How to grant full permission to a file created by my application for ALL users?

Question

The tool I develop needs to grant access rights "Full Control" to a file created by it. It needs to be read, modified and deleted from all windows accounts and even possible future accounts. Could this be achieved?

I know I can try this for a SPECIFIC_USER:

FileSystemAccessRule rule = new FileSystemAccessRule(SPECIFIC_USER, FileSystemRights.FullControl, AccessControlType.Allow);
FileSecurity fSecurity = File.GetAccessControl(filePath);
fSecurity.SetAccessRule(rule);
File.SetAccessControl(filePath, fSecurity);

But how do I grant it to all users? And even possible future accounts? If the latter part is not possible, how to go about the first requirement?

Thanks.

EDIT:

This is the code which worked for me. Taken from the answerer's link.

private void GrantAccess(string fullPath)
{
    DirectoryInfo dInfo = new DirectoryInfo(fullPath);
    DirectorySecurity dSecurity = dInfo.GetAccessControl();
    dSecurity.AddAccessRule(new FileSystemAccessRule(
        new SecurityIdentifier(WellKnownSidType.WorldSid, null), 
        FileSystemRights.FullControl,
        InheritanceFlags.ObjectInherit |
           InheritanceFlags.ContainerInherit,
        PropagationFlags.NoPropagateInherit,
        AccessControlType.Allow));

    dInfo.SetAccessControl(dSecurity);
}

Note the PropagationFlags.NoPropagateInherit which is required (mentioned towards the last in the link). It does grant privilege to even future accounts.

Endow

Note to people, don't use "everyone", instead use new SecurityIdentifier(WellKnownSidType.WorldSid, null) which returns a SecurityIdentifier object. Everyone only works on english windows installations, using the other method ensures it's compatible with multiple language versions. – Goatsbeard

@trukin can you make it an answer? thanks – Endow

@nawfal: I'm having same issue, and I need to give access of my installation folder once application installed, but where can I write this code? – Raskind

@HinaKhuman Giving installation folder privileges are better handled by the installer. I dont know which one you are using but it should be pretty straight forward. If you wanna do it from C# then call the GrantAccess method from wherever you want but your application itself should have the rights. – Endow

@nawfal: Thanks! see detailed question here: https://mcmap.net/q/242693/-onafterinstall-not-working-after-installation-winform-c/5743676 – Raskind

Answer 1

Note to people using this.

When using literal strings for the FileSystemAccessRule, it should be WellKnownSidType.WorldSid instead of "everyone".

The reason is because there are multiple Window languages and Everyone only applies to EN ones, so for Spanish, it might be "Todos" (or something else).

using System.Security.AccessControl;
using System.Security.Principal;
using System.IO;

private void GrantAccess(string fullPath)
{
    DirectoryInfo dInfo = new DirectoryInfo(fullPath);
    DirectorySecurity dSecurity = dInfo.GetAccessControl();
    dSecurity.AddAccessRule(new FileSystemAccessRule(new SecurityIdentifier(WellKnownSidType.WorldSid, null), FileSystemRights.FullControl, InheritanceFlags.ObjectInherit | InheritanceFlags.ContainerInherit, PropagationFlags.NoPropagateInherit, AccessControlType.Allow));
    dInfo.SetAccessControl(dSecurity);
}

Goatsbeard

Thank-you so much.. been struggling with decompressing files and setting permissions to .mdf files (because I got read-only errors). Thanks! – Cornett

May I ask the purpose of the return value? – Indwell

@Indwell oh none really, it was meant to be called from somewhere and if it failed (say GrantAccess caught an exception, then it would return false), then whatever code uses that should not continue since no permissions were granted. – Goatsbeard

DirectorySecurity is not found. What is the reference lib? i added 3 lines 'using...', still error. – Delusive

Do not forget to include InheritanceFlags.ObjectInherit | InheritanceFlags.ContainerInherit, PropagationFlags.NoPropagateInherit or it will only add the user/group without applying any permissions to it (the user/group will only have special permissions). Just spent an hour trying to understand why it would appply any permissions to the group, so hope this saves someone some time! – Simitar

Answer 2

You will need to give full control to "Everyone" group on the machine. Found this post on MSDN which talks about it.

Hope this works for you.

Veasey

Thanks, Ill see to that. Does this grant access to even future accounts? – Endow

Thanks it did work and grants access to future user accounts as well. Please accept my edit so that others know what exactly should be done. – Endow

Answer 3

Here is similar code, but limited to doing so for a single file which is what brought me here. Though for better security, you may wish to use WellKnownSidType.AuthenticatedUserSid instead of WordSid.

var fileSecurity = new System.Security.AccessControl.FileSecurity();
var everyone = new SecurityIdentifier(WellKnownSidType.WorldSid, null);
var rule = new FileSystemAccessRule(everyone, FileSystemRights.FullControl, AccessControlType.Allow);
fileSecurity.AddAccessRule(rule);
  
File.SetAccessControl(path, fileSecurity);

Mana