{"id":40273,"date":"2004-03-12T07:00:00","date_gmt":"2004-03-12T07:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2004\/03\/12\/what-is-the-default-security-descriptor\/"},"modified":"2004-03-12T07:00:00","modified_gmt":"2004-03-12T07:00:00","slug":"what-is-the-default-security-descriptor","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20040312-00\/?p=40273","title":{"rendered":"What is the default security descriptor?"},"content":{"rendered":"<p>\nAll these functions have an optional LPSECURITY_ATTRIBUTES parameter,\nfor which everybody just passes NULL, thereby obtaining the default\nsecurity descriptor.\nBut what <b>is<\/b> the default security descriptor?\n<\/p>\n<p>\nOf course, the place to start is MSDN, in the section titled\n<a HREF=\"http:\/\/msdn.microsoft.com\/library\/en-us\/security\/security\/security_descriptors_for_new_objects.asp\">\nSecurity Descriptors for New Objects<\/a>.\n<\/p>\n<p>\nIt says that the default DACL comes from inheritable ACEs\n(if the object belongs to a hierarchy, like the filesystem\nor the registry); otherwise, the default DACL comes from the\nprimary or impersonation token of the creator.\n<\/p>\n<p>\nBut what is the default primary token?\n<\/p>\n<p>\nGosh, I don&#8217;t know either. So let&#8217;s write a program to find out.\n<\/p>\n<pre>\n#include &lt;windows.h&gt;\n#include &lt;sddl.h&gt; \/\/ ConvertSecurityDescriptorToStringSecurityDescriptor\nint WINAPI\nWinMain(HINSTANCE, HINSTANCE, LPSTR, int)\n{\n HANDLE Token;\n if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &amp;Token)) {\n DWORD RequiredSize = 0;\n GetTokenInformation(Token, TokenDefaultDacl, NULL, 0, &amp;RequiredSize);\n TOKEN_DEFAULT_DACL* DefaultDacl =\n     reinterpret_cast&lt;TOKEN_DEFAULT_DACL*&gt;(LocalAlloc(LPTR, RequiredSize));\n if (DefaultDacl) {\n  SECURITY_DESCRIPTOR Sd;\n  LPTSTR StringSd;\n  if (GetTokenInformation(Token, TokenDefaultDacl, DefaultDacl,\n                          RequiredSize, &amp;RequiredSize) &amp;&amp;\n      InitializeSecurityDescriptor(&amp;Sd, SECURITY_DESCRIPTOR_REVISION) &amp;&amp;\n      SetSecurityDescriptorDacl(&amp;Sd, TRUE,\n          DefaultDacl-&gt;DefaultDacl, FALSE) &amp;&amp;\n      ConvertSecurityDescriptorToStringSecurityDescriptor(&amp;Sd,\n          SDDL_REVISION_1, DACL_SECURITY_INFORMATION, &amp;StringSd, NULL)) {\n   MessageBox(NULL, StringSd, TEXT(\"Result\"), MB_OK);\n   LocalFree(StringSd);\n  }\n  LocalFree(DefaultDacl);\n }\n CloseHandle(Token);\n }\n return 0;\n}\n<\/pre>\n<p>\nOkay, I admit it, the whole purpose of this entry is just so I can call\nthe function\n<a HREF=\"http:\/\/msdn.microsoft.com\/library\/en-us\/security\/security\/convertsecuritydescriptortostringsecuritydescriptor.asp\">\nConvertSecurityDescriptorToStringSecurityDescriptor<\/a>,\nquite possibly the longest function name in the Win32 API.\nAnd just for fun, I used the NT variable naming convention instead\nof Hungarian.\n<\/p>\n<p>\nIf you run this program you&#8217;ll get something like this:\n<\/p>\n<pre>\nD:(A;;GA;;;S-1-5-21-1935655697-839522115-854245398-1003)(A;;GA;;;SY)\n<\/pre>\n<p>\nPull out our\n<a HREF=\"http:\/\/msdn.microsoft.com\/library\/en-us\/security\/security\/security_descriptor_string_format.asp\">\nhandy reference to the Security Descriptor String Format<\/a> to decode this.\n<\/p>\n<ul>\n<li>\n&#8220;D:&#8221; &#8211; This introduces the DACL.<\/p>\n<li>\n&#8220;(A;;GA;;;S-&#8230;)&#8221; &#8211; &#8220;Allow&#8221; &#8220;Generic All&#8221; access to &#8220;S-&#8230;&#8221;, which\nhappens to be me.  Every user by default\nhas full access to their own process.<\/p>\n<li>\n&#8220;(A;;GA;;;SY)&#8221; &#8211; &#8220;Allow&#8221; &#8220;Generic All&#8221; access to &#8220;Local System&#8221;.\n<\/ul>\n<p>\nNext time, I&#8217;ll teach you\n<a href=\"http:\/\/blogs.msdn.com\/oldnewthing\/archive\/2004\/03\/15\/89753.aspx\">\nhow to decode that S-&#8230; thing<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>All these functions have an optional LPSECURITY_ATTRIBUTES parameter, for which everybody just passes NULL, thereby obtaining the default security descriptor. But what is the default security descriptor? Of course, the place to start is MSDN, in the section titled Security Descriptors for New Objects. It says that the default DACL comes from inheritable ACEs (if [&hellip;]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-40273","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"<p>All these functions have an optional LPSECURITY_ATTRIBUTES parameter, for which everybody just passes NULL, thereby obtaining the default security descriptor. But what is the default security descriptor? Of course, the place to start is MSDN, in the section titled Security Descriptors for New Objects. It says that the default DACL comes from inheritable ACEs (if [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/40273","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=40273"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/40273\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=40273"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=40273"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=40273"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}