File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/__pycache__/win_lgpo_reg.cpython-310.pyc
Back
o ;j�f � @ st d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z ddl Z ddl Z ddl Z ddlZ ddlmZ zddlZdZW n eyM dZY nw ej�e�dd�d d d d �d dddd�ej�e�dd�d d dd �ddddd�d�ZdZej�e�dd�d d d�Ze�e�Z dZ dd � Z d d � Z d d � Z d!d"� Z!d#d$� Z"e d/d%d&��Z#ed'd(fd)d*�Z$d+d,� Z%d-d.� Z&dS )0z� A Salt Util for working with the Registry.pol file. The Registry.pol file is the source of truth for registry settings that are configured via LGPO. � N)�contextmanager)�CommandExecutionErrorTFZWINDIRz C:\WindowsZSystem32Z GroupPolicy�Userz Registry.polZ HKEY_USERSzUser Configuration�gPCUserExtensionNameszN[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F73-3407-48AE-BA88-E8213C6761F1}])Z policy_pathZhiveZ lgpo_sectionZgpt_extension_location�gpt_extension_guid�Machine�HKEY_LOCAL_MACHINEzComputer Configuration�gPCMachineExtensionNameszN[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F72-3407-48AE-BA88-E8213C6761F1}])r r u 剐来 zgpt.iniZlgpo_regc C s t jj�� sdS ts dS tS )z8 Only works on Windows with the lgpo_reg module )Fz(LGPO_REG Util: Only available on Windows)Fz$LGPO_REG Util: Missing win32 modules)�salt�utils�platformZ is_windows�HAS_WINDOWS_MODULES�__virtualname__� r r �K/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/win_lgpo_reg.py� __virtual__C s r c C s: |r| rt �d| � t�| |tj�}|rt �d� dS dS )a{ Helper function to do a regex search of a string value in policy_data. This is used to search the policy data from a registry.pol file or from gpt.ini Args: search_string (str): The string to search for policy_data (str): The data to be searched Returns: bool: ``True`` if the regex search_string is found, otherwise ``False`` z LGPO_REG Util: Searching for %szLGPO_REG Util: FoundTF)�log�debug�re�search� IGNORECASE)� search_string� policy_data�matchr r r �search_reg_polO s r c C s� z't �d�} t j| j_t jg| j_| �d�}|r t�d� nt�d� t |�W S t y@ } z t� d|� W Y d}~dS d}~ww )u_ Trigger a native in-process Machine Group Policy refresh via userenv.dll. Calls ``RefreshPolicy(bMachine=True)`` exported by ``userenv.dll`` via ``ctypes``. This signals the native OS Group Policy service to process the local ``.pol`` file and commit registry keys without requiring a direct write to the protected policy hive. .. note:: This call is **asynchronous** — it signals the GP service to begin processing the local ``Registry.pol`` file and returns before that processing is complete. Registry values will reflect the updated policy only after the service finishes its refresh cycle. To verify the applied state after the refresh, use :func:`salt.modules.win_lgpo_reg.get_rsop_value`. Returns: bool: ``True`` if the refresh signal was accepted successfully � userenv.dllTz:LGPO_REG Util: Group Policy refresh triggered successfullyz2LGPO_REG Util: Group Policy refresh returned Falsez9LGPO_REG Util: Failed to trigger Group Policy refresh: %sNF) �ctypes�WinDLL�c_boolZ RefreshPolicy�restype�argtypesr r �warning�bool� Exception�error)�userenv�result�excr r r �refresh_policyg s ��r( c C sZ d}t j�| �r+t�d| � tjj�| d�� }|� � }W d � |S 1 s&w Y |S )z� Helper function to read the content of the Registry.pol file Args: reg_pol_path (str): The path to the Registry.pol file Returns: bytes: The data as contained in the Registry.pol file Nz LGPO_REG Util: Reading from %s�rb) �os�path�existsr r r r �files�fopen�read)Z reg_pol_pathZ return_dataZpol_filer r r �read_reg_pol_file� s ��r0 c C s� t d|d �D ]P}z$tjj�| |��}|�|� W d � W dS 1 s%w Y W dS tyW } z |jdks>||kr?