puppet 3.3.2 → 3.4.0.rc1

data/lib/puppet/util/windows/process.rb

@@ -8,6 +8,117 @@ module Puppet::Util::Windows::Process
   extend ::Windows::Handle
   extend ::Windows::Synchronize
 
+  module API
+    require 'ffi'
+    extend FFI::Library
+    ffi_convention :stdcall
+
+    ffi_lib 'kernel32'
+
+    # http://msdn.microsoft.com/en-us/library/windows/desktop/ms683179(v=vs.85).aspx
+    # HANDLE WINAPI GetCurrentProcess(void);
+    attach_function :get_current_process, :GetCurrentProcess, [], :uint
+
+    # BOOL WINAPI CloseHandle(
+    #   _In_  HANDLE hObject
+    # );
+    attach_function :close_handle, :CloseHandle, [:uint], :bool
+
+    ffi_lib 'advapi32'
+
+    # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379295(v=vs.85).aspx
+    # BOOL WINAPI OpenProcessToken(
+    #   _In_   HANDLE ProcessHandle,
+    #   _In_   DWORD DesiredAccess,
+    #   _Out_  PHANDLE TokenHandle
+    # );
+    attach_function :open_process_token, :OpenProcessToken,
+      [:uint, :uint, :pointer], :bool
+
+
+    # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379261(v=vs.85).aspx
+    # typedef struct _LUID {
+    #   DWORD LowPart;
+    #   LONG  HighPart;
+    # } LUID, *PLUID;
+    class LUID < FFI::Struct
+      layout :low_part, :uint,
+             :high_part, :int
+    end
+
+    # http://msdn.microsoft.com/en-us/library/Windows/desktop/aa379180(v=vs.85).aspx
+    # BOOL WINAPI LookupPrivilegeValue(
+    #   _In_opt_  LPCTSTR lpSystemName,
+    #   _In_      LPCTSTR lpName,
+    #   _Out_     PLUID lpLuid
+    # );
+    attach_function :lookup_privilege_value, :LookupPrivilegeValueW,
+      [:buffer_in, :buffer_in, :pointer], :bool
+
+    Token_Information = enum(
+        :token_user, 1,
+        :token_groups,
+        :token_privileges,
+        :token_owner,
+        :token_primary_group,
+        :token_default_dacl,
+        :token_source,
+        :token_type,
+        :token_impersonation_level,
+        :token_statistics,
+        :token_restricted_sids,
+        :token_session_id,
+        :token_groups_and_privileges,
+        :token_session_reference,
+        :token_sandbox_inert,
+        :token_audit_policy,
+        :token_origin,
+        :token_elevation_type,
+        :token_linked_token,
+        :token_elevation,
+        :token_has_restrictions,
+        :token_access_information,
+        :token_virtualization_allowed,
+        :token_virtualization_enabled,
+        :token_integrity_level,
+        :token_ui_access,
+        :token_mandatory_policy,
+        :token_logon_sid,
+        :max_token_info_class
+      )
+
+    # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379263(v=vs.85).aspx
+    # typedef struct _LUID_AND_ATTRIBUTES {
+    #   LUID  Luid;
+    #   DWORD Attributes;
+    # } LUID_AND_ATTRIBUTES, *PLUID_AND_ATTRIBUTES;
+    class LUID_And_Attributes < FFI::Struct
+      layout :luid, LUID,
+             :attributes, :uint
+    end
+
+    # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379630(v=vs.85).aspx
+    # typedef struct _TOKEN_PRIVILEGES {
+    #   DWORD               PrivilegeCount;
+    #   LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY];
+    # } TOKEN_PRIVILEGES, *PTOKEN_PRIVILEGES;
+    class Token_Privileges < FFI::Struct
+      layout :privilege_count, :uint,
+             :privileges, [LUID_And_Attributes, 1]    # placeholder for offset
+    end
+
+    # http://msdn.microsoft.com/en-us/library/windows/desktop/aa446671(v=vs.85).aspx
+    # BOOL WINAPI GetTokenInformation(
+    #   _In_       HANDLE TokenHandle,
+    #   _In_       TOKEN_INFORMATION_CLASS TokenInformationClass,
+    #   _Out_opt_  LPVOID TokenInformation,
+    #   _In_       DWORD TokenInformationLength,
+    #   _Out_      PDWORD ReturnLength
+    # );
+    attach_function :get_token_information, :GetTokenInformation,
+      [:uint, Token_Information, :pointer, :uint, :pointer ], :bool
+  end
+
   def execute(command, arguments, stdin, stdout, stderr)
     Process.create( :command_line => command, :startup_info => {:stdin => stdin, :stdout => stdout, :stderr => stderr}, :close_handles => false )
   end
@@ -33,4 +144,92 @@ module Puppet::Util::Windows::Process
     exit_status
   end
   module_function :wait_process
+
+  def get_current_process
+    # this pseudo-handle does not require closing per MSDN docs
+    API.get_current_process
+  end
+  module_function :get_current_process
+
+  def open_process_token(handle, desired_access)
+    token_handle_ptr = FFI::MemoryPointer.new(:uint, 1)
+    result = API.open_process_token(handle, desired_access, token_handle_ptr)
+    if !result
+      raise Puppet::Util::Windows::Error.new(
+        "OpenProcessToken(#{handle}, #{desired_access.to_s(8)}, #{token_handle_ptr})")
+    end
+
+    begin
+      yield token_handle = token_handle_ptr.read_uint
+    ensure
+      API.close_handle(token_handle)
+    end
+  end
+  module_function :open_process_token
+
+  def lookup_privilege_value(name, system_name = '')
+    luid = FFI::MemoryPointer.new(API::LUID.size)
+    result = API.lookup_privilege_value(WideString.new(system_name),
+      WideString.new(name.to_s), luid)
+
+    return API::LUID.new(luid) if result
+    raise Puppet::Util::Windows::Error.new(
+      "LookupPrivilegeValue(#{system_name}, #{name}, #{luid})")
+  end
+  module_function :lookup_privilege_value
+
+  def get_token_information(token_handle, token_information)
+    # to determine buffer size
+    return_length_ptr = FFI::MemoryPointer.new(:uint, 1)
+    result = API.get_token_information(token_handle, token_information, nil, 0, return_length_ptr)
+    return_length = return_length_ptr.read_uint
+
+    if return_length <= 0
+      raise Puppet::Util::Windows::Error.new(
+        "GetTokenInformation(#{token_handle}, #{token_information}, nil, 0, #{return_length_ptr})")
+    end
+
+    # re-call API with properly sized buffer for all results
+    token_information_buf = FFI::MemoryPointer.new(return_length)
+    result = API.get_token_information(token_handle, token_information,
+      token_information_buf, return_length, return_length_ptr)
+
+    if !result
+      raise Puppet::Util::Windows::Error.new(
+        "GetTokenInformation(#{token_handle}, #{token_information}, #{token_information_buf}, " +
+          "#{return_length}, #{return_length_ptr})")
+    end
+
+    raw_privileges = API::Token_Privileges.new(token_information_buf)
+    privileges = { :count => raw_privileges[:privilege_count], :privileges => [] }
+
+    offset = token_information_buf + API::Token_Privileges.offset_of(:privileges)
+    privilege_ptr = FFI::Pointer.new(API::LUID_And_Attributes, offset)
+
+    # extract each instance of LUID_And_Attributes
+    0.upto(privileges[:count] - 1) do |i|
+      privileges[:privileges] <<  API::LUID_And_Attributes.new(privilege_ptr[i])
+    end
+
+    privileges
+  end
+  module_function :get_token_information
+
+  TOKEN_ALL_ACCESS = 0xF01FF
+  ERROR_NO_SUCH_PRIVILEGE = 1313
+  def process_privilege_symlink?
+    handle = get_current_process
+    open_process_token(handle, TOKEN_ALL_ACCESS) do |token_handle|
+      luid = lookup_privilege_value('SeCreateSymbolicLinkPrivilege')
+      token_info = get_token_information(token_handle, :token_privileges)
+      token_info[:privileges].any? { |p| p[:luid].values == luid.values }
+    end
+  rescue Puppet::Util::Windows::Error => e
+    if e.code == ERROR_NO_SUCH_PRIVILEGE
+      false # pre-Vista
+    else
+      raise e
+    end
+  end
+  module_function :process_privilege_symlink?
 end

data/lib/puppet/util/windows/root_certs.rb

@@ -1,17 +1,16 @@
 require 'puppet/util/windows'
 require 'openssl'
-require 'Win32API'
-require 'windows/msvcrt/buffer'
+require 'ffi'
 
 # Represents a collection of trusted root certificates.
 #
 # @api public
 class Puppet::Util::Windows::RootCerts
   include Enumerable
+  extend FFI::Library
 
-  CertOpenSystemStore         = Win32API.new('crypt32', 'CertOpenSystemStore', ['L','P'], 'L')
-  CertEnumCertificatesInStore = Win32API.new('crypt32', 'CertEnumCertificatesInStore', ['L', 'L'], 'L')
-  CertCloseStore              = Win32API.new('crypt32', 'CertCloseStore', ['L', 'L'], 'B')
+  typedef :ulong, :dword
+  typedef :uintptr_t, :handle
 
   def initialize(roots)
     @roots = roots
@@ -24,10 +23,6 @@ class Puppet::Util::Windows::RootCerts
     @roots.each {|cert| yield cert}
   end
 
-  class << self
-    include Windows::MSVCRT::Buffer
-  end
-
   # Returns a new instance.
   # @return [Puppet::Util::Windows::RootCerts] object constructed from current root certificates
   def self.instance
@@ -43,34 +38,12 @@ class Puppet::Util::Windows::RootCerts
 
     # This is based on a patch submitted to openssl:
     # http://www.mail-archive.com/openssl-dev@openssl.org/msg26958.html
-    context = 0
-    store = CertOpenSystemStore.call(0, "ROOT")
+    ptr = FFI::Pointer::NULL
+    store = CertOpenSystemStoreA(nil, "ROOT")
     begin
-      while (context = CertEnumCertificatesInStore.call(store, context) and context != 0)
-        # 466 typedef struct _CERT_CONTEXT {
-        # 467     DWORD      dwCertEncodingType;
-        # 468     BYTE       *pbCertEncoded;
-        # 469     DWORD      cbCertEncoded;
-        # 470     PCERT_INFO pCertInfo;
-        # 471     HCERTSTORE hCertStore;
-        # 472 } CERT_CONTEXT, *PCERT_CONTEXT;
-
-        # buffer to hold struct above
-        ctx_buf = 0.chr * 5 * 8
-
-        # copy from win to ruby
-        memcpy(ctx_buf, context, ctx_buf.size)
-
-        # unpack structure
-        arr = ctx_buf.unpack('LLLLL')
-
-        # create buf of length cbCertEncoded
-        cert_buf = 0.chr * arr[2]
-
-        # copy pbCertEncoded from win to ruby
-        memcpy(cert_buf, arr[1], cert_buf.length)
-
-        # create a cert
+      while (ptr = CertEnumCertificatesInStore(store, ptr)) and not ptr.null?
+        context = CERT_CONTEXT.new(ptr)
+        cert_buf = context[:pbCertEncoded].read_bytes(context[:cbCertEncoded])
         begin
           certs << OpenSSL::X509::Certificate.new(cert_buf)
         rescue => detail
@@ -78,9 +51,51 @@ class Puppet::Util::Windows::RootCerts
         end
       end
     ensure
-      CertCloseStore.call(store, 0)
+      CertCloseStore(store, 0)
     end
 
     certs
   end
+
+  private
+
+  # typedef ULONG_PTR HCRYPTPROV_LEGACY;
+  # typedef void *HCERTSTORE;
+
+  class CERT_CONTEXT < FFI::Struct
+    layout(
+      :dwCertEncodingType, :dword,
+      :pbCertEncoded,      :pointer,
+      :cbCertEncoded,      :dword,
+      :pCertInfo,          :pointer,
+      :hCertStore,         :handle
+    )
+  end
+
+  # HCERTSTORE
+  # WINAPI
+  # CertOpenSystemStoreA(
+  #   __in_opt HCRYPTPROV_LEGACY hProv,
+  #   __in LPCSTR szSubsystemProtocol
+  #   );
+  ffi_lib :crypt32
+  attach_function :CertOpenSystemStoreA, [:pointer, :string], :handle
+
+  # PCCERT_CONTEXT
+  # WINAPI
+  # CertEnumCertificatesInStore(
+  #   __in HCERTSTORE hCertStore,
+  #   __in_opt PCCERT_CONTEXT pPrevCertContext
+  #   );
+  ffi_lib :crypt32
+  attach_function :CertEnumCertificatesInStore, [:handle, :pointer], :pointer
+
+  # BOOL
+  # WINAPI
+  # CertCloseStore(
+  #   __in_opt HCERTSTORE hCertStore,
+  #   __in DWORD dwFlags
+  #   );
+  ffi_lib :crypt32
+  attach_function :CertCloseStore, [:handle, :dword], :bool
 end

data/lib/puppet/util/windows/security.rb

@@ -53,6 +53,8 @@
 #   enables Puppet to detect when file/dirs are out-of-sync,
 #   especially those that Puppet did not create, but is attempting
 #   to manage.
+# * A special case of this is S_ISYSTEM_MISSING, which is set when the
+#   SYSTEM permissions are *not* present on the DACL.
 # * On Unix, the owner and group can be modified without changing the
 #   mode. But on Windows, an access control entry specifies which SID
 #   it applies to. As a result, the set_owner and set_group methods
@@ -100,11 +102,13 @@ module Puppet::Util::Windows::Security
   S_IRWXO = 0000007
   S_ISVTX = 0001000
   S_IEXTRA = 02000000  # represents an extra ace
+  S_ISYSTEM_MISSING = 04000000
 
   # constants that are missing from Windows::Security
   PROTECTED_DACL_SECURITY_INFORMATION   = 0x80000000
   UNPROTECTED_DACL_SECURITY_INFORMATION = 0x20000000
   NO_INHERITANCE = 0x0
+  SE_DACL_PROTECTED = 0x1000
 
   # Set the owner of the object referenced by +path+ to the specified
   # +owner_sid+.  The owner sid should be of the form "S-1-5-32-544"
@@ -112,9 +116,12 @@ module Puppet::Util::Windows::Security
   # SE_RESTORE_NAME privilege in their process token can overwrite the
   # object's owner to something other than the current user.
   def set_owner(owner_sid, path)
-    old_sid = get_owner(path)
+    sd = get_security_descriptor(path)
 
-    change_sid(old_sid, owner_sid, OWNER_SECURITY_INFORMATION, path)
+    if owner_sid != sd.owner
+      sd.owner = owner_sid
+      set_security_descriptor(path, sd)
+    end
   end
 
   # Get the owner of the object referenced by +path+.  The returned
@@ -125,7 +132,7 @@ module Puppet::Util::Windows::Security
   def get_owner(path)
     return unless supports_acl?(path)
 
-    get_sid(OWNER_SECURITY_INFORMATION, path)
+    get_security_descriptor(path).owner
   end
 
   # Set the owner of the object referenced by +path+ to the specified
@@ -134,9 +141,12 @@ module Puppet::Util::Windows::Security
   # access to the object can change the group (regardless of whether
   # the current user belongs to that group or not).
   def set_group(group_sid, path)
-    old_sid = get_group(path)
+    sd = get_security_descriptor(path)
 
-    change_sid(old_sid, group_sid, GROUP_SECURITY_INFORMATION, path)
+    if group_sid != sd.group
+      sd.group = group_sid
+      set_security_descriptor(path, sd)
+    end
   end
 
   # Get the group of the object referenced by +path+.  The returned
@@ -147,7 +157,7 @@ module Puppet::Util::Windows::Security
   def get_group(path)
     return unless supports_acl?(path)
 
-    get_sid(GROUP_SECURITY_INFORMATION, path)
+    get_security_descriptor(path).group
   end
 
   def supports_acl?(path)
@@ -163,31 +173,6 @@ module Puppet::Util::Windows::Security
     (flags.unpack('L')[0] & Windows::File::FILE_PERSISTENT_ACLS) != 0
   end
 
-  def change_sid(old_sid, new_sid, info, path)
-    if old_sid != new_sid
-      mode = get_mode(path)
-
-      string_to_sid_ptr(new_sid) do |psid|
-        with_privilege(SE_RESTORE_NAME) do
-          open_file(path, WRITE_OWNER) do |handle|
-            set_security_info(handle, info, psid)
-          end
-        end
-      end
-
-      # rebuild dacl now that sid has changed
-      set_mode(mode, path)
-    end
-  end
-
-  def get_sid(info, path)
-    with_privilege(SE_BACKUP_NAME) do
-      open_file(path, READ_CONTROL) do |handle|
-        get_security_info(handle, info)
-      end
-    end
-  end
-
   def get_attributes(path)
     attributes = GetFileAttributes(path)
 
@@ -222,6 +207,10 @@ module Puppet::Util::Windows::Security
     (FILE_GENERIC_EXECUTE & ~FILE_READ_ATTRIBUTES) => S_IXOTH
   }
 
+  def get_aces_for_path_by_sid(path, sid)
+    get_security_descriptor(path).dacl.select { |ace| ace.sid == sid }
+  end
+
   # Get the mode of the object referenced by +path+.  The returned
   # integer value represents the POSIX-style read, write, and execute
   # modes for the user, group, and other classes, e.g. 0640.  Any user
@@ -231,58 +220,61 @@ module Puppet::Util::Windows::Security
   def get_mode(path)
     return unless supports_acl?(path)
 
-    owner_sid = get_owner(path)
-    group_sid = get_group(path)
     well_known_world_sid = Win32::Security::SID::Everyone
     well_known_nobody_sid = Win32::Security::SID::Nobody
+    well_known_system_sid = Win32::Security::SID::LocalSystem
 
-    with_privilege(SE_BACKUP_NAME) do
-      open_file(path, READ_CONTROL) do |handle|
-        mode = 0
-
-        get_dacl(handle).each do |ace|
-          case ace[:sid]
-          when owner_sid
-            MASK_TO_MODE.each_pair do |k,v|
-              if (ace[:mask] & k) == k
-                mode |= (v << 6)
-              end
-            end
-          when group_sid
-            MASK_TO_MODE.each_pair do |k,v|
-              if (ace[:mask] & k) == k
-                mode |= (v << 3)
-              end
-            end
-          when well_known_world_sid
-            MASK_TO_MODE.each_pair do |k,v|
-              if (ace[:mask] & k) == k
-                mode |= (v << 6) | (v << 3) | v
-              end
-            end
-            if File.directory?(path) and (ace[:mask] & (FILE_WRITE_DATA | FILE_EXECUTE | FILE_DELETE_CHILD)) == (FILE_WRITE_DATA | FILE_EXECUTE)
-              mode |= S_ISVTX;
-            end
-          when well_known_nobody_sid
-            if (ace[:mask] & FILE_APPEND_DATA).nonzero?
-              mode |= S_ISVTX
-            end
-          else
-            #puts "Warning, unable to map SID into POSIX mode: #{ace[:sid]}"
-            mode |= S_IEXTRA
-          end
+    mode = S_ISYSTEM_MISSING
 
-          # if owner and group the same, then user and group modes are the OR of both
-          if owner_sid == group_sid
-            mode |= ((mode & S_IRWXG) << 3) | ((mode & S_IRWXU) >> 3)
-            #puts "owner: #{group_sid}, 0x#{ace[:mask].to_s(16)}, #{mode.to_s(8)}"
+    sd = get_security_descriptor(path)
+    sd.dacl.each do |ace|
+      next if ace.inherit_only?
+
+      case ace.sid
+      when sd.owner
+        MASK_TO_MODE.each_pair do |k,v|
+          if (ace.mask & k) == k
+            mode |= (v << 6)
+          end
+        end
+      when sd.group
+        MASK_TO_MODE.each_pair do |k,v|
+          if (ace.mask & k) == k
+            mode |= (v << 3)
+          end
+        end
+      when well_known_world_sid
+        MASK_TO_MODE.each_pair do |k,v|
+          if (ace.mask & k) == k
+            mode |= (v << 6) | (v << 3) | v
           end
         end
+        if File.directory?(path) && (ace.mask & (FILE_WRITE_DATA | FILE_EXECUTE | FILE_DELETE_CHILD)) == (FILE_WRITE_DATA | FILE_EXECUTE)
+          mode |= S_ISVTX;
+        end
+      when well_known_nobody_sid
+        if (ace.mask & FILE_APPEND_DATA).nonzero?
+          mode |= S_ISVTX
+        end
+      when well_known_system_sid
+      else
+        #puts "Warning, unable to map SID into POSIX mode: #{ace.sid}"
+        mode |= S_IEXTRA
+      end
 
-        #puts "get_mode: #{mode.to_s(8)}"
-        mode
+      if ace.sid == well_known_system_sid
+        mode &= ~S_ISYSTEM_MISSING
+      end
+
+      # if owner and group the same, then user and group modes are the OR of both
+      if sd.owner == sd.group
+        mode |= ((mode & S_IRWXG) << 3) | ((mode & S_IRWXU) >> 3)
+        #puts "owner: #{sd.group}, 0x#{ace.mask.to_s(16)}, #{mode.to_s(8)}"
       end
     end
+
+    #puts "get_mode: #{mode.to_s(8)}"
+    mode
   end
 
   MODE_TO_MASK = {
@@ -305,15 +297,16 @@ module Puppet::Util::Windows::Security
   # privileges in their process token can change the mode for objects
   # that they do not have read and write access to.
   def set_mode(mode, path, protected = true)
-    owner_sid = get_owner(path)
-    group_sid = get_group(path)
+    sd = get_security_descriptor(path)
     well_known_world_sid = Win32::Security::SID::Everyone
     well_known_nobody_sid = Win32::Security::SID::Nobody
+    well_known_system_sid = Win32::Security::SID::LocalSystem
 
     owner_allow = STANDARD_RIGHTS_ALL  | FILE_READ_ATTRIBUTES | FILE_WRITE_ATTRIBUTES
     group_allow = STANDARD_RIGHTS_READ | FILE_READ_ATTRIBUTES | SYNCHRONIZE
     other_allow = STANDARD_RIGHTS_READ | FILE_READ_ATTRIBUTES | SYNCHRONIZE
     nobody_allow = 0
+    system_allow = 0
 
     MODE_TO_MASK.each do |k,v|
       if ((mode >> 6) & k) == k
@@ -331,22 +324,29 @@ module Puppet::Util::Windows::Security
       nobody_allow |= FILE_APPEND_DATA;
     end
 
+    # caller is NOT managing SYSTEM by using group or owner, so set to FULL
+    if ! [sd.owner, sd.group].include? well_known_system_sid
+      # we don't check S_ISYSTEM_MISSING bit, but automatically carry over existing SYSTEM perms
+      # by default set SYSTEM perms to full
+      system_allow = FILE_ALL_ACCESS
+    end
+
     isdir = File.directory?(path)
 
     if isdir
       if (mode & (S_IWUSR | S_IXUSR)) == (S_IWUSR | S_IXUSR)
         owner_allow |= FILE_DELETE_CHILD
       end
-      if (mode & (S_IWGRP | S_IXGRP)) == (S_IWGRP | S_IXGRP) and (mode & S_ISVTX) == 0
+      if (mode & (S_IWGRP | S_IXGRP)) == (S_IWGRP | S_IXGRP) && (mode & S_ISVTX) == 0
         group_allow |= FILE_DELETE_CHILD
       end
-      if (mode & (S_IWOTH | S_IXOTH)) == (S_IWOTH | S_IXOTH) and (mode & S_ISVTX) == 0
+      if (mode & (S_IWOTH | S_IXOTH)) == (S_IWOTH | S_IXOTH) && (mode & S_ISVTX) == 0
         other_allow |= FILE_DELETE_CHILD
       end
     end
 
     # if owner and group the same, then map group permissions to the one owner ACE
-    isownergroup = owner_sid == group_sid
+    isownergroup = sd.owner == sd.group
     if isownergroup
       owner_allow |= group_allow
     end
@@ -357,64 +357,37 @@ module Puppet::Util::Windows::Security
       remove_attributes(path, FILE_ATTRIBUTE_READONLY)
     end
 
-    set_acl(path, protected) do |acl|
-      #puts "ace: owner #{owner_sid}, mask 0x#{owner_allow.to_s(16)}"
-      add_access_allowed_ace(acl, owner_allow, owner_sid)
-
-      unless isownergroup
-        #puts "ace: group #{group_sid}, mask 0x#{group_allow.to_s(16)}"
-        add_access_allowed_ace(acl, group_allow, group_sid)
-      end
-
-      #puts "ace: other #{well_known_world_sid}, mask 0x#{other_allow.to_s(16)}"
-      add_access_allowed_ace(acl, other_allow, well_known_world_sid)
+    dacl = Puppet::Util::Windows::AccessControlList.new
+    dacl.allow(sd.owner, owner_allow)
+    unless isownergroup
+      dacl.allow(sd.group, group_allow)
+    end
+    dacl.allow(well_known_world_sid, other_allow)
+    dacl.allow(well_known_nobody_sid, nobody_allow)
 
-      #puts "ace: nobody #{well_known_nobody_sid}, mask 0x#{nobody_allow.to_s(16)}"
-      add_access_allowed_ace(acl, nobody_allow, well_known_nobody_sid)
+    # TODO: system should be first?
+    dacl.allow(well_known_system_sid, system_allow)
 
-      # add inherit-only aces for child dirs and files that are created within the dir
-      if isdir
-        inherit = INHERIT_ONLY_ACE | CONTAINER_INHERIT_ACE
-        add_access_allowed_ace(acl, owner_allow, Win32::Security::SID::CreatorOwner, inherit)
-        add_access_allowed_ace(acl, group_allow, Win32::Security::SID::CreatorGroup, inherit)
+    # add inherit-only aces for child dirs and files that are created within the dir
+    if isdir
+      inherit = INHERIT_ONLY_ACE | CONTAINER_INHERIT_ACE
+      dacl.allow(Win32::Security::SID::CreatorOwner, owner_allow, inherit)
+      dacl.allow(Win32::Security::SID::CreatorGroup, group_allow, inherit)
 
-        inherit = INHERIT_ONLY_ACE |  OBJECT_INHERIT_ACE
-        add_access_allowed_ace(acl, owner_allow & ~FILE_EXECUTE, Win32::Security::SID::CreatorOwner, inherit)
-        add_access_allowed_ace(acl, group_allow & ~FILE_EXECUTE, Win32::Security::SID::CreatorGroup, inherit)
-      end
+      inherit = INHERIT_ONLY_ACE |  OBJECT_INHERIT_ACE
+      dacl.allow(Win32::Security::SID::CreatorOwner, owner_allow & ~FILE_EXECUTE, inherit)
+      dacl.allow(Win32::Security::SID::CreatorGroup, group_allow & ~FILE_EXECUTE, inherit)
     end
 
+    new_sd = Puppet::Util::Windows::SecurityDescriptor.new(sd.owner, sd.group, dacl, protected)
+    set_security_descriptor(path, new_sd)
+
     nil
   end
 
-  # setting DACL requires both READ_CONTROL and WRITE_DACL access rights,
-  # and their respective privileges, SE_BACKUP_NAME and SE_RESTORE_NAME.
-  def set_acl(path, protected = true)
-    with_privilege(SE_BACKUP_NAME) do
-      with_privilege(SE_RESTORE_NAME) do
-        open_file(path, READ_CONTROL | WRITE_DAC) do |handle|
-          acl = 0.chr * 1024 # This can be increased later as needed
-
-          unless InitializeAcl(acl, acl.size, ACL_REVISION)
-            raise Puppet::Util::Windows::Error.new("Failed to initialize ACL")
-          end
-
-          raise Puppet::Util::Windows::Error.new("Invalid DACL") unless IsValidAcl(acl)
-
-          yield acl
-
-          # protected means the object does not inherit aces from its parent
-          info = DACL_SECURITY_INFORMATION
-          info |= protected ? PROTECTED_DACL_SECURITY_INFORMATION : UNPROTECTED_DACL_SECURITY_INFORMATION
-
-          # set the DACL
-          set_security_info(handle, info, acl)
-        end
-      end
-    end
-  end
+  def add_access_allowed_ace(acl, mask, sid, inherit = nil)
+    inherit ||= NO_INHERITANCE
 
-  def add_access_allowed_ace(acl, mask, sid, inherit = NO_INHERITANCE)
     string_to_sid_ptr(sid) do |sid_ptr|
       raise Puppet::Util::Windows::Error.new("Invalid SID") unless IsValidSid(sid_ptr)
 
@@ -434,126 +407,68 @@ module Puppet::Util::Windows::Security
     end
   end
 
-  def get_dacl(handle)
-    get_dacl_ptr(handle) do |dacl_ptr|
-      # REMIND: need to handle NULL DACL
-      raise Puppet::Util::Windows::Error.new("Invalid DACL") unless IsValidAcl(dacl_ptr)
-
-      # ACL structure, size and count are the important parts. The
-      # size includes both the ACL structure and all the ACEs.
+  def parse_dacl(dacl_ptr)
+    # REMIND: need to handle NULL DACL
+    raise Puppet::Util::Windows::Error.new("Invalid DACL") unless IsValidAcl(dacl_ptr)
+
+    # ACL structure, size and count are the important parts. The
+    # size includes both the ACL structure and all the ACEs.
+    #
+    # BYTE AclRevision
+    # BYTE Padding1
+    # WORD AclSize
+    # WORD AceCount
+    # WORD Padding2
+    acl_buf = 0.chr * 8
+    memcpy(acl_buf, dacl_ptr, acl_buf.size)
+    ace_count = acl_buf.unpack('CCSSS')[3]
+
+    dacl = Puppet::Util::Windows::AccessControlList.new
+
+    # deny all
+    return dacl if ace_count == 0
+
+    0.upto(ace_count - 1) do |i|
+      ace_ptr = [0].pack('L')
+
+      next unless GetAce(dacl_ptr, i, ace_ptr)
+
+      # ACE structures vary depending on the type. All structures
+      # begin with an ACE header, which specifies the type, flags
+      # and size of what follows. We are only concerned with
+      # ACCESS_ALLOWED_ACE and ACCESS_DENIED_ACEs, which have the
+      # same structure:
       #
-      # BYTE AclRevision
-      # BYTE Padding1
-      # WORD AclSize
-      # WORD AceCount
-      # WORD Padding2
-      acl_buf = 0.chr * 8
-      memcpy(acl_buf, dacl_ptr, acl_buf.size)
-      ace_count = acl_buf.unpack('CCSSS')[3]
-
-      dacl = []
-
-      # deny all
-      return dacl if ace_count == 0
-
-      0.upto(ace_count - 1) do |i|
-        ace_ptr = [0].pack('L')
-
-        next unless GetAce(dacl_ptr, i, ace_ptr)
-
-        # ACE structures vary depending on the type. All structures
-        # begin with an ACE header, which specifies the type, flags
-        # and size of what follows. We are only concerned with
-        # ACCESS_ALLOWED_ACE and ACCESS_DENIED_ACEs, which have the
-        # same structure:
-        #
-        # BYTE  C AceType
-        # BYTE  C AceFlags
-        # WORD  S AceSize
-        # DWORD L ACCESS_MASK
-        # DWORD L Sid
-        # ..      ...
-        # DWORD L Sid
-
-        ace_buf = 0.chr * 8
-        memcpy(ace_buf, ace_ptr.unpack('L')[0], ace_buf.size)
-
-        ace_type, ace_flags, size, mask = ace_buf.unpack('CCSL')
-
-        # skip aces that only serve to propagate inheritance
-        next if (ace_flags & INHERIT_ONLY_ACE).nonzero?
-
-        case ace_type
-        when ACCESS_ALLOWED_ACE_TYPE
-          sid_ptr = ace_ptr.unpack('L')[0] + 8 # address of ace_ptr->SidStart
-          raise Puppet::Util::Windows::Error.new("Failed to read DACL, invalid SID") unless IsValidSid(sid_ptr)
-          sid = sid_ptr_to_string(sid_ptr)
-          dacl << {:sid => sid, :type => ace_type, :mask => mask}
-        else
-          Puppet.warning "Unsupported access control entry type: 0x#{ace_type.to_s(16)}"
-        end
+      # BYTE  C AceType
+      # BYTE  C AceFlags
+      # WORD  S AceSize
+      # DWORD L ACCESS_MASK
+      # DWORD L Sid
+      # ..      ...
+      # DWORD L Sid
+
+      ace_buf = 0.chr * 8
+      memcpy(ace_buf, ace_ptr.unpack('L')[0], ace_buf.size)
+
+      ace_type, ace_flags, size, mask = ace_buf.unpack('CCSL')
+
+      case ace_type
+      when ACCESS_ALLOWED_ACE_TYPE
+        sid_ptr = ace_ptr.unpack('L')[0] + 8 # address of ace_ptr->SidStart
+        raise Puppet::Util::Windows::Error.new("Failed to read DACL, invalid SID") unless IsValidSid(sid_ptr)
+        sid = sid_ptr_to_string(sid_ptr)
+        dacl.allow(sid, mask, ace_flags)
+      when ACCESS_DENIED_ACE_TYPE
+        sid_ptr = ace_ptr.unpack('L')[0] + 8 # address of ace_ptr->SidStart
+        raise Puppet::Util::Windows::Error.new("Failed to read DACL, invalid SID") unless IsValidSid(sid_ptr)
+        sid = sid_ptr_to_string(sid_ptr)
+        dacl.deny(sid, mask, ace_flags)
+      else
+        Puppet.warning "Unsupported access control entry type: 0x#{ace_type.to_s(16)}"
       end
-
-      dacl
     end
-  end
 
-  def get_dacl_ptr(handle)
-    dacl = [0].pack('L')
-    sd = [0].pack('L')
-
-    rv = GetSecurityInfo(
-         handle,
-         SE_FILE_OBJECT,
-         DACL_SECURITY_INFORMATION,
-         nil,
-         nil,
-         dacl, #dacl
-         nil, #sacl
-         sd) #sec desc
-    raise Puppet::Util::Windows::Error.new("Failed to get DACL") unless rv == ERROR_SUCCESS
-    begin
-      yield dacl.unpack('L')[0]
-    ensure
-      LocalFree(sd.unpack('L')[0])
-    end
-  end
-
-  # Set the security info on the specified handle.
-  def set_security_info(handle, info, ptr)
-    rv = SetSecurityInfo(
-         handle,
-         SE_FILE_OBJECT,
-         info,
-         (info & OWNER_SECURITY_INFORMATION) == OWNER_SECURITY_INFORMATION ? ptr : nil,
-         (info & GROUP_SECURITY_INFORMATION) == GROUP_SECURITY_INFORMATION ? ptr : nil,
-         (info & DACL_SECURITY_INFORMATION) == DACL_SECURITY_INFORMATION ? ptr : nil,
-         nil)
-    raise Puppet::Util::Windows::Error.new("Failed to set security information") unless rv == ERROR_SUCCESS
-  end
-
-  # Get the SID string, e.g. "S-1-5-32-544", for the specified handle
-  # and type of information (owner, group).
-  def get_security_info(handle, info)
-    sid = [0].pack('L')
-    sd = [0].pack('L')
-
-    rv = GetSecurityInfo(
-         handle,
-         SE_FILE_OBJECT,
-         info, # security info
-         info == OWNER_SECURITY_INFORMATION ? sid : nil,
-         info == GROUP_SECURITY_INFORMATION ? sid : nil,
-         nil, #dacl
-         nil, #sacl
-         sd) #sec desc
-    raise Puppet::Util::Windows::Error.new("Failed to get security information") unless rv == ERROR_SUCCESS
-
-    begin
-      return sid_ptr_to_string(sid.unpack('L')[0])
-    ensure
-      LocalFree(sd.unpack('L')[0])
-    end
+    dacl
   end
 
   # Open an existing file with the specified access mode, and execute a
@@ -565,7 +480,7 @@ module Puppet::Util::Windows::Security
              FILE_SHARE_READ | FILE_SHARE_WRITE,
              0, # security_attributes
              OPEN_EXISTING,
-             FILE_FLAG_BACKUP_SEMANTICS,
+             FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_BACKUP_SEMANTICS,
              0) # template
     raise Puppet::Util::Windows::Error.new("Failed to open '#{path}'") if handle == INVALID_HANDLE_VALUE
     begin
@@ -620,4 +535,114 @@ module Puppet::Util::Windows::Security
       CloseHandle(token)
     end
   end
+
+  def get_security_descriptor(path)
+    sd = nil
+
+    with_privilege(SE_BACKUP_NAME) do
+      open_file(path, READ_CONTROL) do |handle|
+        owner_sid = [0].pack('L')
+        group_sid = [0].pack('L')
+        dacl = [0].pack('L')
+        ppsd = [0].pack('L')
+
+        rv = GetSecurityInfo(
+          handle,
+          SE_FILE_OBJECT,
+          OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
+          owner_sid,
+          group_sid,
+          dacl,
+          nil, #sacl
+          ppsd) #sec desc
+        raise Puppet::Util::Windows::Error.new("Failed to get security information") unless rv == ERROR_SUCCESS
+
+        begin
+          owner = sid_ptr_to_string(owner_sid.unpack('L')[0])
+          group = sid_ptr_to_string(group_sid.unpack('L')[0])
+
+          control = FFI::MemoryPointer.new(:uint16, 1)
+          revision = FFI::MemoryPointer.new(:uint32, 1)
+          ffsd = FFI::Pointer.new(ppsd.unpack('L')[0])
+
+          if ! API.get_security_descriptor_control(ffsd, control, revision)
+            raise Puppet::Util::Windows::Error.new("Failed to get security descriptor control")
+          end
+
+          protect = (control.read_uint16 & SE_DACL_PROTECTED) == SE_DACL_PROTECTED
+
+          dacl = parse_dacl(dacl.unpack('L')[0])
+          sd = Puppet::Util::Windows::SecurityDescriptor.new(owner, group, dacl, protect)
+        ensure
+          LocalFree(ppsd.unpack('L')[0])
+        end
+      end
+    end
+
+    sd
+  end
+
+  # setting DACL requires both READ_CONTROL and WRITE_DACL access rights,
+  # and their respective privileges, SE_BACKUP_NAME and SE_RESTORE_NAME.
+  def set_security_descriptor(path, sd)
+    # REMIND: FFI
+    acl = 0.chr * 1024 # This can be increased later as neede
+    unless InitializeAcl(acl, acl.size, ACL_REVISION)
+      raise Puppet::Util::Windows::Error.new("Failed to initialize ACL")
+    end
+
+    raise Puppet::Util::Windows::Error.new("Invalid DACL") unless IsValidAcl(acl)
+
+    with_privilege(SE_BACKUP_NAME) do
+      with_privilege(SE_RESTORE_NAME) do
+        open_file(path, READ_CONTROL | WRITE_DAC | WRITE_OWNER) do |handle|
+          string_to_sid_ptr(sd.owner) do |ownersid|
+            string_to_sid_ptr(sd.group) do |groupsid|
+              sd.dacl.each do |ace|
+                case ace.type
+                when ACCESS_ALLOWED_ACE_TYPE
+                  #puts "ace: allow, sid #{sid_to_name(ace.sid)}, mask 0x#{ace.mask.to_s(16)}"
+                  add_access_allowed_ace(acl, ace.mask, ace.sid, ace.flags)
+                when ACCESS_DENIED_ACE_TYPE
+                  #puts "ace: deny, sid #{sid_to_name(ace.sid)}, mask 0x#{ace.mask.to_s(16)}"
+                  add_access_denied_ace(acl, ace.mask, ace.sid)
+                else
+                  raise "We should never get here"
+                  # TODO: this should have been a warning in an earlier commit
+                end
+              end
+
+              # protected means the object does not inherit aces from its parent
+              flags = OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION
+              flags |= sd.protect ? PROTECTED_DACL_SECURITY_INFORMATION : UNPROTECTED_DACL_SECURITY_INFORMATION
+
+              rv = SetSecurityInfo(handle,
+                                   SE_FILE_OBJECT,
+                                   flags,
+                                   ownersid,
+                                   groupsid,
+                                   acl,
+                                   nil)
+              raise Puppet::Util::Windows::Error.new("Failed to set security information") unless rv == ERROR_SUCCESS
+            end
+          end
+        end
+      end
+    end
+  end
+
+  module API
+    extend FFI::Library
+    ffi_lib 'kernel32'
+    ffi_convention :stdcall
+
+    # typedef WORD SECURITY_DESCRIPTOR_CONTROL, *PSECURITY_DESCRIPTOR_CONTROL;
+    # BOOL WINAPI GetSecurityDescriptorControl(
+    #   _In_   PSECURITY_DESCRIPTOR pSecurityDescriptor,
+    #   _Out_  PSECURITY_DESCRIPTOR_CONTROL pControl,
+    #   _Out_  LPDWORD lpdwRevision
+    # );
+    ffi_lib :advapi32
+    attach_function :get_security_descriptor_control, :GetSecurityDescriptorControl, [:pointer, :pointer, :pointer], :bool
+  end
 end