如何访问和审核 .NET Core 3.1 中文件的安全性

Question

I'm struggling for a while now with accessing file using .NET Core 3.1. I've stumble across several examples but it seems that non of them works or I'm doing something wrong. So any advice or example will be highly appreciated.

First example that I've used is as follows:

var everyone = new SecurityIdentifier(WellKnownSidType.WorldSid, null);
                    AccessFileControl.AddFileSecurity(this.LocalReport.ReportPath, everyone, FileSystemRights.WriteData, AccessControlType.Allow);
                    ChangeFontFamily(fontFamily);
                    AccessFileControl.RemoveFileSecurity(this.LocalReport.ReportPath, everyone, FileSystemRights.WriteData, AccessControlType.Deny);


      // Adds an ACL entry on the specified file for the specified account.
        public static void AddFileSecurity(string fileName, SecurityIdentifier indentifier,
            FileSystemRights rights, AccessControlType controlType)
        {
            // Get a FileSecurity object that represents the
            // current security settings.
            var security = new FileSecurity(fileName,
                AccessControlSections.Owner |
                AccessControlSections.Group |
                AccessControlSections.Access);

            security.ModifyAccessRule(AccessControlModification.Add, new FileSystemAccessRule(indentifier,
                rights, controlType), out bool modified);
        }

In example above I've got The process does not possess the 'SeSecurityPrivilege' privilege which is required for this operation. also happen when changed AccessControlSection to All

var security = new FileSecurity(fileName,AccessControlSections.All);

Then in second example I tried to integrate slightly different approach

   var ac = new FileInfo(fileName).GetAccessControl();
        // Get a FileSecurity object that represents the
        // current security settings.

        var security = new FileSecurity(fileName,
          AccessControlSections.Owner |
          AccessControlSections.Group |
          AccessControlSections.Access);

        security.ModifyAccessRule(AccessControlModification.Add, new FileSystemAccessRule(indentifier,
            rights, controlType), out bool modified);

        ac.AddAccessRule(new FileSystemAccessRule(indentifier,
            rights, controlType));

        ac.SetAccessRule(new FileSystemAccessRule(indentifier,
            rights, controlType));

            FileSystemAclExtensions.SetAccessControl(new DirectoryInfo(fileName), ds);

Which returned Access to the path '....' is denied.

In third example I tried with this approach:

    public static void AddFileSecurity(string fileName, SecurityIdentifier indentifier,
        FileSystemRights rights, AccessControlType controlType)
    {

        // Create a new DirectoryInfo object.
        DirectoryInfo dInfo = new DirectoryInfo(fileName);

        // Get a DirectorySecurity object that represents the 
        // current security settings.
        DirectorySecurity dSecurity = dInfo.GetAccessControl();

        // Add the FileSystemAccessRule to the security settings. 
        dSecurity.AddAccessRule(new FileSystemAccessRule(indentifier,
            rights, controlType));

        // Set the new access settings.
        dInfo.SetAccessControl(dSecurity);
    }

In third example I've got Attempted to perform an unauthorized operation.

To be fair I don't know what I'm doing wrong and any help is appreciated

EDIT 1

As user jdweng pointed out I tried only with AccessControlSections.Owner but without any luck. I' ve got same error Access to the path '....' is denied .

EDIT 2

In last attempt I tried something along this path but resulted yet again with Attempted to perform an unauthorized operation.

Attempt:

public static void AddFileSecurity(string fileName, string directoryPath, SecurityIdentifier indentifier,
    FileSystemRights rights, AccessControlType controlType)
{

    var access = new FileInfo(fileName).GetAccessControl();

    access.AddAccessRule(new FileSystemAccessRule(indentifier,
                   rights, controlType));


    FileSystemAclExtensions.SetAccessControl(new FileInfo(fileName), access);
}

// Removes an ACL entry on the specified file for the specified account.
public static void RemoveFileSecurity(string fileName, SecurityIdentifier indentifier,
    FileSystemRights rights, AccessControlType controlType)
{

    var access = new FileInfo(fileName).GetAccessControl();

    access.RemoveAccessRule(new FileSystemAccessRule(indentifier,
                   rights, controlType));

    FileSystemAclExtensions.SetAccessControl(new FileInfo(fileName), access);

}

}

Answer 1

You might consider running your application as an admin.. Add this manifest file to your project: runasadmin.manifest:

    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <dependency>
    <dependentAssembly>

      <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls"   version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*" />

    </dependentAssembly>
  </dependency>

  <v3:trustInfo xmlns:v3="urn:schemas-microsoft-com:asm.v3">
    <v3:security>
      <v3:requestedPrivileges>
        <v3:requestedExecutionLevel level="highestAvailable" />
      </v3:requestedPrivileges>
    </v3:security>
  </v3:trustInfo>
</assembly>

If that does not work or you don't want to run your app as an administrator(or if you're already running your application as an administrator), comment me..