The branch, master has been updated via a4d0563... provision: Use short name for assignee of ACE (BA, SA, CO, ...) via bcba41c... python-s4: use secrets.ldb instead of sam.ldb for reading domain SID via d1c2923... provision: Fix an error with eadb when using not default install dir and running as a non root user from 2cf97c4... s4-dns: don't leave behind a tmp file
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master - Log ----------------------------------------------------------------- commit a4d056339235d436dfdbf82e14975151ee1bc7c3 Author: Matthieu Patou <m...@matws.net> Date: Wed Jan 27 02:03:15 2010 +0300 provision: Use short name for assignee of ACE (BA, SA, CO, ...) Use short name (shortcut for wellknown SID/RID) for assignee in each entry of ACL (when possible) of sysvol files (GPO objects and netlogon folders). This avoid error prone substitution of DOMAINSID in ACL and make ACL clearer by using shortname for assignee accordingly with SDDL synthax rules. Translation to real SID is handled internaly by the from_sddl function. Signed-off-by: Matthias Dieter Wallnöfer <mwallnoe...@yahoo.de> commit bcba41c351bc78d739fb174338d8c71148053b5d Author: Matthieu Patou <m...@matws.net> Date: Wed Jan 27 01:32:29 2010 +0300 python-s4: use secrets.ldb instead of sam.ldb for reading domain SID This allow to be able to run net acl set xxx yyy on DC, but also on domain member. Signed-off-by: Matthias Dieter Wallnöfer <mwallnoe...@yahoo.de> commit d1c29231511376f4379909401f723b1ea9c538ea Author: Matthieu Patou <m...@matws.net> Date: Mon Feb 8 15:36:07 2010 +0300 provision: Fix an error with eadb when using not default install dir and running as a non root user Signed-off-by: Matthias Dieter Wallnöfer <mwallnoe...@yahoo.de> ----------------------------------------------------------------------- Summary of changes: source4/scripting/python/samba/netcmd/ntacl.py | 4 ++-- source4/scripting/python/samba/provision.py | 20 +++++++++++--------- 2 files changed, 13 insertions(+), 11 deletions(-) Changeset truncated at 500 lines: diff --git a/source4/scripting/python/samba/netcmd/ntacl.py b/source4/scripting/python/samba/netcmd/ntacl.py index a96593e..8c0803f 100644 --- a/source4/scripting/python/samba/netcmd/ntacl.py +++ b/source4/scripting/python/samba/netcmd/ntacl.py @@ -61,7 +61,7 @@ class cmd_acl_set(Command): credopts=None, sambaopts=None, versionopts=None): lp = sambaopts.get_loadparm() creds = credopts.get_credentials(lp) - path = os.path.join(lp.get("private dir"), lp.get("sam database") or "samdb.ldb") + path = os.path.join(lp.get("private dir"), lp.get("secrets database") or "secrets.ldb") creds = credopts.get_credentials(lp) creds.set_kerberos_state(DONT_USE_KERBEROS) try: @@ -71,7 +71,7 @@ class cmd_acl_set(Command): sys.exit(1) attrs = ["objectSid"] print lp.get("realm") - res = ldb.search(expression="(objectClass=*)",base="DC=%s"%lp.get("realm").lower().replace(".",",DC="), scope=SCOPE_BASE, attrs=attrs) + res = ldb.search(expression="(objectClass=*)",base="flatname=%s,cn=Primary Domains"%lp.get("workgroup"), scope=SCOPE_BASE, attrs=attrs) if len(res) !=0: domainsid = ndr_unpack( security.dom_sid,res[0]["objectSid"][0]) setntacl(lp,file,acl,str(domainsid),xattr_backend,eadb_file) diff --git a/source4/scripting/python/samba/provision.py b/source4/scripting/python/samba/provision.py index 86f1d9c..f52766b 100644 --- a/source4/scripting/python/samba/provision.py +++ b/source4/scripting/python/samba/provision.py @@ -465,7 +465,11 @@ def make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, if os.path.exists(smbconf): default_lp.load(smbconf) if eadb: - posixeadb_line = "posix:eadb = " + os.path.abspath(os.path.join(os.path.join(targetdir, "private"),"eadb.tdb")) + if targetdir is not None: + privdir = os.path.join(targetdir, "private") + else: + privdir = default_lp.get("private dir") + posixeadb_line = "posix:eadb = " + os.path.abspath(os.path.join(privdir,"eadb.tdb")) else: posixeadb_line = "" @@ -1061,8 +1065,8 @@ def setup_samdb(path, setup_path, session_info, provision_backend, lp, FILL_FULL = "FULL" FILL_NT4SYNC = "NT4SYNC" FILL_DRS = "DRS" -SYSVOL_ACL = "O:${DOMAINSID}-500G:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;S-1-5-32-549)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)" -POLICIES_ACL = "O:${DOMAINSID}-500G:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;S-1-5-32-549)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001301bf;;;${DOMAINSID}-520)" +SYSVOL_ACL = "O:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)" +POLICIES_ACL = "O:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001301bf;;;PA)" def set_gpo_acl(path,acl,lp,domsid): setntacl(lp,path,acl,domsid) @@ -1074,27 +1078,25 @@ def set_gpo_acl(path,acl,lp,domsid): def setsysvolacl(samdb,names,netlogon,sysvol,gid,domainsid,lp): canchown = 1 - acl = SYSVOL_ACL.replace("${DOMAINSID}",str(domainsid)) try: os.chown(sysvol,-1,gid) except: canchown = 0 - setntacl(lp,sysvol,acl,str(domainsid)) + setntacl(lp,sysvol,SYSVOL_ACL,str(domainsid)) for root, dirs, files in os.walk(sysvol, topdown=False): for name in files: if canchown: os.chown(os.path.join(root, name),-1,gid) - setntacl(lp,os.path.join(root, name),acl,str(domainsid)) + setntacl(lp,os.path.join(root, name),SYSVOL_ACL,str(domainsid)) for name in dirs: if canchown: os.chown(os.path.join(root, name),-1,gid) - setntacl(lp,os.path.join(root, name),acl,str(domainsid)) + setntacl(lp,os.path.join(root, name),SYSVOL_ACL,str(domainsid)) # Set ACL for GPO policy_path = os.path.join(sysvol, names.dnsdomain, "Policies") - acl = POLICIES_ACL.replace("${DOMAINSID}",str(domainsid)) - set_gpo_acl(policy_path,dsacl2fsacl(acl,str(domainsid)),lp,str(domainsid)) + set_gpo_acl(policy_path,dsacl2fsacl(POLICIES_ACL,str(domainsid)),lp,str(domainsid)) res = samdb.search(base="CN=Policies,CN=System,%s"%(names.domaindn), attrs=["cn","nTSecurityDescriptor"], expression="", scope=ldb.SCOPE_ONELEVEL) -- Samba Shared Repository