{"record":{"id":"15a4371391e04125","repo":"java-native-access/jna","slug":"security-descriptor-relative-does-not-contain-sacl","errorCode":null,"errorMessage":"SECURITY_DESCRIPTOR_RELATIVE does not contain SACL","messagePattern":"SECURITY_DESCRIPTOR_RELATIVE does not contain SACL","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java","lineNumber":2899,"sourceCode":"        if (setGroup) {\n            if (psidGroup == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain group\");\n            if (!Advapi32.INSTANCE.IsValidSid(psidGroup))\n                throw new IllegalArgumentException(\"Group PSID is invalid\");\n            infoType |= GROUP_SECURITY_INFORMATION;\n        }\n\n        if (setDACL) {\n            if (dacl == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain DACL\");\n            if (!Advapi32.INSTANCE.IsValidAcl(dacl.getPointer()))\n                throw new IllegalArgumentException(\"DACL is invalid\");\n            infoType |= DACL_SECURITY_INFORMATION;\n        }\n\n        if (setSACL) {\n            if (sacl == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain SACL\");\n            if (!Advapi32.INSTANCE.IsValidAcl(sacl.getPointer()))\n                throw new IllegalArgumentException(\"SACL is invalid\");\n            infoType |= SACL_SECURITY_INFORMATION;\n        }\n\n        /*\n         * Control bits SE_DACL_PROTECTED/SE_SACL_PROTECTED indicate the *ACL is protected. The *ACL_SECURITY_INFORMATION flags\n         * are meta flags for SetNamedSecurityInfo and are not stored in the SD.  If either *ACLProtectedStatus is set,\n         * get the current status from the securityDescriptor and apply as such, otherwise the ACL remains at its default.\n        */\n        if (setDACLProtectedStatus) {\n            if ((securityDescriptor.Control & SE_DACL_PROTECTED) != 0) {\n                infoType |= PROTECTED_DACL_SECURITY_INFORMATION;\n            }\n            else if ((securityDescriptor.Control & SE_DACL_PROTECTED) == 0) {\n                infoType |= UNPROTECTED_DACL_SECURITY_INFORMATION;\n            }\n        }","sourceCodeStart":2881,"sourceCodeEnd":2917,"githubUrl":"https://github.com/java-native-access/jna/blob/d036ad9781adad4b66693e8fa7098e4ac665e0a3/contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java#L2881-L2917","documentation":"When setSACL is requested but the SECURITY_DESCRIPTOR_RELATIVE has no system ACL (sacl is null), Advapi32Util throws IllegalArgumentException. The library refuses to apply a null SACL via the descriptor components API.","triggerScenarios":"Calling with setSACL=true on a descriptor without SE_SACL_PRESENT control bit or whose SACL was never parsed; also commonly hit when the caller lacked READ_CONTROL/access-system-security rights so the source SACL came back empty.","commonSituations":"Copying audit settings from an object where SACL reading was silently skipped due to privileges; descriptors with DACL but no SACL; manually built descriptors with audit flags unset.","solutions":["Check securityDescriptor.getSystemACL() for null and pass setSACL=false when absent.","Read the SACL with sufficient privileges (SE_SECURITY_NAME privilege enabled) via Advapi32.GetSecurityDescriptorSacl.","Drop SACL_SECURITY_INFORMATION from the requested components if audit policy is not required.","Build and attach a valid SACL to the descriptor before the call."],"exampleFix":"// before\nAdvapi32Util.setSecurityDescriptorComponents(sd, true, true, true, true, false, false);\n// after\nAdvapi32Util.setSecurityDescriptorComponents(sd, true, true, true, sd.getSystemACL() != null, false, false);","handlingStrategy":"validation","validationCode":"if (securityDescriptor.getSystemACL() == null) {\n    throw new IllegalStateException(\"Descriptor has no SACL; omit SACL component\");\n}","typeGuard":"boolean hasSACL(SECURITY_DESCRIPTOR_RELATIVE sd) {\n    return sd != null && sd.getSystemACL() != null;\n}","tryCatchPattern":"try {\n    Advapi32Util.setSecurityDescriptorComponents(sd, setOwner, setGroup, setDACL, setSACL, false, false);\n} catch (IllegalArgumentException e) {\n    log.warn(\"SACL missing/invalid: \" + e.getMessage());\n}","preventionTips":["Enable the SE_SECURITY_NAME privilege before reading SACLs so they are not returned empty.","Check getSystemACL() for null before enabling setSACL.","Only request SACL updates when audit configuration actually exists on the source."],"tags":["windows","security-descriptor","acl","null-check","jna"],"backgroundTag":"null-argument","analyzedSha":"d036ad9781adad4b66693e8fa7098e4ac665e0a3","analyzedAt":"2026-09-12T06:50:59.239Z","contentChangedAt":"2026-09-12T06:50:59.239Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}