有没有办法在C#中修改进程DACL

我有遗留的C代码更改进程DACL并尝试使用.NET 3.5中的托管代码类.我在网上找到了有人创建了一个SetAclOnServices类的代码,该类扩展了服务的NativeObjectSecurity类.我认为我可以实现这一点,只需将ResourceType.Service更改为ResourceType.KernelObject,但是当我调用GetAccessControl时,它会失败并显示File Not Found错误.

解决方法

圣诞节快乐.

public class ProcessSecurity : NativeObjectSecurity
{
    public ProcessSecurity(SafeHandle processHandle)
        : base(false,ResourceType.KernelObject,processHandle,AccessControlSections.Access)
    {

    }

    public void AddAccessRule(ProcessAccessRule rule)
    {
        base.AddAccessRule(rule);
    }

    // this is not a full impl- it only supports writing DACL changes
    public void SaveChanges(SafeHandle processHandle)
    {
        Persist(processHandle,AccessControlSections.Access);
    }

    public override Type AccessRightType
    {
        get { return typeof(ProcessAccessRights); }
    }

    public override AccessRule AccessRuleFactory(System.Security.Principal.IdentityReference identityReference,int accessMask,bool isInherited,InheritanceFlags inheritanceFlags,PropagationFlags propagationFlags,AccessControlType type)
    {
        return new ProcessAccessRule(identityReference,(ProcessAccessRights)accessMask,isInherited,inheritanceFlags,propagationFlags,type);
    }

    public override Type AccessRuleType
    {
        get { return typeof(ProcessAccessRule); }
    }

    public override AuditRule AuditRuleFactory(System.Security.Principal.IdentityReference identityReference,AuditFlags flags)
    {
        throw new NotImplementedException();
    }

    public override Type AuditRuleType
    {
        get { throw new NotImplementedException(); }
    }
}

public class ProcessAccessRule : AccessRule
{
    public ProcessAccessRule(IdentityReference identityReference,ProcessAccessRights accessMask,AccessControlType type)
        : base(identityReference,(int)accessMask,type)
    {
    }

    public ProcessAccessRights ProcessAccessRights { get { return (ProcessAccessRights)AccessMask; } }
}

[Flags]
public enum ProcessAccessRights
{
    STANDARD_RIGHTS_required = (0x000F0000),DELETE = (0x00010000),// required to delete the object. 
    READ_CONTROL = (0x00020000),// required to read information in the security descriptor for the object,not including the information in the SACL. To read or write the SACL,you must request the ACCESS_SYstem_Security access right. For more information,see SACL Access Right. 
    WRITE_DAC = (0x00040000),// required to modify the DACL in the security descriptor for the object. 
    WRITE_OWNER = (0x00080000),// required to change the owner in the security descriptor for the object. 

    PROCESS_ALL_ACCESS = STANDARD_RIGHTS_required | SYNCHRONIZE | 0xFFF,//All possible access rights for a process object.
    PROCESS_CREATE_PROCESS = (0x0080),// required to create a process. 
    PROCESS_CREATE_THREAD = (0x0002),// required to create a thread. 
    PROCESS_DUP_HANDLE = (0x0040),// required to duplicate a handle using DuplicateHandle. 
    PROCESS_QUERY_informatION = (0x0400),// required to retrieve certain information about a process,such as its token,exit code,and priority class (see OpenProcesstoken,GetExitCodeProcess,GetPriorityClass,and IsProcessInJob). 
    PROCESS_QUERY_LIMITED_informatION = (0x1000),PROCESS_SET_informatION = (0x0200),// required to set certain information about a process,such as its priority class (see SetPriorityClass). 
    PROCESS_SET_QUOTA = (0x0100),// required to set memory limits using SetProcessWorkingSetSize. 
    PROCESS_SUSPEND_RESUME = (0x0800),// required to suspend or resume a process. 
    PROCESS_TERMINATE = (0x0001),// required to terminate a process using TerminateProcess. 
    PROCESS_VM_OPERATION = (0x0008),// required to perform an operation on the address space of a process (see VirtualProtectEx and WriteProcessMemory). 
    PROCESS_VM_READ = (0x0010),// required to read memory in a process using ReadProcessMemory. 
    PROCESS_VM_WRITE = (0x0020),// required to write to memory in a process using WriteProcessMemory. 
    SYNCHRONIZE = (0x00100000),// required to wait for the process to terminate using the wait functions. 
}