[cifs-protocol] [EXTERNAL] [MS-DTYP] conditional ACE SDDL sid arrays - TrackingID#2212170040000207
Jeff McCashland (He/him)
jeffm at microsoft.com
Sat Dec 17 04:17:08 UTC 2022
[DocHelp to BCC, support on CC, SR ID on Subject]
Hi Douglas,
Thank you for the question. We have created SR 2212170040000207 to track this issue. One of our engineers will respond soon to assist.
Best regards,
Jeff McCashland (He/him) | Senior Escalation Engineer | Microsoft Protocol Open Specifications Team
Phone: +1 (425) 703-8300 x38300 | Hours: 9am-5pm | Time zone: (UTC-08:00) Pacific Time (US and Canada)
Local country phone number found here: http://support.microsoft.com/globalenglish | Extension 1138300
-----Original Message-----
From: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Sent: Friday, December 16, 2022 6:02 PM
To: Interoperability Documentation Help <dochelp at microsoft.com>; cifs-protocol at lists.samba.org
Subject: [EXTERNAL] [MS-DTYP] conditional ACE SDDL sid arrays
hi Dochelp,
I am working on conditional ACES for Samba. The documentation is mostly very clear, but I have one question prompted by example 3 in 2.4.4.19, which deals with the encoding of this SDDL snippet:
> (@User.clearanceLevel>=@Resource.requiredClearance) ||
> (Member_of{SID(BA)})
where the 'Member_of{SID(BA)}' becomes a composite token containing the single SID, followed by the Member_of operator. So far this makes sense.
However, earlier, in 2.4.4.17.6 ('Relational Operator Tokens') we have
> The operand type MUST be either a SID literal, or a composite, each of
> whose elements is a SID literal.
which is also clear. But the ABNF in 2.5.1.1 ('Syntax') look like
> memberof-op = ( "Member_of" / ... ) wspace sid-array
and sid-array is
> sid-array = literal-SID [wspace] / "{" [wspace] literal-SID [wspace] *( "," [wspace] literal-SID [wspace]) "}"
so *syntactically*, this (a literal-SID without the curly brackets)
(Member_of SID(BA))
would also refer to a sid-array. Thus here's the question: would this last form be compiled as a composite value (as implied by "sid-array") or would it be a solitary SID?
And if doesn't result in a solitary SID, how would such a SID be represented in SDDL, or is that not possible?
The wider question is whether, for valid conditonal aces, an ACE -> SDDL -> ACE cycle should always end up at the same point as the original.
As a side-note, the example omits the wspace in memberof-op. I suspect the ABNF is inexact, but it might be fiddly to fix because I don't know if '[wspace]'
would work for the form without {}.
cheers,
Douglas
More information about the cifs-protocol
mailing list