Restrict a directory that can be used only through a .net Application

Question

I have a windows Application that stores certain files in a directory. I would like to know if there is a way in .net that I can restrict users not to have access to that directly (by just going to that directory in windows, and grab files) so only my application can add/verify/delete a file in that directory.

Answer 1

This is only possible if your application runs with different credentials than the user running the application.

By default all applications run with the credentials of the user who launched the process. This means the application has the same directory and file restrictions as the user. Without a different account, the application can only decrease it's ability to access the file system, not increase it.

Dealing with the file system is evil in general. Even if you could get the user to not play in that directory you still can't trust the results will be in the exact same state as you left them. It's possible for other users, physical disk corruption or any number of other things to corrupt your files.

The only way to sanely program the file system is to expect failure from the start and count yourself lucky when it actually works.

Answer 2

The application needs to run as a specific user - and that user will always have the same rights as your application. You can, potentially, make a service that runs as an administrator to prevent standard users from accessing a directory, but the administrator will still be able to change things in the directory.

I suggest you look for another approach for your problem. There are potentially alternatives - perhaps you should consider keeping some type of encrypted hash on the directory contents. That would at least allow you to verify that the contents have not been changed, although it won't prevent the change from occurring.

Answer 3

Look at FileSystemWatcher - it doesn't prevent from changes in directory, but allows to notify program about changes in dir.

Answer 4

As others have mentioned, you need the application to act as a different user than the ones currently logged in. You should look into 'impersonation', here are some links that can get you started on getting your application to act as a different user when performing certain tasks:

http://csharptuning.blogspot.com/2007/06/impersonation-in-c.html

http://www.codeproject.com/KB/cs/cpimpersonation1.aspx

Answer 5

The easiest (although not secure in any way) method, would be to use a hidden folder, which the users know nothing about. so \servername\hiddenfiles$

A more secure alternative would be to change the credentials the program is using to access the folder. Is it necessary for them to access it as themselves?

An alternative would be to create a dummy account for each user, where they do not know the password. Make it relate to their windows login, so domain\myname becomes domain\mynamehidden. Then use this to connect to the directory.
This will ensure everything can be audited nicely too.

Answer 6

Could you use the Isolated Storage in .Net? While, it isn't necessarily restricted away from your users it may be a lot harder to find.... (stores under the local settings\application data\isolated storage for the logged in user)

Via code you work with it by using / importing the System.Io.IsolatedStorage and then you can create directories, files, etc... normal.

You also don't have to keep track of the actual directory on the HD it's in as .Net manages this. Maybe a nice plus.