Current File : //usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyc
�
���^c @@ s d Z d d l m Z m Z m Z d d l Z d d l m Z m Z d d l Z
d d l Z
d d l m
Z
d d l m Z e Z y: d d l Z d d l Z d d l Z d d l Z e Z Wn e k
r� n Xe j e � Z d Z d � Z e d � Z e d
d � Z d � Z d
� Z! d � Z" d
d � Z# d
d � Z$ d
d � Z% d
d � Z& d e d
e e d � Z' d d
d � Z( e d
d � Z) d d
e d � Z* d
e d � Z+ d
d � Z, d
e e e e d � Z- d � Z. d
e e e e e e d � Z/ d � Z0 d
e e e e d � Z1 d S( u(
============
Windows DACL
============
This salt utility contains objects and functions for setting permissions to
objects in Windows. You can use the built in functions or access the objects
directly to create your own custom functionality. There are two objects, Flags
and Dacl.
If you need access only to flags, use the Flags object.
.. code-block:: python
import salt.utils.win_dacl
flags = salt.utils.win_dacl.Flags()
flag_full_control = flags.ace_perms['file']['basic']['full_control']
The Dacl object inherits Flags. To use the Dacl object:
..code-block:: python
import salt.utils.win_dacl
dacl = salt.utils.win_dacl.Dacl(obj_type='file')
dacl.add_ace('Administrators', 'grant', 'full_control')
dacl.save('C:\temp')
Object types are used by setting the `obj_type` parameter to a valid Windows
object. Valid object types are as follows:
- file
- service
- printer
- registry
- registry32 (for WOW64)
- share
Each object type has its own set up permissions and 'applies to' properties as
follows. At this time only basic permissions are used for setting. Advanced
permissions are listed for displaying the permissions of an object that don't
match the basic permissions, ie. Special permissions. These should match the
permissions you see when you look at the security for an object.
**Basic Permissions**
================ ==== ======== ===== ======= =======
Permissions File Registry Share Printer Service
================ ==== ======== ===== ======= =======
full_control X X X X
modify X
read_execute X
read X X X X
write X X X
read_write X
change X
print X
manage_printer X
manage_documents X
================ ==== ======== ===== ======= =======
**Advanced Permissions**
======================= ==== ======== ======= =======
Permissions File Registry Printer Service
======================= ==== ======== ======= =======
list_folder X
read_data X
create_files X
write_data X
create_folders X
append_data X
read_ea X
write_ea X
traverse_folder X
execute_file X
delete_subfolders_files X
read_attributes X
write_attributes X
delete X X
read_permissions X X X
change_permissions X X X
take_ownership X X
query_value X
set_value X
create_subkey X
enum_subkeys X
notify X
create_link X
read_control X
write_dac X
write_owner X
manage_printer X
print X
query_config X
change_config X
query_status X
enum_dependents X
start X
stop X
pause_resume X
interrogate X
user_defined X
change_owner X
======================= ==== ======== ======= =======
Only the registry and file object types have 'applies to' properties. These
should match what you see when you look at the properties for an object.
**File types:**
- this_folder_only: Applies only to this object
- this_folder_subfolders_files (default): Applies to this object
and all sub containers and objects
- this_folder_subfolders: Applies to this object and all sub
containers, no files
- this_folder_files: Applies to this object and all file
objects, no containers
- subfolders_files: Applies to all containers and objects
beneath this object
- subfolders_only: Applies to all containers beneath this object
- files_only: Applies to all file objects beneath this object
**Registry types:**
- this_key_only: Applies only to this key
- this_key_subkeys: Applies to this key and all subkeys
- subkeys_only: Applies to all subkeys beneath this object
i ( t absolute_importt print_functiont unicode_literalsN( t CommandExecutionErrort SaltInvocationError( t range( t sixu daclc C@ s0 t j j j � s t d f St s, t d f St S( u4
Only load if Win32 Libraries are installed
u win_dacl: Requires Windowsu win_dacl: Requires pywin32( t saltt utilst platformt
is_windowst Falset HAS_WIN32t __virtualname__( ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt __virtual__� s
c C@ s1 t s
d Sd t f d � � Y} | r- | � S| S( u_
Helper function for instantiating a Flags object
Args:
instantiated (bool):
True to return an instantiated object, False to return the object
definition. Use False if inherited by another class. Default is
True.
Returns:
object: An instance of the Flags object or its definition
Nt Flagsc B@ s� e Z d Z i i i d d 6d d 6d d 6d d 6d d
6d d 6d d
6d d 6d d 6d
d 6d d 6d 6i d d 6d d 6d d 6d d 6d d 6d d 6d d 6d! d" 6d# d$ 6d% d& 6d' d( 6d) d* 6d+ d, 6d d- 6d d. 6d d/ 6d d0 6d d1 6d d2 6d d3 6d d4 6d d5 6d d6 6d d7 6d" d8 6d$ d9 6d& d: 6d( d; 6d* d< 6d, d= 6d> 6d? 6i i
d@ dA 6d dB 6d dC 6d@ dD 6dE dF 6d dG 6d dH 6dA d
6dB d 6dC d 6d 6i dI d 6dJ d 6dK d 6dL d 6dM d 6dN d 6d% d& 6dO d( 6dP d* 6dQ d, 6d dR 6d dS 6d dT 6d dU 6d dV 6d dW 6d& d: 6d( dX 6d* dY 6d, dZ 6d> 6d[ 6i i d d 6d\ d 6d d 6d d
6d d] 6d d 6d 6i d> 6d^ 6i i d_ d` 6da db 6dc dd 6d` de 6db df 6dd dg 6d 6i
da dh 6d_ d 6d' d( 6d) d* 6d+ d, 6dh df 6d de 6d( d; 6d* d< 6d, d= 6d> 6di 6i i d@ dj 6dk dl 6d dm 6d dn 6dj d
6dl do 6dm d 6dn d 6d 6i dp d 6dq d 6dr d 6ds d 6dt d 6du d 6dv d 6dw d" 6dx d$ 6dy d( 6dz d* 6d{ d, 6d d| 6d d} 6d d~ 6d d 6d d� 6d d� 6d d� 6d" d� 6d$ d� 6d( d; 6d* d< 6d, d� 6d> 6d� 6Z i i d� d� 6d� d 6d� d 6d� d� 6d� d� 6d� d� 6d� d� 6d� d� 6d� d 6d� d� 6d� d� 6d d� 6d d� 6d� d� 6d� d� 6d� d� 6d? 6i d� d� 6d� d 6d� d� 6d� d� 6d� d 6d� d� 6d d� 6d� d� 6d[ 6i d� d� 6d� d 6d� d� 6d� d� 6d� d 6d� d� 6d d� 6d� d� 6d� 6Z i e j d� 6e j d� 6d� e j 6d� e j 6Z i e j d� 6e j
d� 6e j d� 6Z i e j
d� 6e j d� 6Z i e j d? 6e j d� 6e j di 6e j d[ 6e j d� 6e j d^ 6Z RS(� uV
Object containing all the flags for dealing with Windows permissions
