以下是一个示例代码,它会创建一个目录 C:\MyDir,并为该目录添加指定的访问控制项:
```c
#include <windows.h>
#include <stdio.h>
#include <aclapi.h>
int main() {
DWORD dwRes;
PACL pDacl = NULL;
PSECURITY_DESCRIPTOR pSD = NULL;
SECURITY_ATTRIBUTES sa = {0};
EXPLICIT_ACCESS ea[6];
SID_IDENTIFIER_AUTHORITY sidAuth = SECURITY_NT_AUTHORITY;
PSID pGuestSid = NULL, pSystemSid = NULL, pAdminSid = NULL, pInteractiveSid = NULL, pCreatorSid = NULL, pBackupSid = NULL;
// 创建 SID
if (!AllocateAndInitializeSid(&sidAuth, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &pGuestSid)) {
printf("AllocateAndInitializeSid error: %u\n", GetLastError());
goto cleanup;
}
if (!AllocateAndInitializeSid(&sidAuth, 1, SECURITY_LOCAL_SYSTEM_RID, 0, 0, 0, 0, 0, 0, 0, &pSystemSid)) {
printf("AllocateAndInitializeSid error: %u\n", GetLastError());
goto cleanup;
}
if (!AllocateAndInitializeSid(&sidAuth, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &pAdminSid)) {
printf("AllocateAndInitializeSid error: %u\n", GetLastError());
goto cleanup;
}
if (!AllocateAndInitializeSid(&sidAuth, 1, SECURITY_INTERACTIVE_RID, 0, 0, 0, 0, 0, 0, 0, &pInteractiveSid)) {
printf("AllocateAndInitializeSid error: %u\n", GetLastError());
goto cleanup;
}
if (!AllocateAndInitializeSid(&sidAuth, 1, SECURITY_CREATOR_OWNER_RID, 0, 0, 0, 0, 0, 0, 0, &pCreatorSid)) {
printf("AllocateAndInitializeSid error: %u\n", GetLastError());
goto cleanup;
}
if (!AllocateAndInitializeSid(&sidAuth, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_BACKUP_OPS, 0, 0, 0, 0, 0, 0, &pBackupSid)) {
printf("AllocateAndInitializeSid error: %u\n", GetLastError());
goto cleanup;
}
// 初始化访问控制项
ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS) * 6);
ea[0].grfAccessPermissions = GENERIC_READ | GENERIC_EXECUTE;
ea[0].grfAccessMode = DENY_ACCESS;
ea[0].grfInheritance = NO_INHERITANCE;
ea[0].Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea[0].Trustee.TrusteeType = TRUSTEE_IS_GROUP;
ea[0].Trustee.ptstrName = (LPTSTR)pGuestSid;
ea[1].grfAccessPermissions = GENERIC_ALL;
ea[1].grfAccessMode = GRANT_ACCESS;
ea[1].grfInheritance = NO_INHERITANCE;
ea[1].Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea[1].Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
ea[1].Trustee.ptstrName = (LPTSTR)pSystemSid;
ea[2].grfAccessPermissions = GENERIC_ALL;
ea[2].grfAccessMode = GRANT_ACCESS;
ea[2].grfInheritance = NO_INHERITANCE;
ea[2].Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea[2].Trustee.TrusteeType = TRUSTEE_IS_GROUP;
ea[2].Trustee.ptstrName = (LPTSTR)pAdminSid;
ea[3].grfAccessPermissions = GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE;
ea[3].grfAccessMode = GRANT_ACCESS;
ea[3].grfInheritance = NO_INHERITANCE;
ea[3].Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea[3].Trustee.TrusteeType = TRUSTEE_IS_GROUP;
ea[3].Trustee.ptstrName = (LPTSTR)pInteractiveSid;
ea[4].grfAccessPermissions = GENERIC_ALL;
ea[4].grfAccessMode = GRANT_ACCESS;
ea[4].grfInheritance = NO_INHERITANCE;
ea[4].Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea[4].Trustee.TrusteeType = TRUSTEE_IS_OWNER;
ea[4].Trustee.ptstrName = (LPTSTR)pCreatorSid;
ea[5].grfAccessPermissions = GENERIC_READ;
ea[5].grfAccessMode = GRANT_ACCESS;
ea[5].grfInheritance = NO_INHERITANCE;
ea[5].Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea[5].Trustee.TrusteeType = TRUSTEE_IS_GROUP;
ea[5].Trustee.ptstrName = (LPTSTR)pBackupSid;
// 创建安全描述符
dwRes = SetEntriesInAcl(6, ea, NULL, &pDacl);
if (dwRes != ERROR_SUCCESS) {
printf("SetEntriesInAcl error: %u\n", dwRes);
goto cleanup;
}
pSD = (PSECURITY_DESCRIPTOR)LocalAlloc(LPTR, SECURITY_DESCRIPTOR_MIN_LENGTH);
if (!pSD) {
printf("LocalAlloc error: %u\n", GetLastError());
goto cleanup;
}
if (!InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION)) {
printf("InitializeSecurityDescriptor error: %u\n", GetLastError());
goto cleanup;
}
if (!SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE)) {
printf("SetSecurityDescriptorDacl error: %u\n", GetLastError());
goto cleanup;
}
sa.nLength = sizeof(SECURITY_ATTRIBUTES);
sa.lpSecurityDescriptor = pSD;
// 创建目录
if (!CreateDirectory(TEXT("C:\\MyDir"), &sa)) {
printf("CreateDirectory error: %u\n", GetLastError());
goto cleanup;
}
// 清理资源
cleanup:
if (pGuestSid) FreeSid(pGuestSid);
if (pSystemSid) FreeSid(pSystemSid);
if (pAdminSid) FreeSid(pAdminSid);
if (pInteractiveSid) FreeSid(pInteractiveSid);
if (pCreatorSid) FreeSid(pCreatorSid);
if (pBackupSid) FreeSid(pBackupSid);
if (pDacl) LocalFree(pDacl);
if (pSD) LocalFree(pSD);
return 0;
}
```
上述代码中,我们使用了 Windows API 中的一些函数来创建指定的访问控制项,并将这些访问控制项应用到 C:\MyDir 目录上。其中,AllocateAndInitializeSid 函数用于创建 SID,SetEntriesInAcl 函数用于初始化访问控制项,InitializeSecurityDescriptor 函数用于创建安全描述符,SetSecurityDescriptorDacl 函数用于将访问控制列表关联到安全描述符上,CreateDirectory 函数用于创建目录。