Re: Using Security Descriptors as containers for SIDs


<hull.cary@xxxxxxxxx> wrote in message
news:1133985637.248635.283320@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
> I'm working with the following Win32 API functions:
> GetNamedSecurityInfo, AllocateAndInitializeSid, and
> SetSecurityDescriptorOwner.
>
> 1. I'm using GetNamedSecurityInfo to get the
> OWNER_SECURTIY_INFORMATION.
>
> 2. I'm creating a SID for the BUILTIN\Administrators group with
> AllocateAndInitializeSid.
>
> 3. I'm trying to set the new owner SID (created in step two) into the
> security descriptor (gathered in step one) using
> SetSecurityDescriptorOwner.
>
> The problem is that step three fails with GetLastError == 1338
> (ERROR_INVALID_SECURITY_DESCR). This error is pretty funny to me
> because *just* before I call SetSecurityDescriptorOwner, I call
> IsValidSecurityDescriptor on the security descriptor I'm passing to
> SetSecurityDescriptorOwner, and it returns TRUE! So, one function says,
> "yes, this is valid" and the very next one says, "no, it's not!"

IsValidSecurityDescriptor is checking if the security descriptor is ready
for a call to AccessCheck, not if it is ready for a call to any of the edit
functions. So, yes, it is valid to pass a security descriptor with only the
owner to SetXxxSecurity(), it isn't for AccessCheck.


.

Loading