Current File : //lib/python2.7/site-packages/salt/modules/win_dacl.pyo
�
���^c @@ s� d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l Z d d l
m Z d d l m
Z
d d l m Z y. d d l Z d d l Z d d l Z e Z Wn e k
r� e Z n Xe j e � Z d Z d e f d � � YZ d
� Z d � Z d � Z e d
� Z! d � Z" e e e d � Z# d � Z$ e e e d � Z% e d � Z& e d � Z' e d � Z( e e e e d � Z) d S( u=
Manage DACLs on Windows
:depends: - winreg Python module
i ( t absolute_importt unicode_literalst print_functionN( t CommandExecutionError( t string_types( t rangeu win_daclt
daclConstantsc B@ sh e Z d Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z
d � Z d
� Z RS( u3
DACL constants used throughout the module
c C@ s� t j t j Bd B| _ i d d 6d d 6d d 6d d 6d d 6d d 6d d 6d d 6d d
6d d 6d d 6d d
6| _ i i i t j j j j j
d 6d d 6d 6i t j j j j j d 6d d 6d 6t j
6i i t j d 6d d 6d 6i t j d 6d d 6d 6i t j t j Bd 6d d 6d 6i t j t j Bt j Bt j Bd 6d d 6d 6i | j d 6d d 6d 6t j 6| _ i i d d 6d d 6d 6i d d 6d d 6d 6| _ i i i d d 6t j d 6d! 6i d" d 6t j d 6d# 6i d$ d 6t j t j Bd 6d% 6i d d 6t j d 6d& 6i d" d 6t j d 6d' 6i d$ d 6t j t j Bd 6d( 6t j
6i i d) d 6t j d 6d* 6i d) d 6t j d 6d+ 6i d, d 6t j t j Bd 6d- 6i d. d 6t j d 6d/ 6i d0 d 6t j d 6d1 6i d2 d 6t j t j Bt j Bd 6d3 6i d4 d 6t j t j Bd 6d5 6i d6 d 6t j t j Bd 6d7 6i d) d 6t j d 6d8 6i d) d 6t j d 6d9 6i d, d 6t j t j Bd 6d: 6i d. d 6t j d 6d; 6i d0 d 6t j d 6d< 6i d2 d 6t j t j Bt j Bd 6d= 6i d4 d 6t j t j Bd 6d> 6i d6 d 6t j t j Bd 6d? 6t j 6| _ i t j j j j j t 6t j j j j j t j j j j j Bt 6| _ i t j d* 6t j d@ 6t j
dA 6| _ d S(B Ni� u MACHINEu HKEY_LOCAL_MACHINEu USERSu
HKEY_USERSu CURRENT_USERu HKEY_CURRENT_USERu CLASSES_ROOTu HKEY_CLASSES_ROOTu HKLMu HKUu HKCUu HKCRu BITSu readu TEXTu READu full controlu FULLCONTROLu writeu WRITEu read and executeu READ&EXECUTEu modifyu MODIFYu allowedi u ALLOWu deniedi u DENYu
this key onlyu KEYu this key and subkeysu KEY&SUBKEYSu subkeys onlyu SUBKEYSu
THIS KEY ONLYu THIS KEY AND SUBKEYSu SUBKEYS ONLYu this file/folder onlyu FILEu FOLDERu" this folder, subfolders, and filesu FOLDER&SUBFOLDERS&FILESu this folder and subfoldersu FOLDER&SUBFOLDERSu this folder and filesu FOLDER&FILESu subfolders and filesu SUBFOLDERS&FILESu subfolders onlyu
SUBFOLDERSu
files onlyu FILESu THIS FILE ONLYu THIS FOLDER ONLYu" THIS FOLDER, SUBFOLDERS, AND FILESu THIS FOLDER AND SUBFOLDERSu THIS FOLDER AND FILESu SUBFOLDERS AND FILESu SUBFOLDERS ONLYu
FILES ONLYu DIRECTORYu REGISTRY( t
ntsecuritycont STANDARD_RIGHTS_REQUIREDt SYNCHRONIZEt FILE_ALL_ACCESSt hkeys_securityt saltt extt sixt movest winregt KEY_READt KEY_ALL_ACCESSt
win32securityt SE_REGISTRY_KEYt FILE_GENERIC_READt FILE_GENERIC_WRITEt FILE_GENERIC_EXECUTEt DELETEt SE_FILE_OBJECTt rightst
validAceTypest NO_INHERITANCEt CONTAINER_INHERIT_ACEt INHERIT_ONLY_ACEt OBJECT_INHERIT_ACEt validPropagationst Truet KEY_WOW64_64KEYt Falset reflection_maskt
objectType( t self( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt __init__1 s
/
c C@ sm t | t � re | j � } y | j | SWqi t k
ra t d j | d j | j � � � � qi Xn | Sd S( uA
returns the bit value of the string object type
uC Invalid object type "{0}". It should be one of the following: {1}u , N( t
isinstanceR t upperR% t KeyErrorR t formatt join( R& t t( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt getObjectTypeBit� s
"c C@ sK y | j | SWn5 t k
rF t d j | d j | j � � � � n Xd S( u]
returns the necessary string value for an HKEY for the win32security module
u= No HKEY named "{0}". It should be one of the following: {1}u , N( R R* R R+ R, ( R& t s( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt getSecurityHkey� s
