How to set security settings on a Reg Key

Thread View: borland.public.cppbuilder.nativeapi

6 messages

[T] Back to Threads [V] Tree View [G] Group Articles

6 total messages Started by Claire W Sun, 13 Apr 2003 16:27

#16995

Author: Claire W
Date: Sun, 13 Apr 2003 16:27

16 lines
1553 bytes

Hi all,
   I'm trying to use SetSecurityInfo(), and I'm including aclapi.h, but I'm
getting the error message,

Ambiguity between 'PACCESS_MASK' and Windows::PACCESS_MASK'.

How should I resolve this ambiguity, and which should I use?

(I'm trying to give a registry key a NULL DACL, so all users can access it.
BCB5 Pro With Patch. Win XP Home.)

BTW, is what I'm trying to do OK? I want to create a key under
HKEY_LOCAL_MACHINE that all users have write access to (it is a  subkey off
of 'Software'). I'm a bit of a newbie to all this NT based multi-user stuff.

Thanks Claire.

Re: How to set security settings on a Reg Key

#16997

Author: Remy Lebeau (TeamB)
Date: Sun, 13 Apr 2003 20:22

13 lines
1370 bytes

"Claire W" <cmw.walker@BeeeeTinternet.com> wrote in message
news:3e9990a7@newsgroups.borland.com...

> BTW, is what I'm trying to do OK? I want to create a key
> under HKEY_LOCAL_MACHINE that all users have write
> access to (it is a  subkey off of 'Software').

The Registry has its own security functions.  Have a look at using
RegSetKeySecurity() instead of SetSecurityInfo().


Gambit

Re: How to set security settings on a Reg Key

#16998

Author: Claire W
Date: Sun, 13 Apr 2003 22:40

25 lines
1891 bytes

"Remy Lebeau (TeamB)" <gambit47@yahoo.com>

> The Registry has its own security functions.  Have a look at using
> RegSetKeySecurity() instead of SetSecurityInfo().

I'm sure these would be the better choice, but I'm not clear on the concepts
used with regards to groups, owner, admins etc. So I don't know what I would
need to do to allow all users to have write access to the key.

What I do know is having a NULL DACL removes all security to the key and
that's OK for me (it's my own key not an existing one).

I changed in 'aclapi.h'

OUT PACCESS_MASK  pAccessRights
to
OUT ::PACCESS_MASK  pAccessRights

to resolve the ambiguity, (and it worked fine).

Checking on google, the ambibuity can also be cleared by putting the include
for aclapi.h before vcl.h.

Thanks, Claire.

Re: How to set security settings on a Reg Key

#17000

Author: Remy Lebeau (TeamB)
Date: Sun, 13 Apr 2003 23:32

28 lines
2066 bytes

"Claire W" <cmw.walker@BeeeeTinternet.com> wrote in message
news:3e99e7c3@newsgroups.borland.com...

> I'm sure these would be the better choice, but I'm not clear
> on the concepts used with regards to groups, owner, admins
> etc. So I don't know what I would need to do to allow all
> users to have write access to the key.

Sounds like you need to read up on NT security in general before you start
messing with it.

As for specifying a NULL DACL, use RegGetKeySecurity() to retreive the
current SECURITY_DESCRIPTOR for the desired key, then call
SetSecurityDescriptorDacl() to set the DACL to NULL, and then call
RegSetKeySecurity() to assign the SECURITY_DESCRIPTOR back to the key.

> I changed in 'aclapi.h'
<snip>

Do not alter header files, especially Microsoft's.

As previously stated, you need to use RegSetKeySecurity() instead of
SetSecurityInfo() anyway.  In which case, aclapi.h is no longer needed for
this situation to begin with.


Gambit

Re: How to set security settings on a Reg Key

#17007

Author: Claire W
Date: Mon, 14 Apr 2003 02:58

35 lines
2596 bytes

"Remy Lebeau (TeamB)" <gambit47@yahoo.com> wrote
> Sounds like you need to read up on NT security in general before you start
> messing with it.

I have a basic understanding of allowing certain users (or groups of users)
access to securable objects according to their SID's and the objects DACL,
but some of the lower level details are confusing. The only other option was
to enumerate the ACE's and give them all write access, and ensure all
possible users were covered by at least one ACE. This second part I would
not know where to begin. The help files give setting the DACL to NULL as a
legitimate option.

> As for specifying a NULL DACL, use RegGetKeySecurity() to retreive the
> current SECURITY_DESCRIPTOR for the desired key, then call
> SetSecurityDescriptorDacl() to set the DACL to NULL, and then call
> RegSetKeySecurity() to assign the SECURITY_DESCRIPTOR back to the key.

Is there a specific benefit to doing it this way as opposed to using
SetSecurityInfo()? Isn't the end result the same?

> > I changed in 'aclapi.h'
> <snip>
>
> Do not alter header files, especially Microsoft's.

I only altered it temporarily. I just needed to be able to carry on until
I could eliminate the error.

> As previously stated, you need to use RegSetKeySecurity() instead of
> SetSecurityInfo() anyway.  In which case, aclapi.h is no longer needed for
> this situation to begin with.

I shall make the changes as recommended.

Claire.

Re: How to set security settings on a Reg Key

#17009

Author: Remy Lebeau (TeamB)
Date: Mon, 14 Apr 2003 05:37

15 lines
1648 bytes

"Claire W" <cmw.walker@BeeeeTinternet.com> wrote in message
news:3e9a2415$1@newsgroups.borland.com...

> Is there a specific benefit to doing it this way as opposed
> to using SetSecurityInfo()?

As already mentioned - the Registry has its own securty system.  In general
terms, it is always best to use what is actually exposed for a specific
purpose whenever possible.  In this case, that would be
RegGet/SetKeySecurity(), which do exactly what you're asking for -
getting/setting security info for Registry keys.


Gambit

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads