admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

POC code for registry->security descriptor interface

Browse Source
This commit is contained in:
clement rouault
2024-05-20 11:25:56 +02:00
parent 74f5d43159
commit 36db869572
1 changed files with 54 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
windows/winobject/registry.py
+54 -1
View File
@@ -7,7 +7,7 @@ from collections import namedtuple, defaultdict
import windows
from windows.dbgprint import dbgprint
import windows.generated_def as gdef
from windows import winproxy
from windows import winproxy, security
from windows.pycompat import basestring, int_types, is_py3
WENCODING = "utf-16-le"
@@ -374,8 +374,61 @@ class PyHKey(object):
def empty(self):
windows.winproxy.RegDeleteTreeW(self.phkey, None)
## Security API
def get_security_descriptor(self, query_sacl=False, flags=security.SecurityDescriptor.DEFAULT_SECURITY_INFORMATION):
open_flags = gdef.READ_CONTROL
if query_sacl:
open_flags |= gdef.ACCESS_SYSTEM_SECURITY
# tmp_handle will autoclose if SecurityDescriptor.from_handle fails
tmp_handle = self._open_key(None, self.fullname, open_flags)
return security.SecurityDescriptor.from_handle(tmp_handle, query_sacl=query_sacl, flags=flags, obj_type="key")
def set_security_descriptor(self, sd):
if isinstance(sd, basestring):
sd = security.SecurityDescriptor.from_string(sd)
open_flags = gdef.WRITE_OWNER | gdef.WRITE_DAC
if (sd.sacl and
any(ace.Header.AceType != gdef.SYSTEM_MANDATORY_LABEL_ACE_TYPE for ace in sd.sacl)):
# Print error if requested but no SecurityPrivilege ?
open_flags |= gdef.ACCESS_SYSTEM_SECURITY
tmp_handle = self._open_key(self.surkey.phkey, self.name, open_flags)
# tmp_handle will autoclose if SecurityDescriptor.from_handle fails
sd._apply_to_handle_and_type(tmp_handle, gdef.SE_KERNEL_OBJECT)
security_descriptor = property(get_security_descriptor, set_security_descriptor)
_sentinel = object()
def update_security_descriptor(self, owner=_sentinel, dacl=_sentinel, sacl=_sentinel, group=_sentinel):
"""[WIP] Api for simple SD update may change"""
# In any case, open the key with the given bitness of explicitly stated in the sam
open_flags = self.sam & (gdef.KEY_WOW64_64KEY | gdef.KEY_WOW64_32KEY)
set_security_info_flags = 0
temp_sd = security.SecurityDescriptor.create()
if owner is not self._sentinel:
open_flags |= gdef.WRITE_OWNER
set_security_info_flags |= gdef.OWNER_SECURITY_INFORMATION
temp_sd.owner = owner
if dacl is not self._sentinel:
open_flags |= gdef.WRITE_DAC
set_security_info_flags |= gdef.DACL_SECURITY_INFORMATION
temp_sd.owner = dacl
if sacl is not self._sentinel:
temp_sd.sacl = sacl
set_security_info_flags |= gdef.LABEL_SECURITY_INFORMATION
if any(ace.Header.AceType != gdef.SYSTEM_MANDATORY_LABEL_ACE_TYPE for ace in sacl):
open_flags |= gdef.ACCESS_SYSTEM_SECURITY
set_security_info_flags |= gdef.SACL_SECURITY_INFORMATION
if group is not self._sentinel:
raise NotImplementedError("update_security_descriptor with group")
# Create the temporary handle for assignement
tmp_handle = self._open_key(self.surkey.phkey, self.name, open_flags)
# tmp_handle will autoclose if SecurityDescriptor.from_handle fails
temp_sd._apply_to_handle_and_type(tmp_handle, gdef.SE_KERNEL_OBJECT, set_security_info_flags)
##! Security API
def __setitem__(self, name, value):
rtype = None
if not (isinstance(value, basestring) or isinstance(value, int_types)):