cmueller/ansible
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

win_regedit: added function to load a dat file for editing (#31289)

Browse source 
* win_regedit: added function to load a dat file for editing

* try to make the tests more resiliant

* more stability changes
This commit is contained in:
Jordan Borean 2017-10-18 06:30:33 +10:00 committed by GitHub
parent 6c3339402a
commit 743ff4897a
6 changed files with 597 additions and 129 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

230
lib/ansible/modules/windows/win_regedit.ps1
View file

@ -1,24 +1,11 @@
#!powershell
# This file is part of Ansible
#
# (c) 2015, Adam Keech <akeech@chathamfinancial.com>, Josh Ludwig <jludwig@chathamfinancial.com>
# (c) 2017, Jordan Borean <jborean93@gmail.com>
#
# Ansible is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# Ansible is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
# WANT_JSON
# POWERSHELL_COMMON
#Requires -Module Ansible.ModuleUtils.Legacy.psm1
$ErrorActionPreference = "Stop"
@ -32,6 +19,7 @@ $data = Get-AnsibleParam -obj $params -name "data"
$type = Get-AnsibleParam -obj $params -name "type" -type "str" -default "string" -validateset "none","binary","dword","expandstring","multistring","string","qword" -aliases "datatype"
$state = Get-AnsibleParam -obj $params -name "state" -type "str" -default "present" -validateset "present","absent"
$delete_key = Get-AnsibleParam -obj $params -name "delete_key" -type "bool" -default $true
$hive = Get-AnsibleParam -obj $params -name "hive" -type "path"
$result = @{
changed = $false
@ -45,6 +33,147 @@ if ($diff_mode) {
}
}
$registry_util = @'
using System;
using System.Collections.Generic;
using System.Runtime.InteropServices;
namespace Ansible
{
[StructLayout(LayoutKind.Sequential)]
public struct LUID
{
public UInt32 LowPart;
public Int32 HighPart;
}
[StructLayout(LayoutKind.Sequential)]
public struct TOKEN_PRIVILEGES
{
public UInt32 PrivilegeCount;
public LUID Luid;
public UInt32 Attributes;
}
public enum HKEY : uint
{
LOCAL_MACHINE = 0x80000002,
USERS = 0x80000003
}
public class Win32Exception : System.ComponentModel.Win32Exception
{
private string _msg;
public Win32Exception(string message) : this(Marshal.GetLastWin32Error(), message) { }
public Win32Exception(int errorCode, string message) : base(errorCode)
{
_msg = String.Format("{0} ({1}, Win32ErrorCode {2})", message, base.Message, errorCode);
}
public override string Message { get { return _msg; } }
public static explicit operator Win32Exception(string message) { return new Win32Exception(message); }
}
public class RegistryUtil
{
public const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
public const int TOKEN_QUERY = 0x00000008;
public const int SE_PRIVILEGE_ENABLED = 0x00000002;
[DllImport("kernel32.dll", CharSet = CharSet.Auto)]
private static extern IntPtr GetCurrentProcess();
[DllImport("kernel32.dll", CharSet = CharSet.Auto)]
private static extern bool CloseHandle(
IntPtr hObject);
[DllImport("advapi32.dll", CharSet = CharSet.Auto)]
private static extern bool OpenProcessToken(
IntPtr ProcessHandle,
UInt32 DesiredAccess,
out IntPtr TokenHandle);
[DllImport("advapi32.dll", CharSet = CharSet.Auto)]
private static extern bool LookupPrivilegeValue(
string lpSystemName,
string lpName,
[MarshalAs(UnmanagedType.Struct)] out LUID lpLuid);
[DllImport("advapi32.dll", CharSet = CharSet.Auto)]
private static extern bool AdjustTokenPrivileges(
IntPtr TokenHandle,
[MarshalAs(UnmanagedType.Bool)] bool DisableAllPrivileges,
ref TOKEN_PRIVILEGES NewState,
UInt32 BufferLength,
IntPtr PreviousState,
IntPtr ReturnLength);
[DllImport("advapi32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern int RegLoadKey(
HKEY hKey,
string lpSubKey,
string lpFile);
[DllImport("advapi32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern int RegUnLoadKey(
HKEY hKey,
string lpSubKey);
public static void EnablePrivileges()
{
List<String> privileges = new List<String>()
{
"SeRestorePrivilege",
"SeBackupPrivilege"
};
foreach (string privilege in privileges)
{
IntPtr hToken;
LUID luid;
TOKEN_PRIVILEGES tkpPrivileges;
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, out hToken))
throw new Win32Exception("OpenProcessToken() failed");
try
{
if (!LookupPrivilegeValue(null, privilege, out luid))
throw new Win32Exception("LookupPrivilegeValue() failed");
tkpPrivileges.PrivilegeCount = 1;
tkpPrivileges.Luid = luid;
tkpPrivileges.Attributes = SE_PRIVILEGE_ENABLED;
if (!AdjustTokenPrivileges(hToken, false, ref tkpPrivileges, 0, IntPtr.Zero, IntPtr.Zero))
throw new Win32Exception(String.Format("AdjustTokenPrivileges() failed to adjust privilege {0}", privilege));
}
finally
{
CloseHandle(hToken);
}
}
}
public static void LoadHive(string lpSubKey, string lpFile)
{
int ret;
ret = RegLoadKey(HKEY.LOCAL_MACHINE, lpSubKey, lpFile);
if (ret != 0)
throw new Win32Exception(ret, String.Format("Failed to load registry hive at {0}", lpFile));
}
public static void UnloadHive(string lpSubKey)
{
GC.Collect();
int ret;
ret = RegUnLoadKey(HKEY.LOCAL_MACHINE, lpSubKey);
if (ret != 0)
throw new Win32Exception(ret, String.Format("Failed to unload registry hive at {0}", lpSubKey));
}
}
}
'@
# Fix HCCC:\ PSDrive for pre-2.3 compatibility
if ($path -match "^HCCC:\\") {
Add-DeprecationWarning -obj $result -message "Please use path: HKCC:\... instead of path: $path" -version 2.6
@ -110,7 +239,8 @@ Function Test-RegistryProperty($path, $name) {
# will validate if the registry key contains the property, returns true
# if the property exists and false if the property does not
try {
$value = (Get-Item -Path $path).GetValue($name)
$reg_key = Get-Item -Path $path
$value = $reg_key.GetValue($name)
# need to do it this way return ($value -eq $null) does not work
if ($value -eq $null) {
return $false
@ -120,6 +250,10 @@ Function Test-RegistryProperty($path, $name) {
} catch [System.Management.Automation.ItemNotFoundException] {
# key didn't exist so the property mustn't
return $false
} finally {
if ($reg_key) {
$reg_key.Close()
}
}
}
@ -235,17 +369,48 @@ if ($type -in @("binary", "none")) {
}
}
# convert the type string to the .NET class
$type = [System.Enum]::Parse([Microsoft.Win32.RegistryValueKind], $type, $true)
if ($hive) {
if (-not (Test-Path $hive)) {
Fail-Json -obj $result -message "hive at path '$hive' is not valid or accessible, cannot load hive"
}
Add-Type -TypeDefinition $registry_util
try {
[Ansible.RegistryUtil]::EnablePrivileges()
} catch [System.ComponentModel.Win32Exception] {
Fail-Json -obj $result -message "failed to enable SeRestorePrivilege and SeRestorePrivilege for the current process: $($_.Exception.Message)"
}
if (Test-Path -Path HKLM:\ANSIBLE) {
Add-Warning -obj $result -message "hive already loaded at HKLM:\ANSIBLE, had to unload hive for win_regedit to continue"
try {
[Ansible.RegistryUtil]::UnloadHive("ANSIBLE")
} catch [System.ComponentModel.Win32Exception] {
Fail-Json -obj $result -message "failed to unload registry hive HKLM:\ANSIBLE from $($hive): $($_.Exception.Message)"
}
}
try {
[Ansible.RegistryUtil]::LoadHive("ANSIBLE", $hive)
} catch [System.ComponentModel.Win32Exception] {
Fail-Json -obj $result -message "failed to load registry hive from '$hive' to HKLM:\ANSIBLE: $($_.Exception.Message)"
}
}
try {
if ($state -eq "present") {
if (-not (Test-Path -path $path)) {
# the key doesn't exist, create it so the next steps work
try {
$null = New-Item -Path $path -Type directory -Force -WhatIf:$check_mode
$new_key = New-Item -Path $path -Type directory -Force -WhatIf:$check_mode
} catch {
Fail-Json $result "failed to create registry key at $($path): $($_.Exception.Message)"
} finally {
if ($new_key) {
$new_key.Close()
}
}
$result.changed = $true
@ -261,6 +426,7 @@ if ($state -eq "present") {
$existing_key = Get-Item -Path $path
$existing_type = $existing_key.GetValueKind($name)
$existing_data = $existing_key.GetValue($name, $false, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
$existing_key.Close()
$change_value = $false
if ($type -ne $existing_type) {
@ -280,10 +446,13 @@ if ($state -eq "present") {
if ($change_value) {
if (-not $check_mode) {
$reg_key = Get-Item -Path $path
try {
(Get-Item -Path $path).OpenSubKey($null, [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree).SetValue($name, $data, $type)
$reg_key.OpenSubKey($null, [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree).SetValue($name, $data, $type)
} catch {
Fail-Json $result "failed to change registry property '$name' at $($path): $($_.Exception.Message)"
} finally {
$reg_key.Close()
}
}
$result.changed = $true
@ -305,10 +474,13 @@ $key_prefix[$path]
} else {
# property doesn't exist just create a new one
if (-not $check_mode) {
$reg_key = Get-Item -Path $path
try {
(Get-Item -Path $path).OpenSubKey($null, [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree).SetValue($name, $data, $type)
$reg_key.OpenSubKey($null, [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree).SetValue($name, $data, $type)
} catch {
Fail-Json $result "failed to change registry property '$name' at $($path): $($_.Exception.Message)"
} finally {
$reg_key.Close()
}
}
$result.changed = $true
@ -347,13 +519,17 @@ $key_prefix[$path]
$existing_key = Get-Item -Path $path
$existing_type = $existing_key.GetValueKind($name)
$existing_data = $existing_key.GetValue($name, $false, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
$existing_key.Close()
# cannot use Remove-ItemProperty as it fails when deleting the (Default) key ($name = $null)
if (-not $check_mode) {
$reg_key = Get-Item -Path $path
try {
(Get-Item -Path $path).OpenSubKey($null, [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree).DeleteValue($name)
$reg_key.OpenSubKey($null, [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree).DeleteValue($name)
} catch {
Fail-Json $result "failed to delete registry property '$name' at $($path): $($_.Exception.Message)"
} finally {
$reg_key.Close()
}
}
$result.changed = $true
@ -368,5 +544,15 @@ $key_prefix[$path]
}
}
}
} finally {
if ($hive) {
[GC]::Collect()
try {
[Ansible.RegistryUtil]::UnloadHive("ANSIBLE")
} catch [System.ComponentModel.Win32Exception] {
Fail-Json -obj $result -message "failed to unload registry hive HKLM:\ANSIBLE from $($hive): $($_.Exception.Message)"
}
}
}
Exit-Json $result

22
lib/ansible/modules/windows/win_regedit.py
View file

@ -83,10 +83,21 @@ options:
type: bool
default: 'yes'
version_added: '2.4'
hive:
description:
- A path to a hive key like C:\Users\Default\NTUSER.DAT to load in the
registry.
- This hive is loaded under the HKLM:\ANSIBLE key which can then be used
in I(name) like any other path.
- This can be used to load the default user profile registry hive or any
other hive saved as a file.
- Using this function requires the user to have the C(SeRestorePrivilege)
and C(SeBackupPrivilege) privileges enabled.
version_added: '2.5'
notes:
- Check-mode C(-C/--check) and diff output C(-D/--diff) are supported, so that you can test every change against the active configuration before
applying changes.
- Beware that some registry hives (C(HKEY_USERS) in particular) do not allow to create new registry paths.
- Beware that some registry hives (C(HKEY_USERS) in particular) do not allow to create new registry paths in the root folder.
- Since ansible 2.4, when checking if a string registry value has changed, a case-sensitive test is used. Previously the test was case-insensitive.
author:
- Adam Keech (@smadam813)
@ -178,6 +189,15 @@ EXAMPLES = r'''
path: HKCU:\Software\MyCompany
name: hello
state: absent
- name: Change default mouse trailing settings for new users
win_regedit:
path: HKLM:\ANSIBLE\Control Panel\Mouse
name: MouseTrails
data: 10
type: string
state: present
hive: C:\Users\Default\NTUSER.dat
'''
RETURN = r'''

1
test/integration/targets/win_regedit/defaults/main.yml
View file

@ -1,2 +1,3 @@
test_win_regedit_local_key: HKLM:\Software\Cow Corp
test_win_regedit_classes_key: HKCR:\.test-ansible
test_win_regedit_hive_key: HKLM:\ANSIBLE\NewKey

