SDDL Parsing and Generation

The Security Descriptor Definition Language (SDDL) is the standard text format for Windows security descriptors: O:ownerG:groupD:dacl_flags(ACEs)S:sacl_flags(ACEs).

Parsing

#![allow(unused)]
fn main() {
use win_sd::{parse, SddlParser, Sid, AccessMask};

let sddl = "O:BAG:SYD:(D;;GA;;;AN)(A;;FA;;;BA)(A;;FR;;;WD)";
let sd = parse::<SddlParser>(sddl).unwrap();

assert_eq!(sd.owner(), Some(&Sid::administrators()));
assert_eq!(sd.group(), Some(&Sid::local_system()));
assert_eq!(sd.dacl().unwrap().ace_count(), 3);
}

Generating

#![allow(unused)]
fn main() {
use win_sd::{generate, SddlGenerator, SecurityDescriptorBuilder, AccessMask, Sid};

let sd = SecurityDescriptorBuilder::new()
    .owner(Sid::administrators())
    .group(Sid::local_system())
    .allow(Sid::everyone(), AccessMask::FILE_GENERIC_READ)
    .build();

let sddl = generate::<SddlGenerator>(&sd).unwrap();
assert_eq!(sddl, "O:BAG:SYD:(A;;FR;;;WD)");
}

SID aliases

Well-known SIDs are represented by two-letter aliases:

BUILTIN and other well-known SIDs

Domain-relative aliases

Domain-relative aliases (DA, DU, DD, etc.) require a DomainContext:

#![allow(unused)]
fn main() {
use win_sd::{parse_with_domain, generate_with_domain, DomainContext, Sid};

let domain = DomainContext::new(
    Sid::from_authority(5, vec![21, 100, 200, 300]),
);

// DA resolves to S-1-5-21-100-200-300-512 (Domain Admins)
let sd = parse_with_domain("O:DAG:DUD:(A;;FA;;;DA)", &domain).unwrap();
let owner = sd.owner().unwrap();
assert_eq!(owner.rid(), Some(512));

// Generate uses aliases when a domain context is provided
let sddl = generate_with_domain(&sd, &domain).unwrap();
assert!(sddl.contains("DA"));
}

Rights aliases

Access mask values use two-letter codes:

ACL flags (the flags string right after D:/S:, before the first ACE): P (protected), AR (auto-inherit request), AI (auto-inherited).

Hex literals are also accepted: 0x001F01FF.

ACE flags

The second semicolon-separated field of an ACE string (e.g. the OICI in (A;OICI;GA;;;BA)) is a concatenation of two-letter inheritance/audit flag codes, corresponding to the AceFlags bits described in ACEs and Security Descriptors:

These codes may be freely combined, e.g. OICI sets both OBJECT_INHERIT and CONTAINER_INHERIT, and SAFA audits both successful and failed access attempts.