c C@ sj y* t | t � r% | j | | d S| SWn9 t k
re t d j | d j | j | � � � � n Xd S( ug
returns a permission bit of the string permission value for the specified object type
u BITSu8 No right "{0}". It should be one of the following: {1}u , N( R( R R R* R R+ R, ( R& R- t m( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt getPermissionBit� s
c C@ sW y | j | | d SWn9 t k
rR t d j | d j | j | � � � � n Xd S( ui
returns the permission textual representation of a specified permission bit/object type
u TEXTu8 No right "{0}". It should be one of the following: {1}u , N( R R* R R+ R, ( R& R- R1 ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt getPermissionText� s
c C@ sO y | j | d SWn5 t k
rJ t d j | d j | j � � � � n Xd S( u9
returns the acetype bit of a text value
u BITSu; No ACE type "{0}". It should be one of the following: {1}u , N( R R* R R+ R, ( R& R- ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt
getAceTypeBit� s
c C@ sO y | j | d SWn5 t k
rJ t d j | d j | j � � � � n Xd S( uE
returns the textual representation of a acetype bit
u TEXTu; No ACE type "{0}". It should be one of the following: {1}u , N( R R* R R+ R, ( R& R- ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt getAceTypeText� s
c C@ sW y | j | | d SWn9 t k
rR t d j | d j | j | � � � � n Xd S( u=
returns the propagation bit of a text value
u BITSuF No propagation type of "{0}". It should be one of the following: {1}u , N( R R* R R+ R, ( R& R- t p( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt getPropagationBit
s
c C@ sW y | j | | d SWn9 t k
rR t d j | d j | j | � � � � n Xd S( uI
returns the textual representation of a propagation bit
u TEXTuF No propagation type of "{0}". It should be one of the following: {1}u , N( R R* R R+ R, ( R& R- R6 ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt getPropagationText s
c C@ st | t j k r^ | j d � } | j | j d � j � � } | j d | � d j | � } n t j j
| � } | S( u�
processes a path/object type combo and returns:
registry types with the correct HKEY text representation
files/directories with environment variables expanded
u \i u \\( R R t splitR0 t popR) t insertR, t ost patht
expandvars( R& R= R% t spltt hive( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt processPath s (
t __name__t
__module__t __doc__R' R. R0 R2 R3 R4 R5 R7 R8 RA ( ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyR ( s � c C@ sH i } d } | r� t j | | t j � r� y t j | � } Wn3 t k
rr } t | d <d j | | � | d <qDXy( t j d | � t | d <| | d <WqDt k
r� } t | d <d j | | � | d <qDXnp y: | r� t j
d | � d n d
} t | d <| | d <Wn3 t k
rC} t | d <d j | | � | d <n X| S( u�
return a state error dictionary, with 'sid' as a field if it could be returned
if user is None, sid will also be None
u ^S-1(-\d+){1,}$u resultuP Unable to obtain the binary security identifier for {0}. The exception was {1}.u commentu u siduU Unable to lookup the account for the security identifier {0}. The exception was {1}.i uI Unable to obtain the security identifier for {0}. The exception was {1}.N( t ret matcht IR t GetBinarySidt ExceptionR# R+ t LookupAccountSidR! t LookupAccountNamet None( t usert rett sid_patternt sidt e( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt _getUserSid0 s4
"
c C@ s& t j j j � r t r t St d f S( u'
Only works on Windows systems
u5 Module win_dacl: module only works on Windows systems( R t utilst platformt
is_windowst HAS_WINDOWS_MODULESt __virtualname__R# ( ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt __virtual__U s c C@ s@ y" t j | | t j � j � } Wn t k
r; d } n X| S( u!
