很久以前写的一个 ShareRestrictedSD 类

代码中一开始的 几个 USES 单元，可能是多余的。

unit ShareRestrictedSD;

interface

uses

  Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms,

  Shlobj, ActiveX, Dialogs,Shellapi;

///////////////////

//如果这家伙起作用，那么它的作者是jiangsheng（C++）；

//如果这家伙一点用没有，那我不知道它的作者

//以上为 jiangsheng 的声明.

//使用方法.

//var

//  SharedSD:TShareRestrictedSD; //创建一个工具类.

//  try

//    SharedSD:=TShareRestrictedSD.Create;

//    FMappingHandle :=

//       CreateFileMapping(

//         $FFFFFFFF, {to virtual memory}

//         SharedSD.GetSA, //获得一个超级用户安全对象.

//         page_readwrite,

//         ,

//         FSize,

//         pchar(FNameToCreate));

//  finally

//    if (SharedSD <> nil) then

//    begin

//      FreeAndNil(SharedSD); //一定要记得释放

//    end;

//  end;

//修改：Flying Wang 和 爱吃猪头肉

///////////////////

const

  SECURITY_NULL_SID_AUTHORITY    = $;

  SECURITY_WORLD_SID_AUTHORITY   = $;

  SECURITY_LOCAL_SID_AUTHORITY   = $;

  SECURITY_CREATOR_SID_AUTHORITY = $;

  SECURITY_NT_AUTHORITY          = $;

  ACL_REVISION                   = $;

  SECURITY_NULL_RID              = $;

  SECURITY_LOCAL_RID             = $;

  SECURITY_WORLD_RID             = $;

  SECURITY_CREATOR_OWNER_RID     = $;

  SECURITY_DIALUP_RID            = $;

  SECURITY_CREATOR_GROUP_RID     = $;

  SECURITY_NETWORK_RID           = $;

  SECURITY_BATCH_RID             = $;

  SECURITY_INTERACTIVE_RID       = $;

  SECURITY_LOGON_IDS_RID         = $;

  SECURITY_SERVICE_RID           = $;

  SECURITY_LOCAL_SYSTEM_RID      =$;

  SECURITY_BUILTIN_DOMAIN_RID    =$;

  HEAP_NO_SERIALIZE              = $;

  HEAP_GROWABLE                  = $;

  HEAP_GENERATE_EXCEPTIONS       = $;

  HEAP_ZERO_MEMORY               = $;

  HEAP_REALLOC_IN_PLACE_ONLY     =$;

  HEAP_TAG_SHIFT                 =$;

  HEAP_TAIL_CHECKING_ENABLED     =$;

  HEAP_FREE_CHECKING_ENABLED     =$;

  HEAP_DISABLE_COALESCE_ON_FREE  =$;

  HEAP_MAXIMUM_TAG               =$0FFF;

  HEAP_PSEUDO_TAG_FLAG           =$;

  HEAP_CREATE_ALIGN_           =$;

  HEAP_CREATE_ENABLE_TRACING     =$;

type

  PACE_HEADER = ^TACE_HEADER;

  _ACE_HEADER = record

    AceType:Byte;

    AceFlags:Byte;

    AceSize:Word;

  end;

  TACE_HEADER = _ACE_HEADER;

  ACE_HEADER = _ACE_HEADER;

//  ACCESS_MASK = DWORD;

  PACCESS_ALLOWED_ACE = ^TACCESS_ALLOWED_ACE;

  _ACCESS_ALLOWED_ACE = record

    Header:TACE_HEADER;

    Mask:ACCESS_MASK;

    SidStart:DWORD;

  end;

  TACCESS_ALLOWED_ACE = _ACCESS_ALLOWED_ACE;

  ACCESS_ALLOWED_ACE = _ACCESS_ALLOWED_ACE;

  TShareRestrictedSD =class(TObject)

  private

    { Private-Deklarationen }

    ptr:Pointer;

    sa:TSecurityAttributes;

    sd:TSecurityDescriptor;

  protected

    { Protected-Deklarationen }

  public

    { Public-Deklarationen }

    Constructor Create;

    Destructor Destroy; override;

    function GetSA:PSecurityAttributes;

  published

    { Published-Deklarationen }

  end;

implementation

Const

  DefSubAuthorityCount = ;

Function BuildRestrictedSD(pSD: PSecurityDescriptor): Pointer;

var

  dwAclLength: DWORD;

  psideveryone: PSID;

  pDACL: PACL;

  bResult: Boolean;

  pACE: PACCESS_ALLOWED_ACE;

  siaWorld: TSIDIdentifierAuthority;

  si: SECURITY_INFORMATION;

begin

  Result := nil;

  psideveryone := nil;

  pDACL := nil;

  bResult := False;

  pACE := nil;

  FillMemory(@siaWorld,Sizeof(siaWorld),SECURITY_NULL_SID_AUTHORITY);

  siaWorld.Value[]:=SECURITY_WORLD_SID_AUTHORITY;

  si := DACL_SECURITY_INFORMATION;

  try

    // initialize the security descriptor

    if (not InitializeSecurityDescriptor(pSD,

      SECURITY_DESCRIPTOR_REVISION)) then

    begin

      //InitializeSecurityDescriptor() failed;

      exit;

    end;

    // obtain a sid for the Authenticated Users Group

    if (not AllocateAndInitializeSid(siaWorld,

            DefSubAuthorityCount,

            SECURITY_WORLD_RID,

            SECURITY_NULL_RID,

            SECURITY_NULL_RID,

            SECURITY_NULL_RID,

            SECURITY_NULL_RID,

            SECURITY_NULL_RID,

            SECURITY_NULL_RID,

            SECURITY_NULL_RID,

            psidEveryone)) then

    begin

      //AllocateAndInitializeSid() failed;

      exit;

    end;

    // NOTE:

    //

    // The Authenticated Users group includes all user accounts that

    // have been successfully authenticated by the system. If access

    // must be restricted to a specific user or group other than

    // Authenticated Users, the SID can be constructed using the

    // LookupAccountSid() API based on a user or group name.

    // calculate the DACL length

    dwAclLength := sizeof(ACL)

            // add space for Authenticated Users group ACE

            + sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)

            + GetLengthSid(psidEveryone);

    // allocate memory for the DACL

    pDACL := PACL(HeapAlloc(GetProcessHeap, HEAP_ZERO_MEMORY,

            dwAclLength));

    if (pDACL = nil) then

    begin

      //HeapAlloc() failed;

      exit;

    end;

    // initialize the DACL

    if (not InitializeAcl(pDACL^, dwAclLength, ACL_REVISION)) then

    begin

      //InitializeAcl() failed

      exit;

    end;

    // add the Authenticated Users group ACE to the DACL with

    // GENERIC_READ, GENERIC_WRITE, and GENERIC_EXECUTE access

    if (not AddAccessAllowedAce(pDACL^, ACL_REVISION,

            GENERIC_ALL,

            psidEveryone)) then

    begin

      //AddAccessAllowedAce() failed;

      exit;

    end;

    // set the DACL in the security descriptor

    if (not SetSecurityDescriptorDacl(pSD, TRUE, pDACL, FALSE)) then

    begin

      //SetSecurityDescriptorDacl() failed;

      exit;

    end;

    bResult := True;

  finally

    if (psidEveryone <> nil) then

    begin

      FreeSid(psidEveryone);

    end;

    if (not bResult) then

    begin

      if (pDACL <> nil) then

      begin

        HeapFree(GetProcessHeap, , pDACL);

      end;

      pDACL := nil;

    end;

  end;

  Result := pDACL;

end;

//The following function frees memory allocated in the

// BuildRestrictedSD() function

procedure FreeRestrictedSD(ptr: Pointer);

begin

  if (ptr <> nil) then

  begin

    HeapFree(GetProcessHeap, , ptr);

  end;

end;

Constructor TShareRestrictedSD.Create;

begin

  ptr := nil;

  sa.nLength := Sizeof(sa);

  sa.lpSecurityDescriptor := @Sd;

  sa.bInheritHandle := False;

  // build a restricted security descriptor

  if Win32Platform = VER_PLATFORM_WIN32_NT then

  begin

    ptr := BuildRestrictedSD(@sd);

    if (ptr = nil) then

    begin

      Raise Exception.Create('BuildRestrictedSD failed');

    end;

  end;

end;

Destructor TShareRestrictedSD.Destroy;

begin

  if (ptr <> nil) then

  begin

    FreeRestrictedSD(ptr);

  end;

end;

function TShareRestrictedSD.GetSA:PSecurityAttributes;

begin

  if (ptr <> nil) then

  begin

    Result := @Sa;

  end

  else

  begin

    Result := nil;

  end;

end;

end.