hectane / go-acl Goto Github PK

The Chmod function is broken, it is specific to English language installs. To be locale-independent, it needs to use SIDs.

I see how to use this to adjust a user's permissions but how could I use this to get a user's permissions? Thanks!

When calling api.GetNamedSecurityInfo to identify the owner of a file, if the path and filename passed are 260 characters or longer, the call is failing. The error returned is "The operation completed successfully." but no security Descriptor or Owner SID are returned, so the owner cannot be lookup up.

In today's LAN environments, being able to lookup file information for paths that are longer than 260 characters is a must.

For now I will continue to do this in .Net but I was really hoping to move this to Go, to improve performance.

Thanks!

I need to retrieve the owner and permissions associated with a file. I followed the example given in readme file to get the SID of owner for a file. I'm getting some value of security descriptor but not getting sid associated with the owner. Not sure if security descriptor value is coming correct or not.

Below is the output that i'm getting:
secDesc is the security descriptory handle and owner points to the sid of owner.

secDesc=== 983968
owner=== &{}

I can see that one of your Appveyor tests is failing with the error "No mapping between account names and security IDs was done.": https://ci.appveyor.com/project/nathan-osman/go-acl/builds/21576505

My tests are failing because of the same error. The code that is returning that error is acl.Chmod(directoryPath, 0700).

Is there a workaround for this? When do you think you can get this fixed?

After changing the acl for a file with Chmod(file, 07xy), I am unable to delete the file. This happens because none of the generic read, write, or execute rights include DELETE permission (https://docs.microsoft.com/en-us/windows/desktop/FileIO/file-security-and-access-rights).

I know on Unix systems delete permission is controlled by the parent directory rather than the file itself, so the analogy doesn't work 100%, but I would expect to be able to delete files if I can also write them.

Can we change Chmod to add DELETE if the write bit is set? I can submit a PR if this is a change you would accept.

I noticed when I tried to set ACLs on a mispelled folder I got an error back which when printed said The operation completed successfully. (i.e. ERROR_SUCCESS)

Looking at the API package:

func GetNamedSecurityInfo(objectName string, objectType int32, secInfo uint32, owner, group **windows.SID, dacl, sacl, secDesc *windows.Handle) error {
	ret, _, err := procGetNamedSecurityInfoW.Call(
		uintptr(unsafe.Pointer(windows.StringToUTF16Ptr(objectName))),
		uintptr(objectType),
		uintptr(secInfo),
		uintptr(unsafe.Pointer(owner)),
		uintptr(unsafe.Pointer(group)),
		uintptr(unsafe.Pointer(dacl)),
		uintptr(unsafe.Pointer(sacl)),
		uintptr(unsafe.Pointer(secDesc)),
	)
	if ret != 0 {
		return err
	}
	return nil
}

The 3rd parameter of the syscall-type function should only be used for functions which return a TRUE/FALSE and vend their error through the GetLastError() mechanism. In the case of GetNamedSecurityInfoW the error code is what is returned. Therefore the code should look more like:

func GetNamedSecurityInfo(objectName string, objectType int32, secInfo uint32, owner, group **windows.SID, dacl, sacl, secDesc *windows.Handle) error {
	ret, _, _ := procGetNamedSecurityInfoW.Call(
		uintptr(unsafe.Pointer(windows.StringToUTF16Ptr(objectName))),
		uintptr(objectType),
		uintptr(secInfo),
		uintptr(unsafe.Pointer(owner)),
		uintptr(unsafe.Pointer(group)),
		uintptr(unsafe.Pointer(dacl)),
		uintptr(unsafe.Pointer(sacl)),
		uintptr(unsafe.Pointer(secDesc)),
	)
	if ret != 0 {
		return windows.Errno(ret)
	}
	return nil
}

I haven't looked at the api package more exhaustively to see if this applies to other functions, but I expect it does. If I find time I will submit an MR with a small test and hopefully fixes for these (though as a larger fix it may be worth moving to the x/sys/windows/mkwinsyscall mechanism for generating these functions?)

result := acl.Apply(`C:\Windows\System32\drivers\usbser.sys`, false, false, acl.GrantName(windows.GENERIC_ALL, "Administrators"))
		fmt.Println(result)

This is my code to modify the acl of usbser.sys , but it doesn't work.

I've tried acl.Chmod(path, 0777) but that still doesn't give NTFS FullControl?

This functionreturns a potential error which is not handled or passed back.

https://github.com/hectane/go-acl/blob/master/apply.go#L19

I'm trying to use this library, and even though it properly reports than an error has occurred, when printing that error with %v, I get the message: "The operation completed successfully." Is it possible to get a message that corresponds to the error, as seen on this list?