为什么添加ACL访问控制列表以后,进程还是能被结束 (dump acl )

来源：互联网发布：巨人网络球球大作战编辑：程序博客网时间：2024/04/25 16:18

查看进程 ACL确实被改变了

kd> dt _Object_header PROCESS 812c9008
nt!_OBJECT_HEADER
Cannot find specified field members.
kd> dt _Object_header 812c9008
nt!_OBJECT_HEADER
   +0x000 PointerCount     : 5
   +0x004 HandleCount      : 2
   +0x004 NextToFree       : 0x00000002
   +0x008 Type             : 0x81582e70 _OBJECT_TYPE
   +0x00c NameInfoOffset   : 0 ''
   +0x00d HandleInfoOffset : 0 ''
   +0x00e QuotaInfoOffset : 0 ''
   +0x00f Flags            : 0x20 ' '
   +0x010 ObjectCreateInfo : 0x81387690 _OBJECT_CREATE_INFORMATION
   +0x010 QuotaBlockCharged : 0x81387690
   +0x014 SecurityDescriptor : 0xe1eeb01f
   +0x018 Body             : _QUAD

kd> !sd 0xe1eeb01f & -8
->Revision: 0x1
->Sbz1    : 0x0
->Control : 0x9004
            SE_DACL_PRESENT
            SE_DACL_PROTECTED
            SE_SELF_RELATIVE
->Owner   : S-1-5-21-1275210071-839522115-765776552-500
->Group   : S-1-5-21-1275210071-839522115-765776552-513
->Dacl    :
->Dacl    : ->AclRevision: 0x2
->Dacl    : ->Sbz1       : 0x0
->Dacl    : ->AclSize    : 0x400
->Dacl    : ->AceCount   : 0x2
->Dacl    : ->Sbz2       : 0x0
->Dacl    : ->Ace[0]: ->AceType: ACCESS_DENIED_ACE_TYPE
->Dacl    : ->Ace[0]: ->AceFlags: 0x0
->Dacl    : ->Ace[0]: ->AceSize: 0x14
->Dacl    : ->Ace[0]: ->Mask : 0x000000fa
->Dacl    : ->Ace[0]: ->SID: S-1-1-0

->Dacl    : ->Ace[1]: ->AceType: ACCESS_ALLOWED_ACE_TYPE
->Dacl    : ->Ace[1]: ->AceFlags: 0x0
->Dacl    : ->Ace[1]: ->AceSize: 0x24
->Dacl    : ->Ace[1]: ->Mask : 0x00100701
->Dacl    : ->Ace[1]: ->SID: S-1-5-21-1275210071-839522115-765776552-500

->Sacl    : is NULL