Module security 

NT security-descriptor helpers built on the win-sd crate ([MS-DTYP] §2.4.6). Marshalling of the self-relative SECURITY_DESCRIPTOR / ACL / SID blobs is delegated to win-sd rather than hand-rolled here.

The POSIX backend cannot express NT ACLs natively, so descriptors are stored verbatim (see smb_server_vfs::Vfs::get_security / smb_server_vfs::Vfs::set_security). When a file has no stored descriptor a permissive default is synthesised so clients always see a valid owner/group/DACL.

Modules

sec_info

SECURITY_INFORMATION component-selector bits ([MS-DTYP] §2.4.7).

Functions

default_descriptor 🔒

Permissive default: owner/group BUILTIN\Administrators, DACL granting Everyone full control. Returned when a file has no stored descriptor.

query_security

Self-relative descriptor bytes for a QUERY SECURITY, keeping only the components named in additional. stored is the backend’s saved blob.