如何防止计算机用户更改“安全性”选项卡中的文件权限

Question

I am trying to prevent read/write access to a file (or folder) with C#. The file is being locked as it is supposed to but the problem is that I can easily go to the security tab abd change the permissions. How can I prevent all computer users from changing these permissions ?

The Code i am using is this (Based on an article from MSDN) :

        DirectorySecurity fs = System.IO.Directory.GetAccessControl(textBox1.Text);
        fs.SetAccessRule(
            new FileSystemAccessRule(
                        "Users", 
                        FileSystemRights.Modify | 
                        FileSystemRights.ReadPermissions | 
                        FileSystemRights.TakeOwnership | 
                        FileSystemRights.ChangePermissions, 
                        AccessControlType.Deny));
        System.IO.Directory.SetAccessControl(textBox1.Text, fs);

Answer 1

What you're wanting to achieve can't be done; it might be helpful to explain why you want to do this as context. More detail on why it can't be done below...

Your code will be run by a user. Hence your code only has the permissions of the user running it. Given that, your program can do anything that the user can do, permissions wise, so the question becomes about Windows permissions, not C# management of them.

It is not possible to use permissions in Windows to prevent Administrators from accessing a file, as Administrators can alter the permissions to whatever they like. So even if you run your app as an administrator, it can't do anything that can't be then undone.

If your code is running as a user, then I believe it is possible to lock yourself out of the folder by changing ownership to some other user as well as preventing read access. But of course an admin will still be able to reset the permissions.

Answer 2

I think what you are asking is how to programmatically work with the User management to restrict folder access:

http://www.codeproject.com/Articles/18219/Windows-OS-User-Management

Then restrict access to Administrators or another group.

Also consider alternatives such as System Administrators doing this via Active Directory.