Reliable way to determine if ntfs inheritance rights were

Question

I have a somewhat unclear question.

What I need: To determine if the permissions (or, strictly speaking, specific ACE DACLs) of a file / folder are inherited.

How I tried to solve this: using winapi bindings for python (more precisely, win32security code). Here's a stripped down version that does just that — it just takes the file path as an argument and prints the ACE one by one, indicating which flags are set.

#!/usr/bin/env python
from win32security import *
import sys

def decode_flags(flags):
    _flags = {
        SE_DACL_PROTECTED:"SE_DACL_PROTECTED",
        SE_DACL_AUTO_INHERITED:"SE_DACL_AUTO_INHERITED",
        OBJECT_INHERIT_ACE:"OBJECT_INHERIT_ACE",
        CONTAINER_INHERIT_ACE:"CONTAINER_INHERIT_ACE",
        INHERIT_ONLY_ACE:"INHERIT_ONLY_ACE",
        NO_INHERITANCE:"NO_INHERITANCE",
        NO_PROPAGATE_INHERIT_ACE:"NO_PROPAGATE_INHERIT_ACE",
        INHERITED_ACE:"INHERITED_ACE"
    }
    for key in _flags.keys():
        if (flags & key):
            print '\t','\t',_flags[key],"is set!"


def main(argv):
    target = argv[0]
    print target

    security_descriptor = GetFileSecurity(target,DACL_SECURITY_INFORMATION)

    dacl = security_descriptor.GetSecurityDescriptorDacl()

    for ace_index in range(dacl.GetAceCount()):
        (ace_type,ace_flags),access_mask,sid = dacl.GetAce(ace_index)
        name,domain,account_type = LookupAccountSid(None,sid)
        print '\t',domain+'\\'+name,hex(ace_flags)
        decode_flags(ace_flags)


if __name__ == '__main__':
    main(sys.argv[1:])

Simple enough - get the security descriptor, get the DACL from it, and then iterate over the ACE into the DACL. The really important bit here is the INHERITED_ACE access flag. It must be set when ACE is inherited and not set explicitly.

/, ACL ACE ACE (), . , - , INHERITED_ACE ! , .

- (, , ), ( , , )! INHERITED_ACE , , , ACE .

:

• ( )
• Windows, , (, , Windows).
• , , , script, (INHERITED_ACE - ACE).
• ( ), .
• ( INHERITED_ACE)
• .. ( , )

, , , , .

Answer 1

Win XP Home Edition : -)

:

Traceback ( ):
"C:\1.py", 37,      (sys.argv [1:])
"C:\1.py", 29,      ace_index (dacl.GetAceCount()):

AttributeError: "NoneType" "GetAceCount"

"" DACL ? , , , ... , ACE . ?

.. # ( Win XP Prof), , .net . , , # , ACE , Python .

:

C: > csharp_tricks.exe 2.txt

FullControl → IsInherited: True

FullControl → IsInherited: True

ReadAndExecute, Synchronize → IsInherited: True

---

C: > 1.py 2.txt

2.txt

BUILTIN\ 0x0

NT AUTHORITY\SYSTEM 0x0

BUILTIN\Users 0x0

#:

public class InheritedAce
{
    public static string GetDACLReport(string path)
    {
        StringBuilder result = new StringBuilder();
        FileSecurity fs = new FileSecurity(path, AccessControlSections.Access);
        foreach (var rule in fs.GetAccessRules(true, true, typeof(SecurityIdentifier)).OfType<FileSystemAccessRule>())
        {
            result.AppendFormat("{0}  -->  IsInherited:  {1}", rule.FileSystemRights, rule.IsInherited);
            result.AppendLine();
        }

        return result.ToString();
    }
}

, pywin32 python. , ...

Answer 2

.Net

System.Security.AccessControl

ACL DACL SACL.

Answer 3

, ,

, , , .

, ACE DACL Microsoft .

, GUI, cacls icacls , - , .

, "" , ACE, .

"" ACE; , - , .

, , Microsoft (, Vista) "" , , , .

Vista, , ACE, .

ControlFlags : 0x8004
Owner : BUILTIN\Administrators
Group : WS1\None
S-1-5-32-544 : BUILTIN\Administrators : 0x0 : 0x0 : 0x1F01FF
S-1-5-32-544 : BUILTIN\Administrators : 0x0 : 0xB : 0x10000000
S-1-5-18 : NT AUTHORITY\SYSTEM : 0x0 : 0x0 : 0x1F01FF
S-1-5-18 : NT AUTHORITY\SYSTEM : 0x0 : 0xB : 0x10000000
S-1-5-11 : NT AUTHORITY\Authenticated Users : 0x0 : 0x0 : 0x1301BF
S-1-5-11 : NT AUTHORITY\Authenticated Users : 0x0 : 0xB : 0xE0010000
S-1-5-32-545 : BUILTIN\Users : 0x0 : 0x0 : 0x1200A9
S-1-5-32-545 : BUILTIN\Users : 0x0 : 0xB : 0xA0000000

ControlFlags ACE.