Skip to content

Conversation

@denis-osipov
Copy link
Contributor

On Microsoft Support page Well-known security identifiers in Windows operating systems said:

A security identifier (SID) is a unique value of variable length that is used to identify a security principal or security group in Windows operating systems. Well-known SIDs are a group of SIDs that identify generic users or generic groups. Their values remain constant across all operating systems.

So I suggest to use SID (*S-1-5-32-545) instead of name (Users).

DETACHED_PROCESS = 8
subprocess.check_call(
['icacls.exe', fname, '/deny', 'Users:(S)'],
['icacls.exe', fname, '/deny', '*S-1-5-32-545:(S)'],
Copy link
Contributor

@eryksun eryksun Jun 7, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, using the numeric SID to avoid localized names is correct. Thanks for catching this.

DETACHED_PROCESS = 8
subprocess.check_call(
['icacls.exe', fname, '/deny', 'Users:(S)'],
['icacls.exe', fname, '/deny', '*S-1-5-32-545:(S)'],
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add a comment mentionning the bpo and explaining what is this identifier, like:

# bpo-30584: Use security identifier *S-1-5-32-545 instead of localized "Users"
# to not depend on the locale

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

Copy link
Member

@vstinner vstinner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, it's your first contribution. In that case, you should add yourself to Misc/ACKS please!

@vstinner vstinner merged commit 897bba7 into python:master Jun 7, 2017
@denis-osipov denis-osipov deleted the fix-issue-30584 branch June 7, 2017 17:25
@denis-osipov denis-osipov restored the fix-issue-30584 branch June 7, 2017 17:25
@denis-osipov denis-osipov deleted the fix-issue-30584 branch June 7, 2017 17:27
vstinner pushed a commit that referenced this pull request Jun 8, 2017
…1999)

* Fix bpo-30584

* Adding a comment mentionning the bpo and explaining what is the identifier

* Add Denis Osipov to Misc/ACKS
(cherry picked from commit 897bba7)
vstinner pushed a commit that referenced this pull request Jun 8, 2017
…2000)

* Fix bpo-30584

* Adding a comment mentionning the bpo and explaining what is the identifier

* Add Denis Osipov to Misc/ACKS
(cherry picked from commit 897bba7)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants