From 5dfccca237a45fea9e6224d2523b8bd40f95158b Mon Sep 17 00:00:00 2001 From: Meik Date: Fri, 10 Jul 2026 11:23:52 +0200 Subject: [PATCH] Use configured NTFS ACL permissions --- LiamBaseClasses/C4IT.LIAM.Base.cs | 6 ++++ LiamNtfs/C4IT.LIAM.Ntfs.cs | 9 ++++- .../C4IT.LIAM.WorkflowActivities.cs | 5 ++- .../C4IT.LIAM.WorkflowactivityBase.cs | 33 ++++++++++++++++++- 4 files changed, 50 insertions(+), 3 deletions(-) diff --git a/LiamBaseClasses/C4IT.LIAM.Base.cs b/LiamBaseClasses/C4IT.LIAM.Base.cs index 8a76372..d33080c 100644 --- a/LiamBaseClasses/C4IT.LIAM.Base.cs +++ b/LiamBaseClasses/C4IT.LIAM.Base.cs @@ -80,6 +80,9 @@ namespace C4IT.LIAM public string ReadGroupGlobal { get; set; } = ""; public string ReadGroupLocal { get; set; } = ""; public string TraverseGroup { get; set; } = ""; + public int ReadACLPermission { get; set; } = 0x200A9; + public int WriteACLPermission { get; set; } = 0x301BF; + public int OwnerACLPermission { get; set; } = 0x1F01FF; public List NamingConventions { get; set; } = new List(); public Dictionary CustomTags { get; set; } = new Dictionary(StringComparer.OrdinalIgnoreCase); @@ -98,6 +101,9 @@ namespace C4IT.LIAM To.GroupFilter = From.GroupFilter; To.GroupRegEx = From.GroupRegEx; To.GroupPath = From.GroupPath; + To.ReadACLPermission = From.ReadACLPermission; + To.WriteACLPermission = From.WriteACLPermission; + To.OwnerACLPermission = From.OwnerACLPermission; To.CustomTags = From.CustomTags; To.AdditionalConfiguration = From.AdditionalConfiguration; To.CustomTags = From.CustomTags; diff --git a/LiamNtfs/C4IT.LIAM.Ntfs.cs b/LiamNtfs/C4IT.LIAM.Ntfs.cs index 3e02e39..ccf5470 100644 --- a/LiamNtfs/C4IT.LIAM.Ntfs.cs +++ b/LiamNtfs/C4IT.LIAM.Ntfs.cs @@ -1349,10 +1349,17 @@ namespace C4IT.LIAM groupNameSanitizeReplacement = GetAdditionalConfigurationValueOrDefault( AdditionalConfigurationGroupNameSanitizeReplacementKey, Helper.DefaultGroupNameSanitizeReplacement), - preserveAdGroupNameCase = IsAdditionalConfigurationEnabled(AdditionalConfigurationPreserveAdGroupNameCaseKey) + preserveAdGroupNameCase = IsAdditionalConfigurationEnabled(AdditionalConfigurationPreserveAdGroupNameCaseKey), + OwnerACLPermission = this.OwnerACLPermission, + WriteACLPermission = this.WriteACLPermission, + ReadACLPermission = this.ReadACLPermission }; engine.traverseBoundaryPath = GetEffectiveTraverseBoundaryPath(); + LogEntry( + $"NTFS filesystem engine ACL permissions: Owner=0x{engine.OwnerACLPermission:X}, Write=0x{engine.WriteACLPermission:X}, Read=0x{engine.ReadACLPermission:X}", + LogLevels.Debug); + foreach (var template in BuildSecurityGroupTemplates()) engine.templates.Add(template); diff --git a/LiamWorkflowActivities/C4IT.LIAM.WorkflowActivities.cs b/LiamWorkflowActivities/C4IT.LIAM.WorkflowActivities.cs index 86d75d5..d2acf4e 100644 --- a/LiamWorkflowActivities/C4IT.LIAM.WorkflowActivities.cs +++ b/LiamWorkflowActivities/C4IT.LIAM.WorkflowActivities.cs @@ -68,7 +68,10 @@ namespace C4IT.LIAM.Activities var dataMain = dataProvider.GetDataList(constFragmentNameConfigProviderMain, "ID, [Expression-ObjectId] as EOID, GCCDomain, GCCTarget, GCCMaxDepth, " + - "GCCgroupLDAPFilter, GCCgroupOUPath, GCCPermissionGroupStrategy, GCCtargetType", + "GCCgroupLDAPFilter, GCCgroupOUPath, GCCPermissionGroupStrategy, GCCtargetType, " + + "OwnerACLPermission.C4IT_EnumValueInt as OwnerACLPermission, " + + "WriteACLPermission.C4IT_EnumValueInt as WriteACLPermission, " + + "ReadACLPermission.C4IT_EnumValueInt as ReadACLPermission", $"[Expression-ObjectId] = '{configEOID}'"); Guid ConfigClassId = (Guid)dataMain.First()["ID"]; diff --git a/LiamWorkflowActivities/C4IT.LIAM.WorkflowactivityBase.cs b/LiamWorkflowActivities/C4IT.LIAM.WorkflowactivityBase.cs index e2d3d3f..0fc134e 100644 --- a/LiamWorkflowActivities/C4IT.LIAM.WorkflowactivityBase.cs +++ b/LiamWorkflowActivities/C4IT.LIAM.WorkflowactivityBase.cs @@ -300,7 +300,10 @@ namespace LiamWorkflowActivities GroupFilter = cLIAMHelper.getStringFromObject(dataMain["GCCgroupLDAPFilter"]), GroupPath = cLIAMHelper.getStringFromObject(dataMain["GCCgroupOUPath"]), GroupStrategy = (eLiamGroupStrategies)cLIAMHelper.getIntFromObject(dataMain["GCCPermissionGroupStrategy"]), - ProviderType = (eLiamProviderTypes)cLIAMHelper.getIntFromObject(dataMain["GCCtargetType"]) + ProviderType = (eLiamProviderTypes)cLIAMHelper.getIntFromObject(dataMain["GCCtargetType"]), + OwnerACLPermission = GetAclPermissionFromDataRow(dataMain, "OwnerACLPermission", 0x1F01FF), + WriteACLPermission = GetAclPermissionFromDataRow(dataMain, "WriteACLPermission", 0x301BF), + ReadACLPermission = GetAclPermissionFromDataRow(dataMain, "ReadACLPermission", 0x200A9) }; if (dataAdditional != null) { @@ -421,6 +424,34 @@ namespace LiamWorkflowActivities } + private int GetAclPermissionFromDataRow(DataRow row, string columnName, int defaultValue) + { + if (row == null || string.IsNullOrWhiteSpace(columnName) || !row.Table.Columns.Contains(columnName)) + return defaultValue; + + var rawValue = cLIAMHelper.getStringFromObject(row[columnName]); + if (string.IsNullOrWhiteSpace(rawValue)) + return defaultValue; + + var value = rawValue.Trim(); + try + { + if (value.StartsWith("0x", StringComparison.OrdinalIgnoreCase)) + return Convert.ToInt32(value.Substring(2), 16); + + if (int.TryParse(value, out var parsedValue)) + return parsedValue; + } + catch (Exception ex) + { + LogEntry($"Could not parse ACL permission config value '{columnName}'='{rawValue}': {ex.Message}. Falling back to default '{defaultValue}'.", LogLevels.Warning); + return defaultValue; + } + + LogEntry($"Could not parse ACL permission config value '{columnName}'='{rawValue}'. Falling back to default '{defaultValue}'.", LogLevels.Warning); + return defaultValue; + } + public ProviderCacheEntry getDataProvider(Guid ProviderConfigClassID) { var CM = MethodBase.GetCurrentMethod();