puppet 4.0.0 → 4.10.0

data/lib/puppet/util/windows/security.rb

@@ -41,7 +41,7 @@
 #   must be running with elevated privileges.
 # * A file/dir can be deleted by anyone with the DELETE access right
 #   OR by anyone that has the FILE_DELETE_CHILD access right for the
-#   parent. See http://support.microsoft.com/kb/238018. But on Unix,
+#   parent. See https://support.microsoft.com/kb/238018. But on Unix,
 #   the user must have write access to the file/dir AND execute access
 #   to all of the parent path components.
 # * Many access control entries are inherited from parent directories,
@@ -65,8 +65,6 @@ require 'puppet/util/windows'
 require 'pathname'
 require 'ffi'
 
-require 'win32/security'
-
 module Puppet::Util::Windows::Security
   include Puppet::Util::Windows::String
 
@@ -199,9 +197,9 @@ module Puppet::Util::Windows::Security
   def get_mode(path)
     return unless supports_acl?(path)
 
-    well_known_world_sid = Win32::Security::SID::Everyone
-    well_known_nobody_sid = Win32::Security::SID::Nobody
-    well_known_system_sid = Win32::Security::SID::LocalSystem
+    well_known_world_sid = Puppet::Util::Windows::SID::Everyone
+    well_known_nobody_sid = Puppet::Util::Windows::SID::Nobody
+    well_known_system_sid = Puppet::Util::Windows::SID::LocalSystem
 
     mode = S_ISYSTEM_MISSING
 
@@ -264,7 +262,7 @@ module Puppet::Util::Windows::Security
   }
 
   # Set the mode of the object referenced by +path+ to the specified
-  # +mode+.  The mode should be specified as POSIX-stye read, write,
+  # +mode+. The mode should be specified as POSIX-style read, write,
   # and execute modes for the user, group, and other classes,
   # e.g. 0640. The sticky bit, S_ISVTX, is supported, but is only
   # meaningful for directories. If set, group and others are not
@@ -278,9 +276,9 @@ module Puppet::Util::Windows::Security
   # that they do not have read and write access to.
   def set_mode(mode, path, protected = true)
     sd = get_security_descriptor(path)
-    well_known_world_sid = Win32::Security::SID::Everyone
-    well_known_nobody_sid = Win32::Security::SID::Nobody
-    well_known_system_sid = Win32::Security::SID::LocalSystem
+    well_known_world_sid = Puppet::Util::Windows::SID::Everyone
+    well_known_nobody_sid = Puppet::Util::Windows::SID::Nobody
+    well_known_system_sid = Puppet::Util::Windows::SID::LocalSystem
 
     owner_allow = FILE::STANDARD_RIGHTS_ALL  |
       FILE::FILE_READ_ATTRIBUTES |
@@ -352,18 +350,21 @@ module Puppet::Util::Windows::Security
     dacl.allow(well_known_nobody_sid, nobody_allow)
 
     # TODO: system should be first?
-    dacl.allow(well_known_system_sid, system_allow)
+    flags = !isdir ? 0 :
+      Puppet::Util::Windows::AccessControlEntry::CONTAINER_INHERIT_ACE |
+      Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE
+    dacl.allow(well_known_system_sid, system_allow, flags)
 
     # add inherit-only aces for child dirs and files that are created within the dir
     inherit_only = Puppet::Util::Windows::AccessControlEntry::INHERIT_ONLY_ACE
     if isdir
       inherit = inherit_only | Puppet::Util::Windows::AccessControlEntry::CONTAINER_INHERIT_ACE
-      dacl.allow(Win32::Security::SID::CreatorOwner, owner_allow, inherit)
-      dacl.allow(Win32::Security::SID::CreatorGroup, group_allow, inherit)
+      dacl.allow(Puppet::Util::Windows::SID::CreatorOwner, owner_allow, inherit)
+      dacl.allow(Puppet::Util::Windows::SID::CreatorGroup, group_allow, inherit)
 
       inherit = inherit_only | Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE
-      dacl.allow(Win32::Security::SID::CreatorOwner, owner_allow & ~FILE::FILE_EXECUTE, inherit)
-      dacl.allow(Win32::Security::SID::CreatorGroup, group_allow & ~FILE::FILE_EXECUTE, inherit)
+      dacl.allow(Puppet::Util::Windows::SID::CreatorOwner, owner_allow & ~FILE::FILE_EXECUTE, inherit)
+      dacl.allow(Puppet::Util::Windows::SID::CreatorGroup, group_allow & ~FILE::FILE_EXECUTE, inherit)
     end
 
     new_sd = Puppet::Util::Windows::SecurityDescriptor.new(sd.owner, sd.group, dacl, protected)
@@ -576,7 +577,7 @@ module Puppet::Util::Windows::Security
   end
 
   def get_max_generic_acl_size(ace_count)
-    # http://msdn.microsoft.com/en-us/library/windows/desktop/aa378853(v=vs.85).aspx
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa378853(v=vs.85).aspx
     # To calculate the initial size of an ACL, add the following together, and then align the result to the nearest DWORD:
     # * Size of the ACL structure.
     # * Size of each ACE structure that the ACL is to contain minus the SidStart member (DWORD) of the ACE.
@@ -640,7 +641,7 @@ module Puppet::Util::Windows::Security
 
   ffi_convention :stdcall
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa363858(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa363858(v=vs.85).aspx
   # HANDLE WINAPI CreateFile(
   #   _In_      LPCTSTR lpFileName,
   #   _In_      DWORD dwDesiredAccess,
@@ -654,7 +655,7 @@ module Puppet::Util::Windows::Security
   attach_function_private :CreateFileW,
     [:lpcwstr, :dword, :dword, :pointer, :dword, :dword, :handle], :handle
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa364993(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa364993(v=vs.85).aspx
   # BOOL WINAPI GetVolumeInformation(
   #   _In_opt_   LPCTSTR lpRootPathName,
   #   _Out_opt_  LPTSTR lpVolumeNameBuffer,
@@ -669,7 +670,7 @@ module Puppet::Util::Windows::Security
   attach_function_private :GetVolumeInformationW,
     [:lpcwstr, :lpwstr, :dword, :lpdword, :lpdword, :lpdword, :lpwstr, :dword], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa374951(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374951(v=vs.85).aspx
   # BOOL WINAPI AddAccessAllowedAceEx(
   #   _Inout_  PACL pAcl,
   #   _In_     DWORD dwAceRevision,
@@ -681,7 +682,7 @@ module Puppet::Util::Windows::Security
   attach_function_private :AddAccessAllowedAceEx,
     [:pointer, :dword, :dword, :dword, :pointer], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa374964(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374964(v=vs.85).aspx
   # BOOL WINAPI AddAccessDeniedAceEx(
   #   _Inout_  PACL pAcl,
   #   _In_     DWORD dwAceRevision,
@@ -693,7 +694,7 @@ module Puppet::Util::Windows::Security
   attach_function_private :AddAccessDeniedAceEx,
     [:pointer, :dword, :dword, :dword, :pointer], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa374931(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374931(v=vs.85).aspx
   # typedef struct _ACL {
   #   BYTE AclRevision;
   #   BYTE Sbz1;
@@ -709,9 +710,9 @@ module Puppet::Util::Windows::Security
            :Sbz2, :word
   end
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa374912(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374912(v=vs.85).aspx
   # ACE types
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa374919(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374919(v=vs.85).aspx
   # typedef struct _ACE_HEADER {
   #   BYTE AceType;
   #   BYTE AceFlags;
@@ -723,17 +724,17 @@ module Puppet::Util::Windows::Security
            :AceSize,  :word
   end
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa374892(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374892(v=vs.85).aspx
   # ACCESS_MASK
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa374847(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374847(v=vs.85).aspx
   # typedef struct _ACCESS_ALLOWED_ACE {
   #   ACE_HEADER  Header;
   #   ACCESS_MASK Mask;
   #   DWORD       SidStart;
   # } ACCESS_ALLOWED_ACE, *PACCESS_ALLOWED_ACE;
   #
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa374879(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374879(v=vs.85).aspx
   # typedef struct _ACCESS_DENIED_ACE {
   #   ACE_HEADER  Header;
   #   ACCESS_MASK Mask;
@@ -748,12 +749,12 @@ module Puppet::Util::Windows::Security
            :SidStart, :dword
   end
 
