Question

如果文件夹已存在，我必须创建文件夹或修改安全属性。我需要设置文件夹的权限，以便只有LocalAccount具有完全访问权限，而其他用户帐户不应具有对此文件夹的任何访问权限。截至目前，我正在尝试以下代码，但无法实现。

更新：我想，任何导致问题的现有ACE（如果文件夹存在）或从父目录继承的任何ACE都会导致问题？

DWORD dwRes;
PSID pEveryoneSID = NULL, pLocalSystemSID = NULL;
PACL pACL = NULL;
PSECURITY_DESCRIPTOR pSD = NULL;
EXPLICIT_ACCESS ea[2];
SID_IDENTIFIER_AUTHORITY SIDAuthWorld =
    SECURITY_WORLD_SID_AUTHORITY;
SID_IDENTIFIER_AUTHORITY SIDAuthNT = SECURITY_NT_AUTHORITY;
SECURITY_ATTRIBUTES sa;

// Create a well-known SID for the Everyone group.
if (!AllocateAndInitializeSid(&SIDAuthWorld, 1,
    SECURITY_WORLD_RID,
    0, 0, 0, 0, 0, 0, 0,
    &pEveryoneSID))
{
    LOGERROR(_T("AllocateAndInitializeSid Error %u\n"), GetLastError());
    goto Cleanup;
}

// Initialize an EXPLICIT_ACCESS structure for an ACE.
// The ACE will deny Everyone GENERIC_ALL to the folder.
ZeroMemory(&ea, 2 * sizeof(EXPLICIT_ACCESS));
ea[0].grfAccessPermissions = GENERIC_ALL;   
ea[0].grfAccessMode = DENY_ACCESS;
ea[0].grfInheritance = NO_INHERITANCE;
ea[0].Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea[0].Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
ea[0].Trustee.ptstrName = (LPTSTR)pEveryoneSID;

// Create a SID for the LocalSystem account(A special account used by the operating system) group.
if (!AllocateAndInitializeSid(&SIDAuthNT, 1,
    SECURITY_LOCAL_SYSTEM_RID,
    0, 0, 0, 0, 0, 0, 0,
    &pLocalSystemSID))
{
    LOGERROR(_T("AllocateAndInitializeSid Error %u\n"), GetLastError());
    goto Cleanup;
}

// Initialize an EXPLICIT_ACCESS structure for an ACE.
// The ACE will allow the  LocalSystem full access to the folder
ea[1].grfAccessPermissions = GENERIC_ALL;
ea[1].grfAccessMode = GRANT_ACCESS;   // or SET_ACCESS ?
ea[1].grfInheritance = NO_INHERITANCE;
ea[1].Trustee.TrusteeForm = TRUSTEE_IS_SID;     
ea[1].Trustee.TrusteeType = TRUSTEE_IS_GROUP;       //not sure what to use here for localAccount
ea[1].Trustee.ptstrName = (LPTSTR)pLocalSystemSID;

// Create a new ACL that contains the new ACEs.
dwRes = SetEntriesInAcl(2, ea, NULL, &pACL);
if (ERROR_SUCCESS != dwRes)
{
    LOGERROR(_T("SetEntriesInAcl Error %u\n"), GetLastError());
    goto Cleanup;
}

// Initialize a security descriptor.  
pSD = (PSECURITY_DESCRIPTOR)LocalAlloc(LPTR,
    SECURITY_DESCRIPTOR_MIN_LENGTH);
if (NULL == pSD)
{
    LOGERROR(_T("LocalAlloc Error %u\n"), GetLastError());
    goto Cleanup;
}

if (!InitializeSecurityDescriptor(pSD,
    SECURITY_DESCRIPTOR_REVISION))
{
    LOGERROR(_T("InitializeSecurityDescriptor Error %u\n"),
        GetLastError());
    goto Cleanup;
}

// Add the ACL to the security descriptor. 
if (!SetSecurityDescriptorDacl(pSD,
    TRUE,     // bDaclPresent flag   
    pACL,
    FALSE))   // not a default DACL 
{
    LOGERROR(_T("SetSecurityDescriptorDacl Error %u\n"),
        GetLastError());
    goto Cleanup;
}

// Initialize a security attributes structure.
sa.nLength = sizeof (SECURITY_ATTRIBUTES);
sa.lpSecurityDescriptor = pSD;
sa.bInheritHandle = FALSE;

int rVal = SHCreateDirectoryExW(NULL, m_tcProxyData, &sa);

仅允许文件夹访问LocalAccount＆amp;否认每个人

0 个答案: