0

I have a C# application which stores it's settings in ProgramData subfolder such as

C:\ProgramData\Manufacturer\Product\Version\Settings.xml

I noticed that the application can't save settings changes, getting a permission denied error. My work-around was to manually change security settings and give Everyone full control on the folder tree and file. This works, but I'd like a more robust method.

Using suggestions from SO, I created the following code:

private void set_permissions()
{
    try
    {
        // Create security idenifier for all users (WorldSid)
        SecurityIdentifier sid = new SecurityIdentifier(WellKnownSidType.WorldSid, null);

        // get file info and add write, modify permissions
        FileInfo fi = new FileInfo(settingsFile);
        FileSecurity fs = fi.GetAccessControl();
        FileSystemAccessRule fsar = 
            new FileSystemAccessRule(sid, FileSystemRights.FullControl, InheritanceFlags.None, PropagationFlags.None, AccessControlType.Allow);

        fs.AddAccessRule(fsar);
        fi.SetAccessControl(fs);
        LogIt.LogInfo("Set permissions on Settings file");
    }
    catch(Exception ex)
    {
        LogIt.LogError(ex.Message);
        MessageBox.Show(ex.Message, "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
    }
}

When I step through the code, I get

Attempted to perform an unauthorized operation exception

when I execute this statement:

fi.SetAccessControl(fs);

If I close Visual Studio 2015 and open it as administrator, then my code will execute properly and the file security now has an entry for Everyone with full control.

So finally, here comes the question:

I'm following suggestion of putting the above code in my application, then in the setup project I add a custom action to run the newly installed application with an Install command-line option. My application, if it sees "Install" argument, will run the above code. Since I'm using a setup project which installs for all users by default, it automatically gives the administrator prompt before install. Does that mean the entire session, including the special action to run the application after install, is running under administrator rights?

If so, this should work, right?

But if the person installing changes it to "This user" then it would not be running with admin rights, and my code will fail. If needed, I could always be the one to do the final install and therefore would always use the administrator prompt, but I hate to depend on that.

Is there a more proper way to do this?

Thanks...

PhilDW
  • 20,260
  • 1
  • 18
  • 28
RMittelman
  • 319
  • 3
  • 16
  • It sounds about right. Security permissions are a hairy subject. Personally, unless you have very important information in settings.xml, you're probably worrying needlessly about it. – alexb Oct 26 '18 at 17:36
  • Thanks Alex, but the program does store its settings there, and we do need to be able to edit the settings from the program itself, then save that file. – RMittelman Oct 27 '18 at 22:31

1 Answers1

0

It seems that your program is not running elevated and therefore cannot update files in that location, and I assume that you want your users to not require admin privilege that you could add using an elevation manifest in your program.

So why choose that location to store the data? Why not just use User's Application Data folder?

As for that code, it's probably more robust to add it as an installer class custom action rather than run an executable. In an Everyone install that runs elevated the code will run privileged with the local system account.

PhilDW
  • 20,260
  • 1
  • 18
  • 28
  • Thanks Phil. I'm storing there cause it's an Everyone install so that's where program data lives rather than user's folder. I just put the code in my app, and when it's run by a custom action with "Install" CLO, that code gets run. Saves the trouble of writing a separate DLL. Just verified it works perfectly, and assigns Everyone full control to that file only. Thereafter any user running normally can still edit settings and save the settings file. Thanks so much for your help, and you get answer credit. – RMittelman Oct 27 '18 at 22:37