Uprawnienia do plików nie dziedziczą uprawnień do katalogów.

Question

Mam program, który tworzy bezpieczny katalog dla danych wyjściowych użytkownika. Działa to poprawnie, ale pliki, które utworzę w nim (lub skopiuję do niego) kończą się jedynie dostępem administratora.

DirectoryInfo outputDirectory = 
      baseOutputDirectory.CreateSubdirectory(outputDirectoryName, 
      GetDirectorySecurity(searchHits.Request.UserId)); 

... 

private DirectorySecurity GetDirectorySecurity(string owner) 
{ 
    const string LOG_SOURCE = "GetDirectorySecurity"; 
    DirectorySecurity ds = new DirectorySecurity(); 

    System.Security.Principal.NTAccount ownerAccount = 
     new System.Security.Principal.NTAccount(owner); 

    ds.SetOwner(ownerAccount); 

    ds.AddAccessRule(
     new FileSystemAccessRule(owner, 
     FileSystemRights.FullControl, 
     AccessControlType.Allow)); 

    //AdminUsers is a List<string> that contains a list from configuration 
    // That represents the admins who should be allowed 
    foreach (string adminUser in AdminUsers) 
    { 
     ds.AddAccessRule(
      new FileSystemAccessRule(adminUser, 
      FileSystemRights.FullControl, 
      AccessControlType.Allow)); 
    } 
    return ds; 
} 

/// <summary> 
/// This method copies any static supporting files, such as javascripts 
/// </summary> 
/// <param name="outputDirectory"></param> 
private void CopySupportingFiles(DirectoryInfo outputDirectory) 
{ 
    foreach (FileInfo file in SupportingFiles) 
    { 
     file.CopyTo(
      Path.Combine(outputDirectory.FullName, file.Name)); 
    } 
} 

etc, etc, etc.

Co robię źle? Dlaczego kaskady uprawnień nie są?

Answer 1

Wygląda na to, że przy ustawianiu DirectorySecurity należy ustawić InheritanceFlags i PropagationFlags (uważam, że nadpisuje to, co ręcznie ustawiłeś).

private DirectorySecurity GetDirectorySecurity(string owner) 
{ 
    const string LOG_SOURCE = "GetDirectorySecurity"; 
    DirectorySecurity ds = new DirectorySecurity(); 

    System.Security.Principal.NTAccount ownerAccount = 
     new System.Security.Principal.NTAccount(owner); 

    ds.SetOwner(ownerAccount); 

    ds.AddAccessRule(
     new FileSystemAccessRule(owner, 
     FileSystemRights.FullControl, 
     InheritanceFlags.ObjectInherit, 
     PropagationFlags.InheritOnly, 
     AccessControlType.Allow)); 

    //AdminUsers is a List<string> that contains a list from configuration 
    // That represents the admins who should be allowed 
    foreach (string adminUser in AdminUsers) 
    { 
     ds.AddAccessRule(
      new FileSystemAccessRule(adminUser, 
      FileSystemRights.FullControl, 
      InheritanceFlags.ObjectInherit, 
      PropagationFlags.InheritOnly, 
      AccessControlType.Allow)); 
    } 
    return ds; 
}