cubefs

1
// Copyright 2012 The Go Authors. All rights reserved.
2
// Use of this source code is governed by a BSD-style
3
// license that can be found in the LICENSE file.
4

5
package windows
6

7
import (
8
	"syscall"
9
	"unsafe"
10

11
	"golang.org/x/sys/internal/unsafeheader"
12
)
13

14
const (
15
	NameUnknown          = 0
16
	NameFullyQualifiedDN = 1
17
	NameSamCompatible    = 2
18
	NameDisplay          = 3
19
	NameUniqueId         = 6
20
	NameCanonical        = 7
21
	NameUserPrincipal    = 8
22
	NameCanonicalEx      = 9
23
	NameServicePrincipal = 10
24
	NameDnsDomain        = 12
25
)
26

27
// This function returns 1 byte BOOLEAN rather than the 4 byte BOOL.
28
// http://blogs.msdn.com/b/drnick/archive/2007/12/19/windows-and-upn-format-credentials.aspx
29
//sys	TranslateName(accName *uint16, accNameFormat uint32, desiredNameFormat uint32, translatedName *uint16, nSize *uint32) (err error) [failretval&0xff==0] = secur32.TranslateNameW
30
//sys	GetUserNameEx(nameFormat uint32, nameBuffre *uint16, nSize *uint32) (err error) [failretval&0xff==0] = secur32.GetUserNameExW
31

32
// TranslateAccountName converts a directory service
33
// object name from one format to another.
34
func TranslateAccountName(username string, from, to uint32, initSize int) (string, error) {
35
	u, e := UTF16PtrFromString(username)
36
	if e != nil {
37
		return "", e
38
	}
39
	n := uint32(50)
40
	for {
41
		b := make([]uint16, n)
42
		e = TranslateName(u, from, to, &b[0], &n)
43
		if e == nil {
44
			return UTF16ToString(b[:n]), nil
45
		}
46
		if e != ERROR_INSUFFICIENT_BUFFER {
47
			return "", e
48
		}
49
		if n <= uint32(len(b)) {
50
			return "", e
51
		}
52
	}
53
}
54

55
const (
56
	// do not reorder
57
	NetSetupUnknownStatus = iota
58
	NetSetupUnjoined
59
	NetSetupWorkgroupName
60
	NetSetupDomainName
61
)
62

63
type UserInfo10 struct {
64
	Name       *uint16
65
	Comment    *uint16
66
	UsrComment *uint16
67
	FullName   *uint16
68
}
69

70
//sys	NetUserGetInfo(serverName *uint16, userName *uint16, level uint32, buf **byte) (neterr error) = netapi32.NetUserGetInfo
71
//sys	NetGetJoinInformation(server *uint16, name **uint16, bufType *uint32) (neterr error) = netapi32.NetGetJoinInformation
72
//sys	NetApiBufferFree(buf *byte) (neterr error) = netapi32.NetApiBufferFree
73

74
const (
75
	// do not reorder
76
	SidTypeUser = 1 + iota
77
	SidTypeGroup
78
	SidTypeDomain
79
	SidTypeAlias
80
	SidTypeWellKnownGroup
81
	SidTypeDeletedAccount
82
	SidTypeInvalid
83
	SidTypeUnknown
84
	SidTypeComputer
85
	SidTypeLabel
86
)
87

88
type SidIdentifierAuthority struct {
89
	Value [6]byte
90
}
91

92
var (
93
	SECURITY_NULL_SID_AUTHORITY        = SidIdentifierAuthority{[6]byte{0, 0, 0, 0, 0, 0}}
94
	SECURITY_WORLD_SID_AUTHORITY       = SidIdentifierAuthority{[6]byte{0, 0, 0, 0, 0, 1}}
95
	SECURITY_LOCAL_SID_AUTHORITY       = SidIdentifierAuthority{[6]byte{0, 0, 0, 0, 0, 2}}
96
	SECURITY_CREATOR_SID_AUTHORITY     = SidIdentifierAuthority{[6]byte{0, 0, 0, 0, 0, 3}}
97
	SECURITY_NON_UNIQUE_AUTHORITY      = SidIdentifierAuthority{[6]byte{0, 0, 0, 0, 0, 4}}
98
	SECURITY_NT_AUTHORITY              = SidIdentifierAuthority{[6]byte{0, 0, 0, 0, 0, 5}}
99
	SECURITY_MANDATORY_LABEL_AUTHORITY = SidIdentifierAuthority{[6]byte{0, 0, 0, 0, 0, 16}}
100
)
101

102
const (
103
	SECURITY_NULL_RID                   = 0
104
	SECURITY_WORLD_RID                  = 0
105
	SECURITY_LOCAL_RID                  = 0
106
	SECURITY_CREATOR_OWNER_RID          = 0
107
	SECURITY_CREATOR_GROUP_RID          = 1
108
	SECURITY_DIALUP_RID                 = 1
109
	SECURITY_NETWORK_RID                = 2
110
	SECURITY_BATCH_RID                  = 3
111
	SECURITY_INTERACTIVE_RID            = 4
112
	SECURITY_LOGON_IDS_RID              = 5
113
	SECURITY_SERVICE_RID                = 6
114
	SECURITY_LOCAL_SYSTEM_RID           = 18
115
	SECURITY_BUILTIN_DOMAIN_RID         = 32
116
	SECURITY_PRINCIPAL_SELF_RID         = 10
117
	SECURITY_CREATOR_OWNER_SERVER_RID   = 0x2
118
	SECURITY_CREATOR_GROUP_SERVER_RID   = 0x3
119
	SECURITY_LOGON_IDS_RID_COUNT        = 0x3
120
	SECURITY_ANONYMOUS_LOGON_RID        = 0x7
121
	SECURITY_PROXY_RID                  = 0x8
122
	SECURITY_ENTERPRISE_CONTROLLERS_RID = 0x9
123
	SECURITY_SERVER_LOGON_RID           = SECURITY_ENTERPRISE_CONTROLLERS_RID
124
	SECURITY_AUTHENTICATED_USER_RID     = 0xb
125
	SECURITY_RESTRICTED_CODE_RID        = 0xc
126
	SECURITY_NT_NON_UNIQUE_RID          = 0x15
127
)
128

129
// Predefined domain-relative RIDs for local groups.
130
// See https://msdn.microsoft.com/en-us/library/windows/desktop/aa379649(v=vs.85).aspx
131
const (
132
	DOMAIN_ALIAS_RID_ADMINS                         = 0x220
133
	DOMAIN_ALIAS_RID_USERS                          = 0x221
134
	DOMAIN_ALIAS_RID_GUESTS                         = 0x222
135
	DOMAIN_ALIAS_RID_POWER_USERS                    = 0x223
136
	DOMAIN_ALIAS_RID_ACCOUNT_OPS                    = 0x224
137
	DOMAIN_ALIAS_RID_SYSTEM_OPS                     = 0x225
138
	DOMAIN_ALIAS_RID_PRINT_OPS                      = 0x226
139
	DOMAIN_ALIAS_RID_BACKUP_OPS                     = 0x227
140
	DOMAIN_ALIAS_RID_REPLICATOR                     = 0x228
141
	DOMAIN_ALIAS_RID_RAS_SERVERS                    = 0x229
142
	DOMAIN_ALIAS_RID_PREW2KCOMPACCESS               = 0x22a
143
	DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS           = 0x22b
144
	DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS      = 0x22c
145
	DOMAIN_ALIAS_RID_INCOMING_FOREST_TRUST_BUILDERS = 0x22d
146
	DOMAIN_ALIAS_RID_MONITORING_USERS               = 0x22e
147
	DOMAIN_ALIAS_RID_LOGGING_USERS                  = 0x22f
148
	DOMAIN_ALIAS_RID_AUTHORIZATIONACCESS            = 0x230
149
	DOMAIN_ALIAS_RID_TS_LICENSE_SERVERS             = 0x231
150
	DOMAIN_ALIAS_RID_DCOM_USERS                     = 0x232
151
	DOMAIN_ALIAS_RID_IUSERS                         = 0x238
152
	DOMAIN_ALIAS_RID_CRYPTO_OPERATORS               = 0x239
153
	DOMAIN_ALIAS_RID_CACHEABLE_PRINCIPALS_GROUP     = 0x23b
154
	DOMAIN_ALIAS_RID_NON_CACHEABLE_PRINCIPALS_GROUP = 0x23c
155
	DOMAIN_ALIAS_RID_EVENT_LOG_READERS_GROUP        = 0x23d
156
	DOMAIN_ALIAS_RID_CERTSVC_DCOM_ACCESS_GROUP      = 0x23e
157
)
158

159
//sys	LookupAccountSid(systemName *uint16, sid *SID, name *uint16, nameLen *uint32, refdDomainName *uint16, refdDomainNameLen *uint32, use *uint32) (err error) = advapi32.LookupAccountSidW
160
//sys	LookupAccountName(systemName *uint16, accountName *uint16, sid *SID, sidLen *uint32, refdDomainName *uint16, refdDomainNameLen *uint32, use *uint32) (err error) = advapi32.LookupAccountNameW
161
//sys	ConvertSidToStringSid(sid *SID, stringSid **uint16) (err error) = advapi32.ConvertSidToStringSidW
162
//sys	ConvertStringSidToSid(stringSid *uint16, sid **SID) (err error) = advapi32.ConvertStringSidToSidW
163
//sys	GetLengthSid(sid *SID) (len uint32) = advapi32.GetLengthSid
164
//sys	CopySid(destSidLen uint32, destSid *SID, srcSid *SID) (err error) = advapi32.CopySid
165
//sys	AllocateAndInitializeSid(identAuth *SidIdentifierAuthority, subAuth byte, subAuth0 uint32, subAuth1 uint32, subAuth2 uint32, subAuth3 uint32, subAuth4 uint32, subAuth5 uint32, subAuth6 uint32, subAuth7 uint32, sid **SID) (err error) = advapi32.AllocateAndInitializeSid
166
//sys	createWellKnownSid(sidType WELL_KNOWN_SID_TYPE, domainSid *SID, sid *SID, sizeSid *uint32) (err error) = advapi32.CreateWellKnownSid
167
//sys	isWellKnownSid(sid *SID, sidType WELL_KNOWN_SID_TYPE) (isWellKnown bool) = advapi32.IsWellKnownSid
168
//sys	FreeSid(sid *SID) (err error) [failretval!=0] = advapi32.FreeSid
169
//sys	EqualSid(sid1 *SID, sid2 *SID) (isEqual bool) = advapi32.EqualSid
170
//sys	getSidIdentifierAuthority(sid *SID) (authority *SidIdentifierAuthority) = advapi32.GetSidIdentifierAuthority
171
//sys	getSidSubAuthorityCount(sid *SID) (count *uint8) = advapi32.GetSidSubAuthorityCount
172
//sys	getSidSubAuthority(sid *SID, index uint32) (subAuthority *uint32) = advapi32.GetSidSubAuthority
173
//sys	isValidSid(sid *SID) (isValid bool) = advapi32.IsValidSid
174

175
// The security identifier (SID) structure is a variable-length
176
// structure used to uniquely identify users or groups.
177
type SID struct{}
178

179
// StringToSid converts a string-format security identifier
180
// SID into a valid, functional SID.
181
func StringToSid(s string) (*SID, error) {
182
	var sid *SID
183
	p, e := UTF16PtrFromString(s)
184
	if e != nil {
185
		return nil, e
186
	}
187
	e = ConvertStringSidToSid(p, &sid)
188
	if e != nil {
189
		return nil, e
190
	}
191
	defer LocalFree((Handle)(unsafe.Pointer(sid)))
192
	return sid.Copy()
193
}
194

195
// LookupSID retrieves a security identifier SID for the account
196
// and the name of the domain on which the account was found.
197
// System specify target computer to search.
198
func LookupSID(system, account string) (sid *SID, domain string, accType uint32, err error) {
199
	if len(account) == 0 {
200
		return nil, "", 0, syscall.EINVAL
201
	}
202
	acc, e := UTF16PtrFromString(account)
203
	if e != nil {
204
		return nil, "", 0, e
205
	}
206
	var sys *uint16
207
	if len(system) > 0 {
208
		sys, e = UTF16PtrFromString(system)
209
		if e != nil {
210
			return nil, "", 0, e
211
		}
212
	}
213
	n := uint32(50)
214
	dn := uint32(50)
215
	for {
216
		b := make([]byte, n)
217
		db := make([]uint16, dn)
218
		sid = (*SID)(unsafe.Pointer(&b[0]))
219
		e = LookupAccountName(sys, acc, sid, &n, &db[0], &dn, &accType)
220
		if e == nil {
221
			return sid, UTF16ToString(db), accType, nil
222
		}
223
		if e != ERROR_INSUFFICIENT_BUFFER {
224
			return nil, "", 0, e
225
		}
226
		if n <= uint32(len(b)) {
227
			return nil, "", 0, e
228
		}
229
	}
230
}
231

232
// String converts SID to a string format suitable for display, storage, or transmission.
233
func (sid *SID) String() string {
234
	var s *uint16
235
	e := ConvertSidToStringSid(sid, &s)
236
	if e != nil {
237
		return ""
238
	}
239
	defer LocalFree((Handle)(unsafe.Pointer(s)))
240
	return UTF16ToString((*[256]uint16)(unsafe.Pointer(s))[:])
241
}
242

243
// Len returns the length, in bytes, of a valid security identifier SID.
244
func (sid *SID) Len() int {
245
	return int(GetLengthSid(sid))
246
}
247

248
// Copy creates a duplicate of security identifier SID.
249
func (sid *SID) Copy() (*SID, error) {
250
	b := make([]byte, sid.Len())
251
	sid2 := (*SID)(unsafe.Pointer(&b[0]))
252
	e := CopySid(uint32(len(b)), sid2, sid)
253
	if e != nil {
254
		return nil, e
255
	}
256
	return sid2, nil
257
}
258

259
// IdentifierAuthority returns the identifier authority of the SID.
260
func (sid *SID) IdentifierAuthority() SidIdentifierAuthority {
261
	return *getSidIdentifierAuthority(sid)
262
}
263

264
// SubAuthorityCount returns the number of sub-authorities in the SID.
265
func (sid *SID) SubAuthorityCount() uint8 {
266
	return *getSidSubAuthorityCount(sid)
267
}
268

269
// SubAuthority returns the sub-authority of the SID as specified by
270
// the index, which must be less than sid.SubAuthorityCount().
271
func (sid *SID) SubAuthority(idx uint32) uint32 {
272
	if idx >= uint32(sid.SubAuthorityCount()) {
273
		panic("sub-authority index out of range")
274
	}
275
	return *getSidSubAuthority(sid, idx)
276
}
277

278
// IsValid returns whether the SID has a valid revision and length.
279
func (sid *SID) IsValid() bool {
280
	return isValidSid(sid)
281
}
282

283
// Equals compares two SIDs for equality.
284
func (sid *SID) Equals(sid2 *SID) bool {
285
	return EqualSid(sid, sid2)
286
}
287

288
// IsWellKnown determines whether the SID matches the well-known sidType.
289
func (sid *SID) IsWellKnown(sidType WELL_KNOWN_SID_TYPE) bool {
290
	return isWellKnownSid(sid, sidType)
291
}
292

293
// LookupAccount retrieves the name of the account for this SID
294
// and the name of the first domain on which this SID is found.
295
// System specify target computer to search for.
296
func (sid *SID) LookupAccount(system string) (account, domain string, accType uint32, err error) {
297
	var sys *uint16
298
	if len(system) > 0 {
299
		sys, err = UTF16PtrFromString(system)
300
		if err != nil {
301
			return "", "", 0, err
302
		}
303
	}
304
	n := uint32(50)
305
	dn := uint32(50)
306
	for {
307
		b := make([]uint16, n)
308
		db := make([]uint16, dn)
309
		e := LookupAccountSid(sys, sid, &b[0], &n, &db[0], &dn, &accType)
310
		if e == nil {
311
			return UTF16ToString(b), UTF16ToString(db), accType, nil
312
		}
313
		if e != ERROR_INSUFFICIENT_BUFFER {
314
			return "", "", 0, e
315
		}
316
		if n <= uint32(len(b)) {
317
			return "", "", 0, e
318
		}
319
	}
320
}
321

322
// Various types of pre-specified SIDs that can be synthesized and compared at runtime.
323
type WELL_KNOWN_SID_TYPE uint32
324

325
const (
326
	WinNullSid                                    = 0
327
	WinWorldSid                                   = 1
328
	WinLocalSid                                   = 2
329
	WinCreatorOwnerSid                            = 3
330
	WinCreatorGroupSid                            = 4
331
	WinCreatorOwnerServerSid                      = 5
332
	WinCreatorGroupServerSid                      = 6
333
	WinNtAuthoritySid                             = 7
334
	WinDialupSid                                  = 8
335
	WinNetworkSid                                 = 9
336
	WinBatchSid                                   = 10
337
	WinInteractiveSid                             = 11
338
	WinServiceSid                                 = 12
339
	WinAnonymousSid                               = 13
340
	WinProxySid                                   = 14
341
	WinEnterpriseControllersSid                   = 15
342
	WinSelfSid                                    = 16
343
	WinAuthenticatedUserSid                       = 17
344
	WinRestrictedCodeSid                          = 18
345
	WinTerminalServerSid                          = 19
346
	WinRemoteLogonIdSid                           = 20
347
	WinLogonIdsSid                                = 21
348
	WinLocalSystemSid                             = 22
349
	WinLocalServiceSid                            = 23
350
	WinNetworkServiceSid                          = 24
351
	WinBuiltinDomainSid                           = 25
352
	WinBuiltinAdministratorsSid                   = 26
353
	WinBuiltinUsersSid                            = 27
354
	WinBuiltinGuestsSid                           = 28
355
	WinBuiltinPowerUsersSid                       = 29
356
	WinBuiltinAccountOperatorsSid                 = 30
357
	WinBuiltinSystemOperatorsSid                  = 31
358
	WinBuiltinPrintOperatorsSid                   = 32
359
	WinBuiltinBackupOperatorsSid                  = 33
360
	WinBuiltinReplicatorSid                       = 34
361
	WinBuiltinPreWindows2000CompatibleAccessSid   = 35
362
	WinBuiltinRemoteDesktopUsersSid               = 36
363
	WinBuiltinNetworkConfigurationOperatorsSid    = 37
364
	WinAccountAdministratorSid                    = 38
365
	WinAccountGuestSid                            = 39
366
	WinAccountKrbtgtSid                           = 40
367
	WinAccountDomainAdminsSid                     = 41
368
	WinAccountDomainUsersSid                      = 42
369
	WinAccountDomainGuestsSid                     = 43
370
	WinAccountComputersSid                        = 44
371
	WinAccountControllersSid                      = 45
372
	WinAccountCertAdminsSid                       = 46
373
	WinAccountSchemaAdminsSid                     = 47
374
	WinAccountEnterpriseAdminsSid                 = 48
375
	WinAccountPolicyAdminsSid                     = 49
376
	WinAccountRasAndIasServersSid                 = 50
377
	WinNTLMAuthenticationSid                      = 51
378
	WinDigestAuthenticationSid                    = 52
379
	WinSChannelAuthenticationSid                  = 53
380
	WinThisOrganizationSid                        = 54
381
	WinOtherOrganizationSid                       = 55
382
	WinBuiltinIncomingForestTrustBuildersSid      = 56
383
	WinBuiltinPerfMonitoringUsersSid              = 57
384
	WinBuiltinPerfLoggingUsersSid                 = 58
385
	WinBuiltinAuthorizationAccessSid              = 59
386
	WinBuiltinTerminalServerLicenseServersSid     = 60
387
	WinBuiltinDCOMUsersSid                        = 61
388
	WinBuiltinIUsersSid                           = 62
389
	WinIUserSid                                   = 63
390
	WinBuiltinCryptoOperatorsSid                  = 64
391
	WinUntrustedLabelSid                          = 65
392
	WinLowLabelSid                                = 66
393
	WinMediumLabelSid                             = 67
394
	WinHighLabelSid                               = 68
395
	WinSystemLabelSid                             = 69
396
	WinWriteRestrictedCodeSid                     = 70
397
	WinCreatorOwnerRightsSid                      = 71
398
	WinCacheablePrincipalsGroupSid                = 72
399
	WinNonCacheablePrincipalsGroupSid             = 73
400
	WinEnterpriseReadonlyControllersSid           = 74
401
	WinAccountReadonlyControllersSid              = 75
402
	WinBuiltinEventLogReadersGroup                = 76
403
	WinNewEnterpriseReadonlyControllersSid        = 77
404
	WinBuiltinCertSvcDComAccessGroup              = 78
405
	WinMediumPlusLabelSid                         = 79
406
	WinLocalLogonSid                              = 80
407
	WinConsoleLogonSid                            = 81
408
	WinThisOrganizationCertificateSid             = 82
409
	WinApplicationPackageAuthoritySid             = 83
410
	WinBuiltinAnyPackageSid                       = 84
411
	WinCapabilityInternetClientSid                = 85
412
	WinCapabilityInternetClientServerSid          = 86
413
	WinCapabilityPrivateNetworkClientServerSid    = 87
414
	WinCapabilityPicturesLibrarySid               = 88
415
	WinCapabilityVideosLibrarySid                 = 89
416
	WinCapabilityMusicLibrarySid                  = 90
417
	WinCapabilityDocumentsLibrarySid              = 91
418
	WinCapabilitySharedUserCertificatesSid        = 92
419
	WinCapabilityEnterpriseAuthenticationSid      = 93
420
	WinCapabilityRemovableStorageSid              = 94
421
	WinBuiltinRDSRemoteAccessServersSid           = 95
422
	WinBuiltinRDSEndpointServersSid               = 96
423
	WinBuiltinRDSManagementServersSid             = 97
424
	WinUserModeDriversSid                         = 98
425
	WinBuiltinHyperVAdminsSid                     = 99
426
	WinAccountCloneableControllersSid             = 100
427
	WinBuiltinAccessControlAssistanceOperatorsSid = 101
428
	WinBuiltinRemoteManagementUsersSid            = 102
429
	WinAuthenticationAuthorityAssertedSid         = 103
430
	WinAuthenticationServiceAssertedSid           = 104
431
	WinLocalAccountSid                            = 105
432
	WinLocalAccountAndAdministratorSid            = 106
433
	WinAccountProtectedUsersSid                   = 107
434
	WinCapabilityAppointmentsSid                  = 108
435
	WinCapabilityContactsSid                      = 109
436
	WinAccountDefaultSystemManagedSid             = 110
437
	WinBuiltinDefaultSystemManagedGroupSid        = 111
438
	WinBuiltinStorageReplicaAdminsSid             = 112
439
	WinAccountKeyAdminsSid                        = 113
440
	WinAccountEnterpriseKeyAdminsSid              = 114
441
	WinAuthenticationKeyTrustSid                  = 115
442
	WinAuthenticationKeyPropertyMFASid            = 116
443
	WinAuthenticationKeyPropertyAttestationSid    = 117
444
	WinAuthenticationFreshKeyAuthSid              = 118
445
	WinBuiltinDeviceOwnersSid                     = 119
446
)
447

448
// Creates a SID for a well-known predefined alias, generally using the constants of the form
449
// Win*Sid, for the local machine.
450
func CreateWellKnownSid(sidType WELL_KNOWN_SID_TYPE) (*SID, error) {
451
	return CreateWellKnownDomainSid(sidType, nil)
452
}
453

454
// Creates a SID for a well-known predefined alias, generally using the constants of the form
455
// Win*Sid, for the domain specified by the domainSid parameter.
456
func CreateWellKnownDomainSid(sidType WELL_KNOWN_SID_TYPE, domainSid *SID) (*SID, error) {
457
	n := uint32(50)
458
	for {
459
		b := make([]byte, n)
460
		sid := (*SID)(unsafe.Pointer(&b[0]))
461
		err := createWellKnownSid(sidType, domainSid, sid, &n)
462
		if err == nil {
463
			return sid, nil
464
		}
465
		if err != ERROR_INSUFFICIENT_BUFFER {
466
			return nil, err
467
		}
468
		if n <= uint32(len(b)) {
469
			return nil, err
470
		}
471
	}
472
}
473

474
const (
475
	// do not reorder
476
	TOKEN_ASSIGN_PRIMARY = 1 << iota
477
	TOKEN_DUPLICATE
478
	TOKEN_IMPERSONATE
479
	TOKEN_QUERY
480
	TOKEN_QUERY_SOURCE
481
	TOKEN_ADJUST_PRIVILEGES
482
	TOKEN_ADJUST_GROUPS
483
	TOKEN_ADJUST_DEFAULT
484
	TOKEN_ADJUST_SESSIONID
485

486
	TOKEN_ALL_ACCESS = STANDARD_RIGHTS_REQUIRED |
487
		TOKEN_ASSIGN_PRIMARY |
488
		TOKEN_DUPLICATE |
489
		TOKEN_IMPERSONATE |
490
		TOKEN_QUERY |
491
		TOKEN_QUERY_SOURCE |
492
		TOKEN_ADJUST_PRIVILEGES |
493
		TOKEN_ADJUST_GROUPS |
494
		TOKEN_ADJUST_DEFAULT |
495
		TOKEN_ADJUST_SESSIONID
496
	TOKEN_READ  = STANDARD_RIGHTS_READ | TOKEN_QUERY
497
	TOKEN_WRITE = STANDARD_RIGHTS_WRITE |
498
		TOKEN_ADJUST_PRIVILEGES |
499
		TOKEN_ADJUST_GROUPS |
500
		TOKEN_ADJUST_DEFAULT
501
	TOKEN_EXECUTE = STANDARD_RIGHTS_EXECUTE
502
)
503

504
const (
505
	// do not reorder
506
	TokenUser = 1 + iota
507
	TokenGroups
508
	TokenPrivileges
509
	TokenOwner
510
	TokenPrimaryGroup
511
	TokenDefaultDacl
512
	TokenSource
513
	TokenType
514
	TokenImpersonationLevel
515
	TokenStatistics
516
	TokenRestrictedSids
517
	TokenSessionId
518
	TokenGroupsAndPrivileges
519
	TokenSessionReference
520
	TokenSandBoxInert
521
	TokenAuditPolicy
522
	TokenOrigin
523
	TokenElevationType
524
	TokenLinkedToken
525
	TokenElevation
526
	TokenHasRestrictions
527
	TokenAccessInformation
528
	TokenVirtualizationAllowed
529
	TokenVirtualizationEnabled
530
	TokenIntegrityLevel
531
	TokenUIAccess
532
	TokenMandatoryPolicy
533
	TokenLogonSid
534
	MaxTokenInfoClass
535
)
536

537
// Group attributes inside of Tokengroups.Groups[i].Attributes
538
const (
539
	SE_GROUP_MANDATORY          = 0x00000001
540
	SE_GROUP_ENABLED_BY_DEFAULT = 0x00000002
541
	SE_GROUP_ENABLED            = 0x00000004
542
	SE_GROUP_OWNER              = 0x00000008
543
	SE_GROUP_USE_FOR_DENY_ONLY  = 0x00000010
544
	SE_GROUP_INTEGRITY          = 0x00000020
545
	SE_GROUP_INTEGRITY_ENABLED  = 0x00000040
546
	SE_GROUP_LOGON_ID           = 0xC0000000
547
	SE_GROUP_RESOURCE           = 0x20000000
548
	SE_GROUP_VALID_ATTRIBUTES   = SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED | SE_GROUP_OWNER | SE_GROUP_USE_FOR_DENY_ONLY | SE_GROUP_LOGON_ID | SE_GROUP_RESOURCE | SE_GROUP_INTEGRITY | SE_GROUP_INTEGRITY_ENABLED
549
)
550

551
// Privilege attributes
552
const (
553
	SE_PRIVILEGE_ENABLED_BY_DEFAULT = 0x00000001
554
	SE_PRIVILEGE_ENABLED            = 0x00000002
555
	SE_PRIVILEGE_REMOVED            = 0x00000004
556
	SE_PRIVILEGE_USED_FOR_ACCESS    = 0x80000000
557
	SE_PRIVILEGE_VALID_ATTRIBUTES   = SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED | SE_PRIVILEGE_REMOVED | SE_PRIVILEGE_USED_FOR_ACCESS
558
)
559

560
// Token types
561
const (
562
	TokenPrimary       = 1
563
	TokenImpersonation = 2
564
)
565

566
// Impersonation levels
567
const (
568
	SecurityAnonymous      = 0
569
	SecurityIdentification = 1
570
	SecurityImpersonation  = 2
571
	SecurityDelegation     = 3
572
)
573

574
type LUID struct {
575
	LowPart  uint32
576
	HighPart int32
577
}
578

579
type LUIDAndAttributes struct {
580
	Luid       LUID
581
	Attributes uint32
582
}
583

584
type SIDAndAttributes struct {
585
	Sid        *SID
586
	Attributes uint32
587
}
588

589
type Tokenuser struct {
590
	User SIDAndAttributes
591
}
592

593
type Tokenprimarygroup struct {
594
	PrimaryGroup *SID
595
}
596

597
type Tokengroups struct {
598
	GroupCount uint32
599
	Groups     [1]SIDAndAttributes // Use AllGroups() for iterating.
600
}
601

602
// AllGroups returns a slice that can be used to iterate over the groups in g.
603
func (g *Tokengroups) AllGroups() []SIDAndAttributes {
604
	return (*[(1 << 28) - 1]SIDAndAttributes)(unsafe.Pointer(&g.Groups[0]))[:g.GroupCount:g.GroupCount]
605
}
606

607
type Tokenprivileges struct {
608
	PrivilegeCount uint32
609
	Privileges     [1]LUIDAndAttributes // Use AllPrivileges() for iterating.
610
}
611

612
// AllPrivileges returns a slice that can be used to iterate over the privileges in p.
613
func (p *Tokenprivileges) AllPrivileges() []LUIDAndAttributes {
614
	return (*[(1 << 27) - 1]LUIDAndAttributes)(unsafe.Pointer(&p.Privileges[0]))[:p.PrivilegeCount:p.PrivilegeCount]
615
}
616

617
type Tokenmandatorylabel struct {
618
	Label SIDAndAttributes
619
}
620

621
func (tml *Tokenmandatorylabel) Size() uint32 {
622
	return uint32(unsafe.Sizeof(Tokenmandatorylabel{})) + GetLengthSid(tml.Label.Sid)
623
}
624

625
// Authorization Functions
626
//sys	checkTokenMembership(tokenHandle Token, sidToCheck *SID, isMember *int32) (err error) = advapi32.CheckTokenMembership
627
//sys	isTokenRestricted(tokenHandle Token) (ret bool, err error) [!failretval] = advapi32.IsTokenRestricted
628
//sys	OpenProcessToken(process Handle, access uint32, token *Token) (err error) = advapi32.OpenProcessToken
629
//sys	OpenThreadToken(thread Handle, access uint32, openAsSelf bool, token *Token) (err error) = advapi32.OpenThreadToken
630
//sys	ImpersonateSelf(impersonationlevel uint32) (err error) = advapi32.ImpersonateSelf
631
//sys	RevertToSelf() (err error) = advapi32.RevertToSelf
632
//sys	SetThreadToken(thread *Handle, token Token) (err error) = advapi32.SetThreadToken
633
//sys	LookupPrivilegeValue(systemname *uint16, name *uint16, luid *LUID) (err error) = advapi32.LookupPrivilegeValueW
634
//sys	AdjustTokenPrivileges(token Token, disableAllPrivileges bool, newstate *Tokenprivileges, buflen uint32, prevstate *Tokenprivileges, returnlen *uint32) (err error) = advapi32.AdjustTokenPrivileges
635
//sys	AdjustTokenGroups(token Token, resetToDefault bool, newstate *Tokengroups, buflen uint32, prevstate *Tokengroups, returnlen *uint32) (err error) = advapi32.AdjustTokenGroups
636
//sys	GetTokenInformation(token Token, infoClass uint32, info *byte, infoLen uint32, returnedLen *uint32) (err error) = advapi32.GetTokenInformation
637
//sys	SetTokenInformation(token Token, infoClass uint32, info *byte, infoLen uint32) (err error) = advapi32.SetTokenInformation
638
//sys	DuplicateTokenEx(existingToken Token, desiredAccess uint32, tokenAttributes *SecurityAttributes, impersonationLevel uint32, tokenType uint32, newToken *Token) (err error) = advapi32.DuplicateTokenEx
639
//sys	GetUserProfileDirectory(t Token, dir *uint16, dirLen *uint32) (err error) = userenv.GetUserProfileDirectoryW
640
//sys	getSystemDirectory(dir *uint16, dirLen uint32) (len uint32, err error) = kernel32.GetSystemDirectoryW
641
//sys	getWindowsDirectory(dir *uint16, dirLen uint32) (len uint32, err error) = kernel32.GetWindowsDirectoryW
642
//sys	getSystemWindowsDirectory(dir *uint16, dirLen uint32) (len uint32, err error) = kernel32.GetSystemWindowsDirectoryW
643

644
// An access token contains the security information for a logon session.
645
// The system creates an access token when a user logs on, and every
646
// process executed on behalf of the user has a copy of the token.
647
// The token identifies the user, the user's groups, and the user's
648
// privileges. The system uses the token to control access to securable
649
// objects and to control the ability of the user to perform various
650
// system-related operations on the local computer.
651
type Token Handle
652

653
// OpenCurrentProcessToken opens an access token associated with current
654
// process with TOKEN_QUERY access. It is a real token that needs to be closed.
655
//
656
// Deprecated: Explicitly call OpenProcessToken(CurrentProcess(), ...)
657
// with the desired access instead, or use GetCurrentProcessToken for a
658
// TOKEN_QUERY token.
659
func OpenCurrentProcessToken() (Token, error) {
660
	var token Token
661
	err := OpenProcessToken(CurrentProcess(), TOKEN_QUERY, &token)
662
	return token, err
663
}
664

665
// GetCurrentProcessToken returns the access token associated with
666
// the current process. It is a pseudo token that does not need
667
// to be closed.
668
func GetCurrentProcessToken() Token {
669
	return Token(^uintptr(4 - 1))
670
}
671

672
// GetCurrentThreadToken return the access token associated with
673
// the current thread. It is a pseudo token that does not need
674
// to be closed.
675
func GetCurrentThreadToken() Token {
676
	return Token(^uintptr(5 - 1))
677
}
678

679
// GetCurrentThreadEffectiveToken returns the effective access token
680
// associated with the current thread. It is a pseudo token that does
681
// not need to be closed.
682
func GetCurrentThreadEffectiveToken() Token {
683
	return Token(^uintptr(6 - 1))
684
}
685

686
// Close releases access to access token.
687
func (t Token) Close() error {
688
	return CloseHandle(Handle(t))
689
}
690

691
// getInfo retrieves a specified type of information about an access token.
692
func (t Token) getInfo(class uint32, initSize int) (unsafe.Pointer, error) {
693
	n := uint32(initSize)
694
	for {
695
		b := make([]byte, n)
696
		e := GetTokenInformation(t, class, &b[0], uint32(len(b)), &n)
697
		if e == nil {
698
			return unsafe.Pointer(&b[0]), nil
699
		}
700
		if e != ERROR_INSUFFICIENT_BUFFER {
701
			return nil, e
702
		}
703
		if n <= uint32(len(b)) {
704
			return nil, e
705
		}
706
	}
707
}
708

709
// GetTokenUser retrieves access token t user account information.
710
func (t Token) GetTokenUser() (*Tokenuser, error) {
711
	i, e := t.getInfo(TokenUser, 50)
712
	if e != nil {
713
		return nil, e
714
	}
715
	return (*Tokenuser)(i), nil
716
}
717

718
// GetTokenGroups retrieves group accounts associated with access token t.
719
func (t Token) GetTokenGroups() (*Tokengroups, error) {
720
	i, e := t.getInfo(TokenGroups, 50)
721
	if e != nil {
722
		return nil, e
723
	}
724
	return (*Tokengroups)(i), nil
725
}
726

727
// GetTokenPrimaryGroup retrieves access token t primary group information.
728
// A pointer to a SID structure representing a group that will become
729
// the primary group of any objects created by a process using this access token.
730
func (t Token) GetTokenPrimaryGroup() (*Tokenprimarygroup, error) {
731
	i, e := t.getInfo(TokenPrimaryGroup, 50)
732
	if e != nil {
733
		return nil, e
734
	}
735
	return (*Tokenprimarygroup)(i), nil
736
}
737

738
// GetUserProfileDirectory retrieves path to the
739
// root directory of the access token t user's profile.
740
func (t Token) GetUserProfileDirectory() (string, error) {
741
	n := uint32(100)
742
	for {
743
		b := make([]uint16, n)
744
		e := GetUserProfileDirectory(t, &b[0], &n)
745
		if e == nil {
746
			return UTF16ToString(b), nil
747
		}
748
		if e != ERROR_INSUFFICIENT_BUFFER {
749
			return "", e
750
		}
751
		if n <= uint32(len(b)) {
752
			return "", e
753
		}
754
	}
755
}
756

757
// IsElevated returns whether the current token is elevated from a UAC perspective.
758
func (token Token) IsElevated() bool {
759
	var isElevated uint32
760
	var outLen uint32
761
	err := GetTokenInformation(token, TokenElevation, (*byte)(unsafe.Pointer(&isElevated)), uint32(unsafe.Sizeof(isElevated)), &outLen)
762
	if err != nil {
763
		return false
764
	}
765
	return outLen == uint32(unsafe.Sizeof(isElevated)) && isElevated != 0
766
}
767

768
// GetLinkedToken returns the linked token, which may be an elevated UAC token.
769
func (token Token) GetLinkedToken() (Token, error) {
770
	var linkedToken Token
771
	var outLen uint32
772
	err := GetTokenInformation(token, TokenLinkedToken, (*byte)(unsafe.Pointer(&linkedToken)), uint32(unsafe.Sizeof(linkedToken)), &outLen)
773
	if err != nil {
774
		return Token(0), err
775
	}
776
	return linkedToken, nil
777
}
778

779
// GetSystemDirectory retrieves the path to current location of the system
780
// directory, which is typically, though not always, `C:\Windows\System32`.
781
func GetSystemDirectory() (string, error) {
782
	n := uint32(MAX_PATH)
783
	for {
784
		b := make([]uint16, n)
785
		l, e := getSystemDirectory(&b[0], n)
786
		if e != nil {
787
			return "", e
788
		}
789
		if l <= n {
790
			return UTF16ToString(b[:l]), nil
791
		}
792
		n = l
793
	}
794
}
795

796
// GetWindowsDirectory retrieves the path to current location of the Windows
797
// directory, which is typically, though not always, `C:\Windows`. This may
798
// be a private user directory in the case that the application is running
799
// under a terminal server.
800
func GetWindowsDirectory() (string, error) {
801
	n := uint32(MAX_PATH)
802
	for {
803
		b := make([]uint16, n)
804
		l, e := getWindowsDirectory(&b[0], n)
805
		if e != nil {
806
			return "", e
807
		}
808
		if l <= n {
809
			return UTF16ToString(b[:l]), nil
810
		}
811
		n = l
812
	}
813
}
814

815
// GetSystemWindowsDirectory retrieves the path to current location of the
816
// Windows directory, which is typically, though not always, `C:\Windows`.
817
func GetSystemWindowsDirectory() (string, error) {
818
	n := uint32(MAX_PATH)
819
	for {
820
		b := make([]uint16, n)
821
		l, e := getSystemWindowsDirectory(&b[0], n)
822
		if e != nil {
823
			return "", e
824
		}
825
		if l <= n {
826
			return UTF16ToString(b[:l]), nil
827
		}
828
		n = l
829
	}
830
}
831

832
// IsMember reports whether the access token t is a member of the provided SID.
833
func (t Token) IsMember(sid *SID) (bool, error) {
834
	var b int32
835
	if e := checkTokenMembership(t, sid, &b); e != nil {
836
		return false, e
837
	}
838
	return b != 0, nil
839
}
840

841
// IsRestricted reports whether the access token t is a restricted token.
842
func (t Token) IsRestricted() (isRestricted bool, err error) {
843
	isRestricted, err = isTokenRestricted(t)
844
	if !isRestricted && err == syscall.EINVAL {
845
		// If err is EINVAL, this returned ERROR_SUCCESS indicating a non-restricted token.
846
		err = nil
847
	}
848
	return
849
}
850

851
const (
852
	WTS_CONSOLE_CONNECT        = 0x1
853
	WTS_CONSOLE_DISCONNECT     = 0x2
854
	WTS_REMOTE_CONNECT         = 0x3
855
	WTS_REMOTE_DISCONNECT      = 0x4
856
	WTS_SESSION_LOGON          = 0x5
857
	WTS_SESSION_LOGOFF         = 0x6
858
	WTS_SESSION_LOCK           = 0x7
859
	WTS_SESSION_UNLOCK         = 0x8
860
	WTS_SESSION_REMOTE_CONTROL = 0x9
861
	WTS_SESSION_CREATE         = 0xa
862
	WTS_SESSION_TERMINATE      = 0xb
863
)
864

865
const (
866
	WTSActive       = 0
867
	WTSConnected    = 1
868
	WTSConnectQuery = 2
869
	WTSShadow       = 3
870
	WTSDisconnected = 4
871
	WTSIdle         = 5
872
	WTSListen       = 6
873
	WTSReset        = 7
874
	WTSDown         = 8
875
	WTSInit         = 9
876
)
877

878
type WTSSESSION_NOTIFICATION struct {
879
	Size      uint32
880
	SessionID uint32
881
}
882

883
type WTS_SESSION_INFO struct {
884
	SessionID         uint32
885
	WindowStationName *uint16
886
	State             uint32
887
}
888

889
//sys WTSQueryUserToken(session uint32, token *Token) (err error) = wtsapi32.WTSQueryUserToken
890
//sys WTSEnumerateSessions(handle Handle, reserved uint32, version uint32, sessions **WTS_SESSION_INFO, count *uint32) (err error) = wtsapi32.WTSEnumerateSessionsW
891
//sys WTSFreeMemory(ptr uintptr) = wtsapi32.WTSFreeMemory
892
//sys WTSGetActiveConsoleSessionId() (sessionID uint32)
893

894
type ACL struct {
895
	aclRevision byte
896
	sbz1        byte
897
	aclSize     uint16
898
	aceCount    uint16
899
	sbz2        uint16
900
}
901

902
type SECURITY_DESCRIPTOR struct {
903
	revision byte
904
	sbz1     byte
905
	control  SECURITY_DESCRIPTOR_CONTROL
906
	owner    *SID
907
	group    *SID
908
	sacl     *ACL
909
	dacl     *ACL
910
}
911

912
type SECURITY_QUALITY_OF_SERVICE struct {
913
	Length              uint32
914
	ImpersonationLevel  uint32
915
	ContextTrackingMode byte
916
	EffectiveOnly       byte
917
}
918

919
// Constants for the ContextTrackingMode field of SECURITY_QUALITY_OF_SERVICE.
920
const (
921
	SECURITY_STATIC_TRACKING  = 0
922
	SECURITY_DYNAMIC_TRACKING = 1
923
)
924

925
type SecurityAttributes struct {
926
	Length             uint32
927
	SecurityDescriptor *SECURITY_DESCRIPTOR
928
	InheritHandle      uint32
929
}
930

931
type SE_OBJECT_TYPE uint32
932

933
// Constants for type SE_OBJECT_TYPE
934
const (
935
	SE_UNKNOWN_OBJECT_TYPE     = 0
936
	SE_FILE_OBJECT             = 1
937
	SE_SERVICE                 = 2
938
	SE_PRINTER                 = 3
939
	SE_REGISTRY_KEY            = 4
940
	SE_LMSHARE                 = 5
941
	SE_KERNEL_OBJECT           = 6
942
	SE_WINDOW_OBJECT           = 7
943
	SE_DS_OBJECT               = 8
944
	SE_DS_OBJECT_ALL           = 9
945
	SE_PROVIDER_DEFINED_OBJECT = 10
946
	SE_WMIGUID_OBJECT          = 11
947
	SE_REGISTRY_WOW64_32KEY    = 12
948
	SE_REGISTRY_WOW64_64KEY    = 13
949
)
950

951
type SECURITY_INFORMATION uint32
952

953
// Constants for type SECURITY_INFORMATION
954
const (
955
	OWNER_SECURITY_INFORMATION            = 0x00000001
956
	GROUP_SECURITY_INFORMATION            = 0x00000002
957
	DACL_SECURITY_INFORMATION             = 0x00000004
958
	SACL_SECURITY_INFORMATION             = 0x00000008
959
	LABEL_SECURITY_INFORMATION            = 0x00000010
960
	ATTRIBUTE_SECURITY_INFORMATION        = 0x00000020
961
	SCOPE_SECURITY_INFORMATION            = 0x00000040
962
	BACKUP_SECURITY_INFORMATION           = 0x00010000
963
	PROTECTED_DACL_SECURITY_INFORMATION   = 0x80000000
964
	PROTECTED_SACL_SECURITY_INFORMATION   = 0x40000000
965
	UNPROTECTED_DACL_SECURITY_INFORMATION = 0x20000000
966
	UNPROTECTED_SACL_SECURITY_INFORMATION = 0x10000000
967
)
968

969
type SECURITY_DESCRIPTOR_CONTROL uint16
970

971
// Constants for type SECURITY_DESCRIPTOR_CONTROL
972
const (
973
	SE_OWNER_DEFAULTED       = 0x0001
974
	SE_GROUP_DEFAULTED       = 0x0002
975
	SE_DACL_PRESENT          = 0x0004
976
	SE_DACL_DEFAULTED        = 0x0008
977
	SE_SACL_PRESENT          = 0x0010
978
	SE_SACL_DEFAULTED        = 0x0020
979
	SE_DACL_AUTO_INHERIT_REQ = 0x0100
980
	SE_SACL_AUTO_INHERIT_REQ = 0x0200
981
	SE_DACL_AUTO_INHERITED   = 0x0400
982
	SE_SACL_AUTO_INHERITED   = 0x0800
983
	SE_DACL_PROTECTED        = 0x1000
984
	SE_SACL_PROTECTED        = 0x2000
985
	SE_RM_CONTROL_VALID      = 0x4000
986
	SE_SELF_RELATIVE         = 0x8000
987
)
988

989
type ACCESS_MASK uint32
990

991
// Constants for type ACCESS_MASK
992
const (
993
	DELETE                   = 0x00010000
994
	READ_CONTROL             = 0x00020000
995
	WRITE_DAC                = 0x00040000
996
	WRITE_OWNER              = 0x00080000
997
	SYNCHRONIZE              = 0x00100000
998
	STANDARD_RIGHTS_REQUIRED = 0x000F0000
999
	STANDARD_RIGHTS_READ     = READ_CONTROL
1000
	STANDARD_RIGHTS_WRITE    = READ_CONTROL
1001
	STANDARD_RIGHTS_EXECUTE  = READ_CONTROL
1002
	STANDARD_RIGHTS_ALL      = 0x001F0000
1003
	SPECIFIC_RIGHTS_ALL      = 0x0000FFFF
1004
	ACCESS_SYSTEM_SECURITY   = 0x01000000
1005
	MAXIMUM_ALLOWED          = 0x02000000
1006
	GENERIC_READ             = 0x80000000
1007
	GENERIC_WRITE            = 0x40000000
1008
	GENERIC_EXECUTE          = 0x20000000
1009
	GENERIC_ALL              = 0x10000000
1010
)
1011

1012
type ACCESS_MODE uint32
1013

1014
// Constants for type ACCESS_MODE
1015
const (
1016
	NOT_USED_ACCESS   = 0
1017
	GRANT_ACCESS      = 1
1018
	SET_ACCESS        = 2
1019
	DENY_ACCESS       = 3
1020
	REVOKE_ACCESS     = 4
1021
	SET_AUDIT_SUCCESS = 5
1022
	SET_AUDIT_FAILURE = 6
1023
)
1024

1025
// Constants for AceFlags and Inheritance fields
1026
const (
1027
	NO_INHERITANCE                     = 0x0
1028
	SUB_OBJECTS_ONLY_INHERIT           = 0x1
1029
	SUB_CONTAINERS_ONLY_INHERIT        = 0x2
1030
	SUB_CONTAINERS_AND_OBJECTS_INHERIT = 0x3
1031
	INHERIT_NO_PROPAGATE               = 0x4
1032
	INHERIT_ONLY                       = 0x8
1033
	INHERITED_ACCESS_ENTRY             = 0x10
1034
	INHERITED_PARENT                   = 0x10000000
1035
	INHERITED_GRANDPARENT              = 0x20000000
1036
	OBJECT_INHERIT_ACE                 = 0x1
1037
	CONTAINER_INHERIT_ACE              = 0x2
1038
	NO_PROPAGATE_INHERIT_ACE           = 0x4
1039
	INHERIT_ONLY_ACE                   = 0x8
1040
	INHERITED_ACE                      = 0x10
1041
	VALID_INHERIT_FLAGS                = 0x1F
1042
)
1043

1044
type MULTIPLE_TRUSTEE_OPERATION uint32
1045

1046
// Constants for MULTIPLE_TRUSTEE_OPERATION
1047
const (
1048
	NO_MULTIPLE_TRUSTEE    = 0
1049
	TRUSTEE_IS_IMPERSONATE = 1
1050
)
1051

1052
type TRUSTEE_FORM uint32
1053

1054
// Constants for TRUSTEE_FORM
1055
const (
1056
	TRUSTEE_IS_SID              = 0
1057
	TRUSTEE_IS_NAME             = 1
1058
	TRUSTEE_BAD_FORM            = 2
1059
	TRUSTEE_IS_OBJECTS_AND_SID  = 3
1060
	TRUSTEE_IS_OBJECTS_AND_NAME = 4
1061
)
1062

1063
type TRUSTEE_TYPE uint32
1064

1065
// Constants for TRUSTEE_TYPE
1066
const (
1067
	TRUSTEE_IS_UNKNOWN          = 0
1068
	TRUSTEE_IS_USER             = 1
1069
	TRUSTEE_IS_GROUP            = 2
1070
	TRUSTEE_IS_DOMAIN           = 3
1071
	TRUSTEE_IS_ALIAS            = 4
1072
	TRUSTEE_IS_WELL_KNOWN_GROUP = 5
1073
	TRUSTEE_IS_DELETED          = 6
1074
	TRUSTEE_IS_INVALID          = 7
1075
	TRUSTEE_IS_COMPUTER         = 8
1076
)
1077

1078
// Constants for ObjectsPresent field
1079
const (
1080
	ACE_OBJECT_TYPE_PRESENT           = 0x1
1081
	ACE_INHERITED_OBJECT_TYPE_PRESENT = 0x2
1082
)
1083

1084
type EXPLICIT_ACCESS struct {
1085
	AccessPermissions ACCESS_MASK
1086
	AccessMode        ACCESS_MODE
1087
	Inheritance       uint32
1088
	Trustee           TRUSTEE
1089
}
1090

1091
// This type is the union inside of TRUSTEE and must be created using one of the TrusteeValueFrom* functions.
1092
type TrusteeValue uintptr
1093

1094
func TrusteeValueFromString(str string) TrusteeValue {
1095
	return TrusteeValue(unsafe.Pointer(StringToUTF16Ptr(str)))
1096
}
1097
func TrusteeValueFromSID(sid *SID) TrusteeValue {
1098
	return TrusteeValue(unsafe.Pointer(sid))
1099
}
1100
func TrusteeValueFromObjectsAndSid(objectsAndSid *OBJECTS_AND_SID) TrusteeValue {
1101
	return TrusteeValue(unsafe.Pointer(objectsAndSid))
1102
}
1103
func TrusteeValueFromObjectsAndName(objectsAndName *OBJECTS_AND_NAME) TrusteeValue {
1104
	return TrusteeValue(unsafe.Pointer(objectsAndName))
1105
}
1106

1107
type TRUSTEE struct {
1108
	MultipleTrustee          *TRUSTEE
1109
	MultipleTrusteeOperation MULTIPLE_TRUSTEE_OPERATION
1110
	TrusteeForm              TRUSTEE_FORM
1111
	TrusteeType              TRUSTEE_TYPE
1112
	TrusteeValue             TrusteeValue
1113
}
1114

1115
type OBJECTS_AND_SID struct {
1116
	ObjectsPresent          uint32
1117
	ObjectTypeGuid          GUID
1118
	InheritedObjectTypeGuid GUID
1119
	Sid                     *SID
1120
}
1121

1122
type OBJECTS_AND_NAME struct {
1123
	ObjectsPresent          uint32
1124
	ObjectType              SE_OBJECT_TYPE
1125
	ObjectTypeName          *uint16
1126
	InheritedObjectTypeName *uint16
1127
	Name                    *uint16
1128
}
1129

1130
//sys	getSecurityInfo(handle Handle, objectType SE_OBJECT_TYPE, securityInformation SECURITY_INFORMATION, owner **SID, group **SID, dacl **ACL, sacl **ACL, sd **SECURITY_DESCRIPTOR) (ret error) = advapi32.GetSecurityInfo
1131
//sys	SetSecurityInfo(handle Handle, objectType SE_OBJECT_TYPE, securityInformation SECURITY_INFORMATION, owner *SID, group *SID, dacl *ACL, sacl *ACL) (ret error) = advapi32.SetSecurityInfo
1132
//sys	getNamedSecurityInfo(objectName string, objectType SE_OBJECT_TYPE, securityInformation SECURITY_INFORMATION, owner **SID, group **SID, dacl **ACL, sacl **ACL, sd **SECURITY_DESCRIPTOR) (ret error) = advapi32.GetNamedSecurityInfoW
1133
//sys	SetNamedSecurityInfo(objectName string, objectType SE_OBJECT_TYPE, securityInformation SECURITY_INFORMATION, owner *SID, group *SID, dacl *ACL, sacl *ACL) (ret error) = advapi32.SetNamedSecurityInfoW
1134
//sys	SetKernelObjectSecurity(handle Handle, securityInformation SECURITY_INFORMATION, securityDescriptor *SECURITY_DESCRIPTOR) (err error) = advapi32.SetKernelObjectSecurity
1135

1136
//sys	buildSecurityDescriptor(owner *TRUSTEE, group *TRUSTEE, countAccessEntries uint32, accessEntries *EXPLICIT_ACCESS, countAuditEntries uint32, auditEntries *EXPLICIT_ACCESS, oldSecurityDescriptor *SECURITY_DESCRIPTOR, sizeNewSecurityDescriptor *uint32, newSecurityDescriptor **SECURITY_DESCRIPTOR) (ret error) = advapi32.BuildSecurityDescriptorW
1137
//sys	initializeSecurityDescriptor(absoluteSD *SECURITY_DESCRIPTOR, revision uint32) (err error) = advapi32.InitializeSecurityDescriptor
1138

1139
//sys	getSecurityDescriptorControl(sd *SECURITY_DESCRIPTOR, control *SECURITY_DESCRIPTOR_CONTROL, revision *uint32) (err error) = advapi32.GetSecurityDescriptorControl
1140
//sys	getSecurityDescriptorDacl(sd *SECURITY_DESCRIPTOR, daclPresent *bool, dacl **ACL, daclDefaulted *bool) (err error) = advapi32.GetSecurityDescriptorDacl
1141
//sys	getSecurityDescriptorSacl(sd *SECURITY_DESCRIPTOR, saclPresent *bool, sacl **ACL, saclDefaulted *bool) (err error) = advapi32.GetSecurityDescriptorSacl
1142
//sys	getSecurityDescriptorOwner(sd *SECURITY_DESCRIPTOR, owner **SID, ownerDefaulted *bool) (err error) = advapi32.GetSecurityDescriptorOwner
1143
//sys	getSecurityDescriptorGroup(sd *SECURITY_DESCRIPTOR, group **SID, groupDefaulted *bool) (err error) = advapi32.GetSecurityDescriptorGroup
1144
//sys	getSecurityDescriptorLength(sd *SECURITY_DESCRIPTOR) (len uint32) = advapi32.GetSecurityDescriptorLength
1145
//sys	getSecurityDescriptorRMControl(sd *SECURITY_DESCRIPTOR, rmControl *uint8) (ret error) [failretval!=0] = advapi32.GetSecurityDescriptorRMControl
1146
//sys	isValidSecurityDescriptor(sd *SECURITY_DESCRIPTOR) (isValid bool) = advapi32.IsValidSecurityDescriptor
1147

