Saturday, January 10, 2009

Avoid using name for well-known sid

Last week, I received the escalation that WTM could not be installed on German OS. In the log file, it seemed that SetEntriesInAcl returned the error code 534. As I checked the error code in Winerror.h. It means ERROR_ARITHMETIC_OVERFLOW -- Arithmetic result exceeded 32 bits. Then I looked at the code,

EXPLICIT_ACCESS ea;
ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));
ea.grfAccessPermissions = dwAccessRights;
ea.grfAccessMode = AccessMode;
ea.grfInheritance= dwInheritance;

ea.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
ea.Trustee.TrusteeType = TrusteeType;
ea.Trustee.ptstrName = L"EVERYONE";
// Create a new ACL that merges the new ACE into the existing DACL.
PACL pOldDACL = NULL, pNewDACL = NULL;

DWORD dwRes = SetEntriesInAcl(1, &ea, pOldDACL, &pNewDACL);

So far, the error code did not make any sense to me. Since the code just tried to add one entry to ACL, and the error code indicated arithmetic overflow. However, one thing caught my attention is the code hard-coded "Everyone" as trustee name. Then I tried to find "Everyone" group on German OS. It turned out that the group could not be found. I knew the code tried to set some permissions on a folder for everyone group. Unfortunately, German OS does not recognize "Everyone". So instead of using "Everyone", I used CreateWellKnownSid passing WinWordSid, which is a predefined well-known sid type for everyone group. The above code would be changed to

EXPLICIT_ACCESS ea;
ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));

ea.grfAccessPermissions = dwAccessRights;

ea.grfAccessMode = AccessMode;
ea.grfInheritance= dwInheritance;
ea.Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea.Trustee.TrusteeType = TrusteeType;

ea.Trustee.ptstrName = pEveryoneSid;

...

With that change, WTM is able to be installed on German OS.
 

0 comments:

Post a Comment