SecDesc

Windows security descriptor.

A descriptor can also be written as a SecDescSpec wherever one is accepted.

Component getters and their control flags raise FieldError when the component was not requested. Loaded but absent components return nil.

Constructor

SecDesc packet ^{overload 1 of 2}

Parses a security descriptor in self-relative binary form.

Parameters

Name	Type	Description
packet	Bin	Self-relative binary form.

Errors

DataError if packet is malformed or not self-relative.

SecDesc ...options ^{overload 2 of 2}

Constructs a security descriptor from built components and control flags.

A control flag given as true requires its component to be present or given.

Parameters

Name	Type	Description
...options	SecDescOptions[Sid, Acl]	Components and control flags.

Fields

control @ SecDescControl ^[get]

The control flags, excluding the self-relative storage flag.

dacl @ (Acl | nil) ^[get]

The discretionary ACL, or nil when absent or present-null.

Raises FieldError when the DACL was not loaded.

dacl_auto_inherit_required @ Bool ^[get]

Whether DACL inheritance computation was requested.

dacl_auto_inherited @ Bool ^[get]

Whether the DACL was produced through inheritance.

dacl_defaulted @ Bool ^[get]

Whether the DACL was supplied by a default mechanism.

dacl_present @ Bool ^[get]

Whether the DACL is present. A present ACL can be null.

dacl_protected @ Bool ^[get]

Whether the DACL is protected from inheritance.

group @ (Sid | nil) ^[get]

The primary group.

Raises FieldError when the group was not loaded.

group_defaulted @ Bool ^[get]

Whether the group was supplied by a default mechanism.

mask @ SecInfo ^[get]

The components that are present.

A descriptor parsed from binary form has all four components marked, because the binary form carries no separate mask. One read from an object may have fewer, depending on what was queried.

owner @ (Sid | nil) ^[get]

The owner.

Raises FieldError when the owner was not loaded.

owner_defaulted @ Bool ^[get]

Whether the owner was supplied by a default mechanism.

revision @ Int ^[get]

Security descriptor revision.

rm_control @ (Int | nil) ^[get]

Resource-manager-defined control byte.

Returns nil when rm_control_valid is false.

rm_control_valid @ Bool ^[get]

Whether the resource-manager control byte is valid.

sacl @ (Acl | nil) ^[get]

The system ACL, or nil when absent or present-null.

Raises FieldError when the SACL was not loaded.

sacl_auto_inherit_required @ Bool ^[get]

Whether SACL inheritance computation was requested.

sacl_auto_inherited @ Bool ^[get]

Whether the SACL was produced through inheritance.

sacl_defaulted @ Bool ^[get]

Whether the SACL was supplied by a default mechanism.

sacl_present @ Bool ^[get]

Whether the SACL is present. A present ACL can be null.

sacl_protected @ Bool ^[get]

Whether the SACL is protected from inheritance.

Methods

to_bin() -> Bin

Returns the descriptor in canonical self-relative binary form.

with ...options -> SecDesc

Returns a descriptor with the given components or control flags replaced.

Components are strict, as for the constructor. An ACL presence flag given as false clears that ACL.

Parameters

Name	Type	Description
...options	SecDescOptions[Sid, Acl]	Components and control flags to replace.