C/C++ Windows 10 x64 (17763) Enterprise DACL issues - c

Question

I`m creating a user-mode process with the correct (I believe) permissions to allow the system to access an object, however this seems to always fail on some system processes with "Access Denied".
The object is created in "Global\" namespace. Some processes succeed, and some not; with the same permissions. Permissions set using ConvertStringSecurityDescriptorToSecurityDescriptor.
Inspecting the processes that do not behave as expected, I've added more permissions:
User: Font Driver Host\UMFD-0
SID: S-1-5-96-0-0
For this I've set: (A;OICI;GA;;;LS) // Since there is no such user on Microsoft's website
User: NT AUTHORITY\NETWORK SERVICE
SID: S-1-5-20
For this I've set: A;OICI;GA;;;NS)
User: NT AUTHORITY\LOCAL SERVICE
SID: S-1-5-19
For this I've set: (A;OICI;GA;;;LS)
Some processes running under these permissions are able to read my object, and some not. Why is that ?
I will not use "Everyone" or empty/null DACL so please do not advise that as a solution. The idea is to "allow" what is necessary since windows denies everything by default.
Please point out what I am doing wrong, would really appreciate it.

Answer 1

It seems like you're setting the User-mode driver. Try to use UD instead of LS, This declaration is in the sddl.h file.
According to the rule of AccessCheck,
All ACEs have been checked and there is still at least one requested
access right that has not been explicitly allowed, in which case,
access is implicitly denied.
EDIT:
#include <iostream>
#include <windows.h>
#include <sddl.h>
BOOL CreateMyDACL(SECURITY_ATTRIBUTES* pSA)
{
const TCHAR* szSD = TEXT("D:")
TEXT("(A;OICI;GA;;;UD)")
TEXT("(A;OICI;GA;;;NS)")
TEXT("(A;OICI;GA;;;LS)");
if (NULL == pSA)
return FALSE;
return ConvertStringSecurityDescriptorToSecurityDescriptor(
szSD,
SDDL_REVISION_1,
&(pSA->lpSecurityDescriptor),
NULL);
}
int main()
{
TCHAR szName[] = TEXT("Global\\MyObject");
SECURITY_ATTRIBUTES sa;
sa.nLength = sizeof(SECURITY_ATTRIBUTES);
sa.bInheritHandle = FALSE;
if (!CreateMyDACL(&sa))
{
printf("Failed CreateMyDACL\n");
exit(1);
}
HANDLE hEvent = CreateEvent(&sa, FALSE, TRUE, szName);
if (hEvent == NULL)
{
printf("error, %d\n", GetLastError());
return -1;
}
else
printf("success, %x\n", hEvent);
//Sleep(10000); //
CloseHandle(hEvent);
return 0;
}