ACCESS CONTROL PLUGIN
---------------------

Written by Mathias Hasselmann <mathias@taschenorakel.de>

The AccessControl plugin for NSIS provides a set of functions related 
Windows NT access control list (ACL) management.


CONVENTIONS
-----------

<filename>
	A valid Windows(tm) filename (ie. "C:\WINDOWS\" or "\\HOSTNAME\SHARE").

<rootkey>
	The well-known root of a registry key. Following values are defined:
	
		HKCR - HKEY_CLASSES_ROOT
		HKLM - HKEY_LOCAL_MACHINE
		HKCU - HKEY_CURRENT_USER
		HKU	 - HKEY_USERS

<regkey>
	The name of the registry to alter (ie. "Software\Microsoft\Windows").

<trustee>
	A valid Windows(tm) account. The account can be specified as relative 
	account name (ie. "Administrator"), as qualified account name 
	(ie. "Domain\Administrator") or as security identifier (SID, 
	ie. "(S-1-5-32-545)" for "BUILTIN\USERS").

<permissions>
	A combination of access rights (ie. "FullAccess" or 
	"GenericRead + GenericWrite").


FUNCTIONS
---------

GrantOnFile <filename> <trustee> <permissions>
GrantOnRegKey <rootkey> <regkey> <trustee> <permissions>

	Makes sure that the trustee get the requested access rights on 
	that object.

SetOnFile <filename> <trustee> <permissions>
SetOnRegKey <rootkey> <regkey> <trustee> <permissions>

	Deletes all permissions on the object and replaces them
	with the specified access right.

DenyOnFile <filename> <trustee> <permissions>
DenyOnRegKey <rootkey> <regkey> <trustee> <permissions>

	Explicitly denies an access right on a object.

RevokeOnFile <filename> <trustee> <permissions>
RevokeOnRegKey <rootkey> <regkey> <trustee> <permissions>

	Removes a formerly defined access right for that object.

SetFileOwner <filename> <trustee>
SetRegKeyOwner <rootkey> <regkey> <trustee>

	Changes the owner of an object.

SetFileGroup <filename> <trustee>
SetRegKeyGroup <rootkey> <regkey> <trustee>

	Changes the primary group of the object.



Extended and bug fixed by Andreas Rock  (andreas.rock@bigfoot.com)"
===================================================================

1. Bug fixes

1.1 Error handling

If an error occures a message box will be displayed. 
The error message is then given back on the stack.
I've changed it in that way, that you must always pop the error 
status from the stack and no message box on erros is displayed.

The message contains the error code in first 4 digits:
e,g, 1001::Trustee is missing

Usage new: e.g. for grant file

# Give ownership for file C:\test.txt to Waterloo\Mathias
  AccessControl::SetFileOwner \
  "C:\test.txt" "Waterloo\Mathias"
  pop $0
  StrCmp $0 "" aclok
	MessageBox MB_OK "Acl error=$0"
  aclok:

Usage old:
# Give ownership for file C:\test.txt to Waterloo\Mathias
  AccessControl::SetFileOwner \
    "C:\test.txt" "Waterloo\Mathias"



1.2 Function ParseSid: line 243 ShowError("uh..");

Must be uncommented. Error is shown by calling function!


2.0 Error messagesm, empty if no error occured

Error messages:

1001:Trustee is missing
1002:Permission flags are missing
1003:Bug: Unsupported change mode:
1004:Filesystem path missing
1005:Invalid filesystem path missing
1006:Root key name missing
1007:Bad root key name (..)
1008:Registry key name missing


2001:Bad trustee ..
2002:Bad permission flags ..
2003:Cannot read access control list. GetNamedSecurityInfo error code:..
2004:Cannot build new access control list. SetEntriesAcl error code:..
2005:Cannot apply new ownership. SetNamedSecurityInfo error code:..



