SeBackupPrivilege, but cannot read all files

Question

I am trying to read full directories independent of the current file-permissions. But even though I do have "SeBackupPrivilege", the following code leads to an "UnauthorizedAccessException". How can this be?

//Create the test-directory.
string testPath = Path.Combine(Environment.CurrentDirectory, "TestDenied");
string filePath = Path.Combine(testPath, "Foo.txt");
Directory.CreateDirectory(testPath);
using (var fs = File.CreateText(filePath)) {
    fs.WriteLine("Foo");
}
var ds = Directory.GetAccessControl(testPath, Utils.AccessControlSectionsToRead);
ds.SetOwner(WindowsIdentity.GetCurrent().User);
ds.AddAccessRule((FileSystemAccessRule)ds.AccessRuleFactory(
    WindowsIdentity.GetCurrent().User,
    (int)FileSystemRights.FullControl,
    false,
    InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit,
    PropagationFlags.None,
    AccessControlType.Deny)
);
Directory.SetAccessControl(testPath, ds);

//Get the backup-privilege
WinAPI.ModifyPrivilege(PrivilegeName.SeBackupPrivilege, true);
//Checked the privilege on the command line here: The process has it.

//Try to access the forbidden file.
using (var fs = File.OpenRead(filePath)) {
    //UnauthorizedAccessException from the line above.
}

How can this happen? I thought, that SeBackupPrivilege gets me access to all files?

Unfortunately, you have to explicitly tell Windows that you want to use your backup privilege when opening the file. I'm not sure how/whether you can do that from .NET. — Harry Johnston, Aug 27 '19 at 18:50

score 0 · Answer 1 · answered Dec 01 '19 at 02:13

0

What Harry is referring to is what CreateFile refers to as FILE_FLAG_BACKUP_SEMANTICS. At last check, none of the .Net classes expose this flag (probably because using it is so uncommon).

However, for those with a need, there's always PInvoke.

answered Dec 01 '19 at 02:13

David Wohlferd

166
6

SeBackupPrivilege, but cannot read all files

1 Answers1