Security descriptors (wire format)

The byte-level layout of a security descriptor and everything inside it is specified in PCDS, the Peios Core Data Structures specification. It is normative there and is not duplicated here.

StructureSection
Descriptor header, self-relative form — Revision, Sbz1, Control, and the four offsetsPCDS §5.1
Control flagsPCDS §5.1
ACL header — AclRevision, AclSize, AceCountPCDS §5.2
ACE header — AceType, AceFlags, AceSizePCDS §5.4
Per-type ACE body layoutsPCDS §5.4
Access mask bit layoutPCDS §5.3
SID binary formatPCDS §4.1
Claim entry formatPCDS §5.9
Conditional-ACE bytecodePCDS §5.11

Peios uses the MS-DTYP §2.4.6 self-relative format without translation, so a descriptor written by a Windows domain controller and replicated through Samba is evaluated as-is. Where KACS's evaluator departs from MS-DTYP — a separate question from the format — the Peios Kernel TRM §3.B has the list.

The right values carried in an access mask are catalogued in Access mask bits.

Edit this page