HEX
Server: LiteSpeed
System: Linux s787.bom1.mysecurecloudhost.com 4.18.0-477.13.1.lve.el8.x86_64 #1 SMP Thu Jun 1 16:40:47 EDT 2023 x86_64
User: mobilech (5348)
PHP: 8.1.34
Disabled: NONE
$ pwd: /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/
Upload Files
File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/win_dacl.cpython-310.pyc
o

;j΅�@s�dZddlZddlZddlZddlZddlmZzddlZddl	Z	ddl
Z
dZWney3dZYnwe�
e�ZdZGdd�d�Zd	d
�Zdd�Zd
d�Zd!dd�Zdd�Zd"dd�Zdd�Zd#dd�Zd$dd�Zd%dd�Zd!dd�Z				d&dd �ZdS)'z=
Manage DACLs on Windows

:depends:   - winreg Python module
�N)�CommandExecutionErrorTFZwin_daclc@s`eZdZdZdd�Zdd�Zdd�Zdd	�Zd
d�Zdd
�Z	dd�Z
dd�Zdd�Zdd�Z
dS)�
daclConstantsz3
    DACL constants used throughout the module
    c
CsdtjtjBdB|_ddddddddddddd�|_tjtjdd�tj	d	d�d
�tj
tjdd�tjdd�tj
tjBdd�tjtjBtj
BtjBd
d�|jd	d�d�i|_ddd�ddd�d�|_tjdtjd�dtjd�dtjtjBd�dtjd�dtjd�dtjtjBd�d�tj
iddtjd��ddtjd��ddtjtjBd��ddtjd��d d!tjd��d"d#tjtjBtjBd��d$d%tjtjBd��d&d'tjtjBd��d(dtjd��d)dtjd��d*dtjtjBd��d+dtjd��d,d!tjd��d-d#tjtjBtjBd��d.d%tjtjBd��d/d'tjtjBd��i|_tj	tj	tjBd0�|_tj
tj
tjd1�|_dS)2Ni��MACHINE�USERS�CURRENT_USER�CLASSES_ROOT)�HKEY_LOCAL_MACHINEZ
HKEY_USERS�HKEY_CURRENT_USERZHKEY_CLASSES_ROOTrrrrZHKLMZHKUZHKCUZHKCR�read)�BITS�TEXTzfull control)�READ�FULLCONTROL�writezread and execute�modify)r
ZWRITEzREAD&EXECUTEZMODIFYr�allowedr)rrZdenied�)ZALLOWZDENYz
this key onlyzthis key and subkeyszsubkeys only)ZKEYzKEY&SUBKEYSZSUBKEYSz
THIS KEY ONLYzTHIS KEY AND SUBKEYSzSUBKEYS ONLY�FILEzthis file/folder onlyZFOLDERzFOLDER&SUBFOLDERS&FILESz"this folder, subfolders, and fileszFOLDER&SUBFOLDERSzthis folder and subfolderszFOLDER&FILESzthis folder and fileszSUBFOLDERS&FILESzsubfolders and filesZ
SUBFOLDERSzsubfolders onlyZFILESz
files onlyzTHIS FILE ONLYzTHIS FOLDER ONLYz"THIS FOLDER, SUBFOLDERS, AND FILESzTHIS FOLDER AND SUBFOLDERSzTHIS FOLDER AND FILESzSUBFOLDERS AND FILESzSUBFOLDERS ONLYz
FILES ONLY)TF)rZ	DIRECTORYZREGISTRY)�
ntsecurityconZSTANDARD_RIGHTS_REQUIREDZSYNCHRONIZEZFILE_ALL_ACCESS�hkeys_security�
win32security�SE_REGISTRY_KEY�winregZKEY_READZKEY_ALL_ACCESSZSE_FILE_OBJECTZFILE_GENERIC_READZFILE_GENERIC_WRITEZFILE_GENERIC_EXECUTEZDELETE�rights�
validAceTypesZNO_INHERITANCEZCONTAINER_INHERIT_ACEZINHERIT_ONLY_ACEZOBJECT_INHERIT_ACE�validPropagationsZKEY_WOW64_64KEYZreflection_mask�
objectType)�self�r�I/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/win_dacl.py�__init__.sZ��

