我正在尝试FileIOPermission
在 Windows 7 中的 .NET 3.5 中。我是 Windows XP 用户,并且因为我是管理员而被授予此权限
我写了下面的代码,测试一下是否可以写入C:\Program Files\Outlook……
static void Main(string[] args)
{
Console.WriteLine("Am I an administrator? " + new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator);
// Try and open a file in C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll
string path = @"C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll";
try
{
FileIOPermission ioPerm = new FileIOPermission(FileIOPermissionAccess.Read, path);
ioPerm.Demand();
string backupPath = Path.ChangeExtension(path, ".bak");
FileIOPermission writeAccess = new FileIOPermission(FileIOPermissionAccess.AllAccess, backupPath);
writeAccess.Demand();
Console.WriteLine("Read access is permitted: {0} => {1}",path,SecurityManager.IsGranted(ioPerm));
Console.WriteLine("Write backup file is permitted: {0} => {1}", backupPath, SecurityManager.IsGranted(writeAccess));
File.Copy(path, backupPath);
Console.WriteLine("File copied! {0}",backupPath);
Console.WriteLine("Deleting file.....");
File.Delete(path);
}
catch (UnauthorizedAccessException uae)
{
Console.WriteLine(uae.ToString());
}
Console.ReadLine();
}
所以该程序会导致UnauthorizedAccessException
(这是我所期望的),但我不明白的是Demand()
允许许可,SecurityManager
确认已授予许可,但在执行时File.Copy()
我确实得到了例外。
虽然我很高兴看到 .NET 阻止了我,但为什么我打电话时它没有提前通知我Demand()
?
我得到以下输出:
Am I an administrator? False
Read access is permitted: C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll => True
Write backup file is permitted: C:\Program Files\Microsoft Office\Office14\BCSLaunch.bak => True
System.UnauthorizedAccessException: Access to the path 'C:\Program Files\Microsoft Office\Office14\BCSLaunch.bak' is denied.
at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.File.InternalCopy(String sourceFileName, String destFileName, Boolean overwrite)
at System.IO.File.Copy(String sourceFileName, String destFileName)
at TryAndGetUACPrompt.Program.Main(String[] args) in C:\Users\..............
请有人帮助我理解为什么我收到的信息相互矛盾?
--
更新 - 19:30 GMT
我使用以下代码查看了源文件的 ACL:
Console.WriteLine("ACL Permissions for Source....");
FileSecurity fileSecurityForOriginalPath = new FileSecurity(path, AccessControlSections.Access);
foreach (FileSystemAccessRule rule in fileSecurityForOriginalPath.GetAccessRules(true,true,typeof(NTAccount)))
{
Console.WriteLine("{0} => {1}", rule.FileSystemRights, rule.AccessControlType);
}
输出如下:
ACL Permissions for Source....
FullControl => Allow
FullControl => Allow
ReadAndExecute, Synchronize => Allow
因此,我确实有机会阅读它。但是,我尝试使用此代码来查看备份路径的权限,显然,我收到一个异常,因为我的备份(目标)文件实际上并不存在,因此我无法检查权限在上面。
接下来我将尝试另一个建议,将此检查移至另一种方法中。
更新 - 19:45 GMT
我已将读/写要求重构为另一种方法:
private static FileIOPermission CheckWriteAccess(string backupPath)
{
FileIOPermission writeAccess = new FileIOPermission(FileIOPermissionAccess.AllAccess, backupPath);
writeAccess.Demand();
return writeAccess;
}
private static FileIOPermission CheckReadAccess(string path)
{
FileIOPermission ioPerm = new FileIOPermission(FileIOPermissionAccess.Read, path);
ioPerm.Demand();
return ioPerm;
}
这些都无一例外地返回正常。
因此,如果 .NET 安全性增强了 DACL,我想知道为什么它认为它会成功,如果实际上并非如此。
--
格林尼治标准时间 19:57 更新
好的,我检查了目录的权限,而不是 backupFile (目标文件),并将其作为输出(使用 .GetAccessRules() 中的 AuthorizationRuleCollection 上的 foreach )
Checking write access in this directory....
FullControl => Allow
268435456 => Allow
FullControl => Allow
268435456 => Allow
FullControl => Allow
268435456 => Allow
ReadAndExecute, Synchronize => Allow
-1610612736 => Allow
268435456 => Allow
我用了一个Enum.Format(typeof(FileSystemAccessRights),rule,"G")
为了获得格式,有效地执行 ToString(),但我只是不确定这些数字是否正确。
输出上述内容的代码:
private static DirectorySecurity CheckWriteAccess(string backupPath)
{
DirectorySecurity writeAccess = new DirectorySecurity( Path.GetDirectoryName(backupPath),AccessControlSections.Access);
Console.WriteLine("Checking write access in this directory....");
foreach (FileSystemAccessRule rule in writeAccess.GetAccessRules(true, true, typeof(NTAccount)))
{
Console.WriteLine("{0} => {1}", Enum.Format(typeof(FileSystemRights),rule.FileSystemRights,"G"), rule.AccessControlType);
}
return writeAccess;
}