 
 from samba.gp_parse.gp_pol import GPPolParser
-
 from storage import registry_factory
 from storage.dconf_registry import add_to_dict
-
-from .polfile import (
-      read_polfile
-    , merge_polfile
-)
-from .shortcuts import (
-      read_shortcuts
-    , merge_shortcuts
-)
-from .services import (
-      read_services
-    , merge_services
-)
-from .printers import (
-      read_printers
-    , merge_printers
-)
-from .inifiles import (
-      read_inifiles
-    , merge_inifiles
-)
-from .folders import (
-      read_folders
-    , merge_folders
-)
-from .files import (
-      read_files
-    , merge_files
-)
-from .envvars import (
-      read_envvars
-    , merge_envvars
-)
-from .drives import (
-      read_drives
-    , merge_drives
-)
-from .tasks import (
-      read_tasks
-    , merge_tasks
-)
-from .scriptsini import (
-      read_scripts
-    , merge_scripts
-)
-from .networkshares import (
-      read_networkshares
-    , merge_networkshares
-)
 import util
-import util.preg
-from util.paths import (
-    local_policy_path,
-    cache_dir,
-    local_policy_cache
-)
 from util.logging import log
+from util.paths import cache_dir, local_policy_cache, local_policy_path
+import util.preg
+
+from .drives import merge_drives, read_drives
+from .envvars import merge_envvars, read_envvars
+from .files import merge_files, read_files
+from .folders import merge_folders, read_folders
+from .inifiles import merge_inifiles, read_inifiles
+from .networkshares import merge_networkshares, read_networkshares
+from .polfile import merge_polfile, read_polfile
+from .printers import merge_printers, read_printers
+from .scriptsini import merge_scripts, read_scripts
+from .services import merge_services, read_services
+from .shortcuts import merge_shortcuts, read_shortcuts
+from .tasks import merge_tasks, read_tasks
 
 
 @unique

gpoa/gpt/inifiles.py

@@ -17,8 +17,10 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 from util.xml import get_xml_root
+
 from .dynamic_attributes import DynamicAttributes
 
+
 def read_inifiles(inifiles_file):
     inifiles = []
 

gpoa/gpt/networkshares.py

@@ -17,8 +17,10 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 from util.xml import get_xml_root
+
 from .dynamic_attributes import DynamicAttributes
 
+
 def read_networkshares(networksharesxml):
     networkshares = []
 

gpoa/gpt/polfile.py

@@ -16,9 +16,8 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-from util.preg import (
-      load_preg
-)
+from util.preg import load_preg
+
 
 def read_polfile(filename):
     return load_preg(filename).entries

gpoa/gpt/printers.py

@@ -17,10 +17,12 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import json
-from .dynamic_attributes import DynamicAttributes
 
 from util.xml import get_xml_root
 
+from .dynamic_attributes import DynamicAttributes
+
+
 def read_printers(printers_file):
     '''
     Read printer configurations from Printer.xml

gpoa/gpt/scriptsini.py

@@ -18,8 +18,10 @@
 
 import configparser
 import os
+
 from .dynamic_attributes import DynamicAttributes
 
+
 def read_scripts(scripts_file):
     scripts = Scripts_lists()
 

gpoa/gpt/services.py

@@ -17,8 +17,10 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 from util.xml import get_xml_root
+
 from .dynamic_attributes import DynamicAttributes
 
+
 def read_services(service_file):
     '''
     Read Services.xml from GPT.

gpoa/gpt/shortcuts.py

@@ -16,18 +16,19 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+from enum import Enum
+import json
 from pathlib import Path
 import stat
-from enum import Enum
-
-from xdg.DesktopEntry import DesktopEntry
-import json
 
+from util.paths import get_desktop_files_directory
 from util.windows import transform_windows_path
 from util.xml import get_xml_root
-from util.paths import get_desktop_files_directory
+from xdg.DesktopEntry import DesktopEntry
+
 from .dynamic_attributes import DynamicAttributes
 
+
 class TargetType(Enum):
     FILESYSTEM = 'FILESYSTEM'
     URL = 'URL'

gpoa/gpupdate

@@ -167,9 +167,15 @@ def try_directly(username, target, loglevel):
 
 def main():
     args = parse_cli_arguments()
-    locale.bindtextdomain('gpoa', '/usr/lib/python3/site-packages/gpoa/locale')
-    gettext.bindtextdomain('gpoa', '/usr/lib/python3/site-packages/gpoa/locale')
+
+    # Set up locale for main application
+    import os
+    base_dir = os.path.dirname(os.path.abspath(__file__))
+    main_locale_path = os.path.join(base_dir, 'locale')
+    locale.bindtextdomain('gpoa', main_locale_path)
+    gettext.bindtextdomain('gpoa', main_locale_path)
     gettext.textdomain('gpoa')
+
     set_loglevel(args.loglevel)
     Dconf_registry._force = args.force
     gpo_appliers = runner_factory(args, process_target(args.target))

gpoa/gpupdate-setup

@@ -30,6 +30,7 @@ from util.util import (
 )
 from util.config import GPConfig
 from util.paths import get_custom_policy_dir
+from frontend.appliers.ini_file import Ini_file
 
 
 class Runner:
@@ -77,7 +78,7 @@ def parse_arguments():
         type=str,
         nargs='?',
         const='backend',
-        choices=['local', 'samba'],
+        choices=['local', 'samba', 'freeipa'],
         help='Backend (source of settings) name')
 
     parser_write.add_argument('status',
@@ -92,7 +93,7 @@ def parse_arguments():
         type=str,
         nargs='?',
         const='backend',
-        choices=['local', 'samba'],
+        choices=['local', 'samba', 'freeipa'],
         help='Backend (source of settings) name')
 
     parser_enable.add_argument('--local-policy',
@@ -101,7 +102,7 @@ def parse_arguments():
     parser_enable.add_argument('--backend',
         default='samba',
         type=str,
-        choices=['local', 'samba'],
+        choices=['local', 'samba', 'freeipa'],
         help='Backend (source of settings) name')
 
     parser_update.add_argument('--local-policy',
@@ -110,7 +111,7 @@ def parse_arguments():
     parser_update.add_argument('--backend',
         default='samba',
         type=str,
-        choices=['local', 'samba'],
+        choices=['local', 'samba', 'freeipa'],
         help='Backend (source of settings) name')
 
 
@@ -221,6 +222,8 @@ def enable_gp(policy_name, backend_type):
     cmd_enable_gpupdate_user_timer = ['/bin/systemctl', '--global', 'enable', 'gpupdate-user.timer']
     cmd_enable_gpupdate_scripts_service = ['/bin/systemctl', 'enable', 'gpupdate-scripts-run.service']
     cmd_enable_gpupdate_user_scripts_service = ['/bin/systemctl', '--global', 'enable', 'gpupdate-scripts-run-user.service']
+    cmd_ipa_client_samba = ['/usr/sbin/ipa-client-samba', '--unattended']
+
 
     config = GPConfig()
 
@@ -271,6 +274,28 @@ def enable_gp(policy_name, backend_type):
     if not is_unit_enabled('gpupdate.timer'):
         disable_gp()
         return
+
+    if backend_type == 'freeipa':
+        result = runcmd(cmd_ipa_client_samba)
+        if result[0] != 0:
+            if "already configured" in str(result[1]) or "already exists" in str(result[1]):
+                print("FreeIPA is already configured")
+            else:
+                print(str(result))
+                return
+        else:
+            print(str(result))
+
+        ini_obj = type("ini", (), {})()
+        ini_obj.path = "/etc/samba/smb.conf"
+        ini_obj.section = "global"
+        ini_obj.action = "UPDATE"
+        ini_obj.property = "log level"
+        ini_obj.value = "0"
+
+        Ini_file(ini_obj)
+
+
     # Enable gpupdate-setup.timer for all users
     if not rollback_on_error(cmd_enable_gpupdate_user_timer):
         return

gpoa/locale/ru_RU/LC_MESSAGES/gpoa.po

@@ -68,6 +68,11 @@ msgstr "В конфигурационном файле была очищена
 msgid "Found GPT in cache"
 msgstr "Найден GPT в кеше"
 
+msgid "Got GPO list for trusted user"
+msgstr "Получен список GPO для доверенного пользователя"
+
+msgid "Restarting systemd unit"
+msgstr "Перезапуск unit systemd"
 
 # Error
 msgid "Insufficient permissions to run gpupdate"
@@ -268,6 +273,18 @@ msgstr "Не удалось обновить LDAP новыми данными п
 msgid "Failed to change local user password"
 msgstr "Не удалось изменить пароль локального пользователя"
 
+msgid "Unable to restart systemd unit"
+msgstr "Не удалось перезапустить unit systemd"
+
+msgid "Kerberos info unavailable; cannot construct DPAPI parameters"
+msgstr "Информация Kerberos недоступна; невозможно сформировать параметры DPAPI"
+
+msgid "Unable to initialize Freeipa backend"
+msgstr "Невозможно инициализировать бэкэнд Freeipa"
+
+msgid "FreeIPA API Error"
+msgstr "Ошибка API FreeIPA"
+
 # Error_end
 
 # Debug
@@ -280,12 +297,6 @@ msgstr "Имя пользователя не указано - будет исп
 msgid "Initializing plugin manager"
 msgstr "Инициализация плагинов"
 
-msgid "ADP plugin initialized"
-msgstr "Инициализирован плагин ADP"
-
-msgid "Running ADP plugin"
-msgstr "Запущен плагин ADP"
-
 msgid "Starting GPOA for user via D-Bus"
 msgstr "Запускается GPOA для пользователя обращением к oddjobd через D-Bus"
 
@@ -958,9 +969,21 @@ msgstr "Расчет времени с момента первого входа
 msgid "No logins found after password change"
 msgstr "Не найдены входы после изменения пароля"
 
+msgid "User not found in passwd database"
+msgstr "Пользователь не найден в базе данных паролей"
+
 msgid "Unknown message type, no message assigned"
 msgstr "Неизвестный тип сообщения"
 
+msgid "Plugin is disabled"
+msgstr "Плагин отключен"
+
+msgid "Running plugin"
+msgstr "Запуск плагина"
+
+msgid "Failed to load cached versions"
+msgstr "Не удалось загрузить кешированные версии"
+
 # Debug_end
 
 # Warning
@@ -1093,6 +1116,16 @@ msgstr "Некорректный часовой пояс в reference datetime"
 
 msgid "wbinfo SID lookup failed; will try as trusted domain user"
 msgstr "Ошибка получения SID через wbinfo; будет предпринята попытка как для пользователя доверенного домена"
+
+msgid "Plugin is not valid API object"
+msgstr "Плагин не является допустимым объектом API"
+
+msgid "Error loading plugin from file"
+msgstr "Ошибка загрузки плагина из файла"
+
+msgid "Plugin failed to apply with user privileges"
+msgstr "Плагин не смог примениться с правами пользователя"
+
 # Warning_end
 
 # Fatal

gpoa/messages/__init__.py

@@ -19,6 +19,7 @@
 
 import gettext
 
+
 def info_code(code):
     info_ids = {}
     info_ids[1] = 'Got GPO list for username'
@@ -32,6 +33,8 @@ def info_code(code):
     info_ids[9] = 'Set user property to'
     info_ids[10] = 'The line in the configuration file was cleared'
     info_ids[11] = 'Found GPT in cache'
+    info_ids[12] = 'Got GPO list for trusted user'
+    info_ids[13] = 'Restarting systemd unit'
 
     return info_ids.get(code, 'Unknown info code')
 
@@ -45,7 +48,7 @@ def error_code(code):
     error_ids[6] = 'Error running GPOA for user'
     error_ids[7] = 'Unable to initialize Samba backend'
     error_ids[8] = 'Unable to initialize no-domain backend'
-    error_ids[9] = 'Error running ADP'
+    error_ids[9] = 'Error running plugin'
     error_ids[10] = 'Unable to determine DC hostname'
     error_ids[11] = 'Error occured while running applier with user privileges'
     error_ids[12] = 'Unable to initialize backend'
@@ -112,6 +115,10 @@ def error_code(code):
     error_ids[74] = 'Autofs restart failed'
     error_ids[75] = 'Failed to update LDAP with new password data'
     error_ids[76] = 'Failed to change local user password'
+    error_ids[77] = 'Unable to restart systemd unit'
+    error_ids[78] = 'Kerberos info unavailable; cannot construct DPAPI parameters'
+    error_ids[79] = 'Unable to initialize Freeipa backend'
+    error_ids[80] = 'FreeIPA API error'
     return error_ids.get(code, 'Unknown error code')
 
 def debug_code(code):
@@ -119,8 +126,8 @@ def debug_code(code):
     debug_ids[1] = 'The GPOA process was started for user'
     debug_ids[2] = 'Username is not specified - will use username of the current process'
     debug_ids[3] = 'Initializing plugin manager'
-    debug_ids[4] = 'ADP plugin initialized'
-    debug_ids[5] = 'Running ADP plugin'
+    debug_ids[4] = 'Running plugin'
+    #debug_ids[5] = ''
     debug_ids[6] = 'Starting GPOA for user via D-Bus'
     debug_ids[7] = 'Cache directory determined'
     debug_ids[8] = 'Initializing local backend without domain'
@@ -349,6 +356,9 @@ def debug_code(code):
     debug_ids[232] = 'No user login records found'
     debug_ids[233] = 'Calculating time since the first user login after their password change'
     debug_ids[234] = 'No logins found after password change'
+    debug_ids[235] = 'User not found in passwd database'
+    debug_ids[236] = 'Plugin is disabled'
+    debug_ids[237] = 'Failed to load cached versions'
 
     return debug_ids.get(code, 'Unknown debug code')
 
@@ -403,6 +413,9 @@ def warning_code(code):
     warning_ids[41] = 'Error getting user login times'
     warning_ids[42] = 'Invalid timezone in reference datetime'
     warning_ids[43] = 'wbinfo SID lookup failed; will try as trusted domain user'
+    warning_ids[44] = 'Plugin is not valid API object'
+    warning_ids[45] = 'Error loading plugin from file'
+    warning_ids[46] = 'Plugin failed to apply with user privileges'
 
     return warning_ids.get(code, 'Unknown warning code')
 
@@ -431,7 +444,7 @@ def get_message(code):
     return retstr
 
 def message_with_code(code):
-    retstr = '[' + code[0:1] + code[1:].rjust(5, '0') + ']| ' + gettext.gettext(get_message(code))
+    retstr = 'core' + '[' + code[0:1] + code[1:].rjust(7, '0') + ']| ' + gettext.gettext(get_message(code))
 
     return retstr
 

gpoa/plugin/__init__.py

@@ -17,4 +17,5 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 from .plugin_manager import plugin_manager
+from .messages import register_plugin_messages, get_plugin_message, get_all_plugin_messages
 

gpoa/plugin/adp.py

@@ -1,41 +0,0 @@
-#
-# GPOA - GPO Applier for Linux
-#
-# Copyright (C) 2019-2020 BaseALT Ltd.
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-import logging
-import subprocess
-
-from util.rpm import is_rpm_installed
-from .exceptions import PluginInitError
-from util.logging import slogm
-from messages import message_with_code
-
-class adp:
-    def __init__(self):
-        if not is_rpm_installed('adp'):
-            raise PluginInitError(message_with_code('W5'))
-        logging.info(slogm(message_with_code('D4')))
-
-    def run(self):
-        try:
-            logging.info(slogm(message_with_code('D5')))
-            subprocess.call(['/usr/bin/adp', 'fetch'])
-            subprocess.call(['/usr/bin/adp', 'apply'])
-        except Exception as exc:
-            logging.error(slogm(message_with_code('E9')))
-            raise exc
-

gpoa/plugin/messages.py

@@ -0,0 +1,180 @@
+#
+# GPOA - GPO Applier for Linux
+#
+# Copyright (C) 2025 BaseALT Ltd.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+"""
+Plugin message registry for GPOA plugins.
+
+This module allows plugins to register their message codes and descriptions
+without modifying the main messages.py file.
+"""
+
+import os
+import sys
+import inspect
+import gettext
+import importlib.util
+from pathlib import Path
+
+_plugin_messages = {}
+_plugin_translations = {}
+
+def _load_plugin_translations(domain):
+    """
+    Load translations for a specific plugin from its locale directory.
+
+    Dynamically searches for plugin modules across the entire project.
+
+    Args:
+        domain (str): Plugin domain/prefix
+    """
+    try:
+        # Try to find the plugin module that registered these messages
+        for prefix, msgs in _plugin_messages.items():
+            if prefix == domain:
+                # Search through all loaded modules to find the plugin class
+                for module_name, module in list(sys.modules.items()):
+                    if module and hasattr(module, '__dict__'):
+                        for name, obj in module.__dict__.items():
+                            # Check if this is a class with the domain attribute
+                            if (isinstance(obj, type) and
+                                hasattr(obj, 'domain') and
+                                obj.domain == domain):
+                                # Found the plugin class, now find its file
+                                try:
+                                    plugin_file = Path(inspect.getfile(obj))
+                                    plugin_dir = plugin_file.parent
+                                    # Look for locale directory in plugin directory
+                                    locale_dir = plugin_dir / 'locale'
+                                    if locale_dir.exists():
+                                        # Try to load translations
+                                        lang = 'ru_RU'  # Default to Russian
+                                        lc_messages_dir = locale_dir / lang / 'LC_MESSAGES'
+                                        if lc_messages_dir.exists():
+                                            # Look for .po files
+                                            po_files = list(lc_messages_dir.glob('*.po'))
+                                            for po_file in po_files:
+                                                try:
+                                                    translation = gettext.translation(
+                                                        po_file.stem,
+                                                        localedir=str(locale_dir),
+                                                        languages=[lang]
+                                                    )
+                                                    _plugin_translations[domain] = translation
+                                                    return  # Successfully loaded translations
+                                                except FileNotFoundError:
+                                                    continue
+                                    # If not found in plugin directory, check parent directories
+                                    # (for plugins that are in subdirectories)
+                                    parent_dirs_to_check = [
+                                        plugin_dir.parent / 'locale',  # Parent directory
+                                        plugin_dir.parent.parent / 'locale'  # Grandparent directory
+                                    ]
+                                    for parent_locale_dir in parent_dirs_to_check:
+                                        if parent_locale_dir.exists():
+                                            lang = 'ru_RU'
+                                            lc_messages_dir = parent_locale_dir / lang / 'LC_MESSAGES'
+                                            if lc_messages_dir.exists():
+                                                po_files = list(lc_messages_dir.glob('*.po'))
+                                                for po_file in po_files:
+                                                    try:
+                                                        translation = gettext.translation(
+                                                            po_file.stem,
+                                                            localedir=str(parent_locale_dir),
+                                                            languages=[lang]
+                                                        )
+                                                        _plugin_translations[domain] = translation
+                                                        return  # Successfully loaded translations
+                                                    except FileNotFoundError:
+                                                        continue
+                                except (TypeError, OSError):
+                                    # Could not get file path for the class
+                                    continue
+                break
+
+        # If not found through module inspection, try system-wide gpupdate plugins directory
+        gpupdate_plugins_locale = Path('/usr/lib/gpupdate/plugins/locale')
+        if gpupdate_plugins_locale.exists():
+            lang = 'ru_RU'
+            lc_messages_dir = gpupdate_plugins_locale / lang / 'LC_MESSAGES'
+            if lc_messages_dir.exists():
+                # Look for .po files matching the plugin prefix
+                po_files = list(lc_messages_dir.glob(f'*{domain.lower()}*.po'))
+                if not po_files:
+                    # Try any .po file if no specific match
+                    po_files = list(lc_messages_dir.glob('*.po'))
+
+                for po_file in po_files:
+                    try:
+                        translation = gettext.translation(
+                            po_file.stem,
+                            localedir=str(gpupdate_plugins_locale),
+                            languages=[lang]
+                        )
+                        _plugin_translations[domain] = translation
+                        return  # Successfully loaded translations
+                    except FileNotFoundError:
+                        continue
+    except Exception:
+        # Silently fail if translations cannot be loaded
+        pass
+
+def register_plugin_messages(domain, messages_dict):
+    """
+    Register message codes for a plugin.
+
+    Args:
+        domain (str): Plugin domain/prefix
+        messages_dict (dict): Dictionary mapping message codes to descriptions
+    """
+    _plugin_messages[domain] = messages_dict
+
+    # Try to load plugin-specific translations
+    _load_plugin_translations(domain)
+
+def get_plugin_message(domain, code):
+    """
+    Get message description for a plugin-specific code.
+
+    Args:
+        domain (str): Plugin domain/prefix
+        code (int): Message code
+
+    Returns:
+        str: Message description or generic message if not found
+    """
+    plugin_msgs = _plugin_messages.get(domain, {})
+    message_text = plugin_msgs.get(code, f"Plugin {domain} message {code}")
+
+    # Try to translate the message if translations are available
+    translation = _plugin_translations.get(domain)
+    if translation:
+        try:
+            return translation.gettext(message_text)
+        except:
+            pass
+
+    return message_text
+
+def get_all_plugin_messages():
+    """
+    Get all registered plugin messages.
+
+    Returns:
+        dict: Dictionary of all registered plugin messages
+    """
+    return _plugin_messages.copy()

