diff options
| author | Matthieu Patou <mat@matws.net> | 2010-01-27 02:03:15 +0300 |
|---|---|---|
| committer | Matthias Dieter Wallnöfer <mwallnoefer@yahoo.de> | 2010-02-11 11:47:04 +0100 |
| commit | a4d056339235d436dfdbf82e14975151ee1bc7c3 (patch) | |
| tree | 54c98273bedee452a38c2f0c5577bca8b22df342 /source4 | |
| parent | bcba41c351bc78d739fb174338d8c71148053b5d (diff) | |
| download | samba-a4d056339235d436dfdbf82e14975151ee1bc7c3.tar.gz samba-a4d056339235d436dfdbf82e14975151ee1bc7c3.tar.bz2 samba-a4d056339235d436dfdbf82e14975151ee1bc7c3.zip | |
provision: Use short name for assignee of ACE (BA, SA, CO, ...)
Use short name (shortcut for wellknown SID/RID) for assignee in each entry of ACL (when possible)
of sysvol files (GPO objects and netlogon folders).
This avoid error prone substitution of DOMAINSID in ACL and make ACL clearer by using shortname
for assignee accordingly with SDDL synthax rules. Translation to real SID is handled internaly by the
from_sddl function.
Signed-off-by: Matthias Dieter Wallnöfer <mwallnoefer@yahoo.de>
Diffstat (limited to 'source4')
| -rw-r--r-- | source4/scripting/python/samba/provision.py | 14 |
1 files changed, 6 insertions, 8 deletions
diff --git a/source4/scripting/python/samba/provision.py b/source4/scripting/python/samba/provision.py index 27e5287457..f52766b228 100644 --- a/source4/scripting/python/samba/provision.py +++ b/source4/scripting/python/samba/provision.py @@ -1065,8 +1065,8 @@ def setup_samdb(path, setup_path, session_info, provision_backend, lp, FILL_FULL = "FULL" FILL_NT4SYNC = "NT4SYNC" FILL_DRS = "DRS" -SYSVOL_ACL = "O:${DOMAINSID}-500G:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;S-1-5-32-549)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)" -POLICIES_ACL = "O:${DOMAINSID}-500G:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;S-1-5-32-549)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001301bf;;;${DOMAINSID}-520)" +SYSVOL_ACL = "O:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)" +POLICIES_ACL = "O:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001301bf;;;PA)" def set_gpo_acl(path,acl,lp,domsid): setntacl(lp,path,acl,domsid) @@ -1078,27 +1078,25 @@ def set_gpo_acl(path,acl,lp,domsid): def setsysvolacl(samdb,names,netlogon,sysvol,gid,domainsid,lp): canchown = 1 - acl = SYSVOL_ACL.replace("${DOMAINSID}",str(domainsid)) try: os.chown(sysvol,-1,gid) except: canchown = 0 - setntacl(lp,sysvol,acl,str(domainsid)) + setntacl(lp,sysvol,SYSVOL_ACL,str(domainsid)) for root, dirs, files in os.walk(sysvol, topdown=False): for name in files: if canchown: os.chown(os.path.join(root, name),-1,gid) - setntacl(lp,os.path.join(root, name),acl,str(domainsid)) + setntacl(lp,os.path.join(root, name),SYSVOL_ACL,str(domainsid)) for name in dirs: if canchown: os.chown(os.path.join(root, name),-1,gid) - setntacl(lp,os.path.join(root, name),acl,str(domainsid)) + setntacl(lp,os.path.join(root, name),SYSVOL_ACL,str(domainsid)) # Set ACL for GPO policy_path = os.path.join(sysvol, names.dnsdomain, "Policies") - acl = POLICIES_ACL.replace("${DOMAINSID}",str(domainsid)) - set_gpo_acl(policy_path,dsacl2fsacl(acl,str(domainsid)),lp,str(domainsid)) + set_gpo_acl(policy_path,dsacl2fsacl(POLICIES_ACL,str(domainsid)),lp,str(domainsid)) res = samdb.search(base="CN=Policies,CN=System,%s"%(names.domaindn), attrs=["cn","nTSecurityDescriptor"], expression="", scope=ldb.SCOPE_ONELEVEL) |