File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/__pycache__/win_lgpo_auditpol.cpython-310.pyc
Back
o ;j0i � @ s� d Z ddlmZ ddlZddlZddlZddlZddlZddlZddl Z ddlm Z ddl m Z ddlZddlmZ e�e�ZdZi Zg d�Zdd d d d �ZdZd Zd Zd Z dZ d Z g d�Z G dd� dej �Z!G dd� dej �Z"G dd� dej �Z#G dd� dej �Z$G dd� dej �Z%dd� Z&da'd d � Z(d<d!d"�Z)d=d&d'�Z*ej+d(d)� �Z,d*d+� Z-g d,�Z.d-d.� Z/d/d0� Z0d>d2d3�Z1d4d5� Z2d6d7� Z3d8d9� Z4d:d;� Z5dS )?u� A salt util for modifying the audit policies on the machine. This util is used by the ``win_auditpol`` and ``win_lgpo`` modules. Though this utility does not set group policy for auditing, it displays how all auditing configuration is applied on the machine, either set directly or via local or domain group policy. .. versionadded:: 2018.3.4 .. versionadded:: 2019.2.1 Audit policy is read and written using the Windows ``advapi32`` APIs (``AuditQuerySystemPolicy`` / ``AuditSetSystemPolicy``) with a static subcategory GUID to English name map, so behavior is consistent regardless of the host OS display language. This util allows you to view and modify the audit settings as they are applied on the machine. The audit settings are broken down into nine categories: - Account Logon - Account Management - Detailed Tracking - DS Access - Logon/Logoff - Object Access - Policy Change - Privilege Use - System The ``get_settings`` function will return the subcategories for all nine of the above categories in one dictionary along with their auditing status. Subcategory names are **canonical English** strings (they match the names Salt and LGPO use, not the host OS localized ``auditpol`` display names). To modify a setting you only need to specify the subcategory name and the value you wish to set. Valid settings are: - No Auditing - Success - Failure - Success and Failure The module constant ``settings`` maps those English labels to the integer **auditing bitmask** passed to ``AuditSetSystemPolicy`` (``0``–``3``, aligned with LGPO ``audit.csv`` ``Setting Value``). Execution modules should keep using the string labels; callers should not rely on ``settings`` values being ``auditpol.exe`` switch strings. LGPO loads defaults via :func:`get_advaudit_policy_rows`; :func:`get_auditpol_dump` serializes the same data as UTF-8 CSV lines for backward compatibility. Usage: .. code-block:: python import salt.utils.win_lgpo_auditpol # Get current state of all audit settings salt.utils.win_lgpo_auditpol.get_settings() # Get the current state of all audit settings in the "Account Logon" # category salt.utils.win_lgpo_auditpol.get_settings(category="Account Logon") # Get current state of the "Credential Validation" setting salt.utils.win_lgpo_auditpol.get_setting(name='Credential Validation') # Set the state of the "Credential Validation" setting to Success and # Failure salt.utils.win_lgpo_auditpol.set_setting(name='Credential Validation', value='Success and Failure') # Set the state of the "Credential Validation" setting to No Auditing salt.utils.win_lgpo_auditpol.set_setting(name='Credential Validation', value='No Auditing') � )� annotationsN)�wintypes)�SimpleNamespace)�CommandExecutionErrorZauditpol) � Account Logon�Account Management�Detailed Tracking� DS Access� Logon/Logoff� Object Access� Policy Change� Privilege Use�System� � � )� No Auditing�Success�Failure�Success and Failure� � �z Machine Namez Policy TargetZ SubcategoryzSubcategory GUIDzInclusion SettingzExclusion Settingz Setting Valuec @ s8 e Zd ZdZdejfdejfdejfdejd fgZdS )�_GUIDzAWin32 ``GUID`` layout (``Data1``..``Data4``) for ``Audit*`` APIs.�Data1�Data2�Data3�Data4r N) �__name__� __module__� __qualname__�__doc__�w�DWORDZWORDZBYTE�_fields_� r% r% �P/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/win_lgpo_auditpol.pyr � s �r c @ s( e Zd ZdZdefdejfdefgZdS )�_AUDIT_POLICY_INFORMATIONzH``AUDIT_POLICY_INFORMATION`` from ntsecapi / advapi32 (per subcategory).�AuditSubcategoryGuid�AuditingInformation�AuditCategoryGuidN)r r r r! r r" �ULONGr$ r% r% r% r& r' � s �r' c @ s$ e Zd ZdZdejfdejfgZdS )�_LUIDz@Locally unique identifier (used with ``LookupPrivilegeValueW``).ZLowPartZHighPartN)r r r r! r" r# ZLONGr$ r% r% r% r& r, � s r, c @ s" e Zd ZdZdefdejfgZdS )�_LUID_AND_ATTRIBUTESz-One privilege entry for ``TOKEN_PRIVILEGES``.�Luid� AttributesN)r r r r! r, r" r# r$ r% r% r% r& r- � s r- c @ s& e Zd ZdZdejfded fgZdS )�_TOKEN_PRIVILEGESzH``TOKEN_PRIVILEGES`` with a single ``LUID_AND_ATTRIBUTES`` (fixed size).�PrivilegeCount� Privilegesr N)r r r r! r" r# r- r$ r% r% r% r& r0 � s r0 c C s> t jddd�} t jddd�}| j}t �t�tjt �t �t��g|_tj |_ | j }t �t�tjg|_tj |_ | j }tj g|_d|_ | j}tjtjt �tj�g|_tj |_ | j}tjtjt �t�g|_tj |_ | j}tjtj t �t�tjt jt jg|_tj |_ |j}g |_tj|_ |j} tjg| _tj | _ t|||||||| d�S )z� Bind advapi32/kernel32 entry points used for audit policy and token privileges. ``use_last_error=True`` so ``ctypes.get_last_error()`` matches Win32 failures after each call. Zadvapi32T)�use_last_errorZkernel32N)�AuditQuerySystemPolicy�AuditSetSystemPolicy� AuditFree�OpenProcessToken�LookupPrivilegeValueW�AdjustTokenPrivileges�GetCurrentProcess� CloseHandle)�ctypesZWinDLLr4 �POINTERr r" r+ r' �argtypesZBOOL�restyper5 r6 ZLPVOIDr7 �HANDLEr# r8 ZLPCWSTRr, r9 r0 �c_void_pr: r; r ) Z advapi32_dllZ kernel32_dllr4 r5 r6 r7 r8 r9 r: r; r% r% r& �_load_advapi32� sd �� �� �rB c C s t du rt� a t S )z� Lazy singleton of :func:`_load_advapi32` bindings (``_API`` cache). Attributes use **PascalCase** names matching the Win32 exports (e.g. ``AuditQuerySystemPolicy``) for parity with MSDN and headers. N)�_APIrB r% r% r% r& �_api� s rD �subcategory_uuid� uuid.UUID�returnc C sH | j }t� }t�d|dd� �\|_|_|_t�|j |dd� d� |S )z� Pack a Python :class:`uuid.UUID` into the Win32 ``GUID`` memory layout. ``UUID.bytes_le`` matches how ``GUID`` fields are ordered in RAM for the ``Data1``/``Data2``/``Data3``/``Data4`` split used by ``AuditQuerySystemPolicy``. z<IHHNr � ) Zbytes_ler �struct�unpackr r r r< �memmover )rE Z uuid_bytes_leZ guid_structr% r% r& � _uuid_to_guid s �rL � audit_mask�int�tuple[str, str]c C s8 t | t@ �}t | t@ �}|r|rdS |rdS |rdS dS )zNMap ``AuditingInformation`` bitmask to (Inclusion Setting, Setting Value str).)r �3)r �1)r �2)r �0)�bool�_AUDIT_SUCCESS�_AUDIT_FAILURE)rM Z success_onZ failure_onr% r% r& �_mask_to_labels s rW c c s� � t � } t�� }| �| �� ttB t�|��s t ddt� � id��zNt � }| � ddt�|��s8t ddt� � id��t � }d|_||jd _t|jd _| �|d t�|�t�|�dd�sdt d dt� � id��dV W | �|� dS | �|� w ) z� Enable ``SeSecurityPrivilege`` on this process for the duration of the ``with`` block (required for ``AuditSetSystemPolicy``). zOpenProcessToken failed�errno��infoNZSeSecurityPrivilegez1LookupPrivilegeValueW(SeSecurityPrivilege) failedr r Fz AdjustTokenPrivileges failed)rD r" r@ r7 r: �_TOKEN_ADJUST_PRIVILEGES� _TOKEN_QUERYr< �byrefr �get_last_errorr, r8 r0 r1 r2 r. �_SE_PRIVILEGE_ENABLEDr/ r9 �sizeofr; )�win32Zprocess_token_handleZsecurity_privilege_luidZtoken_privilegesr% r% r& � _enable_se_security_privilege' sL �� � � � � �rb c s t � t� �} t| }|� }g �t� �D ]\}\}}}t�|�}��|� t|�||< qt� t �� }t � } | � || t� |��sJt�� } tdd| id��|sX� �fdd�t| �D �S z+g } t| �D ] }|| } | �� | d � | d �| t| j�f� q_| W | �|� S | �|� w )uS Call ``AuditQuerySystemPolicy`` for every subcategory in :data:`_AUDIT_SUBCATEGORY_METADATA`. Returns: list: One tuple per row: ``(category_name, subcategory_name, subcategory_uuid, audit_mask)`` — ``audit_mask`` is the raw ``AuditingInformation`` ULONG (success/failure bits per MSDN). z AuditQuerySystemPolicy failedrX rY c s, g | ]}� | d � | d �| d f�qS )r r r% )�.0�i�Z metadata_rowsZsubcategory_uuids_orderedr% r& � <listcomp>{ s � ��z*_query_system_policies.<locals>.<listcomp>r r )�_AUDIT_SUBCATEGORY_METADATA�lenr � enumerate�uuid�UUID�appendrL r< r= r' rD r4 r] r^ r �rangerN r) r6 ) Zsubcategory_countZguid_array_typeZsubcategory_guid_array�indexZ _categoryZ _subcategory� guid_stringZ parsed_uuidZallocated_policy_array_ptrra �err�resultsZpolicy_info_structr% re r& �_query_system_policiesU sL �� � ��rr );)r zSecurity State Changez&{0CCE9210-69AE-11D9-BED3-505054503030})r zSecurity System Extensionz&{0CCE9211-69AE-11D9-BED3-505054503030})r zSystem Integrityz&{0CCE9212-69AE-11D9-BED3-505054503030})r z IPsec Driverz&{0CCE9213-69AE-11D9-BED3-505054503030})r zOther System Eventsz&{0CCE9214-69AE-11D9-BED3-505054503030})r ZLogonz&{0CCE9215-69AE-11D9-BED3-505054503030})r ZLogoffz&{0CCE9216-69AE-11D9-BED3-505054503030})r zAccount Lockoutz&{0CCE9217-69AE-11D9-BED3-505054503030})r zIPsec Main Modez&{0CCE9218-69AE-11D9-BED3-505054503030})r zIPsec Quick Modez&{0CCE9219-69AE-11D9-BED3-505054503030})r zIPsec Extended Modez&{0CCE921A-69AE-11D9-BED3-505054503030})r z Special Logonz&{0CCE921B-69AE-11D9-BED3-505054503030})r zOther Logon/Logoff Eventsz&{0CCE921C-69AE-11D9-BED3-505054503030})r zNetwork Policy Serverz&{0CCE9243-69AE-11D9-BED3-505054503030})r zUser / Device Claimsz&{0CCE9247-69AE-11D9-BED3-505054503030})r zGroup Membershipz&{0CCE9249-69AE-11D9-BED3-505054503030})r z File Systemz&{0CCE921D-69AE-11D9-BED3-505054503030})r ZRegistryz&{0CCE921E-69AE-11D9-BED3-505054503030})r z Kernel Objectz&{0CCE921F-69AE-11D9-BED3-505054503030})r ZSAMz&{0CCE9220-69AE-11D9-BED3-505054503030})r zCertification Servicesz&{0CCE9221-69AE-11D9-BED3-505054503030})r zApplication Generatedz&{0CCE9222-69AE-11D9-BED3-505054503030})r zHandle Manipulationz&{0CCE9223-69AE-11D9-BED3-505054503030})r z File Sharez&{0CCE9224-69AE-11D9-BED3-505054503030})r z Filtering Platform Packet Dropz&{0CCE9225-69AE-11D9-BED3-505054503030})r z Filtering Platform Connectionz&{0CCE9226-69AE-11D9-BED3-505054503030})r zOther Object Access Eventsz&{0CCE9227-69AE-11D9-BED3-505054503030})r zDetailed File Sharez&{0CCE9244-69AE-11D9-BED3-505054503030})r zRemovable Storagez&{0CCE9245-69AE-11D9-BED3-505054503030})r zCentral Policy Stagingz&{0CCE9246-69AE-11D9-BED3-505054503030})r zSensitive Privilege Usez&{0CCE9228-69AE-11D9-BED3-505054503030})r zNon Sensitive Privilege Usez&{0CCE9229-69AE-11D9-BED3-505054503030})r zOther Privilege Use Eventsz&{0CCE922A-69AE-11D9-BED3-505054503030})r zProcess Creationz&{0CCE922B-69AE-11D9-BED3-505054503030})r zProcess Terminationz&{0CCE922C-69AE-11D9-BED3-505054503030})r zDPAPI Activityz&{0CCE922D-69AE-11D9-BED3-505054503030})r z RPC Eventsz&{0CCE922E-69AE-11D9-BED3-505054503030})r zPlug and Play Eventsz&{0CCE9248-69AE-11D9-BED3-505054503030})r zToken Right Adjusted Eventsz&{0CCE924A-69AE-11D9-BED3-505054503030})r zAudit Policy Changez&{0CCE922F-69AE-11D9-BED3-505054503030})r z Authentication Policy Changez&{0CCE9230-69AE-11D9-BED3-505054503030})r zAuthorization Policy Changez&{0CCE9231-69AE-11D9-BED3-505054503030})r z MPSSVC Rule-Level Policy Changez&{0CCE9232-69AE-11D9-BED3-505054503030})r z Filtering Platform Policy Changez&{0CCE9233-69AE-11D9-BED3-505054503030})r zOther Policy Change Eventsz&{0CCE9234-69AE-11D9-BED3-505054503030})r zUser Account Managementz&{0CCE9235-69AE-11D9-BED3-505054503030})r zComputer Account Managementz&{0CCE9236-69AE-11D9-BED3-505054503030})r zSecurity Group Managementz&{0CCE9237-69AE-11D9-BED3-505054503030})r z Distribution Group Managementz&{0CCE9238-69AE-11D9-BED3-505054503030})r z Application Group Managementz&{0CCE9239-69AE-11D9-BED3-505054503030})r z Other Account Management Eventsz&{0CCE923A-69AE-11D9-BED3-505054503030})r zDirectory Service Accessz&{0CCE923B-69AE-11D9-BED3-505054503030})r zDirectory Service Changesz&{0CCE923C-69AE-11D9-BED3-505054503030})r z Directory Service Replicationz&{0CCE923D-69AE-11D9-BED3-505054503030})r z&Detailed Directory Service Replicationz&{0CCE923E-69AE-11D9-BED3-505054503030})r zCredential Validationz&{0CCE923F-69AE-11D9-BED3-505054503030})r z"Kerberos Service Ticket Operationsz&{0CCE9240-69AE-11D9-BED3-505054503030})r zOther Account Logon Eventsz&{0CCE9241-69AE-11D9-BED3-505054503030})r z Kerberos Authentication Servicez&{0CCE9242-69AE-11D9-BED3-505054503030}c C s t jj�� sdS tS )z* Only load if on a Windows system )Fz&This utility only available on Windows)�salt�utils�platformZ is_windows�__virtualname__r% r% r% r& � __virtual__S s rw c C s^ g } t tt� �D ]$\\}}}}|\}}}}t|�\}}|�� } | �dd|| |d|d�� q| S )ub Return one row per advanced audit subcategory for LGPO and related code. Rows are built from ``AuditQuerySystemPolicy`` and the in-module GUID/name table, so they do not depend on ``auditpol.exe`` or the host display language. Returns: list: A list of dictionaries, each with keys ``Machine Name``, ``Policy Target``, ``Subcategory``, ``Subcategory GUID``, ``Inclusion Setting``, ``Exclusion Setting``, and ``Setting Value``. ``Machine Name`` is always ``""``; ``Policy Target`` is ``System``; ``Subcategory`` is the English name used with :func:`set_setting`; ``Subcategory GUID`` is braced uppercase; ``Setting Value`` is ``"0"``–``"3"`` matching LGPO's ``audit.csv`` convention. Raises: CommandExecutionError: If the Windows API call fails. � r r )�ziprg rr rW �upperrl ) Zrows_outZ_metadata_categoryZ subcategoryro � query_row�_rM Z inclusionZ setting_valZ guid_bracedr% r% r& �get_advaudit_policy_rows] s$ � �� r} �Allc C s� | � � dv r d}n d}tD ]}|� � | � � kr|} nq |du r(td| � d���i }ttt� �D ] \\}}}}|\}}}} |durF||krFq0t| �\} } | ||< q0|S )a� Get the current configuration for all audit settings in the given category. Reads effective policy via ``AuditQuerySystemPolicy`` (not ``auditpol /get``), so results use English subcategory keys and English value labels regardless of OS language. Args: category (str): One of the nine categories, or ``All`` / ``*`` for every subcategory. Names are matched case-insensitively against :data:`categories`. Returns: dict: Maps each **English** subcategory name to one of ``No Auditing``, ``Success``, ``Failure``, or ``Success