AccessControl是NSIS权限设置插件,只适用于Win2000或以上

/*
参数说明:
<filename> 一个可用的文件夹如:"c:windows"或"\127.0.0.1sharename"
<rootkey> 常用的注册表根目录,已经进行了宏定义:HKCR - HKEY_CLASSES_ROOT|HKLM - HKEY_LOCAL_MACHINE|HKCU - HKEY_CURRENT_USER|HKU - HKEY_USERS
<regkey> 注册表要改变的键名:"SoftwareMicrosoftWindows"
<trustee> 委托人:可以是一个可用的系统用户.如:"Administrator","Everyone",或者是SID(安全标识符http://support.microsoft.com/kb/243330/en-us)
<permissions> 权限值:可以是一个权限值组合如:"GenericRead + GenericWrite"或"FullAccess"
/NOINHERIT 不继续权限.
文件权限:
ReadData+WriteData+AppendData+ReadEA+WriteEA+Execute+ReadAttributes+WriteAttributes+Delete+ReadControl+WriteDAC+WriteOwner+Synchronize+
FullAccess+GenericRead+GenericWrite+GenericExecute+NULL
文件夹权限:
ListDirectory,AddFile,AddSubdirectory,ReadEA,WriteEA,Traverse,DeleteChild,ReadAttributes,WriteAttributes,Delete,ReadControl,WriteDAC,
WriteOwner,Synchronize,FullAccess,GenericRead,GenericWrite,GenericExecute,NULL
注册表权限:
QueryValue,SetValue,CreateSubKey,EnumerateSubKeys,Notify,CreateLink,Delete,ReadControl,WriteDAC,WriteOwner,Synchronize,GenericRead,
GenericWrite,GenericExecute,FullAccess,NULL
插件用法:
GrantOnFile [/NOINHERIT] <filename> <trustee> <permissions>
GrantOnRegKey [/NOINHERIT] <rootkey> <regkey> <trustee> <permissions>
SetOnFile [/NOINHERIT] <filename> <trustee> <permissions>
SetOnRegKey [/NOINHERIT] <rootkey> <regkey> <trustee> <permissions>
ClearOnFile [/NOINHERIT] <filename> <trustee> <permissions>
ClearOnRegKey [/NOINHERIT] <rootkey> <regkey> <trustee> <permissions>
DenyOnFile [/NOINHERIT] <filename> <trustee> <permissions>
DenyOnRegKey [/NOINHERIT] <rootkey> <regkey> <trustee> <permissions>
RevokeOnFile [/NOINHERIT] <filename> <trustee> <permissions>
RevokeOnRegKey [/NOINHERIT] <rootkey> <regkey> <trustee> <permissions>
SetFileOwner <filename> <trustee>
SetRegKeyOwner <rootkey> <regkey> <trustee>
GetFileOwner <filename>
GetRegKeyOwner <rootkey> <regkey>
SetFileGroup <filename> <trustee>
SetRegKeyGroup <rootkey> <regkey> <trustee>
GetFileGroup <filename>
GetRegKeyGroup <rootkey> <regkey>
EnableFileInheritance <filename>
EnableRegKeyInheritance <rootkey> <regkey>
DisableFileInheritance <filename>
DisableRegKeyInheritance <rootkey> <regkey>
SidToName <sidstring>
NameToSid <username>
GetCurrentUserName
*/
!AddPluginDir "../Plugins"
OutFile "AccessControl.exe"
SetCompressor /SOLID lzma
!include "logiclib.nsh"
SilentInstall silent
RequestExecutionLevel highest
Var Owner
Section ""
 IfFileExists "$EXEDIRTEMPFile.txt" label1
 CreateDirectory "$EXEDIRTEMP"
 FileOpen $0 "$EXEDIRTEMPFile.txt" "w"
 FileWrite $0 "AccessControl"
 FileClose $0
 label1:
 #移除文件的权限
 AccessControl::RevokeOnFile "$EXEDIRTEMPFile.txt" "Everyone" "FullAccess"
 #增加文件的权限,修改,执行,读取,写入
 AccessControl::GrantOnFile "$EXEDIRTEMPFile.txt" "Everyone" "Delete+GenericExecute+GenericRead+GenericWrite"
 #修改文件的权限
 AccessControl::SetOnFile "$EXEDIRTEMPFile.txt" "Everyone" "GenericExecute+GenericRead+GenericWrite"
 #保留文件的权限
 AccessControl::ClearOnFile "$EXEDIRTEMPFile.txt" "Everyone" "GenericRead+GenericWrite"
 #拒绝文件的权限
 AccessControl::RevokeOnFile "$EXEDIRTEMPFile.txt" "Everyone" "FullAccess"
 AccessControl::RevokeOnFile "$EXEDIRTEMPFile.txt" "Administrator" "FullAccess"
 AccessControl::RevokeOnFile "$EXEDIRTEMPFile.txt" "Administrators" "FullAccess"
 AccessControl::DenyOnFile "$EXEDIRTEMPFile.txt" "Everyone" "FullAccess"
 AccessControl::DenyOnFile "$EXEDIRTEMPFile.txt" "Administrator" "FullAccess"
 AccessControl::DenyOnFile "$EXEDIRTEMPFile.txt" "Administrators" "FullAccess"
 #设置文件所有者
 AccessControl::SetFileOwner "$EXEDIRTEMPFile.txt" "Administrators"
 #获得文件所有者
 AccessControl::GetFileOwner "$EXEDIRTEMPFile.txt"
 #设置文件用户组
 AccessControl::SetFileGroup "$EXEDIRTEMPFile.txt" "Administrators"
 #获得文件用户组
 AccessControl::GetFileGroup "$EXEDIRTEMPFile.txt"
 #允许文件继承
 AccessControl::EnableFileInheritance "$EXEDIRTEMPFile.txt"
 #禁止文件继承
 AccessControl::DisableFileInheritance "$EXEDIRTEMPFile.txt"
#SID: S-1-1-0
#Name: Everyone
 #获得当前用户名
 AccessControl::GetCurrentUserName
 Pop $0
 #用户名转安全标志
 AccessControl::NameToSid "$0"
 Pop $0
 #安全标志转用户名
 AccessControl::SidToName "$0"
 Pop $0
 #解锁
 AccessControl::SetOnFile "$EXEDIRTEMPFile.txt" "Everyone" "FullAccess"
 AccessControl::SetOnFile "$EXEDIRTEMPFile.txt" "Administrator" "FullAccess"
 AccessControl::SetOnFile "$EXEDIRTEMPFile.txt" "Administrators" "FullAccess"
SectionEnd