Windows Security Internals

8 OTHER ACCESS CHECKING USE CASES

Access checks determine what access a caller should have when opening a kernel resource. However, we sometimes perform them for other reasons, as they can serve as additional security checks. This chapter details some examples of using access checks as a secondary security mechanism.

We’ll start by looking at traversal checking, which determines whether a caller has access to a hierarchy of resources. Next, we’ll discuss how access checks are used when a handle is duplicated. We’ll also consider how an access check can limit access to kernel information, such as process listings, from sandboxed applications. ...