Skip to main content

admits_exactly

Function admits_exactly 

Source
pub fn admits_exactly(descriptor: &str, admission: &RootAdmission) -> bool
Expand description

Whether a DACL is already exactly what default_root_sddl would write.

Used only to skip a rewrite that would change nothing. A false negative costs one SetNamedSecurityInfoW — which is why an alias Windows substituted for an account SID is allowed to produce one — and a false positive would leave the root under-reconciled after a mode change, which is why the comparison is equality rather than “contains what is needed”.

The rights are compared as well as the trustees, and that is not fastidiousness. A root that already names SY, BA and the selected account but grants the third FA matches on trustees alone, and FA carries the WRITE_DAC and WRITE_OWNER that ADMITTED_RIGHTS exists to withhold — so accepting it would leave the admitted account able to undo the protection this module applied. Masks rather than text, because Windows renders FRFWFXSD back as 0x1301bf.