summaryrefslogtreecommitdiff
path: root/python/samba/ntacls.py
AgeCommit message (Collapse)AuthorFilesLines
2025-05-26python: Fix code spellingJennifer Sutton1-1/+1
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-03-19python:ntacls: pull allow list out of loopDouglas Bagnall1-13/+11
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14927 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Ralph Boehme <slow@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Wed Mar 19 15:56:38 UTC 2025 on atb-devel-224
2025-03-19python/ntacls.py: only allow allow and deny ACEs in setntacl()Ralph Boehme1-9/+25
Commit 27dd0afb62d4f7427c966e984c7c8b01bc4d93b5 introduced a regression. Before that commit we included only SEC_ACE_TYPE_ACCESS_ALLOWED(0) as 'not type & SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT' filtered out SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT(5), but also SEC_ACE_TYPE_ACCESS_DENIED and SEC_ACE_TYPE_ACCESS_DENIED_OBJECT. After that commit we started to include SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT, which is wrong. It was also always wrong to exclude SEC_ACE_TYPE_ACCESS_DENIED(1). So now we make it explicit that we only include SEC_ACE_TYPE_ACCESS_ALLOWED and SEC_ACE_TYPE_ACCESS_DENIED. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14927 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Ralph Boehme <slow@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org>
2023-12-15python: pep257: docstring should use double quotesRob van der Linde1-1/+1
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30python: Remove redundant backslashesJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-23python:samba: Fix code spellingAndreas Schneider1-2/+2
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Fri Jun 23 14:51:14 UTC 2023 on atb-devel-224
2022-10-04CVE-2007-4559 python: ensure sanity in our tarfilesDouglas Bagnall1-1/+2
Python's tarfile module is not very careful about paths that step out of the target directory. We can be a bit better at little cost. This was reported in 2007[1], and has recently been publicised [2, for example]. We were informed of this bug in December 2021 by Luis Alberto López Alvar, but decided then that there were no circumstances under which this was a security concern. That is, if you can alter the backup files, you can already do worse things. But there is a case to guard against an administrator being tricked into trying to restore a file that isn't based on a real backup. [1] https://nvd.nist.gov/vuln/detail/CVE-2007-4559 [2] https://www.theregister.com/2022/09/22/python_vulnerability_tarfile/ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15185 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue Oct 4 03:48:43 UTC 2022 on sn-devel-184
2022-03-17python/ntacls.py: Fix ACE type comparisonJoseph Sutton1-1/+2
SEC_ACE_TYPE_ values are not flags, so this comparison does not behave as intended. Modify the check to more closely match the one in gp_create_gpt_security_descriptor(). Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-28python: remove all 'from __future__ import print_function'Douglas Bagnall1-2/+0
This made Python 2's print behave like Python 3's print(). In some cases, where we had: from __future__ import print_function """Intended module documentation...""" this will have the side effect of making the intended module documentation work as the actual module documentation (i.e. becoming __doc__), because it is once again the first statement in the module. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-03-24netcmd: Fix opening SamDB database for offline backupJoseph Sutton1-4/+1
When opening the backed-up SamDB database, open the top-level database without loading any modules so the backend database files aren't unnecessarily opened. The domain SID is now fetched from the original database rather than from the backup. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14676 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Samuel Cabrero <scabrero@samba.org>
2020-12-17python/ntacls.py: add SMBHelper.set_acl() helper functionBjörn Baumbach1-0/+14
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Björn Baumbach <bb@sernet.de> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2020-12-17python/ntacls.py: let SMBHelper.get_acl() use the default values of ↵Stefan Metzmacher1-9/+5
self.smb_conn.get_acl() Now that self.smb_conn.get_acl() has sane default values for secinfo and access_mask we can remove any additional logic in SMBHelper. The resulting values are the same. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-12-20pysmbd: add "session_info" arg tp py_smbd_create_file()Ralph Boehme1-2/+2
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-12-20pysmbd: add "session_info" arg to py_smbd_mkdir()Ralph Boehme1-2/+2
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-12-20pysmbd: make "session_info" arg to py_smbd_get_nt_acl() mandatoryRalph Boehme1-8/+8
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-12-20pysmbd: make "session_info" arg to py_smbd_set_nt_acl() mandatoryRalph Boehme1-8/+14
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-08-17Prevent samba-tool online backup crashDavid Mulder1-5/+32
On some GPOs, getting a files ntacl throws an NT_STATUS_ACCESS_DENIED. Catch and log the failure when this happens. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14088 Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Tim Beale <timbeale@samba.org>
2019-06-18python/ntacls: use correct "state directory" smb.conf option instead of ↵Björn Baumbach1-1/+3
"state dir" samba-tool ntacl get testfile --xattr-backend=tdb --use-ntvfs Fixes: Unknown parameter encountered: "state dir" Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-05-28python/ntacls: we only need security.SEC_STD_READ_CONTROL in order to get ↵Stefan Metzmacher1-1/+1
the ACL We should avoid security.SEC_FLAG_MAXIMUM_ALLOWED otherwise we may get NT_STATUS_SHARING_VIOLATION when we run 'samba-tool domain backup online' against a Windows DC. Windows DCs have hidden folders for the NtFrs or Dfsr services, which are locked by the running service. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13917 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2019-01-17ntacls: Pass correct use_ntvfs through to setntacl()Tim Beale1-1/+2
We were already checking the smb.conf to see if it uses the NTVFS file server or the default smbd server. However, we weren't passing this through to the setntacl() call. This fixes the problem we noticed with 'samba-tool gpo aclcheck' failing after a restore. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-09s3:libsmb: Revert SMB Py bindings name back to libsmb_samba_internalTim Beale1-1/+1
In order to make it clear that the APIs in these Python bindings are unstable and should not be used by external consumers, this patch changes the name of the Python bindings back to libsmb_samba_internal. To make the Python code that uses these bindings (i.e. samba-tool, etc) look a little cleaner, we can just change the module name as we import it, e.g. from samba.samba3 import libsmb_samba_internal as libsmb Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Wed Jan 9 14:30:31 CET 2019 on sn-devel-144
2019-01-07python/ntacls: Convert ntacls to use s3 flagsTim Beale1-6/+6
This helper code is just using the flags defined by the Python bindings. Convert it over to use s3 bindings instead of s4. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-10-25python/ntacls: remove unused importsDouglas Bagnall1-1/+0
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2018-10-11pysmbd: add option to pass a session info to set_nt_acl() functionBjörn Baumbach1-2/+11
A filled session info is needed by some vfs modules, e.g. full_audit. Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Volker Lendecke <vl@samba.org>
2018-08-24PEP8: add spaces after operatorsDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-08-24PEP8: fix E401: multiple imports on one lineJoe Guo1-1/+3
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E302: expected 2 blank lines, found 1Joe Guo1-0/+2
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E228: missing whitespace around modulo operatorJoe Guo1-1/+1
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E222: multiple spaces after operatorJoe Guo1-1/+1
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E127: continuation line over-indented for visual indentJoe Guo1-5/+5
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E115: expected an indented block (comment)Joe Guo1-1/+1
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-07-12ntacls: add session_info arg to setntacl and pass down to set_nt_acl apiJoe Guo1-4/+35
Then underneath code can reuse the authentication info in session to improve performance. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13521 Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2018-07-12ntacls: reuse predefined SECURITY_SECINFO_FLAGSJoe Guo1-3/+3
Use predefined SECURITY_SECINFO_FLAGS to replace bitwise or operations on flag list. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13521 Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2018-06-28ntacls: add functions to backup and restore ntaclsJoe Guo1-0/+327
1. backup a share online from a smb connection with ntacls using pysmb API. 2. backup a share offline from service path with ntacls using pysmbd API. 3. restore from tarfile with pysmdb API. Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-03-23samba python libs: convert print func to be py2/py3 compatibleNoel Power1-2/+3
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2015-09-29samba-tool: add command to dump dosinfo xattr from a fileRalph Boehme1-0/+8
Add a new command "getdosinfo" to samba-tool to dump dosinfo xattr from a file. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Tue Sep 29 06:00:49 CEST 2015 on sn-devel-104
2013-03-02Move python modules from source4/scripting/python/ to python/.Jelmer Vernooij1-0/+240
Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sat Mar 2 03:57:34 CET 2013 on sn-devel-104
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 19:43:18 +0000