|< Windows Access Control Programming 3 | Main | Windows Access Control Programming 5 >|Site Index |Download |

MODULE I

WINDOWS OS SECURITY

::ACCESS CONTROL STORY::

PART 4

What are in this Module?

1. ACE Strings

2. The Description

3. ACE Inheritance Rules

The Description

ace_type - A string that indicates the value of theAceType member of theACE_HEADER structure. The ACE type string can be one of the following strings defined insddl.h.

If ace_type is ACCESS_ALLOWED_OBJECT_ACE_TYPE and neither object_guid nor inherit_object_guid has a GUID specified, then ConvertStringSecurityDescriptorToSecurityDescriptor() converts ace_type toACCESS_ALLOWED_ACE_TYPE.

ace_flags - A string that indicates the value of theAceFlags member of the ACE_HEADER structure.  The ACE flags string can be a concatenation of the following strings that defined in sddl.h.

rights - A string that indicates the access rights controlled by the ACE.  This string can be a hexadecimal string representation of the access rights, such as "0x7800003F", or it can be a concatenation of the following strings.

object_guid - A string representation of a GUID that indicates the value of the ObjectType member of an object-specific ACE structure, such asACCESS_ALLOWED_OBJECT_ACE.  The GUID string uses the format returned by theUuidToString() function.  The following table lists some commonly used object GUIDs.

inherit_object_guid - A string representation of a GUID that indicates the value of the InheritedObjectType member of an object-specific ACE structure.  The GUID string uses theUuidToString format.

account_sid - SID string that identifies the trustee of the ACE.

The following example shows an ACE string for an access-allowed ACE.  It is not an object-specific ACE, so it has no information in theobject_guid andinherit_object_guid fields.  The ace_flags field is also empty, which indicates that none of the ACE flags are set.

(A;;RPWPCCDCLCSWRCWDWOGA;;;S-1-0-0)

The ACE string shown above describes the following ACE information.

AceType:       0x00 (ACCESS_ALLOWED_ACE_TYPE)

AceFlags:      0x00

Access Mask:   0x100e003f

                    READ_CONTROL

                    WRITE_DAC

                    WRITE_OWNER

                    GENERIC_ALL

                    Other access rights(0x0000003f)

Ace Sid      : (S-1-0-0)

ACE Inheritance Rules

The system propagates inheritable ACEs to child objects according to a set of inheritance rules.  The system places inherited ACEs in the DACL of the child according to the preferred order of ACEs in a DACL.  The system sets the INHERITED_ACE flag in all inherited ACEs.  For Windows NT, Windows Me/98/95, the system does not set the INHERITED_ACE flag in all inherited ACEs.  The ACEs inherited by container and non-container child objects differ, depending on the combinations of inheritance flags.  These inheritance rules work the same for both DACLs and SACLs.

If an inherited ACE is an effective ACE for the child object, the system maps any generic rights to the specific rights for the child object.  Similarly, the system maps generic security identifiers (SIDs), such asCREATOR_OWNER, to the appropriate SID.  If an inherited ACE is an inherit-only ACE, any generic rights or generic SIDs are left unchanged so that they can be mapped appropriately when the ACE is inherited by the next generation of child objects.  For a case in which a container object inherits an ACE that is both effective on the container and inheritable by its descendants, the container may inherit two ACEs.  This occurs if the inheritable ACE contains generic information.  The container inherits an inherit-only ACE that contains the generic information and an effective-only ACE in which the generic information has been mapped.

An object-specific ACE has anInheritedObjectType member that can contain a GUID to identify the type of object that can inherit the ACE.  If the InheritedObjectType GUID is not specified, the inheritance rules for an object-specific ACE are the same as for a standard ACE.  If theInheritedObjectType GUID is specified, the ACE is inheritable by objects that match the GUID ifOBJECT_INHERIT_ACE is set, and by containers that match theGUID if CONTAINER_INHERIT_ACE is set.  Note that currently only DS objects support object-specific ACEs, and the DS treats all object types as containers.

Further reading and digging:

1. Structure, enum, union and typedef story can be foundC/C++ struct, enum, union & typedef.

2. Notation used in MSDN is Hungarian Notation instead of CamelCase and is discussedWindows programming notations.

3. Windows data type information is inWindows data types used in Win32 programming.

4. Check the best selling C, C++ and Windows books at Amazon.com.

5. Microsoft C references, online MSDN.

6. Microsoft Visual C++, online MSDN.

7. ReactOS - Windows binary compatible OS - C/C++ source code repository, Doxygen.

8. Linux Access Control Lists (ACL) info can be found atAccess Control Lists.

9. For Multi bytes, Unicode characters and Localization please refer to Locale, wide characters & Unicode (Story) and Windows users & groups programming tutorials (Implementation).

|< Windows Access Control Programming 3 | Main | Windows Access Control Programming 5 >|Site Index |Download |