bolt 0.24.0 → 0.25.0

data/vendored/puppet/lib/puppet/util/windows/sid.rb

@@ -1,282 +0,0 @@
-require 'puppet/util/windows'
-
-module Puppet::Util::Windows
-  module SID
-    require 'ffi'
-    extend FFI::Library
-
-    # missing from Windows::Error
-    ERROR_NONE_MAPPED           = 1332
-    ERROR_INVALID_SID_STRUCTURE = 1337
-
-    # Well Known SIDs
-    Null                        = 'S-1-0'
-    Nobody                      = 'S-1-0-0'
-    World                       = 'S-1-1'
-    Everyone                    = 'S-1-1-0'
-    Local                       = 'S-1-2'
-    Creator                     = 'S-1-3'
-    CreatorOwner                = 'S-1-3-0'
-    CreatorGroup                = 'S-1-3-1'
-    CreatorOwnerServer          = 'S-1-3-2'
-    CreatorGroupServer          = 'S-1-3-3'
-    NonUnique                   = 'S-1-4'
-    Nt                          = 'S-1-5'
-    Dialup                      = 'S-1-5-1'
-    Network                     = 'S-1-5-2'
-    Batch                       = 'S-1-5-3'
-    Interactive                 = 'S-1-5-4'
-    Service                     = 'S-1-5-6'
-    Anonymous                   = 'S-1-5-7'
-    Proxy                       = 'S-1-5-8'
-    EnterpriseDomainControllers = 'S-1-5-9'
-    PrincipalSelf               = 'S-1-5-10'
-    AuthenticatedUsers          = 'S-1-5-11'
-    RestrictedCode              = 'S-1-5-12'
-    TerminalServerUsers         = 'S-1-5-13'
-    LocalSystem                 = 'S-1-5-18'
-    NtLocal                     = 'S-1-5-19'
-    NtNetwork                   = 'S-1-5-20'
-    BuiltinAdministrators       = 'S-1-5-32-544'
-    BuiltinUsers                = 'S-1-5-32-545'
-    Guests                      = 'S-1-5-32-546'
-    PowerUsers                  = 'S-1-5-32-547'
-    AccountOperators            = 'S-1-5-32-548'
-    ServerOperators             = 'S-1-5-32-549'
-    PrintOperators              = 'S-1-5-32-550'
-    BackupOperators             = 'S-1-5-32-551'
-    Replicators                 = 'S-1-5-32-552'
-
-    # Convert an account name, e.g. 'Administrators' into a SID string,
-    # e.g. 'S-1-5-32-544'. The name can be specified as 'Administrators',
-    # 'BUILTIN\Administrators', or 'S-1-5-32-544', and will return the
-    # SID. Returns nil if the account doesn't exist.
-    def name_to_sid(name)
-      sid = name_to_principal(name)
-
-      sid ? sid.sid : nil
-    end
-    module_function :name_to_sid
-
-    # Convert an account name, e.g. 'Administrators' into a Principal::SID object,
-    # e.g. 'S-1-5-32-544'. The name can be specified as 'Administrators',
-    # 'BUILTIN\Administrators', or 'S-1-5-32-544', and will return the
-    # SID object. Returns nil if the account doesn't exist.
-    # This method returns a SID::Principal with the account, domain, SID, etc
-    def name_to_principal(name)
-      # Apparently, we accept a symbol..
-      name = name.to_s.strip if name
-
-      # if name is a SID string, convert it to raw bytes for use with lookup_account_sid
-      raw_sid_bytes = nil
-      begin
-        string_to_sid_ptr(name) do |sid_ptr|
-          raw_sid_bytes = sid_ptr.read_array_of_uchar(get_length_sid(sid_ptr))
-        end
-      rescue
-      end
-
-      raw_sid_bytes ? Principal.lookup_account_sid(raw_sid_bytes) : Principal.lookup_account_name(name)
-    rescue
-      nil
-    end
-    module_function :name_to_principal
-    class << self; alias name_to_sid_object name_to_principal; end
-
-    # Converts an octet string array of bytes to a SID::Principal object,
-    # e.g. [1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0] is the representation for
-    # S-1-5-18, the local 'SYSTEM' account.
