Sazonov
19th June 2013 15:25 UTC

AccessControl: inheritance of permissions
Dear NSIS users, during my installation to the root directory I need to create several folders, copu files there and set full access to all child objects (subdirectories, folders, files and so on) of the root folder. I supposed "AccessControl plugin" could help me and decided to solve this task next way. I set "full access to the root directory" calling "AccessControl::GrantOnFile "$INSTDIR" "(S-1-5-32-545)" "FullAccess"". Then try to inherit properties implementing "AccessControl::EnableFileInheritance "$INSTDIR"". As result I saw that the root directory and new file objects had "full access" but ones that had existed before the installation had no changes in their permission. My OS Win 7 x 64. Of course I can do it manually but I would like installation process does it. Will be glad to see your opinions. Dmitriy.

demiller9
19th June 2013 19:41 UTC

Wow! That sounds really unsafe. Do your users know that you are (trying to) enable full write and delete access to everything on their drive? Any passing malware could find an easy home there.

Anders
19th June 2013 20:40 UTC

demiller9 is correct, you are not supposed to allow everyone to write to files in $programfiles. If you need write access to some kind of base/template files you should copy them from the shared location into appdata/localappdata when your application runs for the first time.

A middle ground is using all users appdata for these files but you really should think about what happens when different users on the same machine runs your app (and even multiple users running it at the same time)...

Sazonov
19th June 2013 21:51 UTC

Ok. For exmple, I have the next "C:\MyCompanyName\RootFolder". All installation is realised in "RootFolder" and I want make full accses to all childs objects of only "RootFolder", not for "C:\ProgramFiles" or even for "C:\MyCompanyName". I know it is not safe way, but now it is the only way to avoid a software modification.