diff options
| -rw-r--r-- | libcli/security/security_descriptor.c | 50 | ||||
| -rw-r--r-- | libcli/security/security_descriptor.h | 4 | ||||
| -rw-r--r-- | source4/lib/ldb/tests/python/sec_descriptor.py | 13 | ||||
| -rw-r--r-- | source4/libcli/security/create_descriptor.c | 352 | ||||
| -rw-r--r-- | source4/scripting/python/samba/provision.py | 49 | ||||
| -rw-r--r-- | source4/selftest/knownfail | 3 | ||||
| -rw-r--r-- | source4/setup/provision_configuration_basedn.ldif | 1 | ||||
| -rw-r--r-- | source4/setup/provision_schema_basedn.ldif | 1 |
8 files changed, 459 insertions, 14 deletions
diff --git a/libcli/security/security_descriptor.c b/libcli/security/security_descriptor.c index dbe11604fd..b77a281852 100644 --- a/libcli/security/security_descriptor.c +++ b/libcli/security/security_descriptor.c @@ -77,6 +77,56 @@ struct security_acl *security_acl_dup(TALLOC_CTX *mem_ctx, } +struct security_acl *security_acl_concatenate(TALLOC_CTX *mem_ctx, + const struct security_acl *acl1, + const struct security_acl *acl2) +{ + struct security_acl *nacl; + int i; + + if (!acl1 && !acl2) + return NULL; + + if (!acl1){ + nacl = security_acl_dup(mem_ctx, acl2); + return nacl; + } + + if (!acl2){ + nacl = security_acl_dup(mem_ctx, acl1); + return nacl; + } + + nacl = talloc (mem_ctx, struct security_acl); + if (nacl == NULL) { + return NULL; + } + + nacl->revision = acl1->revision; + nacl->size = acl1->size + acl2->size; + nacl->num_aces = acl1->num_aces + acl2->num_aces; + + if (nacl->num_aces == 0) + return nacl; + + nacl->aces = (struct security_ace *)talloc_array (mem_ctx, struct security_ace, acl1->num_aces+acl2->num_aces); + if ((nacl->aces == NULL) && (nacl->num_aces > 0)) { + goto failed; + } + + for (i = 0; i < acl1->num_aces; i++) + nacl->aces[i] = acl1->aces[i]; + for (i = 0; i < acl2->num_aces; i++) + nacl->aces[i + acl1->num_aces] = acl2->aces[i]; + + return nacl; + + failed: + talloc_free (nacl); + return NULL; + +} + /* talloc and copy a security descriptor */ diff --git a/libcli/security/security_descriptor.h b/libcli/security/security_descriptor.h index a377ef59ce..bc5761ab6f 100644 --- a/libcli/security/security_descriptor.h +++ b/libcli/security/security_descriptor.h @@ -64,4 +64,8 @@ struct security_ace *security_ace_create(TALLOC_CTX *mem_ctx, struct security_acl *security_acl_dup(TALLOC_CTX *mem_ctx, const struct security_acl *oacl); +struct security_acl *security_acl_concatenate(TALLOC_CTX *mem_ctx, + const struct security_acl *acl1, + const struct security_acl *acl2); + #endif /* __SECURITY_DESCRIPTOR_H__ */ diff --git a/source4/lib/ldb/tests/python/sec_descriptor.py b/source4/lib/ldb/tests/python/sec_descriptor.py index 58a345450b..71c17d17e6 100644 --- a/source4/lib/ldb/tests/python/sec_descriptor.py +++ b/source4/lib/ldb/tests/python/sec_descriptor.py @@ -249,7 +249,10 @@ userAccountControl: %s""" % userAccountControl desc_sddl = desc.as_sddl( self.domain_sid ) if ace in desc_sddl: return - desc_sddl = desc_sddl[0:desc_sddl.index("(")] + ace + desc_sddl[desc_sddl.index("("):] + if desc_sddl.find("(") >= 0: + desc_sddl = desc_sddl[0:desc_sddl.index("(")] + ace + desc_sddl[desc_sddl.index("("):] + else: + desc_sddl = desc_sddl + ace self.modify_desc(object_dn, desc_sddl) def get_desc_sddl(self, object_dn): @@ -809,13 +812,11 @@ member: """ + user_dn #mod = "" self.dacl_add_ace(object_dn, mod) desc_sddl = self.get_desc_sddl(object_dn) - #print desc_sddl # Create additional object into the first one object_dn = "OU=test_domain_ou2," + object_dn self.delete_force(self.ldb_admin, object_dn) self.create_domain_ou(self.ldb_admin, object_dn) desc_sddl = self.get_desc_sddl(object_dn) - #print desc_sddl ## Tests for SCHEMA @@ -1397,6 +1398,10 @@ class DaclDescriptorTests(DescriptorTests): # Add flag 'protected' in both DACL and SACL so no inherit ACEs # can propagate from above desc_sddl = desc_sddl.replace(":AI", ":AIP") + # colon at the end breaks ldif parsing, fix it + res = re.findall(".*?S:", desc_sddl) + if res: + desc_sddl = desc_sddl.replace("S:", "") self.modify_desc(object_dn, desc_sddl) # Verify all inheritable ACEs are gone desc_sddl = self.get_desc_sddl(object_dn) @@ -1429,6 +1434,7 @@ class DaclDescriptorTests(DescriptorTests): self.create_domain_group(self.ldb_admin, group_dn, sddl) # Make sure created group descriptor has NO additional ACEs desc_sddl = self.get_desc_sddl(group_dn) + print "group descriptor: " + desc_sddl self.assertEqual(desc_sddl, sddl) def test_202(self): @@ -1590,7 +1596,6 @@ class DaclDescriptorTests(DescriptorTests): # Make sure created group object contains only the above inherited ACE(s) # that we've added manually desc_sddl = self.get_desc_sddl(group_dn) - #print desc_sddl self.assertTrue("(D;ID;WP;;;AU)" in desc_sddl) self.assertTrue("(D;CIIOID;WP;;;CO)" in desc_sddl) diff --git a/source4/libcli/security/create_descriptor.c b/source4/libcli/security/create_descriptor.c index 6a928273b7..1054479f28 100644 --- a/source4/libcli/security/create_descriptor.c +++ b/source4/libcli/security/create_descriptor.c @@ -29,6 +29,18 @@ #include "includes.h" #include "libcli/security/security.h" +/* Todos: + * build the security token dacl as follows: + * SYSTEM: GA, OWNER: GA, LOGIN_SID:GW|GE + * Need session id information for the login SID. Probably + * the best place for this is during token creation + * + * Implement SD Invariants + * ACE sorting rules + * LDAP_SERVER_SD_FLAGS_OID control + * ADTS 7.1.3.3 needs to be clarified + */ + /* the mapping function for generic rights for DS.(GA,GR,GW,GX) * The mapping function is passed as an argument to the * descriptor calculating routine and depends on the security @@ -63,6 +75,328 @@ uint32_t map_generic_rights_ds(uint32_t access_mask) return access_mask; } +/* Not sure what this has to be, +* and it does not seem to have any influence */ +static bool object_in_list(struct GUID *object_list, struct GUID *object) +{ + return true; +} + + +static bool contains_inheritable_aces(struct security_acl *acl) +{ + int i; + if (!acl) + return false; + + for (i=0; i < acl->num_aces; i++) { + struct security_ace *ace = &acl->aces[i]; + if ((ace->flags & SEC_ACE_FLAG_CONTAINER_INHERIT) || + (ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT)) + return true; + } + + return false; +} + +static struct security_acl *preprocess_creator_acl(TALLOC_CTX *mem, struct security_acl *acl) +{ + int i; + struct security_acl *new_acl = talloc_zero(mem, struct security_acl); + + new_acl->revision = acl->revision; + for (i=0; i < acl->num_aces; i++) { + struct security_ace *ace = &acl->aces[i]; + if (!