Problem
You need to obtain the security rights and/or audit information for a file or registry key.
Solution
When obtaining security/audit information for a file, use the static GetAccessControl method of the File class to obtain a System.Security.AccessControl.FileSecurity object. Use the FileSecurity object to access the security and audit information for the file. These steps are demonstrated in Example 17-15.
Example 17-15. Obtaining security audit information
public static void ViewFileRights() |
These methods produce the following output:
GetSecurityDescriptorSddlForm: O:BAG:SYD:PAI(A;;FA;;;SY)(A;;FA;;;BA)
IdentityReference.Value: NT AUTHORITY\SYSTEM
AccessControlType: Allow
FileSystemRights: FullControl
InheritanceFlags: None
IsInherited: False
PropagationFlags: None
-----------------
IdentityReference.Value: BUILTIN\Administrators
AccessControlType: Allow
FileSystemRights: FullControl
InheritanceFlags: None
IsInherited: False
PropagationFlags: None
-----------------
GetGroup(typeof(NTAccount)).Value: NT AUTHORITY\SYSTEM
GetOwner(typeof(NTAccount)).Value: BUILTIN\Administrators
When obtaining security/audit information for a registry key, use the GetAccess-Control instance method of theMicrosoft.Win32.RegistryKey class to obtain a System. Security.AccessControl.RegistrySecurityobject. Use the RegistrySecurity object to access the security and audit information for the registry key. These steps are demonstrated in Example 17-16.
Example 17-16. Getting security or audit information for a registry key
public static void ViewRegKeyRights() |
These methods produce the following output:
GetSecurityDescriptorSddlForm: O:S-1-5-21-329068152-1383384898-682003330-1004G:S-1-
5-21-329068152-1383384898-682003330-513D:
AI(A;ID;KR;;;BU)(A;CIIOID;GR;;;BU)(A;ID;KA;;;BA)(A;CIIOID;GA;;;BA)(A;ID;KA;;;SY)(A;CI
IOID;GA;;;SY)(A;ID;KA;;;S-1-5-21-329068152-1383384898-682003330-
1004)(A;CIIOID;GA;;;CO)
IdentityReference.Value: BUILTIN\Users
AccessControlType: Allow
RegistryRights: ReadKey
InheritanceFlags: None
IsInherited: True
PropagationFlags: None
-----------------
IdentityReference.Value: BUILTIN\Users
AccessControlType: Allow
RegistryRights: -2147483648
InheritanceFlags: ContainerInherit
IsInherited: True
PropagationFlags: InheritOnly
-----------------
IdentityReference.Value: BUILTIN\Administrators
AccessControlType: Allow
RegistryRights: FullControl
InheritanceFlags: None
IsInherited: True
PropagationFlags: None
-----------------
IdentityReference.Value: BUILTIN\Administrators
AccessControlType: Allow
RegistryRights: 268435456
InheritanceFlags: ContainerInherit
IsInherited: True
PropagationFlags: InheritOnly
-----------------
IdentityReference.Value: NT AUTHORITY\SYSTEM
AccessControlType: Allow
RegistryRights: FullControl
InheritanceFlags: None
IsInherited: True
PropagationFlags: None
-----------------
IdentityReference.Value: NT AUTHORITY\SYSTEM
AccessControlType: Allow
RegistryRights: 268435456
InheritanceFlags: ContainerInherit
IsInherited: True
PropagationFlags: InheritOnly
-----------------
IdentityReference.Value: OPERATOR-C1EFE0\Admin
AccessControlType: Allow
RegistryRights: FullControl
InheritanceFlags: None
IsInherited: True
PropagationFlags: None
-----------------
IdentityReference.Value: CREATOR OWNER
AccessControlType: Allow
RegistryRights: 268435456
InheritanceFlags: ContainerInherit
IsInherited: True
PropagationFlags: InheritOnly
-----------------
GetGroup(typeof(NTAccount)).Value: OPERATOR-C1EFE0\None
GetOwner(typeof(NTAccount)).Value: OPERATOR-C1EFE0\Admin
---------------------------------------
Discussion
The essential method that is used to obtain the security information for a file or registry key is theGetAccessControl method. When this method is called on the RegistryKey object, a RegistrySecurity object is returned. However, when this method is called on a File class, a FileSecurity object is returned. TheRegistrySecurity and FileSecurity objects essentially represent a Discretionary Access Control List (DACL), which is what developers writing code in unmanaged languages such as C++ are used to working with.
The RegistrySecurity and FileSecurity objects each contains a list of security rules that has been applied to the system object that it represents. The RegistrySecurity object contains a list of RegistryAccessRuleobjects, and the FileSecurity object contains a list of FileSystemAccessRule objects. These rule objects are the equivalent of the Access Control Entries (ACE) that make up the list of security rules within a DACL.
System objects other than just the File class and RegistryKey object allow security privileges to be queried.Table 17-1 lists all the .NET Framework classes that return a security object type and what that type is. In addition, the rule-object type that is contained in the security object is also listed.
Class | Object returned by the GetAccessControl method | Rule-object type contained within the security object |
---|---|---|
Directory | DirectorySecurity | FileSystemAccessRule |
DirectoryInfo | DirectorySecurity | FileSystemAccessRule |
EventWaitHandle | EventWaitHandleSecurity | EventWaitHandleAccessRule |
File | FileSecurity | FileSystemAccessRule |
FileInfo | FileSecurity | FileSystemAccessRule |
FileStream | FileSecurity | FileSystemAccessRule |
Mutex | MutexSecurity | MutexAccessRule |
RegistryKey | RegistrySecurity | RegistryAccessRule |
Semaphore | SemaphoreSecurity | SemaphoreAccessRule |
The abstraction of a system object's DACL through the *Security objects and the abstraction of a DACL's ACE through the *AccessRule objects allows easy access to the security privileges of that system object. In previous versions of the .NET Framework, these DACLs and their ACEs would have been accessible only in unmanaged code. With the latest .NET Framework, you now have access to view and program these objects.
See Also
See Recipe 17.14; see the "System.IO.File.GetAccessControl Method," "System. Security.AccessControl.FileSecurity Class," "Microsoft.Win32.RegistryKey.GetAccessControl Method," and "System.Security.AccessControl.RegistrySecurity Class" topics in the MSDN documentation.
Không có nhận xét nào:
Đăng nhận xét