From f509550f872424a67d4fbc9473c8959e53dffb70 Mon Sep 17 00:00:00 2001 From: David Mulder Date: Fri, 6 Nov 2020 09:54:59 -0700 Subject: [PATCH] samba-tool: Add a gpo command for removing Sudoers Group Policy Signed-off-by: David Mulder Reviewed-by: Douglas Bagnall --- python/samba/netcmd/gpo.py | 51 +++++++++++++++++++++++++++++++++++++- selftest/knownfail.d/gpo | 1 - 2 files changed, 50 insertions(+), 2 deletions(-) delete mode 100644 selftest/knownfail.d/gpo diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py index f1cbbc04e1b..8ec8adb37ae 100644 --- a/python/samba/netcmd/gpo.py +++ b/python/samba/netcmd/gpo.py @@ -1804,6 +1804,11 @@ samba-tool gpo manage sudoers list {31B2F340-016D-11D2-945F-00C04FB984F9} class cmd_remove_sudoers(Command): """Removes a Samba Sudoers Group Policy from the sysvol + +This command removes a sudo rule from the sysvol from applying to winbind clients. + +Example: +samba-tool gpo manage sudoers remove {31B2F340-016D-11D2-945F-00C04FB984F9} 'fakeu ALL=(ALL) NOPASSWD: ALL' """ synopsis = "%prog [options]" @@ -1822,7 +1827,51 @@ class cmd_remove_sudoers(Command): takes_args = ["gpo", "entry"] def run(self, gpo, entry, H=None, sambaopts=None, credopts=None, versionopts=None): - pass + self.lp = sambaopts.get_loadparm() + self.creds = credopts.get_credentials(self.lp, fallback_machine=True) + + # We need to know writable DC to setup SMB connection + if H and H.startswith('ldap://'): + dc_hostname = H[7:] + self.url = H + else: + dc_hostname = netcmd_finddc(self.lp, self.creds) + self.url = dc_url(self.lp, self.creds, dc=dc_hostname) + + # SMB connect to DC + conn = smb_connection(dc_hostname, + 'sysvol', + lp=self.lp, + creds=self.creds) + + realm = self.lp.get('realm') + pol_file = '\\'.join([realm.lower(), 'Policies', gpo, + 'MACHINE\\Registry.pol']) + try: + pol_data = ndr_unpack(preg.file, conn.loadfile(pol_file)) + except NTSTATUSError as e: + if e.args[0] == 0xC0000033: # STATUS_OBJECT_NAME_INVALID + raise CommandError("The specified entry does not exist") + elif e.args[0] == 0xC0000022: # STATUS_ACCESS_DENIED + raise CommandError("The authenticated user does " + "not have sufficient privileges") + raise + + if entry not in [e.data for e in pol_data.entries]: + raise CommandError("Cannot remove '%s' because it does not exist" % + entry) + + entries = [e for e in pol_data.entries if e.data != entry] + pol_data.num_entries = len(entries) + pol_data.entries = entries + + try: + conn.savefile(pol_file, ndr_pack(pol_data)) + except NTSTATUSError as e: + if e.args[0] == 0xC0000022: # STATUS_ACCESS_DENIED + raise CommandError("The authenticated user does " + "not have sufficient privileges") + raise class cmd_sudoers(SuperCommand): """Manage Sudoers Group Policy Objects""" diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo deleted file mode 100644 index d6c5890bac3..00000000000 --- a/selftest/knownfail.d/gpo +++ /dev/null @@ -1 +0,0 @@ -^samba.tests.samba_tool.gpo.samba.tests.samba_tool.gpo.GpoCmdTestCase.test_sudoers_remove -- 2.47.3