GetAppContainerNamedObjectPath 函数 (securityappcontainer.h)
GetAppContainerNamedObjectPath 函数检索应用容器的命名对象路径。 每个应用容器都有自己的命名对象路径。
语法
BOOL GetAppContainerNamedObjectPath(
[in, optional] HANDLE Token,
[in, optional] PSID AppContainerSid,
[in] ULONG ObjectPathLength,
[out, optional] LPWSTR ObjectPath,
[out] PULONG ReturnLength
);
参数
[in, optional] Token
与令牌相关的句柄。 如果传入 NULL 且未传入 AppContainerSid 参数，则使用调用方当前进程令牌，如果模拟，则使用线程令牌。
[in, optional] AppContainerSid
应用容器的 SID。
[in] ObjectPathLength
缓冲区的长度。
[out, optional] ObjectPath
用命名对象路径填充的缓冲区。
[out] ReturnLength
返回适应命名对象路径长度所需的长度。
返回值
如果函数成功，该函数将返回 值为 TRUE。
如果函数失败，它将返回 FALSE 值。 要获得更多的错误信息，请调用 GetLastError。
注解
对于跨 Windows 应用商店应用和桌面应用程序工作且具有在 Windows 应用商店应用上下文中加载的功能的辅助技术工具，有时上下文中功能可能需要与该工具同步。 通常，这种同步是通过在用户的会话中建立命名对象来实现的。 Windows 应用商店应用为此机制带来了挑战，因为默认情况下，Windows 应用商店应用无法访问用户或全局会话中的命名对象。 建议更新辅助技术工具，以使用UI 自动化 API 或放大 API，以避免此类缺陷。 在此期间，可能需要继续使用命名对象。
示例
以下示例建立了一个命名对象，以便可以从 Windows 应用商店应用访问它。
#pragma comment(lib, "advapi32.lib")
#include <windows.h>
#include <stdio.h>
#include <aclapi.h>
#include <tchar.h>
int main(void)
{
BOOL GetLogonSid (HANDLE hToken, PSID *ppsid)
{
BOOL bSuccess = FALSE;
DWORD dwLength = 0;
PTOKEN_GROUPS ptg = NULL;
// Verify the parameter passed in is not NULL.
if (NULL == ppsid)
goto Cleanup;
// Get required buffer size and allocate the TOKEN_GROUPS buffer.
if (!GetTokenInformation(
hToken, // handle to the access token
TokenLogonSid, // get information about the token's groups
(LPVOID) ptg, // pointer to TOKEN_GROUPS buffer
0, // size of buffer
&dwLength // receives required buffer size
))
{
if (GetLastError() != ERROR_INSUFFICIENT_BUFFER)
goto Cleanup;
ptg = (PTOKEN_GROUPS)HeapAlloc(GetProcessHeap(),
HEAP_ZERO_MEMORY, dwLength);
if (ptg == NULL)
goto Cleanup;
}
// Get the token group information from the access token.
if (!GetTokenInformation(
hToken, // handle to the access token
TokenLogonSid, // get information about the token's groups
(LPVOID) ptg, // pointer to TOKEN_GROUPS buffer
dwLength, // size of buffer
&dwLength // receives required buffer size
) || ptg->GroupCount != 1)
{
goto Cleanup;
}
// Found the logon SID; make a copy of it.
dwLength = GetLengthSid(ptg->Groups[0].Sid);
*ppsid = (PSID) HeapAlloc(GetProcessHeap(),
HEAP_ZERO_MEMORY, dwLength);
if (*ppsid == NULL)
goto Cleanup;
if (!CopySid(dwLength, *ppsid, ptg->Groups[0].Sid))
{
HeapFree(GetProcessHeap(), 0, (LPVOID)*ppsid);
goto Cleanup;
}
bSuccess = TRUE;
Cleanup:
// Free the buffer for the token groups.
if (ptg != NULL)
HeapFree(GetProcessHeap(), 0, (LPVOID)ptg);
return bSuccess;
}
BOOL
CreateObjectSecurityDescriptor(PSID pLogonSid, PSECURITY_DESCRIPTOR* ppSD)
{
BOOL bSuccess = FALSE;
DWORD dwRes;
PSID pAllAppsSID = NULL;
PACL pACL = NULL;
PSECURITY_DESCRIPTOR pSD = NULL;
EXPLICIT_ACCESS ea[2];
SID_IDENTIFIER_AUTHORITY ApplicationAuthority = SECURITY_APP_PACKAGE_AUTHORITY;
// Create a well-known SID for the all appcontainers group.
if(!AllocateAndInitializeSid(&ApplicationAuthority,
SECURITY_BUILTIN_APP_PACKAGE_RID_COUNT,
SECURITY_APP_PACKAGE_BASE_RID,
SECURITY_BUILTIN_PACKAGE_ANY_PACKAGE,
0, 0, 0, 0, 0, 0,
&pAllAppsSID))
{
wprintf(L"AllocateAndInitializeSid Error %u\n", GetLastError());
goto Cleanup;
}
// Initialize an EXPLICIT_ACCESS structure for an ACE.
// The ACE will allow LogonSid generic all access
ZeroMemory(&ea, 2 * sizeof(EXPLICIT_ACCESS));
ea[0].grfAccessPermissions = STANDARD_RIGHTS_ALL | MUTEX_ALL_ACCESS;
ea[0].grfAccessMode = SET_ACCESS;
ea[0].grfInheritance= NO_INHERITANCE;
ea[0].Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea[0].Trustee.TrusteeType = TRUSTEE_IS_USER;
ea[0].Trustee.ptstrName = (LPTSTR) pLogonSid;
// Initialize an EXPLICIT_ACCESS structure for an ACE.
// The ACE will allow the all appcontainers execute permission
ea[1].grfAccessPermissions = STANDARD_RIGHTS_READ | STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE | MUTEX_MODIFY_STATE;
ea[1].grfAccessMode = SET_ACCESS;
ea[1].grfInheritance= NO_INHERITANCE;
ea[1].Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea[1].Trustee.TrusteeType = TRUSTEE_IS_GROUP;
ea[1].Trustee.ptstrName = (LPTSTR) pAllAppsSID;
// Create a new ACL that contains the new ACEs.
dwRes = SetEntriesInAcl(2, ea, NULL, &pACL);
if (ERROR_SUCCESS != dwRes)
{
wprintf(L"SetEntriesInAcl Error %u\n", GetLastError());
goto Cleanup;
}
// Initialize a security descriptor.
pSD = (PSECURITY_DESCRIPTOR) LocalAlloc(LPTR,
SECURITY_DESCRIPTOR_MIN_LENGTH);
if (NULL == pSD)
{
wprintf(L"LocalAlloc Error %u\n", GetLastError());
goto Cleanup;
}
if (!InitializeSecurityDescriptor(pSD,
SECURITY_DESCRIPTOR_REVISION))
{
wprintf(L"InitializeSecurityDescriptor Error %u\n",
GetLastError());
goto Cleanup;
}
// Add the ACL to the security descriptor.
if (!SetSecurityDescriptorDacl(pSD,
TRUE, // bDaclPresent flag
pACL,
FALSE)) // not a default DACL
{
wprintf(L"SetSecurityDescriptorDacl Error %u\n",
GetLastError());
goto Cleanup;
}
*ppSD = pSD;
pSD = NULL;
bSuccess = TRUE;
Cleanup:
if (pAllAppsSID)
FreeSid(pAllAppsSID);
if (pACL)
LocalFree(pACL);
if (pSD)
LocalFree(pSD);
return bSuccess;
}
�
PSID pLogonSid = NULL;
PSECURITY_DESCRIPTOR pSd = NULL;
SECURITY_ATTRIBUTES SecurityAttributes;
HANDLE hToken = NULL;
HANDLE hMutex = NULL;
�
//Allowing LogonSid and all appcontainers.
if (GetLogonSid(hToken, &pLogonSid) && CreateObjectSecurityDescriptor(pLogonSid, &pSd) )
{
SecurityAttributes.nLength = sizeof(SECURITY_ATTRIBUTES);
SecurityAttributes.bInheritHandle = TRUE;
SecurityAttributes.lpSecurityDescriptor = pSd;
hMutex = CreateMutex(
&SecurityAttributes, // default security descriptor
FALSE, // mutex not owned
TEXT("NameOfMutexObject")); // object name
}
return 0;
}
要求
| 要求 | 值 |
|---|---|
| 最低受支持的客户端 | Windows 8 [仅限桌面应用] |
| 最低受支持的服务器 | Windows Server 2012 [仅限桌面应用] |
| 目标平台 | Windows |
| 标头 | securityappcontainer.h |
| Library | Kernel32.lib |
| DLL | Kernel32.dll |