How do the names in the file security dialog map to access control masks?
When you call up the file security dialog, you’ll see options like “Full Control” and “Read and Execute”. That’s really nice as friendly names go, but when you’re digging into the security descriptor, you may need to know what those permissions really map to when it comes down to bits.
First, the summary attributes:
|Friendly name||Access mask||Inheritance|
|Read and execute|
|List folder contents|
If you go to the Advanced view, then you get much more precise control:
|Friendly name||Access mask|
|Traverse Folder / Execute File|
|List Folder / Read Data|
|Read Extended Attriibutes|
|Create Files / Write Data|
|Create Folders / Append Data|
|Write Extended Attributes|
|Delete Subfolders and Files|
(In the Advanced view, you control inheritance from the “Apply to” drop-down combo box.)
Note that the “Delete Subfolders and Files” and “Delete” attributes together determine whether you can delete a file or subdirectory: You can delete an item either if you have
DELETE permission on the item or if you have
DELETE_CHILD permission on its parent. This “combo” allows you to set up a directory where everybody can create files and can delete files that they have created, while still retaining the ability as the directory’s owner to delete any file in it. You do this by granting yourself
DELETE_CHILD permission on the directory and granting
CREATOR_OWNER as an inheritable attribute. Since you have
DELETE_CHILD permission, you can delete anything in the directory. And since the creator/owner has
DELETE permission, people can delete the files that they themselves created.
[Update 2pm: INHERIT_ONLY_ACE should be OBJECT_INHERIT_ACE.]