How to check if the option "enable inherited permissions" is enabled for a file or folder?

Question

I am writing a small utility in C # to make sure that the specified folder and all its contents have the appropriate permissions (I want to provide full access to the Authenticated Users group). The following code seems to work correctly to update the top-level ACL (Access Control List):

 SecurityIdentifier allUsers = new SecurityIdentifier(WellKnownSidType.AuthenticatedUserSid, null); InheritanceFlags iFlags = InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit; FileSystemAccessRule newRule = new FileSystemAccessRule(allUsers, FileSystemRights.FullControl, iFlags, PropagationFlags.None, AccessControlType.Allow); DirectoryInfo info = new DirectoryInfo(folderPath); DirectorySecurity security = info.GetAccessControl(); security.AddAccessRule(newRule); info.SetAccessControl(security); 

I noticed, however, that this new access rule does not apply to subfolders for which the option "Enable inherited permissions ..." is not checked in their security properties. It makes sense. So what I want to do is re-enable inheritance of security permissions for any such subfolders.

My digging discovered the ObjectSecurity.SetAccessRuleProtection method, which should be half what I need. However, it seems negligent to simply blindly use the above method for objects that already inherit their parent DACL. Thus, I want to determine which objects inherit their inheritance, but I cannot find the corresponding method or property that returns this information. Is there any? Did I miss something?

Answer 1

I remember something like this:

 DirectoryInfo d = new DirectoryInfo(@"e:\test1"); DirectorySecurity acl = d.GetAccessControl(); if (acl.GetAccessRules(false, true, typeof(System.Security.Principal.SecurityIdentifier)).Count >0) // -- has inherited permissions else // -- has no inherited permissions 

I also tried to find a way to test this, but I could not find it (even in C ++). So I ended up using the code above. It worked like a charm.

Answer 2

There seems to be a way you can control:

 DirectorySecurity ds = System.IO.Directory.GetAccessControl(@"C:\test"); byte[] rawBytes = ds.GetSecurityDescriptorBinaryForm(); RawSecurityDescriptor rsd = new RawSecurityDescriptor(rawBytes, 0); if ((rsd.ControlFlags & ControlFlags.DiscretionaryAclProtected) == ControlFlags.DiscretionaryAclProtected) { // "Include inheritable permissions from this object parent" is unchecked } else { // "Include inheritable permissons from this object parent" is checked }