18
test/integration/targets/win_regedit/tasks/cleanup.yml Normal file
View file

@ -0,0 +1,18 @@
---
- name: load HKLM:\ANSIBLE with test hive
win_command: reg.exe load HKLM\ANSIBLE C:\Users\Default\NTUSER.dat
failed_when: false
- name: make sure testing keys are removed before test
win_regedit:
path: '{{item}}'
delete_key: yes
state: absent
with_items:
- '{{test_win_regedit_local_key}}'
- '{{test_win_regedit_classes_key}}'
- '{{test_win_regedit_hive_key}}'
- name: ensure HKLM:\ANSIBLE is unloaded
win_command: reg.exe unload HKLM\ANSIBLE
failed_when: false

18
test/integration/targets/win_regedit/tasks/main.yml
View file

@ -1,12 +1,6 @@
---
- name: make sure testing keys are removed before test
win_regedit:
path: '{{item}}'
delete_key: yes
state: absent
with_items:
- '{{test_win_regedit_local_key}}'
- '{{test_win_regedit_classes_key}}'
- name: make sure we start on a blank state
include_tasks: cleanup.yml
- block:
- name: run tests for each property type
@ -81,10 +75,4 @@
always:
- name: make sure testing keys are removed after test
win_regedit:
path: '{{item}}'
delete_key: yes
state: absent
with_items:
- '{{test_win_regedit_local_key}}'
- '{{test_win_regedit_classes_key}}'
include_tasks: cleanup.yml

255
test/integration/targets/win_regedit/tasks/tests.yml
View file

@ -458,3 +458,258 @@
assert:
that:
- not create_prop_with_json_again|changed
- name: create new key in loaded hive (check mode)
win_regedit:
path: '{{test_win_regedit_hive_key}}'
state: present
hive: C:\Users\Default\NTUSER.dat
register: new_key_in_hive_check
check_mode: yes
- name: get result of create new key in loaded hive (check mode)
win_shell: |
&reg.exe load HKLM\ANSIBLE C:\Users\Default\NTUSER.dat > $null
Test-Path -Path HKLM:\ANSIBLE\NewKey
exit 0
register: new_key_in_hive_result_check
- win_command: reg.exe unload HKLM\ANSIBLE
- name: assert result of create new key in loaded hive (check mode)
assert:
that:
- new_key_in_hive_check|changed
- new_key_in_hive_result_check.stdout == "False\r\n"
- name: create new key in loaded hive
win_regedit:
path: '{{test_win_regedit_hive_key}}'
state: present
hive: C:\Users\Default\NTUSER.dat
register: new_key_in_hive
- name: get result of create new key in loaded hive
win_shell: |
&reg.exe load HKLM\ANSIBLE C:\Users\Default\NTUSER.dat > $null
Test-Path -Path HKLM:\ANSIBLE\NewKey
exit 0
register: new_key_in_hive_result
- win_command: reg.exe unload HKLM\ANSIBLE
- name: assert result of create new key in loaded hive
assert:
that:
- new_key_in_hive|changed
- new_key_in_hive_result.stdout == "True\r\n"
- name: create new key in loaded hive (idempotent)
win_regedit:
path: '{{test_win_regedit_hive_key}}'
state: present
hive: C:\Users\Default\NTUSER.dat
register: new_key_in_hive_again
- name: assert result of create new key in loaded hive (idempotent)
assert:
that:
- not new_key_in_hive_again|changed
- name: set hive key property (check mode)
win_regedit:
path: '{{test_win_regedit_hive_key}}'
name: TestProp
data: string
type: string
state: present
hive: C:\Users\Default\NTUSER.dat
register: new_prop_in_hive_check
check_mode: yes
- name: get result of set hive key property (check mode)
win_shell: |
&reg.exe load HKLM\ANSIBLE C:\Users\Default\NTUSER.dat > $null
$prop = Get-ItemProperty -Path HKLM:\ANSIBLE\NewKey -Name TestProp -ErrorAction SilentlyContinue
if ($prop) {
$prop.TestProp
}
exit 0
register: new_prop_in_hive_result_check
- win_command: reg.exe unload HKLM\ANSIBLE
- name: assert result of set hive key property (check mode)
assert:
that:
- new_prop_in_hive_check|changed
- new_prop_in_hive_result_check.stdout == ""
- name: set hive key property
win_regedit:
path: '{{test_win_regedit_hive_key}}'
name: TestProp
data: string
type: string
state: present
hive: C:\Users\Default\NTUSER.dat
register: new_prop_in_hive
- name: get result of set hive key property
win_shell: |
&reg.exe load HKLM\ANSIBLE C:\Users\Default\NTUSER.dat > $null
$prop = Get-ItemProperty -Path HKLM:\ANSIBLE\NewKey -Name TestProp -ErrorAction SilentlyContinue
if ($prop) {
$prop.TestProp
}
exit 0
register: new_prop_in_hive_result
- win_command: reg.exe unload HKLM\ANSIBLE
- name: assert result of set hive key property
assert:
that:
- new_prop_in_hive|changed
- new_prop_in_hive_result.stdout == "string\r\n"
- name: set hive key property (idempotent)
win_regedit:
path: '{{test_win_regedit_hive_key}}'
name: TestProp
data: string
type: string
state: present
hive: C:\Users\Default\NTUSER.dat
register: new_prop_in_hive_again
- name: assert result of set hive key property (idempotent)
assert:
that:
- not new_prop_in_hive_again|changed
- name: remove hive key property (check mode)
win_regedit:
path: '{{test_win_regedit_hive_key}}'
name: TestProp
state: absent
hive: C:\Users\Default\NTUSER.dat
register: remove_prop_in_hive_check
check_mode: yes
- name: get result of remove hive key property (check mode)
win_shell: |
&reg.exe load HKLM\ANSIBLE C:\Users\Default\NTUSER.dat > $null
$prop = Get-ItemProperty -Path HKLM:\ANSIBLE\NewKey -Name TestProp -ErrorAction SilentlyContinue
if ($prop) {
$prop.TestProp
}
exit 0
register: remove_prop_in_hive_result_check
- win_command: reg.exe unload HKLM\ANSIBLE
- name: assert result of remove hive key property (check mode)
assert:
that:
- remove_prop_in_hive_check|changed
- remove_prop_in_hive_result_check.stdout == "string\r\n"
- name: remove hive key property
win_regedit:
path: '{{test_win_regedit_hive_key}}'
name: TestProp
state: absent
hive: C:\Users\Default\NTUSER.dat
register: remove_prop_in_hive
- name: get result of remove hive key property
win_shell: |
&reg.exe load HKLM\ANSIBLE C:\Users\Default\NTUSER.dat > $null
$prop = Get-ItemProperty -Path HKLM:\ANSIBLE\NewKey -Name TestProp -ErrorAction SilentlyContinue
if ($prop) {
$prop.TestProp
}
exit 0
register: remove_prop_in_hive_result
- win_command: reg.exe unload HKLM\ANSIBLE
- name: assert result of remove hive key property
assert:
that:
- remove_prop_in_hive|changed
- remove_prop_in_hive_result.stdout == ""
- name: remove hive key property (idempotent)
win_regedit:
path: '{{test_win_regedit_hive_key}}'
name: TestProp
state: absent
hive: C:\Users\Default\NTUSER.dat
register: remove_prop_in_hive_again
- name: assert result of set hive key property (idempotent)
assert:
that:
- not remove_prop_in_hive_again|changed
- name: remove key in loaded hive (check mode)
win_regedit:
path: '{{test_win_regedit_hive_key}}'
state: absent
delete_yes: yes
hive: C:\Users\Default\NTUSER.dat
register: remove_key_in_hive_check
check_mode: yes
- name: get result of remove key in loaded hive (check mode)
win_shell: |
&reg.exe load HKLM\ANSIBLE C:\Users\Default\NTUSER.dat > $null
Test-Path -Path HKLM:\ANSIBLE\NewKey
exit 0
register: remove_key_in_hive_result_check
- win_command: reg.exe unload HKLM\ANSIBLE
- name: assert result of removekey in loaded hive (check mode)
assert:
that:
- remove_key_in_hive_check|changed
- remove_key_in_hive_result_check.stdout == "True\r\n"
- name: remove key in loaded hive
win_regedit:
path: '{{test_win_regedit_hive_key}}'
state: absent
delete_yes: yes
hive: C:\Users\Default\NTUSER.dat
register: remove_key_in_hive
- name: get result of remove key in loaded hive
win_shell: |
&reg.exe load HKLM\ANSIBLE C:\Users\Default\NTUSER.dat > $null
Test-Path -Path HKLM:\ANSIBLE\NewKey
exit 0
register: remove_key_in_hive_result
- win_command: reg.exe unload HKLM\ANSIBLE
- name: assert result of remove key in loaded hive
assert:
that:
- remove_key_in_hive|changed
- remove_key_in_hive_result.stdout == "False\r\n"
- name: remove key in loaded hive (idempotent)
win_regedit:
path: '{{test_win_regedit_hive_key}}'
state: absent
delete_yes: yes
hive: C:\Users\Default\NTUSER.dat
register: remove_key_in_hive_again
- name: assert result of remove key in loaded hive (idempotent)
assert:
that:
- not remove_key_in_hive_again|changed