How does RegistryPermission works?

Question

I am trying to check if I have write access to a specific key in the registry before displaying a form that allow the user to change some settings that are written in that key.

code sanitized for clarity

public bool CanWrite()
{
    string key = @"HKEY_LOCAL_MACHINE\SOFTWARE\MyHaccpPlan, Inc.\2.0";

    try
    {
        RegistryPermission permission = new RegistryPermission(RegistryPermissionAccess.Write, key);
        permission.Demand();
        return true;
    }
    catch(SecurityException)
    {
        return false;
    }
}

I am running the application using a user that has read access only. The problem is that this function return true, even if the user don't have write access.

Later, a call like

Registry.SetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\MyHaccpPlan, Inc.\2.0", "Language", "fr-CA");

will fail with UnauthorizedAccessException.

How do I properly check for registry rights before attempting to write to it?

Edit

I don't want the current user to be able to write there. I want to use this registry entry as a flag that a feature in the software should be disabled. But if the user is an administrator, I want the software to allow the feature. The goal is that a network administrator could be able to preset the settings and that the users will be unable to change them.

But beside actually writing and waiting for it to crash, I want to check the security using the permission system offered in .NET if that is possible.

Answer 1

mmm you can try using a tool like Lutz Roeder's Reflector for viewing the content of the Registry.SetValue Method.

Looking a bit to it, it seems to do it with next line of code:

new SecurityPermission(SecurityPermissionFlag.UnmanagedCode).Demand();

Answer 2

You shouldn't rely on .NET code access security for managing access control to the registry; let alone should you have explicit checks in your code. With that approach, the user can still use the registry editor and bypass all your access checks.

Instead, you should use proper ACLs to restrict what users can write to a key.

If you want to test at run-time whether you have access to a key, you should try to open the key for writing, and catch SecurityException (in which case the user running the application has no permission to modify the key).