Module jcifs
Package org.codelibs.jcifs.smb1

Class ACE

java.lang.Object
org.codelibs.jcifs.smb1.ACE
public class ACE extends Object
An Access Control Entry (ACE) is an element in a security descriptor such as those associated with files and directories. The Windows OS determines which users have the necessary permissions to access objects based on these entries.

To fully understand the information exposed by this class a description of the access check algorithm used by Windows is required. The following is a basic description of the algorithm. For a more complete description we recommend reading the section on Access Control in Keith Brown's "The .NET Developer's Guide to Windows Security" (which is also available online).

Direct ACEs are evaluated first in order. The SID of the user performing the operation and the desired access bits are compared to the SID and access mask of each ACE. If the SID matches, the allow/deny flags and access mask are considered. If the ACE is a "deny" ACE and any of the desired access bits match bits in the access mask of the ACE, the whole access check fails. If the ACE is an "allow" ACE and all of the bits in the desired access bits match bits in the access mask of the ACE, the access check is successful. Otherwise, more ACEs are evaluated until all desired access bits (combined) are "allowed". If all of the desired access bits are not "allowed" the then same process is repeated for inherited ACEs.

For example, if user WNET\alice tries to open a file with desired access bits 0x00000003 (FILE_READ_DATA | FILE_WRITE_DATA) and the target file has the following security descriptor ACEs: 

 Allow WNET\alice     0x001200A9  Direct
 Allow Administrators 0x001F01FF  Inherited
 Allow SYSTEM         0x001F01FF  Inherited
the access check would fail because the direct ACE has an access mask of 0x001200A9 which doesn't have the FILE_WRITE_DATA bit on (bit 0x00000002). Actually, this isn't quite correct. If WNET\alice is in the local Administrators group the access check will succeed because the inherited ACE allows local Administrators both FILE_READ_DATA and FILE_WRITE_DATA access.

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final int
    DELETE
    Standard delete permission
    static final int
    FILE_APPEND_DATA
    Permission to append data to a file or add subdirectories
    static final int
    FILE_DELETE
    Permission to delete a file or directory
    static final int
    FILE_EXECUTE
    Permission to execute a file or traverse a directory
    static final int
    FILE_READ_ATTRIBUTES
    Permission to read file attributes
    static final int
    FILE_READ_DATA
    Permission to read data from a file or list directory contents
    static final int
    FILE_READ_EA
    Permission to read extended attributes
    static final int
    FILE_WRITE_ATTRIBUTES
    Permission to write file attributes
    static final int
    FILE_WRITE_DATA
    Permission to write data to a file or add files to a directory
    static final int
    FILE_WRITE_EA
    Permission to write extended attributes
    static final int
    FLAGS_CONTAINER_INHERIT
    Inheritance flag: child containers inherit this ACE
    static final int
    FLAGS_INHERIT_ONLY
    Inheritance flag: ACE applies only to children, not to the object itself
    static final int
    FLAGS_INHERITED
    Inheritance flag: ACE was inherited from parent
    static final int
    FLAGS_NO_PROPAGATE
    Inheritance flag: inheritance stops after one level
    static final int
    FLAGS_OBJECT_INHERIT
    Inheritance flag: child objects inherit this ACE
    static final int
    GENERIC_ALL
    Generic all permissions
    static final int
    GENERIC_EXECUTE
    Generic execute permission
    static final int
    GENERIC_READ
    Generic read permission
    static final int
    GENERIC_WRITE
    Generic write permission
    static final int
    READ_CONTROL
    Permission to read the security descriptor
    static final int
    SYNCHRONIZE
    Permission to synchronize with the file
    static final int
    WRITE_DAC
    Permission to write the discretionary access control list
    static final int
    WRITE_OWNER
    Permission to change the owner in the security descriptor

  • Constructor Summary

    Constructors
    Constructor
    Description
    ACE()
    Default constructor for ACE

  • Method Summary

    Modifier and Type
    Method
    Description
    int
    getAccessMask()
    Returns the access mask accociated with this ACE.
    String
    getApplyToText()
    Returns the 'Apply To' text for inheritance of ACEs on directories such as 'This folder, subfolder and files'.
    int
    getFlags()
    Returns the flags for this ACE.
    SID
    getSID()
    Return the SID associated with this ACE.
    boolean
    isAllow()
    Returns true if this ACE is an allow ACE and false if it is a deny ACE.
    boolean
    isInherited()
    Returns true if this ACE is an inherited ACE and false if it is a direct ACE.
    String
    toString()
    Return a string represeting this ACE.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

  • Field Details

    • FILE_READ_DATA

      public static final int FILE_READ_DATA
      Permission to read data from a file or list directory contents
      See Also:

