The branch, master has been updated
via a4d0563... provision: Use short name for assignee of ACE (BA, SA,
CO, ...)
via bcba41c... python-s4: use secrets.ldb instead of sam.ldb for
reading domain SID
via d1c2923... provision: Fix an error with eadb when using not default
install dir and running as a non root user
from 2cf97c4... s4-dns: don't leave behind a tmp file
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit a4d056339235d436dfdbf82e14975151ee1bc7c3
Author: Matthieu Patou <[email protected]>
Date: Wed Jan 27 02:03:15 2010 +0300
provision: Use short name for assignee of ACE (BA, SA, CO, ...)
Use short name (shortcut for wellknown SID/RID) for assignee in each
entry of ACL (when possible)
of sysvol files (GPO objects and netlogon folders).
This avoid error prone substitution of DOMAINSID in ACL and make ACL
clearer by using shortname
for assignee accordingly with SDDL synthax rules. Translation to real SID
is handled internaly by the
from_sddl function.
Signed-off-by: Matthias Dieter Wallnöfer <[email protected]>
commit bcba41c351bc78d739fb174338d8c71148053b5d
Author: Matthieu Patou <[email protected]>
Date: Wed Jan 27 01:32:29 2010 +0300
python-s4: use secrets.ldb instead of sam.ldb for reading domain SID
This allow to be able to run net acl set xxx yyy on DC, but also on domain
member.
Signed-off-by: Matthias Dieter Wallnöfer <[email protected]>
commit d1c29231511376f4379909401f723b1ea9c538ea
Author: Matthieu Patou <[email protected]>
Date: Mon Feb 8 15:36:07 2010 +0300
provision: Fix an error with eadb when using not default install dir and
running as a non root user
Signed-off-by: Matthias Dieter Wallnöfer <[email protected]>
-----------------------------------------------------------------------
Summary of changes:
source4/scripting/python/samba/netcmd/ntacl.py | 4 ++--
source4/scripting/python/samba/provision.py | 20 +++++++++++---------
2 files changed, 13 insertions(+), 11 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source4/scripting/python/samba/netcmd/ntacl.py
b/source4/scripting/python/samba/netcmd/ntacl.py
index a96593e..8c0803f 100644
--- a/source4/scripting/python/samba/netcmd/ntacl.py
+++ b/source4/scripting/python/samba/netcmd/ntacl.py
@@ -61,7 +61,7 @@ class cmd_acl_set(Command):
credopts=None, sambaopts=None, versionopts=None):
lp = sambaopts.get_loadparm()
creds = credopts.get_credentials(lp)
- path = os.path.join(lp.get("private dir"), lp.get("sam
database") or "samdb.ldb")
+ path = os.path.join(lp.get("private dir"), lp.get("secrets
database") or "secrets.ldb")
creds = credopts.get_credentials(lp)
creds.set_kerberos_state(DONT_USE_KERBEROS)
try:
@@ -71,7 +71,7 @@ class cmd_acl_set(Command):
sys.exit(1)
attrs = ["objectSid"]
print lp.get("realm")
- res =
ldb.search(expression="(objectClass=*)",base="DC=%s"%lp.get("realm").lower().replace(".",",DC="),
scope=SCOPE_BASE, attrs=attrs)
+ res =
ldb.search(expression="(objectClass=*)",base="flatname=%s,cn=Primary
Domains"%lp.get("workgroup"), scope=SCOPE_BASE, attrs=attrs)
if len(res) !=0:
domainsid = ndr_unpack(
security.dom_sid,res[0]["objectSid"][0])
setntacl(lp,file,acl,str(domainsid),xattr_backend,eadb_file)
diff --git a/source4/scripting/python/samba/provision.py
b/source4/scripting/python/samba/provision.py
index 86f1d9c..f52766b 100644
--- a/source4/scripting/python/samba/provision.py
+++ b/source4/scripting/python/samba/provision.py
@@ -465,7 +465,11 @@ def make_smbconf(smbconf, setup_path, hostname, domain,
realm, serverrole,
if os.path.exists(smbconf):
default_lp.load(smbconf)
if eadb:
- posixeadb_line = "posix:eadb = " +
os.path.abspath(os.path.join(os.path.join(targetdir, "private"),"eadb.tdb"))
+ if targetdir is not None:
+ privdir = os.path.join(targetdir, "private")
+ else:
+ privdir = default_lp.get("private dir")
+ posixeadb_line = "posix:eadb = " +
os.path.abspath(os.path.join(privdir,"eadb.tdb"))
else:
posixeadb_line = ""
@@ -1061,8 +1065,8 @@ def setup_samdb(path, setup_path, session_info,
provision_backend, lp,
FILL_FULL = "FULL"
FILL_NT4SYNC = "NT4SYNC"
FILL_DRS = "DRS"
-SYSVOL_ACL =
"O:${DOMAINSID}-500G:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;S-1-5-32-549)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)"
-POLICIES_ACL =
"O:${DOMAINSID}-500G:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;S-1-5-32-549)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001301bf;;;${DOMAINSID}-520)"
+SYSVOL_ACL =
"O:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)"
+POLICIES_ACL =
"O:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001301bf;;;PA)"
def set_gpo_acl(path,acl,lp,domsid):
setntacl(lp,path,acl,domsid)
@@ -1074,27 +1078,25 @@ def set_gpo_acl(path,acl,lp,domsid):
def setsysvolacl(samdb,names,netlogon,sysvol,gid,domainsid,lp):
canchown = 1
- acl = SYSVOL_ACL.replace("${DOMAINSID}",str(domainsid))
try:
os.chown(sysvol,-1,gid)
except:
canchown = 0
- setntacl(lp,sysvol,acl,str(domainsid))
+ setntacl(lp,sysvol,SYSVOL_ACL,str(domainsid))
for root, dirs, files in os.walk(sysvol, topdown=False):
for name in files:
if canchown:
os.chown(os.path.join(root, name),-1,gid)
- setntacl(lp,os.path.join(root, name),acl,str(domainsid))
+ setntacl(lp,os.path.join(root,
name),SYSVOL_ACL,str(domainsid))
for name in dirs:
if canchown:
os.chown(os.path.join(root, name),-1,gid)
- setntacl(lp,os.path.join(root, name),acl,str(domainsid))
+ setntacl(lp,os.path.join(root,
name),SYSVOL_ACL,str(domainsid))
# Set ACL for GPO
policy_path = os.path.join(sysvol, names.dnsdomain, "Policies")
- acl = POLICIES_ACL.replace("${DOMAINSID}",str(domainsid))
-
set_gpo_acl(policy_path,dsacl2fsacl(acl,str(domainsid)),lp,str(domainsid))
+
set_gpo_acl(policy_path,dsacl2fsacl(POLICIES_ACL,str(domainsid)),lp,str(domainsid))
res = samdb.search(base="CN=Policies,CN=System,%s"%(names.domaindn),
attrs=["cn","nTSecurityDescriptor"],
expression="",
scope=ldb.SCOPE_ONELEVEL)
--
Samba Shared Repository
