@@ -5587,9 +5587,18 @@ struct _Py_SECURITY_ATTRIBUTE_DATA {
5587
5587
PACL acl ;
5588
5588
SECURITY_DESCRIPTOR sd ;
5589
5589
EXPLICIT_ACCESS_W ea [4 ];
5590
- char sid [64 ];
5590
+ BYTE sidAdmins [SECURITY_MAX_SID_SIZE ];
5591
+ BYTE sidSystem [SECURITY_MAX_SID_SIZE ];
5592
+ BYTE sidCreator [SECURITY_MAX_SID_SIZE ];
5591
5593
};
5592
5594
5595
+ static int
5596
+ _initializeSid (BYTE * sid , WELL_KNOWN_SID_TYPE sidType )
5597
+ {
5598
+ DWORD cbSid = SECURITY_MAX_SID_SIZE ;
5599
+ return CreateWellKnownSid (sidType , NULL , sid , & cbSid ) ? 1 : 0 ;
5600
+ }
5601
+
5593
5602
static int
5594
5603
initializeDefaultSecurityAttributes (
5595
5604
PSECURITY_ATTRIBUTES * securityAttributes ,
@@ -5612,44 +5621,37 @@ initializeMkdir700SecurityAttributes(
5612
5621
* securityAttributes = NULL ;
5613
5622
memset (data , 0 , sizeof (* data ));
5614
5623
5624
+ SID_IDENTIFIER_AUTHORITY SidNtAuthority = SECURITY_NT_AUTHORITY ;
5615
5625
if (!InitializeSecurityDescriptor (& data -> sd , SECURITY_DESCRIPTOR_REVISION )
5616
- || !SetSecurityDescriptorGroup (& data -> sd , NULL , TRUE)) {
5626
+ || !SetSecurityDescriptorGroup (& data -> sd , NULL , TRUE)
5627
+ || !_initializeSid (data -> sidAdmins , WinBuiltinAdministratorsSid )
5628
+ || !_initializeSid (data -> sidSystem , WinLocalSystemSid )
5629
+ || !_initializeSid (data -> sidCreator , WinCreatorOwnerRightsSid )
5630
+ ) {
5617
5631
return GetLastError ();
5618
5632
}
5619
5633
5620
- int use_alias = 0 ;
5621
- DWORD cbSid = sizeof (data -> sid );
5622
- if (!CreateWellKnownSid (WinCreatorOwnerRightsSid , NULL , (PSID )data -> sid , & cbSid )) {
5623
- use_alias = 1 ;
5624
- }
5625
-
5626
5634
data -> securityAttributes .nLength = sizeof (SECURITY_ATTRIBUTES );
5627
5635
data -> ea [0 ].grfAccessPermissions = GENERIC_ALL ;
5628
5636
data -> ea [0 ].grfAccessMode = SET_ACCESS ;
5629
5637
data -> ea [0 ].grfInheritance = SUB_CONTAINERS_AND_OBJECTS_INHERIT ;
5630
- if (use_alias ) {
5631
- data -> ea [0 ].Trustee .TrusteeForm = TRUSTEE_IS_NAME ;
5632
- data -> ea [0 ].Trustee .TrusteeType = TRUSTEE_IS_ALIAS ;
5633
- data -> ea [0 ].Trustee .ptstrName = L"CURRENT_USER" ;
5634
- } else {
5635
- data -> ea [0 ].Trustee .TrusteeForm = TRUSTEE_IS_SID ;
5636
- data -> ea [0 ].Trustee .TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP ;
5637
- data -> ea [0 ].Trustee .ptstrName = (LPWCH )(SID * )data -> sid ;
5638
- }
5638
+ data -> ea [0 ].Trustee .TrusteeForm = TRUSTEE_IS_SID ;
5639
+ data -> ea [0 ].Trustee .TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP ;
5640
+ data -> ea [0 ].Trustee .ptstrName = (LPWCH )data -> sidSystem ;
5639
5641
5640
5642
data -> ea [1 ].grfAccessPermissions = GENERIC_ALL ;
5641
5643
data -> ea [1 ].grfAccessMode = SET_ACCESS ;
5642
5644
data -> ea [1 ].grfInheritance = SUB_CONTAINERS_AND_OBJECTS_INHERIT ;
5643
- data -> ea [1 ].Trustee .TrusteeForm = TRUSTEE_IS_NAME ;
5644
- data -> ea [1 ].Trustee .TrusteeType = TRUSTEE_IS_ALIAS ;
5645
- data -> ea [1 ].Trustee .ptstrName = L"SYSTEM" ;
5645
+ data -> ea [1 ].Trustee .TrusteeForm = TRUSTEE_IS_SID ;
5646
+ data -> ea [1 ].Trustee .TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP ;
5647
+ data -> ea [1 ].Trustee .ptstrName = ( LPWCH ) data -> sidAdmins ;
5646
5648
5647
5649
data -> ea [2 ].grfAccessPermissions = GENERIC_ALL ;
5648
5650
data -> ea [2 ].grfAccessMode = SET_ACCESS ;
5649
5651
data -> ea [2 ].grfInheritance = SUB_CONTAINERS_AND_OBJECTS_INHERIT ;
5650
- data -> ea [2 ].Trustee .TrusteeForm = TRUSTEE_IS_NAME ;
5652
+ data -> ea [2 ].Trustee .TrusteeForm = TRUSTEE_IS_SID ;
5651
5653
data -> ea [2 ].Trustee .TrusteeType = TRUSTEE_IS_ALIAS ;
5652
- data -> ea [2 ].Trustee .ptstrName = L"ADMINISTRATORS" ;
5654
+ data -> ea [2 ].Trustee .ptstrName = ( LPWCH ) data -> sidCreator ;
5653
5655
5654
5656
int r = SetEntriesInAclW (3 , data -> ea , NULL , & data -> acl );
5655
5657
if (r ) {
0 commit comments