:py:mod:`dissect.ntfs.secure`
=============================

.. py:module:: dissect.ntfs.secure




Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.ntfs.secure.Secure
   dissect.ntfs.secure.SecurityDescriptor
   dissect.ntfs.secure.ACL
   dissect.ntfs.secure.ACE




.. py:class:: Secure(record: dissect.ntfs.mft.MftRecord = None, sds: BinaryIO | None = None)

   Lookup security descriptors from the ``$Secure`` file, or optionally just a file-like object of the ``$SDS``.

   Only one the ``record`` or ``sds`` arguments needs to be provided.

   :param record: The MFT record of the ``$Secure`` file, used when opening from a full NTFS volume.
   :param sds: A file-like object of the ``$SDS`` stream, used when opening from separate system files.


   .. py:attribute:: record
      :value: None



   .. py:attribute:: sds
      :value: None



   .. py:attribute:: sii
      :value: None



   .. py:attribute:: lookup


   .. py:method:: descriptors() -> collections.abc.Iterator[SecurityDescriptor]

      Return all security descriptors.



.. py:class:: SecurityDescriptor(fh: BinaryIO)

   Parse a security descriptor from a file-like object.

   :param fh: The file-like object to parse a security descriptor from.


   .. py:attribute:: header


   .. py:attribute:: owner
      :value: None



   .. py:attribute:: group
      :value: None



   .. py:attribute:: sacl
      :value: None



   .. py:attribute:: dacl
      :value: None



.. py:class:: ACL(fh: BinaryIO)

   Parse an ACL from a file-like object.

   :param fh: The file-like object to parse an ACL from.


   .. py:attribute:: header


   .. py:attribute:: ace


.. py:class:: ACE(fh: BinaryIO)

   Parse an ACE from a file-like object.

   :param fh: The file-like object to parse an ACE from.


   .. py:attribute:: header


   .. py:attribute:: data


   .. py:attribute:: mask
      :value: None



   .. py:attribute:: flags
      :value: None



   .. py:attribute:: object_type
      :value: None



   .. py:attribute:: inherited_object_type
      :value: None



   .. py:attribute:: sid
      :value: None



   .. py:attribute:: compound_type
      :value: None



   .. py:attribute:: server_sid
      :value: None



   .. py:attribute:: application_data


   .. py:method:: __repr__() -> str


   .. py:property:: type
      :type: dissect.ntfs.c_ntfs.ACE_TYPE


      Return the ACE type.


   .. py:property:: is_standard_ace
      :type: bool


      Return whether this ACE is a standard ACE.


   .. py:property:: is_compound_ace
      :type: bool


      Return whether this ACE is a compound ACE.


   .. py:property:: is_object_ace
      :type: bool


      Return whether this ACE is an object ACE.