Admin rights for a single method

Question

Is it possible to require administrator rights for one single method?

Something like this:

[RequireAdminRightsForThisMethod()]

private void TheMethod(){

    // Do something

}

Cynewulf

Take a gander here: omegacoder.com/?p=82 – Hagy

What would you want it to do? – Nisan

Just a note: If someone gives you an answer with WindowsIdentity.GetCurrent() or the like that this will only work for winforms off the bat, not web pages. – Frication

74.125.47.132/search?q=cache:BcnrvCZth5EJ:www.omegacoder.com/… – Iqbal

I want the fire UAC to ask for permissions when the applications executes one method. – Cynewulf

This avoids the method if the applications does not have permissions. I need to launch the UAC to ask for administrator permissions. – Cynewulf

You can't do that automatically. – Nisan

Thanks to everyone. Finally I will restart the application asking for administrator permissions when I need to copy updated files. – Cynewulf

any help for #8714495 ? :( – Raby

Answer 1

You can add a PrincipalPermission attribute to your method to demand administrative privileges for its execution:

[PrincipalPermission(SecurityAction.Demand, Role = @"BUILTIN\Administrators")]
public void MyMethod()
{
}

This is described in more detail in the following article:

Security Principles and Local Admin Rights in C# .Net

If you are looking for a way to elevate an already existing process I doubt that this is possible as administrator privileges are given on process-level to a process upon startup (see this related question). You would have to run your application "as administrator" to get the desired behavior.

However, there are some tricks that might allow you to do what you want, but be warned that this might open up severe security risks. See the following thread in the MSDN forums:

Launching MyElevatedCom Server without prompting Administrator credentialls from Standard User

Update (from comment)

It seems that if an update requires elevation your application update is best done by a separate process (either another executable, or your application called with a command line switch). For that separate process you can request elevation as follows:

var psi = new ProcessStartInfo();
psi.FileName = "path to update.exe";
psi.Arguments = "arguments for update.exe";
psi.Verb = "runas";

var process = new Process();
process.StartInfo = psi;
process.Start();   
process.WaitForExit();

Highland

It is possible if you have credentials to change the thread to impersonate those admin credentials. I haven't done it in .NET, but I have in C++/Win32. – Antre

@kenny: Yes, that's surely true, but I doubt that it is possible to elevate the current process (which would be required for certain tasks). See the discussion here: social.msdn.microsoft.com/Forums/en-IE/windowscompatibility/…. – Highland

The reason I need that is because when the application has an update it needs to copy files to the application folder. I couln't do this without administrator rights. What I want is to fire the UAC when the "CoppyFiles()" method is called. Hope this helps to understand my question. – Cynewulf

@lluis you know you could use the directoryservices object / namespace and check if the user is an administrator then implement the rest of the program...meaning if(admin)//do this else //dont do this – Hagy

Thanks to everyone. I will restart the application asking for administrator permissions when I need to copy updated files. – Cynewulf

any help for #8714495 :( – Raby

Throws Request for principal permission failed. I'm using WPF & trying to write a file inside Program Files. – Hosbein

@MangeshGhotage: The request will only work if you run elevated. – Highland

Seems like this answer is no longer valid: Principal is obsolete and no longer honored by the runtime. – Misquotation

Answer 2

A method can require administrative privileges to run, but it's not possible to automatically elevate to Admin when executing a method.

Nisan

But if we elevate the whole application using admin, then that application can access admin folders through browse window? So, if we can only elevate that function with admin credentials through program(c#), that would be helpful. Any suggestions ? – Drawer