u Full controli� u Modifyi� u Read & execute with writei� u Read & executei� u Readi� u Writei u full_controlu modifyu read_executeu readu writeu basicu List folder / read datai u Create files / write datai u Create folders / append datai u Read extended attributesi u Write extended attributesi u Traverse folder / execute filei u Delete subfolders and filesi@ u Read attributesi� u Write attributesi u Deletei u Read permissionsi u Change permissionsi u Take ownershipi u list_folderu read_datau create_filesu
write_datau create_foldersu append_datau read_eau write_eau traverse_folderu execute_fileu delete_subfolders_filesu read_attributesu write_attributesu deleteu read_permissionsu change_permissionsu take_ownershipu advancedu fileu Full Controli? i i i u Executei i @l �� u Query Valueu Set Valueu
Create Subkeyu Enumerate Subkeysu Notifyu Create Linku Read Controlu Write DACu Write Owneru query_valueu set_valueu
create_subkeyu enum_subkeysu notifyu create_linku read_controlu write_dacu write_owneru registryu Changeu changeu shareu Printi u Manage this printeri u Manage documentsi0 u printu manage_printeru manage_documentsi u printeri� u Read & Writei� i� i u
read_writeu Query Configu
Change Configu Query Statusu Enumerate Dependentsu Startu Stopu Pause/Resumeu Interrogateu User-Defined Controlu Read Permissionsu Change Permissionsu Change Owneru query_configu
change_configu query_statusu enum_dependentsu startu stopu pause_resumeu interrogateu user_definedu change_owneru serviceu Not Inherited (file)i u This folder and filesu This folder and subfoldersu! This folder, subfolders and filesi u This folder onlyi u
Files onlyi u Subfolders onlyi
u Subfolders and files onlyi u Inherited (file)u this_folder_onlyu this_folder_subfolders_filesu this_folder_subfoldersu this_folder_filesu subfolders_filesu subfolders_onlyu
files_onlyu
Not Inheritedu This key and subkeysu
This key onlyu Subkeys onlyu Inheritedu
this_key_onlyu this_key_subkeysu subkeys_onlyu
registry32u grantu denyu daclu groupu owneru protectedu unprotected( t __name__t
__module__t __doc__t ace_permst ace_propt
win32securityt ACCESS_ALLOWED_ACE_TYPEt ACCESS_DENIED_ACE_TYPEt ace_typet DACL_SECURITY_INFORMATIONt GROUP_SECURITY_INFORMATIONt OWNER_SECURITY_INFORMATIONt elementt# PROTECTED_DACL_SECURITY_INFORMATIONt% UNPROTECTED_DACL_SECURITY_INFORMATIONt inheritancet SE_FILE_OBJECTt
SE_SERVICEt
SE_PRINTERt SE_REGISTRY_KEYt SE_REGISTRY_WOW64_32KEYt
SE_LMSHAREt obj_type( ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyR � s�
( R t object( t instantiatedR ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt flags� s �u filec @ s= t r d Sn d t t � f � f d � � Y� � | | � S( uO
Helper function for instantiating a Dacl class.
Args:
obj_name (str):
The full path to the object. If None, a blank DACL will be created.
Default is None.
obj_type (str):
The type of object. Default is 'File'
Returns:
object: An instantiated Dacl object
Nt Daclc @ sq e Z d Z d d d � Z d � Z d � Z � f d � Z d � Z d � Z d � Z
d d
� Z d d � Z RS(
u
DACL Object
u filec S@ s/ | j � | j k r- t d j | � � � n | j � | _ | d k rZ t j � | _ n� d | j k r{ | j | � } n y* t j
| | j | j | j d � } WnS t j
k
r� } d | j k r� d j | � } t j | � t | � � n � n X| j � | _ | j d k r+t j � | _ n d S( u�
Either load the DACL from the passed object or create an empty DACL.
If `obj_name` is not passed, an empty DACL is created.
Args:
obj_name (str):
The full path to the object. If None, a blank DACL will be
created
obj_type (Optional[str]):
The type of object.
Returns:
obj: A DACL object
Usage:
.. code-block:: python
# Create an Empty DACL
dacl = Dacl(obj_type=obj_type)
# Load the DACL of the named object
dacl = Dacl(obj_name, obj_type)
u Invalid "obj_type" passed: {0}u registryu daclu The system cannot findu System cannot find {0}N( t lowerR& R t formatt dacl_typet NoneR t ACLt daclt get_reg_namet GetNamedSecurityInfoR t
pywintypest errort strerrort logt exceptionR t GetSecurityDescriptorDacl( t selft obj_nameR& t sdt exct msg( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt __init__� s( $
c S@ s� i d d 6d d 6d d 6d d 6d d 6d d 6d d 6d d 6d d 6d
d 6d
d
6d
d 6} | j d
� } | j d � } y | | j � } Wn6 t k
r� t j d | � t d j | � � � n X| j d | � d j | � S( uY
Take the obj_name and convert the hive to a valid registry hive.
Args:
obj_name (str):
The full path to the registry key including the hive, eg:
``HKLM\SOFTWARE\salt``. Valid options for the hive are:
- HKEY_LOCAL_MACHINE
- MACHINE
- HKLM
- HKEY_USERS
- USERS
- HKU
- HKEY_CURRENT_USER
- CURRENT_USER
- HKCU
- HKEY_CLASSES_ROOT
- CLASSES_ROOT
- HKCR
Returns:
str:
The full path to the registry key in the format expected by
the Windows API
Usage:
.. code-block:: python
import salt.utils.win_dacl
dacl = salt.utils.win_dacl.Dacl()
valid_key = dacl.get_reg_name('HKLM\SOFTWARE\salt')
# Returns: MACHINE\SOFTWARE\salt
u MACHINEu HKEY_LOCAL_MACHINEu HKLMu USERSu
HKEY_USERSu HKUu CURRENT_USERu HKEY_CURRENT_USERu HKCUu CLASSES_ROOTu HKEY_CLASSES_ROOTu HKCRu \i u Invalid Registry Hive: %su Invalid Registry Hive: {0}u \\(
t splitt popt uppert KeyErrorR6 R7 R R, t insertt join( R9 R: t hivest regt passed_hivet
valid_hive( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyR1 s. (
c
S@ s) t | � } | j d k r* t d � � n d } t | t j � r� y | j | j d | } Wqt k
r� } d j
| � } t j | � t
| | � � qXnr y1 x* | D]" } | | j | j d | O} q� WWn> t k
r} d j
| � } t j | � t
| | � � n X| j � d
k r>t d j
| � � � n y� | j � d k r�| j j t j | j j | j i � j | � | | � nq | j � d k r�| j j t j | j j | j i � j | � | | � n% t j d | � t d
j
| � � � Wn# t k
r$} t d j
| � f SXt S( u�
Add an ACE to the DACL
Args:
principal (str):
The sid of the user/group to for the ACE
access_mode (str):
Determines the type of ACE to add. Must be either ``grant``
or ``deny``.
permissions (str, list):
The type of permissions to grant/deny the user. Can be one
of the basic permissions, or a list of advanced permissions.
applies_to (str):
The objects to which these permissions will apply. Not all
these options apply to all object types.
