I would like to have some suggestions on how the permissions in Windows-2012 can be configured for the following use case:
- Each user (let's call him
bob) runs an application (let's call it
myapprequires read/write permissions for all files and folders under
bobrequires read/write permissions under
bobcannot read the folder
- By default and unless specified in 3 and 4,
bobcan read any file and folder under
My background is Linux and I am not so sure how to organize this in a Windows Server.
I would appreciate if anybody could point me in the right direction!
(1) I made up the path. It will be somewhere in windows. (I don't think it is important, but if so please share your knowledge!)
EDIT: Solution Under Linux
- App runs under user
- User runs under user
bob, which is part of the group
- All files and folders under
/users/bob/myappare owned by user
/users/bob/, folders has permissions
750(read/write/executable for owner, read/executable for group, none for everybody) and normal files
640(read/write for owner, read for group, none for everybody), files executable
750(read/write/executable for owner, read/executable for group, none for everybody)
/users/bob/myapp/logshas permissions 700 (read/write/executable for owner, none for group and none everybody else)
For the graphical application running under
bobapp to be displayed under
bob session would be another problem, but there are many options to allow
bob session see and interact with
bobapp graphical application.
sudo would be used in case that
bob wants to start
myapp, as it needs to temporarily get permissions to run the app.
sudo would be very restricted and just allow
bob to start the program as
Note 3: When the application or the user creates new files and folders, you need to be careful of the default permissions that will be inherit when the new files and folders are created (several options, probably I would use something like this)