saltstack / saltstack/salt

win_dacl module returns READ&EXECUTE rather than READANDEXECUTE

Open
#57,099 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug severity-medium
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description
check_ace in the win_dacl module returns READANDEXECUTE for the permissions. It fails the comparison against self.right, which contains READ&EXECUTE.

Setup
deployuser_recycleperms:
win_dacl.present:
- name: '%SystemRoot%\System32\inetsrv\config\redirection.config'
- objectType: File
- user: cruisecontrol
- permission: READ
- acetype: ALLOW
- propagation: 'THIS FILE ONLY'
- require:
- user: cruisecontrol_user

Steps to Reproduce the behavior
Call the above state.
The permissions are set correctly.
The validation fails, however, causing the state to fail.

----------
          ID: deployuser_recycleperms
    Function: win_dacl.present
        Name: %SystemRoot%\System32\inetsrv\config\redirection.config
      Result: False
     Comment: An exception occurred in this state: Traceback (most recent call last):
                File "C:\salt\bin\lib\site-packages\salt\modules\win_dacl.py", line 225, in getPermissionBit
                  return self.rights[t][m]['BITS']
              KeyError: 'READANDEXECUTE'

              During handling of the above exception, another exception occurred:

              Traceback (most recent call last):
                File "C:\salt\bin\lib\site-packages\salt\state.py", line 1933, in call
                  **cdata['kwargs'])
                File "C:\salt\bin\lib\site-packages\salt\loader.py", line 1951, in wrapper
                  return f(*args, **kwargs)
                File "C:\salt\bin\lib\site-packages\salt\states\win_dacl.py", line 94, in present
                  tRet = __salt__['win_dacl.check_ace'](name, objectType, user, permission, acetype, propagation, True)
                File "C:\salt\bin\lib\site-packages\salt\modules\win_dacl.py", line 781, in check_ace
                  permissionbit = dc.getPermissionBit(objectTypeBit, permission) if permission else None
                File "C:\salt\bin\lib\site-packages\salt\modules\win_dacl.py", line 231, in getPermissionBit
                  .format(m, ', '.join(self.rights[t])))
              salt.exceptions.CommandExecutionError: No right "READANDEXECUTE".  It should be one of the following:  FULLCONTROL, MODIFY, READ&EXECUTE, READ, WRITE
     Started: 18:23:28.020375
    Duration: 49.784 ms
     Changes:

Expected behavior
READ&EXECUTE should match READ&EXECUTE.
-or-
The module should be updated to match the permissions returned by the system.

Screenshots
N/A

Versions Report

salt --versions-report (Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)
Salt Version:
           Salt: 2019.2.2

Dependency Versions:
           cffi: 1.12.2
       cherrypy: 17.4.1
       dateutil: 2.8.0
      docker-py: Not Installed
          gitdb: 2.0.6
      gitpython: 2.1.10
          ioflo: Not Installed
         Jinja2: 2.10.1
        libgit2: Not Installed
        libnacl: 1.6.1
       M2Crypto: Not Installed
           Mako: 1.0.7
   msgpack-pure: Not Installed
 msgpack-python: 0.5.6
   mysql-python: Not Installed
      pycparser: 2.19
       pycrypto: Not Installed
   pycryptodome: 3.8.1
         pygit2: Not Installed
         Python: 3.5.4 (v3.5.4:3f56838, Aug  8 2017, 02:17:05) [MSC v.1900 64 bit (AMD64)]
   python-gnupg: 0.4.4
         PyYAML: 3.13
          PyZMQ: 18.0.1
           RAET: Not Installed
          smmap: 2.0.5
        timelib: 0.2.4
        Tornado: 4.5.3
            ZMQ: 4.3.1

System Versions:
           dist:
         locale: cp1252
        machine: AMD64
        release: 2019Server
         system: Windows
        version: 2019Server 10.0.17763 SP0 Multiprocessor Free

Additional context
Documentation is missing of the available values, as well.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with salt/modules/win_dacl.py, especially getPermissionBit and check_ace, and trace the permissions returned for the reproduced win_dacl.present state. Compare the accepted rights with the system's returned value and review salt/states/win_dacl.py for the validation path. Done means the reported permission validates correctly and the available permission values are documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
devops
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.