ESecObjError - this initializes the application for security manipulation
TKernelSecObject -
TSecureableObject -
TUserSecObject -
SetPrivilegeInAccessToken - Ignore previous info
SetSpecificPrivilegeInAccessToken -
TServiceSecObject = class(TSecureableObject)
public
procedure SetObjectSecurity(hObject: TSC_Handle);
procedure GetObjectSecurity(hObject: TSC_Handle);
end;
{TPrivateSecObject = class(TSecureableObject)
private
m_hAccessToken: HANDLE;
m_gmPrivateMapping: TGeneric_Mapping;
m_ObjectSD: PSecurityDescriptor;
m_dwUniqueHandleId: Pointer;
public
Constructor Create(bProtected: Boolean); override;
Destructor Destroy; override;
procedure SetObjectSecurity;
procedure GetObjectSecurity;
procedure MatchAccessRequest(dwMask: DWORD; hThread: THandle);
function MapRequestedRights (dwArg: DWORD): DWORD;
end;
helper function
ACCESS_ALLOWED_ACE
ACCESS_DENIED_ACE
ACE_HEADER
PACCESS_ALLOWED_ACE
PACCESS_DENIED_ACE
PACE_HEADER
PSYSTEM_ALARM_ACE
PSYSTEM_AUDIT_ACE
SYSTEM_ALARM_ACE
SYSTEM_AUDIT_ACE
ACCESS_ALLOWED_ACE_TYPE
ACCESS_DENIED_ACE_TYPE
ACL_REVISION
ACL_REVISION1
ACL_REVISION2
CONTAINER_INHERIT_ACE
DOMAIN_ALIAS_RID_ACCOUNT_OPS
DOMAIN_ALIAS_RID_ADMINS
DOMAIN_ALIAS_RID_BACKUP_OPS
DOMAIN_ALIAS_RID_GUESTS
DOMAIN_ALIAS_RID_POWER_USERS
DOMAIN_ALIAS_RID_PRINT_OPS
DOMAIN_ALIAS_RID_REPLICATOR
DOMAIN_ALIAS_RID_SYSTEM_OPS
DOMAIN_ALIAS_RID_USERS
DOMAIN_GROUP_RID_ADMINS
DOMAIN_GROUP_RID_GUESTS
DOMAIN_GROUP_RID_USERS
DOMAIN_USER_RID_ADMIN
DOMAIN_USER_RID_GUEST
FAILED_ACCESS_ACE_FLAG
INHERIT_ONLY_ACE
NO_PROPAGATE_INHERIT_ACE
OBJECT_INHERIT_ACE
SECURITY_ANONYMOUS_LOGON_RID
SECURITY_BATCH_RID
SECURITY_BUILTIN_DOMAIN_RID
SECURITY_CREATOR_GROUP_RID
SECURITY_CREATOR_OWNER_RID
SECURITY_CREATOR_SID_AUTHORITY
SECURITY_DESCRIPTOR_REVISION
SECURITY_DESCRIPTOR_REVISION1
SECURITY_DIALUP_RID
SECURITY_INTERACTIVE_RID
SECURITY_LOCAL_RID
SECURITY_LOCAL_SID_AUTHORITY
SECURITY_LOCAL_SYSTEM_RID
SECURITY_LOGON_IDS_RID
SECURITY_LOGON_IDS_RID_COUNT
SECURITY_NETWORK_RID
SECURITY_NON_UNIQUE_AUTHORITY
SECURITY_NT_AUTHORITY
SECURITY_NT_NON_UNIQUE
SECURITY_NULL_RID
SECURITY_NULL_SID_AUTHORITY
SECURITY_SERVICE_RID
SECURITY_WORLD_RID
SECURITY_WORLD_SID_AUTHORITY
SUCCESSFUL_ACCESS_ACE_FLAG
SYSTEM_ALARM_ACE_TYPE
SYSTEM_AUDIT_ACE_TYPE
VALID_INHERIT_FLAGS
function SetPrivilegeInAccessToken(bEnabled: Boolean): Boolean;
Ignore previous info
function SetSpecificPrivilegeInAccessToken(lpPrivType: PAnsiChar; bEnabled: Boolean): Boolean;
TServiceSecObject = class(TSecureableObject)
public
procedure SetObjectSecurity(hObject: TSC_Handle);
procedure GetObjectSecurity(hObject: TSC_Handle);
end;
{TPrivateSecObject = class(TSecureableObject)
private
m_hAccessToken: HANDLE;
m_gmPrivateMapping: TGeneric_Mapping;
m_ObjectSD: PSecurityDescriptor;
m_dwUniqueHandleId: Pointer;
public
Constructor Create(bProtected: Boolean); override;
Destructor Destroy; override;
procedure SetObjectSecurity;
procedure GetObjectSecurity;
procedure MatchAccessRequest(dwMask: DWORD; hThread: THandle);
function MapRequestedRights (dwArg: DWORD): DWORD;
end;
helper function
ACCESS_ALLOWED_ACE = record
Header : ACE_HEADER;
Mask : ACCESS_MASK;
SidStart : DWORD;
end;
We'll define the structure of the predefined ACE types. Pictorally the structure of the predefined ACE's is as follows: // 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 +---------------+-------+-------+---------------+---------------+ | AceFlags | Resd |Inherit| AceSize | AceType | +---------------+-------+-------+---------------+---------------+ | Mask | +---------------------------------------------------------------+ | | + + | | + Sid + | | + + | | +---------------------------------------------------------------+ // Mask is the access mask associated with the ACE. This is either the access allowed, access denied, audit, or alarm mask. // Sid is the Sid associated with the ACE. // The following are the four predefined ACE types. Examine the AceType field in the Header to determine which structure is appropriate to use for casting.
ACCESS_DENIED_ACE = record
Header : ACE_HEADER;
Mask : ACCESS_MASK;
SidStart : DWORD;
end;
ACE_HEADER = record
AceType : BYTE;
AceFlags : BYTE;
AceSize : WORD;
end;
The structure of an ACE is a common ace header followed by ace type specific data. Pictorally the structure of the common ace header is as follows: // 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 +---------------+-------+-------+---------------+---------------+ | AceSize | AceFlags | AceType | +---------------+-------+-------+---------------+---------------+ // AceType denotes the type of the ace, there are some predefined ace types // AceSize is the size, in bytes, of ace. // AceFlags are the Ace flags for audit and inheritance, defined shortly.
PACCESS_ALLOWED_ACE = ^ACCESS_ALLOWED_ACE
PACCESS_DENIED_ACE = ^ACCESS_DENIED_ACE
PACE_HEADER = ^ACE_HEADER
PSYSTEM_ALARM_ACE = ^SYSTEM_ALARM_ACE
PSYSTEM_AUDIT_ACE = ^SYSTEM_AUDIT_ACE
SYSTEM_ALARM_ACE = record
Header : ACE_HEADER;
Mask : ACCESS_MASK;
SidStart : DWORD;
end;
SYSTEM_AUDIT_ACE = record
Header : ACE_HEADER;
Mask : ACCESS_MASK;
SidStart : DWORD;
end;
ACCESS_ALLOWED_ACE_TYPE = $0
The following are the predefined ace types that go into the AceType field of an Ace header. //
ACCESS_DENIED_ACE_TYPE = $1
ACL_REVISION = 2
end_ntddk // ////////////////////////////////////////////////////////////////////// // ACL and ACE // // ////////////////////////////////////////////////////////////////////// // Define an ACL and the ACE format. The structure of an ACL header followed by one or more ACEs. Pictorally the structure of an ACL header is as follows: // 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 +-------------------------------+---------------+---------------+ | AclSize | Sbz1 | AclRevision | +-------------------------------+---------------+---------------+ | Sbz2 | AceCount | +-------------------------------+-------------------------------+ // The current AclRevision is defined to be ACL_REVISION. // AclSize is the size, in bytes, allocated for the ACL. This includes the ACL header, ACES, and remaining free space in the buffer. // AceCount is the number of ACES in the ACL. // begin_ntddk begin_ntifs This is the *current* ACL revision
ACL_REVISION1 = 1
This is the history of ACL revisions. Add a new one whenever ACL_REVISION is updated
ACL_REVISION2 = 2
CONTAINER_INHERIT_ACE = $2
DOMAIN_ALIAS_RID_ACCOUNT_OPS = $00000224
(0x00000223L
DOMAIN_ALIAS_RID_ADMINS = $00000220
(0x00000202L) well-known aliases ...
DOMAIN_ALIAS_RID_BACKUP_OPS = $00000227
(0x00000226L
DOMAIN_ALIAS_RID_GUESTS = $00000222
(0x00000221L
DOMAIN_ALIAS_RID_POWER_USERS = $00000223
(0x00000222L
DOMAIN_ALIAS_RID_PRINT_OPS = $00000226
(0x00000225L
DOMAIN_ALIAS_RID_REPLICATOR = $00000228
(0x00000227L
DOMAIN_ALIAS_RID_SYSTEM_OPS = $00000225
(0x00000224L
DOMAIN_ALIAS_RID_USERS = $00000221
(0x00000220L
DOMAIN_GROUP_RID_ADMINS = $00000200
(0x000001F5L) well-known groups ...
DOMAIN_GROUP_RID_GUESTS = $00000202
(0x00000201L
DOMAIN_GROUP_RID_USERS = $00000201
(0x00000200L
DOMAIN_USER_RID_ADMIN = $000001F4
(0x00000020L) /////////////////////////////////////////////////////////////////////////// // well-known domain relative sub-authority values (RIDs)... // // /////////////////////////////////////////////////////////////////////////// Well-known users ...
DOMAIN_USER_RID_GUEST = $000001F5
(0x000001F4L
FAILED_ACCESS_ACE_FLAG = $80
INHERIT_ONLY_ACE = $8
NO_PROPAGATE_INHERIT_ACE = $4
OBJECT_INHERIT_ACE = $1
The following are the inherit flags that go into the AceFlags field of an Ace header. //
SECURITY_ANONYMOUS_LOGON_RID = $00000007
(0x00000006L
SECURITY_BATCH_RID = $00000003
(0x00000002L
SECURITY_BUILTIN_DOMAIN_RID = $00000020
(0x00000015L
SECURITY_CREATOR_GROUP_RID = $00000001
(0x00000000L
SECURITY_CREATOR_OWNER_RID = $00000000
(0X00000000L
SECURITY_CREATOR_SID_AUTHORITY = (0,0,0,0,0,3)
SECURITY_DESCRIPTOR_REVISION = 1
(0x00000228L) ////////////////////////////////////////////////////////////////////// // SECURITY_DESCRIPTOR // // ////////////////////////////////////////////////////////////////////// // Define the Security Descriptor and related data types. This is an opaque data structure. // begin_ntddk begin_ntifs // Current security descriptor revision value //
SECURITY_DESCRIPTOR_REVISION1 = 1
SECURITY_DIALUP_RID = $00000001
ntifs
SECURITY_INTERACTIVE_RID = $00000004
(0x00000003L
SECURITY_LOCAL_RID = $00000000
(0x00000000L
SECURITY_LOCAL_SID_AUTHORITY = (0,0,0,0,0,2)
SECURITY_LOCAL_SYSTEM_RID = $00000012
(3L
SECURITY_LOGON_IDS_RID = $00000005
(0x00000007L
SECURITY_LOGON_IDS_RID_COUNT = 3
(0x00000005L
SECURITY_NETWORK_RID = $00000002
(0x00000001L
SECURITY_NON_UNIQUE_AUTHORITY = (0,0,0,0,0,4)
SECURITY_NT_AUTHORITY = (0,0,0,0,0,5)
(0x00000001L) /////////////////////////////////////////////////////////////////////////// // NT well-known SIDs // // NT Authority S-1-5 // Dialup S-1-5-1 // // Network S-1-5-2 // Batch S-1-5-3 // Interactive S-1-5-4 // Service S-1-5-6 // AnonymousLogon S-1-5-7 (aka null logon session) // // (Logon IDs) S-1-5-5-X-Y // // (NT non-unique IDs) S-1-5-0x15-... // // (Built-in domain) s-1-5-0x20 // // ///////////////////////////////////////////////////////////////////////////
SECURITY_NT_NON_UNIQUE = $00000015
(0x00000012L
SECURITY_NULL_RID = $00000000
SECURITY_NULL_SID_AUTHORITY = (0,0,0,0,0,0)
/////////////////////////////////////////////////////////////////////////// // Universal well-known SIDs // // Null SID S-1-0-0 // World S-1-1-0 // Local S-1-2-0 // Creator Owner ID S-1-3-0 // Creator Group ID S-1-3-1 // // (Non-unique IDs) S-1-4 // // ///////////////////////////////////////////////////////////////////////////
SECURITY_SERVICE_RID = $00000006
(0x00000004L
SECURITY_WORLD_RID = $00000000
(0x00000000L);
SECURITY_WORLD_SID_AUTHORITY = (0,0,0,0,0,1)
SUCCESSFUL_ACCESS_ACE_FLAG = $40
The following are the currently defined ACE flags that go into the AceFlags field of an ACE header. Each ACE type has its own set of AceFlags. // SUCCESSFUL_ACCESS_ACE_FLAG - used only with system audit and alarm ACE types to indicate that a message is generated for successful accesses. // FAILED_ACCESS_ACE_FLAG - used only with system audit and alarm ACE types to indicate that a message is generated for failed accesses. // // SYSTEM_AUDIT and SYSTEM_ALARM AceFlags // These control the signaling of audit and alarms for success or failure. //
SYSTEM_ALARM_ACE_TYPE = $3
SYSTEM_AUDIT_ACE_TYPE = $2
VALID_INHERIT_FLAGS = $F