NAME

Win32::SDDL - SDDL parsing module for Windows

SYNOPSIS

    use Win32::SDDL;

    my $sddl = Win32::SDDL->new( 'service' );

    $sddl->Import( 'D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPLOCRRC;;;PU)' );

    foreach my $mask( @{$sddl->{ACL}} ){
        $trustees{ $mask->{Trustee} } = 1;
    }

    my @trustees = sort keys %trustees;


    print scalar( @{$sddl->{ACL}} )." entries found.\n";

DESCRIPTION

This module was created to aid in interpreting SDDL strings commonly used in Windows to represent access control lists. SDDL stands for Security Descriptor Definition Language. Because SDDL uses many predefined constants, it can be difficult to read. This module provides an object-oriented interface for converting and using the information in SDDL strings.

NOTE: For resources relating to SDDL, see the SEE ALSO section of this document.

METHODS

Win32::SDDL->new( *type* );

Example:

    my $sddl = Win32::SDDL->new( 'service' );

Creates a new Win32::SDDL object. Optionally, an object type can be provided. The only optional type supported at present is 'service'. This will change the value of certain constants as they have a different meaning for services than they do for files, registry keys, or other objects.

$sddl->Import( $sddl_string );

Example:

    my $sddl_string = 'D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPLOCRRC;;;PU)';

    $sddl->Import( $sddl_string ) or die( "Error!  Unable to import '$sddl_string'!\n" );

PROPERTIES

All Win32::SDDL objects have the following properties:

$sddl->{SDString}

The currently loaded SDDL string

$sddl->{Type}

The type of SDDL string (changes the description of some constants).

$sddl->{ACL}

An array of Win32::SDDL::ACE objects.

Each object has the following properties:

Flags

An array of flags translated into English.

AccessMask

An array of permissions translated into English.

Type

The type of ACE (SYSTEM_AUDIT,ACCESS_ALLOW, or ACCESS_DENY).

objectType

A GUID representing the object type for the ACE (usually empty).

InheritedObjectType

A GUID representing the parent object type if it exists.

Trustee

The Trustee name.

UPDATE HISTORY

See the Changes file.

BUGS/CHANGES NEEDED

Replace Win32::OLE Dependency

Right now I'm using WMI to translate SIDs to account names. I would like to find a way to import the Win32 API with a minimal footprint to reduce the size of the module for people who distribute packaged executables and archives of their scripts.

Have any questions/suggestions?

Please contact me if you have any requests or suggestions.

SEE ALSO

http://windowssdk.msdn.microsoft.com/en-us/library/ms723280.aspx

COPYRIGHT

Copyright 2006 Tim Johnson

This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

AUTHOR

Tim Johnson <tojo2000@tojo2000.com>