If someone could tell me what I’m doing wrong here, I’ll be greatful…
I’m trying to deny DELETE access to a registry key for everyone except the
program that has created it. Here’s a test code I’m using:
HKEY hKey;
DWORD dwDisposition;
PSECURITY_DESCRIPTOR psd;
PACL pOldDacl, pNewDacl;
EXPLICIT_ACCESS ea[2];
char szName1 = “EVERYONE”;
char szName2 = “CREATOR OWNER”;
DWORD a;
a = ::RegCreateKeyEx(
HKEY_LOCAL_MACHINE,
“SOFTWARE\Envox\RegTest”,
0,
NULL,
0,
KEY_ALL_ACCESS,
NULL,
&hKey,
&dwDisposition);
a = ::GetSecurityInfo(
hKey,
SE_REGISTRY_KEY,
DACL_SECURITY_INFORMATION,
NULL,
NULL,
&pOldDacl,
NULL,
&psd);
::BuildExplicitAccessWithName(
&ea[0],
szName1,
DELETE,
DENY_ACCESS,
CONTAINER_INHERIT_ACE);
::BuildExplicitAccessWithName(
&ea[1],
szName2,
DELETE,
GRANT_ACCESS,
CONTAINER_INHERIT_ACE);
a = ::SetEntriesInAcl(
2,
ea,
pOldDacl,
&pNewDacl);
a = ::SetSecurityInfo(
hKey,
SE_REGISTRY_KEY,
DACL_SECURITY_INFORMATION,
NULL,
NULL,
pNewDacl,
NULL);
::LocalFree(psd);
::LocalFree(pOldDacl);
::LocalFree(pNewDacl);
a = ::RegCloseKey(hKey);
a = ::RegDeleteKey(HKEY_LOCAL_MACHINE, “SOFTWARE\Envox\RegTest”);
It succeedes in denying delete access to everyone, but it fails to grant it
back to the program (SetSecurityInfo returns a success code, but RegDeleteKey
fails with ACCESS_DENIED)
I also tried using CURRENT_USER as szName2, setting the access rights one by
one, but nothing works…
TIA,
Marko
ICQ: 5990814
Research is what I’m doing when I don’t know what I’m doing.
– Wernher von Braun