Returns:
bool: True if successful, otherwise False
Usage:
.. code-block:: python
dacl = Dacl(obj_type=obj_type)
dacl.add_ace(sid, access_mode, permission, applies_to)
dacl.save(obj_name, protected)
u+ You must load the DACL before adding an ACEi u basicu! Invalid permission specified: {0}u advancedu grantu denyu Invalid Access Mode: {0}u Invalid access mode: %su Invalid access mode: {0}u
Error: {0}N( u grantu deny( t get_sidR0 R. R t
isinstanceR t string_typesR R- RB R, R6 R7 R R+ t AddAccessAllowedAceExR t ACL_REVISION_DSR t gett AddAccessDeniedAceExt ExceptionR t True(
R9 t principalt access_modet permissionst
applies_tot sidt perm_flagR< R= t perm( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt add_aceL sP
$
c @ s� � � } � � } � � } � � } � � } xht d | j j � � D]N} | j j | � } | d d t j @d k rF | d d t j k r� | j j t j | d d | d | d � q�| d d t j k r| j j t j | d d | d | d � q�| d d t j
k rK| j j t j | d d | d | d � q�| d d t j k r�| j j t j | d d | d | d � q�qF qF Wx`t d | j j � � D]F} | j j | � } | d d t j @t j k r�| d d t j A} | d d t j k r:| j j t j | | d | d � q�| d d t j k rx| j j t j | | d | d � q�| d d t j
k r�| j j t j | | d | d � q�| d d t j k r�| j j t j | | d | d � q�q�q�Wx^ t d | j j � � D]D } | j j | � } | j j t j | d d | d | d � qWxe t d | j j � � D]K } | j j | � } | j j t j | d d t j A| d | d � quWx^ t d | j j � � D]D } | j j | � } | j j t j | d d | d | d � q�Wxe t d | j j � � D]K } | j j | � } | j j t j | d d t j A| d | d � q>W| j | _ d S( u\
Put the ACEs in the ACL in the proper order. This is necessary
because the add_ace function puts ACEs at the end of the list
without regard for order. This will cause the following Windows
Security dialog to appear when viewing the security for the object:
``The permissions on Directory are incorrectly ordered, which may
cause some entries to be ineffective.``
.. note:: Run this function after adding all your ACEs.
Proper Orders is as follows:
1. Implicit Deny
2. Inherited Deny
3. Implicit Deny Object
4. Inherited Deny Object
5. Implicit Allow
6. Inherited Allow
7. Implicit Allow Object
8. Inherited Allow Object
Usage:
.. code-block:: python
dacl = Dacl(obj_type=obj_type)
dacl.add_ace(sid, access_mode, applies_to, permission)
dacl.order_acl()
dacl.save(obj_name, protected)
i i i N(
R R0 t GetAceCountt GetAceR t
INHERITED_ACER RO RM t ACCESS_DENIED_OBJECT_ACE_TYPER RL t ACCESS_ALLOWED_OBJECT_ACE_TYPE( R9 t new_daclt deny_daclt
deny_obj_daclt
allow_daclt allow_obj_daclt it aceR ( R* ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt order_acl� s� c S@ s_ t | � } | j � } i } x: | D]2 } | | | k r% i | | | | 6| | <q% q% W| S( u�
Get the ACE for a specific principal.
Args:
principal (str):
The name of the user or group for which to get the ace. Can
also be a SID.
Returns:
dict: A dictionary containing the ACEs found for the principal
Usage:
.. code-block:: python
dacl = Dacl(obj_type=obj_type)
dacl.get_ace()
( t get_namet list_aces( R9 RR t acest retR ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt get_ace, s
c S@ s� i i d 6i d 6} x� t d | j j � � D]� } | j j | � } | j | � \ } } } } } | | | k r� i | d 6| d 6| | | | <q- i i | d 6| d 6| 6| | | <q- W| S( u
List all Entries in the dacl.
Returns:
dict: A dictionary containing the ACEs for the object
Usage:
.. code-block:: python
dacl = Dacl('C:\Temp')
dacl.list_aces()
u Inheritedu
Not Inheritedi u
applies tou permissions( R R0 RZ R[ t _ace_to_dict( R9 Rj Rd Re t usert a_typet a_propt a_permsR ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyRh K s
c
S@ s� t j | d � } y t | � } Wn t k
r< | } n X| j | d d } | d d t j @d k } d } | j d k r� | d d } | r� | d d t j A} n y | j | j | } Wq� t k
r� d } q� Xn | j d k r� d n | j } | j | d
j
| d g � } | s�g } xd | j | d D]Q } t | t j
� r^q@n | d | @| k r@| j | j | d | � q@q@W| j � n | s�d j | d � g } n | | | | | r�d
n d f S( uP
Helper function for creating the ACE return dictionary
i i i i u NAu fileu registryu
registry32u Unknown propagationu basicu advancedu Undefined Permission: {0}u Inheritedu
Not Inherited( u fileu registryu
registry32( R t ConvertSidToStringSidRg R R R\ R- R RB R RN RJ R RK t appendt sortR, (
R9 Re RV RR R t inheritedR R& R RX ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyRl q s@
!
u allc S@ s t | � } d } g } x� t d | j j � � D]� } | j j | | � } | d d t j @d k } | d | k r1 | r1 | j | d d | j � k s� | d k r� | j j | | � | j
| j | � � | d 7} q� q1 q1 W| sd j | � g } n | S( u�
Remove a specific ACE from the DACL.
Args:
principal (str):
The user whose ACE to remove. Can be the user name or a SID.
ace_type (str):
The type of ACE to remove. If not specified, all ACEs will
be removed. Default is 'all'. Valid options are:
- 'grant'
- 'deny'
- 'all'
Returns:
list: List of removed aces
Usage:
.. code-block:: python
dacl = Dacl(obj_name='C:\temp', obj_type='file')
dacl.rm_ace('Users')
dacl.save(obj_name='C:\temp')
i i i i u allu ACE not found for {0}(
RI R R0 RZ R[ R R\ R R+ t DeleteAceRr Rl R, ( R9 RR R RV t offsetRj Rd Re Rt ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt rm_ace� s ! c S@ s� | j d } | d k rG | r3 | | j d B} qG | | j d B} n | j d k rh | j | � } n y0 t j | | j | j | d d | j d � Wn1 t j
k
r� } t d j | � | j
� � n Xt S( ux
Save the DACL
Args:
obj_name (str):
The object for which to set permissions. This can be the
path to a file or folder, a registry key, printer, etc. For
more information about how to format the name see:
https://msdn.microsoft.com/en-us/library/windows/desktop/aa379593(v=vs.85).aspx
protected (Optional[bool]):
True will disable inheritance for the object. False will
enable inheritance. None will make no change. Default is
``None``.
Returns:
bool: True if successful, Otherwise raises an exception
Usage:
.. code-block:: python
dacl = Dacl(obj_type='file')
dacl.save('C:\Temp', True)
u daclu protectedu unprotectedu registryu
registry32u Failed to set permissions: {0}N( u registryu
registry32( R R. R R- R1 R t SetNamedSecurityInfoR& R0 R3 R4 R R, R5 RQ ( R9 R: t protectedt sec_infoR< ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt save� s$
N(
R R R R. R> R1 RY Rf Rk Rh Rl Rw R{ ( ( R* ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyR* � s 6 H U� & > 2( R R) R ( R: R& ( ( R* s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyR0 � s "� � Mc C@ s� | d k r d } n y t j j j | � } Wn t k
rG | } n Xy t j | � } WnO t j k
r� t
j d | � t d j | � � � n t
k
r� t � n X| S( u�
Converts a username to a sid, or verifies a sid. Required for working with
the DACL.
Args:
principal(str):
The principal to lookup the sid. Can be a sid or a username.
Returns:
PySID Object: A sid
Usage:
.. code-block:: python
# Get a user's sid
salt.utils.win_dacl.get_sid('jsnuffy')
# Verify that the sid is valid
salt.utils.win_dacl.get_sid('S-1-5-32-544')
u NULL SIDu Invalid user/group or sid: %su Invalid user/group or sid: {0}N( R. R R t
win_functionst get_sid_from_nameR R t ConvertStringSidToSidR3 R4 R6 R7 R, t TypeError( RR RV ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyRI s
c C@ s� | d k r d } n y t j | � SWn t k
rE t | � } n Xy t j | � SWn9 t j k
r� t j d | � t d j
| � � � n Xd S( u�
Converts a PySID object to a string SID.
Args:
principal(str):
The principal to lookup the sid. Must be a PySID object.
Returns:
str: A string sid
Usage:
.. code-block:: python
# Get a PySID object
py_sid = salt.utils.win_dacl.get_sid('jsnuffy')
# Get the string version of the SID
salt.utils.win_dacl.get_sid_string(py_sid)
u NULL SIDu Invalid principal %su Invalid principal {0}N( R. R Rq R RI R3 R4 R6 R7 R R, ( RR ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt get_sid_stringF s
c C@ s< t | t j � r | } nv | d k r0 d } n y t j | � } WnK t j k
r� y t j d | � d } Wq� t j k
r� | } q� Xn Xy t j d | � d SWn� t j t f k
r7} d j
| � } t | � t j k rt j
| j � j d � } d j
| | � } n t j | � t | | � � n Xd S( ua
Gets the name from the specified principal.
Args:
principal (str):
Find the Normalized name based on this. Can be a PySID object, a SID
string, or a user name in any capitalization.
.. note::
Searching based on the user name can be slow on hosts connected
to large Active Directory domains.
Returns:
str: The name that corresponds to the passed principal
Usage:
.. code-block:: python
salt.utils.win_dacl.get_name('S-1-5-32-544')
salt.utils.win_dacl.get_name('adminisTrators')
u S-1-0-0i u Error resolving "{0}"u
u {0}: {1}N( RJ R3 t SIDTypeR. R R~ R4 t LookupAccountNamet LookupAccountSidR R, t typet win32apit
FormatMessaget winerrort rstripR6 R7 R ( RR t sid_objR< t messaget win_error( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyRg m s(
c C@ s y t � j | j � } Wn& t k
rB t d j | � � � n X| d k rd t � j | � } n y( t j | | t j
� } | j � } Wn~ t k
r� d } nh t
j k
r } | j d k s� | j d k r� d } q
t j d | � t d j | � | j � � n Xt | � S(
u�
Gets the owner of the passed object
Args:
obj_name (str):
The path for which to obtain owner information. The format of this
parameter is different depending on the ``obj_type``
obj_type (str):
The type of object to query. This value changes the format of the
``obj_name`` parameter as follows:
- file: indicates a file or directory
- a relative path, such as ``FileName.txt`` or ``..\FileName``
- an absolute path, such as ``C:\DirName\FileName.txt``
- A UNC name, such as ``\\ServerName\ShareName\FileName.txt``
- service: indicates the name of a Windows service
- printer: indicates the name of a printer
- registry: indicates a registry key
- Uses the following literal strings to denote the hive:
- HKEY_LOCAL_MACHINE
- MACHINE
- HKLM
- HKEY_USERS
- USERS
- HKU
- HKEY_CURRENT_USER
- CURRENT_USER
- HKCU
- HKEY_CLASSES_ROOT
- CLASSES_ROOT
- HKCR
- Should be in the format of ``HIVE\Path\To\Key``. For example,
``HKLM\SOFTWARE\Windows``
- registry32: indicates a registry key under WOW64. Formatting is
the same as it is for ``registry``
- share: indicates a network share
Returns:
str: The owner (group or user)
Usage:
.. code-block:: python
salt.utils.win_dacl.get_owner('c:\\file')
u Invalid "obj_type" passed: {0}u registryu
registry32u S-1-0-0i i2 u Failed to get the owner: %su Failed to get owner: {0}( u registryu
registry32( R) R& R+ RB R R, R0 R1 R R2 R t GetSecurityDescriptorOwnert MemoryErrorR3 R4 R� R6 R7 R R5 Rg ( R: R& t
obj_type_flagt security_descriptort owner_sidR< ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt get_owner� s( 6
c C@ s6 y t � j | j � } Wn& t k
rB t d j | � � � n Xd | j � k rz t � j | � } t j d | � n y( t
j | | t
j � } | j
� } Wn~ t k
r� d } nh t j k
r"} | j d k s� | j d k r� d } q#t j d | � t d j | � | j � � n Xt t
j | � � S( u�
Gets the primary group of the passed object
Args:
obj_name (str):
The path for which to obtain primary group information
obj_type (str):
The type of object to query. This value changes the format of the
``obj_name`` parameter as follows:
- file: indicates a file or directory
- a relative path, such as ``FileName.txt`` or ``..\FileName``
- an absolute path, such as ``C:\DirName\FileName.txt``
- A UNC name, such as ``\\ServerName\ShareName\FileName.txt``
- service: indicates the name of a Windows service
- printer: indicates the name of a printer
- registry: indicates a registry key
- Uses the following literal strings to denote the hive:
- HKEY_LOCAL_MACHINE
- MACHINE
- HKLM
- HKEY_USERS
- USERS
- HKU
- HKEY_CURRENT_USER
- CURRENT_USER
- HKCU
- HKEY_CLASSES_ROOT
- CLASSES_ROOT
- HKCR
- Should be in the format of ``HIVE\Path\To\Key``. For example,
``HKLM\SOFTWARE\Windows``
- registry32: indicates a registry key under WOW64. Formatting is
the same as it is for ``registry``
- share: indicates a network share
Returns:
str: The primary group for the object
Usage:
.. code-block:: python
salt.utils.win_dacl.get_primary_group('c:\\file')
u Invalid "obj_type" passed: {0}u registryu Name converted to: %su S-1-0-0i i2 u# Failed to get the primary group: %su Failed to get primary group: {0}( R) R& R+ RB R R, R0 R1 R6 t debugR R2 R t GetSecurityDescriptorGroupR� R3 R4 R� R7 R R5 Rg Rq ( R: R& R� R� t primary_group_gidR< ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt get_primary_group� s, 6
c
C@ s t | � } t � } | j � | j k rB t d j | � � � n d | j � k ri t � j | � } n t � } t j
d d � } | j | t j
f � t j
d d � } | j | t j
f � t j � } t j | t j t j B� } t j | d | � y7 t j | | j | j � | j d | d
d
d
� WnD t j k
rz} t j d | | � t d j | � | j � � n Xt S( ue
Set the owner of an object. This can be a file, folder, registry key,
printer, service, etc...
Args:
obj_name (str):
The object for which to set owner. This can be the path to a file or
folder, a registry key, printer, etc. For more information about how
to format the name see:
https://msdn.microsoft.com/en-us/library/windows/desktop/aa379593(v=vs.85).aspx
principal (str):
The name of the user or group to make owner of the object. Can also
pass a SID.
obj_type (Optional[str]):
The type of object for which to set the owner. Default is ``file``
Returns:
bool: True if successful, raises an error otherwise
Usage:
.. code-block:: python
salt.utils.win_dacl.set_owner('C:\MyDirectory', 'jsnuffy', 'file')
u Invalid "obj_type" passed: {0}u registryu u SeTakeOwnershipPrivilegeu SeRestorePrivilegei u owneru Failed to make %s the owner: %su Failed to set owner: {0}N( RI R) R+ R& R R, R0 R1 t setR t LookupPrivilegeValuet addt win32cont SE_PRIVILEGE_ENABLEDR� t GetCurrentProcesst OpenProcessTokent TOKEN_ALL_ACCESSt TOKEN_ADJUST_PRIVILEGESt AdjustTokenPrivilegesRx R R. R3 R4 R6 R7 R R5 RQ (
R: RR R& RV t obj_flagst new_privst luidt p_handlet t_handleR< ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt set_ownerP s:
c
C@ s� | d k r d } n t | � } t � } | j � | j k rW t d j | � � � n d | j � k r~ t � j | � } n t � } t
j d d � } | j | t
j f � t
j d d � } | j | t
j f � t j � } t
j | t
j t
j B� } t
j | d | � y7 t
j | | j | j � | j d d | d d � WnD t j k
r�} t j d | | � t d
j | � | j � � n Xt S( us
Set the primary group of an object. This can be a file, folder, registry
key, printer, service, etc...
Args:
obj_name (str):
The object for which to set primary group. This can be the path to a
file or folder, a registry key, printer, etc. For more information
about how to format the name see:
https://msdn.microsoft.com/en-us/library/windows/desktop/aa379593(v=vs.85).aspx
principal (str):
The name of the group to make primary for the object. Can also pass
a SID.
obj_type (Optional[str]):
The type of object for which to set the primary group.
Returns:
bool: True if successful, raises an error otherwise
Usage:
.. code-block:: python
salt.utils.win_dacl.set_primary_group('C:\MyDirectory', 'Administrators', 'file')
u Noneu Invalid "obj_type" passed: {0}u registryu u SeTakeOwnershipPrivilegeu SeRestorePrivilegei u groupu' Failed to make %s the primary group: %su Failed to set primary group: {0}N( R. RI R) R+ R& R R, R0 R1 R� R R� R� R� R� R� R� R� R� R� R� Rx R R3 R4 R6 R7 R R5 RQ (
R: RR R& t gidR� R� R� R� R� R< ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt set_primary_group� s<
u grantc C@ s� | d k rE d | j � k r' d } qE | j � d k rE d } qE n | r] t d | � } n t | | � } | j | | � | j | | | | � | j � | j | | � t S( uO
Set the permissions of an object. This can be a file, folder, registry key,
printer, service, etc...
Args:
obj_name (str):
The object for which to set permissions. This can be the path to a
file or folder, a registry key, printer, etc. For more information
about how to format the name see:
https://msdn.microsoft.com/en-us/library/windows/desktop/aa379593(v=vs.85).aspx
principal (str):
The name of the user or group for which to set permissions. Can also
pass a SID.
permissions (str, list):
The type of permissions to grant/deny the user. Can be one of the
basic permissions, or a list of advanced permissions.
access_mode (Optional[str]):
Whether to grant or deny user the access. Valid options are:
- grant (default): Grants the user access
- deny: Denies the user access
applies_to (Optional[str]):
The objects to which these permissions will apply. Not all these
options apply to all object types. Defaults to
'this_folder_subfolders_files'
obj_type (Optional[str]):
The type of object for which to set permissions. Default is 'file'
reset_perms (Optional[bool]):
True will overwrite the permissions on the specified object. False
will append the permissions. Default is False
protected (Optional[bool]):
True will disable inheritance for the object. False will enable
inheritance. None will make no change. Default is None.
Returns:
bool: True if successful, raises an error otherwise
Usage:
.. code-block:: python
salt.utils.win_dacl.set_permissions(
'C:\Temp', 'jsnuffy', 'full_control', 'grant')
u registryu this_key_subkeysu fileu this_folder_subfolders_filesR& N( R. R+ R0 Rw RY Rf R{ RQ ( R: RR RT RS RU R& t reset_permsRy t obj_dacl( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt set_permissions� s >
u allc C@ s0 t | | � } | j | | � | j | � t S( u�
Remove a user's ACE from an object. This can be a file, folder, registry
key, printer, service, etc...
Args:
obj_name (str):
The object from which to remove the ace. This can be the
path to a file or folder, a registry key, printer, etc. For more
information about how to format the name see:
https://msdn.microsoft.com/en-us/library/windows/desktop/aa379593(v=vs.85).aspx
principal (str):
The name of the user or group for which to set permissions. Can also
pass a SID.
ace_type (Optional[str]):
The type of ace to remove. There are two types of ACEs, 'grant' and
'deny'. 'all' will remove all ACEs for the user. Default is 'all'
obj_type (Optional[str]):
The type of object for which to set permissions. Default is 'file'
Returns:
bool: True if successful, raises an error otherwise
Usage:
.. code-block:: python
# Remove jsnuffy's grant ACE from C:\Temp
salt.utils.win_dacl.rm_permissions('C:\\Temp', 'jsnuffy', 'grant')
# Remove all ACEs for jsnuffy from C:\Temp
salt.utils.win_dacl.rm_permissions('C:\\Temp', 'jsnuffy')
( R0 Rw R{ RQ ( R: RR R R& R� ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt rm_permissionsC s )
c C@ s2 t | | � } | d k r% | j � S| j | � S( uv
Get the permissions for the passed object
Args:
obj_name (str):
The name of or path to the object.
principal (Optional[str]):
The name of the user or group for which to get permissions. Can also
pass a SID. If None, all ACEs defined on the object will be
returned. Default is None
obj_type (Optional[str]):
The type of object for which to get permissions.
Returns:
dict: A dictionary representing the object permissions
Usage:
.. code-block:: python
salt.utils.win_dacl.get_permissions('C:\Temp')
N( R0 R. Rh Rk ( R: RR R& R� ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt get_permissionst s
c C@ sV | j � d
k r* t d j | � � � n | j � } t | | � } | j � } t | � } | j | d j | j � | j | d j | j � t � � } | s� t d j | � � � n d } xj t d | j j
� � D]P }
| j j |
� } | d | k r� | j | d d | k r� | d } q� q� W| s8t S| rH| | k S| | @| k S( u�
Check if the object has a permission
Args:
obj_name (str):
The name of or path to the object.
principal (str):
The name of the user or group for which to get permissions. Can also
pass a SID.
permission (str):
The permission to verify. Valid options depend on the obj_type.
access_mode (Optional[str]):
The access mode to check. Is the user granted or denied the
permission. Default is 'grant'. Valid options are:
- grant
- deny
obj_type (Optional[str]):
The type of object for which to check permissions. Default is 'file'
exact (Optional[bool]):
True for an exact match, otherwise check to see if the permission is
included in the ACE. Default is True
Returns:
bool: True if the object has the permission, otherwise False
Usage:
.. code-block:: python
# Does Joe have read permissions to C:\Temp
salt.utils.win_dacl.has_permission(
'C:\\Temp', 'joe', 'read', 'grant', False)
# Does Joe have Full Control of C:\Temp
salt.utils.win_dacl.has_permission(
'C:\\Temp', 'joe', 'full_control', 'grant')
u grantu denyu! Invalid "access_mode" passed: {0}u basicu advancedu Invalid "permission" passed: {0}i i i ( u grantu denyN(
R+ R R, R0 RI R RN R R. R RZ R[ R ( R: RR t
permissionRS R& t exactR� RV t chk_flagt cur_flagRd Re ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt has_permission� s. 3 & +
c C@ s\ | d k r$ t d j | � � � n | r< t d | � } n t | | � } | j | | � S( u�
Enable or disable an objects inheritance.
Args:
obj_name (str):
The name of the object
enabled (bool):
True to enable inheritance, False to disable
obj_type (Optional[str]):
The type of object. Only three objects allow inheritance. Valid
objects are:
- file (default): This is a file or directory
- registry
- registry32 (for WOW64)
clear (Optional[bool]):
True to clear existing ACEs, False to keep existing ACEs.
Default is False
Returns:
bool: True if successful, otherwise an Error
Usage:
.. code-block:: python
salt.utils.win_dacl.set_inheritance('C:\Temp', False)
u fileu registryu
registry32u- obj_type called with incorrect parameter: {0}R& ( u fileu registryu
registry32( R R, R0 R{ ( R: t enabledR& t clearR� ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt set_inheritance� s ! c C@ ss t d | d | � } t j } xN t d | j j � � D]4 } | j j | � } | d d | @| k r7 t Sq7 Wt S( u�
Get an object's inheritance.
Args:
obj_name (str):
The name of the object
obj_type (Optional[str]):
The type of object. Only three object types allow inheritance. Valid
objects are:
- file (default): This is a file or directory
- registry
- registry32 (for WOW64)
The following should return False as there is no inheritance:
- service
- printer
- share
Returns:
bool: True if enabled, otherwise False
Usage:
.. code-block:: python
salt.utils.win_dacl.get_inheritance('HKLM\SOFTWARE\salt', 'registry')
R: R& i i ( R0 R R\ R RZ R[ RQ R ( R: R& R� Rt Rd Re ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt get_inheritance s c C@ sq t d | � } d | j � k rb | j | � } t j d | � | j | � } t j d | � n y t � j | j � } Wn& t k
r� t d j | � � � n Xd } | r� | t
j O} n | r� | t
j O} n | r� | t
j
O} n | r| t
j O} n | st d � � n t � }
t
j d d � } |
j | t j f � t
j d d
� } |
j | t j f � t
j d d � } |
j | t j f � t j � } t
j | t
j t j B� }
t
j |
d |
� t
j | | | � } | j � } | j � } | j � } | j � } y# t
j | | | | | | | � Wn. t j! k
rl} t" d j | j# � � � n Xt$ S(
u�
Copy the security descriptor of the Source to the Target. You can specify a
specific portion of the security descriptor to copy using one of the
`copy_*` parameters.
.. note::
At least one `copy_*` parameter must be ``True``
.. note::
The user account running this command must have the following
privileges:
- SeTakeOwnershipPrivilege
- SeRestorePrivilege
- SeSecurityPrivilege
Args:
source (str):
The full path to the source. This is where the security info will be
copied from
target (str):
The full path to the target. This is where the security info will be
applied
obj_type (str): file
The type of object to query. This value changes the format of the
``obj_name`` parameter as follows:
- file: indicates a file or directory
- a relative path, such as ``FileName.txt`` or ``..\FileName``
- an absolute path, such as ``C:\DirName\FileName.txt``
- A UNC name, such as ``\\ServerName\ShareName\FileName.txt``
- service: indicates the name of a Windows service
- printer: indicates the name of a printer
- registry: indicates a registry key
- Uses the following literal strings to denote the hive:
- HKEY_LOCAL_MACHINE
- MACHINE
- HKLM
- HKEY_USERS
- USERS
- HKU
- HKEY_CURRENT_USER
- CURRENT_USER
- HKCU
- HKEY_CLASSES_ROOT
- CLASSES_ROOT
- HKCR
- Should be in the format of ``HIVE\Path\To\Key``. For example,
``HKLM\SOFTWARE\Windows``
- registry32: indicates a registry key under WOW64. Formatting is
the same as it is for ``registry``
- share: indicates a network share
copy_owner (bool): True
``True`` copies owner information. Default is ``True``
copy_group (bool): True
``True`` copies group information. Default is ``True``
copy_dacl (bool): True
``True`` copies the DACL. Default is ``True``
copy_sacl (bool): True
``True`` copies the SACL. Default is ``True``
Returns:
bool: ``True`` if successful
Raises:
SaltInvocationError: When parameters are invalid
CommandExecutionError: On failure to set security
Usage:
.. code-block:: python
salt.utils.win_dacl.copy_security(
source='C:\\temp\\source_file.txt',
target='C:\\temp\\target_file.txt',
obj_type='file')
salt.utils.win_dacl.copy_security(
source='HKLM\\SOFTWARE\\salt\\test_source',
target='HKLM\\SOFTWARE\\salt\\test_target',
obj_type='registry',
copy_owner=False)
R& u registryu Source converted to: %su Target converted to: %su Invalid "obj_type" passed: {0}i uC One of copy_owner, copy_group, copy_dacl, or copy_sacl must be Trueu u SeTakeOwnershipPrivilegeu SeRestorePrivilegeu SeSecurityPrivilegeu Failed to set security info: {0}(% R0 R+ R1 R6 t infoR) R& RB R R, R R R R t SACL_SECURITY_INFORMATIONR� R� R� R� R� R� R� R� R� R� R� R2 R� R� R8 t GetSecurityDescriptorSaclRx R3 R4 R R5 RQ ( t sourcet targetR& t
copy_ownert
copy_groupt copy_daclt copy_saclR� R� t security_flagsR� R� R� R� t sect sd_sidt sd_gidt sd_daclt sd_saclR< ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt
copy_securityI sb `
c C@ s� | j � } i } xq| D]i} d } y t d | � } Wn7 t k
rq | d j d j | j � | � � q n Xd | | k r� | | d }
t � j d |
} t � j d | } n d }
| | d k r| | k r� i | | <n | | d | | | <|
r�|
| | d <q�q t | | d t
j � r�t d | d | d
| | d d | d | d
t
� s | | k r�i | | <n | | d | | | <q n~ x{ | | d D]k } t d | d | d
| d | d | d
t
� s�| | k r i g | 6| | <n | | | j | � q�q�W|
r | | d | k r�| d | | d | k s| | k rki | | <n |
| | d <qq�q q W| r�d | d k r�i | d d <n x�| D]�} t d | � } t d t k r#| | d d k ri | d d | <n | | | | d d | | <q�d }
d | | k r"| | d k r�| | d | k r�x� t � j | D]� }
t � j | |
| d | | d k rn|
} xG t � j | D]2 } t j j j � j | | | k r�| }
q�q�WqnqnWn |
s0| j � d k rd }
q d }
q0n | | d }
g } | | | k r�x� | d | | d D]� } x� t � j | d D]s }
t � j | d |
| k rx|
} xF t � j | d D]- } t � j | d | | k r�| } q�q�WqxqxWq]W| s�x� | d | | d D]� } x� t � j | d D]z }
t � j | d |
| k r+|
} xM t � j | d D]4 } t � j | d | | k rj| j | � qjqjWq+q+WqWq�n | | | } yv t d | d | d | d | d |
d | � | | d d k ri | d d | <n | | | | d d | | <Wq�t k
r�} t
| d <| d j d j | | | | | j � � q�Xq�Wn | S( u�
Helper function used by ``check_perms`` for checking and setting Grant and
Deny permissions.
Args:
obj_name (str):
The name or full path to the object
obj_type (Optional[str]):
The type of object for which to check permissions. Default is 'file'
new_perms (dict):
A dictionary containing the user/group and the basic permissions to
check/grant, ie: ``{'user': {'perms': 'basic_permission'}}``.
cur_perms (dict):
A dictionary containing the user/group permissions as they currently
exists on the target object.
access_mode (str):
The access mode to set. Either ``grant`` or ``deny``
ret (dict):
A dictionary to append changes to and return. If not passed, will
create a new dictionary to return.
Returns:
dict: A dictionary of return data as expected by the state system
u RR u commentu0 {0} Perms: User "{1}" missing from Target Systemu
applies_tou fileu
Not Inheritedu permsR: R� RS R& R� u
applies tou changesu testu registryu
registry32u this_key_subkeysu this_folder_subfolders_filesu permissionsu basicu advancedRT RU u resultu< Failed to change {0} permissions for "{1}" to {2}
Error: {3}N( u registryu
registry32( R+ Rg R Rr R, t
capitalizeR) R R. RJ R RK R� R t __opts__RQ R R t win_daclR R� R5 ( R: R& t new_permst cur_permsRS Rj t changesRm t applies_to_textt user_nameRU t at_flagRX t flagt flag1t permsRW R< ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt _check_perms� s�
!*# %"
%c
C@ s� | j � t � j k r0 t d j | � � � n | j � } | sm i | d 6i d 6g d 6t d 6} d } n | d } g | d <| rWt d | � } t d | d | � } | | k rWt d
t k r� | | d d <qTyA t d | d | d | � t
j d j | � � | | d d <WqTt k
rPt
| d <| d j d
j | � � qTXqWn | d# k r'| t d | d | � k s't d
t k r�| | d d <q$yG t d | d | d | � t
j d | r�d n d � | | d d <Wq$t k
r t
| d <| d j d j | | � � q$Xq'n t
j d j | � � t d | d | � }
| d# k r�t d | d | d | d |
d d d | � } n | d# k r�t d | d | d | d |
d d d | � } n | rt
j d j | � � t d | d | � }
x |
d D]} | d# k r| j � t d � | D� � k rd |
d | k rt d
t k r�d | d k ri | d d <n | d d j i |
d | | 6� q
d | d k r�i | d d <n t d | d | d d d | � | d d j i |
d | | 6� qn | d# k r| j � t d � | D� � k rd |
d | k rt d
t k r�d | d k r�i | d d <n | d d j i |
d | | 6� qd | d k r�i | d d <n t d | d | d d d | � | d d j i |
d | | 6� qqqWn t | t j � rM| rm| d j d! | � qmn | rm| j | d � | d <n d" j | d � | d <t d
r�| d r�d# | d <n | S($ u/
Check owner and permissions for the passed directory. This function checks
the permissions and sets them, returning the changes made.
.. versionadded:: 2019.2.0
Args:
obj_name (str):
The name or full path to the object
obj_type (Optional[str]):
The type of object for which to check permissions. Default is 'file'
ret (dict):
A dictionary to append changes to and return. If not passed, will
create a new dictionary to return.
owner (str):
The owner to set for the directory.
grant_perms (dict):
A dictionary containing the user/group and the basic permissions to
check/grant, ie: ``{'user': {'perms': 'basic_permission'}}``.
Default is ``None``.
deny_perms (dict):
A dictionary containing the user/group and permissions to
check/deny. Default is ``None``.
inheritance (bool):
``True`` will enable inheritance from the parent object. ``False``
will disable inheritance. Default is ``True``.
reset (bool):
``True`` will clear the DACL and set only the permissions defined
in ``grant_perms`` and ``deny_perms``. ``False`` append permissions
to the existing DACL. Default is ``False``. This does NOT affect
inherited permissions.
Returns:
dict: A dictionary of changes that have been made
Usage:
.. code-block:: bash
# You have to use __utils__ in order for __opts__ to be available
# To see changes to ``C:\Temp`` if the 'Users' group is given 'read & execute' permissions.
__utils__['dacl.check_perms'](obj_name='C:\Temp',
obj_type='file',
owner='Administrators',
grant_perms={
'Users': {
'perms': 'read_execute'
}
})
# Specify advanced attributes with a list
__utils__['dacl.check_perms'](obj_name='C:\Temp',
obj_type='file',
owner='Administrators',
grant_perms={
'jsnuffy': {
'perms': [
'read_attributes',
'read_ea'
],
'applies_to': 'files_only'
}
})
u Invalid "obj_type" passed: {0}u nameu changesu commentu resultu RR R: R& u testu owneru Owner set to {0}u Failed to change owner to "{0}"u inheritanceR� u %s inheritanceu Enablingu Disablingu* Failed to set inheritance for "{0}" to {1}u# Getting current permissions for {0}R� R� RS u denyRj u grantu Resetting permissions for {0}u
Not Inheritedc s@ s | ] } | j � Vq d S( N( R+ ( t .0t k( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pys <genexpr>A s u remove_permsR c s@ s | ] } | j � Vq d S( N( R+ ( R� R� ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pys <genexpr>T s i u
N( R+ R) R& R R, RQ Rg R� R� R� R6 R� R R Rr R. R� R� R� R� R� t updateR� RJ R RK RC t extendRD ( R: R& Rj t ownert grant_permst
deny_permsR t resett orig_commentt
current_ownerR� R� ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt check_perms� s� R
" "#
c C@ s� | j � } i } x�| D]�} y t | � } Wn- t k
r^ t j d | j � | � q n Xd } | d k r{d | | k rj| | d k r4d | d | k r4x� t � j | D]w } t � j | | | d | d d k r� | }
x> t � j | D]) } t � j | | |
k r� | } q� q� Wq� q� Wn | sx| d k rOd } qgd | k rgd
} qgqxq{| | d } n | j d | d | d
| | d d | � r | | | | <q q W| S( Nu. %s Perms: User "%s" missing from Target Systemu fileu registryu
registry32u
applies_tou
Not Inheritedu denyu
applies tou this_folder_subfolders_filesu this_key_subkeysRR RS RT u permsRU ( u fileu registryu
registry32(
R+ Rg R R6 R� R� R. R) R RY ( R� R& R� R� RS Rj Rm R� RU R� R� R� ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt
_set_permsw s@
* c C@ s� i } | r$ t d | � } i } n' t | d | �} t d | d | � } | d k r� t d | d | d | d | d d � | d <n | d k r� t d | d | d | d | d d � | d <n | j � | j | | � r� | Si S(
u�
Set permissions for the given path
.. versionadded:: 2019.2.0
Args:
obj_name (str):
The name or full path to the object
obj_type (Optional[str]):
The type of object for which to check permissions. Default is 'file'
grant_perms (dict):
A dictionary containing the user/group and the basic permissions to
grant, ie: ``{'user': {'perms': 'basic_permission'}}``. You can also
set the ``applies_to`` setting here. The default for ``applise_to``
is ``this_folder_subfolders_files``. Specify another ``applies_to``
setting like this:
.. code-block:: yaml
{'user': {'perms': 'full_control', 'applies_to': 'this_folder'}}
To set advanced permissions use a list for the ``perms`` parameter,
ie:
.. code-block:: yaml
{'user': {'perms': ['read_attributes', 'read_ea'], 'applies_to': 'this_folder'}}
To see a list of available attributes and applies to settings see
the documentation for salt.utils.win_dacl.
A value of ``None`` will make no changes to the ``grant`` portion of
the DACL. Default is ``None``.
deny_perms (dict):
A dictionary containing the user/group and permissions to deny along
with the ``applies_to`` setting. Use the same format used for the
``grant_perms`` parameter. Remember, deny permissions supersede
grant permissions.
A value of ``None`` will make no changes to the ``deny`` portion of
the DACL. Default is ``None``.
inheritance (bool):
If ``True`` the object will inherit permissions from the parent, if
``False``, inheritance will be disabled. Inheritance setting will
not apply to parent directories if they must be created. Default is
``False``.
reset (bool):
If ``True`` the existing DCL will be cleared and replaced with the
settings defined in this function. If ``False``, new entries will be
appended to the existing DACL. Default is ``False``.
Returns:
bool: True if successful
Raises:
CommandExecutionError: If unsuccessful
Usage:
.. code-block:: bash
import salt.utils.win_dacl
# To grant the 'Users' group 'read & execute' permissions.
salt.utils.win_dacl.set_perms(obj_name='C:\Temp',
obj_type='file',
grant_perms={
'Users': {
'perms': 'read_execute'
}
})
# Specify advanced attributes with a list
salt.utils.win_dacl.set_perms(obj_name='C:\Temp',
obj_type='file',
grant_perms={
'jsnuffy': {
'perms': [
'read_attributes',
'read_ea'
],
'applies_to': 'this_folder_only'
}
}"
R& R: R� R� R� RS u denyu grantN( R0 R� R. R� Rf R{ ( R: R& R� R� R R� Rj R� R� ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt set_perms� s, a
(2 R t
__future__R R R t loggingt salt.exceptionsR R t salt.utils.platformR t salt.utils.win_functionst salt.ext.six.movesR t salt.extR R R R R� R� R3 RQ t ImportErrort getLoggerR R6 R
R R) R. R0 RI R� Rg R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� ( ( ( s7 /usr/lib/python2.7/site-packages/salt/utils/win_dacl.pyt <module>� s~
�
� � d . ' 9 T V M T P .% V- - � � � .
Mini Shell