    • FILE_WRITE_DATA

      public static final int FILE_WRITE_DATA
      Permission to write data to a file or add files to a directory
      See Also:

    • FILE_APPEND_DATA

      public static final int FILE_APPEND_DATA
      Permission to append data to a file or add subdirectories
      See Also:

    • FILE_READ_EA

      public static final int FILE_READ_EA
      Permission to read extended attributes
      See Also:

    • FILE_WRITE_EA

      public static final int FILE_WRITE_EA
      Permission to write extended attributes
      See Also:

    • FILE_EXECUTE

      public static final int FILE_EXECUTE
      Permission to execute a file or traverse a directory
      See Also:

    • FILE_DELETE

      public static final int FILE_DELETE
      Permission to delete a file or directory
      See Also:

    • FILE_READ_ATTRIBUTES

      public static final int FILE_READ_ATTRIBUTES
      Permission to read file attributes
      See Also:

    • FILE_WRITE_ATTRIBUTES

      public static final int FILE_WRITE_ATTRIBUTES
      Permission to write file attributes
      See Also:

    • DELETE

      public static final int DELETE
      Standard delete permission
      See Also:

    • READ_CONTROL

      public static final int READ_CONTROL
      Permission to read the security descriptor
      See Also:

    • WRITE_DAC

      public static final int WRITE_DAC
      Permission to write the discretionary access control list
      See Also:

    • WRITE_OWNER

      public static final int WRITE_OWNER
      Permission to change the owner in the security descriptor
      See Also:

    • SYNCHRONIZE

      public static final int SYNCHRONIZE
      Permission to synchronize with the file
      See Also:

    • GENERIC_ALL

      public static final int GENERIC_ALL
      Generic all permissions
      See Also:

    • GENERIC_EXECUTE

      public static final int GENERIC_EXECUTE
      Generic execute permission
      See Also:

    • GENERIC_WRITE

      public static final int GENERIC_WRITE
      Generic write permission
      See Also:

    • GENERIC_READ

      public static final int GENERIC_READ
      Generic read permission
      See Also:

    • FLAGS_OBJECT_INHERIT

      public static final int FLAGS_OBJECT_INHERIT
      Inheritance flag: child objects inherit this ACE
      See Also:

    • FLAGS_CONTAINER_INHERIT

      public static final int FLAGS_CONTAINER_INHERIT
      Inheritance flag: child containers inherit this ACE
      See Also:

    • FLAGS_NO_PROPAGATE

      public static final int FLAGS_NO_PROPAGATE
      Inheritance flag: inheritance stops after one level
      See Also:

    • FLAGS_INHERIT_ONLY

      public static final int FLAGS_INHERIT_ONLY
      Inheritance flag: ACE applies only to children, not to the object itself
      See Also:

    • FLAGS_INHERITED

      public static final int FLAGS_INHERITED
      Inheritance flag: ACE was inherited from parent
      See Also:

  • Constructor Details

    • ACE

      public ACE()
      Default constructor for ACE

  • Method Details

    • isAllow

      public boolean isAllow()
      Returns true if this ACE is an allow ACE and false if it is a deny ACE.
      Returns:
      true if this is an allow ACE, false if it is a deny ACE

    • isInherited

      public boolean isInherited()
      Returns true if this ACE is an inherited ACE and false if it is a direct ACE.

      Note: For reasons not fully understood, FLAGS_INHERITED may not be set within all security descriptors even though the ACE was in face inherited. If an inherited ACE is added to a parent the Windows ACL editor will rebuild all children ACEs and set this flag accordingly.

      Returns:
      true if this ACE is inherited, false if it is direct

    • getFlags

      public int getFlags()
      Returns the flags for this ACE. The isInherited() method checks the FLAGS_INHERITED bit in these flags.
      Returns:
      the ACE flags

    • getApplyToText

      public String getApplyToText()
      Returns the 'Apply To' text for inheritance of ACEs on directories such as 'This folder, subfolder and files'. For files the text is always 'This object only'.
      Returns:
      the text describing what this ACE applies to

    • getAccessMask

      public int getAccessMask()
      Returns the access mask accociated with this ACE. Use the constants for FILE_READ_DATA, FILE_WRITE_DATA, READ_CONTROL, GENERIC_ALL, etc with bitwise operators to determine which bits of the mask are on or off.
      Returns:
      the access mask for this ACE

    • getSID

      public SID getSID()
      Return the SID associated with this ACE.
      Returns:
      the SID for this ACE

    • toString

      public String toString()
      Return a string represeting this ACE.

      Note: This function should probably be changed to return SDDL fragments but currently it does not.

      Overrides:
      toString in class Object