salt.modules.win_dacl

Manage DACLs on Windows

depends:	winreg Python module

salt.modules.win_dacl.add_ace(path, objectType, user, permission, acetype, propagation)

add an ace to an object

path: path to the object (i.e. c:\temp\file, HKEY_LOCAL_MACHINE\SOFTWARE\KEY, etc) user: user to add permission: permissions for the user acetype: either allow/deny for each user/permission (ALLOW, DENY) propagation: how the ACE applies to children for Registry Keys and Directories(KEY, KEY&SUBKEYS, SUBKEYS)

CLI Example:

allow domain\fakeuser full control on HKLM\\SOFTWARE\\somekey, propagate to this key and subkeys
    salt 'myminion' win_dacl.add_ace 'HKEY_LOCAL_MACHINE\\SOFTWARE\\somekey' 'Registry' 'domain\fakeuser' 'FULLCONTROL' 'ALLOW' 'KEY&SUBKEYS'

salt.modules.win_dacl.check_ace(path, objectType, user, permission=None, acetype=None, propagation=None, exactPermissionMatch=False)

Checks a path to verify the ACE (access control entry) specified exists

Parameters:

path -- path to the file/reg key objectType -- The type of object (FILE, DIRECTORY, REGISTRY) user -- user that the ACL is for permission -- permission to test for (READ, FULLCONTROL, etc) acetype -- the type of ACE (ALLOW or DENY) propagation -- the propagation type of the ACE (FILES, FOLDERS, KEY, KEY&SUBKEYS, SUBKEYS, etc) exactPermissionMatch -- the ACL must match exactly, IE if READ is specified, the user must have READ exactly and not FULLCONTROL (which also has the READ permission obviously)

Returns (dict): 'Exists' true if the ACE exists, false if it does not

CLI Example:

salt 'minion-id' win_dacl.check_ace c:  emp directory <username> fullcontrol

salt.modules.win_dacl.check_inheritance(path, objectType, user=None)

Check a specified path to verify if inheritance is enabled

Parameters:	path -- path of the registry key or file system object to check objectType -- The type of object (FILE, DIRECTORY, REGISTRY) user -- if provided, will consider only the ACEs for that user

Returns (bool): 'Inheritance' of True/False

CLI Example:

salt 'minion-id' win_dacl.check_inheritance c:  emp directory <username>

class salt.modules.win_dacl.daclConstants

DACL constants used throughout the module

getAceTypeBit(t)

returns the acetype bit of a text value

getAceTypeText(t)

returns the textual representation of a acetype bit

getObjectTypeBit(t)

returns the bit value of the string object type

getPermissionBit(t, m)

returns a permission bit of the string permission value for the specified object type

getPermissionText(t, m)

returns the permission textual representation of a specified permission bit/object type

getPropagationBit(t, p)

returns the propagation bit of a text value

getPropagationText(t, p)

returns the textual representation of a propagation bit

getSecurityHkey(s)

returns the necessary string value for an HKEY for the win32security module

processPath(path, objectType)

processes a path/object type combo and returns:

registry types with the correct HKEY text representation files/directories with environment variables expanded

salt.modules.win_dacl.disable_inheritance(path, objectType, copy=True)

Disable inheritance on an object

Parameters:	path -- The path to the object objectType -- The type of object (FILE, DIRECTORY, REGISTRY) copy -- True will copy the Inherited ACEs to the DACL before disabling inheritance

Returns (dict): A dictionary containing the results

CLI Example:

salt 'minion-id' win_dacl.disable_inheritance c:        emp directory

salt.modules.win_dacl.enable_inheritance(path, objectType, clear=False)

enable/disable inheritance on an object

Parameters:	path -- The path to the object objectType -- The type of object (FILE, DIRECTORY, REGISTRY) clear -- True will remove non-Inherited ACEs from the ACL

Returns (dict): A dictionary containing the results

CLI Example:

salt 'minion-id' win_dacl.enable_inheritance c: emp directory

salt.modules.win_dacl.get(path, objectType, user=None)

Get the ACL of an object. Will filter by user if one is provided.

Parameters:	path -- The path to the object objectType -- The type of object (FILE, DIRECTORY, REGISTRY) user -- A user name to filter by

Returns (dict): A dictionary containing the ACL

CLI Example:

salt 'minion-id' win_dacl.get c:        emp directory

salt.modules.win_dacl.rm_ace(path, objectType, user, permission=None, acetype=None, propagation=None)

remove an ace to an object

path: path to the object (i.e. c:\temp\file, HKEY_LOCAL_MACHINE\SOFTWARE\KEY, etc) user: user to remove permission: permissions for the user acetypes: either allow/deny for each user/permission (ALLOW, DENY) propagation: how the ACE applies to children for Registry Keys and Directories(KEY, KEY&SUBKEYS, SUBKEYS)

If any of the optional parameters are omitted (or set to None) they act as wildcards.

CLI Example:

remove allow domain\fakeuser full control on HKLM\\SOFTWARE\\somekey propagated to this key and subkeys
    salt 'myminion' win_dacl.rm_ace 'Registry' 'HKEY_LOCAL_MACHINE\\SOFTWARE\\somekey' 'domain\fakeuser' 'FULLCONTROL' 'ALLOW' 'KEY&SUBKEYS'