使用ACL为一个用户创建一个文件夹

Question

我想为特定用户设置一个文件夹为只读，他不应该能够编辑或删除它，我尝试了下面的代码，但它不工作，什么变化做我需要为它

try 
{ 
    string folderPath = textBox1.Text; 
    string username = comboBox1.SelectedItem.ToString(); 
    DirectorySecurity ds = Directory.GetAccessControl(folderPath); 
    FileSystemAccessRule fsa = 
     new FileSystemAccessRule(username, 
            FileSystemRights.ReadAndExecute, 
            AccessControlType.Allow); 
    ds.AddAccessRule(fsa); 
    Directory.SetAccessControl(folderPath, ds); 
    MessageBox.Show("ReadOnly"); 
} 
catch (Exception ex) 
{ 
    MessageBox.Show(ex.Message); 
} 

Answer 1

该用户可能通过一组如Everyone的成员继承到文件夹的其他权利，所以设置一个允许规则只允许他做一些他已经可以做。

例子：

 
- Root 
    [Allow: read/write (Everyone)] 
    - ParentFolder 
    [Allow: read/write (Everyone) - inherited from Root] 
    - RestrictedFolder 
     [Allow: read/write (Everyone) - inherited from Root] 
     [Allow: read (Restricted User) - this has no effect!] 

你可能想设置一个拒绝规则，而。这应该确保阻止用户写入或删除文件夹，而不考虑允许写入的组的继承权限或成员身份。

DirectorySecurity ds = Directory.GetAccessControl(folderPath); 
FileSystemRights allExceptRead = 
    FileSystemRights.FullControl & ~FileSystemRights.ReadAndExecute; 
// Use AccessControlType.Deny instead of Allow. 
FileSystemAccessRule fsa = new FileSystemAccessRule(username, 
                allExceptRead, 
                AccessControlType.Deny); 
ds.AddAccessRule(fsa); 
Directory.SetAccessControl(folderPath, ds); 

所以事后，层次结构如下所示：

 
- Root 
    [Allow: read/write (Everyone)] 
    - ParentFolder 
    [Allow: read/write (Everyone) - inherited from Root] 
    - RestrictedFolder 
     [Deny: write (Restricted User) - This overrides the inherited permission] 
     [Allow: read/write (Everyone) - inherited from Root] 

如果用户是不是已经允许读通过继承或组成员的文件夹中的机会，那么你将不得不添加两条访问规则，就像你已经（明确允许阅读）和另一个像我的（明确地防止除了阅读之外的任何东西）一样。例如层次算账：

 
- Root 
    [Allow: read/write (Everyone)] 
    - ParentFolder 
    [Allow: read/write (Everyone)] 
    // Prevent ParentFolder's permissions from propagating to child 
    [Prevent child folders from inheriting permissions] 
    - RestrictedFolder 
     [Deny: write (Restricted User)] 
     // Note the "Everyone" permission is not inherited. 
     // Without explicitly allowing read, the user can do nothing to this folder 
     [Allow: read (Restricted User) - Explicitly allow reading] 

---

更新

据this link，否认该文件夹本身Delete权限是不够的。您还需要在文件夹的父级文件夹上拒绝Delete subfolders and files。所以，你的文件夹层次结构必须是这样的：

 
- Root 
    [Allow: read/write (Everyone)] 
    - ParentFolder 
    [Deny: delete subfolders and files (Restricted User)] 
    [Allow: read/write (Everyone) - inherited from Root] 
    - RestrictedFolder 
     [Deny: write (Restricted User) - This overrides the inherited permission] 
     [Allow: read/write (Everyone) - inherited from Root]