Question

As part of a testing utility I am creating some registry keys and applying a specific security descriptor to them. Later on I want to reset it to the “default” security descriptor (i.e. inherited from the parent). What is the proper way to do this?

I can’t save and restore the original security descriptor because this utility may be run multiple times before the tester will want to reset it. I guess I could save it to a temp file or registry value, but I would prefer a more elegant solution.

So, do I have to do something with the parent’s security descriptor or what? I’m having a hard time figuring out what to do.

Almost forgot to mention I’m doing this in C.

UPDATE: I should have added that I’ll also be doing this with files (and possibly other securable objects), so it would be nice if there were a generic way to work with security descriptors themselves instead of using object-specific things like RegSaveKey. I imagine it would require working with the security descriptor of the parent, so it would be great if I could do something like the following:

BOOL WINAPI GetDefaultChildSecurityDescriptorFromParent(LPSECURITY_DESCRIPTOR Parent, LPSECURITY_DESCRIPTOR* Child);

I’m just not sure how to do it programmatically. You can accomplish this in the security descriptor editor by using the check box to inherit entries from the parent, so obviously it is possible somehow.

Answer 1

I hate to answer my own question, but I found a snippet of documentation on the matter (the DACL is really the only thing I am concerned with). Looks like I have to get the DACL of the parent and create a new DACL that includes all the inheritable ACEs in it. I was hoping it would be simpler than that, but it’s not too bad.