无法正确获得ACL

Question

I'm trying to get ACL for a shared folder. The code to get security descriptor is following:

private static SECURITY_DESCRIPTOR GetSecurityDescriptor(string path)
{
    var sdUtil = new ADsSecurityUtility();
    Byte[] temp = (Byte[])sdUtil.GetSecurityDescriptor(path, (int)ADS_PATHTYPE_ENUM.ADS_PATH_FILESHARE, (int)ADS_SD_FORMAT_ENUM.ADS_SD_FORMAT_RAW);
    IntPtr ptr = (IntPtr)0;
    SECURITY_DESCRIPTOR sd;
    try
    {
        ptr = Marshal.AllocHGlobal(temp.Length);
        Marshal.Copy(temp, 0, ptr, temp.Length);
        sd = (SECURITY_DESCRIPTOR)Marshal.PtrToStructure(ptr, typeof(SECURITY_DESCRIPTOR));
        return sd;
    }
    catch (Exception)
    {
        throw new Exception("Couldn't get security descriptor");
    }
    finally
    {
        Marshal.FreeHGlobal(ptr);
    }
}

SD is ok, I have no problem with that. Then I'm trying to get DACL and SACL from the SD.

private static List<ACL> GetAcls(SECURITY_DESCRIPTOR sd)
{
    List<ACL> result = new List<ACL>(2);
    ACL temp = new ACL();
    int daclPresent = 0;
    int daclDefaulted = 0;
    try
    {
        int res = PInvoke.GetSecurityDescriptorDacl(ref sd, ref daclPresent, ref temp, ref daclDefaulted);
        result.Add(temp);
        temp = new ACL();
    }
    catch (Exception) { }
    try
    {
        int res = PInvoke.GetSecurityDescriptorSacl(ref sd, ref daclPresent, ref temp, ref daclDefaulted);
        result.Add(temp);
    }
    catch (Exception) { }
    return result;
}

External functions are defined as following:

    [DllImport("advapi32.dll")]
    public static extern int GetSecurityDescriptorDacl(
        [MarshalAs(UnmanagedType.Struct)] ref SECURITY_DESCRIPTOR pSecurityDescriptor,
        ref int lpbDaclPresent,
        [MarshalAs(UnmanagedType.Struct)] ref ACL pDacl,
        ref int lpbDaclDefaulted
    );

    [DllImport("advapi32.dll")]
    public static extern int GetSecurityDescriptorSacl(
        [MarshalAs(UnmanagedType.Struct)] ref SECURITY_DESCRIPTOR pSecurityDescriptor,
        ref int lpbDaclPresent,
        [MarshalAs(UnmanagedType.Struct)] ref ACL pDacl,
        ref int lpbDaclDefaulted
    );

When I check properties of SD instance I see following:

sd.Dacl
{Permission.ACL}
    AceCount: 83886080
    AclRevision: 169
    AclSize: 1281
    Sbz1: 0
    Sbz2: 21

sd.Sacl
{Permission.ACL}
    AceCount: 6
    AclRevision: 20
    AclSize: 9961474
    Sbz1: 0
    Sbz2: 2359297

In total ACL contains 6 ACEs. So it seems SACL contains all of them. However it's not recommended by MS to use these properties. Instead GetSecurityDescriptorDacl and GetSecurityDescriptorSacl should be used. So I use them. And see that count of ACEs in DACL is 0 and count of ACEs in SACL is also 0.

So the question is: how to get properly all ACEs from the security descriptor?

Answer 1

You must treat a SECURITY_DESCRIPTOR as an opaque handle. You can't cast to one as you have done on the line:

   sd = (SECURITY_DESCRIPTOR)Marshal.PtrToStructure(ptr, 
          typeof(SECURITY_DESCRIPTOR)); 

When you did the above cast you lost all the Owner, Group, DACL and SACL information since you have a self-relative SECURITY_DESCRIPTOR but you are not marshaling the data along with your definition of the structure.

Simply change your declarations of the various API calls (ie GetSecurityDescriptorDacl, etc.) to take a byte[] rather than a ref SECURITY_DESCRIPTOR and pass in the byte[] that you received from the ADsSecurityUtility.