sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-27 22:50:26 +03:00
Code

gpo: Apply Group Policy Sudo Rights

Browse Source 
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
This commit is contained in:
David Mulder 2020-06-26 12:35:20 -06:00 committed by David Mulder
parent 9679ba9577
commit 88b6266168
5 changed files with 78 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libgpo/admx/en-US/samba.adml
View File

@ -12,10 +12,12 @@
<string id="POL_825D441F_905E_4C7E_9E4B_03013697C6C1">Hourly</string>
<string id="POL_D298F3BD_44D9_426D_AF11_3163D31582F6">Monthly</string>
<string id="POL_3ACC7ECD_8086_4F4A_96DF_85B8FDE2F674">Weekly</string>
<string id="POL_DB5DF501_6F87_42D4_9FEC_E7F32C498BD3">Sudo Rights</string>
<string id="POL_9320E11F_AC80_4A7D_A5C8_1C0F3F727061_Help">This policy setting allows you to execute commands, either local or on remote storage, daily.</string>
<string id="POL_825D441F_905E_4C7E_9E4B_03013697C6C1_Help">This policy setting allows you to execute commands, either local or on remote storage, hourly.</string>
<string id="POL_D298F3BD_44D9_426D_AF11_3163D31582F6_Help">This policy setting allows you to execute commands, either local or on remote storage, monthly.</string>
<string id="POL_3ACC7ECD_8086_4F4A_96DF_85B8FDE2F674_Help">This policy setting allows you to execute commands, either local or on remote storage, weekly.</string>
<string id="POL_DB5DF501_6F87_42D4_9FEC_E7F32C498BD3_Help">This policy configures the sudoers file with the lines specified.</string>
</stringTable>
<presentationTable>
<presentation id="POL_9320E11F_AC80_4A7D_A5C8_1C0F3F727061">
@ -30,6 +32,9 @@
<presentation id="POL_3ACC7ECD_8086_4F4A_96DF_85B8FDE2F674">
<listBox refId="LST_1E7198A6_7850_4CAB_B656_BC18752564FC">Script and arguments</listBox>
</presentation>
<presentation id="POL_DB5DF501_6F87_42D4_9FEC_E7F32C498BD3">
<listBox refId="LST_4F4BA073_4F7B_4B64_A61D_8E75257A4B9F">Sudoers commands</listBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>

7
libgpo/admx/samba.admx
View File

@ -43,5 +43,12 @@
<list id="LST_1E7198A6_7850_4CAB_B656_BC18752564FC" key="Software\Policies\Samba\Unix Settings\Weekly Scripts" valueName="Weekly Scripts" />
</elements>
</policy>
<policy name="POL_DB5DF501_6F87_42D4_9FEC_E7F32C498BD3" class="Machine" displayName="$(string.POL_DB5DF501_6F87_42D4_9FEC_E7F32C498BD3)" explainText="$(string.POL_DB5DF501_6F87_42D4_9FEC_E7F32C498BD3_Help)" presentation="$(presentation.POL_DB5DF501_6F87_42D4_9FEC_E7F32C498BD3)" key="Software\Policies\Samba\Unix Settings">
<parentCategory ref="CAT_7D8D7DC8_5A9D_4BE1_8227_F09CDD5AFFC6" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<elements>
<list id="LST_4F4BA073_4F7B_4B64_A61D_8E75257A4B9F" key="Software\Policies\Samba\Unix Settings\Sudo Rights" valueName="Sudo Rights" />
</elements>
</policy>
</policies>
</policyDefinitions>

65
python/samba/gp_sudoers_ext.py
View File

@ -14,9 +14,72 @@
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
import os
from samba.gpclass import gp_pol_ext
from base64 import b64encode
from tempfile import NamedTemporaryFile
from subprocess import Popen, PIPE
from distutils.spawn import find_executable
intro = '''
### autogenerated by samba
#
# This file is generated by the gp_sudoers_ext Group Policy
# Client Side Extension. To modify the contents of this file,
# modify the appropriate Group Policy objects which apply
# to this machine. DO NOT MODIFY THIS FILE DIRECTLY.
#
'''
visudo = find_executable('visudo',
path='%s:%s' % (os.environ['PATH'], '/usr/sbin'))
class gp_sudoers_ext(gp_pol_ext):
def __str__(self):
return 'Unix Settings/Sudo Rights'
def process_group_policy(self, deleted_gpo_list, changed_gpo_list,
sdir='/etc/sudoers.d'):
pass
for gpo in deleted_gpo_list:
self.gp_db.set_guid(gpo[0])
if str(self) in gpo[1]:
for attribute, sudoers in gpo[1][str(self)].items():
os.unlink(sudoers)
self.gp_db.delete(str(self), attribute)
self.gp_db.commit()
for gpo in changed_gpo_list:
if gpo.file_sys_path:
section = 'Software\\Policies\\Samba\\Unix Settings\\Sudo Rights'
self.gp_db.set_guid(gpo.name)
pol_file = 'MACHINE/Registry.pol'
path = os.path.join(gpo.file_sys_path, pol_file)
pol_conf = self.parse(path)
if not pol_conf:
continue
for e in pol_conf.entries:
if e.keyname == section and e.data.strip():
attribute = b64encode(e.data.encode()).decode()
old_val = self.gp_db.retrieve(str(self), attribute)
if not old_val:
contents = intro
contents += '%s\n' % e.data
with NamedTemporaryFile() as f:
with open(f.name, 'w') as w:
w.write(contents)
sudo_validation = \
Popen([visudo, '-c', '-f', f.name],
stdout=PIPE, stderr=PIPE).wait()
if sudo_validation == 0:
with NamedTemporaryFile(prefix='gp_',
delete=False,
dir=sdir) as f:
with open(f.name, 'w') as w:
w.write(contents)
self.gp_db.store(str(self),
attribute,
f.name)
else:
self.logger.warn('Sudoers apply "%s" failed'
% e.data)
self.gp_db.commit()

1
selftest/knownfail
View File

@ -396,4 +396,3 @@
^samba.tests.ntlmdisabled.python\(ktest\).python2.ntlmdisabled.NtlmDisabledTests.test_samr_change_password\(ktest\)
^samba.tests.ntlmdisabled.python\(ad_dc_no_ntlm\).python3.ntlmdisabled.NtlmDisabledTests.test_ntlm_connection\(ad_dc_no_ntlm\)
^samba.tests.ntlmdisabled.python\(ad_dc_no_ntlm\).python2.ntlmdisabled.NtlmDisabledTests.test_ntlm_connection\(ad_dc_no_ntlm\)
^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_sudoers

2
source4/scripting/bin/samba-gpupdate
View File

@ -33,6 +33,7 @@ from samba.gpclass import apply_gp, unapply_gp, GPOStorage
from samba.gp_sec_ext import gp_sec_ext
from samba.gp_ext_loader import get_gp_client_side_extensions
from samba.gp_scripts_ext import gp_scripts_ext
from samba.gp_sudoers_ext import gp_sudoers_ext
import logging
if __name__ == "__main__":
@ -82,6 +83,7 @@ if __name__ == "__main__":
if opts.target == 'Computer':
gp_extensions.append(gp_sec_ext(logger, lp, creds, store))
gp_extensions.append(gp_scripts_ext(logger, lp, creds, store))
gp_extensions.append(gp_sudoers_ext(logger, lp, creds, store))
for ext in machine_exts:
gp_extensions.append(ext(logger, lp, creds, store))
elif opts.target == 'User':