这是我要模拟用户然后创建互斥量的代码。未创建互斥锁。我收到ERROR_ACCESS_DENIED错误。

void Impersonate()
{
    DWORD logonType = LOGON32_LOGON_INTERACTIVE;
    DWORD logonProvider = LOGON32_PROVIDER_DEFAULT;
    HANDLE userToken;
    HANDLE hMutex;
    DWORD err;

    LPSTR user = "zoom"; // the user I created myself on my machine. 
    // It has Administrator privileges, and my account, 
    // from which I start the app, is Admin too
    LPSTR password = "zoom";
    LPSTR domain = ".";
    hMutex = NULL;

    LogonUserA(user, domain, password, logonType, logonProvider,&userToken);

    // just to make sure that mutexes are created fine before impersonation
    hMutex = CreateMutexA( NULL, FALSE, "mutex_good" );  

    ImpersonateLoggedOnUser(userToken);

    hMutex = CreateMutexA( NULL, FALSE, "mutex_797" ); // I can set any 
                                                       // random name, no difference
    if( hMutex == NULL )
    {
        err = GetLastError();
        // here err is ERROR_ACCESS_DENIED 
    }

    CloseHandle(userToken);
}

最佳答案

首先，您需要了解NT Namespaces并使用WinObj工具。

这就像带有文件夹和不同"file"的内存中的小文件系统(此处"file"下的意思是不同的对象类型-Event，Mutant(mutex)，Section，Device，...)。每次创建命名对象时，都会将其放置在NT Namespaces中的某个文件夹中。此处的文件夹(如NTFS中的文件夹)具有安全描述符。结果并不是每个人都可以在任何文件夹下创建对象。

解释您对文件系统语言所做的操作(也许会更清楚):

我(John)尝试在%USERPROFILE%\Documents下创建文件“mutex_good”，这没关系。因为这是我的个人文件夹，并且我对此具有写权限。

然后我以zoom登录(模拟)并尝试在%USERPROFILE%\Documents下再次创建文件“mutex_797”(两种情况下%USERPROFILE%都扩展到同一路径，说c:\Users\John模拟不会影响此操作)

和zoom无法创建文件。为什么 ？他根本无权这样做。只有John，Administartors和SYSTEM具有对c:\Users\John的写权限，但没有zoom的写权限。

现在让我们返回NT Namespaces。当我们调用CreateMutexA( NULL, FALSE, "mutex_797" );时，会在哪里放置"mutex_797"？

如果您不使用appcontainer并且不在系统session 0中运行-您将在某些用户session <N>中运行，并且您的命名对象将放置在\Sessions\<N>\BaseNamedObjects目录中，其中N = 1,2。

所以叫CreateMutexA( NULL, FALSE, "mutex_797" );
尝试在\Sessions\<N>\BaseNamedObjects\mutex_797创建互斥锁

但是，在\Sessions\<N>\BaseNamedObjects中存在下一个SymbolicLinks(这类似于NTFS文件系统中的):

Global -> \BaseNamedObjects
Local  -> \Sessions\<N>\BaseNamedObjects
Session -> \Sessions\BNOLINKS

//
// Object Manager Directory Specific Access Rights.
//

#define DIRECTORY_QUERY                 (0x0001)
#define DIRECTORY_TRAVERSE              (0x0002)
#define DIRECTORY_CREATE_OBJECT         (0x0004)
#define DIRECTORY_CREATE_SUBDIRECTORY   (0x0008)

T FL AcessMsK Sid
0 00 000F000F S-1-5-90-0-1 DWM-1
0 00 000F000F S-1-5-18 SYSTEM
0 0B 10000000 S-1-5-18 SYSTEM
0 0B 10000000 S-1-3-0 CREATOR OWNER
0 00 000F000F S-1-5-21-4026734978-3280735129-2412320105-1001 John
0 0B 10000000 S-1-5-5-0-294807 LogonSessionId_0_294807
0 00 0002000F S-1-5-5-0-294807 LogonSessionId_0_294807
0 00 0002000F S-1-5-32-544 Administrators
0 02 00000003 S-1-1-0 Everyone
0 00 00000002 S-1-5-12 RESTRICTED
17 00 00000001 S-1-16-4096 Low Mandatory Level

T FL AcessMsK Sid
0 00 0002000F S-1-1-0 Everyone
0 00 00000002 S-1-5-12 RESTRICTED
0 00 000F000F S-1-5-90-0-0 
0 00 000F000F S-1-5-18 SYSTEM
17 00 00000001 S-1-16-4096 Low Mandatory Level

T FL AcessMsK Sid
0 00 0002000F S-1-1-0 Everyone
0 00 0002000F S-1-5-12 RESTRICTED
0 00 000F000F S-1-5-90-0-0 
0 00 000F000F S-1-5-18 SYSTEM
17 00 00000001 S-1-16-4096 Low Mandatory Level

The creation of a file-mapping object in the global namespace, by using CreateFileMapping, from a session other than session zero is a privileged operation. Because of this, an application running in an arbitrary Remote Desktop Session Host (RD Session Host) server session must have SeCreateGlobalPrivilege enabled in order to create a file-mapping object in the global namespace successfully. The privilege check is limited to the creation of file-mapping objects, and does not apply to opening existing ones. For example, if a service or the system creates a file-mapping object, any process running in any session can access that file-mapping object provided that the user has the necessary access.

I understand passing NULL as a first parameter of CreateMutex means that 'default' security attributes will be used. In this case it will be security parameters associated to the thread, i.e. with impersonated user.

关于c++ - 模拟后CreateMutex失败，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/41369232/