From 05e01bd3b50404371a8f9ee1128ff08925e8b906 Mon Sep 17 00:00:00 2001
From: Phil <schwartzmx@gmail.com>
Date: Tue, 14 Jul 2015 18:35:28 -0500
Subject: [PATCH] updates user search verification for local/domain - Thanks to
@trondhindenes for implementing this strategy - also updated documentation
---
windows/win_acl.ps1 | 110 ++++++++++++++++++++++++++++++++++----------
windows/win_acl.py | 4 +-
2 files changed, 87 insertions(+), 27 deletions(-)
diff --git a/windows/win_acl.ps1 b/windows/win_acl.ps1
index 39530866c61..ec72828a531 100644
--- a/windows/win_acl.ps1
+++ b/windows/win_acl.ps1
@@ -15,21 +15,82 @@
#
# You should have received a copy of the GNU General Public License
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
-
+
# WANT_JSON
# POWERSHELL_COMMON
-
+
# win_acl module (File/Resources Permission Additions/Removal)
+
+
+#Functions
+Function UserSearch
+{
+ Param ([string]$AccountName)
+ #Check if there's a realm specified
+ if ($AccountName.Split("\").count -gt 1)
+ {
+ if ($AccountName.Split("\")[0] -eq $env:COMPUTERNAME)
+ {
+ $IsLocalAccount = $true
+ }
+ Else
+ {
+ $IsDomainAccount = $true
+ $IsUpn = $false
+ }
+
+ }
+ Elseif ($AccountName -contains "@")
+ {
+ $IsDomainAccount = $true
+ $IsUpn = $true
+ }
+ Else
+ {
+ #Default to local user account
+ $accountname = $env:COMPUTERNAME + "\" + $AccountName
+ $IsLocalAccount = $true
+ }
+
+
+ if ($IsLocalAccount -eq $true)
+ {
+ $localaccount = get-wmiobject -class "Win32_UserAccount" -namespace "root\CIMV2" -filter "(LocalAccount = True)" | where {$_.Caption -eq $AccountName}
+ if ($localaccount)
+ {
+ return $localaccount.Caption
+ }
+ $LocalGroup = get-wmiobject -class "Win32_Group" -namespace "root\CIMV2" -filter "LocalAccount = True"| where {$_.Caption -eq $AccountName}
+ if ($LocalGroup)
+ {
+ return $LocalGroup.Caption
+ }
+ }
+ ElseIf (($IsDomainAccount -eq $true) -and ($IsUpn -eq $false))
+ {
+ #Search by samaccountname
+ $Searcher = [adsisearcher]""
+ $Searcher.Filter = "sAMAccountName=$($accountname.split("\")[1])"
+ $result = $Searcher.FindOne()
+
+ if ($result)
+ {
+ return $accountname
+ }
+ }
+
+}
+
$params = Parse-Args $args;
-
+
$result = New-Object psobject @{
win_acl = New-Object psobject
changed = $false
}
-
+
If ($params.src) {
$src = $params.src.toString()
-
+
If (-Not (Test-Path -Path $src)) {
Fail-Json $result "$src file or directory does not exist on the host"
}
@@ -37,21 +98,20 @@ If ($params.src) {
Else {
Fail-Json $result "missing required argument: src"
}
-
+
If ($params.user) {
- $user = $params.user.toString()
-
- # Test that the user/group exists on the local machine
- $localComputer = [ADSI]("WinNT://"+[System.Net.Dns]::GetHostName())
- $list = ($localComputer.psbase.children | Where-Object { (($_.psBase.schemaClassName -eq "User") -Or ($_.psBase.schemaClassName -eq "Group"))} | Select-Object -expand Name)
- If (-Not ($list -contains "$user")) {
- Fail-Json $result "$user is not a valid user or group on the host machine"
- }
+ $user = UserSearch -AccountName ($Params.User)
+
+ # Test that the user/group is resolvable on the local machine
+ if (!$user)
+ {
+ Fail-Json $result "$($Params.User) is not a valid user or group on the host machine or domain"
+ }
}
Else {
Fail-Json $result "missing required argument: user. specify the user or group to apply permission changes."
}
-
+
If ($params.type -eq "allow") {
$type = $true
}
@@ -61,7 +121,7 @@ ElseIf ($params.type -eq "deny") {
Else {
Fail-Json $result "missing required argument: type. specify whether to allow or deny the specified rights."
}
-
+
If ($params.inherit) {
# If it's a file then no flags can be set or an exception will be thrown
If (Test-Path -Path $src -PathType Leaf) {
@@ -80,44 +140,44 @@ Else {
$inherit = "ContainerInherit, ObjectInherit"
}
}
-
+
If ($params.propagation) {
$propagation = $params.propagation.toString()
}
Else {
$propagation = "None"
}
-
+
If ($params.rights) {
$rights = $params.rights.toString()
}
Else {
Fail-Json $result "missing required argument: rights"
}
-
+
If ($params.state -eq "absent") {
$state = "remove"
}
Else {
$state = "add"
}
-
+
Try {
$colRights = [System.Security.AccessControl.FileSystemRights]$rights
$InheritanceFlag = [System.Security.AccessControl.InheritanceFlags]$inherit
$PropagationFlag = [System.Security.AccessControl.PropagationFlags]$propagation
-
+
If ($type) {
$objType =[System.Security.AccessControl.AccessControlType]::Allow
}
Else {
$objType =[System.Security.AccessControl.AccessControlType]::Deny
}
-
+
$objUser = New-Object System.Security.Principal.NTAccount($user)
$objACE = New-Object System.Security.AccessControl.FileSystemAccessRule ($objUser, $colRights, $InheritanceFlag, $PropagationFlag, $objType)
$objACL = Get-ACL $src
-
+
# Check if the ACE exists already in the objects ACL list
$match = $false
ForEach($rule in $objACL.Access){
@@ -126,7 +186,7 @@ Try {
Break
}
}
-
+
If ($state -eq "add" -And $match -eq $false) {
Try {
$objACL.AddAccessRule($objACE)
@@ -161,5 +221,5 @@ Try {
Catch {
Fail-Json $result "an error occured when attempting to $state $rights permission(s) on $src for $user"
}
-
+
Exit-Json $result
\ No newline at end of file
diff --git a/windows/win_acl.py b/windows/win_acl.py
index 96cfc5751b9..b3ddcce7ac8 100644
--- a/windows/win_acl.py
+++ b/windows/win_acl.py
@@ -24,7 +24,7 @@
DOCUMENTATION = '''
---
module: win_acl
-version_added: ""
+version_added: "2.0"
short_description: Set file/directory permissions for a system user or group.
description:
- Add or remove rights/permissions for a given user or group for the specified src file or folder.
@@ -107,7 +107,7 @@ options:
- InheritOnly
default: "None"
aliases: []
-author: Phil Schwartz
+author: Phil Schwartz, Trond Hindenes
'''
EXAMPLES = '''