samba-tool: Add implementation of gpo create command

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

1 files changed, 176 insertions, 1 deletions

diff --git a/source4/scripting/python/samba/netcmd/gpo.py b/source4/scripting/python/samba/netcmd/gpo.py
index c9765f2f20..94b1c61265 100644
--- a/source4/scripting/python/samba/netcmd/gpo.py
+++ b/source4/scripting/python/samba/netcmd/gpo.py
@@ -43,6 +43,7 @@ from samba.auth import AUTH_SESSION_INFO_DEFAULT_GROUPS, AUTH_SESSION_INFO_AUTHE
 from samba.netcmd.common import netcmd_finddc
 from samba import policy
 from samba import smb
+import uuid
 
 
 def samdb_connect(ctx):
@@ -788,7 +789,181 @@ class cmd_fetch(Command):
 
 
 class cmd_create(Command):
-    """Create a GPO"""
+    """Create an empty GPO"""
+
+    synopsis = "%prog gpo create <displayname> [options]"
+
+    takes_optiongroups = {
+        "sambaopts": options.SambaOptions,
+        "versionopts": options.VersionOptions,
+        "credopts": options.CredentialsOptions,
+    }
+
+    takes_args = [ 'displayname' ]
+
+    takes_options = [
+        Option("-H", help="LDB URL for database or target server", type=str),
+        Option("--tmpdir", help="Temporary directory for copying policy files", type=str)
+        ]
+
+    def run(self, displayname, H=None, tmpdir=None, sambaopts=None, credopts=None, 
+            versionopts=None):
+
+        self.lp = sambaopts.get_loadparm()
+        self.creds = credopts.get_credentials(self.lp, fallback_machine=True)
+
+        self.url = dc_url(self.lp, self.creds, H)
+
+        dc_hostname = netcmd_finddc(self.lp, self.creds)
+        samdb_connect(self)
+
+        msg = get_gpo_info(self.samdb, displayname=displayname)
+        if msg.count > 0:
+            raise CommandError("A GPO already existing with name '%s'" % displayname)
+
+        # Create new GUID
+        guid  = str(uuid.uuid4())
+        gpo = "{%s}" % guid.upper()
+        realm = self.lp.get('realm')
+        unc_path = "\\\\%s\\sysvol\\%s\\Policies\\%s" % (realm, realm, gpo)
+
+        # Create GPT
+        if tmpdir is None:
+            tmpdir = "/tmp"
+        if not os.path.isdir(tmpdir):
+            raise CommandError("Temporary directory '%s' does not exist" % tmpdir)
+
+        localdir = os.path.join(tmpdir, "policy")
+        if not os.path.isdir(localdir):
+            os.mkdir(localdir)
+
+        gpodir = os.path.join(localdir, gpo)
+        if os.path.isdir(gpodir):
+            raise CommandError("GPO directory '%s' already exists, refusing to overwrite" % gpodir)
+
+        try:
+            os.mkdir(gpodir)
+            os.mkdir(os.path.join(gpodir, "Machine"))
+            os.mkdir(os.path.join(gpodir, "User"))
+            gpt_contents = "[General]\r\nVersion=0\r\n"
+            file(os.path.join(gpodir, "GPT.INI"), "w").write(gpt_contents)
+        except Exception, e:
+            raise CommandError("Error Creating GPO files", e) 
+
+        # Add cn=<guid>
+        gpo_dn = self.samdb.get_default_basedn()
+        gpo_dn.add_child(ldb.Dn(self.samdb, "CN=Policies,CN=System"))
+        gpo_dn.add_child(ldb.Dn(self.samdb, "CN=%s" % gpo))
+
+        m = ldb.Message()
+        m.dn = ldb.Dn(self.samdb, gpo_dn.get_linearized())
+        m['a01'] = ldb.MessageElement("top", ldb.FLAG_MOD_ADD, "objectClass")
+        m['a02'] = ldb.MessageElement("container", ldb.FLAG_MOD_ADD, "objectClass")
+        m['a03'] = ldb.MessageElement("groupPolicyContainer", ldb.FLAG_MOD_ADD, "objectClass")
+        m['a04'] = ldb.MessageElement(displayname, ldb.FLAG_MOD_ADD, "displayName")
+        m['a05'] = ldb.MessageElement(gpo, ldb.FLAG_MOD_ADD, "name")
+        m['a06'] = ldb.MessageElement(gpo, ldb.FLAG_MOD_ADD, "CN")
+        m['a07'] = ldb.MessageElement(unc_path, ldb.FLAG_MOD_ADD, "gPCFileSysPath")
+        m['a08'] = ldb.MessageElement("0", ldb.FLAG_MOD_ADD, "flags")
+        m['a09'] = ldb.MessageElement("0", ldb.FLAG_MOD_ADD, "versionNumber")
+        m['a10'] = ldb.MessageElement("TRUE", ldb.FLAG_MOD_ADD, "showInAdvancedViewOnly")
+        m['a11'] = ldb.MessageElement("2", ldb.FLAG_MOD_ADD, "gpcFunctionalityVersion")
