Introducing windows-acl: working with ACLs in Rust

Summary: Trail of Bits released windows-acl, a Rust crate that simplifies programmatic manipulation of Windows discretionary (DACL) and system (SACL) access control lists. The crate handles the ordering and conflict rules that make inserting DACL entries difficult, and the author used it to update appjaillauncher-rs, a Rust port of AppJailLauncher that sandboxes Windows applications using AppContainers.
What's compelling: ACLs govern access to every securable Windows object and underpin sandboxing, event auditing, and integrity levels, yet manipulating them correctly in Rust previously required imperfect, complicated workarounds. The crate's SACL support gives Rust tooling access to the Windows Event auditing engine, which the source describes as instrumental in detecting endpoint compromise.

Read the original at Trail of Bits Blog ↗