Is there a programmatic way to set Write permissions to my app's folders?

Question

User2136700745 posted

Every time I install my web app, I have to manually set Write permissions to two folders.  I got to thinking that the global "Application_Start" method could do this for me automatically.  Here's my initial attempt to do this with the root-level "Logs" folder:

  private void SetRequiredFolderWritePermissions()
  {
    string rootPath = Server.MapPath("~");
    DirectoryInfo info = new DirectoryInfo(rootPath + "Logs");
    //WindowsIdentity iisIUsrs = new WindowsIdentity("IIS_IUSRS");
    DirectorySecurity ds = info.GetAccessControl();
    ds.AddAccessRule(new FileSystemAccessRule("IIS_IUSRS", FileSystemRights.Write, InheritanceFlags.ObjectInherit | InheritanceFlags.ContainerInherit, PropagationFlags.None, AccessControlType.Allow));
    info.SetAccessControl(ds);
  }

It doesn't cause an error but when I check whether "IIS_IUSRS" has Write privileges for the "Logs" folder, it does not.

Is there a correct way to do this?

Robert

Answer 1

User465171450 posted

Yeah it shouldn't be able to do this. Think of how bad this could go if web apps were allowed to to this.

You can use PowerShell to handle this though. Here is an example of  setting ACLs on a directory: http://blogs.msdn.com/b/johan/archive/2008/10/01/powershell-editing-permissions-on-a-file-or-folder.aspx

Answer 2

User2136700745 posted

So you're saying that every time I install a new version of my app, I have to manually change the Write permissions of the two folders?

Surely there must be a way to automate this?!

Answer 3

User-166373564 posted

Hi pelalusa,

So you're saying that every time I install a new version of my app, I have to manually change the Write permissions of the two folders?

Surely there must be a way to automate this?!

I check relevant topic about this write permissions issue online, we can set folder permissions manually or you can make it an automatic part of the deployment process. Making it automatic requires complex MSBuild code, and since you only  have to do this the first time you deploy, this tutorial only shows how to do it manually. See: http://www.asp.net/mvc/tutorials/deployment/deployment-to-a-hosting-provider/deployment-to-a-hosting-provider-setting-folder-permissions-6-of-12 

Please let me know if there is anything that I can do to help.

best regards,

Angie 

Answer 4

User2136700745 posted

Hi Angie,

Yes, I know how to do it manually.

In my case, it's overkill to create an MS Build setup file.  Instead I just Zip up the published files and me or my client unzips them into the 'wwwroot' app folder.  Then Write permissions on two folders have to be set each time (because the folders are erased).

I was just hoping for a simple way to automate this.

Robert

Answer 5

User753101303 posted

Hi,

How is this automated? You could use https://technet.microsoft.com/en-us/library/bb490872.aspx maybe or PowerShell or the IIS management DLL from a C# app...

The main point is that the account that does the change need to be allowed to do that (which is likely why you couldn't do that from the app itself).

Answer 6

User-760709272 posted

Store your logs outside of your website folders, or store them inside the app_data folder.  Keeping log files in website folders is a bad idea for numerous reasons, you are risking app recycling and it is also a security risk.