File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/win_dacl.cpython-310.pyc
Back
o ;j΅ � @ s� d Z ddlZddlZddlZddlZddlmZ zddlZddl Z ddl Z dZ W n e y3 dZ Y nw e� e�ZdZG dd� d�Zd d � Zd d � Zd d� Zd!dd�Zdd� Zd"dd�Zdd� Zd#dd�Zd$dd�Zd%dd �Zd!d d �Z d&d d �Z dS )'z= Manage DACLs on Windows :depends: - winreg Python module � N)�CommandExecutionErrorTFZwin_daclc @ s` e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dd� Z dd� Z dd� Z dS )� daclConstantsz3 DACL constants used throughout the module c C sd t jt jB dB | _ddddddddddddd� | _tjtjdd�tj d d�d �tj t j dd�t j d d�t j t j B d d�t j t j B t j B t jB d d�| jd d�d�i| _ddd�ddd�d�| _tjdtjd�dtjd�dtjtjB d�dtjd�dtjd�dtjtjB d�d�tj i ddtjd��ddtjd��d d tjtjB d��d d tjd��d d!tjd��d"d#tjtjB tjB d��d$d%tjtjB d��d&d'tjtjB d��d(dtjd��d)dtjd��d*d tjtjB d��d+d tjd��d,d!tjd��d-d#tjtjB tjB d��d.d%tjtjB d��d/d'tjtjB d��i| _tj tj tjB d0�| _tj tj tjd1�| _d S )2Ni� �MACHINE�USERS� CURRENT_USER� CLASSES_ROOT) �HKEY_LOCAL_MACHINEZ HKEY_USERS�HKEY_CURRENT_USERZHKEY_CLASSES_ROOTr r r r ZHKLMZHKUZHKCUZHKCR�read)�BITS�TEXTz full control)�READ� FULLCONTROL�writezread and execute�modify)r ZWRITEz READ&EXECUTEZMODIFYr �allowedr )r r Zdenied� )ZALLOWZDENYz this key onlyzthis key and subkeysz subkeys only)ZKEYz KEY&SUBKEYSZSUBKEYSz THIS KEY ONLYzTHIS KEY AND SUBKEYSz SUBKEYS ONLY�FILEzthis file/folder onlyZFOLDERzFOLDER&SUBFOLDERS&FILESz"this folder, subfolders, and fileszFOLDER&SUBFOLDERSzthis folder and subfoldersz FOLDER&FILESzthis folder and fileszSUBFOLDERS&FILESzsubfolders and filesZ SUBFOLDERSzsubfolders onlyZFILESz files onlyzTHIS FILE ONLYzTHIS FOLDER ONLYz"THIS FOLDER, SUBFOLDERS, AND FILESzTHIS FOLDER AND SUBFOLDERSzTHIS FOLDER AND FILESzSUBFOLDERS AND FILESzSUBFOLDERS ONLYz FILES ONLY)TF)r Z DIRECTORYZREGISTRY)� ntsecurityconZSTANDARD_RIGHTS_REQUIREDZ SYNCHRONIZEZFILE_ALL_ACCESS�hkeys_security� win32security�SE_REGISTRY_KEY�winregZKEY_READZKEY_ALL_ACCESSZSE_FILE_OBJECTZFILE_GENERIC_READZFILE_GENERIC_WRITEZFILE_GENERIC_EXECUTEZDELETE�rights� validAceTypesZNO_INHERITANCEZCONTAINER_INHERIT_ACEZINHERIT_ONLY_ACEZOBJECT_INHERIT_ACE�validPropagationsZKEY_WOW64_64KEYZreflection_mask� objectType)�self� r �I/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/win_dacl.py�__init__. sZ �� � ������ ��� ������������ ����������� ���!���&��*��.���3��7��;����A���F����h � �zdaclConstants.__init__c C sJ t |t�r#|�� }z| j| W S ty" td�|d�| j����w |S )zA returns the bit value of the string object type z@Invalid object type "{}". It should be one of the following: {}�, )� isinstance�str�upperr �KeyErrorr �format�join�r �tr r r �getObjectTypeBit� s ���z daclConstants.getObjectTypeBitc C s4 z| j | W S ty td�|d�| j ����w )z] returns the necessary string value for an HKEY for the win32security module z;No HKEY named "{}". It should be one of the following: {}r! )r r% r r& r' )r �sr r r �getSecurityHkey� s ���z daclConstants.getSecurityHkeyc C sP zt |t�r| j| | d