MSDN Magazine - November 2008 - (Page 64)

Figure 7 ACL Access Mask ACL Access Mask: 3322222222221111111111 10987654321098765432109876543210 + + + + |G|G|G|G|Res'd|A| StandardRights| SpecificRights | |R|W|E|A| |S| | | +-+ + + + are those rights that are common to all securable objects. Generic rights are convenient shorthand for specifying rights of similar intent for various objects. The specification of generic rights is mapped into the appropriate set of specific rights. Integrity labels are also encoded using the ACE rights field when specifying the SACL. The available rights for various objects are listed in Figure 8. There are a number of largely equivalent rights mappings that are used rather indiscriminately. Full Control (FC) is equivalent to Generic_All (GA). For the file system, File All (FA) is the appropriate full control declaration. Key All (KA) is the appropriate full control declaration for the registry. Generic declarations are frequently used in place of the more appropriate declarations but are mapped to the appropriate file system or registry key declarations, as appropriate. SDDL expressions frequently mix these terms, thus you need to be aware of the equivalences. Many objects can be assigned rights. In addition to files and directories, we have registry keys, processes, desktops, and so forth. For the full list, see Figures A through I in the online version of this article at msdn.microsoft.com/magazine/cc982153. Since we will be discussing permissions on the file system and registry, the specific rights for these objects are provided in Figures 9 and 10. long structured identifier that is essentially meaningless to a person, or a shorthand “SID string” notation for a common account. The SID string notation for common accounts is used wherever possible to make the system more readable. A table of common or well-known accounts and their SID strings is shown in Figure J in the online version of this article. The OW declaration of Owner Rights is new with Windows Server 2008 and Windows Vista. Previously, the Creator/Owner (CO) of an object had the standard rights of read control (RC) and Write_DAC (WD) over that object, enabling the owner to set the Figure 8 Generic Rights Hex 0x10000000l token GA Description GenericAll, GenericFileAll, GenericKeyAll The caller can perform all normal operations on the object. GenericExecute, GenericFileExecute, GenericKeyExecute The caller can execute the object. (Note this generally only makes sense for certain kinds of objects, such as file objects and section objects.) GenericWrite, GenericFileWrite, GenericKeyWrite The caller can perform normal write operations on the object. GenericRead, GenericFileRead, GenericKeyRead The caller can perform normal read operations on the object. 0x20000000l GX 0x40000000l GW Standard and Specific Rights 0x80000000l Gr Figure 9 Specific File Rights Specific Rights 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 Files cc Dc lc sW rP WP Dt read Write Append readeA WriteeA execute Delete child Directory cc Dc lc sW rP WP Dt list AddFile AddSubDir readeA WriteeA traverse Delete child Integrity Labels and Their Usage As was already stated, the integrity labels, if present, are stored in the object’s SACL. Objects implicitly have medium integrity, so if there is no integrity label, the object has medium integrity. Similarly, if there is no integrity label on a security token, it also has medium integrity. The low-integrity label is used to label Low Rights processes, such as LowRights Internet Explorer and related untrusted objects. The “high” and “system” levels are used to help isolate those objects from medium and low processes and objects. The integrity labels are shown in Figure 11. Figure 10 Specific Registry Rights Specific Rights 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 registry cc Dc lc sW rP WP Query set CreateSubKey EnumSubKey Notify createlink services cc Dc lc sW rP WP Dt lo cr QueryConf ChangeConf Querystat enumDeps start stop Pause Interrogate UserDefined Object_guid and inherit_object_guid Object_guid and inherit_object_guid are used in specifying the security of objects in Active Directory. They are not used when securing the file system or registry. “OA” and “OD” in the ace_type field of an ACE string correspond to an object-allow and object-deny ACE, respectively. In this case, the object_guid holds the guid of the object being permissioned and the inherit_object_guid holds the guid of the object from which it inherits permissions. The account_sid field in the ACE structure denotes the security principal that is being granted or denied the access rights specified in the ACE. The account_sid field may hold a SID, which is a 64 msdn magazine File and Registry Permissions http://msdn.microsoft.com/magazine/cc982153

Table of Contents Feed for the Digital Edition of MSDN Magazine - November 2008

Contents MSDN Magazine - November 2008 Toolbox CLR Inside Out Data Points Cutting Edge Security Briefs Test Your Security IQ Agile SDL Access Control Utility Spotlight RIA Test Run Wicked Code Foundations Team System End Bracket

MSDN Magazine - November 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.