{"id":23303,"date":"2008-02-27T10:00:00","date_gmt":"2008-02-27T10:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2008\/02\/27\/if-you-ask-for-standard_rights_required-you-may-as-well-ask-for-the-moon\/"},"modified":"2008-02-27T10:00:00","modified_gmt":"2008-02-27T10:00:00","slug":"if-you-ask-for-standard_rights_required-you-may-as-well-ask-for-the-moon","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20080227-00\/?p=23303","title":{"rendered":"If you ask for STANDARD_RIGHTS_REQUIRED, you may as well ask for the moon"},"content":{"rendered":"

\nOne of the predefined security access masks is\nSTANDARD_RIGHTS_REQUIRED<\/code>.\nYou see it used in defining the _ALL_ACCESS<\/code> masks for\nvarious objects.\nHere are just a few examples:\n<\/p>\n

\n#define PROCESS_ALL_ACCESS        (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \\\n                                   0xFFF)\n#define EVENT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3)\n#define FILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1FF)\n<\/pre>\n
\nThe STANDARD_RIGHTS_REQUIRED<\/code> mask is meant to be used\nwhen defining access masks for object types.\nI’m guessing it’s called STANDARD_RIGHTS_REQUIRED<\/code> because\nit’s the set of access masks that all securable objects must support.\n\nLook at the documentation<\/a>\nor just at the definition:\n<\/p>\n
\n#define DELETE                           (0x00010000L)\n#define READ_CONTROL                     (0x00020000L)\n#define WRITE_DAC                        (0x00040000L)\n#define WRITE_OWNER                      (0x00080000L)\n#define STANDARD_RIGHTS_REQUIRED         (0x000F0000L)\n<\/pre>\n
\nNotice that STANDARD_RIGHTS_REQUIRED<\/code> is just\nan abbreviation for the union of the four access bits\nDELETE | READ_CONTROL | WRITE_DAC | WRITE_OWNER<\/code>.\n<\/p>\n
\nNow that you see what it’s for,\nyou can also see what it’s not<\/strong> for:\nYou’re not expected to pass it as the mask of requested<\/strong>\naccess bits when you attempt to open an object.\nIn other words, the following is wrong:\n<\/p>\n
\n\/\/ wrong!\nHANDLE hProcess =\n    OpenProcess(dwProcessId, FALSE,\n                STANDARD_RIGHTS_REQUIRED | PROCESS_QUERY_INFORMATION);<\/i>\n<\/pre>\n
\nThe person writing this code probably thought,\n“Well, I just want to be able to query information, so I need to\npass PROCESS_QUERY_INFORMATION<\/code>.\nThere’s this other thing here called STANDARD_RIGHTS_REQUIRED<\/code>;\nsince it’s required, I’ll pass that too.”\n<\/p>\n
\nThe “required”ness of STANDARD_RIGHTS_REQUIRED<\/code> doesn’t\napply to you, the program opening the object.\nIt applies to the person who is designing the object.\n<\/p>\n
\nYour attempt to be a “good security citizen” and ask only for the\naccess you need (namely, PROCESS_QUERY_INFORMATION<\/code>)\nhas backfired due to the addition of STANDARD_RIGHTS_REQUIRED<\/code>.\nIf you ask for\nSTANDARD_RIGHTS_REQUIRED<\/code>,\nyou are asking for everything<\/strong>.\n<\/p>\n
\nWhy is that?\nNotice that STANDARD_RIGHTS_REQUIRED<\/code> includes\nWRITE_DAC<\/code>.\nIf you have WRITE_DAC<\/code> permission, that means that you\nhave permission to\nchange the security descriptor on the object,\nat which point you totally 0wnz0r it.\nYou want PROCESS_VM_WRITE<\/code> access but the security\ndescriptor doesn’t let you?\nNo problem.\nJust set a new security descriptor that grants you\nPROCESS_ALL_ACCESS<\/code> to the process object.\nTada! You now have all the access in the world.\n<\/p>\n
\nMoral of the story:\nDon’t ask for STANDARD_RIGHTS_REQUIRED<\/code>,\nbecause only somebody with full control will be able to get it.\nAsk for what you actually want.<\/p>\n","protected":false},"excerpt":{"rendered":"
One of the predefined security access masks is STANDARD_RIGHTS_REQUIRED. You see it used in defining the _ALL_ACCESS masks for various objects. Here are just a few examples: #define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \\ 0xFFF) #define EVENT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3) #define FILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1FF) The STANDARD_RIGHTS_REQUIRED mask is meant to be used when defining […]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-23303","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"
One of the predefined security access masks is STANDARD_RIGHTS_REQUIRED. You see it used in defining the _ALL_ACCESS masks for various objects. Here are just a few examples: #define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \\ 0xFFF) #define EVENT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3) #define FILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1FF) The STANDARD_RIGHTS_REQUIRED mask is meant to be used when defining […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/23303","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=23303"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/23303\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=23303"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=23303"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=23303"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}