RtlAddAccessAllowedAceEx - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
#ifndef _NTRTL_H
NTSYSAPI
NTSTATUS
NTAPI
RtlAddAccessAllowedAceEx(
_Inout_ PACL Acl,
_In_ ULONG AceRevision,
_In_ ULONG AceFlags,
_In_ ACCESS_MASK AccessMask,
_In_ PSID Sid
);
View code on GitHub// ntifs.h
NTSYSAPI NTSTATUS RtlAddAccessAllowedAceEx(
[in, out] PACL Acl,
[in] ULONG AceRevision,
[in] ULONG AceFlags,
[in] ACCESS_MASK AccessMask,
[in] PSID Sid
);
View the official Windows Driver Kit DDI referenceThis function is documented in Windows Driver Kit.
The RtlAddAccessAllowedAceEx routine adds an access-allowed access control entry (ACE ) with inheritance ACE flags to an access control list (ACL). The access is granted to the specified security identifier (SID).
Acl [in, out]A pointer to a caller-allocated buffer that contains the ACL to be modified. RtlAddAccessAllowedAceEx adds an access-allowed ACE to the end of this ACL. The ACE is in the form of an ACCESS_ALLOWED_ACE structure.
AceRevision [in]ACL revision level of the ACE to be added. This value can be ACL_REVISION or ACL_REVISION_DS. It must be ACL_REVISION_DS if the ACL contains an object-specific ACE.
AceFlags [in]Bitmask specifying the inherit flags of the ACE to be added.
AccessMask [in]A bitmask of one or more ACCESS_MASK flags that specify the access rights to be granted to the specified SID. For more information, see the description of the DesiredAccess parameter of ZwCreateFile.
Sid [in]A pointer to the SID structure that represents a user, group, or logon account that is being granted access.
RtlAddAccessAllowedAceEx can return one of the following values:
| Return code | Description |
|---|---|
| STATUS_SUCCESS | The ACE was successfully added. |
| STATUS_ALLOTTED_SPACE_EXCEEDED | A new ACE does not fit into the ACL. A larger ACL buffer is required. For more information about how to calculate the size of an ACL, see RtlCreateAcl. |
| STATUS_INVALID_ACL | The specified ACL is not correctly formed. |
| STATUS_INVALID_PARAMETER | The AceFlags parameter was invalid. |
| STATUS_INVALID_SID | The specified SID structure is not structurally valid. |
| STATUS_REVISION_MISMATCH | The specified AceRevision is not known or is not compatible with that of the ACL. |
Unlike RtlAddAccessAllowedAce, this routine sets the inheritance ACE flags.
For more information about security and access control, see Windows security model for driver developers and the documentation on these topics in the Windows SDK, such as:
RtlCreateSecurityDescriptorRelative