views:

88

answers:

1

Hi all,I have a search algorithm that tries to resolve the location of a directory on a local drive. The directory obviously will need to access other directories present on the system if it is searching for a sub directory of one of those. However in doing this I keep getting the UnauthorizedAccessException. I would like to provide the search mechanism the access privileges of the active user when it is run, how can I achieve this. Thank you.

Update: I'm working with C# on this.

A: 

In most cases, the correct answer is that you shouldn't.

Your algorithm should catch the UnauthorizedAccessException, accept that it won't be allowed to navigate further down that folder, and act like the folder is empty.

That means that sometimes you will get an answer that a directory you are looking for doesn't exist when it technically does exist. That's OK. It's the way it's supposed to be. If you don't have permission to it, it doesn't exist for you.

Folders protected under some other users' rights are "private". A program that "Joe" runs is not supposed to look at the folders that belong to "Mary". That's the whole point of permissions.

There are very few controlled exceptions to the rule. Notoriously, Disk Backup and Anti-virus applications need to be able to navigate the entire disk, regardless of folder permissions. They do so by setting up a service that runs under a highly privileged account (maybe "SYSTEM", maybe something else). It will likely be an account that holds the SeBackupPrivilege.

You can do that for your program, if you really need to scan the whole disk, but for most application scenarios you really shouldn't. Only a machine-wide maintenance application like an anti-virus or backup program should be given that kind of authority.

It's not that it's "overkill"; it's that it's "wrong". It does not play by the rules.

Euro Micelli
>A program that "Joe" runs is not supposed to look at the folders that belong to "Mary".Very true, that is why in my question I stated that I'd like the algorithm to have access to <b>only</b> the directories the current active user has access to.I have been running tests with my algorithm and it looks like there are "ghost" (ghost not hidden) files in the system which were causing the exceptions i was facing. Catching the exception here i think is warranted but i still think providing the algorithm access to the current active user is not dangerous. how to do this is the issue.
gogole
I'm not sure I understood then; are you looking for a way to avoid the exception to begin with -- maybe detect in advance if you can access the folder? The general advice I've seen is that it's incredibly hard to correctly check permissions in advance, it can be dramatically slower (especially over the network) and it's obviously subject to race conditions. The recommendation is to just do what you need to do with the folder and handle the error gracefully when and if it happens. Or is it something else?
Euro Micelli