From 7c8e3f4da1acb4f1c5b341e476faa7db288c1531 Mon Sep 17 00:00:00 2001 From: Hans-Joachim Kliemeck Date: Sat, 17 Oct 2015 17:07:39 +0200 Subject: [PATCH] added separate module to change owner, since win_acl is ACL only and should not be more complex --- windows/win_owner.ps1 | 134 ++++++++++++++++++++++++++++++++++++++++++ windows/win_owner.py | 67 +++++++++++++++++++++ 2 files changed, 201 insertions(+) create mode 100644 windows/win_owner.ps1 create mode 100644 windows/win_owner.py diff --git a/windows/win_owner.ps1 b/windows/win_owner.ps1 new file mode 100644 index 00000000000..5af5072b372 --- /dev/null +++ b/windows/win_owner.ps1 @@ -0,0 +1,134 @@ +#!powershell +# This file is part of Ansible +# +# Copyright 2015, Hans-Joachim Kliemeck +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . + +# WANT_JSON +# POWERSHELL_COMMON + +#Functions +Function UserSearch +{ + Param ([string]$AccountName) + #Check if there's a realm specified + if ($AccountName.Split("\").count -gt 1) + { + if ($AccountName.Split("\")[0] -eq $env:COMPUTERNAME) + { + $IsLocalAccount = $true + } + Else + { + $IsDomainAccount = $true + $IsUpn = $false + } + + } + Elseif ($AccountName -contains "@") + { + $IsDomainAccount = $true + $IsUpn = $true + } + Else + { + #Default to local user account + $accountname = $env:COMPUTERNAME + "\" + $AccountName + $IsLocalAccount = $true + } + + + if ($IsLocalAccount -eq $true) + { + # do not use Win32_UserAccount, because e.g. SYSTEM (BUILTIN\SYSTEM or COMPUUTERNAME\SYSTEM) will not be listed. on Win32_Account groups will be listed too + $localaccount = get-wmiobject -class "Win32_Account" -namespace "root\CIMV2" -filter "(LocalAccount = True)" | where {$_.Caption -eq $AccountName} + if ($localaccount) + { + return $localaccount.SID + } + } + ElseIf (($IsDomainAccount -eq $true) -and ($IsUpn -eq $false)) + { + #Search by samaccountname + $Searcher = [adsisearcher]"" + $Searcher.Filter = "sAMAccountName=$($accountname.split("\")[1])" + $result = $Searcher.FindOne() + + if ($result) + { + $user = $result.GetDirectoryEntry() + + # get binary SID from AD account + $binarySID = $user.ObjectSid.Value + + # convert to string SID + return (New-Object System.Security.Principal.SecurityIdentifier($binarySID,0)).Value + } + } + +} + +$params = Parse-Args $args; + +$result = New-Object PSObject; +Set-Attr $result "changed" $false; + +$path = Get-Attr $params "path" -failifempty $true +$user = Get-Attr $params "user" -failifempty $true +$recurse = Get-Attr $params "recurse" "no" -validateSet "no","yes" -resultobj $result + +If (-Not (Test-Path -Path $path)) { + Fail-Json $result "$path file or directory does not exist on the host" +} + +# Test that the user/group is resolvable on the local machine +$sid = UserSearch -AccountName ($user) +if (!$sid) +{ + Fail-Json $result "$user is not a valid user or group on the host machine or domain" +} + +Try { + $objUser = New-Object System.Security.Principal.SecurityIdentifier($sid) + + $file = Get-Item -Path $path + $acl = Get-Acl $file.FullName + + If ($acl.getOwner([System.Security.Principal.SecurityIdentifier]) -ne $objUser) { + Set-Attr $result "changed" $true; + } + + $acl.setOwner($objUser) + Set-Acl $file.FullName $acl + + If ($recurse -eq "yes") { + $files = Get-ChildItem -Path $path -Force -Recurse + ForEach($file in $files){ + $acl = Get-Acl $file.FullName + + If ($acl.getOwner([System.Security.Principal.SecurityIdentifier]) -ne $objUser) { + Set-Attr $result "changed" $true; + } + + $acl.setOwner($objUser) + Set-Acl $file.FullName $acl + } + } +} +Catch { + Fail-Json $result "an error occured when attempting to change owner on $path for $user" +} + +Exit-Json $result diff --git a/windows/win_owner.py b/windows/win_owner.py new file mode 100644 index 00000000000..9af816abfe9 --- /dev/null +++ b/windows/win_owner.py @@ -0,0 +1,67 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- + +# Copyright 2015, Hans-Joachim Kliemeck +# +# This file is part of Ansible +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . + +# this is a windows documentation stub. actual code lives in the .ps1 +# file of the same name + +DOCUMENTATION = ''' +--- +module: win_service_configure +version_added: "2.0" +short_description: Set owner +description: + - Set owner of files or directories +options: + path: + description: + - Path to be used for changing owner + required: true + default: null + user: + description: + - Name to be used for changing owner + required: true + default: null + recurse: + description: + - Indicates if the owner should be changed recursively + required: false + choices: + - no + - yes + default: no +author: Hans-Joachim Kliemeck +''' + +EXAMPLES = ''' +# Playbook example +--- +- name: Change owner of Path + win_owner: + path: 'C:\\apache\\' + user: apache + recurse: yes + +- name: Set the owner of root directory + win_owner: + path: 'C:\\apache\\' + user: SYSTEM + recurse: no +'''