-    # Raises an Error for nil or non-array input.
-    # This method returns a SID::Principal with the account, domain, SID, etc
-    def octet_string_to_principal(bytes)
-      if !bytes || !bytes.respond_to?('pack') || bytes.empty?
-        raise Puppet::Util::Windows::Error.new(_("Octet string must be an array of bytes"))
-      end
-
-      Principal.lookup_account_sid(bytes)
-    end
-    module_function :octet_string_to_principal
-    class << self; alias octet_string_to_sid_object octet_string_to_principal; end
-
-    # Converts a COM instance of IAdsUser or IAdsGroup to a SID::Principal object,
-    # Raises an Error for nil or an object without an objectSID / Name property.
-    # This method returns a SID::Principal with the account, domain, SID, etc
-    # This method will return instances even when the SID is unresolvable, as
-    # may be the case when domain users have been added to local groups, but
-    # removed from the domain
-    def ads_to_principal(ads_object)
-      if !ads_object || !ads_object.respond_to?(:ole_respond_to?) ||
-        !ads_object.ole_respond_to?(:objectSID) || !ads_object.ole_respond_to?(:Name)
-        raise Puppet::Error.new("ads_object must be an IAdsUser or IAdsGroup instance")
-      end
-      octet_string_to_principal(ads_object.objectSID)
-    rescue Puppet::Util::Windows::Error => e
-      # if the error is not a lookup / mapping problem, immediately re-raise
-      raise if e.code != ERROR_NONE_MAPPED
-
-      # if the Name property isn't formatted like a SID, OR
-      if !valid_sid?(ads_object.Name) ||
-        # if the objectSID doesn't match the Name property, also raise
-        ((converted = octet_string_to_sid_string(ads_object.objectSID)) != ads_object.Name)
-        raise Puppet::Error.new("ads_object Name: #{ads_object.Name} invalid or does not match objectSID: #{ads_object.objectSID} (#{converted})", e)
-      end
-
-      unresolved_principal(ads_object.Name, ads_object.objectSID)
-    end
-    module_function :ads_to_principal
-
-    # Convert a SID string, e.g. "S-1-5-32-544" to a name,
-    # e.g. 'BUILTIN\Administrators'. Returns nil if an account
-    # for that SID does not exist.
-    def sid_to_name(value)
-
-      sid_bytes = []
-      begin
-        string_to_sid_ptr(value) do |ptr|
-          sid_bytes = ptr.read_array_of_uchar(get_length_sid(ptr))
-        end
-      rescue Puppet::Util::Windows::Error => e
-        raise if e.code != ERROR_INVALID_SID_STRUCTURE
-      end
-
-      Principal.lookup_account_sid(sid_bytes).domain_account
-    rescue
-      nil
-    end
-    module_function :sid_to_name
-
-    # https://stackoverflow.com/a/1792930 - 68 bytes, 184 characters in a string
-    MAXIMUM_SID_STRING_LENGTH = 184
-
-    # Convert a SID pointer to a SID string, e.g. "S-1-5-32-544".
-    def sid_ptr_to_string(psid)
-      if ! psid.kind_of?(FFI::Pointer) || IsValidSid(psid) == FFI::WIN32_FALSE
-        raise Puppet::Util::Windows::Error.new(_("Invalid SID"))
-      end
-
-      sid_string = nil
-      FFI::MemoryPointer.new(:pointer, 1) do |buffer_ptr|
-        if ConvertSidToStringSidW(psid, buffer_ptr) == FFI::WIN32_FALSE
-          raise Puppet::Util::Windows::Error.new(_("Failed to convert binary SID"))
-        end
-
-        buffer_ptr.read_win32_local_pointer do |wide_string_ptr|
-          if wide_string_ptr.null?
