File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/__pycache__/win_runas.cpython-310.pyc
Back
o ;j�R � @ s� d Z ddlZddlZddlZddlZddlZddlZddlmZ z,ddl Z ddl Z ddl Z ddl Z ddl Z ddlZddlZddlZddlZddlZdZW n eyW dZY nw e�e�Zddd�Zd d � Zd d � Zddd�Z ddd�Z ddd�Z dS )aV Run child processes as another Windows user. The main entry points are :func:`runas` (starts the child with ``CreateProcessWithTokenW`` when the minion can obtain a privileged context) and :func:`runas_unpriv` (uses ``CreateProcessWithLogonW`` as a fallback). Both are used from :mod:`salt.modules.cmdmod` when ``runas`` is set on Windows. � N)�CommandExecutionErrorTF�� c C s6 t | t�r| nt| �}t|�|kr|d|� d S |S )aI Shorten a command line for safe logging (full line is never executed from this helper). Args: cmd: Command string; non-strings are formatted with ``repr()``. max_len: Maximum length before truncation; an ellipsis is appended. Returns: Truncated string suitable for debug log lines. Nu …)� isinstance�str�repr�len)�cmdZmax_len�s� r �H/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/win_runas.py� _preview_cmd* s r c C s t sdS dS )z� Load this module only when PyWin32 (and related imports) succeeded. Returns: The string ``win_runas`` on success, or ``(False, reason)`` when required imports failed so the loader should skip the module. )Fz This utility requires pywin32Z win_runas)� HAS_WIN32r r r r � __virtual__> s r c C sZ d}t | �}d|v r|jddd�\}}|�d�}d|v r%|jddd�\}}t |�t |�fS )a� Parse domain-style account names into a plain user name and domain. Accepts UPN (``user@domain``), down-level (``DOMAIN\user``), or a bare name (domain becomes ``.`` for local accounts). Args: username: Account string; non-strings are coerced with ``str()`` at the start of this function. Returns: A ``(user_name, domain)`` pair suitable for ``LogonUser`` and family. �.�@� )�maxsplitz.local�\)r �split� removesuffix)�username�domainZ user_namer r r �split_usernameL s r r c C s� t �� }t�d||� t � � }d}d}d} |d7 }zt�| |�}W n tjy< } z t�d||� W Y d}~nd}~ww nt � � | |krRt�d|t � � | � nqt �� | }|duret�d|� |S t�d |� |durvt�d � |�dS ) a� Build a user environment block for ``CreateProcess*`` using ``CreateEnvironmentBlock``. Retries for up to ``timeout`` seconds if the call fails (e.g. logon/logoff races). Does not use ``LoadUserProfile`` / ``UnloadUserProfile``: that can block for a long time and is not required when the caller already holds a user token from ``LogonUser`` or similar. Args: user_token: Windows access token (handle) for the target user, as used by ``win32profile.CreateEnvironmentBlock`` / ``CreateProcess*``. inherit: Passed through to ``CreateEnvironmentBlock`` (whether to inherit the environment of the process associated with ``user_token``; typically ``False`` for an isolated child env). timeout: If ``CreateEnvironmentBlock`` raises, retry until this many seconds have elapsed since the first attempt, then give up. Returns: Environment data for the ``environment`` parameter to ``CreateProcess*``, or ``None`` if no block was produced and there was no exception to re-raise. On repeated failure, the last ``pywintypes.error`` may be raised. z2win_runas.create_env: begin inherit=%s timeout=%ssNr Tr zBwin_runas.create_env: CreateEnvironmentBlock attempt %s failed: %sz:win_runas.create_env: giving up after %s attempts in %.2fsz&win_runas.create_env: success in %.3fsz6win_runas.create_env: no environment block after %.3fszBwin_runas.create_env: re-raising last CreateEnvironmentBlock error)�time� monotonic�log�debug� win32profileZCreateEnvironmentBlock� pywintypes�error) � user_token�inherit�timeout�t0�start�env�exc�attempt�elapsedr r r � create_envf sH ��� �� �r) c ( C s t |t�s t|�}zt�d|�\}}}t|�\}}W n tjy4 } z t�|j �� d�}t |��d}~ww tj tj B }t�t�� |�} ddl} | jj�| � z| jjj| jjjddgd�} W n tys t�d� d} t�| � Y nw t | ttf�r�t � | �} t�d|||t | �� | s�t�d� t | |||�S |d kr�t� ||d t!j"t!j#�} n|r�t� |||t!j$t!j#�} n| jj�%|�j&} t�'| tj(�} | d kr�t�'| tj)�} | jj�| � | jj�*| � t�+� }d |_,t-�.