用API实现指定共享用户访问权限的方法

思想是首先获得指定用户的SID，建立一个共享资源的访问控制列表，把SID加入访问控制列表，初始化共享资源的安全描述符

void AddShareDir(VectorShareDir& vecShareDir)
{
for (VectorShareDir::iterator iter = vecShareDir.begin(); iter != vecShareDir.end(); iter++)
{
SECURITY_DESCRIPTOR sd;
PACL pDacl = NULL;
DWORD dwAclSize = 0;
DWORD dwAccess;

// 如果没有任何权限则不添加共享
if (iter->nPermission == 1) // 读
dwAccess = 0x001200a9;
else if (iter->nPermission == 2) // 更改
dwAccess = 0x001301bf;
else if (iter->nPermission == 3) // 完全控制
dwAccess = GENERIC_ALL;
else
return;

SHARE_INFO_502   si502;
NET_API_STATUS   status;
_bstr_t bstrShareName(iter->strNetname.c_str());
_bstr_t bstrSharePath(iter->strPath.c_str());
vector<PSID> vecSid;
dwAclSize = sizeof(ACL);
GetSidByAccountName(iter->strUsers, vecSid, dwAclSize);

// 计算所需要的存储空间 add by wl
VectorShareDir::iterator _iter;
for (_iter = iter+1; _iter != vecShareDir.end(); _iter++)
{
if (strcmp(iter->strPath.c_str(), _iter->strPath.c_str()) != 0)
continue;

DWORD dwAcc;
if (_iter->nPermission == 1)
dwAcc = 0x001200a9;
else if (_iter->nPermission == 2)
dwAcc = 0x001301bf;
else if (_iter->nPermission == 3)
dwAcc = GENERIC_ALL;
else
break;

vector<PSID> vecOtherSid;
GetSidByAccountName(_iter->strUsers, vecOtherSid, dwAclSize);
}

// 为Acl分配空间并初始化
pDacl = (PACL)malloc(dwAclSize);
if(pDacl == NULL)
return;
InitializeAcl(pDacl, dwAclSize, ACL_REVISION);

// 把SID放到ACL中
vector<PSID>::iterator it;
for (it = vecSid.begin(); it != vecSid.end(); it++)
{
BOOL bRet = AddAccessAllowedAce(pDacl, ACL_REVISION, dwAccess, *it);
DWORD dwError = 0;
if (!bRet)
{
dwError = GetLastError();
gLogger.debug("[CSharedResourceMgr::AddShareDir] Add ace to acl error:%d", GetLastError());
}
}

for (_iter = iter+1; _iter != vecShareDir.end(); _iter++)
{
if (strcmp(iter->strPath.c_str(), _iter->strPath.c_str()) != 0)
continue;

DWORD dwAcc;
if (_iter->nPermission == 1)
dwAcc = 0x001200a9;
else if (_iter->nPermission == 2)
dwAcc = 0x001301bf;
else if (_iter->nPermission == 3)
dwAcc = GENERIC_ALL;
else
break;

vector<PSID> vecOtherSid;
DWORD dwTemp = 0;
GetSidByAccountName(_iter->strUsers, vecOtherSid, dwTemp);
for (it = vecOtherSid.begin(); it != vecOtherSid.end(); it++)
{
BOOL bRet = AddAccessAllowedAce(pDacl, ACL_REVISION, dwAcc, *it);
DWORD dwError = 0;
if (!bRet)
{
dwError = GetLastError();
gLogger.debug("[CSharedResourceMgr::AddShareDir] Add ace to acl error:%d", GetLastError());
}
}
}

InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION);
SetSecurityDescriptorDacl(&sd, TRUE, pDacl, FALSE);

si502.shi502_netname = bstrShareName;
si502.shi502_type = STYPE_DISKTREE;
si502.shi502_remark = NULL;
si502.shi502_max_uses = SHI_USES_UNLIMITED;
si502.shi502_permissions = ACCESS_ALL; // 此权限不起作用
si502.shi502_current_uses = 0;
si502.shi502_path = bstrSharePath;
si502.shi502_passwd = NULL;
si502.shi502_reserved = 0;
si502.shi502_security_descriptor = &sd;

status = NetShareAdd(NULL, 502, (LPBYTE)&si502, NULL);

if (NERR_DuplicateShare==status)
{
PSHARE_INFO_502 bufPtr;
if (NERR_Success == NetShareGetInfo(NULL, bstrShareName, 502, (LPBYTE*)&bufPtr))
{
bufPtr->shi502_security_descriptor = &sd;
if (NERR_Success == NetShareSetInfo(NULL, bstrShareName, 502, (LPBYTE)bufPtr, NULL))
{
status = NERR_Success;
}
else
{
gLogger.debug("[CSharedResourceMgr::AddShareDir]Set share info erroe:%d\n", GetLastError());
}
}
else
{
gLogger.debug("[CSharedResourceMgr::AddShareDir]Get share info erroe:%d\n", GetLastError());
}
}

if (pDacl != NULL)
free(pDacl);

if(status==NERR_Success)
gLogger.debug("[CSharedResourceMgr::AddShareDir] Create share:%s successed.", iter->strNetname);
else   
gLogger.debug("[CSharedResourceMgr::AddShareDir].Create share:%s meets an error:%d.", iter->strNetname, status);
}
}

void GetSidByAccountName(string strUsers, vector<PSID>& vecSid, DWORD& dwAclSize)
{
TCHAR RefDomain[64];
DWORD cchDomain = 64;
DWORD cbSid = 96;
SID_NAME_USE peUse = SidTypeUser;
vector<string> vecUsers;
Linkwork::String::SplitString(strUsers, ',', vecUsers);
size_t nSize = vecUsers.size();

for (int i = 0; i < nSize; i++)
{
PSID pSid = (PSID)malloc(cbSid);
if(pSid == NULL)
{
gLogger.debug("[CSharedResourceMgr::AddShareDir]HeapAlloc memory for user:%s error.", vecUsers[i]);
continue;
}

if(!LookupAccountName(NULL,     //[in]    这个参数指明查找的用户或组在哪个系统上，为NULL表示本地系统
vecUsers[i].c_str(), //[in]    欲授予访问权限的用户或组
pSid, //[out]   存放返回的SID值
&cbSid, //[in,out]进去的是你设定的缓冲区长度，出来的是实际SID的长度
RefDomain, //[out]   域名
&cchDomain, //[in,out]长度
&peUse)) //[out]   结构，用来指示用户的类型
{
free(pSid);
pSid = NULL;
if(GetLastError() == ERROR_INSUFFICIENT_BUFFER)
{
pSid = (PSID)malloc(cbSid);
if(pSid == NULL)
{
gLogger.debug("[CSharedResourceMgr::AddShareDir]HeapAlloc memory for user:%s error.", vecUsers[i]);
continue;
}
cchDomain = DNLEN + 1;
if(!LookupAccountName(NULL, vecUsers[i].c_str(), pSid, &cbSid, RefDomain, &cchDomain, &peUse))
{
free(pSid);
pSid = NULL;
gLogger.debug("[CSharedResourceMgr::AddShareDir]LookupAccountName error:%d!", GetLastError());
continue;
}
}
else
{
if(!IsValidSid(pSid))
gLogger.debug("[CSharedResourceMgr::AddShareDir]SID is NOT valid!");
else
gLogger.debug("[CSharedResourceMgr::AddShareDir]Lookup Account Name error:%d!", GetLastError());
continue;
}
}
char* pszStringSid;
if (ConvertSidToStringSid(pSid, &pszStringSid))
gLogger.info("The sid of %s is %s", vecUsers[i].c_str(), pszStringSid);
vecSid.push_back(pSid);
dwAclSize += (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) + GetLengthSid(pSid);
LocalFree(pszStringSid);
pszStringSid = NULL;
}
}