C#使用DirectorySecurity的SetOwner设置文件夹所有者只能设为当前用户
看到有人问了这个问题，查询并实验后发现确实有这个问题，测试代码如下：
static void Main(string[] args)
{
try
{
string folderPath = @"e:\testSecurity";
Directory.CreateDirectory(folderPath);
DirectorySecurity defaultFSec = Directory.GetAccessControl(folderPath);
IdentityReference newUser = new NTAccount("User2");
defaultFSec.SetOwner(newUser);
Directory.SetAccessControl(folderPath, defaultFSec);
}
catch(Exception ex)
{
Console.WriteLine(ex);
}
Console.ReadLine();
}结果是System.InvalidOperationException: The security identifier is not allowed to be the owner of this object.
2005年在Microsoft Connect上就有人提出了这个问题，微软说下个版本将会考虑添加这个功能，然而现在似乎还不行。
当然总是有什么其他办法的，既然资源管理器可以做到，那么直接调用API就是一个可行的办法。Richard Willis给出了一个实现方法，我这里把他的代码转贴一下：
sealed class UnmanagedCode
{
[DllImport("kernel32.dll", SetLastError=true)]
[return: MarshalAs(UnmanagedType.Bool)]
static extern bool CloseHandle(IntPtr hObject);
// Use this signature if you do not want the previous state
[DllImport("advapi32.dll", SetLastError=true)]
[return: MarshalAs(UnmanagedType.Bool)]
static extern bool AdjustTokenPrivileges(IntPtr tokenHandle,
[MarshalAs(UnmanagedType.Bool)]bool disableAllPrivileges,
ref TOKEN_PRIVILEGES newState,
UInt32 bufferLength,
IntPtr previousState,
IntPtr returnLength);
[DllImport("kernel32.dll", ExactSpelling = true)]
static extern IntPtr GetCurrentProcess();
[DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
static extern bool OpenProcessToken
(IntPtr processHandle, int desiredAccess, ref IntPtr phtok);
[DllImport("advapi32.dll", SetLastError = true)]
static extern bool LookupPrivilegeValue
(string host, string name, ref LUID lpLuid);
[StructLayout(LayoutKind.Sequential, Pack = 1)]
struct TOKEN_PRIVILEGES
{
public UInt32 PrivilegeCount;
public LUID Luid;
public UInt32 Attributes;
}
[StructLayout(LayoutKind.Sequential)]
public struct LUID
{
public uint LowPart;
public int HighPart;
}
const int SE_PRIVILEGE_ENABLED = 0x00000002;
const int TOKEN_QUERY = 0x00000008;
const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
//http://msdn.microsoft.com/en-us/library/bb530716(VS.85).aspx
const string SE_RESTORE_PRIVILEGE = "SeRestorePrivilege";
public static void GiveRestorePrivilege()
{
TOKEN_PRIVILEGES tokenPrivileges;
tokenPrivileges.PrivilegeCount = 1;
tokenPrivileges.Luid = new LUID();
tokenPrivileges.Attributes = SE_PRIVILEGE_ENABLED;
IntPtr tokenHandle = RetrieveProcessToken();
try
{
bool success = LookupPrivilegeValue
(null, SE_RESTORE_PRIVILEGE, ref tokenPrivileges.Luid);
if (success == false)
{
int lastError = Marshal.GetLastWin32Error();
throw new Exception(
string.Format("Could not find privilege {0}. Error {1}",
SE_RESTORE_PRIVILEGE, lastError));
}
success = AdjustTokenPrivileges(
tokenHandle, false,
ref tokenPrivileges, 0,
IntPtr.Zero, IntPtr.Zero);
if (success == false)
{
int lastError = Marshal.GetLastWin32Error();
throw new Exception(
string.Format("Could not assign privilege {0}. Error {1}",
SE_RESTORE_PRIVILEGE, lastError));
}
}
finally
{
CloseHandle(tokenHandle);
}
}
static IntPtr RetrieveProcessToken()
{
IntPtr processHandle = GetCurrentProcess();
IntPtr tokenHandle = IntPtr.Zero;
bool success = OpenProcessToken(processHandle,
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,
ref tokenHandle);
if (success == false)
{
int lastError = Marshal.GetLastWin32Error();
throw new Exception(
string.Format("Could not retrieve process token. Error {0}",
lastError));
}
return tokenHandle;
}
}
