AccessControl plug-in: Difference between revisions

From NSIS Wiki
Jump to navigationJump to search
m (→‎Description: v1.0.8.3)
 
(20 intermediate revisions by 11 users not shown)
Line 2: Line 2:


== Links ==
== Links ==
<attach>AccessControl.zip</attach>
<attach>AccessControl.zip</attach> (includes NSIS-Unicode variant)
Run with <code>conda execute</code> or install with <code>conda install</code> (see [[Conda]]).
 
[http://support.microsoft.com/kb/243330 Well-known security identifiers in Windows operating systems]


== Description ==
== Description ==
'''Version:''' 21st August 2007.<br>
'''Supported on:''' ''Windows ME+, Windows 2000+''.


The AccessControl plugin for NSIS provides a set of functions related Windows NT access control list (ACL) management.
'''Version:''' 1.0.8.3 (20210224)
 
'''Supported on:''' ''WinNT4+''.


'''Original:''' 20th April 2006<br />
The AccessControl plugin for NSIS provides a set of functions related to Windows NT access control list (ACL) management.
'''Updated:''' 30th June 2006 ~ Afrow UK<br />
'''Changes:''' Error MessageBox removed. Error messages are now just returned on NSIS stack.<br />
'''Updated:''' 13th July 2007 ~ kichik<br />
'''Changes:''' Return proper error codes (return value instead of GetLastError()).<br />
'''Updated:''' 21st August 2007 ~ Afrow UK<br />
'''Changes:''' Added /NOINHERIT, EnableInheritance, DisableInheritance.<br />


== Usage Example ==
== Usage Example ==
Line 23: Line 21:
   AccessControl::SetFileOwner \
   AccessControl::SetFileOwner \
     "C:\test.txt" "Waterloo\Mathias"
     "C:\test.txt" "Waterloo\Mathias"
  Pop $0 ; "error" on errors


# Make the directory "$INSTDIR\database" read write accessible by all users
# Make the directory "$INSTDIR\database" read write accessible by all users
   AccessControl::GrantOnFile \
   AccessControl::GrantOnFile \
     "$INSTDIR\database" "(BU)" "GenericRead + GenericWrite"
     "$INSTDIR\database" "(BU)" "GenericRead + GenericWrite"
  Pop $0


# Give all authentificated users (BUILTIN\Users) full access on
# Give all authentificated users (BUILTIN\Users) full access on
Line 32: Line 32:
   AccessControl::GrantOnRegKey \
   AccessControl::GrantOnRegKey \
     HKLM "Software\Vendor\SomeApp" "(BU)" "FullAccess"
     HKLM "Software\Vendor\SomeApp" "(BU)" "FullAccess"
  Pop $0


# Same as above, but with a numeric string SID
# Same as above, but with a numeric string SID
   AccessControl::GrantOnRegKey \
   AccessControl::GrantOnRegKey \
     HKLM "Software\Vendor\SomeApp" "(S-1-5-32-545)" "FullAccess"
     HKLM "Software\Vendor\SomeApp" "(S-1-5-32-545)" "FullAccess"
  Pop $0
</highlight-nsis>
</highlight-nsis>


Detailed usage instructions can be found in the package.
''Detailed usage instructions and a list of functions can be found in the package readme Docs\AccessControl\AccessControl.txt.''
 
== CONVENTIONS ==
 
'''<filename>'''
A valid Windows(tm) filename (ie. "C:\WINDOWS\" or "\\HOSTNAME\SHARE").
 
'''<rootkey>'''
The well-known root of a registry key. Following values are defined:
HKCR - HKEY_CLASSES_ROOT
HKLM - HKEY_LOCAL_MACHINE
HKCU - HKEY_CURRENT_USER
HKU - HKEY_USERS
<br>
'''<regkey>'''
The name of the registry to alter (ie. "Software\Microsoft\Windows").
 
'''<trustee>'''
A valid Windows(tm) account. The account can be specified as relative account name
(ie.Administrator" or "Everyone"), a qualified account name (ie. "Domain\Administrator")
or as Security identifier (SID, ie. "(S-1-5-32-545)"). "BUILTIN\USERS" is also a valid account
name. For a list of trustee names, open up Control Panel > Administrative Tools
> Computer Management > Local Users and Groups.
See also [http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q243330 Well-known security identifiers in Windows operating systems]
 
'''<permissions>'''
A combination of access rights (ie. "FullAccess" or "GenericRead + GenericWrite").
For a full list of access rights, open the AccessControl.c source file
in Notepad.
 
== Functions ==
* GrantOnFile [/NOINHERIT] <filename> <trustee> <permissions>
* GrantOnRegKey [/NOINHERIT] <rootkey> <regkey> <trustee> <permissions>
Makes sure that the trustee get the requested access rights on
that object.
 
* SetOnFile [/NOINHERIT] <filename> <trustee> <permissions>
* SetOnRegKey [/NOINHERIT] <rootkey> <regkey> <trustee> <permissions>
Deletes all permissions on the object and replaces them
with the specified access right.
 
* DenyOnFile [/NOINHERIT] <filename> <trustee> <permissions>
* DenyOnRegKey [/NOINHERIT] <rootkey> <regkey> <trustee> <permissions>
Explicitly denies an access right on a object.
 
* RevokeOnFile [/NOINHERIT] <filename> <trustee> <permissions>
* RevokeOnRegKey [/NOINHERIT] <rootkey> <regkey> <trustee> <permissions>
Removes a formerly defined access right for that object.
Note that permissions will still be revoked even if they are
inherited.
 
* SetFileOwner <filename> <trustee>
* SetRegKeyOwner <rootkey> <regkey> <trustee>
Changes the owner of an object.
 
* SetFileGroup <filename> <trustee>
* SetRegKeyGroup <rootkey> <regkey> <trustee>
Changes the primary group of the object.
 
* EnableInheritance <filename>
* EnableInheritance <rootkey> <regkey>
Enables inheritance of parent object permissions.
 
* DisableInheritance <filename>
* DisableInheritance <rootkey> <regkey>
Disables inheritance of parent object permissions.


== File and Directory Permission List ==
== File and Directory Permission List ==
Line 150: Line 85:
* NULL
* NULL


'''See also:''' [http://msdn2.microsoft.com/en-us/library/aa364399.aspx File Security and Access Rights]<br>
=== Registry Permissions ===
'''See also:''' [http://nsis.sourceforge.net/Talk:AccessControl_plug-in  Set the append/modify flag for ACLs]
* QueryValue
<p>
* SetValue
* CreateSubKey
* EnumerateSubKeys
* Notify
* CreateLink
* Delete
* ReadControl
* WriteDAC
* WriteOwner
* Synchronize
* GenericRead
* GenericWrite
* GenericExecute
* FullAccess
* NULL
 
'''See also:''' [http://msdn2.microsoft.com/en-us/library/aa364399.aspx File Security and Access Rights]<br />
'''See also:''' [http://nsis.sourceforge.net/Talk:AccessControl_plug-in  Set the append/modify flag for ACLs]<br />
'''Comment:''' The GenericWrite permission isn't the same like the one on the microsoft page.
'''Comment:''' The GenericWrite permission isn't the same like the one on the microsoft page.
</p>


== Credits ==
== Credits ==
Written by [http://taschenorakel.de/mathias/ Mathias Hasselmann]
Written by [http://taschenorakel.de/mathias/ Mathias Hasselmann]<br />
NSIS-Unicode port by [http://wizou.fr Olivier Marcoux]<br />
Major changes by [http://www.afrowsoft.co.uk Afrow UK]<br />
Win95/WinNT4 support and bugfixes by [[User:Anders|Anders]]


[[Category:Plugins]]
[[Category:Plugins]]

Latest revision as of 15:48, 24 February 2021

Author: tbf (talk, contrib)


Links

AccessControl.zip (48 KB) (includes NSIS-Unicode variant)

Run with conda execute or install with conda install (see Conda).

Well-known security identifiers in Windows operating systems

Description

Version: 1.0.8.3 (20210224)

Supported on: WinNT4+.

The AccessControl plugin for NSIS provides a set of functions related to Windows NT access control list (ACL) management.

Usage Example

# Give ownership for file C:\test.txt to Waterloo\Mathias
  AccessControl::SetFileOwner \
    "C:\test.txt" "Waterloo\Mathias"
  Pop $0 ; "error" on errors
 
# Make the directory "$INSTDIR\database" read write accessible by all users
  AccessControl::GrantOnFile \
    "$INSTDIR\database" "(BU)" "GenericRead + GenericWrite"
  Pop $0
 
# Give all authentificated users (BUILTIN\Users) full access on
# the registry key HKEY_LOCAL_MACHINE\Software\Vendor\SomeApp
  AccessControl::GrantOnRegKey \
    HKLM "Software\Vendor\SomeApp" "(BU)" "FullAccess"
  Pop $0
 
# Same as above, but with a numeric string SID
  AccessControl::GrantOnRegKey \
    HKLM "Software\Vendor\SomeApp" "(S-1-5-32-545)" "FullAccess"
  Pop $0

Detailed usage instructions and a list of functions can be found in the package readme Docs\AccessControl\AccessControl.txt.

File and Directory Permission List

File Permissions

  • ReadData
  • WriteData
  • AppendData
  • ReadEA
  • WriteEA
  • Execute
  • ReadAttributes
  • WriteAttributes
  • Delete
  • ReadControl
  • WriteDAC
  • WriteOwner
  • Synchronize
  • FullAccess
  • GenericRead
  • GenericWrite
  • GenericExecute
  • NULL

Directory Permissions

  • ListDirectory
  • AddFile
  • AddSubdirectory
  • ReadEA
  • WriteEA
  • Traverse
  • DeleteChild
  • ReadAttributes
  • WriteAttributes
  • Delete
  • ReadControl
  • WriteDAC
  • WriteOwner
  • Synchronize
  • FullAccess
  • GenericRead
  • GenericWrite
  • GenericExecute
  • NULL

Registry Permissions

  • QueryValue
  • SetValue
  • CreateSubKey
  • EnumerateSubKeys
  • Notify
  • CreateLink
  • Delete
  • ReadControl
  • WriteDAC
  • WriteOwner
  • Synchronize
  • GenericRead
  • GenericWrite
  • GenericExecute
  • FullAccess
  • NULL

See also: File Security and Access Rights
See also: Set the append/modify flag for ACLs
Comment: The GenericWrite permission isn't the same like the one on the microsoft page.

Credits

Written by Mathias Hasselmann
NSIS-Unicode port by Olivier Marcoux
Major changes by Afrow UK
Win95/WinNT4 support and bugfixes by Anders

Retrieved from "https://nsis.sourceforge.io/mediawiki/index.php?title=AccessControl_plug-in&oldid=25661"