File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/win_lgpo_reg.cpython-310.pyc
Back
o ;j| � @ s� d Z ddlZddlZddlZddlZddlZddlZddlm Z e� e �Z dZ dZdddd d d d d dd� Zdd� Zdd� Zd)dd�Zd)dd�Zd)dd�Zd)dd �Zd d � Z d*d d!�Z " d+d#d$�Z d,d%d&�Zd'd(� ZdS )-a� LGPO - Registry.pol =================== .. versionadded:: 3006.0 A module for working with registry based policies in Windows Local Group Policy (LGPO). This module contains functions for working with the ``Registry.pol`` file. The ``Registry.pol`` file is the source of truth for registry settings and LGPO. Group Policy is refreshed every 90 seconds by default. During that refresh the contents of the ``Registry.pol`` file are applied to the Registry. If the setting is changed outside of Group Policy to something other than what is contained in the ``Registry.pol`` file, it will be changed back during the next refresh. In the Group Policy Editor (``gpedit.msc``) these policies can be set to three states: - Not Configured - Enabled - Disabled A policy that is "Not Configured" does not have an entry in the ``Registry.pol`` file. A Group Policy refresh will not make any changes to key/value pairs in the registry that are not specified in the ``Registry.pol`` file. An "Enabled" policy will have an entry in the ``Registry.pol`` files that contains its key path, value name, value type, value size, and value data. When Group Policy is refreshed, existing values will be overwritten with those contained in the ``Registry.pol`` file. A "Disabled" policy will have an entry in the ``Registry.pol`` file with the key path and the value name, but the value name will be prepended with ``**del.``. When Group Policy is refreshed the key/value will be deleted from the registry. If the key contains no values, it will also be deleted. Working with LGPO Reg --------------------- The easiest way to figure out the values needed for this module is to set the policy using the Group Policy Editor (``gpedit.msc``) and then run the ``lgpo_reg.read_reg_pol`` function. This function will display a dictionary of all registry-based policies in the ``Registry.pol`` file. From its return you can get the ``key``, ``v_name``, ``v_type``, and ``v_data`` required to "enable" that policy. Use those values to set/disable/delete policies using this module. The same values can also be used to create states for setting these policies. .. note:: Not all policies in the Group Policy Editor (``gpedit.msc``) that write to the registry make that change in the ``Registry.pol`` file. Those policies could still be enforced via the ``Registry.pol`` file... theoretically. But you will have to find the values needed to set them with this module using a different method. � N)�SaltInvocationErrorZlgpo_regz&{00000000-0000-0000-0000-000000000000}ZREG_NONE�REG_SZ� REG_EXPAND_SZ� REG_BINARY� REG_DWORDZREG_DWORD_BIG_ENDIANZREG_LINK� REG_MULTI_SZ� REG_QWORD) r � � � � � � � � c C s t jj�� sdS tS )z Only works on Windows )Fz*LGPO_REG Module: Only available on Windows)�salt�utils�platformZ is_windows�__virtualname__� r r �M/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/win_lgpo_reg.py� __virtual__U s r c C s� d}d}| D ]5}|� � |� � kr;|}| | D ]$}|� � �d�r0|� � |� � �dd�d kr/|}q|� � |� � kr:|}qq||fS )a Helper function to find the value in the registry.pol file. Sometimes the value is prepended by an action that needs to happen with that value, such as `**del.` to delete it from the registry. Returns: tuple: A tuple containing: found_key, found_name � �**del.