Gets the DACL of a path
N( R t GetNamedSecurityInfot DACL_SECURITY_INFORMATIONt GetSecurityDescriptorDaclRI RL ( R= R% t dacl( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt _get_dacl^ s
c
C@ s� i | d 6g d 6} t | � } | r� | r� t � } | j | � } | j | | � } t | | � } | r� xk t d | j � � D]Q } | j | � } | d s� | d | d k r� | d j t | | � � q� q� Wq� n | S( u~
Get the ACL of an object. Will filter by user if one is provided.
Args:
path: The path to the object
objectType: The type of object (FILE, DIRECTORY, REGISTRY)
user: A user name to filter by
Returns (dict): A dictionary containing the ACL
CLI Example:
.. code-block:: bash
salt 'minion-id' win_dacl.get c: emp directory
u Pathu ACLsi u sidi (
RR R R. RA R] R t GetAceCountt GetAcet appendt _ace_to_text(
R= R% RM RN t sidRett dct
objectTypeBitt tdaclt countert tAce( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt getk s
'c C@ sl i d d 6i d 6d d 6} | rT| rT| rT| rT| rT| j � d k rT d } n t � } | j | � } | j | | � } | j � } | j � j � } | j � j � } | j � j � } t | � } | d s� | S| j | | � }
| j | � } | j | | � } t
| | � }
|
r>g } y� | d k rW|
j t j
| |
| d � n, | d k r�|
j t j
| |
| d � n t j | | t j d d |
d � | j d j | | j | � | j | | � | j | | � � � t | d <Wn1 t k
r#} d
j | � | d <t | d <| SX| rQ| | d d <qQqhd j | � | d <n d
| d <t | d <| S( u�
add an ace to an object
path: path to the object (i.e. c:\\temp\\file, HKEY_LOCAL_MACHINE\\SOFTWARE\\KEY, etc)
user: user to add
permission: permissions for the user
acetype: either allow/deny for each user/permission (ALLOW, DENY)
propagation: how the ACE applies to children for Registry Keys and Directories(KEY, KEY&SUBKEYS, SUBKEYS)
CLI Example:
.. code-block:: bash
allow domain\fakeuser full control on HKLM\\SOFTWARE\\somekey, propagate to this key and subkeys
salt 'myminion' win_dacl.add_ace 'HKEY_LOCAL_MACHINE\\SOFTWARE\\somekey' 'Registry' 'domain\fakeuser' 'FULLCONTROL' 'ALLOW' 'KEY&SUBKEYS'
u resultu changesu u commentu FILEi u sidi u {0} {1} {2} on {3}u? An error occurred attempting to add the ace. The error was {0}u
Added ACEsu Unable to obtain the DACL of {0}u1 An empty value was specified for a required item.N( RL R) R R. RA t stripRR R2 R4 R7 R] t AddAccessAllowedAceExR t ACL_REVISIONt AddAccessDeniedAceExt SetNamedSecurityInfoRZ R` R+ R5 R3 R8 R! RI R# ( R= R% RM t
permissiont acetypet propagationRN Rc Rd Rb t
permissionbitt
acetypebitt propagationbitR\ t acesAddedRQ ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt add_ace� s^
c
C@ s i d d 6i d 6d d 6} | r| rt � } | rQ | j � d k rQ d } n | j | � } | j | | � } | j � } | r� | j � j � n d } | r� | j � j � n d } | r� | j � j � n d } t | | | | | | t � d r�t | � } | d s| S| r,| j | | � n d }
| rG| j
| � n d } | re| j | | � n d } t | | � }
d } g } x� | |
j
� k rv|
j | � } | d d t j @t j k ri| d | d
k ri| s�| d d | k rf| s| d d | @| k rc|
s-| d |
k r`|
j | � | d } | j t | | � � q`qcqfqin | d } q�W| r�y> t j | | t j d d |
d � | | d d <t | d <Wq�t k
r�} t | d <d j | � | d <| SXq�qd
| d <n | S( u
remove an ace to an object
path: path to the object (i.e. c:\\temp\\file, HKEY_LOCAL_MACHINE\\SOFTWARE\\KEY, etc)
user: user to remove
permission: permissions for the user
acetypes: either allow/deny for each user/permission (ALLOW, DENY)
propagation: how the ACE applies to children for Registry Keys and Directories(KEY, KEY&SUBKEYS, SUBKEYS)
If any of the optional parameters are omitted (or set to None) they act as wildcards.
CLI Example:
.. code-block:: bash
remove allow domain\fakeuser full control on HKLM\\SOFTWARE\\somekey propagated to this key and subkeys
salt 'myminion' win_dacl.rm_ace 'Registry' 'HKEY_LOCAL_MACHINE\\SOFTWARE\\somekey' 'domain\fakeuser' 'FULLCONTROL' 'ALLOW' 'KEY&SUBKEYS'
u resultu changesu u commentu FILEu Existsi i i u sidu Removed ACEsu' Error removing ACE. The error was {0}.u, The specified ACE was not found on the path.N( RL R R) R. RA Ri t check_aceR! RR R2 R4 R7 R] R^ R_ R t
INHERITED_ACEt DeleteAceR` Ra Rm RZ RI R# R+ ( R= R% RM Rn Ro Rp RN Rc Rd Rb Rq Rr Rs R\ Rf t acesRemovedRg RQ ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt rm_ace� s^
"
%
c C@ s� t � } | j | � } yT t j d | d � } | d rX d j | d | d � } n d j | d � } Wn$ t k
r� t j | d � } n X| d } | d d } | d d } d } x= | j D]2 } | j | d | k r� | j | d } Pq� q� WxI | j | D]: } | j | | d | k r
| j | | d } Pq
q
W| t j @t j k rwd } | t j A} n xI | j
| D]: } | j
| | d | k r�| j
| | d } Pq�q�Wd
j | | | | | � S( uG
helper function to convert an ace to a textual representation
u i i u {1}\{0}i u {0}u BITSu TEXTu [Inherited]u {0} {1} {2} on {3} {4}( R R. R RJ R+ RI t ConvertSidToStringSidR R Rw R ( t aceR% Rc t userSidt tPermt tAceTypet tPropst
tInheritedt x( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyRa s<
c
C@ sd i t d 6d d 6i d 6} | r`y t j | | t j � } | j � } | r8| r� d } g } xs | | j � k r� | j | � }
|
d d t j @t j k r� | j | � | j t
|
| � � qc | d } qc W| r� | | d d <q� n d | d d <t j | | t j t j Bd d | d � d
| d d <n� | s�d } g } xs | | j � k r�| j | � }
|
d d t j @t j k r�| j | � | j t
|
| � � qM| d } qMW| r�| | d d <q�n d | d d
<t j | | t j t j Bd d | d � d | d d <t | d <Wq`t k
r\} t | d <d j | � | d <q`Xn | S( ut
helper function to set the inheritance
Args:
path (str): The path to the object
objectType (str): The type of object
inheritance (bool): True enables inheritance, False disables
copy (bool): Copy inherited ACEs to the DACL before disabling
inheritance
clear (bool): Remove non-inherited ACEs from the DACL
u resultu u commentu changesi i u Removed ACEsu Left in the DACLu Non-Inherited ACEsu Enabledu Inheritanceu Copied to the DACLu Previously Inherited ACEsu Disabledu< Error attempting to set the inheritance. The error was {0}.N( R# R RY RZ R[ R^ R_ Rw Rx R` Ra Rm t% UNPROTECTED_DACL_SECURITY_INFORMATIONRL t# PROTECTED_DACL_SECURITY_INFORMATIONR! RI R+ (
R= R% t inheritancet copyt clearRN t sdRe Rf t removedAcesRg t inheritedAcesRemovedRQ ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt _set_dacl_inheritanceE s^
c C@ s@ t � } | j | � } | j | | � } t | | t d | � S( u�
enable/disable inheritance on an object
Args:
path: The path to the object
objectType: The type of object (FILE, DIRECTORY, REGISTRY)
clear: True will remove non-Inherited ACEs from the ACL
Returns (dict): A dictionary containing the results
CLI Example:
.. code-block:: bash
salt 'minion-id' win_dacl.enable_inheritance c: emp directory
N( R R. RA R� R! RL ( R= R% R� Rc ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt enable_inheritance� s c C@ s@ t � } | j | � } | j | | � } t | | t | d � S( u�
Disable inheritance on an object
Args:
path: The path to the object
objectType: The type of object (FILE, DIRECTORY, REGISTRY)
copy: True will copy the Inherited ACEs to the DACL before disabling inheritance
Returns (dict): A dictionary containing the results
CLI Example:
.. code-block:: bash
salt 'minion-id' win_dacl.disable_inheritance c: emp directory
N( R R. RA R� R# RL ( R= R% R� Rc ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt disable_inheritance� s c C@ s8 i t d 6t d 6d d 6} t | � } t � } | j | � } | j | | � } y( t j | | t j � } | j � } Wn1 t k
r� } t | d <d j
| � | d <| SXxz t d | j � � D]c } | j
| � }
|
d d t j @t j k r� | d s|
d | d k r&t | d <Pq&q� q� Wt | d <| S(
u�
Check a specified path to verify if inheritance is enabled
Args:
path: path of the registry key or file system object to check
objectType: The type of object (FILE, DIRECTORY, REGISTRY)
user: if provided, will consider only the ACEs for that user
Returns (bool): 'Inheritance' of True/False
CLI Example:
.. code-block:: bash
salt 'minion-id' win_dacl.check_inheritance c: emp directory <username>
u resultu Inheritanceu u commentuA Error obtaining the Security Descriptor or DACL of the path: {0}.i i u sidi ( R# RR R R. RA R RY RZ R[ RI R+ R R^ R_ Rw R! ( R= R% RM RN Rb Rc R� t daclsRQ Rf R| ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt check_inheritance� s,
c C@ s i t d 6t d 6d d 6} t � } | j | � } | j | | � } | rW | j � n d
} | ro | j � n d
} | r� | j � n d
} | r� | j | | � n d
}
| r� | j | � n d
} | r� | j | | � n d
} t | � }
|
d s� |
St
| | � } t | d <| rx� t d | j
� � D]� } | j | � } | d |
d k r3| sw| d d | k r�| s�| d d | @| k r�|
s�t | d <| S| r�| d |
k r�t | d <| Sq�| d |
@|
k r�t | d <| Sq�q�q3q3Wn
d | d <| S( uP
Checks a path to verify the ACE (access control entry) specified exists
Args:
path: path to the file/reg key
objectType: The type of object (FILE, DIRECTORY, REGISTRY)
user: user that the ACL is for
permission: permission to test for (READ, FULLCONTROL, etc)
acetype: the type of ACE (ALLOW or DENY)
propagation: the propagation type of the ACE (FILES, FOLDERS, KEY, KEY&SUBKEYS, SUBKEYS, etc)
exactPermissionMatch: the ACL must match exactly, IE if READ is specified, the user must have READ exactly and not FULLCONTROL (which also has the READ permission obviously)
Returns (dict): 'Exists' true if the ACE exists, false if it does not
CLI Example:
.. code-block:: bash
salt 'minion-id' win_dacl.check_ace c: emp directory <username> fullcontrol
u resultu Existsu u commenti i u sidi u No DACL found for object.N( R# R R. RA R) RL R2 R4 R7 RR R] R! R R^ R_ ( R= R% RM Rn Ro Rp t exactPermissionMatchRN Rc Rd Rq Rr Rs Rb R� Rf R| ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyRv � sF
(* RD t
__future__R R R R< t loggingRE t salt.utils.platformR t salt.exceptionsR t salt.ext.sixR t salt.ext.six.movesR t salt.ext.six.moves.winregR R R! RV t ImportErrorR# t getLoggerRB t logRW t objectR RR RX R] RL Rh Ru Rz Ra R� R� R� R� Rv ( ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_dacl.pyt <module> s>
� %
# HI &H /
Mini Shell