如何以编程方式修复非规范 ACL？

Question

我有以下代码：

DirectoryInfo directory = new DirectoryInfo(@"C:\Program Files\Company\Product");
if (!directory.Exists) { directory.Create(); }

DirectorySecurity directorySecurity = directory.GetAccessControl();
SecurityIdentifier securityIdentifier = new SecurityIdentifier(WellKnownSidType.BuiltinUsersSid, null);
directorySecurity.AddAccessRule(
    new FileSystemAccessRule(
        securityIdentifier,
        FileSystemRights.Write,
        InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit,
        PropagationFlags.None,
        AccessControlType.Allow));
directory.SetAccessControl(directorySecurity);

对 AddAccessRule 的调用会抛出 InvalidOperationException 并具有以下堆栈跟踪：

System.InvalidOperationException: This access control list is not in canonical form and therefore cannot be modified.
   at System.Security.AccessControl.CommonAcl.ThrowIfNotCanonical()
   at System.Security.AccessControl.CommonAcl.AddQualifiedAce(SecurityIdentifier sid, AceQualifier qualifier, Int32 accessMask, AceFlags flags, ObjectAceFlags objectFlags, Guid objectType, Guid inheritedObjectType)
   at System.Security.AccessControl.DiscretionaryAcl.AddAccess(AccessControlType accessType, SecurityIdentifier sid, Int32 accessMask, InheritanceFlags inheritanceFlags, PropagationFlags propagationFlags)
   at System.Security.AccessControl.CommonObjectSecurity.ModifyAccess(AccessControlModification modification, AccessRule rule, Boolean& modified)
   at System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(AccessRule rule)
   at System.Security.AccessControl.FileSystemSecurity.AddAccessRule(FileSystemAccessRule rule)

这只发生在某些系统上（我见过 Windows XP 和 Windows 7）。在发生错误的情况下，使用 Windows 资源管理器查看目录的安全权限通常会导致显示带有以下文本的消息框：

权限顺序错误，可能会导致 导致部分条目无效。按“确定”继续并排序 正确设置权限，或取消以重置权限。

此时单击“确定”即可解决问题。这里发生了什么？系统如何进入这种状态，有没有办法以编程方式检测/修复它（即无需用户手动使用资源管理器来修复此问题）？

更新

我对 ACL、规范形式是什么以及为什么有必要做了更多研究。我仍然不确定文件通常如何进入这种状态，但我发现 Icacls 工具可用于通过保存权限列表来创建具有非规范 ACL 的目录，并将其更改为 out-乱序，并恢复它。现在我只需要一种无需用户交互即可修复它的方法。

Answer 1

我在 MSDN 博客文章中找到了解决方案： 说 wwhhhaaaat？ - 访问控制列表不规范。基本上，您需要构建一个具有相同权限的新 DACL，但按照正确的规范顺序：

static void Main(string[] args)
{
    // directory with known ACL problem (created using Icacls)
    DirectoryInfo directoryInfo = new DirectoryInfo("acltest");

    var directorySecurity = directoryInfo.GetAccessControl(AccessControlSections.Access);
    CanonicalizeDacl(directorySecurity);
    directoryInfo.SetAccessControl(directorySecurity);
}

static void CanonicalizeDacl(NativeObjectSecurity objectSecurity)
{
    if (objectSecurity == null) { throw new ArgumentNullException("objectSecurity"); }
    if (objectSecurity.AreAccessRulesCanonical) { return; }

    // A canonical ACL must have ACES sorted according to the following order:
    //   1. Access-denied on the object
    //   2. Access-denied on a child or property
    //   3. Access-allowed on the object
    //   4. Access-allowed on a child or property
    //   5. All inherited ACEs 
    RawSecurityDescriptor descriptor = new RawSecurityDescriptor(objectSecurity.GetSecurityDescriptorSddlForm(AccessControlSections.Access));

    List<CommonAce> implicitDenyDacl = new List<CommonAce>();
    List<CommonAce> implicitDenyObjectDacl = new List<CommonAce>();
    List<CommonAce> inheritedDacl = new List<CommonAce>();
    List<CommonAce> implicitAllowDacl = new List<CommonAce>();
    List<CommonAce> implicitAllowObjectDacl = new List<CommonAce>();

    foreach (CommonAce ace in descriptor.DiscretionaryAcl)
    {
        if ((ace.AceFlags & AceFlags.Inherited) == AceFlags.Inherited) { inheritedDacl.Add(ace); }
        else
        {
            switch (ace.AceType)
            {
                case AceType.AccessAllowed:
                    implicitAllowDacl.Add(ace);
                    break;

                case AceType.AccessDenied:
                    implicitDenyDacl.Add(ace);
                    break;

                case AceType.AccessAllowedObject:
                    implicitAllowObjectDacl.Add(ace);
                    break;

                case AceType.AccessDeniedObject:
                    implicitDenyObjectDacl.Add(ace);
                    break;
            }
        }
    }

    Int32 aceIndex = 0;
    RawAcl newDacl = new RawAcl(descriptor.DiscretionaryAcl.Revision, descriptor.DiscretionaryAcl.Count);
    implicitDenyDacl.ForEach(x => newDacl.InsertAce(aceIndex++, x));
    implicitDenyObjectDacl.ForEach(x => newDacl.InsertAce(aceIndex++, x));
    implicitAllowDacl.ForEach(x => newDacl.InsertAce(aceIndex++, x));
    implicitAllowObjectDacl.ForEach(x => newDacl.InsertAce(aceIndex++, x));
    inheritedDacl.ForEach(x => newDacl.InsertAce(aceIndex++, x));

    if (aceIndex != descriptor.DiscretionaryAcl.Count)
    {
        System.Diagnostics.Debug.Fail("The DACL cannot be canonicalized since it would potentially result in a loss of information");
        return;
    }

    descriptor.DiscretionaryAcl = newDacl;
    objectSecurity.SetSecurityDescriptorSddlForm(descriptor.GetSddlForm(AccessControlSections.Access), AccessControlSections.Access);
}

Answer 2

‘RawAcl’有扩展方法，它们似乎规范了错误的 ACE。

但这有点神秘。这些方法只是存在，我还没有找到任何文档。查看 .net 4.8 DirectoryObjectSecurity 的源代码，作者抱怨：

A better way would be to have an internal method that would canonicalize the ACL and call it once

这是方法的签名：

{
    //
    // Summary:
    //     Canonicalizes the specified Access Control List.
    //
    // Parameter:
    //   acl:
    //     The Access Control List.
    public static void Canonicalize(this RawAcl acl);
    //
    // Summary:
    //     Sort ACEs according to canonical form for this System.Security.AccessControl.ObjectSecurity.
    //
    // Parameter:
    //   objectSecurity:
    //     The object security whose DiscretionaryAcl will be made canonical.
    public static void CanonicalizeAccessRules(this ObjectSecurity objectSecurity);
}

但是 正如我们所知，有些 ACE 无法在不丢失信息的情况下进行规范化。这些扩展方法没有

return value

并且在这种情况下似乎不会抛出任何

exception

。因此，使用它们可能会导致信息丢失。凯文·基布勒 (Kevin Kibler) 的很棒的答案可能是更好的方法。