�.r )�lower� startswith�split)�pol_data�key�v_name� found_key� found_name�p_keyZp_namer r r � _find_value_ s ��r$ �Machinec C s\ | � � dv r d} n | � � dv rd} ntd��tjjj| }tjjj|d d�}tjj�|�S )am Read the contents of the Registry.pol file. Display the contents as a human-readable dictionary. Args: policy_class (:obj:`str`, optional): The registry class to retrieve. Can be one of the following: - Computer - Machine - User Default is ``Machine``. Raises: SaltInvocationError: Invalid policy class Returns: dict: A dictionary representing the contents of the Registry.pol file CLI Example: .. code-block:: bash # Read the machine Registry.pol salt '*' lgpo_reg.read_reg_pol �Zcomputer�machiner% ��user�User�%An invalid policy class was specified� policy_path)Z reg_pol_path)r r r r � win_lgpo_reg� CLASS_INFOZread_reg_pol_fileZreg_pol_to_dict)� policy_classZpol_infoZ pol_file_datar r r � read_reg_polw s �r0 c C sh |� � dv r d}n |� � dv rd}ntd��tjjj| }tjj�| �}tjj�||d |d |d �S ) a Write data to the Registry.pol file. The data is a dictionary that is then converted to the appropriate bytes format expected by Registry.pol Args: data (dict): A dictionary containing Registry.pol data policy_class (:obj:`str`, optional): The registry class to write to. Can be one of the following: - Computer - Machine - User Default is ``Machine``. Raises: SaltInvocationError: Invalid policy class CommandExecutionError: On failure Returns: bool: True if successful CLI Example: .. code-block:: bash # Write to Machine Registry.pol salt '*' lgpo_reg.write_reg_pol "{'SOFTWARE\MyKey': {'MyValue': 'data': 1, 'type': 'REG_DWORD'}}" r& r% r( r* r+ r, Zgpt_extension_locationZgpt_extension_guid)r r r r r- r. Zdict_to_reg_polZwrite_reg_pol_data)�datar/ Zpolicy_class_infoZpolicy_file_datar r r � write_reg_pol� s ! �r2 c C sv |� � dv r d}n |� � dv rd}ntd��t|d�}t|| |�\}}|r9|r9d|v r3||| | d< || | S i S ) a� Get the value of a single value pair as set in the ``Registry.pol`` file. Args: key (str): The registry key where the value name resides v_name (str): The value name to retrieve policy_class (:obj:`str`, optional): The registry class to read from. Can be one of the following: - Computer - Machine - User Default is ``Machine``. Raises: SaltInvocationError: Invalid policy class Returns: dict: A dictionary containing the value data and the value type found CLI Example: .. code-block:: bash # Get a value salt '*' lgpo_reg.get_value "SOFTWARE\MyKey" "MyValue" r& r% r( r* r+ �r/ r r1 )r r r0 r$ )r r r/ r r! r" r r r � get_value� s ! r4 c C sh |� � dv r d}n |� � dv rd}ntd��t|d�}d}|D ] }| � � |� � kr+|}q |r2|| S i S )a� Get all the values set in a key in the ``Registry.pol`` file. Args: key (str): The registry key where the values reside policy_class (:obj:`str`, optional): The registry class to read from. Can be one of the following: - Computer - Machine - User Default is ``Machine``. Raises: SaltInvocationError: Invalid policy class Returns: dict: A dictionary containing the value data and the value type CLI Example: .. code-block:: bash # Get all values from a key salt '*' lgpo_reg.get_key "SOFTWARE\MyKey" r& r% r( r* r+ r3 r )r r r0 )r r/ r r! r# r r r �get_key s �r5 c C sf zddl }W n ty t�d� i Y S w z�tjj�� �p |jdd�}| � dd�}|� d|� d |� d ��}|sCi W d � W S |d }|j }|}z|� d |� d ��} | r]| d j }W n t yg Y nw t|d d�} t�| d| � ��} | ||j| |||j|tkd�W d � W S 1 s�w Y W dS t y� } zt�d| � i W Y d} ~ S d} ~ ww )a[ Query the Resultant Set of Policy (RSoP) for a specific Machine registry key/value. Returns information about the winning Group Policy Object (GPO) for that value, including whether it is managed by a Domain GPO. .. note:: Only Machine (computer) policy is supported. User policy RSoP requires per-user SID scoping and a different WMI namespace, which