up vote 2 down vote favorite
share [g+] share [fb]

Let's say I want a specific folder X in My Documents to only be accessible by a specific application.

The Windows permissions don't allow me to do this easily, is there any solution which can do this?

link|improve this question
98% accept rate
feedback

4 Answers

up vote 3 down vote accepted

Although a bit extreme, the way I implement this in my home is to have virtual machines for various purposes.

This way I can have a virtual machine for various purposes, finance, programming, day to day, gaming, etc. And on the host you can secure the VMs appropriately and even give accounts on host/guest VMs in various capacities if you are looking to address a multiple user situation.

Like I said, I know extreme but for me, it does the job exactly how I want it to be since I use a handful of environments.

link|improve this answer
1  
Multiple accounts (not per application but per environment like finance) or VM approach (although this one has a huge resource impact) seems like a good high level idea, still wondering if it can be done at a lower level... If not, this is probably the closest solution. – Tom Wijsman Sep 5 '10 at 14:12
I know in linux this can be done with SELinux although I am not familiar enough with Windows to comment on that environment. – Chris Sep 6 '10 at 14:01
feedback
up vote 2 down vote
+50

You can use a Host-based Intrusion Prevention System (HIPS), which wikipedia defines as :

an installed software package which monitors a single host for suspicious activity by analysing events occurring within that host.

Such a system will have to be taught : It will ask permission for each program and for each folder and will let you permit or block the access or permit unrestricted access to all folders. Many HIPS suites also come bundled with a firewall.

Some free HIPS programs are listed in the article (and its comments):
Best Free Intrusion Prevention and Detection Utility for Home Use (HIPS).

My own favorite firewall+HIPS product is Online Armor Free.
Another very good one is Comodo Internet Security (CIS).

link|improve this answer
+1 for mentioning that it's a HIPS. I'm already aware of Comodo, but such systems cause a lot of overhead... But when I think of it again, besides the permission to access a folder an application may also not access another process as that would work around the security. So I guess there is no other solution than to either split up in several light environments or by using heavy protection... – Tom Wijsman Sep 5 '10 at 19:58
I'm using Online Armor, and the only time I experience slow-downs is when I'm copying an enormous number of files, because HIPS will verify each file. For these cases, I turn off Online Armor temporarily. I see HIPS as essential security, as well as giving me info about the behavior of products I test, as I don't like them to get out of their designated directories or to call home. – harrymc Sep 5 '10 at 20:29
feedback
up vote 0 down vote

I think this might be possible with Sandboxie, but I'm not sure.

link|improve this answer
This indeed provides isolation, but the difference between that solution and the question is that permanent storage of the data is needed... In Sandboxie you have to explicitly recover the files from the sandbox and you can't configure it to do it automatically as far as I can see. – Tom Wijsman Aug 22 '10 at 15:05
feedback
up vote 0 down vote

You should make a user with restricted permissions and "run as" the program using that user. I did that with Filezilla FTP server recently.

link|improve this answer
Creating an account for each application is not feasible... I will have to login every time and the data would be shattered all over the Users folder. – Tom Wijsman Sep 5 '10 at 14:15
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.