Documentation
¶
Overview ¶
Package windows owns the private runtime DACL grant policy.
Index ¶
- func Validate(account, owner string, present, null bool, entries []Entry, field string) error
- func ValidateAncestor(account, owner string, present, null bool, entries []Entry, field string) error
- func ValidateConfiguration(account string, descriptor Descriptor, field string) error
- type Assessment
- type Descriptor
- type Entry
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Validate ¶
Validate restricts grants without computing ordered effective access. SYSTEM and Administrators retain their privileged host-management access.
func ValidateAncestor ¶
func ValidateAncestor(account, owner string, present, null bool, entries []Entry, field string) error
ValidateAncestor checks ownership and mutation grants on a path ancestor. Shared reads, traversal, and subdirectory creation remain valid. Child ownership checks and protected private creation remain the caller's responsibility.
func ValidateConfiguration ¶
func ValidateConfiguration(account string, descriptor Descriptor, field string) error
ValidateConfiguration permits shared reads but restricts owners and mutation grants. A successful native file read must separately establish service read access.
Types ¶
type Assessment ¶
Assessment reports descriptor compatibility with the private DACL policy. Compatibility does not establish effective access, ancestor safety, or a stable snapshot.
func Assess ¶
func Assess(account string, descriptor Descriptor) Assessment
Assess classifies an observed descriptor without resolving principal names or reading files.
type Descriptor ¶
Descriptor owns the native security metadata used by the private DACL policy.
Source Files