-  # http://stackoverflow.com/a/1792930
+  # https://stackoverflow.com/a/1792930
   MAXIMUM_SID_BYTES_LENGTH = 68
   MAXIMUM_GENERIC_ACE_SIZE = GENERIC_ACCESS_ACE.offset_of(:SidStart) +
     MAXIMUM_SID_BYTES_LENGTH
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa446634(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa446634(v=vs.85).aspx
   # BOOL WINAPI GetAce(
   #   _In_   PACL pAcl,
   #   _In_   DWORD dwAceIndex,
@@ -763,7 +764,7 @@ module Puppet::Util::Windows::Security
   attach_function_private :GetAce,
     [:pointer, :dword, :pointer], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa375202(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa375202(v=vs.85).aspx
   # BOOL WINAPI AdjustTokenPrivileges(
   #   _In_       HANDLE TokenHandle,
   #   _In_       BOOL DisableAllPrivileges,
@@ -776,9 +777,9 @@ module Puppet::Util::Windows::Security
   attach_function_private :AdjustTokenPrivileges,
     [:handle, :win32_bool, :pointer, :dword, :pointer, :pdword], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/hardware/ff556610(v=vs.85).aspx
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379561(v=vs.85).aspx
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa446647(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/hardware/ff556610(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379561(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa446647(v=vs.85).aspx
   # typedef WORD SECURITY_DESCRIPTOR_CONTROL, *PSECURITY_DESCRIPTOR_CONTROL;
   # BOOL WINAPI GetSecurityDescriptorControl(
   #   _In_   PSECURITY_DESCRIPTOR pSecurityDescriptor,
@@ -789,7 +790,7 @@ module Puppet::Util::Windows::Security
   attach_function_private :GetSecurityDescriptorControl,
     [:pointer, :lpword, :lpdword], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa378853(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa378853(v=vs.85).aspx
   # BOOL WINAPI InitializeAcl(
   #   _Out_  PACL pAcl,
   #   _In_   DWORD nAclLength,
@@ -799,7 +800,7 @@ module Puppet::Util::Windows::Security
   attach_function_private :InitializeAcl,
     [:pointer, :dword, :dword], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379142(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379142(v=vs.85).aspx
   # BOOL WINAPI IsValidAcl(
   #   _In_  PACL pAcl
   # );
@@ -807,7 +808,7 @@ module Puppet::Util::Windows::Security
   attach_function_private :IsValidAcl,
     [:pointer], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379593(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379593(v=vs.85).aspx
   SE_OBJECT_TYPE = enum(
     :SE_UNKNOWN_OBJECT_TYPE, 0,
     :SE_FILE_OBJECT,
@@ -824,7 +825,7 @@ module Puppet::Util::Windows::Security
     :SE_REGISTRY_WOW64_32KEY
   )
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa446654(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa446654(v=vs.85).aspx
   # DWORD WINAPI GetSecurityInfo(
   #   _In_       HANDLE handle,
   #   _In_       SE_OBJECT_TYPE ObjectType,
@@ -839,7 +840,7 @@ module Puppet::Util::Windows::Security
   attach_function_private :GetSecurityInfo,
     [:handle, SE_OBJECT_TYPE, :dword, :pointer, :pointer, :pointer, :pointer, :pointer], :dword
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379588(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379588(v=vs.85).aspx
   # DWORD WINAPI SetSecurityInfo(
   #   _In_      HANDLE handle,
   #   _In_      SE_OBJECT_TYPE ObjectType,

data/lib/puppet/util/windows/security_descriptor.rb

@@ -5,7 +5,7 @@
 # flags, DACL, and SACL. The SACL is not currently supported, though it has the
 # same layout as a DACL.
 #
-# @see http://msdn.microsoft.com/en-us/library/windows/desktop/aa379563(v=vs.85).aspx
+# @see https://msdn.microsoft.com/en-us/library/windows/desktop/aa379563(v=vs.85).aspx
 # @api private
 class Puppet::Util::Windows::SecurityDescriptor
   require 'puppet/util/windows/security'

data/lib/puppet/util/windows/sid.rb

@@ -9,6 +9,44 @@ module Puppet::Util::Windows
     ERROR_NONE_MAPPED           = 1332
     ERROR_INVALID_SID_STRUCTURE = 1337
 
