2

I'm trying to get a function working in Lazarus that should add a File-ACL to the yet existing ACL of that object. Obviously I'm doing somethinh wrong: The program crashes with a SIGSEGV when it reaches BuildExplicitAccessWithName. Regarding the debugger, this function calls BuildTrusteeWithObjectsAndName iternally which then leads to the SIGSEGV. What am I doing wrong here? Here's my code:

program acltest;

uses JwaWindows;

function AddFileACL(Filename, TrusteeName: AnsiString; AccessMode: ACCESS_MODE; Inheritance: dWord): Boolean; stdcall;
var
  pExplicitAccess : PEXPLICIT_ACCESS;
  ExistingDacl : PACL;
  pExistingDacl : PPACL;
  NewAcl : PACL;
  psd : PSECURITY_DESCRIPTOR;
begin
  NewAcl := nil;
  psd := nil;
  pExistingDacl := nil;
  Result := false;
  try
    if ERROR_SUCCESS = GetNamedSecurityInfo(pAnsiChar(Filename), SE_FILE_OBJECT, DACL_SECURITY_INFORMATION, nil, nil, pExistingDacl, nil, psd) then
    begin
      try
        BuildExplicitAccessWithName(pExplicitAccess, PAnsiChar(TrusteeName), GENERIC_ALL, AccessMode, Inheritance);
        ExistingDacl := pExistingDacl^;
        if ERROR_SUCCESS = SetEntriesInAcl(1, pExplicitAccess, ExistingDacl, NewAcl) then
        begin
          if ERROR_SUCCESS = SetNamedSecurityInfo(pAnsiChar(Filename), SE_FILE_OBJECT, DACL_SECURITY_INFORMATION, nil, nil, NewAcl, nil) then
          begin
            Result := true;
          end;
        end;
      finally
      end;
    end;
  finally
  end;
end;

begin
  if AddFileACL('C:\Users\keckc\Desktop\test.txt', 'Everyone', GRANT_ACCESS, SUB_CONTAINERS_AND_OBJECTS_INHERIT) = true then
  begin
    writeln('Yep, it works!');
  end
  else begin
    writeln('Nope, try again!');
  end;
end.
2
  • Your use of try...finally looks quite pointless. Also, the last if...then could be converted to plain assignment statement. Jul 30, 2014 at 10:25
  • Thanks for your reply. Yes, they are a bit pointless ATM. I will improve the error handling as soon as I have resolved the other problems ;-)
    – Chris
    Jul 30, 2014 at 12:33

2 Answers 2

3

You pass pExplicitAccess which is an uninitialized pointer variable of type PEXPLICIT_ACCESS. You are expected instead to allocate an EXPLICIT_ACCESS structure, and pass its address.

var
  ExplicitAccess: EXPLICIT_ACCESS;
....
BuildExplicitAccessWithName(@ExplicitAccess, ...);

In the call to GetNamedSecurityInfo, passing psd is somewhat pointless. Since it has the value nil, you may as well delete pass nil. At which point you'll be able to remove the psd variable.

As for pExistingDacl, again you initialise it to nil. And so pExistingDacl^ is going to be another SIGSEV. Instead you should remove the pExistingDacl variable, and pass @ExistingDacl.

It would seem that you have similar problems with the calls to SetEntriesInAcl and SetNamedSecurityInfo, but hopefully by now, you can understand the pattern and will be able to resolve the problems.

Finally, I do also wonder why you are using the ANSI version of the function rather than the Unicode version.

5
  • Thanks for your reply. I have fixed the parameters as you advised. psd is needed here, even if it is not used since it's a mandatory parameter in the function. However, it still refuses to work. I've updates my source to reflect the changes. When I run it, it complains about a "wrong parameter" in SetEntriesInAcl.
    – Chris
    Jul 30, 2014 at 12:37
  • You asked about the SIGSEV. Did I not answer that? Or do you want me to answer the new question too? Or, to put it another way, perhaps you would be better asking a new question about the new problem. ;-) Not least because I personally am not an expert in the ins and outs of the security APIs and so whilst I could answer the SIGSEV question, I'm surely the wrong person to answer the new question. Jul 30, 2014 at 13:02
  • Well, yes, I asked why I got a SIGSEGV and yes, you answered that question. Thank you very much. But still I can't get that damned thing running, so it would be great if you could help me with that problem, too.
    – Chris
    Jul 30, 2014 at 13:09
  • Ok, I didn't notice that you edited you last comment while I was typing ;-) I think I'll edit my question then in that way that it reflects the "new problem", too. Anyway thanks for your efforts!
    – Chris
    Jul 30, 2014 at 13:18
  • Honestly, that's not my area of expertise. If I were you I'd ask a new question. I really don't think you should ask the new question here. Make a new question for it. Please. Jul 30, 2014 at 13:21
0

In XE8 and most likely other flavors of Delphi GetNamedSecurityInfo is declared wrong.

Two ways to solve that:

1) Redeclare as:

   function FixedGetNamedSecurityInfo(pObjectName: LPWSTR; ObjectType: SE_OBJECT_TYPE;
         SecurityInfo: SECURITY_INFORMATION; ppsidOwner, ppsidGroup: PPSID; ppDacl, ppSacl: PPACL;
         var ppSecurityDescriptor: PSECURITY_DESCRIPTOR): DWORD; stdcall;
         external 'ADVAPI32.DLL' name 'GetNamedSecurityInfoW'; 

The other is to typecast the pointer used:

GetNamedSecurityInfo(FileObject.ToPchar, SE_OBJECT_TYPE.SE_FILE_OBJECT, DACL_SECURITY_INFORMATION, nil, nil, PACL(@pExistingDacl), nil, pSD);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.