using System;
using System.Runtime.InteropServices;
using Vanara.InteropServices;
using static Vanara.PInvoke.AdvApi32;
using static Vanara.PInvoke.Authz;
namespace Vanara.PInvoke
{
/// Platform invokable enumerated types, constants and functions from aclui.h
public static partial class AclUI
{
/// Messages sent from property sheet.
public enum PropertySheetCallbackMessage : uint
{
/// Add reference.
PSPCB_ADDREF = 0,
/// Release reference.
PSPCB_RELEASE = 1,
/// Create page.
PSPCB_CREATE = 2,
/// Initialize dialog.
PSPCB_SI_INITDIALOG = 0x00401 // wm_user + 1
}
/// Specifies the security descriptor to use.
public enum SECURITY_OBJECT_ID
{
///
/// The security descriptor of the resource.
/// If Id is set to this value, then pData points to a security descriptor and cbData is the number of bytes in pData.
/// pData2 is NULL and cbData2 is 0.
///
SECURITY_OBJECT_ID_OBJECT_SD = 1,
///
/// The security descriptor of a network share.
///
/// If Id is set to this value, then pData points to the ISecurityInformation interface of an object that represents the security
/// context of the share.
///
///
/// If the security descriptor is not yet available, then pData2 must be a handle to a waitable object that is signaled when the
/// security descriptor is ready when the GetSecondarySecurity method returns S_FALSE. The waitable object should be created by
/// the CreateEvent function. In this case, cbData2 is 0.
///
/// This identifier is only applicable to file system objects.
///
SECURITY_OBJECT_ID_SHARE = 2,
///
/// The security descriptor of a central access policy.
///
/// If Id is set to this value, then pData points to the security descriptor with an empty DACL, an owner, group, and attribute
/// access control entries (ACEs) that match the resource's owner, group, and attributes as well as a
/// SCOPE_SECURITY_INFORMATION_ACE that contains the central policy's ID. cbData is set to the number of bytes in pData.
///
/// pData2 is NULL and cbData2 is 0.
///
/// The security descriptor is constructed to allow computing effective permissions to correctly determine when access is limited
/// by the central policy and higher detail of the central access rule cannot be determined. This is used when a central access
/// policy that applies to a resource cannot be resolved into its elemental central access rules.
///
///
SECURITY_OBJECT_ID_CENTRAL_POLICY = 3,
///
/// The security descriptor of a central access rule.
///
/// If Id is set to this value, then pData points to the security descriptor with an owner, group, and attribute ACEs that match
/// the resource's owner, group, and attributes, and a discretionary access control list (DACL) that matches the central access
/// rule's DACL. cbData is set to the number of bytes in pData.
///
///
/// In addition, pData2 points to a security descriptor with a DACL that contains a conditional ACE that grants 0x1 to Everyone
/// if the resource condition from the central access rule evaluates to TRUE. cbData2 is set to the number of bytes in pData2.
///
///
/// The security descriptor is constructed to allow computing effective permissions to determine when access is limited by the
/// central access policy at the highest detail. That is, access is limited by pointing to a central policy rule.
///
///
SECURITY_OBJECT_ID_CENTRAL_ACCESS_RULE = 4
}
/// A set of bit flags that determine the editing options available to the user.
[Flags]
public enum SI_OBJECT_INFO_Flags : uint
{
///
/// The Advanced button is displayed on the basic security property page. If the user clicks this button, the system displays an
/// advanced security property sheet that enables advanced editing of the discretionary access control list (DACL) of the object.
///
SI_ADVANCED = 0x00000010,
///
/// If this flag is set, a shield is displayed on the Edit button of the advanced Auditing pages. For NTFS objects, this flag is
/// requested when the user does not have READ_CONTROL or ACCESS_SYSTEM_SECURITY access. Windows Server 2003 and Windows XP: This
/// flag is not supported.
///
SI_AUDITS_ELEVATION_REQUIRED = 0x02000000,
///
/// Indicates that the object is a container. If this flag is set, the access control editor enables the controls relevant to the
/// inheritance of permissions onto child objects.
///
SI_CONTAINER = 0x00000004,
/// Combines the EditPerms, EditOwner, and EditAudit flags.
SI_EDIT_ALL = (SI_EDIT_PERMS | SI_EDIT_OWNER | SI_EDIT_AUDITS),
///
/// If this flag is set and the user clicks the Advanced button, the system displays an advanced security property sheet that
/// includes an Auditing property page for editing the object's SACL.
///
SI_EDIT_AUDITS = 0x00000002,
/// If this flag is set, the Effective Permissions page is displayed.
SI_EDIT_EFFECTIVE = 0x00020000,
///
/// If this flag is set and the user clicks the Advanced button, the system displays an advanced security property sheet that
/// includes an Owner property page for changing the object's owner.
///
SI_EDIT_OWNER = 0x00000001,
///
/// This is the default value. The basic security property page always displays the controls for basic editing of the object's
/// DACL. To disable these controls, set the ReadOnly flag.
///
SI_EDIT_PERMS = 0x00000000,
///
/// If this flag is set, the system enables controls for editing ACEs that apply to the object's property sets and properties.
/// These controls are available only on the property sheet displayed when the user clicks the Advanced button.
///
SI_EDIT_PROPERTIES = 0x00000080,
///
/// Indicates that the access control editor cannot read the DACL but might be able to write to the DACL. If a call to the
/// ISecurityInformation::GetSecurity method returns AccessDenied, the user can try to add a new ACE, and a more appropriate
/// warning is displayed.
///
SI_MAY_WRITE = 0x10000000,
///
/// If this flag is set, the access control editor hides the check box that allows inheritable ACEs to propagate from the parent
/// object to this object. If this flag is not set, the check box is visible. The check box is clear if the SE_DACL_PROTECTED
/// flag is set in the object's security descriptor. In this case, the object's DACL is protected from being modified by
/// inheritable ACEs. If the user clears the check box, any inherited ACEs in the security descriptor are deleted or converted to
/// noninherited ACEs. Before proceeding with this conversion, the system displays a warning message box to confirm the change.
///
SI_NO_ACL_PROTECT = 0x00000200,
///
/// If this flag is set, the access control editor hides the Special Permissions tab on the Advanced Security Settings page.
///
SI_NO_ADDITIONAL_PERMISSION = 0x00200000,
///
/// If this flag is set, the access control editor hides the check box that controls the NO_PROPAGATE_INHERIT_ACE flag. This flag
/// is relevant only when the Advanced flag is also set.
///
SI_NO_TREE_APPLY = 0x00000400,
///
/// When set, indicates that the ObjectGuid property is valid. This is set in comparisons with object-specific ACEs in
/// determining whether the ACE applies to the current object.
///
SI_OBJECT_GUID = 0x00010000,
///
/// If this flag is set, a shield is displayed on the Edit button of the advanced Owner page. For NTFS objects, this flag is
/// requested when the user does not have WRITE_OWNER access. This flag is valid only if the owner page is requested. Windows
/// Server 2003 and Windows XP: This flag is not supported.
///
SI_OWNER_ELEVATION_REQUIRED = 0x04000000,
///
/// If this flag is set, the user cannot change the owner of the object. Set this flag if EditOwner is set but the user does not
/// have permission to change the owner.
///
SI_OWNER_READONLY = 0x00000040,
///
/// Combine this flag with Container to display a check box on the owner page that indicates whether the user intends the new
/// owner to be applied to all child objects as well as the current object. The access control editor does not perform the recursion.
///
SI_OWNER_RECURSE = 0x00000100,
///
/// If this flag is set, the Title property value is used as the title of the basic security property page. Otherwise, a default
/// title is used.
///
SI_PAGE_TITLE = 0x00000800,
///
/// If this flag is set, an image of a shield is displayed on the Edit button of the simple and advanced Permissions pages. For
/// NTFS objects, this flag is requested when the user does not have READ_CONTROL or WRITE_DAC access. Windows Server 2003 and
/// Windows XP: This flag is not supported.
///
SI_PERMS_ELEVATION_REQUIRED = 0x01000000,
///
/// If this flag is set, the editor displays the object's security information, but the controls for editing the information are
/// disabled. This flag cannot be combined with the ViewOnly flag.
///
SI_READONLY = 0x00000008,
///
/// If this flag is set, the Default button is displayed. If the user clicks this button, the access control editor calls the
/// IAccessControlEditorDialogProvider.DefaultSecurity to retrieve an application-defined default security descriptor. The access
/// control editor uses this security descriptor to reinitialize the property sheet, and the user is allowed to apply the change
/// or cancel.
///
SI_RESET = 0x00000020,
/// When set, this flag displays the Reset Defaults button on the Permissions page.
SI_RESET_DACL = 0x00040000,
///
/// When set, this flag displays the Reset permissions on all child objects and enable propagation of inheritable permissions
/// check box in the Permissions page of the Access Control Settings window. This function does not reset the permissions and
/// enable propagation of inheritable permissions.
///
SI_RESET_DACL_TREE = 0x00004000,
/// When set, this flag displays the Reset Defaults button on the Owner page.
SI_RESET_OWNER = 0x00100000,
/// When set, this flag displays the Reset Defaults button on the Auditing page.
SI_RESET_SACL = 0x00080000,
///
/// When set, this flag displays the Reset auditing entries on all child objects and enables propagation of the inheritable
/// auditing entries check box in the Auditing page of the Access Control Settings window. This function does not reset the
/// permissions and enable propagation of inheritable permissions.
///
SI_RESET_SACL_TREE = 0x00008000,
///
/// Set this flag if the computer defined by the ServerName property is known to be a domain controller. If this flag is set, the
/// domain name is included in the scope list of the Add Users and Groups dialog box. Otherwise, the pszServerName computer is
/// used to determine the scope list of the dialog box.
///
SI_SERVER_IS_DC = 0x00001000,
// ISecurityInformation3
/// View Only.
SI_VIEW_ONLY = 0x00400000,
// ISecurityInformation4
//SI_DISABLE_DENY_ACE = 0x80000000,
//SI_ENABLE_CENTRAL_POLICY = 0x40000000,
//SI_ENABLE_EDIT_ATTRIBUTE_CONDITION = 0x20000000,
//SI_SCOPE_ELEVATION_REQUIRED = 0x08000000,
}
/// Page types used by the new advanced ACL UI
public enum SI_PAGE_ACTIVATED : uint
{
///
SI_SHOW_DEFAULT = 0,
///
SI_SHOW_PERM_ACTIVATED,
///
SI_SHOW_AUDIT_ACTIVATED,
///
SI_SHOW_OWNER_ACTIVATED,
///
SI_SHOW_EFFECTIVE_ACTIVATED,
///
SI_SHOW_SHARE_ACTIVATED,
///
SI_SHOW_CENTRAL_POLICY_ACTIVATED,
}
/// Values that indicate the types of property pages in an access control editor property sheet.
public enum SI_PAGE_TYPE : uint
{
/// Permissions page.
SI_PAGE_PERM = 0,
/// Advanced page.
SI_PAGE_ADVPERM,
/// Audit page.
SI_PAGE_AUDIT,
/// Owner page.
SI_PAGE_OWNER,
/// Effective Rights page.
SI_PAGE_EFFECTIVE,
/// Take Ownership page.
SI_PAGE_TAKEOWNERSHIP,
/// Share page.
SI_PAGE_SHARE
}
///
/// The IEffectivePermission interface provides a means to determine effective permission for a security principal on an object. The
/// access control editor uses this information to communicate the effective permission to the client.
///
[ComImport, InterfaceType(ComInterfaceType.InterfaceIsIUnknown), Guid("3853DC76-9F35-407c-88A1-D19344365FBC")]
[PInvokeData("aclui.h", MSDNShortId = "aa378393")]
public interface IEffectivePermission
{
/// Returns the effective permission for an object type.
/// A GUID for the object type whose permission is being queried.
///
/// A pointer to a SID structure that represents the security principal whose effective permission is being determined.
///
/// A pointer to null-terminated wide character string that represents the server name.
///
/// A pointer to a SECURITY_DESCRIPTOR structure that represents the object's security descriptor. The security descriptor is
/// used to perform the access check.
///
///
/// A pointer to a pointer to an OBJECT_TYPE_LIST structure that represents the array of object types in the object tree for the
/// object. If an object does not support property access, use the following technique to specify the value for the OBJECT_TYPE_LIST.
///
/// A pointer to a ULONG that receives the count of object types pointed to by ppObjectTypeList.
///
/// A pointer to a pointer to an ACCESS_MASK that receives the array of granted access masks. The operating system will use
/// LocalFree to free the memory allocated for this parameter.
///
///
/// A pointer to a ULONG variable that receives the count of granted access masks pointed to by the ppGrantedAccessList parameter.
///
[PreserveSig]
HRESULT GetEffectivePermission(in Guid pguidObjectType, [In] PSID pUserSid,
[In, MarshalAs(UnmanagedType.LPWStr)] string pszServerName, [In] PSECURITY_DESCRIPTOR pSD,
[MarshalAs(UnmanagedType.LPArray)] out OBJECT_TYPE_LIST[] ppObjectTypeList,
out uint pcObjectTypeListLength,
[MarshalAs(UnmanagedType.LPArray)] out ACCESS_MASK[] ppGrantedAccessList,
out uint pcGrantedAccessListLength);
}
///
/// The IEffectivePermission2 interface provides a way to determine effective permissions for a security principal on an object in a
/// way where the principal's security context may be compounded with a device context or adjusted in other ways. Additionally, it
/// determines the effective permissions even when multiple security checks apply. The access control editor uses this information to
/// communicate the effective permissions to the client.
///
[ComImport, InterfaceType(ComInterfaceType.InterfaceIsIUnknown), Guid("941FABCA-DD47-4FCA-90BB-B0E10255F20D")]
[PInvokeData("aclui.h", MSDNShortId = "hh448520")]
public interface IEffectivePermission2
{
///
/// The ComputeEffectivePermissionWithSecondarySecurity method computes the effective permissions for an object. It supports
/// integrating secondary or custom security policies. You may choose to provide this additional security information by
/// implementing the ISecurityInformation4 interface. This method supports compound identity, which is when a principal's access
/// token contains user and device authorization information.
///
///
/// A pointer to a SID structure that represents the security principal whose effective permission is being determined.
///
///
/// A pointer to a SID structure that represents the device from which the principal is accessing the object. If this is not NULL
/// and you are using the AuthzAccessCheck function to compute the effective permissions, then the device SID may be compounded
/// with the pSid parameter by using the AuthzInitializeCompoundContext function.
///
///
/// The name of the server on which the object resides. This is the same name that was returned from the
/// ISecurityInformation::GetObjectInformation method.
///
///
/// An array of security objects. This array is composed of objects that were deduced by the access control editor in addition to
/// the ones returned from the ISecurityInformation4::GetSecondarySecurity method.
///
///
/// The number of security objects in the pSecurityObjects parameter, and the number of results lists in the pEffpermResultLists parameter.
///
///
/// A pointer to additional user groups that should be used to modify the security context which was initialized from the pSid
/// parameter. If you are using the AuthzAccessCheck function to compute the effective permissions, then the modification may be
/// done by calling the AuthzModifySids function using AuthzContextInfoGroupsSids as the SidClass parameter.
///
///
/// Pointer to an array of AUTHZ_SID_OPERATION structures that specify how the user groups in the authz context must be modified
/// for each user group in the pUserGroups argument. This array contains as many elements as the number of groups in the
/// pUserGroups parameter.
///
///
/// A pointer to additional device groups that should be used to modify the security context which was initialized from the pSid
/// parameter or one that was created by compounding the contexts that were initialized from the pSid and pDeviceSid parameters.
/// If you are using the AuthzAccessCheck function to compute the effective permissions, then the modification may be done by
/// calling the AuthzModifySids function using AuthzContextInfoDeviceSids as the SidClass parameter.
///
///
/// Pointer to an array of AUTHZ_SID_OPERATION enumeration types that specify how the device groups in the authz context must be
/// modified for each device group in the pDeviceGroups argument. This array contains as many elements as the number of groups in
/// the pDeviceGroups parameter.
///
///
/// Pointer to an AUTHZ_SECURITY_ATTRIBUTES_INFORMATION structure that contains the user claims context that should be used to
/// modify the security context that was initialized from the pSid parameter. If you are using the AuthzAccessCheck function to
/// compute the effective permissions, then the modification may be done by calling the AuthzModifyClaims function using
/// AuthzContextInfoUserClaims as the ClaimClass parameter.
///
///
/// Pointer to an AUTHZ_SECURITY_ATTRIBUTE_OPERATION enumeration type that specifies the operations associated with the user
/// claims context.
///
///
/// A pointer to the device claims context that should be used to modify the security context that was initialized from the pSid
/// parameter or one that was created by compounding the contexts that were initialized from the pSid and pDeviceSid parameters.
/// This may be supplied by the caller, even if the pDeviceSid parameter is not. If you are using the AuthzAccessCheck function
/// to compute the effective permissions, then the modification may be done by calling the AuthzModifyClaims function using
/// AuthzContextInfoDeviceClaims as the ClaimClass parameter.
///
///
/// Pointer to an AUTHZ_SECURITY_ATTRIBUTE_OPERATION enumeration type that specifies the operations associated with the device
/// claims context.
///
///
/// A pointer to an array of the effective permissions results of type EFFPERM_RESULT_LIST. This array is dwSecurityObjectCount
/// elements long. The array is initialized by the caller and the implementation is expected to set all fields of each member in
/// the array, indicating what access was granted by the corresponding security object.
