Question

如何删除拒绝“列出文件夹内容”的目录的子目录？可以在here中找到“列出文件夹/读取数据”权限的说明，但是我找不到关于它的Microsoft文档。

这是目录结构和权限设置的方式。

C:\Temp\A\B\test.txt

A-拒绝“列出文件夹内容”
B-在设置A的特权之前具有默认特权
test.txt-在设置A的特权之前具有默认特权

这是我在代码注释中尝试过的代码。同样，在每种方法的上方，我还包括一条注释，指出我尝试过的路径的值。我从来没有尝试过删除所有包含这些示例的子目录。我正在尝试删除文件或空目录。

  [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
  [return: MarshalAs(UnmanagedType.Bool)]
  static extern bool RemoveDirectory(string lpPathName);

  //C:\Temp\A - Success
  //C:\Temp\A\B - Fail
  private void RemoveDirectoryImpl(string path)
  {
     if (!RemoveDirectory(path))
        //Returns error code 5 "access denied"
        Debug.WriteLine(Marshal.GetLastWin32Error());
  }

  //C:\Temp\A - Success
  //C:\Temp\A\B - Fail
  private void DirectoryInfoDeleteImpl(string path)
  {
     DirectoryInfo directoryInfo = new DirectoryInfo(path);
     //this throws an UnauthorizedAccessException but the directory is empty so it has no read-only files and the directory itself is not read-only.
     directoryInfo.Delete();
  }

  //C:\Temp\A - Success
  //C:\Temp\A\B - Fail
  private void DirectoryDeleteImpl(string path)
  {
     //this throws an UnauthorizedAccessException but the directory is empty so it has no read-only files and the directory itself is not read-only.
     Directory.Delete(path);
  }

由于某种原因，我可以在B中添加和删除文件。另外，只要它为空，我也可以删除带有拒绝“列出文件夹内容”的根目录。

  //C:\Temp\A\B\test.txt - Success
  private void FileDeleteImpl(string path)
  {
     //this is successful and does not throw an error.
     File.Delete(path);
  }

我确实发现了有趣的Bypass Traverse Checking。我确认我们的组策略设置中仍然包含“所有人”组。

这也是该目录的“安全性”选项卡的屏幕快照。

编辑1：

使用信息@rbmm在注释中给了我，我可以将这段代码放在一起，但是它仍然不会删除目录。我给自己“列出文件夹的内容”后尝试了此代码，并且可以正常工作。这段代码没有任何错误。

  private void BackupPrivilegeDeleteImpl(string path)
  {
     TOKEN_PRIVILEGES tokenPrivileges = new TOKEN_PRIVILEGES();
     tokenPrivileges.Privileges = new LUID_AND_ATTRIBUTES[40];
     IntPtr token = IntPtr.Zero;

     try
     {
        bool success = OpenProcessToken(Process.GetCurrentProcess().Handle, TOKEN_ADJUST_PRIVILEGES, ref token);

        if (!success)
           throw new Win32Exception(Marshal.GetLastWin32Error());

        success = LookupPrivilegeValue(null, SE_BACKUP_NAME, ref tokenPrivileges.Privileges[0].Luid);

        if (!success)
           throw new Win32Exception(Marshal.GetLastWin32Error());

        tokenPrivileges.PrivilegeCount = 1;
        tokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
        success = AdjustTokenPrivileges(token, false, ref tokenPrivileges, (uint)Marshal.SizeOf(tokenPrivileges), IntPtr.Zero, IntPtr.Zero);

        if (!success)
           throw new Win32Exception(Marshal.GetLastWin32Error());

        //Directory always comes back as the value 0xffffffff
        IntPtr directory = CreateFile(path, EFileAccessMasks.Delete, EFileShare.Delete, IntPtr.Zero, ECreationDisposition.OpenExisting, EFileAttributes.DeleteOnClose | EFileAttributes.ReparsePoint | EFileAttributes.BackupSemantics, IntPtr.Zero);
        CloseHandle(directory);

        Debug.WriteLine(success.ToString());
     }
     catch (Win32Exception e)
     {
        tbLastError.Text = e.NativeErrorCode.ToString();
        Debug.WriteLine(e.ToString());
     }
     catch (Exception e)
     {
        Debug.WriteLine(e.ToString());
     }
     finally
     {
        CloseHandle(token);
     }
  }

EDIT2：

根据@eryksun请求，添加了accessschk的输出。

C:\Temp\A
  DESCRIPTOR FLAGS:
      [SE_DACL_PRESENT]
      [SE_DACL_PROTECTED]
  OWNER: REDACTED
  [0] ACCESS_DENIED_ACE_TYPE: NT AUTHORITY\Authenticated Users
          [CONTAINER_INHERIT_ACE]
        FILE_LIST_DIRECTORY
        FILE_READ_ATTRIBUTES
        FILE_READ_EA
        FILE_TRAVERSE
        READ_CONTROL
  [1] ACCESS_ALLOWED_ACE_TYPE: NT AUTHORITY\Authenticated Users
          [OBJECT_INHERIT_ACE]
          [CONTAINER_INHERIT_ACE]
          [INHERITED_ACE]
        FILE_ADD_FILE
        FILE_ADD_SUBDIRECTORY
        FILE_LIST_DIRECTORY
        FILE_READ_ATTRIBUTES
        FILE_READ_EA
        FILE_TRAVERSE
        FILE_WRITE_ATTRIBUTES
        FILE_WRITE_EA
        SYNCHRONIZE
        READ_CONTROL
  [2] ACCESS_ALLOWED_ACE_TYPE: NT AUTHORITY\SYSTEM
          [OBJECT_INHERIT_ACE]
          [CONTAINER_INHERIT_ACE]
          [INHERITED_ACE]
        FILE_ALL_ACCESS
  [3] ACCESS_ALLOWED_ACE_TYPE: REDACTED
          [OBJECT_INHERIT_ACE]
          [CONTAINER_INHERIT_ACE]
          [INHERITED_ACE]
        FILE_ALL_ACCESS
  [4] ACCESS_ALLOWED_ACE_TYPE: BUILTIN\Administrators
          [OBJECT_INHERIT_ACE]
          [CONTAINER_INHERIT_ACE]
          [INHERITED_ACE]
        FILE_ALL_ACCESS
  [5] ACCESS_ALLOWED_ACE_TYPE: BUILTIN\Users
          [OBJECT_INHERIT_ACE]
          [CONTAINER_INHERIT_ACE]
          [INHERITED_ACE]
        FILE_ALL_ACCESS

C:\Temp\A\B
  DESCRIPTOR FLAGS:
      [SE_DACL_PRESENT]
      [SE_DACL_PROTECTED]
  OWNER: REDACTED
  [0] ACCESS_DENIED_ACE_TYPE: NT AUTHORITY\Authenticated Users
          [CONTAINER_INHERIT_ACE]
          [INHERITED_ACE]
        FILE_LIST_DIRECTORY
        FILE_READ_ATTRIBUTES
        FILE_READ_EA
        FILE_TRAVERSE
        READ_CONTROL
  [1] ACCESS_ALLOWED_ACE_TYPE: NT AUTHORITY\Authenticated Users
          [OBJECT_INHERIT_ACE]
          [CONTAINER_INHERIT_ACE]
          [INHERITED_ACE]
        FILE_ADD_FILE
        FILE_ADD_SUBDIRECTORY
        FILE_LIST_DIRECTORY
        FILE_READ_ATTRIBUTES
        FILE_READ_EA
        FILE_TRAVERSE
        FILE_WRITE_ATTRIBUTES
        FILE_WRITE_EA
        SYNCHRONIZE
        READ_CONTROL
  [2] ACCESS_ALLOWED_ACE_TYPE: NT AUTHORITY\SYSTEM
          [OBJECT_INHERIT_ACE]
          [CONTAINER_INHERIT_ACE]
          [INHERITED_ACE]
        FILE_ALL_ACCESS
  [3] ACCESS_ALLOWED_ACE_TYPE: REDACTED
          [OBJECT_INHERIT_ACE]
          [CONTAINER_INHERIT_ACE]
          [INHERITED_ACE]
        FILE_ALL_ACCESS
  [4] ACCESS_ALLOWED_ACE_TYPE: BUILTIN\Administrators
          [OBJECT_INHERIT_ACE]
          [CONTAINER_INHERIT_ACE]
          [INHERITED_ACE]
        FILE_ALL_ACCESS
  [5] ACCESS_ALLOWED_ACE_TYPE: BUILTIN\Users
          [OBJECT_INHERIT_ACE]
          [CONTAINER_INHERIT_ACE]
          [INHERITED_ACE]
        FILE_ALL_ACCESS

Answer 1

这是使删除生效的最终代码。感谢@eryksun和@rbmm在使此工作正常运行并为我提供我需要进行的正确win32 api调用方面所提供的帮助。我这里最大的问题是，我在此行LookupPrivilegeValue(null, "SeBackupPrivilege", ref tokenPrivileges.Privileges[0].Luid)上将LUID作为uint而不是LUID结构进行编组。在对令牌设置了特权之后，我就可以对目录使用托管的C＃删除方法，因为在后台它仅调用RemoveDirectory。我还根据返回的布尔值开始检查AdjustPrivileges是否成功，并始终使用Marshal.GetLastWin32Error() != 0确实帮助调试了此问题。

  private void BackupPrivilegeDeleteImpl(string path)
  {
     TOKEN_PRIVILEGES tokenPrivileges = new TOKEN_PRIVILEGES();
     tokenPrivileges.Privileges = new LUID_AND_ATTRIBUTES[1];
     IntPtr token = IntPtr.Zero;

     try
     {
        bool success = OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, ref token);

        if (!success)
           throw new Win32Exception(Marshal.GetLastWin32Error());

        success = LookupPrivilegeValue(null, "SeBackupPrivilege", ref tokenPrivileges.Privileges[0].Luid);

        if (!success)
           throw new Win32Exception(Marshal.GetLastWin32Error());

        tokenPrivileges.PrivilegeCount = 1;
        tokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
        success = AdjustTokenPrivileges(token, false, ref tokenPrivileges, (uint)Marshal.SizeOf(tokenPrivileges), IntPtr.Zero, IntPtr.Zero);

        if (!success || Marshal.GetLastWin32Error() != 0)
           throw new Win32Exception(Marshal.GetLastWin32Error());

        if (!RemoveDirectory(path))
           throw new Win32Exception(Marshal.GetLastWin32Error());
     }
     catch (Win32Exception e)
     {
        tbLastError.Text = e.NativeErrorCode.ToString();
        Debug.WriteLine(e.ToString());
     }
     catch (Exception e)
     {
        Debug.WriteLine(e.ToString());
     }
     finally
     {
        CloseHandle(token);
     }
  }

Answer 2

如果您的应用程序具有管理员权限，请使用SetAccessControl()中的DirectoryInfo提供对目录的访问。

如何删除已拒绝设置“列表文件夹内容”的目录的子目录

2 个答案: