How do you check for permissions to write to a directory or file

Question

I got a program that writes some data to a file using a method like the one below.


public void ExportToFile(string filename)
{
     using(FileStream fstream = new FileStream(filename,FileMode.Create))
     using (TextWriter writer = new StreamWriter(fstream))
     {
         // try catch block for write permissions 
         writer.WriteLine(text);


     }
}

When running the program I get an error:

Unhandled Exception: System.UnauthorizedAccessException: Access to the path 'mypath' is denied. at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, nt32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions ptions, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolea bFromProxy)

Question: What code do I need to catch this and how do I grant the access?

User · Accepted Answer

UPDATE   Modified the code based on this answer to get rid of obsolete methods   You can use the Security namespace to check this   public void ExportToFile string filename        var permissionSet   new PermissionSet PermissionState None           var writePermission   new FileIOPermission FileIOPermissionAccess Write  filename       permissionSet AddPermission writePermission        if  permissionSet IsSubsetOf AppDomain CurrentDomain PermissionSet                 using  FileStream fstream   new FileStream filename  FileMode Create           using  TextWriter writer   new StreamWriter fstream                            try catch block for write permissions              writer WriteLine  sometext                          else                 perform some recovery action here            As far as getting those permission  you are going to have to ask the user to do that for you somehow  If you could programatically do this  then we would all be in trouble

User · Answer

Its a fixed version of MaxOvrdrv s Code   public static bool IsReadable this DirectoryInfo di        AuthorizationRuleCollection rules      WindowsIdentity identity      try               rules   di GetAccessControl   GetAccessRules true  true  typeof SecurityIdentifier            identity   WindowsIdentity GetCurrent              catch  UnauthorizedAccessException uae                Debug WriteLine uae ToString             return false             bool isAllow   false      string userSID   identity User Value       foreach  FileSystemAccessRule rule in rules                if  rule IdentityReference ToString      userSID    identity Groups Contains rule IdentityReference                         if   rule FileSystemRights HasFlag FileSystemRights Read                     rule FileSystemRights HasFlag FileSystemRights ReadAttributes                     rule FileSystemRights HasFlag FileSystemRights ReadData    amp  amp  rule AccessControlType    AccessControlType Deny                  return false              else if   rule FileSystemRights HasFlag FileSystemRights Read   amp  amp                  rule FileSystemRights HasFlag FileSystemRights ReadAttributes   amp  amp                  rule FileSystemRights HasFlag FileSystemRights ReadData    amp  amp  rule AccessControlType    AccessControlType Allow                  isAllow   true                       return isAllow     public static bool IsWriteable this DirectoryInfo me        AuthorizationRuleCollection rules      WindowsIdentity identity      try               rules   me GetAccessControl   GetAccessRules true  true  typeof System Security Principal SecurityIdentifier            identity   WindowsIdentity GetCurrent              catch  UnauthorizedAccessException uae                Debug WriteLine uae ToString             return false             bool isAllow   false      string userSID   identity User Value       foreach  FileSystemAccessRule rule in rules                if  rule IdentityReference ToString      userSID    identity Groups Contains rule IdentityReference                         if   rule FileSystemRights HasFlag FileSystemRights Write                     rule FileSystemRights HasFlag FileSystemRights WriteAttributes                     rule FileSystemRights HasFlag FileSystemRights WriteData                     rule FileSystemRights HasFlag FileSystemRights CreateDirectories                     rule FileSystemRights HasFlag FileSystemRights CreateFiles    amp  amp  rule AccessControlType    AccessControlType Deny                  return false              else if   rule FileSystemRights HasFlag FileSystemRights Write   amp  amp                  rule FileSystemRights HasFlag FileSystemRights WriteAttributes   amp  amp                  rule FileSystemRights HasFlag FileSystemRights WriteData   amp  amp                  rule FileSystemRights HasFlag FileSystemRights CreateDirectories   amp  amp                  rule FileSystemRights HasFlag FileSystemRights CreateFiles    amp  amp  rule AccessControlType    AccessControlType Allow                  isAllow   true                       return isAllow

User · Answer

When your code does the following    Checks the current user has permission to do something  Carries out the action that needs the entitlements checked in 1    You run the risk that the permissions change between 1 and 2 because you can t predict what else will be happening on the system at runtime  Therefore  your code should handle the situation where an UnauthorisedAccessException is thrown even if you have previously checked permissions    Note that the SecurityManager class is used to check CAS permissions and doesn t actually check with the OS whether the current user has write access to the specified location  through ACLs and ACEs   As such  IsGranted will always return true for locally running applications   Example  derived from Josh s example      1  Provide early notification that the user does not have permission to write  FileIOPermission writePermission   new FileIOPermission FileIOPermissionAccess Write  filename   if  SecurityManager IsGranted writePermission           No permission         Either throw an exception so this can be handled by a calling function       or inform the user that they do not have permission to write to the folder and return       2  Attempt the action but handle permission changes  try       using  FileStream fstream   new FileStream filename  FileMode Create       using  TextWriter writer   new StreamWriter fstream                 writer WriteLine  sometext            catch  UnauthorizedAccessException ex          No permission         Either throw an exception so this can be handled by a calling function       or inform the user that they do not have permission to write to the folder and return      It s tricky and not recommended to try to programatically calculate the effective permissions from the folder based on the raw ACLs  which are all that are available through the System Security AccessControl classes   Other answers on Stack Overflow and the wider web recommend trying to carry out the action to know whether permission is allowed  This post sums up what s required to implement the permission calculation and should be enough to put you off from doing this

User · Answer

None of these worked for me   they return as true  even when they aren t  The problem is  you have to test the available permission against the current process user rights  this tests for file creation rights  just change the FileSystemRights clause to  Write  to test write access         lt summary gt      Test a directory for create file access permissions      lt  summary gt       lt param name  DirectoryPath  gt Full directory path lt  param gt       lt returns gt State  bool  lt  returns gt  public static bool DirectoryCanCreate string DirectoryPath        if  string IsNullOrEmpty DirectoryPath   return false       try               AuthorizationRuleCollection rules   Directory GetAccessControl DirectoryPath  GetAccessRules true  true  typeof System Security Principal SecurityIdentifier            WindowsIdentity identity   WindowsIdentity GetCurrent             foreach  FileSystemAccessRule rule in rules                        if  identity Groups Contains rule IdentityReference                                 if   FileSystemRights CreateFiles  amp  rule FileSystemRights     FileSystemRights CreateFiles                                        if  rule AccessControlType    AccessControlType Allow                          return true                                                      catch        return false

User · Answer

Since this isn t closed  i would like to submit a new entry for anyone looking to have something working properly for them    using an amalgamation of what i found here  as well as using DirectoryServices to debug the code itself and find the proper code to use  here s what i found that works for me in every situation    note that my solution extends DirectoryInfo object           public static bool IsReadable this DirectoryInfo me                 AuthorizationRuleCollection rules          WindowsIdentity identity          try                       rules   me GetAccessControl   GetAccessRules true  true  typeof System Security Principal SecurityIdentifier                identity   WindowsIdentity GetCurrent                      catch  Exception ex              Posible UnauthorizedAccessException             return false                     bool isAllow false          string userSID   identity User Value           foreach  FileSystemAccessRule rule in rules                        if  rule IdentityReference ToString      userSID    identity Groups Contains rule IdentityReference                                 if   rule FileSystemRights HasFlag FileSystemRights Read                         rule FileSystemRights HasFlag FileSystemRights ReadAndExecute                         rule FileSystemRights HasFlag FileSystemRights ReadAttributes                         rule FileSystemRights HasFlag FileSystemRights ReadData                         rule FileSystemRights HasFlag FileSystemRights ReadExtendedAttributes                         rule FileSystemRights HasFlag FileSystemRights ReadPermissions    amp  amp  rule AccessControlType    AccessControlType Deny                      return false                  else if   rule FileSystemRights HasFlag FileSystemRights Read                         rule FileSystemRights HasFlag FileSystemRights ReadAndExecute                         rule FileSystemRights HasFlag FileSystemRights ReadAttributes                         rule FileSystemRights HasFlag FileSystemRights ReadData                         rule FileSystemRights HasFlag FileSystemRights ReadExtendedAttributes                         rule FileSystemRights HasFlag FileSystemRights ReadPermissions    amp  amp  rule AccessControlType    AccessControlType Allow                      isAllow   true                                   return isAllow             public static bool IsWriteable this DirectoryInfo me                AuthorizationRuleCollection rules          WindowsIdentity identity          try                       rules   me GetAccessControl   GetAccessRules true  true  typeof System Security Principal SecurityIdentifier                identity   WindowsIdentity GetCurrent                      catch  Exception ex              Posible UnauthorizedAccessException             return false                     bool isAllow   false          string userSID   identity User Value           foreach  FileSystemAccessRule rule in rules                        if  rule IdentityReference ToString      userSID    identity Groups Contains rule IdentityReference                                 if   rule FileSystemRights HasFlag FileSystemRights Write                         rule FileSystemRights HasFlag FileSystemRights WriteAttributes                         rule FileSystemRights HasFlag FileSystemRights WriteData                         rule FileSystemRights HasFlag FileSystemRights WriteExtendedAttributes                         rule FileSystemRights HasFlag FileSystemRights CreateDirectories                         rule FileSystemRights HasFlag FileSystemRights CreateFiles    amp  amp  rule AccessControlType    AccessControlType Deny                      return false                  else if   rule FileSystemRights HasFlag FileSystemRights Write                         rule FileSystemRights HasFlag FileSystemRights WriteAttributes                         rule FileSystemRights HasFlag FileSystemRights WriteData                         rule FileSystemRights HasFlag FileSystemRights WriteExtendedAttributes                         rule FileSystemRights HasFlag FileSystemRights CreateDirectories                         rule FileSystemRights HasFlag FileSystemRights CreateFiles    amp  amp  rule AccessControlType    AccessControlType Allow                      isAllow   true                                   return me IsReadable    amp  amp  isAllow

User · Answer

Sorry  but none of the previous solutions helped me  I need to check both sides  SecurityManager and SO permissions  I have learned a lot with Josh code and with iain answer  but I m afraid I need to use Rakesh code  also thanks to him   Only one bug  I found that he only checks for Allow and not for Deny permissions  So my proposal is           string folder          AuthorizationRuleCollection rules          try               rules   Directory GetAccessControl folder                   GetAccessRules true  true  typeof System Security Principal NTAccount              catch Exception ex      Posible UnauthorizedAccessException             throw new Exception  No permission   ex                      var rulesCast   rules Cast lt FileSystemAccessRule gt             if rulesCast Any rule   gt  rule AccessControlType    AccessControlType Deny                  rulesCast Any rule   gt  rule AccessControlType    AccessControlType Allow               throw new Exception  No permission               Here I have permission  ole

User · Answer

When your code does the following    Checks the current user has permission to do something  Carries out the action that needs the entitlements checked in 1    You run the risk that the permissions change between 1 and 2 because you can t predict what else will be happening on the system at runtime  Therefore  your code should handle the situation where an UnauthorisedAccessException is thrown even if you have previously checked permissions    Note that the SecurityManager class is used to check CAS permissions and doesn t actually check with the OS whether the current user has write access to the specified location  through ACLs and ACEs   As such  IsGranted will always return true for locally running applications   Example  derived from Josh s example      1  Provide early notification that the user does not have permission to write  FileIOPermission writePermission   new FileIOPermission FileIOPermissionAccess Write  filename   if  SecurityManager IsGranted writePermission           No permission         Either throw an exception so this can be handled by a calling function       or inform the user that they do not have permission to write to the folder and return       2  Attempt the action but handle permission changes  try       using  FileStream fstream   new FileStream filename  FileMode Create       using  TextWriter writer   new StreamWriter fstream                 writer WriteLine  sometext            catch  UnauthorizedAccessException ex          No permission         Either throw an exception so this can be handled by a calling function       or inform the user that they do not have permission to write to the folder and return      It s tricky and not recommended to try to programatically calculate the effective permissions from the folder based on the raw ACLs  which are all that are available through the System Security AccessControl classes   Other answers on Stack Overflow and the wider web recommend trying to carry out the action to know whether permission is allowed  This post sums up what s required to implement the permission calculation and should be enough to put you off from doing this

User · Answer

You can try following code block to check if the directory is having Write Access.

It checks the FileSystemAccessRule.

           string directoryPath = "C:\\XYZ"; //folderBrowserDialog.SelectedPath;
           bool isWriteAccess = false;
           try
           {
              AuthorizationRuleCollection collection = Directory.GetAccessControl(directoryPath).GetAccessRules(true, true, typeof(System.Security.Principal.NTAccount));
              foreach (FileSystemAccessRule rule in collection)
              {
                 if (rule.AccessControlType == AccessControlType.Allow)
                 {
                    isWriteAccess = true;
                    break;
                 }
              }
           }
           catch (UnauthorizedAccessException ex)
           {
              isWriteAccess = false;
           }
           catch (Exception ex)
           {
              isWriteAccess = false;
           }
           if (!isWriteAccess)
           {
             //handle notifications                 
           }

User · Answer

Wow   there is a lot of low-level security code in this thread -- most of which did not work for me  either -- although I learned a lot in the process  One thing that I learned is that most of this code is not geared to applications seeking per user access rights -- it is for Administrators wanting to alter rights programmatically  which -- as has been pointed out -- is not a good thing  As a developer  I cannot use the  easy way out  -- by running as Administrator -- which -- I am not one on the machine that runs the code  nor are my users -- so  as clever as these solutions are -- they are not for my situation  and probably not for most rank and file developers  either   Like most posters of this type of question -- I initially felt it was  hackey   too -- I have since decided that it is perfectly alright to try it and let the possible exception tell you exactly what the user s rights are -- because the information I got did not tell me what the rights actually were  The code below -- did     Private Function CheckUserAccessLevel folder As String  As Boolean Try   Dim newDir As String   String Format   0  1  2                                           folder                                         If folder EndsWith                                                                                                                                             LookWhatICanDo     Dim lookWhatICanDo   Directory CreateDirectory newDir     Directory Delete newDir    Return True  Catch ex As Exception   Return False End Try   End Function

[c#] How do you check for permissions to write to a directory or file?

The answer is

Examples related to c#

Examples related to .net

Tags