Enum Ace

pub enum Ace {
    ACCESS_ALLOWED_ACE {
        header: AceHeader,
        sid: Sid,
        _padding: Vec<u8>,
    },
    ACCESS_ALLOWED_OBJECT_ACE {
        header: AceHeader,
        object_type: Guid,
        inherited_object_type: Guid,
        sid: Sid,
        _padding: Vec<u8>,
    },
    ACCESS_DENIED_ACE {
        header: AceHeader,
        sid: Sid,
        _padding: Vec<u8>,
    },
    ACCESS_DENIED_OBJECT_ACE {
        header: AceHeader,
        object_type: Guid,
        inherited_object_type: Guid,
        sid: Sid,
        _padding: Vec<u8>,
    },
    ACCESS_ALLOWED_CALLBACK_ACE {
        header: AceHeader,
        sid: Sid,
        application_data: Vec<u8>,
        is_conditional: bool,
        _padding: Vec<u8>,
    },
    ACCESS_DENIED_CALLBACK_ACE {
        header: AceHeader,
        sid: Sid,
        application_data: Vec<u8>,
        is_conditional: bool,
        _padding: Vec<u8>,
    },
    ACCESS_ALLOWED_CALLBACK_OBJECT_ACE {
        header: AceHeader,
        object_type: Guid,
        inherited_object_type: Guid,
        sid: Sid,
        application_data: Vec<u8>,
        is_conditional: bool,
        _padding: Vec<u8>,
    },
    ACCESS_DENIED_CALLBACK_OBJECT_ACE {
        header: AceHeader,
        object_type: Guid,
        inherited_object_type: Guid,
        sid: Sid,
        application_data: Vec<u8>,
        is_conditional: bool,
        _padding: Vec<u8>,
    },
    SYSTEM_AUDIT_ACE {
        header: AceHeader,
        sid: Sid,
        _padding: Vec<u8>,
    },
    SYSTEM_AUDIT_OBJECT_ACE {
        header: AceHeader,
        object_type: Guid,
        inherited_object_type: Guid,
        sid: Sid,
        application_data: Vec<u8>,
        is_conditional: bool,
        _padding: Vec<u8>,
    },
    SYSTEM_AUDIT_CALLBACK_ACE {
        header: AceHeader,
        sid: Sid,
        application_data: Vec<u8>,
        is_conditional: bool,
        _padding: Vec<u8>,
    },
    SYSTEM_MANDATORY_LABEL_ACE {
        header: AceHeader,
        sid: Sid,
        _padding: Vec<u8>,
    },
    SYSTEM_AUDIT_CALLBACK_OBJECT_ACE {
        header: AceHeader,
        object_type: Guid,
        inherited_object_type: Guid,
        sid: Sid,
        application_data: Vec<u8>,
        is_conditional: bool,
        _padding: Vec<u8>,
    },
    SYSTEM_RESOURCE_ATTRIBUTE_ACE {
        header: AceHeader,
        object_type: Guid,
        inherited_object_type: Guid,
        sid: Sid,
        application_data: Vec<u8>,
        is_conditional: bool,
        _padding: Vec<u8>,
    },
    SYSTEM_SCOPED_POLICY_ID_ACE {
        header: AceHeader,
        sid: Sid,
        _padding: Vec<u8>,
    },
}

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/628ebb1d-c509-4ea0-a10f-77ef97ca4586

Variants

ACCESS_ALLOWED_ACE

The ACCESS_ALLOWED_ACE structure defines an ACE for the discretionary access control list (DACL) that controls access to an object. An access-allowed ACE allows access to an object for a specific trustee identified by a security identifier (SID).

Fields

header: AceHeader

sid: Sid

The SID of a trustee.

_padding: Vec<u8>

ACCESS_ALLOWED_OBJECT_ACE

The ACCESS_ALLOWED_OBJECT_ACE structure defines an ACE that controls allowed access to an object, a property set, or property. The ACE contains a set of access rights, a GUID that identifies the type of object, and a SID that identifies the trustee to whom the system will grant access. The ACE also contains a GUID and a set of flags that control inheritance of the ACE by child objects.

Fields

header: AceHeader

object_type: Guid

A GUID that identifies a property set, property, extended right, or type of child object. The purpose of this GUID depends on the user rights specified in the Mask field. This field is valid only if the ACE_OBJECT_TYPE_PRESENT bit is set in the Flags field. Otherwise, the ObjectType field is ignored. For information on access rights and for a mapping of the control access rights to the corresponding GUID value that identifies each right, see [MS-ADTS] sections 5.1.3.2 and 5.1.3.2.1.

ACCESS_MASK bits are not mutually exclusive. Therefore, the ObjectType field can be set in an ACE with any ACCESS_MASK. If the AccessCheck algorithm calls this ACE and does not find an appropriate GUID, then that ACE will be ignored. For more information on access checks and object access, see [MS-ADTS] section 5.1.3.3.3.

inherited_object_type: Guid

A GUID that identifies the type of child object that can inherit the ACE. Inheritance is also controlled by the inheritance flags in the ACE_HEADER, as well as by any protection against inheritance placed on the child objects. This field is valid only if the ACE_INHERITED_OBJECT_TYPE_PRESENT bit is set in the Flags member. Otherwise, the InheritedObjectType field is ignored.

sid: Sid

The SID of a trustee. The length of the SID MUST be a multiple of 4.

_padding: Vec<u8>

ACCESS_DENIED_ACE

The ACCESS_DENIED_ACE structure defines an ACE for the DACL that controls access to an object. An access-denied ACE denies access to an object for a specific trustee identified by a SID.

Fields

header: AceHeader

sid: Sid

The SID of a trustee.

_padding: Vec<u8>

ACCESS_DENIED_OBJECT_ACE

The ACCESS_DENIED_OBJECT_ACE structure defines an ACE that controls denied access to an object, a property set, or a property. The ACE contains a set of access rights, a GUID that identifies the type of object, and a SID that identifies the trustee to whom the system will deny access. The ACE also contains a GUID and a set of flags that control inheritance of the ACE by child objects.

Fields

header: AceHeader

object_type: Guid

inherited_object_type: Guid

sid: Sid

The SID of a trustee.

_padding: Vec<u8>

ACCESS_ALLOWED_CALLBACK_ACE

The ACCESS_ALLOWED_CALLBACK_ACE structure defines an ACE for the DACL that controls access to an object. An access-allowed ACE allows access to an object for a specific trustee identified by a SID.

Fields

header: AceHeader

sid: Sid

The SID of a trustee.

application_data: Vec<u8>

Optional application data. The size of the application data is determined by the AceSize field of the ACE_HEADER.

is_conditional: bool

Conditional ACEs are a form of CALLBACK ACEs with a special format of the application data. A Conditional ACE allows a conditional expression to be evaluated when an access check (as specified in section 2.5.3.2) is performed.

_padding: Vec<u8>

ACCESS_DENIED_CALLBACK_ACE

The ACCESS_DENIED_CALLBACK_ACE structure defines an ACE for the DACL that controls access to an object. An access-denied ACE denies access to an object for a specific trustee identified by a SID.

Fields

header: AceHeader

sid: Sid

The SID of a trustee.

application_data: Vec<u8>

Optional application data. The size of the application data is determined by the AceSize field of the ACE_HEADER.

is_conditional: bool

Conditional ACEs are a form of CALLBACK ACEs with a special format of the application data. A Conditional ACE allows a conditional expression to be evaluated when an access check (as specified in section 2.5.3.2) is performed.

_padding: Vec<u8>

ACCESS_ALLOWED_CALLBACK_OBJECT_ACE

The ACCESS_ALLOWED_CALLBACK_OBJECT_ACE structure defines an ACE that controls allowed access to an object, property set, or property. The ACE contains a set of user rights, a GUID that identifies the type of object, and a SID that identifies the trustee to whom the system will grant access. The ACE also contains a GUID and a set of flags that control inheritance of the ACE by child objects.

Fields

header: AceHeader

object_type: Guid

A GUID that identifies a property set, property, extended right, or type of child object. The purpose of this GUID depends on the user rights specified in the Mask field. This field is valid only if the ACE _OBJECT_TYPE_PRESENT bit is set in the Flags field. Otherwise, the ObjectType field is ignored.

inherited_object_type: Guid

A GUID that identifies the type of child object that can inherit the ACE. Inheritance is also controlled by the inheritance flags in the ACE_HEADER, as well as by any protection against inheritance placed on the child objects. This field is valid only if the ACE_INHERITED_OBJECT_TYPE_PRESENT bit is set in the Flags member. Otherwise, the InheritedObjectType field is ignored.

sid: Sid

The SID of a trustee.

application_data: Vec<u8>

Optional application data. The size of the application data is determined by the AceSize field of the ACE_HEADER.

is_conditional: bool

Conditional ACEs are a form of CALLBACK ACEs with a special format of the application data. A Conditional ACE allows a conditional expression to be evaluated when an access check (as specified in section 2.5.3.2) is performed.

_padding: Vec<u8>

ACCESS_DENIED_CALLBACK_OBJECT_ACE

The ACCESS_DENIED_CALLBACK_OBJECT_ACE structure defines an ACE that controls denied access to an object, a property set, or property. The ACE contains a set of user rights, a GUID that identifies the type of object, and a SID that identifies the trustee to whom the system will deny access. The ACE also contains a GUID and a set of flags that control inheritance of the ACE by child objects.

Fields

header: AceHeader

object_type: Guid

A GUID that identifies a property set, property, extended right, or type of child object. The purpose of this GUID depends on the user rights specified in the Mask field. This field is valid only if the ACE _OBJECT_TYPE_PRESENT bit is set in the Flags field. Otherwise, the ObjectType field is ignored.

inherited_object_type: Guid

A GUID that identifies the type of child object that can inherit the ACE. Inheritance is also controlled by the inheritance flags in the ACE_HEADER, as well as by any protection against inheritance placed on the child objects. This field is valid only if the ACE_INHERITED_OBJECT_TYPE_PRESENT bit is set in the Flags member. Otherwise, the InheritedObjectType field is ignored.

sid: Sid

The SID of a trustee.

application_data: Vec<u8>

Optional application data. The size of the application data is determined by the AceSize field of the ACE_HEADER.

is_conditional: bool

Conditional ACEs are a form of CALLBACK ACEs with a special format of the application data. A Conditional ACE allows a conditional expression to be evaluated when an access check (as specified in section 2.5.3.2) is performed.

_padding: Vec<u8>

SYSTEM_AUDIT_ACE

The SYSTEM_AUDIT_ACE structure defines an access ACE for the system access control list (SACL) that specifies what types of access cause system-level notifications. A system-audit ACE causes an audit message to be logged when a specified trustee attempts to gain access to an object. The trustee is identified by a SID.

Fields

header: AceHeader

sid: Sid

The SID of a trustee. The length of the SID MUST be a multiple of 4. An access attempt of a kind specified by the Mask field by any trustee whose SID matches the Sid field causes the system to generate an audit message. If an application does not specify a SID for this field, audit messages are generated for the specified access rights for all trustees.

_padding: Vec<u8>

SYSTEM_AUDIT_OBJECT_ACE

The SYSTEM_AUDIT_OBJECT_ACE structure defines an ACE for a SACL. The ACE can audit access to an object or subobjects, such as property sets or properties. The ACE contains a set of user rights, a GUID that identifies the type of object or subobject, and a SID that identifies the trustee for whom the system will audit access. The ACE also contains a GUID and a set of flags that control inheritance of the ACE by child objects.

Fields

header: AceHeader

object_type: Guid

A GUID that identifies a property set, a property, an extended right, or a type of child object. The purpose of this GUID depends on the user rights specified in the Mask field. This field is valid only if the ACE_OBJECT_TYPE_PRESENT bit is set in the Flags field. Otherwise, the ObjectType field is ignored.

inherited_object_type: Guid

A GUID that identifies the type of child object that can inherit the ACE. Inheritance is also controlled by the inheritance flags in the ACE_HEADER, as well as by any protection against inheritance placed on the child objects. This field is valid only if the ACE_INHERITED_OBJECT_TYPE_PRESENT bit is set in the Flags member. Otherwise, the InheritedObjectType field is ignored.

sid: Sid

The SID of a trustee.

application_data: Vec<u8>

Optional application data. The size of the application data is determined by the AceSize field of the ACE_HEADER.

is_conditional: bool

_padding: Vec<u8>

SYSTEM_AUDIT_CALLBACK_ACE

The SYSTEM_AUDIT_CALLBACK_ACE structure defines an ACE for the SACL that specifies what types of access cause system-level notifications. A system-audit ACE causes an audit message to be logged when a specified trustee attempts to gain access to an object. The trustee is identified by a SID.

Fields

header: AceHeader

sid: Sid

The SID of a trustee. The length of the SID MUST be a multiple of 4. An access attempt of a kind specified by the Mask field by any trustee whose SID matches the Sid field causes the system to generate an audit message. If an application does not specify a SID for this field, audit messages are generated for the specified access rights for all trustees.

application_data: Vec<u8>

Optional application data. The size of the application data is determined by the AceSize field of the ACE_HEADER.

is_conditional: bool

Conditional ACEs are a form of CALLBACK ACEs with a special format of the application data. A Conditional ACE allows a conditional expression to be evaluated when an access check (as specified in section 2.5.3.2) is performed.

