[cifs-protocol] [EXTERNAL] [MS-DTYP] no SDDL for ACCESS_DENIED_CALLBACK_OBJECT_ACE? - TrackingID#2308250010010895
tomjebo at microsoft.com
Fri Aug 25 17:29:19 UTC 2023
[dochelp to bcc]
[support mail to cc]
Thanks for your request regarding MS-DTYP ACCESS_DENIED_CALLBACK_OBJECT_ACE. One of the Open Specifications team members will respond to assist you. In the meantime, we’ve created case 2308250010010895 to track this request. Please leave the case number in the subject when communicating with our team about this request.
Microsoft Open Specifications Support
From: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Sent: Thursday, August 24, 2023 5:36 PM
To: Interoperability Documentation Help <dochelp at microsoft.com>; cifs-protocol at lists.samba.org
Subject: [EXTERNAL] [MS-DTYP] no SDDL for ACCESS_DENIED_CALLBACK_OBJECT_ACE?
According to [MS-DTYP], there is no way to express a ACCESS_DENIED_CALLBACK_OBJECT_ACE in SDDL.
I just want to confirm that.
If ACCESS_ALLOWED_CALLBACK_OBJECT_ACE has type "ZA", symmetry would propose "ZD"
for the denied counterpart, but no.
I have tried mutating a ACCESS_ALLOWED_CALLBACK_OBJECT_ACE to flip the ace type, but I can't get it to encode as SDDL.
So I suppose it is the case that in the places where we transmit security descriptors as SDDL, we just can't transmit these ones.
More information about the cifs-protocol