From 95d613f3ab376af8c06399d256d931c6c00c21d6 Mon Sep 17 00:00:00 2001 From: P-Hessler <43963088+P-Hessler@users.noreply.github.com> Date: Wed, 13 Nov 2019 00:54:57 +0100 Subject: [PATCH] win_acl no longer needs SeSecurityPrivilege (#57804) * win_acl no longer needs SeSecurityPrivilege Set-ACL raises missing SeSecurityPrivilege error when the inheritance from the parent directory is disabled. * fixes test sanity * registry rights can only be modified with Set-ACL * add changelog --- ...4-win_acl-no-longer-needs-SeSecurityPrivilege.yml | 2 ++ lib/ansible/modules/windows/win_acl.ps1 | 12 ++++++++++-- 2 files changed, 12 insertions(+), 2 deletions(-) create mode 100644 changelogs/fragments/57804-win_acl-no-longer-needs-SeSecurityPrivilege.yml diff --git a/changelogs/fragments/57804-win_acl-no-longer-needs-SeSecurityPrivilege.yml b/changelogs/fragments/57804-win_acl-no-longer-needs-SeSecurityPrivilege.yml new file mode 100644 index 00000000000..4f210d4d6b8 --- /dev/null +++ b/changelogs/fragments/57804-win_acl-no-longer-needs-SeSecurityPrivilege.yml @@ -0,0 +1,2 @@ +bugfixes: + - win_acl - Fixed error when setting rights on directory for which inheritance from parent directory has been disabled. diff --git a/lib/ansible/modules/windows/win_acl.ps1 b/lib/ansible/modules/windows/win_acl.ps1 index 8fc344bfc16..e3c3813038d 100644 --- a/lib/ansible/modules/windows/win_acl.ps1 +++ b/lib/ansible/modules/windows/win_acl.ps1 @@ -176,7 +176,11 @@ Try { If ($state -eq "present" -And $match -eq $false) { Try { $objACL.AddAccessRule($objACE) - Set-ACL -LiteralPath $path -AclObject $objACL + If ($path_item.PSProvider.Name -eq "Registry") { + Set-ACL -LiteralPath $path -AclObject $objACL + } else { + (Get-Item -LiteralPath $path).SetAccessControl($objACL) + } $result.changed = $true } Catch { @@ -186,7 +190,11 @@ Try { ElseIf ($state -eq "absent" -And $match -eq $true) { Try { $objACL.RemoveAccessRule($objACE) - Set-ACL -LiteralPath $path -AclObject $objACL + If ($path_item.PSProvider.Name -eq "Registry") { + Set-ACL -LiteralPath $path -AclObject $objACL + } else { + (Get-Item -LiteralPath $path).SetAccessControl($objACL) + } $result.changed = $true } Catch {