在我接触Windows之前，对Windows的文件权限是不屑一顾。要用的时候才发现，Windows文件权限的组合远多于POSIX的rwx。这个坑花了三四天的时间。一句话总结：Windows虽然有更多的组合，但是不能实现全部的rwx组合。
首先是权限本身的转换，这里有个自认为完美的实现，只用一个掩码变量实现x, w, r等3种权限和OTH， GRP，USR等3个用户组的遍历，根据掩码得到的结果保存Windows下对应的权限。
创建3个sid时要特别注意其SID_IDENTIFIER_AUTHORITY 和RID。SID_IDENTIFIER_AUTHORITY分别是SECURITY_CREATOR_SID_AUTHORITY, SECURITY_CREATOR_SID_AUTHORITY, SECURITY_WORLD_SID_AUTHORITY; RID分别是SECURITY_CREATOR_OWNER_RID, SECURITY_CREATOR_GROUP_RID, SECURITY_WORLD_RID。
如果SID创建函数的输入参数有误，在创建时并不会有任何提示，但是用错误的SID创建了新的EXPLICIT_ACCESS，再将EXPLICIT_ACCESS通过SetEntriesInAcl写入DACL时，就会出现莫名的错误，而且没法调试，SetEntriesInAcl后的若干行都跳过了根本不显示其返回值或者错误代码。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 |
#pragma comment(lib, "advapi32.lib") #include <windows.h> #include <stdio.h> #include <accctrl.h> #include <aclapi.h> static int _set_security_info_from_rwx(LPTSTR lpszOwnFile, DWORD rwx) { size_t ret = -1; DWORD win_modes[] = {GENERIC_EXECUTE, GENERIC_WRITE, GENERIC_READ}; DWORD current_mode = 0x0001; // bit zero set to 1, which is S_IXOTH DWORD grants[] = {0, 0, 0}; DWORD denies[] = {0, 0, 0}; for (int i = 2; i >= 0; i--) { for (int j = 0; j <= 2; j++) { if (rwx & current_mode) { grants[i] |= win_modes[j]; } else { denies[i] |= win_modes[j]; } // Shift the mode bit being examined to the next one in the order X, W, R. current_mode <<= 1; } // Shift the group of mode bits being examined to the next one in the order OTH, GRP, USR // And also reset the value of current bit to 1. current_mode <<= 1; } PSID psid[3] = {NULL, NULL, NULL}; PACL pACL = NULL; SID_IDENTIFIER_AUTHORITY SIDAuthCr = SECURITY_CREATOR_SID_AUTHORITY; SID_IDENTIFIER_AUTHORITY SIDAuthWorld = SECURITY_WORLD_SID_AUTHORITY; // Create a SID for the Owner. if (!AllocateAndInitializeSid(&SIDAuthCr, 1, SECURITY_CREATOR_OWNER_RID, 0, 0, 0, 0, 0, 0, 0, &psid[0])) { printf("AllocateAndInitializeSid (Owner) error %u\n", GetLastError()); _set_errno(GetLastError()); goto done; } // Create a SID for the Owner group. if (!AllocateAndInitializeSid (&SIDAuthCr, 1, SECURITY_CREATOR_GROUP_RID, 0, 0, 0, 0, 0, 0, 0, &psid[1])) { printf("AllocateAndInitializeSid (Owner Group) error %u\n", GetLastError()); _set_errno(GetLastError()); goto done; } // Create a SID for the Everyone group. if (!AllocateAndInitializeSid(&SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &psid[2])) { printf("AllocateAndInitializeSid (Everyone Group) error %u\n", GetLastError()); _set_errno(GetLastError()); goto done; } const int NUM_ACES = 6; EXPLICIT_ACCESS ea[NUM_ACES]; DWORD dwRes; ZeroMemory(&ea, NUM_ACES * sizeof(EXPLICIT_ACCESS)); // Track the number of effective ea, to avoid blank permission ea. int num_aces = 0; for (int i = 0; i < 3; i++) { // Set access to each ea. According to ACE canoical rule, // deny access must proceed before set access. if (denies[i]) { ea[num_aces].grfAccessPermissions = denies[i]; ea[num_aces].grfAccessMode = DENY_ACCESS; ea[num_aces].grfInheritance = NO_INHERITANCE; ea[num_aces].Trustee.TrusteeForm = TRUSTEE_IS_SID; ea[num_aces].Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP; ea[num_aces].Trustee.ptstrName = (LPTSTR) psid[i]; num_aces++; } if (grants[i]) { ea[num_aces].grfAccessPermissions = grants[i]; ea[num_aces].grfAccessMode = SET_ACCESS; ea[num_aces].grfInheritance = NO_INHERITANCE; ea[num_aces].Trustee.TrusteeForm = TRUSTEE_IS_SID; ea[num_aces].Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP; ea[num_aces].Trustee.ptstrName = (LPTSTR) psid[i]; num_aces++; } } // Write the effective ea to DACL. if (ERROR_SUCCESS != SetEntriesInAcl(num_aces, ea, NULL, &pACL)) { printf("Failed SetEntriesInAcl!\n"); _set_errno(GetLastError()); goto done; } // Try to modify the object's DACL. dwRes = SetNamedSecurityInfo( lpszOwnFile, // name of the object SE_FILE_OBJECT, // type of object DACL_SECURITY_INFORMATION, // change only the object's DACL NULL, NULL, // do not change owner or group pACL, // DACL specified NULL); // do not change SACL if (dwRes != ERROR_SUCCESS) { printf("Fail to change DACL\n"); _set_errno(GetLastError()); goto done; } printf("Successfully changed DACL\n"); ret = 0; done: for (int i = 0; i < 3; i++) { if (psid[i]) { FreeSid(psid[i]); } } if (pACL) LocalFree(pACL); return ret; } int main() { LPTSTR lpszOwnFile = ".\\myfile.txt"; if ( _set_security_info_from_rwx(lpszOwnFile, 0x644)) { printf("Error!\n"); return 1; } else { printf("Succeed!\n"); return 0; } } |
看起来权限设置没问题，实际上acl的顺序乱了，而acl是严重依赖于顺序的，乱了就是废了。
创建文件后再修改显得不够专业，也有可能有不常见的坑。因此接下来通过CreateFile直接在创建时指定权限。
CREATOR跟posix中的owner没有关系，现在还不明白CREATOR是什么用途。
总之这个方案是失败。失败是成功之母，成功快出生了。详情见续篇。