golden hour

/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules

File/Folder	Size	Actions
__init__.py	35 B
__pycache__	-
acme.py	12.74 KB
aix_group.py	4.12 KB
aix_shadow.py	1.93 KB
aixpkg.py	24.15 KB
aliases.py	5.07 KB
alternatives.py	5.71 KB
ansiblegate.py	19.51 KB
apache.py	12.47 KB
apcups.py	2.15 KB
apf.py	3.09 KB
apkpkg.py	16 KB
aptly.py	15.28 KB
aptpkg.py	116.64 KB
archive.py	48.63 KB
arista_pyeapi.py	22.06 KB
artifactory.py	24.78 KB
at.py	10.72 KB
at_solaris.py	8.51 KB
augeas_cfg.py	13.93 KB
aws_sqs.py	6.55 KB
azurearm_compute.py	20.8 KB
azurearm_dns.py	15.8 KB
azurearm_network.py	82.99 KB
azurearm_resource.py	35.75 KB
bamboohr.py	7.36 KB
baredoc.py	11.13 KB
bcache.py	28.97 KB
beacons.py	27.82 KB
bigip.py	69.11 KB
bluez_bluetooth.py	6.76 KB
boto3_elasticache.py	37.34 KB
boto3_elasticsearch.py	53.17 KB
boto3_route53.py	39.82 KB
boto3_sns.py	12.93 KB
boto_apigateway.py	61.86 KB
boto_asg.py	35.69 KB
boto_cfn.py	7.95 KB
boto_cloudfront.py	12.75 KB
boto_cloudtrail.py	14.45 KB
boto_cloudwatch.py	10.99 KB
boto_cloudwatch_event.py	9.48 KB
boto_cognitoidentity.py	14.63 KB
boto_datapipeline.py	6.94 KB
boto_dynamodb.py	14.98 KB
boto_ec2.py	79.27 KB
boto_efs.py	14.05 KB
boto_elasticache.py	23.69 KB
boto_elasticsearch_domain.py	15.85 KB
boto_elb.py	35.53 KB
boto_elbv2.py	10.78 KB
boto_iam.py	75.62 KB
boto_iot.py	26.2 KB
boto_kinesis.py	19.62 KB
boto_kms.py	17.29 KB
boto_lambda.py	35.05 KB
boto_rds.py	34.92 KB
boto_route53.py	32.55 KB
boto_s3.py	4.24 KB
boto_s3_bucket.py	31.8 KB
boto_secgroup.py	25.22 KB
boto_sns.py	7.22 KB
boto_sqs.py	6.43 KB
boto_ssm.py	3.63 KB
boto_vpc.py	113.08 KB
bower.py	5.85 KB
bridge.py	10.81 KB
bsd_shadow.py	6.25 KB
btrfs.py	33.66 KB
cabal.py	3.79 KB
capirca_acl.py	40.04 KB
cassandra_cql.py	54.16 KB
cassandra_mod.py	4.3 KB
celery.py	3.33 KB
ceph.py	15.82 KB
chassis.py	1.52 KB
chef.py	4.66 KB
chocolatey.py	41.55 KB
chronos.py	2.89 KB
chroot.py	11.73 KB
cimc.py	23.02 KB
ciscoconfparse_mod.py	14.79 KB
cisconso.py	3.83 KB
cloud.py	9.39 KB
cmdmod.py	163.73 KB
composer.py	10.31 KB
config.py	16.98 KB
consul.py	69.3 KB
container_resource.py	12.94 KB
cp.py	31.98 KB
cpan.py	5.54 KB
cron.py	28.09 KB
cryptdev.py	10.08 KB
csf.py	16.04 KB
cyg.py	8.32 KB
daemontools.py	5.41 KB
data.py	3.85 KB
datadog_api.py	7.76 KB
ddns.py	7.12 KB
deb_apache.py	7.41 KB
deb_postgres.py	4.18 KB
debconfmod.py	4.06 KB
debian_ip.py	64.91 KB
debian_service.py	6.55 KB
debuild_pkgbuild.py	34.68 KB
defaults.py	6.55 KB
devinfo.py	9.07 KB
devmap.py	627 B
dig.py	8.75 KB
disk.py	30.82 KB
djangomod.py	7.53 KB
dnsmasq.py	5.71 KB
dnsutil.py	11.51 KB
dockercompose.py	32.62 KB
dockermod.py	224.85 KB
dpkg_lowpkg.py	12.94 KB
drac.py	10.97 KB
dracr.py	38.53 KB
drbd.py	7.19 KB
dummyproxy_pkg.py	2.46 KB
dummyproxy_service.py	2.91 KB
ebuildpkg.py	38.74 KB
eix.py	1.58 KB
elasticsearch.py	51.44 KB
environ.py	8.96 KB
eselect.py	4.99 KB
esxcluster.py	1.66 KB
esxdatacenter.py	1.68 KB
esxi.py	2.79 KB
esxvm.py	1.63 KB
etcd_mod.py	8.56 KB
ethtool.py	11.12 KB
event.py	7.67 KB
extfs.py	8.78 KB
file.py	232.18 KB
firewalld.py	20.51 KB
freebsd_sysctl.py	4.99 KB
freebsd_update.py	6.19 KB
freebsdjail.py	7.16 KB
freebsdkmod.py	6.17 KB
freebsdpkg.py	17.04 KB
freebsdports.py	13.13 KB
freebsdservice.py	12.53 KB
freezer.py	10.2 KB
gcp_addon.py	4.07 KB
gem.py	10.6 KB
genesis.py	21.75 KB
gentoo_service.py	9.18 KB
gentoolkitmod.py	8.39 KB
git.py	172.01 KB
github.py	53.19 KB
glanceng.py	4.69 KB
glassfish.py	19.49 KB
glusterfs.py	19.55 KB
gnomedesktop.py	6.85 KB
google_chat.py	1.52 KB
gpg.py	39.09 KB
grafana4.py	30.27 KB
grains.py	21.81 KB
groupadd.py	11.87 KB
grub_legacy.py	3.08 KB
guestfs.py	2.37 KB
hadoop.py	3.76 KB
haproxyconn.py	10.17 KB
hashutil.py	6.77 KB
heat.py	25.25 KB
helm.py	39.27 KB
hg.py	7.16 KB
highstate_doc.py	22.76 KB
hosts.py	10.47 KB
http.py	3.76 KB
icinga2.py	4.46 KB
