ACCESS跳进程访问共享内存的权力问题

http://www.moon-soft.com/doc/19875.htm

过进程访问共享内存的权柄问题

笔者:未知 来源:月光软件站 加入时间:2005-2-28 月不过软件站

叩问:我以服务器上之所以 CreateFileMapping
创建了平截共享内存。让这个exe始终以服务器上走。
 
同时,别的用户以客户端用IE访问服务器,将要查询的数额通过C#打的网页提交上去,服务器得到网页参数后,建立一个COM对象看达到一个exe的共享内存,然后以于共享内存中之询问结果回到给客户。
 问题是现之COM无法用openmapping访问exe的共享内存,提示 访问拒绝
。而自当服务器上凭建议一个工编译成exe,文件就可看这段共享内存!!为何在网页中尽管无成为?COM难道只要来啊
权限 设置.两个过程中的权杖整合方式是呀?怎么用DACL?

 

自因此ATL写了一个Service,在斯Service中,我创建了平块共享内存(Memory
Mapping)和一个Mutex
然后我以另外一个日常程序中失去访问这块共享内存和Mutex,但是,我因此CreateMutex打开Mutex失败,GetLastError()返回5,含义是访问给拒绝!!
平,我在于是MapViewOfFile时,也获取同的一无是处!!!!!!

本身一度了解原委是因在创立共享内存和Mutext时,SECURITY_ATTRIBUTES我设为NULL!!!

而本人尚未缓解之方

瞩望各位老虾帮拉!

报:检查服务运作所运用的用户的权。通常,为了安全起见,服务过程的拥有者权限是很没有的。为了吃服务过程看对象,你要以开创共享内存时指定一个尤其宽广的的平安描述符,增加一个初的访问控制项目(ACE)给你的ASP进程的拥有者。默认的访问控制列表(ACL)只包含创建者和管理员组。

下列代码创建一个存有用户还得看的安康描述称。你得在创立共享内存时使用这安全描述称。
 CShareRestrictedSD ShareRestrictedSD;
    hMapFile = CreateFileMapping(INVALID_HANDLE_VALUE,    // Current
file handle.
 ShareRestrictedSD.GetSA(),   // Default security.
//    NULL,                             
    PAGE_READWRITE,                    // Read/write permission.
    0,                                 // Max. object size.
    FileSize,                                 // Size of hFile.
    MapName);            // Name of mapping object.

class CShareRestrictedSD
{
public:
 CShareRestrictedSD();
 virtual ~CShareRestrictedSD();
 SECURITY_ATTRIBUTES* GetSA();
protected:
 PVOID  ptr;
 SECURITY_ATTRIBUTES sa;
 SECURITY_DESCRIPTOR sd;
};
//如果这家伙起作用,那么它们的撰稿人是jiangsheng;
//如果这家伙一点之所以无,那我未了解其的作者。
PVOID BuildRestrictedSD(PSECURITY_DESCRIPTOR pSD) {

   DWORD  dwAclLength;

   PSID   psidEveryone = NULL;

   PACL   pDACL   = NULL;
   BOOL   bResult = FALSE;

   PACCESS_ALLOWED_ACE pACE = NULL;

   SID_IDENTIFIER_AUTHORITY siaWorld =
SECURITY_WORLD_SID_AUTHORITY  ;
 
   SECURITY_INFORMATION si = DACL_SECURITY_INFORMATION;
 
   __try {

      // initialize the security descriptor
      if (!InitializeSecurityDescriptor(pSD,
            SECURITY_DESCRIPTOR_REVISION)) {
         printf(“InitializeSecurityDescriptor() failed with error
%d\n”,
               GetLastError());
         __leave;
      }

      // obtain a sid for the Authenticated Users Group
      if (!AllocateAndInitializeSid(&siaWorld, 1,
            SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0,
            &psidEveryone)) {
         printf(“AllocateAndInitializeSid() failed with error %d\n”,
               GetLastError());
         __leave;
      }

      // NOTE:
      //
      // The Authenticated Users group includes all user accounts that
      // have been successfully authenticated by the system. If access
      // must be restricted to a specific user or group other than
      // Authenticated Users, the SID can be constructed using the
      // LookupAccountSid() API based on a user or group name.

      // calculate the DACL length
      dwAclLength = sizeof(ACL)
            // add space for Authenticated Users group ACE
            + sizeof(ACCESS_ALLOWED_ACE) – sizeof(DWORD)
            + GetLengthSid(psidEveryone);

      // allocate memory for the DACL
      pDACL = (PACL) HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY,
            dwAclLength);
      if (!pDACL) {
         printf(“HeapAlloc() failed with error %d\n”,
GetLastError());
         __leave;
      }

      // initialize the DACL
      if (!InitializeAcl(pDACL, dwAclLength, ACL_REVISION)) {
         printf(“InitializeAcl() failed with error %d\n”,
               GetLastError());
         __leave;
      }
     
      // add the Authenticated Users group ACE to the DACL with
      // GENERIC_READ, GENERIC_WRITE, and GENERIC_EXECUTE access
      if (!AddAccessAllowedAce(pDACL, ACL_REVISION,
            GENERIC_ALL,
            psidEveryone)) {
         printf(“AddAccessAllowedAce() failed with error %d\n”,
               GetLastError());
         __leave;
      }

      // set the DACL in the security descriptor
      if (!SetSecurityDescriptorDacl(pSD, TRUE, pDACL, FALSE)) {
         printf(“SetSecurityDescriptorDacl() failed with error %d\n”,
               GetLastError());
         __leave;
      }

      bResult = TRUE;
    
   } __finally {

      if (psidEveryone) FreeSid(psidEveryone);
   }

   if (bResult == FALSE) {
      if (pDACL) HeapFree(GetProcessHeap(), 0, pDACL);
      pDACL = NULL;
   }

   return (PVOID) pDACL;
}

// The following function frees memory allocated in the
// BuildRestrictedSD() function
VOID FreeRestrictedSD(PVOID ptr) {

   if (ptr) HeapFree(GetProcessHeap(), 0, ptr);

   return;
}

CShareRestrictedSD::CShareRestrictedSD()
{
 ptr=NULL;
 sa.nLength = sizeof(sa);
 sa.lpSecurityDescriptor = &sd;
 sa.bInheritHandle = FALSE;
 // build a restricted security descriptor
 ptr = BuildRestrictedSD(&sd);
 if (!ptr) {
  TRACE(“BuildRestrictedSD() failed\n”);
 }
}

CShareRestrictedSD::~CShareRestrictedSD()
{
 if(ptr){
  FreeRestrictedSD(ptr);
 }
}
SECURITY_ATTRIBUTES* CShareRestrictedSD::GetSA()
{
 if(ptr){
  return &sa;
 }
 else
  return NULL;
}

相关文章