Question

Why do the following access rule show up as “Special permission” when I browse permissions in the explorer property window? I want it to appear as a normal “modify” access.

var di = new DirectoryInfo(ConfigDirectory);
DirectorySecurity security = di.GetAccessControl();
var rule = new FileSystemAccessRule(domainSid, FileSystemRights.Modify, AccessControlType.Allow);
security.AddAccessRule(rule);
di.SetAccessControl(security);

domainSid = SID for domain users.

1. How do I create the rule so it’s inherited by all files that are created in that folder?

Answer 1

Use this instead:

var di = new DirectoryInfo(ConfigDirectory);
DirectorySecurity security = di.GetAccessControl();
var rule = new FileSystemAccessRule(domainSid, FileSystemRights.Modify, InheritanceFlags.ObjectInherit | InheritanceFlags.ContainerInherit, PropagationFlags.None, AccessControlType.Allow);
security.AddAccessRule(rule);
security.SetAccessRule(rule);
di.SetAccessControl(security);

The difference is using a FileSystemAccessRule Constructor that allows you to specifiy inheritance and the call to security.SetAccessRule(rule);