I want to set folder
with permissions such that restricted users could access file.txt
(in folder
) they have permissions to read by specifying full path but could not list the content of folder
.
For example, in Linux, we could do it like this:
$ whoami
cychoi
$ mkdir folder && echo 'file content' > folder/file.txt
$ chmod 111 folder/
$ sudo ls -la folder/
total 12
d--x--x--x 2 cychoi cychoi 4096 Aug 18 21:52 .
drwx------ 3 cychoi cychoi 4096 Aug 18 21:52 ..
-rw------- 1 cychoi cychoi 13 Aug 18 21:52 file.txt
$ ls folder/
ls: cannot open directory folder/: Permission denied
$ cat folder/file.txt
file content
$
In Windows 7, I clear all permissions of folder
except execute/traverse
(Apply to "this folder only"). However, It fails to read the content of file.txt
even full path is specified.
On the other hand, if read data/list directory
is also set for folder
, file.txt
will be read successfully but folder
content will be leaked to restricted users.
G:\ptest>whoami user-pc\test G:\ptest>runas /u:administrator "cmd /c icacls g:\ptest\folder\ /t & pause" Enter the password for administrator: Attempting to start cmd /c icacls g:\ptest\folder\ /t & pause as user "USER-PC\administrator" ... g:\ptest\folder\ user-PC\test:(S,X) BUILTIN\Administrators:(OI)(CI)(F) NT AUTHORITY\SYSTEM:(OI)(CI)(F) user-PC\cychoi:(OI)(CI)(F) g:\ptest\folder\file.txt user-PC\test:(F) BUILTIN\Administrators:(I)(F) NT AUTHORITY\SYSTEM:(I)(F) user-PC\cychoi:(I)(F) G:\ptest>dir Volume in drive G is ????? Volume Serial Number is DEAD-BEEF Directory of G:\ptest 18/08/2015 21:59 . 18/08/2015 21:59 .. 18/08/2015 21:59 folder 0 File(s) 0 bytes 3 Dir(s) 4,779,642,880 bytes free G:\ptest>dir folder Volume in drive G is ????? Volume Serial Number is DEAD-BEEF Directory of G:\ptest\folder File Not Found G:\ptest>type folder\file.txt Access is denied. G:\ptest>runas /u:administrator "cmd /c icacls g:\ptest\folder\ /grant test:(rd) & pause" Enter the password for administrator: Attempting to start cmd /c icacls g:\ptest\folder\ /grant test:(rd) & pause as user "USER-PC\administrator" ... G:\ptest>runas /u:administrator "cmd /c icacls g:\ptest\folder\ & pause" Enter the password for administrator: Attempting to start cmd /c icacls g:\ptest\folder\ & pause as user "USER-PC\administrator" ... g:\ptest\folder\ user-PC\test:(S,RD,X) BUILTIN\Administrators:(OI)(CI)(F) NT AUTHORITY\SYSTEM:(OI)(CI)(F) user-PC\cychoi:(OI)(CI)(F) G:\ptest>dir folder Volume in drive G is ????? Volume Serial Number is DEAD-BEEF Directory of G:\ptest\folder 18/08/2015 21:59 . 18/08/2015 21:59 .. 18/08/2015 21:59 12 file.txt 1 File(s) 12 bytes 2 Dir(s) 4,779,642,880 bytes free G:\ptest>type folder\file.txt file content G:\ptest>
So, how can I achieve the same behaviour as in the Linux example I shown above?
/grant test:(OI)(IO)R
access is denied
when trying to readfile.txt
.folder user-PC\test:(OI)(IO)(R) user-PC\test:(S,X)
folder\file.txt user-PC\test:(I)(R)
access is denied
when you usetype folder\file.txt
? Try something else, likenotepad folder\file.txt
. As I check with Process Monitor,type
getACCESS DENIED
on folder and does not even try to open file.(X)
permission on directories is there just for show (and for older & non-Windows systems). So your problem isn't in the permissions. As PetSerAl noticed, it's cmd.exe doing what it shouldn't, then blaming the wrong thing.