nbsp;    bError = TRUE;
        goto Cleanup;
      }
    }
    else
    {
      printf( "GetKernelObjectSecurity() = %d\n", GetLastError() );
      bError = TRUE;
      goto Cleanup;
    }
  }

  //
  // 得到原安全描述符的访问控制列表 ACL
  //
  if ( !GetSecurityDescriptorDacl( pOrigSd, &bDAcl, &pOldDAcl, &bDefDAcl ) )
  {
    printf( "GetSecurityDescriptorDacl() = %d\n", GetLastError() );

    bError = TRUE;
    goto Cleanup;
  }

  //
  // 生成新 ACE 权限的访问控制列表 ACL
  //
  dwRet = SetEntriesInAcl( 1, &ea, pOldDAcl, &pNewDAcl );
  if ( dwRet != ERROR_SUCCESS )
  {
    printf( "SetEntriesInAcl() = %d\n", GetLastError() );
    pNewDAcl = NULL;

    bError = TRUE;
    goto Cleanup;
  }

  if ( !MakeAbsoluteSD( pOrigSd,
                        pNewSd,
                        &dwSDLen,
                        pOldDAcl,
                        &dwAclSize,
                        pSacl,
                        &dwSaclSize,
                        pSidOwner,
                        &dwSidOwnLen,
                        pSidPrimary,
                        &dwSidPrimLen ) )
  {
    //
    // 第一次调用给出的参数肯定返回这个错误，这样做的目的是
  &nb