跨进度访问共享内存的权力难点

http://www.moon-soft.com/doc/19875.htm

跨进度访问共享内存的权位难题

小编:未知 来源:月光软件站 参加时间:二零零六-2-28 月光软件站

问:作者在服务器上用 CreateFileMapping
创建了一段共享内存。让那些exe始终在服务器上跑。
 
同时,其他用户在客户端用IE访问服务器,将要查询的数目经过C#创设的网页提交上去,服务器得到网页参数后,建立二个COM对象访问上3个exe的共享内存,然后将在共享内存中的询问结果重回给客户。
 难点是当今那么些COM不可以用openmapping访问exe的共享内存,指示 访问拒绝
。而自我在服务器上随便指出一个工程编译成exe,文件就可访问这段共享内存!!为什么在网页中就不成?COM难道要有何样
权限 设置.三个经过之间的权杖整合格局是怎样?怎么用DACL?

 

自我用ATL写了1个Service,在那一个Service中,作者创造了一块共享内存(Memory
Mapping)和三个Mutex
下一场小编在另1个平凡程序中去访问那块共享内存和Mutex,可是,笔者用CreateMutex打开Mutex失利,GetLastError()再次回到5,含义是造访被驳回!!
同等,小编在用MapViewOfFile时,也赢得平等的谬误!!!!!!

本身曾经通晓原因是因为在成立共享内存和Mutext时,SECU奥迪Q5ITY_ATTRIBUTES我设为NULL!!!

然而自身平昔不消除的点子

期望各位大虾帮协助!

答:检查服务运营所运用的用户的权位。平日,为了安全起见,服务进度的拥有者权限是很低的。为了让服务进度访问对象,你需求在创立共享内存时内定3个越来越广泛的的广安描述符,增添七个新的访问控制项目(ACE)给你的ASP进度的拥有者。默许的访问控制列表(ACL)只含有成立者和管理员组。

下列代码创立多少个富有用户都得以访问的新余描述符。你可以在开立共享内存时使用那一个安全描述符。
 CShareRestrictedSD ShareRestrictedSD;
    hMapFile = CreateFileMapping(INVALID_HANDLE_VALUE,    // Current
file handle.
 ShareRestrictedSD.GetSA(),   // Default security.
//    NULL,                             
    PAGE_READWRITE,                    // Read/write permission.
    0,                                 // Max. object size.
    FileSize,                                 // Size of hFile.
    MapName);            // Name of mapping object.

class CShareRestrictedSD
{
public:
 CShareRestrictedSD();
 virtual ~CShareRestrictedSD();
 SECURITY_ATTRIBUTES* GetSA();
protected:
 PVOID  ptr;
 SECURITY_ATTRIBUTES sa;
 SECURITY_DESCRIPTOR sd;
};
//若是这个人起成效,那么它的笔者是jiangsheng;
//倘若这个人一点用没有,那笔者不知底它的小编。
PVOID BuildRestrictedSD(PSECURITY_DESCRIPTOR pSD) {

   DWORD  dwAclLength;

   PSID   psidEveryone = NULL;

   PACL   pDACL   = NULL;
   BOOL   bResult = FALSE;

   PACCESS_ALLOWED_ACE pACE = NULL;

   SID_IDENTIFIER_AUTHORITY siaWorld =
SECURITY_WORLD_SID_AUTHORITY  ;
 
   SECURITY_INFORMATION si = DACL_SECURITY_INFORMATION;
 
   __try {

      // initialize the security descriptor
      if (!InitializeSecurityDescriptor(pSD,
            SECURITY_DESCRIPTOR_REVISION)) {
         printf(“InitializeSecurityDescriptor() failed with error
%d\n”,
               GetLastError());
         __leave;
      }

      // obtain a sid for the Authenticated Users Group
      if (!AllocateAndInitializeSid(&siaWorld, 1,
            SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0,
            &psidEveryone)) {
         printf(“AllocateAndInitializeSid() failed with error %d\n”,
               GetLastError());
         __leave;
      }

      // NOTE:
      //
      // The Authenticated Users group includes all user accounts that
      // have been successfully authenticated by the system. If access
      // must be restricted to a specific user or group other than
      // Authenticated Users, the SID can be constructed using the
      // LookupAccountSid() API based on a user or group name.

      // calculate the DACL length
      dwAclLength = sizeof(ACL)
            // add space for Authenticated Users group ACE
            + sizeof(ACCESS_ALLOWED_ACE) – sizeof(DWORD)
            + GetLengthSid(psidEveryone);

      // allocate memory for the DACL
      pDACL = (PACL) HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY,
            dwAclLength);
      if (!pDACL) {
         printf(“HeapAlloc() failed with error %d\n”,
GetLastError());
         __leave;
      }

      // initialize the DACL
      if (!InitializeAcl(pDACL, dwAclLength, ACL_REVISION)) {
         printf(“InitializeAcl() failed with error %d\n”,
               GetLastError());
         __leave;
      }
     
      // add the Authenticated Users group ACE to the DACL with
      // GENERIC_READ, GENERIC_WRITE, and GENERIC_EXECUTE access
      if (!AddAccessAllowedAce(pDACL, ACL_REVISION,
            GENERIC_ALL,
            psidEveryone)) {
         printf(“AddAccessAllowedAce() failed with error %d\n”,
               GetLastError());
         __leave;
      }

      // set the DACL in the security descriptor
      if (!SetSecurityDescriptorDacl(pSD, TRUE, pDACL, FALSE)) {
         printf(“SetSecurityDescriptorDacl() failed with error %d\n”,
               GetLastError());
         __leave;
      }

      bResult = TRUE;
    
   } __finally {

      if (psidEveryone) FreeSid(psidEveryone);
   }

   if (bResult == FALSE) {
      if (pDACL) HeapFree(GetProcessHeap(), 0, pDACL);
      pDACL = NULL;
   }

   return (PVOID) pDACL;
}

// The following function frees memory allocated in the
// BuildRestrictedSD() function
VOID FreeRestrictedSD(PVOID ptr) {

   if (ptr) HeapFree(GetProcessHeap(), 0, ptr);

   return;
}

CShareRestrictedSD::CShareRestrictedSD()
{
 ptr=NULL;
 sa.nLength = sizeof(sa);
 sa.lpSecurityDescriptor = &sd;
 sa.bInheritHandle = FALSE;
 // build a restricted security descriptor
 ptr = BuildRestrictedSD(&sd);
 if (!ptr) {
  TRACE(“BuildRestrictedSD() failed\n”);
 }
}

CShareRestrictedSD::~CShareRestrictedSD()
{
 if(ptr){
  FreeRestrictedSD(ptr);
 }
}
SECURITY_ATTRIBUTES* CShareRestrictedSD::GetSA()
{
 if(ptr){
  return &sa;
 }
 else
  return NULL;
}

相关文章