File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/states/__pycache__/linux_acl.cpython-310.pyc
o
�N�g-e � @ sj d Z ddlZddlZddlZddlmZ e�e�Z dZ
dd� Z dd d
�Z dd d �Z
dd
d�Zddd�ZdS )a�
Linux File Access Control Lists
The Linux ACL state module requires the `getfacl` and `setfacl` binaries.
Ensure a Linux ACL is present
.. code-block:: yaml
root:
acl.present:
- name: /root
- acl_type: user
- acl_name: damian
- perms: rwx
Ensure a Linux ACL does not exist
.. code-block:: yaml
root:
acl.absent:
- name: /root
- acl_type: user
- acl_name: damian
- perms: rwx
Ensure a Linux ACL list is present
.. code-block:: yaml
root:
acl.list_present:
- name: /root
- acl_type: user
- acl_names:
- damian
- homer
- perms: rwx
Ensure a Linux ACL list does not exist
.. code-block:: yaml
root:
acl.list_absent:
- name: /root
- acl_type: user
- acl_names:
- damian
- homer
- perms: rwx
.. warning::
The effective permissions of Linux file access control lists (ACLs) are
governed by the "effective rights mask" (the `mask` line in the output of
the `getfacl` command) combined with the `perms` set by this module: any
permission bits (for example, r=read) present in an ACL but not in the mask
are ignored. The mask is automatically recomputed when setting an ACL, so
normally this isn't important. However, if the file permissions are
changed (with `chmod` or `file.managed`, for example), the mask will
generally be set based on just the group bits of the file permissions.
As a result, when using `file.managed` or similar to control file
permissions as well as this module, you should set your group permissions
to be at least as broad as any permissions in your ACL. Otherwise, the two
state declarations will each register changes each run, and if the `file`
declaration runs later, your ACL will be ineffective.
� N)�CommandExecutionErrorZaclc C s$ t jj�d�rt jj�d�rtS dS )z(
Ensure getfacl & setfacl exist
ZgetfaclZsetfacl)FzWThe linux_acl state cannot be loaded: the getfacl or setfacl binary is not in the path.)�salt�utils�path�which�__virtualname__� r r �I/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/linux_acl.py� __virtual__T s r
� Fc s� | di dd�}ddddd�� d d
d d d
�}t j�| �s(| � d�|d< d|d< |S td | |d�}|�d�rLd�|�d�dd� �} || �di �}
d} n|} || }
d} |dkrd|| �d��| d��n|�|
�| d�so| �r�z�fdd�|
| D ��� } W n t t
t t fy� d} Y nw | �r}t
� fdd�|D ��}
d}|r�|D ]7}d}| r�t j�|�s�q�|| �di �}n|| }|�| g �D ]}�|v r�|� d |
kr�d}q�|s�d} nq�n| � d t
� fd d�|D ��kr�d}nd}|s�d |d< |S | � d }d �||d@ ||d@ ||d@ �}|||d �|||d �d!�}td" �r4|�d#�|||�d|d$�� |S z'|�rAtd% | |dd&� td' |||| |dd&� |�d(|� �d|d$�� W |S t�y| } z|�d)�||j�dd*�� W Y d}~|S d}~ww d+|||d �i}td" �r�|�d,�||�d|d$�� d|d< |S z'|�r�td% | |dd&� td' |||| |dd&� |�d-|� �d|d$�� W |S t�y� } z|�d)�||j�dd*�� W Y d}~|S d}~ww d.|d< d|d< |S )/a�
Ensure a Linux ACL is present
name
The acl path
acl_type
The type of the acl is used for it can be 'user' or 'group'
acl_name
The user or group
perms
Set the permissions eg.: rwx
recurse
Set the permissions recursive in the path
force
Wipe out old permissions and ensure only the new permissions are set
Tr ��name�result�changes�comment� � � r ��r�w�x�-r r r r )r r r r � does not existr Fr � acl.getfacl�� recursive�zd:zdefault:�:N�defaultsc �$ g | ]}t t|�� ��� kr|�qS r ��next�iter�keys��.0�i�� _search_namer r �
<listcomp>� �
�zpresent.<locals>.<listcomp>c 3 � � | ] }� � ||�V qd S �N��getr% ��_octalr r � <genexpr>� � � zpresent.<locals>.<genexpr>�octalc 3 r, r- r. r% r0 r r r2 � r3 �$Permissions are in the desired statez{}{}{}��acl_name�acl_type�perms��new�old�test�4Updated permissions will be applied for {}: {} -> {}�r r r �
acl.wipefacls�r Z raise_err� acl.modfaclzUpdated permissions for �%Error updating permissions for {}: {}�r r r; �*New permissions will be applied for {}: {}z Applied new permissions for �ACL Type does not exist)�osr �exists�__salt__�
startswith�join�splitr/ �pop�AttributeError�
IndexError�
StopIteration�KeyError�sum�isdir�format�__opts__�updater �strerror)r
r8 r7 r9 �recurse�force�retZ
_octal_lookup�__current_perms� _acl_type�_current_perms�_default�userZ octal_sum� need_refreshr � acl_foundZ_current_perms_path�user_aclZ_numZ new_permsr �excr )r1 r) r �presentb s&
��� ���"i �
�
��
��
����>����6�� �
��� �������
�� rd c s� | di dd�}t j�| �s| � d�|d< d|d< |S td | |d �}|�d
�r>d �|�d �d d
� �}|| �di �}d} n|}|| }d} |dkrV|| �d��|d�� n|� |�|d
�s`| r�z� fdd�|| D ��� }
W n t t
t t fy~ d
}
Y nw d} |D ] } d}
|| �|g �D ]
}� |v r�d}
nq�|
r�d} nq�|
s�| r�d|d< t
d r�d
|d< |S td |||| |d � |S d|d< |S d|d< d|d< |S )a7
Ensure a Linux ACL does not exist
name
The acl path
acl_type
The type of the acl is used for, it can be 'user' or 'group'
acl_name
The user or group
perms
Remove the permissions eg.: rwx
recurse
Set the permissions recursive in the path
Tr r r r Fr r r r r r Nr c r r r! r% r( r r r* d r+ zabsent.<locals>.<listcomp>�Removing permissionsr= � acl.delfaclr5 rF )rG r rH rI rJ rK rL r/ rM rN rO rP rQ rU )r
r8 r7 r9 rX rZ r[ r\ r] r^ r_ r` r ra rb r r( r �absent0 sd
�������rg c s� |du rg }| di dd�}ddddd �� t � fd
d �|D ��}tj�| �s2| � d �|d
< d|d< |S td | �}|�d�rTd�|�d�dd� �} || �di �}
d} n~|} || }
d} |
�d
i ��dd�} |
�d
i ��dd�}
g }d}|
| D ]}|� � D ]}|�
|� d�� ||| d k}q~qx|dkr�z|� |
� W n t
y� Y nw z|� | � W n t
y� Y nw t|�t|�A }|s�|r�|s�| di d�|�d�}|S |dkr�|| �d
��| d�}n|}|
�| d�s�| �r�z i }|
| D ]}|�r tt|� � ��|v �r |�|� q�W n ttf�y d}Y nw |�rFi }t|�D �] \}}||v �r�|| d t � fdd �|D ��k�rEd|d
< �q#|�d �|�||d �d �|�|t|| d �d �d �� td �r~|�d �|t|| d �|�d|d!�� | S z-|�r�td" | |dd#� |D ]}td$ |||| |dd#� �q�|�d%�|�d|d!�� W �q# t�y� } z|�d&�||j�dd'�� W Y d}~�q#d}~ww d(d �|�||d �i}td �r�|�d)�||�d|d!�� d|d< | S z0|�r�td" | |dd#� |D ]}td$ |||| |dd#� �q|�d*�d �|��d|d!�� W �q# t�yC } z|�d&�||j�dd'�� W Y d}~�q#d}~ww |S d(d �|�||d �i}td �ri|�d)�||�d|d!�� d|d< |S z0|�rvtd" | |dd#� |D ]}td$ |||| |dd#� �qx|�d*�d �|��d|d!�� W |S t�y� } z|�d&�||j�dd'�� W Y d}~|S d}~ww d+|d
< d|d< |S ),a�
Ensure a Linux ACL list is present
Takes a list of acl names and add them to the given path
name
The acl path
acl_type
The type of the acl is used for it can be 'user' or 'group'
acl_names
The list of users or groups
perms
Set the permissions eg.: rwx
recurse
Set the permissions recursive in the path
force
Wipe out old permissions and ensure only the new permissions are set
NTr r r r r r r c 3 r, r- r. r% r0 r r r2 � r3 z list_present.<locals>.<genexpr>r r Fr r r r r �group�ownerzutf-8r4 r_ z,Permissions and {}s are in the desired statec 3 r, r- r. r% r0 r r r2 � s �
�r5 z, r6 r: r= r> r? r@ rA rB zUpdated permissions for {}rC rD r; rE z Applied new permissions for {}rF )rR rG r rH rI rJ rK rL r/ r$ �append�encode�remove�
ValueError�setrT r" r# rV rN rQ � enumerate�strrU r rW )r
r8 � acl_namesr9 rX rY rZ Z _octal_permsr[ r\ r] r^ Z
_origin_groupZ
_origin_ownerZ_current_acl_typesZ
diff_perms�keyZcurrent_acl_nameZ diff_acls�
_search_names�usersr' r �countZ search_namer7 rc r r0 r � list_present� s�
� � � ��
���
� ����
����
���
� �����
��
��� �
���
� �����F���
���
��������
�� rv c
C s� |du rg }| di dd�}t j�| �s | � d�|d< d|d< |S td | �}|�d
�rBd �|�d �d d� �}|| �d
i �}d}n|}|| }d}|sZt|| �d��|d��} nt|�} |�|d�sf|r�z i }
|| D ]} | r�t t
| � � ��| v r�|
� | � qmW n
t
tfy� d}
Y nw |
r�d|d< td r�d|d< |S |D ] } td || | |d� q�|S d|d< |S d|d< d|d< |S )aX
Ensure a Linux ACL list does not exist
Takes a list of acl names and remove them from the given path
name
The acl path
acl_type
The type of the acl is used for, it can be 'user' or 'group'
acl_names
The list of users or groups
recurse
Set the permissions recursive in the path
NTr r r r Fr r r r r r re r= rf r r5 rF )rG r rH rI rJ rK rL r/ rn r" r# r$ rV rN rQ rU )
r
r8 rq rX rZ r[ r\ r] r^ rs rt r' r7 r r r � list_absent� sT
�����rw )r r FF)r r F)Nr FF)NF)�__doc__�loggingrG Zsalt.utils.pathr Zsalt.exceptionsr � getLogger�__name__�logr r
rd rg rv rw r r r r �<module> s H
O
Y &