gpoa/plugin/plugin.py

@@ -1,7 +1,7 @@
 #
 # GPOA - GPO Applier for Linux
 #
-# Copyright (C) 2019-2020 BaseALT Ltd.
+# Copyright (C) 2019-2025 BaseALT Ltd.
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -16,12 +16,75 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-from abc import ABC
+from abc import ABC, abstractmethod
+from typing import final
+from gpoa.util.util import string_to_literal_eval
+from gpoa.util.logging import log
+from gpoa.plugin.plugin_log import PluginLog
+from gpoa.storage.dconf_registry import Dconf_registry
 
-class plugin():
-    def __init__(self, plugin_name):
-        self.plugin_name = plugin_name
+class plugin(ABC):
+    def __init__(self, dict_dconf_db={}, username=None, fs_file_cache=None):
+        self.dict_dconf_db = dict_dconf_db
+        self.file_cache = fs_file_cache
+        self.username = username
+        self._log = None
+        self.plugin_name = self.__class__.__name__
 
+    @final
+    def apply(self):
+        """Apply the plugin with current privileges"""
+        self.run()
+
+    @final
+    def apply_user(self, username):
+        """Apply the plugin with user privileges"""
+        from util.system import with_privileges
+
+        def run_with_user():
+            try:
+                result = self.run()
+                # Ensure result is JSON-serializable
+                return {"success": True, "result": result}
+            except Exception as exc:
+                # Return error information in JSON-serializable format
+                return {"success": False, "error": str(exc)}
+
+        try:
+            execution_result = with_privileges(username, run_with_user)
+            if execution_result and execution_result.get("success"):
+                result = execution_result.get("result", True)
+                return result
+            else:
+                return False
+        except:
+            return False
+
+    @final
+    def get_dict_registry(self, prefix=''):
+        """Get the dictionary from the registry"""
+        return  string_to_literal_eval(self.dict_dconf_db.get(prefix,{}))
+
+    def _init_plugin_log(self, message_dict=None, locale_dir=None, domain=None):
+        """Initialize plugin-specific logger with message codes."""
+        self._log = PluginLog(message_dict, locale_dir, domain, self.plugin_name)
+
+    def log(self, message_code, data=None):
+        """
+        Log message using plugin-specific logger with message codes.
+
+        Args:
+            message_code (str): Message code in format 'W1', 'E2', etc.
+            data (dict): Additional data for message formatting
+        """
+        if self._log:
+            self._log(message_code, data)
+        else:
+            # Fallback to basic logging
+            level_char = message_code[0] if message_code else 'E'
+            log(level_char, {"plugin": self.__class__.__name__, "message": f"Message {message_code}", "data": data})
+
+    @abstractmethod
     def run(self):
         pass
 

gpoa/plugin/plugin_base.py

@@ -0,0 +1,44 @@
+#
+# GPOA - GPO Applier for Linux
+#
+# Copyright (C) 2025 BaseALT Ltd.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from abc import abstractmethod
+from gpoa.plugin.plugin import plugin
+
+class FrontendPlugin(plugin):
+    """
+    Base class for frontend plugins with simplified logging support.
+    """
+
+    def __init__(self, dict_dconf_db={}, username=None, fs_file_cache=None):
+        super().__init__(dict_dconf_db, username, fs_file_cache)
+
+    @abstractmethod
+    def run(self):
+        """
+        Abstract method that must be implemented by concrete plugins.
+        This method should contain the main plugin execution logic.
+        """
+        pass
+
+
+
+
+
+
+
+