and Failure``. Raises: KeyError: If ``category`` is not recognized. CommandExecutionError: If the Windows API call fails. )�all�*NzInvalid category: "�")�lower� categories�KeyErrorry rg rr rW ) �categoryZwant�c�retZ category_nameZsubcategory_nameZ_subcategory_uuidr{ r| rM ZlabelZ_setting_value_strr% r% r& � get_settings� s( �� r� c C s> t dd�}|D ]}| �� |�� kr|| S qtd| � ���)a� Get the current configuration for a single subcategory. Args: name (str): English subcategory name (matched case-insensitively). Returns: str: One of ``No Auditing``, ``Success``, ``Failure``, or ``Success and Failure``. Raises: KeyError: If ``name`` is not a known subcategory. CommandExecutionError: If querying the current policy fails. r~ �r� �Invalid name: )r� r� r� )�nameZcurrent_settings�settingr% r% r& � get_setting� s �r� c C s, dt vrtdd�} dd� | D �t d< t d S )z� Return lowercase English subcategory names valid for :func:`set_setting`. Cached on ``__context__['auditpol.valid_names']`` until cleared after a successful :func:`set_setting`. �auditpol.valid_namesr~ r� c S s g | ]}|� � �qS r% )r� )rc �kr% r% r& rf � s z$_get_valid_names.<locals>.<listcomp>)� __context__r� )Z settings_mapr% r% r& �_get_valid_names� s r� c C s< | � � t� vrtd| � ���d}tD ]}|� � |� � kr$tt| �} nq|du r0td|� ���d}d}tD ]\}}}| � � |� � krL|}t�|�} nq6|du rXtd| � ���t� } t |�| _ || _ t � | _ t� } t� �! d} | �t�| �| �s�t�� } td| ||d�d��W d � n1 s�w Y t�dd� d S ) a� Set the auditing bitmask for one subcategory. Enables ``SeSecurityPrivilege`` on the current process token for the duration of the ``AuditSetSystemPolicy`` call. Args: name (str): English subcategory name (same strings as returned by :func:`get_settings`). value (str): One of ``No Auditing``, ``Success``, ``Failure``, or ``Success and Failure`` (matched case-insensitively). Returns: bool: ``True`` on success. Raises: KeyError: On invalid ``name`` or ``value``. CommandExecutionError: If privilege adjustment or ``AuditSetSystemPolicy`` fails. r� NzInvalid setting value: r zAuditSetSystemPolicy failed)rX r� �valuerY r� T)r� r� r� �settingsrN rg rj rk r' rL r( r) r r* rD rb r5 r< r] r^ r r� �pop) r� r� Z audit_bitmaskr� Zresolved_subcategory_nameZresolved_subcategory_uuidZ _meta_catZmeta_subcategoryro Zaudit_policy_infora Z policy_countrp r% r% r& � set_setting� sT � � ���� � r� c C sL t jdd�} tj| tdd�}|�� t� D ]}|�|� q| �d� | � � S )a% Return advanced audit policy rows as CSV **text lines** (UTF-8). This does not run ``auditpol /backup`` or read a temp file. It formats the same data as :func:`get_advaudit_policy_rows` using :mod:`csv`, so each line is a normal Unicode string (newlines ``\n``). Returns: list: Lines including a header row, suitable for passing to :class:`csv.DictReader` if needed. Raises: CommandExecutionError: If building rows fails (e.g. API error from :func:`get_advaudit_policy_rows`). rx )�newline� )Z fieldnamesZlineterminatorr ) �io�StringIO�csvZ DictWriter� _FIELDNAMESZ writeheaderr} Zwriterow�seek� readlines)�buf�writer�rowr% r% r& �get_auditpol_dump s r� )rE rF rG r )rM rN rG rO )r~ )6r! � __future__r � contextlibr� r< r� �loggingrI rj r r" �typesr Zsalt.utils.platformrs Zsalt.exceptionsr � getLoggerr �logrv r� r� r� Z _AUDIT_NONErU rV r\ r[ r_ r� � Structurer r' r, r- r0 rB rC rD rL rW �contextmanagerrb rr rg rw r} r� r� r� r� r� r% r% r% r& �<module> sf N � J -C < )- D
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings