NULL DACL versis Empty DACL and Owner implcit access
- From: "Paul Baker [MVP, Windows - SDK]" <paulrichardbaker@xxxxxxxxxxxxxxxx>
- Date: Thu, 30 Aug 2007 10:13:49 -0400
There was question on microsoft.public.windowsxp.print_fax that I was able
to resolve, but there are some things that I do not completely understand.
Cannot install new printer drivers:
http://groups.google.com/group/microsoft.public.windowsxp.print_fax/browse_thread/thread/82d6284ca5b17f25
The poster received an 'Access denied' error installing a printer driver.
Process Monitor showed that it was able to create a "New" subfolder in
"C:\windows\system32\spool\drivers\w32x86\3" but not create a file in it.
According to the CACLS command line tool, he had correct permissions on the
"C:\windows\system32\spool\drivers\w32x86" folder. However, for the "3"
subfolder, CACLs listed no ACEs, leading us to believe that the DACL was
either NULL or empty (or is there a different explanation?)
Null DACLs and Empty DACLs:
http://msdn2.microsoft.com/en-us/library/aa379286.aspx
If the DACL were empty, it would grant everyone full access and I would not
expect the access described above to be denied. If the DACL were NULL, I
would expect that access would be denied to create a subfolder, but it was
not.
Owner of a New Object:
http://msdn2.microsoft.com/en-us/library/Aa379299.aspx
The above article would suggest that the owner would be granted implicit
WRITE_DAC permissions, so not even the owner should be able to create a
subfolder.
I myself tested a folder with an empty ACL created using the Access Control
Editor and found that the Effective Permissions page granted me, as the
owner, Read Permissions and Write Permissions. I believe this means I have
READ_DAC access as well as WRITE_DAC access, which seems to contradict the
above article. I was still denied access to create a subfolder, though, as
expected.
What can explain the fact that the poster (I think actually SYSTEM
impersonating the poser) was able to create a "New" subfolder but not create
a file in it? Thanks,
Paul
.
- Follow-Ups:
- RE: NULL DACL versis Empty DACL and Owner implcit access
- From: "Jeffrey Tan[MSFT]"
- RE: NULL DACL versis Empty DACL and Owner implcit access
- Prev by Date: Re: Changing the location of keys and certificates
- Next by Date: RE: cryptdecrypt failed with an error 0x80090020 when using with an ke
- Previous by thread: cryptdecrypt failed with an error 0x80090020 when using with an ke
- Next by thread: RE: NULL DACL versis Empty DACL and Owner implcit access
- Index(es):
Relevant Pages
|
