jcifs.smb

Class ACE


public class ACE
extends java.lang.Object

An Access Control Entry (ACE) is an element in a security descriptor such as those associated with files and directories. The Windows OS determines which users have the necessary permissions to access objects based on these entries.

To fully understand the information exposed by this class a description of the access check algorithm used by Windows is required. The following is a basic description of the algorithm. For a more complete description we recommend reading the section on Access Control in Keith Brown's "The .NET Developer's Guide to Windows Security" (which is also available online).

Direct ACEs are evaluated first in order. The SID of the user performing the operation and the desired access bits are compared to the SID and access mask of each ACE. If the SID matches, the allow/deny flags and access mask are considered. If the ACE is a "deny" ACE and any of the desired access bits match bits in the access mask of the ACE, the whole access check fails. If the ACE is an "allow" ACE and all of the bits in the desired access bits match bits in the access mask of the ACE, the access check is successful. Otherwise, more ACEs are evaluated until all desired access bits (combined) are "allowed". If all of the desired access bits are not "allowed" the then same process is repeated for inherited ACEs.

For example, if user WNET\alice tries to open a file with desired access bits 0x00000003 (FILE_READ_DATA | FILE_WRITE_DATA) and the target file has the following security descriptor ACEs:

 Allow WNET\alice     0x001200A9  Direct
 Allow Administrators 0x001F01FF  Inherited
 Allow SYSTEM         0x001F01FF  Inherited
 
the access check would fail because the direct ACE has an access mask of 0x001200A9 which doesn't have the FILE_WRITE_DATA bit on (bit 0x00000002). Actually, this isn't quite correct. If WNET\alice is in the local Administrators group the access check will succeed because the inherited ACE allows local Administrators both FILE_READ_DATA and FILE_WRITE_DATA access.

Field Summary

static int
DELETE
static int
FILE_APPEND_DATA
static int
FILE_DELETE
static int
FILE_EXECUTE
static int
FILE_READ_ATTRIBUTES
static int
FILE_READ_DATA
static int
FILE_READ_EA
static int
FILE_WRITE_ATTRIBUTES
static int
FILE_WRITE_DATA
static int
FILE_WRITE_EA
static int
FLAGS_CONTAINER_INHERIT
static int
FLAGS_INHERITED
static int
FLAGS_INHERIT_ONLY
static int
FLAGS_NO_PROPAGATE
static int
FLAGS_OBJECT_INHERIT
static int
GENERIC_ALL
static int
GENERIC_EXECUTE
static int
GENERIC_READ
static int
GENERIC_WRITE
static int
READ_CONTROL
static int
SYNCHRONIZE
static int
WRITE_DAC
static int
WRITE_OWNER

Method Summary

int
getAccessMask()
Returns the access mask accociated with this ACE.
String
getApplyToText()
Returns the 'Apply To' text for inheritance of ACEs on directories such as 'This folder, subfolder and files'.
int
getFlags()
Returns the flags for this ACE.
SID
getSID()
Return the SID associated with this ACE.
boolean
isAllow()
Returns true if this ACE is an allow ACE and false if it is a deny ACE.
boolean
isInherited()
Returns true if this ACE is an inherited ACE and false if it is a direct ACE.
String
toString()
Return a string represeting this ACE.

Field Details

DELETE

public static final int DELETE
Field Value:
65536

FILE_APPEND_DATA

public static final int FILE_APPEND_DATA
Field Value:
4

FILE_DELETE

public static final int FILE_DELETE
Field Value:
64

FILE_EXECUTE

public static final int FILE_EXECUTE
Field Value:
32

FILE_READ_ATTRIBUTES

public static final int FILE_READ_ATTRIBUTES
Field Value:
128

FILE_READ_DATA

public static final int FILE_READ_DATA
Field Value:
1

FILE_READ_EA

public static final int FILE_READ_EA
Field Value:
8

FILE_WRITE_ATTRIBUTES

public static final int FILE_WRITE_ATTRIBUTES
Field Value:
256

FILE_WRITE_DATA

public static final int FILE_WRITE_DATA
Field Value:
2

FILE_WRITE_EA

public static final int FILE_WRITE_EA
Field Value:
16

FLAGS_CONTAINER_INHERIT

public static final int FLAGS_CONTAINER_INHERIT
Field Value:
2

FLAGS_INHERITED

public static final int FLAGS_INHERITED
Field Value:
16

FLAGS_INHERIT_ONLY

public static final int FLAGS_INHERIT_ONLY
Field Value:
8

FLAGS_NO_PROPAGATE

public static final int FLAGS_NO_PROPAGATE
Field Value:
4

FLAGS_OBJECT_INHERIT

public static final int FLAGS_OBJECT_INHERIT
Field Value:
1

GENERIC_ALL

public static final int GENERIC_ALL
Field Value:
268435456

GENERIC_EXECUTE

public static final int GENERIC_EXECUTE
Field Value:
536870912

GENERIC_READ

public static final int GENERIC_READ
Field Value:
-2147483648

GENERIC_WRITE

public static final int GENERIC_WRITE
Field Value:
1073741824

READ_CONTROL

public static final int READ_CONTROL
Field Value:
131072

SYNCHRONIZE

public static final int SYNCHRONIZE
Field Value:
1048576

WRITE_DAC

public static final int WRITE_DAC
Field Value:
262144

WRITE_OWNER

public static final int WRITE_OWNER
Field Value:
524288

Method Details

getAccessMask

public int getAccessMask()
Returns the access mask accociated with this ACE. Use the constants for FILE_READ_DATA, FILE_WRITE_DATA, READ_CONTROL, GENERIC_ALL, etc with bitwise operators to determine which bits of the mask are on or off.

getApplyToText

public String getApplyToText()
Returns the 'Apply To' text for inheritance of ACEs on directories such as 'This folder, subfolder and files'. For files the text is always 'This object only'.

getFlags

public int getFlags()
Returns the flags for this ACE. The isInherited() method checks the FLAGS_INHERITED bit in these flags.

getSID

public SID getSID()
Return the SID associated with this ACE.

isAllow

public boolean isAllow()
Returns true if this ACE is an allow ACE and false if it is a deny ACE.

isInherited

public boolean isInherited()
Returns true if this ACE is an inherited ACE and false if it is a direct ACE.

Note: For reasons not fully understood, FLAGS_INHERITED may not be set within all security descriptors even though the ACE was in face inherited. If an inherited ACE is added to a parent the Windows ACL editor will rebuild all children ACEs and set this flag accordingly.


toString

public String toString()
Return a string represeting this ACE.

Note: This function should probably be changed to return SDDL fragments but currently it does not.