-            raise Puppet::Error.new(_("ConvertSidToStringSidW failed to allocate buffer for sid"))
-          end
-
-          sid_string = wide_string_ptr.read_arbitrary_wide_string_up_to(MAXIMUM_SID_STRING_LENGTH)
-        end
-      end
-
-      sid_string
-    end
-    module_function :sid_ptr_to_string
-
-    # Convert a SID string, e.g. "S-1-5-32-544" to a pointer (containing the
-    # address of the binary SID structure). The returned value can be used in
-    # Win32 APIs that expect a PSID, e.g. IsValidSid. The account for this
-    # SID may or may not exist.
-    def string_to_sid_ptr(string_sid, &block)
-      FFI::MemoryPointer.from_string_to_wide_string(string_sid) do |lpcwstr|
-        FFI::MemoryPointer.new(:pointer, 1) do |sid_ptr_ptr|
-
-          if ConvertStringSidToSidW(lpcwstr, sid_ptr_ptr) == FFI::WIN32_FALSE
-            raise Puppet::Util::Windows::Error.new(_("Failed to convert string SID: %{string_sid}") % { string_sid: string_sid })
-          end
-
-          sid_ptr_ptr.read_win32_local_pointer do |sid_ptr|
-            yield sid_ptr
-          end
-        end
-      end
-
-      # yielded sid_ptr has already had LocalFree called, nothing to return
-      nil
-    end
-    module_function :string_to_sid_ptr
-
-    # Return true if the string is a valid SID, e.g. "S-1-5-32-544", false otherwise.
-    def valid_sid?(string_sid)
-      valid = false
-
-      begin
-        string_to_sid_ptr(string_sid) { |ptr| valid = ! ptr.nil? && ! ptr.null? }
-      rescue Puppet::Util::Windows::Error => e
-        raise if e.code != ERROR_INVALID_SID_STRUCTURE
-      end
-
-      valid
-    end
-    module_function :valid_sid?
-
-    def get_length_sid(sid_ptr)
-      # MSDN states IsValidSid should be called on pointer first
-      if ! sid_ptr.kind_of?(FFI::Pointer) || IsValidSid(sid_ptr) == FFI::WIN32_FALSE
-        raise Puppet::Util::Windows::Error.new(_("Invalid SID"))
-      end
-
-      GetLengthSid(sid_ptr)
-    end
-    module_function :get_length_sid
-
-    def octet_string_to_sid_string(sid_bytes)
-      sid_string = nil
-
-      FFI::MemoryPointer.new(:byte, sid_bytes.length) do |sid_ptr|
-        sid_ptr.write_array_of_uchar(sid_bytes)
-        sid_string = Puppet::Util::Windows::SID.sid_ptr_to_string(sid_ptr)
-      end
-
-      sid_string
-    end
-    module_function :octet_string_to_sid_string
-
-    # @api private
-    def self.unresolved_principal(name, sid_bytes)
-      Principal.new(
-        name + " (unresolvable)", # account
-        sid_bytes, # sid_bytes
-        name, # sid string
-        nil, #domain
-        # https://msdn.microsoft.com/en-us/library/cc245534.aspx?f=255&MSPPError=-2147217396
-        # Indicates that the type of object could not be determined. For example, no object with that SID exists.
-        :SidTypeUnknown)
-    end
-
-    ffi_convention :stdcall
-
-    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379151(v=vs.85).aspx
-    # BOOL WINAPI IsValidSid(
-    #   _In_  PSID pSid
-    # );
-    ffi_lib :advapi32
-    attach_function_private :IsValidSid,
-      [:pointer], :win32_bool
-
-    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa376399(v=vs.85).aspx
-    # BOOL ConvertSidToStringSid(
-    #   _In_   PSID Sid,
-    #   _Out_  LPTSTR *StringSid
-    # );
-    ffi_lib :advapi32
-    attach_function_private :ConvertSidToStringSidW,
-      [:pointer, :pointer], :win32_bool
-
-    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa376402(v=vs.85).aspx
-    # BOOL WINAPI ConvertStringSidToSid(
-    #   _In_   LPCTSTR StringSid,
-    #   _Out_  PSID *Sid
-    # );
-    ffi_lib :advapi32
-    attach_function_private :ConvertStringSidToSidW,
-      [:lpcwstr, :pointer], :win32_bool
-
-    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa446642(v=vs.85).aspx
-    # DWORD WINAPI GetLengthSid(
-    #   _In_ PSID pSid
-    # );
-    ffi_lib :advapi32
-    attach_function_private :GetLengthSid, [:pointer], :dword
-  end
-end

data/vendored/puppet/lib/puppet/util/windows/string.rb

@@ -1,16 +0,0 @@
-require 'puppet/util/windows'
-
-module Puppet::Util::Windows::String
-  def wide_string(str)
-    # if given a nil string, assume caller wants to pass a nil pointer to win32
-    return nil if str.nil?
-    # ruby (< 2.1) does not respect multibyte terminators, so it is possible
-    # for a string to contain a single trailing null byte, followed by garbage
-    # causing buffer overruns.
-    #
-    # See http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?revision=41920&view=revision
-    newstr = str + "\0".encode(str.encoding)
-    newstr.encode!('UTF-16LE')
-  end
-  module_function :wide_string
-end

data/vendored/puppet/lib/puppet/util/windows/user.rb

@@ -1,309 +0,0 @@
-require 'puppet/util/windows'
-
-require 'facter'
-require 'ffi'
-
-module Puppet::Util::Windows::User
-  extend Puppet::Util::Windows::String
-  extend FFI::Library
-
-  def admin?
-    elevated_supported = Puppet::Util::Windows::Process.supports_elevated_security?
-
-    # if Vista or later, check for unrestricted process token
-    return Puppet::Util::Windows::Process.elevated_security? if elevated_supported
-
-    # otherwise 2003 or less
-    check_token_membership
-  end
-  module_function :admin?
-
-
-  # https://msdn.microsoft.com/en-us/library/windows/desktop/ee207397(v=vs.85).aspx
-  SECURITY_MAX_SID_SIZE = 68
-
-  # https://msdn.microsoft.com/en-us/library/windows/desktop/ms681385(v=vs.85).aspx
-  # These error codes indicate successful authentication but failure to
-  # logon for a separate reason
-  ERROR_ACCOUNT_RESTRICTION = 1327
-  ERROR_INVALID_LOGON_HOURS = 1328
-  ERROR_INVALID_WORKSTATION = 1329
-  ERROR_ACCOUNT_DISABLED    = 1331
-
-  def check_token_membership
-    is_admin = false
-    FFI::MemoryPointer.new(:byte, SECURITY_MAX_SID_SIZE) do |sid_pointer|
-      FFI::MemoryPointer.new(:dword, 1) do |size_pointer|
-        size_pointer.write_uint32(SECURITY_MAX_SID_SIZE)
-
-        if CreateWellKnownSid(:WinBuiltinAdministratorsSid, FFI::Pointer::NULL, sid_pointer, size_pointer) == FFI::WIN32_FALSE
-          raise Puppet::Util::Windows::Error.new(_("Failed to create administrators SID"))
-        end
-      end
-
-      if IsValidSid(sid_pointer) == FFI::WIN32_FALSE
-        raise Puppet::Util::Windows::Error.new(_("Invalid SID"))
-      end
-
-      FFI::MemoryPointer.new(:win32_bool, 1) do |ismember_pointer|
-        if CheckTokenMembership(FFI::Pointer::NULL_HANDLE, sid_pointer, ismember_pointer) == FFI::WIN32_FALSE
-          raise Puppet::Util::Windows::Error.new(_("Failed to check membership"))
-        end
-
-        # Is administrators SID enabled in calling thread's access token?
-        is_admin = ismember_pointer.read_win32_bool
-      end
-    end
-
-    is_admin
-  end
-  module_function :check_token_membership
-
-  def password_is?(name, password)
-    begin
-      logon_user(name, password) { |token| }
-    rescue Puppet::Util::Windows::Error => detail
-
-      authenticated_error_codes = Set[
-        ERROR_ACCOUNT_RESTRICTION,
-        ERROR_INVALID_LOGON_HOURS,
-        ERROR_INVALID_WORKSTATION,
-        ERROR_ACCOUNT_DISABLED,
-      ]
-
-      return authenticated_error_codes.include?(detail.code)
-    end
-  end
-  module_function :password_is?
-
-  def logon_user(name, password, &block)
-    fLOGON32_LOGON_NETWORK = 3
-    fLOGON32_PROVIDER_DEFAULT = 0
-
-    token = nil
-    begin
-      FFI::MemoryPointer.new(:handle, 1) do |token_pointer|
-        if LogonUserW(wide_string(name), wide_string('.'), password.nil? ? FFI::Pointer::NULL : wide_string(password),
-            fLOGON32_LOGON_NETWORK, fLOGON32_PROVIDER_DEFAULT, token_pointer) == FFI::WIN32_FALSE
-          raise Puppet::Util::Windows::Error.new(_("Failed to logon user %{name}") % { name: name.inspect })
-        end
-
-        yield token = token_pointer.read_handle
-      end
-    ensure
-      FFI::WIN32.CloseHandle(token) if token
-    end
-
-    # token has been closed by this point
-    true
-  end
-  module_function :logon_user
-
-  def load_profile(user, password)
-    logon_user(user, password) do |token|
-      FFI::MemoryPointer.from_string_to_wide_string(user) do |lpUserName|
-        pi = PROFILEINFO.new
-        pi[:dwSize] = PROFILEINFO.size
-        pi[:dwFlags] = 1 # PI_NOUI - prevents display of profile error msgs
-        pi[:lpUserName] = lpUserName
-
-        # Load the profile. Since it doesn't exist, it will be created
-        if LoadUserProfileW(token, pi.pointer) == FFI::WIN32_FALSE
-          raise Puppet::Util::Windows::Error.new(_("Failed to load user profile %{user}") % { user: user.inspect })
-        end
-
-        Puppet.debug("Loaded profile for #{user}")
-
-        if UnloadUserProfile(token, pi[:hProfile]) == FFI::WIN32_FALSE
-          raise Puppet::Util::Windows::Error.new(_("Failed to unload user profile %{user}") % { user: user.inspect })
-        end
-      end
-    end
-  end
-  module_function :load_profile
-
-  ffi_convention :stdcall
-
-  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa378184(v=vs.85).aspx
-  # BOOL LogonUser(
-  #   _In_      LPTSTR lpszUsername,
-  #   _In_opt_  LPTSTR lpszDomain,
-  #   _In_opt_  LPTSTR lpszPassword,
-  #   _In_      DWORD dwLogonType,
-  #   _In_      DWORD dwLogonProvider,
-  #   _Out_     PHANDLE phToken
-  # );
-  ffi_lib :advapi32
-  attach_function_private :LogonUserW,
-    [:lpwstr, :lpwstr, :lpwstr, :dword, :dword, :phandle], :win32_bool
-
-  # https://msdn.microsoft.com/en-us/library/windows/desktop/bb773378(v=vs.85).aspx
-  # typedef struct _PROFILEINFO {
-  #   DWORD  dwSize;
-  #   DWORD  dwFlags;
-  #   LPTSTR lpUserName;
-  #   LPTSTR lpProfilePath;
-  #   LPTSTR lpDefaultPath;
-  #   LPTSTR lpServerName;
-  #   LPTSTR lpPolicyPath;
-  #   HANDLE hProfile;
-  # } PROFILEINFO, *LPPROFILEINFO;
-  # technically
-  # NOTE: that for structs, buffer_* (lptstr alias) cannot be used
-  class PROFILEINFO < FFI::Struct
-    layout :dwSize, :dword,
-           :dwFlags, :dword,
-           :lpUserName, :pointer,
-           :lpProfilePath, :pointer,
-           :lpDefaultPath, :pointer,
-           :lpServerName, :pointer,
-           :lpPolicyPath, :pointer,
-           :hProfile, :handle
-  end
-
-  # https://msdn.microsoft.com/en-us/library/windows/desktop/bb762281(v=vs.85).aspx
-  # BOOL WINAPI LoadUserProfile(
-  #   _In_     HANDLE hToken,
-  #   _Inout_  LPPROFILEINFO lpProfileInfo
-  # );
-  ffi_lib :userenv
-  attach_function_private :LoadUserProfileW,
-    [:handle, :pointer], :win32_bool
-
-  # https://msdn.microsoft.com/en-us/library/windows/desktop/bb762282(v=vs.85).aspx
-  # BOOL WINAPI UnloadUserProfile(
-  #   _In_  HANDLE hToken,
-  #   _In_  HANDLE hProfile
-  # );
-  ffi_lib :userenv
-  attach_function_private :UnloadUserProfile,
-    [:handle, :handle], :win32_bool
-
-  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa376389(v=vs.85).aspx
-  # BOOL WINAPI CheckTokenMembership(
-  #   _In_opt_  HANDLE TokenHandle,
-  #   _In_      PSID SidToCheck,
-  #   _Out_     PBOOL IsMember
-  # );
-  ffi_lib :advapi32
-  attach_function_private :CheckTokenMembership,
-    [:handle, :pointer, :pbool], :win32_bool
-
-  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379650(v=vs.85).aspx
-  WELL_KNOWN_SID_TYPE = enum(
-    :WinNullSid                                   , 0,
-    :WinWorldSid                                  , 1,
-    :WinLocalSid                                  , 2,
-    :WinCreatorOwnerSid                           , 3,
-    :WinCreatorGroupSid                           , 4,
-    :WinCreatorOwnerServerSid                     , 5,
-    :WinCreatorGroupServerSid                     , 6,
-    :WinNtAuthoritySid                            , 7,
-    :WinDialupSid                                 , 8,
-    :WinNetworkSid                                , 9,
-    :WinBatchSid                                  , 10,
-    :WinInteractiveSid                            , 11,
-    :WinServiceSid                                , 12,
-    :WinAnonymousSid                              , 13,
-    :WinProxySid                                  , 14,
-    :WinEnterpriseControllersSid                  , 15,
-    :WinSelfSid                                   , 16,
-    :WinAuthenticatedUserSid                      , 17,
-    :WinRestrictedCodeSid                         , 18,
-    :WinTerminalServerSid                         , 19,
-    :WinRemoteLogonIdSid                          , 20,
-    :WinLogonIdsSid                               , 21,
-    :WinLocalSystemSid                            , 22,
-    :WinLocalServiceSid                           , 23,
-    :WinNetworkServiceSid                         , 24,
-    :WinBuiltinDomainSid                          , 25,
-    :WinBuiltinAdministratorsSid                  , 26,
-    :WinBuiltinUsersSid                           , 27,
-    :WinBuiltinGuestsSid                          , 28,
-    :WinBuiltinPowerUsersSid                      , 29,
-    :WinBuiltinAccountOperatorsSid                , 30,
-    :WinBuiltinSystemOperatorsSid                 , 31,
-    :WinBuiltinPrintOperatorsSid                  , 32,
-    :WinBuiltinBackupOperatorsSid                 , 33,
-    :WinBuiltinReplicatorSid                      , 34,
-    :WinBuiltinPreWindows2000CompatibleAccessSid  , 35,
-    :WinBuiltinRemoteDesktopUsersSid              , 36,
-    :WinBuiltinNetworkConfigurationOperatorsSid   , 37,
-    :WinAccountAdministratorSid                   , 38,
-    :WinAccountGuestSid                           , 39,
-    :WinAccountKrbtgtSid                          , 40,
-    :WinAccountDomainAdminsSid                    , 41,
-    :WinAccountDomainUsersSid                     , 42,
-    :WinAccountDomainGuestsSid                    , 43,
