| 12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758 |
- import win32security,win32file,win32api,ntsecuritycon,win32con, os
- from win32security import ACL_REVISION_DS, CONTAINER_INHERIT_ACE, OBJECT_INHERIT_ACE, \
- PROTECTED_DACL_SECURITY_INFORMATION, DACL_SECURITY_INFORMATION, SACL_SECURITY_INFORMATION, \
- OWNER_SECURITY_INFORMATION, GROUP_SECURITY_INFORMATION, SE_FILE_OBJECT
- ## SE_SECURITY_NAME needed to access SACL, SE_RESTORE_NAME needed to change owner to someone other than yourself
- new_privs = ((win32security.LookupPrivilegeValue('',ntsecuritycon.SE_SECURITY_NAME),win32con.SE_PRIVILEGE_ENABLED),
- (win32security.LookupPrivilegeValue('',ntsecuritycon.SE_RESTORE_NAME),win32con.SE_PRIVILEGE_ENABLED),
- )
- ph = win32api.GetCurrentProcess()
- th = win32security.OpenProcessToken(ph,win32security.TOKEN_ALL_ACCESS|win32con.TOKEN_ADJUST_PRIVILEGES)
- modified_privs=win32security.AdjustTokenPrivileges(th,0,new_privs)
- ## look up a few sids that should be available on most systems
- my_sid = win32security.GetTokenInformation(th,ntsecuritycon.TokenUser)[0]
- pwr_sid = win32security.LookupAccountName('','Power Users')[0]
- admin_sid = win32security.LookupAccountName('','Administrators')[0]
- everyone_sid=win32security.LookupAccountName('','EveryOne')[0]
- ## create a dir and set security so Everyone has read permissions, and all files and subdirs inherit its ACLs
- temp_dir=win32api.GetTempPath()
- dir_name=win32api.GetTempFileName(temp_dir,'sfa')[0]
- os.remove(dir_name)
- os.mkdir(dir_name)
- dir_dacl=win32security.ACL()
- dir_dacl.AddAccessAllowedAceEx(ACL_REVISION_DS, CONTAINER_INHERIT_ACE|OBJECT_INHERIT_ACE, win32con.GENERIC_READ, everyone_sid)
- ## make sure current user has permissions on dir
- dir_dacl.AddAccessAllowedAceEx(ACL_REVISION_DS, CONTAINER_INHERIT_ACE|OBJECT_INHERIT_ACE, win32con.GENERIC_ALL, my_sid)
- ## keep dir from inheriting any permissions so it only has ACEs explicitely set here
- win32security.SetNamedSecurityInfo(dir_name, SE_FILE_OBJECT,
- OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION|PROTECTED_DACL_SECURITY_INFORMATION,
- pwr_sid, pwr_sid, dir_dacl, None)
- ## Create a file in the dir and add some specific permissions to it
- fname=win32api.GetTempFileName(dir_name,'sfa')[0]
- print fname
- file_sd=win32security.GetNamedSecurityInfo(fname, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION|SACL_SECURITY_INFORMATION)
- file_dacl=file_sd.GetSecurityDescriptorDacl()
- file_sacl=file_sd.GetSecurityDescriptorSacl()
- if file_dacl is None:
- file_dacl=win32security.ACL()
- if file_sacl is None:
- file_sacl=win32security.ACL()
- file_dacl.AddAccessDeniedAce(file_dacl.GetAclRevision(),win32con.DELETE,admin_sid)
- file_dacl.AddAccessDeniedAce(file_dacl.GetAclRevision(),win32con.DELETE,my_sid)
- file_dacl.AddAccessAllowedAce(file_dacl.GetAclRevision(),win32con.GENERIC_ALL,pwr_sid)
- file_sacl.AddAuditAccessAce(file_dacl.GetAclRevision(),win32con.GENERIC_ALL,my_sid,True,True)
- win32security.SetNamedSecurityInfo(fname, SE_FILE_OBJECT,
- DACL_SECURITY_INFORMATION|SACL_SECURITY_INFORMATION,
- None, None, file_dacl, file_sacl)
-
- win32security.AdjustTokenPrivileges(th, 0, modified_privs)
|
