Question

I have a somewhat obscure question here.

What I need: To determine if the permissions (or, strictly speaking, a specific ACE of a DACL) of a file/folder was inherited.

How I tried to solve this: using winapi bindings for python (win32security module, to be precise). Here is the stripped down version, that does just that, – it simply takes a path to a file as an argument and prints out ACEs one by one, indicating which flags are set.

#!/usr/bin/env python
from win32security import *
import sys

def decode_flags(flags):
    _flags = {
        SE_DACL_PROTECTED:"SE_DACL_PROTECTED",
        SE_DACL_AUTO_INHERITED:"SE_DACL_AUTO_INHERITED",
        OBJECT_INHERIT_ACE:"OBJECT_INHERIT_ACE",
        CONTAINER_INHERIT_ACE:"CONTAINER_INHERIT_ACE",
        INHERIT_ONLY_ACE:"INHERIT_ONLY_ACE",
        NO_INHERITANCE:"NO_INHERITANCE",
        NO_PROPAGATE_INHERIT_ACE:"NO_PROPAGATE_INHERIT_ACE",
        INHERITED_ACE:"INHERITED_ACE"
    }
    for key in _flags.keys():
        if (flags & key):
            print '\t','\t',_flags[key],"is set!"


def main(argv):
    target = argv[0]
    print target

    security_descriptor = GetFileSecurity(target,DACL_SECURITY_INFORMATION)

    dacl = security_descriptor.GetSecurityDescriptorDacl()

    for ace_index in range(dacl.GetAceCount()):
        (ace_type,ace_flags),access_mask,sid = dacl.GetAce(ace_index)
        name,domain,account_type = LookupAccountSid(None,sid)
        print '\t',domain+'\\'+name,hex(ace_flags)
        decode_flags(ace_flags)


if __name__ == '__main__':
    main(sys.argv[1:])

Simple enough – get a security descriptor, get a DACL from it then iterate through the ACEs in the DACL. The really important bit here is INHERITED_ACE access flag. It should be set when the ACE is inherited and not set explicitly.

When you create a folder/file, its ACL gets populated with ACEs according to the ACEs of the parent object (folder), that are set to propagate to children. However, unless you do any change to the access list, the INHERITED_ACE flag will NOT be set! But the inherited permissions are there and they DO work.

If you do any slight change (say, add an entry to the access list, apply changes and delete it), the flag magically appears (the behaviour does not change in any way, though, it worked before and it works afterwards)! What I want is to find the source of this behaviour of the INHERITED_ACE flag and, maybe find another reliable way to determine if the ACE was inherited or not.

How to reproduce:

1. Create an object (file or folder)
2. Check permissions in windows explorer, see that they have been propagated from the parent object (using, say, security tab of file properties dialog of windows explorer).
3. Check the flags using, for example, the script I was using (INHERITED_ACE will NOT be set on any ACEs).
4. Change permissions of an object (apply changes), change them back even.
5. Check the flags (INHERITED_ACE will be there)
6. ..shake your head in disbelief (I know I did)

Sorry for a somewhat lengthy post, hope this makes at least a little sense.

Answer 1

On my Win XP Home Edition this code doesn’t seem to work at all 🙂

I get this stack trace:

Traceback (most recent call last):
File “C:\1.py”, line 37, in
main(sys.argv[1:])
File “C:\1.py”, line 29, in main
for ace_index in range(dacl.GetAceCount()):

AttributeError: ‘NoneType’ object has no attribute ‘GetAceCount’

Can you just try to “nudge” the DACL to be filled?
I mean, if you know it’s going to work after you make a slight change in it… do a slight change programmatically, add a stub ACE and remove it. Can you?

UPDATE. I made an experiment with a C# program on my work machine (with Win XP Prof) and I must tell you that the .net way of getting this security information actually works. So, when I create a new file, my C# program detects that the ACEs were inherited, while your python code doesn’t.

Here is the sample output of my runs:

C:>csharp_tricks.exe 2.txt

FullControl –> IsInherited: True

FullControl –> IsInherited: True

ReadAndExecute, Synchronize –> IsInherited: True

---

C:>1.py 2.txt

2.txt

BUILTIN\Administrators 0x0

NT AUTHORITY\SYSTEM 0x0

BUILTIN\Users 0x0

My C# class:

public class InheritedAce
{
    public static string GetDACLReport(string path)
    {
        StringBuilder result = new StringBuilder();
        FileSecurity fs = new FileSecurity(path, AccessControlSections.Access);
        foreach (var rule in fs.GetAccessRules(true, true, typeof(SecurityIdentifier)).OfType<FileSystemAccessRule>())
        {
            result.AppendFormat("{0}  -->  IsInherited:  {1}", rule.FileSystemRights, rule.IsInherited);
            result.AppendLine();
        }

        return result.ToString();
    }
}

So, it seems to be a bug in the python pywin32 security library. Maybe they aren’t doing all the necessary system calls…