Manage DACLs on Windows
winreg Python module
salt.modules.win_dacl.
add_ace
(path, objectType, user, permission, acetype, propagation)¶add an ace to an object
path: path to the object (i.e. c:\temp\file, HKEY_LOCAL_MACHINE\SOFTWARE\KEY, etc) user: user to add permission: permissions for the user acetype: either allow/deny for each user/permission (ALLOW, DENY) propagation: how the ACE applies to children for Registry Keys and Directories(KEY, KEY&SUBKEYS, SUBKEYS)
CLI Example:
allow domain\fakeuser full control on HKLM\\SOFTWARE\\somekey, propagate to this key and subkeys
salt 'myminion' win_dacl.add_ace 'HKEY_LOCAL_MACHINE\\SOFTWARE\\somekey' 'Registry' 'domain\fakeuser' 'FULLCONTROL' 'ALLOW' 'KEY&SUBKEYS'
salt.modules.win_dacl.
check_ace
(path, objectType, user, permission=None, acetype=None, propagation=None, exactPermissionMatch=False)¶Checks a path to verify the ACE (access control entry) specified exists
path -- path to the file/reg key
objectType -- The type of object (FILE, DIRECTORY, REGISTRY)
user -- user that the ACL is for
permission -- permission to test for (READ, FULLCONTROL, etc)
acetype -- the type of ACE (ALLOW or DENY)
propagation -- the propagation type of the ACE (FILES, FOLDERS, KEY, KEY&SUBKEYS, SUBKEYS, etc)
exactPermissionMatch -- the ACL must match exactly, IE if READ is specified, the user must have READ exactly and not FULLCONTROL (which also has the READ permission obviously)
Returns (dict): 'Exists' true if the ACE exists, false if it does not
CLI Example:
salt 'minion-id' win_dacl.check_ace c: emp directory <username> fullcontrol
salt.modules.win_dacl.
check_inheritance
(path, objectType, user=None)¶Check a specified path to verify if inheritance is enabled
path -- path of the registry key or file system object to check
objectType -- The type of object (FILE, DIRECTORY, REGISTRY)
user -- if provided, will consider only the ACEs for that user
Returns (bool): 'Inheritance' of True/False
CLI Example:
salt 'minion-id' win_dacl.check_inheritance c: emp directory <username>
salt.modules.win_dacl.
daclConstants
¶DACL constants used throughout the module
getAceTypeBit
(t)¶returns the acetype bit of a text value
getAceTypeText
(t)¶returns the textual representation of a acetype bit
getObjectTypeBit
(t)¶returns the bit value of the string object type
getPermissionBit
(t, m)¶returns a permission bit of the string permission value for the specified object type
getPermissionText
(t, m)¶returns the permission textual representation of a specified permission bit/object type
getPropagationBit
(t, p)¶returns the propagation bit of a text value
getPropagationText
(t, p)¶returns the textual representation of a propagation bit
getSecurityHkey
(s)¶returns the necessary string value for an HKEY for the win32security module
processPath
(path, objectType)¶registry types with the correct HKEY text representation files/directories with environment variables expanded
salt.modules.win_dacl.
disable_inheritance
(path, objectType, copy=True)¶Disable inheritance on an object
path -- The path to the object
objectType -- The type of object (FILE, DIRECTORY, REGISTRY)
copy -- True will copy the Inherited ACEs to the DACL before disabling inheritance
Returns (dict): A dictionary containing the results
CLI Example:
salt 'minion-id' win_dacl.disable_inheritance c: emp directory
salt.modules.win_dacl.
enable_inheritance
(path, objectType, clear=False)¶enable/disable inheritance on an object
path -- The path to the object
objectType -- The type of object (FILE, DIRECTORY, REGISTRY)
clear -- True will remove non-Inherited ACEs from the ACL
Returns (dict): A dictionary containing the results
CLI Example:
salt 'minion-id' win_dacl.enable_inheritance c: emp directory
salt.modules.win_dacl.
get
(path, objectType, user=None)¶Get the ACL of an object. Will filter by user if one is provided.
path -- The path to the object
objectType -- The type of object (FILE, DIRECTORY, REGISTRY)
user -- A user name to filter by
Returns (dict): A dictionary containing the ACL
CLI Example:
salt 'minion-id' win_dacl.get c: emp directory
salt.modules.win_dacl.
rm_ace
(path, objectType, user, permission=None, acetype=None, propagation=None)¶remove an ace to an object
path: path to the object (i.e. c:\temp\file, HKEY_LOCAL_MACHINE\SOFTWARE\KEY, etc) user: user to remove permission: permissions for the user acetypes: either allow/deny for each user/permission (ALLOW, DENY) propagation: how the ACE applies to children for Registry Keys and Directories(KEY, KEY&SUBKEYS, SUBKEYS)
If any of the optional parameters are omitted (or set to None) they act as wildcards.
CLI Example:
remove allow domain\fakeuser full control on HKLM\\SOFTWARE\\somekey propagated to this key and subkeys
salt 'myminion' win_dacl.rm_ace 'Registry' 'HKEY_LOCAL_MACHINE\\SOFTWARE\\somekey' 'domain\fakeuser' 'FULLCONTROL' 'ALLOW' 'KEY&SUBKEYS'