-    :WinAccountComputersSid                       , 44,
-    :WinAccountControllersSid                     , 45,
-    :WinAccountCertAdminsSid                      , 46,
-    :WinAccountSchemaAdminsSid                    , 47,
-    :WinAccountEnterpriseAdminsSid                , 48,
-    :WinAccountPolicyAdminsSid                    , 49,
-    :WinAccountRasAndIasServersSid                , 50,
-    :WinNTLMAuthenticationSid                     , 51,
-    :WinDigestAuthenticationSid                   , 52,
-    :WinSChannelAuthenticationSid                 , 53,
-    :WinThisOrganizationSid                       , 54,
-    :WinOtherOrganizationSid                      , 55,
-    :WinBuiltinIncomingForestTrustBuildersSid     , 56,
-    :WinBuiltinPerfMonitoringUsersSid             , 57,
-    :WinBuiltinPerfLoggingUsersSid                , 58,
-    :WinBuiltinAuthorizationAccessSid             , 59,
-    :WinBuiltinTerminalServerLicenseServersSid    , 60,
-    :WinBuiltinDCOMUsersSid                       , 61,
-    :WinBuiltinIUsersSid                          , 62,
-    :WinIUserSid                                  , 63,
-    :WinBuiltinCryptoOperatorsSid                 , 64,
-    :WinUntrustedLabelSid                         , 65,
-    :WinLowLabelSid                               , 66,
-    :WinMediumLabelSid                            , 67,
-    :WinHighLabelSid                              , 68,
-    :WinSystemLabelSid                            , 69,
-    :WinWriteRestrictedCodeSid                    , 70,
-    :WinCreatorOwnerRightsSid                     , 71,
-    :WinCacheablePrincipalsGroupSid               , 72,
-    :WinNonCacheablePrincipalsGroupSid            , 73,
-    :WinEnterpriseReadonlyControllersSid          , 74,
-    :WinAccountReadonlyControllersSid             , 75,
-    :WinBuiltinEventLogReadersGroup               , 76,
-    :WinNewEnterpriseReadonlyControllersSid       , 77,
-    :WinBuiltinCertSvcDComAccessGroup             , 78,
-    :WinMediumPlusLabelSid                        , 79,
-    :WinLocalLogonSid                             , 80,
-    :WinConsoleLogonSid                           , 81,
-    :WinThisOrganizationCertificateSid            , 82,
-    :WinApplicationPackageAuthoritySid            , 83,
-    :WinBuiltinAnyPackageSid                      , 84,
-    :WinCapabilityInternetClientSid               , 85,
-    :WinCapabilityInternetClientServerSid         , 86,
-    :WinCapabilityPrivateNetworkClientServerSid   , 87,
-    :WinCapabilityPicturesLibrarySid              , 88,
-    :WinCapabilityVideosLibrarySid                , 89,
-    :WinCapabilityMusicLibrarySid                 , 90,
-    :WinCapabilityDocumentsLibrarySid             , 91,
-    :WinCapabilitySharedUserCertificatesSid       , 92,
-    :WinCapabilityEnterpriseAuthenticationSid     , 93,
-    :WinCapabilityRemovableStorageSid             , 94
-  )
-
-  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa446585(v=vs.85).aspx
-  # BOOL WINAPI CreateWellKnownSid(
-  #   _In_       WELL_KNOWN_SID_TYPE WellKnownSidType,
-  #   _In_opt_   PSID DomainSid,
-  #   _Out_opt_  PSID pSid,
-  #   _Inout_    DWORD *cbSid
-  # );
-  ffi_lib :advapi32
-  attach_function_private :CreateWellKnownSid,
-    [WELL_KNOWN_SID_TYPE, :pointer, :pointer, :lpdword], :win32_bool
-
-  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379151(v=vs.85).aspx
-  # BOOL WINAPI IsValidSid(
-  #   _In_  PSID pSid
-  # );
-  ffi_lib :advapi32
-  attach_function_private :IsValidSid,
-    [:pointer], :win32_bool
-end