From: David Mulder <dmulder@suse.com>
Date: Thu, 6 Aug 2020 23:25:47 +0000 (-0600)
Subject: gpo: Fix unapply failure when multiple extensions run
X-Git-Tag: talloc-2.3.2~702
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c887f7a7d2303121a3a59fa7161ddf08053c31da;p=thirdparty%2Fsamba.git

gpo: Fix unapply failure when multiple extensions run

When multiple Group Policy Extensions are present,
only the last executed extension saves it's
changes to the Group Policy Database, due to the
database being loaded seperately for each
extension.

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
---

diff --git a/python/samba/gpclass.py b/python/samba/gpclass.py
index 37d6be38de8..ddb580d7301 100644
--- a/python/samba/gpclass.py
+++ b/python/samba/gpclass.py
@@ -453,6 +453,7 @@ def apply_gp(lp, creds, logger, store, gp_extensions, force=False):
     store.start()
     for ext in gp_extensions:
         try:
+            ext = ext(logger, lp, creds, store)
             ext.process_group_policy(del_gpos, changed_gpos)
         except Exception as e:
             logger.error('Failed to apply extension  %s' % str(ext))
@@ -476,6 +477,7 @@ def unapply_gp(lp, creds, logger, store, gp_extensions):
     store.start()
     for ext in gp_extensions:
         try:
+            ext = ext(logger, lp, creds, store)
             ext.process_group_policy(del_gpos, [])
         except Exception as e:
             logger.error('Failed to unapply extension  %s' % str(ext))
@@ -507,6 +509,7 @@ def rsop(lp, creds, gp_extensions, target):
         print('GPO: %s' % gpo.display_name)
         print('='*term_width)
         for ext in gp_extensions:
+            ext = ext(logger, lp, creds, store)
             print('  CSE: %s' % ext.__module__.split('.')[-1])
             print('  ' + ('-'*int(term_width/2)))
             for section, settings in ext.rsop(gpo).items():
diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py
index 76030fa389e..005f6a4e2ef 100644
--- a/python/samba/tests/gpo.py
+++ b/python/samba/tests/gpo.py
@@ -480,11 +480,9 @@ class GPOTests(tests.TestCase):
             gpos = ads.get_gpo_list(machine_creds.get_username())
 
         gp_extensions = []
-        gp_extensions.append(gp_krb_ext(logger, self.lp, machine_creds, store))
-        gp_extensions.append(gp_scripts_ext(logger, self.lp, machine_creds,
-            store))
-        gp_extensions.append(gp_sudoers_ext(logger, self.lp, machine_creds,
-            store))
+        gp_extensions.append(gp_krb_ext)
+        gp_extensions.append(gp_scripts_ext)
+        gp_extensions.append(gp_sudoers_ext)
 
         # Create registry stage data
         reg_pol = os.path.join(local_path, policies, '%s/MACHINE/REGISTRY.POL')
@@ -515,6 +513,7 @@ class GPOTests(tests.TestCase):
             self.assertTrue(ret, 'Could not create the target %s' %
                                  (reg_pol % g.name))
             for ext in gp_extensions:
+                ext = ext(logger, self.lp, machine_creds, store)
                 ret = ext.rsop(g)
                 self.assertEquals(len(ret.keys()), 1,
                                   'A single policy should have been displayed')
@@ -559,11 +558,9 @@ class GPOTests(tests.TestCase):
             gpos = ads.get_gpo_list(machine_creds.get_username())
 
         gp_extensions = []
-        gp_extensions.append(gp_krb_ext(logger, self.lp, machine_creds, store))
-        gp_extensions.append(gp_scripts_ext(logger, self.lp, machine_creds,
-            store))
-        gp_extensions.append(gp_sudoers_ext(logger, self.lp, machine_creds,
-            store))
+        gp_extensions.append(gp_krb_ext)
+        gp_extensions.append(gp_scripts_ext)
+        gp_extensions.append(gp_sudoers_ext)
 
         # Create registry stage data
         reg_pol = os.path.join(local_path, policies, '%s/MACHINE/REGISTRY.POL')
@@ -597,6 +594,7 @@ class GPOTests(tests.TestCase):
         remove = []
         with TemporaryDirectory() as dname:
             for ext in gp_extensions:
+                ext = ext(logger, self.lp, machine_creds, store)
                 if type(ext) == gp_krb_ext:
                     ext.process_group_policy([], gpos)
                     ret = store.get_int('kdc:user_ticket_lifetime')
diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo
deleted file mode 100644
index a1ebedf76ad..00000000000
--- a/selftest/knownfail.d/gpo
+++ /dev/null
@@ -1,2 +0,0 @@
-samba.tests.gpo.samba.tests.gpo.GPOTests.test_process_group_policy
-samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_unapply
diff --git a/source4/scripting/bin/samba-gpupdate b/source4/scripting/bin/samba-gpupdate
index 33e1fb793fc..a5566cce6f2 100755
--- a/source4/scripting/bin/samba-gpupdate
+++ b/source4/scripting/bin/samba-gpupdate
@@ -83,15 +83,13 @@ if __name__ == "__main__":
                                                             lp.configfile)
     gp_extensions = []
     if opts.target == 'Computer':
-        gp_extensions.append(gp_access_ext(logger, lp, creds, store))
-        gp_extensions.append(gp_krb_ext(logger, lp, creds, store))
-        gp_extensions.append(gp_scripts_ext(logger, lp, creds, store))
-        gp_extensions.append(gp_sudoers_ext(logger, lp, creds, store))
-        for ext in machine_exts:
-            gp_extensions.append(ext(logger, lp, creds, store))
+        gp_extensions.append(gp_access_ext)
+        gp_extensions.append(gp_krb_ext)
+        gp_extensions.append(gp_scripts_ext)
+        gp_extensions.append(gp_sudoers_ext)
+        gp_extensions.extend(machine_exts)
     elif opts.target == 'User':
-        for ext in user_exts:
-            gp_extensions.append(ext(logger, lp, creds, store))
+        gp_extensions.extend(user_exts)
 
     if opts.rsop:
         rsop(lp, creds, gp_extensions, opts.target)