DirectorySecurity not setting permissions correctl

Question

I have a C# code which creates a folder and sets some permissions on it. Here is the code sample:

static void Main(string[] args){

        Directory.CreateDirectory("C:\\vk07");
        DirectorySecurity dirSec = Directory.GetAccessControl("C:\\vk07");

        dirSec.AddAccessRule(new FileSystemAccessRule("INTRANET\\fGLBChorusUsers", FileSystemRights.ReadAndExecute, AccessControlType.Allow));            
        Directory.SetAccessControl("C:\\vk07", dirSec);
}

When I check the permissions set on the folder created above, instead of having Read and Modify (which is what I have set in the code), it shows only "Special Permissions" as checked.

Please can some one help me with this? I am new to ACL, so don't understand it very well.

Answer 1

FileSystemRights.ReadAndExecute doesn't allow you to modify. This is for read-only. You would need FileSystemRights.Modify for the full range. You may want to check out for the options available.

here is an example of the above:

String dir = @"C:\vk07"; 
Directory.CreateDirectory(dir); 
DirectoryInfo dirInfo = new   DirectoryInfo(dir); 
DirectorySecurity dirSec = dirInfo.GetAccessControl(); 
dirSec.AddAccessRule(new FileSystemAccessRule("INTRANET\\fGLBChorusUsers",FileSystemRights.Modify,AccessCo‌ntrolType.Allow)); 
dirInfo.SetAccessControl(dirSec);

Answer 2

I got the same code to work in VB, setting FileSystemRights.FullControl.

        Dim fsRule As FileSystemAccessRule = New FileSystemAccessRule(sid, FileSystemRights.FullControl, (InheritanceFlags.ContainerInherit + InheritanceFlags.ObjectInherit), PropagationFlags.None, AccessControlType.Allow)

Answer 3

I also had this problem. After executing the following code:

var security = Directory.GetAccessControl(folderPath);
security.AddAccessRule(
    new FileSystemAccessRule(
        new SecurityIdentifier(WellKnownSidType.NetworkServiceSid, null),
        FileSystemRights.Modify,
        InheritanceFlags.ObjectInherit,
        PropagationFlags.InheritOnly,
        AccessControlType.Allow
    )
);
Directory.SetAccessControl(folderPath, security);

...then the Properties Dialog for folderPath would appear as follows:

As you mentioned, only 'Special Permissions' is checked, but if you click Advanced, then you see:

Notice that in this dialog NETWORK SERVICE has the modify permission.

It seems as though when you set permissions programmatically Windows does not show these permissions within the folder properties dialog, but they still exist under advanced security settings. I also confirmed that my Window service (running as NETWORK SERVICE) was then able to access files within folderPath.

Answer 4

This code works for me:

    security.AddAccessRule(
    new FileSystemAccessRule(
        "domain\\login",
        FileSystemRights.Modify,
        InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit,
        PropagationFlags.None,
        AccessControlType.Allow
    ));

Answer 5

I was having this same problem, The actual reason is if you look at that network service picture from the other post, it is applying to files only. The basic permissions will only show up on the first picture if they say "This folder, subfolders, and files" To do this, you need to set the two flags -InheritanceFlags.ContainerInherit + InheritanceFlags.ObjectInherit.

    Try
        'If destination directory does not exist, create it first.
        If Not Directory.Exists(path) Then Directory.CreateDirectory(path)

        Dim dir As New DirectoryInfo(path)
        Dim dirsec As DirectorySecurity = dir.GetAccessControl()
        'Remove inherited permissions
        dirsec.SetAccessRuleProtection(True, False)

        'create rights, include subfolder and files to be inherited by this
        Dim Modify As New FileSystemAccessRule(username, FileSystemRights.Modify, InheritanceFlags.ContainerInherit + InheritanceFlags.ObjectInherit, PropagationFlags.None, AccessControlType.Allow)
        Dim Full As New FileSystemAccessRule(admingroup, FileSystemRights.FullControl, InheritanceFlags.ContainerInherit + InheritanceFlags.ObjectInherit, PropagationFlags.None, AccessControlType.Allow)

        dirsec.AddAccessRule(Modify)
        dirsec.AddAccessRule(Full)
        'Set
        dir.SetAccessControl(dirsec)
    Catch ex As Exception
        MsgBox(ex.Message)
    End Try