�

������
���
������������	��������������!���&��*��.���3��7��;����A���F����h
��zdaclConstants.__init__c
CsJt|t�r#|��}z|j|WSty"td�|d�|j����w|S)zA
        returns the bit value of the string object type
        z@Invalid object type "{}". It should be one of the following:  {}�, )�
isinstance�str�upperr�KeyErrorr�format�join�r�trrr�getObjectTypeBit�s
���zdaclConstants.getObjectTypeBitc
Cs4z|j|WStytd�|d�|j����w)z]
        returns the necessary string value for an HKEY for the win32security module
        z;No HKEY named "{}".  It should be one of the following:  {}r!)rr%rr&r')r�srrr�getSecurityHkey�s���zdaclConstants.getSecurityHkeycCsPzt|t�r|j||dWS|WSty'td�|d�|j|����w)zg
        returns a permission bit of the string permission value for the specified object type
        r�6No right "{}".  It should be one of the following:  {}r!)r"r#rr%rr&r'�rr)�mrrr�getPermissionBit�s
���zdaclConstants.getPermissionBitcC�@z
|j||dWStytd�|d�|j|����w)zi
        returns the permission textual representation of a specified permission bit/object type
        rr-r!)rr%rr&r'r.rrr�getPermissionText�����zdaclConstants.getPermissionTextc
C�8z|j|dWStytd�|d�|j����w)z9
        returns the acetype bit of a text value
        r�9No ACE type "{}".  It should be one of the following:  {}r!�rr%rr&r'r(rrr�
getAceTypeBit����zdaclConstants.getAceTypeBitc
Cr4)zE
        returns the textual representation of a acetype bit
        rr5r!r6r(rrr�getAceTypeTextr8zdaclConstants.getAceTypeTextcCr1)z=
        returns the propagation bit of a text value
        r�DNo propagation type of "{}".  It should be one of the following:  {}r!�rr%rr&r'�rr)�prrr�getPropagationBit"r3zdaclConstants.getPropagationBitcCr1)zI
        returns the textual representation of a propagation bit
        rr:r!r;r<rrr�getPropagationText/r3z daclConstants.getPropagationTextcCsR|tjkr!|�d�}|�|�d����}|�d|�d�|�}|Stj	�
|�}|S)z�
        processes a path/object type combo and returns:
            registry types with the correct HKEY text representation
            files/directories with environment variables expanded
        �\rz\\)rr�splitr,�popr$�insertr'�os�path�
expandvars)rrErZspltZhiverrr�processPath<s


�zdaclConstants.processPathN)�__name__�
__module__�__qualname__�__doc__r r*r,r0r2r7r9r>r?rGrrrrr$s	 





rc
Cs:i}d}|rft�||tj�rfzt�|�}Wnty4}zd|d<d�||�|d<WYd}~|Sd}~wwzt�d|�d|d<||d	<W|Stye}zd|d<d
�||�|d<WYd}~|Sd}~wwz|rqt�d|�dnd}d|d<||d	<W|Sty�}zd|d<d�||�|d<WYd}~|Sd}~ww)
z�
    return a state error dictionary, with 'sid' as a field if it could be returned
    if user is None, sid will also be None
    z^S-1(-\d+){1,}$F�resultzNUnable to obtain the binary security identifier for {}.  The exception was {}.�commentN�T�sidzSUnable to lookup the account for the security identifier {}.  The exception was {}.rzGUnable to obtain the security identifier for {}.  The exception was {}.)	�re�match�IrZGetBinarySid�	Exceptionr&�LookupAccountSidZLookupAccountName)�user�retZsid_patternrO�errr�
_get_user_sidLsN���
����
����rXcCstjj��r
tr
tSdS)z'
    Only works on Windows systems
    )Fz5Module win_dacl: module only works on Windows systems)�salt�utils�platformZ
is_windows�HAS_WINDOWS_MODULES�__virtualname__rrrr�__virtual__wsr^cCs4z
t�||tj���}W|Styd}Y|Sw)z!
    Gets the DACL of a path
    N)r�GetNamedSecurityInfo�DACL_SECURITY_INFORMATION�GetSecurityDescriptorDaclrS)rEr�daclrrr�	_get_dacl�s����rcc
Cs�|gd�}t|�}|rG|rGt�}|�|�}|�||�}t||�}|rGtd|���D]}|�|�}	|dr<|	d|dkrF|d�t	|	|��q)|S)a�
    Get the ACL of an object. Will filter by user if one is provided.

    Args:

        path (str): The path to the object

        objectType (str): The type of object (FILE, DIRECTORY, REGISTRY)

        user (:obj:`str`, optional):
            A username to filter by.
            Default is ``None``.

    Returns (dict): A dictionary containing the ACL

    CLI Example:

    .. code-block:: bash

        salt 'minion-id' win_dacl.get 'c:\temp' directory
    )�Path�ACLsrrO�re)
rXrr*rGrc�range�GetAceCount�GetAce�append�_ace_to_text)
rErrUrV�sidRet�dc�
objectTypeBit�tdacl�counter�tAcerrr�get�s



�rrcCs�didd�}|r�|r�|r�|r�|r�|��dkrd}t�}|�|�}|�||�}|��}|����}|����}|����}t|�}	|	dsF|	S|�||�}
|�|�}|�||�}t	||�}
|
r�g}zG|dkrq|
�
tj||
|	d�n|dkr�|
�
tj||
|	d�t�||tjdd|
d�|�d	�||�|�|�||�|�||���d
|d<Wnty�}zd�|�|d<d
|d<|WYd}~Sd}~ww|r�||dd<|Sd|��|d<|Sd|d<d
|d<|S)a
    Add an ace to an object

    Args:

        path (str):
            Path to the object (i.e. c:\\temp\\file, HKEY_LOCAL_MACHINE\\SOFTWARE\\KEY, etc)

        user (str): User to add

        permission (str): Permissions for the user

        acetype (str): Either allow/deny for each user/permission (ALLOW, DENY)

        propagation (str):
            How the ACE applies to children for Registry Keys and Directories
            (KEY, KEY&SUBKEYS, SUBKEYS)

    CLI Example:

    .. code-block:: bash

        # allow domain\fakeuser full control on HKLM\\SOFTWARE\\somekey, propagate to this key and subkeys
        salt 'myminion' win_dacl.add_ace 'HKEY_LOCAL_MACHINE\\SOFTWARE\\somekey' 'Registry' 'domain\fakeuser' 'FULLCONTROL' 'ALLOW' 'KEY&SUBKEYS'
    NrN�rL�changesrMrrLrrOrz{} {} {} on {}Tz>An error occurred attempting to add the ace.  The error was {}rMFrtz
Added ACEszUnable to obtain the DACL of z1An empty value was specified for a required item.)r$rr*rG�striprXr0r7r>rcZAddAccessAllowedAceExrZACL_REVISIONZAddAccessDeniedAceEx�SetNamedSecurityInfor`rjr&r9r2r?rS)rErrU�
permission�acetype�propagationrVrmrnrl�
permissionbit�
acetypebit�propagationbitrbZ	acesAddedrWrrr�add_ace�s�


���	

��������r}c
CsBdidd�}|�r|�rt�}|r|��dkrd}|�|�}|�||�}|��}|r0|����nd}|r:|����nd}|rD|����nd}t||||||d�d�rt|�}	|	ds]|	S|re|�||�nd}
|rn|�|�nd}|rx|�	||�nd}t
||�}
d}g}||
��kr�|
�|�}|dd	t
j@t
jkr�|d
|	dkr�|r�|dd|kr�|r�|dd	|@|kr�|
r�|d	|
kr�|
�|�|d	}|�t||��|d	}||
��ks�|�rzt
�||t
jdd|
d�||dd
<d|d<W|St�y}zd|d<d|�d�|d<|WYd}~Sd}~ww|Sd|d<|S)a
    remove an ace to an object

    Args:

        path (str):
            Path to the object (i.e. c:\\temp\\file, HKEY_LOCAL_MACHINE\\SOFTWARE\\KEY, etc)

        user (str): User to remove

        permission (:obj:`str`, optional):
            Permission for the user.
            Default is ``None``.

        acetype (:obj:`str`, optional):
            Either allow/deny for each user/permission (ALLOW, DENY).
            Default is ``None``.

        propagation (:obj:`str`, optional):
            How the ACE applies to children for Registry Keys and Directories
            (KEY, KEY&SUBKEYS, SUBKEYS).
            Default is ``None``.

    If any of the optional parameters are omitted (or set to None) they act as
    wildcards.

    CLI Example:

    .. code-block:: bash

        # Remove allow domain\fakeuser full control on HKLM\\SOFTWARE\\somekey propagated to this key and subkeys
        salt 'myminion' win_dacl.rm_ace 'Registry' 'HKEY_LOCAL_MACHINE\\SOFTWARE\\somekey' 'domain\fakeuser' 'FULLCONTROL' 'ALLOW' 'KEY&SUBKEYS'
    NrNrsrT�ExistsrLrrrfrOrt�Removed ACEsFz#Error removing ACE.  The error was �.rMz,The specified ACE was not found on the path.)rr$r*rGru�	check_acerXr0r7r>rcrhrir�
INHERITED_ACE�	DeleteAcerjrkrvr`rS)rErrUrwrxryrVrmrnrlrzr{r|rbrpZacesRemovedrqrWrrr�rm_aces�"
����

�
���	
����r�c		Cszt�}|�|�}zt�d|d�}|dr!|d�d|d��}n|d�}Wnty7t�|d�}Ynw|d}|dd}|dd}d}|jD]}|j|d|kra|j|d}nqM|j|D]}|j||d|kr|j||d}nqg|tj@tjkr�d}|tjA}|j	|D]}|j	||d|kr�|j	||d}nq�|�d	|�d	|�d
|�d	|��	S)zG
    helper function to convert an ace to a textual representation
    rNrfrr@rrrz[Inherited]� z on )
rr*rrTrSZConvertSidToStringSidrrr�r)	�acerrmZuserSidZtPermZtAceTypeZtPropsZ
tInherited�xrrrrk�sD

��
��
� rkc

Cs�ddid�}|r�z�t�||tj�}|��}|rq|rUd}g}	||��krL|�|�}
|
ddtj@tjkrB|�|�|	�t	|
|��n|d}||��ks#|	rT|	|dd<nd|dd	<t�
||tjtjBd
d
|d
�d|dd<nY|s�d}g}||��kr�|�|�}
|
ddtj@tjkr�|�|�|�t	|
|��n|d}||��ks}|r�||dd<nd
|dd<t�
||tjtjBd
d
|d
�d|dd<d|d<W|St
y�}zd|d<d|�d�|d<WYd
}~|Sd
}~ww|S)a3
    helper function to set the inheritance

    Args:

        path (str): The path to the object

        objectType (str): The type of object

        inheritance (:obj:`bool`, optional):
            ``True`` enables inheritance, ``False`` disables.
            Default is ``True``.

        copy (:obj:`bool`, optional):
            Copy inherited ACEs to the DACL before disabling inheritance.
            Default is ``True``.

        clear (:obj:`bool`, optional):
            Remove non-inherited ACEs from the DACL.
            Default is ``False``.
    FrN)rLrMrtrrrtrzLeft in the DACLzNon-Inherited ACEsNZEnabled�InheritancezCopied to the DACLzPreviously Inherited ACEsZDisabledTrLz8Error attempting to set the inheritance.  The error was r�rM)rr_r`rarhrir�r�rjrkrvZ%UNPROTECTED_DACL_SECURITY_INFORMATIONZ#PROTECTED_DACL_SECURITY_INFORMATIONrS)
rErZinheritance�copy�clearrV�sdrorpZremovedAcesrqZinheritedAcesRemovedrWrrr�_set_dacl_inheritance�s��
�
�	���

�
�	���

�
���r�cCs,t�}|�|�}|�||�}t||dd|�S)a�
    Enable/disable inheritance on an object

    Args:

        path (str): The path to the object

        objectType (str): The type of object (FILE, DIRECTORY, REGISTRY)

        clear (:obj:`bool`, optional):
            ``True`` will remove non-Inherited ACEs from the ACL.
            Default is ``False``.

    Returns (dict): A dictionary containing the results

    CLI Example:

    .. code-block:: bash

        salt 'minion-id' win_dacl.enable_inheritance 'c:\temp' directory
    TN�rr*rGr�)rErr�rmrrr�enable_inheritances
r�cCs,t�}|�|�}|�||�}t||d|d�S)a
    Disable inheritance on an object

    Args:

        path (str): The path to the object

        objectType (str): The type of object (FILE, DIRECTORY, REGISTRY)

        copy (:obj:`bool`, optional):
            ``True`` will copy the Inherited ACEs to the DACL before
            disabling inheritance.
            Default is ``True``.

    Returns (dict): A dictionary containing the results

    CLI Example:

    .. code-block:: bash

        salt 'minion-id' win_dacl.disable_inheritance 'c:\temp' directory
    FNr�)rErr�rmrrr�disable_inheritance#s
r�c
Cs�dddd�}t|�}t�}|�|�}|�||�}zt�||tj�}|��}Wn tyF}zd|d<d|�d�|d<|WYd}~Sd}~wwt	d	|�
��D]%}	|�|	�}
|
d	d
tj@tjkrs|drm|
d|dkrsd
|d<nqNd
|d<|S)a"
    Check a specified path to verify if inheritance is enabled

    Args:

        path (str): path of the registry key or file system object to check

        objectType (str): The type of object (FILE, DIRECTORY, REGISTRY)

        user (:obj:`str`, optional):
            If provided, will consider only the ACEs for that user.
            Default is ``None``.

    Returns (bool): 'Inheritance' of True/False

    CLI Example:

    .. code-block:: bash

        salt 'minion-id' win_dacl.check_inheritance 'c:\temp' directory <username>
    FrN)rLr�rMrLz=Error obtaining the Security Descriptor or DACL of the path: r�rMNrrrOrfTr�)
rXrr*rGrr_r`rarSrgrhrir�)rErrUrVrlrmr��daclsrWrpr�rrr�check_inheritanceAs4
�
���
�r�cCs|dddd�}t�}|�|�}	|�||	�}|r|��nd}|r"|��nd}|r*|��nd}|r4|�|	|�nd}
|r=|�|�nd}|rG|�|	|�nd}t|�}
|
dsS|
St||	�}d|d<|r�t	d|�
��D]P}|�|�}|d|
d	kr�|r~|dd|kr�|r�|dd
|@|kr�|
s�d|d<|S|r�|d
|
kr�d|d<|Sqe|d
|
@|
kr�d|d<|Sqe|Sd|d
<|S)a�
    Checks a path to verify the ACE (access control entry) specified exists

    Args:

        path (str): Path to the file/reg key

        objectType (str): The type of object (FILE, DIRECTORY, REGISTRY)

        user (str): User that the ACL is for

        permission (:obj:`str`, optional):
            Permission to test for (READ, FULLCONTROL, etc).
            Default is ``None``.

        acetype (:obj:`str`, optional):
            The type of ACE (ALLOW or DENY).
            Default is ``None``.

        propagation (:obj:`str`, optional):
            The propagation type of the ACE (FILES, FOLDERS, KEY, KEY&SUBKEYS,
            SUBKEYS, etc).
            Default is ``None``.

        exactPermissionMatch (:obj:`bool`, optional):
            The ACL must match exactly, ie: if ``READ`` is specified, the user
            must have ``READ`` exactly and not ``FULLCONTROL`` (which also has
            the ``READ`` permission obviously)

    Returns (dict): 'Exists' true if the ACE exists, false if it does not

    CLI Example:

    .. code-block:: bash

        salt 'minion-id' win_dacl.check_ace 'c:\temp' directory <username> fullcontrol
    FrN)rLr~rMNrLTrrfrOrr~zNo DACL found for object.rM)rr*rGr$r0r7r>rXrcrgrhri)rErrUrwrxryZexactPermissionMatchrVrmrnrzr{r|rlr�rpr�rrrr�wsP.
��

����r�)N)NNN)TTF)F)T)NNNF)rK�loggingrDrPZsalt.utils.platformrYZsalt.exceptionsrrrrr\�ImportError�	getLoggerrH�logr]rrXr^rcrrr}r�rkr�r�r�r�r�rrrr�<module>sF�
*+	

'
dj
$
`

:�
@ Telegram