+    # Well Known SIDs
+    Null                        = 'S-1-0'
+    Nobody                      = 'S-1-0-0'
+    World                       = 'S-1-1'
+    Everyone                    = 'S-1-1-0'
+    Local                       = 'S-1-2'
+    Creator                     = 'S-1-3'
+    CreatorOwner                = 'S-1-3-0'
+    CreatorGroup                = 'S-1-3-1'
+    CreatorOwnerServer          = 'S-1-3-2'
+    CreatorGroupServer          = 'S-1-3-3'
+    NonUnique                   = 'S-1-4'
+    Nt                          = 'S-1-5'
+    Dialup                      = 'S-1-5-1'
+    Network                     = 'S-1-5-2'
+    Batch                       = 'S-1-5-3'
+    Interactive                 = 'S-1-5-4'
+    Service                     = 'S-1-5-6'
+    Anonymous                   = 'S-1-5-7'
+    Proxy                       = 'S-1-5-8'
+    EnterpriseDomainControllers = 'S-1-5-9'
+    PrincipalSelf               = 'S-1-5-10'
+    AuthenticatedUsers          = 'S-1-5-11'
+    RestrictedCode              = 'S-1-5-12'
+    TerminalServerUsers         = 'S-1-5-13'
+    LocalSystem                 = 'S-1-5-18'
+    NtLocal                     = 'S-1-5-19'
+    NtNetwork                   = 'S-1-5-20'
+    BuiltinAdministrators       = 'S-1-5-32-544'
+    BuiltinUsers                = 'S-1-5-32-545'
+    Guests                      = 'S-1-5-32-546'
+    PowerUsers                  = 'S-1-5-32-547'
+    AccountOperators            = 'S-1-5-32-548'
+    ServerOperators             = 'S-1-5-32-549'
+    PrintOperators              = 'S-1-5-32-550'
+    BackupOperators             = 'S-1-5-32-551'
+    Replicators                 = 'S-1-5-32-552'
+
     # Convert an account name, e.g. 'Administrators' into a SID string,
     # e.g. 'S-1-5-32-544'. The name can be specified as 'Administrators',
     # 'BUILTIN\Administrators', or 'S-1-5-32-544', and will return the
@@ -16,7 +54,7 @@ module Puppet::Util::Windows
     def name_to_sid(name)
       sid = name_to_sid_object(name)
 
-      sid ? sid.to_s : nil
+      sid ? sid.sid : nil
     end
     module_function :name_to_sid
 
@@ -24,14 +62,22 @@ module Puppet::Util::Windows
     # e.g. 'S-1-5-32-544'. The name can be specified as 'Administrators',
     # 'BUILTIN\Administrators', or 'S-1-5-32-544', and will return the
     # SID object. Returns nil if the account doesn't exist.
+    # This method returns a SID::Principal with the account, domain, SID, etc
     def name_to_sid_object(name)
       # Apparently, we accept a symbol..
       name = name.to_s.strip if name
 
-      # if it's in SID string form, convert to user
-      parsed_sid = Win32::Security::SID.string_to_sid(name) rescue nil
+      # if name is a SID string, convert it to raw bytes for use with lookup_account_sid
+      raw_sid_bytes = nil
+      begin
+        string_to_sid_ptr(name) do |sid_ptr|
+          valid = ! sid_ptr.nil? && ! sid_ptr.null?
+          raw_sid_bytes = sid_ptr.read_array_of_uchar(get_length_sid(sid_ptr))
+        end
+      rescue
+      end
 
-      parsed_sid ? Win32::Security::SID.new(parsed_sid) : Win32::Security::SID.new(name)
+      raw_sid_bytes ? Principal.lookup_account_sid(raw_sid_bytes) : Principal.lookup_account_name(name)
     rescue
       nil
     end
@@ -41,12 +87,13 @@ module Puppet::Util::Windows
     # e.g. [1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0] is the representation for
     # S-1-5-18, the local 'SYSTEM' account.
     # Raises an Error for nil or non-array input.
+    # This method returns a SID::Principal with the account, domain, SID, etc
     def octet_string_to_sid_object(bytes)
       if !bytes || !bytes.respond_to?('pack') || bytes.empty?
         raise Puppet::Util::Windows::Error.new("Octet string must be an array of bytes")
       end
 
-      Win32::Security::SID.new(bytes.pack('C*'))
+      Principal.lookup_account_sid(bytes)
     end
     module_function :octet_string_to_sid_object
 
@@ -54,24 +101,29 @@ module Puppet::Util::Windows
     # e.g. 'BUILTIN\Administrators'. Returns nil if an account
     # for that SID does not exist.
     def sid_to_name(value)
-      sid = Win32::Security::SID.new(Win32::Security::SID.string_to_sid(value))
 
-      if sid.domain and sid.domain.length > 0
-        "#{sid.domain}\\#{sid.account}"
-      else
-        sid.account
+      sid_bytes = []
+      begin
+        string_to_sid_ptr(value) do |ptr|
+          valid = ! ptr.nil? && ! ptr.null?
+          sid_bytes = ptr.read_array_of_uchar(get_length_sid(ptr))
+        end
+      rescue Puppet::Util::Windows::Error => e
+        raise if e.code != ERROR_INVALID_SID_STRUCTURE
       end
+
+      Principal.lookup_account_sid(sid_bytes).domain_account
     rescue
       nil
     end
     module_function :sid_to_name
 
-    # http://stackoverflow.com/a/1792930 - 68 bytes, 184 characters in a string
+    # https://stackoverflow.com/a/1792930 - 68 bytes, 184 characters in a string
     MAXIMUM_SID_STRING_LENGTH = 184
 
     # Convert a SID pointer to a SID string, e.g. "S-1-5-32-544".
     def sid_ptr_to_string(psid)
-      if ! psid.instance_of?(FFI::Pointer) || IsValidSid(psid) == FFI::WIN32_FALSE
+      if ! psid.kind_of?(FFI::Pointer) || IsValidSid(psid) == FFI::WIN32_FALSE
         raise Puppet::Util::Windows::Error.new("Invalid SID")
       end
 
@@ -131,9 +183,19 @@ module Puppet::Util::Windows
     end
     module_function :valid_sid?
 
+    def get_length_sid(sid_ptr)
+      # MSDN states IsValidSid should be called on pointer first
+      if ! sid_ptr.kind_of?(FFI::Pointer) || IsValidSid(sid_ptr) == FFI::WIN32_FALSE
+        raise Puppet::Util::Windows::Error.new("Invalid SID")
+      end
+
+      GetLengthSid(sid_ptr)
+    end
+    module_function :get_length_sid
+
     ffi_convention :stdcall
 
-    # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379151(v=vs.85).aspx
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379151(v=vs.85).aspx
     # BOOL WINAPI IsValidSid(
     #   _In_  PSID pSid
     # );
@@ -141,7 +203,7 @@ module Puppet::Util::Windows
     attach_function_private :IsValidSid,
       [:pointer], :win32_bool
 
-    # http://msdn.microsoft.com/en-us/library/windows/desktop/aa376399(v=vs.85).aspx
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa376399(v=vs.85).aspx
     # BOOL ConvertSidToStringSid(
     #   _In_   PSID Sid,
     #   _Out_  LPTSTR *StringSid
@@ -150,7 +212,7 @@ module Puppet::Util::Windows
     attach_function_private :ConvertSidToStringSidW,
       [:pointer, :pointer], :win32_bool
 
-    # http://msdn.microsoft.com/en-us/library/windows/desktop/aa376402(v=vs.85).aspx
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa376402(v=vs.85).aspx
     # BOOL WINAPI ConvertStringSidToSid(
     #   _In_   LPCTSTR StringSid,
     #   _Out_  PSID *Sid
@@ -158,5 +220,12 @@ module Puppet::Util::Windows
     ffi_lib :advapi32
     attach_function_private :ConvertStringSidToSidW,
       [:lpcwstr, :pointer], :win32_bool
+
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa446642(v=vs.85).aspx
+    # DWORD WINAPI GetLengthSid(
+    #   _In_ PSID pSid
+    # );
+    ffi_lib :advapi32
+    attach_function_private :GetLengthSid, [:pointer], :dword
   end
 end