SECURITY_INFORMATION

The SECURITY_INFORMATION data type identifies the object-related security information being set or queried. This security information includes: 


typedef DWORD SECURITY_INFORMATION, *PSECURITY_INFORMATION;

Remarks

Some SECURITY_INFORMATION members work only with the SetNamedSecurityInfo function. These members are not returned in the structure returned by other security functions such as GetNamedSecurityInfo or ConvertStringSecurityDescriptorToSecurityDescriptor.

Each item of security information is designated by a bit flag. Each bit flag can be one of the following values.

ValueMeaning
DACL_SECURITY_INFORMATIONThe DACL of the object is being referenced.
LABEL_SECURITY_INFORMATIONThe mandatory integrity label is being referenced.
GROUP_SECURITY_INFORMATIONThe primary group identifier of the object is being referenced.
OWNER_SECURITY_INFORMATIONThe owner identifier of the object is being referenced.
PROTECTED_DACL_SECURITY_INFORMATION The DACL cannot inherit access control entries (ACEs).
PROTECTED_SACL_SECURITY_INFORMATION The SACL cannot inherit ACEs.
SACL_SECURITY_INFORMATIONThe SACL of the object is being referenced.
UNPROTECTED_DACL_SECURITY_INFORMATION The DACL inherits ACEs from the parent object.
UNPROTECTED_SACL_SECURITY_INFORMATION The SACL inherits ACEs from the parent object.

 

Requirements

Minimum supported clientWindows 2000 Professional
Minimum supported serverWindows 2000 Server
HeaderWinnt.h (include Windows.h)

See Also

Access Control
Basic Access Control Structures
ConvertStringSecurityDescriptorToSecurityDescriptor
GetFileSecurity
GetKernelObjectSecurity
GetNamedSecurityInfo
GetPrivateObjectSecurity
GetUserObjectSecurity
SetFileSecurity
SetKernelObjectSecurity
SetNamedSecurityInfo
SetPrivateObjectSecurity
SetUserObjectSecurity

Send comments about this topic to Microsoft

Build date: 9/11/2009

Tags :


Community Content

Gideon7
Integrity ACEs in the SACL
Windows Vista (or later) stores the mandatory integrity label ACEs (if any) in the SACL. To view or manipulate the integrity ACEs requires that the flag LABEL_SECURITY_INFORMATION be set for both the GetXxxSecurity and the SetXxxSecurity functions. Without the flag the GetXxxSecurity functions will elide the mandatory integrity label ACEs from the SACL of the returned security descriptor.

Gideon7
Metaflags for protected ACLs

PROTECTED_DACL_SECURITY_INFORMATION and PROTECTED_SACL_SECURITY_INFORMATION are metaflags that confirm that you want to set the flag SE_DACL_PROTECTED (0x1000) or SE_SACL_PROTECTED (0x2000) in the security descriptor when calling the high-level security APIs SetNamedSecurityInfo or SetSecurityInfo. In a similar fashion, the metaflags UNPROTECTED_DACL_SECURITY_INFORMATION and UNPROTECTED_SACL_SECURITY_INFORMATION indicate that you want to clear the respective flags in the security descriptor. The low-level security APIs ignore the metaflags.


Page view tracker