internal static DiscretionaryAcl CreateAllowEveryoneFullAccess(bool isDS, bool isContainer)
 {
     DiscretionaryAcl acl = new DiscretionaryAcl(isContainer, isDS, 1);
     acl.AddAccess(AccessControlType.Allow, _sidEveryone, -1, isContainer ? (InheritanceFlags.ObjectInherit | InheritanceFlags.ContainerInherit) : InheritanceFlags.None, PropagationFlags.None);
     acl.everyOneFullAccessForNullDacl = true;
     return acl;
 }

        private static void AuthUserStartStop(DiscretionaryAcl dacl)
        {
            var sid = new SecurityIdentifier(WellKnownSidType.AuthenticatedUserSid, null);

            dacl.SetAccess(AccessControlType.Allow, sid, (int) (ServiceAccess.ServiceStart | ServiceAccess.ServiceStop),
                           InheritanceFlags.None, PropagationFlags.None);
        }

 protected ObjectSecurity( bool isContainer, bool isDS )
     : this()
 {
     // we will create an empty DACL, denying anyone any access as the default. 5 is the capacity.
     DiscretionaryAcl dacl = new DiscretionaryAcl(isContainer, isDS, 5);
      _securityDescriptor = new CommonSecurityDescriptor( isContainer, isDS, ControlFlags.None, null, null, null, dacl );
 }

		public void NullRawAclRevisionOK ()
		{
			DiscretionaryAcl dacl1 = new DiscretionaryAcl (false, false, null);
			Assert.AreEqual (2, dacl1.Revision);

			DiscretionaryAcl dacl2 = new DiscretionaryAcl (false, true, null);
			Assert.AreEqual (4, dacl2.Revision);
		}

 static IpcStore()
 {
     var dacl = new DiscretionaryAcl(false, false, 1);
     dacl.AddAccess(AccessControlType.Allow, new SecurityIdentifier(WellKnownSidType.CreatorOwnerSid, null), -1, InheritanceFlags.None, PropagationFlags.None);
     dacl.AddAccess(AccessControlType.Allow, new SecurityIdentifier(WellKnownSidType.BuiltinUsersSid, null), -1, InheritanceFlags.None, PropagationFlags.None);
     dacl.AddAccess(AccessControlType.Allow, new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null), -1, InheritanceFlags.None, PropagationFlags.None);
     IpcAcl = new CommonSecurityDescriptor(false, false, ControlFlags.GroupDefaulted | ControlFlags.OwnerDefaulted | ControlFlags.DiscretionaryAclPresent, null, null, null, dacl);
 }

		public void AddAccessObjectAceNonDSFailsEvenIfObjectAceFlagsNoneImplyingCommonAce ()
		{
			SecurityIdentifier sid = new SecurityIdentifier ("BA");
			DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, 0);

			dacl.AddAccess (AccessControlType.Allow, sid, 1, InheritanceFlags.None, PropagationFlags.None,
			                ObjectAceFlags.None, Guid.Empty, Guid.Empty);
		}

		public CommonSecurityDescriptor (bool isContainer, bool isDS,
						 ControlFlags flags,
						 SecurityIdentifier owner,
						 SecurityIdentifier group,
						 SystemAcl systemAcl,
						 DiscretionaryAcl discretionaryAcl)
		{
			Init (isContainer, isDS, flags, owner, group, systemAcl, discretionaryAcl);
		}

		public void UsesRawAclRevision ()
		{
			RawAcl acl1 = new RawAcl (RawAcl.AclRevisionDS, 0);
			DiscretionaryAcl dacl1 = new DiscretionaryAcl (false, false, acl1);
			Assert.AreEqual (4, dacl1.Revision);

			RawAcl acl2 = new RawAcl (RawAcl.AclRevision, 0);
			DiscretionaryAcl dacl2 = new DiscretionaryAcl (false, true, acl2);
			Assert.AreEqual (2, dacl2.Revision);
		}

		public void EmptyBinaryFormDSOK()
		{
			DiscretionaryAcl dacl = new DiscretionaryAcl (false, true, 0);
			byte[] buffer = new byte[8];
			dacl.GetBinaryForm (buffer, 0);

			Assert.AreEqual (4, buffer [0]); // Revision
			Assert.AreEqual (8, ToUInt16 (buffer, 2)); // ACL Size
			Assert.AreEqual (0, ToUInt16 (buffer, 4)); // ACE Count
		}

 private static void EditDacl(DiscretionaryAcl dacl, SecurityIdentifier account, int right, bool add)
 {
     if (add)
     {
         dacl.AddAccess(AccessControlType.Allow, account, right, InheritanceFlags.None, PropagationFlags.None);
     }
     else
     {
         dacl.RemoveAccess(AccessControlType.Allow, account, right, InheritanceFlags.None, PropagationFlags.None);
     }
 }

 internal static CommonSecurityDescriptor CreateSecurityDescriptor(SecurityIdentifier userSid)
 {
     SecurityIdentifier sid = new SecurityIdentifier(networkSidSddlForm);
     DiscretionaryAcl dacl = new DiscretionaryAcl(false, false, 1);
     // Deny all access to NetworkSid
     dacl.AddAccess(AccessControlType.Deny, sid, -1, InheritanceFlags.None, PropagationFlags.None);
     if (userSid != null)
         dacl.AddAccess(AccessControlType.Allow, userSid, -1, InheritanceFlags.None, PropagationFlags.None);
     // Add access to the current user creating the pipe
     dacl.AddAccess(AccessControlType.Allow, WindowsIdentity.GetCurrent().User, -1, InheritanceFlags.None, PropagationFlags.None);
     // Initialize and return the CommonSecurityDescriptor
     return new CommonSecurityDescriptor(false, false, ControlFlags.OwnerDefaulted | ControlFlags.GroupDefaulted | ControlFlags.DiscretionaryAclPresent, null, null, null, dacl);;
 }

		public void AddAccessCommonAce ()
		{
			SecurityIdentifier sid = new SecurityIdentifier ("BA");
			DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, 0);

			dacl.AddAccess (AccessControlType.Allow, sid, 1, InheritanceFlags.None, PropagationFlags.None);
			Assert.AreEqual (1, dacl.Count);

			CommonAce ace = (CommonAce)dacl[0];
			Assert.AreEqual (1, ace.AccessMask);
			Assert.AreEqual ("S-1-5-32-544", ace.SecurityIdentifier.Value);
			Assert.IsFalse (ace.IsInherited);
		}

		public void AddAccessFailsOnNonCanonical ()
		{
			SecurityIdentifier sid = new SecurityIdentifier ("BU");

			RawAcl acl = new RawAcl (RawAcl.AclRevision, 0);
			acl.InsertAce (0, new CommonAce (AceFlags.None, AceQualifier.AccessAllowed, 1, sid, false, null));
			acl.InsertAce (1, new CommonAce (AceFlags.None, AceQualifier.AccessDenied, 1, sid, false, null));

			DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, acl);
			Assert.IsFalse (dacl.IsCanonical);
			Assert.AreEqual (2, dacl.Count);

			dacl.AddAccess (AccessControlType.Allow, sid, 1, InheritanceFlags.None, PropagationFlags.None);
		}

		public CommonSecurityDescriptor (bool isContainer, bool isDS,
						 ControlFlags flags,
						 SecurityIdentifier owner,
						 SecurityIdentifier group,
						 SystemAcl systemAcl,
						 DiscretionaryAcl discretionaryAcl)
		{
			this.isContainer = isContainer;
			this.isDS = isDS;
			this.flags = flags;
			this.owner = owner;
			this.group = group;
			this.systemAcl = systemAcl;
			this.discretionaryAcl = discretionaryAcl;
			
			throw new NotImplementedException ();
		}

		void Init (bool isContainer, bool isDS, RawSecurityDescriptor rawSecurityDescriptor)
		{
			if (null == rawSecurityDescriptor)
				throw new ArgumentNullException ("rawSecurityDescriptor");
				
			SystemAcl sacl = null;
			if (null != rawSecurityDescriptor.SystemAcl)
				sacl = new SystemAcl (isContainer, isDS, rawSecurityDescriptor.SystemAcl);
				
			DiscretionaryAcl dacl = null;
			if (null != rawSecurityDescriptor.DiscretionaryAcl)
				dacl = new DiscretionaryAcl (isContainer, isDS, rawSecurityDescriptor.DiscretionaryAcl);
				
			Init (isContainer, isDS,
			      rawSecurityDescriptor.ControlFlags,
			      rawSecurityDescriptor.Owner,
			      rawSecurityDescriptor.Group,
			      sacl, dacl);
		}

 private void BuildSecurityDescriptor()
 {
     NTAccount account;
     SecurityIdentifier identifier;
     CommonAce ace;
     RawAcl rawAcl = new RawAcl(GenericAcl.AclRevision, 1);
     int index = 0;
     if (this.operationRoleMembers != null)
     {
         foreach (string str in this.operationRoleMembers)
         {
             account = new NTAccount(str);
             identifier = (SecurityIdentifier) account.Translate(typeof(SecurityIdentifier));
             ace = new CommonAce(AceFlags.None, AceQualifier.AccessAllowed, 1, identifier, false, null);
             rawAcl.InsertAce(index, ace);
             index++;
         }
     }
     if (this.contractRoleMembers != null)
     {
         foreach (string str2 in this.contractRoleMembers)
         {
             account = new NTAccount(str2);
             identifier = (SecurityIdentifier) account.Translate(typeof(SecurityIdentifier));
             ace = new CommonAce(AceFlags.None, AceQualifier.AccessAllowed, 1, identifier, false, null);
             rawAcl.InsertAce(index, ace);
             index++;
         }
     }
     if (this.serviceRoleMembers != null)
     {
         foreach (string str3 in this.serviceRoleMembers)
         {
             account = new NTAccount(str3);
             identifier = (SecurityIdentifier) account.Translate(typeof(SecurityIdentifier));
             ace = new CommonAce(AceFlags.None, AceQualifier.AccessAllowed, 1, identifier, false, null);
             rawAcl.InsertAce(index, ace);
             index++;
         }
     }
     DiscretionaryAcl discretionaryAcl = new DiscretionaryAcl(true, false, rawAcl);
     this.securityDescriptor = new CommonSecurityDescriptor(true, false, ControlFlags.DiscretionaryAclPresent, sidAdministrators, sidAdministrators, null, discretionaryAcl);
 }

 private static byte[] FromSecurityIdentifiersFull(List<SecurityIdentifier> allowedSids, int accessRights)
 {
     int capacity = (allowedSids == null) ? 3 : (2 + allowedSids.Count);
     DiscretionaryAcl discretionaryAcl = new DiscretionaryAcl(false, false, capacity);
     discretionaryAcl.AddAccess(AccessControlType.Deny, new SecurityIdentifier(WellKnownSidType.NetworkSid, null), 0x10000000, InheritanceFlags.None, PropagationFlags.None);
     int accessMask = GenerateClientAccessRights(accessRights);
     if (allowedSids == null)
     {
         discretionaryAcl.AddAccess(AccessControlType.Allow, new SecurityIdentifier(WellKnownSidType.WorldSid, null), accessMask, InheritanceFlags.None, PropagationFlags.None);
     }
     else
     {
         for (int i = 0; i < allowedSids.Count; i++)
         {
             SecurityIdentifier sid = allowedSids[i];
             discretionaryAcl.AddAccess(AccessControlType.Allow, sid, accessMask, InheritanceFlags.None, PropagationFlags.None);
         }
     }
     discretionaryAcl.AddAccess(AccessControlType.Allow, GetProcessLogonSid(), accessRights, InheritanceFlags.None, PropagationFlags.None);
     CommonSecurityDescriptor descriptor = new CommonSecurityDescriptor(false, false, ControlFlags.None, null, null, null, discretionaryAcl);
     byte[] binaryForm = new byte[descriptor.BinaryLength];
     descriptor.GetBinaryForm(binaryForm, 0);
     return binaryForm;
 }

        private void CreateFromParts(bool isContainer, bool isDS, ControlFlags flags, SecurityIdentifier owner, SecurityIdentifier group, SystemAcl systemAcl, DiscretionaryAcl discretionaryAcl)
        {
            if (systemAcl != null &&
                systemAcl.IsContainer != isContainer)
            {
                throw new ArgumentException(
                     isContainer ?
                        SR.AccessControl_MustSpecifyContainerAcl :
                        SR.AccessControl_MustSpecifyLeafObjectAcl,
nameof(systemAcl));
            }

            if (discretionaryAcl != null &&
                discretionaryAcl.IsContainer != isContainer)
            {
                throw new ArgumentException(
                     isContainer ?
                        SR.AccessControl_MustSpecifyContainerAcl :
                        SR.AccessControl_MustSpecifyLeafObjectAcl,
nameof(discretionaryAcl));
            }

            _isContainer = isContainer;

            if (systemAcl != null &&
                systemAcl.IsDS != isDS)
            {
                throw new ArgumentException(
                     isDS ?
                        SR.AccessControl_MustSpecifyDirectoryObjectAcl :
                        SR.AccessControl_MustSpecifyNonDirectoryObjectAcl,
nameof(systemAcl));
            }

            if (discretionaryAcl != null &&
                discretionaryAcl.IsDS != isDS)
            {
                throw new ArgumentException(
                    isDS ?
                        SR.AccessControl_MustSpecifyDirectoryObjectAcl :
                        SR.AccessControl_MustSpecifyNonDirectoryObjectAcl,
nameof(discretionaryAcl));
            }

            _isDS = isDS;

            _sacl = systemAcl;

            //
            // Replace null DACL with an allow-all for everyone DACL
            //

            if (discretionaryAcl == null)
            {
                //
                // to conform to native behavior, we will add allow everyone ace for DACL
                //

                discretionaryAcl = DiscretionaryAcl.CreateAllowEveryoneFullAccess(_isDS, _isContainer);
            }

            _dacl = discretionaryAcl;

            //
            // DACL is never null. So always set the flag bit on
            //

            ControlFlags actualFlags = flags | ControlFlags.DiscretionaryAclPresent;

            //
            // Keep SACL and the flag bit in sync.
            //

            if (systemAcl == null)
            {
                unchecked { actualFlags &= ~(ControlFlags.SystemAclPresent); }
            }
            else
            {
                actualFlags |= (ControlFlags.SystemAclPresent);
            }

            _rawSd = new RawSecurityDescriptor(actualFlags, owner, group, systemAcl == null ? null : systemAcl.RawAcl, discretionaryAcl.RawAcl);
        }

		public void AddDiscretionaryAcl (byte revision, int trusted)
		{
			DiscretionaryAcl = new DiscretionaryAcl (IsContainer, IsDS, revision, trusted);
			flags |= ControlFlags.DiscretionaryAclPresent;
		}

		public void EmptyBinaryLengthOK()
		{
			DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, 0);
			Assert.AreEqual (8, dacl.BinaryLength);
		}