From 7c8e3f4da1acb4f1c5b341e476faa7db288c1531 Mon Sep 17 00:00:00 2001 From: Hans-Joachim Kliemeck Date: Sat, 17 Oct 2015 17:07:39 +0200 Subject: [PATCH 1/9] added separate module to change owner, since win_acl is ACL only and should not be more complex --- windows/win_owner.ps1 | 134 ++++++++++++++++++++++++++++++++++++++++++ windows/win_owner.py | 67 +++++++++++++++++++++ 2 files changed, 201 insertions(+) create mode 100644 windows/win_owner.ps1 create mode 100644 windows/win_owner.py diff --git a/windows/win_owner.ps1 b/windows/win_owner.ps1 new file mode 100644 index 00000000000..5af5072b372 --- /dev/null +++ b/windows/win_owner.ps1 @@ -0,0 +1,134 @@ +#!powershell +# This file is part of Ansible +# +# Copyright 2015, Hans-Joachim Kliemeck +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . + +# WANT_JSON +# POWERSHELL_COMMON + +#Functions +Function UserSearch +{ + Param ([string]$AccountName) + #Check if there's a realm specified + if ($AccountName.Split("\").count -gt 1) + { + if ($AccountName.Split("\")[0] -eq $env:COMPUTERNAME) + { + $IsLocalAccount = $true + } + Else + { + $IsDomainAccount = $true + $IsUpn = $false + } + + } + Elseif ($AccountName -contains "@") + { + $IsDomainAccount = $true + $IsUpn = $true + } + Else + { + #Default to local user account + $accountname = $env:COMPUTERNAME + "\" + $AccountName + $IsLocalAccount = $true + } + + + if ($IsLocalAccount -eq $true) + { + # do not use Win32_UserAccount, because e.g. SYSTEM (BUILTIN\SYSTEM or COMPUUTERNAME\SYSTEM) will not be listed. on Win32_Account groups will be listed too + $localaccount = get-wmiobject -class "Win32_Account" -namespace "root\CIMV2" -filter "(LocalAccount = True)" | where {$_.Caption -eq $AccountName} + if ($localaccount) + { + return $localaccount.SID + } + } + ElseIf (($IsDomainAccount -eq $true) -and ($IsUpn -eq $false)) + { + #Search by samaccountname + $Searcher = [adsisearcher]"" + $Searcher.Filter = "sAMAccountName=$($accountname.split("\")[1])" + $result = $Searcher.FindOne() + + if ($result) + { + $user = $result.GetDirectoryEntry() + + # get binary SID from AD account + $binarySID = $user.ObjectSid.Value + + # convert to string SID + return (New-Object System.Security.Principal.SecurityIdentifier($binarySID,0)).Value + } + } + +} + +$params = Parse-Args $args; + +$result = New-Object PSObject; +Set-Attr $result "changed" $false; + +$path = Get-Attr $params "path" -failifempty $true +$user = Get-Attr $params "user" -failifempty $true +$recurse = Get-Attr $params "recurse" "no" -validateSet "no","yes" -resultobj $result + +If (-Not (Test-Path -Path $path)) { + Fail-Json $result "$path file or directory does not exist on the host" +} + +# Test that the user/group is resolvable on the local machine +$sid = UserSearch -AccountName ($user) +if (!$sid) +{ + Fail-Json $result "$user is not a valid user or group on the host machine or domain" +} + +Try { + $objUser = New-Object System.Security.Principal.SecurityIdentifier($sid) + + $file = Get-Item -Path $path + $acl = Get-Acl $file.FullName + + If ($acl.getOwner([System.Security.Principal.SecurityIdentifier]) -ne $objUser) { + Set-Attr $result "changed" $true; + } + + $acl.setOwner($objUser) + Set-Acl $file.FullName $acl + + If ($recurse -eq "yes") { + $files = Get-ChildItem -Path $path -Force -Recurse + ForEach($file in $files){ + $acl = Get-Acl $file.FullName + + If ($acl.getOwner([System.Security.Principal.SecurityIdentifier]) -ne $objUser) { + Set-Attr $result "changed" $true; + } + + $acl.setOwner($objUser) + Set-Acl $file.FullName $acl + } + } +} +Catch { + Fail-Json $result "an error occured when attempting to change owner on $path for $user" +} + +Exit-Json $result diff --git a/windows/win_owner.py b/windows/win_owner.py new file mode 100644 index 00000000000..9af816abfe9 --- /dev/null +++ b/windows/win_owner.py @@ -0,0 +1,67 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- + +# Copyright 2015, Hans-Joachim Kliemeck +# +# This file is part of Ansible +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . + +# this is a windows documentation stub. actual code lives in the .ps1 +# file of the same name + +DOCUMENTATION = ''' +--- +module: win_service_configure +version_added: "2.0" +short_description: Set owner +description: + - Set owner of files or directories +options: + path: + description: + - Path to be used for changing owner + required: true + default: null + user: + description: + - Name to be used for changing owner + required: true + default: null + recurse: + description: + - Indicates if the owner should be changed recursively + required: false + choices: + - no + - yes + default: no +author: Hans-Joachim Kliemeck +''' + +EXAMPLES = ''' +# Playbook example +--- +- name: Change owner of Path + win_owner: + path: 'C:\\apache\\' + user: apache + recurse: yes + +- name: Set the owner of root directory + win_owner: + path: 'C:\\apache\\' + user: SYSTEM + recurse: no +''' From cda7e96fcc277ecf285bb61264882a60f91ab9a9 Mon Sep 17 00:00:00 2001 From: Hans-Joachim Kliemeck Date: Sat, 17 Oct 2015 23:10:56 +0200 Subject: [PATCH 2/9] added userprincipal support --- windows/win_owner.ps1 | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/windows/win_owner.ps1 b/windows/win_owner.ps1 index 5af5072b372..519d6fe5802 100644 --- a/windows/win_owner.ps1 +++ b/windows/win_owner.ps1 @@ -48,8 +48,7 @@ Function UserSearch $accountname = $env:COMPUTERNAME + "\" + $AccountName $IsLocalAccount = $true } - - + if ($IsLocalAccount -eq $true) { # do not use Win32_UserAccount, because e.g. SYSTEM (BUILTIN\SYSTEM or COMPUUTERNAME\SYSTEM) will not be listed. on Win32_Account groups will be listed too @@ -59,13 +58,19 @@ Function UserSearch return $localaccount.SID } } - ElseIf (($IsDomainAccount -eq $true) -and ($IsUpn -eq $false)) + ElseIf ($IsDomainAccount -eq $true) { #Search by samaccountname $Searcher = [adsisearcher]"" - $Searcher.Filter = "sAMAccountName=$($accountname.split("\")[1])" - $result = $Searcher.FindOne() - + + If ($IsUpn -eq $false) { + $Searcher.Filter = "sAMAccountName=$($accountname.split("\")[1])" + } + Else { + $Searcher.Filter = "userPrincipalName=$($accountname)" + } + + $result = $Searcher.FindOne() if ($result) { $user = $result.GetDirectoryEntry() @@ -77,7 +82,6 @@ Function UserSearch return (New-Object System.Security.Principal.SecurityIdentifier($binarySID,0)).Value } } - } $params = Parse-Args $args; From 7978afe1fde538380ed4c613cbca8b895c22efb0 Mon Sep 17 00:00:00 2001 From: Hans-Joachim Kliemeck Date: Sun, 18 Oct 2015 17:26:12 +0200 Subject: [PATCH 3/9] fixed documentation --- windows/win_owner.py | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/windows/win_owner.py b/windows/win_owner.py index 9af816abfe9..f96b10766b3 100644 --- a/windows/win_owner.py +++ b/windows/win_owner.py @@ -23,7 +23,7 @@ DOCUMENTATION = ''' --- -module: win_service_configure +module: win_owner version_added: "2.0" short_description: Set owner description: @@ -33,12 +33,10 @@ options: description: - Path to be used for changing owner required: true - default: null user: description: - Name to be used for changing owner required: true - default: null recurse: description: - Indicates if the owner should be changed recursively @@ -47,7 +45,7 @@ options: - no - yes default: no -author: Hans-Joachim Kliemeck +author: Hans-Joachim Kliemeck (@h0nIg) ''' EXAMPLES = ''' From 3a5d4576c65140e09ca021cf505ba2c70fa16c84 Mon Sep 17 00:00:00 2001 From: Hans-Joachim Kliemeck Date: Wed, 21 Oct 2015 21:11:51 +0200 Subject: [PATCH 4/9] as suggested by @marcind, convert to boolean --- windows/win_owner.ps1 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/win_owner.ps1 b/windows/win_owner.ps1 index 519d6fe5802..eb69e744e63 100644 --- a/windows/win_owner.ps1 +++ b/windows/win_owner.ps1 @@ -91,7 +91,7 @@ Set-Attr $result "changed" $false; $path = Get-Attr $params "path" -failifempty $true $user = Get-Attr $params "user" -failifempty $true -$recurse = Get-Attr $params "recurse" "no" -validateSet "no","yes" -resultobj $result +$recurse = Get-Attr $params "recurse" "no" -validateSet "no","yes" -resultobj $result | ConvertTo-Bool If (-Not (Test-Path -Path $path)) { Fail-Json $result "$path file or directory does not exist on the host" @@ -117,7 +117,7 @@ Try { $acl.setOwner($objUser) Set-Acl $file.FullName $acl - If ($recurse -eq "yes") { + If ($recurse) { $files = Get-ChildItem -Path $path -Force -Recurse ForEach($file in $files){ $acl = Get-Acl $file.FullName From 45249fb0420a7bfcac7fc59a92124ca2457646c3 Mon Sep 17 00:00:00 2001 From: Hans-Joachim Kliemeck Date: Mon, 26 Oct 2015 10:20:14 +0100 Subject: [PATCH 5/9] only call set-acl if necessary --- windows/win_owner.ps1 | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/win_owner.ps1 b/windows/win_owner.ps1 index eb69e744e63..0623f2b17a1 100644 --- a/windows/win_owner.ps1 +++ b/windows/win_owner.ps1 @@ -111,23 +111,23 @@ Try { $acl = Get-Acl $file.FullName If ($acl.getOwner([System.Security.Principal.SecurityIdentifier]) -ne $objUser) { + $acl.setOwner($objUser) + Set-Acl $file.FullName $acl + Set-Attr $result "changed" $true; } - $acl.setOwner($objUser) - Set-Acl $file.FullName $acl - If ($recurse) { $files = Get-ChildItem -Path $path -Force -Recurse ForEach($file in $files){ $acl = Get-Acl $file.FullName If ($acl.getOwner([System.Security.Principal.SecurityIdentifier]) -ne $objUser) { + $acl.setOwner($objUser) + Set-Acl $file.FullName $acl + Set-Attr $result "changed" $true; } - - $acl.setOwner($objUser) - Set-Acl $file.FullName $acl } } } From 10ce1f92aa61f2d140a2b7ea731bb3a76289e593 Mon Sep 17 00:00:00 2001 From: Hans-Joachim Kliemeck Date: Thu, 5 Nov 2015 17:46:25 +0100 Subject: [PATCH 6/9] fixxed problem with match @ --- windows/win_owner.ps1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/win_owner.ps1 b/windows/win_owner.ps1 index 0623f2b17a1..9bd3c335e9c 100644 --- a/windows/win_owner.ps1 +++ b/windows/win_owner.ps1 @@ -37,7 +37,7 @@ Function UserSearch } } - Elseif ($AccountName -contains "@") + Elseif ($AccountName.contains("@")) { $IsDomainAccount = $true $IsUpn = $true From c0b2080ae18962de859929ac241992ed857e9bca Mon Sep 17 00:00:00 2001 From: Hans-Joachim Kliemeck Date: Tue, 12 Jan 2016 09:57:56 +0100 Subject: [PATCH 7/9] fixed problems related to userpricincipalname (user@domain) and undefined variables fixed variable capitalization --- windows/win_owner.ps1 | 39 ++++++++++++++++++--------------------- 1 file changed, 18 insertions(+), 21 deletions(-) diff --git a/windows/win_owner.ps1 b/windows/win_owner.ps1 index 9bd3c335e9c..d781dd011d8 100644 --- a/windows/win_owner.ps1 +++ b/windows/win_owner.ps1 @@ -22,52 +22,49 @@ #Functions Function UserSearch { - Param ([string]$AccountName) + Param ([string]$accountName) #Check if there's a realm specified - if ($AccountName.Split("\").count -gt 1) + + $searchDomain = $false + $searchDomainUPN = $false + if ($accountName.Split("\").count -gt 1) { - if ($AccountName.Split("\")[0] -eq $env:COMPUTERNAME) - { - $IsLocalAccount = $true - } - Else + if ($accountName.Split("\")[0] -ne $env:COMPUTERNAME) { - $IsDomainAccount = $true - $IsUpn = $false + $searchDomain = $true + $accountName = $accountName.split("\")[1] } - } - Elseif ($AccountName.contains("@")) + Elseif ($accountName.contains("@")) { - $IsDomainAccount = $true - $IsUpn = $true + $searchDomain = $true + $searchDomainUPN = $true } Else { #Default to local user account - $accountname = $env:COMPUTERNAME + "\" + $AccountName - $IsLocalAccount = $true + $accountName = $env:COMPUTERNAME + "\" + $accountName } - if ($IsLocalAccount -eq $true) + if ($searchDomain -eq $false) { # do not use Win32_UserAccount, because e.g. SYSTEM (BUILTIN\SYSTEM or COMPUUTERNAME\SYSTEM) will not be listed. on Win32_Account groups will be listed too - $localaccount = get-wmiobject -class "Win32_Account" -namespace "root\CIMV2" -filter "(LocalAccount = True)" | where {$_.Caption -eq $AccountName} + $localaccount = get-wmiobject -class "Win32_Account" -namespace "root\CIMV2" -filter "(LocalAccount = True)" | where {$_.Caption -eq $accountName} if ($localaccount) { return $localaccount.SID } } - ElseIf ($IsDomainAccount -eq $true) + Else { #Search by samaccountname $Searcher = [adsisearcher]"" - If ($IsUpn -eq $false) { - $Searcher.Filter = "sAMAccountName=$($accountname.split("\")[1])" + If ($searchDomainUPN -eq $false) { + $Searcher.Filter = "sAMAccountName=$($accountName)" } Else { - $Searcher.Filter = "userPrincipalName=$($accountname)" + $Searcher.Filter = "userPrincipalName=$($accountName)" } $result = $Searcher.FindOne() From d5ab52eb58f48c1ba7d2cefeb610c415e440cb1c Mon Sep 17 00:00:00 2001 From: Hans-Joachim Kliemeck Date: Tue, 12 Jan 2016 12:36:45 +0100 Subject: [PATCH 8/9] fixxed tests --- windows/win_owner.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/win_owner.py b/windows/win_owner.py index f96b10766b3..1b16c1b727f 100644 --- a/windows/win_owner.py +++ b/windows/win_owner.py @@ -24,7 +24,7 @@ DOCUMENTATION = ''' --- module: win_owner -version_added: "2.0" +version_added: "2.1" short_description: Set owner description: - Set owner of files or directories @@ -63,3 +63,7 @@ EXAMPLES = ''' user: SYSTEM recurse: no ''' + +RETURN = ''' + +''' \ No newline at end of file From 1c097f9495c70fa0067a9edfb0ffa5fdd873cfad Mon Sep 17 00:00:00 2001 From: Hans-Joachim Kliemeck Date: Mon, 21 Mar 2016 17:49:51 +0100 Subject: [PATCH 9/9] suggestion by @nitzmahone, to not use Get-Attr in combination with ConvertTo-Bool --- windows/win_owner.ps1 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/win_owner.ps1 b/windows/win_owner.ps1 index d781dd011d8..076ab846052 100644 --- a/windows/win_owner.ps1 +++ b/windows/win_owner.ps1 @@ -88,7 +88,8 @@ Set-Attr $result "changed" $false; $path = Get-Attr $params "path" -failifempty $true $user = Get-Attr $params "user" -failifempty $true -$recurse = Get-Attr $params "recurse" "no" -validateSet "no","yes" -resultobj $result | ConvertTo-Bool +$recurse = Get-Attr $params "recurse" "no" -validateSet "no","yes" -resultobj $result +$recurse = $recurse | ConvertTo-Bool If (-Not (Test-Path -Path $path)) { Fail-Json $result "$path file or directory does not exist on the host"