///
/// If a security object was considered, the fEvaluated member should be set to TRUE. In this case, the pObjectTypeList and
/// pGrantedAccessList members should both be cObjectTypeListLength elements long. The pObjectTypeList member must point to
/// memory that is owned by the resource manager and must remain valid until the EditSecurity function exits. The
/// pGrantedAccessList member is freed by the caller by using the LocalFree function. If the resource manager does not support
/// object ACEs, then the pObjectTypeList member should point to the NULL GUID, the cObjectTypeListLength member should be 1, and
/// the pGrantedAccessList member should be a single DWORD.
///
///
[PreserveSig]
HRESULT ComputeEffectivePermissionWithSecondarySecurity(
[In] PSID pSid,
[In, Optional] PSID pDeviceSid,
[In, Optional, MarshalAs(UnmanagedType.LPWStr)] string pszServerName,
[In, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 4)] SECURITY_OBJECT[] pSecurityObjects,
uint dwSecurityObjectCount,
in TOKEN_GROUPS pUserGroups,
[In, Optional] AUTHZ_SID_OPERATION[] pAuthzUserGroupsOperations,
in TOKEN_GROUPS pDeviceGroups,
[In, Optional] AUTHZ_SID_OPERATION[] pAuthzDeviceGroupsOperations,
in AUTHZ_SECURITY_ATTRIBUTES_INFORMATION pAuthzUserClaims,
[In, Optional] AUTHZ_SECURITY_ATTRIBUTE_OPERATION[] pAuthzUserClaimsOperations,
in AUTHZ_SECURITY_ATTRIBUTES_INFORMATION pAuthzDeviceClaims,
[In, Optional] AUTHZ_SECURITY_ATTRIBUTE_OPERATION[] pAuthzDeviceClaimsOperations,
[MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 4)] EFFPERM_RESULT_LIST[] pEffpermResultLists);
}
///
/// The ISecurityInformation interface enables the access control editor to communicate with the caller of the CreateSecurityPage and
/// EditSecurity functions. The editor calls the interface methods to retrieve information that is used to initialize its pages and
/// to determine the editing options available to the user. The editor also calls the interface methods to pass the user's input back
/// to the application.
///
[ComImport, InterfaceType(ComInterfaceType.InterfaceIsIUnknown), Guid("965FC360-16FF-11d0-91CB-00AA00BBB723")]
[PInvokeData("aclui.h", MSDNShortId = "aa378900")]
public interface ISecurityInformation
{
///
/// The GetObjectInformation method requests information that the access control editor uses to initialize its pages and to
/// determine the editing options available to the user.
///
///
/// A pointer to an SI_OBJECT_INFO structure. Your implementation must fill this structure to pass information back to the access
/// control editor.
///
[PreserveSig]
HRESULT GetObjectInformation(ref SI_OBJECT_INFO object_info);
///
/// The GetSecurity method requests a security descriptor for the securable object whose security descriptor is being edited. The
/// access control editor calls this method to retrieve the object's current or default security descriptor.
///
///
/// A set of SECURITY_INFORMATION bit flags that indicate the parts of the security descriptor being requested. This parameter
/// can be a combination of the following values.
///
///
/// A pointer to a variable that your implementation must set to a pointer to the object's security descriptor. The security
/// descriptor must include the components requested by the RequestedInformation parameter.
/// The system calls the LocalFree function to free the returned pointer.
///
///
/// If this parameter is TRUE, ppSecurityDescriptor should return an application-defined default security descriptor for the
/// object. The access control editor uses this default security descriptor to reinitialize the property page.
///
/// The access control editor sets this parameter to TRUE only if the user clicks the Default button. The Default button is
/// displayed only if you set the SI_RESET flag in the ISecurityInformation::GetObjectInformation method. If no default security
/// descriptor is available, do not set the SI_RESET flag.
///
/// If this flag is FALSE, ppSecurityDescriptor should return the object's current security descriptor.
///
[PreserveSig]
HRESULT GetSecurity([In] SECURITY_INFORMATION RequestInformation, out PSECURITY_DESCRIPTOR SecurityDescriptor, [In, MarshalAs(UnmanagedType.Bool)] bool fDefault);
///
/// The SetSecurity method provides a security descriptor containing the security information the user wants to apply to the
/// securable object. The access control editor calls this method when the user clicks Okay or Apply.
///
///
/// A set of SECURITY_INFORMATION bit flags that indicate the parts of the security descriptor to set.
///
///
/// A pointer to a security descriptor containing the new security information. Do not assume the security descriptor is in
/// self-relative form; it can be either absolute or self-relative.
///
[PreserveSig]
HRESULT SetSecurity([In] SECURITY_INFORMATION RequestInformation, [In] PSECURITY_DESCRIPTOR SecurityDescriptor);
///
/// The GetAccessRights method requests information about the access rights that can be controlled for a securable object. The
/// access control editor calls this method to retrieve display strings and other information used to initialize the property pages.
///
///
/// A pointer to a GUID structure that identifies the type of object for which access rights are being requested. If this
/// parameter is NULL or a pointer to GUID_NULL, return the access rights for the object being edited. Otherwise, the GUID
/// identifies a child object type returned by the ISecurityInformation::GetInheritTypes method. The GUID corresponds to the
/// InheritedObjectType member of an object-specific ACE.
///
///
/// A set of bit flags that indicate the property page being initialized. This value is zero if the basic security page is being
/// initialized. Otherwise, it is a combination of the following values.
///
///
/// A pointer to an array of SI_ACCESS structures. The array must include one entry for each access right. You can specify access
/// rights that apply to the object itself, as well as object-specific access rights that apply only to a property set or
/// property on the object.
///
/// A pointer to ULONG that indicates the number of entries in the ppAccess array.
///
/// A pointer to ULONG that indicates the zero-based index of the array entry that contains the default access rights. The access
/// control editor uses this entry as the initial access rights in a new ACE.
