Allowing Access

You can allow all access to an object by adding a NULL discretionary access-control list (DACL) to the object's security descriptor. Unlike an empty DACL that denies all access, a NULL DACL grants everyone full access to the object. You can also grant access to a specified trustee by using a DACL that has one or more access-allowed ACEs.

This topic includes examples that use the high-level access-control functions provided by Windows NT version 4.0. For an example that uses the older low-level access control functions, see Allowing Access Using the Low-Level Functions.

The first example uses the SetNamedSecurityInfo function to attach a NULL DACL to a file. The SetNamedSecurityInfo call specifies the DACL_SECURITY_INFORMATION flag to indicate that it is setting the file's DACL; and it passes a NULL pointer for the pDacl parameter.

// grant full access to everyone with a NULL DACL

dwRes = SetNamedSecurityInfo(TEXT("myfile"), SE_FILE_OBJECT,

DACL_SECURITY_INFORMATION,

NULL, NULL, NULL, NULL);

The second example adds an access-allowed ACE to the DACL of an object. The example uses the GetNamedSecurityInfo function to get the existing DACL. Then it uses the BuildExplicitAccessWithName and SetEntriesInAcl functions to merge a new ACE with any existing ACEs in the DACL. Finally, the example calls the SetNamedSecurityInfo function to attach the new DACL to the object's security descriptor.

DWORD AddAceToAcl (LPTSTR lpObjectName, SE_OBJECT_TYPE ObjectType)

{

DWORD dwRes;

PACL pOldDACL, pNewDACL;

PSECURITY_DESCRIPTOR pSD;

EXPLICIT_ACCESS ea;

if (NULL == lpObjectName)

return ERROR_INVALID_PARAMETER;

// get a pointer to the existing DACL

dwRes = GetNamedSecurityInfo(lpObjectName, ObjectType,

DACL_SECURITY_INFORMATION,

NULL, NULL, &pOldDACL, NULL, &pSD);

if (ERROR_SUCCESS != dwRes)

return dwRes;

// initialize an EXPLICIT_ACCESS structure to allow access

ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));

BuildExplicitAccessWithName(&ea, "duke", GENERIC_READ,

SET_ACCESS, NO_INHERITANCE);

// create an new ACL by merging the EXPLICIT_ACCESS structure

// with the existing DACL

dwRes = SetEntriesInAcl(1, &ea, pOldDACL, &pNewDACL);

if (ERROR_SUCCESS != dwRes)

goto Cleanup;

// attach the new ACL as the object's DACL

dwRes = SetNamedSecurityInfo(lpObjectName, ObjectType,

DACL_SECURITY_INFORMATION,

NULL, NULL, pNewDACL, NULL);

// free the buffers returned by SetEntriesInAcl

// and GetNamedSecurityInfo

Cleanup:

if(pSD != NULL)

LocalFree((HLOCAL) pSD);

if(pNewDACL != NULL)

LocalFree((HLOCAL) pNewDACL);

return dwRes;

}