Access to ACLs with the .NET Framework

With the .NET Framework 1.x, access to ACLs can only be granted to users via a series of cumbersome platform invocation (P/Invoke) calls.

The .NET Framework 2.0 allows developers to manipulate security settings of objects in a few easy steps using managed code. It does so by introducing the concepts of security objects and rules. The framework classes will be included in the new System.Security.AccessControl namespace.

Programming the inheritance part of the access control is not easy. Sementics part is easy, but the logical part is hard. Here is a list of terms being used:

• Explicit rules
• Inherited rules
• Container inherit
• Object inherit
• Inherit only
• No-propagate inherit

The Framework now models Windows security descriptors, allowing you to programmatically read and modify access control lists (ACL), take ownership of objects, convert between security descriptor description language (SDDL) strings and binary security descriptors, and more.

Read Mark Pustilnik's article Safety in Windows: Manage Access to Windows Objects with ACLs and the .NET Framework in more detail.