Directory.SetAccessControl(String, DirectorySecurity) 方法

定義

命名空間:

System.IO

組件:

mscorlib.dll

將 DirectorySecurity 物件描述的存取控制清單 (ACL) 項目套用至指定的目錄。

public:
 static void SetAccessControl(System::String ^ path, System::Security::AccessControl::DirectorySecurity ^ directorySecurity);

public static void SetAccessControl (string path, System.Security.AccessControl.DirectorySecurity directorySecurity);

static member SetAccessControl : string * System.Security.AccessControl.DirectorySecurity -> unit

Public Shared Sub SetAccessControl (path As String, directorySecurity As DirectorySecurity)

參數

path

String

要加入或從中移除存取控制清單 (ACL) 項目的目錄。

directorySecurity

DirectorySecurity

DirectorySecurity 物件，描述要套用至 path 參數所描述之目錄的 ACL 項目。

例外狀況

ArgumentNullException

directorySecurity 參數為 null。

DirectoryNotFoundException

找不到此目錄。

ArgumentException

path 無效。

UnauthorizedAccessException

目前的處理序無法存取 path 所指定的目錄。

-或-

目前的處理序沒有足夠的權限可設定 ACL 項目。

範例

下列範例會使用 GetAccessControl 和 SetAccessControl 方法來新增訪問控制清單， (ACL) 項目，然後從目錄中移除 ACL 專案。 您必須提供有效的使用者或群組帳戶，才能執行這個範例。

using namespace System;
using namespace System::IO;
using namespace System::Security::AccessControl;

// Adds an ACL entry on the specified directory for the
// specified account.
void AddDirectorySecurity(String^ directoryName, String^ account, 
     FileSystemRights rights, AccessControlType controlType)
{
    // Create a new DirectoryInfo object.
    DirectoryInfo^ dInfo = gcnew DirectoryInfo(directoryName);

    // Get a DirectorySecurity object that represents the
    // current security settings.
    DirectorySecurity^ dSecurity = dInfo->GetAccessControl();

    // Add the FileSystemAccessRule to the security settings.
    dSecurity->AddAccessRule( gcnew FileSystemAccessRule(account,
        rights, controlType));

    // Set the new access settings.
    dInfo->SetAccessControl(dSecurity);
}

// Removes an ACL entry on the specified directory for the
// specified account.
void RemoveDirectorySecurity(String^ directoryName, String^ account,
     FileSystemRights rights, AccessControlType controlType)
{
    // Create a new DirectoryInfo object.
    DirectoryInfo^ dInfo = gcnew DirectoryInfo(directoryName);

    // Get a DirectorySecurity object that represents the
    // current security settings.
    DirectorySecurity^ dSecurity = dInfo->GetAccessControl();

    // Add the FileSystemAccessRule to the security settings.
    dSecurity->RemoveAccessRule(gcnew FileSystemAccessRule(account,
        rights, controlType));

    // Set the new access settings.
    dInfo->SetAccessControl(dSecurity);
}    

int main()
{
    String^ directoryName = "TestDirectory";
    String^ accountName = "MYDOMAIN\\MyAccount";
    if (!Directory::Exists(directoryName))
    {
        Console::WriteLine("The directory {0} could not be found.", 
            directoryName);
        return 0;
    }
    try
    {
        Console::WriteLine("Adding access control entry for {0}",
            directoryName);

        // Add the access control entry to the directory.
        AddDirectorySecurity(directoryName, accountName,
            FileSystemRights::ReadData, AccessControlType::Allow);

        Console::WriteLine("Removing access control entry from {0}",
            directoryName);

        // Remove the access control entry from the directory.
        RemoveDirectorySecurity(directoryName, accountName, 
            FileSystemRights::ReadData, AccessControlType::Allow);

        Console::WriteLine("Done.");
    }
    catch (UnauthorizedAccessException^)
    {
        Console::WriteLine("You are not authorised to carry" +
            " out this procedure.");
    }
    catch (System::Security::Principal::
        IdentityNotMappedException^)
    {
        Console::WriteLine("The account {0} could not be found.", accountName);
    }
}

using System;
using System.IO;
using System.Security.AccessControl;

namespace FileSystemExample
{
    class DirectoryExample
    {
        public static void Main()
        {
            try
            {
                string DirectoryName = "TestDirectory";

                Console.WriteLine("Adding access control entry for " + DirectoryName);

                // Add the access control entry to the directory.
                AddDirectorySecurity(DirectoryName, @"MYDOMAIN\MyAccount", FileSystemRights.ReadData, AccessControlType.Allow);

                Console.WriteLine("Removing access control entry from " + DirectoryName);

                // Remove the access control entry from the directory.
                RemoveDirectorySecurity(DirectoryName, @"MYDOMAIN\MyAccount", FileSystemRights.ReadData, AccessControlType.Allow);

                Console.WriteLine("Done.");
            }
            catch (Exception e)
            {
                Console.WriteLine(e);
            }

            Console.ReadLine();
        }

        // Adds an ACL entry on the specified directory for the specified account.
        public static void AddDirectorySecurity(string DirectoryName, string Account, FileSystemRights Rights, AccessControlType ControlType)
        {
            // Create a new DirectoryInfo object.
            DirectoryInfo dInfo = new DirectoryInfo(DirectoryName);

            // Get a DirectorySecurity object that represents the
            // current security settings.
            DirectorySecurity dSecurity = dInfo.GetAccessControl();

            // Add the FileSystemAccessRule to the security settings.
            dSecurity.AddAccessRule(new FileSystemAccessRule(Account,
                                                            Rights,
                                                            ControlType));

            // Set the new access settings.
            dInfo.SetAccessControl(dSecurity);
        }

        // Removes an ACL entry on the specified directory for the specified account.
        public static void RemoveDirectorySecurity(string DirectoryName, string Account, FileSystemRights Rights, AccessControlType ControlType)
        {
            // Create a new DirectoryInfo object.
            DirectoryInfo dInfo = new DirectoryInfo(DirectoryName);

            // Get a DirectorySecurity object that represents the
            // current security settings.
            DirectorySecurity dSecurity = dInfo.GetAccessControl();

            // Add the FileSystemAccessRule to the security settings.
            dSecurity.RemoveAccessRule(new FileSystemAccessRule(Account,
                                                            Rights,
                                                            ControlType));

            // Set the new access settings.
            dInfo.SetAccessControl(dSecurity);
        }
    }
}

open System
open System.IO
open System.Security.AccessControl

// Adds an ACL entry on the specified directory for the specified account.
let addDirectorySecurity fileName (account: string) rights controlType =
    // Create a new DirectoryInfo object.
    let dInfo = DirectoryInfo fileName

    // Get a DirectorySecurity object that represents the
    // current security settings.
    let dSecurity = dInfo.GetAccessControl()

    // Add the FileSystemAccessRule to the security settings.
    dSecurity.AddAccessRule(FileSystemAccessRule(account, rights, controlType))

    // Set the new access settings.
    dInfo.SetAccessControl dSecurity

// Removes an ACL entry on the specified directory for the specified account.
let removeDirectorySecurity fileName (account: string) rights controlType =
    // Create a new DirectoryInfo object.
    let dInfo = DirectoryInfo fileName

    // Get a DirectorySecurity object that represents the
    // current security settings.
    let dSecurity = dInfo.GetAccessControl()

    // Add the FileSystemAccessRule to the security settings.
    dSecurity.RemoveAccessRule(FileSystemAccessRule(account, rights, controlType)) |> ignore

    // Set the new access settings.
    dInfo.SetAccessControl dSecurity

try
    let DirectoryName = "TestDirectory"

    printfn $"Adding access control entry for {DirectoryName}"

    // Add the access control entry to the directory.
    addDirectorySecurity DirectoryName @"MYDOMAIN\MyAccount" FileSystemRights.ReadData AccessControlType.Allow

    printfn $"Removing access control entry from {DirectoryName}"

    // Remove the access control entry from the directory.
    removeDirectorySecurity DirectoryName @"MYDOMAIN\MyAccount" FileSystemRights.ReadData AccessControlType.Allow

    printfn "Done."
with e ->
    printfn $"{e}"

Imports System.IO
Imports System.Security.AccessControl



Module DirectoryExample

    Sub Main()
        Try
            Dim DirectoryName As String = "TestDirectory"

            Console.WriteLine("Adding access control entry for " + DirectoryName)

            ' Add the access control entry to the directory.
            AddDirectorySecurity(DirectoryName, "MYDOMAIN\MyAccount", FileSystemRights.ReadData, AccessControlType.Allow)

            Console.WriteLine("Removing access control entry from " + DirectoryName)

            ' Remove the access control entry from the directory.
            RemoveDirectorySecurity(DirectoryName, "MYDOMAIN\MyAccount", FileSystemRights.ReadData, AccessControlType.Allow)

            Console.WriteLine("Done.")
        Catch e As Exception
            Console.WriteLine(e)
        End Try

        Console.ReadLine()

    End Sub


    ' Adds an ACL entry on the specified directory for the specified account.
    Sub AddDirectorySecurity(ByVal FileName As String, ByVal Account As String, ByVal Rights As FileSystemRights, ByVal ControlType As AccessControlType)
        ' Create a new DirectoryInfoobject.
        Dim dInfo As New DirectoryInfo(FileName)

        ' Get a DirectorySecurity object that represents the 
        ' current security settings.
        Dim dSecurity As DirectorySecurity = dInfo.GetAccessControl()

        ' Add the FileSystemAccessRule to the security settings. 
        dSecurity.AddAccessRule(New FileSystemAccessRule(Account, Rights, ControlType))

        ' Set the new access settings.
        dInfo.SetAccessControl(dSecurity)

    End Sub


    ' Removes an ACL entry on the specified directory for the specified account.
    Sub RemoveDirectorySecurity(ByVal FileName As String, ByVal Account As String, ByVal Rights As FileSystemRights, ByVal ControlType As AccessControlType)
        ' Create a new DirectoryInfo object.
        Dim dInfo As New DirectoryInfo(FileName)

        ' Get a DirectorySecurity object that represents the 
        ' current security settings.
        Dim dSecurity As DirectorySecurity = dInfo.GetAccessControl()

        ' Add the FileSystemAccessRule to the security settings. 
        dSecurity.RemoveAccessRule(New FileSystemAccessRule(Account, Rights, ControlType))

        ' Set the new access settings.
        dInfo.SetAccessControl(dSecurity)

    End Sub
End Module

備註

方法 SetAccessControl 會將訪問控制清單 (ACL) 專案套用至代表非內含 ACL 清單的檔案。

警告

為 directorySecurity 參數指定的 ACL 會取代目錄的現有 ACL。 若要新增新用戶的許可權，請使用 GetAccessControl 方法來取得現有的 ACL 並加以修改。

ACL 描述具有或沒有指定檔案或目錄上特定動作許可權的個人和/或群組。 如需詳細資訊，請參閱如何：新增或移除存取控制清單項目。

方法 SetAccessControl 只會 DirectorySecurity 保存物件建立之後已修改的物件。 DirectorySecurity如果物件尚未修改，它將不會保存到檔案。 因此，無法從一個 DirectorySecurity 檔案擷取物件，並將相同的物件重新套用至另一個檔案。

若要將 ACL 資訊從一個檔案複製到另一個檔案：

1. GetAccessControl使用 方法，從原始程序檔擷取 DirectorySecurity 物件。

2. Create 目的地檔案的新 DirectorySecurity 物件。

3. GetSecurityDescriptorBinaryForm使用來源DirectorySecurity物件的 或 GetSecurityDescriptorSddlForm 方法來擷取 ACL 資訊。

4. SetSecurityDescriptorBinaryForm使用 或 SetSecurityDescriptorSddlForm 方法，將步驟 3 中擷取的資訊複製到目的地DirectorySecurity物件。

5. 使用 SetAccessControl 方法將目的地DirectorySecurity物件設定為目的地檔案。

在NTFS環境中，如果使用者具有ListDirectory父資料夾的許可權，ReadAttributes則會將和 ReadExtendedAttributes 授與給使用者。 若要拒絕 ReadAttributes 和 ReadExtendedAttributes，請在父目錄上拒絕 ListDirectory 。

另請參閱

• FileSystemWatcher