1

I want to set folder with permissions such that restricted users could access file.txt (in folder) they have permissions to read by specifying full path but could not list the content of folder.

For example, in Linux, we could do it like this:

$ whoami
cychoi
$ mkdir folder && echo 'file content' > folder/file.txt
$ chmod 111 folder/
$ sudo ls -la folder/
total 12
d--x--x--x 2 cychoi cychoi 4096 Aug 18 21:52 .
drwx------ 3 cychoi cychoi 4096 Aug 18 21:52 ..
-rw------- 1 cychoi cychoi   13 Aug 18 21:52 file.txt
$ ls folder/
ls: cannot open directory folder/: Permission denied
$ cat folder/file.txt
file content
$

In Windows 7, I clear all permissions of folder except execute/traverse (Apply to "this folder only"). However, It fails to read the content of file.txt even full path is specified.

On the other hand, if read data/list directory is also set for folder, file.txt will be read successfully but folder content will be leaked to restricted users.

G:\ptest>whoami
user-pc\test

G:\ptest>runas /u:administrator "cmd /c icacls g:\ptest\folder\ /t & pause"
Enter the password for administrator:
Attempting to start cmd /c icacls g:\ptest\folder\ /t & pause as user "USER-PC\administrator" ...

g:\ptest\folder\ user-PC\test:(S,X)
                 BUILTIN\Administrators:(OI)(CI)(F)
                 NT AUTHORITY\SYSTEM:(OI)(CI)(F)
                 user-PC\cychoi:(OI)(CI)(F)

g:\ptest\folder\file.txt user-PC\test:(F)
                         BUILTIN\Administrators:(I)(F)
                         NT AUTHORITY\SYSTEM:(I)(F)
                         user-PC\cychoi:(I)(F)

G:\ptest>dir
 Volume in drive G is ?????
 Volume Serial Number is DEAD-BEEF

 Directory of G:\ptest

18/08/2015  21:59              .
18/08/2015  21:59              ..
18/08/2015  21:59              folder
               0 File(s)              0 bytes
               3 Dir(s)   4,779,642,880 bytes free

G:\ptest>dir folder
 Volume in drive G is ?????
 Volume Serial Number is DEAD-BEEF

 Directory of G:\ptest\folder

File Not Found

G:\ptest>type folder\file.txt
Access is denied.

G:\ptest>runas /u:administrator "cmd /c icacls g:\ptest\folder\ /grant test:(rd) & pause"
Enter the password for administrator:
Attempting to start cmd /c icacls g:\ptest\folder\ /grant test:(rd) & pause as user "USER-PC\administrator" ...

G:\ptest>runas /u:administrator "cmd /c icacls g:\ptest\folder\ & pause"
Enter the password for administrator:
Attempting to start cmd /c icacls g:\ptest\folder\ & pause as user "USER-PC\administrator" ...


g:\ptest\folder\ user-PC\test:(S,RD,X)
                 BUILTIN\Administrators:(OI)(CI)(F)
                 NT AUTHORITY\SYSTEM:(OI)(CI)(F)
                 user-PC\cychoi:(OI)(CI)(F)

G:\ptest>dir folder
 Volume in drive G is ?????
 Volume Serial Number is DEAD-BEEF

 Directory of G:\ptest\folder

18/08/2015  21:59              .
18/08/2015  21:59              ..
18/08/2015  21:59                12 file.txt
               1 File(s)             12 bytes
               2 Dir(s)   4,779,642,880 bytes free

G:\ptest>type folder\file.txt
file content
G:\ptest>

So, how can I achieve the same behaviour as in the Linux example I shown above?

5
  • 1
    /grant test:(OI)(IO)R
    – user364455
    Aug 18, 2015 at 16:12
  • @PetSerAl Thanks. Tried but I still get access is denied when trying to read file.txt.
    – cychoi
    Aug 18, 2015 at 16:38
  • FYI, folder user-PC\test:(OI)(IO)(R) user-PC\test:(S,X) folder\file.txt user-PC\test:(I)(R)
    – cychoi
    Aug 18, 2015 at 16:39
  • 2
    You get access is denied when you use type folder\file.txt? Try something else, like notepad folder\file.txt. As I check with Process Monitor, type get ACCESS DENIED on folder and does not even try to open file.
    – user364455
    Aug 18, 2015 at 17:39
  • 1
    All Windows versions since NT 4.ish actually let users bypass all traverse checking. So the (X) permission on directories is there just for show (and for older & non-Windows systems). So your problem isn't in the permissions. As PetSerAl noticed, it's cmd.exe doing what it shouldn't, then blaming the wrong thing. Aug 19, 2015 at 5:28

0

You must log in to answer this question.

Browse other questions tagged .