.NET RegistrySecurity API 处理非规范 ACL : Handling approach

Question

我正在尝试将访问规则添加到 RegistryKey像这样:

using ( RegistryKey registry = OpenOrCreateMyKey() )
{
    RegistrySecurity security = registry.GetAccessControl();
    security.AddAccessRule( new RegistryAccessRule(
        new SecurityIdentifier( WellKnownSidType.BuiltinUsersSid, null ),
        RegistryRights.WriteKey,
        InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit,
        PropagationFlags.None,
        AccessControlType.Allow ) );
    registry.SetAccessControl( security );
}

但是，如果注册表被破坏， AddAccessRule抛出异常(反射器显示 GetAccessControl 调用确定它们不是预先规范的，并且当您尝试在 RegistrySecurity 实例处于该状态时执行写入时触发故障安全):

System.InvalidOperationException: This access control list is not in canonical form and therefore cannot be modified.

运行regedt32(可能还有regedit)然后会显示一个弹出窗口说 the permissions on <key> are incorrectly ordered, which may cause some entries to be ineffective <paraphrasing>Do you want to unmangle them now? Y/N</paraprasing>
我在这个问题上看到的最权威的文章是 http://www.codeproject.com/KB/system/accessctrl3.aspx ，其中说:

However, the control flags are implemented as properties (talk about inconsistency!). You can retrieve the auto inheritance settings from the AreAccessRulesProtected / AreAuditRulesProtected (recall if an ACL is protected, it does not auto-inherit). If you read part 2, you'll know that some of the Windows APIs did not support inheritance, hence could corrupt the inheritance settings of your machine. The good news is that .NET fully supports the inheritance mechanism and will properly preserve the inheritance settings. If you opened a security descriptor that somehow got a disordered ACL (maybe from some rogue Win32 app), an InvalidOperationException will be thrown if you tried to edit it.

一般是这样的 non canonical ACLs results from use of the [since retired] NewSID tool , 和 people write KB articles to say "well stop doing that then" .

但是，关键的是，这并不总是原因，有时代码只是需要工作。处理这个问题的好方法是什么？

我将提供两个答案，人们可​​以投票和挑漏洞、投票、评论和挑剔。

Answer 1

方法 1 是忽略继承的权限并盲目地写下您想要的内容:-

using ( RegistryKey registry = OpenOrCreateMyKey() )
{
    RegistrySecurity security = new RegistrySecurity();
    security.AddAccessRule( new RegistryAccessRule( ... ));
    registry.SetAccessControl( security );
}

问题是，我不知道潜在的负面影响是什么。我很高兴所有需要访问的人都会从我的规则中获得它。但是，它与操作系统基础架构的其余部分配合得很好吗？