program test;

{$PACKENUM 4}

uses
  jwaaccctrl,
  SysUtils;

begin
  WriteLn(Format('EXPLICIT_ACCESS_A size: %d ENUM SIZE: %d', [SizeOf(jwaaccctrl.EXPLICIT_ACCESS_A), SizeOf(jwaaccctrl.ACCESS_MODE)]));
end.

program acltest;

{$MODE DELPHI}

uses
  sysutils,
  JwaWinNT,
  JwaAclApi,
  JwaAccCtrl,
  JwaSDDL,
  jwawinbase,
  jwawinsta,
  jwawintype,
  jwawinerror;

function SetFilePermissionForRunAs(filename: string): boolean;
var
  sid: JwaWinNT.PSID;
  groupSid: JwaWinNT.PSID;
  sidSize: DWORD;
  nameUse: JwaWinNT.SID_NAME_USE;
  refDomain: LpStr;
  refDomainSize: DWORD;
  dolocalfree: boolean;
  procToken: HANDLE;
  changedSecurityInfo: DWORD;
  acl: jwawinnt.PACL;

  function SetPrivilege(token: HANDLE; privilege: PChar; state: boolean): boolean;
  var
    luid: jwawintype._LUID;
    tp: jwawinnt.TOKEN_PRIVILEGES;
  begin
    if not jwawinbase.LookupPrivilegeValue(nil, privilege, luid) then
      Result := false
    else
    begin
      FillChar(tp, sizeOf(tp), #0);
      tp.privilegeCount := 1;
      tp.Privileges[0].Luid := luid;
      if state then
        tp.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED
      else
        tp.Privileges[0].Attributes := SE_PRIVILEGE_REMOVED;

      Result := AdjustTokenPrivileges(token, LongBool(false), @tp, sizeOf(tp), nil,nil);
    end
  end;

  function SetupAccess(owner: jwawinnt.PSID; var acl: jwawinnt.PACL): bool;
  const
    EA_COUNT = 3;
  var
    sidAuthWorld: jwawinnt.SID_IDENTIFIER_AUTHORITY;
    sidAuthNT: jwawinnt.SID_IDENTIFIER_AUTHORITY;
    everyoneSID: jwawinnt.PSID;
    adminSID: jwawinnt.PSID;
    ea: Array[0..(EA_COUNT-1)] of jwaaccctrl.EXPLICIT_ACCESS_A;
    status: jwawintype.DWORD;
  begin
    try
      begin
        sidAuthWorld := jwawinnt.SECURITY_WORLD_SID_AUTHORITY;
        sidAuthNT := jwawinnt.SECURITY_NT_AUTHORITY;

        if not (jwawinbase.AllocateAndInitializeSid(@sidAuthWorld, 1, jwawinnt.SECURITY_WORLD_RID,
            0, 0, 0, 0, 0, 0, 0, everyoneSID)
          and AllocateAndInitializeSid(@sidAuthNT, 2, jwawinnt.SECURITY_BUILTIN_DOMAIN_RID,
          jwawinnt.DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, adminSID)) then
        begin
          WriteLn('Could not allocate SIDs: ' + SysErrorMessage(getLastError()));
          Result := false;
        end
        else
        begin
          jwawinbase.ZeroMemory(@ea, EA_COUNT * sizeOf(EXPLICIT_ACCESS_A));

          ea[0].grfAccessPermissions := GENERIC_ALL;
          ea[0].grfAccessMode := DENY_ACCESS;
          ea[0].grfInheritance := NO_INHERITANCE;
          ea[0].Trustee.MultipleTrusteeOperation := NO_MULTIPLE_TRUSTEE;
          ea[0].Trustee.pMultipleTrustee := nil;
          ea[0].Trustee.TrusteeForm := TRUSTEE_IS_SID;
          ea[0].Trustee.TrusteeType := TRUSTEE_IS_WELL_KNOWN_GROUP;
          ea[0].Trustee.ptstrName := pointer(everyoneSID);

