pub fn admits_exactly(descriptor: &str, admission: &RootAdmission) -> boolExpand description
Whether a DACL is already exactly what default_root_sddl would write.
Used only to skip a rewrite that would change nothing. A false negative
costs one SetNamedSecurityInfoW — which is why an alias Windows substituted
for an account SID is allowed to produce one — and a false positive would
leave the root under-reconciled after a mode change, which is why the
comparison is equality rather than “contains what is needed”.
The rights are compared as well as the trustees, and that is not
fastidiousness. A root that already names SY, BA and the selected
account but grants the third FA matches on trustees alone, and FA
carries the WRITE_DAC and WRITE_OWNER that ADMITTED_RIGHTS exists to
withhold — so accepting it would leave the admitted account able to undo the
protection this module applied. Masks rather than text, because Windows
renders FRFWFXSD back as 0x1301bf.