BorlandTalk.com

M · Guest

Hi All,

I'm trying to set a new DACL (using D5 on either 2k, XP or 2k3) on both
the Winstation and Desktop objects during Winlogon using the following
code

<code>

procedure set_winstation_dacl(hToken : cardinal);
var s : string;
d : string;
dt : hdesk;
mydacl : pacl;
sd : psecurity_descriptor
lo_sid : string;
begin
.
.
.
.
d := 'D Sad

A;NP;LCWP;;;'+s+') blah blah blah';

dt := openwindowstation('WinSta0',false,GENERIC_ALL);

fillchar(mydacl,sizeof(pacl),0);
fillchar(sd.a,sizeof(psecurity_descriptor),0);

convertstringsecuritydescriptortosecuritydescriptor(pchar(d),SDDL_REVISION_1,sd,nil);

if
setsecurityinfo(dt,SE_WINDOW_OBJECT,DACL_SECURITY_INFORMATION,nil,nil,sd.dacl,nil)<>ERROR_SUCCESS

then
showmessage('Winstation - ' + syserrormessage(getlasterror))
else
showmessage('Winstation ok');

.
.
.
.
end;

</code>

but essentially always come up with the error - Invalid Access To
Memory Location. I've previously read stuff about DWORD alignment
using the SetSecurityInfo API and have {$A+} set as a directive in the
code, however, makes no difference :-(

In the above hToken is obtained using the code

logonuser('a','b','c',LOGON32_LOGON_INTERACTIVE,LOGON32_PROVIDER_DEFAULT,th)

and passing th (declared as cardinal) to the above procedure. Also the
convertstringsecuritydescriptortosecuritydescriptor API does generate
a correct DACL as I've used it and applied the same DACL to a newly
created directory...

Can anyone assist with this please ?

TIA

Mark

M · Guest

The api call convertstringsecuritydescriptortosecuritydescriptor
generates a relative security descriptor, however, SetSecurityInfo
requires an absolute one, therefore, simply call makeabsolutesd on the
returned security descriptor before passing it to the SetSecurityInfo
api !