1148
//sys	setSecurityDescriptorControl(sd *SECURITY_DESCRIPTOR, controlBitsOfInterest SECURITY_DESCRIPTOR_CONTROL, controlBitsToSet SECURITY_DESCRIPTOR_CONTROL) (err error) = advapi32.SetSecurityDescriptorControl
1149
//sys	setSecurityDescriptorDacl(sd *SECURITY_DESCRIPTOR, daclPresent bool, dacl *ACL, daclDefaulted bool) (err error) = advapi32.SetSecurityDescriptorDacl
1150
//sys	setSecurityDescriptorSacl(sd *SECURITY_DESCRIPTOR, saclPresent bool, sacl *ACL, saclDefaulted bool) (err error) = advapi32.SetSecurityDescriptorSacl
1151
//sys	setSecurityDescriptorOwner(sd *SECURITY_DESCRIPTOR, owner *SID, ownerDefaulted bool) (err error) = advapi32.SetSecurityDescriptorOwner
1152
//sys	setSecurityDescriptorGroup(sd *SECURITY_DESCRIPTOR, group *SID, groupDefaulted bool) (err error) = advapi32.SetSecurityDescriptorGroup
1153
//sys	setSecurityDescriptorRMControl(sd *SECURITY_DESCRIPTOR, rmControl *uint8) = advapi32.SetSecurityDescriptorRMControl
1154

1155
//sys	convertStringSecurityDescriptorToSecurityDescriptor(str string, revision uint32, sd **SECURITY_DESCRIPTOR, size *uint32) (err error) = advapi32.ConvertStringSecurityDescriptorToSecurityDescriptorW
1156
//sys	convertSecurityDescriptorToStringSecurityDescriptor(sd *SECURITY_DESCRIPTOR, revision uint32, securityInformation SECURITY_INFORMATION, str **uint16, strLen *uint32) (err error) = advapi32.ConvertSecurityDescriptorToStringSecurityDescriptorW
1157

1158
//sys	makeAbsoluteSD(selfRelativeSD *SECURITY_DESCRIPTOR, absoluteSD *SECURITY_DESCRIPTOR, absoluteSDSize *uint32, dacl *ACL, daclSize *uint32, sacl *ACL, saclSize *uint32, owner *SID, ownerSize *uint32, group *SID, groupSize *uint32) (err error) = advapi32.MakeAbsoluteSD
1159
//sys	makeSelfRelativeSD(absoluteSD *SECURITY_DESCRIPTOR, selfRelativeSD *SECURITY_DESCRIPTOR, selfRelativeSDSize *uint32) (err error) = advapi32.MakeSelfRelativeSD
1160

1161
//sys	setEntriesInAcl(countExplicitEntries uint32, explicitEntries *EXPLICIT_ACCESS, oldACL *ACL, newACL **ACL) (ret error) = advapi32.SetEntriesInAclW
1162

1163
// Control returns the security descriptor control bits.
1164
func (sd *SECURITY_DESCRIPTOR) Control() (control SECURITY_DESCRIPTOR_CONTROL, revision uint32, err error) {
1165
	err = getSecurityDescriptorControl(sd, &control, &revision)
1166
	return
1167
}
1168

1169
// SetControl sets the security descriptor control bits.
1170
func (sd *SECURITY_DESCRIPTOR) SetControl(controlBitsOfInterest SECURITY_DESCRIPTOR_CONTROL, controlBitsToSet SECURITY_DESCRIPTOR_CONTROL) error {
1171
	return setSecurityDescriptorControl(sd, controlBitsOfInterest, controlBitsToSet)
1172
}
1173

1174
// RMControl returns the security descriptor resource manager control bits.
1175
func (sd *SECURITY_DESCRIPTOR) RMControl() (control uint8, err error) {
1176
	err = getSecurityDescriptorRMControl(sd, &control)
1177
	return
1178
}
1179

1180
// SetRMControl sets the security descriptor resource manager control bits.
1181
func (sd *SECURITY_DESCRIPTOR) SetRMControl(rmControl uint8) {
1182
	setSecurityDescriptorRMControl(sd, &rmControl)
1183
}
1184

1185
// DACL returns the security descriptor DACL and whether it was defaulted. The dacl return value may be nil
1186
// if a DACL exists but is an "empty DACL", meaning fully permissive. If the DACL does not exist, err returns
1187
// ERROR_OBJECT_NOT_FOUND.
1188
func (sd *SECURITY_DESCRIPTOR) DACL() (dacl *ACL, defaulted bool, err error) {
1189
	var present bool
1190
	err = getSecurityDescriptorDacl(sd, &present, &dacl, &defaulted)
1191
	if !present {
1192
		err = ERROR_OBJECT_NOT_FOUND
1193
	}
1194
	return
1195
}
1196

1197
// SetDACL sets the absolute security descriptor DACL.
1198
func (absoluteSD *SECURITY_DESCRIPTOR) SetDACL(dacl *ACL, present, defaulted bool) error {
1199
	return setSecurityDescriptorDacl(absoluteSD, present, dacl, defaulted)
1200
}
1201

1202
// SACL returns the security descriptor SACL and whether it was defaulted. The sacl return value may be nil
1203
// if a SACL exists but is an "empty SACL", meaning fully permissive. If the SACL does not exist, err returns
1204
// ERROR_OBJECT_NOT_FOUND.
1205
func (sd *SECURITY_DESCRIPTOR) SACL() (sacl *ACL, defaulted bool, err error) {
1206
	var present bool
1207
	err = getSecurityDescriptorSacl(sd, &present, &sacl, &defaulted)
1208
	if !present {
1209
		err = ERROR_OBJECT_NOT_FOUND
1210
	}
1211
	return
1212
}
1213

1214
// SetSACL sets the absolute security descriptor SACL.
1215
func (absoluteSD *SECURITY_DESCRIPTOR) SetSACL(sacl *ACL, present, defaulted bool) error {
1216
	return setSecurityDescriptorSacl(absoluteSD, present, sacl, defaulted)
1217
}
1218

1219
// Owner returns the security descriptor owner and whether it was defaulted.
1220
func (sd *SECURITY_DESCRIPTOR) Owner() (owner *SID, defaulted bool, err error) {
1221
	err = getSecurityDescriptorOwner(sd, &owner, &defaulted)
1222
	return
1223
}
1224

1225
// SetOwner sets the absolute security descriptor owner.
1226
func (absoluteSD *SECURITY_DESCRIPTOR) SetOwner(owner *SID, defaulted bool) error {
1227
	return setSecurityDescriptorOwner(absoluteSD, owner, defaulted)
1228
}
1229

1230
// Group returns the security descriptor group and whether it was defaulted.
1231
func (sd *SECURITY_DESCRIPTOR) Group() (group *SID, defaulted bool, err error) {
1232
	err = getSecurityDescriptorGroup(sd, &group, &defaulted)
1233
	return
1234
}
1235

1236
// SetGroup sets the absolute security descriptor owner.
1237
func (absoluteSD *SECURITY_DESCRIPTOR) SetGroup(group *SID, defaulted bool) error {
1238
	return setSecurityDescriptorGroup(absoluteSD, group, defaulted)
1239
}
1240

1241
// Length returns the length of the security descriptor.
1242
func (sd *SECURITY_DESCRIPTOR) Length() uint32 {
1243
	return getSecurityDescriptorLength(sd)
1244
}
1245

1246
// IsValid returns whether the security descriptor is valid.
1247
func (sd *SECURITY_DESCRIPTOR) IsValid() bool {
1248
	return isValidSecurityDescriptor(sd)
1249
}
1250

1251
// String returns the SDDL form of the security descriptor, with a function signature that can be
1252
// used with %v formatting directives.
1253
func (sd *SECURITY_DESCRIPTOR) String() string {
1254
	var sddl *uint16
1255
	err := convertSecurityDescriptorToStringSecurityDescriptor(sd, 1, 0xff, &sddl, nil)
1256
	if err != nil {
1257
		return ""
1258
	}
1259
	defer LocalFree(Handle(unsafe.Pointer(sddl)))
1260
	return UTF16PtrToString(sddl)
1261
}
1262

1263
// ToAbsolute converts a self-relative security descriptor into an absolute one.
1264
func (selfRelativeSD *SECURITY_DESCRIPTOR) ToAbsolute() (absoluteSD *SECURITY_DESCRIPTOR, err error) {
1265
	control, _, err := selfRelativeSD.Control()
1266
	if err != nil {
1267
		return
1268
	}
1269
	if control&SE_SELF_RELATIVE == 0 {
1270
		err = ERROR_INVALID_PARAMETER
1271
		return
1272
	}
1273
	var absoluteSDSize, daclSize, saclSize, ownerSize, groupSize uint32
1274
	err = makeAbsoluteSD(selfRelativeSD, nil, &absoluteSDSize,
1275
		nil, &daclSize, nil, &saclSize, nil, &ownerSize, nil, &groupSize)
1276
	switch err {
1277
	case ERROR_INSUFFICIENT_BUFFER:
1278
	case nil:
1279
		// makeAbsoluteSD is expected to fail, but it succeeds.
1280
		return nil, ERROR_INTERNAL_ERROR
1281
	default:
1282
		return nil, err
1283
	}
1284
	if absoluteSDSize > 0 {
1285
		absoluteSD = (*SECURITY_DESCRIPTOR)(unsafe.Pointer(&make([]byte, absoluteSDSize)[0]))
1286
	}
1287
	var (
1288
		dacl  *ACL
1289
		sacl  *ACL
1290
		owner *SID
1291
		group *SID
1292
	)
1293
	if daclSize > 0 {
1294
		dacl = (*ACL)(unsafe.Pointer(&make([]byte, daclSize)[0]))
1295
	}
1296
	if saclSize > 0 {
1297
		sacl = (*ACL)(unsafe.Pointer(&make([]byte, saclSize)[0]))
1298
	}
1299
	if ownerSize > 0 {
1300
		owner = (*SID)(unsafe.Pointer(&make([]byte, ownerSize)[0]))
1301
	}
1302
	if groupSize > 0 {
1303
		group = (*SID)(unsafe.Pointer(&make([]byte, groupSize)[0]))
1304
	}
1305
	err = makeAbsoluteSD(selfRelativeSD, absoluteSD, &absoluteSDSize,
1306
		dacl, &daclSize, sacl, &saclSize, owner, &ownerSize, group, &groupSize)
1307
	return
1308
}
1309

1310
// ToSelfRelative converts an absolute security descriptor into a self-relative one.
1311
func (absoluteSD *SECURITY_DESCRIPTOR) ToSelfRelative() (selfRelativeSD *SECURITY_DESCRIPTOR, err error) {
1312
	control, _, err := absoluteSD.Control()
1313
	if err != nil {
1314
		return
1315
	}
1316
	if control&SE_SELF_RELATIVE != 0 {
1317
		err = ERROR_INVALID_PARAMETER
1318
		return
1319
	}
1320
	var selfRelativeSDSize uint32
1321
	err = makeSelfRelativeSD(absoluteSD, nil, &selfRelativeSDSize)
1322
	switch err {
1323
	case ERROR_INSUFFICIENT_BUFFER:
1324
	case nil:
1325
		// makeSelfRelativeSD is expected to fail, but it succeeds.
1326
		return nil, ERROR_INTERNAL_ERROR
1327
	default:
1328
		return nil, err
1329
	}
1330
	if selfRelativeSDSize > 0 {
1331
		selfRelativeSD = (*SECURITY_DESCRIPTOR)(unsafe.Pointer(&make([]byte, selfRelativeSDSize)[0]))
1332
	}
1333
	err = makeSelfRelativeSD(absoluteSD, selfRelativeSD, &selfRelativeSDSize)
1334
	return
1335
}
1336

1337
func (selfRelativeSD *SECURITY_DESCRIPTOR) copySelfRelativeSecurityDescriptor() *SECURITY_DESCRIPTOR {
1338
	sdLen := int(selfRelativeSD.Length())
1339
	const min = int(unsafe.Sizeof(SECURITY_DESCRIPTOR{}))
1340
	if sdLen < min {
1341
		sdLen = min
1342
	}
1343

1344
	var src []byte
1345
	h := (*unsafeheader.Slice)(unsafe.Pointer(&src))
1346
	h.Data = unsafe.Pointer(selfRelativeSD)
1347
	h.Len = sdLen
1348
	h.Cap = sdLen
1349

1350
	const psize = int(unsafe.Sizeof(uintptr(0)))
1351

1352
	var dst []byte
1353
	h = (*unsafeheader.Slice)(unsafe.Pointer(&dst))
1354
	alloc := make([]uintptr, (sdLen+psize-1)/psize)
1355
	h.Data = (*unsafeheader.Slice)(unsafe.Pointer(&alloc)).Data
1356
	h.Len = sdLen
1357
	h.Cap = sdLen
1358

1359
	copy(dst, src)
1360
	return (*SECURITY_DESCRIPTOR)(unsafe.Pointer(&dst[0]))
1361
}
1362

1363
// SecurityDescriptorFromString converts an SDDL string describing a security descriptor into a
1364
// self-relative security descriptor object allocated on the Go heap.
1365
func SecurityDescriptorFromString(sddl string) (sd *SECURITY_DESCRIPTOR, err error) {
1366
	var winHeapSD *SECURITY_DESCRIPTOR
1367
	err = convertStringSecurityDescriptorToSecurityDescriptor(sddl, 1, &winHeapSD, nil)
1368
	if err != nil {
1369
		return
1370
	}
1371
	defer LocalFree(Handle(unsafe.Pointer(winHeapSD)))
1372
	return winHeapSD.copySelfRelativeSecurityDescriptor(), nil
1373
}
1374

1375
// GetSecurityInfo queries the security information for a given handle and returns the self-relative security
1376
// descriptor result on the Go heap.
1377
func GetSecurityInfo(handle Handle, objectType SE_OBJECT_TYPE, securityInformation SECURITY_INFORMATION) (sd *SECURITY_DESCRIPTOR, err error) {
1378
	var winHeapSD *SECURITY_DESCRIPTOR
1379
	err = getSecurityInfo(handle, objectType, securityInformation, nil, nil, nil, nil, &winHeapSD)
1380
	if err != nil {
1381
		return
1382
	}
1383
	defer LocalFree(Handle(unsafe.Pointer(winHeapSD)))
1384
	return winHeapSD.copySelfRelativeSecurityDescriptor(), nil
1385
}
1386

1387
// GetNamedSecurityInfo queries the security information for a given named object and returns the self-relative security
1388
// descriptor result on the Go heap.
1389
func GetNamedSecurityInfo(objectName string, objectType SE_OBJECT_TYPE, securityInformation SECURITY_INFORMATION) (sd *SECURITY_DESCRIPTOR, err error) {
1390
	var winHeapSD *SECURITY_DESCRIPTOR
1391
	err = getNamedSecurityInfo(objectName, objectType, securityInformation, nil, nil, nil, nil, &winHeapSD)
1392
	if err != nil {
1393
		return
1394
	}
1395
	defer LocalFree(Handle(unsafe.Pointer(winHeapSD)))
1396
	return winHeapSD.copySelfRelativeSecurityDescriptor(), nil
1397
}
1398

1399
// BuildSecurityDescriptor makes a new security descriptor using the input trustees, explicit access lists, and
1400
// prior security descriptor to be merged, any of which can be nil, returning the self-relative security descriptor
1401
// result on the Go heap.
1402
func BuildSecurityDescriptor(owner *TRUSTEE, group *TRUSTEE, accessEntries []EXPLICIT_ACCESS, auditEntries []EXPLICIT_ACCESS, mergedSecurityDescriptor *SECURITY_DESCRIPTOR) (sd *SECURITY_DESCRIPTOR, err error) {
1403
	var winHeapSD *SECURITY_DESCRIPTOR
1404
	var winHeapSDSize uint32
1405
	var firstAccessEntry *EXPLICIT_ACCESS
1406
	if len(accessEntries) > 0 {
1407
		firstAccessEntry = &accessEntries[0]
1408
	}
1409
	var firstAuditEntry *EXPLICIT_ACCESS
1410
	if len(auditEntries) > 0 {
1411
		firstAuditEntry = &auditEntries[0]
1412
	}
1413
	err = buildSecurityDescriptor(owner, group, uint32(len(accessEntries)), firstAccessEntry, uint32(len(auditEntries)), firstAuditEntry, mergedSecurityDescriptor, &winHeapSDSize, &winHeapSD)
1414
	if err != nil {
1415
		return
1416
	}
1417
	defer LocalFree(Handle(unsafe.Pointer(winHeapSD)))
1418
	return winHeapSD.copySelfRelativeSecurityDescriptor(), nil
1419
}
1420

1421
// NewSecurityDescriptor creates and initializes a new absolute security descriptor.
1422
func NewSecurityDescriptor() (absoluteSD *SECURITY_DESCRIPTOR, err error) {
1423
	absoluteSD = &SECURITY_DESCRIPTOR{}
1424
	err = initializeSecurityDescriptor(absoluteSD, 1)
1425
	return
1426
}
1427

1428
// ACLFromEntries returns a new ACL on the Go heap containing a list of explicit entries as well as those of another ACL.
1429
// Both explicitEntries and mergedACL are optional and can be nil.
1430
func ACLFromEntries(explicitEntries []EXPLICIT_ACCESS, mergedACL *ACL) (acl *ACL, err error) {
1431
	var firstExplicitEntry *EXPLICIT_ACCESS
1432
	if len(explicitEntries) > 0 {
1433
		firstExplicitEntry = &explicitEntries[0]
1434
	}
1435
	var winHeapACL *ACL
1436
	err = setEntriesInAcl(uint32(len(explicitEntries)), firstExplicitEntry, mergedACL, &winHeapACL)
1437
	if err != nil {
1438
		return
1439
	}
1440
	defer LocalFree(Handle(unsafe.Pointer(winHeapACL)))
1441
	aclBytes := make([]byte, winHeapACL.aclSize)
1442
	copy(aclBytes, (*[(1 << 31) - 1]byte)(unsafe.Pointer(winHeapACL))[:len(aclBytes):len(aclBytes)])
1443
	return (*ACL)(unsafe.Pointer(&aclBytes[0])), nil
1444
}
1445