sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-12-20 16:23:51 +03:00
Code Activity

samba-tool: Add a gpo command for removing VGP Host Access Group Policy

Browse Source 
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Mar 18 20:02:50 UTC 2021 on sn-devel-184
This commit is contained in:
David Mulder
2021-03-03 14:19:01 -07:00
committed by Jeremy Allison
parent 90acb3cf99
commit f1a72fc63d
3 changed files with 74 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

70
python/samba/netcmd/gpo.py
View File

@@ -3911,7 +3911,75 @@ samba-tool gpo manage access remove {31B2F340-016D-11D2-945F-00C04FB984F9} allow
def run(self, gpo, etype, name, domain, H=None, sambaopts=None,
credopts=None, versionopts=None):
pass
self.lp = sambaopts.get_loadparm()
self.creds = credopts.get_credentials(self.lp, fallback_machine=True)
# We need to know writable DC to setup SMB connection
if H and H.startswith('ldap://'):
dc_hostname = H[7:]
self.url = H
else:
dc_hostname = netcmd_finddc(self.lp, self.creds)
self.url = dc_url(self.lp, self.creds, dc=dc_hostname)
# SMB connect to DC
conn = smb_connection(dc_hostname,
'sysvol',
lp=self.lp,
creds=self.creds)
realm = self.lp.get('realm')
if etype == 'allow':
vgp_dir = '\\'.join([realm.lower(), 'Policies', gpo,
'MACHINE\\VGP\\VTLA\\VAS'
'HostAccessControl\\Allow'])
elif etype == 'deny':
vgp_dir = '\\'.join([realm.lower(), 'Policies', gpo,
'MACHINE\\VGP\\VTLA\\VAS'
'HostAccessControl\\Deny'])
else:
raise CommandError("The entry type must be either 'allow' or "
"'deny'. Unknown type '%s'" % etype)
vgp_xml = '\\'.join([vgp_dir, 'manifest.xml'])
try:
xml_data = ET.ElementTree(ET.fromstring(conn.loadfile(vgp_xml)))
policy = xml_data.getroot().find('policysetting')
data = policy.find('data')
except NTSTATUSError as e:
# STATUS_OBJECT_NAME_INVALID, STATUS_OBJECT_NAME_NOT_FOUND,
# STATUS_OBJECT_PATH_NOT_FOUND
if e.args[0] in [0xC0000033, 0xC0000034, 0xC000003A]:
raise CommandError("Cannot remove %s entry because it does "
"not exist" % etype)
elif e.args[0] == 0xC0000022: # STATUS_ACCESS_DENIED
raise CommandError("The authenticated user does "
"not have sufficient privileges")
else:
raise
for listelement in data.findall('listelement'):
adobject = listelement.find('adobject')
name_elm = adobject.find('name')
domain_elm = adobject.find('domain')
if name_elm is not None and name_elm.text == name and \
domain_elm is not None and domain_elm.text == domain:
data.remove(listelement)
break
else:
raise CommandError("Cannot remove %s entry because it does "
"not exist" % etype)
out = BytesIO()
xml_data.write(out, encoding='UTF-8', xml_declaration=True)
out.seek(0)
try:
create_directory_hier(conn, vgp_dir)
conn.savefile(vgp_xml, out.read())
except NTSTATUSError as e:
if e.args[0] == 0xC0000022: # STATUS_ACCESS_DENIED
raise CommandError("The authenticated user does "
"not have sufficient privileges")
raise
class cmd_access(SuperCommand):
"""Manage Host Access Group Policy Objects"""