Skip to content

Commit 6e2c4ea

Browse files
author
Kalinga Bhusan Ray
committed
win permision using python
1 parent 5dc8e74 commit 6e2c4ea

File tree

1 file changed

+354
-0
lines changed

1 file changed

+354
-0
lines changed

‎tutorials/windows/win_permission.py‎

Lines changed: 354 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,354 @@
1+
import os, sys, re
2+
from shutil import copyfile
3+
import ntsecuritycon as con
4+
import win32security
5+
import win32api
6+
import shutil
7+
import psutil,getpass
8+
9+
#http://pyxr.sourceforge.net/PyXR/c/python24/lib/site-packages/win32/lib/ntsecuritycon.py.html
10+
#0003 DELETE = (65536)
11+
#0004 READ_CONTROL = (131072)
12+
#0005 WRITE_DAC = (262144)
13+
#0006 WRITE_OWNER = (524288)
14+
#0007 SYNCHRONIZE = (1048576)
15+
#0008 STANDARD_RIGHTS_REQUIRED = (983040)
16+
#0009 STANDARD_RIGHTS_READ = (READ_CONTROL)
17+
#0010 STANDARD_RIGHTS_WRITE = (READ_CONTROL)
18+
#0011 STANDARD_RIGHTS_EXECUTE = (READ_CONTROL)
19+
#0012 STANDARD_RIGHTS_ALL = (2031616)
20+
#0013 SPECIFIC_RIGHTS_ALL = (65535)
21+
#0014 ACCESS_SYSTEM_SECURITY = (16777216)
22+
#0015 MAXIMUM_ALLOWED = (33554432)
23+
#0016 GENERIC_READ = (-2147483648)
24+
#0017 GENERIC_WRITE = (1073741824)
25+
#0018 GENERIC_EXECUTE = (536870912)
26+
#0019 GENERIC_ALL = (268435456)
27+
#0020
28+
#0021 # file security permissions
29+
#0022 FILE_READ_DATA= ( 1 )
30+
#0023 FILE_LIST_DIRECTORY= ( 1 )
31+
#0024 FILE_WRITE_DATA= ( 2 )
32+
#0025 FILE_ADD_FILE= ( 2 )
33+
#0026 FILE_APPEND_DATA= ( 4 )
34+
#0027 FILE_ADD_SUBDIRECTORY= ( 4 )
35+
#0028 FILE_CREATE_PIPE_INSTANCE= ( 4 )
36+
#0029 FILE_READ_EA= ( 8 )
37+
#0030 FILE_WRITE_EA= ( 16 )
38+
#0031 FILE_EXECUTE= ( 32 )
39+
#0032 FILE_TRAVERSE= ( 32 )
40+
#0033 FILE_DELETE_CHILD= ( 64 )
41+
#0034 FILE_READ_ATTRIBUTES= ( 128 )
42+
#0035 FILE_WRITE_ATTRIBUTES= ( 256 )
43+
#0036 FILE_ALL_ACCESS= (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 1023)
44+
#0037 FILE_GENERIC_READ= (STANDARD_RIGHTS_READ | FILE_READ_DATA | FILE_READ_ATTRIBUTES | FILE_READ_EA | SYNCHRONIZE)
45+
#0038 FILE_GENERIC_WRITE= (STANDARD_RIGHTS_WRITE | FILE_WRITE_DATA | FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA | FILE_APPEND_DATA | SYNCHRONIZE)
46+
#0039 FILE_GENERIC_EXECUTE= (STANDARD_RIGHTS_EXECUTE | FILE_READ_ATTRIBUTES | FILE_EXECUTE | SYNCHRONIZE)
47+
48+
49+
########Currently NOT used#####
50+
def win32_set_file_access(filename, access_right, allow = True):
51+
userx, domain, type = win32security.LookupAccountName ("", win32api.GetUserName())
52+
#print "#GetUserName from win32api:", win32api.GetUserName()
53+
print "#Gettings details:"
54+
print "userx", userx
55+
print "GetSubAuthorityCount", userx.GetSubAuthorityCount()
56+
print "GetSubAuthority", userx.GetSubAuthority()
57+
print "GetSidIdentifierAuthority", userx.GetSidIdentifierAuthority()
58+
print "domain from win32security: ", domain
59+
print "type", type
60+
sd = win32security.GetFileSecurity(filename, win32security.DACL_SECURITY_INFORMATION)
61+
dacl = sd.GetSecurityDescriptorDacl()
62+
ace_count = dacl.GetAceCount()
63+
print "#ace_count", ace_count
64+
for i in range(0, ace_count):
65+
dacl.DeleteAce(0)
66+
ace_count = dacl.GetAceCount()
67+
print "#ace_count after deleting all access control entires", ace_count
68+
69+
if allow:
70+
print "#Allow access", access_right
71+
dacl.AddAccessAllowedAceEx(win32security.ACL_REVISION, con.OBJECT_INHERIT_ACE|con.CONTAINER_INHERIT_ACE, FILE_ALL_ACCESS, userx)
72+
else:
73+
dacl.AddAccessDeniedAceEx(win32security.ACL_REVISION, con.OBJECT_INHERIT_ACE|con.CONTAINER_INHERIT_ACE, FILE_ALL_ACCESS, userx)
74+
print "#Deny access", access_right
