From 47040a14cd50bf50429f44eba0acdcf736412b61 Mon Sep 17 00:00:00 2001 From: Eugene Burkov Date: Tue, 3 Dec 2024 14:26:43 +0300 Subject: [PATCH] permcheck: fix nil entries --- internal/permcheck/security_windows.go | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/internal/permcheck/security_windows.go b/internal/permcheck/security_windows.go index 8174a4af..39ee2a9c 100644 --- a/internal/permcheck/security_windows.go +++ b/internal/permcheck/security_windows.go @@ -72,16 +72,23 @@ func rangeACEs(dacl *windows.ACL, f aceFunc) (err error) { } // setSecurityInfo sets the security information on the specified file, using -// ents to create a discretionary access control list. Both owner and ents can -// be nil, in which case the corresponding information is not set. +// ents to create a discretionary access control list. Either owner or ents can +// be nil, in which case the corresponding information is not set, but at least +// one of them should be specified. func setSecurityInfo(fname string, owner *windows.SID, ents []windows.EXPLICIT_ACCESS) (err error) { var secInfo windows.SECURITY_INFORMATION + var acl *windows.ACL if len(ents) > 0 { // TODO(e.burkov): Investigate if this whole set is necessary. secInfo |= windows.DACL_SECURITY_INFORMATION | windows.PROTECTED_DACL_SECURITY_INFORMATION | windows.UNPROTECTED_DACL_SECURITY_INFORMATION + + acl, err = windows.ACLFromEntries(ents, nil) + if err != nil { + return fmt.Errorf("creating access control list: %w", err) + } } if owner != nil { @@ -92,11 +99,6 @@ func setSecurityInfo(fname string, owner *windows.SID, ents []windows.EXPLICIT_A return errors.Error("no security information to set") } - acl, err := windows.ACLFromEntries(ents, nil) - if err != nil { - return fmt.Errorf("creating access control list: %w", err) - } - err = windows.SetNamedSecurityInfo(fname, objectType, secInfo, owner, nil, acl, nil) if err != nil { return fmt.Errorf("setting security info: %w", err)