Registry - Create Key - Security

Question

I'm considering creating a key under HKEY_LOCAL_MACHINE. I've read the MDSN and kind of understand what to do but am concerned about the Registry Security business. I want any user on the system to be able to access the key. Do I need to specify something in the LPSECURITY_ATTRIBUTES parameter of the RegCreateKeyEx call? If so what? Under the description of that parameter, there is a link to SECURITY_ATTRIBUTES where it says "This is not the same as granting access to everyone by assigning a NULL discretionary access control list (DACL)." But I can't find out exactly what that means. Can anyone help?

Answer 1

Do you want any user to be able to read the key, or to write it? By default any user will be able to read the key without any additional effort on your part. If you want to specify additional security attributes such as write access then you will need to specify the security attributes.

I found an article here entitled Creating a DACL. Use the code in there, or some variant, and then do something like this:

 SECURITY_ATTRIBUTES  sa;

 sa.nLength = sizeof(SECURITY_ATTRIBUTES);
 sa.bInheritHandle = FALSE;  

 // Call function to set the DACL. The DACL
 // is set in the SECURITY_ATTRIBUTES 
 // lpSecurityDescriptor member.
 if (!CreateMyDACL(&sa))
 {
     // Error encountered; generate message and exit.
     printf("Failed CreateMyDACL\n");
     exit(1);
 }

 RegCreateKeyEx(HKEY_LOCAL_MACHINE, subKey, 0, NULL, 0, KEY_ALL_ACCESS, &sa, &hKey, NULL);