RtlAddAccessAllowedAceEx routine

The RtlAddAccessAllowedAceEx routine adds an access-allowed access control entry (ACE) with inheritance ACE flags to an access control list (ACL). The access is granted to the specified security identifier (SID).

Syntax


NTSTATUS RtlAddAccessAllowedAceEx(
  _Inout_ PACL        Acl,
  _In_    ULONG       AceRevision,
  _In_    ULONG       AceFlags,
  _In_    ACCESS_MASK AccessMask,
  _In_    PSID        Sid
);

Parameters

Acl [in, out]

A pointer to a caller-allocated buffer that contains the ACL to be modified. RtlAddAccessAllowedAceEx adds an access-allowed ACE to the end of this ACL. The ACE is in the form of an ACCESS_ALLOWED_ACE structure.

AceRevision [in]

ACL revision level of the ACE to be added. This value can be ACL_REVISION or ACL_REVISION_DS. It must be ACL_REVISION_DS if the ACL contains an object-specific ACE.

AceFlags [in]

Bitmask specifying the inherit flags of the ACE to be added.

AccessMask [in]

A bitmask of one or more ACCESS_MASK flags that specify the access rights to be granted to the specified SID. For more information, see the description of the DesiredAccess parameter of ZwCreateFile.

Sid [in]

A pointer to the SID structure that represents a user, group, or logon account that is being granted access.

Return value

RtlAddAccessAllowedAceEx can return one of the following values:

Return codeDescription
STATUS_SUCCESS

The ACE was successfully added.

STATUS_ALLOTTED_SPACE_EXCEEDED

A new ACE does not fit into the ACL. A larger ACL buffer is required. For more information about how to calculate the size of an ACL, see RtlCreateAcl.

STATUS_INVALID_ACL

The specified ACL is not correctly formed.

STATUS_INVALID_PARAMETER

The AceFlags parameter was invalid.

STATUS_INVALID_SID

The specified SID structure is not structurally valid.

STATUS_REVISION_MISMATCH

The specified AceRevision is not known or is not compatible with that of the ACL.

 

Remarks

Unlike RtlAddAccessAllowedAce, this routine sets the inheritance ACE flags.

For more information about security and access control, see the documentation about these topics in the Microsoft Windows SDK, such as:

Requirements

Target platform

Universal

Version

This routine is available in Microsoft Windows 2000 and later Windows operating systems.

Header

Ntifs.h (include Ntifs.h or FltKernel.h)

Library

NtosKrnl.lib

DLL

NtosKrnl.exe

IRQL

<= APC_LEVEL

See also

ACCESS_ALLOWED_ACE
ACCESS_MASK
ACE
ACL
RtlCreateAcl
RtlCreateSecurityDescriptor
RtlCreateSecurityDescriptorRelative
RtlLengthSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlValidSecurityDescriptor
SeAssignSecurity
SID
ZwCreateFile

 

 

Send comments about this topic to Microsoft

Show: