Checking the existence of ACE in windows object DACL

Question

is there a way to check if an ACE already exists in the DACL of an object?

I want to use the RtlAddAccessAllowedAce API call to add an ACE to an object, but I want to do that only if the ACE doesn't exist already.

Does someone know how can I either check if the ACE already exist, or to try to remove the given ACE before adding it, or any other solution which will achieve the same goal? Thanks!

score 2 · Accepted Answer · answered Sep 10 '17 at 10:43

you can or use winapi or direct walk by ACL ACEs - enumerate ACE one by one and check are some specific ACE exist:

variant 1:

void WalkAcl(PACL acl)
{
    ACL_SIZE_INFORMATION asi;
    if (GetAclInformation(acl, &asi, sizeof(asi), AclSizeInformation))
    {
        if (asi.AceCount)
        {
            do 
            {
                union {
                    PVOID pvAce;
                    PACE_HEADER pAceHeader;
                    PACCESS_ALLOWED_ACE pAllowedAce;
                };

                PWSTR szSid;
                if (GetAce(acl, --asi.AceCount, &pvAce))
                {
                    switch (pAceHeader->AceType)
                    {
                    case ACCESS_ALLOWED_ACE_TYPE:
                        if (ConvertSidToStringSid(&pAllowedAce->SidStart, &szSid))
                        {
                            DbgPrint("%08x %S\n", pAllowedAce->Mask, szSid);
                            LocalFree(szSid);
                        }
                        break;
                    }
                }

            } while (asi.AceCount);
        }
    }
}

variant 2:

void WalkAcl(PACL acl)
{
    if (USHORT AceCount = acl->AceCount)
    {
        union {
            PVOID pv;
            PBYTE pb;
            PACE_HEADER pAceHeader;
            PACCESS_ALLOWED_ACE pAllowedAce;
        };

        pv = acl + 1;

        do 
        {
            UNICODE_STRING usSid;
            switch (pAceHeader->AceType)
            {
            case ACCESS_ALLOWED_ACE_TYPE:
                if (0 <= RtlConvertSidToUnicodeString(&usSid, &pAllowedAce->SidStart, TRUE))
                {
                    DbgPrint("%08x %wZ\n", pAllowedAce->Mask, usSid);
                    RtlFreeUnicodeString(&usSid);
                }
                break;
            }

        } while (pb += pAceHeader->AceSize, --AceCount);
    }
}

Comments are not for extended discussion; this conversation has been [moved to chat](http://chat.stackoverflow.com/rooms/154136/discussion-on-answer-by-rbmm-checking-the-existence-of-ace-in-windows-object-dac). — Andy, Sep 11 '17 at 12:40

Checking the existence of ACE in windows object DACL

1 Answers1