SDDL Parsing and Generation

The Security Descriptor Definition Language (SDDL) is the standard text format for Windows security descriptors: O:ownerG:groupD:dacl_flags(ACEs)S:sacl_flags(ACEs).

Parsing

#![allow(unused)]
fn main() {
use win_sd::{parse, SddlParser, Sid, AccessMask};

let sddl = "O:BAG:SYD:(D;;GA;;;AN)(A;;FA;;;BA)(A;;FR;;;WD)";
let sd = parse::<SddlParser>(sddl).unwrap();

assert_eq!(sd.owner(), Some(&Sid::administrators()));
assert_eq!(sd.group(), Some(&Sid::local_system()));
assert_eq!(sd.dacl().unwrap().ace_count(), 3);
}

Generating

#![allow(unused)]
fn main() {
use win_sd::{generate, SddlGenerator, SecurityDescriptorBuilder, AccessMask, Sid};

let sd = SecurityDescriptorBuilder::new()
    .owner(Sid::administrators())
    .group(Sid::local_system())
    .allow(Sid::everyone(), AccessMask::FILE_GENERIC_READ)
    .build();

let sddl = generate::<SddlGenerator>(&sd).unwrap();
assert_eq!(sddl, "O:BAG:SYD:(A;;FR;;;WD)");
}

SID aliases

Well-known SIDs are represented by two-letter aliases:

Alias	SID	Name
WD	S-1-1-0	Everyone
BA	S-1-5-32-544	BUILTIN\Administrators
BU	S-1-5-32-545	BUILTIN\Users
SY	S-1-5-18	LOCAL SYSTEM
AN	S-1-5-7	ANONYMOUS LOGON
AU	S-1-5-11	Authenticated Users
CO	S-1-3-0	Creator Owner
LW	S-1-16-4096	Low Integrity
ME	S-1-16-8192	Medium Integrity
HI	S-1-16-12288	High Integrity
SI	S-1-16-16384	System Integrity

BUILTIN and other well-known SIDs

Alias	SID	Name
PS	S-1-5-10	Principal Self
ED	S-1-5-9	Enterprise DCs
OW	S-1-3-4	Owner Rights
BO	S-1-5-32-551	Backup Operators
SO	S-1-5-32-549	Server Operators
PO	S-1-5-32-550	Print Operators
AO	S-1-5-32-548	Account Operators
PU	S-1-5-32-547	Power Users
RE	S-1-5-32-552	Replicator
RU	S-1-5-32-554	Pre-W2K Compatible
IS	S-1-5-32-568	IIS_IUSRS
CY	S-1-5-32-569	Crypto Operators
ER	S-1-5-32-573	Event Log Readers
HA	S-1-5-32-578	Hyper-V Admins
AA	S-1-5-32-579	Access Control Assistance
AC	S-1-15-2-1	All Application Packages

Domain-relative aliases

Domain-relative aliases (DA, DU, DD, etc.) require a DomainContext:

#![allow(unused)]
fn main() {
use win_sd::{parse_with_domain, generate_with_domain, DomainContext, Sid};

let domain = DomainContext::new(
    Sid::from_authority(5, vec![21, 100, 200, 300]),
);

// DA resolves to S-1-5-21-100-200-300-512 (Domain Admins)
let sd = parse_with_domain("O:DAG:DUD:(A;;FA;;;DA)", &domain).unwrap();
let owner = sd.owner().unwrap();
assert_eq!(owner.rid(), Some(512));

// Generate uses aliases when a domain context is provided
let sddl = generate_with_domain(&sd, &domain).unwrap();
assert!(sddl.contains("DA"));
}

Alias	RID	Name
DA	512	Domain Admins
DU	513	Domain Users
DG	514	Domain Guests
DC	515	Domain Computers
DD	516	Domain Controllers
SA	518	Schema Admins
EA	519	Enterprise Admins
PA	520	Policy Admins
RO	521	Read-Only DCs

Rights aliases

Access mask values use two-letter codes:

Code	Value	Meaning
GA	0x10000000	GENERIC_ALL
GR	0x80000000	GENERIC_READ
GW	0x40000000	GENERIC_WRITE
GX	0x20000000	GENERIC_EXECUTE
FA	0x001F01FF	FILE_ALL_ACCESS
FR	0x00120089	FILE_GENERIC_READ
FW	0x00120116	FILE_GENERIC_WRITE
FX	0x001200A0	FILE_GENERIC_EXECUTE
KA	0x000F003F	KEY_ALL_ACCESS
KR	0x00020019	KEY_READ
KW	0x00020006	KEY_WRITE
CC	0x00000001	CREATE_CHILD (AD)
DC	0x00000002	DELETE_CHILD (AD)
RP	0x00000010	READ_PROP (AD)
WP	0x00000020	WRITE_PROP (AD)
CR	0x00000100	CONTROL_ACCESS (AD)
RC	0x00020000	READ_CONTROL
SD	0x00010000	DELETE
WD	0x00040000	WRITE_DAC
WO	0x00080000	WRITE_OWNER
NW	0x01	NO_WRITE_UP (integrity)
NR	0x02	NO_READ_UP (integrity)
NX	0x04	NO_EXECUTE_UP (integrity)

ACL flags: P (protected), AR (auto-inherit request), AI (auto-inherited).

Hex literals are also accepted: 0x001F01FF.

Keyboard shortcuts