base/fs/m_fs_info_win.c
/* Using Authz api instead of GetEffectiveRightsFromAcl because GetEffectiveRightsFromAcl "... may be altered or
 * unavailable in subsequent [OS] versions". Authz is the recommend way to determine a user or groups perimissions in
 * regard to a file. */
Using Authz api instead of GetEffectiveRightsFromAcl because GetEffectiveRightsFromAcl "... may be altered or
unavailable in subsequent [OS] versions". Authz is the recommend way to determine a user or groups perimissions in
regard to a file.
Using Authz api instead of GetEffectiveRightsFromAcl because GetEffectiveRightsFromAcl " ... may be altered or unavailable in subsequent [ OS ] versions " . Authz is the recommend way to determine a user or groups perimissions in regard to a file .
static unsigned int M_fs_info_sid_perms(PSECURITY_DESCRIPTOR sd, PSID sid)
{
	AUTHZ_ACCESS_REQUEST          access_request;
	AUTHZ_ACCESS_REPLY            access_reply;
	AUTHZ_CLIENT_CONTEXT_HANDLE   authz_client  = NULL;
	AUTHZ_RESOURCE_MANAGER_HANDLE authz_manager = NULL;
	ACCESS_MASK                   access_mask   = 0;
	DWORD                         access_error  = 0;
	LUID                          id;
	int                           myperms       = 0;
	if (!IsValidSid(sid)) {
		return 0;
	}
	if (!AuthzInitializeResourceManager(AUTHZ_RM_FLAG_NO_AUDIT, NULL, NULL, NULL, NULL, &authz_manager)) {
		return 0;
	}
	M_mem_set(&id, 0, sizeof(id));
	if (!AuthzInitializeContextFromSid(0, sid, authz_manager, NULL, id, NULL, &authz_client)) {
		AuthzFreeResourceManager(authz_manager);
		return 0;
	}
	M_mem_set(&access_request, 0, sizeof(access_request));
	access_request.DesiredAccess        = MAXIMUM_ALLOWED;
	access_request.PrincipalSelfSid     = sid;
	access_request.ObjectTypeList       = NULL;
	access_request.ObjectTypeListLength = 0;
	access_request.OptionalArguments    = NULL;
	M_mem_set(&access_reply, 0, sizeof(access_reply));
	access_reply.ResultListLength  = 1;
	access_reply.GrantedAccessMask = &access_mask;
	access_reply.Error             = &access_error;
	if (!AuthzAccessCheck(0, authz_client, &access_request, NULL, sd, NULL, 0, &access_reply, NULL) || *(access_reply.Error) != ERROR_SUCCESS) {
		AuthzFreeContext(authz_client);
		AuthzFreeResourceManager(authz_manager);
		return 0;
	}
	if ((*(access_reply.GrantedAccessMask) & GENERIC_ALL) == GENERIC_ALL || (*(access_reply.GrantedAccessMask) & FILE_ALL_ACCESS) == FILE_ALL_ACCESS)
	{
		AuthzFreeContext(authz_client);
		AuthzFreeResourceManager(authz_manager);
		return M_FS_PERMS_MODE_READ|M_FS_PERMS_MODE_WRITE|M_FS_PERMS_MODE_EXEC;
	}
	if ((*(access_reply.GrantedAccessMask) & GENERIC_READ) == GENERIC_READ || (*(access_reply.GrantedAccessMask) & FILE_GENERIC_READ) == FILE_GENERIC_READ) {
		myperms |= M_FS_PERMS_MODE_READ;
	}
	if ((*(access_reply.GrantedAccessMask) & GENERIC_WRITE) == GENERIC_WRITE || (*(access_reply.GrantedAccessMask) & FILE_GENERIC_WRITE) == FILE_GENERIC_WRITE) {
		myperms |= M_FS_PERMS_MODE_WRITE;
	}
	if ((*(access_reply.GrantedAccessMask) & GENERIC_EXECUTE) == GENERIC_EXECUTE || (*(access_reply.GrantedAccessMask) & FILE_GENERIC_EXECUTE) == FILE_GENERIC_EXECUTE) {
		myperms |= M_FS_PERMS_MODE_EXEC;
	}
	AuthzFreeContext(authz_client);
	AuthzFreeResourceManager(authz_manager);
	return (unsigned int)myperms;
}
static unsigned int M_fs_info_sid_perms ( PSECURITY_DESCRIPTOR sd , PSID sid ) { AUTHZ_ACCESS_REQUEST access_request ; AUTHZ_ACCESS_REPLY access_reply ; AUTHZ_CLIENT_CONTEXT_HANDLE authz_client = NULL ; AUTHZ_RESOURCE_MANAGER_HANDLE authz_manager = NULL ; ACCESS_MASK access_mask = 0 ; DWORD access_error = 0 ; LUID id ; int myperms = 0 ; if ( ! IsValidSid ( sid ) ) { return 0 ; } if ( ! AuthzInitializeResourceManager ( AUTHZ_RM_FLAG_NO_AUDIT , NULL , NULL , NULL , NULL , & authz_manager ) ) { return 0 ; } M_mem_set ( & id , 0 , sizeof ( id ) ) ; if ( ! AuthzInitializeContextFromSid ( 0 , sid , authz_manager , NULL , id , NULL , & authz_client ) ) { AuthzFreeResourceManager ( authz_manager ) ; return 0 ; } M_mem_set ( & access_request , 0 , sizeof ( access_request ) ) ; access_request . DesiredAccess = MAXIMUM_ALLOWED ; access_request . PrincipalSelfSid = sid ; access_request . ObjectTypeList = NULL ; access_request . ObjectTypeListLength = 0 ; access_request . OptionalArguments = NULL ; M_mem_set ( & access_reply , 0 , sizeof ( access_reply ) ) ; access_reply . ResultListLength = 1 ; access_reply . GrantedAccessMask = & access_mask ; access_reply . Error = & access_error ; if ( ! AuthzAccessCheck ( 0 , authz_client , & access_request , NULL , sd , NULL , 0 , & access_reply , NULL ) || * ( access_reply . Error ) != ERROR_SUCCESS ) { AuthzFreeContext ( authz_client ) ; AuthzFreeResourceManager ( authz_manager ) ; return 0 ; } if ( ( * ( access_reply . GrantedAccessMask ) & GENERIC_ALL ) == GENERIC_ALL || ( * ( access_reply . GrantedAccessMask ) & FILE_ALL_ACCESS ) == FILE_ALL_ACCESS ) { AuthzFreeContext ( authz_client ) ; AuthzFreeResourceManager ( authz_manager ) ; return M_FS_PERMS_MODE_READ | M_FS_PERMS_MODE_WRITE | M_FS_PERMS_MODE_EXEC ; } if ( ( * ( access_reply . GrantedAccessMask ) & GENERIC_READ ) == GENERIC_READ || ( * ( access_reply . GrantedAccessMask ) & FILE_GENERIC_READ ) == FILE_GENERIC_READ ) { myperms |= M_FS_PERMS_MODE_READ ; } if ( ( * ( access_reply . GrantedAccessMask ) & GENERIC_WRITE ) == GENERIC_WRITE || ( * ( access_reply . GrantedAccessMask ) & FILE_GENERIC_WRITE ) == FILE_GENERIC_WRITE ) { myperms |= M_FS_PERMS_MODE_WRITE ; } if ( ( * ( access_reply . GrantedAccessMask ) & GENERIC_EXECUTE ) == GENERIC_EXECUTE || ( * ( access_reply . GrantedAccessMask ) & FILE_GENERIC_EXECUTE ) == FILE_GENERIC_EXECUTE ) { myperms |= M_FS_PERMS_MODE_EXEC ; } AuthzFreeContext ( authz_client ) ; AuthzFreeResourceManager ( authz_manager ) ; return ( unsigned int ) myperms ; }
Using Authz api instead of GetEffectiveRightsFromAcl because GetEffectiveRightsFromAcl "... may be altered or
 unavailable in subsequent [OS] versions".
Using Authz api instead of GetEffectiveRightsFromAcl because GetEffectiveRightsFromAcl " ... may be altered or unavailable in subsequent [ OS ] versions " .
/* Can determine permissions for a valid sid */