Question

我想恢复共享文件夹上的有效权限。为此，我使用了CreateFile，GetSecurityInfo和GetEffectiveRightsFromAclA方法。问题是，当我设置管理员的SID时，当测试权限时，它不起作用。这是否来自我的代码的错误实现？我指定我拥有该文件的权限。

    //stringName is the file path
    HANDLE file = CreateFile(stringName.c_str(), GENERIC_READ, 
    FILE_SHARE_READ, 
    nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr);
    PSID pSid;
    //The SID is that of the administrator 
    ConvertStringSidToSidA(stringSid.c_str(), &pSid);

    PACL ppDacl;
    PSECURITY_DESCRIPTOR ppSecurityDescriptor;
    GetSecurityInfo(file, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION, nullptr, 
    &pSid, &ppDacl, nullptr, &ppSecurityDescriptor);

    ACCESS_MASK pAccesMask;
    TRUSTEE_A pTrustee;
    GetEffectiveRightsFromAclA(ppDacl, &pTrustee, &pAccesMask);
    //here conditions are not respected
    if((pAccesMask & GENERIC_READ) == GENERIC_READ)
    {
        std::cout<<"ok"<<std::endl;
    }
    if((pAccesMask & GENERIC_WRITE) == GENERIC_WRITE)
    {
        std::cout<<"ok"<<std::endl;
    }
    if((pAccesMask & GENERIC_EXECUTE) == GENERIC_EXECUTE)
    {
        std::cout<<"ok"<<std::endl;
    }
    if((pAccesMask & GENERIC_ALL) == GENERIC_ALL)
    {
        std::cout<<"ok"<<std::endl;
    }

Answer 1

在使用pAccesMask值之前，请确保GetEffectiveRightsFromAclA函数返回ERROR_SUCCESS。

并且因为a Windows file object maps the GENERIC_READ bit to the READ_CONTROL and SYNCHRONIZE standard access rights。因此，如下更改GENERIC_READ的条件检查逻辑：

if ((pAccesMask & READ_CONTROL) == READ_CONTROL && (pAccesMask & SYNCHRONIZE) == SYNCHRONIZE) //GENERIC_READ
{
    std::cout << "GENERIC_READ" << std::endl;
}

在共享文件夹上恢复有效权限的问题

1 个答案: