[...]
TACE_HEADER =
record
AceType : Byte;
AceFlags: Byte;
AceSize : Word;
end;
PACE_HEADER = ^TACE_HEADER;
TACCESS_MASK = DWORD;
PACCESS_MASK = ^TACCESS_MASK;
TACCESS_ALLOWED_ACE =
record
Header : TACE_HEADER;
Mask : TACCESS_MASK;
SidStart: DWORD;
end;
PACCESS_ALLOWED_ACE = ^TACCESS_ALLOWED_ACE;
[...]
function GetUserSID(szUsername:
String): PSID;
var
UserSID : PSID;
cbUserSID: Cardinal;
sDomain :
String;
cbsDomain: Cardinal;
pNameUse : SID_NAME_USE;
begin
Result :=
nil;
cbUserSID := 0; UserSID :=
nil;
sDomain := '
'; cbsDomain := 0;
LookupAccountName(PChar('
\\.'), PChar(szUsername), UserSID, cbUserSID, @sDomain[1], cbsDomain, pNameUse);
GetMem(UserSID, cbUserSID);
ZeroMemory(UserSID, cbUserSID);
SetLength(sDomain, cbsDomain);
ZeroMemory(@sDomain[1], Length(sDomain));
if (LookupAccountName(PChar('
\\.'), PChar(szUsername), UserSID, cbUserSID, @sDomain[1], cbsDomain, pNameUse))
then
Result := UserSID;
end;
function SecureUpDesktop(hDesktop: HDESK; dwAccessMask: DWORD): Boolean;
var
si : SECURITY_INFORMATION;
UserSID : PSID;
pNewAcl : PACL;
cbACL : Cardinal;
psdNew : PSECURITY_DESCRIPTOR;
begin
Result := FALSE;
if (hDesktop <> 0)
then
begin
UserSID := GetUserSID('
MyTestAccount');
if (UserSID <>
nil)
and (IsValidSid(@UserSID^))
then
try
// Neuen SecurityDescriptor erstellen und initialisieren...
psdNew := PSECURITY_DESCRIPTOR(LocalAlloc(LPTR, SECURITY_DESCRIPTOR_MIN_LENGTH));
if not InitializeSecurityDescriptor(psdNew, SECURITY_DESCRIPTOR_REVISION)
then
Exit;
// ACL erstellen und Initialisieren
cbACL := SizeOf(
ACL) + SizeOf(TACCESS_ALLOWED_ACE) + GetLengthSid(UserSID) - SizeOf(DWORD);
pnewAcl := PACL(LocalAlloc(LPTR, cbACL)) ;
if not InitializeAcl(pnewAcl^, cbACL, 2)
then
Exit;
// Füge Rechte zu Acl hinzu
if not(AddAccessAllowedAce(pnewAcl^, pnewAcl.AclRevision, dwAccessMask, UserSID))
then
Exit;
// Acl in den Security-Descriptor schreiben
if not(SetSecurityDescriptorDacl(psdNew, True, pNewAcl, False))
then
Exit;
// Setze die neuen Rechte...
si := DACL_SECURITY_INFORMATION;
if not(SetUserObjectSecurity(hDesktop, si, psdNew))
then
Exit;
finally
FreeMem(UserSID);
end;
end;
end;
[...]
SecureUpDesktop(hNewDesktop, DESKTOP_READOBJECTS
or DESKTOP_CREATEWINDOW
or DESKTOP_CREATEMENU
or DESKTOP_WRITEOBJECTS
or DESKTOP_ENUMERATE);
[...]