Tổng quan về các chức năng thay đổi mô tả bảo mật, bạn đảo ngược quá trình. Sử dụng một cuộc gọi như AddACE () để thêm một ACE mới, ACL sử dụng SetSecurityDescriptorSACL () để thay đổi SACL trong mô tả một, và cuối cùng, | An Overview of the Functions To change the security descriptor you reverse the process. Use a call like AddACE to add a new ACE to an ACL use SetSecurityDescriptorSACL to change SACL within a descriptor and finally save the descriptor using a call like SetFileSecurity . The Importance of Order for Security Once you know how Windows evaluates the ACEs in the DACL you ll discover a few problem areas problems that the Windows utilities address automatically. Order is an important consideration when working with Windows security because Windows uses a very basic method for determining how to evaluate the security elements. You ll need to program around these problems to derive the result found in the various Windows utilities. The SACL has the same problem but it only affects auditing so the effect is less severe from the system security standpoint. Windows evaluates the ACEs in an ACL in the order in which they appear. At first this might not seem like a very big deal. However it could become a problem in some situations. For example what if you want to revoke all of a user s rights in one area but their list of ACEs includes membership in a group that allows access to that area If you place the access-allowed ACE before the access-denied ACE in the list the user would get access to the area. The bottom line is that you should place all your access-denied ACEs in the list first to prevent any potential breach in security. Also use care in the ordering of group SIDs. Rights that a user acquires from different groups are cumulative. This means a user who s part of two groups one that has access to a file and another that doesn t will have access to the file if the group granting the right appears first on the list. In addition if one ACE grants read rights and another write rights to a file and the user is asking for read and write rights Windows will grant the request. Obviously you could spend all your time trying to figure out the best arrangement of groups. As the .
