2.1 security.h — Security descriptors
<peios/security.h> is the shared vocabulary of the whole access-control surface. SIDs, security descriptors, ACLs, and ACEs are the currency every KACS interface trades in — tokens carry them, files are protected by them, access checks evaluate them, and the registry secures keys with them. They cross the kernel boundary as variable-length, self-relative byte buffers in the MS-DTYP wire formats, and this module is the one place libpeios lifts that raw wire form into something safe to handle from C.
Everything here assumes the library conventions: ssize_t returns are byte lengths using the two-call protocol, builders are heap-backed and sticky-error, and views borrow the buffer they parse. This page does not repeat those rules per function — read that page first.
The module has four parts:
- SIDs — build, parse, format, and compare security identifiers.
- ACLs and security descriptors — assemble them with builders.
- Parsing — read them back with zero-copy views.
- SDDL and inheritance — the text form and the userspace-only inheritance helpers.
The wire constants (KACS_SID_*, KACS_SD_*, KACS_ACE_*, and struct kacs_generic_mapping) come straight from <pkm/sid.h> and <pkm/sd.h>. libpeios does not re-alias them — you use the published ABI names directly.
2.1.1 See also #
- Library conventions — the error, buffer, builder, and view rules this page builds on.
- SIDs and Security descriptors — the operator-side concepts behind this vocabulary.
<peios/token.h>,<peios/file.h>,<peios/access.h>— the KACS interfaces that consume this vocabulary, including the generic-mapping tablespeios_access_map_genericexpects.