如何获得有效的文件权限？

Question

I'm trying to get file effective permissions . What is the best way to do that?

I'm trying to use win32security but GetEffectiveRightsFromAcl(trustee) function needs the PyTRUSTEE parameter. And I don't know how to set it correctly.

As a result, I need to get the same permissions as with Get-EffectiveAccess calling in PowerShell.

We were tried to use Authz.h but in that case we got the Audit failure in Windows Event Viewer.

We also tried to use GetEffectiveRightsFromAcl from Aclapi.h but it can become a reason of server hangup in case when we have a lot of files.

python:

dacl = win32security.GetNamedSecurityInfo( FILENAME,
 win32security.SE_FILE_OBJECT,
 win32security.DACL_SECURITY_INFORMATION).GetSecurityDescriptorDacl()
mask = dacl.GetEffectiveRightsFromAcl( ??? )

Authz.h :

AuthzInitializeResourceManager(AUTHZ_RM_FLAG_NO_AUDIT, NULL, NULL, NULL, NULL, &hManager);
AuthzInitializeContextFromSid(0, psid, hManager, NULL, unusedId, NULL, &hAuthzClientContext);
AuthzFreeResourceManager(hManager);

accessRequest->DesiredAccess = MAXIMUM_ALLOWED;
accessRequest->PrincipalSelfSid = NULL;
accessRequest->ObjectTypeList = NULL;
accessRequest->ObjectTypeListLength = 0;
accessRequest->OptionalArguments = NULL;
RtlZeroMemory(Buffer, sizeof(Buffer));
accessReply->ResultListLength = 1;

accessReply->GrantedAccessMask = (PACCESS_MASK)LocalAlloc(LPTR, sizeof(ACCESS_MASK));
accessReply->Error = (PDWORD)(Buffer + sizeof(ACCESS_MASK));

AuthzAccessCheck(0, hAuthzClient, accessRequest, NULL, psd, NULL, 0, accessReply, NULL)

Aclapi.h

ACCESS_MASK accessRights;
TRUSTEE trustee;

BuildTrusteeWithName(&trustee, trav->user);
retcode = GetEffectiveRightsFromAcl( acl,&trustee,&accessRights);

I'm need to get something like that:

FILE_READ_DATA
FILE_WRITE_DATA
FILE_APPEND_DATA
FILE_READ_EA
FILE_WRITE_EA
FILE_EXECUTE
FILE_DELETE_CHILD
FILE_READ_ATTRIBUTE
FILE_WRITE_ATTRIBUTE
DELETE
READ_CONTROL
WRITE_DAC
WRITE_OWNER
SYNCHRONIZE

Answer 1

I got some result using @eryksun help. Thanks. Also I found this useful example .

def print_permissions(mask):
print("PERMISSION:",
      1 if bool(mask & 0x00000001) else 0,
      1 if bool(mask & 0x00000002) else 0,
      1 if bool(mask & 0x00000004) else 0,
      1 if bool(mask & 0x00000008) else 0,
      1 if bool(mask & 0x00000010) else 0,
      1 if bool(mask & 0x00000020) else 0,
      1 if bool(mask & 0x00000040) else 0,
      1 if bool(mask & 0x00000080) else 0,
      1 if bool(mask & 0x00000100) else 0,
      1 if bool(mask & 0x00010000) else 0,
      1 if bool(mask & 0x00020000) else 0,
      1 if bool(mask & 0x00040000) else 0,
      1 if bool(mask & 0x00080000) else 0,
      1 if bool(mask & 0x00100000) else 0)

def get_permissions(dacl):
for n_ace in range(dacl.GetAceCount()):
    ace = dacl.GetAce(n_ace)
    (ace_type, ace_flags) = ace[0]
    if ace_type in CONVENTIONAL_ACES:
        mask, sid = ace[1:]
    else:
        mask, object_type, inherited_object_type, sid = ace[1:]
    name, domain, type = win32security.LookupAccountSid(None, sid)
    print("\nUSER:", name)
    print_permissions(mask)

for f in files:
    try:
        dacl = win32security.GetNamedSecurityInfo(
            f,
            win32security.SE_FILE_OBJECT,
            win32security.DACL_SECURITY_INFORMATION).GetSecurityDescriptorDacl()
    except BaseException as ex:
        winerror, funcname, strerror = ex.args
        print("Error: ", winerror,"\n")
    else:
        get_permissions(dacl)

I don't use GetEffectiveRightsFromAcl because it's contained in the ace.

When I tried to create a token with Privilege Constants I also got the same Audit Failure (in System Account case). So I didn't found any result that will work without Audit Faulire in both cases (System Account and Administrator) (except PowerShell).