          ea[1].grfAccessPermissions := GENERIC_ALL;
          ea[1].grfAccessMode := SET_ACCESS;
          ea[1].grfInheritance := NO_INHERITANCE;
          ea[1].Trustee.MultipleTrusteeOperation := NO_MULTIPLE_TRUSTEE;
          ea[1].Trustee.pMultipleTrustee := nil;
          ea[1].Trustee.TrusteeForm := TRUSTEE_IS_SID;
          ea[1].Trustee.TrusteeType := TRUSTEE_IS_GROUP;
          ea[1].Trustee.ptstrName := pointer(adminSID);

          ea[2].grfAccessPermissions := GENERIC_ALL;
          ea[2].grfAccessMode := SET_ACCESS;
          ea[2].grfInheritance := NO_INHERITANCE;
          ea[2].Trustee.MultipleTrusteeOperation := NO_MULTIPLE_TRUSTEE;
          ea[2].Trustee.pMultipleTrustee := nil;
          ea[2].Trustee.TrusteeForm := TRUSTEE_IS_SID;
          ea[2].Trustee.TrusteeType := TRUSTEE_IS_USER;
          ea[2].Trustee.ptstrName := pointer(owner);

          status := jwaaclapi.SetEntriesInAclA(2, @ea, nil, acl);
          if status = ERROR_SUCCESS then
            Result := true
          else
          begin
            WriteLn('Error in SetEntriesInAcl: ' + IntToStr(status));
            Result := false;
          end;
        end;
      end
    finally
      If Assigned(everyoneSID) then
        jwawinbase.FreeSID(everyoneSID);
      If Assigned(adminSID) then
        jwawinbase.FreeSID(adminSID);
    end
  end;
begin
    try
      begin
        sidSize := 0;
        refDomainSize := 0;
        doLocalFree := false;

        procToken := INVALID_HANDLE_VALUE;

        groupSid := nil;
        sid := nil;
        changedSecurityInfo := jwawinnt.OWNER_SECURITY_INFORMATION
          or jwawinnt.DACL_SECURITY_INFORMATION;

          jwawinbase.LookupAccountNameA(nil, 'Administrator', nil,
            sidSize, nil, refDomainSize, nameUse);

          GetMem(sid, sidSize);
          GetMem(refDomain, refDomainSize);

          Result := jwawinbase.LookupAccountNameA(nil, 'Administrator',
            sid, sidSize, refDomain, refDomainSize, nameUse);

          if not SetupAccess(sid, acl) then
          begin
            Result := false;
          end
          else if jwaaclapi.SetNamedSecurityInfoA(PChar(filename),
            JwaAccCtrl.SE_FILE_OBJECT, changedSecurityInfo, sid, groupSid, acl, nil)
            <> ERROR_SUCCESS then
          begin
            // if it fails we are probably missing the SE_RESTORE_NAME privilege, so we retry
            if (not OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, procToken)) or
               (not SetPrivilege(procToken, SE_RESTORE_NAME, true)) then
              Result := false
            else
            begin
              Result := jwaaclapi.SetNamedSecurityInfoA(PChar(filename),
                JwaAccCtrl.SE_FILE_OBJECT, changedSecurityInfo, sid, groupSid, acl, nil)
                = ERROR_SUCCESS;
              if not Result then
                WriteLn('Error while setting security info: ' + SysErrorMessage(getLastError()));
              SetPrivilege(procToken, SE_RESTORE_NAME, false);
            end;
          end;
        end
    finally
      begin
        if Assigned(sid) then
          if doLocalFree then
            LocalFree(DWORD(sid))
          else
            FreeMem(sid, sidSize);

        // note: groupSid always needs LocalFree currently
        if Assigned(groupSid) then
            LocalFree(DWORD(groupSid));

        if Assigned(refDomain) then
          FreeMem(refDomain, refDomainSize);

        if Assigned(acl) then
          LocalFree(DWORD(acl));
      end;
    end;
end;

begin
  if not SetFilePermissionForRunAs('C:\Users\Administrator\test.txt') then
    WriteLn('Fail');
  WriteLn(Format('EXPLICIT_ACCESS_A size: %d', [SizeOf(EXPLICIT_ACCESS_A)]));
end.