W S |W S ty' td�|d�| j| ����w )zg returns a permission bit of the string permission value for the specified object type r �6No right "{}". It should be one of the following: {}r! )r" r# r r% r r& r' �r r) �mr r r �getPermissionBit� s ���z daclConstants.getPermissionBitc C �@ z | j | | d W S ty td�|d�| j | ����w )zi returns the permission textual representation of a specified permission bit/object type r r- r! )r r% r r& r' r. r r r �getPermissionText� � ���z daclConstants.getPermissionTextc C �8 z| j | d W S ty td�|d�| j ����w )z9 returns the acetype bit of a text value r �9No ACE type "{}". It should be one of the following: {}r! �r r% r r& r' r( r r r � getAceTypeBit � ���zdaclConstants.getAceTypeBitc C r4 )zE returns the textual representation of a acetype bit r r5 r! r6 r( r r r �getAceTypeText r8 z daclConstants.getAceTypeTextc C r1 )z= returns the propagation bit of a text value r �DNo propagation type of "{}". It should be one of the following: {}r! �r r% r r& r' �r r) �pr r r �getPropagationBit" r3 z daclConstants.getPropagationBitc C r1 )zI returns the textual representation of a propagation bit r r: r! r; r< r r r �getPropagationText/ r3 z daclConstants.getPropagationTextc C sR |t jkr!|�d�}| �|�d��� �}|�d|� d�|�}|S tj � |�}|S )z� processes a path/object type combo and returns: registry types with the correct HKEY text representation files/directories with environment variables expanded �\r z\\) r r �splitr, �popr$ �insertr' �os�path� expandvars)r rE r ZspltZhiver r r � processPath< s �zdaclConstants.processPathN)�__name__� __module__� __qualname__�__doc__r r* r, r0 r2 r7 r9 r> r? rG r r r r r $ s r c C s: i }d}| rft �|| t j�rfzt�| �}W n ty4 } zd|d< d�| |�|d< W Y d}~|S d}~ww zt�d|� d|d< ||d < W |S tye } zd|d< d �| |�|d< W Y d}~|S d}~ww z| rqt�d| �d nd}d|d< ||d < W |S ty� } zd|d< d �| |�|d< W Y d}~|S d}~ww ) z� return a state error dictionary, with 'sid' as a field if it could be returned if user is None, sid will also be None z^S-1(-\d+){1,}$F�resultzNUnable to obtain the binary security identifier for {}. The exception was {}.�commentN� T�sidzSUnable to lookup the account for the security identifier {}. The exception was {}.r zGUnable to obtain the security identifier for {}. The exception was {}.) �re�match�Ir Z GetBinarySid� Exceptionr& �LookupAccountSidZLookupAccountName)�user�retZ sid_patternrO �er r r � _get_user_sidL sN ��� ���� ����rX c C s t jj�� r tr tS dS )z' Only works on Windows systems )Fz5Module win_dacl: module only works on Windows systems)�salt�utils�platformZ is_windows�HAS_WINDOWS_MODULES�__virtualname__r r r r � __virtual__w s r^ c C s4 z t �| |t j��� }W |S ty d}Y |S w )z! Gets the DACL of a path N)r �GetNamedSecurityInfo�DACL_SECURITY_INFORMATION�GetSecurityDescriptorDaclrS )rE r �daclr r r � _get_dacl� s �� ��rc c C s� | g d�}t |�}| rG|rGt� }|�|�}|�| |�} t| |�}|rGtd|�� �D ] }|�|�} |d r<| d |d krF|d �t | |�� q)|S )a� Get the ACL of an object. Will filter by user if one is provided. Args: path (str): The path to the object objectType (str): The type of object (FILE, DIRECTORY, REGISTRY) user (:obj:`str`, optional): A username to filter by. Default is ``None``. Returns (dict): A dictionary containing the ACL CLI Example: .. code-block:: bash salt 'minion-id' win_dacl.get 'c:\temp' directory )�Path�ACLsr rO � re ) rX r r* rG rc �range� GetAceCount�GetAce�append� _ace_to_text) rE r rU rV �sidRet�dc� objectTypeBit�tdacl�counter�tAcer r r �get� s �rr c C s� di dd�}| r�|r�|r�|r�|r�|� � dkrd}t� }|�|�}|�| |�} |�� }|�� � � }|�� � � }|�� � � }t|�} | d sF| S |�||�} |�|�} |�||�} t | |�} | r�g }zG| dkrq| � t j | | | d � n| dkr�| � t j | | | d � t �| |t jdd| d� |�d �||�|�|�||�|�||��� d |d< W n ty� } zd �|�|d < d |d< |W Y d}~S d}~ww |r�||d d< |S d| � �|d < |S d|d < d |d< |S )a Add an ace to an object Args: path (str): Path to the object (i.e. c:\\temp\\file, HKEY_LOCAL_MACHINE\\SOFTWARE\\KEY, etc) user (str): User to add permission (str): Permissions for the user acetype (str): Either allow/deny for each user/permission (ALLOW, DENY) propagation (str): How the ACE applies to children for Registry Keys and Directories (KEY, KEY&SUBKEYS, SUBKEYS) CLI Example: .. code-block:: bash # allow domain\fakeuser full control on HKLM\\SOFTWARE\\somekey, propagate to this key and subkeys salt 'myminion' win_dacl.add_ace 'HKEY_LOCAL_MACHINE\\SOFTWARE\\somekey' 'Registry' 'domain\fakeuser' 'FULLCONTROL' 'ALLOW' 'KEY&SUBKEYS' NrN �rL �changesrM r rL r rO r z{} {} {} on {}Tz>An error occurred attempting to add the ace. The error was {}rM Frt z Added ACEsz Unable to obtain the DACL of z1An empty value was specified for a required item.)r$ r r* rG �striprX r0 r7 r> rc ZAddAccessAllowedAceExr Z ACL_REVISIONZAddAccessDeniedAceEx�SetNamedSecurityInfor` rj r& r9 r2 r? rS )rE r rU � permission�acetype� propagationrV rm rn rl � permissionbit� acetypebit�propagationbitrb Z acesAddedrW r r r �add_ace� s� ��� �� ���� ��r} c C sB di dd�}| �r |�r t � }|r|�� dkrd}|�|�}|�| |�} |�� }|r0|�� �� nd}|r:|�� �� nd}|rD|�� �� nd}t| |||||d�d �rt|�} | d s]| S |re|�||�nd} |rn|�|�nd} |rx|� ||�nd} t | |�} d}g }|| � � k r�| � |�}|d d t j@ t jkr�|d | d kr�| r�|d d | kr�| r�|d d | @ | kr�| r�|d | kr�| �|� |d }|�t||�� |d }|| � � k s�|�rzt �| |t jdd| d� ||d d < d|d< W |S t�y } zd|d< d|� d�|d< |W Y d}~S d}~ww |S d|d< |S )a remove an ace to an object Args: path (str): Path to the object (i.e. c:\\temp\\file, HKEY_LOCAL_MACHINE\\SOFTWARE\\KEY, etc) user (str): User to remove permission (:obj:`str`, optional): Permission for the user. Default is ``None``. acetype (:obj:`str`, optional): Either allow/deny for each user/permission (ALLOW, DENY). Default is ``None``. propagation (:obj:`str`, optional): How the ACE applies to children for Registry Keys and Directories (KEY, KEY&SUBKEYS, SUBKEYS). Default is ``None``. If any of the optional parameters are omitted (or set to None) they act as wildcards. CLI Example: .. code-block:: bash # Remove allow domain\fakeuser full control on HKLM\\SOFTWARE\\somekey propagated to this key and subkeys salt 'myminion' win_dacl.rm_ace 'Registry' 'HKEY_LOCAL_MACHINE\\SOFTWARE\\somekey' 'domain\fakeuser' 'FULLCONTROL' 'ALLOW' 'KEY&SUBKEYS' NrN rs r T�ExistsrL r r rf rO rt � Removed ACEsFz#Error removing ACE. The error was �.rM z,The specified ACE was not found on the path.)r r$ r* rG ru � check_acerX r0 r7 r> rc rh ri r � INHERITED_ACE� DeleteAcerj rk rv r` rS )rE r rU rw rx ry rV rm rn rl rz r{ r| rb rp Z acesRemovedrq rW r r r �rm_ace s� " ���� � � �� ����r� c C sz t � }|�|�}z t�d| d �}|d r!|d � d|d � �}n|d � }W n ty7 t�| d �}Y nw | d }| d d }| d d }d}|jD ]}|j| d |kra|j| d } nqM|j| D ]}|j| | d |kr|j| | d } nqg|tj@ tjkr�d}|tjA }|j | D ]}|j | | d |kr�|j | | d } nq�|� d |� d |� d |� d |� � S ) zG helper function to convert an ace to a textual representation rN rf r r@ r r r z [Inherited]� z on ) r r* r rT rS ZConvertSidToStringSidr r r� r ) �acer rm ZuserSidZtPermZtAceTypeZtPropsZ tInherited�xr r r rk � sD � � �� � rk c C s� ddi d�}| r�z�t �| |t j�}|�� }|rq|rUd}g } ||�� k rL|�|�} | d d t j@ t jkrB|�|� | �t | |�� n|d }||�� k s#| rT| |d d< nd|d d < t � | |t jt j B d d |d � d |d d < nY|s�d}g } ||�� k r�|�|�} | d d t j@ t jkr�|�|� | �t | |�� n|d }||�� k s}| r�| |d d< nd |d d< t � | |t jt j B d d |d � d|d d < d|d< W |S t y� } zd|d< d| � d�|d< W Y d } ~ |S d } ~ ww |S )a3 helper function to set the inheritance Args: path (str): The path to the object objectType (str): The type of object inheritance (:obj:`bool`, optional): ``True`` enables inheritance, ``False`` disables. Default is ``True``. copy (:obj:`bool`, optional): Copy inherited ACEs to the DACL before disabling inheritance. Default is ``True``. clear (:obj:`bool`, optional): Remove non-inherited ACEs from the DACL. Default is ``False``. FrN )rL rM rt r r rt r zLeft in the DACLzNon-Inherited ACEsNZEnabled� InheritancezCopied to the DACLzPreviously Inherited ACEsZDisabledTrL z8Error attempting to set the inheritance. The error was r� rM )r r_ r` ra rh ri r� r� rj rk rv Z%UNPROTECTED_DACL_SECURITY_INFORMATIONZ#PROTECTED_DACL_SECURITY_INFORMATIONrS ) rE r Z inheritance�copy�clearrV �sdro rp Z removedAcesrq ZinheritedAcesRemovedrW r r r �_set_dacl_inheritance� s� � � � � �� � � � �� � ���r� c C s, t � }|�|�}|�| |�} t| |dd|�S )a� Enable/disable inheritance on an object Args: path (str): The path to the object objectType (str): The type of object (FILE, DIRECTORY, REGISTRY) clear (:obj:`bool`, optional): ``True`` will remove non-Inherited ACEs from the ACL. Default is ``False``. Returns (dict): A dictionary containing the results CLI Example: .. code-block:: bash salt 'minion-id' win_dacl.enable_inheritance 'c:\temp' directory TN�r r* rG r� )rE r r� rm r r r �enable_inheritance s r� c C s, t � }|�|�}|�| |�} t| |d|d�S )a Disable inheritance on an object Args: path (str): The path to the object objectType (str): The type of object (FILE, DIRECTORY, REGISTRY) copy (:obj:`bool`, optional): ``True`` will copy the Inherited ACEs to the DACL before disabling inheritance. Default is ``True``. Returns (dict): A dictionary containing the results CLI Example: .. code-block:: bash salt 'minion-id' win_dacl.disable_inheritance 'c:\temp' directory FNr� )rE r r� rm r r r �disable_inheritance# s r� c C s� dddd�}t |�}t� }|�|�}|�| |�} zt�| |tj�}|�� }W n tyF } zd|d< d|� d�|d< |W Y d}~S d}~ww t d |� � �D ]%} |� | �} | d d tj @ tj krs|d rm| d |d krsd |d< nqNd |d< |S )a" Check a specified path to verify if inheritance is enabled Args: path (str): path of the registry key or file system object to check objectType (str): The type of object (FILE, DIRECTORY, REGISTRY) user (:obj:`str`, optional): If provided, will consider only the ACEs for that user. Default is ``None``. Returns (bool): 'Inheritance' of True/False CLI Example: .. code-block:: bash salt 'minion-id' win_dacl.check_inheritance 'c:\temp' directory <username> FrN )rL r� rM rL z=Error obtaining the Security Descriptor or DACL of the path: r� rM Nr r rO rf Tr� ) rX r r* rG r r_ r` ra rS rg rh ri r� ) rE r rU rV rl rm r� �daclsrW rp r� r r r �check_inheritanceA s4 � ��� �r� c C s| dddd�}t � }|�|�} |�| | �} |r|�� nd}|r"|�� nd}|r*|�� nd}|r4|�| |�nd} |r=|�|�nd} |rG|�| |�nd} t|�} | d sS| S t| | �}d|d< |r�t d|� � �D ]P}|� |�}|d | d kr�| r~|d d | kr�| r�|d d | @ | kr�| s�d|d < | S |r�|d | kr�d|d < | S qe|d | @ | kr�d|d < | S qe|S d |d < |S )a� Checks a path to verify the ACE (access control entry) specified exists Args: path (str): Path to the file/reg key objectType (str): The type of object (FILE, DIRECTORY, REGISTRY) user (str): User that the ACL is for permission (:obj:`str`, optional): Permission to test for (READ, FULLCONTROL, etc). Default is ``None``. acetype (:obj:`str`, optional): The type of ACE (ALLOW or DENY). Default is ``None``. propagation (:obj:`str`, optional): The propagation type of the ACE (FILES, FOLDERS, KEY, KEY&SUBKEYS, SUBKEYS, etc). Default is ``None``. exactPermissionMatch (:obj:`bool`, optional): The ACL must match exactly, ie: if ``READ`` is specified, the user must have ``READ`` exactly and not ``FULLCONTROL`` (which also has the ``READ`` permission obviously) Returns (dict): 'Exists' true if the ACE exists, false if it does not CLI Example: .. code-block:: bash salt 'minion-id' win_dacl.check_ace 'c:\temp' directory <username> fullcontrol FrN )rL r~ rM NrL Tr rf rO r r~ zNo DACL found for object.rM ) r r* rG r$ r0 r7 r> rX rc rg rh ri )rE r rU rw rx ry ZexactPermissionMatchrV rm rn rz r{ r| rl r� rp r� r r r r� w sP . �� � ���r� )N)NNN)TTF)F)T)NNNF) rK �loggingrD rP Zsalt.utils.platformrY Zsalt.exceptionsr r r r r\ � ImportError� getLoggerrH �logr] r rX r^ rc rr r} r� rk r� r� r� r� r� r r r r �<module> sF � *+ ' dj $ ` :�
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings