Crate windows_sddl 

windows-sddl

A pure-Rust, no-FFI parser and builder for the Windows self-relative SECURITY_DESCRIPTOR blob (MS-DTYP §2.4.6) — the binary form stored in nTSecurityDescriptor, returned over LDAP, and found in registry hives and backup formats. It works cross-platform against raw bytes: no windows crate, no OS calls.

It also ships the Sid/Guid types and a table of Active-Directory extended-right GUIDs (rights) so a generic-looking ACE mask can be resolved into a concrete right (DCSync, Shadow Credentials, RBCD, cert enrollment, …).

Example

use windows_sddl::{parse, AccessMask};

// A self-relative SD with one ACCESS_ALLOWED ACE granting full control to a trustee:
let sd_bytes = windows_sddl::build_rbcd_sd(&windows_sddl::Sid::parse("S-1-5-21-1-2-3-1104").unwrap());
let sd = parse(&sd_bytes).unwrap();
let ace = &sd.dacl.unwrap().aces[0];
assert!(ace.is_allow());
assert!(ace.mask.contains(AccessMask::WRITE_DAC));

Uses

• DFIR / forensics: read ACLs out of offline hives or LDAP dumps without a Windows host.
• ACL auditing: enumerate who has WriteDacl/WriteOwner/GenericAll on an object.
• Backup / migration tooling: inspect or rebuild security descriptors portably.

Re-exports

pub use sid::Guid;

pub use sid::Sid;

Modules

rights

AD control-access-right / property-set GUIDs. When an object ACE carries one of these in object_type, a generic-looking mask becomes a concrete attack primitive.

sid

SID / GUID types per MS-DTYP. No FFI — pure binary + string handling, so this works cross-platform against raw bytes (LDAP objectSid, registry hives, backup formats).

Structs

AccessMask

ACCESS_MASK bits (MS-DTYP §2.4.3 + AD-specific extended rights).

Ace

Acl

SecurityDescriptor

Enums

AceType

ACE header type byte (MS-DTYP §2.4.4). Allow/deny + their object variants; everything else is preserved as AceType::Other.

SddlError

Functions

build_rbcd_sd

Build a msDS-AllowedToActOnBehalfOfOtherIdentity-style security descriptor granting trustee full control (the RBCD primitive): a self-relative SD with one allow ACE, owner BUILTIN\Administrators. Handy for tests and for tooling that needs to write an SD.

parse

Parse a self-relative SECURITY_DESCRIPTOR. Offsets are from the start of b. Never panics on malformed / hostile input — returns SddlError instead.

sid_to_bytes

Serialize a SID to its binary (objectSid) form. (Convenience alias for Sid::to_bytes.)