Spaces:
Sleeping
Sleeping
File size: 8,637 Bytes
10865e1 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 |
"""
Implements a permissions editor for services.
Service can be specified as plain name for local machine,
or as a remote service of the form \\machinename\service
"""
import os
import ntsecuritycon
import pythoncom
import win32api
import win32com.server.policy
import win32con
import win32security
import win32service
from win32com.authorization import authorization
SERVICE_GENERIC_EXECUTE = (
win32service.SERVICE_START
| win32service.SERVICE_STOP
| win32service.SERVICE_PAUSE_CONTINUE
| win32service.SERVICE_USER_DEFINED_CONTROL
)
SERVICE_GENERIC_READ = (
win32service.SERVICE_QUERY_CONFIG
| win32service.SERVICE_QUERY_STATUS
| win32service.SERVICE_INTERROGATE
| win32service.SERVICE_ENUMERATE_DEPENDENTS
)
SERVICE_GENERIC_WRITE = win32service.SERVICE_CHANGE_CONFIG
from ntsecuritycon import (
CONTAINER_INHERIT_ACE,
INHERIT_ONLY_ACE,
OBJECT_INHERIT_ACE,
PSPCB_SI_INITDIALOG,
READ_CONTROL,
SI_ACCESS_CONTAINER,
SI_ACCESS_GENERAL,
SI_ACCESS_PROPERTY,
SI_ACCESS_SPECIFIC,
SI_ADVANCED,
SI_CONTAINER,
SI_EDIT_ALL,
SI_EDIT_AUDITS,
SI_EDIT_PROPERTIES,
SI_PAGE_ADVPERM,
SI_PAGE_AUDIT,
SI_PAGE_OWNER,
SI_PAGE_PERM,
SI_PAGE_TITLE,
SI_RESET,
STANDARD_RIGHTS_EXECUTE,
STANDARD_RIGHTS_READ,
STANDARD_RIGHTS_WRITE,
WRITE_DAC,
WRITE_OWNER,
)
from pythoncom import IID_NULL
from win32com.shell.shellcon import ( # # Msg parameter to PropertySheetPageCallback
PSPCB_CREATE,
PSPCB_RELEASE,
)
from win32security import CONTAINER_INHERIT_ACE, INHERIT_ONLY_ACE, OBJECT_INHERIT_ACE
class ServiceSecurity(win32com.server.policy.DesignatedWrapPolicy):
_com_interfaces_ = [authorization.IID_ISecurityInformation]
_public_methods_ = [
"GetObjectInformation",
"GetSecurity",
"SetSecurity",
"GetAccessRights",
"GetInheritTypes",
"MapGeneric",
"PropertySheetPageCallback",
]
def __init__(self, ServiceName):
self.ServiceName = ServiceName
self._wrap_(self)
def GetObjectInformation(self):
"""Identifies object whose security will be modified, and determines options available
to the end user"""
flags = SI_ADVANCED | SI_EDIT_ALL | SI_PAGE_TITLE | SI_RESET
hinstance = 0 ## handle to module containing string resources
servername = "" ## name of authenticating server if not local machine
## service name can contain remote machine name of the form \\Server\ServiceName
objectname = os.path.split(self.ServiceName)[1]
pagetitle = "Service Permissions for " + self.ServiceName
objecttype = IID_NULL
return flags, hinstance, servername, objectname, pagetitle, objecttype
def GetSecurity(self, requestedinfo, bdefault):
"""Requests the existing permissions for object"""
if bdefault:
return win32security.SECURITY_DESCRIPTOR()
else:
return win32security.GetNamedSecurityInfo(
self.ServiceName, win32security.SE_SERVICE, requestedinfo
)
def SetSecurity(self, requestedinfo, sd):
"""Applies permissions to the object"""
owner = sd.GetSecurityDescriptorOwner()
group = sd.GetSecurityDescriptorGroup()
dacl = sd.GetSecurityDescriptorDacl()
sacl = sd.GetSecurityDescriptorSacl()
win32security.SetNamedSecurityInfo(
self.ServiceName,
win32security.SE_SERVICE,
requestedinfo,
owner,
group,
dacl,
sacl,
)
def GetAccessRights(self, objecttype, flags):
"""Returns a tuple of (AccessRights, DefaultAccess), where AccessRights is a sequence of tuples representing
SI_ACCESS structs, containing (guid, access mask, Name, flags). DefaultAccess indicates which of the
AccessRights will be used initially when a new ACE is added (zero based).
Flags can contain SI_ACCESS_SPECIFIC,SI_ACCESS_GENERAL,SI_ACCESS_CONTAINER,SI_ACCESS_PROPERTY,
CONTAINER_INHERIT_ACE,INHERIT_ONLY_ACE,OBJECT_INHERIT_ACE
"""
## input flags: SI_ADVANCED,SI_EDIT_AUDITS,SI_EDIT_PROPERTIES indicating which property sheet is requesting the rights
if (objecttype is not None) and (objecttype != IID_NULL):
## Not relevent for services
raise NotImplementedError("Object type is not supported")
## ???? for some reason, the DACL for a service will not retain ACCESS_SYSTEM_SECURITY in an ACE ????
## (IID_NULL, win32con.ACCESS_SYSTEM_SECURITY, 'View/change audit settings', SI_ACCESS_SPECIFIC),
accessrights = [
(
IID_NULL,
win32service.SERVICE_ALL_ACCESS,
"Full control",
SI_ACCESS_GENERAL,
),
(IID_NULL, SERVICE_GENERIC_READ, "Generic read", SI_ACCESS_GENERAL),
(IID_NULL, SERVICE_GENERIC_WRITE, "Generic write", SI_ACCESS_GENERAL),
(
IID_NULL,
SERVICE_GENERIC_EXECUTE,
"Start/Stop/Pause service",
SI_ACCESS_GENERAL,
),
(IID_NULL, READ_CONTROL, "Read Permissions", SI_ACCESS_GENERAL),
(IID_NULL, WRITE_DAC, "Change permissions", SI_ACCESS_GENERAL),
(IID_NULL, WRITE_OWNER, "Change owner", SI_ACCESS_GENERAL),
(IID_NULL, win32con.DELETE, "Delete service", SI_ACCESS_GENERAL),
(IID_NULL, win32service.SERVICE_START, "Start service", SI_ACCESS_SPECIFIC),
(IID_NULL, win32service.SERVICE_STOP, "Stop service", SI_ACCESS_SPECIFIC),
(
IID_NULL,
win32service.SERVICE_PAUSE_CONTINUE,
"Pause/unpause service",
SI_ACCESS_SPECIFIC,
),
(
IID_NULL,
win32service.SERVICE_USER_DEFINED_CONTROL,
"Execute user defined operations",
SI_ACCESS_SPECIFIC,
),
(
IID_NULL,
win32service.SERVICE_QUERY_CONFIG,
"Read configuration",
SI_ACCESS_SPECIFIC,
),
(
IID_NULL,
win32service.SERVICE_CHANGE_CONFIG,
"Change configuration",
SI_ACCESS_SPECIFIC,
),
(
IID_NULL,
win32service.SERVICE_ENUMERATE_DEPENDENTS,
"List dependent services",
SI_ACCESS_SPECIFIC,
),
(
IID_NULL,
win32service.SERVICE_QUERY_STATUS,
"Query status",
SI_ACCESS_SPECIFIC,
),
(
IID_NULL,
win32service.SERVICE_INTERROGATE,
"Query status (immediate)",
SI_ACCESS_SPECIFIC,
),
]
return (accessrights, 0)
def MapGeneric(self, guid, aceflags, mask):
"""Converts generic access rights to specific rights."""
return win32security.MapGenericMask(
mask,
(
SERVICE_GENERIC_READ,
SERVICE_GENERIC_WRITE,
SERVICE_GENERIC_EXECUTE,
win32service.SERVICE_ALL_ACCESS,
),
)
def GetInheritTypes(self):
"""Specifies which types of ACE inheritance are supported.
Services don't use any inheritance
"""
return ((IID_NULL, 0, "Only current object"),)
def PropertySheetPageCallback(self, hwnd, msg, pagetype):
"""Invoked each time a property sheet page is created or destroyed."""
## page types from SI_PAGE_TYPE enum: SI_PAGE_PERM SI_PAGE_ADVPERM SI_PAGE_AUDIT SI_PAGE_OWNER
## msg: PSPCB_CREATE, PSPCB_RELEASE, PSPCB_SI_INITDIALOG
return None
def EditSecurity(self, owner_hwnd=0):
"""Creates an ACL editor dialog based on parameters returned by interface methods"""
isi = pythoncom.WrapObject(
self, authorization.IID_ISecurityInformation, pythoncom.IID_IUnknown
)
authorization.EditSecurity(owner_hwnd, isi)
if __name__ == "__main__":
# Find the first service on local machine and edit its permissions
scm = win32service.OpenSCManager(
None, None, win32service.SC_MANAGER_ENUMERATE_SERVICE
)
svcs = win32service.EnumServicesStatus(scm)
win32service.CloseServiceHandle(scm)
si = ServiceSecurity(svcs[0][0])
si.EditSecurity()
|