(ace->flags & SEC_ACE_FLAG_INHERITED_ACE)){ + new_acl->aces = talloc_realloc(new_acl, new_acl->aces, struct security_ace, + new_acl->num_aces+1); + if (new_acl->aces == NULL) { + talloc_free(new_acl); + return NULL; + } + new_acl->aces[new_acl->num_aces] = *ace; + /*memcpy(&new_acl->aces[new_acl->num_aces], ace, + sizeof(struct security_ace)); */ + new_acl->num_aces++; + } + } + if (new_acl) + new_acl->revision = acl->revision; + /* Todo what to do if all were inherited and this is empty */ + return new_acl; +} + +/* This is not exactly as described in the docs. The original seemed to return + * only a list of the inherited or flagless ones... */ + +static bool postprocess_acl(struct security_acl *acl, + struct dom_sid *owner, + struct dom_sid *group, + uint32_t (*generic_map)(uint32_t access_mask)) +{ + int i; + struct dom_sid *co, *cg; + TALLOC_CTX *tmp_ctx = talloc_new(acl); + if (!generic_map){ + return false; + } + co = dom_sid_parse_talloc(tmp_ctx, SID_CREATOR_OWNER); + cg = dom_sid_parse_talloc(tmp_ctx, SID_CREATOR_GROUP); + for (i=0; i < acl->num_aces; i++){ + struct security_ace *ace = &acl->aces[i]; + if (!(ace->flags == 0 || ace->flags & SEC_ACE_FLAG_INHERITED_ACE)) + continue; + if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) + continue; + if (dom_sid_equal(&ace->trustee, co)){ + ace->trustee = *owner; + /* perhaps this should be done somewhere else? */ + ace->flags &= ~SEC_ACE_FLAG_CONTAINER_INHERIT; + } + if (dom_sid_equal(&ace->trustee, cg)){ + ace->trustee = *group; + ace->flags &= ~SEC_ACE_FLAG_CONTAINER_INHERIT; + } + ace->access_mask = generic_map(ace->access_mask); + } + + talloc_free(tmp_ctx); + return true; +} + +static struct security_acl *calculate_inherited_from_parent(TALLOC_CTX *mem_ctx, + struct security_acl *acl, + bool is_container, + struct GUID *object_list) +{ + int i; + TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx); + struct security_acl *tmp_acl = talloc_zero(tmp_ctx, struct security_acl); + struct security_acl *inh_acl = talloc_zero(tmp_ctx, struct security_acl); + struct security_acl *new_acl; + struct dom_sid *co, *cg; + if (!tmp_acl || !inh_acl) + return NULL; + + co = dom_sid_parse_talloc(tmp_ctx, SID_CREATOR_OWNER); + cg = dom_sid_parse_talloc(tmp_ctx, SID_CREATOR_GROUP); + + for (i=0; i < acl->num_aces; i++){ + struct security_ace *ace = &acl->aces[i]; + if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) + continue; + + if ((ace->flags & SEC_ACE_FLAG_CONTAINER_INHERIT) || + (ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT)){ + tmp_acl->aces = talloc_realloc(tmp_acl, tmp_acl->aces, struct security_ace, + tmp_acl->num_aces+1); + if (tmp_acl->aces == NULL) { + talloc_free(tmp_ctx); + return NULL; + } + + tmp_acl->aces[tmp_acl->num_aces] = *ace; + tmp_acl->aces[tmp_acl->num_aces].flags |= SEC_ACE_FLAG_INHERITED_ACE; + + if (is_container && (ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT)) + tmp_acl->aces[tmp_acl->num_aces].flags |= SEC_ACE_FLAG_INHERIT_ONLY; + + if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT || + ace->type == SEC_ACE_TYPE_ACCESS_DENIED_OBJECT){ + if (!object_in_list(object_list, &ace->object.object.type.type)){ + tmp_acl->aces[tmp_acl->num_aces].flags |= SEC_ACE_FLAG_INHERIT_ONLY; + } + + } + tmp_acl->num_aces++; + } + } + + if (is_container){ + for (i=0; i < acl->num_aces; i++){ + struct security_ace *ace = &acl->aces[i]; + + if (ace->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) + continue; + if (!dom_sid_equal(&ace->trustee, co) && !dom_sid_equal(&ace->trustee, cg)) + continue; + + if ((ace->flags & SEC_ACE_FLAG_CONTAINER_INHERIT) || + (ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT)){ + inh_acl->aces = talloc_realloc(inh_acl, inh_acl->aces, struct security_ace, + inh_acl->num_aces+1); + if (inh_acl->aces == NULL){ + talloc_free(tmp_ctx); + return NULL; + } + inh_acl->aces[inh_acl->num_aces] = *ace; + inh_acl->aces[inh_acl->num_aces].flags |= SEC_ACE_FLAG_INHERIT_ONLY; + inh_acl->aces[inh_acl->num_aces].flags |= SEC_ACE_FLAG_INHERITED_ACE; + inh_acl->num_aces++; + } + } + } + new_acl = security_acl_concatenate(mem_ctx,tmp_acl, inh_acl); + if (new_acl) + new_acl->revision = acl->revision; + talloc_free(tmp_ctx); + return new_acl; +} + +/* In the docs this looks == calculate_inherited_from_parent. However, + * It shouldn't return the inherited, rather filter them out.... + */ +static struct security_acl *calculate_inherited_from_creator(TALLOC_CTX *mem_ctx, + struct security_acl *acl, + bool is_container, + struct GUID *object_list) +{ + int i; + TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx); + struct security_acl *tmp_acl = talloc_zero(tmp_ctx, struct security_acl); +/* struct security_acl *inh_acl = talloc_zero(tmp_ctx, struct security_acl); */ + struct security_acl *new_acl; + struct dom_sid *co, *cg; + + if (!tmp_acl) + return NULL; + + co = dom_sid_parse_talloc(tmp_ctx, SID_CREATOR_OWNER); + cg = dom_sid_parse_talloc(tmp_ctx, SID_CREATOR_GROUP); + + for (i=0; i < acl->num_aces; i++){ + struct security_ace *ace = &acl->aces[i]; + if (ace->flags & SEC_ACE_FLAG_INHERITED_ACE) + continue; + + tmp_acl->aces = talloc_realloc(tmp_acl, tmp_acl->aces, struct security_ace, + tmp_acl->num_aces+1); + tmp_acl->aces[tmp_acl->num_aces] = *ace; + tmp_acl->aces[tmp_acl->num_aces].flags = 0; + tmp_acl->num_aces++; + + if (!dom_sid_equal(&ace->trustee, co) && !dom_sid_equal(&ace->trustee, cg)) + continue; + + tmp_acl->aces = talloc_realloc(tmp_acl, tmp_acl->aces, struct security_ace, + tmp_acl->num_aces+1); + tmp_acl->aces[tmp_acl->num_aces] = *ace; + tmp_acl->aces[tmp_acl->num_aces].flags |= SEC_ACE_FLAG_INHERIT_ONLY; + tmp_acl->num_aces++; + } + new_acl = security_acl_dup(mem_ctx,tmp_acl); + + talloc_free(tmp_ctx); + return new_acl; +} + +static bool compute_acl(int acl_type, + struct security_descriptor *parent_sd, + struct security_descriptor *creator_sd, + bool is_container, + uint32_t inherit_flags, + struct GUID *object_list, + uint32_t (*generic_map)(uint32_t access_mask), + struct security_token *token, + struct security_descriptor *new_sd) /* INOUT argument */ +{ + struct security_acl *p_acl = NULL, *c_acl = NULL, **new_acl; + if (acl_type == SEC_DESC_DACL_PRESENT){ + if (parent_sd) + p_acl = parent_sd->dacl; + if (creator_sd) + c_acl = creator_sd->dacl; + new_acl = &new_sd->dacl; + } + else{ + if (parent_sd) + p_acl = parent_sd->sacl; + if (creator_sd) + c_acl = creator_sd->sacl; + new_acl = &new_sd->sacl; + } + if (contains_inheritable_aces(p_acl)){ + if (!c_acl || (c_acl && inherit_flags & SEC_DEFAULT_DESCRIPTOR)){ + *new_acl = calculate_inherited_from_parent(new_sd, + p_acl, + is_container, + object_list); + if (*new_acl == NULL) + goto final; + if (!postprocess_acl(*new_acl, new_sd->owner_sid, + new_sd->group_sid, generic_map)) + return false; + else + goto final; + } + if (c_acl && !(inherit_flags & SEC_DEFAULT_DESCRIPTOR)){ + struct security_acl *pr_acl, *tmp_acl, *tpr_acl; + tpr_acl = preprocess_creator_acl(new_sd, c_acl); + tmp_acl = calculate_inherited_from_creator(new_sd, + tpr_acl, + is_container, + object_list); + /* Todo some refactoring here! */ + if (acl_type == SEC_DESC_DACL_PRESENT && + !(creator_sd->type & SECINFO_PROTECTED_DACL) && + (inherit_flags & SEC_DACL_AUTO_INHERIT)){ + pr_acl = calculate_inherited_from_parent(new_sd, + p_acl, + is_container, + object_list); + + *new_acl = security_acl_concatenate(new_sd, tmp_acl, pr_acl); + new_sd->type |= SEC_DESC_DACL_AUTO_INHERITED; + } + else if (acl_type == SEC_DESC_SACL_PRESENT && + !(creator_sd->type & SECINFO_PROTECTED_SACL) && + (inherit_flags & SEC_SACL_AUTO_INHERIT)){ + pr_acl = calculate_inherited_from_parent(new_sd, + p_acl, + is_container, + object_list); + + *new_acl = security_acl_concatenate(new_sd, tmp_acl, pr_acl); + new_sd->type |= SEC_DESC_SACL_AUTO_INHERITED; + } + } + if (*new_acl == NULL) + goto final; + if (!postprocess_acl(*new_acl, new_sd->owner_sid, + new_sd->group_sid,generic_map)) + return false; + else + goto final; + } + else{ + if (!c_acl){ + if (acl_type == SEC_DESC_DACL_PRESENT && token->default_dacl) + *new_acl = security_acl_dup(new_sd, token->default_dacl); + } + else{ + *new_acl = preprocess_creator_acl(new_sd,c_acl); + if (*new_acl == NULL) + goto final; + if (!postprocess_acl(*new_acl, new_sd->owner_sid, + new_sd->group_sid,generic_map)) + return false; + else + goto final; + } + } +final: + if (acl_type == SEC_DESC_DACL_PRESENT && new_sd->dacl) + new_sd->type |= SEC_DESC_DACL_PRESENT; + + if (acl_type == SEC_DESC_SACL_PRESENT && new_sd->sacl) + new_sd->type |= SEC_DESC_SACL_PRESENT; + /* This is a hack to handle the fact that + * apprantly any AI flag provided by the user is preserved */ + if (creator_sd) + new_sd->type |= creator_sd->type; + return true; +} + struct security_descriptor *create_security_descriptor(TALLOC_CTX *mem_ctx, struct security_descriptor *parent_sd, struct security_descriptor *creator_sd, @@ -108,10 +442,20 @@ struct security_descriptor *create_security_descriptor(TALLOC_CTX *mem_ctx, talloc_free(new_sd); return NULL; } - /* Todo remove */ - if (creator_sd && creator_sd->type & SEC_DESC_DACL_PRESENT){ - new_sd->dacl = security_acl_dup(new_sd, creator_sd->dacl); - new_sd->type |= SEC_DESC_DACL_PRESENT; + + if (!compute_acl(SEC_DESC_DACL_PRESENT, parent_sd, creator_sd, + is_container, inherit_flags, object_list, + generic_map,token,new_sd)){ + talloc_free(new_sd); + return NULL; } + + if (!compute_acl(SEC_DESC_SACL_PRESENT, parent_sd, creator_sd, + is_container, inherit_flags, object_list, + generic_map, token,new_sd)){ + talloc_free(new_sd); + return NULL; + } + return new_sd; } diff --git a/source4/scripting/python/samba/provision.py b/source4/scripting/python/samba/provision.py index fe11b94d67..25cec4b143 100644 --- a/source4/scripting/python/samba/provision.py +++ b/source4/scripting/python/samba/provision.py @@ -48,6 +48,7 @@ from samba import DS_DOMAIN_FUNCTION_2000, DS_DC_FUNCTION_2008_R2 from samba.samdb import SamDB from samba.idmap import IDmapDB from samba.dcerpc import security +from samba.ndr import ndr_pack import urllib from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError, timestring from ms_schema import read_ms_schema @@ -76,6 +77,39 @@ def find_setup_dir(): return ret raise Exception("Unable to find setup directory.") +def get_schema_descriptor(domain_sid): + sddl = "O:SAG:SAD:(A;CI;RPLCLORC;;;AU)(A;CI;RPWPCRCCLCLORCWOWDSW;;;SA)" \ + "(A;CI;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)" \ + "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \ + "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;ED)" \ + "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \ + "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;BA)" \ + "S:(AU;SA;WPCCDCWOWDSDDTSW;;;WD)" \ + "(AU;CISA;WP;;;WD)(AU;SA;CR;;;BA)" \ + "(AU;SA;CR;;;DU)(OU;SA;CR;e12b56b6-0a95-11d1-adbb-00c04fd8d5cd;;WD)" \ + "(OU;SA;CR;45ec5156-db7e-47bb-b53f-dbeb2d03c40f;;WD)" + sec = security.descriptor.from_sddl(sddl, domain_sid) + return b64encode(ndr_pack(sec)) + +def get_config_descriptor(domain_sid): + sddl = "O:EAG:EAD:(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \ + "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \ + "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \ + "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \ + "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \ + "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \ + "(A;;RPLCLORC;;;AU)(A;CI;RPWPCRCCDCLCLORCWOWDSDDTSW;;;EA)" \ + "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;CIIO;RPWPCRCCLCLORCWOWDSDSW;;;DA)" \ + "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \ + "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;ED)" \ + "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \ + "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;BA)" \ + "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;S-1-5-21-3191434175-1265308384-3577286990-498)" \ + "S:(AU;SA;WPWOWD;;;WD)(AU;SA;CR;;;BA)(AU;SA;CR;;;DU)" \ + "(OU;SA;CR;45ec5156-db7e-47bb-b53f-dbeb2d03c40f;;WD)" + sec = security.descriptor.from_sddl(sddl, domain_sid) + return b64encode(ndr_pack(sec)) + DEFAULTSITE = "Default-First-Site-Name" @@ -142,7 +176,7 @@ class ProvisionResult(object): self.samdb = None class Schema(object): - def __init__(self, setup_path, schemadn=None, + def __init__(self, setup_path, domain_sid, schemadn=None, serverdn=None, sambadn=None, ldap_backend_type=None): """Load schema for the SamDB from the AD schema files and samba4_schema.ldif @@ -165,8 +199,11 @@ class Schema(object): {"SCHEMADN": schemadn, "SERVERDN": serverdn, }) + + descr = get_schema_descriptor(domain_sid) self.schema_dn_add = read_and_sub_file(setup_path("provision_schema_basedn.ldif"), - {"SCHEMADN": schemadn + {"SCHEMADN": schemadn, + "DESCRIPTOR": descr }) prefixmap = open(setup_path("prefixMap.txt"), 'r').read() @@ -847,7 +884,7 @@ def setup_samdb(path, setup_path, session_info, credentials, lp, ldap_backend=ldap_backend, serverrole=serverrole) if (schema == None): - schema = Schema(setup_path, schemadn=names.schemadn, serverdn=names.serverdn, + schema = Schema(setup_path, domainsid, schemadn=names.schemadn, serverdn=names.serverdn, sambadn=names.sambadn, ldap_backend_type=ldap_backend.ldap_backend_type) # Load the database, but importantly, use Ldb not SamDB as we don't want to load the global schema @@ -928,8 +965,10 @@ def setup_samdb(path, setup_path, session_info, credentials, lp, }) message("Adding configuration container") + descr = get_config_descriptor(domainsid); setup_add_ldif(samdb, setup_path("provision_configuration_basedn.ldif"), { "CONFIGDN": names.configdn, + "DESCRIPTOR": descr, }) message("Modifying configuration container") setup_modify_ldif(samdb, setup_path("provision_configuration_basedn_modify.ldif"), { @@ -1049,7 +1088,7 @@ def provision(setup_dir, message, session_info, """ def setup_path(file): - return os.path.join(setup_dir, file) + return os.path.join(setup_dir, file) if domainsid is None: domainsid = security.random_sid() @@ -1132,7 +1171,7 @@ def provision(setup_dir, message, session_info, ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="") - schema = Schema(setup_path, schemadn=names.schemadn, serverdn=names.serverdn, + schema = Schema(setup_path, domainsid, schemadn=names.schemadn, serverdn=names.serverdn, sambadn=names.sambadn, ldap_backend_type=ldap_backend_type) secrets_credentials = credentials diff --git a/source4/selftest/knownfail b/source4/selftest/knownfail index d4ad716d6a..fcb16c9814 100644 --- a/source4/selftest/knownfail +++ b/source4/selftest/knownfail @@ -56,4 +56,5 @@ samba4.winbind.struct.*.LOOKUP_NAME_SID # Not yet working in winbind ^samba4.*base.delaywrite.*update of write time using SET_END_OF_FILE$ ^samba4.*base.delaywrite.*update of write time using SET_ALLOCATION_SIZE$ ^samba4.ldap.python \(dc\).Test add_ldif\(\) with BASE64 security descriptor input using WRONG domain SID$ -^samba4.ldap.secdesc.python
\ No newline at end of file +^samba4.ldap.python \(dc\).Testing ldb.add_ldif\(\) for nTSecurityDescriptor +^samba4.ldap.secdesc.python diff --git a/source4/setup/provision_configuration_basedn.ldif b/source4/setup/provision_configuration_basedn.ldif index f009113f10..b385359a61 100644 --- a/source4/setup/provision_configuration_basedn.ldif +++ b/source4/setup/provision_configuration_basedn.ldif @@ -5,3 +5,4 @@ dn: ${CONFIGDN} objectClass: top objectClass: configuration cn: Configuration +nTSecurityDescriptor:: ${DESCRIPTOR} diff --git a/source4/setup/provision_schema_basedn.ldif b/source4/setup/provision_schema_basedn.ldif index 8c7ce88bac..5301a11965 100644 --- a/source4/setup/provision_schema_basedn.ldif +++ b/source4/setup/provision_schema_basedn.ldif @@ -5,3 +5,4 @@ dn: ${SCHEMADN} objectClass: top objectClass: dMD cn: Schema +nTSecurityDescriptor:: ${DESCRIPTOR} |