_padding: Vec<u8>

SYSTEM_MANDATORY_LABEL_ACE

The SYSTEM_MANDATORY_LABEL_ACE structure defines an ACE for the SACL that specifies the mandatory access level and policy for a securable object

Fields

header: AceHeader

sid: Sid

The SID of a trustee. The length of the SID MUST be a multiple of 4. The identifier authority of the SID must be SECURITY_MANDATORY_LABEL_AUTHORITY. The RID of the SID specifies the mandatory integrity level of the object associated with the SACL that contains this ACE. The RID must be one of the following values.

_padding: Vec<u8>

SYSTEM_AUDIT_CALLBACK_OBJECT_ACE

The SYSTEM_AUDIT_CALLBACK_OBJECT_ACE structure defines an ACE for a SACL. The ACE can audit access to an object or subobjects, such as property sets or properties. The ACE contains a set of user rights, a GUID that identifies the type of object or subobject, and a SID that identifies the trustee for whom the system will audit access. The ACE also contains a GUID and a set of flags that control inheritance of the ACE by child objects.

Fields

header: AceHeader

object_type: Guid

A GUID that identifies a property set, property, extended right, or type of child object. The purpose of this GUID depends on the user rights specified in the Mask field. This field is valid only if the ACE_OBJECT_TYPE_PRESENT bit is set in the Flags field. Otherwise, the ObjectType field is ignored.

inherited_object_type: Guid

A GUID that identifies the type of child object that can inherit the ACE. Inheritance is also controlled by the inheritance flags in the ACE_HEADER, as well as by any protection against inheritance placed on the child objects. This field is valid only if the ACE_INHERITED_OBJECT_TYPE_PRESENT bit is set in the Flags member. Otherwise, the InheritedObjectType field is ignored.

sid: Sid

The SID of a trustee.

application_data: Vec<u8>

Optional application data. The size of the application data is determined by the AceSize field of the ACE_HEADER.

is_conditional: bool

_padding: Vec<u8>

SYSTEM_RESOURCE_ATTRIBUTE_ACE

The SYSTEM_RESOURCE_ATTRIBUTE_ACE structure defines an ACE for the specification of a resource attribute associated with an object. A SYSTEM_RESOURCE_ATTRIBUTE_ACE is used in conditional ACEs in specifying access or audit policy for the resource.

Fields

header: AceHeader

object_type: Guid

inherited_object_type: Guid

sid: Sid

The SID corresponding to the Everyone SID (S-1-1-0) in binary form.

application_data: Vec<u8>

Data describing a resource attribute type, name, and value(s). This data MUST be encoded in CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 format as described in section 2.4.10.1

is_conditional: bool

_padding: Vec<u8>

SYSTEM_SCOPED_POLICY_ID_ACE

The SYSTEM_SCOPED_POLICY_ID_ACE structure defines an ACE for the purpose of applying a central access policy to the resource.

Fields

header: AceHeader

sid: Sid

A SID that identifies a central access policy. For a SYSTEM_SCOPED_POLICY_ID_ACE to be applicable on a resource, this SID MUST match a CAPID of a CentralAccessPolicy contained in the CentralAccessPoliciesList (as specified in [MS-GPCAP] section 3.2.1.1) of the machine on which the access evaluation will be performed.

_padding: Vec<u8>

Implementations

impl Ace

pub fn access_allowed(flags: AceFlags, mask: AccessMask, sid: Sid) -> Self

pub fn access_denied(flags: AceFlags, mask: AccessMask, sid: Sid) -> Self

pub fn access_allowed_object( flags: AceFlags, mask: AccessMask, object_type: Guid, inherited_object_type: Guid, sid: Sid, ) -> Self

pub fn access_denied_object( flags: AceFlags, mask: AccessMask, object_type: Guid, inherited_object_type: Guid, sid: Sid, ) -> Self

pub fn access_allowed_callback( flags: AceFlags, mask: AccessMask, sid: Sid, application_data: Vec<u8>, ) -> Self

pub fn access_denied_callback( flags: AceFlags, mask: AccessMask, sid: Sid, application_data: Vec<u8>, ) -> Self

pub fn access_allowed_object_callback( flags: AceFlags, mask: AccessMask, object_type: Guid, inherited_object_type: Guid, sid: Sid, application_data: Vec<u8>, ) -> Self

pub fn access_denied_object_callback( flags: AceFlags, mask: AccessMask, object_type: Guid, inherited_object_type: Guid, sid: Sid, application_data: Vec<u8>, ) -> Self

pub fn audit(flags: AceFlags, mask: AccessMask, sid: Sid) -> Self

pub fn audit_object( flags: AceFlags, mask: AccessMask, object_type: Guid, inherited_object_type: Guid, sid: Sid, application_data: Vec<u8>, ) -> Self

pub fn audit_callback( flags: AceFlags, mask: AccessMask, sid: Sid, application_data: Vec<u8>, ) -> Self

pub fn mandatory_label(flags: AceFlags, mask: AccessMask, sid: Sid) -> Self

pub fn audit_callback_object( flags: AceFlags, mask: AccessMask, object_type: Guid, inherited_object_type: Guid, sid: Sid, application_data: Vec<u8>, ) -> Self

pub fn resource_attribute( flags: AceFlags, mask: AccessMask, object_type: Guid, inherited_object_type: Guid, sid: Sid, application_data: Vec<u8>, ) -> Self

pub fn scoped_policy_id(flags: AceFlags, mask: AccessMask, sid: Sid) -> Self

Trait Implementations

impl BinRead for Ace

type Args<'__binrw_generated_args_lifetime> = ()

The type used for the args parameter of read_args() and read_options().

fn read_options<R: Read + Seek>( __binrw_generated_var_reader: &mut R, __binrw_generated_var_endian: Endian, __binrw_generated_var_arguments: Self::Args<'_>, ) -> BinResult<Self>

Read Self from the reader using the given Endian and arguments.

fn read_be<R>(reader: &mut R) -> Result<Self, Error>

where R: Read + Seek, Self::Args<'a>: for<'a> Required,

Read Self from the reader using default arguments and assuming big-endian byte order.

fn read_le<R>(reader: &mut R) -> Result<Self, Error>

where R: Read + Seek, Self::Args<'a>: for<'a> Required,

Read Self from the reader using default arguments and assuming little-endian byte order.

fn read_ne<R>(reader: &mut R) -> Result<Self, Error>

where R: Read + Seek, Self::Args<'a>: for<'a> Required,

Read T from the reader assuming native-endian byte order.

fn read_be_args<R>(reader: &mut R, args: Self::Args<'_>) -> Result<Self, Error>

where R: Read + Seek,

Read Self from the reader, assuming big-endian byte order, using the given arguments.

fn read_le_args<R>(reader: &mut R, args: Self::Args<'_>) -> Result<Self, Error>

where R: Read + Seek,

Read Self from the reader, assuming little-endian byte order, using the given arguments.

fn read_ne_args<R>(reader: &mut R, args: Self::Args<'_>) -> Result<Self, Error>

where R: Read + Seek,

Read T from the reader, assuming native-endian byte order, using the given arguments.

impl BinWrite for Ace

type Args<'__binrw_generated_args_lifetime> = ()

The type used for the args parameter of write_args() and write_options().

fn write_options<W: Write + Seek>( &self, __binrw_generated_var_writer: &mut W, __binrw_generated_var_endian: Endian, __binrw_generated_var_arguments: Self::Args<'_>, ) -> BinResult<()>

Write Self to the writer using the given Endian and arguments.

fn write_be<W>(&self, writer: &mut W) -> Result<(), Error>

where W: Write + Seek, Self::Args<'a>: for<'a> Required,

Write Self to the writer assuming big-endian byte order.

fn write_le<W>(&self, writer: &mut W) -> Result<(), Error>

where W: Write + Seek, Self::Args<'a>: for<'a> Required,

Write Self to the writer assuming little-endian byte order.

fn write_be_args<W>( &self, writer: &mut W, args: Self::Args<'_>, ) -> Result<(), Error>

where W: Write + Seek,

Write Self to the writer, assuming big-endian byte order, using the given arguments.

fn write_le_args<W>( &self, writer: &mut W, args: Self::Args<'_>, ) -> Result<(), Error>

where W: Write + Seek,

Write Self to the writer, assuming little-endian byte order, using the given arguments.

impl Debug for Ace

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for Ace

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for Ace

fn eq(&self, other: &Ace) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl RawSize for Ace

fn raw_size(&self) -> u16

impl Eq for Ace

impl StructuralPartialEq for Ace