From: David Mulder Date: Mon, 27 Apr 2020 22:02:55 +0000 (-0600) Subject: gpo: Run Group Policy Scripts X-Git-Tag: ldb-2.2.0~53 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a9d1ccc5699a4e8c66012f769cec8fba6ce84a59;p=thirdparty%2Fsamba.git gpo: Run Group Policy Scripts Signed-off-by: David Mulder Reviewed-by: Alexander Bokovoy --- diff --git a/libgpo/admx/en-US/samba.adml b/libgpo/admx/en-US/samba.adml new file mode 100755 index 00000000000..b5fc5098638 --- /dev/null +++ b/libgpo/admx/en-US/samba.adml @@ -0,0 +1,19 @@ + + + + + + + + Samba + Unix Settings + Daily Scripts + This policy setting allows you to execute commands, either local or on remote storage, daily. + + + + Script and arguments + + + + diff --git a/libgpo/admx/samba.admx b/libgpo/admx/samba.admx new file mode 100755 index 00000000000..f2921ff1885 --- /dev/null +++ b/libgpo/admx/samba.admx @@ -0,0 +1,23 @@ + + + + + + + + + + + + + + + + + + + + + + + diff --git a/libgpo/admx/wscript_build b/libgpo/admx/wscript_build new file mode 100644 index 00000000000..cb1cadbf782 --- /dev/null +++ b/libgpo/admx/wscript_build @@ -0,0 +1,3 @@ +#!/usr/bin/env python + +bld.INSTALL_FILES('${DATADIR}/samba/admx', ['samba.admx', 'en-US/samba.adml']) diff --git a/libgpo/wscript_build b/libgpo/wscript_build index f36ccf2c701..e6e54fe359a 100644 --- a/libgpo/wscript_build +++ b/libgpo/wscript_build @@ -19,3 +19,5 @@ pyrpc_util = bld.pyembed_libname('pyrpc_util') bld.SAMBA3_PYTHON('python_samba_libgpo', 'pygpo.c', deps='%s gpext talloc ads TOKEN_UTIL auth %s' % (pyparam_util, pyrpc_util), realname='samba/gpo.so') + +bld.RECURSE('admx') diff --git a/python/samba/gp_scripts_ext.py b/python/samba/gp_scripts_ext.py new file mode 100644 index 00000000000..f83f367a5d7 --- /dev/null +++ b/python/samba/gp_scripts_ext.py @@ -0,0 +1,53 @@ +# gp_scripts_ext samba gpo policy +# Copyright (C) David Mulder 2020 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +import os, re +from samba.gpclass import gp_pol_ext +from base64 import b64encode +from tempfile import NamedTemporaryFile + +class gp_scripts_ext(gp_pol_ext): + def __str__(self): + return 'Unix Settings/Daily Scripts' + + def process_group_policy(self, deleted_gpo_list, changed_gpo_list, cdir='/etc/cron.daily'): + for gpo in deleted_gpo_list: + self.gp_db.set_guid(gpo[0]) + if str(self) in gpo[1]: + for attribute, script in gpo[1][str(self)].items(): + os.unlink(script) + self.gp_db.delete(str(self), attribute) + self.gp_db.commit() + + for gpo in changed_gpo_list: + if gpo.file_sys_path: + section_name = 'Software\\Policies\\Samba\\Unix Settings\\Daily Scripts' + self.gp_db.set_guid(gpo.name) + pol_file = 'MACHINE/Registry.pol' + path = os.path.join(gpo.file_sys_path, pol_file) + pol_conf = self.parse(path) + if not pol_conf: + continue + for e in pol_conf.entries: + if e.keyname == section_name and e.data.strip(): + attribute = b64encode(e.data.encode()).decode() + old_val = self.gp_db.retrieve(str(self), attribute) + if not old_val: + with NamedTemporaryFile(mode="w+", delete=False, dir=cdir) as f: + f.write('#!/bin/sh\n%s' % e.data) + os.chmod(f.name, 0o700) + self.gp_db.store(str(self), attribute, f.name) + self.gp_db.commit() diff --git a/source4/scripting/bin/samba-gpupdate b/source4/scripting/bin/samba-gpupdate index 528019c7478..68dfad1ed87 100755 --- a/source4/scripting/bin/samba-gpupdate +++ b/source4/scripting/bin/samba-gpupdate @@ -32,6 +32,7 @@ from samba import getopt as options from samba.gpclass import apply_gp, unapply_gp, GPOStorage from samba.gp_sec_ext import gp_sec_ext from samba.gp_ext_loader import get_gp_client_side_extensions +from samba.gp_scripts_ext import gp_scripts_ext import logging if __name__ == "__main__": @@ -80,6 +81,7 @@ if __name__ == "__main__": gp_extensions = [] if opts.target == 'Computer': gp_extensions.append(gp_sec_ext(logger, lp, creds, store)) + gp_extensions.append(gp_scripts_ext(logger, lp, creds, store)) for ext in machine_exts: gp_extensions.append(ext(logger, lp, creds, store)) elif opts.target == 'User':