ó
    cÛ–i–"  ã                   ót   • S r SSKJrJrJrJrJr  SSKrSSKJ	r	  SSK
JrJrJr  SSKJr  S r " S S	\5      rg)
z5Utility methods for security descriptor manipulation.é    )ÚFLAG_MOD_REPLACEÚ
SCOPE_BASEÚDnÚMessageÚMessageElementN)Úsecurity)Úndr_deepcopyÚndr_packÚ
ndr_unpack)ÚNT_STATUS_OBJECT_NAME_NOT_FOUNDc                 ó>   ^• SmSR                  U4S jU  5       5      $ )a#  Encode claim attribute names according to [MS-DTYP] 2.5.1 ("attr-char2")

Some characters must be encoded as %hhhh, while others must not be.
Of the optional ones, we encode some control characters.

The   byte is also encoded, which is useful for tests, but it
is forbidden in either form.
z 	
 !"%&()<=>|Ú c              3   óR   >#   • U  H  nUT;  a  UOS [        U5      S 3v •  M     g7f)Ú%Ú04xN)Úord)Ú.0ÚcÚescapess     €Ú0/usr/lib/python3/dist-packages/samba/sd_utils.pyÚ	<genexpr>Ú#escaped_claim_id.<locals>.<genexpr>'   s;   øé € ð &ò %�qð ˜wÓ&ñ àœC ›F 3˜<Ð(ô)ò %ùs   ƒ$')Újoin)Úclaim_idr   s    @r   Úescaped_claim_idr      s*   ø€ ð .€GØ�7‰7ô &ñ %ó&ó &ð &ó    c                   ót   • \ rS rSrSrS rSS jrSS jrS r  SS jr	SS	 jr
S
 rSS jrSS jrSS jrSrg)ÚSDUtilsé-   zCSome utilities for manipulation of security descriptors on objects.c                 óv   • Xl         [        R                  " U R                   R                  5       5      U l        g ©N)Úldbr   Údom_sidÚget_domain_sidÚ
domain_sid)ÚselfÚsamdbs     r   Ú__init__ÚSDUtils.__init__0   s&   € ØŒÜ"×*Ò*¨4¯8©8×+BÑ+BÓ+DÓEˆ�r   Nc                 ó"  • [        5       n[        U[        5      (       a  Xl        O[        U R                  U5      Ul        [        U[
        5      (       d!  [        U[        R                  5      (       d   e[        U[
        5      (       a*  [        R                  R                  X R                  5      nO![        U[        R                  5      (       a  Un[        [        W5      [        S5      US'   U R                  R                  XC5        g)zRModify security descriptor using either SDDL string
or security.descriptor object
ÚnTSecurityDescriptorN)r   Ú
isinstancer   Údnr"   Ústrr   Ú
descriptorÚ	from_sddlr%   r   r
   r   Úmodify)r&   Ú	object_dnÚsdÚcontrolsÚmÚtmp_descs         r   Úmodify_sd_on_dnÚSDUtils.modify_sd_on_dn4   sÃ   € ô ‹IˆÜ�i¤×$Ñ$Ø�Dä�d—h‘h 	Ó*ˆAŒDä˜2œs×#Ñ#¤z°"´h×6IÑ6I×'JÑ'JÐKÐJÜ�bœ#×ÑÜ×*Ñ*×4Ñ4°R¿¹ÓI‰HÜ˜œH×/Ñ/×0Ñ0ØˆHä$2´8¸HÓ3EÜ3CØ3Ió%KˆÐ
 Ñ!ð 	�‰�‰˜Õ$r   c                 ó�   • U R                   R                  U[        S S/US9nUS   S   S   n[        [        R
                  U5      $ )Nr+   ©r4   r   )r"   Úsearchr   r   r   r/   )r&   r2   r4   ÚresÚdescs        r   Úread_sd_on_dnÚSDUtils.read_sd_on_dnI   sO   € Ø�h‰h�o‰o˜i¬°TØ5Ð6Àð ð Kˆà�1‰vÐ,Ñ-¨aÑ0ˆÜœ(×-Ñ-¨tÓ4Ð4r   c                 ó~   • U R                   R                  U5      n[        [        R                  US   S   S   5      $ )Nr   Ú	objectSid)r"   r;   r   r   r#   )r&   r2   r<   s      r   Úget_object_sidÚSDUtils.get_object_sidO   s5   € Ø�h‰h�o‰o˜iÓ(ˆÜœ(×*Ñ*¨C°©F°;Ñ,?ÀÑ,BÓCÐCr   c                 ó(  ^ • Uc  / nUc  / nU 4S jnUc§  Uc  S[         R                  -  /nT R                  XS9nUR                  [         R                  -  (       d^  [        UR                  5      nUR                   H9  n	U	R                  [         R                  -  (       d  M'   UR                  U	5        M;     OeUc  / nT R                  R!                  U["        S U/US9n[%        US   U   S   5      n[         R&                  R)                  UT R*                  5      nSn/ n/ n/ nU H¸  n	[-        U	[$        5      (       a  U" U	5      n	[-        U	[         R.                  5      (       d   eU	R                  [         R                  -  (       a  UR1                  U	5        Mv  X—R                  R                  ;  a  UR1                  U	5        M¢  UR                  U	5        US-  nMº     U Hà  n	Sn[-        U	[2        5      (       a  SU	;   a  U	S   nU	S   n	[-        U	[$        5      (       a  U" U	5      n	[-        U	[         R.                  5      (       d   eU	R                  [         R                  -  (       a  UR1                  U	5        M�  X—R                  R                  ;   a  UR1                  U	5        MÉ  UR5                  U	U5        US-  nMâ     US:X  a  XïU4$ Uc  T R7                  XUS9  OiUR9                  T R*                  5      n[;        5       nUUl        [?        URA                  S	5      [B        U5      UU'   T R                  RE                  UUS9  XïU4$ ! [        R                   a%  n
U
R                  S   [        :w  a  U
e S n
A
GM  S n
A
ff = f)
Nc                 óÚ   >• [         R                  R                  SU -   TR                  5      n[	        UR
                  R                  5      S:X  d   eUR
                  R                  S   $ )NúD:é   r   )r   r/   r0   r%   ÚlenÚdaclÚaces)Úace_sddlÚace_sdr&   s     €r   Úace_from_sddlÚ2SDUtils.update_aces_in_dacl.<locals>.ace_from_sddlZ   sU   ø€ Ü×(Ñ(×2Ñ2°4¸(±?ÀDÇOÁOÓTˆFÜ�v—{‘{×'Ñ'Ó(¨AÓ-Ð-Ð-Ø—;‘;×#Ñ# AÑ&Ð&r   zsd_flags:1:%dr:   r   rG   éÿÿÿÿÚidxÚaceÚascii)#r   ÚSECINFO_DACLr>   ÚtypeÚSEC_DESC_DACL_PROTECTEDr	   rI   rJ   ÚflagsÚSEC_ACE_FLAG_INHERITED_ACEÚdacl_del_aceÚsambaÚNTSTATUSErrorÚargsr   r"   r;   r   r.   r/   r0   r%   r,   rQ   ÚappendÚdictÚdacl_addr7   Úas_sddlr   r-   r   Úencoder   r1   )r&   r-   Údel_acesÚadd_acesÚ	sddl_attrr4   rM   r3   Ú	dacl_copyrQ   Úerrr<   Úold_sddlÚnum_changesÚdel_ignoredÚadd_ignoredÚinherited_ignoredÚadd_idxÚnew_sddlr5   s   `                   r   Úupdate_aces_in_daclÚSDUtils.update_aces_in_daclS   s7  ø€ àÑØˆHØÑØˆHõ	'ð
 ÑØÑØ+¬h×.CÑ.CÑCÐD�Ø×#Ñ# BÐ#Ð:ˆBØ—7‘7œX×=Ñ=×=ô )¨¯©Ó1�	Ø$Ÿ>œ>�CØ—y‘y¤8×#FÑ#F×FÑFð!ØŸO™O¨CÖ0ñ *øð ÑØ�Ø—(‘(—/‘/ "¤j°$Ø#, +¸ð "ð BˆCä˜3˜q™6 )Ñ,¨QÑ/Ó0ˆHÜ×$Ñ$×.Ñ.¨x¸¿¹ÓIˆBàˆØˆØˆØÐãˆCÜ˜#œs×#Ñ#Ù# CÓ(�Ü˜c¤8§<¡<×0Ñ0Ð0Ð0à�y‰yœ8×>Ñ>×>Ø!×(Ñ(¨Ô-ÙàŸ'™'Ÿ,™,Ó&Ø×"Ñ" 3Ô'Ùà�O‰O˜CÔ Ø˜1ÑŠKñ ó  ˆCØˆGÜ˜#œt×$Ñ$Ø˜C“<Ø! %™j�GØ˜%‘j�Ü˜#œs×#Ñ#Ù# CÓ(�Ü˜c¤8§<¡<×0Ñ0Ð0Ð0à�y‰yœ8×>Ñ>×>Ø!×(Ñ(¨Ô-Ùà—g‘g—l‘lÓ"Ø×"Ñ" 3Ô'Ùà�K‰K˜˜WÔ%Ø˜1ÑŠKñ' ð* ˜!ÓØÐ->Ð>Ð>àÑØ× Ñ  °(Ð Ò;à—z‘z $§/¡/Ó2ˆHÜ“	ˆAØˆAŒDÜ)¨(¯/©/¸'Ó*BÜ*:Ø*3ó5ˆAˆi‰Lð �H‰H�O‰O˜A¨ˆOÑ1àÐ):Ð:Ð:øôM  %×2Ñ2ó !Ø"Ÿx™x¨™{Ô.MÓMØ&) 	ö !ûð!ús   Â&MÍNÍ,NÎNc                 óú   • [         R                  R                  SU-   U R                  5      n/ nSnUR                  R
                   H  nUR                  XgS.5        US-  nM     U R                  XUS9u  p‰n
Xš4$ )zCPrepend an ACE (or more) to an objects security descriptor
        rF   r   )rP   rQ   rG   ©rb   r4   ©r   r/   r0   r%   rI   rJ   r\   rm   )r&   r2   rJ   r4   rL   rb   rk   rQ   Ú_ÚaiÚiis              r   Údacl_prepend_acesÚSDUtils.dacl_prepend_aces¶   s‚   € ô ×$Ñ$×.Ñ.¨t°d©{¸D¿O¹OÓLˆØˆØˆØ—;‘;×#Ô#ˆCØ�O‰O GÑ8Ô9Ø�q‰LŠGñ $ð ×,Ñ,¨YØ6>ð -ð @‰	ˆˆràˆvˆr   c                 ó,   • U R                  XS/S9u    ng)z?Add an ACE (or more) to an objects security descriptor
        úshow_deleted:1r:   N)ru   )r&   r2   rQ   rr   s       r   Údacl_add_aceÚSDUtils.dacl_add_aceÃ   s&   € ð ×%Ñ% iØ0@Ð/Að &ð C‰ˆ‰1r   c                 óè   • [         R                  R                  SU-   U R                  5      n/ nUR                  R
                   H  nUR                  U5        M     U R                  XUS9u  pxn	X‰4$ )zBAppend an ACE (or more) to an objects security descriptor
        rF   rp   rq   )
r&   r2   rJ   r4   rL   rb   rQ   rr   rs   rt   s
             r   Údacl_append_acesÚSDUtils.dacl_append_acesÉ   so   € ô ×$Ñ$×.Ñ.¨t°d©{¸D¿O¹OÓLˆØˆØ—;‘;×#Ô#ˆCØ�O‰O˜CÖ ñ $à×,Ñ,¨YØ6>ð -ð @‰	ˆˆràˆvˆr   c                 óè   • [         R                  R                  SU-   U R                  5      n/ nUR                  R
                   H  nUR                  U5        M     U R                  XUS9u  pxn	Xy4$ )zBDelete an ACE (or more) to an objects security descriptor
        rF   )ra   r4   rq   )
r&   r2   rJ   r4   Údel_sdra   rQ   Údirr   rt   s
             r   Údacl_delete_acesÚSDUtils.dacl_delete_acesÔ   so   € ô ×$Ñ$×.Ñ.¨t°d©{¸D¿O¹OÓLˆØˆØ—;‘;×#Ô#ˆCØ�O‰O˜CÖ ñ $à×,Ñ,¨YØ6>ð -ð @‰	ˆˆràˆvˆr   c                 ól   • Uc  / nU R                  XS/-   5      nUR                  U R                  5      $ )z:Return object nTSecurityDescriptor in SDDL format
        rx   )r>   r_   r%   )r&   r2   r4   r=   s       r   Úget_sd_as_sddlÚSDUtils.get_sd_as_sddlß   s;   € ð ÑØˆHØ×!Ñ! )Ð9IÐ8JÑ-JÓKˆØ�|‰|˜DŸO™OÓ,Ð,r   )r%   r"   r!   )NNNN)Ú__name__Ú
__module__Ú__qualname__Ú__firstlineno__Ú__doc__r(   r7   r>   rB   rm   ru   ry   r|   r�   r„   Ú__static_attributes__© r   r   r   r   -   sE   † ÙMòFô%ô*5òDð ?CØ59ôa;ôFòCô	ô	÷-r   r   )rŠ   r"   r   r   r   r   r   rY   Úsamba.dcerpcr   Ú	samba.ndrr	   r
   r   Úsamba.ntstatusr   r   Úobjectr   rŒ   r   r   Ú<module>r‘      s2   ðñ& <ç IÕ Iã Ý !ß 8Ñ 8Ý :ò&ô x-ˆfõ x-r   