[wix-users] Restrict access to a folder generated using wix installer

[Phill Hogland]

One approach that you might use is to:

1) On a representative target system, create the folder and use the Windows tools to set the permissions as you desire.

2) In a admin CMD box run the cacls.exe /S  (OS tool) to generate a SDDL string which describes the permissions on the folder.

https://ss64.com/nt/cacls.html

3) In your Wix authoring use PermissionEx/@Sddl

4) Use Internet documentation of SDDL to modify the generated SDDL as needed and then test the results carefully since doing this impacts security of the system.

http://www.lewisroberts.com/2010/09/16/getting-started-with-sddl/

https://jorgequestforknowledge.wordpress.com/2008/03/26/parsing-sddl-strings/







________________________________
From: wix-users <wix-users-bounces at lists.wixtoolset.org> on behalf of Nikhil L <niks9731 at gmail.com>
Sent: Friday, February 10, 2017 12:21:03 AM
To: wix-users at lists.wixtoolset.org
Subject: [wix-users] Restrict access to a folder generated using wix installer

My use case is to run a msi package which creates a folder, in addition to
doing other things, which should be accessible only to the Administrators.
I tried using the util:PermissionEx element but the wix page for the
PermissionEx element doesn’t really tell about what do different attributes
do. I tried various things, one eg below, but I was still able to access
the created folder from both administrator and a non-admin user account.


<Directory Id=“TmpDir” Name=“TmpDir”>

<Component Id="CreateDir" Guid=“<>">

        <CreateFolder>

          <util:PermissionEx User="Users" Read="no" GenericRead="no”/> <!—
Tried different combinations here —>

        </CreateFolder>

      </Component>

      </Directory>

Any help as to what should I do to achieve what I have stated above. Let me
know if my question is unclear and I can explain in a more detail or in a
different way.

____________________________________________________________________
WiX Toolset Users Mailing List provided by FireGiant http://www.firegiant.com/