代码之家 › 专栏 › 技术社区 › Ruben Bartelink

.NET RegistrySecurity API对非规范ACL的处理:处理方法

registrykey acl winapi .net

2

Ruben Bartelink · 技术社区 · 15 年前

我正在尝试添加一个访问规则到 RegistryKey 像这样:

using ( RegistryKey registry = OpenOrCreateMyKey() )
{
    RegistrySecurity security = registry.GetAccessControl();
    security.AddAccessRule( new RegistryAccessRule(
        new SecurityIdentifier( WellKnownSidType.BuiltinUsersSid, null ),
        RegistryRights.WriteKey,
        InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit,
        PropagationFlags.None,
        AccessControlType.Allow ) );
    registry.SetAccessControl( security );
}

但是,如果注册表损坏, AddAccessRule GetAccessControl 调用确定它们在前面不是规范的,并且当您尝试在 RegistrySecurity

System.InvalidOperationException: This access control list is not in canonical form and therefore cannot be modified.

the permissions on <key> are incorrectly ordered, which may cause some entries to be ineffective <paraphrasing>Do you want to unmangle them now? Y/N</paraprasing>

我在这个问题上看到的最具权威性的文章是 http://www.codeproject.com/KB/system/accessctrl3.aspx ,上面写着:

但是,控制标志是作为属性实现的(谈论不一致性!)。可以从中检索自动继承设置 AreAccessRulesProtected AreAuditRulesProtected (回想一下,如果ACL受到保护,它不会自动继承)。如果您阅读了第2部分,您将知道一些Windows api不支持继承,因此可能会损坏您机器的继承设置。好消息是.NET完全支持继承机制,并将正确地保留继承设置。如果您打开了一个安全描述符,但它以某种方式获得了一个无序的ACL(可能来自某个恶意Win32应用程序),那么如果您试图编辑它,将抛出InvalidOperationException。

一般来说 non canonical ACLs results from use of the [since retired] NewSID tool people write KB articles to say "well stop doing that then"

但是,关键的是,这并不总是原因,有时代码只是需要工作。什么是处理这个的好方法?

我将提供两个答案,人们可以投票,挑刺,投票,评论和吹毛求疵。

2 回复 | 直到 15 年前

1

2

Ruben Bartelink 15 年前

方法1是忽略继承的权限,盲目地编写您想要的内容无论如何:-

using ( RegistryKey registry = OpenOrCreateMyKey() )
{
    RegistrySecurity security = new RegistrySecurity();
    security.AddAccessRule( new RegistryAccessRule( ... ));
    registry.SetAccessControl( security );
}

问题是,我不知道潜在的负面影响是什么。我很高兴所有需要访问的人都能从我的规则中获得它。但是,它与操作系统基础设施的其余部分配合得好吗?

2

1

Community CDub 8 年前

using ( RegistryKey registry = OpenOrCreateMyKey() )
{
    RegistrySecurity security = new RegistrySecurity();
    if ( !security.AreAccessRulesCanonical )
    {
        Log.WriteWarning( "Registry permissions (likely ones inherited from parent) are inconsistent (RegistrySecurity.AreAccessRulesCanonical is false), so using alternate permissioning algorithm, Has NewSID or another tool mangled permissions? regedt32 can be used to analyze the issue." );
         // Ignore parent ACLs and just blindly stuff in this ACL (which will continue to be inherited)
         security = new RegistrySecurity();
     }

    security.AddAccessRule( new RegistryAccessRule( ... ));
    registry.SetAccessControl( security );
}

除了 Approach 1 ,这有不可预测的行为,但至少它在某种程度上与原始方法兼容。