gpoa/plugin/plugin_log.py

@@ -0,0 +1,276 @@
+#
+# GPOA - GPO Applier for Linux
+#
+# Copyright (C) 2019-2025 BaseALT Ltd.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import gettext
+import locale
+import logging
+import inspect
+from pathlib import Path
+
+from gpoa.util.logging import slogm
+from gpoa.plugin.messages import register_plugin_messages
+
+
+class PluginLog:
+    """
+    Plugin logging class with message codes and translations support.
+
+    Usage:
+        log = PluginLog({
+            'w': {1: 'Warning message template {param}'},
+            'e': {1: 'Error message template {param}'},
+            'i': {1: 'Info message template {param}'},
+            'd': {1: 'Debug message template {param}'}
+        }, domain='dm_applier')
+
+        log('W1', {'param': 'value'})
+    """
+
+    def __init__(self, message_dict=None, locale_dir=None, domain=None, plugin_name=None):
+        """
+        Initialize plugin logger.
+
+        Args:
+            message_dict (dict): Dictionary with message templates
+            locale_dir (str): Path to locale directory for translations
+            domain (str): Translation domain name (required for translations)
+        """
+        self.message_dict = message_dict or {}
+        self.locale_dir = locale_dir
+        self.domain = domain or 'plugin'
+        self._translation = None
+        self.plugin_name = plugin_name
+        # Register plugin messages
+        if message_dict:
+            # Convert to flat dictionary for registration
+            flat_messages = {}
+            for level, level_dict in message_dict.items():
+                for code, message in level_dict.items():
+                    flat_messages[code] = message
+
+            register_plugin_messages(self.domain, flat_messages)
+
+        # Auto-detect locale directory only if explicitly None (not provided)
+        # If locale_dir is an empty string or other falsy value, don't auto-detect
+        if self.locale_dir is None:
+            self._auto_detect_locale_dir()
+
+        # Load translations
+        self._load_translations()
+
+    def _auto_detect_locale_dir(self):
+        """Auto-detect locale directory based on plugin file location."""
+        try:
+            # Try to find the calling plugin module
+            frame = inspect.currentframe()
+            while frame:
+                module = frame.f_globals.get('__name__', '')
+                if module and 'plugin' in module:
+                    module_file = frame.f_globals.get('__file__', '')
+                    if module_file:
+                        plugin_dir = Path(module_file).parent
+                        # First try: locale directory in plugin's own directory
+                        locale_candidate = plugin_dir / 'locale'
+                        if locale_candidate.exists():
+                            self.locale_dir = str(locale_candidate)
+                            return
+                        # Second try: common locale directory for frontend plugins
+                        if 'frontend_plugins' in str(plugin_dir):
+                            frontend_plugins_dir = plugin_dir.parent
+                            common_locale_dir = frontend_plugins_dir / 'locale'
+                            if common_locale_dir.exists():
+                                self.locale_dir = str(common_locale_dir)
+                                return
+                frame = frame.f_back
+            # Third try: relative to current working directory
+            cwd_locale = Path.cwd() / 'gpoa' / 'frontend_plugins' / 'locale'
+            if cwd_locale.exists():
+                self.locale_dir = str(cwd_locale)
+                return
+            # Fourth try: relative to script location
+            script_dir = Path(__file__).parent.parent.parent / 'frontend_plugins' / 'locale'
+            if script_dir.exists():
+                self.locale_dir = str(script_dir)
+                return
+            # Fifth try: system installation path for frontend plugins
+            system_paths = [
+                '/usr/lib/python3/site-packages/gpoa/frontend_plugins/locale',
+                '/usr/local/lib/python3/site-packages/gpoa/frontend_plugins/locale'
+            ]
+            for path in system_paths:
+                if os.path.exists(path):
+                    self.locale_dir = path
+                    return
+
+            # Sixth try: system-wide gpupdate package locale directory
+            gpupdate_package_locale = Path('/usr/lib/python3/site-packages/gpoa/locale')
+            if gpupdate_package_locale.exists():
+                self.locale_dir = str(gpupdate_package_locale)
+                return
+
+            # Seventh try: system-wide locale directory (fallback)
+            system_locale_dir = Path('/usr/share/locale')
+            if system_locale_dir.exists():
+                self.locale_dir = str(system_locale_dir)
+                return
+        except:
+            pass
+
+    def _load_translations(self):
+        """Load translations for the plugin using system locale."""
+        if self.locale_dir:
+            # Use only self.domain as the translation file name
+            # This aligns with the convention that plugin translation files
+            # are always named according to the domain
+            domain = self.domain
+
+            try:
+                # Get system locale
+                system_locale = locale.getdefaultlocale()[0]
+                languages = [system_locale] if system_locale else ['ru_RU']
+
+                # First try: load from the detected locale_dir without fallback
+                try:
+                    self._translation = gettext.translation(
+                        domain,
+                        localedir=self.locale_dir,
+                        languages=languages,
+                        fallback=False
+                    )
+                except FileNotFoundError:
+                    # File not found, try with fallback
+                    self._translation = gettext.translation(
+                        domain,
+                        localedir=self.locale_dir,
+                        languages=languages,
+                        fallback=True
+                    )
+
+                    # Check if we got real translations or NullTranslations
+                    if isinstance(self._translation, gettext.NullTranslations):
+                        # Try loading from system locale directory as fallback
+                        try:
+                            self._translation = gettext.translation(
+                                domain,
+                                localedir='/usr/share/locale',
+                                languages=languages,
+                                fallback=False
+                            )
+                        except FileNotFoundError:
+                            # File not found in system directory, use fallback
+                            self._translation = gettext.translation(
+                                domain,
+                                localedir='/usr/share/locale',
+                                languages=languages,
+                                fallback=True
+                            )
+
+            except Exception:
+                # If any exception occurs, fall back to NullTranslations
+                self._translation = gettext.NullTranslations()
+
+            # Ensure _translation is set even if all attempts failed
+            if not hasattr(self, '_translation'):
+                self._translation = gettext.NullTranslations()
+        else:
+            self._translation = gettext.NullTranslations()
+
+    def _get_message_template(self, level, code):
+        """Get message template for given level and code."""
+        level_dict = self.message_dict.get(level, {})
+        return level_dict.get(code, 'Unknown message {code}')
+
+    def _format_message(self, level, code, data=None):
+        """Format message with data and apply translation."""
+        template = self._get_message_template(level, code)
+        # Apply translation
+        translated_template = self._translation.gettext(template)
+        # Format with data if provided
+        if data and isinstance(data, dict):
+            try:
+                return translated_template.format(**data)
+            except:
+                return "{} | {}".format(translated_template, data)
+        return translated_template
+
+    def _get_full_code(self, level_char, code):
+        """Get full message code without plugin prefix."""
+        return f"{level_char}{code:05d}"
+
+    def __call__(self, message_code, data=None):
+        """
+        Log a message with the given code and data.
+
+        Args:
+            message_code (str): Message code in format 'W1', 'E2', etc.
+            data (dict): Additional data for message formatting
+        """
+        if not message_code or len(message_code) < 2:
+            logging.error(slogm("Invalid message code format", {"code": message_code}))
+            return
+        level_char = message_code[0].lower()
+        try:
+            code_num = int(message_code[1:])
+        except ValueError:
+            logging.error(slogm("Invalid message code number", {"code": message_code}))
+            return
+
+        # Get the formatted message
+        message = self._format_message(level_char, code_num, data)
+        # Create full message code for logging
+        full_code = self._get_full_code(level_char.upper(), code_num)
+        # Format the log message like main code: [Code]| Message | data
+        full_code = self._get_full_code(level_char.upper(), code_num)
+        log_message = f"{self.plugin_name}[{full_code}]| {message}"
+        if data:
+            log_message += f"|{data}"
+
+        # Log with appropriate level - no kwargs needed
+        if level_char == 'i':
+            logging.info(slogm(log_message))
+        elif level_char == 'w':
+            logging.warning(slogm(log_message))
+        elif level_char == 'e':
+            logging.error(slogm(log_message))
+        elif level_char == 'd':
+            logging.debug(slogm(log_message))
+        elif level_char == 'f':
+            logging.fatal(slogm(log_message))
+        else:
+            logging.info(slogm(log_message))
+
+    def info(self, code, data=None):
+        """Log info message."""
+        self(f"I{code}", data)
+
+    def warning(self, code, data=None):
+        """Log warning message."""
+        self(f"W{code}", data)
+
+    def error(self, code, data=None):
+        """Log error message."""
+        self(f"E{code}", data)
+
+    def debug(self, code, data=None):
+        """Log debug message."""
+        self(f"D{code}", data)
+
+    def fatal(self, code, data=None):
+        """Log fatal message."""
+        self(f"F{code}", data)

gpoa/plugin/plugin_manager.py

@@ -1,7 +1,7 @@
 #
 # GPOA - GPO Applier for Linux
 #
-# Copyright (C) 2019-2020 BaseALT Ltd.
+# Copyright (C) 2019-2025 BaseALT Ltd.
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -16,25 +16,203 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import logging
+import importlib.util
+import inspect
+from pathlib import Path
+
+from gpoa.util.logging import log
+from gpoa.util.paths import gpupdate_plugins_path
+from gpoa.util.util import string_to_literal_eval
 
-from .adp import adp
-from .roles import roles
-from .exceptions import PluginInitError
 from .plugin import plugin
-from util.logging import slogm
-from messages import message_with_code
+from gpoa.storage import registry_factory
+from gpoa.storage.fs_file_cache import fs_file_cache
+from gpoa.util.util import get_uid_by_username
+
 
 class plugin_manager:
-    def __init__(self):
-        self.plugins = {}
-        logging.debug(slogm(message_with_code('D3')))
-        try:
-            self.plugins['adp'] = adp()
-        except PluginInitError as exc:
-            logging.warning(slogm(str(exc)))
+    def __init__(self, is_machine, username):
+        self.is_machine = is_machine
+        self.username = username
+        self.file_cache = fs_file_cache('file_cache', self.username)
+        self.list_plugins = []
+        self.dict_dconf_db = self.get_dict_dconf_db()
+        self.filling_settings()
+        self.plugins = self.load_plugins()
+        log('D3')
+
+    def get_dict_dconf_db(self):
+        dconf_storage = registry_factory()
+        if self.username and not self.is_machine:
+            uid = get_uid_by_username(self.username)
+            dict_dconf_db = dconf_storage.get_dictionary_from_dconf_file_db(uid)
+        else:
+            dict_dconf_db = dconf_storage.get_dictionary_from_dconf_file_db()
+        return dict_dconf_db
+
+    def filling_settings(self):
+        """Filling in settings"""
+        dict_gpupdate_key = string_to_literal_eval(
+            self.dict_dconf_db.get('Software/BaseALT/Policies/GPUpdate',{}))
+        self.plugins_enable = dict_gpupdate_key.get('Plugins')
+        self.plugins_list = dict_gpupdate_key.get('PluginsList')
+
+    def check_enabled_plugin(self, plugin_name):
+        """Check if the plugin is enabled"""
+        if not self.plugins_enable:
+            return False
+
+        if isinstance(self.plugins_list, list):
+            return plugin_name in self.plugins_list
+        # if the list is missing or not a list, consider the plugin enabled
+        return True
 
     def run(self):
-        #self.plugins.get('adp', plugin('adp')).run()
-        self.plugins.get('roles', plugin('roles')).run()
+        """Run the plugins with appropriate privileges"""
+        for plugin_obj in self.plugins:
+            if self.is_valid_api_object(plugin_obj):
+                # Set execution context for plugins that support it
+                if hasattr(plugin_obj, 'set_context'):
+                    plugin_obj.set_context(self.is_machine, self.username)
+                if self.check_enabled_plugin(plugin_obj.plugin_name):
+                    log('D4', {'plugin_name': plugin_obj.plugin_name})
 
+                    # Use apply_user for user context, apply for machine context
+                    if not self.is_machine and self.username:
+                        result = plugin_obj.apply_user(self.username)
+                        if result is False:
+                            log('W46', {'plugin_name': plugin_obj.plugin_name, 'username': self.username})
+                    else:
+                        plugin_obj.apply()
+                else:
+                    log('D236', {'plugin_name': plugin_obj.plugin_name})
+            else:
+                log('W44', {'plugin_name': getattr(plugin_obj, 'plugin_name', 'unknown')})
+
+    def load_plugins(self):
+        """Load plugins from multiple directories"""
+        plugins = []
+
+        # Default plugin directories
+        plugin_dirs = [
+            # Frontend plugins
+            Path(gpupdate_plugins_path()).absolute(),
+            # System-wide plugins
+            Path("/usr/lib/gpupdate/plugins")
+        ]
+
+        for plugin_dir in plugin_dirs:
+            if plugin_dir.exists() and plugin_dir.is_dir():
+                plugins.extend(self._load_plugins_from_directory(plugin_dir))
+
+        return plugins
+
+    def _load_plugins_from_directory(self, directory):
+        """Load plugins from a specific directory"""
+        plugins = []
+
+        for file_path in directory.glob("*.py"):
+            if file_path.name == "__init__.py":
+                continue
+
+            try:
+                plugin_obj = self._load_plugin_from_file(file_path)
+                if plugin_obj:
+                    plugins.append(plugin_obj)
+            except Exception as exc:
+                log('W45', {'plugin_file': file_path.name, 'error': str(exc)})
+
+        return plugins
+
+    def _load_plugin_from_file(self, file_path):
+        """Load a single plugin from a Python file"""
+        module_name = file_path.stem
+
+        # Load the module
+        spec = importlib.util.spec_from_file_location(module_name, file_path)
+        if not spec or not spec.loader or module_name in self.list_plugins:
+            return None
+        # Save the list of names to prevent repetition
+        self.list_plugins.append(module_name)
+
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+
+
+        # Find factory functions based on context
+        factory_funcs = []
+        target_factory_names = []
+
+        if self.is_machine:
+            target_factory_names = ['create_machine_applier', 'create_plugin']
+        else:
+            target_factory_names = ['create_user_applier', 'create_plugin']
+
+        for name, obj in inspect.getmembers(module):
+            if (inspect.isfunction(obj) and
+                name.lower() in target_factory_names and
+                callable(obj)):
+                factory_funcs.append(obj)
+
+        # Create plugin instance
+
+
+        if factory_funcs:
+            # Use factory function if available
+            plugin_instance = factory_funcs[0](self.dict_dconf_db, self.username, self.file_cache)
+        else:
+            # No suitable factory function found for this context
+            return None
+
+        # Auto-detect locale directory for this plugin and initialize/update logger
+        if hasattr(plugin_instance, '_init_plugin_log'):
+            plugin_file = file_path
+            plugin_dir = plugin_file.parent
+
+            # First try: locale directory in plugin's own directory
+            locale_candidate = plugin_dir / 'locale'
+
+            # Second try: common locale directory for frontend plugins
+            if not locale_candidate.exists() and 'frontend_plugins' in str(plugin_dir):
+                frontend_plugins_dir = plugin_dir.parent
+                common_locale_dir = frontend_plugins_dir / 'locale'
+                if common_locale_dir.exists():
+                    locale_candidate = common_locale_dir
+
+            # Third try: system-wide gpupdate plugins locale directory
+            if not locale_candidate.exists():
+                gpupdate_plugins_locale = Path('/usr/lib/gpupdate/plugins/locale')
+                if gpupdate_plugins_locale.exists():
+                    locale_candidate = gpupdate_plugins_locale
+
+            if locale_candidate.exists():
+                # If logger already exists, reinitialize it with the correct locale directory
+                if hasattr(plugin_instance, '_log') and plugin_instance._log is not None:
+                    # Save message_dict and domain from existing logger
+                    message_dict = getattr(plugin_instance._log, 'message_dict', None)
+                    domain = getattr(plugin_instance._log, 'domain', None)
+
+                    # Reinitialize logger with proper locale directory
+                    plugin_instance._log = None
+                else:
+                    message_dict = None
+                    domain = None
+
+                # Get domain from plugin instance or use class name
+                if not domain:
+                    domain = getattr(plugin_instance, 'domain', plugin_instance.__class__.__name__.lower())
+
+                # Initialize plugin logger with the found locale directory
+                plugin_instance._init_plugin_log(
+                    message_dict=message_dict,
+                    locale_dir=str(locale_candidate),
+                    domain=domain
+                )
+
+        return plugin_instance
+
+        return None
+
+    def is_valid_api_object(self, obj):
+        """Check if the object is a valid plugin API object"""
+        return isinstance(obj, plugin)

gpoa/plugin/roles.py

@@ -16,12 +16,17 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-from util.roles import fill_roles
+from gpoa.util.roles import fill_roles
+from .plugin import plugin
 
-class roles:
-    def __init__(self):
-        pass
+
+class roles(plugin):
+    def __init__(self, user=None):
+        super().__init__(user)
+        self.plugin_name = "roles"
 
     def run(self):
-        fill_roles()
+        # Roles plugin logic would go here
+        # For now, just pass as the original was doing nothing
+        pass
 

gpoa/storage/__init__.py

@@ -17,7 +17,8 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 
-from storage.dconf_registry import Dconf_registry
+from .dconf_registry import Dconf_registry
+
 
 def registry_factory(registry_name='', envprofile=None , username=None):
     if username:

gpoa/storage/cache.py

@@ -18,6 +18,7 @@
 
 from abc import ABC
 
+
 class cache(ABC):
     def __init__(self):
         pass

gpoa/storage/dconf_registry.py

@@ -16,24 +16,29 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import subprocess
-from pathlib import Path
-from util.util import (string_to_literal_eval,
-                       try_dict_to_literal_eval,
-                       touch_file, get_uid_by_username,
-                       add_prefix_to_keys,
-                       remove_keys_with_prefix,
-                       clean_data)
-from util.paths import get_dconf_config_path
-from util.logging import log
-import re
 from collections import OrderedDict
 import itertools
-from gpt.dynamic_attributes import RegistryKeyMetadata
+from pathlib import Path
+import re
+import subprocess
+
 import gi
+from gpoa.gpt.dynamic_attributes import RegistryKeyMetadata
+from gpoa.util.logging import log
+from gpoa.util.paths import get_dconf_config_path
+from gpoa.util.util import (
+    add_prefix_to_keys,
+    clean_data,
+    get_uid_by_username,
+    remove_keys_with_prefix,
+    string_to_literal_eval,
+    touch_file,
+    try_dict_to_literal_eval,
+)
+
 gi.require_version("Gvdb", "1.0")
 gi.require_version("GLib", "2.0")
-from gi.repository import Gvdb, GLib
+from gi.repository import GLib, Gvdb
 
 
 class PregDconf():
@@ -690,8 +695,12 @@ def create_dconf_ini_file(filename, data, uid=None, nodomain=None):
     '''
     with open(filename, 'a' if nodomain else 'w') as file:
         for section, section_data in data.items():
+            if not section:
+                continue
             file.write(f'[{section}]\n')
             for key, value in section_data.items():
+                if not key:
+                    continue
                 if isinstance(value, int):
                     file.write(f'{key} = {value}\n')
                 else:

gpoa/storage/fs_file_cache.py

@@ -19,16 +19,16 @@
 
 import os
 import os.path
-import tempfile
 from pathlib import Path
+import tempfile
+
 import smbc
-
-
-from util.logging import log
-from util.paths import file_cache_dir, file_cache_path_home, UNCPath
 from util.exceptions import NotUNCPathError
+from util.logging import log
+from util.paths import UNCPath, file_cache_dir, file_cache_path_home
 from util.util import get_machine_name
 
+
 class fs_file_cache:
     __read_blocksize = 4096
 

gpoa/storage/registry.py

@@ -18,6 +18,7 @@
 
 from abc import ABC
 
+
 class registry(ABC):
     def __init__(self, db_name):
         pass

gpoa/util/arguments.py

@@ -16,9 +16,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+from enum import Enum, IntEnum
 import logging
 import logging.handlers
-from enum import IntEnum, Enum
 
 from .logging import log
 

gpoa/util/config.py

@@ -19,10 +19,8 @@
 
 from configparser import ConfigParser
 
-from .util import (
-      get_backends
-    , get_default_policy_name
-)
+from .util import get_backends, get_default_policy_name
+
 
 class GPConfig:
     __config_path = '/etc/gpupdate/gpupdate.ini'

gpoa/util/dbus.py

@@ -17,10 +17,10 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import dbus
+from storage import Dconf_registry
 
 from .logging import log
 from .users import is_root
-from storage import Dconf_registry
 
 
 class dbus_runner:

gpoa/util/gpoa_ini_parsing.py

@@ -16,15 +16,25 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-from configobj import (ConfigObj, NestingError, Section,
-                        DuplicateError, ParseError, UnreprError,
-                        UnknownType,UnreprError,
-                        BOM_UTF8, DEFAULT_INDENT_TYPE, BOM_LIST,
-                        match_utf8, unrepr)
-import six
+import os
 import re
 import sys
-import os
+
+from configobj import (
+    BOM_LIST,
+    BOM_UTF8,
+    DEFAULT_INDENT_TYPE,
+    ConfigObj,
+    DuplicateError,
+    NestingError,
+    ParseError,
+    Section,
+    UnknownType,
+    UnreprError,
+    match_utf8,
+    unrepr,
+)
+import six
 
 # Michael Foord: fuzzyman AT voidspace DOT org DOT uk
 # Nicola Larosa: nico AT tekNico DOT net

gpoa/util/ipa.py

@@ -0,0 +1,68 @@
+#
+# GPOA - GPO Applier for Linux
+#
+# Copyright (C) 2019-2020 BaseALT Ltd.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import configparser
+import os
+from ipalib import api
+
+class ipaopts:
+    def __init__(self):
+        """Initialize the class and load the FreeIPA config file."""
+        self.config_file = "/etc/ipa/default.conf"
+        self.config = configparser.ConfigParser()
+
+        if not os.path.exists(self.config_file):
+            raise FileNotFoundError(f"Config file for Freeipa{self.config_file} not found.")
+
+        self.config.read(self.config_file)
+
+    def get_realm(self):
+        """Return the Kerberos realm from the config."""
+        try:
+            return self.config.get('global', 'realm')
+        except (configparser.NoSectionError, configparser.NoOptionError):
+            raise ValueError("Realm not found in config file.")
+
+    def get_domain(self):
+        """Return the domain from the config."""
+        try:
+            return self.config.get('global', 'domain')
+        except (configparser.NoSectionError, configparser.NoOptionError):
+            raise ValueError("Domain not found in config file.")
+
+    def get_server(self):
+        """
+        Return the FreeIPA PDC Emulator server from API.
+        """
+        try:
+            result = api.Command.gpmaster_show_pdc()
+            pdc_server = result['result']['pdc_emulator']
+            return pdc_server
+        except Exception as e:
+            pass
+
+    def get_machine_name(self):
+        """Return the host from the config."""
+        try:
+            return self.config.get('global', 'host')
+        except (configparser.NoSectionError, configparser.NoOptionError):
+            raise ValueError("Host not found in config file.")
+
+    def get_cache_dir(self):
+        """Return the cache directory path."""
+        return "/var/cache/freeipa/gpo_cache"

gpoa/util/ipacreds.py

@@ -0,0 +1,102 @@
+#
+# GPOA - GPO Applier for Linux
+#
+# Copyright (C) 2019-2025 BaseALT Ltd.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>
+
+import smbc
+import os
+import re
+from ipalib import api
+from pathlib import Path
+from storage.dconf_registry import Dconf_registry, extract_display_name_version
+from util.util import get_uid_by_username
+from .ipa import ipaopts
+from util.logging import log
+
+class ipacreds(ipaopts):
+    def __init__(self):
+        super().__init__()
+        self.smb_context = smbc.Context(use_kerberos=True)
+        self.gpo_list = []
+
+    def update_gpos(self, username):
+        gpos = []
+        try:
+            if not api.isdone('bootstrap'):
+                api.bootstrap(context='cli')
+            if not api.isdone('finalize'):
+                api.finalize()
+            api.Backend.rpcclient.connect()
+            try:
+                server = self.get_server()
+                is_machine = (username == self.get_machine_name())
+                if is_machine:
+                    result = api.Command.chain_resolve_for_host(username)
+                else:
+                    result = api.Command.chain_resolve_for_user(username)
+                policies_list = result["result"]
+                try:
+                    if is_machine:
+                        dconf_dict = Dconf_registry.get_dictionary_from_dconf_file_db(save_dconf_db=True)
+                    else:
+                        uid = get_uid_by_username(username)
+                        dconf_dict = Dconf_registry.get_dictionary_from_dconf_file_db(uid, save_dconf_db=True)
+                    dict_gpo_name_version = extract_display_name_version(dconf_dict, username)
+                except Exception as exc:
+                    logdata = {'exc': str(exc)}
+                    log('D235', logdata)
+                    dict_gpo_name_version = {}
+
+                for policy in policies_list:
+                    class SimpleGPO:
+                        def __init__(self, policy_data):
+                            self.display_name = policy_data.get('name', 'Unknown')
+                            self.file_sys_path = policy_data.get('file_system_path', '')
+                            self.version = int(policy_data.get('version', 0))
+                            self.flags = int(policy_data.get('flags', 0))
+                            self.link = policy_data.get('link', 'Unknown')
+                            guid_match = re.search(r'\{[^}]+\}', self.file_sys_path)
+                            self.name = guid_match.group(0) if guid_match else f"policy_{id(self)}"
+
+                    gpo = SimpleGPO(policy)
+                    if (gpo.display_name in dict_gpo_name_version.keys() and
+                        dict_gpo_name_version.get(gpo.display_name, {}).get('version') == str(gpo.version)):
+
+                        cached_path = dict_gpo_name_version.get(gpo.display_name, {}).get('correct_path')
+                        if cached_path and Path(cached_path).exists():
+                            gpo.file_sys_path = cached_path
+                            ldata = {'gpo_name': gpo.display_name, 'gpo_uuid': gpo.name, 'file_sys_path_cache': True}
+                        else:
+                            ldata = {'gpo_name': gpo.display_name, 'gpo_uuid': gpo.name, 'file_sys_path': gpo.file_sys_path}
+                    else:
+                        ldata = {'gpo_name': gpo.display_name, 'gpo_uuid': gpo.name, 'file_sys_path': gpo.file_sys_path}
+                    gpos.append(gpo)
+            finally:
+                api.Backend.rpcclient.disconnect()
+
+        except Exception as exc:
+            logdata = {'exc': str(exc)}
+            log('E80', logdata)
+        return gpos, server
+
+    def get_domain(self):
+        return super().get_domain()
+
+    def get_server(self):
+        return super().get_server()
+
+    def get_cache_dir(self):
+        return super().get_cache_dir()

gpoa/util/kerberos.py

@@ -19,23 +19,34 @@
 import os
 import subprocess
 
-from .util import get_machine_name
 from .logging import log
 from .samba import smbopts
+from .util import get_machine_name
+from .ipa import ipaopts
 
 
-def machine_kinit(cache_name=None):
+def machine_kinit(cache_name=None, backend_type=None):
     '''
     Perform kinit with machine credentials
     '''
-    opts = smbopts()
-    host = get_machine_name()
-    realm = opts.get_realm()
-    with_realm = '{}@{}'.format(host, realm)
-    os.environ['KRB5CCNAME'] = 'FILE:{}'.format(cache_name)
-    kinit_cmd = ['kinit', '-k', with_realm]
+    if backend_type == 'freeipa':
+        keytab_path = '/etc/samba/samba.keytab'
+        opts = ipaopts()
+        host = "cifs/" + opts.get_machine_name()
+        realm = opts.get_realm()
+        with_realm = '{}@{}'.format(host, realm)
+        kinit_cmd = ['kinit', '-kt', keytab_path, with_realm]
+    else:
+        opts = smbopts()
+        host = get_machine_name()
+        realm = opts.get_realm()
+        with_realm = '{}@{}'.format(host, realm)
+        kinit_cmd = ['kinit', '-k', with_realm]
+
     if cache_name:
+        os.environ['KRB5CCNAME'] = 'FILE:{}'.format(cache_name)
         kinit_cmd.extend(['-c', cache_name])
+
     proc = subprocess.Popen(kinit_cmd)
     proc.wait()
 

gpoa/util/logging.py

@@ -16,11 +16,11 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import json
 import datetime
+import json
 import logging
 
-from messages import message_with_code
+from gpoa.messages import message_with_code
 
 
 class encoder(json.JSONEncoder):
@@ -50,12 +50,47 @@ class slogm(object):
         now = str(datetime.datetime.now().isoformat(sep=' ', timespec='milliseconds'))
         args = {}
         args.update(self.kwargs)
-        result = '{}|{}|{}'.format(now, self.message, args)
+        if args:
+            result = '{}|{}|{}'.format(now, self.message, args)
+        else:
+            result = '{}|{}'.format(now, self.message)
 
         return result
 
 def log(message_code, data=None):
-    mtype = message_code[0]
+    # New simplified format: message_code can be a single character for level
+    # and data should contain the actual message
+    if isinstance(message_code, str) and len(message_code) == 1:
+        # Simple level-based logging with message in data
+        mtype = message_code
+
+        if data and isinstance(data, dict):
+            # Extract message from data
+            message = data.get('message', 'No message provided')
+            plugin_name = data.get('plugin', 'UnknownPlugin')
+            log_data = data.get('data', {})
+
+            # Format the log message
+            log_message = f"[{plugin_name}] {message}"
+            if log_data:
+                log_message += f" | {log_data}"
+
+            if 'I' == mtype:
+                logging.info(slogm(log_message, data))
+            elif 'W' == mtype:
+                logging.warning(slogm(log_message, data))
+            elif 'E' == mtype:
+                logging.error(slogm(log_message, data))
+            elif 'F' == mtype:
+                logging.fatal(slogm(log_message, data))
+            elif 'D' == mtype:
+                logging.debug(slogm(log_message, data))
+            else:
+                logging.info(slogm(log_message, data))
+            return
+
+    # Fallback to old format for compatibility
+    mtype = message_code[0] if isinstance(message_code, str) and len(message_code) > 0 else 'E'
 
     if 'I' == mtype:
         logging.info(slogm(message_with_code(message_code), data))

gpoa/util/paths.py

@@ -17,11 +17,12 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import pathlib
 import os
+import pathlib
 from pathlib import Path
 from urllib.parse import urlparse
-from util.util import get_homedir
+
+from .util import get_homedir
 
 from .config import GPConfig
 from .exceptions import NotUNCPathError
@@ -109,6 +110,12 @@ def get_dconf_config_file(uid = None):
 def get_desktop_files_directory():
     return '/usr/share/applications'
 
+def gpupdate_plugins_path():
+    '''
+    Returns path to gpupdate frontend plugins directory
+    '''
+    return os.path.join(os.path.dirname(__file__), '..', 'frontend_plugins')
+
 class UNCPath:
     def __init__(self, path):
         self.path = path

gpoa/util/preg.py

@@ -18,9 +18,9 @@
 
 
 from xml.etree import ElementTree
-from storage.dconf_registry import load_preg_dconf
 
 from samba.gp_parse.gp_pol import GPPolParser
+from storage.dconf_registry import load_preg_dconf
 
 from .logging import log
 

gpoa/util/rpm.py

@@ -18,6 +18,7 @@
 
 
 import subprocess
+
 import rpm
 
 

gpoa/util/samba.py

@@ -19,6 +19,7 @@
 
 import optparse
 import socket
+
 from samba import getopt as options
 
 

gpoa/util/sid.py

@@ -18,13 +18,15 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 from enum import Enum
-
 import pwd
 import subprocess
+
 import pysss_nss_idmap
 from storage.dconf_registry import Dconf_registry
 
 from .logging import log
+from .util import get_user_info
+
 
 def wbinfo_getsid(domain, user):
     '''
@@ -68,7 +70,7 @@ def get_sid(domain, username, is_machine = False):
     if not domain:
         found_uid = 0
         if not is_machine:
-            found_uid = pwd.getpwnam(username).pw_uid
+            found_uid = get_user_info(username).pw_uid
         return '{}-{}'.format(get_local_sid_prefix(), found_uid)
 
     # domain user

gpoa/util/signals.py

@@ -23,6 +23,7 @@ import signal
 from .arguments import ExitCodeUpdater
 from .kerberos import machine_kdestroy
 
+
 def signal_handler(sig_number, frame):
     print('Received signal, exiting gracefully')
     # Ignore extra signals

gpoa/util/system.py

@@ -16,14 +16,17 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+import json
+import locale
 import os
-import sys
 import pwd
 import signal
 import subprocess
-import locale
-from .logging import log
+import sys
+
 from .dbus import dbus_session
+from .logging import log
+from .util import get_user_info
 
 
 def set_privileges(username, uid, gid, groups, home):
@@ -55,21 +58,29 @@ def set_privileges(username, uid, gid, groups, home):
 
     os.chdir(home)
 
-    logdata = {}
-    logdata['uid'] = uid
-    logdata['gid'] = gid
-    logdata['username'] = username
+    logdata = {'uid': uid, 'gid': gid, 'username': username}
     log('D37', logdata)
 
 
 def with_privileges(username, func):
     '''
-    Run supplied function with privileges for specified username.
+    Run supplied function with privileges for specified username and return JSON result of func().
     '''
-    if not os.getuid() == 0:
+    if os.getuid() != 0:
         raise Exception('Not enough permissions to drop privileges')
 
-    user_pw = pwd.getpwnam(username)
+    # Resolve user information with retry
+    max_retries = 3
+    for attempt in range(max_retries):
+        try:
+            user_pw = get_user_info(username)
+            break
+        except KeyError:
+            if attempt == max_retries - 1:
+                raise
+            import time
+            time.sleep(0.5)  # Wait before retry
+
     user_uid = user_pw.pw_uid
     user_gid = user_pw.pw_gid
     user_groups = os.getgrouplist(username, user_gid)
@@ -78,60 +89,74 @@ def with_privileges(username, func):
     if not os.path.isdir(user_home):
         raise Exception('User home directory not exists')
 
+    # Create a pipe for inter-process communication
+    rfd, wfd = os.pipe()
+
     pid = os.fork()
     if pid > 0:
+        # --- Parent process ---
+        os.close(wfd)
         log('D54', {'pid': pid})
-        waitpid, status = os.waitpid(pid, 0)
 
+        # Wait for child process
+        waitpid, status = os.waitpid(pid, 0)
         code = os.WEXITSTATUS(status)
         if code != 0:
             raise Exception('Error in forked process ({})'.format(status))
 
-        return
+        # Read data from pipe
+        data = os.read(rfd, 10_000_000)
+        os.close(rfd)
 
-    # We need to return child error code to parent
-    result = 0
+        if not data:
+            return None
+
+        # Deserialize JSON
+        return json.loads(data.decode("utf-8"))
+
+    # --- Child process ---
+    os.close(rfd)
+
+    result = None
+    exitcode = 0
     dbus_pid = -1
     dconf_pid = -1
     try:
-
         # Drop privileges
         set_privileges(username, user_uid, user_gid, user_groups, user_home)
 
-        # Run the D-Bus session daemon in order D-Bus calls to work
+        # Start dbus-launch to get session bus
         proc = subprocess.Popen(
             'dbus-launch',
             shell=True,
             stdout=subprocess.PIPE,
-            stderr=subprocess.STDOUT)
+            stderr=subprocess.STDOUT
+        )
         for var in proc.stdout:
             sp = var.decode('utf-8').split('=', 1)
-            os.environ[sp[0]] = sp[1][:-1]
+            os.environ[sp[0]] = sp[1].strip()
 
-        # Save pid of dbus-daemon
+        # Save DBus session PID
         dbus_pid = int(os.environ['DBUS_SESSION_BUS_PID'])
 
-        # Run user appliers
-        func()
+        # Execute target function and expect JSON-serializable result
+        result = func()
 
-        # Save pid of dconf-service
-        dconf_connection = "ca.desrt.dconf"
+        # Try to get dconf-service PID
         try:
             session = dbus_session()
-            dconf_pid = session.get_connection_pid(dconf_connection)
+            dconf_pid = session.get_connection_pid("ca.desrt.dconf")
         except Exception:
             pass
 
     except Exception as exc:
-        logdata = {}
-        logdata['msg'] = str(exc)
-        log('E33', logdata)
-        result = 1;
+        log('E33', {'msg': str(exc)})
+        exitcode = 1
     finally:
-        logdata = {}
-        logdata['dbus_pid'] = dbus_pid
-        logdata['dconf_pid'] = dconf_pid
-        log('D56', logdata)
+        # Log dbus/dconf info
+        log('D56', {'dbus_pid': dbus_pid, 'dconf_pid': dconf_pid})
+
+        # Cleanup processes
         if dbus_pid > 0:
             os.kill(dbus_pid, signal.SIGHUP)
         if dconf_pid > 0:
@@ -139,5 +164,11 @@ def with_privileges(username, func):
         if dbus_pid > 0:
             os.kill(dbus_pid, signal.SIGTERM)
 
-    sys.exit(result)
+    # Serialize result to JSON and send to parent
+    try:
+        os.write(wfd, json.dumps(result).encode("utf-8"))
+    except Exception:
+        pass
+    os.close(wfd)
 
+    sys.exit(exitcode)

gpoa/util/util.py

@@ -17,13 +17,15 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 
-import os
-import pwd
-import subprocess
-import re
-from pathlib import Path
-from .samba import smbopts
 import ast
+import os
+from pathlib import Path
+import pwd
+import re
+import subprocess
+from functools import lru_cache
+
+from .samba import smbopts
 
 
 def get_machine_name():
@@ -54,11 +56,27 @@ def traverse_dir(root_dir):
     return filelist
 
 
+@lru_cache(maxsize=128)
+def get_user_info(username):
+    '''
+    Get user information with caching.
+    '''
+    try:
+        return pwd.getpwnam(username)
+    except KeyError as exc:
+        # Clear cache to retry on next call
+        get_user_info.cache_clear()
+        # Log the error for debugging
+        from .logging import log
+        logdata = {'username': username, 'exception': str(exc)}
+        log('D237', logdata)
+        raise
+
 def get_homedir(username):
     '''
     Query password database for user's home directory.
     '''
-    return pwd.getpwnam(username).pw_dir
+    return get_user_info(username).pw_dir
 
 def homedir_exists(username):
     '''
@@ -79,8 +97,9 @@ def mk_homedir_path(username, homedir_path):
     Create subdirectory in user's $HOME.
     '''
     homedir = get_homedir(username)
-    uid = pwd.getpwnam(username).pw_uid
-    gid = pwd.getpwnam(username).pw_gid
+    user_info = get_user_info(username)
+    uid = user_info.pw_uid
+    gid = user_info.pw_gid
 
     elements = homedir_path.split('/')
     longer_path = homedir
@@ -106,7 +125,7 @@ def get_backends():
     '''
     Get the list of backends supported by GPOA
     '''
-    return ['local', 'samba']
+    return ['local', 'samba', 'freeipa']
 
 def get_default_policy_name():
     '''
@@ -192,7 +211,7 @@ def touch_file(filename):
 
 def get_uid_by_username(username):
     try:
-        user_info = pwd.getpwnam(username)
+        user_info = get_user_info(username)
         return user_info.pw_uid
     except KeyError:
         return None
@@ -250,7 +269,7 @@ def check_local_user_exists(username):
     """
     try:
         # Try to get user information from the password database
-        pwd.getpwnam(username)
+        get_user_info(username)
         return True
     except:
         return False

gpoa/util/windows.py

@@ -19,33 +19,38 @@
 
 import os
 from pathlib import Path
-from samba.credentials import Credentials
+
 from samba import NTSTATUSError
+from samba.credentials import Credentials
 
 try:
-    from samba.gpclass import get_dc_hostname, check_refresh_gpo_list
+    from samba.gpclass import check_refresh_gpo_list, get_dc_hostname
 except ImportError:
     from samba.gp.gpclass import get_dc_hostname, check_refresh_gpo_list, get_gpo_list
 
-from samba.netcmd.common import netcmd_get_domain_infos_via_cldap
-from storage.dconf_registry import Dconf_registry, extract_display_name_version
-import samba.gpo
+import ipaddress
+import optparse
+import random
+
+import ldb
+import netifaces
+from samba.auth import system_session
+import samba.gpo
+from samba.net import Net
+from samba.netcmd.common import netcmd_get_domain_infos_via_cldap
+from samba.param import LoadParm
+from samba.samdb import SamDB
+from storage.dconf_registry import Dconf_registry, extract_display_name_version
+from util.system import with_privileges
+
+from gpoa.storage import registry_factory
 
-from .xdg import (
-      xdg_get_desktop
-)
-from .util import get_homedir, get_uid_by_username
 from .exceptions import GetGPOListFail
 from .logging import log
 from .samba import smbopts
-from gpoa.storage import registry_factory
-from samba.samdb import SamDB
-from samba.auth import system_session
-import optparse
-import ldb
-import ipaddress
-import netifaces
-import random
+from .util import get_homedir, get_uid_by_username
+from .xdg import xdg_get_desktop
+
 
 class smbcreds (smbopts):
 
@@ -113,18 +118,22 @@ class smbcreds (smbopts):
         hostname
         '''
         gpos = []
-        if Dconf_registry.get_info('machine_name') == username:
-            dconf_dict = Dconf_registry.get_dictionary_from_dconf_file_db(save_dconf_db=True)
-            self.is_machine = True
-        else:
-            dconf_dict = Dconf_registry.get_dictionary_from_dconf_file_db(get_uid_by_username(username), save_dconf_db=True)
-            self.is_machine = False
-        if not self.is_machine and Dconf_registry.get_info('trust'):
-            # TODO: Always returning an empty list here.
-            # Need to implement fetching policies from the trusted domain.
-            return []
+        dconf_dict = self.get_dconf_dict(username)
+
+        if not self.is_machine and Dconf_registry.get_info('trust'):
+            try:
+                info = with_privileges(username, get_kerberos_domain_info)
+                pdc_dns_name = info.get('pdc_dns_name')
+                if pdc_dns_name:
+                    Dconf_registry.set_info('pdc_dns_name', pdc_dns_name)
+                    gpos = get_gpo_list(pdc_dns_name, self.creds, self.lp, username)
+                    logdata = {'username': username}
+                    log('I12', logdata)
+                    self.process_gpos(gpos, username, dconf_dict)
+                    return gpos
+            except Exception as exc:
+                pass
 
-        dict_gpo_name_version = extract_display_name_version(dconf_dict, username)
         try:
             log('D48')
             ads = samba.gpo.ADS_STRUCT(self.selected_dc, self.lp, self.creds)
@@ -133,17 +142,7 @@ class smbcreds (smbopts):
                 gpos = ads.get_gpo_list(username)
                 logdata = {'username': username}
                 log('I1', logdata)
-                for gpo in gpos:
-                    # These setters are taken from libgpo/pygpo.c
-                    # print(gpo.ds_path) # LDAP entry
-                    if gpo.display_name in dict_gpo_name_version.keys() and dict_gpo_name_version.get(gpo.display_name, {}).get('version') == str(getattr(gpo, 'version', None)):
-                        if Path(dict_gpo_name_version.get(gpo.display_name, {}).get('correct_path')).exists():
-                            gpo.file_sys_path = ''
-                            ldata = {'gpo_name': gpo.display_name, 'gpo_uuid': gpo.name, 'file_sys_path_cache': True}
-                            log('I11', ldata)
-                            continue
-                    ldata = {'gpo_name': gpo.display_name, 'gpo_uuid': gpo.name, 'file_sys_path': gpo.file_sys_path}
-                    log('I2', ldata)
+                self.process_gpos(gpos, username, dconf_dict)
 
         except Exception as exc:
             if self.selected_dc != self.pdc_emulator_server:
@@ -153,6 +152,48 @@ class smbcreds (smbopts):
 
         return gpos
 
+    def get_dconf_dict(self, username):
+        """
+        Retrieve dconf dictionary either for the machine itself
+        or for a specific user depending on the given username
+        """
+        if Dconf_registry.get_info('machine_name') == username:
+            dconf_dict = Dconf_registry.get_dictionary_from_dconf_file_db(save_dconf_db=True)
+            self.is_machine = True
+        else:
+            dconf_dict = Dconf_registry.get_dictionary_from_dconf_file_db(get_uid_by_username(username), save_dconf_db=True)
+            self.is_machine = False
+        return dconf_dict
+
+
+    def process_gpos(self, gpos, username, dconf_dict):
+        """
+        Process GPO objects and update their file_sys_path if cached version is valid
+        """
+        dict_gpo_name_version = extract_display_name_version(dconf_dict, username)
+        for gpo in gpos:
+            # These setters are taken from libgpo/pygpo.c
+            cached_info = dict_gpo_name_version.get(gpo.display_name, {})
+
+            # Check if GPO version matches and cached path exists
+            if cached_info.get('version') == str(getattr(gpo, 'version', None)):
+                if Path(cached_info.get('correct_path', '')).exists():
+                    gpo.file_sys_path = ''
+                    logdata = {
+                        'gpo_name': gpo.display_name,
+                        'gpo_uuid': gpo.name,
+                        'file_sys_path_cache': True
+                    }
+                    log('I11', logdata)
+                    continue
+            # Default log if no cache hit
+            logdata = {
+                'gpo_name': gpo.display_name,
+                'gpo_uuid': gpo.name,
+                'file_sys_path': gpo.file_sys_path
+            }
+            log('I2', logdata)
+
     def update_gpos(self, username):
 
         list_selected_dc = set()
@@ -178,7 +219,13 @@ class smbcreds (smbopts):
             logdata['dc'] = self.selected_dc
             try:
                 log('D49', logdata)
-                check_refresh_gpo_list(self.selected_dc, self.lp, self.creds, gpos)
+                if not self.is_machine and Dconf_registry.get_info('trust'):
+                    check_refresh_gpo_list(Dconf_registry.get_info('pdc_dns_name'),
+                                           self.lp,
+                                           self.creds,
+                                           gpos)
+                else:
+                    check_refresh_gpo_list(self.selected_dc, self.lp, self.creds, gpos)
                 log('D50', logdata)
                 list_selected_dc.clear()
             except NTSTATUSError as smb_exc:
@@ -363,3 +410,28 @@ def check_scroll_enabled():
         return bool(int(data))
     else:
         return False
+
+def get_kerberos_domain_info():
+    """
+    Retrieve information about the AD domain using Kerberos tickets
+    """
+    try:
+        # Initialize credentials and load Samba parameters
+        creds = Credentials()
+        creds.guess()
+        lp = LoadParm()
+
+        # Get current realm
+        realm = creds.get_realm()
+
+        # Query domain controller
+        net = Net(creds, lp, server=None)
+        info = net.finddc(flags=0, domain=realm)
+
+        return {
+            "pdc_dns_name": info.pdc_dns_name,
+            "principal": creds.get_principal(),
+        }
+
+    except Exception as exc:
+        return {'Exception':exc}

gpoa/util/xdg.py

@@ -18,9 +18,12 @@
 
 
 import os
+
 from messages import message_with_code
-from .util import get_homedir
+
 from .logging import log
+from .util import get_homedir
+
 
 def xdg_get_desktop(username, homedir = None):
     if username:

gpupdate.spec

@@ -1,6 +1,7 @@
 %define _unpackaged_files_terminate_build 1
 #add_python3_self_prov_path %buildroot%python3_sitelibdir/gpoa
 
+%add_python3_req_skip applaer.systemd
 %add_python3_req_skip backend
 %add_python3_req_skip frontend.frontend_manager
 %add_python3_req_skip gpt.envvars
@@ -34,6 +35,8 @@
 %add_python3_req_skip util.windows
 %add_python3_req_skip util.xml
 %add_python3_req_skip util.gpoa_ini_parsing
+%add_python3_req_skip util.ipacreds
+%add_python3_req_skip frontend.appliers.ini_file
 
 Name: gpupdate
 Version: 0.13.4
@@ -63,10 +66,13 @@ Requires: dconf-profile
 Requires: packagekit
 Requires: dconf
 Requires: libgvdb-gir
+Requires: freeipa-client-samba
 # This is needed by shortcuts_applier
 Requires: desktop-file-utils
 # This is needed for smb file cache support
 Requires: python3-module-smbc >= 1.0.23-alt3
+# This is needed for laps
+Requires: python3-module-libcng_dpapi
 
 Source0: %name-%version.tar
 
@@ -88,6 +94,12 @@ msgfmt \
 	-o %buildroot%python3_sitelibdir/gpoa/locale/ru_RU/LC_MESSAGES/gpoa.mo \
 	%buildroot%python3_sitelibdir/gpoa/locale/ru_RU/LC_MESSAGES/gpoa.po
 
+# Generate plugin translations
+for po_file in %buildroot%python3_sitelibdir/gpoa/frontend_plugins/locale/*/LC_MESSAGES/*.po; do
+	mo_file="${po_file%.po}.mo"
+	msgfmt -o "$mo_file" "$po_file"
+done
+
 mkdir -p \
 	%buildroot%_bindir/ \
 	%buildroot%_sbindir/ \

tools/parsing_chrom_admx_intvalues.py

@@ -6,6 +6,7 @@
 import sys
 from xml.etree import ElementTree
 
+
 def get_child(parent, desires:list, list_data_pol:list):
     if parent.tag == 'decimal':
         list_data_pol.append(parent.get('value'))