diff options
author | David Mulder <dmulder@suse.com> | 2020-11-06 09:29:57 -0700 |
---|---|---|
committer | David Mulder <dmulder@samba.org> | 2020-12-09 17:38:28 +0000 |
commit | b402c7642c5569bd0d8a6a9df4859f8bd89784b7 (patch) | |
tree | 149c8df9beda0099cd61dee38349ca48d204e3af /python | |
parent | 6f1374844c3bced28ac59633d12f2125a74376db (diff) | |
download | samba-b402c7642c5569bd0d8a6a9df4859f8bd89784b7.tar.gz |
samba-tool: Add a gpo command for listing Sudoers Group Policies
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Diffstat (limited to 'python')
-rw-r--r-- | python/samba/netcmd/gpo.py | 43 |
1 files changed, 41 insertions, 2 deletions
diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py index 0b0740729a4..6a3f62299b5 100644 --- a/python/samba/netcmd/gpo.py +++ b/python/samba/netcmd/gpo.py @@ -37,7 +37,8 @@ from samba.netcmd import ( from samba.samdb import SamDB from samba import dsdb from samba.dcerpc import security -from samba.ndr import ndr_unpack +from samba.ndr import ndr_unpack, ndr_pack +from samba.dcerpc import preg import samba.security import samba.auth from samba.auth import AUTH_SESSION_INFO_DEFAULT_GROUPS, AUTH_SESSION_INFO_AUTHENTICATED, AUTH_SESSION_INFO_SIMPLE_PRIVILEGES @@ -1666,6 +1667,11 @@ class cmd_admxload(Command): class cmd_list_sudoers(Command): """List Samba Sudoers Group Policy from the sysvol + +This command lists sudo rules from the sysvol that will be applied to winbind clients. + +Example: +samba-tool gpo manage sudoers list {31B2F340-016D-11D2-945F-00C04FB984F9} """ synopsis = "%prog <gpo> [options]" @@ -1684,7 +1690,40 @@ class cmd_list_sudoers(Command): takes_args = ["gpo"] def run(self, gpo, H=None, sambaopts=None, credopts=None, versionopts=None): - pass + self.lp = sambaopts.get_loadparm() + self.creds = credopts.get_credentials(self.lp, fallback_machine=True) + + # We need to know writable DC to setup SMB connection + if H and H.startswith('ldap://'): + dc_hostname = H[7:] + self.url = H + else: + dc_hostname = netcmd_finddc(self.lp, self.creds) + self.url = dc_url(self.lp, self.creds, dc=dc_hostname) + + # SMB connect to DC + conn = smb_connection(dc_hostname, + 'sysvol', + lp=self.lp, + creds=self.creds) + + realm = self.lp.get('realm') + pol_file = '\\'.join([realm.lower(), 'Policies', gpo, + 'MACHINE\\Registry.pol']) + try: + pol_data = ndr_unpack(preg.file, conn.loadfile(pol_file)) + except NTSTATUSError as e: + if e.args[0] == 0xC0000033: # STATUS_OBJECT_NAME_INVALID + return # The file doesn't exist, so there is nothing to list + if e.args[0] == 0xC0000022: # STATUS_ACCESS_DENIED + raise CommandError("The authenticated user does " + "not have sufficient privileges") + raise + + keyname = b'Software\\Policies\\Samba\\Unix Settings\\Sudo Rights' + for entry in pol_data.entries: + if get_bytes(entry.keyname) == keyname: + self.outf.write('%s\n' % entry.data) class cmd_sudoers(SuperCommand): """Manage Sudoers Group Policy Objects""" |