75+
ace_count = dacl.GetAceCount()
76+
print "#ace_count after AddAccess*", ace_count
77+
78+
sd.SetSecurityDescriptorDacl(1, dacl, 0)
79+
win32security.SetFileSecurity(filename, win32security.DACL_SECURITY_INFORMATION, sd)
80+
81+
def updateACLEntries(filename):
82+
entries = [{'AccessMode': win32security.DENY_ACCESS,
83+
'AccessPermissions': 0,
84+
'Inheritance': win32security.CONTAINER_INHERIT_ACE |
85+
win32security.OBJECT_INHERIT_ACE,
86+
'Trustee': {'TrusteeType': win32security.TRUSTEE_IS_USER,
87+
'TrusteeForm': win32security.TRUSTEE_IS_NAME,
88+
'Identifier': ''}}
89+
]
90+
91+
entries[0]['AccessPermissions'] = ( con.FILE_ALL_ACCESS )
92+
entries[0]['Trustee']['Identifier'] = "USAU-VW-W2K16-0\hudson"
93+
94+
95+
sd = win32security.GetNamedSecurityInfo(filename, win32security.SE_FILE_OBJECT,
96+
win32security.DACL_SECURITY_INFORMATION)
97+
dacl = sd.GetSecurityDescriptorDacl()
98+
dacl.SetEntriesInAcl(entries)
99+
win32security.SetNamedSecurityInfo(filename, win32security.SE_FILE_OBJECT,
100+
win32security.DACL_SECURITY_INFORMATION |
101+
win32security.UNPROTECTED_DACL_SECURITY_INFORMATION,
102+
None, None, dacl, None)
103+
104+
import csv,subprocess
105+
def get_current_user_processes():
106+
csv_output = subprocess.check_output(["tasklist","/FI","USERNAME eq {}".format(os.getenv("USERNAME")),"/FO","CSV"]).decode("ascii","ignore")
107+
cr = csv.reader(csv_output.splitlines())
108+
next(cr) # skip title lines
109+
return {int(row[1]):row[0] for row in cr}
110+
111+
#####################################################
112+
113+
def get_owner(self):
114+
r""" Return the name of the owner of this file or directory.
115+
116+
This follows symbolic links.
117+
118+
On Windows, this returns a name of the form ur'DOMAIN\User Name'.
119+
On Windows, a group can own a file or directory.
120+
"""
121+
if os.name == 'nt':
122+
if win32security is None:
123+
raise Exception("path.owner requires win32all to be installed")
124+
desc = win32security.GetFileSecurity(
125+
self, win32security.OWNER_SECURITY_INFORMATION)
126+
sid = desc.GetSecurityDescriptorOwner()
127+
account, domain, typecode = win32security.LookupAccountSid(None, sid)
128+
return domain + u'\\' + account
129+
else:
130+
if pwd is None:
131+
raise NotImplementedError("path.owner is not implemented on this platform.")
132+
st = self.stat()
133+
return pwd.getpwuid(st.st_uid).pw_name
134+
135+
def user_account_details():
136+
userx, domain, type = win32security.LookupAccountName ("", win32api.GetUserName())
137+
print "#GetUserName from win32api:", win32api.GetUserName()
138+
print "#Gettings details:"
139+
print "userx", userx
140+
141+
subAuthorityCount = userx.GetSubAuthorityCount()
142+
print "ubAuthorityCount", subAuthorityCount
143+
144+
for i in range (0, subAuthorityCount):
145+
authority = userx.GetSubAuthority(i)
146+
print "authority", authority
147+
148+
print "GetSidIdentifierAuthority", userx.GetSidIdentifierAuthority()
149+
print "domain from win32security: ", domain
150+
print "type", type
151+
152+
print win32security.LookupAccountSid("", userx)
153+
154+
155+
# code samples found at
156+
# https://stackoverflow.com/questions/27500067/chmod-issue-to-change-file-permission-using-python
157+
# https://stackoverflow.com/questions/26465546/how-to-authorize-deny-write-access-to-a-directory-on-windows-using-python
158+
def win32_get_effective_rights(path):
159+
print ("*****************Effective Rights for %s*******************")%path
160+
161+
sd = win32security.GetFileSecurity(path, win32security.DACL_SECURITY_INFORMATION)
162+
dacl = sd.GetSecurityDescriptorDacl()
163+
mask = dacl.GetEffectiveRightsFromAcl({'TrusteeForm': win32security.TRUSTEE_IS_NAME, 'TrusteeType': win32security.TRUSTEE_IS_GROUP, 'Identifier': 'System'})
164+
print "mask for System", mask
165+
print calculate_plaintext_mask(mask)
166+
167+
mask = dacl.GetEffectiveRightsFromAcl({'TrusteeForm': win32security.TRUSTEE_IS_NAME, 'TrusteeType': win32security.TRUSTEE_IS_USER, 'Identifier': 'Administrator'})
168+
print "mask for Administrator", mask
169+
print calculate_plaintext_mask(mask)
170+
171+
mask = dacl.GetEffectiveRightsFromAcl({'TrusteeForm': win32security.TRUSTEE_IS_NAME, 'TrusteeType': win32security.TRUSTEE_IS_USER, 'Identifier': 'hudson'})
172+
print "mask for hudson", mask
173+
print calculate_plaintext_mask(mask)
174+
175+
mask = dacl.GetEffectiveRightsFromAcl({'TrusteeForm': win32security.TRUSTEE_IS_NAME, 'TrusteeType': win32security.TRUSTEE_IS_GROUP, 'Identifier': 'Everyone'})
176+
print "mask for Everyone", mask
177+
print calculate_plaintext_mask(mask)
178+
179+
mask = dacl.GetEffectiveRightsFromAcl({'TrusteeForm': win32security.TRUSTEE_IS_NAME, 'TrusteeType': win32security.TRUSTEE_IS_GROUP, 'Identifier': 'Users'})
180+
print "mask for users", mask
181+
print calculate_plaintext_mask(mask)
182+
183+
mask = dacl.GetEffectiveRightsFromAcl({'TrusteeForm': win32security.TRUSTEE_IS_NAME, 'TrusteeType': win32security.TRUSTEE_IS_GROUP, 'Identifier': 'kalinga'})
184+
print "mask for kalinga", mask
185+
print calculate_plaintext_mask(mask)
186+
187+
mask = dacl.GetEffectiveRightsFromAcl({'TrusteeForm': win32security.TRUSTEE_IS_NAME, 'TrusteeType': win32security.TRUSTEE_IS_GROUP, 'Identifier': 'Administrators'})
188+
print "mask for Administrators", mask
189+
print calculate_plaintext_mask(mask)
190+
print "************************************"
191+
192+
193+
def make_path_non_writable(filename):
194+
sd = win32security.GetFileSecurity(filename, win32security.DACL_SECURITY_INFORMATION)
195+
dacl = sd.GetSecurityDescriptorDacl()
196+
ace_count = dacl.GetAceCount()
197+
print "ace_count", ace_count
198+
199+
for i in range(0, ace_count):
200+
dacl.DeleteAce(0)
201+
202+
sd.SetSecurityDescriptorDacl(1, dacl, 0)
203+
win32security.SetFileSecurity(filename, win32security.DACL_SECURITY_INFORMATION, sd)
204+
205+
#rights = FILE_ALL_ACCESS
206+
rights = con.FILE_ADD_SUBDIRECTORY | con.FILE_ALL_ACCESS
207+
208+
win32_modify_rights(filename, "", "Administrators", rights, False)
209+
win32_modify_rights(filename, "", "Administrator", rights, False)
210+
win32_modify_rights(filename, "", "System", rights, False)
211+
win32_modify_rights(filename, "", "Users", rights, False)
212+
213+
win32_modify_rights(filename, "", "hudson", rights, False)
214+
win32_modify_rights(filename, "", "kalinga", rights, False)
215+
216+
def make_path_writable(filename):
217+
rights = con.FILE_ADD_SUBDIRECTORY | con.FILE_ALL_ACCESS
218+
win32_modify_rights(filename, "", "kalinga", rights, True)
219+
win32_modify_rights(filename, "", "hudson", rights, True)
220+
221+
def win32_modify_rights(filename, group, user, access_right, allow = True):
222+
sd = win32security.GetFileSecurity(filename, win32security.DACL_SECURITY_INFORMATION)
223+
dacl = sd.GetSecurityDescriptorDacl()
224+
ace_count = dacl.GetAceCount()
225+
print "ace_count", ace_count
226+
227+
if allow:
228+
print "#Allow access", access_right
229+
dacl.AddAccessAllowedAceEx(win32security.ACL_REVISION, con.OBJECT_INHERIT_ACE|con.CONTAINER_INHERIT_ACE, access_right, win32security.LookupAccountName("", user)[0])
230+
else:
231+
print "user", user, " PySID:", win32security.LookupAccountName("", user)[0]
232+
dacl.AddAccessDeniedAceEx(win32security.ACL_REVISION, con.OBJECT_INHERIT_ACE|con.CONTAINER_INHERIT_ACE, access_right, win32security.LookupAccountName("", user)[0])
233+
print "#Deny access", access_right
234+
ace_count = dacl.GetAceCount()
235+
print "ace_count", ace_count
236+
237+
sd.SetSecurityDescriptorDacl(1, dacl, 0)
238+
win32security.SetFileSecurity(filename, win32security.DACL_SECURITY_INFORMATION, sd)
239+
240+
241+
typical_aces={
242+
2032127L:"Full Control(All)",
243+
1179817L:"Read(RX)",
244+
1180086L:"Add",
245+
1180095L:"Add&Read",
246+
1245631L:"Change"
247+
}
248+
249+
binary_aces={
250+
1:"ACCESS_READ", #0x00000001
251+
2:"ACCESS_WRITE", #0x00000002
252+
4:"ACCESS_CREATE", #0x00000004 FILE_ADD_SUBDIRECTORY
253+
8:"ACCESS_EXEC", #0x00000008
254+
16:"ACCESS_DELETE", #0x00000010
255+
32:"ACCESS_ATRIB", #0x00000020
256+
64:"ACCESS_PERM", #0x00000040
257+
128:"FILE_READ_ATTRIBUTES", #0x00034
258+
256:"FILE_WRITE_ATTRIBUTES",#0x00035
259+
32768:"ACCESS_GROUP", #0x00008000
260+
65536:"DELETE", #0x00010000
261+
131072:"READ_CONTROL", #0x00020000
262+
262144:"WRITE_DAC", #0x00040000
263+
524288:"WRITE_OWNER", #0x00080000
264+
1048576:"SYNCHRONIZE", #0x00100000
265+
16777216:"ACCESS_SYSTEM_SECURITY",#0x01000000
266+
33554432:"MAXIMUM_ALLOWED", #0x02000000
267+
268435456:"GENERIC_ALL", #0x10000000
268+
536870912:"GENERIC_EXECUTE",#0x20000000
269+
1073741824:"GENERIC_WRITE", #0x40000000
270+
65535:"SPECIFIC_RIGHTS_ALL",#0x0000ffff
271+
983040:"STANDARD_RIGHTS_REQUIRED",#0x000f0000
272+
2031616:"STANDARD_RIGHTS_ALL",#0x001f0000
273+
274+
}
275+
276+
def calculate_plaintext_mask(mask):
277+
a=2147483648L
278+
#if typical_aces.has_key(mask):
279+
# return typical_aces[mask]
280+
#else:
281+
result='NONE'
282+
while a>>1:
283+
a=a>>1
284+
masked=mask&a
285+
if masked:
286+
print masked
287+
if binary_aces.has_key(masked):
288+
result=binary_aces[masked]+':'+result
289+
return result
290+
291+
def main():
292+
print "Enter main"
293+
294+
user_name = getpass.getuser()
295+
print "user_name", user_name
296+
297+
p = psutil.Process(os.getpid())
298+
print "pname", p.name()
299+
300+
print "domain = os.environ['userdomain']"
301+
domain = os.environ['userdomain']
302+
print domain
303+
usr = os.environ['username']
304+
print "username from env: ",usr
305+
306+
user_account_details()
307+
308+
basePath = r"C:\\tmp\\"
309+
310+
if os.path.exists(basePath):
311+
print "Trying to remove existing: ", basePath
312+
print "Owner", get_owner(basePath)
313+
shutil.rmtree(basePath)
314+
315+
print "Creating: ", basePath
316+
os.mkdir(basePath)
317+
318+
win32_get_effective_rights(basePath)
319+
320+
321+
print "make_path_non_writable object:", basePath
322+
make_path_non_writable(basePath)
323+
win32_get_effective_rights(basePath)
324+
325+
backup_dir = os.path.join(basePath,"_backups")
326+
print "Trying to create a subdirectory using os.mkdir inside: ", basePath
327+
os.mkdir(backup_dir)
328+
print ("Contents in %s:")% basePath
329+
contents = os.listdir(basePath)
330+
for c in contents:
331+
print c
332+
win32_get_effective_rights(backup_dir)
333+
win32_get_effective_rights(basePath)
334+
335+
open(os.path.join(basePath,"_backups","myFille.txt"), 'w+')
336+
print ("Contents in %s:")% basePath
337+
contents = os.listdir(basePath)
338+
for c in contents:
339+
print c
340+
341+
print ("copyfile")
342+
copyfile("C:\\testFile.txt", os.path.join(basePath,"_backups"))
343+
344+
contents = os.listdir(basePath)
345+
print ("Contents in %s:")% basePath
346+
for c in contents:
347+
print c
348+
349+
#print "Try to remove: ", basePath
350+
#shutil.rmtree(basePath)
351+
352+
353+
main()
354+

0 commit comments

Comments
 (0)