FILE_DACL

Use FILE_DACL to verify the discretionary access control list (DACL) permissions on a file or folder. The check compares the target's access control entries (ACEs) against the entries you define inline, without requiring a separate <file_acl> block. This makes it a self-contained replacement for the older FILE_PERMISSIONS check type.

Note: This check requires SMB access to the target Windows system and sufficient permissions to read the file or folder security descriptor.

Usage

The following predefined paths can be used in the file field:

%SystemDrive%

%SystemRoot%

%WinDir%

%ProgramFiles%

%CommonProgramFiles%

%AllUsersProfile%

Each dacl line defines one access control entry (ACE). The fields are separated by the || operator, in the order:

"principal" || "right" || "scope" [|| "inheritance"]

The following describes each segment of a dacl line:

• principal — The user or group name, or a raw SID string (for example Administrators, SYSTEM, Users, CREATOR OWNER). Principal names are compared case-insensitively.
  • To assign multiple granular rights to one principal, use multiple dacl lines for that principal. The rights are OR'd together.
• right — A single file permission. Supported values: full control, modify, read & execute, list folder contents, read, write, traverse folder / execute file, list folder / read data, read attributes, read extended attributes, create files / write data, create folders / append data, write attributes, write extended attributes, delete subfolder and files, delete, read permissions, change permissions, take ownership.
• scope — Which objects the ACE applies to. Supported values: this folder only, this folder, subfolders and files, this folder and subfolders, this folder and files, subfolders and files only, subfolders only, files only.
• inheritance — Optional fourth segment that controls how the ACE is matched against the system's inheritance flags. Supported values: not inherited (default), inherited, not used.

Additional field notes:

• Use file to specify the full path to the file or folder (for example, C:\WINDOWS\SYSTEM32) or a predefined path keyword. If you use a path keyword, the remote registry must be enabled so that Nessus can resolve the variable value.
• check_type — Determines how the policy ACL is compared against the system ACL. Defaults to CHECK_EQUAL when omitted.
• CHECK_EQUAL—- Requires an exact match.
• CHECK_SUBSET — Requires the policy ACEs to be a subset of the system ACEs.
• CHECK_SUBSET_USER — Same as CHECK_SUBSET, but ignores principals present on the system that are not listed in the policy.
• CHECK_SUPERSET — Requires the system rights to be greater than or equal to the policy rights.
• acl_option — Set to CAN_BE_NULL to pass the check if the file does not exist.

Examples

Verify a subset of permissions on the system drive root:

Specify multiple granular rights for a single principal:

Pass when an optional file may not be present:

Comparison with the legacy FILE_PERMISSIONS style

The older FILE_PERMISSIONS check requires a separate <file_acl> block referenced by value_data:

The equivalent self-contained FILE_DACL check: