Security watch Tools for managing ACLs Jesper M Johansson Before I go into how to save or re- In Windows, access control lists (ACLs) store ACLs, let me first explore why it is so difficult. Let’s say you have a hier- give you extremely fine control over archy containing user data for students at a local college. You save the ACL on the ability of users and processes to 1 February. On 17 April you discover that somehow the ACL has been cor- use resources such as files and folders. rupted and you go to restore it from the saved copy. What complications Managing ACLs can be one of the more could there be with this operation? First, the new quarter started on complicated tasks related to protecting the 2 April. About 15 per cent of your students graduated; consequently, security of your users’ systems. Fortunately, their directories no longer exist. Thus, you have ACLs in the backup file that there are a number of useful utilities are invalid. You also have a batch of new students, another 15 per cent, that that help automate and simplify tasks granular permissions introduced with started with the new quarter. They surrounding permissions and ACLs. Windows 2000, making this an update have home directories now, but no Most readers are familiar with the that is about seven years overdue. ACLs in the backup file. What should venerable cacls.exe tool that has been Surprisingly, in spite of being dep- their ACLs be? Then of course you in every version of Windows NT since recated, cacls.exe does actually include have the 70 per cent that are still there, it first came out. If you run cacls.exe in some new features. First, it is aware but they have created new files and Windows Vista, you are greeted with of both junction points and symbol- folders and deleted others. You can ig- this message: ic links, and knows to traverse those. nore the deleted ones, but how do you Microsoft Windows [Version 6.0.5744] Second, it can both print and set an configure the new folders they creat- Copyright (c) 2006 Microsoft Corporation. All rights reserved. ACL using a Security Description Def­i ed? What if a student decided to share nition Language (SDDL) string. a folder with his friends on 4 March? C:\Windows\system32>cacls However, in spite of the updates to Will you break that when you restore NOTE: Cacls is now deprecated, please use cacls.exe, you really want the function- the ACL? Icacls. ality available in icacls.exe. Saving and restoring ACLs is not In addition to updates to ACLs in nearly as simple an operation as many Windows Vista (see technetmagazine. Saving and restoring ACLs people would have you believe. You com/issues/2007/06), Microsoft has A constant wish – at least of mine – for need to tread extremely lightly when also updated some of the tools that the past 10 years has been the ability doing so. It is very possible, even likely, you use to manage ACLs. Interestingly, to save an ACL so that you can restore that you will have some undefined be- the most significant of these updates it at a later date. This turns out to be haviour as a result. Restoring ACLs is are command-line tools. one of the most complicated opera- definitely a last resort; the longer it has Icacls.exe is new in Windows Vista tions you can perform on ACLs. Except been since you backed it up, the more (and also down-level in Windows in certain special cases, it is unlikely to likely it is that something will break Server 2003 Service Pack 2). It will get back to exactly where you would when you restore it. eventually replace cacls.exe, which, have been had you not ruined the If you nevertheless wish to try this as you may be aware, was never com- ACLs in the first place. Nevertheless, functionality, run icacls.exe with the pletely updated to support the more this functionality can be quite useful. /save switch: TechNet Magazine September 2007 75 75_79_SecWatch.desfin.indd 75 8/8/07 16:33:53 Security watch icacls <target> /save acls.bin /t tor, you would find that it appears to flaw was not fixed prior to release. At be a Unicode (UTF-16) formatted text this point in time, we do not know This would save the ACLs to a file file. In fact, that is almost exactly what when, or even whether, it will be fixed. called acls.bin. The file will contain it is. This might lead you to think you So for now, the best advice is to not one line for each object with an ACL could edit it and save it from a text edi- edit your saved ACLs. If you need to followed by one line specifying the tor. Don’t do it! do so, save the file as a .bin file and use ACL in SDDL. Using the /t switch the If you open the file that contains the a hex editor, such as your favourite de- command will operate on the object saved ACLs in a text editor and then velopment environment. you specified and all objects and con- save it, you will not be able to restore Once you have saved an ACL using tainers underneath it. the ACLs from that file. It turns out the /save switch, you can restore it us- The save functionality is a welcome that it is not actually a Unicode text ing icacls.exe with the /restore switch. addition to the toolkit, but it has a file after all. Such a file must begin The restore command in its simplest few flaws. For example, it only saves with the 2 bytes 0xfffe. If you save the form uses this syntax: the discretionary access control list file with a text editor, such as Notepad, icacls <directory> /restore acls.bin (DACL), not the system access control it will in fact put that flag into the file list (SACL). In fact, if there is a SACL, in the first 2 bytes. The icacls.exe tool, The restore procedure does not op- it saves a dummy value that indicates however, expects the ACL data to start erate on files. To see this, look at the se- this, but it does not actually save any at byte 0 in the file. Consequently, the quence of commands shown in Figure part of the SACL. tool will be unable to parse the ACLs 1. Here I create a save file by point- In addition, the way the ACL is saved in the file as it expects the first two ing icacls.exe at a file. I then try to re- creates an interesting problem. Before bytes to be part of the string specifying store it by simply substituting /restore you open the saved ACL in your favou- the object to operate on. Your backup for /save. This fails because the restore rite text editor, remember: file will be unusable. command only operates on directories. Do Not Edit Your Saved ACL! Microsoft is aware of this problem, The files it is supposed to modify are If you were to open the file con- but as it was only reported very late in specified in the acls.bin file already. To taining your saved ACL in a text edi- the beta cycle for Windows Vista, this restore the ACL, I point it at the direc- tory instead of the file. This is what I do in the last command where I speci- Figure 1 Saving and restoring ACLs fy “.” as the object to operate on. C:\Users\Jesper>icacls test.txt /save acls.bin Note also that the restore command processed file: test.txt Successfully processed 1 files; Failed processing 0 files must run elevated! You can run the save C:\Users\Jesper>icacls test.txt /restore acls.bin command from a command prompt test.txt\test.txt: The system cannot find the path specified running as a low admin or even a stan- Successfully processed 0 files; Failed processing 1 files dard user, so long as you have the right C:\Users\Jesper>icacls . /restore acls.bin processed file: .\test.txt to read the ACL. However, to restore Successfully processed 1 files; Failed processing 0 files the ACL you need to have a complete, unadulterated administrative token. Figure 2 Substituting SIDs during restore Substituting SIDs C:\Users\Jesper>icacls test.txt test.txt VistaRC2-Test\foo:(R,W) Another feature that’s very useful in VistaRC2-Test\Jesper:(I)(F) icacls.exe is the ability to replace the NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Administrators:(I)(F) permissions for one user with permis- Successfully processed 1 files; Failed processing 0 files sions for a different user. This is done C:\Users\Jesper>icacls test.txt /save acls.bin during restore using the /substitute processed file: test.txt switch. The documentation for the Successfully processed 1 files; Failed processing 0 files substitute switch says it needs an SID, C:\Users\Jesper>icacls. /substitute foo bar /restore acls.bin processed file: .\test.txt but later it explains that this can actual- Successfully processed 1 files; Failed processing 0 files ly also be a regular user name. Thus, the C:\Users\Jesper>icacls test.txt sequence shown in Figure 2 works. test.txt VistaRC2-Test\bar:(R,W) VistaRC2-Test\Jesper:(I)(F) As you can see, I end up with the NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Administrators:(I)(F) same ACL I had before, but the ACE Successfully processed 1 files; Failed processing 0 files that used to specify permissions for foo now specifies them for bar instead.