MSDN Magazine - November 2008 - (Page 62)

time, the owner field of the security descriptor is set to the SID of the principal invoking the object creation. The group field is set to the primary group of the principal’s security token. If it is not necessary to audit an object or to set an integrity label, the SACL will not be present. Within the string_aces, only those fields that are necessary are included (the minimal set is ace_type, rights, and the subject, typically the account_sid). Typically, the object_guid and inherit_object_guid are not present. The system parses ACEs in order, from Figure 4 Security Descriptors token o G Description owner_sid: a SID string that identifies the object’s security principal; only one is allowed. group_sid: a SID string that identifies the object’s primary group. This is provided to support the POSIX compatibility system and is not otherwise used by Windows; only one is allowed. sacl_flags(string_ace_1)(string_ace_2) (string_ace_n). Sacl_flags are security descriptor control flags that apply to the SACL. The sacl_flags string uses the same control bit strings as the dacl_flags string. dacl_flags(string_ace_1)(string_ace_2) (string_ace_n). Dacl flags are security descriptor control flags that apply to the DACL. The dacl_flags string can be a concatenation of zero or more of the following strings: P, AI, AR. Protected: the permissions being declared are the only ones extant; other permissions from higher up the inheritance tree do not apply. Aces are inherited using the Windows nt 5.0 inheritance mechanism, by which ACE entries are automatically propagated from parent to children for securable objects that support the inheritance model (file system, registry, active directory, and so on). The modern APIs for setting DACLs set this automatically. For the Windows NT 4.0 files system. The AR flag is set to indicate that the inheritance of entries from parent to child is required. Windows nt 4.0 did not have automatic inheritance. This is a legacy feature. Modern APIs for setting DACLs will write only AI, not AR, ACEs. first to last, until access is either granted or denied. Thus, ordering of ACEs is important. “Deny permissions” should be placed before “allow permissions.” An ACL with no ACEs in it is an empty DACL. Since an ACE grants a specified subject access to an object, no one can access an object with an empty DACL. An object without a DACL is said to have a NULL DACL. Objects with NULL DACLs have not been secured and everybody has full control over them. For that reason, do not set either empty or NULL DACLs. It is worthwhile now to look at what a realistic security descriptor looks like. Here’s a security descriptor for the root of the Windows Server 2008 system drive (note that cacls is a legacy command-line routine for investigating and setting ACLs and is being replaced by icacls. Unfortunately, icacls does not support a command-line switch to output the results in standard Security Descriptor Definition Language, or SDDL, a switch that cacls has—the /S flag): C:\>cacls c:/ /s c:\"D:PAI(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;BU) (A;CI;LC;;;BU)(A;CIIO;DC;;;BU)(A;OICIIO;GA;;;CO)" s D Based upon what we know about security descriptors, you can see from the leading “D:” that no ownership or group membership is claimed and that the descriptor is a DACL. The DACL is protected: the “P” and the Windows NT 5.0 inherit flag is set. Then we have a number of ace_strings that have to be deciphered. Recall the string_aces format I showed you previously. The allowed ace_types are defined in Figure 5, and the allowed ace_flags are defined in Figure 6. The ace_flags for inheritance are the ruling factors for the inheritance of ACEs. ACE rights are indicated by a string that denotes the access rights controlled by ACE. This string can be a hexadecimal string representation of the access rights, such as “0x7800003F”, or it can be a concatenation of the Rights strings, such as “CCLCSWLOCRRC”, which I will interpret later. The hex representation and associated bit values are shown in Figure 7. The system uses a single bitmap representation of ACE rights for all objects. Not all bits are meaningful for various objects. Only rights that are appropriate for an object are applied. Standard rights Figure 6 Allowed ace_flags Ace type string “cI” “ID” Ace Flags CONTAINER_INHERIT_ACE flag INHERITED_ACE flag. Note that this is set by the system when the Ace is inherited. Previously inherited entries are replaced by newly inherited entries in child objects if inheritable ACE entries in the parent are modified. This bit is not present in Windows NT 4.0 ACLs. INHERIT_ONLY_ACE flag NO_PROPAGATE_INHERIT_ACE flag OBJECT_INHERIT_ACE flag FAIleD_Access_Ace_FlAG sUccessFUl_Access_Ace_FlAG File and Registry Permissions Understanding Security Descriptor string_aces P AI Ar Figure 5 Allowed ace_types Ace type string “A” “Al” “AU” “D” “oA” “oD” “ol” “oU” 62 msdn magazine Ace type Value Access_AlloWeD_Ace_tYPe sYsteM_AlArM_Ace_tYPe sYsteM_AUDIt_Ace_tYPe Access_DenIeD_Ace_tYPe ACCESS_ALLOWED_OBJECT_ACE_TYPE, used in Active Directory ACCESS_DENIED_OBJECT_ACE_TYPE, used in Active Directory SYSTEM_ALARM_OBJECT_ACE_TYPE, used in Active Directory SYSTEM_AUDIT_OBJECT_ACE_TYPE, used in Active Directory “Io” “nP” “oI” “FA” “sA”

Table of Contents Feed for the Digital Edition of MSDN Magazine - November 2008

Contents MSDN Magazine - November 2008 Toolbox CLR Inside Out Data Points Cutting Edge Security Briefs Test Your Security IQ Agile SDL Access Control Utility Spotlight RIA Test Run Wicked Code Foundations Team System End Bracket

MSDN Magazine - November 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.