ホーム › System.GroupPolicy › RsopAccessCheckByType

RsopAccessCheckByType

関数

RSOPトークンで種類別のアクセス許可を判定する。

DLLUSERENV.dll呼出規約winapiSetLastErrorあり対応OSWindows Vista 以降

シグネチャ

// USERENV.dll
#include <windows.h>

HRESULT RsopAccessCheckByType(
    PSECURITY_DESCRIPTOR pSecurityDescriptor,
    PSID pPrincipalSelfSid,   // optional
    void* pRsopToken,
    DWORD dwDesiredAccessMask,
    OBJECT_TYPE_LIST* pObjectTypeList,   // optional
    DWORD ObjectTypeListLength,
    GENERIC_MAPPING* pGenericMapping,
    PRIVILEGE_SET* pPrivilegeSet,   // optional
    DWORD* pdwPrivilegeSetLength,   // optional
    DWORD* pdwGrantedAccessMask,
    BOOL* pbAccessStatus
);

パラメーター

名前	型	方向
pSecurityDescriptor	PSECURITY_DESCRIPTOR	in
pPrincipalSelfSid	PSID	inoptional
pRsopToken	void*	in
dwDesiredAccessMask	DWORD	in
pObjectTypeList	OBJECT_TYPE_LIST*	inoptional
ObjectTypeListLength	DWORD	in
pGenericMapping	GENERIC_MAPPING*	in
pPrivilegeSet	PRIVILEGE_SET*	inoptional
pdwPrivilegeSetLength	DWORD*	inoptional
pdwGrantedAccessMask	DWORD*	out
pbAccessStatus	BOOL*	out

戻り値の型: HRESULT

各言語での呼び出し定義

// USERENV.dll
#include <windows.h>

HRESULT RsopAccessCheckByType(
    PSECURITY_DESCRIPTOR pSecurityDescriptor,
    PSID pPrincipalSelfSid,   // optional
    void* pRsopToken,
    DWORD dwDesiredAccessMask,
    OBJECT_TYPE_LIST* pObjectTypeList,   // optional
    DWORD ObjectTypeListLength,
    GENERIC_MAPPING* pGenericMapping,
    PRIVILEGE_SET* pPrivilegeSet,   // optional
    DWORD* pdwPrivilegeSetLength,   // optional
    DWORD* pdwGrantedAccessMask,
    BOOL* pbAccessStatus
);

[DllImport("USERENV.dll", SetLastError = true, ExactSpelling = true)]
static extern int RsopAccessCheckByType(
    IntPtr pSecurityDescriptor,   // PSECURITY_DESCRIPTOR
    IntPtr pPrincipalSelfSid,   // PSID optional
    IntPtr pRsopToken,   // void*
    uint dwDesiredAccessMask,   // DWORD
    IntPtr pObjectTypeList,   // OBJECT_TYPE_LIST* optional
    uint ObjectTypeListLength,   // DWORD
    IntPtr pGenericMapping,   // GENERIC_MAPPING*
    IntPtr pPrivilegeSet,   // PRIVILEGE_SET* optional
    IntPtr pdwPrivilegeSetLength,   // DWORD* optional
    out uint pdwGrantedAccessMask,   // DWORD* out
    out int pbAccessStatus   // BOOL* out
);

<DllImport("USERENV.dll", SetLastError:=True, ExactSpelling:=True)>
Public Shared Function RsopAccessCheckByType(
    pSecurityDescriptor As IntPtr,   ' PSECURITY_DESCRIPTOR
    pPrincipalSelfSid As IntPtr,   ' PSID optional
    pRsopToken As IntPtr,   ' void*
    dwDesiredAccessMask As UInteger,   ' DWORD
    pObjectTypeList As IntPtr,   ' OBJECT_TYPE_LIST* optional
    ObjectTypeListLength As UInteger,   ' DWORD
    pGenericMapping As IntPtr,   ' GENERIC_MAPPING*
    pPrivilegeSet As IntPtr,   ' PRIVILEGE_SET* optional
    pdwPrivilegeSetLength As IntPtr,   ' DWORD* optional
    <Out> ByRef pdwGrantedAccessMask As UInteger,   ' DWORD* out
    <Out> ByRef pbAccessStatus As Integer   ' BOOL* out
) As Integer
End Function

' pSecurityDescriptor : PSECURITY_DESCRIPTOR
' pPrincipalSelfSid : PSID optional
' pRsopToken : void*
' dwDesiredAccessMask : DWORD
' pObjectTypeList : OBJECT_TYPE_LIST* optional
' ObjectTypeListLength : DWORD
' pGenericMapping : GENERIC_MAPPING*
' pPrivilegeSet : PRIVILEGE_SET* optional
' pdwPrivilegeSetLength : DWORD* optional
' pdwGrantedAccessMask : DWORD* out
' pbAccessStatus : BOOL* out
Declare PtrSafe Function RsopAccessCheckByType Lib "userenv" ( _
    ByVal pSecurityDescriptor As LongPtr, _
    ByVal pPrincipalSelfSid As LongPtr, _
    ByVal pRsopToken As LongPtr, _
    ByVal dwDesiredAccessMask As Long, _
    ByVal pObjectTypeList As LongPtr, _
    ByVal ObjectTypeListLength As Long, _
    ByVal pGenericMapping As LongPtr, _
    ByVal pPrivilegeSet As LongPtr, _
    ByVal pdwPrivilegeSetLength As LongPtr, _
    ByRef pdwGrantedAccessMask As Long, _
    ByRef pbAccessStatus As Long) As Long
' VBA7前提(PtrSafe)。32bit Office では LongPtr→Long。Integer=16bit / Long=32bit / LongLong=64bit。

import ctypes
from ctypes import wintypes

RsopAccessCheckByType = ctypes.windll.userenv.RsopAccessCheckByType
RsopAccessCheckByType.restype = ctypes.c_int
RsopAccessCheckByType.argtypes = [
    wintypes.HANDLE,  # pSecurityDescriptor : PSECURITY_DESCRIPTOR
    wintypes.HANDLE,  # pPrincipalSelfSid : PSID optional
    ctypes.POINTER(None),  # pRsopToken : void*
    wintypes.DWORD,  # dwDesiredAccessMask : DWORD
    ctypes.c_void_p,  # pObjectTypeList : OBJECT_TYPE_LIST* optional
    wintypes.DWORD,  # ObjectTypeListLength : DWORD
    ctypes.c_void_p,  # pGenericMapping : GENERIC_MAPPING*
    ctypes.c_void_p,  # pPrivilegeSet : PRIVILEGE_SET* optional
    ctypes.POINTER(wintypes.DWORD),  # pdwPrivilegeSetLength : DWORD* optional
    ctypes.POINTER(wintypes.DWORD),  # pdwGrantedAccessMask : DWORD* out
    ctypes.c_void_p,  # pbAccessStatus : BOOL* out
]
# GetLastError: use ctypes.GetLastError() (or ctypes.WinDLL(use_last_error=True))

require 'fiddle'
require 'fiddle/import'

lib = Fiddle.dlopen('USERENV.dll')
RsopAccessCheckByType = Fiddle::Function.new(
  lib['RsopAccessCheckByType'],
  [
    Fiddle::TYPE_VOIDP,  # pSecurityDescriptor : PSECURITY_DESCRIPTOR
    Fiddle::TYPE_VOIDP,  # pPrincipalSelfSid : PSID optional
    Fiddle::TYPE_VOIDP,  # pRsopToken : void*
    -Fiddle::TYPE_INT,  # dwDesiredAccessMask : DWORD
    Fiddle::TYPE_VOIDP,  # pObjectTypeList : OBJECT_TYPE_LIST* optional
    -Fiddle::TYPE_INT,  # ObjectTypeListLength : DWORD
    Fiddle::TYPE_VOIDP,  # pGenericMapping : GENERIC_MAPPING*
    Fiddle::TYPE_VOIDP,  # pPrivilegeSet : PRIVILEGE_SET* optional
    Fiddle::TYPE_VOIDP,  # pdwPrivilegeSetLength : DWORD* optional
    Fiddle::TYPE_VOIDP,  # pdwGrantedAccessMask : DWORD* out
    Fiddle::TYPE_VOIDP,  # pbAccessStatus : BOOL* out
  ],
  Fiddle::TYPE_INT)

#[link(name = "userenv")]
extern "system" {
    fn RsopAccessCheckByType(
        pSecurityDescriptor: *mut core::ffi::c_void,  // PSECURITY_DESCRIPTOR
        pPrincipalSelfSid: *mut core::ffi::c_void,  // PSID optional
        pRsopToken: *mut (),  // void*
        dwDesiredAccessMask: u32,  // DWORD
        pObjectTypeList: *mut OBJECT_TYPE_LIST,  // OBJECT_TYPE_LIST* optional
        ObjectTypeListLength: u32,  // DWORD
        pGenericMapping: *mut GENERIC_MAPPING,  // GENERIC_MAPPING*
        pPrivilegeSet: *mut PRIVILEGE_SET,  // PRIVILEGE_SET* optional
        pdwPrivilegeSetLength: *mut u32,  // DWORD* optional
        pdwGrantedAccessMask: *mut u32,  // DWORD* out
        pbAccessStatus: *mut i32  // BOOL* out
    ) -> i32;
}
// crates: windows-sys provides ready-made bindings for this API.

$sig = @"
[DllImport("USERENV.dll", SetLastError = true)]
public static extern int RsopAccessCheckByType(IntPtr pSecurityDescriptor, IntPtr pPrincipalSelfSid, IntPtr pRsopToken, uint dwDesiredAccessMask, IntPtr pObjectTypeList, uint ObjectTypeListLength, IntPtr pGenericMapping, IntPtr pPrivilegeSet, IntPtr pdwPrivilegeSetLength, out uint pdwGrantedAccessMask, out int pbAccessStatus);
"@
$api = Add-Type -MemberDefinition $sig -Name 'USERENV_RsopAccessCheckByType' -Namespace Win32 -PassThru
# $api::RsopAccessCheckByType(pSecurityDescriptor, pPrincipalSelfSid, pRsopToken, dwDesiredAccessMask, pObjectTypeList, ObjectTypeListLength, pGenericMapping, pPrivilegeSet, pdwPrivilegeSetLength, pdwGrantedAccessMask, pbAccessStatus)

#uselib "USERENV.dll"
#func global RsopAccessCheckByType "RsopAccessCheckByType" sptr, sptr, sptr, sptr, sptr, sptr, sptr, sptr, sptr, sptr, sptr
; RsopAccessCheckByType pSecurityDescriptor, pPrincipalSelfSid, pRsopToken, dwDesiredAccessMask, varptr(pObjectTypeList), ObjectTypeListLength, varptr(pGenericMapping), varptr(pPrivilegeSet), varptr(pdwPrivilegeSetLength), varptr(pdwGrantedAccessMask), pbAccessStatus   ; 戻り値は stat
; pSecurityDescriptor : PSECURITY_DESCRIPTOR -> "sptr"
; pPrincipalSelfSid : PSID optional -> "sptr"
; pRsopToken : void* -> "sptr"
; dwDesiredAccessMask : DWORD -> "sptr"
; pObjectTypeList : OBJECT_TYPE_LIST* optional -> "sptr"
; ObjectTypeListLength : DWORD -> "sptr"
; pGenericMapping : GENERIC_MAPPING* -> "sptr"
; pPrivilegeSet : PRIVILEGE_SET* optional -> "sptr"
; pdwPrivilegeSetLength : DWORD* optional -> "sptr"
; pdwGrantedAccessMask : DWORD* out -> "sptr"
; pbAccessStatus : BOOL* out -> "sptr"
; ※HSP3.7は #func のため戻り値はシステム変数 stat に格納されます。

出力引数:

#uselib "USERENV.dll"
#cfunc global RsopAccessCheckByType "RsopAccessCheckByType" sptr, sptr, sptr, int, var, int, var, var, var, var, int
; res = RsopAccessCheckByType(pSecurityDescriptor, pPrincipalSelfSid, pRsopToken, dwDesiredAccessMask, pObjectTypeList, ObjectTypeListLength, pGenericMapping, pPrivilegeSet, pdwPrivilegeSetLength, pdwGrantedAccessMask, pbAccessStatus)
; pSecurityDescriptor : PSECURITY_DESCRIPTOR -> "sptr"
; pPrincipalSelfSid : PSID optional -> "sptr"
; pRsopToken : void* -> "sptr"
; dwDesiredAccessMask : DWORD -> "int"
; pObjectTypeList : OBJECT_TYPE_LIST* optional -> "var"
; ObjectTypeListLength : DWORD -> "int"
; pGenericMapping : GENERIC_MAPPING* -> "var"
; pPrivilegeSet : PRIVILEGE_SET* optional -> "var"
; pdwPrivilegeSetLength : DWORD* optional -> "var"
; pdwGrantedAccessMask : DWORD* out -> "var"
; pbAccessStatus : BOOL* out -> "int"
; ※出力/バッファ引数は var 方式(変数を直接渡す)。varptr 方式にも切替可。#uselib "USERENV.dll"
#cfunc global RsopAccessCheckByType "RsopAccessCheckByType" sptr, sptr, sptr, int, sptr, int, sptr, sptr, sptr, sptr, int
; res = RsopAccessCheckByType(pSecurityDescriptor, pPrincipalSelfSid, pRsopToken, dwDesiredAccessMask, varptr(pObjectTypeList), ObjectTypeListLength, varptr(pGenericMapping), varptr(pPrivilegeSet), varptr(pdwPrivilegeSetLength), varptr(pdwGrantedAccessMask), pbAccessStatus)
; pSecurityDescriptor : PSECURITY_DESCRIPTOR -> "sptr"
; pPrincipalSelfSid : PSID optional -> "sptr"
; pRsopToken : void* -> "sptr"
; dwDesiredAccessMask : DWORD -> "int"
; pObjectTypeList : OBJECT_TYPE_LIST* optional -> "sptr"
; ObjectTypeListLength : DWORD -> "int"
; pGenericMapping : GENERIC_MAPPING* -> "sptr"
; pPrivilegeSet : PRIVILEGE_SET* optional -> "sptr"
; pdwPrivilegeSetLength : DWORD* optional -> "sptr"
; pdwGrantedAccessMask : DWORD* out -> "sptr"
; pbAccessStatus : BOOL* out -> "int"
; ※出力/バッファ引数はポインタ方式(token=sptr / 呼び出しは varptr(変数))。

出力引数:

; HRESULT RsopAccessCheckByType(PSECURITY_DESCRIPTOR pSecurityDescriptor, PSID pPrincipalSelfSid, void* pRsopToken, DWORD dwDesiredAccessMask, OBJECT_TYPE_LIST* pObjectTypeList, DWORD ObjectTypeListLength, GENERIC_MAPPING* pGenericMapping, PRIVILEGE_SET* pPrivilegeSet, DWORD* pdwPrivilegeSetLength, DWORD* pdwGrantedAccessMask, BOOL* pbAccessStatus)
#uselib "USERENV.dll"
#cfunc global RsopAccessCheckByType "RsopAccessCheckByType" intptr, intptr, intptr, int, var, int, var, var, var, var, int
; res = RsopAccessCheckByType(pSecurityDescriptor, pPrincipalSelfSid, pRsopToken, dwDesiredAccessMask, pObjectTypeList, ObjectTypeListLength, pGenericMapping, pPrivilegeSet, pdwPrivilegeSetLength, pdwGrantedAccessMask, pbAccessStatus)
; pSecurityDescriptor : PSECURITY_DESCRIPTOR -> "intptr"
; pPrincipalSelfSid : PSID optional -> "intptr"
; pRsopToken : void* -> "intptr"
; dwDesiredAccessMask : DWORD -> "int"
; pObjectTypeList : OBJECT_TYPE_LIST* optional -> "var"
; ObjectTypeListLength : DWORD -> "int"
; pGenericMapping : GENERIC_MAPPING* -> "var"
; pPrivilegeSet : PRIVILEGE_SET* optional -> "var"
; pdwPrivilegeSetLength : DWORD* optional -> "var"
; pdwGrantedAccessMask : DWORD* out -> "var"
; pbAccessStatus : BOOL* out -> "int"
; ※出力/バッファ引数は var 方式(変数を直接渡す)。varptr 方式にも切替可。; HRESULT RsopAccessCheckByType(PSECURITY_DESCRIPTOR pSecurityDescriptor, PSID pPrincipalSelfSid, void* pRsopToken, DWORD dwDesiredAccessMask, OBJECT_TYPE_LIST* pObjectTypeList, DWORD ObjectTypeListLength, GENERIC_MAPPING* pGenericMapping, PRIVILEGE_SET* pPrivilegeSet, DWORD* pdwPrivilegeSetLength, DWORD* pdwGrantedAccessMask, BOOL* pbAccessStatus)
#uselib "USERENV.dll"
#cfunc global RsopAccessCheckByType "RsopAccessCheckByType" intptr, intptr, intptr, int, intptr, int, intptr, intptr, intptr, intptr, int
; res = RsopAccessCheckByType(pSecurityDescriptor, pPrincipalSelfSid, pRsopToken, dwDesiredAccessMask, varptr(pObjectTypeList), ObjectTypeListLength, varptr(pGenericMapping), varptr(pPrivilegeSet), varptr(pdwPrivilegeSetLength), varptr(pdwGrantedAccessMask), pbAccessStatus)
; pSecurityDescriptor : PSECURITY_DESCRIPTOR -> "intptr"
; pPrincipalSelfSid : PSID optional -> "intptr"
; pRsopToken : void* -> "intptr"
; dwDesiredAccessMask : DWORD -> "int"
; pObjectTypeList : OBJECT_TYPE_LIST* optional -> "intptr"
; ObjectTypeListLength : DWORD -> "int"
; pGenericMapping : GENERIC_MAPPING* -> "intptr"
; pPrivilegeSet : PRIVILEGE_SET* optional -> "intptr"
; pdwPrivilegeSetLength : DWORD* optional -> "intptr"
; pdwGrantedAccessMask : DWORD* out -> "intptr"
; pbAccessStatus : BOOL* out -> "int"
; ※出力/バッファ引数はポインタ方式(token=intptr / 呼び出しは varptr(変数))。

import (
	"golang.org/x/sys/windows"
	"unsafe"
)

var (
	userenv = windows.NewLazySystemDLL("USERENV.dll")
	procRsopAccessCheckByType = userenv.NewProc("RsopAccessCheckByType")
)

// pSecurityDescriptor (PSECURITY_DESCRIPTOR), pPrincipalSelfSid (PSID optional), pRsopToken (void*), dwDesiredAccessMask (DWORD), pObjectTypeList (OBJECT_TYPE_LIST* optional), ObjectTypeListLength (DWORD), pGenericMapping (GENERIC_MAPPING*), pPrivilegeSet (PRIVILEGE_SET* optional), pdwPrivilegeSetLength (DWORD* optional), pdwGrantedAccessMask (DWORD* out), pbAccessStatus (BOOL* out)
r1, _, err := procRsopAccessCheckByType.Call(
	uintptr(pSecurityDescriptor),
	uintptr(pPrincipalSelfSid),
	uintptr(pRsopToken),
	uintptr(dwDesiredAccessMask),
	uintptr(pObjectTypeList),
	uintptr(ObjectTypeListLength),
	uintptr(pGenericMapping),
	uintptr(pPrivilegeSet),
	uintptr(pdwPrivilegeSetLength),
	uintptr(pdwGrantedAccessMask),
	uintptr(pbAccessStatus),
)
_ = err  // syscall.Errno (valid when the call sets last-error)
_ = r1   // HRESULT

function RsopAccessCheckByType(
  pSecurityDescriptor: THandle;   // PSECURITY_DESCRIPTOR
  pPrincipalSelfSid: THandle;   // PSID optional
  pRsopToken: Pointer;   // void*
  dwDesiredAccessMask: DWORD;   // DWORD
  pObjectTypeList: Pointer;   // OBJECT_TYPE_LIST* optional
  ObjectTypeListLength: DWORD;   // DWORD
  pGenericMapping: Pointer;   // GENERIC_MAPPING*
  pPrivilegeSet: Pointer;   // PRIVILEGE_SET* optional
  pdwPrivilegeSetLength: Pointer;   // DWORD* optional
  pdwGrantedAccessMask: Pointer;   // DWORD* out
  pbAccessStatus: Pointer   // BOOL* out
): Integer; stdcall;
  external 'USERENV.dll' name 'RsopAccessCheckByType';

result := DllCall("USERENV\RsopAccessCheckByType"
    , "Ptr", pSecurityDescriptor   ; PSECURITY_DESCRIPTOR
    , "Ptr", pPrincipalSelfSid   ; PSID optional
    , "Ptr", pRsopToken   ; void*
    , "UInt", dwDesiredAccessMask   ; DWORD
    , "Ptr", pObjectTypeList   ; OBJECT_TYPE_LIST* optional
    , "UInt", ObjectTypeListLength   ; DWORD
    , "Ptr", pGenericMapping   ; GENERIC_MAPPING*
    , "Ptr", pPrivilegeSet   ; PRIVILEGE_SET* optional
    , "Ptr", pdwPrivilegeSetLength   ; DWORD* optional
    , "Ptr", pdwGrantedAccessMask   ; DWORD* out
    , "Ptr", pbAccessStatus   ; BOOL* out
    , "Int")   ; return: HRESULT

●RsopAccessCheckByType(pSecurityDescriptor, pPrincipalSelfSid, pRsopToken, dwDesiredAccessMask, pObjectTypeList, ObjectTypeListLength, pGenericMapping, pPrivilegeSet, pdwPrivilegeSetLength, pdwGrantedAccessMask, pbAccessStatus) = DLL("USERENV.dll", "int RsopAccessCheckByType(void*, void*, void*, dword, void*, dword, void*, void*, void*, void*, void*)")
# 呼び出し: RsopAccessCheckByType(pSecurityDescriptor, pPrincipalSelfSid, pRsopToken, dwDesiredAccessMask, pObjectTypeList, ObjectTypeListLength, pGenericMapping, pPrivilegeSet, pdwPrivilegeSetLength, pdwGrantedAccessMask, pbAccessStatus)
# pSecurityDescriptor : PSECURITY_DESCRIPTOR -> "void*"
# pPrincipalSelfSid : PSID optional -> "void*"
# pRsopToken : void* -> "void*"
# dwDesiredAccessMask : DWORD -> "dword"
# pObjectTypeList : OBJECT_TYPE_LIST* optional -> "void*"
# ObjectTypeListLength : DWORD -> "dword"
# pGenericMapping : GENERIC_MAPPING* -> "void*"
# pPrivilegeSet : PRIVILEGE_SET* optional -> "void*"
# pdwPrivilegeSetLength : DWORD* optional -> "void*"
# pdwGrantedAccessMask : DWORD* out -> "void*"
# pbAccessStatus : BOOL* out -> "void*"
# なでしこ1は32bit・ANSI(Shift_JIS)。文字列=char*(ANSI)、ポインタ/ハンドル=void*(4byte)。