【windows 访问控制】十一、C# 实操对象 System.Security.AccessControl 命名空间

AccessControl 命名空间结构图

解说：

DirectorySecurity=目录ACL
FileSecurity=文件ACL
FileSystemAuditRule=目录和文件中SACL中的ACE
FileSystemAccessRule=目录和文件中DACL中的ACE
GetAccessControl=ACL（AccessControlList）The security descriptors of all the access control sections of the directory.

DirectorySecurity类和FileSecurity类是对基础Microsoft Windows文件安全系统的抽象。----注：本文部分内容改编自《.NET安全揭秘》

FileSystemAccessRule和FileSystemAuditRule 类是对组成DACL和SACL的访问控制项（ACE）的抽象----注：本文部分内容改编自《.NET安全揭秘》

案例1、window平台的ACL、 ACE操作实例

給文件夹添加访问控制项（ACE：）, 要以管理员的方式运行vs2022，这样才能正确的添加sACE,特权。

新建一个ACL

第一方式，新建一个ACL，然后赋值给文件，这种方式会覆盖原来ACL的列表。并且对文件的sACE，dACE经行增删改

using System.Diagnostics;

using System.Security.AccessControl;

using System.Security.Principal;

//把桌面设置未当前目录

 Directory.SetCurrentDirectory(Environment.GetFolderPath(Environment.SpecialFolder.Desktop  ));

//用n

#region 添加ACE

//新建ACE ，ACE 

FileSystemAuditRule SACE = new("TestAccount", FileSystemRights.FullControl, AuditFlags.Success);

FileSystemAuditRule SACE2 = new(WindowsIdentity.GetCurrent().Name, FileSystemRights.Read, AuditFlags.Failure);

FileSystemAuditRule SACE3 = new("TestAccount", FileSystemRights.Modify, AuditFlags.Failure);

FileSystemAccessRule DACE = new("TestAccount" ,FileSystemRights.FullControl,AccessControlType.Deny);

FileSystemAccessRule DACE2 = new(WindowsIdentity.GetCurrent().Name, FileSystemRights.Read|FileSystemRights.Write,InheritanceFlags.None,PropagationFlags.None, AccessControlType.Allow);

FileSystemAccessRule DACE3 = new("TestAccount", FileSystemRights.Read , AccessControlType.Allow);

//关联桌面的已经存在的CSD文件夹

DirectoryInfo dir = new  ("CSD");

//获取文件的ACL

DirectorySecurity ACL=dir.GetAccessControl();

//将sACEs、dACLs加入ACL

ACL.AddAccessRule(DACE);

ACL.AddAccessRule(DACE2);

ACL.AddAccessRule(DACE3);

ACL.AddAuditRule(SACE);

ACL.AddAuditRule(SACE2);

ACL.AddAuditRule(SACE3);

dir.SetAccessControl(ACL);

//获取文件夹SACL权限

DirectorySecurity AClwithAudit = dir.GetAccessControl(AccessControlSections.Audit);

foreach (FileSystemAuditRule item in AClwithAudit.GetAuditRules(true, true, typeof(NTAccount)))

{

    Console.WriteLine(item.AuditFlags);

}

Console.Read();

//获取文件夹DACL权限

DirectorySecurity AClwithAccess = dir.GetAccessControl(AccessControlSections.Access);

foreach (FileSystemAccessRule item in AClwithAccess.GetAccessRules(true, true, typeof(NTAccount)))

{

    Console.WriteLine(item.AccessControlType );

}

#endregion 

//removeDACE("TestAccount","CSD",AccessControlType.Deny);

RemoveAllDACE("TestAccount","CSD");


/// <summary>

/// 删除指定用户的文件夹dACE

/// </summary>

static void RemovedDACE(string username,string fielname, AccessControlType Type)

{

    DirectoryInfo dir = new (fielname);

    DirectorySecurity AClwithAccess = dir.GetAccessControl(AccessControlSections.Access);

    foreach (FileSystemAccessRule dace in AClwithAccess.GetAccessRules(true, true, typeof(NTAccount)))

    {

        Console.WriteLine(dace.IdentityReference.Value);

        if (dace.AccessControlType == Type && dace.IdentityReference.Value == @$"{Environment.UserDomainName}\{username}")

        {

            AClwithAccess.ModifyAccessRule(AccessControlModification.Remove, dace, out bool ivalue);

            if (ivalue == true)

            {

                dir.SetAccessControl(AClwithAccess);

                Console.WriteLine("移除成功");

            }

        }

    }

}

/// <summary>

///  删除指定用户在指定文件夹的所有D-ACE权限

/// </summary>

static void RemoveAllDACE(string username,string filename)

{

    DirectoryInfo dir = new (filename);

    DirectorySecurity AClwithAccess = dir.GetAccessControl();

    AClwithAccess.PurgeAccessRules(new NTAccount(@$"{Environment.UserDomainName}\{username}"));

    dir.SetAccessControl(AClwithAccess);

    Console.WriteLine("移除成功");

}

/// <summary>

/// 删除指定用户的文件夹sACE

/// </summary>

static void RemovedSACE(string username, string fielname, AuditFlags Type)

{

    DirectoryInfo dir = new(fielname);

    DirectorySecurity AClwithAccess = dir.GetAccessControl(AccessControlSections.Access);

    foreach (FileSystemAuditRule sace in AClwithAccess.GetAuditRules(true, true, typeof(NTAccount)))

    {

        Console.WriteLine(sace.IdentityReference.Value);

        if (sace.AuditFlags == Type && sace.IdentityReference.Value == @$"{Environment.UserDomainName}\{username}")

        {

            AClwithAccess.ModifyAuditRule(AccessControlModification.Remove, sace, out bool ivalue);

            if (ivalue == true)

            {

                dir.SetAccessControl(AClwithAccess);

                Console.WriteLine("移除成功");

            }

        }

    }

}

/// <summary>

/// 删除指定用户在指定文件夹的所有S-ACE权限

/// </summary>

static void RemovedALLSACE(string username, string filename)

{

    DirectoryInfo dir = new(filename);

    DirectorySecurity AClwithAudit = dir.GetAccessControl();

    AClwithAudit.PurgeAuditRules(new NTAccount(@$"{Environment.UserDomainName}\{username}"));

    dir.SetAccessControl(AClwithAudit);

    Console.WriteLine("移除成功");

}

下面详细的介绍一下比较重要的几个方法，第一个：

一、 public FileSystemAccessRule( string identity, FileSystemRights fileSystemRights, InheritanceFlags inheritanceFlags, PropagationFlags propagationFlags, AccessControlType type)

定义访问规则，参数如下：

identity 　　
　　Type:     System.String
　　The name of a user account. （账户名）
fileSystemRights
    Type:     System.Security.AccessControl.FileSystemRights
 　　One of the FileSystemRights values that specifies the type of operation associated with the access rule. （与访问规则相关联的操作类型）
inheritanceFlags
     Type:     System.Security.AccessControl.InheritanceFlags
 　　One of the InheritanceFlags values that specifies how access masks are propagated to child objects.
　　（CSDN上解释的是“该值指示如何将访问掩码传播到子对象”，我的理解是 该值规定是将继承规则作用在文件夹上还是文件上）
 propagationFlags
     Type:     System.Security.AccessControl.PropagationFlags
 　　One of the PropagationFlags values that specifies how Access Control Entries (ACEs) are propagated to child objects.
　　（CSDN上解释的是“该值指定如何将访问控制项 (Ace) 传播到子对象”，propagationFlags能起作用的前提是inheritanceFlags不为None）
type
     Type:     System.Security.AccessControl.AccessControlType
 　　One of the AccessControlType values that specifies whether to allow or deny the operation.（允许还是拒绝）

第一个参数是账户名，第二个是操作类型，操作类型对应的有以下：

("AppendData", "附加数据");

("ChangePermissions", "更改权限");

("CreateDirectories", "创建文件夹/附加数据");

("CreateFiles", "创建文件/写入数据");

("Delete", "删除");

("DeleteSubdirectoriesAndFiles", "删除子文件夹及文件");

("ExecuteFile", "执行文件");

("FullControl", "完全控制");

("ListDirectory", "列出文件夹/读取数据");

("Modify", "修改");

("Read", "读取");

("ReadAndExecute", "读取和执行");

("ReadAttributes", "读取属性");

("ReadData", "读取数据");

("ReadExtendedAttributes", "读取扩展属性");

("ReadPermissions", "读取权限");

("Synchronize", "同步");

("TakeOwnership", "更改文件(夹)所有者");

("Traverse", "执行程序");

("Write", "写入");

("WriteAttributes", "写入属性");

("WriteData", "写入数据");

("WriteExtendedAttributes", "写入扩展属性");

第三四个参数比较难懂，并且他两个应该组合起来应用。一个是inheritanceFlags（ContainerInherit,None,ObjectInherit），另一个是propagationFlags（InheritOnly,None,NoPropagateInherit），这两枚举都有三个值，都具有允许其成员值的按位组合的 FlagsAttribute 特性，propagationFlags能起作用的前提是inheritanceFlags不为None。

下面是我总结的常用的枚举组合：

对应到windows界面操作上后，如下图所示：

第五个参数规定该访问规则的类型是允许还是拒绝。

现有的ACL上添加ACE

using System.Security.AccessControl;

using System.Security.Principal;

//把桌面设置未当前目录

 Directory.SetCurrentDirectory(Environment.GetFolderPath(Environment.SpecialFolder.Desktop  ));

//新建ACE ，ACE的拥有者设置成当前 操作系统用

FileSystemAuditRule SACE=new FileSystemAuditRule(WindowsIdentity.GetCurrent().Name,FileSystemRights.FullControl,AuditFlags.Success);

FileSystemAccessRule DACE = new FileSystemAccessRule(WindowsIdentity.GetCurrent().Name,FileSystemRights.FullControl,AccessControlType.Deny);

FileSystemAccessRule DACE2 = new FileSystemAccessRule(WindowsIdentity.GetCurrent().Name, FileSystemRights.Read|FileSystemRights.Write,InheritanceFlags.None,PropagationFlags.None, AccessControlType.Allow);

//新建文件，并且ACL把文件添加到目录上。会和原来的ACL列表合并

DirectoryInfo dir = new DirectoryInfo("CSD");

DirectorySecurity sd=dir.GetAccessControl();

sd.AddAccessRule(DACE);

sd.AddAccessRule(DACE2);

dir.SetAccessControl(sd);

遍历ACL中的ACE

遍历ACL中的ACE

            AuthorizationRuleCollection rules = fileAcl.GetAccessRules(true, true, typeof(NTAccount));

            // AuthorizationRule Rule = rules[0];

            foreach (FileSystemAccessRule rule in rules)

            {

                if(rule.IdentityReference.Value.CompareTo("Users")==0)

               {

                fileAcl.RemoveAccessRule(rule);

               }

            }

文件夹权限继承控制

DirectorySecurity ss = di.GetAccessControl();

ss.SetAccessRuleProtection(true,true);//这个是保护acl，防止继承，true为启用保护，这样就不会继承父类了，第二项是否保留已经继承的。

获取ACE的掩码

using System.Security.AccessControl;

using System.IO;

using System.Security.Principal;

using System.Reflection;

Directory.SetCurrentDirectory(Environment.GetFolderPath(Environment.SpecialFolder.Desktop));

DirectoryInfo di = new("CSD");

DirectorySecurity ss = di.GetAccessControl();

Console.WriteLine(ss.GetGroup(typeof(NTAccount)));

foreach (FileSystemAccessRule ace in ss.GetAccessRules(true,true,typeof(NTAccount)))

{

    Type getMask = typeof(FileSystemAccessRule);

    PropertyInfo propertyInfo = getMask.GetProperty("AccessMask", BindingFlags.Instance|BindingFlags.NonPublic | BindingFlags.GetProperty);

 int Mask  =int.Parse( propertyInfo.GetValue(ace, null).ToString());

 Console.WriteLine($"AccessControltype:{ace.FileSystemRights}  AcessMask:{ Convert.ToString(Mask, 2).PadLeft(32,'0') }");   

}

案例2、通用平台的ACL ACE操作实例

这些方式是操作SD类型的通用方式（与底层的Windows资源的类型无关），.NET提供了如下类型：

1. 表示SD

System.Security.AccessControl.GenericSecurityDescriptor
System.Security.AccessControl.CommonSecurityDescriptor
System.Security.AccessControl.RawSecurityDescriptor

2. 表示ACL、DACL与SACL

System.Security.AccessControl.GenericAcl
System.Security.AccessControl.CommonAcl
System.Security.AccessControl.DescretionaryAcl
System.Security.AccessControl.SystemAcl
System.Security.AccessControl.RawAcl

3. 表示一个ACE

System.Security.AccessControl.GenericAce
System.Security.AccessControl.CustomAce
System.Security.AccessControl.KnownAce
System.Security.AccessControl.CompoundAce
System.Security.AccessControl.QualifiedAce
System.Security.AccessControl.CommonAce
System.Security.AccessControl.ObjectAce

示例：创建一个SD，向其DACL中添加ACE并将其转化为一个代表Windows资源的特殊SD（此处为互斥体）。

using System;

using System.Security.AccessControl;

using System.Security.Principal;

class Program {

static void Main() {

//创建一个新的SD

CommonSecurityDescriptor csd = new CommonSecurityDescriptor(false, false, string.Empty);

DiscretionaryAcl dacl = csd.DiscretionaryAcl;

//向DACL中添加ACE

dacl.AddAccess(

AccessControlType.Allow, // 枚举Allow、Deny.

WindowsIdentity.GetCurrent().Owner,

(int)MutexRights.TakeOwnership | (int)MutexRights.Synchronize,

InheritanceFlags.None, // 禁用ACE继承

PropagationFlags.None); 

string sSDDL = csd.GetSddlForm( AccessControlSections.Owner ); 

MutexSecurity mutexSec = new MutexSecurity();

mutexSec.SetSecurityDescriptorSddlForm( sSDDL );

AuthorizationRuleCollection aces = mutexSec.GetAccessRules(true, true, typeof(NTAccount));

foreach ( AuthorizationRule ace in aces ) {

if (ace is MutexAccessRule) {

MutexAccessRule mutexAce = (MutexAccessRule)ace;

Console.WriteLine( "-->SID : " + mutexAce.IdentityReference.Value );

Console.WriteLine( "访问权限类型：" + mutexAce.AccessControlType.ToString());

if (0xffffffff == (uint) mutexAce.MutexRights)

Console.WriteLine( "拥有所有权限" );

else

Console.WriteLine( "权限: " + mutexAce.MutexRights.ToString());

}

}

}

}