|d�\}}| jj�/|�}t-�.|d�\}}| jj�/|�}t-�.|d�\}}| jj�/|�}t0j1t0j2B t0j3B }t!j4}|t!j5O }| jjj6||j7|j7|j7d �}t�d � t8| dd�}d}�z"t�d� t9�:� }| jjj;t<| �d d| ||||d�}t�dt9�:� | � |j=}|j>} |j?} |j@} t�d| | � | jjjA�|j7� | jjjA�|j7� | jjjA�|j7� d| i} | �r�t0�B| �} t�d| � | dv �r�t�d� t�| � g }!g }"dd� }#tCjD|#|j7|!dfd�}$tCjD|#|j7|"d fd�}%|$�E� |%�E� t�d | � t�d | � t9�:� }&tF�G|tFjH�t!jIk�rt�d t9�:� |& | � t0�J|�}'t�d | |'� |'| d!< nt�d"| � |$�K� |%�K� t�d#| � |!�r,|!d nd �L� | d< |"�r9|"d nd | d < W |du�rK| jjjA�|� t�| � t�| � | �rat�M� t�| � | S |du�rp| jjjA�|� t�| � t�| � | �r�t�M� t�| � w w )$a� Run ``cmd`` as ``username`` using a logon token and ``CreateProcessWithTokenW``. The minion must be able to impersonate ``SYSTEM`` (e.g. admin with ``SeImpersonatePrivilege``) for the primary path. If that fails, this delegates to :func:`runas_unpriv` (logon + ``CreateProcessWithLogonW``) so a password is required for non-service accounts in that case. The process is created suspended, the primary thread is resumed with ``ResumeThread``, and stdout/stderr are read on helper threads while waiting so large child output cannot fill the pipe and deadlock the parent. Args: cmd: Full process command line (string) or argv sequence; lists are passed through ``subprocess.list2cmdline`` to build ``lpCommandLine``. username: Target account; UPN, ``DOMAIN\user``, or local name. May be non-string (e.g. numeric local user name) and is coerced to ``str``. password: Password for ``LogonUser`` when required; may be omitted for some service accounts and when S4U logon is used. cwd: Optional working directory for the child (``lpCurrentDirectory``); ``None`` uses the default for the new process. Returns: Dict with keys: ``pid``, ``retcode`` (if wait succeeded), ``stdout``, ``stderr`` (empty strings on read failure). Raises: salt.exceptions.CommandExecutionError: If the account name cannot be resolved (e.g. ``LookupAccountName`` failure). N� r ZSeTcbPrivilege)Z session_idZprivsz!Unable to impersonate SYSTEM userz4win_runas.runas: user=%r domain=%r cwd=%r cmdline=%sz0No impersonation token, using unprivileged runasz NT AUTHORITY� r �ZdwFlagsZ hStdInputZ hStdOutputZ hStdErrorz:win_runas.runas: building environment block for user tokenF)r! z<win_runas.runas: calling CreateProcessWithTokenW (suspended))� logonflagsZapplicationname� commandline�currentdirectory� creationflags� startupinfoZ environmentz:win_runas.runas: CreateProcessWithTokenW returned in %.3fsz5win_runas.runas: new process pid=%s main_thread_id=%s�pidzFwin_runas.runas: ResumeThread returned %s (previously-suspended count))���l �� z�win_runas.runas: ResumeThread failed; process may never run; if the next line logs an infinite wait, the child is likely still suspendedc S s� z.t �t| �tjtjB �}t�|d��}|�|�� � W d � W dS 1 s'w Y W dS t yM } zt � d||� |�d� W Y d}~dS d}~ww )zARead one inherited pipe end into *bucket* (list with one string).�rNz$win_runas.runas: reading %s pipe: %sr+ ) �msvcrt�open_osfhandle�int�os�O_RDONLY�O_TEXT�fdopen�append�read�OSErrorr r )�handleZbucket�name�fdZfhr& r r r �_pump_pipecopyz s &���z runas.<locals>._pump_pipecopy�stdout)�target�args�stderrz6win_runas.runas: started pipe-drain threads for pid=%sz;win_runas.runas: waiting for pid=%s to exit (infinite wait)zEwin_runas.runas: WaitForSingleObject signalled after %.3fs for pid=%sz$win_runas.runas: pid=%s exit code=%s�retcodezAwin_runas.runas: unexpected WaitForSingleObject result for pid=%sz5win_runas.runas: pipe-drain threads joined for pid=%s)Nr r � win32security�LookupAccountNamer r r �win32api� FormatMessage�winerror�rstripr Z TOKEN_QUERYZTOKEN_ADJUST_PRIVILEGESZOpenProcessTokenZGetCurrentProcess�salt.platform.win�platform�winZ elevate_tokenZimpersonate_sidZ SYSTEM_SIDr> r r � CloseHandle�list�tuple� subprocess� list2cmdliner � runas_unprivZ LogonUser�win32conZLOGON32_LOGON_SERVICEZLOGON32_PROVIDER_DEFAULTZLOGON32_LOGON_INTERACTIVEZlogon_msv1_s4u�TokenZGetTokenInformationZTokenElevationTypeZTokenLinkedTokenZgrant_winsta_and_desktopZSECURITY_ATTRIBUTESZbInheritHandle� win32pipe� CreatePipeZmake_inheritable� win32processZCREATE_NO_WINDOWZCREATE_NEW_CONSOLEZCREATE_SUSPENDED�STARTF_USESTDHANDLES�STARTF_USESHOWWINDOW� STARTUPINFOr? r) r r ZCreateProcessWithTokenWr7 �hProcess�hThread� dwProcessId� dwThreadId�kernel32Z ResumeThread� threading�Threadr$ � win32event�WaitForSingleObject�INFINITE� WAIT_OBJECT_0�GetExitCodeProcess�join�stripZ RevertToSelf)(r r �password�cwd�_r r& �message�access�th�saltZimpersonation_tokenr Zelevation_typeZsecurity_attributesZ stdin_readZ stdin_writeZ stdout_readZ stdout_writeZ stderr_readZ stderr_writer0 �flags� startup_infor% r_ r# � process_infor` ra rb �retZ resume_countZ stdout_bufZ stderr_bufrB Zt_outZt_err�t_wait�exitcoder r r �runas� sp #�� � � � �� ����� � � �� � � � � � � � � � �rz c C s$ t |t�s t|�}zt�d|�\}}}t|�\}}W n tjy4 } z t�|j �� d�}t |��d}~ww t | t t f�rAt�| �} t�d|||t| �� tjjjddd�\}} tjjjddd�\} } tjjj�tjjj�} tjjj| dd�} tj }|tj O }tjjj || | | d�}zIt�d � t � � }tjjj!|||tjjj"| ||d �}t�d |j#t � � | � tjjj�$|j%� W tjjj�$| � tjjj�$| � tjjj�$| � ntjjj�$| � tjjj�$| � tjjj�$| � w d |j#i}t&�'|t(j)t(j*B �}t(�+|d ��}|�,� |d< W d � n 1 �sw Y t&�'| t(j)t(j*B �}t(�+|d ��}|�,� |d< W d � n 1 �s:w Y t�d|j#� t � � }tjjj�-|j.t/j0�tj1k�r�t�dt � � | |j#� tjjj2�3� }tjjj�4|j.t5�6|�� t�d|j#|j7� |j7|d< tjjj�$|j.� |S )aL Run ``cmd`` as ``username`` using ``CreateProcessWithLogonW`` (with profile). Used when :func:`runas` cannot use ``CreateProcessWithTokenW`` (e.g. no SYSTEM impersonation). Requires ``password`` for the target account. Stdin is inherited from the minion; stdout/stderr are collected from anonymous pipes. Output is read after the process exit wait (acceptable for typical output sizes; the privileged :func:`runas` path uses concurrent draining to avoid pipe deadlocks on very large streams). Args: cmd: Command line string, or a list/tuple passed to ``subprocess.list2cmdline``. username: Target account; coerced to ``str`` if needed. password: Password for ``CreateProcessWithLogonW`` (required). cwd: Optional working directory for the child; ``None`` for default. Returns: Dict with ``pid``, ``retcode`` (if the process handle wait succeeded), ``stdout``, and ``stderr`` strings. Raises: salt.exceptions.CommandExecutionError: If the account name cannot be resolved. Nr* z;win_runas.runas_unpriv: user=%r domain=%r cwd=%r cmdline=%sFT)Z inherit_readZ inherit_write)Z srchandler! r, z/win_runas.runas_unpriv: CreateProcessWithLogonW)r r rm r- r. r1 r/ z7win_runas.runas_unpriv: process started pid=%s in %.3fsr2 r4 rC rF zBwin_runas.runas_unpriv: waiting for pid=%s to exit (infinite wait)zGwin_runas.runas_unpriv: WaitForSingleObject done after %.3fs for pid=%sz+win_runas.runas_unpriv: pid=%s exit code=%srG )8r r rH rI r r r rJ rK rL rM r rR rS rT rU r r r rs rO rP rZ rc Z GetStdHandleZSTD_INPUT_HANDLEZDuplicateHandlerW r\ r] r^ r r ZCreateProcessWithLogonWZLOGON_WITH_PROFILEra rQ r` r5 r6 r8 r9 r: r; r= rg r_ rf rh ri ZwintypesZDWORDrj �ctypes�byref�value)r r rm rn ro r r& rp �c2pread�c2pwrite�errread�errwrite�stdinZdupinrt ru r# rv rw Zfd_outZf_outZfd_errZf_errrx ry r r r rV � s� �� � � � � � � �� � �� �� � �� rV )r )Fr )NN)N) �__doc__r{ �loggingr8 rT rd r Zsalt.exceptionsr r5 r rJ rW rf rY r[ r rH rN rs r � ImportError� getLogger�__name__r r r r r) rz rV r r r r �<module> s@ � <
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings