Directory.SetAccessControl(String, DirectorySecurity) Metoda

Definicja

Stosuje wpisy listy kontroli dostępu (ACL) opisane przez obiekt DirectorySecurity do określonego katalogu.Applies access control list (ACL) entries described by a DirectorySecurity object to the specified directory.

public:
 static void SetAccessControl(System::String ^ path, System::Security::AccessControl::DirectorySecurity ^ directorySecurity);
public static void SetAccessControl (string path, System.Security.AccessControl.DirectorySecurity directorySecurity);
static member SetAccessControl : string * System.Security.AccessControl.DirectorySecurity -> unit

Parametry

path
String

Katalog służący do dodawania lub usuwania wpisów listy kontroli dostępu (ACL).A directory to add or remove access control list (ACL) entries from.

directorySecurity
DirectorySecurity

Obiekt DirectorySecurity, który opisuje wpis listy ACL, który ma zostać zastosowany do katalogu opisanego przez path parametru.A DirectorySecurity object that describes an ACL entry to apply to the directory described by the path parameter.

Wyjątki

Parametr directorySecurity ma wartość null.The directorySecurity parameter is null.

Nie można znaleźć katalogu.The directory could not be found.

path jest nieprawidłowy.The path was invalid.

Bieżący proces nie ma dostępu do katalogu określonego przez path.The current process does not have access to the directory specified by path.

lub-or- Bieżący proces nie ma wystarczających uprawnień do ustawienia wpisu listy ACL.The current process does not have sufficient privilege to set the ACL entry.

Bieżący system operacyjny nie jest systemem Windows 2000 lub nowszym.The current operating system is not Windows 2000 or later.

Przykłady

W poniższym przykładzie zastosowano GetAccessControl i metody SetAccessControl, aby dodać wpis listy kontroli dostępu (ACL), a następnie usunąć wpis listy ACL z katalogu.The following example uses the GetAccessControl and the SetAccessControl methods to add an access control list (ACL) entry and then remove an ACL entry from a directory. Aby uruchomić ten przykład, należy podać prawidłowe konto użytkownika lub grupy.You must supply a valid user or group account to run this example.

using namespace System;
using namespace System::IO;
using namespace System::Security::AccessControl;

// Adds an ACL entry on the specified directory for the
// specified account.
void AddDirectorySecurity(String^ directoryName, String^ account, 
     FileSystemRights rights, AccessControlType controlType)
{
    // Create a new DirectoryInfo object.
    DirectoryInfo^ dInfo = gcnew DirectoryInfo(directoryName);

    // Get a DirectorySecurity object that represents the
    // current security settings.
    DirectorySecurity^ dSecurity = dInfo->GetAccessControl();

    // Add the FileSystemAccessRule to the security settings.
    dSecurity->AddAccessRule( gcnew FileSystemAccessRule(account,
        rights, controlType));

    // Set the new access settings.
    dInfo->SetAccessControl(dSecurity);
}

// Removes an ACL entry on the specified directory for the
// specified account.
void RemoveDirectorySecurity(String^ directoryName, String^ account,
     FileSystemRights rights, AccessControlType controlType)
{
    // Create a new DirectoryInfo object.
    DirectoryInfo^ dInfo = gcnew DirectoryInfo(directoryName);

    // Get a DirectorySecurity object that represents the
    // current security settings.
    DirectorySecurity^ dSecurity = dInfo->GetAccessControl();

    // Add the FileSystemAccessRule to the security settings.
    dSecurity->RemoveAccessRule(gcnew FileSystemAccessRule(account,
        rights, controlType));

    // Set the new access settings.
    dInfo->SetAccessControl(dSecurity);
}    

int main()
{
    String^ directoryName = "TestDirectory";
    String^ accountName = "MYDOMAIN\\MyAccount";
    if (!Directory::Exists(directoryName))
    {
        Console::WriteLine("The directory {0} could not be found.", 
            directoryName);
        return 0;
    }
    try
    {
        Console::WriteLine("Adding access control entry for {0}",
            directoryName);

        // Add the access control entry to the directory.
        AddDirectorySecurity(directoryName, accountName,
            FileSystemRights::ReadData, AccessControlType::Allow);

        Console::WriteLine("Removing access control entry from {0}",
            directoryName);

        // Remove the access control entry from the directory.
        RemoveDirectorySecurity(directoryName, accountName, 
            FileSystemRights::ReadData, AccessControlType::Allow);

        Console::WriteLine("Done.");
    }
    catch (UnauthorizedAccessException^)
    {
        Console::WriteLine("You are not authorised to carry" +
            " out this procedure.");
    }
    catch (System::Security::Principal::
        IdentityNotMappedException^)
    {
        Console::WriteLine("The account {0} could not be found.", accountName);
    }
}

using System;
using System.IO;
using System.Security.AccessControl;

namespace FileSystemExample
{
    class DirectoryExample
    {
        public static void Main()
        {
            try
            {
                string DirectoryName = "TestDirectory";

                Console.WriteLine("Adding access control entry for " + DirectoryName);

                // Add the access control entry to the directory.
                AddDirectorySecurity(DirectoryName, @"MYDOMAIN\MyAccount", FileSystemRights.ReadData, AccessControlType.Allow);

                Console.WriteLine("Removing access control entry from " + DirectoryName);

                // Remove the access control entry from the directory.
                RemoveDirectorySecurity(DirectoryName, @"MYDOMAIN\MyAccount", FileSystemRights.ReadData, AccessControlType.Allow);

                Console.WriteLine("Done.");
            }
            catch (Exception e)
            {
                Console.WriteLine(e);
            }

            Console.ReadLine();
        }

        // Adds an ACL entry on the specified directory for the specified account.
        public static void AddDirectorySecurity(string FileName, string Account, FileSystemRights Rights, AccessControlType ControlType)
        {
            // Create a new DirectoryInfo object.
            DirectoryInfo dInfo = new DirectoryInfo(FileName);

            // Get a DirectorySecurity object that represents the 
            // current security settings.
            DirectorySecurity dSecurity = dInfo.GetAccessControl();

            // Add the FileSystemAccessRule to the security settings. 
            dSecurity.AddAccessRule(new FileSystemAccessRule(Account,
                                                            Rights,
                                                            ControlType));

            // Set the new access settings.
            dInfo.SetAccessControl(dSecurity);

        }

        // Removes an ACL entry on the specified directory for the specified account.
        public static void RemoveDirectorySecurity(string FileName, string Account, FileSystemRights Rights, AccessControlType ControlType)
        {
            // Create a new DirectoryInfo object.
            DirectoryInfo dInfo = new DirectoryInfo(FileName);

            // Get a DirectorySecurity object that represents the 
            // current security settings.
            DirectorySecurity dSecurity = dInfo.GetAccessControl();

            // Add the FileSystemAccessRule to the security settings. 
            dSecurity.RemoveAccessRule(new FileSystemAccessRule(Account,
                                                            Rights,
                                                            ControlType));

            // Set the new access settings.
            dInfo.SetAccessControl(dSecurity);

        }
    }
}

Imports System.IO
Imports System.Security.AccessControl



Module DirectoryExample

    Sub Main()
        Try
            Dim DirectoryName As String = "TestDirectory"

            Console.WriteLine("Adding access control entry for " + DirectoryName)

            ' Add the access control entry to the directory.
            AddDirectorySecurity(DirectoryName, "MYDOMAIN\MyAccount", FileSystemRights.ReadData, AccessControlType.Allow)

            Console.WriteLine("Removing access control entry from " + DirectoryName)

            ' Remove the access control entry from the directory.
            RemoveDirectorySecurity(DirectoryName, "MYDOMAIN\MyAccount", FileSystemRights.ReadData, AccessControlType.Allow)

            Console.WriteLine("Done.")
        Catch e As Exception
            Console.WriteLine(e)
        End Try

        Console.ReadLine()

    End Sub


    ' Adds an ACL entry on the specified directory for the specified account.
    Sub AddDirectorySecurity(ByVal FileName As String, ByVal Account As String, ByVal Rights As FileSystemRights, ByVal ControlType As AccessControlType)
        ' Create a new DirectoryInfoobject.
        Dim dInfo As New DirectoryInfo(FileName)

        ' Get a DirectorySecurity object that represents the 
        ' current security settings.
        Dim dSecurity As DirectorySecurity = dInfo.GetAccessControl()

        ' Add the FileSystemAccessRule to the security settings. 
        dSecurity.AddAccessRule(New FileSystemAccessRule(Account, Rights, ControlType))

        ' Set the new access settings.
        dInfo.SetAccessControl(dSecurity)

    End Sub


    ' Removes an ACL entry on the specified directory for the specified account.
    Sub RemoveDirectorySecurity(ByVal FileName As String, ByVal Account As String, ByVal Rights As FileSystemRights, ByVal ControlType As AccessControlType)
        ' Create a new DirectoryInfo object.
        Dim dInfo As New DirectoryInfo(FileName)

