java-native-access/jna · error · IllegalArgumentException

SECURITY_DESCRIPTOR_RELATIVE does not contain DACL

Error message

SECURITY_DESCRIPTOR_RELATIVE does not contain DACL

What it means

When setDACL is requested but the SECURITY_DESCRIPTOR_RELATIVE has no DACL (dacl is null), Advapi32Util throws IllegalArgumentException. This prevents applying a null discretionary ACL, which on Windows could otherwise expose the object with no access restrictions.

Source

Thrown at contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java:2891

        if (setOwner) {
            if (psidOwner == null)
                throw new IllegalArgumentException("SECURITY_DESCRIPTOR_RELATIVE does not contain owner");
            if (!Advapi32.INSTANCE.IsValidSid(psidOwner))
                throw new IllegalArgumentException("Owner PSID is invalid");
            infoType |= OWNER_SECURITY_INFORMATION;
        }

        if (setGroup) {
            if (psidGroup == null)
                throw new IllegalArgumentException("SECURITY_DESCRIPTOR_RELATIVE does not contain group");
            if (!Advapi32.INSTANCE.IsValidSid(psidGroup))
                throw new IllegalArgumentException("Group PSID is invalid");
            infoType |= GROUP_SECURITY_INFORMATION;
        }

        if (setDACL) {
            if (dacl == null)
                throw new IllegalArgumentException("SECURITY_DESCRIPTOR_RELATIVE does not contain DACL");
            if (!Advapi32.INSTANCE.IsValidAcl(dacl.getPointer()))
                throw new IllegalArgumentException("DACL is invalid");
            infoType |= DACL_SECURITY_INFORMATION;
        }

        if (setSACL) {
            if (sacl == null)
                throw new IllegalArgumentException("SECURITY_DESCRIPTOR_RELATIVE does not contain SACL");
            if (!Advapi32.INSTANCE.IsValidAcl(sacl.getPointer()))
                throw new IllegalArgumentException("SACL is invalid");
            infoType |= SACL_SECURITY_INFORMATION;
        }

        /*
         * Control bits SE_DACL_PROTECTED/SE_SACL_PROTECTED indicate the *ACL is protected. The *ACL_SECURITY_INFORMATION flags
         * are meta flags for SetNamedSecurityInfo and are not stored in the SD.  If either *ACLProtectedStatus is set,
         * get the current status from the securityDescriptor and apply as such, otherwise the ACL remains at its default.
        */

View on GitHub (pinned to d036ad9781)

Solutions

  1. Check securityDescriptor.getDiscretionaryACL() for null and pass setDACL=false when absent.
  2. Extract the DACL first with Advapi32.GetSecurityDescriptorDacl or Advapi32Util.getSecurityDescriptorDacl.
  3. Read the source object's DACL via Advapi32Util.getFileSecurity / getSecurityDescriptorACL before copying.
  4. If setting a null DACL is truly intended, use the lower-level Advapi32.SetSecurityDescriptorDacl with the appropriate flag instead.

Example fix

// before
Advapi32Util.setSecurityDescriptorComponents(sd, true, true, true, true, false, false);
// after
Advapi32Util.setSecurityDescriptorComponents(sd, true, true, sd.getDiscretionaryACL() != null, true, false, false);
Defensive patterns

Strategy: validation

Validate before calling

if (securityDescriptor.getDiscretionaryACL() == null) {
    throw new IllegalStateException("Descriptor has no DACL; omit DACL component");
}

Type guard

boolean hasDACL(SECURITY_DESCRIPTOR_RELATIVE sd) {
    return sd != null && sd.getDiscretionaryACL() != null;
}

Try / catch

try {
    Advapi32Util.setSecurityDescriptorComponents(sd, setOwner, setGroup, setDACL, setSACL, false, false);
} catch (IllegalArgumentException e) {
    log.warn("DACL missing/invalid: " + e.getMessage());
}

Prevention

When it happens

Trigger: Calling with setDACL=true on a descriptor whose control bits indicate no DACL present (SE_DACL_PRESENT unset) or whose DACL was not parsed into the ACL structure.

Common situations: Descriptors read from objects that only set a SACL; building a descriptor manually with owner/group only; attempting to copy a DACL that was never extracted from the source object.

Related errors

AI-assisted analysis of java-native-access/jna@d036ad9781 (2026-09-12). Data as JSON: /api/errors/5d34e04f3131ae79. Report an issue: GitHub.