jperezduerto.info
Security in depth · Unit 22 · Lesson 26 of 44
DACLs describe permitted access
Distinguish a present empty DACL from an absent discretionary restriction.
Helpful before thisWindows privilege escalation
After this lesson you can
- Interpret DACL presence and entries before drawing an access conclusion.
One idea. One situation. One reasoned decision.
How it works
A discretionary access-control list contains entries that allow or deny access to an object for specified principals. The requested rights, relevant token, entry ordering, inheritance, and object behavior matter to evaluation. Avoid reducing this to a slogan such as “deny always wins” without context. A missing DACL and an empty DACL also have very different meanings: broad access versus no discretionary grants.
Read the supplied record
Two fictional inventory rows both show an entry count of zero:
| Object | DACL state |
|---|---|
| A | Present, empty list |
| B | No DACL restriction |
For an ordinary discretionary check, A has no grants in the list; B does not restrict access through a DACL. The same numeric count therefore cannot support the same conclusion. Obtain the descriptor state as well as the entries.
For a populated DACL, preserve entry order and identify explicit versus inherited entries. The system evaluates relevant entries for the requested rights; the phrase “deny always wins” can conceal those details. Other controls and special rights can also matter to the final operation.
An inventory should distinguish an unreadable descriptor from either of these states. A collection failure is missing evidence, not an empty policy. That difference affects both the severity of a finding and the next verification step.
The key distinction: An empty DACL grants no discretionary access; an absent one does not impose those restrictions.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
A descriptor explicitly contains a present, empty DACL. In an ordinary discretionary check without an overriding privilege or special owner right, what does it grant?
Show the answer
Correct answer: No discretionary grants to satisfy the request. The list exists and has no allow entries. It must not be confused with an absent or null DACL.
Try it
- WriteWrite the distinct conclusions supported by the two supplied records. State why an entry count alone is insufficient.