无法复制文件,即使在C#中授予了FileIOPermission

Question

我FileIOPermission在.NET 3.5中尝试使用Windows 7.我一直是Windows XP用户,并且因为我是管理员而被授予此权限

我编写了以下代码,测试是否可以写入C:\ Program Files\Outlook ......

static void Main(string[] args)
{
    Console.WriteLine("Am I an administrator? " + new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator);

    //  Try and open a file in C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll
    string path = @"C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll";

    try
    {
        FileIOPermission ioPerm = new FileIOPermission(FileIOPermissionAccess.Read, path);
        ioPerm.Demand();

        string backupPath = Path.ChangeExtension(path, ".bak");
        FileIOPermission writeAccess = new FileIOPermission(FileIOPermissionAccess.AllAccess, backupPath);
        writeAccess.Demand();

        Console.WriteLine("Read access is permitted: {0} => {1}",path,SecurityManager.IsGranted(ioPerm));
        Console.WriteLine("Write backup file is permitted: {0} => {1}", backupPath, SecurityManager.IsGranted(writeAccess));

        File.Copy(path, backupPath);

        Console.WriteLine("File copied! {0}",backupPath);
        Console.WriteLine("Deleting file.....");
        File.Delete(path);
    }
    catch (UnauthorizedAccessException uae)
    {
        Console.WriteLine(uae.ToString());
    }

    Console.ReadLine();
}

所以程序会导致UnauthorizedAccessException(我期望的),但我不明白的是,Demand()允许权限,SecurityManager确认授予权限,但在执行时File.Copy()我确实得到了异常.

虽然我很高兴看到.NET阻止了我,但为什么在我打电话时它没有通知我Demand()？

我得到以下输出:

Am I an administrator? False
Read access is permitted: C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll => True
Write backup file is permitted: C:\Program Files\Microsoft Office\Office14\BCSLaunch.bak => True
System.UnauthorizedAccessException: Access to the path 'C:\Program Files\Microsoft Office\Office14\BCSLaunch.bak' is denied.
   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.File.InternalCopy(String sourceFileName, String destFileName, Boolean overwrite)
   at System.IO.File.Copy(String sourceFileName, String destFileName)
   at TryAndGetUACPrompt.Program.Main(String[] args) in C:\Users\..............

有人可以帮助我理解为什么我会收到相互矛盾的信息吗？

-

更新 - 格林尼治标准时间19:30

我使用以下代码查看了源文件的ACL:

Console.WriteLine("ACL Permissions for Source....");
FileSecurity fileSecurityForOriginalPath = new FileSecurity(path, AccessControlSections.Access);

foreach (FileSystemAccessRule rule in fileSecurityForOriginalPath.GetAccessRules(true,true,typeof(NTAccount)))
{
   Console.WriteLine("{0} => {1}", rule.FileSystemRights, rule.AccessControlType);
}

输出如下:

ACL Permissions for Source....
FullControl => Allow
FullControl => Allow
ReadAndExecute, Synchronize => Allow

因此,我有权阅读它.但是,我尝试使用此代码来查看备份路径的权限,显然,我得到一个例外,因为我的备份(目标)文件实际上不存在,所以我无法检查它的权限.

我接下来会尝试另一个建议,将此检查移到另一种方法中.

更新 - 格林尼治标准时间19:45

我已将读/写需求重构为另一种方法:

private static FileIOPermission CheckWriteAccess(string backupPath)
{
    FileIOPermission writeAccess = new FileIOPermission(FileIOPermissionAccess.AllAccess, backupPath);
    writeAccess.Demand();
    return writeAccess;
}

private static FileIOPermission CheckReadAccess(string path)
{
    FileIOPermission ioPerm = new FileIOPermission(FileIOPermissionAccess.Read, path);
    ioPerm.Demand();
    return ioPerm;
}

这些都毫无例外地返回罚款.

因此,如果.NET安全性增强了DACL,我想知道为什么它认为它会成功,如果实际上它不是.

-

格林尼治标准时间19:57更新

好的,我检查了Directory的权限,而不是backupFile(目标文件),并将其作为输出(使用来自.GetAccessRules()的AuthorizationRuleCollection上的foreach)

Checking write access in this directory....
FullControl => Allow
268435456 => Allow
FullControl => Allow
268435456 => Allow
FullControl => Allow
268435456 => Allow
ReadAndExecute, Synchronize => Allow
-1610612736 => Allow
268435456 => Allow

我使用an Enum.Format(typeof(FileSystemAccessRights),rule,"G")来获取格式,有效地执行ToString(),但我不确定这些数字是否正确.

输出上述代码:

private static DirectorySecurity CheckWriteAccess(string backupPath)
{
    DirectorySecurity writeAccess = new DirectorySecurity( Path.GetDirectoryName(backupPath),AccessControlSections.Access);

    Console.WriteLine("Checking write access in this directory....");
    foreach (FileSystemAccessRule rule in writeAccess.GetAccessRules(true, true, typeof(NTAccount)))
    {
        Console.WriteLine("{0} => {1}", Enum.Format(typeof(FileSystemRights),rule.FileSystemRights,"G"), rule.AccessControlType);
    }

    return writeAccess;
}

Answer 1

读中科院IOPermisson /写仅授予您的能力来读取或写入.它不需要注意文件系统级别权限(ACL).检查文件夹上的ACL更接近:)

-Oisin