我可以找到关于如何编程DCOM的各种东西，但几乎没有关于如何设置/检查安全编程。编程的dcomcnfg功能
我不想重新创建dcomcnfg，但是如果我知道如何在C＃（首选或VB.net）中重现dcomcnfg的所有功能，那么我的目标就在眼前。
我似乎无法找到任何好的资源，没有开源的API，甚至没有如何做每一步的快速例子。即使在这里，DCOM或dcomcnfg也没有什么结果，也没有真正涉及如何设置/验证/列出安全性。
如果任何人有一些指向开放API或一些例子，我将不胜感激。
Daniel发布的答案很有帮助。丹尼尔，非常感谢你！
Microsoft's documentation的问题是它们表明注册表值包含二进制形式的ACL。因此，例如，如果您试图设置机器的默认访问权限（而不是每个进程），则您将访问注册表项HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Ole \ DefaultAccessPermission。但是，在我最初尝试使用System.Security.AccessControl.RawACL类访问此密钥失败。
由于Daniel的代码表明该值实际上并不是一个ACL，但实际上是一个带有ACL的SecurityDescriptor。
因此，尽管我知道这篇文章已经过时，但我会发布解决方案来检查和设置安全设置，并添加NetworkService以进行默认本地访问。当然，你可以把它做得更好，我敢肯定，但要开始你只需要改变键和访问掩码。
static class ComACLRights{
public const int COM_RIGHTS_EXECUTE= 1;
public const int COM_RIGHTS_EXECUTE_LOCAL = 2;
public const int COM_RIGHTS_EXECUTE_REMOTE = 4;
public const int COM_RIGHTS_ACTIVATE_LOCAL = 8;
public const int COM_RIGHTS_ACTIVATE_REMOTE = 16;
}
class Program
{
static void Main(string[] args)
{
var value = Registry.GetValue("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole", "DefaultAccessPermission", null);
RawSecurityDescriptor sd;
RawAcl acl;
if (value == null)
{
System.Console.WriteLine("Default Access Permission key has not been created yet");
sd = new RawSecurityDescriptor("");
}else{
sd = new RawSecurityDescriptor(value as byte[], 0);
}
acl = sd.DiscretionaryAcl;
bool found = false;
foreach (CommonAce ca in acl)
{
if (ca.SecurityIdentifier.IsWellKnown(WellKnownSidType.NetworkServiceSid))
{
//ensure local access is set
ca.AccessMask |= ComACLRights.COM_RIGHTS_EXECUTE | ComACLRights.COM_RIGHTS_EXECUTE_LOCAL | ComACLRights.COM_RIGHTS_ACTIVATE_LOCAL; //set local access. Always set execute
found = true;
break;
}
}
if(!found){
//Network Service was not found. Add it to the ACL
SecurityIdentifier si = new SecurityIdentifier(
WellKnownSidType.NetworkServiceSid, null);
CommonAce ca = new CommonAce(
AceFlags.None,
AceQualifier.AccessAllowed,
ComACLRights.COM_RIGHTS_EXECUTE | ComACLRights.COM_RIGHTS_EXECUTE_LOCAL | ComACLRights.COM_RIGHTS_ACTIVATE_LOCAL,
si,
false,
null);
acl.InsertAce(acl.Count, ca);
}
//re-set the ACL
sd.DiscretionaryAcl = acl;
byte[] binaryform = new byte[sd.BinaryLength];
sd.GetBinaryForm(binaryform, 0);
Registry.SetValue("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole", "DefaultAccessPermission", binaryform, RegistryValueKind.Binary);
}
}
此信息存储在HKCR\AppID\{Your-AppID}\LaunchPermission和AccessPermission中。这些是包含序列化安全描述符的REG_BINARY值。不知道是否有任何东西提供方便的.NET访问者...
更多关于MSDN的信息。
面对类似的情况（从MSI配置DCOM安全性）我设法创建一个解决方案，通过更改HKEY_CLASSES_ROOT \ AppID {APP-GUID-GOES-HERE}中的注册表项值来完成我想要的操作。感谢Arnout的回答让我走上了正确的道路。
具体而言，我创建了一种方法来编辑DCOM对象的安全权限，该权限存储在LaunchPermission和AccessPermission注册表项值中。这些是序列化的安全描述符，您可以通过将二进制数据传递到RawSecurityDescriptor来访问它们。这个类以美味的.NET-y方式简化了大量细节，但是您仍然需要关注有关Windows ACL的所有逻辑细节，并且必须确保使用RawSecurityDescriptor.GetBinaryForm将安全描述符写回注册表中。
我创建的方法叫做EditOrCreateACE。此方法将编辑帐户的现有ACE或插入新的ACE，并确保访问掩码已设置传递的标志。我在这里附上它作为一个例如，这绝不是对如何处理它的任何权力，因为我知道很少的的Windows ACL的东西还是：
// These are constants for the access mask on LaunchPermission.
// I'm unsure of the exact constants for AccessPermission
private const int COM_RIGHTS_EXECUTE = 1;
private const int COM_RIGHTS_EXECUTE_LOCAL = 2;
private const int COM_RIGHTS_EXECUTE_REMOTE = 4;
private const int COM_RIGHTS_ACTIVATE_LOCAL = 8;
private const int COM_RIGHTS_ACTIVATE_REMOTE = 16;
void EditOrCreateACE(string keyname, string valuename,
string accountname, int mask)
{
// Get security descriptor from registry
byte[] keyval = (byte[]) Registry.GetValue(keyname, valuename,
new byte[] { });
RawSecurityDescriptor sd;
if (keyval.Length > 0) {
sd = new RawSecurityDescriptor(keyval, 0);
} else {
sd = InitializeEmptySecurityDescriptor();
}
RawAcl acl = sd.DiscretionaryAcl;
CommonAce accountACE = null;
// Look for the account in the ACL
int i = 0;
foreach (GenericAce ace in acl) {
if (ace.AceType == AceType.AccessAllowed) {
CommonAce c_ace = ace as CommonAce;
NTAccount account =
c_ace.SecurityIdentifier.Translate(typeof(NTAccount))
as NTAccount;
if (account.Value.Contains(accountname)) {
accountACE = c_ace;
}
i++;
}
}
// If no ACE found for the given account, insert a new one at the end
// of the ACL, otherwise just set the mask
if (accountACE == null) {
SecurityIdentifier ns_account =
(new NTAccount(accountname)).Translate(typeof(SecurityIdentifier))
as SecurityIdentifier;
CommonAce ns = new CommonAce(AceFlags.None, AceQualifier.AccessAllowed,
mask, ns_account, false, null);
acl.InsertAce(acl.Count, ns);
} else {
accountACE.AccessMask |= mask;
}
// Write security descriptor back to registry
byte[] binarySd = new byte[sd.BinaryLength];
sd.GetBinaryForm(binarySd, 0);
Registry.SetValue(keyname, valuename, binarySd);
}
private static RawSecurityDescriptor InitializeEmptySecurityDescriptor()
{
var localSystem =
new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null);
var new_sd =
new RawSecurityDescriptor(ControlFlags.DiscretionaryAclPresent,
localSystem, localSystem, null,
new RawAcl(GenericAcl.AclRevision, 1));
return new_sd;
}
请注意，此代码是不意味着完美。如果注册表中缺少这些ACL的整个注册表项值，则合成的ACL只会授予对传递的帐户的访问权限，而不会进行其他任何操作。我也确定有很多我没有正确处理的错误情况和我已经掩盖的细节。再次，这是一个示例如何处理.NET中的DCOM ACL。
Yikes！刚刚注意到你的答案，对此感到遗憾。我会尽快尝试，并尽快回复您。 看起来我们需要一个完整的库。 – PerryJ 2012-08-02 18:26:20
我发现这个解决方案的工作：
public static void SetUp()
{
SetCOMSercurityAccess("DefaultAccessPermission");
SetCOMSercurityAccess("DefaultLaunchPermission");
}
private static void SetCOMSercurityAccess(string regKey)
{
//This is the magic permission!
byte[] binaryform = new string[]
{
"01","00","04","80","80","00","00","00","90","00","00","00","00","00","00","00","14","00","00","00","02","00","6c","00","04",
"00","00","00","00","00","14","00","1f","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00","00","00",
"24","00","0b","00","00","00","01","05","00","00","00","00","00","05","15","00","00","00","a3","53","d8","c8","94","bd","63",
"84","88","bf","fa","cf","a7","2b","00","00","00","00","18","00","1f","00","00","00","01","02","00","00","00","00","00","05",
"20","00","00","00","20","02","00","00","00","00","14","00","1f","00","00","00","01","01","00","00","00","00","00","05","04",
"00","00","00","01","02","00","00","00","00","00","05","20","00","00","00","20","02","00","00","01","02","00","00","00","00",
"00","05","20","00","00","00","20","02","00","00"
}.Select(o=> Convert.ToByte(o,16)).ToArray();
Registry.SetValue("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole", regKey, binaryform, RegistryValueKind.Binary);
}
在情况下，帮助他人......
你和丹尼尔似乎都走在了正确的轨道上。这一切仍然如此痛苦，但它的工作原理。我被剥夺了谁给予信用。但是你看起来像你可以更多地使用这些点。 :) – PerryJ 2013-04-12 22:40:08