DACL原理.控制文件的访问权限(文件,注册表.目录.等任何带有安全属性的对象.)

HANDLE CreateFileA(
  LPCSTR                lpFileName,
  DWORD                 dwDesiredAccess,
  DWORD                 dwShareMode,
  LPSECURITY_ATTRIBUTES lpSecurityAttributes,  安全属性
  DWORD                 dwCreationDisposition,
  DWORD                 dwFlagsAndAttributes,
  HANDLE                hTemplateFile
);

ConvertSecurityDescriptorToStringSecurityDescriptor
ConvertStringSecurityDescriptorToSecurityDescriptor

"O:AOG:DAD:(A;;RPWPCCDCLCSWRCWDWOGA;;;S-1-0-0)"

DAD:(A;;RPWPCCDCLCSWRCWDWOGA;;;S-1-0-0)

ace_type;ace_flags;rights;object_guid;inherit_object_guid;account_sid;(resource_attribute)

#include <windows.h>
#include <AclAPI.h>
#define _WIN32_WINNT 0x0500
#pragma comment(lib,"Advapi32.lib")



BOOL CreateMyDACL(SECURITY_ATTRIBUTES *);

void main()
{
    SECURITY_ATTRIBUTES  sa;

    sa.nLength = sizeof(SECURITY_ATTRIBUTES);
    sa.bInheritHandle = FALSE;

    // Call function to set the DACL. The DACL
    // is set in the SECURITY_ATTRIBUTES 
    // lpSecurityDescriptor member.
    if (!CreateMyDACL(&sa))
    {
        // Error encountered; generate message and exit.
        printf("Failed CreateMyDACL\n");
        exit(1);
    }

    // Use the updated SECURITY_ATTRIBUTES to specify
    // security attributes for securable objects.
    // This example uses security attributes during
    // creation of a new directory.
   
    HANDLE hFile = CreateFile(TEXT("D:\\1234.txt"), GENERIC_READ | GENERIC_WRITE, FILE_SHARE_WRITE | FILE_SHARE_READ, &sa, CREATE_NEW, NULL, NULL);
    // Free the memory allocated for the SECURITY_DESCRIPTOR.
    if (NULL != LocalFree(sa.lpSecurityDescriptor))
    {
        // Error encountered; generate message and exit.
        printf("Failed LocalFree\n");
        exit(1);
    }
}


BOOL CreateMyDACL(SECURITY_ATTRIBUTES * pSA)
{
 
    TCHAR * szSD =(TCHAR*) TEXT("D:(D;OICI;GRGW;;;BA)");    
                                     

    if (NULL == pSA)
        return FALSE;

    return ConvertStringSecurityDescriptorToSecurityDescriptor(
        szSD,
        SDDL_REVISION_1,
        &(pSA->lpSecurityDescriptor),
        NULL);
}

ace_type;
ace_flags;
rights;
object_guid;
inherit_object_guid;
account_sid;(resource_attribute)

    解析ACE字符串: 
    (D;OICI;GRGW;;;BG)       
    D 代表拒绝还是允许.     也就是ACE的类型.这里可以控制你的用户的是允许还是拒绝
    OICI: 代表 对象继承  还是容器继承 一般是子继承有关.子对象是否可以集成
    GR:  代表只读权限. 也就是 rights GA是所有权限 GW可写 GX可执行
    BG: 是一个SID字符串. 代表的是 内置客人用户,相应的 BU是内置用户 BA是内置管理员 可以根据上面所说.查询SID 字符串代表的意思

TCHAR * szSD =(TCHAR*) TEXT("D:(A;OICI;GR;;;BA)");