C# - 如何仅向当前用户授予访问权限并限制对其他用户的访问权限

Question

我想要一个应用程序来创建一个文件夹并限制当前用户和管理员以外的用户访问它。由于下面的代码，当前用户也失去了访问权限并且无法删除该文件夹。

string rootPath = Environment.GetEnvironmentVariable("TEMP");
var rootDirectory = new DirectoryInfo(rootPath);
DirectoryInfo subFolder = rootDirectory.CreateSubdirectory("SubFolder");
var directorySecurity = subFolder.GetAccessControl();

var adminitrators = new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null);
directorySecurity.AddAccessRule(
    new FileSystemAccessRule(
        adminitrators,
        FileSystemRights.FullControl,
        InheritanceFlags.None,
        PropagationFlags.NoPropagateInherit,
        AccessControlType.Allow));

directorySecurity.AddAccessRule(
    new FileSystemAccessRule(
        WindowsIdentity.GetCurrent().Name,
        FileSystemRights.FullControl,
        InheritanceFlags.None,
        PropagationFlags.NoPropagateInherit, 
        AccessControlType.Allow));

var everyone = new SecurityIdentifier(WellKnownSidType.WorldSid, null);
directorySecurity.AddAccessRule(
    new FileSystemAccessRule(
        everyone,
        FileSystemRights.FullControl,
        InheritanceFlags.None,
        PropagationFlags.NoPropagateInherit,
        AccessControlType.Deny));

subFolder.SetAccessControl(directorySecurity);

subFolder.Delete(true); // <-- System.UnauthorizedAccessException

Answer 1

好的，所以完整的解决方案如下:

1. 正如@zerkms 所提议的，我们需要删除“Deny for all”。这解决了当前用户尝试删除文件夹时抛出的 System.UnauthorizedAccessException。

2. 如说明here使用 SetAccessRuleProtection 确保权限不会从父文件夹继承。

       string rootPath = Environment.GetEnvironmentVariable("TEMP");
       var rootDirectory = new DirectoryInfo(rootPath);
   
       DirectoryInfo subFolder = rootDirectory.CreateSubdirectory("SubFolder");
       var directorySecurity = subFolder.GetAccessControl();
   
       var adminitrators = new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null);
       directorySecurity.AddAccessRule(
           new FileSystemAccessRule(
                   adminitrators,
                   FileSystemRights.FullControl,
                   InheritanceFlags.None,
                   PropagationFlags.NoPropagateInherit,
                   AccessControlType.Allow));
   
       directorySecurity.AddAccessRule(
           new FileSystemAccessRule(
                   WindowsIdentity.GetCurrent().Name,
                   FileSystemRights.FullControl,
                   InheritanceFlags.None,
                   PropagationFlags.NoPropagateInherit, 
                   AccessControlType.Allow));
   
       directorySecurity.SetAccessRuleProtection(isProtected: true, preserveInheritance: false);
   
       subFolder.SetAccessControl(directorySecurity);