Question

Examine the following two blocks of code:

System.Security.AccessControl.DirectorySecurity dsec = System.IO.Directory.GetAccessControl(str);
System.Security.Principal.NTAccount group= new System.Security.Principal.NTAccount("DOMAIN","USERGROUP");
System.Security.AccessControl.FileSystemAccessRule myrule = new System.Security.AccessControl.FileSystemAccessRule(group,System.Security.AccessControl.FileSystemRights.FullControl, System.Security.AccessControl.AccessControlType.Allow);
dsec.SetAccessRule(myrule);
System.IO.Directory.SetAccessControl(str,dsec);

and

System.Security.AccessControl.FileSecurity fsec = System.IO.File.GetAccessControl(file);
System.Security.Principal.NTAccount group= new System.Security.Principal.NTAccount("DOMAIN","USERGROUP");
System.Security.AccessControl.FileSystemAccessRule myrule = new System.Security.AccessControl.FileSystemAccessRule(group,System.Security.AccessControl.FileSystemRights.FullControl, System.Security.AccessControl.AccessControlType.Allow);
fsec.SetAccessRule(myrule);
System.IO.File.SetAccessControl(file,fsec);

One would expect them both to do the exact same thing, only one to a directory and one to a file. And, in some ways, they do. In both cases, the filesystem object in question changes such that DOMAIN\USERGROUP has the Effective Permissions of Full Control.

However, the strange part is, when you right click on a file and view security, you see this:

and when you right click on a folder and view security, you see this:

If I then go to Advanced->Effective Permissions->Select(DOMAIN\USERGROUP), it shows that the effective permissions for the folder, for that group, is Full Control (All of the boxes are checked, not just the Full Control Box. That would be even weirder).

My question is, why is there a difference in the effect of an almost identical implementation and does anyone know how to replicate the effect of applying permissions to Files?

Answer 1

The difference is the relevance of propagation flags for directory security.

var accessRule = new FileSystemAccessRule(
    identity: group,
    fileSystemRights: FileSystemRights.FullControl,
    type: AccessControlType.Allow,
    inheritanceFlags: InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit,
    propagationFlags: PropagationFlags.None);

Note the inheritanceFlags setting. If unspecified, the default is none, which gets classified as “special”.