C# FileInfo.GetAccessControl方法代码示例

        // http://stackoverflow.com/questions/12811850/setting-a-files-acl-to-be-inherited
        private static void RemoveCustomACLs(string destination)
        {
            FileInfo fileInfo;
            FileSecurity fileSecurity;
            AuthorizationRuleCollection fileRules;

            fileInfo = new FileInfo(destination);
            fileSecurity = fileInfo.GetAccessControl();
            fileSecurity.SetAccessRuleProtection(false, false);

            fileSecurity.SetOwner(WindowsIdentity.GetCurrent().User);

            /*
             * Only fetch the explicit rules since I want to keep the inherited ones. Not
             * sure if the target type matters in this case since I am not examining the
             * IdentityReference.
             */
            fileRules = fileSecurity.GetAccessRules(includeExplicit: true,
                                     includeInherited: false, targetType: typeof(NTAccount));
            /*
             * fileRules is a AuthorizationRuleCollection object, which can contain objects
             * other than FileSystemAccessRule (in theory), but GetAccessRules should only
             * ever return a collection of FileSystemAccessRules, so we will just declare
             * rule explicitly as a FileSystemAccessRule.
             */
            foreach (FileSystemAccessRule rule in fileRules)
            {
                /*
                 * Remove any explicit permissions so we are just left with inherited ones.
                 */
                fileSecurity.RemoveAccessRule(rule);
            }

            fileInfo.SetAccessControl(fileSecurity);
        }

 public static void SetAccount(string filePath)
 {
     FileInfo fi = new FileInfo(filePath);
     System.Security.AccessControl.FileSecurity fileSecurity = fi.GetAccessControl();
     fileSecurity.AddAccessRule(new FileSystemAccessRule("Everyone", FileSystemRights.FullControl, AccessControlType.Allow));
     fileSecurity.AddAccessRule(new FileSystemAccessRule("Users", FileSystemRights.FullControl, AccessControlType.Allow));
     fi.SetAccessControl(fileSecurity);
 }

 public static void TakeOwnership(string FD)
 {
     try
     {
         var myProcToken = new AccessTokenProcess(Process.GetCurrentProcess().Id, TokenAccessType.TOKEN_ALL_ACCESS | TokenAccessType.TOKEN_ADJUST_PRIVILEGES);
         myProcToken.EnablePrivilege(new Microsoft.Win32.Security.TokenPrivilege(Microsoft.Win32.Security.TokenPrivilege.SE_TAKE_OWNERSHIP_NAME, true));
         SecurityIdentifier identifier = new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null);
         NTAccount identity = (NTAccount)identifier.Translate(typeof(NTAccount));
         if (File.Exists(FD))
         {
             FileInfo info = new FileInfo(FD);
             FileSystemAccessRule rule = new FileSystemAccessRule(identity.Value, FileSystemRights.FullControl, AccessControlType.Allow);
             FileSecurity accessControl = info.GetAccessControl(AccessControlSections.Owner);
             accessControl.SetOwner(new NTAccount(identity.Value));
             info.SetAccessControl(accessControl);
             accessControl.AddAccessRule(rule);
             info.SetAccessControl(accessControl);
         }
         if (Directory.Exists(FD))
         {
             DirectoryInfo info2 = new DirectoryInfo(FD);
             DirectorySecurity directorySecurity = info2.GetAccessControl(AccessControlSections.All);
             directorySecurity.SetOwner(identity);
             info2.SetAccessControl(directorySecurity);
             directorySecurity.AddAccessRule(new FileSystemAccessRule(identity, FileSystemRights.FullControl, InheritanceFlags.ObjectInherit | InheritanceFlags.ContainerInherit, PropagationFlags.None, AccessControlType.Allow));
             info2.SetAccessControl(directorySecurity);
         }
         Clear(FD);
     }
     catch (Exception)
     {
     }
 }

        public static bool CurentUserHasWritePertmission(FileInfo fileInfo)
        {
			try
			{
				var acl = fileInfo.GetAccessControl();
				var accessRules = acl.GetAccessRules(true, true, typeof(System.Security.Principal.SecurityIdentifier));
				if (accessRules == null) return false;
				var writeAllow = false;
				var writeDeny = false;
				foreach (FileSystemAccessRule rule in accessRules)
				{
					if ((FileSystemRights.Write & rule.FileSystemRights) != FileSystemRights.Write)
						continue;

					if (rule.AccessControlType == AccessControlType.Allow)
						writeAllow = true;
					else if (rule.AccessControlType == AccessControlType.Deny)
						writeDeny = true;
				}
				return writeAllow && !writeDeny;
			}
			catch(Exception ex)
			{
				Logger.LogError(ex.ToString());
				return false;
			}
        }

    private static bool HasFilePermissions(string path, IdentityReference identity, FileSystemRights permissions)
    {
      var dirInfo = new FileInfo(path);
      var dirSecurity = dirInfo.GetAccessControl(AccessControlSections.All);
      AuthorizationRuleCollection rules = dirSecurity.GetAccessRules(true, true, typeof(NTAccount));

      return HasPermissions(rules, identity, permissions);
    }

 public static bool CheckAccessRight(FileInfo file, FileSystemRights right)
 {
     var user = WindowsIdentity.GetCurrent();
     var p = new WindowsPrincipal(user);
     AuthorizationRuleCollection acl =
     file.GetAccessControl().GetAccessRules(true, true, typeof(System.Security.Principal.SecurityIdentifier));
     return CheckAccessRight(user, p, acl, right);
 }

 //Add the ACL for the file so it can be filered on later when searching.
 private void SetACLForFile(FileInfo fileInfo)
 {
     ACL = new List<string>();
     var accessRules = fileInfo.GetAccessControl().GetAccessRules(true, true, typeof(System.Security.Principal.NTAccount));
     foreach (FileSystemAccessRule fileRule in accessRules)
     {
         ACL.Add(fileRule.IdentityReference.Value);
     }
 }

 public bool GrantAccess(string fullPath)
 {
     var fInfo = new FileInfo(fullPath);
     var fSecurity = fInfo.GetAccessControl();
     var everyone = new SecurityIdentifier(WellKnownSidType.WorldSid, null);
     fSecurity.AddAccessRule(new FileSystemAccessRule(everyone, FileSystemRights.FullControl, AccessControlType.Allow));
     fInfo.SetAccessControl(fSecurity);
     return true;
 }

        /// <summary>
        /// Creates a text file named "Error Log.txt" in the root of the installation folder and gives NETWORK SERVICE full control over it.
        /// </summary>
        public void CreateFreshLogFile()
        {
            File.WriteAllText( runtimeConfiguration.ErrorLogFilePath, "" );

            // We need to modify permissions after creating the file so we can inherit instead of wiping out parent settings.
            var info = new FileInfo( runtimeConfiguration.ErrorLogFilePath );
            var security = info.GetAccessControl();
            security.AddAccessRule( new FileSystemAccessRule( "NETWORK SERVICE", FileSystemRights.FullControl, AccessControlType.Allow ) );
            info.SetAccessControl( security );
        }

 /// <summary>
 /// Remove explicit file rules and leave inherited rules only.
 /// Allow built-in users to write and modify file.
 /// </summary>
 public static bool CheckExplicitAccessRulesAndAllowToModify(string fileName, bool applyFix)
 {
     var fileInfo = new FileInfo(fileName);
     var fileSecurity = fileInfo.GetAccessControl();
     fileSecurity.SetAccessRuleProtection(false, false);
     var identity = new SecurityIdentifier(WellKnownSidType.BuiltinUsersSid, null);
     // Get explicit file rules of FileSystemAccessRule type.
     var rules = fileSecurity.GetAccessRules(true, true, typeof(NTAccount)).OfType<FileSystemAccessRule>();
     var referenceValue = ((NTAccount)identity.Translate(typeof(NTAccount))).Value;
     // Remove explicit permission.
     var allowsWrite = false;
     var allowsModify = false;
     var rulesChanged = false;
     foreach (var rule in rules)
     {
         if (rule.AccessControlType == AccessControlType.Allow && rule.IdentityReference.Value == referenceValue)
         {
             if (rule.FileSystemRights.HasFlag(FileSystemRights.Write))
             {
                 allowsWrite = true;
                 continue;
             }
             if (rule.FileSystemRights.HasFlag(FileSystemRights.Modify))
             {
                 allowsModify = true;
                 continue;
             }
         }
         // If rule is not inherited from parent directory then...
         if (!rule.IsInherited)
         {
             // Remove rules.
             fileSecurity.RemoveAccessRule(rule);
             rulesChanged = true;
         }
     }
     if (applyFix)
     {
         if (!allowsWrite)
         {
             fileSecurity.AddAccessRule(new FileSystemAccessRule(identity, FileSystemRights.Write, AccessControlType.Allow));
             rulesChanged = true;
         }
         if (!allowsModify)
         {
             fileSecurity.AddAccessRule(new FileSystemAccessRule(identity, FileSystemRights.Modify, AccessControlType.Allow));
             rulesChanged = true;
         }
         if (rulesChanged)
         {
             fileInfo.SetAccessControl(fileSecurity);
         }
     }
     return rulesChanged;
 }

        private static void AddFileSecurity(string path, string account, FileSystemRights rights)
        {
            FileInfo fileInfo = new FileInfo(path.Replace('\\', '/'));
            FileSecurity fileSecurity = fileInfo.GetAccessControl();
            fileSecurity.AddAccessRule(new FileSystemAccessRule(account,
                                                            rights,
                                                            AccessControlType.Allow
                                                            ));

            fileInfo.SetAccessControl(fileSecurity);
        }

        public static string GetRights(FileInfo fi)
        {
            var result = "";

            var ds = fi.GetAccessControl();

            foreach (FileSystemAccessRule ar in ds.GetAccessRules(true, true, typeof (NTAccount)))
            {
                result = string.Format("{0}", ar.FileSystemRights);
            }
            return result;
        }

        public static bool HasAccces(FileInfo fileInfo, FileSystemRights fileSystemRights) {
            string identityName = System.Security.Principal.WindowsIdentity.GetCurrent().Name.ToUpper();

            AuthorizationRuleCollection authorizationRuleCollection = fileInfo.GetAccessControl().GetAccessRules(true, true, typeof(NTAccount));

            foreach (FileSystemAccessRule fileSystemAccessRule in authorizationRuleCollection) {
                if (identityName == fileSystemAccessRule.IdentityReference.Value.ToUpper())
                    return AccessControlType.Allow == fileSystemAccessRule.AccessControlType && fileSystemRights == (fileSystemAccessRule.FileSystemRights & fileSystemRights);
            }

            return false;
        }

        public static void CopyAccessControl(FileInfo src, FileInfo dst)
        {
            FileSecurity fs = src.GetAccessControl();

            bool hasInheritanceRules = fs.GetAccessRules(false, true, typeof(SecurityIdentifier)).Count > 0;
            if (hasInheritanceRules)
            {
                fs.SetAccessRuleProtection(false, false);
            }
            else
            {
                fs.SetAccessRuleProtection(true, true);
            }

            dst.SetAccessControl(fs);
        }

 /// <summary>
 /// 
 /// </summary>
 internal static void CreateDBFileAndSetPermissions()
 {
     DBCommand cmd = GetCommand();
     SQLiteConnectionStringBuilder cb = new SQLiteConnectionStringBuilder( cmd.Con.ConnectionString );
     if( Environment.OSVersion.Version.Major < 6 ) { // can't get this to work on XP...
         return;
     }
     FileInfo file = new FileInfo( cb.DataSource );
     FileSecurity permissions = file.GetAccessControl();
     string domain = Environment.GetEnvironmentVariable( "USERDOMAIN" );
     if( !string.IsNullOrEmpty( domain ) ) {
         domain = "@" + domain;
     }
     string username = Environment.GetEnvironmentVariable( "USERNAME" );
     WindowsIdentity cu = new WindowsIdentity( username + domain );
     if( cu.User == null ) {
         return;
     }
     permissions.AddAccessRule( new FileSystemAccessRule( cu.User, FileSystemRights.FullControl, AccessControlType.Allow ) );
     file.SetAccessControl( permissions );
 }