Add "Everyone" Group permission to access a file

[JimWu]

As title, I'd like to add a "Everyone" group to a file and give this account a full control right.

I have try to use FileSecurity class to add a account, ASPNET ,for example.

code as follow:

try
{
     AddFileSecurity(@"c:\TestACL.txt", "ASPNET", FileSystemRights.FullControl, AccessControlType.Allow);
}
catch(Exception e){
 
}
 
  public static void AddFileSecurity(string filepath, string account, FileSystemRights right, AccessControlType controlType) 
{
 
      FileSecurity filesec = File.GetAccessControl(filepath);
      filesec.AddAccessRule(new FileSystemAccessRule(account, right, controlType));
            File.SetAccessControl(filepath, filesec);
 
} 
 

Now, I'd like to add another account "Everyone", instead of "ASPNET" above code, but it's not work.

Have anyone get idea or can tell me this question.

Think you,

Jim.

[spacix]

The reason you can't do this is a matter of NTFS permissions. The "Everyone" you can see in file permissions tab on a file/folder on a NTFS file system is a "Built-in security principal." It is assigned to every group, user, and other "Built-in security principals." (Other Examples: CREATOR OWNER, SYSTEM, SERVICE, an so forth, some of these have higher than administrator privileges)

These aren't physical users (such as Administrator) or groups, and I'm fairly sure you need to be an administrator/running with administrator privileges, to edit/change file permissions to these "Built-in security principals."

You are running this in ASP.NET from what I pickup from you post, so the application trying to set the security of the file is from a limited account (for VERY good security reasons, I don't suggest changing it) that isn't allowed to give access rights to a "Built-in security principal." If it was allowed full control a file could be uploaded and even executed with administrator privileges!; which is very very bad.

[JimWu]

Thinks for ur kindly answer.
Now, I have another problem to Add permission on a folder.
Code (cs):

try{
AddDirectorySecurity(@"c:\Upload", "USERS", FileSystemRights.FullControl, AccessControlType.Allow);
}
catch(Exception e){

}
public static void AddDirectorySecurity(string folderName, string account, FileSystemRights rights, AccessControlType controlType) {

DirectoryInfo dir = new DirectoryInfo(folderName);
DirectorySecurity sec = dir.GetAccessControl();
sec.AddAccessRule(new FileSystemAccessRule(account, rights, controlType));
dir.SetAccessControl(sec);

}

After that, the folder "Upload" is added successfully permission,I check this folder's, Upload, properties, and then I see the this folder permission but I dont know why this folder's permission is only add a "sepcial Permissions" list, checked , on this account "USERS" for the upload folder.

My purpose is add FullControl permission or others single permission,for example, Read, to USERS account on folder.

Do anyone have a good solution to answer this question.

Thank you for help.

Jim.

[spacix]

Most likely cause of this "error"/problem is that the permissions are only applying to one or two of the following; but not all of them which is called "full control."

• This folder
• subfolders
• files

You might have better luck making a new folder somewhere else (sorta like a sandbox for your application; and hopefully on a different drive) and setting the permissions to not to inherit (yet click to copy them) then allow "higher" access rights for the ASP.NET user. maybe even make it the "CREATOR OWNER" of the file and set the "CREATOR OWNER" object's access rights down. Though you should limit execute for the whole folder and keep your scripts elsewhere, or in a sibling directory.

After this your new folders (created with inherit) would be able to have the same access rights without setting permissions. This would be your best bet if your going to be making a lot of these...

Thinks for ur kindly answer.
Now, I have another problem to Add permission on a folder.
Code (cs):

try{
AddDirectorySecurity(@"c:\Upload", "USERS", FileSystemRights.FullControl, AccessControlType.Allow);
}
catch(Exception e){

}
public static void AddDirectorySecurity(string folderName, string account, FileSystemRights rights, AccessControlType controlType) {

DirectoryInfo dir = new DirectoryInfo(folderName);
DirectorySecurity sec = dir.GetAccessControl();
sec.AddAccessRule(new FileSystemAccessRule(account, rights, controlType));
dir.SetAccessControl(sec);

}

After that, the folder "Upload" is added successfully permission,I check this folder's, Upload, properties, and then I see the this folder permission but I dont know why this folder's permission is only add a "sepcial Permissions" list, checked , on this account "USERS" for the upload folder.

My purpose is add FullControl permission or others single permission,for example, Read, to USERS account on folder.

Do anyone have a good solution to answer this question.

Thank you for help.

Jim.

[JimWu]

Kindly spacix ,thank you for your kindly answer to me.

I obtain some many basic concepts of NTFS permissions from you.

Now, I am already find the answer to solve my problem.

Thank you very much.

Jim

Most likely cause of this "error"/problem is that the permissions are only applying to one or two of the following; but not all of them which is called "full control."

• This folder
• subfolders
• files

You might have better luck making a new folder somewhere else (sorta like a sandbox for your application; and hopefully on a different drive) and setting the permissions to not to inherit (yet click to copy them) then allow "higher" access rights for the ASP.NET user. maybe even make it the "CREATOR OWNER" of the file and set the "CREATOR OWNER" object's access rights down. Though you should limit execute for the whole folder and keep your scripts elsewhere, or in a sibling directory.

After this your new folders (created with inherit) would be able to have the same access rights without setting permissions. This would be your best bet if your going to be making a lot of these...