SeAccessCheck routine

The SeAccessCheck routine determines whether the requested access rights can be granted to an object protected by a security descriptor and an object owner.

Syntax


BOOLEAN SeAccessCheck(
  _In_  PSECURITY_DESCRIPTOR      SecurityDescriptor,
  _In_  PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext,
  _In_  BOOLEAN                   SubjectContextLocked,
  _In_  ACCESS_MASK               DesiredAccess,
  _In_  ACCESS_MASK               PreviouslyGrantedAccess,
  _Out_ PPRIVILEGE_SET            *Privileges,
  _In_  PGENERIC_MAPPING          GenericMapping,
  _In_  KPROCESSOR_MODE           AccessMode,
  _Out_ PACCESS_MASK              GrantedAccess,
  _Out_ PNTSTATUS                 AccessStatus
);

Parameters

SecurityDescriptor [in]

Pointer to the SECURITY_DESCRIPTOR structure that describes the security descriptor protecting the object being accessed.

SubjectSecurityContext [in]

Pointer to the SECURITY_SUBJECT_CONTEXT structure that specifies the subject's captured security context.

SubjectContextLocked [in]

Indicates whether the user's subject context is locked, so that it does not have to be locked again.

DesiredAccess [in]

Specifies the ACCESS_MASK bitmask for the access rights that the caller is attempting to acquire. If the caller sets the MAXIMUM_ALLOWED bit, the routine performs all DACL checks. However, the routine does not do any privilege checks, unless the caller specifically requests them by setting the ACCESS_SYSTEM_SECURITY or WRITE_OWNER bits.

PreviouslyGrantedAccess [in]

Specifies the ACCESS_MASK bitmask of access rights already granted, such as access rights granted as a result of holding a privilege.

Privileges [out]

Pointer to a caller-supplied variable to be set to the address of the PRIVILEGE_SET structure that will be used as part of the access validation, or this parameter can be NULL. The returned buffer, if any, must be released by the caller with SeFreePrivileges.

GenericMapping [in]

Pointer to the GENERIC_MAPPING structure associated with this object type. This value specifies the specific access rights implied by each GENERIC_XXX access right.

AccessMode [in]

Specifies the access mode to be used in the check, either UserMode or KernelMode.

GrantedAccess [out]

Pointer to a returned access mask indicating the granted access. If the caller specifies MAXIMUM_ALLOWED, and the DACL in SecurityDescriptor is NULL, then the routine returns GENERIC_ALL plus any additional access the caller explicitly requests.

AccessStatus [out]

Pointer to the status value indicating why access was denied.

Return value

If access is allowed, SeAccessCheck returns TRUE.

Remarks

SeAccessCheck might perform privilege tests for SeTakeOwnershipPrivilege and SeSecurityPrivilege, depending on the accesses being requested. It might perform additional privilege testing in future releases of the operating system.

This routine also might check whether the caller is the owner of the object in order to grant WRITE_DAC or READ_CONTROL access.

If this routine returns FALSE, the caller should use the returned AccessStatus as its return value. That is, the caller should avoid hardcoding a return value of STATUS_ACCESS_DENIED or any other specific STATUS_XXX value.

Requirements

Target platform

Universal

Version

Available in Windows 2000 and later versions of Windows.

Header

Wdm.h (include Wdm.h, Ntddk.h, or Ntifs.h)

Library

NtosKrnl.lib

DLL

NtosKrnl.exe

IRQL

PASSIVE_LEVEL

DDI compliance rules

PowerIrpDDis, HwStorPortProhibitedDDIs

See also

SeFreePrivileges
IoGetFileObjectGenericMapping
SeValidSecurityDescriptor
ACCESS_MASK
GENERIC_MAPPING
PRIVILEGE_SET
SECURITY_DESCRIPTOR
SECURITY_SUBJECT_CONTEXT

 

 

Send comments about this topic to Microsoft

Show: