为"ALL APPLICATION PACKAGES"组分配文件夹权限

Question

Win 8似乎有了一个新的用户组"所有应用程序包"。默认情况下，此组似乎对所有文件夹都具有读取权限。然而，我的要求是在我创建的文件夹上设置一些特定的ACL。这个组目前对我的文件夹没有权限，我写了一些代码来添加"所有应用程序包"的读取权限。我使用的是VS2010，下面是经过修剪的代码片段。

列出的"所有应用程序包"的SIDhttp://msdn.microsoft.com/en-us/library/cc980032.aspx是ALL_APP_PACKAGES（S-1-15-2-1）。

但无论我以何种方式或何种值作为受托人Name传递，下面的代码都不起作用。例如，在下面的代码中，SetNamedSecurityInfo（）失败，返回ERROR_INVALID_ACL。但是，如果我使用"管理员"或"每个人"帐户，那么它就可以工作了。

我需要分配的确切权限是"读取和执行"、"列出文件夹内容"one_answers"读取"

#include "stdafx.h"
#include "windows.h"
#include "sddl.h"
#include "Aclapi.h"
int _tmain(int argc, _TCHAR* argv[])
{
TCHAR pszObjName[MAX_PATH] = L"C:\Program Files\Common Files\Test\";
PACL pOldDACL = NULL, pNewDACL = NULL;
PSECURITY_DESCRIPTOR pSD = NULL;
EXPLICIT_ACCESS ea;
SECURITY_INFORMATION si = DACL_SECURITY_INFORMATION;
// Get a pointer to the existing DACL (Conditionaly).
DWORD dwRes = GetNamedSecurityInfo(pszObjName, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION, NULL, NULL, &pOldDACL, NULL, &pSD);
// Initialize an EXPLICIT_ACCESS structure for the new ACE. 
ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));
ea.grfAccessPermissions = STANDARD_RIGHTS_READ;
ea.grfAccessMode = SET_ACCESS;
ea.grfInheritance= SUB_CONTAINERS_AND_OBJECTS_INHERIT;
ea.Trustee.TrusteeForm = TRUSTEE_IS_SID;
// ea.Trustee.TrusteeType = TRUSTEE_IS_GROUP;
// Should I be using SID (S-1-15-2-1) (SetEntriesInAcl() fails) or "ALL_APP_PACKAGES" (SetEntriesInAcl() passes but SetNamedSecurityInfo() fails)
//If I use "Administrators" or "Everyone" as Trustee Name then it works fine but not with "ALL APPLICATION PACKAGES"
ea.Trustee.ptstrName = _T(" ALL_APP_PACKAGES"); 
// Create a new ACL that merges the new ACE into the existing DACL.
dwRes = SetEntriesInAcl(1, &ea, pOldDACL, &pNewDACL);
if(ERROR_SUCCESS != dwRes) 
goto Cleanup; 
// Attach the new ACL as the object's DACL.
dwRes = SetNamedSecurityInfo(pszObjName, SE_FILE_OBJECT, si, NULL, NULL, pNewDACL, NULL);
if(ERROR_SUCCESS != dwRes)  
goto Cleanup;
Cleanup:
if(pSD != NULL) 
LocalFree((HLOCAL) pSD); 
if(pNewDACL != NULL) 
LocalFree((HLOCAL) pNewDACL); 
return dwRes;
}

Answer 1

尝试以这种方式设置受托人结构。它对我有用。

ea.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
ea.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
ea.Trustee.ptstrName = L"ALL APPLICATION PACKAGES"; 

Answer 2

我需要分配的确切权限是"读取和执行"、"列出文件夹"内容"one_answers"阅读"所以你需要

ea.grfAccessPermissions = GENERIC_READ | GENERIC_EXECUTE;

而不是

ea.grfAccessPermissions = STANDARD_RIGHTS_READ;

此外，如果组名是本地化的，这可能不会起作用：

ea.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
ea.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
ea.Trustee.ptstrName = L"ALL APPLICATION PACKAGES"; 

这件作品将：

// Allocate enough memory for the largest possible SID.
PSID TheSID = NULL;
DWORD SidSize = SECURITY_MAX_SID_SIZE;
if (!(TheSID = LocalAlloc(LMEM_FIXED, SidSize)))
    goto Cleanup;
// Create a SID for the Everyone group on the local computer.
if (!CreateWellKnownSid(WinBuiltinAnyPackageSid, NULL, TheSID, &SidSize))
    goto Cleanup;
// Initialize an EXPLICIT_ACCESS structure for the new ACE. 
ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));
ea.grfAccessPermissions = GENERIC_READ | GENERIC_EXECUTE;
ea.grfAccessMode = SET_ACCESS;
ea.grfInheritance = SUB_CONTAINERS_AND_OBJECTS_INHERIT;
ea.Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
ea.Trustee.ptstrName = (LPWSTR)TheSID;