0

I would like to have some suggestions on how the permissions in Windows-2012 can be configured for the following use case:

  1. Each user (let's call him bob) runs an application (let's call it myapp).
  2. myapp requires read/write permissions for all files and folders under c:\Users\bob\myapp (1)
  3. bob requires read/write permissions under c:\Users\bob\myapp\templates.
  4. bob cannot read the folder c:\Users\bob\myapp\logs
  5. By default and unless specified in 3 and 4, bob can read any file and folder under c:\Users\bob\myapp\

My background is Linux and I am not so sure how to organize this in a Windows Server.

I would appreciate if anybody could point me in the right direction!

(1) I made up the path. It will be somewhere in windows. (I don't think it is important, but if so please share your knowledge!)

EDIT: Solution Under Linux

  • App runs under user bobapp, group bobapp.
  • User runs under user bob, which is part of the group bobapp
  • All files and folders under /users/bob/myapp are owned by user bobapp, group bobapp
  • Under /users/bob/, folders has permissions 750 (read/write/executable for owner, read/executable for group, none for everybody) and normal files 640 (read/write for owner, read for group, none for everybody), files executable 750 (read/write/executable for owner, read/executable for group, none for everybody)
  • /users/bob/myapp/logs has permissions 700 (read/write/executable for owner, none for group and none everybody else)

Note 1: For the graphical application running under bobapp to be displayed under bob session would be another problem, but there are many options to allow bob session see and interact with bobapp graphical application.

Note 2: sudo would be used in case that bob wants to start myapp, as it needs to temporarily get permissions to run the app. sudo would be very restricted and just allow bob to start the program as bobapp user.

Note 3: When the application or the user creates new files and folders, you need to be careful of the default permissions that will be inherit when the new files and folders are created (several options, probably I would use something like this)

0

How would you solve this in linux systems?
Since the application runs in the user's context, the read and write permissions are the same.
You can set directory permissions with Cacls or via installer routine.
You would probably make the main directory c:\Users\bob\myapp read- and writable.
Inherit those permissions to all subdirectories except for c:\Users\bob\myapp\logs.
You mentioned sudo in the bounty, so my guess is that you see the same problem. You cannot apply restrictions where the application runs in the same context. So either you would need to run the application under a different user context or you need to find a different solution for the logs directory. You could unset permissions, read/write, and then set permissions again. Since the user is the owner of the directory when he created it you can change permissions anytime.

About your Windows path question: There are protected paths as C:\Program Files\ or C:\Windows\ which need administrative privileges (and is owned by TrustedInstaller). So it matters where to build your directories.

Edit:
From the update of the OP referred sudo. This tool is needed to run a program as another user, typically configured to not need a password to change context. As far as I know there is no equivalent in vanilla Windows.
You can see the discussion here about how to achieve elevated prompts etc. but mostly those require administrative rights and/or require you to enter a password like runas.
Additionally "Impersonate a client after authentication" might help but I've never used it and can't tell anything about it.

1
  • Noted about the protected paths. Added Linux solution so it might help out to find the equivalent in Windows. Hopefully it can help you to tailor the response a bit more to this use case. – Tk421 Dec 15 '20 at 22:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.