        ' Get a DirectorySecurity object that represents the 
        ' current security settings.
        Dim dSecurity As DirectorySecurity = dInfo.GetAccessControl()

        ' Add the FileSystemAccessRule to the security settings. 
        dSecurity.RemoveAccessRule(New FileSystemAccessRule(Account, Rights, ControlType))

        ' Set the new access settings.
        dInfo.SetAccessControl(dSecurity)

    End Sub
End Module

Uwagi

Metoda SetAccessControl stosuje wpisy listy kontroli dostępu (ACL) do pliku, który reprezentuje niedziedziczoną listę ACL.The SetAccessControl method applies access control list (ACL) entries to a file that represents the noninherited ACL list.

Przestroga

Lista ACL określona dla parametru directorySecurity zastępuje istniejącą listę ACL dla katalogu.The ACL specified for the directorySecurity parameter replaces the existing ACL for the directory. Aby dodać uprawnienia dla nowego użytkownika, użyj metody GetAccessControl, aby uzyskać istniejącą listę ACL i zmodyfikować ją.To add permissions for a new user, use the GetAccessControl method to obtain the existing ACL and modify it.

Lista ACL opisuje osoby i/lub grupy, które mają lub nie mają uprawnień do określonych akcji dotyczących danego pliku lub katalogu.An ACL describes individuals and/or groups who have, or do not have, rights to specific actions on the given file or directory. Aby uzyskać więcej informacji, zobacz jak: Dodawanie lub usuwanie wpisów listy Access Control.For more information, see How to: Add or Remove Access Control List Entries.

Metoda SetAccessControl utrzymuje tylko DirectorySecurity obiektów, które zostały zmodyfikowane po utworzeniu obiektu.The SetAccessControl method persists only DirectorySecurity objects that have been modified after object creation. Jeśli obiekt DirectorySecurity nie został zmodyfikowany, nie zostanie utrwalony w pliku.If a DirectorySecurity object has not been modified, it will not be persisted to a file. W związku z tym nie można pobrać obiektu DirectorySecurity z jednego pliku i ponownie zastosować tego samego obiektu do innego pliku.Therefore, it is not possible to retrieve a DirectorySecurity object from one file and reapply the same object to another file.

Aby skopiować informacje listy ACL z jednego pliku do innego:To copy ACL information from one file to another:

  1. Użyj metody GetAccessControl, aby pobrać obiekt DirectorySecurity z pliku źródłowego.Use the GetAccessControl method to retrieve the DirectorySecurity object from the source file.

  2. Utwórz nowy obiekt DirectorySecurity dla pliku docelowego.Create a new DirectorySecurity object for the destination file.

  3. Użyj metody GetSecurityDescriptorBinaryForm lub GetSecurityDescriptorSddlForm źródłowego obiektu DirectorySecurity, aby pobrać informacje listy ACL.Use the GetSecurityDescriptorBinaryForm or GetSecurityDescriptorSddlForm method of the source DirectorySecurity object to retrieve the ACL information.

  4. Użyj metody SetSecurityDescriptorBinaryForm lub SetSecurityDescriptorSddlForm, aby skopiować informacje pobrane w kroku 3 do obiektu docelowego DirectorySecurity.Use the SetSecurityDescriptorBinaryForm or SetSecurityDescriptorSddlForm method to copy the information retrieved in step 3 to the destination DirectorySecurity object.

  5. Ustaw obiekt docelowy DirectorySecurity w pliku docelowym przy użyciu metody SetAccessControl.Set the destination DirectorySecurity object to the destination file using the SetAccessControl method.

W środowiskach NTFS ReadAttributes i ReadExtendedAttributes są udzielane użytkownikowi, jeśli użytkownik ma ListDirectory uprawnienia do folderu nadrzędnego.In NTFS environments, ReadAttributes and ReadExtendedAttributes are granted to the user if the user has ListDirectory rights on the parent folder. Aby odmówić ReadAttributes i ReadExtendedAttributes, Odrzuć ListDirectory w katalogu nadrzędnym.To deny ReadAttributes and ReadExtendedAttributes, deny ListDirectory on the parent directory.

Zabezpieczenia

FileIOPermission
uprawnienia do wyliczania listy kontroli dostępu (ACL) dla katalogu.for permission to enumerate access control list (ACL) for a directory. Skojarzone wyliczenia: NoAccess, ViewAssociated enumerations: NoAccess , View Akcja zabezpieczeń: zapotrzebowanie.Security action: Demand.

Dotyczy

Zobacz też