+        try:
+            self.samdb.add(m)
+        except Exception, e:
+            raise CommandError("Error adding GPO in AD", e)
+
+        # Add cn=User,cn=<guid>
+        child_dn = gpo_dn
+        child_dn.add_child(ldb.Dn(self.samdb, "CN=User"))
+
+        m = ldb.Message()
+        m.dn = ldb.Dn(self.samdb, child_dn.get_linearized())
+        m['a01'] = ldb.MessageElement("top", ldb.FLAG_MOD_ADD, "objectClass")
+        m['a02'] = ldb.MessageElement("container", ldb.FLAG_MOD_ADD, "objectClass")
+        m['a03'] = ldb.MessageElement("TRUE", ldb.FLAG_MOD_ADD, "showInAdvancedViewOnly")
+        m['a04'] = ldb.MessageElement("User", ldb.FLAG_MOD_ADD, "CN")
+        m['a05'] = ldb.MessageElement("User", ldb.FLAG_MOD_ADD, "name")
+        try:
+            self.samdb.add(m)
+        except Exception, e:
+            raise CommandError("Error adding GPO in AD", e)
+
+        # Add cn=User,cn=<guid>
+        child_dn = gpo_dn
+        child_dn.add_child(ldb.Dn(self.samdb, "CN=Machine"))
+
+        m = ldb.Message()
+        m.dn = ldb.Dn(self.samdb, child_dn.get_linearized())
+        m['a01'] = ldb.MessageElement("top", ldb.FLAG_MOD_ADD, "objectClass")
+        m['a02'] = ldb.MessageElement("container", ldb.FLAG_MOD_ADD, "objectClass")
+        m['a03'] = ldb.MessageElement("TRUE", ldb.FLAG_MOD_ADD, "showInAdvancedViewOnly")
+        m['a04'] = ldb.MessageElement("Machine", ldb.FLAG_MOD_ADD, "CN")
+        m['a05'] = ldb.MessageElement("Machine", ldb.FLAG_MOD_ADD, "name")
+        try:
+            self.samdb.add(m)
+        except Exception, e:
+            raise CommandError("Error adding GPO in AD", e)
+
+        # Copy GPO files over SMB
+        [dom_name, service, sharepath] = parse_unc(unc_path)
+        try:
+            conn = smb.SMB(dc_hostname, service, lp=self.lp, creds=self.creds)
+        except Exception, e:
+            raise CommandError("Error connecting to '%s' using SMB" % dc_hostname, e)
+
+        try:
+            create_directory_hier(conn, sharepath)
+            copy_directory_local_to_remote(conn, gpodir, sharepath)
+        except Exception, e:
+            raise CommandError("Error Copying GPO to DC", e)
+
+        # Get new security descriptor
+        msg = get_gpo_info(self.samdb, gpo=gpo)[0]
+        ds_sd_ndr = msg['ntSecurityDescriptor'][0]
+        ds_sd = ndr_unpack(dcerpc.security.descriptor, ds_sd_ndr)
+
+        # Create a file system security descriptor
+        fs_sd = dcerpc.security.descriptor()
+        fs_sd.owner_sid = ds_sd.owner_sid
+        fs_sd.group_sid = ds_sd.group_sid
+        fs_sd.type = ds_sd.type
+        fs_sd.revision = ds_sd.revision
+
+        # Copy sacl
+        fs_sd.sacl = ds_sd.sacl
+
+        # Copy dacl
+        dacl = ds_sd.dacl
+        for ace in dacl.aces:
+            # Don't add the allow for SID_BUILTIN_PREW2K
+            if (not (ace.type & dcerpc.security.SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT) and 
+                    ace.trustee == dcerpc.security.SID_BUILTIN_PREW2K):
+                continue
+
+            # Copy the ace from the directory server security descriptor
+            new_ace = ace
+
+            # Set specific inheritance flags for within the GPO
+            new_ace.flags |= (dcerpc.security.SEC_ACE_FLAG_OBJECT_INHERIT |
+                             dcerpc.security.SEC_ACE_FLAG_CONTAINER_INHERIT)
+            if ace.trustee == dcerpc.security.SID_CREATOR_OWNER:
+                new_ace.flags |= dcerpc.security.SEC_ACE_FLAG_INHERIT_ONLY
+
+            # Get a directory access mask from the assigned access mask on the ldap object
+            new_ace.access_mask = policy.ads_to_dir_access_mask(ace.access_mask)
+
+            # Add the ace to DACL
+            fs_sd.dacl_add(new_ace)
+
+        # Set ACL
+        try:
+            conn.set_acl(sharepath, fs_sd)
+        except Exception, e:
+            raise CommandError("Error setting ACL on GPT", e)
+
+        print "GPO '%s' created as %s" % (displayname, gpo)
+
 
 class cmd_setacl(Command):
     """Set ACL on a GPO"""