C# AccessControl.RawAcl类代码示例

		public RawSecurityDescriptor (ControlFlags flags,
					      SecurityIdentifier owner,
					      SecurityIdentifier group,
					      RawAcl systemAcl,
					      RawAcl discretionaryAcl)
		{
		}

		public RawSecurityDescriptor (byte[] binaryForm, int offset)
		{
			if (binaryForm == null)
				throw new ArgumentNullException("binaryForm");
			
			if (offset < 0 || offset > binaryForm.Length - 0x14)
				throw new ArgumentOutOfRangeException("offset", offset, "Offset out of range");
			
			if (binaryForm[offset] != 1)
				throw new ArgumentException("Unrecognized Security Descriptor revision.", "binaryForm");
			
			resourcemgr_control = binaryForm[offset + 0x01];
			control_flags = (ControlFlags)ReadUShort(binaryForm, offset + 0x02);
			
			int ownerPos = ReadInt(binaryForm, offset + 0x04);
			int groupPos = ReadInt(binaryForm, offset + 0x08);
			int saclPos = ReadInt(binaryForm, offset + 0x0C);
			int daclPos = ReadInt(binaryForm, offset + 0x10);
			
			if (ownerPos != 0)
				owner_sid = new SecurityIdentifier(binaryForm, ownerPos);
			
			if (groupPos != 0)
				group_sid = new SecurityIdentifier(binaryForm, groupPos);
			
			if (saclPos != 0)
				system_acl = new RawAcl(binaryForm, saclPos);
			
			if (daclPos != 0)
				discretionary_acl = new RawAcl(binaryForm, daclPos);
		}

		void Init (bool isContainer, bool isDS, RawAcl rawAcl)
		{
			is_container = isContainer;
			is_ds = isDS;
			raw_acl = rawAcl;
			CleanAndRetestCanonicity ();
		}

	// Constructor.
	internal CommonAcl(RawAcl acl, bool isContainer, bool isDS,
					   bool wasCanonicalInitially, byte revision)
			{
				this.acl = acl;
				this.isContainer = isContainer;
				this.isDS = isDS;
				this.wasCanonicalInitially = wasCanonicalInitially;
				this.revision = revision;
			}

		public void UsesRawAclRevision ()
		{
			RawAcl acl1 = new RawAcl (RawAcl.AclRevisionDS, 0);
			DiscretionaryAcl dacl1 = new DiscretionaryAcl (false, false, acl1);
			Assert.AreEqual (4, dacl1.Revision);

			RawAcl acl2 = new RawAcl (RawAcl.AclRevision, 0);
			DiscretionaryAcl dacl2 = new DiscretionaryAcl (false, true, acl2);
			Assert.AreEqual (2, dacl2.Revision);
		}

		public void BinaryRoundtrip ()
		{
			RawAcl acl = CreateRoundtripRawAcl ();
			byte[] binaryForm1 = new byte[acl.BinaryLength];
			acl.GetBinaryForm (binaryForm1, 0);

			RawAcl acl2 = new RawAcl (binaryForm1, 0);
			byte[] binaryForm2 = new byte[acl2.BinaryLength];
			acl2.GetBinaryForm (binaryForm2, 0);

			CompareBinaryForms (binaryForm1, binaryForm2);
		}

		internal CommonAcl (bool isContainer, bool isDS, RawAcl rawAcl)
		{
			if (rawAcl == null) {
				rawAcl = new RawAcl (isDS ? AclRevisionDS : AclRevision, default_capacity);
			} else {
				// The RawAcl ACEs are cloned.
				byte[] binaryForm = new byte [rawAcl.BinaryLength];
				rawAcl.GetBinaryForm (binaryForm, 0);
				rawAcl = new RawAcl (binaryForm, 0);
			}

			Init (isContainer, isDS, rawAcl);
		}

		public void AddAccessFailsOnNonCanonical ()
		{
			SecurityIdentifier sid = new SecurityIdentifier ("BU");

			RawAcl acl = new RawAcl (RawAcl.AclRevision, 0);
			acl.InsertAce (0, new CommonAce (AceFlags.None, AceQualifier.AccessAllowed, 1, sid, false, null));
			acl.InsertAce (1, new CommonAce (AceFlags.None, AceQualifier.AccessDenied, 1, sid, false, null));

			DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, acl);
			Assert.IsFalse (dacl.IsCanonical);
			Assert.AreEqual (2, dacl.Count);

			dacl.AddAccess (AccessControlType.Allow, sid, 1, InheritanceFlags.None, PropagationFlags.None);
		}

 private void BuildSecurityDescriptor()
 {
     NTAccount account;
     SecurityIdentifier identifier;
     CommonAce ace;
     RawAcl rawAcl = new RawAcl(GenericAcl.AclRevision, 1);
     int index = 0;
     if (this.operationRoleMembers != null)
     {
         foreach (string str in this.operationRoleMembers)
         {
             account = new NTAccount(str);
             identifier = (SecurityIdentifier) account.Translate(typeof(SecurityIdentifier));
             ace = new CommonAce(AceFlags.None, AceQualifier.AccessAllowed, 1, identifier, false, null);
             rawAcl.InsertAce(index, ace);
             index++;
         }
     }
     if (this.contractRoleMembers != null)
     {
         foreach (string str2 in this.contractRoleMembers)
         {
             account = new NTAccount(str2);
             identifier = (SecurityIdentifier) account.Translate(typeof(SecurityIdentifier));
             ace = new CommonAce(AceFlags.None, AceQualifier.AccessAllowed, 1, identifier, false, null);
             rawAcl.InsertAce(index, ace);
             index++;
         }
     }
     if (this.serviceRoleMembers != null)
     {
         foreach (string str3 in this.serviceRoleMembers)
         {
             account = new NTAccount(str3);
             identifier = (SecurityIdentifier) account.Translate(typeof(SecurityIdentifier));
             ace = new CommonAce(AceFlags.None, AceQualifier.AccessAllowed, 1, identifier, false, null);
             rawAcl.InsertAce(index, ace);
             index++;
         }
     }
     DiscretionaryAcl discretionaryAcl = new DiscretionaryAcl(true, false, rawAcl);
     this.securityDescriptor = new CommonSecurityDescriptor(true, false, ControlFlags.DiscretionaryAclPresent, sidAdministrators, sidAdministrators, null, discretionaryAcl);
 }

		public void IndexerMakesCopies ()
		{
			// This behavior is mentioned in the DiscretionaryAcl RawAcl constructor overload.
			// Turns out it applies to more than just the constructor.
			SecurityIdentifier worldSid = new SecurityIdentifier ("WD");

			// RawAcl does not make copies.
			RawAcl acl = new RawAcl (RawAcl.AclRevision, 1);
			CommonAce ace = new CommonAce (AceFlags.SuccessfulAccess, AceQualifier.SystemAudit, 1, worldSid, false, null);
			acl.InsertAce (0, ace);
			Assert.AreSame (acl [0], acl [0]);

			// CommonAcl does.
			SystemAcl sacl = new SystemAcl (false, false, acl);
			Assert.AreNotSame (sacl [0], sacl [0]);

			// Make sure the copying occurs in the constructor as well as the indexer.
			ace.AceFlags = AceFlags.FailedAccess;
			Assert.AreEqual (AceFlags.SuccessfulAccess, sacl [0].AceFlags);
		}

		static RawAcl CreateRoundtripRawAcl ()
		{
			SecurityIdentifier sid = new SecurityIdentifier (WellKnownSidType.BuiltinUsersSid, null);
			Assert.AreEqual (16, sid.BinaryLength);
			
			GenericAce[] aces = new GenericAce[] {
				new ObjectAce (AceFlags.None, AceQualifier.AccessAllowed, 1, sid,
				               ObjectAceFlags.ObjectAceTypePresent,
				               Guid.Empty, Guid.Empty, false, new byte[8]),
				new ObjectAce (AceFlags.None, AceQualifier.AccessAllowed, 2, sid,
				               ObjectAceFlags.InheritedObjectAceTypePresent,
				               Guid.Empty, Guid.Empty, true, new byte[16]),
				new ObjectAce (AceFlags.None, AceQualifier.AccessAllowed, 4, sid,
				               ObjectAceFlags.InheritedObjectAceTypePresent,
				               Guid.Empty, new Guid ("{8865FB90-A9EB-422F-A8BA-07ECA611D699}"), true, new byte[4]),
				new ObjectAce (AceFlags.None, AceQualifier.AccessAllowed, 4, sid,
				               ObjectAceFlags.ObjectAceTypePresent|ObjectAceFlags.InheritedObjectAceTypePresent,
				               Guid.Empty, new Guid ("{B893007C-38D5-4827-A698-BA25F1E30BAC}"), true, new byte[4]),
				new ObjectAce (AceFlags.None, AceQualifier.AccessAllowed, 4, sid,
				               ObjectAceFlags.None,
				               Guid.Empty, new Guid ("{C0F9DF22-C320-4400-B41F-754F69668640}"), true, new byte[4])
			};
			
			// Make sure this created right, first of all.
			Assert.AreEqual (AceType.AccessAllowedObject, aces [0].AceType);
			Assert.AreEqual (AceType.AccessAllowedCallbackObject, aces [1].AceType);
			Assert.AreEqual (AceType.AccessAllowedCallbackObject, aces [2].AceType);
			Assert.AreEqual (AceType.AccessAllowedCallbackObject, aces [3].AceType);
			Assert.AreEqual (AceType.AccessAllowedCallbackObject, aces [4].AceType);
			Assert.AreEqual (52, aces [0].BinaryLength);
			Assert.AreEqual (60, aces [1].BinaryLength);
			Assert.AreEqual (48, aces [2].BinaryLength);
			Assert.AreEqual (64, aces [3].BinaryLength);
			Assert.AreEqual (32, aces [4].BinaryLength);

			RawAcl acl = new RawAcl (RawAcl.AclRevision, 0);
			for (int i = 0; i < aces.Length; i ++)
				acl.InsertAce (i, aces[i]);
			return acl;
		}

		public void GetBinaryForm ()
		{
			RawAcl acl = new RawAcl (1, 0);
			
			byte[] buffer = new byte[acl.BinaryLength];
			acl.GetBinaryForm (buffer, 0);
			byte[] sdBinary = new byte[] { 0x01, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00 };
			Assert.AreEqual (sdBinary, buffer);
			
			
			SecurityIdentifier builtInAdmins = new SecurityIdentifier (WellKnownSidType.BuiltinAdministratorsSid, null);
			CommonAce ace = new CommonAce (AceFlags.None, AceQualifier.AccessAllowed, 0x7FFFFFFF, builtInAdmins, false, null);
			acl.InsertAce (0, ace);
			buffer = new byte[acl.BinaryLength];
			acl.GetBinaryForm (buffer, 0);
			sdBinary = new byte[] {
				0x01, 0x00, 0x20, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
				0x18, 0x00, 0xFF, 0xFF, 0xFF, 0x7F, 0x01, 0x02, 0x00, 0x00,
				0x00, 0x00, 0x00, 0x05, 0x20, 0x00, 0x00, 0x00, 0x20, 0x02,
				0x00, 0x00 };
			Assert.AreEqual (sdBinary, buffer);
		}

        //
        // Creates an ACL from a raw ACL
        // - 'trusted' (internal) callers get to pass the raw ACL
        //   that this object will take ownership of
        // - 'untrusted' callers are handled by creating a local
        //   copy of the ACL passed in
        //

        internal CommonAcl( bool isContainer, bool isDS, RawAcl rawAcl, bool trusted, bool isDacl )
            : base()
        {
            if ( rawAcl == null )
            {
                throw new ArgumentNullException( "rawAcl" );
            }
            Contract.EndContractBlock();

            _isContainer = isContainer;
            _isDS = isDS;

            if (trusted)
            {
                //
                // In the trusted case, we take over ownership of the ACL passed in
                //

                _acl = rawAcl;

                RemoveMeaninglessAcesAndFlags( isDacl );
            }
            else
            {
                //
                // In the untrusted case, we create our own raw ACL to keep the ACEs in
                //

                _acl = new RawAcl( rawAcl.Revision, rawAcl.Count );
            
                for ( int i = 0; i < rawAcl.Count; i++ )
                {
                    //
                    // Clone each ACE prior to putting it in
                    //

                    GenericAce ace = rawAcl[i].Copy();

                    //
                    // Avoid inserting meaningless ACEs
                    //

                    if ( true == InspectAce( ref ace, isDacl ))
                    {
                        _acl.InsertAce( _acl.Count, ace );
                    }
                }
            }

            //
            // See whether the ACL is canonical to begin with
            //

            if ( true == CanonicalCheck( isDacl ))
            {
                //
                // Sort and compact the array
                //

                Canonicalize( true, isDacl );

                _isCanonical = true;
            }
            else
            {
                _isCanonical = false;
            }
        }

            public byte[] GetSecurity(SecurityInformation requestedInformation, bool wantDefault)
            {
                //FileSecurity fsec= new FileSecurity(@"c:\Test1\test.txt",~AccessControlSections.Audit);
                //return fsec.GetSecurityDescriptorBinaryForm();
                WindowsIdentity user = WindowsIdentity.GetCurrent();
                if (user != null)
                {
                    int length = 0;
                    IntPtr token = user.Token;
                    GetTokenInformation(token, TOKEN_INFORMATION_CLASS.TokenDefaultDacl, IntPtr.Zero, 0, out length);
                    IntPtr TokenInformation = Marshal.AllocHGlobal((int) length);
                    bool Result = GetTokenInformation(token, TOKEN_INFORMATION_CLASS.TokenDefaultDacl, TokenInformation, (uint) length,
                                                      out length);
                    TOKEN_DEFAULT_DACL dacl =
                        (TOKEN_DEFAULT_DACL) Marshal.PtrToStructure(TokenInformation, typeof (TOKEN_DEFAULT_DACL));
                    ACL acl = (ACL) Marshal.PtrToStructure(dacl.DefaultDacl, typeof (ACL));

                    byte[] aceArr = new byte[acl.AclSize];
                    Marshal.Copy(dacl.DefaultDacl, aceArr, 0, acl.AclSize);

                    RawAcl rawAcl = new RawAcl(aceArr, 0);

                    Marshal.FreeHGlobal(TokenInformation);
                    GetTokenInformation(token, TOKEN_INFORMATION_CLASS.TokenOwner, IntPtr.Zero, 0, out length);
                    TokenInformation = Marshal.AllocHGlobal((int) length);
                    GetTokenInformation(token, TOKEN_INFORMATION_CLASS.TokenOwner, TokenInformation, (uint)length,
                                                      out length);
                    TOKEN_OWNER tokOwner = (TOKEN_OWNER) Marshal.PtrToStructure(TokenInformation, typeof (TOKEN_OWNER));
                    SecurityIdentifier ownerSID= new SecurityIdentifier(tokOwner.Owner);

                    Marshal.FreeHGlobal(TokenInformation);
                    GetTokenInformation(token, TOKEN_INFORMATION_CLASS.TokenPrimaryGroup, IntPtr.Zero, 0, out length);
                    TokenInformation = Marshal.AllocHGlobal((int)length);
                    GetTokenInformation(token, TOKEN_INFORMATION_CLASS.TokenPrimaryGroup, TokenInformation, (uint)length,
                                                      out length);
                    TOKEN_PRIMARY_GROUP tokGroup= (TOKEN_PRIMARY_GROUP)Marshal.PtrToStructure(TokenInformation, typeof(TOKEN_PRIMARY_GROUP));
                    SecurityIdentifier groupSID = new SecurityIdentifier(tokGroup.PrimaryGroup);

                    RawSecurityDescriptor rawDesc = new RawSecurityDescriptor(ControlFlags.DiscretionaryAclPresent, ownerSID, groupSID, null, rawAcl);
                    byte[] ret = new byte[rawDesc.BinaryLength];
                    rawDesc.GetBinaryForm(ret, 0);
                    return ret;

                }
                return null;
            }

        private void Button_Click(object sender, RoutedEventArgs e)
        {
            WindowsIdentity user = WindowsIdentity.GetCurrent();
            if (user != null)
            {
                int length = 0;
                IntPtr token = user.Token;
                GetTokenInformation(token, TOKEN_INFORMATION_CLASS.TokenDefaultDacl, IntPtr.Zero, 0, out length);
                IntPtr TokenInformation = Marshal.AllocHGlobal((int)length);
                bool Result = GetTokenInformation(token, TOKEN_INFORMATION_CLASS.TokenDefaultDacl, TokenInformation, (uint)length, out length);
                TOKEN_DEFAULT_DACL dacl = (TOKEN_DEFAULT_DACL)Marshal.PtrToStructure(TokenInformation, typeof(TOKEN_DEFAULT_DACL));
                ACL acl = (ACL)Marshal.PtrToStructure(dacl.DefaultDacl, typeof(ACL));

                byte[] aceArr = new byte[acl.AclSize];
                Marshal.Copy(dacl.DefaultDacl, aceArr, 0, acl.AclSize);

                RawAcl rawAcl = new RawAcl(aceArr, 0);

                DiscretionaryAcl dacl1 = new DiscretionaryAcl(false, false, rawAcl);

                string titel = "titel";

                AclUIAdapter.EditSecurity(new ServiceSecurityModel(System.Environment.MachineName, titel));
            }
        }