Friday, December 23, 2016

The surprising OWNER RIGHTS principal

Windows has a security principal called OWNER RIGHTS. Like several other all-caps principals, it doesn't apply to anyone in particular. It defines the access that the owner of the object is given even if not otherwise allowed. The surprising part is that the mere presence of an access control entry for this principal blows away the default rights granted to the owner (the ability to read and write the access control list). If you add an entry for this principal with no permissions, being the owner is no longer special other than in that the file size counts against the owner's disk quota.

No comments:

Post a Comment