idem.py	1.75 KB
ifttt.py	2.28 KB
ilo.py	15.98 KB
incron.py	7.68 KB
influxdb08mod.py	15.07 KB
influxdbmod.py	16.13 KB
infoblox.py	17.53 KB
ini_manage.py	14.63 KB
inspectlib	-
inspector.py	8.19 KB
introspect.py	4.02 KB
iosconfig.py	14.78 KB
ipmi.py	25.47 KB
ipset.py	17.97 KB
iptables.py	57.44 KB
iwtools.py	3.99 KB
jboss7.py	20.51 KB
jboss7_cli.py	15.23 KB
jenkinsmod.py	11.9 KB
jinja.py	2.66 KB
jira_mod.py	7.07 KB
junos.py	73.96 KB
k8s.py	24.87 KB
kapacitor.py	5.37 KB
kerberos.py	5.42 KB
kernelpkg_linux_apt.py	6.71 KB
kernelpkg_linux_yum.py	7.26 KB
key.py	1007 B
keyboard.py	2.64 KB
keystone.py	43.14 KB
keystoneng.py	21.82 KB
keystore.py	7.18 KB
kmod.py	7.65 KB
kubeadm.py	34.64 KB
kubernetesmod.py	46.77 KB
launchctl_service.py	9.69 KB
layman.py	4.22 KB
ldap3.py	18.81 KB
ldapmod.py	5.9 KB
libcloud_compute.py	23.48 KB
libcloud_dns.py	9.73 KB
libcloud_loadbalancer.py	13.14 KB
libcloud_storage.py	12.16 KB
linux_acl.py	7.7 KB
linux_ip.py	5.55 KB
linux_lvm.py	17.86 KB
linux_service.py	4.64 KB
linux_shadow.py	12.96 KB
linux_sysctl.py	7.5 KB
localemod.py	11.84 KB
locate.py	2.58 KB
logadm.py	9.44 KB
logmod.py	1.25 KB
logrotate.py	7.72 KB
lvs.py	11.54 KB
lxc.py	147.27 KB
lxd.py	90.07 KB
mac_assistive.py	11.37 KB
mac_brew_pkg.py	19.91 KB
mac_desktop.py	2.77 KB
mac_group.py	6.62 KB
mac_keychain.py	6.39 KB
mac_pkgutil.py	2.84 KB
mac_portspkg.py	11.36 KB
mac_power.py	13.29 KB
mac_service.py	19.64 KB
mac_shadow.py	14.23 KB
mac_softwareupdate.py	14.52 KB
mac_sysctl.py	5.13 KB
mac_system.py	15.07 KB
mac_timezone.py	8.34 KB
mac_user.py	16.41 KB
mac_xattr.py	6.27 KB
macdefaults.py	2.33 KB
macpackage.py	6.66 KB
makeconf.py	17.31 KB
mandrill.py	6.31 KB
marathon.py	5.36 KB
match.py	13 KB
mattermost.py	3.4 KB
mdadm_raid.py	9.86 KB
mdata.py	3.38 KB
memcached.py	6.13 KB
mine.py	18.84 KB
minion.py	7.68 KB
mod_random.py	7.18 KB
modjk.py	12.48 KB
mongodb.py	29.75 KB
monit.py	5.51 KB
moosefs.py	3.87 KB
mount.py	58.44 KB
mssql.py	14.64 KB
msteams.py	2.11 KB
munin.py	2.4 KB
mysql.py	90.66 KB
nacl.py	9.72 KB
nagios.py	6.53 KB
nagios_rpc.py	5.09 KB
namecheap_domains.py	12.84 KB
namecheap_domains_dns.py	5.93 KB
namecheap_domains_ns.py	4.51 KB
namecheap_ssl.py	25.69 KB
namecheap_users.py	2.4 KB
napalm_bgp.py	9.72 KB
napalm_formula.py	11.33 KB
napalm_mod.py	61.37 KB
napalm_netacl.py	28.59 KB
napalm_network.py	93.22 KB
napalm_ntp.py	10.22 KB
napalm_probes.py	13.25 KB
napalm_route.py	5.09 KB
napalm_snmp.py	7.05 KB
napalm_users.py	6.49 KB
napalm_yang_mod.py	20.28 KB
netaddress.py	1.6 KB
netbox.py	32.22 KB
netbsd_sysctl.py	3.92 KB
netbsdservice.py	6.43 KB
netmiko_mod.py	19.61 KB
netscaler.py	27.02 KB
network.py	63.42 KB
neutron.py	44.92 KB
neutronng.py	15.02 KB
nexus.py	22.95 KB
nfs3.py	3.9 KB
nftables.py	33.58 KB
nginx.py	3.83 KB
nilrt_ip.py	36.18 KB
nix.py	8.03 KB
nova.py	19.6 KB
npm.py	10.4 KB
nspawn.py	41.35 KB
nxos.py	24.65 KB
nxos_api.py	14.72 KB
nxos_upgrade.py	14.74 KB
omapi.py	3.6 KB
openbsd_sysctl.py	3.74 KB
openbsdpkg.py	10.97 KB
openbsdrcctl_service.py	6.33 KB
openbsdservice.py	8.31 KB
openscap.py	2.81 KB
openstack_config.py	3.21 KB
openstack_mng.py	2.71 KB
openvswitch.py	17.19 KB
opkg.py	49.67 KB
opsgenie.py	3.29 KB
oracle.py	5.82 KB
osquery.py	24.93 KB
out.py	2.53 KB
pacmanpkg.py	31.92 KB
pagerduty.py	4.7 KB
pagerduty_util.py	13.48 KB
pam.py	2.01 KB
panos.py	61.05 KB
parallels.py	19.85 KB
parted_partition.py	21.53 KB
pcs.py	14.11 KB
pdbedit.py	10.79 KB
pecl.py	3.79 KB
peeringdb.py	8.39 KB
pf.py	9.51 KB
philips_hue.py	1.55 KB
pillar.py	21.37 KB
pip.py	53.42 KB
pkg_resource.py	12.3 KB
pkgin.py	17.29 KB
pkgng.py	61.07 KB
pkgutil.py	9.85 KB
portage_config.py	22.73 KB
postfix.py	16.24 KB
postgres.py	88.24 KB
poudriere.py	7.85 KB
powerpath.py	2.57 KB
proxy.py	11.49 KB
ps.py	20.89 KB
publish.py	10.25 KB
puppet.py	10.9 KB
purefa.py	33.59 KB
purefb.py	13.69 KB
