Win32::FileSecurity - manage FileSecurity Discretionary Access Control Lists in perl

- NAME
- SYNOPSIS
- DESCRIPTION
- CONSTANTS
- FUNCTIONS

- NOTE:
- %permisshash

- EXAMPLE1
- EXAMPLE2
- COMMON MASKS FROM CACLS AND WINFILE

- READ
- CHANGE
- ADD & READ
- FULL

- RESOURCES
- VERSION
- REVISION NOTES
- KNOWN ISSUES / BUGS

# NAME

Win32::FileSecurity - manage FileSecurity Discretionary Access Control Lists in perl

# SYNOPSIS

            use Win32::FileSecurity;

# DESCRIPTION

This module offers control over the administration of system FileSecurity DACLs. You may want to use Get and EnumerateRights to get an idea of what mask values correspond to what rights as viewed from File Manager.

# CONSTANTS

      DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER,
      SYNCHRONIZE, STANDARD_RIGHTS_REQUIRED,
      STANDARD_RIGHTS_READ, STANDARD_RIGHTS_WRITE,
      STANDARD_RIGHTS_EXECUTE, STANDARD_RIGHTS_ALL,
      SPECIFIC_RIGHTS_ALL, ACCESS_SYSTEM_SECURITY,
      MAXIMUM_ALLOWED, GENERIC_READ, GENERIC_WRITE,
      GENERIC_EXECUTE, GENERIC_ALL, F, FULL, R, READ,
      C, CHANGE

# FUNCTIONS

## NOTE:

All of the functions return false if they fail, unless otherwise noted. Errors returned via $! containing both Win32 `GetLastError()` and a text message indicating Win32 function that failed.

constant( $name, $set )
  Stores the value of named constant $name into $set. Same as `$set = Win32::FileSecurity::NAME_OF_CONSTANT();`.

Get( $filename, \%permisshash )
  Gets the DACLs of a file or directory.

Set( $filename, \%permisshash )
  Sets the DACL for a file or directory.

EnumerateRights( $mask, \@rightslist )
  Turns the bitmask in $mask into a list of strings in @rightslist.

MakeMask( qw( DELETE READ_CONTROL ) )
  Takes a list of strings representing constants and returns a bitmasked integer value.

## %permisshash

Entries take the form $permisshash{USERNAME} = $mask ;

# EXAMPLE1

        # Gets the rights for all files listed on the command line.
        use Win32::FileSecurity qw(Get EnumerateRights);

        foreach( @ARGV ) {
            next unless -e $_ ;
            if ( Get( $_, \%hash ) ) {
                while( ($name, $mask) = each %hash ) {
                    print "$name:\n\t";
                    EnumerateRights( $mask, \@happy ) ;
                    print join( "\n\t", @happy ), "\n";
                }
            }
            else {
                print( "Error #", int( $! ), ": $!" ) ;
            }
        }

# EXAMPLE2

        # Gets existing DACL and modifies Administrator rights
        use Win32::FileSecurity qw(MakeMask Get Set);

        # These masks show up as Full Control in File Manager
        $file = MakeMask( qw( FULL ) );

        $dir = MakeMask( qw(
                FULL
            GENERIC_ALL
        ) );

        foreach( @ARGV ) {
            s/\\$//;
            next unless -e;
            Get( $_, \%hash ) ;
            $hash{Administrator} = ( -d ) ? $dir : $file ;
            Set( $_, \%hash ) ;
        }

# COMMON MASKS FROM CACLS AND WINFILE

## READ

            MakeMask( qw( FULL ) ); # for files
            MakeMask( qw( READ GENERIC_READ GENERIC_EXECUTE ) ); # for directories

## CHANGE

            MakeMask( qw( CHANGE ) ); # for files
            MakeMask( qw( CHANGE GENERIC_WRITE GENERIC_READ GENERIC_EXECUTE ) ); # for directories

## ADD & READ

            MakeMask( qw( ADD GENERIC_READ GENERIC_EXECUTE ) ); # for directories only!

## FULL

            MakeMask( qw( FULL ) ); # for files
            MakeMask( qw( FULL  GENERIC_ALL ) ); # for directories

# RESOURCES

From Microsoft: check_sd
| http://premium.microsoft.com/download/msdn/samples/2760.exe

(thanks to Guert Schimmel at Sybase for turning me on to this one)

# VERSION

1.03 ALPHA 97-12-14

# REVISION NOTES

1. 03 ALPHA 1998.01.11
Imported diffs from 0.67 (parent) version

2. 02 ALPHA 1997.12.14
Pod fixes, @EXPORT list additions <gsar@activestate.com>

Fix unitialized vars on unknown ACLs <jmk@exc.bybyte.de>

3. 01 ALPHA 1997.04.25
CORE Win32 version imported from 0.66 <gsar@activestate.com>

4. 67 ALPHA 1997.07.07
Kludged bug in mapping bits to separate ACE's. Notably, this screwed up CHANGE access by leaving out a delete bit in the `INHERIT_ONLY_ACE | OBJECT_INHERIT_ACE` Access Control Entry.

May need to rethink...

5. 66 ALPHA 1997.03.13
Fixed bug in memory allocation check

6. 65 ALPHA 1997.02.25
Tested with 5.003 build 303

Added ISA exporter, and @EXPORT_OK

Added F, FULL, R, READ, C, CHANGE as composite pre-built mask names.

Added server\ to keys returned in hash from Get

Made constants and MakeMask case insensitive (I don't know why I did that)

Fixed mask comparison in ListDacl and Enumerate Rights from simple & mask to exact bit match ! ( ( x & y ) ^ x ) makes sure all bits in x are set in y

Fixed some ``wild'' pointers

7. 60 ALPHA 1996.07.31
Now suitable for file and directory permissions

Included ListDacl.exe in bundle for debugging

Added ``intuitive'' inheritance for directories, basically functions like FM triggered by presence of GENERIC_ rights this may need to change

see EXAMPLE2

Changed from AddAccessAllowedAce to AddAce for control over inheritance

8. 51 ALPHA 1996.07.20
Fixed memory allocation bug

9. 50 ALPHA 1996.07.29
Base functionality

Using AddAccessAllowedAce

Suitable for file permissions

# KNOWN ISSUES / BUGS

May not work on remote drives.

Errors croak, don't return via $! as documented.

Win32::FileSecurity - manage FileSecurity Discretionary Access Control Lists in perl