� t� d| |||� t � |� W Y d}~qd}~ww dS )z� Write data to a file, retrying on Windows sharing violations (winerror 32). Fails immediately on any other error (e.g. winerror 5, true access denied). � N� zFLGPO_REG Util: %s is locked (attempt %d/%d). Retrying in %d seconds...) �ranger r r- r. �write�PermissionError�winerrorr r! �time�sleep)r+ �data�mode� retry_count� retry_delay�attempt�f�er r r �_write_with_retry� s, ������r@ c c sv � t �d�}t jj|j_t jg|j_t j|j_t jjg|j_|�| �}|s)t d��z dV W |�|� dS |�|� w )uc Context manager that holds the Windows GP critical section for the duration of a read-modify-write cycle on Registry.pol. EnterCriticalPolicySection / LeaveCriticalPolicySection are the same primitives gpsvc uses internally, so holding this lock prevents the GP service from opening the policy file concurrently. EnterCriticalPolicySection is a blocking call — it does not return until the critical section is acquired. If gpsvc currently holds it (e.g. during a background GP refresh), this call blocks until gpsvc releases it, at which point gpsvc will also have released any file lock on Registry.pol. No retry loop is needed here; the blocking behavior is the wait mechanism. The only residual risk after acquiring the critical section is a non-GP locker (AV scanner, VSS) that does not participate in this handshake; the _write_with_retry layer handles those. If the lock cannot be acquired (returns NULL), a CommandExecutionError is raised. NULL from this API always indicates a genuine system error (handle exhaustion, access denied creating the kernel object, etc.) — not a "GP service is busy" condition. The blocking behavior handles the busy case. Proceeding silently without the lock would risk an uncoordinated read-modify-write followed by a confusing downstream write error. r z4LGPO_REG Util: Failed to acquire GP critical sectionN) r r ZwintypesZHANDLEZEnterCriticalPolicySectionr r r ZLeaveCriticalPolicySectionr )�machiner% �handler r r � _policy_lock� s � �rC � � c C s t j�|�st�d� tjj�|� | du rd} z$t � d�}| � |�s-t�d|� || } t�d|� t || d||� W n t yY } zd|� d |� �} t�| � t| ��d}~ww d } t j�|�r�tjj�|d �� } | �� } W d � n1 syw Y | �d d ��dd ��d d �} td| �s�t�d� d| } tt�|�� d�| �r�t�dt�|�� d�| tjtjB �} | | �� | � � � } tt�|�� | d�s�t�d� | � d�} || d | d< d� | �} | d| �� � | | | � � d� } n!t�d| tjtjB �}d� | |�� |� � � ||| |� � d� �} td| ��r�t�d | tjtjB �}| |�� |� � � }|� d�}t �!d t �"d t#|d ���}|�$� d �$� k�rX|d |d d f}n|�$� d �$� k�rk|d d |d f}t �!d t j"d g|�R � �d }d� | d|�� � d!|| |� � d� �} nTt�d"| tjtjB �}|�$� d �$� k�r�d#}n|�$� d �$� k�r�d$}nd%} t| ��d� | |�� |� � � d!t#d&� t%|d ��&d'�t%|d ��&d'��d(�| |� � d� �} | �rz t || d)||� W d+S t �y } zd*� ||�} t�| � t| ��d}~ww d+S ),a� Helper function to actually write the data to a Registry.pol file Also updates/edits the gpt.ini file to include the ADM policy extensions to let the computer know user and/or machine registry policy files need to be processed Args: data_to_write (bytes): Data to write into the user/machine registry.pol file policy_file_path (str): Path to the registry.pol file gpt_extension (str): GPT extension list name from _policy_info class for this registry class gpt_extension_location gpt_extension_guid (str): ADMX registry extension guid for the class gpt_ini_path (str): The path to the gpt.ini file retry_count (int): Number of attempts to make when a write fails due to a sharing violation (``winerror 32``). Sharing violations occur when a process such as an antivirus scanner or VSS holds the file open with an incompatible sharing mode. The GP critical section (see :func:`_policy_lock`) prevents races with ``gpsvc`` itself, so retries are primarily a fallback for those other lockers. Default is ``10``. retry_delay (int): Seconds to wait between retry attempts when a sharing violation is encountered. Default is ``5``. Returns: bool: True if successful Raises: CommandExecutionError: On failure z;LGPO_REG Util: Creating parent directories for Registry.polN� � utf-16-lez#LGPO_REG Util: Writing header to %sz LGPO_REG Util: Writing to %s�wbz<An error occurred attempting to write to registry.pol PATH: z EXCEPTION: � �rz z_|-� z\[General\]\r\nz2LGPO_REG Util: Adding [General] section to gpt.iniz [General] �=�^z=.*\r\n)r r z+LGPO_REG Util: Inserting gpt extension GUIDr1 r z^\[General\]\r\nz {}{}={} {}zVersion=z^Version=.