is not practical when Salt runs as SYSTEM. Args: key (str): The registry key path v_name (str): The registry value name Returns: dict: A dictionary containing the RSoP information, or ``{}`` if the value is not found in RSoP, if the machine is not domain-joined, or if WMI is unavailable. Keys when a result is found: - key (str): The registry key path - name (str): The registry value name - data: The value data - type (str): The registry value type (e.g. ``REG_DWORD``) - gpo_id (str): The GUID of the winning GPO - gpo_name (str): The display name of the winning GPO - precedence (int): The policy precedence (1 = winning) - domain_managed (bool): ``True`` if managed by a Domain GPO CLI Example: .. code-block:: bash salt '*' lgpo_reg.get_rsop_value "SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" VulnerableChannelAllowList r Nz9LGPO_REG Mod: wmi module not available, cannot query RSoPzroot\rsop\computer)� namespace�\z\\z>SELECT * FROM RSOP_RegistryPolicySetting WHERE RegistryKey = 'z' AND ValueName = 'z' AND Precedence = 1z#SELECT * FROM RSOP_GPO WHERE ID = '�'Z ValueTypeZ REG_TYPE_)r �namer1 �type�gpo_id�gpo_nameZ precedence�domain_managedz&LGPO_REG Mod: Failed to query RSoP: %s)�wmi� ImportError�log�debugr r ZwinapiZComZWMI�replace�queryZGPOID�Name� Exception�getattr�_RSOP_VALUE_TYPES�getZValueZ Precedence�LOCAL_POLICY_GPO_ID) r r r> �connZwmi_key�resultsZsettingr; r< ZgposZvalue_type_intZvalue_type_str�excr r r �get_rsop_value; sd % � ���� � � ��(�' ��rM Fc C s� |� � dv r d}d}n|� � dv rd}d}ntd��|�� }g d�}||vr/d |� �} t| ��|d v rKt|t�r<t|�}t|t�sJ|� d �} t| ��n0|d kr^t|t�s]|� d �} t| ��n |dv r{zt|� W n ttfyz |� d�} t| ��w |dk} t j j j | d��n t |d�} t| | |�\} } | r�| r�d| v r�t�d| � | | �| �| | |< |} t�d| � ||d�| | | < n t�d| � ||d�| | |< nt�d| � |||d�i| | < d}t| |d�s�t�d� d}W d � n1 s�w Y |du �r t j j�� }|dk�r%|�r%t j jj|| |||d ��s%t�d � d}|�r7|�r7t j j �� �s7t�d � |�rZ|dk�rZt| |d �}|�d ��rZt�d!| ||�d"|�d#��� |S )$a Add a key/value pair to the registry.pol file. This bypasses the admx/adml style policies. This is the equivalent of setting a policy to ``Enabled`` Args: key (str): The registry key path v_name (str): The registry value name within the key v_data(str): The registry value v_type (:obj:`str`, optional): The registry value type. Must be one of the following: - REG_BINARY - REG_DWORD - REG_EXPAND_SZ - REG_MULTI_SZ - REG_QWORD - REG_SZ Default is REG_DWORD. policy_class (:obj:`str`, optional): The registry class to write to. Can be one of the following: - Computer - Machine - User Default is ``Machine``. write_registry (:obj:`bool`, optional): Controls whether the value is also written to the live registry immediately after updating ``Registry.pol``. - ``None`` (default): auto-detect. Skips the registry write on Domain Controllers where ``HKLM\\SOFTWARE\\Policies\\`` is write-protected; writes directly on all other machine types. - ``True``: always write to the registry (non-DC behaviour). - ``False``: always skip the registry write; the Group Policy engine will commit the value on the next refresh. refresh_policy (:obj:`bool`, optional): When ``True``, trigger a native in-process Group Policy refresh via ``userenv.dll`` after successfully writing ``Registry.pol``. .. note:: The refresh is **asynchronous**. This call signals the Group Policy service to begin processing; it returns before processing is complete. Registry values will reflect the updated policy only after the service finishes its refresh cycle. Use :func:`get_rsop_value` to verify applied state. Default is ``False``. Raises: SaltInvocationError: Invalid policy_class SaltInvocationError: Invalid v_type SaltInvocationError: v_data doesn't match v_type Returns: bool: ``True`` if successful, otherwise ``False``. CLI Example: .. code-block:: bash # Set REG_DWORD value (default) salt '*' lgpo_reg.set_value "SOFTWARE\MyKey" "MyValue" 1 # Set REG_SZ value salt '*' lgpo_reg.set_value "SOFTWARE\MyKey" "MyValue" "string value" "REG_SZ" r& r% �HKLMr( r* �HKCUr+ )r r r r r r zInvalid type: )r r z data must be a stringr z data must be a list)r r z data must be an integer�r' r3 r z%LGPO_REG Mod: Found disabled name: %sz LGPO_REG Mod: Updating value: %s�r1 r: z#LGPO_REG Mod: Setting new value: %sz*LGPO_REG Mod: Adding new key and value: %sT�/LGPO_REG Mod: Failed to write registry.pol fileFN)�hiver �vnameZvdataZvtypez*LGPO_REG Mod: Failed to set registry entry�@LGPO_REG Mod: Group Policy refresh did not complete successfully�r r r= �pLGPO_REG Mod: '%s\%s' is managed by Domain GPO '%s'. Changes may be overridden on the next Group Policy refresh.r< r; ) r r �upper� isinstance�int�str�list� TypeError� ValueErrorr r r- � _policy_lockr0 r$ r@ rA �popr2 �error� win_functions�is_domain_controller�win_reg� set_value�refresh_policy�warningrM rH )r r Zv_dataZv_typer/ �write_registryrf rS Z valid_types�msgr' r r! r" �success�rsopr r r re � s� T � � � � � � � �re r' c C s0 |� � dv r d}d}n|� � dv rd}d}ntd��|dk}tjjj|d��~ t|d �}t|| |�\}} d } |rx| rcd | v rEt� d |� nGt� d |� || � | � d | � �} ddd�|| | < d} n)t� d|� ddd�|| d |� �< d} nt� d| � d |� �ddd�i|| < d} d} | r�t ||d �s�t� d� d } W d � n1 s�w Y |du r�tjj �� }d} |dkr�|r�tjjj|| |d�} | s�| du r�t� d� nt� d� d } | s�| du r�dS | r�|r�tjj�� s�t�d� | �r|dk�rt| |d�} | �d��rt�d | || �d | �d ��� | S ) a Mark a registry value for deletion in the registry.pol file. This bypasses the admx/adml style policies. This is the equivalent of setting the policy to ``Disabled`` in the Group Policy editor (``gpedit.msc``) Args: key (str): The registry key path v_name (str): The registry value name within the key policy_class (:obj:`str`, optional): The registry class to write to. Can be one of the following: - Computer - Machine - User Default is ``Machine``. write_registry (:obj:`bool`, optional): Controls whether the registry value is also deleted immediately after updating ``Registry.pol``. - ``None`` (default): auto-detect. Skips the registry delete on Domain Controllers; deletes directly on all other machine types. - ``True``: always delete from the registry (non-DC behaviour). - ``False``: always skip the registry delete; the Group Policy engine will remove the value on the next refresh. refresh_policy (:obj:`bool`, optional): When ``True``, trigger a native in-process Group Policy refresh via ``userenv.dll`` after successfully writing ``Registry.pol``. .. note:: The refresh is **asynchronous**. This call signals the Group Policy service to begin processing; it returns before processing is complete. Registry values will reflect the updated policy only after the service finishes its refresh cycle. Use :func:`get_rsop_value` to verify applied state. Default is ``False``. Raises: SaltInvocationError: Invalid policy_class CommandExecutionError: On failure Returns: bool: ``True`` if successful, otherwise ``False`` None: If already disabled CLI Example: .. code-block:: bash # Delete a value salt '*' lgpo_reg.delete_value "SOFTWARE\MyKey" "MyValue" r& r% rN r( r* rO r+ rP r3 Fr z"LGPO_REG Mod: Already disabled: %sz&LGPO_REG Mod: Disabling value name: %s� r rQ Tz1LGPO_REG Mod: Setting new disabled value name: %sz8LGPO_REG Mod: Adding new key and disabled value name: %srR N�rS r rT �0LGPO_REG Mod: Registry key/value already missing�-LGPO_REG Mod: Failed to remove registry entryrU rV r= rW r< r; )r r r r r- r_ r0 r$ r@ rA r` r2 ra rb rc rd � delete_valuerf rg rM rH �r r r/ rh rf rS r' r r! r" Z pol_modifiedrj Zreg_retrk r r r � disable_valueP s� A �� � �% � �rr c C s� |� � dv r d}d}n|� � dv rd}d}ntd��|dk}tjjj|d��\ t|d �}t|| |�\}} d } |rd| r]t� d | � || � | � d } t || �d kr\t� d|� |� |� n t� d|� nt� d| � d } | r{t ||d �s{t� d� d } W d � n1 s�w Y |du r�tjj�� }d} |dkr�|r�tjjj|| |d�} | s�| du r�t� d� nt� d� d } | s�| du r�dS | r�|r�tjj�� s�t�d� | r�|dkr�t| |d�} | �d�r�t�d| || �d| �d��� | S ) a Delete a key/value pair from the Registry.pol file. This bypasses the admx/adml style policies. This is the equivalent of setting the policy to ``Not Configured``. Args: key (str): The registry key path v_name (str): The registry value name within the key policy_class (:obj:`str`, optional): The registry class to write to. Can be one of the following: - Computer - Machine - User Default is ``Machine``. write_registry (:obj:`bool`, optional): Controls whether the registry value is also deleted immediately after updating ``Registry.pol``. - ``None`` (default): auto-detect. Skips the registry delete on Domain Controllers; deletes directly on all other machine types. - ``True``: always delete from the registry (non-DC behaviour). - ``False``: always skip the registry delete; the Group Policy engine will remove the value on the next refresh. refresh_policy (:obj:`bool`, optional): When ``True``, trigger a native in-process Group Policy refresh via ``userenv.dll`` after successfully writing ``Registry.pol``. .. note:: The refresh is **asynchronous**. This call signals the Group Policy service to begin processing; it returns before processing is complete. Registry values will reflect the updated policy only after the service finishes its refresh cycle. Use :func:`get_rsop_value` to verify applied state. Default is ``False``. Raises: SaltInvocationError: Invalid policy_class CommandExecutionError: On failure Returns: bool: ``True`` if successful, otherwise ``False`` None: Key/value not present CLI Example: .. code-block:: bash # Delete all values under a key salt '*' lgpo_reg.delete_value "SOFTWARE\MyKey" "MyValue" r& r% rN r( r* rO r+ rP r3 Fz%LGPO_REG Mod: Removing value name: %sTr z$LGPO_REG Mod: Removing empty key: %sz&LGPO_REG Mod: Value name not found: %sz LGPO_REG Mod: Key not found: %srR Nrm rn ro rU rV r= rW r< r; )r r r r r- r_ r0 r$ r@ rA r` �lenr2 ra rb rc rd rp rf rg rM rH rq r r r rp � sr B � � � � �rp c C s t jj�� S )ay Trigger a native in-process Machine Group Policy refresh. Delegates to :func:`salt.utils.win_lgpo_reg.refresh_policy`. Use this after a batch of ``set_value`` / ``disable_value`` calls made with ``refresh_policy=False`` to commit all policy changes in a single pass. .. note:: This call is **asynchronous**. It signals the Group Policy service to begin processing the local ``Registry.pol`` file, but returns before that processing is complete. Registry values will reflect the updated policy only after the service finishes its refresh cycle. Use :func:`get_rsop_value` to verify the applied state after the refresh has had time to complete. Returns: bool: ``True`` if the refresh signal was accepted successfully CLI Example: .. code-block:: bash salt '*' lgpo_reg.refresh_policy )r r r- rf r r r r rf x s rf )r% )r r% NF)r' NF)r% NF)�__doc__�loggingZsalt.utils.platformr Zsalt.utils.win_functionsZsalt.utils.win_lgpo_regZsalt.utils.win_regZsalt.utils.winapiZsalt.exceptionsr � getLogger�__name__r@ r rI rG r r$ r0 r2 r4 r5 rM re rr rp rf r r r r �<module> sZ 9 � , 4 40\ � A � �
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings