truyền đi dưới bất kỳ hình thức nào hoặc bằng bất cứ phương tiện nào mà không cần sự cho phép bằng văn bản của nhà xuất bản. Thư viện Quốc hội mục-trong-Xuất bản dữ liệu đang chờ xử lý. In ấn và ràng buộc tại Hoa Kỳ | 848 CASE STUDY 2 WINDOWS 2000 CHAP. 11 owner SID is not known it can be looked up by name using Loo klip Accounted. It can then be inserted into the security descriptor. The same holds for the group SID if any. Normally these will be the caller s own SID and one of the caller s groups but the system administrator can fin in any SIDs. Win32 API function Description 4 1 n itial ize Secu city Desc ri pto r Prepare a new security descriptor for use Loo ku p AccountSid Look up the SID for a given user name Se tSecu ri ty Descr Í pto rO w n e r Enter the owner SID in the security descriptor SetSecu r tty Desc ri ptorG roup Enter a group SID in the security descriptor InitializeAct Initialize a DACL or SACL Ad dAccessAllowedAce Add a new ACE to a DACL or SACL allowing access Ad d Access Den led Ace Add a new ACE to a DACL or SACL denying access DeleteAce Remove an ACE from a DACL or SACL I SetSecurityDescriptorPacI I Attach a DACL to a security descriptor Figure 11-44. The principal Win32 API functions for security. At this point the security descriptor s DACL or SACL can be initialized with InitiaiizeAcl. ACL entries can be added using Add Access Al Io wed Ace and AddAccess Denied Ace These calls can be repeated multiple times to add as many ACE entries as are needed. DeleteAce can be used to remove an entry more like on an existing ACL than on one being constructed for the first time. When he ACL is ready. Setsecurity Deso riptorDad can be used to attach it to the security descriptor. Finally when the object is created the newly minted security descriptor can be passed as a parameter to have it attached to the object. Implementation of Security Security in a standalone Windows 2000 system is implemented by a number of components most of which we have already seen networking is a whole other story and beyond the scope of this book . Logging in is handled by winlogon and authentication is handled by fcass and as discussed in Sec. . The result of a
