/*
* Process Hacker -
* known access control entry
* (access allowed, access denied, system alarm, system audit)
*
* Copyright (C) 2009 wj32
*
* This file is part of Process Hacker.
*
* Process Hacker is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Process Hacker is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with Process Hacker. If not, see .
*/
using System;
using ProcessHacker.Native.Api;
namespace ProcessHacker.Native.Security.AccessControl
{
public sealed class KnownAce : Ace
{
private int _mask;
private Sid _sid;
public KnownAce(AceType type, AceFlags flags, int mask, Sid sid)
{
if (
type != AceType.AccessAllowed &&
type != AceType.AccessDenied &&
type != AceType.SystemAlarm &&
type != AceType.SystemAudit
)
throw new ArgumentException("Invalid ACE type.");
this.MemoryRegion = new MemoryAlloc(
KnownAceStruct.SizeOf - // known ace struct size
sizeof(int) + // minus SidStart field
sid.Length // plus SID length
);
// Initialize the ACE (minus the SID).
KnownAceStruct knownAce = new KnownAceStruct
{
Mask = mask,
Header =
{
AceType = type,
AceFlags = flags,
AceSize = (ushort)this.MemoryRegion.Size
}
};
// Write the ACE to memory.
this.MemoryRegion.WriteStruct(knownAce);
// Write the SID.
this.MemoryRegion.WriteMemory(Win32.KnownAceSidStartOffset.ToInt32(), sid, sid.Length);
// Update the cached info.
this.Read();
}
public KnownAce(IntPtr memory)
: base(memory)
{ }
public int Mask
{
get { return _mask; }
}
public Sid Sid
{
get { return _sid; }
}
protected override void Read()
{
var knownAce = this.MemoryRegion.ReadStruct();
_mask = knownAce.Mask;
_sid = Sid.FromPointer(this.Memory.Increment(Win32.KnownAceSidStartOffset));
base.Read();
}
}
}