gpo: Fix unapply failure when multiple extensions run

When multiple Group Policy Extensions are present,
only the last executed extension saves it's
changes to the Group Policy Database, due to the
database being loaded seperately for each
extension.

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

diff --git a/python/samba/gpclass.py b/python/samba/gpclass.py
index 37d6be38de820e80189976e4b91f88c02426d310..ddb580d7301bb1889438218071ada0af61e42acc 100644 (file)
--- a/python/samba/gpclass.py
+++ b/python/samba/gpclass.py
@@ -453,6 +453,7 @@ def apply_gp(lp, creds, logger, store, gp_extensions, force=False):
     store.start()
     for ext in gp_extensions:
         try:
+            ext = ext(logger, lp, creds, store)
             ext.process_group_policy(del_gpos, changed_gpos)
         except Exception as e:
             logger.error('Failed to apply extension  %s' % str(ext))
@@ -476,6 +477,7 @@ def unapply_gp(lp, creds, logger, store, gp_extensions):
     store.start()
     for ext in gp_extensions:
         try:
+            ext = ext(logger, lp, creds, store)
             ext.process_group_policy(del_gpos, [])
         except Exception as e:
             logger.error('Failed to unapply extension  %s' % str(ext))
@@ -507,6 +509,7 @@ def rsop(lp, creds, gp_extensions, target):
         print('GPO: %s' % gpo.display_name)
         print('='*term_width)
         for ext in gp_extensions:
+            ext = ext(logger, lp, creds, store)
             print('  CSE: %s' % ext.__module__.split('.')[-1])
             print('  ' + ('-'*int(term_width/2)))
             for section, settings in ext.rsop(gpo).items():

diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py
index 76030fa389eddd38faa8fa02acefa38b5f775f71..005f6a4e2ef5fc741f365ce87b649b04b3f1cf51 100644 (file)
--- a/python/samba/tests/gpo.py
+++ b/python/samba/tests/gpo.py
@@ -480,11 +480,9 @@ class GPOTests(tests.TestCase):
             gpos = ads.get_gpo_list(machine_creds.get_username())
 
         gp_extensions = []
-        gp_extensions.append(gp_krb_ext(logger, self.lp, machine_creds, store))
-        gp_extensions.append(gp_scripts_ext(logger, self.lp, machine_creds,
-            store))
-        gp_extensions.append(gp_sudoers_ext(logger, self.lp, machine_creds,
-            store))
+        gp_extensions.append(gp_krb_ext)
+        gp_extensions.append(gp_scripts_ext)
+        gp_extensions.append(gp_sudoers_ext)
 
         # Create registry stage data
         reg_pol = os.path.join(local_path, policies, '%s/MACHINE/REGISTRY.POL')
@@ -515,6 +513,7 @@ class GPOTests(tests.TestCase):
             self.assertTrue(ret, 'Could not create the target %s' %
                                  (reg_pol % g.name))
             for ext in gp_extensions:
+                ext = ext(logger, self.lp, machine_creds, store)
                 ret = ext.rsop(g)
                 self.assertEquals(len(ret.keys()), 1,
                                   'A single policy should have been displayed')
@@ -559,11 +558,9 @@ class GPOTests(tests.TestCase):
             gpos = ads.get_gpo_list(machine_creds.get_username())
 
         gp_extensions = []
-        gp_extensions.append(gp_krb_ext(logger, self.lp, machine_creds, store))
-        gp_extensions.append(gp_scripts_ext(logger, self.lp, machine_creds,
-            store))
-        gp_extensions.append(gp_sudoers_ext(logger, self.lp, machine_creds,
-            store))
+        gp_extensions.append(gp_krb_ext)
+        gp_extensions.append(gp_scripts_ext)
+        gp_extensions.append(gp_sudoers_ext)
 
         # Create registry stage data
         reg_pol = os.path.join(local_path, policies, '%s/MACHINE/REGISTRY.POL')
@@ -597,6 +594,7 @@ class GPOTests(tests.TestCase):
         remove = []
         with TemporaryDirectory() as dname:
             for ext in gp_extensions:
+                ext = ext(logger, self.lp, machine_creds, store)
                 if type(ext) == gp_krb_ext:
                     ext.process_group_policy([], gpos)
                     ret = store.get_int('kdc:user_ticket_lifetime')

diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo
deleted file mode 100644 (file)
index a1ebedf..0000000
--- a/selftest/knownfail.d/gpo
+++ /dev/null
@@ -1,2 +0,0 @@
-samba.tests.gpo.samba.tests.gpo.GPOTests.test_process_group_policy
-samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_unapply

diff --git a/source4/scripting/bin/samba-gpupdate b/source4/scripting/bin/samba-gpupdate
index 33e1fb793fc8a5047f533b246f39b669b22b79ea..a5566cce6f2308782a317e548152c0766526cbd2 100755 (executable)
--- a/source4/scripting/bin/samba-gpupdate
+++ b/source4/scripting/bin/samba-gpupdate
@@ -83,15 +83,13 @@ if __name__ == "__main__":
                                                             lp.configfile)
     gp_extensions = []
     if opts.target == 'Computer':
-        gp_extensions.append(gp_access_ext(logger, lp, creds, store))
-        gp_extensions.append(gp_krb_ext(logger, lp, creds, store))
-        gp_extensions.append(gp_scripts_ext(logger, lp, creds, store))
-        gp_extensions.append(gp_sudoers_ext(logger, lp, creds, store))
-        for ext in machine_exts:
-            gp_extensions.append(ext(logger, lp, creds, store))
+        gp_extensions.append(gp_access_ext)
+        gp_extensions.append(gp_krb_ext)
+        gp_extensions.append(gp_scripts_ext)
+        gp_extensions.append(gp_sudoers_ext)
+        gp_extensions.extend(machine_exts)
     elif opts.target == 'User':
-        for ext in user_exts:
-            gp_extensions.append(ext(logger, lp, creds, store))
+        gp_extensions.extend(user_exts)
 
     if opts.rsop:
         rsop(lp, creds, gp_extensions, opts.target)