編輯 1
這里我使用的檔案句柄是來自 system32 目錄的 DLL 檔案。
我也嘗試過以下操作：
- 使用
LABEL_SECURITY_INFORMATION代替SACL_SECURITY_INFORMATION - 我嘗試使用
hr = SetSecurityInfo(hFile, SE_KERNEL_OBJECT, LABEL_SECURITY_INFORMATION, NULL, NULL, NULL, pNewSACL);設定 SACl 而不是SetSecurityDescriptorSacl和SetKernelObjectSecurity
原來的
我正在嘗試將審核 ACE 添加到內核安全物件并洗掉所有現有的 ACE。因此，我能夠通過參考互聯網上的檔案和其他帖子得出以下代碼。最后，我可以毫無錯誤地運行 SetKernelObjectSecurity，但是當我再次嘗試驗證是否添加了 ACE 時，我看到 ACE 計數為 0。截至目前，我被困在了這一點上。如果有人可以幫助我如何正確更改內核物件 SACl 中的 ACE，那就太好了。
謝謝你。
以下是代碼的簡要概述：
- 可以看到有5個Section
- 第 1 部分：創建句柄
- 第 2 部分：獲取內核物件安全性和 pOldSacl
- 第 3 部分：從 oldSACL 創建 newSACL
- 第 4 節：將 newSACL 添加到內核物件安全性
- 第 5 部分：驗證 SACL 是否已更新
- 除此之外，還有 5 個
// NOTE標簽顯示了各個點的 ace 計數值
代碼如下：
void setAceAudit()
{
DWORD dwRes = 0;
PACL pOldSACL = NULL, pNewSACL = NULL;
PSECURITY_DESCRIPTOR pSS = NULL;
EXPLICIT_ACCESS ea;
HANDLE hFile = NULL;
// SECTION 1: Create handle
hFile = CreateFile2(filePath,
FILE_GENERIC_EXECUTE | FILE_GENERIC_READ | FILE_GENERIC_WRITE | READ_CONTROL | WRITE_OWNER | ACCESS_SYSTEM_SECURITY,
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
OPEN_EXISTING,
nullptr);
if (hFile == INVALID_HANDLE_VALUE && GetLastError() == ERROR_ACCESS_DENIED)
{
// A directory will fail without FILE_FLAG_BACKUP_SEMANTICS.
CREATEFILE2_EXTENDED_PARAMETERS extendedParams = {
sizeof(CREATEFILE2_EXTENDED_PARAMETERS),
FILE_ATTRIBUTE_NORMAL,
FILE_FLAG_BACKUP_SEMANTICS,
0,
nullptr,
nullptr
};
hFile = CreateFile2(filePath,
FILE_GENERIC_EXECUTE | FILE_GENERIC_READ | FILE_GENERIC_WRITE | READ_CONTROL | WRITE_OWNER | ACCESS_SYSTEM_SECURITY,
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
OPEN_EXISTING,
&extendedParams);
}
// SECTION 1: End
// SECTION 2: Get Kernel object security and pOldSacl
DWORD dwSize = 0;
HRESULT hr = S_OK;
if (!GetKernelObjectSecurity(hFile, LABEL_SECURITY_INFORMATION, pSS, dwSize, &dwSize))
{
DWORD dwError = GetLastError();
if (ERROR_INSUFFICIENT_BUFFER != dwError)
{
hr = HRESULT_FROM_WIN32(dwError);
}
else if (NULL == (pSS = (PSECURITY_DESCRIPTOR)LocalAlloc(LPTR, dwSize)))
{
hr = E_OUTOFMEMORY;
}
else if (!GetKernelObjectSecurity(hFile, LABEL_SECURITY_INFORMATION, pSS, dwSize, &dwSize))
{
hr = HRESULT_FROM_WIN32(GetLastError());
}
}
else
{
hr = E_UNEXPECTED;
}
VERIFY_ARE_EQUAL(hr, S_OK);
BOOL bSaclPresent = FALSE;
BOOL bSaclDefaulted = FALSE;
if (!GetSecurityDescriptorSacl(pSS, &bSaclPresent, &pOldSACL, &bSaclDefaulted))
{
hr = HRESULT_FROM_WIN32(GetLastError());
}
// SECTION 2: End
// SECTION 3: Create newSACL from oldSACL
ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));
ea.grfAccessPermissions = 0X11000000;
ea.grfAccessMode = SET_AUDIT_SUCCESS;
ea.grfInheritance = NO_PROPAGATE_INHERIT_ACE;
ea.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
ea.Trustee.ptstrName = L"Administrator";
dwRes = SetEntriesInAcl(1, &ea, pOldSACL, &pNewSACL);
if (ERROR_SUCCESS != dwRes) {
LOG_OUTPUT(L"SetEntriesInAcl Error %lu %ld\n", dwRes, GetLastError());
return dwRes;
}
for (int ii = pNewSACL->AceCount - 1; ii >= 0; ii--)
{
PSYSTEM_MANDATORY_LABEL_ACE pAce = NULL; // Only access pAce->Header until checking AceType
if (!GetAce(pNewSACL, ii, (LPVOID*)&pAce))
{
VERIFY_ARE_EQUAL((DWORD)0, GetLastError());
}
DeleteAce(pNewSACL, ii);
}
PSID pIntegritySid = NULL;
BOOL fRet;
if (true)
{
fRet = ConvertStringSidToSidW(SDDL_ML_HIGH, &pIntegritySid);
}
else
{
fRet = ConvertStringSidToSidW(SDDL_ML_MEDIUM, &pIntegritySid);
}
VERIFY_IS_TRUE(fRet);
fRet = AddAuditAccessAce(pNewSACL, ACL_REVISION_DS, OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE, pIntegritySid, FALSE, FALSE);
VERIFY_IS_TRUE(fRet);
DWORD absSize = 0;
DWORD daclSize = 0;
DWORD saclSize = 0;
DWORD ownerSize = 0;
DWORD primGroupSize = 0;
fRet = MakeAbsoluteSD(pSS, NULL, &absSize, NULL, &daclSize, NULL, &saclSize, NULL, &ownerSize, NULL, &primGroupSize);
PSECURITY_DESCRIPTOR pSD = LocalAlloc(0, absSize);
fRet = MakeAbsoluteSD(pSS,
pSD, &absSize,
/*pSD->Dacl =*/ (PACL)LocalAlloc(0, daclSize), &daclSize,
/*pSD->Sacl =*/ (PACL)LocalAlloc(0, saclSize), &saclSize,
/*pSD->Owner =*/ (PSID)LocalAlloc(0, ownerSize), &ownerSize,
/*pSD->Group =*/ (PSID)LocalAlloc(0, primGroupSize), &primGroupSize);
// NOTE 1: Verified that ACE count is 1 in pNewSACL before inserting it
// SECTION 3: End
// SECTION 4: Add newSACL to kernel object security
if (!SetSecurityDescriptorSacl(pSD, TRUE, pNewSACL, FALSE))
{
DWORD dwError = GetLastError();
hr = HRESULT_FROM_WIN32(dwError);
}
// NOTE 2: Verified that new SACL in pSD has ACE count as 1 by using GetSecurityDescriptorSacl
if (!SetKernelObjectSecurity(hFile, SACL_SECURITY_INFORMATION, pSD))
{
// NOTE 3: Call flow doesn't go here so SetKernelObjectSecurity is success.
DWORD dwError = GetLastError();
hr = HRESULT_FROM_WIN32(dwError);
}
// SECTION 4: End
// SECTION 5: Validate if SACL is updated
// NOTE 4: Following code is to validate that ACE count is changed by using GetKernelObjectSecurity and GetSecurityDescriptorSacl but as in (NOTE 5) it is found to be 0
dwSize = 0;
PSECURITY_DESCRIPTOR pSD1 = NULL;
if (!GetKernelObjectSecurity(hFile, LABEL_SECURITY_INFORMATION, pSD1, dwSize, &dwSize))
{
DWORD dwError = GetLastError();
if (ERROR_INSUFFICIENT_BUFFER != dwError)
{
hr = HRESULT_FROM_WIN32(dwError);
}
else if (NULL == (pSD1 = (PSECURITY_DESCRIPTOR)LocalAlloc(LPTR, dwSize)))
{
hr = E_OUTOFMEMORY;
}
else if (!GetKernelObjectSecurity(hFile, LABEL_SECURITY_INFORMATION, pSD1, dwSize, &dwSize))
{
hr = HRESULT_FROM_WIN32(GetLastError());
}
}
else
{
// Should never get here, as dwSize was initialized to 0,
// so the call to GetKernelObjectSecurity should fail.
// Adding this to avoid Prefast/Prefix complaining that
// potential use of NULL pSD below.
hr = E_UNEXPECTED;
}
VERIFY_ARE_EQUAL(hr, S_OK);
PACL pSacl = NULL;
bSaclPresent = FALSE;
bSaclDefaulted = FALSE;
if (!GetSecurityDescriptorSacl(pSD1, &bSaclPresent, &pSacl, &bSaclDefaulted))
{
hr = HRESULT_FROM_WIN32(GetLastError());
}
VERIFY_ARE_EQUAL(hr, S_OK);
VERIFY_ARE_NOT_EQUAL(pSacl, (PACL)NULL);
VERIFY_ARE_EQUAL(bSaclPresent, (BOOL)true);
VERIFY_ARE_NOT_EQUAL(pSacl->AceCount, (WORD)0); // NOTE 5: ACE Count is 0
// SECTION 5: End
CloseHandle(hFile);
}
uj5u.com熱心網友回復：
替換LABEL_SECURITY_INFORMATION為SACL_SECURITY_INFORMATION。
轉載請註明出處，本文鏈接：https://www.uj5u.com/qukuanlian/386185.html