The ZwSetSecurityObject routine sets an object's security state.
NTSYSAPI NTSTATUS ZwSetSecurityObject( HANDLE Handle, SECURITY_INFORMATION SecurityInformation, PSECURITY_DESCRIPTOR SecurityDescriptor );
Handle for the object whose security state is to be set. This handle must have the access specified in the Meaning column of the table shown in the description of the SecurityInformation parameter.
SECURITY_INFORMATION value specifying the information to be set. Can be a combination of one or more of the following.
|DACL_SECURITY_INFORMATION||Indicates the discretionary access control list (DACL) of the object is to be set. Requires WRITE_DAC access.|
|GROUP_SECURITY_INFORMATION||Indicates the primary group identifier of the object is to be set. Requires WRITE_OWNER access.|
|OWNER_SECURITY_INFORMATION||Indicates the owner identifier of the object is to be set. Requires WRITE_OWNER access.|
|SACL_SECURITY_INFORMATION||Indicates the system ACL (SACL) of the object is to be set. Requires ACCESS_SYSTEM_SECURITY access.|
Pointer to the security descriptor to be set for the object.
ZwSetSecurityObject returns STATUS_SUCCESS or an appropriate error status. Possible error status codes include the following:
||Handle does not have the required access rights.|
||SecurityDescriptor is a NULL pointer.|
||The object's security descriptor could not be captured.|
||The object's security descriptor contains an invalid ACL.|
||Handle is not a valid handle.|
||SecurityDescriptor does not point to a valid security descriptor.|
||The object's security descriptor contains an invalid SID.|
||Handle is not a handle of the expected type.|
||The revision level of the object's security descriptor is unknown or is not supported.|
A security descriptor can be in absolute or self-relative form. In self-relative form, all members of the structure are located contiguously in memory. In absolute form, the structure only contains pointers to the members. For more information, see "Absolute and Self-Relative Security Descriptors" in the Security section of the Windows SDK documentation.
For more information about security and access control, see the documentation on these topics in the Windows SDK.
Minifilters should use FltSetSecurityObject instead of ZwSetSecurityObject.
Callers of ZwSetSecurityObject must be running at IRQL = PASSIVE_LEVEL and with special kernel APCs enabled.
|Minimum supported client||Available starting with Windows XP.|
|Header||ntifs.h (include Ntifs.h)|
|IRQL||PASSIVE_LEVEL (see Remarks section)|
|DDI compliance rules||PowerIrpDDis, HwStorPortProhibitedDDIs|