*\r\ns >2Hs >Ir r �Versionz^\[General]\r\n)r r1 )r1 r z0LGPO_REG Util: Could not determine gpt extensionz{}{}� � �wzNAn error occurred attempting to write the gpt.ini file. path: {} exception: {}T)'r* r+ r, r r r �modulesZwin_fileZ makedirs_�REG_POL_HEADER�encode� startswithr@ r# � exceptionr r r- r. r/ �replacer r �escaper r � MULTILINE�start�end�split�join�format�struct�unpack�pack�int�lower�str�zfill)Z data_to_writeZpolicy_file_pathZ gpt_extensionr Z gpt_ini_pathr; r< �reg_pol_headerr? �msgZ gpt_ini_dataZgpt_fileZ gpt_ext_locZ gpt_ext_strZgeneral_locationZ version_locZ version_strZ version_numsZ version_numr r r �write_reg_pol_data� s� / ���� �� � � � � ������ � ����� �� ��rh c C s> t �d�}| du r |} | �|�sd}t|��| �|�}|s$t�d� i S dd� }t�d� i }|�d�D ]�}|�d d ��d d �}|�d d �\}}} } } ||�� d�}||�� d�}t � d| �d } | dkrfn�| t j t jfv rv|| �� d�} n�| t jkr�| �� } nv| t jkr�t � d| �d } nh| t jkr�t � d| �d } nZ| t jkr�t�d� nO| t jkr�|| �} | s�d} nA| � d��d�} n8| t jkr�t�d� n-| t jkr�t�d� n"| t jkr�t�d� n| t jkr�t � d| �d } n d| � �}t|��tjj � � } | j � | d�} |� |i � |�sd|| d< q4| | d�|| |< q4|S ) a@ Convert the data obtained from a Registry.pol file to a dictionary. Args: policy_data (bytes): The data as retrieved from the Registry.pol file Raises: SaltInvocationError: Invalid or corrupt policy data Returns: dict: A dictionary representation of the Registry.pol data rG Nz:LGPO_REG Util: Invalid Header. Registry.pol may be corruptz-LGPO_REG Util: No registry.pol data to returnc S s0 | dd � dkr| d d� } | dd � dks| S )N���s r )�valuer r r �strip_field_end� s �z(reg_pol_to_dict.<locals>.strip_field_endz%LGPO_REG Util: Unpacking reg pol datas ] [ s ] rF s [ s ; rO �<ir �>i�%LGPO_REG Util: REG_LINK not supported� �/LGPO_REG Util: REGO_RESOURCE_LIST not supported�9LGPO_REG Util: REG_FULL_RESOURCE_DESCRIPTOR not supported�;LGPO_REG Util: REG_RESOURCE_REQUIREMENTS_LIST not supported�<qz,LGPO_REG Util: Found unknown registry type: �REG_NONE� CREATEKEY�*)�typer9 )!rS rT rU r �lstripr r r\ rW �decoder_ r` �win32con�REG_SZ� REG_EXPAND_SZ� REG_BINARY�hex� REG_DWORD�REG_DWORD_BIG_ENDIAN�REG_LINKr! � REG_MULTI_SZ�REG_RESOURCE_LIST� REG_FULL_RESOURCE_DESCRIPTOR� REG_RESOURCE_REQUIREMENTS_LIST� REG_QWORDr r �win_reg�RegistryZ vtype_reverse�get� setdefault) r rf rg Z pol_file_datark Zreg_pol�policy�key�v_name�v_type�v_size�v_data�regr r r �reg_pol_to_dict� sj r� c C s� t jj�� }d�d�}d�d�}d�d�}d�d�}g }| �� D �]B\}}|�� D �]8\} } | dkr<| dkr<d} d d i} z |j| d } W n tyW d �| d �} t | ��w |� �d�| | � �d�| t � d | �g} d }| t j krwd}n�| t jt jfv r�| d �d�| }n�| t jkr�t�| d �}n�| t jkr�t � d t| d ��}n�| t jkr�t � dt| d ��}nx| t jkr�t�d� nm| t jkr�| d d u r�|}n_t| d �dkr�|}nTt| d �dkr�| d d s�|}nCd�| d ��d�| | }n4| t j k�rt�d� n(| t j k�rt�d� n | t j k�r t�d� n| t j k�r.t � dt| d ��}t|�dk�r;d} t | ��|d u �rFd} t | ��t|�� dd �| }| �!|� | �!|� |�!|�| �� q)q t"�d�}|D ] } ||| | 7 }�qk|S ) z� Convert a dictionary to the byte format expected by the Registry.pol file Args: data (dict): A dictionary containing the contents to be converted Returns: bytes: The data to be written to the Registry.pol file �[rG �]�;ro rv ru rI rw rt z.LGPO_REG Util: Found unknown registry type: {}rl NrF r9 rm rn r r1 rp rq rr rs i�� z'LGPO_REG Util: Size exceeds 65535 bytesz*LGPO_REG Util: Unknown data transformation� �little)#r r r� r� rT �itemsZvtype�KeyErrorr^ r r_ ra rz rt r{ r| r} �bytes�fromhexr rb r� r� r r! r� �lenr] r� r� r� r� �to_bytes�appendrS )r9 r� Zpol_enter_delimZpol_exit_delimZpol_section_delimZpol_section_termZpoliciesr� rj r� �dr� rg r� r� r� Zpolicy_file_datar r r �dict_to_reg_pol s� � � ��� � � kr� )T)'�__doc__r Zctypes.wintypes�loggingr* r r_ r7 � contextlibr Zsalt.modules.win_filer Zsalt.utils.filesZsalt.utils.platformZsalt.utils.win_regZsalt.exceptionsr rz r � ImportErrorr+ r] �getenvZ CLASS_INFOrS Z GPT_INI_PATH� getLogger�__name__r r r r r( r0 r@ rC rh r� r� r r r r �<module> s� � �� ��� � $ 0 � , z
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings