Los permisos de archivo no heredan los permisos de directorio

Question

Tengo un programa que crea un directorio seguro para la salida del usuario. Esto está funcionando correctamente, pero los archivos que creo en él (o que lo copian) terminan solo con acceso de administrador.

DirectoryInfo outputDirectory = 
      baseOutputDirectory.CreateSubdirectory(outputDirectoryName, 
      GetDirectorySecurity(searchHits.Request.UserId)); 

... 

private DirectorySecurity GetDirectorySecurity(string owner) 
{ 
    const string LOG_SOURCE = "GetDirectorySecurity"; 
    DirectorySecurity ds = new DirectorySecurity(); 

    System.Security.Principal.NTAccount ownerAccount = 
     new System.Security.Principal.NTAccount(owner); 

    ds.SetOwner(ownerAccount); 

    ds.AddAccessRule(
     new FileSystemAccessRule(owner, 
     FileSystemRights.FullControl, 
     AccessControlType.Allow)); 

    //AdminUsers is a List<string> that contains a list from configuration 
    // That represents the admins who should be allowed 
    foreach (string adminUser in AdminUsers) 
    { 
     ds.AddAccessRule(
      new FileSystemAccessRule(adminUser, 
      FileSystemRights.FullControl, 
      AccessControlType.Allow)); 
    } 
    return ds; 
} 

/// <summary> 
/// This method copies any static supporting files, such as javascripts 
/// </summary> 
/// <param name="outputDirectory"></param> 
private void CopySupportingFiles(DirectoryInfo outputDirectory) 
{ 
    foreach (FileInfo file in SupportingFiles) 
    { 
     file.CopyTo(
      Path.Combine(outputDirectory.FullName, file.Name)); 
    } 
} 

etc, etc, etc.

¿Qué estoy haciendo mal? ¿Por qué los permisos no están en cascada?

Answer 1

Parece que debe configurar el InheritanceFlags y el PropagationFlags al configurar el DirectorySecurity (creo que sobrescribirá lo que haya configurado manualmente).

private DirectorySecurity GetDirectorySecurity(string owner) 
{ 
    const string LOG_SOURCE = "GetDirectorySecurity"; 
    DirectorySecurity ds = new DirectorySecurity(); 

    System.Security.Principal.NTAccount ownerAccount = 
     new System.Security.Principal.NTAccount(owner); 

    ds.SetOwner(ownerAccount); 

    ds.AddAccessRule(
     new FileSystemAccessRule(owner, 
     FileSystemRights.FullControl, 
     InheritanceFlags.ObjectInherit, 
     PropagationFlags.InheritOnly, 
     AccessControlType.Allow)); 

    //AdminUsers is a List<string> that contains a list from configuration 
    // That represents the admins who should be allowed 
    foreach (string adminUser in AdminUsers) 
    { 
     ds.AddAccessRule(
      new FileSystemAccessRule(adminUser, 
      FileSystemRights.FullControl, 
      InheritanceFlags.ObjectInherit, 
      PropagationFlags.InheritOnly, 
      AccessControlType.Allow)); 
    } 
    return ds; 
}