Use SIDs instead of account names when modifying ACLs (#695)

Fixes #655
Azure · Jan 8, 2019 · d9b12c9 · d9b12c9
1 parent 761254f
commit d9b12c9
Showing 1 changed file with 9 additions and 5 deletions.
diff --git a/scripts/windows/setup/IotEdgeSecurityDaemon.ps1 b/scripts/windows/setup/IotEdgeSecurityDaemon.ps1
@@ -558,8 +558,9 @@ function Get-SecurityDaemon {
             # non-privileged modules can access it.
             $path = "$EdgeInstallDirectory\$name"
             New-Item $Path -ItemType Directory -Force | Out-Null
+            $sid = New-Object System.Security.Principal.SecurityIdentifier 'S-1-5-11' # NT AUTHORITY\Authenticated Users
             $rule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule(`
-                'NT AUTHORITY\Authenticated Users', 'Modify', 'ObjectInherit', 'InheritOnly', 'Allow')
+                $sid, 'Modify', 'ObjectInherit', 'InheritOnly', 'Allow')
             $acl = Get-Acl -Path $path
             $acl.AddAccessRule($rule)
             Set-Acl -Path $path -AclObject $acl
@@ -1103,19 +1104,22 @@ function Write-HostRed {
 }
 
 function Remove-BuiltinWritePermissions([string] $Path) {
-    $user = 'BUILTIN\Users'
-    Write-Verbose  "Remove $user permission to $Path"
+    $sid = New-Object System.Security.Principal.SecurityIdentifier 'S-1-5-32-545' # BUILTIN\Users
+
+    Write-Verbose  "Remove BUILTIN\Users permission to $Path"
     Invoke-Native "icacls ""$Path"" /inheritance:d"
 
     $acl = Get-Acl -Path $Path
     $write = [System.Security.AccessControl.FileSystemRights]::Write
     foreach ($access in $acl.Access) {
-        if ($access.IdentityReference.Value -eq $user -and
+        $accessSid = $access.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier])
+
+        if ($accessSid -eq $sid -and
             $access.AccessControlType -eq 'Allow' -and
             ($access.FileSystemRights -band $write) -eq $write)
         {
             $rule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule(`
-                $user, 'Write', $access.InheritanceFlags, $access.PropagationFlags, 'Allow')
+                $sid, 'Write', $access.InheritanceFlags, $access.PropagationFlags, 'Allow')
             $acl.RemoveAccessRule($rule) | Out-Null
         }
     }