ImpersonateLoggedOnUser and SetFileAttributes

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

Hi,

I'm having some trouble with impersonating and SetFileAttributes. I'm
getting access, but I shouldn't!

I have created a file with only one ACE defined, granting r/w access to a
normal user (i.e. non-admin).

The local administrator is correctly denied access if he tries to change
file attributes from explorer. If he calls SetFileAttributes he's also
denied access.

If I try SetFileAttributes with LocalSystem, I get access denied.

But if LocalSystem impersonates local administrator and calls
SetFileAttributes, access is granted (which it shouldn't be!) and
SetFileAttributes is successful.

The code looks like this (error checking and cleanup omitted for brevity):

<code>

LogonUserW("administrator", NULL, "password",
LOGON32_LOGON_NETWORK_CLEARTEXT, LOGON32_PROVIDER_DEFAULT, &token);

ImpersonateLoggedOnUser(token);

SetFileAttributes(fileName, FILE_ATTRIBUTE_READONLY);

</code>

This happens on both XP and Win2K

What am I missing??


Thanks,
Sebastian Bargmann

(sorry about the crosspost to platformsdk.security)








.