pushbullet.py	1.88 KB
pushover_notify.py	3.48 KB
pw_group.py	4.62 KB
pw_user.py	12.47 KB
pyenv.py	6.93 KB
qemu_img.py	1.53 KB
qemu_nbd.py	3.28 KB
quota.py	6.43 KB
rabbitmq.py	38.4 KB
rallydev.py	6.09 KB
random_org.py	23.76 KB
rbac_solaris.py	16.05 KB
rbenv.py	10.75 KB
rdp.py	6.08 KB
rebootmgr.py	7.68 KB
redismod.py	16.36 KB
reg.py	16.36 KB
rest_pkg.py	2.26 KB
rest_sample_utils.py	558 B
rest_service.py	3.63 KB
restartcheck.py	24.1 KB
restconf.py	3.15 KB
ret.py	1.27 KB
rh_ip.py	38.55 KB
rh_service.py	16.61 KB
riak.py	5.19 KB
rpm_lowpkg.py	27.67 KB
rpmbuild_pkgbuild.py	24.53 KB
rsync.py	8.04 KB
runit.py	17.17 KB
rvm.py	11.1 KB
s3.py	9.93 KB
s6.py	3.62 KB
salt_proxy.py	4.48 KB
salt_version.py	4.58 KB
saltcheck.py	46.66 KB
saltcloudmod.py	954 B
saltutil.py	57.49 KB
schedule.py	50.81 KB
scp_mod.py	6.22 KB
scsi.py	2.66 KB
sdb.py	2.48 KB
seed.py	8.87 KB
selinux.py	24.2 KB
sensehat.py	7.79 KB
sensors.py	1.3 KB
serverdensity_device.py	8.1 KB
servicenow.py	4.36 KB
slack_notify.py	7.83 KB
slackware_service.py	6.84 KB
slsutil.py	19.04 KB
smartos_imgadm.py	12.04 KB
smartos_nictagadm.py	6.46 KB
smartos_virt.py	5.21 KB
smartos_vmadm.py	26.2 KB
smbios.py	10.05 KB
smf_service.py	8.52 KB
smtp.py	5.41 KB
snapper.py	27.14 KB
solaris_fmadm.py	11.2 KB
solaris_group.py	2.8 KB
solaris_shadow.py	7.98 KB
solaris_system.py	3.72 KB
solaris_user.py	11.06 KB
solarisipspkg.py	18.68 KB
solarispkg.py	15.4 KB
solr.py	45.54 KB
solrcloud.py	14.63 KB
splunk.py	8.14 KB
splunk_search.py	8.76 KB
sqlite3.py	2.54 KB
ssh.py	43.89 KB
ssh_pkg.py	1.08 KB
ssh_service.py	3.39 KB
state.py	82.34 KB
status.py	57.79 KB
statuspage.py	14.67 KB
supervisord.py	11.15 KB
suse_apache.py	2.45 KB
suse_ip.py	35.72 KB
svn.py	10.75 KB
swarm.py	13.5 KB
swift.py	5.53 KB
sysbench.py	6.62 KB
sysfs.py	6.61 KB
syslog_ng.py	31.52 KB
sysmod.py	22.59 KB
sysrc.py	3.38 KB
system.py	19.28 KB
system_profiler.py	3.54 KB
systemd_service.py	46.29 KB
telegram.py	3.28 KB
telemetry.py	12.87 KB
temp.py	831 B
test.py	15.4 KB
test_virtual.py	237 B
testinframod.py	9.92 KB
textfsm_mod.py	16.22 KB
timezone.py	19.98 KB
tls.py	58.63 KB
tomcat.py	18.59 KB
trafficserver.py	10.44 KB
transactional_update.py	35.83 KB
travisci.py	2.05 KB
tuned.py	2.34 KB
twilio_notify.py	2.95 KB
udev.py	3.72 KB
upstart_service.py	16.92 KB
uptime.py	3.23 KB
useradd.py	22.63 KB
uwsgi.py	996 B
vagrant.py	20.4 KB
varnish.py	3.08 KB
vault.py	15.61 KB
vbox_guest.py	10.55 KB
vboxmanage.py	14.71 KB
vcenter.py	1.61 KB
victorops.py	6.54 KB
virt.py	287.71 KB
virtualenv_mod.py	15.09 KB
vmctl.py	9.56 KB
vsphere.py	380.41 KB
webutil.py	3.66 KB
win_auditpol.py	4.74 KB
win_autoruns.py	2.29 KB
win_certutil.py	4.55 KB
win_dacl.py	32.27 KB
win_disk.py	1.8 KB
win_dism.py	20.7 KB
win_dns_client.py	4.19 KB
win_dsc.py	27.54 KB
win_event.py	22.32 KB
win_file.py	64.39 KB
win_firewall.py	20.15 KB
win_groupadd.py	11.27 KB
win_iis.py	68.78 KB
win_ip.py	11.43 KB
win_lgpo.py	491.76 KB
win_lgpo_reg.py	17.9 KB
win_license.py	2.72 KB
win_network.py	13.9 KB
win_ntp.py	1.8 KB
win_path.py	11.12 KB
win_pkg.py	86.43 KB
win_pki.py	15.8 KB
win_powercfg.py	9.85 KB
win_psget.py	8.97 KB
win_servermanager.py	14.21 KB
win_service.py	32.96 KB
win_shadow.py	3.03 KB
win_shortcut.py	16.49 KB
win_smtp_server.py	17.67 KB
win_snmp.py	13.38 KB
win_status.py	16.94 KB
win_system.py	40.61 KB
win_task.py	79.17 KB
win_timezone.py	13.3 KB
win_useradd.py	27.39 KB
win_wua.py	38.29 KB
win_wusa.py	5.88 KB
winrepo.py	6.09 KB
wordpress.py	4.71 KB
x509.py	63.1 KB
x509_v2.py	74.15 KB
xapi_virt.py	24.07 KB
xbpspkg.py	15.84 KB
xfs.py	15.35 KB
xml.py	2.14 KB
xmpp.py	5.28 KB
yaml.py	1.94 KB
yumpkg.py	116.5 KB
zabbix.py	97.55 KB
zcbuildout.py	28.16 KB
zenoss.py	5.64 KB
zfs.py	34.44 KB
zk_concurrency.py	11.16 KB
znc.py	2.26 KB
zoneadm.py	15.05 KB
zonecfg.py	21.85 KB
zookeeper.py	14.72 KB
zpool.py	44.02 KB
zypperpkg.py	94.87 KB

Edit: win_dacl.py

"""
Manage DACLs on Windows

:depends:   - winreg Python module
"""

import logging
import os
import re

import salt.utils.platform
from salt.exceptions import CommandExecutionError

# TODO: Figure out the exceptions that could be raised and properly catch
#       them instead of a bare except that catches any exception at all
#       may also need to add the ability to take ownership of an object to set
#       permissions if the minion is running as a user and not LOCALSYSTEM

try:
    import winreg

import ntsecuritycon
    import win32security

HAS_WINDOWS_MODULES = True
except ImportError:
    HAS_WINDOWS_MODULES = False

log = logging.getLogger(__name__)

# Define the module's virtual name
__virtualname__ = "win_dacl"

class daclConstants:
    """
    DACL constants used throughout the module
    """

# Definition in ntsecuritycon is incorrect (does not match winnt.h). The version
    # in ntsecuritycon has the extra bits 0x200 enabled.
    # Note that you when you set this permission what you'll generally get back is it
    # ORed with 0x200 (SI_NO_ACL_PROTECT), which is what ntsecuritycon incorrectly defines.

def __init__(self):
        self.FILE_ALL_ACCESS = (
            ntsecuritycon.STANDARD_RIGHTS_REQUIRED | ntsecuritycon.SYNCHRONIZE | 0x1FF
        )

self.hkeys_security = {
            "HKEY_LOCAL_MACHINE": "MACHINE",
            "HKEY_USERS": "USERS",
            "HKEY_CURRENT_USER": "CURRENT_USER",
            "HKEY_CLASSES_ROOT": "CLASSES_ROOT",
            "MACHINE": "MACHINE",
            "USERS": "USERS",
            "CURRENT_USER": "CURRENT_USER",
            "CLASSES_ROOT": "CLASSES_ROOT",
            "HKLM": "MACHINE",
            "HKU": "USERS",
            "HKCU": "CURRENT_USER",
            "HKCR": "CLASSES_ROOT",
        }
        self.rights = {
            win32security.SE_REGISTRY_KEY: {
                "READ": {"BITS": winreg.KEY_READ, "TEXT": "read"},
                "FULLCONTROL": {"BITS": winreg.KEY_ALL_ACCESS, "TEXT": "full control"},
            },
            win32security.SE_FILE_OBJECT: {
                "READ": {"BITS": ntsecuritycon.FILE_GENERIC_READ, "TEXT": "read"},
                "WRITE": {"BITS": ntsecuritycon.FILE_GENERIC_WRITE, "TEXT": "write"},
                "READ&EXECUTE": {
                    "BITS": ntsecuritycon.FILE_GENERIC_EXECUTE
                    | ntsecuritycon.FILE_GENERIC_READ,
                    "TEXT": "read and execute",
                },
                "MODIFY": {
                    "BITS": ntsecuritycon.FILE_GENERIC_WRITE
                    | ntsecuritycon.FILE_GENERIC_READ
                    | ntsecuritycon.FILE_GENERIC_EXECUTE
                    | ntsecuritycon.DELETE,
                    "TEXT": "modify",
                },
                "FULLCONTROL": {"BITS": self.FILE_ALL_ACCESS, "TEXT": "full control"},
            },
        }
        self.validAceTypes = {
            "ALLOW": {"TEXT": "allowed", "BITS": 0},
            "DENY": {"TEXT": "denied", "BITS": 1},
        }
        self.validPropagations = {
            win32security.SE_REGISTRY_KEY: {
                "KEY": {"TEXT": "this key only", "BITS": win32security.NO_INHERITANCE},
                "KEY&SUBKEYS": {
                    "TEXT": "this key and subkeys",
                    "BITS": win32security.CONTAINER_INHERIT_ACE,
                },
                "SUBKEYS": {
                    "TEXT": "subkeys only",
                    "BITS": win32security.INHERIT_ONLY_ACE
                    | win32security.CONTAINER_INHERIT_ACE,
                },
                "THIS KEY ONLY": {
                    "TEXT": "this key only",
                    "BITS": win32security.NO_INHERITANCE,
                },
                "THIS KEY AND SUBKEYS": {
                    "TEXT": "this key and subkeys",
                    "BITS": win32security.CONTAINER_INHERIT_ACE,
                },
                "SUBKEYS ONLY": {
                    "TEXT": "subkeys only",
                    "BITS": win32security.INHERIT_ONLY_ACE
                    | win32security.CONTAINER_INHERIT_ACE,
                },
            },
            win32security.SE_FILE_OBJECT: {
                "FILE": {
                    "TEXT": "this file/folder only",
                    "BITS": win32security.NO_INHERITANCE,
                },
                "FOLDER": {
                    "TEXT": "this file/folder only",
                    "BITS": win32security.NO_INHERITANCE,
                },
                "FOLDER&SUBFOLDERS&FILES": {
                    "TEXT": "this folder, subfolders, and files",
                    "BITS": win32security.CONTAINER_INHERIT_ACE
                    | win32security.OBJECT_INHERIT_ACE,
                },
                "FOLDER&SUBFOLDERS": {
                    "TEXT": "this folder and subfolders",
                    "BITS": win32security.CONTAINER_INHERIT_ACE,
                },
                "FOLDER&FILES": {
                    "TEXT": "this folder and files",
                    "BITS": win32security.OBJECT_INHERIT_ACE,
                },
                "SUBFOLDERS&FILES": {
                    "TEXT": "subfolders and files",
                    "BITS": win32security.INHERIT_ONLY_ACE
                    | win32security.CONTAINER_INHERIT_ACE
                    | win32security.OBJECT_INHERIT_ACE,
                },
                "SUBFOLDERS": {
                    "TEXT": "subfolders only",
                    "BITS": win32security.INHERIT_ONLY_ACE
                    | win32security.CONTAINER_INHERIT_ACE,
                },
                "FILES": {
                    "TEXT": "files only",
                    "BITS": win32security.INHERIT_ONLY_ACE
                    | win32security.OBJECT_INHERIT_ACE,
                },
                "THIS FILE ONLY": {
                    "TEXT": "this file/folder only",
                    "BITS": win32security.NO_INHERITANCE,
                },
                "THIS FOLDER ONLY": {
                    "TEXT": "this file/folder only",
                    "BITS": win32security.NO_INHERITANCE,
                },
                "THIS FOLDER, SUBFOLDERS, AND FILES": {
                    "TEXT": "this folder, subfolders, and files",
                    "BITS": win32security.CONTAINER_INHERIT_ACE
                    | win32security.OBJECT_INHERIT_ACE,
                },
                "THIS FOLDER AND SUBFOLDERS": {
                    "TEXT": "this folder and subfolders",
                    "BITS": win32security.CONTAINER_INHERIT_ACE,
                },
                "THIS FOLDER AND FILES": {
                    "TEXT": "this folder and files",
                    "BITS": win32security.OBJECT_INHERIT_ACE,
                },
                "SUBFOLDERS AND FILES": {
                    "TEXT": "subfolders and files",
                    "BITS": win32security.INHERIT_ONLY_ACE
                    | win32security.CONTAINER_INHERIT_ACE
                    | win32security.OBJECT_INHERIT_ACE,
                },
                "SUBFOLDERS ONLY": {
                    "TEXT": "subfolders only",
                    "BITS": win32security.INHERIT_ONLY_ACE
                    | win32security.CONTAINER_INHERIT_ACE,
                },
                "FILES ONLY": {
                    "TEXT": "files only",
                    "BITS": win32security.INHERIT_ONLY_ACE
                    | win32security.OBJECT_INHERIT_ACE,
                },
            },
        }
        self.reflection_mask = {
            True: winreg.KEY_ALL_ACCESS,
            False: winreg.KEY_ALL_ACCESS | winreg.KEY_WOW64_64KEY,
        }
        self.objectType = {
            "FILE": win32security.SE_FILE_OBJECT,
            "DIRECTORY": win32security.SE_FILE_OBJECT,
            "REGISTRY": win32security.SE_REGISTRY_KEY,
        }

def getObjectTypeBit(self, t):
        """
        returns the bit value of the string object type
        """
        if isinstance(t, str):
            t = t.upper()
            try:
                return self.objectType[t]
            except KeyError:
                raise CommandExecutionError(
                    'Invalid object type "{}". It should be one of the following:  {}'.format(
                        t, ", ".join(self.objectType)
                    )
                )
        else:
            return t

def getSecurityHkey(self, s):
        """
        returns the necessary string value for an HKEY for the win32security module
        """
        try:
            return self.hkeys_security[s]
        except KeyError:
            raise CommandExecutionError(
                'No HKEY named "{}".  It should be one of the following:  {}'.format(
                    s, ", ".join(self.hkeys_security)
                )
            )

def getPermissionBit(self, t, m):
        """
        returns a permission bit of the string permission value for the specified object type
        """
        try:
            if isinstance(m, str):
                return self.rights[t][m]["BITS"]
            else:
                return m
        except KeyError:
            raise CommandExecutionError(
                'No right "{}".  It should be one of the following:  {}'.format(
                    m, ", ".join(self.rights[t])
                )
            )

def getPermissionText(self, t, m):
        """
        returns the permission textual representation of a specified permission bit/object type
        """
        try:
            return self.rights[t][m]["TEXT"]
        except KeyError:
            raise CommandExecutionError(
                'No right "{}".  It should be one of the following:  {}'.format(
                    m, ", ".join(self.rights[t])
                )
            )

def getAceTypeBit(self, t):
        """
        returns the acetype bit of a text value
        """
        try:
            return self.validAceTypes[t]["BITS"]
        except KeyError:
            raise CommandExecutionError(
                'No ACE type "{}".  It should be one of the following:  {}'.format(
                    t, ", ".join(self.validAceTypes)
                )
            )

def getAceTypeText(self, t):
        """
        returns the textual representation of a acetype bit
        """
        try:
            return self.validAceTypes[t]["TEXT"]
        except KeyError:
            raise CommandExecutionError(
                'No ACE type "{}".  It should be one of the following:  {}'.format(
                    t, ", ".join(self.validAceTypes)
                )
            )

def getPropagationBit(self, t, p):
        """
        returns the propagation bit of a text value
        """
        try:
            return self.validPropagations[t][p]["BITS"]
        except KeyError:
            raise CommandExecutionError(
                'No propagation type of "{}".  It should be one of the following:  {}'.format(
                    p, ", ".join(self.validPropagations[t])
                )
            )

def getPropagationText(self, t, p):
        """
        returns the textual representation of a propagation bit
        """
        try:
            return self.validPropagations[t][p]["TEXT"]
        except KeyError:
            raise CommandExecutionError(
                'No propagation type of "{}".  It should be one of the following:  {}'.format(
                    p, ", ".join(self.validPropagations[t])
                )
            )

def processPath(self, path, objectType):
        """
        processes a path/object type combo and returns:
            registry types with the correct HKEY text representation
            files/directories with environment variables expanded
        """
        if objectType == win32security.SE_REGISTRY_KEY:
            splt = path.split("\\")
            hive = self.getSecurityHkey(splt.pop(0).upper())
            splt.insert(0, hive)
            path = r"\\".join(splt)
        else:
            path = os.path.expandvars(path)
        return path

def _getUserSid(user):
    """
    return a state error dictionary, with 'sid' as a field if it could be returned
    if user is None, sid will also be None
    """
    ret = {}

sid_pattern = r"^S-1(-\d+){1,}$"

if user and re.match(sid_pattern, user, re.I):
        try:
            sid = win32security.GetBinarySid(user)
        except Exception as e:  # pylint: disable=broad-except
            ret["result"] = False
            ret["comment"] = (
                "Unable to obtain the binary security identifier for {}.  The exception"
                " was {}.".format(user, e)
            )
        else:
            try:
                win32security.LookupAccountSid("", sid)
                ret["result"] = True
                ret["sid"] = sid
            except Exception as e:  # pylint: disable=broad-except
                ret["result"] = False
                ret["comment"] = (
                    "Unable to lookup the account for the security identifier {}.  The"
                    " exception was {}.".format(user, e)
                )
    else:
        try:
            sid = win32security.LookupAccountName("", user)[0] if user else None
            ret["result"] = True
            ret["sid"] = sid
        except Exception as e:  # pylint: disable=broad-except
            ret["result"] = False
            ret["comment"] = (
                "Unable to obtain the security identifier for {}.  The exception"
                " was {}.".format(user, e)
            )
    return ret

def __virtual__():
    """
    Only works on Windows systems
    """
    if salt.utils.platform.is_windows() and HAS_WINDOWS_MODULES:
        return __virtualname__
    return (False, "Module win_dacl: module only works on Windows systems")

def _get_dacl(path, objectType):
    """
    Gets the DACL of a path
    """
    try:
        dacl = win32security.GetNamedSecurityInfo(
            path, objectType, win32security.DACL_SECURITY_INFORMATION
        ).GetSecurityDescriptorDacl()
    except Exception:  # pylint: disable=broad-except
        dacl = None
    return dacl

def get(path, objectType, user=None):
    """
    Get the ACL of an object. Will filter by user if one is provided.

Args:
        path: The path to the object
        objectType: The type of object (FILE, DIRECTORY, REGISTRY)
        user: A user name to filter by

Returns (dict): A dictionary containing the ACL

CLI Example:

.. code-block:: bash

salt 'minion-id' win_dacl.get c:\temp directory
    """
    ret = {"Path": path, "ACLs": []}

sidRet = _getUserSid(user)

if path and objectType:
        dc = daclConstants()
        objectTypeBit = dc.getObjectTypeBit(objectType)
        path = dc.processPath(path, objectTypeBit)
        tdacl = _get_dacl(path, objectTypeBit)
        if tdacl:
            for counter in range(0, tdacl.GetAceCount()):
                tAce = tdacl.GetAce(counter)
                if not sidRet["sid"] or (tAce[2] == sidRet["sid"]):
                    ret["ACLs"].append(_ace_to_text(tAce, objectTypeBit))
    return ret

def add_ace(path, objectType, user, permission, acetype, propagation):
    r"""
    add an ace to an object

path:  path to the object (i.e. c:\\temp\\file, HKEY_LOCAL_MACHINE\\SOFTWARE\\KEY, etc)
    user: user to add
    permission:  permissions for the user
    acetype:  either allow/deny for each user/permission (ALLOW, DENY)
    propagation: how the ACE applies to children for Registry Keys and Directories(KEY, KEY&SUBKEYS, SUBKEYS)

CLI Example:

.. code-block:: bash

allow domain\fakeuser full control on HKLM\\SOFTWARE\\somekey, propagate to this key and subkeys
            salt 'myminion' win_dacl.add_ace 'HKEY_LOCAL_MACHINE\\SOFTWARE\\somekey' 'Registry' 'domain\fakeuser' 'FULLCONTROL' 'ALLOW' 'KEY&SUBKEYS'
    """
    ret = {"result": None, "changes": {}, "comment": ""}

if path and user and permission and acetype and propagation:
        if objectType.upper() == "FILE":
            propagation = "FILE"
        dc = daclConstants()
        objectTypeBit = dc.getObjectTypeBit(objectType)
        path = dc.processPath(path, objectTypeBit)
        user = user.strip()
        permission = permission.strip().upper()
        acetype = acetype.strip().upper()
        propagation = propagation.strip().upper()

sidRet = _getUserSid(user)
        if not sidRet["result"]:
            return sidRet
        permissionbit = dc.getPermissionBit(objectTypeBit, permission)
        acetypebit = dc.getAceTypeBit(acetype)
        propagationbit = dc.getPropagationBit(objectTypeBit, propagation)
        dacl = _get_dacl(path, objectTypeBit)

if dacl:
            acesAdded = []
            try:
                if acetypebit == 0:
                    dacl.AddAccessAllowedAceEx(
                        win32security.ACL_REVISION,
                        propagationbit,
                        permissionbit,
                        sidRet["sid"],
                    )
                elif acetypebit == 1:
                    dacl.AddAccessDeniedAceEx(
                        win32security.ACL_REVISION,
                        propagationbit,
                        permissionbit,
                        sidRet["sid"],
                    )
                win32security.SetNamedSecurityInfo(
                    path,
                    objectTypeBit,
                    win32security.DACL_SECURITY_INFORMATION,
                    None,
                    None,
                    dacl,
                    None,
                )
                acesAdded.append(
                    "{} {} {} on {}".format(
                        user,
                        dc.getAceTypeText(acetype),
                        dc.getPermissionText(objectTypeBit, permission),
                        dc.getPropagationText(objectTypeBit, propagation),
                    )
                )
                ret["result"] = True
            except Exception as e:  # pylint: disable=broad-except
                ret[
                    "comment"
                ] = "An error occurred attempting to add the ace.  The error was {}".format(
                    e
                )
                ret["result"] = False
                return ret
            if acesAdded:
                ret["changes"]["Added ACEs"] = acesAdded
        else:
            ret["comment"] = "Unable to obtain the DACL of {}".format(path)
    else:
        ret["comment"] = "An empty value was specified for a required item."
        ret["result"] = False
    return ret

def rm_ace(path, objectType, user, permission=None, acetype=None, propagation=None):
    r"""
    remove an ace to an object

path:  path to the object (i.e. c:\\temp\\file, HKEY_LOCAL_MACHINE\\SOFTWARE\\KEY, etc)
    user: user to remove
    permission:  permissions for the user
    acetypes:  either allow/deny for each user/permission (ALLOW, DENY)
    propagation: how the ACE applies to children for Registry Keys and Directories(KEY, KEY&SUBKEYS, SUBKEYS)

If any of the optional parameters are omitted (or set to None) they act as wildcards.

