Geek Answers Handbook

FileSystemWatcher exceeds file system permissions

While experimenting with FileSystemWatcher, I found that it somehow exceeded my user account permissions for files and folders and would increase change events with information about what changed in files and folders that you don’t even have access to.

I have two questions:

1) Why is this happening?
2) Is this a problem in the AD configuration? how to fix it?
3) Is there a way to collect these files or even create FileSystemInfo from them to get more information about the files (and not just the changes made to them)?

As far as I tried, only FileSystemWatcher is immune to restrictions, I cannot run any other thing on it, here is a list of what I tried:

  • File.exists
  • Directory.Exists
  • FileInfo instance for found files
  • DirectoryInfo instance for found files
  • File.copy
  • File.Delete

Update : a tried and tested helge solution, with something similar to what it launched, not via the windows api, but on the command line:

robocopy / B \ myserver \ folder c: \ somefolder

The best team name.

You can verify with robocopy that / B stands for “backup mode,” and this is what suggested the excess would be the reason for this security.

I will try something, I want to find out what exactly makes FileSystemWatcher browse folders, I do not have permission to open it. Knowing why, I want to learn how to block FileSystemWatcher, and how to collect found files.

I would do a survey if I was with my personal account. Please can someone help me? I will write a blog post about this decision, among other things, which may help someone with the same doubts in the future.

+7
source share
1 answer

According to this answer to SO, FileSystemWatcher is based on the ReadDirectoryChangesW API function . If so, this explains the behavior you observe - and why it is not a security hole.

As documented on MSDN, ReadDirectoryChangesW needs the SeBackupPrivilege privilege (which is requested by the FILE_FLAG_BACKUP_SEMANTICS parameter for CreateFile). If the file is opened in this mode, the returned handle provides full access to the file, bypassing access checks. This function is intended for backup programs , which should be able to read everything on the disk, regardless of permissions.

This is not a security hole, because the SeBackupPrivilege privilege, which is required for this, is granted only to administrators by default. Administrators and virtually anyone who has physical access to the machine can always control and read every file if it is not encrypted.

As for the functions that can be used to access files in backup mode: at least BackupRead is available for reading. Enumeration is easily possible with FindFirstFile / FindNextFile. Of course, this requires a real Windows API, not the damaged .NET file system functions.

+4
source

More articles:


All Articles