给进程创建一个安全描述符(SA)

#include <windows.h>

#include <stdio.h>

#include <aclapi.h>



void main()

{



    DWORD dwRes, dwDisposition;

    PSID pEveryoneSID = NULL, pAdminSID = NULL;

    PACL pACL = NULL;

    PSECURITY_DESCRIPTOR pSD = NULL;

    EXPLICIT_ACCESS ea[2];

    SID_IDENTIFIER_AUTHORITY SIDAuthWorld =

            SECURITY_WORLD_SID_AUTHORITY;

    SID_IDENTIFIER_AUTHORITY SIDAuthNT = SECURITY_NT_AUTHORITY;

    SECURITY_ATTRIBUTES sa;

    LONG lRes;

    HKEY hkSub = NULL;



    // Create a well-known SID for the Everyone group.

    if(!AllocateAndInitializeSid(&SIDAuthWorld, 1,

                     SECURITY_WORLD_RID,

                     0, 0, 0, 0, 0, 0, 0,

                     &pEveryoneSID))

    {

        printf("AllocateAndInitializeSid Error %u\n", GetLastError());

        goto Cleanup;

    }



    // Initialize an EXPLICIT_ACCESS structure for an ACE.

    // The ACE will allow Everyone read access to the key.

    ZeroMemory(&ea, 2 * sizeof(EXPLICIT_ACCESS));

    ea[0].grfAccessPermissions = KEY_READ;

    ea[0].grfAccessMode = SET_ACCESS;

    ea[0].grfInheritance= NO_INHERITANCE;

    ea[0].Trustee.TrusteeForm = TRUSTEE_IS_SID;

    ea[0].Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;

    ea[0].Trustee.ptstrName  = (LPTSTR) pEveryoneSID;



    // Create a SID for the BUILTIN\Administrators group.

    if(! AllocateAndInitializeSid(&SIDAuthNT, 2,

                     SECURITY_BUILTIN_DOMAIN_RID,

                     DOMAIN_ALIAS_RID_ADMINS,

                     0, 0, 0, 0, 0, 0,

                     &pAdminSID)) 

    {

        printf("AllocateAndInitializeSid Error %u\n", GetLastError());

        goto Cleanup; 

    }



    // Initialize an EXPLICIT_ACCESS structure for an ACE.

    // The ACE will allow the Administrators group full access to

    // the key.

    ea[1].grfAccessPermissions = KEY_ALL_ACCESS;

    ea[1].grfAccessMode = SET_ACCESS;

    ea[1].grfInheritance= NO_INHERITANCE;

    ea[1].Trustee.TrusteeForm = TRUSTEE_IS_SID;

    ea[1].Trustee.TrusteeType = TRUSTEE_IS_GROUP;

    ea[1].Trustee.ptstrName  = (LPTSTR) pAdminSID;



    // Create a new ACL that contains the new ACEs.

    dwRes = SetEntriesInAcl(2, ea, NULL, &pACL);

    if (ERROR_SUCCESS != dwRes) 

    {

        printf("SetEntriesInAcl Error %u\n", GetLastError());

        goto Cleanup;

    }



    // Initialize a security descriptor.  

    pSD = (PSECURITY_DESCRIPTOR) LocalAlloc(LPTR, 

                             SECURITY_DESCRIPTOR_MIN_LENGTH); 

    if (NULL == pSD) 

    { 

        printf("LocalAlloc Error %u\n", GetLastError());

        goto Cleanup; 

    } 

 

    if (!InitializeSecurityDescriptor(pSD,

            SECURITY_DESCRIPTOR_REVISION)) 

    {  

        printf("InitializeSecurityDescriptor Error %u\n",

                                GetLastError());

        goto Cleanup; 

    } 

 

    // Add the ACL to the security descriptor. 

    if (!SetSecurityDescriptorDacl(pSD, 

            TRUE,     // bDaclPresent flag   

            pACL, 

            FALSE))   // not a default DACL 

    {  

        printf("SetSecurityDescriptorDacl Error %u\n",

                GetLastError());

        goto Cleanup; 

    } 



    // Initialize a security attributes structure.

    sa.nLength = sizeof (SECURITY_ATTRIBUTES);

    sa.lpSecurityDescriptor = pSD;

    sa.bInheritHandle = FALSE;



    // Use the security attributes to set the security descriptor 

    // when you create a key.

    lRes = RegCreateKeyEx(HKEY_CURRENT_USER, "mykey", 0, "", 0, 

            KEY_READ | KEY_WRITE, &sa, &hkSub, &dwDisposition); 

    printf("RegCreateKeyEx result %u\n", lRes );



Cleanup:



    if (pEveryoneSID) 

        FreeSid(pEveryoneSID);

    if (pAdminSID) 

        FreeSid(pAdminSID);

    if (pACL) 

        LocalFree(pACL);

    if (pSD) 

        LocalFree(pSD);

    if (hkSub) 

        RegCloseKey(hkSub);



    return;



}

来源于MSDN：ms-help://MS.MSDNQTR.v90.chs/secauthz/security/creating_a_security_descriptor_for_a_new_object_in_c__.htm