C# 4 and .NET 4

file security ❘ 805
adding and removing aCls from a file
It is also possible to manipulate the ACLs of a resource using the same objects that were used in the previous
examples. The following code example changes a previous code example where a file’s ACL information was
read. Here, the ACLs are read for a specified file, changed, and then read again:
try
{
using (FileStream myFile = new FileStream(myFilePath,
FileMode.Open, FileAccess.ReadWrite))
{
FileSecurity fileSec = myFile.GetAccessControl();
Console.WriteLine("ACL list before modification:");
foreach (FileSystemAccessRule fileRule in
fileSec.GetAccessRules(true, true,
typeof(System.Security.Principal.NTAccount)))
{
Console.WriteLine("{0} {1} {2} access for {3}", myFilePath,
fileRule.AccessControlType == AccessControlType.Allow
"provides": "denies",
fileRule.FileSystemRights,
fileRule.IdentityReference);
}
Console.WriteLine();
Console.WriteLine("ACL list after modification:");
FileSystemAccessRule newRule = new FileSystemAccessRule(
new System.Security.Principal.NTAccount(@"PUSHKIN\Tuija"),
FileSystemRights.FullControl,
AccessControlType.Allow);
fileSec.AddAccessRule(newRule);
File.SetAccessControl(myFilePath, fileSec);
}
}
foreach (FileSystemAccessRule fileRule in
fileSec.GetAccessRules(true, true,
typeof(System.Security.Principal.NTAccount)))
{
Console.WriteLine("{0} {1} {2} access for {3}", myFilePath,
fileRule.AccessControlType == AccessControlType.Allow
"provides": "denies",
fileRule.FileSystemRights,
fileRule.IdentityReference);
}
In this case, a new access rule is added to the file’s ACL. This is done by using the FileSystemAccessRule
object. The FileSystemAccessRule class is an abstraction access control entry (ACE) instance. The ACE
defines the user account to use, the type of access that this user account can deal with, and whether or
not to allow or deny this access. In creating a new instance of this object, a new NTAccount is created and
given Full Control to the file. Even though a new NTAccount is created, it must still reference an existing
user. Then the AddAccessRule method of the FileSecurity class is used to assign the new rule. From
there, the FileSecurity object reference is used to set the access control to the file in question using the
SetAccessControl() method of the File class.
www.it-ebooks.info