From: David Mulder <dmulder@suse.com>
Date: Tue, 26 Jan 2021 17:46:27 +0000 (-0700)
Subject: samba-tool: Add a gpo command for listing VGP Files Group Policy
X-Git-Tag: tevent-0.11.0~1803
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a786e30fdae7d96bccfcb2a0f44036b5e231bdc7;p=thirdparty%2Fsamba.git

samba-tool: Add a gpo command for listing VGP Files Group Policy

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
---

diff --git a/docs-xml/manpages/samba-tool.8.xml b/docs-xml/manpages/samba-tool.8.xml
index 83511b4ddf6..faefa55037d 100644
--- a/docs-xml/manpages/samba-tool.8.xml
+++ b/docs-xml/manpages/samba-tool.8.xml
@@ -899,6 +899,11 @@
 	<para>Removes a VGP Symbolic Link Group Policy from the sysvol</para>
 </refsect3>
 
+<refsect3>
+	<title>gpo manage files list</title>
+	<para>List VGP Files Group Policy from the sysvol</para>
+</refsect3>
+
 <refsect2>
 	<title>group</title>
 	<para>Manage groups.</para>
diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py
index c0accafd1fe..af0df653948 100644
--- a/python/samba/netcmd/gpo.py
+++ b/python/samba/netcmd/gpo.py
@@ -68,6 +68,7 @@ from samba.netcmd.common import attr_default
 from samba.common import get_bytes, get_string
 from configparser import ConfigParser
 from io import StringIO, BytesIO
+from samba.vgp_files_ext import calc_mode, stat_from_mode
 
 
 def gpo_flags_string(value):
@@ -2513,7 +2514,50 @@ samba-tool gpo manage files list {31B2F340-016D-11D2-945F-00C04FB984F9}
     takes_args = ["gpo"]
 
     def run(self, gpo, H=None, sambaopts=None, credopts=None, versionopts=None):
-        pass
+        self.lp = sambaopts.get_loadparm()
+        self.creds = credopts.get_credentials(self.lp, fallback_machine=True)
+
+        # We need to know writable DC to setup SMB connection
+        if H and H.startswith('ldap://'):
+            dc_hostname = H[7:]
+            self.url = H
+        else:
+            dc_hostname = netcmd_finddc(self.lp, self.creds)
+            self.url = dc_url(self.lp, self.creds, dc=dc_hostname)
+
+        # SMB connect to DC
+        conn = smb_connection(dc_hostname,
+                              'sysvol',
+                              lp=self.lp,
+                              creds=self.creds)
+
+        realm = self.lp.get('realm')
+        vgp_xml = '\\'.join([realm.lower(), 'Policies', gpo,
+                                'MACHINE\\VGP\\VTLA\\Unix',
+                                'Files\\manifest.xml'])
+        try:
+            xml_data = ET.fromstring(conn.loadfile(vgp_xml))
+        except NTSTATUSError as e:
+            # STATUS_OBJECT_NAME_INVALID, STATUS_OBJECT_NAME_NOT_FOUND,
+            # STATUS_OBJECT_PATH_NOT_FOUND
+            if e.args[0] in [0xC0000033, 0xC0000034, 0xC000003A]:
+                return # The file doesn't exist, so there is nothing to list
+            if e.args[0] == 0xC0000022: # STATUS_ACCESS_DENIED
+                raise CommandError("The authenticated user does "
+                                   "not have sufficient privileges")
+            raise
+
+        policy = xml_data.find('policysetting')
+        data = policy.find('data')
+        for entry in data.findall('file_properties'):
+            source = entry.find('source').text
+            target = entry.find('target').text
+            user = entry.find('user').text
+            group = entry.find('group').text
+            mode = calc_mode(entry)
+            p = '%s\t%s\t%s\t%s -> %s' % \
+                    (stat_from_mode(mode), user, group, target, source)
+            self.outf.write('%s\n' % p)
 
 class cmd_files(SuperCommand):
     """Manage Files Group Policy Objects"""
diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo
deleted file mode 100644
index 6f6444f1afd..00000000000
--- a/selftest/knownfail.d/gpo
+++ /dev/null
@@ -1 +0,0 @@
-^samba.tests.samba_tool.gpo.samba.tests.samba_tool.gpo.GpoCmdTestCase.test_files_list