Geek asks and answers

Removing / Modifying a Legacy ACE in an ACL (Windows)

I am trying to modify an existing ACL in a directory (and its subdirectories) to remove write access for the Users built-in group. A directory inherits this particular right from the parent directory. I tried using AtlSetDacl () to set a new ACL, but that does not eliminate the inherited write permission. Fragment:

ATL::CDacl dacl;
ATL::AtlGetDacl(directoryName.c_str(), SE_FILE_OBJECT, &dacl);
UINT aceCount = dacl.GetAceCount();
ATL::CDacl newDacl;
for (UINT i = 0; i < aceCount; ++i)
{
   ATL::CSid sid;
   ACCESS_MASK mask = 0;
   BYTE flags = 0;
   dacl.GetAclEntry(i,
                    &sid,
                    &mask,
                    (BYTE*) 0,
                    &flags);
   if (sid != Sids::Users())
       newDacl.AddAllowedAce(sid, mask, flags);
}
newDacl.AddAllowedAce(Sids::Users(),FILE_LIST_DIRECTORY | FILE_READ_EA | FILE_EXECUTE | FILE_READ_ATTRIBUTES, CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE);
AtlSetDacl(directoryName.c_str(), SE_FILE_OBJECT, newDacl);

I also tried SetNamedSecurityInfo () and its associated APIs to erase the existing ACL and create a new one, but no luck here either. It doesn't seem like it should be so complicated. Using cacls.exe is a piece of cake (unfortunately, this is not an option for me). Any ideas on how to do this?

+3
source share
2 answers

ACE, SetNamedSecurityInfo DACL_SECURITY_INFORMATION | PROTECTED_DACL_SECURITY_INFORMATION SecurityInfo.

PROTECTED_DACL_SECURITY_INFORMATION ACE ACL.

, ACL , . , read-compare-add , INHERITED_ACE, .

+5

ATL:: AtlSetDacl

inline bool AtlSetDacl( HANDLE hObject, SE_OBJECT_TYPE ObjectType, const CDacl& rDacl, DWORD dwInheritanceFlowControl= 0 ) throw(...);

dwInheritanceFlowControl:
. 0 ( ), PROTECTED_DACL_SECURITY_INFORMATION UNPROTECTED_DACL_SECURITY_INFORMATION.

PROTECTED_DACL_SECURITY_INFORMATION , , .

0

More articles:


All Articles