Problem - Kevin Tafuro

modify its DACLcan result in denial of service attacks because the object should be
accessible but no longer is.
An ACE (an ACLcontains one or more ACEs) consists of three primary pieces of
information: a security ID (SID), an access right, and a boolean indicator of whether
the ACE allows or denies the access right to the entity identified by the ACE’s SID. A
SID uniquely identifies a user or group on a system. The special SID, known as
“Everyone” or “World”, identifies all users and groups on the system. All objects
support a generic set of access rights, and some objects may define others specific to
their type. Table 2-1 lists the generic access rights. Finally, an ACE can either allow
or deny an access right.
Table 2-1. Generic access rights supported by all objects
Access right (C constant) Description
DELETE The ability to delete the object
READ_CONTROL The ability to read the object’s security descriptor, not including its SACL
SYNCHRONIZE The ability for a thread to wait for the object to be put into the signaled state; not all
objects support this functionality
WRITE_DAC The ability to modify the object’s DACL
WRITE_OWNER The ability to set the object’s owner
GENERIC_READ The ability to read from or query the object
GENERIC_WRITE The ability to write to or modify the object
GENERIC_EXECUTE The ability to execute the object (applies primarily to files)
GENERIC_ALL Full control
When Windows consults an ACLto verify access to an object, it will always choose
the best match. That is, if a deny ACE for “Everyone” is found, and an allow ACE is
then found for a specific user that happens to be the current user, Windows will use
the allow ACE. For example, suppose that the DACLfor a data file contains the following
ACEs:
DENY GENERIC_ALL Everyone
This ACE prevents anyone except for the owner of the file from performing any
action on the file.
ALLOW GENERIC_WRITE Marketing
Anyone that is a member of the group “Marketing” will be allowed to write to
the file because this ACE explicitly allows that access right for that group.
ALLOW GENERIC_READ Everyone
This ACE grants read access to the file to everyone.
All objects are created with an owner. The owner of an object is ordinarily the user
who created the object; however, depending on the object’s ACL, another user could
possibly take ownership of the object. The owner of an object always has full control
42 | Chapter 2: Access Control
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.