Setting folder permissions on AI, resets the inherited ones?

[marcelo]

Hi,

I have a folder on my installation that i have added full permissions to NETWORK SERVICES; I installed the application and the permission is set properly, with one exception. All the other (inherited) permissions are gone.. now only NETWORK SERVICES have permission on that folder, not even the administrator can add/modify/delete files folders in it.
Is there a way to "ADD/APPEND" permissions on a folder using AI, and keep the Inherited permissions?

Thanks,
Marcelo

[Cosmin]

Hi,

If the folder is already present on the machine then Windows Installer tries to preserve the original permissions and add the new ones. However, if the folder is created by your installation package then only the permissions you configured will be set for it. In this case, you need to configure permissions for all the users or groups to which you want to grant access to the folder.

Regards,
Cosmin

[marcelo]

Hi Cosmin,

Thanks for the reply;

The folder is a new folder, created by the installation, but i need the same permission as any other folder that the same installation has + extra permissions. if my application installs on C:\PF\Company\Product, i expect that all sub folders of "Product" to inherit the permissions of its parent. If I need EXTRA permissions on certain folders, then those should be added. Otherwise how can I know what permissions are already in place for its parent to add to the list manually, thats something I cannot foresee.
Maybe a checkbox on that form to allow us to select if that folder should inherit the permissions + add the ones specified on the list would be good.

Right now i just removed that permission set from AI and added to my custom actions post installation setup.

Regards,
Marcelo

[Cosmin]

Hi,

Since this is not supported by Windows Installer, the only solution is to use a custom action. This custom action can check the permissions which are already set for the folder and add your custom ones.

Regards,
Cosmin

[marcelo]

Hi,

Yup, thats what I did (last line on my previous post), it works like a charm now. Thanks

Regards,
Marcelo

[Jairo]

Hi,

is it possible to show me, step by step, how to do this thing using Custom Action?

regards,

Jairo Marques

[marcelo]

Hi Jairo,

Here is how I've done it:

1. Create a .NET DLL with a class that inherits from the System.Configuration.Install.Installer class;
2. Override the methods "Install, Uninstall, Rollback, Commit" methods.
3. In the Install method, add/call the following code: (I've made in C# but you can easily translate that to any .net lang u want, as long as it is managed);

Code: Select all

static public string AddFullPermissionsOnFolderForUser(string p_strPath, string p_strAccountGroupName)
{
    try
    {
	DirectoryInfo FolderInfo = new DirectoryInfo(p_strPath);

	System.Security.AccessControl.DirectorySecurity FolderCurrentAccessControl = FolderInfo.GetAccessControl();

	FolderCurrentAccessControl.AddAccessRule(new System.Security.AccessControl.FileSystemAccessRule(p_strAccountGroupName, System.Security.AccessControl.FileSystemRights.FullControl, System.Security.AccessControl.InheritanceFlags.ContainerInherit, System.Security.AccessControl.PropagationFlags.None, System.Security.AccessControl.AccessControlType.Allow));
	FolderCurrentAccessControl.AddAccessRule(new System.Security.AccessControl.FileSystemAccessRule(p_strAccountGroupName, System.Security.AccessControl.FileSystemRights.FullControl, System.Security.AccessControl.InheritanceFlags.ObjectInherit, System.Security.AccessControl.PropagationFlags.None, System.Security.AccessControl.AccessControlType.Allow));

	FolderInfo.SetAccessControl(FolderCurrentAccessControl);
	return string.Format("Successfully added full permissions to '{0}' on '{1}'.", p_strAccountGroupName, p_strPath));
    }
    catch (System.Security.Principal.IdentityNotMappedException)
    {
	return string.Format("'{0}' is not a valid User/Group to set permissions on '{1}'", p_strAccountGroupName, p_strPath));
    }
    catch (Exception ex)
    {
	return string.Format("An unhandled exception was thrown while attempting to set full permissions to '{0}' on '{1}', The message returned was: {2}", p_strAccountGroupName, p_strPath, ex.Message));
    }
}

4. Add your .NET dll to the installation on AI.
5. On the Custom Actions Tab (in advanced installer), add a new InstallExecuteSequence "InstallFinalize";
6. Add a new ".net Installer Class Action" and point to your .NET dll.


As you can see in the code you can easily change it to set specific permissions instead of full control.

Hope that helps,
Marcelo

[Jairo]

Hi Marcelo,

I'm not using .net at this moment, but your help will help me to find a solution using COM.

BTW, if anybody know how to do the same thing using COM (VB6) I´ll be very glad.

Regards,

Jairo

[marcelo]

Hi Jairo, a quick Googlization returned me the following:

Function SetPermissions()
Dim strHomeFolder, strHome, strUser
Dim intRunError, objShell, objFSO

strHomeFolder = "C:\Test"

Set objShell = CreateObject("Wscript.Shell")
Set objFSO = CreateObject("Scripting.FileSystemObject")
If objFSO.FolderExists(strHomeFolder) Then
intRunError = objShell.Run("%COMSPEC% /c Echo Y| cacls " _
& strHomeFolder & " /e /c /g everyone:F ", 2, True)

If intRunError <> 0 Then
Wscript.Echo "Error assigning permissions for user " _
& strUser & " to home folder " & strHomeFolder
End If
End If
End Function


Haven't tried so can't guarntee it works..

HTH,
Marcelo