///
[PreserveSig]
HRESULT GetAccessRights(in Guid guidObject, [In] int dwFlags, [MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 3)] out SI_ACCESS[] access, ref uint access_count, out uint DefaultAccess);
///
/// The MapGeneric method requests that the generic access rights in an access mask be mapped to their corresponding standard and
/// specific access rights. For more information about generic, standard, and specific access rights, see Access Rights and
/// Access Masks.
///
///
/// A pointer to a GUID structure that identifies the type of object to which the access mask applies. If this member is NULL or
/// a pointer to GUID_NULL, the access mask applies to the object itself.
///
///
/// A pointer to the AceFlags member of the ACE_HEADER structure from the ACE whose access mask is being mapped.
///
///
/// A pointer to an access mask that contains the generic access rights to map. Your implementation must map the generic access
/// rights to the corresponding standard and specific access rights for the specified object type.
///
[PreserveSig]
HRESULT MapGeneric(in Guid guidObjectType, ref System.Security.AccessControl.AceFlags AceFlags, ref ACCESS_MASK Mask);
///
/// The GetInheritTypes method requests information about how ACEs can be inherited by child objects. For more information, see
/// ACE Inheritance.
///
///
/// A pointer to a variable you should set to a pointer to an array of SI_INHERIT_TYPE structures. The array should include one
/// entry for each combination of inheritance flags and child object type that you support.
///
///
/// A pointer to a variable that you should set to indicate the number of entries in the ppInheritTypes array.
///
[PreserveSig]
HRESULT GetInheritTypes([MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 1)] out SI_INHERIT_TYPE[] InheritType, out uint InheritTypesCount);
///
/// The PropertySheetPageCallback method notifies an EditSecurity or CreateSecurityPage caller that an access control editor
/// property page is being created or destroyed.
///
///
/// If uMsg is PSPCB_SI_INITDIALOG, hwnd is a handle to the property page dialog box. Otherwise, hwnd is NULL.
///
/// Identifies the message being received.
///
/// A value from the SI_PAGE_TYPE enumeration type that indicates the type of access control editor property page being created
/// or destroyed.
///
[PreserveSig]
HRESULT PropertySheetPageCallback([In] HWND hwnd, [In] PropertySheetCallbackMessage uMsg, [In] SI_PAGE_TYPE uPage);
}
///
/// The ISecurityInformation2 interface enables the access control editor to obtain information from the client that is not provided
/// by the ISecurityInformation interface. The client does not need to implement ISecurityInformation2 unless the default behavior of
/// the access control editor is unsuitable for the client.
///
[ComImport, InterfaceType(ComInterfaceType.InterfaceIsIUnknown), Guid("c3ccfdb4-6f88-11d2-a3ce-00c04fb1782a")]
[PInvokeData("aclui.h", MSDNShortId = "aa378908")]
public interface ISecurityInformation2
{
///
/// The IsDaclCanonical method determines whether the ACEs contained in the specified DACL structure are ordered according to the
/// definition of DACL ordering implemented by the client.
///
/// A pointer to a discretionary ACL structure initialized by InitializeAcl.
///
/// Returns TRUE if the ACEs contained in the specified DACL structure are ordered according to the definition of DACL ordering
/// implemented by the client. Returns FALSE if the ACEs are not ordered correctly.
///
[return: MarshalAs(UnmanagedType.Bool)]
bool IsDaclCanonical([In] PACL pDacl);
///
/// The LookupSids method returns the common names corresponding to each of the elements in the specified list of SIDs.
///
/// The number of pointers to SID structures pointed to by rgpSids.
/// A pointer to an array of pointers to SID structures.
///
/// A pointer to a pointer to a returned data transfer object that contains the common names of the SIDs. Optionally, this
/// parameter also returns the user principal name (UPN) of the SIDs in the rgpSids parameter. The data transfer object is a
/// SID_INFO structure.
///
[PreserveSig]
HRESULT LookupSids([In] uint cSids, [In, MarshalAs(UnmanagedType.LPArray)] PSID[] rgpSids, out IntPtr ppdo);
}
///
/// The ISecurityInformation3 interface provides methods necessary for displaying an elevated access control editor when a user
/// clicks the Edit button on an access control editor page that displays an image of a shield on that Edit button. The image of a
/// shield is displayed on the Edit button when the access control editor is launched by a process with a token that lacks permission
/// to save changes to the object being edited.
///
[ComImport, InterfaceType(ComInterfaceType.InterfaceIsIUnknown), Guid("E2CDC9CC-31BD-4f8f-8C8B-B641AF516A1A")]
[PInvokeData("aclui.h", MSDNShortId = "bb540757")]
public interface ISecurityInformation3
{
///
/// The GetFullResourceName method retrieves the full path and file name of the object associated with the access control editor
/// that is displayed by calling the OpenElevatedEditor method.
///
/// The full path and file name of the object for which permissions are to be edited.
[PreserveSig]
HRESULT GetFullResourceName([MarshalAs(UnmanagedType.LPWStr)] out string ppszResourceName);
///
/// The OpenElevatedEditor method opens an access control editor when a user clicks the Edit button on an access control editor
/// page that displays an image of a shield on that Edit button. The image of a shield is displayed when the access control
/// editor is launched by a process with a token that lacks permission to save changes to the object being edited.
///
/// The parent window of the access control editor.
///
/// A value of the SI_PAGE_TYPE enumeration that indicates the page type on which to display the elevated access control editor.
///
[PreserveSig]
HRESULT OpenElevatedEditor([In] HWND hWnd, [In] SI_PAGE_TYPE uPage);
}
///
/// The ISecurityInformation4 interface enables the resource manager to provide additional information when computing effective
/// permissions using the IEffectivePermission2 interface.
///
[ComImport, InterfaceType(ComInterfaceType.InterfaceIsIUnknown), Guid("EA961070-CD14-4621-ACE4-F63C03E583E4")]
[PInvokeData("aclui.h", MSDNShortId = "hh448522")]
public interface ISecurityInformation4
{
/// The GetSecondarySecurity method returns additional security contexts that may impact access to the resource.
///
/// An array of SECURITY_OBJECT structures that contain the secondary security objects associated with the resources that are set
/// on success. The array is owned by the caller and is freed by using the LocalFree function. The pwszName member is also freed
/// by using LocalFree. If the cbData or cbData2 members of the SECURITY_OBJECT structure are not zero, then the caller must free
/// the corresponding pData or pData2 by using LocalFree. If either of those members are zero, then the corresponding pData and
/// pData2 members are owned by the resource manager and must remain valid until the EditSecurity function returns.
///
/// The number of security objects in the pSecurityObjects parameter that are set on success.
[PreserveSig]
HRESULT GetSecondarySecurity([MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 1)] out SECURITY_OBJECT[] pSecurityObjects, out uint pSecurityObjectCount);
}
///
/// The ISecurityObjectTypeInfo interface provides a means of determining the source of inherited access control entries (ACEs) in
/// discretionary access control lists (DACLs) and system access control lists (SACLs). The access control editor uses this
/// information to communicate the inheritance source to the client.
///
[ComImport, InterfaceType(ComInterfaceType.InterfaceIsIUnknown), Guid("FC3066EB-79EF-444b-9111-D18A75EBF2FA")]
[PInvokeData("aclui.h", MSDNShortId = "aa379128")]
public interface ISecurityObjectTypeInfo
{
///
/// The GetInheritSource method provides a means of determining the source of inherited access control entries (ACEs) in
/// discretionary access control lists (DACLs) and system access control lists (SACLs).
///
/// A SECURITY_INFORMATION structure that represents the security information of the object.
/// A pointer to an ACL structure that represents the access control list (ACL) of the object.
///
/// A pointer to a pointer to an INHERITED_FROM structure that receives an array of INHERITED_FROM structures. The length of this
/// array is the same as the number of ACEs in the ACL referenced by pACL. Each INHERITED_FROM entry in ppInheritArray provides
/// inheritance information for the corresponding ACE entry in pACL.
///
[PreserveSig]
HRESULT GetInheritSource([In] int si, [In] PACL pACL, [MarshalAs(UnmanagedType.LPArray)] out INHERITED_FROM[] ppInheritArray);
}
///
/// Combines the and types for use in the last parameter of
/// method.
///
/// The value.
/// The value.
/// A combined value.
public static uint COMBINE_PAGE_ACTIVATION(SI_PAGE_TYPE pt, SI_PAGE_ACTIVATED pa) => (uint)pt | ((uint)pa << 16);
///
/// The CreateSecurityPage function creates a basic security property page that enables the user to view and edit the access rights
/// allowed or denied by the access control entries (ACEs) in an object's discretionary access control list (DACL). Use the
/// PropertySheet function or the PSM_ADDPAGE message to add this page to a property sheet.
///
///
/// A pointer to your implementation of the ISecurityInformation interface. The system calls the interface methods to retrieve
/// information about the object being edited and to return the user's input.
///
///
/// If the function succeeds, the function returns a handle to a basic security property page. If the function fails, it returns
/// NULL. To get extended error information, call GetLastError.
///
[DllImport(Lib.AclUI, ExactSpelling = true, SetLastError = true)]
[PInvokeData("aclui.h", Dll = "Aclui.dll", MSDNShortId = "aa446584")]
public static extern IntPtr CreateSecurityPage([In] ISecurityInformation psi);
///
/// The EditSecurity function displays a property sheet that contains a basic security property page. This property page
/// enables the user to view and edit the access rights allowed or denied by the ACEs in an object's DACL.
///
/// A handle to the window that owns the property sheet. This parameter can be NULL.
///
/// A pointer to your implementation of the ISecurityInformation interface. The system calls the interface methods to retrieve
/// information about the object being edited and to return the user's input.
///
///
/// If the function succeeds, the return value is a nonzero value.
/// If the function fails, the return value is zero. To get extended error information, call GetLastError.
///
///
/// The EditSecurity function calls the CreateSecurityPage function to create a basic security property page.
///
/// During the property page initialization, the system calls the ISecurityInformation::GetSecurity and
/// ISecurityInformation::SetSecurity methods to determine whether the user has permission to edit the object's security descriptor.
/// The system displays an error message if the user does not have permission.
///
///
/// The basic security property page can include an Advanced button for displaying the advanced security property sheet. This
/// advanced security property sheet can contain three additional property pages that enable the user to view and edit the object's
/// DACL, SACL, and owner.
///
///
// https://docs.microsoft.com/en-us/windows/desktop/api/aclui/nf-aclui-editsecurity BOOL ACLUIAPI EditSecurity( HWND hwndOwner,
// LPSECURITYINFO psi );
[DllImport(Lib.AclUI, SetLastError = true, ExactSpelling = true)]
[PInvokeData("aclui.h", MSDNShortId = "756c94b0-946f-47eb-b4b4-db3e6e89fe46")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool EditSecurity([Optional] HWND hwndOwner, ISecurityInformation psi);
///
/// The EditSecurityAdvanced function extends the EditSecurity function to include the security page type when displaying the
/// property sheet that contains a basic security property page. This property page enables the user to view and edit the access
/// rights allowed or denied by the access control entries (ACEs) in an object's discretionary access control list (DACL).
///
/// A handle to the window that owns the property sheet. This parameter can be NULL.
///
/// A pointer to your implementation of the ISecurityInformation interface. The system calls the interface methods to retrieve
/// information about the object being edited and to return the user's input.
///
///
/// A value of the SI_PAGE_TYPE enumeration that indicates the page type on which to display the elevated access control editor.
///
///
/// If the function succeeds, the return value is S_OK.
///
/// If the function fails, any other HRESULT value indicates an error. For a list of common error codes, see Common HRESULT Values.
///
///
// https://docs.microsoft.com/en-us/windows/desktop/api/aclui/nf-aclui-editsecurityadvanced HRESULT ACLUIAPI EditSecurityAdvanced(
// HWND hwndOwner, LPSECURITYINFO psi, SI_PAGE_TYPE uSIPage );
[DllImport(Lib.AclUI, SetLastError = false, ExactSpelling = true)]
[PInvokeData("aclui.h", MSDNShortId = "E451BBB9-4E01-4A8F-9ACD-750351F16453")]
public static extern HRESULT EditSecurityAdvanced([Optional] HWND hwndOwner, ISecurityInformation psi, uint uSIPage);
///
/// The EditSecurityAdvanced function extends the EditSecurity function to include the security page type when displaying the
/// property sheet that contains a basic security property page. This property page enables the user to view and edit the access
/// rights allowed or denied by the access control entries (ACEs) in an object's discretionary access control list (DACL).
///
/// A handle to the window that owns the property sheet. This parameter can be NULL.
///
/// A pointer to your implementation of the ISecurityInformation interface. The system calls the interface methods to retrieve
/// information about the object being edited and to return the user's input.
///
///
/// A value of the SI_PAGE_TYPE enumeration that indicates the page type on which to display the elevated access control editor.
///
/// A value of the SI_PAGE_ACTIVATED enumeration that indicates the page type to display.
///
/// If the function succeeds, the return value is S_OK.
///
/// If the function fails, any other HRESULT value indicates an error. For a list of common error codes, see Common HRESULT Values.
///
///
[PInvokeData("aclui.h", MSDNShortId = "E451BBB9-4E01-4A8F-9ACD-750351F16453")]
public static HRESULT EditSecurityAdvanced([Optional] HWND hwndOwner, ISecurityInformation psi, SI_PAGE_TYPE pageType, SI_PAGE_ACTIVATED pageActivated) =>
EditSecurityAdvanced(hwndOwner, psi, COMBINE_PAGE_ACTIVATION(pageType, pageActivated));
/// The EFFPERM_RESULT_LIST structure lists the effective permissions.
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
[PInvokeData("aclui.h", MSDNShortId = "hh448491")]
public struct EFFPERM_RESULT_LIST
{
/// Indicates if the effective permissions results have been evaluated.
[MarshalAs(UnmanagedType.Bool)] public bool fEvaluated;
/// The number of elements in both the pObjectTypeList and pGrantedAccessList members.
public uint cObjectTypeListLength;
///
/// A pointer to an array of OBJECT_TYPE_LIST structures that specifies the properties and property sets for which access was evaluated.
///
[MarshalAs(UnmanagedType.LPArray)] public OBJECT_TYPE_LIST[] pObjectTypeList;
///
/// A pointer to an array of ACCESS_MASK values that specifies the access rights granted for each corresponding object type.
///
[MarshalAs(UnmanagedType.LPArray)] public uint[] pGrantedAccessList;
}
/// The SECURITY_OBJECT structure contains the security object information.
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
[PInvokeData("aclui.h", MSDNShortId = "hh448532")]
public struct SECURITY_OBJECT
{
/// A pointer to the name.
[MarshalAs(UnmanagedType.LPWStr)] public string pwszName;
/// A pointer to the security data.
public IntPtr pData;
///
/// The size, in bytes, of the data pointed to by the pData member. This may be zero if pData contains the data, such as when the
/// data is an IUnknown interface pointer, a handle, or data specific to the resource manager that can be stored in pData
/// directly without a memory allocation.
///
public uint cbData;
/// A pointer to the additional security data.
public IntPtr pData2;
///
/// The size, in bytes, of the data pointed to by the pData2 member. This may be zero if pData2 contains the data, such as when
/// the data is an IUnknown interface pointer, a handle, or data specific to the resource manager that can be stored in pData2
/// directly without a memory allocation.
///
public uint cbData2;
///
/// The identifier for the security object's type. If the fWellKnown member is FALSE, then the Id member has no special
/// significance other than to help resource managers distinguish it from other classes of security objects. If the fWellKnown
/// member is TRUE, then the Id member is one of the following and the entire structure follows the corresponding representation.
///
public uint Id;
/// TRUE if the security object represents one of the well-know security objects listed in the Id member.
[MarshalAs(UnmanagedType.Bool)] public bool fWellKnown;
}
///
/// The SI_OBJECT_INFO structure is used by the ISecurityInformation::GetObjectInformation method to specify information used to
/// initialize the access control editor.
///
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
[PInvokeData("aclui.h", MSDNShortId = "aa379605")]
public struct SI_OBJECT_INFO
{
/// A set of bit flags that determine the editing options available to the user.
public SI_OBJECT_INFO_Flags dwFlags;
///
/// Identifies a module that contains string resources to be used in the property sheet. The
/// ISecurityInformation::GetAccessRights and ISecurityInformation::GetInheritTypes methods can specify string resource
/// identifiers for display names.
///
public HINSTANCE hInstance;
///
/// A pointer to a null-terminated, Unicode string that names the computer on which to look up account names and SIDs. This value
/// can be NULL to specify the local computer. The access control editor does not free this pointer.
///
[MarshalAs(UnmanagedType.LPWStr)]
public string pszServerName;
///
/// A pointer to a null-terminated, Unicode string that names the object being edited. This name appears in the title of the
/// advanced security property sheet and any error message boxes displayed by the access control editor. The access control
/// editor does not free this pointer.
///
[MarshalAs(UnmanagedType.LPWStr)]
public string pszObjectName;
///
/// A pointer to a null-terminated, Unicode string used as the title of the basic security property page. This member is ignored
/// unless the SI_PAGE_TITLE flag is set in dwFlags. If the page title is not provided, a default title is used. The access
/// control editor does not free this pointer.
///
[MarshalAs(UnmanagedType.LPWStr)]
public string pszPageTitle;
/// A GUID for the object. This member is ignored unless the SI_OBJECT_GUID flag is set in dwFlags.
public Guid guidObjectType;
/// Initializes a new instance of the struct.
/// A set of bit flags that determine the editing options available to the user.
/// Names the object being edited.
/// Names the computer on which to look up account names and SIDs.
/// The title of the basic security property page.
/// The unique identifier for the object.
public SI_OBJECT_INFO(SI_OBJECT_INFO_Flags flags, string objectName, string serverName = null, string pageTitle = null, Guid? guidObject = null)
{
dwFlags = flags;
hInstance = IntPtr.Zero;
pszObjectName = objectName;
pszServerName = serverName;
pszPageTitle = pageTitle;
guidObjectType = guidObject ?? Guid.Empty;
if (pageTitle != null)
dwFlags |= SI_OBJECT_INFO_Flags.SI_PAGE_TITLE;
if (guidObjectType != Guid.Empty)
dwFlags |= SI_OBJECT_INFO_Flags.SI_OBJECT_GUID;
}
/// Gets a value indicating whether this instance is container.
/// true if this instance is container; otherwise, false.
public bool IsContainer => ((dwFlags & SI_OBJECT_INFO_Flags.SI_CONTAINER) == SI_OBJECT_INFO_Flags.SI_CONTAINER);
/// Returns a that represents this instance.
/// A that represents this instance.
public override string ToString() => $"{pszObjectName}: {dwFlags}{(IsContainer ? " (Cont)" : "")}";
}
///
/// The SID_INFO structure contains the list of common names corresponding to the SID structures returned by
/// ISecurityInformation2::LookupSids. It is a member of the SID_INFO_LIST structure.
///
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
[PInvokeData("aclui.h", MSDNShortId = "aa379599")]
public struct SID_INFO
{
/// A pointer to a SID structure that identifies one of the SIDs passed into ISecurityInformation2::LookupSids.
public IntPtr pSid;
/// A pointer to a string containing the common name corresponding to the SID structure specified in pSid.
[MarshalAs(UnmanagedType.LPWStr)]
public string pwzCommonName;
///
/// A pointer to a string describing the SID structure as either a user or a group. The possible values of this string are as
/// follows: "Computer", "Group", or "User"
///
[MarshalAs(UnmanagedType.LPWStr)]
public string pwzClass;
///
/// A pointer to the user principal name (UPN) corresponding to the SID structure specified in pSid. If a UPN has not been
/// designated for the SID structure, the value of this parameter is NULL.
///
[MarshalAs(UnmanagedType.LPWStr)]
public string pwzUPN;
}
///
/// Class contains information about an access right or default access mask for a securable object. The
/// method uses this class to specify information that the access control editor
/// uses to initialize its property pages.
///
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
[PInvokeData("aclui.h", MSDNShortId = "aa379603")]
public sealed class SI_ACCESS : IDisposable
{
///
/// A pointer to a GUID structure that identifies the type of object to which the access right or default access mask applies.
/// The GUID can identify a property set or property on the object, or a type of child object that can be contained by the
/// object. If this member points to GUID_NULL, the access right applies to the object itself.
///
public GuidPtr pguid;
///
/// A bitmask that specifies the access right described by this structure. The mask can contain any combination of standard and
/// specific rights, but should not contain generic rights such as GENERIC_ALL.
///
public uint mask;
/// A display string that describes the access right.
[MarshalAs(UnmanagedType.LPWStr)]
public string pszName;
/// A set of that indicate where the access right is displayed.
public INHERIT_FLAGS dwFlags;
/// Initializes a new instance of the class.
/// The access mask.
/// The display name.
/// The access flags.
/// Type of the object.
public SI_ACCESS(uint mask, string name, INHERIT_FLAGS flags, Guid? objType = null)
{
this.mask = mask;
pszName = name;
dwFlags = flags;
if (objType != null)
ObjectTypeId = objType.Value;
}
///
/// The type of object. This member can be . The GUID corresponds to the InheritedObjectType member of an
/// object-specific ACE.
///
/// The object type identifier.
public Guid ObjectTypeId
{
get => pguid.Value.GetValueOrDefault();
set => pguid.Assign(value);
}
void IDisposable.Dispose() => pguid.Free();
}
///
/// Contains information about how access control entries (ACEs) can be inherited by child objects. The
/// method uses this structure to specify display strings that the access control
/// editor uses to initialize its property pages.
///
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
[PInvokeData("aclui.h", MSDNShortId = "aa379604")]
public sealed class SI_INHERIT_TYPE : IDisposable
{
///
/// A pointer to a GUID structure that identifies the type of child object. This member can be a pointer to GUID_NULL. The GUID
/// corresponds to the InheritedObjectType member of an object-specific ACE.
///
public GuidPtr pguid;
///
/// A set of that indicate the types of ACEs that can be inherited by the
/// . These flags correspond to the AceFlags member of an ACE_HEADER structure.
///
public INHERIT_FLAGS dwFlags;
/// A display string that describes the child object.
[MarshalAs(UnmanagedType.LPWStr)]
public string pszName;
/// Initializes a new instance of the struct.
/// The inheritance flags.
/// The display name.
public SI_INHERIT_TYPE(INHERIT_FLAGS flags, string name)
{
dwFlags = flags;
pszName = name;
}
/// Initializes a new instance of the struct.
/// Type of the child object.
/// The inheritance flags.
/// The display name.
public SI_INHERIT_TYPE(Guid childObjectType, INHERIT_FLAGS flags, string name) : this(flags, name)
{
ChildObjectTypeId = childObjectType;
}
///
/// The type of child object. This member can be . The GUID corresponds to the InheritedObjectType member
/// of an object-specific ACE.
///
/// The child object type identifier.
public Guid ChildObjectTypeId
{
get => pguid.Value.GetValueOrDefault();
set => pguid.Assign(value);
}
void IDisposable.Dispose() => pguid.Free();
}
}
}