CLI Example:

.. code-block:: bash

remove allow domain\fakeuser full control on HKLM\\SOFTWARE\\somekey propagated to this key and subkeys
            salt 'myminion' win_dacl.rm_ace 'Registry' 'HKEY_LOCAL_MACHINE\\SOFTWARE\\somekey' 'domain\fakeuser' 'FULLCONTROL' 'ALLOW' 'KEY&SUBKEYS'
    """
    ret = {"result": None, "changes": {}, "comment": ""}

if path and user:
        dc = daclConstants()
        if propagation and objectType.upper() == "FILE":
            propagation = "FILE"
        objectTypeBit = dc.getObjectTypeBit(objectType)
        path = dc.processPath(path, objectTypeBit)

user = user.strip()
        permission = permission.strip().upper() if permission else None
        acetype = acetype.strip().upper() if acetype else None
        propagation = propagation.strip().upper() if propagation else None

if check_ace(path, objectType, user, permission, acetype, propagation, True)[
            "Exists"
        ]:
            sidRet = _getUserSid(user)
            if not sidRet["result"]:
                return sidRet
            permissionbit = (
                dc.getPermissionBit(objectTypeBit, permission) if permission else None
            )
            acetypebit = dc.getAceTypeBit(acetype) if acetype else None
            propagationbit = (
                dc.getPropagationBit(objectTypeBit, propagation)
                if propagation
                else None
            )
            dacl = _get_dacl(path, objectTypeBit)
            counter = 0
            acesRemoved = []
            while counter < dacl.GetAceCount():
                tAce = dacl.GetAce(counter)
                if (
                    tAce[0][1] & win32security.INHERITED_ACE
                ) != win32security.INHERITED_ACE:
                    if tAce[2] == sidRet["sid"]:
                        if not acetypebit or tAce[0][0] == acetypebit:
                            if not propagationbit or (
                                (tAce[0][1] & propagationbit) == propagationbit
                            ):
                                if not permissionbit or tAce[1] == permissionbit:
                                    dacl.DeleteAce(counter)
                                    counter = counter - 1
                                    acesRemoved.append(
                                        _ace_to_text(tAce, objectTypeBit)
                                    )

counter = counter + 1
            if acesRemoved:
                try:
                    win32security.SetNamedSecurityInfo(
                        path,
                        objectTypeBit,
                        win32security.DACL_SECURITY_INFORMATION,
                        None,
                        None,
                        dacl,
                        None,
                    )
                    ret["changes"]["Removed ACEs"] = acesRemoved
                    ret["result"] = True
                except Exception as e:  # pylint: disable=broad-except
                    ret["result"] = False
                    ret["comment"] = "Error removing ACE.  The error was {}.".format(e)
                    return ret
        else:
            ret["comment"] = "The specified ACE was not found on the path."
    return ret

def _ace_to_text(ace, objectType):
    """
    helper function to convert an ace to a textual representation
    """
    dc = daclConstants()
    objectType = dc.getObjectTypeBit(objectType)
    try:
        userSid = win32security.LookupAccountSid("", ace[2])
        if userSid[1]:
            userSid = "{1}\\{0}".format(userSid[0], userSid[1])
        else:
            userSid = "{}".format(userSid[0])
    except Exception:  # pylint: disable=broad-except
        userSid = win32security.ConvertSidToStringSid(ace[2])
    tPerm = ace[1]
    tAceType = ace[0][0]
    tProps = ace[0][1]
    tInherited = ""
    for x in dc.validAceTypes:
        if dc.validAceTypes[x]["BITS"] == tAceType:
            tAceType = dc.validAceTypes[x]["TEXT"]
            break
    for x in dc.rights[objectType]:
        if dc.rights[objectType][x]["BITS"] == tPerm:
            tPerm = dc.rights[objectType][x]["TEXT"]
            break
    if (tProps & win32security.INHERITED_ACE) == win32security.INHERITED_ACE:
        tInherited = "[Inherited]"
        tProps = tProps ^ win32security.INHERITED_ACE
    for x in dc.validPropagations[objectType]:
        if dc.validPropagations[objectType][x]["BITS"] == tProps:
            tProps = dc.validPropagations[objectType][x]["TEXT"]
            break
    return "{} {} {} on {} {}".format(userSid, tAceType, tPerm, tProps, tInherited)

def _set_dacl_inheritance(path, objectType, inheritance=True, copy=True, clear=False):
    """
    helper function to set the inheritance
    Args:

path (str): The path to the object

objectType (str): The type of object

inheritance (bool): True enables inheritance, False disables

copy (bool): Copy inherited ACEs to the DACL before disabling
        inheritance

clear (bool): Remove non-inherited ACEs from the DACL
    """
    ret = {"result": False, "comment": "", "changes": {}}

if path:
        try:
            sd = win32security.GetNamedSecurityInfo(
                path, objectType, win32security.DACL_SECURITY_INFORMATION
            )
            tdacl = sd.GetSecurityDescriptorDacl()
            if inheritance:
                if clear:
                    counter = 0
                    removedAces = []
                    while counter < tdacl.GetAceCount():
                        tAce = tdacl.GetAce(counter)
                        if (
                            tAce[0][1] & win32security.INHERITED_ACE
                        ) != win32security.INHERITED_ACE:
                            tdacl.DeleteAce(counter)
                            removedAces.append(_ace_to_text(tAce, objectType))
                        else:
                            counter = counter + 1
                    if removedAces:
                        ret["changes"]["Removed ACEs"] = removedAces
                else:
                    ret["changes"]["Non-Inherited ACEs"] = "Left in the DACL"
                win32security.SetNamedSecurityInfo(
                    path,
                    objectType,
                    win32security.DACL_SECURITY_INFORMATION
                    | win32security.UNPROTECTED_DACL_SECURITY_INFORMATION,
                    None,
                    None,
                    tdacl,
                    None,
                )
                ret["changes"]["Inheritance"] = "Enabled"
            else:
                if not copy:
                    counter = 0
                    inheritedAcesRemoved = []
                    while counter < tdacl.GetAceCount():
                        tAce = tdacl.GetAce(counter)
                        if (
                            tAce[0][1] & win32security.INHERITED_ACE
                        ) == win32security.INHERITED_ACE:
                            tdacl.DeleteAce(counter)
                            inheritedAcesRemoved.append(_ace_to_text(tAce, objectType))
                        else:
                            counter = counter + 1
                    if inheritedAcesRemoved:
                        ret["changes"]["Removed ACEs"] = inheritedAcesRemoved
                else:
                    ret["changes"]["Previously Inherited ACEs"] = "Copied to the DACL"
                win32security.SetNamedSecurityInfo(
                    path,
                    objectType,
                    win32security.DACL_SECURITY_INFORMATION
                    | win32security.PROTECTED_DACL_SECURITY_INFORMATION,
                    None,
                    None,
                    tdacl,
                    None,
                )
                ret["changes"]["Inheritance"] = "Disabled"
            ret["result"] = True
        except Exception as e:  # pylint: disable=broad-except
            ret["result"] = False
            ret[
                "comment"
            ] = "Error attempting to set the inheritance.  The error was {}.".format(e)

return ret

def enable_inheritance(path, objectType, clear=False):
    """
    enable/disable inheritance on an object

Args:
        path: The path to the object
        objectType: The type of object (FILE, DIRECTORY, REGISTRY)
        clear: True will remove non-Inherited ACEs from the ACL

Returns (dict): A dictionary containing the results

CLI Example:

.. code-block:: bash

salt 'minion-id' win_dacl.enable_inheritance c:\temp directory
    """
    dc = daclConstants()
    objectType = dc.getObjectTypeBit(objectType)
    path = dc.processPath(path, objectType)

return _set_dacl_inheritance(path, objectType, True, None, clear)

def disable_inheritance(path, objectType, copy=True):
    """
    Disable inheritance on an object

Args:
        path: The path to the object
        objectType: The type of object (FILE, DIRECTORY, REGISTRY)
        copy: True will copy the Inherited ACEs to the DACL before disabling inheritance

Returns (dict): A dictionary containing the results

CLI Example:

.. code-block:: bash

salt 'minion-id' win_dacl.disable_inheritance c:\temp directory
    """
    dc = daclConstants()
    objectType = dc.getObjectTypeBit(objectType)
    path = dc.processPath(path, objectType)

return _set_dacl_inheritance(path, objectType, False, copy, None)

def check_inheritance(path, objectType, user=None):
    """
    Check a specified path to verify if inheritance is enabled

Args:
        path: path of the registry key or file system object to check
        objectType: The type of object (FILE, DIRECTORY, REGISTRY)
        user: if provided, will consider only the ACEs for that user

Returns (bool): 'Inheritance' of True/False

CLI Example:

.. code-block:: bash

salt 'minion-id' win_dacl.check_inheritance c:\temp directory <username>
    """

ret = {"result": False, "Inheritance": False, "comment": ""}

sidRet = _getUserSid(user)

dc = daclConstants()
    objectType = dc.getObjectTypeBit(objectType)
    path = dc.processPath(path, objectType)

try:
        sd = win32security.GetNamedSecurityInfo(
            path, objectType, win32security.DACL_SECURITY_INFORMATION
        )
        dacls = sd.GetSecurityDescriptorDacl()
    except Exception as e:  # pylint: disable=broad-except
        ret["result"] = False
        ret[
            "comment"
        ] = "Error obtaining the Security Descriptor or DACL of the path: {}.".format(e)
        return ret

for counter in range(0, dacls.GetAceCount()):
        ace = dacls.GetAce(counter)
        if (ace[0][1] & win32security.INHERITED_ACE) == win32security.INHERITED_ACE:
            if not sidRet["sid"] or ace[2] == sidRet["sid"]:
                ret["Inheritance"] = True
                break

ret["result"] = True
    return ret

def check_ace(
    path,
    objectType,
    user,
    permission=None,
    acetype=None,
    propagation=None,
    exactPermissionMatch=False,
):
    """
    Checks a path to verify the ACE (access control entry) specified exists

Args:
        path:  path to the file/reg key
        objectType: The type of object (FILE, DIRECTORY, REGISTRY)
        user:  user that the ACL is for
        permission:  permission to test for (READ, FULLCONTROL, etc)
        acetype:  the type of ACE (ALLOW or DENY)
        propagation:  the propagation type of the ACE (FILES, FOLDERS, KEY, KEY&SUBKEYS, SUBKEYS, etc)
        exactPermissionMatch:  the ACL must match exactly, IE if READ is specified, the user must have READ exactly and not FULLCONTROL (which also has the READ permission obviously)

Returns (dict): 'Exists' true if the ACE exists, false if it does not

CLI Example:

.. code-block:: bash

salt 'minion-id' win_dacl.check_ace c:\temp directory <username> fullcontrol
    """
    ret = {"result": False, "Exists": False, "comment": ""}

dc = daclConstants()
    objectTypeBit = dc.getObjectTypeBit(objectType)
    path = dc.processPath(path, objectTypeBit)

permission = permission.upper() if permission else None
    acetype = acetype.upper() if permission else None
    propagation = propagation.upper() if propagation else None

permissionbit = (
        dc.getPermissionBit(objectTypeBit, permission) if permission else None
    )
    acetypebit = dc.getAceTypeBit(acetype) if acetype else None
    propagationbit = (
        dc.getPropagationBit(objectTypeBit, propagation) if propagation else None
    )

sidRet = _getUserSid(user)
    if not sidRet["result"]:
        return sidRet

dacls = _get_dacl(path, objectTypeBit)
    ret["result"] = True
    if dacls:
        for counter in range(0, dacls.GetAceCount()):
            ace = dacls.GetAce(counter)
            if ace[2] == sidRet["sid"]:
                if not acetypebit or ace[0][0] == acetypebit:
                    if (
                        not propagationbit
                        or (ace[0][1] & propagationbit) == propagationbit
                    ):
                        if not permissionbit:
                            ret["Exists"] = True
                            return ret
                        if exactPermissionMatch:
                            if ace[1] == permissionbit:
                                ret["Exists"] = True
                                return ret
                        else:
                            if (ace[1] & permissionbit) == permissionbit:
                                ret["Exists"] = True
                                return ret
    else:
        ret["comment"] = "No DACL found for object."
    return ret