0

Is it possible to set the permissions on a file so that a user won't be able to copy the file (no read permissions), but an aplication running under that user could read that file ?

I think not, but I am not 100% sure - for the application to be able to read it the user it is running it would have to have read permissions?

Maybe such a thing can be set with windows policies?

1
  • "Is it possible to set the permissions on a file so that a user won't be able to copy the file (no read permissions), but an application running under that user could read that file ?" - No
    – Ramhound
    Jan 16, 2017 at 9:56

3 Answers 3

1

As the application would be running with user permissions it wouldn't be able to read the file if the user was not able to read the file.

You could try to setup a process that impersonates another user on behalf of the user running the application which could have different permissions. It's going to be quite a a bit of work and depending on how you implement this you would give a user that permission anyway as he would just lookup the credentials used for the impersonation.

Another approach would be to check that a user is not able to list the contents of the directory containing the file. It would still be possible to open the file as the user would still have read permissions on it. This approach would just obscure the access and not prevent it!

0

It depend on tech level of your user. If he/she well educated then the answer is - No, but you can use various obscurity tricks that "prevent" user to see actual file's content while it could be accessed from your program. The easiest method (IMHO) of obfuscation is to use alternative data streams (ADS) somewhere in %AppData%

Could you clarify, what are you trying to achieve ? May be there is a better solution we might suggest to you

0

If the user runs the application without administrative permissions, the application won't be able to access the file.

If the user runs the application as administrator, the program can access the file, the user cannot. Do note that an application that runs as administrator has far more rights and that might not be practical.

A better approach would be to hide the file or store it differently, depending on what the application does and how much control you have over how it accesses files.

For example, you could store the data itself inside a database that is located on the network or have a server-client communication where the server transmits the file to the client, the client displays it and removes the copy upon completion. In essence this could be as simple as a webserver. Keep in mind that if a user opens a file, they can store it and then they do have access. Showing the file embedded inside the webpage could prevent that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .