Re: API to change "Allow inheritable permissions...

From: Nick Finco [MSFT] (nfinco_at_online.microsoft.com)
Date: 07/02/03 

Date: Wed, 2 Jul 2003 11:20:34 -0700

Ok, I see what you are trying to do. You don't want this ACL to inherit any
ACEs from the parent, aka. a Protected ACL. When you have the security
descriptor in memory, add the SE_DACL_PROTECTED flag to its Control field.
Then go ahead and set it using SetNamedSecurityInfo.

N 

-- 
This posting is provided "AS IS" with no warranties, and confers no rights.
Any included code samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"Tim Bedford" <tim.bedford@ttplabtech.com> wrote in message
news:ek7RXWHQDHA.2432@TK2MSFTNGP10.phx.gbl...
> Thanks for that Nick,
> What I'm doing at present is constructing a new DACL, with one allowed ACE
> in it, using SetNamedSecurityInfo to add it. But when I examine the object
> there's two ACE's in it. One that it seems to have inheritted. How did
that
> sneak in there? Isn't there a way to get the DACL to stay as I've
> constructed it?
> (am I right in thinking that greyed checkboxes mean the permissions are
> inheritted?).
> thanks,
>
> Tim
>
>
> "Nick Finco [MSFT]" <nfinco@online.microsoft.com> wrote in message
> news:ODEU0v$PDHA.1556@TK2MSFTNGP10.phx.gbl...
> > Use GetNamedSecurityInfo to grab the DACL or SACL of the object.  Then
use
> > GetAce to retrieve each ACE until you find the one you are trying to
> modify.
> > Once you have found the ACE, type-cast it to a ACE_HEADER (you most
likely
> > already did this to determine the ACE type).  Then modify the AceFlags
> field
> > to include the correct flag.  Pass the security descriptor you retrieved
> > into SetNamedSecurityInfo to set the modified ACL onto the object.
> >
> > You could also pass the security descriptor returned from
> > GetNamedSecurityInfo into ConvertSecurityDescriptorToSecurityDescriptor,
> > modify the SDDL string to reflect the new flags, convert the string back
> > into a security descriptor
> > (ConvertSecurityDescriptorToStringSecurityDescriptor), and use
> > SetNamedSecurityInfo like above.
> >
> > N
> >
> > --
> > This posting is provided "AS IS" with no warranties, and confers no
> rights.
> > Any included code samples are subject to the terms specified at
> > http://www.microsoft.com/info/cpyright.htm
> >
> >
> > "Tim Bedford" <tim.bedford@ttplabtech.com> wrote in message
> > news:uckEQj#PDHA.3020@TK2MSFTNGP10.phx.gbl...
> > > Hi,
> > > Windows 2000: Under the Security tab in the right-click, file/dir
> > properties
> > > dialog thing there's a checkbox to "Allow inheritable permissions from
> > > parent to propagate to this object".
> > >
> > > How do you do this programmatically? I've tried using the flags in the
> > > AddAccessAllowedAceEx call on the object in question and its parent
> object
> > > but can't get it to work.
> > >
> > > Sorry if this questions been asked a thousand times already.
> > > thanks for any help,
> > >
> > > Tim
> > >
> > >
> > >
> > >
> >
> >
>
>

Relevant Pages

  • Re: Enum only files/folders where explicit NTFS rights have been s
    ... You are right when you say "ACL had been touched by earlier generations ... AccessEnum "differ from parent" feature is not so much evolved, ... only comparing effectives rights listing to the parent rights listing, ... not what SHOULD inherit OR NOT (like for folders rights where "Apply onto: ...
    (microsoft.public.security)
  • Re: How can I control folder permissions when creating a folder
    ... I'm not an ACL expert, but I believe the inheritance flag is set on the child, not the parent. ... >Subject: Re: How can I control folder permissions when creating a folder ... >set "inherit from parent" right after I create the folder. ...
    (microsoft.public.dotnet.security)
  • ACL/ACE ? about Container Inherit / Inherit Only
    ... Is this single directory ACE: ... ACE == access control entry (a single component of an ACL) ... Inherit == take on same rights as parent dir ... OI == object inherit ...
    (microsoft.public.win2000.security)
  • Registry ACL Changer: How does this look?
    ... int ChangeSysKeyPermissions; ... // MODIFY THE ACL TO DENY OR ALLOW SYSTEM THE SETVALUE RIGHT. ... // Create an EXPLICIT_ACCESS structure for our ACE. ... // Set NewDacl to OrigDacl ...
    (microsoft.public.win32.programmer.kernel)
  • Re: [Python-Dev] rexec.py unuseable
    ... > taking rexec into account. ... the acl should consist of a dictionary of aces ... where the name is the function or module name, and the value is an ace ... the tricky bit is the "inheritance" permissions, ...
    (comp.lang.python)